Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 20 Mar 2018 11:24:53 +0100
From:      Hans Petter Selasky <>
To:        Vincenzo Di Salvo <>
Subject:   Re: R: R: usb's quirks ... how to sniff bios'es messages addressed to usb rom chip
Message-ID:  <>
References:  <!&!AAAAAAAAAAAYAAAAAAAAANB1sR69XHJMoG+MU1AT/> <> <000401d3bfbe$c7f99370$57ecba50$@it> <> <!&!AAAAAAAAAAAYAAAAAAAAANB1sR69XHJMoG+MU1AT/>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On 03/20/18 10:07, Vincenzo Di Salvo wrote:
> Hi,
> probably what you are saying is so important that solves my doubt about  a my misunderstanding about USB protocol and my idea to use the usbdump is totally wrong and no more usefull.
> Foundamentally my goal is only understand if, pluging a usb device, a direct writing operation can or not occur from the processor into the usb device.


You need to distinguish between daemons and the operating system, OS. 
When you plug a USB disk device, typically what happens is that the OS 
will read from the disk to figure out partition tables and disk slices. 
This part is read-only. Later on the OS will tell this information to 
user-space, for example hald, and then depending on what software you 
have installed, the disk will be automatically mounted, which might 
involve a few write requests. mount(8) has a -r option to avoid any 
writes to the disk. Usually this is not set for desktop environments.

> So, please, let me ask another question to exclude all my misunderstanding.
> You wrote:
> “A processor runs on the USB device replying to this protocol. There is no direct hardware access. You need to ask the manufacturer which USB request returns the counter you are asking for”.
> 1- If "there is no direct hardware access", this means that the processor can only do read-only accesses to the USB device. Is it correct ? yes/no:

The USB storage protocol has separate read and write commands. The PC 
sends either a read command or a write command to the USB device and a 
small CPU interprets this command and replies back the the PC. This 
small CPU then makes a new request for the actual disk drive.

> 2- Speaking of “which USB request returns the counter” do you mean that the counter increment occurs "internally" following a request of the processor, excluding a direct writing operation of the processor into the usb device ?. Is it correct ? yes/no:

USB itself doesn't have any counters for disk access. There is only one 
running counter, but it doesn't distinguish between read and write 
requests. Any request increments the counter by one.

The OS might however keep statistics on how many read/write requests 
have been performed. In FreeBSD these statistics is usually available 
through the "sysctl -a" tree.

> If so, your reply solves my limited knowledges of the usb protocol.

Further, it is common that when you read files, the access time is 
updated in the file tables. This cause write requests. Look for the 
description of the "noatime" option in the mount manual page.


Want to link to this message? Use this URL: <>