hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu-option.h"
  12 #include "qemu-config.h"
  13 #include "usb.h"
  14 #include "block.h"
  15 #include "scsi.h"
  16 #include "console.h"
  17 #include "monitor.h"
  18
  19 //#define DEBUG_MSD
  20
  21 #ifdef DEBUG_MSD
  22 #define DPRINTF(fmt, ...) \
  23 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  24 #else
  25 #define DPRINTF(fmt, ...) do {} while(0)
  26 #endif
  27
  28 /* USB requests.  */
  29 #define MassStorageReset  0xff
  30 #define GetMaxLun         0xfe
  31
  32 enum USBMSDMode {
  33     USB_MSDM_CBW, /* Command Block.  */
  34     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  35     USB_MSDM_DATAIN, /* Transfer data from device.  */
  36     USB_MSDM_CSW /* Command Status.  */
  37 };
  38
  39 typedef struct {
  40     USBDevice dev;
  41     enum USBMSDMode mode;
  42     uint32_t scsi_len;
  43     uint8_t *scsi_buf;
  44     uint32_t usb_len;
  45     uint8_t *usb_buf;
  46     uint32_t data_len;
  47     uint32_t residue;
  48     uint32_t tag;
  49     SCSIBus bus;
  50     BlockConf conf;
  51     SCSIDevice *scsi_dev;
  52     int result;
  53     /* For async completion.  */
  54     USBPacket *packet;
  55 } MSDState;
  56
  57 struct usb_msd_cbw {
  58     uint32_t sig;
  59     uint32_t tag;
  60     uint32_t data_len;
  61     uint8_t flags;
  62     uint8_t lun;
  63     uint8_t cmd_len;
  64     uint8_t cmd[16];
  65 };
  66
  67 struct usb_msd_csw {
  68     uint32_t sig;
  69     uint32_t tag;
  70     uint32_t residue;
  71     uint8_t status;
  72 };
  73
  74 static const uint8_t qemu_msd_dev_descriptor[] = {
  75         0x12,       /*  u8 bLength; */
  76         0x01,       /*  u8 bDescriptorType; Device */
  77         0x00, 0x01, /*  u16 bcdUSB; v1.0 */
  78
  79         0x00,       /*  u8  bDeviceClass; */
  80         0x00,       /*  u8  bDeviceSubClass; */
  81         0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
  82         0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
  83
  84         /* Vendor and product id are arbitrary.  */
  85         0x00, 0x00, /*  u16 idVendor; */
  86         0x00, 0x00, /*  u16 idProduct; */
  87         0x00, 0x00, /*  u16 bcdDevice */
  88
  89         0x01,       /*  u8  iManufacturer; */
  90         0x02,       /*  u8  iProduct; */
  91         0x03,       /*  u8  iSerialNumber; */
  92         0x01        /*  u8  bNumConfigurations; */
  93 };
  94
  95 static const uint8_t qemu_msd_config_descriptor[] = {
  96
  97         /* one configuration */
  98         0x09,       /*  u8  bLength; */
  99         0x02,       /*  u8  bDescriptorType; Configuration */
 100         0x20, 0x00, /*  u16 wTotalLength; */
 101         0x01,       /*  u8  bNumInterfaces; (1) */
 102         0x01,       /*  u8  bConfigurationValue; */
 103         0x00,       /*  u8  iConfiguration; */
 104         0xc0,       /*  u8  bmAttributes;
 105                                  Bit 7: must be set,
 106                                      6: Self-powered,
 107                                      5: Remote wakeup,
 108                                      4..0: resvd */
 109         0x00,       /*  u8  MaxPower; */
 110
 111         /* one interface */
 112         0x09,       /*  u8  if_bLength; */
 113         0x04,       /*  u8  if_bDescriptorType; Interface */
 114         0x00,       /*  u8  if_bInterfaceNumber; */
 115         0x00,       /*  u8  if_bAlternateSetting; */
 116         0x02,       /*  u8  if_bNumEndpoints; */
 117         0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
 118         0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
 119         0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
 120         0x00,       /*  u8  if_iInterface; */
 121
 122         /* Bulk-In endpoint */
 123         0x07,       /*  u8  ep_bLength; */
 124         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 125         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 126         0x02,       /*  u8  ep_bmAttributes; Bulk */
 127         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 128         0x00,       /*  u8  ep_bInterval; */
 129
 130         /* Bulk-Out endpoint */
 131         0x07,       /*  u8  ep_bLength; */
 132         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 133         0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 134         0x02,       /*  u8  ep_bmAttributes; Bulk */
 135         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 136         0x00        /*  u8  ep_bInterval; */
 137 };
 138
 139 static void usb_msd_copy_data(MSDState *s)
 140 {
 141     uint32_t len;
 142     len = s->usb_len;
 143     if (len > s->scsi_len)
 144         len = s->scsi_len;
 145     if (s->mode == USB_MSDM_DATAIN) {
 146         memcpy(s->usb_buf, s->scsi_buf, len);
 147     } else {
 148         memcpy(s->scsi_buf, s->usb_buf, len);
 149     }
 150     s->usb_len -= len;
 151     s->scsi_len -= len;
 152     s->usb_buf += len;
 153     s->scsi_buf += len;
 154     s->data_len -= len;
 155     if (s->scsi_len == 0) {
 156         if (s->mode == USB_MSDM_DATAIN) {
 157             s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 158         } else if (s->mode == USB_MSDM_DATAOUT) {
 159             s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 160         }
 161     }
 162 }
 163
 164 static void usb_msd_send_status(MSDState *s)
 165 {
 166     struct usb_msd_csw csw;
 167
 168     csw.sig = cpu_to_le32(0x53425355);
 169     csw.tag = cpu_to_le32(s->tag);
 170     csw.residue = s->residue;
 171     csw.status = s->result;
 172     memcpy(s->usb_buf, &csw, 13);
 173 }
 174
 175 static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 176                                      uint32_t arg)
 177 {
 178     MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
 179     USBPacket *p = s->packet;
 180
 181     if (tag != s->tag) {
 182         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
 183     }
 184     if (reason == SCSI_REASON_DONE) {
 185         DPRINTF("Command complete %d\n", arg);
 186         s->residue = s->data_len;
 187         s->result = arg != 0;
 188         if (s->packet) {
 189             if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 190                 /* A deferred packet with no write data remaining must be
 191                    the status read packet.  */
 192                 usb_msd_send_status(s);
 193                 s->mode = USB_MSDM_CBW;
 194             } else {
 195                 if (s->data_len) {
 196                     s->data_len -= s->usb_len;
 197                     if (s->mode == USB_MSDM_DATAIN)
 198                         memset(s->usb_buf, 0, s->usb_len);
 199                     s->usb_len = 0;
 200                 }
 201                 if (s->data_len == 0)
 202                     s->mode = USB_MSDM_CSW;
 203             }
 204             s->packet = NULL;
 205             usb_packet_complete(p);
 206         } else if (s->data_len == 0) {
 207             s->mode = USB_MSDM_CSW;
 208         }
 209         return;
 210     }
 211     s->scsi_len = arg;
 212     s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
 213     if (p) {
 214         usb_msd_copy_data(s);
 215         if (s->usb_len == 0) {
 216             /* Set s->packet to NULL before calling usb_packet_complete
 217                because annother request may be issued before
 218                usb_packet_complete returns.  */
 219             DPRINTF("Packet complete %p\n", p);
 220             s->packet = NULL;
 221             usb_packet_complete(p);
 222         }
 223     }
 224 }
 225
 226 static void usb_msd_handle_reset(USBDevice *dev)
 227 {
 228     MSDState *s = (MSDState *)dev;
 229
 230     DPRINTF("Reset\n");
 231     s->mode = USB_MSDM_CBW;
 232 }
 233
 234 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 235                                   int index, int length, uint8_t *data)
 236 {
 237     MSDState *s = (MSDState *)dev;
 238     int ret = 0;
 239
 240     switch (request) {
 241     case DeviceRequest | USB_REQ_GET_STATUS:
 242         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 243             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 244         data[1] = 0x00;
 245         ret = 2;
 246         break;
 247     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 248         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 249             dev->remote_wakeup = 0;
 250         } else {
 251             goto fail;
 252         }
 253         ret = 0;
 254         break;
 255     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 256         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 257             dev->remote_wakeup = 1;
 258         } else {
 259             goto fail;
 260         }
 261         ret = 0;
 262         break;
 263     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 264         dev->addr = value;
 265         ret = 0;
 266         break;
 267     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 268         switch(value >> 8) {
 269         case USB_DT_DEVICE:
 270             memcpy(data, qemu_msd_dev_descriptor,
 271                    sizeof(qemu_msd_dev_descriptor));
 272             ret = sizeof(qemu_msd_dev_descriptor);
 273             break;
 274         case USB_DT_CONFIG:
 275             memcpy(data, qemu_msd_config_descriptor,
 276                    sizeof(qemu_msd_config_descriptor));
 277             ret = sizeof(qemu_msd_config_descriptor);
 278             break;
 279         case USB_DT_STRING:
 280             switch(value & 0xff) {
 281             case 0:
 282                 /* language ids */
 283                 data[0] = 4;
 284                 data[1] = 3;
 285                 data[2] = 0x09;
 286                 data[3] = 0x04;
 287                 ret = 4;
 288                 break;
 289             case 1:
 290                 /* vendor description */
 291                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
 292                 break;
 293             case 2:
 294                 /* product description */
 295                 ret = set_usb_string(data, "QEMU USB HARDDRIVE");
 296                 break;
 297             case 3:
 298                 /* serial number */
 299                 ret = set_usb_string(data, "1");
 300                 break;
 301             default:
 302                 goto fail;
 303             }
 304             break;
 305         default:
 306             goto fail;
 307         }
 308         break;
 309     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 310         data[0] = 1;
 311         ret = 1;
 312         break;
 313     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 314         ret = 0;
 315         break;
 316     case DeviceRequest | USB_REQ_GET_INTERFACE:
 317         data[0] = 0;
 318         ret = 1;
 319         break;
 320     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 321         ret = 0;
 322         break;
 323     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 324         ret = 0;
 325         break;
 326     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
 327         ret = 0;
 328         break;
 329         /* Class specific requests.  */
 330     case (((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) | MassStorageReset):
 331     case MassStorageReset:
 332         /* Reset state ready for the next CBW.  */
 333         s->mode = USB_MSDM_CBW;
 334         ret = 0;
 335         break;
 336     case (((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) | GetMaxLun):
 337     case GetMaxLun:
 338         data[0] = 0;
 339         ret = 1;
 340         break;
 341     default:
 342     fail:
 343         ret = USB_RET_STALL;
 344         break;
 345     }
 346     return ret;
 347 }
 348
 349 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 350 {
 351     MSDState *s = opaque;
 352     s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
 353     s->packet = NULL;
 354     s->scsi_len = 0;
 355 }
 356
 357 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 358 {
 359     MSDState *s = (MSDState *)dev;
 360     int ret = 0;
 361     struct usb_msd_cbw cbw;
 362     uint8_t devep = p->devep;
 363     uint8_t *data = p->data;
 364     int len = p->len;
 365
 366     switch (p->pid) {
 367     case USB_TOKEN_OUT:
 368         if (devep != 2)
 369             goto fail;
 370
 371         switch (s->mode) {
 372         case USB_MSDM_CBW:
 373             if (len != 31) {
 374                 fprintf(stderr, "usb-msd: Bad CBW size");
 375                 goto fail;
 376             }
 377             memcpy(&cbw, data, 31);
 378             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 379                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 380                         le32_to_cpu(cbw.sig));
 381                 goto fail;
 382             }
 383             DPRINTF("Command on LUN %d\n", cbw.lun);
 384             if (cbw.lun != 0) {
 385                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 386                 goto fail;
 387             }
 388             s->tag = le32_to_cpu(cbw.tag);
 389             s->data_len = le32_to_cpu(cbw.data_len);
 390             if (s->data_len == 0) {
 391                 s->mode = USB_MSDM_CSW;
 392             } else if (cbw.flags & 0x80) {
 393                 s->mode = USB_MSDM_DATAIN;
 394             } else {
 395                 s->mode = USB_MSDM_DATAOUT;
 396             }
 397             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 398                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 399             s->residue = 0;
 400             s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 401             /* ??? Should check that USB and SCSI data transfer
 402                directions match.  */
 403             if (s->residue == 0) {
 404                 if (s->mode == USB_MSDM_DATAIN) {
 405                     s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 406                 } else if (s->mode == USB_MSDM_DATAOUT) {
 407                     s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 408                 }
 409             }
 410             ret = len;
 411             break;
 412
 413         case USB_MSDM_DATAOUT:
 414             DPRINTF("Data out %d/%d\n", len, s->data_len);
 415             if (len > s->data_len)
 416                 goto fail;
 417
 418             s->usb_buf = data;
 419             s->usb_len = len;
 420             if (s->scsi_len) {
 421                 usb_msd_copy_data(s);
 422             }
 423             if (s->residue && s->usb_len) {
 424                 s->data_len -= s->usb_len;
 425                 if (s->data_len == 0)
 426                     s->mode = USB_MSDM_CSW;
 427                 s->usb_len = 0;
 428             }
 429             if (s->usb_len) {
 430                 DPRINTF("Deferring packet %p\n", p);
 431                 usb_defer_packet(p, usb_msd_cancel_io, s);
 432                 s->packet = p;
 433                 ret = USB_RET_ASYNC;
 434             } else {
 435                 ret = len;
 436             }
 437             break;
 438
 439         default:
 440             DPRINTF("Unexpected write (len %d)\n", len);
 441             goto fail;
 442         }
 443         break;
 444
 445     case USB_TOKEN_IN:
 446         if (devep != 1)
 447             goto fail;
 448
 449         switch (s->mode) {
 450         case USB_MSDM_DATAOUT:
 451             if (s->data_len != 0 || len < 13)
 452                 goto fail;
 453             /* Waiting for SCSI write to complete.  */
 454             usb_defer_packet(p, usb_msd_cancel_io, s);
 455             s->packet = p;
 456             ret = USB_RET_ASYNC;
 457             break;
 458
 459         case USB_MSDM_CSW:
 460             DPRINTF("Command status %d tag 0x%x, len %d\n",
 461                     s->result, s->tag, len);
 462             if (len < 13)
 463                 goto fail;
 464
 465             s->usb_len = len;
 466             s->usb_buf = data;
 467             usb_msd_send_status(s);
 468             s->mode = USB_MSDM_CBW;
 469             ret = 13;
 470             break;
 471
 472         case USB_MSDM_DATAIN:
 473             DPRINTF("Data in %d/%d\n", len, s->data_len);
 474             if (len > s->data_len)
 475                 len = s->data_len;
 476             s->usb_buf = data;
 477             s->usb_len = len;
 478             if (s->scsi_len) {
 479                 usb_msd_copy_data(s);
 480             }
 481             if (s->residue && s->usb_len) {
 482                 s->data_len -= s->usb_len;
 483                 memset(s->usb_buf, 0, s->usb_len);
 484                 if (s->data_len == 0)
 485                     s->mode = USB_MSDM_CSW;
 486                 s->usb_len = 0;
 487             }
 488             if (s->usb_len) {
 489                 DPRINTF("Deferring packet %p\n", p);
 490                 usb_defer_packet(p, usb_msd_cancel_io, s);
 491                 s->packet = p;
 492                 ret = USB_RET_ASYNC;
 493             } else {
 494                 ret = len;
 495             }
 496             break;
 497
 498         default:
 499             DPRINTF("Unexpected read (len %d)\n", len);
 500             goto fail;
 501         }
 502         break;
 503
 504     default:
 505         DPRINTF("Bad token\n");
 506     fail:
 507         ret = USB_RET_STALL;
 508         break;
 509     }
 510
 511     return ret;
 512 }
 513
 514 static void usb_msd_password_cb(void *opaque, int err)
 515 {
 516     MSDState *s = opaque;
 517
 518     if (!err)
 519         usb_device_attach(&s->dev);
 520     else
 521         qdev_unplug(&s->dev.qdev);
 522 }
 523
 524 static int usb_msd_initfn(USBDevice *dev)
 525 {
 526     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 527
 528     if (!s->conf.dinfo || !s->conf.dinfo->bdrv) {
 529         error_report("usb-msd: drive property not set");
 530         return -1;
 531     }
 532
 533     s->dev.speed = USB_SPEED_FULL;
 534     scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
 535     s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, s->conf.dinfo, 0);
 536     s->bus.qbus.allow_hotplug = 0;
 537     usb_msd_handle_reset(dev);
 538
 539     if (bdrv_key_required(s->conf.dinfo->bdrv)) {
 540         if (cur_mon) {
 541             monitor_read_bdrv_key_start(cur_mon, s->conf.dinfo->bdrv,
 542                                         usb_msd_password_cb, s);
 543             s->dev.auto_attach = 0;
 544         } else {
 545             autostart = 0;
 546         }
 547     }
 548
 549     return 0;
 550 }
 551
 552 static USBDevice *usb_msd_init(const char *filename)
 553 {
 554     static int nr=0;
 555     char id[8];
 556     QemuOpts *opts;
 557     DriveInfo *dinfo;
 558     USBDevice *dev;
 559     int fatal_error;
 560     const char *p1;
 561     char fmt[32];
 562
 563     /* parse -usbdevice disk: syntax into drive opts */
 564     snprintf(id, sizeof(id), "usb%d", nr++);
 565     opts = qemu_opts_create(&qemu_drive_opts, id, 0);
 566
 567     p1 = strchr(filename, ':');
 568     if (p1++) {
 569         const char *p2;
 570
 571         if (strstart(filename, "format=", &p2)) {
 572             int len = MIN(p1 - p2, sizeof(fmt));
 573             pstrcpy(fmt, len, p2);
 574             qemu_opt_set(opts, "format", fmt);
 575         } else if (*filename != ':') {
 576             printf("unrecognized USB mass-storage option %s\n", filename);
 577             return NULL;
 578         }
 579         filename = p1;
 580     }
 581     if (!*filename) {
 582         printf("block device specification needed\n");
 583         return NULL;
 584     }
 585     qemu_opt_set(opts, "file", filename);
 586     qemu_opt_set(opts, "if", "none");
 587
 588     /* create host drive */
 589     dinfo = drive_init(opts, NULL, &fatal_error);
 590     if (!dinfo) {
 591         qemu_opts_del(opts);
 592         return NULL;
 593     }
 594
 595     /* create guest device */
 596     dev = usb_create(NULL /* FIXME */, "usb-storage");
 597     if (!dev) {
 598         return NULL;
 599     }
 600     qdev_prop_set_drive(&dev->qdev, "drive", dinfo);
 601     if (qdev_init(&dev->qdev) < 0)
 602         return NULL;
 603
 604     return dev;
 605 }
 606
 607 static struct USBDeviceInfo msd_info = {
 608     .product_desc   = "QEMU USB MSD",
 609     .qdev.name      = "usb-storage",
 610     .qdev.size      = sizeof(MSDState),
 611     .init           = usb_msd_initfn,
 612     .handle_packet  = usb_generic_handle_packet,
 613     .handle_reset   = usb_msd_handle_reset,
 614     .handle_control = usb_msd_handle_control,
 615     .handle_data    = usb_msd_handle_data,
 616     .usbdevice_name = "disk",
 617     .usbdevice_init = usb_msd_init,
 618     .qdev.props     = (Property[]) {
 619         DEFINE_BLOCK_PROPERTIES(MSDState, conf),
 620         DEFINE_PROP_END_OF_LIST(),
 621     },
 622 };
 623
 624 static void usb_msd_register_devices(void)
 625 {
 626     usb_qdev_register(&msd_info);
 627 }
 628 device_init(usb_msd_register_devices)