hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu-option.h"
  12 #include "qemu-config.h"
  13 #include "usb.h"
  14 #include "block.h"
  15 #include "scsi-disk.h"
  16 #include "console.h"
  17
  18 //#define DEBUG_MSD
  19
  20 #ifdef DEBUG_MSD
  21 #define DPRINTF(fmt, ...) \
  22 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  23 #else
  24 #define DPRINTF(fmt, ...) do {} while(0)
  25 #endif
  26
  27 /* USB requests.  */
  28 #define MassStorageReset  0xff
  29 #define GetMaxLun         0xfe
  30
  31 enum USBMSDMode {
  32     USB_MSDM_CBW, /* Command Block.  */
  33     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  34     USB_MSDM_DATAIN, /* Transfer data from device.  */
  35     USB_MSDM_CSW /* Command Status.  */
  36 };
  37
  38 typedef struct {
  39     USBDevice dev;
  40     enum USBMSDMode mode;
  41     uint32_t scsi_len;
  42     uint8_t *scsi_buf;
  43     uint32_t usb_len;
  44     uint8_t *usb_buf;
  45     uint32_t data_len;
  46     uint32_t residue;
  47     uint32_t tag;
  48     SCSIBus *bus;
  49     DriveInfo *dinfo;
  50     SCSIDevice *scsi_dev;
  51     int result;
  52     /* For async completion.  */
  53     USBPacket *packet;
  54 } MSDState;
  55
  56 struct usb_msd_cbw {
  57     uint32_t sig;
  58     uint32_t tag;
  59     uint32_t data_len;
  60     uint8_t flags;
  61     uint8_t lun;
  62     uint8_t cmd_len;
  63     uint8_t cmd[16];
  64 };
  65
  66 struct usb_msd_csw {
  67     uint32_t sig;
  68     uint32_t tag;
  69     uint32_t residue;
  70     uint8_t status;
  71 };
  72
  73 static const uint8_t qemu_msd_dev_descriptor[] = {
  74         0x12,       /*  u8 bLength; */
  75         0x01,       /*  u8 bDescriptorType; Device */
  76         0x00, 0x01, /*  u16 bcdUSB; v1.0 */
  77
  78         0x00,       /*  u8  bDeviceClass; */
  79         0x00,       /*  u8  bDeviceSubClass; */
  80         0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
  81         0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
  82
  83         /* Vendor and product id are arbitrary.  */
  84         0x00, 0x00, /*  u16 idVendor; */
  85         0x00, 0x00, /*  u16 idProduct; */
  86         0x00, 0x00, /*  u16 bcdDevice */
  87
  88         0x01,       /*  u8  iManufacturer; */
  89         0x02,       /*  u8  iProduct; */
  90         0x03,       /*  u8  iSerialNumber; */
  91         0x01        /*  u8  bNumConfigurations; */
  92 };
  93
  94 static const uint8_t qemu_msd_config_descriptor[] = {
  95
  96         /* one configuration */
  97         0x09,       /*  u8  bLength; */
  98         0x02,       /*  u8  bDescriptorType; Configuration */
  99         0x20, 0x00, /*  u16 wTotalLength; */
 100         0x01,       /*  u8  bNumInterfaces; (1) */
 101         0x01,       /*  u8  bConfigurationValue; */
 102         0x00,       /*  u8  iConfiguration; */
 103         0xc0,       /*  u8  bmAttributes;
 104                                  Bit 7: must be set,
 105                                      6: Self-powered,
 106                                      5: Remote wakeup,
 107                                      4..0: resvd */
 108         0x00,       /*  u8  MaxPower; */
 109
 110         /* one interface */
 111         0x09,       /*  u8  if_bLength; */
 112         0x04,       /*  u8  if_bDescriptorType; Interface */
 113         0x00,       /*  u8  if_bInterfaceNumber; */
 114         0x00,       /*  u8  if_bAlternateSetting; */
 115         0x02,       /*  u8  if_bNumEndpoints; */
 116         0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
 117         0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
 118         0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
 119         0x00,       /*  u8  if_iInterface; */
 120
 121         /* Bulk-In endpoint */
 122         0x07,       /*  u8  ep_bLength; */
 123         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 124         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 125         0x02,       /*  u8  ep_bmAttributes; Bulk */
 126         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 127         0x00,       /*  u8  ep_bInterval; */
 128
 129         /* Bulk-Out endpoint */
 130         0x07,       /*  u8  ep_bLength; */
 131         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 132         0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 133         0x02,       /*  u8  ep_bmAttributes; Bulk */
 134         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 135         0x00        /*  u8  ep_bInterval; */
 136 };
 137
 138 static void usb_msd_copy_data(MSDState *s)
 139 {
 140     uint32_t len;
 141     len = s->usb_len;
 142     if (len > s->scsi_len)
 143         len = s->scsi_len;
 144     if (s->mode == USB_MSDM_DATAIN) {
 145         memcpy(s->usb_buf, s->scsi_buf, len);
 146     } else {
 147         memcpy(s->scsi_buf, s->usb_buf, len);
 148     }
 149     s->usb_len -= len;
 150     s->scsi_len -= len;
 151     s->usb_buf += len;
 152     s->scsi_buf += len;
 153     s->data_len -= len;
 154     if (s->scsi_len == 0) {
 155         if (s->mode == USB_MSDM_DATAIN) {
 156             s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 157         } else if (s->mode == USB_MSDM_DATAOUT) {
 158             s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 159         }
 160     }
 161 }
 162
 163 static void usb_msd_send_status(MSDState *s)
 164 {
 165     struct usb_msd_csw csw;
 166
 167     csw.sig = cpu_to_le32(0x53425355);
 168     csw.tag = cpu_to_le32(s->tag);
 169     csw.residue = s->residue;
 170     csw.status = s->result;
 171     memcpy(s->usb_buf, &csw, 13);
 172 }
 173
 174 static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 175                                      uint32_t arg)
 176 {
 177     MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
 178     USBPacket *p = s->packet;
 179
 180     if (tag != s->tag) {
 181         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
 182     }
 183     if (reason == SCSI_REASON_DONE) {
 184         DPRINTF("Command complete %d\n", arg);
 185         s->residue = s->data_len;
 186         s->result = arg != 0;
 187         if (s->packet) {
 188             if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 189                 /* A deferred packet with no write data remaining must be
 190                    the status read packet.  */
 191                 usb_msd_send_status(s);
 192                 s->mode = USB_MSDM_CBW;
 193             } else {
 194                 if (s->data_len) {
 195                     s->data_len -= s->usb_len;
 196                     if (s->mode == USB_MSDM_DATAIN)
 197                         memset(s->usb_buf, 0, s->usb_len);
 198                     s->usb_len = 0;
 199                 }
 200                 if (s->data_len == 0)
 201                     s->mode = USB_MSDM_CSW;
 202             }
 203             s->packet = NULL;
 204             usb_packet_complete(p);
 205         } else if (s->data_len == 0) {
 206             s->mode = USB_MSDM_CSW;
 207         }
 208         return;
 209     }
 210     s->scsi_len = arg;
 211     s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
 212     if (p) {
 213         usb_msd_copy_data(s);
 214         if (s->usb_len == 0) {
 215             /* Set s->packet to NULL before calling usb_packet_complete
 216                because annother request may be issued before
 217                usb_packet_complete returns.  */
 218             DPRINTF("Packet complete %p\n", p);
 219             s->packet = NULL;
 220             usb_packet_complete(p);
 221         }
 222     }
 223 }
 224
 225 static void usb_msd_handle_reset(USBDevice *dev)
 226 {
 227     MSDState *s = (MSDState *)dev;
 228
 229     DPRINTF("Reset\n");
 230     s->mode = USB_MSDM_CBW;
 231 }
 232
 233 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 234                                   int index, int length, uint8_t *data)
 235 {
 236     MSDState *s = (MSDState *)dev;
 237     int ret = 0;
 238
 239     switch (request) {
 240     case DeviceRequest | USB_REQ_GET_STATUS:
 241         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 242             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 243         data[1] = 0x00;
 244         ret = 2;
 245         break;
 246     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 247         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 248             dev->remote_wakeup = 0;
 249         } else {
 250             goto fail;
 251         }
 252         ret = 0;
 253         break;
 254     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 255         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 256             dev->remote_wakeup = 1;
 257         } else {
 258             goto fail;
 259         }
 260         ret = 0;
 261         break;
 262     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 263         dev->addr = value;
 264         ret = 0;
 265         break;
 266     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 267         switch(value >> 8) {
 268         case USB_DT_DEVICE:
 269             memcpy(data, qemu_msd_dev_descriptor,
 270                    sizeof(qemu_msd_dev_descriptor));
 271             ret = sizeof(qemu_msd_dev_descriptor);
 272             break;
 273         case USB_DT_CONFIG:
 274             memcpy(data, qemu_msd_config_descriptor,
 275                    sizeof(qemu_msd_config_descriptor));
 276             ret = sizeof(qemu_msd_config_descriptor);
 277             break;
 278         case USB_DT_STRING:
 279             switch(value & 0xff) {
 280             case 0:
 281                 /* language ids */
 282                 data[0] = 4;
 283                 data[1] = 3;
 284                 data[2] = 0x09;
 285                 data[3] = 0x04;
 286                 ret = 4;
 287                 break;
 288             case 1:
 289                 /* vendor description */
 290                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
 291                 break;
 292             case 2:
 293                 /* product description */
 294                 ret = set_usb_string(data, "QEMU USB HARDDRIVE");
 295                 break;
 296             case 3:
 297                 /* serial number */
 298                 ret = set_usb_string(data, "1");
 299                 break;
 300             default:
 301                 goto fail;
 302             }
 303             break;
 304         default:
 305             goto fail;
 306         }
 307         break;
 308     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 309         data[0] = 1;
 310         ret = 1;
 311         break;
 312     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 313         ret = 0;
 314         break;
 315     case DeviceRequest | USB_REQ_GET_INTERFACE:
 316         data[0] = 0;
 317         ret = 1;
 318         break;
 319     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 320         ret = 0;
 321         break;
 322     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 323         if (value == 0 && index != 0x81) { /* clear ep halt */
 324             goto fail;
 325         }
 326         ret = 0;
 327         break;
 328         /* Class specific requests.  */
 329     case MassStorageReset:
 330         /* Reset state ready for the next CBW.  */
 331         s->mode = USB_MSDM_CBW;
 332         ret = 0;
 333         break;
 334     case GetMaxLun:
 335         data[0] = 0;
 336         ret = 1;
 337         break;
 338     default:
 339     fail:
 340         ret = USB_RET_STALL;
 341         break;
 342     }
 343     return ret;
 344 }
 345
 346 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 347 {
 348     MSDState *s = opaque;
 349     s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
 350     s->packet = NULL;
 351     s->scsi_len = 0;
 352 }
 353
 354 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 355 {
 356     MSDState *s = (MSDState *)dev;
 357     int ret = 0;
 358     struct usb_msd_cbw cbw;
 359     uint8_t devep = p->devep;
 360     uint8_t *data = p->data;
 361     int len = p->len;
 362
 363     switch (p->pid) {
 364     case USB_TOKEN_OUT:
 365         if (devep != 2)
 366             goto fail;
 367
 368         switch (s->mode) {
 369         case USB_MSDM_CBW:
 370             if (len != 31) {
 371                 fprintf(stderr, "usb-msd: Bad CBW size");
 372                 goto fail;
 373             }
 374             memcpy(&cbw, data, 31);
 375             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 376                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 377                         le32_to_cpu(cbw.sig));
 378                 goto fail;
 379             }
 380             DPRINTF("Command on LUN %d\n", cbw.lun);
 381             if (cbw.lun != 0) {
 382                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 383                 goto fail;
 384             }
 385             s->tag = le32_to_cpu(cbw.tag);
 386             s->data_len = le32_to_cpu(cbw.data_len);
 387             if (s->data_len == 0) {
 388                 s->mode = USB_MSDM_CSW;
 389             } else if (cbw.flags & 0x80) {
 390                 s->mode = USB_MSDM_DATAIN;
 391             } else {
 392                 s->mode = USB_MSDM_DATAOUT;
 393             }
 394             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 395                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 396             s->residue = 0;
 397             s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 398             /* ??? Should check that USB and SCSI data transfer
 399                directions match.  */
 400             if (s->residue == 0) {
 401                 if (s->mode == USB_MSDM_DATAIN) {
 402                     s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 403                 } else if (s->mode == USB_MSDM_DATAOUT) {
 404                     s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 405                 }
 406             }
 407             ret = len;
 408             break;
 409
 410         case USB_MSDM_DATAOUT:
 411             DPRINTF("Data out %d/%d\n", len, s->data_len);
 412             if (len > s->data_len)
 413                 goto fail;
 414
 415             s->usb_buf = data;
 416             s->usb_len = len;
 417             if (s->scsi_len) {
 418                 usb_msd_copy_data(s);
 419             }
 420             if (s->residue && s->usb_len) {
 421                 s->data_len -= s->usb_len;
 422                 if (s->data_len == 0)
 423                     s->mode = USB_MSDM_CSW;
 424                 s->usb_len = 0;
 425             }
 426             if (s->usb_len) {
 427                 DPRINTF("Deferring packet %p\n", p);
 428                 usb_defer_packet(p, usb_msd_cancel_io, s);
 429                 s->packet = p;
 430                 ret = USB_RET_ASYNC;
 431             } else {
 432                 ret = len;
 433             }
 434             break;
 435
 436         default:
 437             DPRINTF("Unexpected write (len %d)\n", len);
 438             goto fail;
 439         }
 440         break;
 441
 442     case USB_TOKEN_IN:
 443         if (devep != 1)
 444             goto fail;
 445
 446         switch (s->mode) {
 447         case USB_MSDM_DATAOUT:
 448             if (s->data_len != 0 || len < 13)
 449                 goto fail;
 450             /* Waiting for SCSI write to complete.  */
 451             usb_defer_packet(p, usb_msd_cancel_io, s);
 452             s->packet = p;
 453             ret = USB_RET_ASYNC;
 454             break;
 455
 456         case USB_MSDM_CSW:
 457             DPRINTF("Command status %d tag 0x%x, len %d\n",
 458                     s->result, s->tag, len);
 459             if (len < 13)
 460                 goto fail;
 461
 462             s->usb_len = len;
 463             s->usb_buf = data;
 464             usb_msd_send_status(s);
 465             s->mode = USB_MSDM_CBW;
 466             ret = 13;
 467             break;
 468
 469         case USB_MSDM_DATAIN:
 470             DPRINTF("Data in %d/%d\n", len, s->data_len);
 471             if (len > s->data_len)
 472                 len = s->data_len;
 473             s->usb_buf = data;
 474             s->usb_len = len;
 475             if (s->scsi_len) {
 476                 usb_msd_copy_data(s);
 477             }
 478             if (s->residue && s->usb_len) {
 479                 s->data_len -= s->usb_len;
 480                 memset(s->usb_buf, 0, s->usb_len);
 481                 if (s->data_len == 0)
 482                     s->mode = USB_MSDM_CSW;
 483                 s->usb_len = 0;
 484             }
 485             if (s->usb_len) {
 486                 DPRINTF("Deferring packet %p\n", p);
 487                 usb_defer_packet(p, usb_msd_cancel_io, s);
 488                 s->packet = p;
 489                 ret = USB_RET_ASYNC;
 490             } else {
 491                 ret = len;
 492             }
 493             break;
 494
 495         default:
 496             DPRINTF("Unexpected read (len %d)\n", len);
 497             goto fail;
 498         }
 499         break;
 500
 501     default:
 502         DPRINTF("Bad token\n");
 503     fail:
 504         ret = USB_RET_STALL;
 505         break;
 506     }
 507
 508     return ret;
 509 }
 510
 511 static void usb_msd_handle_destroy(USBDevice *dev)
 512 {
 513     MSDState *s = (MSDState *)dev;
 514
 515     s->scsi_dev->info->destroy(s->scsi_dev);
 516     drive_uninit(s->dinfo->bdrv);
 517     qemu_free(s);
 518 }
 519
 520 static int usb_msd_initfn(USBDevice *dev)
 521 {
 522     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 523
 524     if (!s->dinfo || !s->dinfo->bdrv) {
 525         qemu_error("usb-msd: drive property not set\n");
 526         return -1;
 527     }
 528
 529     s->dev.speed = USB_SPEED_FULL;
 530     s->bus = scsi_bus_new(&s->dev.qdev, 0, 1, usb_msd_command_complete);
 531     s->scsi_dev = scsi_bus_legacy_add_drive(s->bus, s->dinfo, 0);
 532     usb_msd_handle_reset(dev);
 533     return 0;
 534 }
 535
 536 USBDevice *usb_msd_init(const char *filename)
 537 {
 538     static int nr=0;
 539     char id[8];
 540     QemuOpts *opts;
 541     DriveInfo *dinfo;
 542     USBDevice *dev;
 543     int fatal_error;
 544     const char *p1;
 545     char fmt[32];
 546
 547     /* parse -usbdevice disk: syntax into drive opts */
 548     snprintf(id, sizeof(id), "usb%d", nr++);
 549     opts = qemu_opts_create(&qemu_drive_opts, id, 0);
 550
 551     p1 = strchr(filename, ':');
 552     if (p1++) {
 553         const char *p2;
 554
 555         if (strstart(filename, "format=", &p2)) {
 556             int len = MIN(p1 - p2, sizeof(fmt));
 557             pstrcpy(fmt, len, p2);
 558             qemu_opt_set(opts, "format", fmt);
 559         } else if (*filename != ':') {
 560             printf("unrecognized USB mass-storage option %s\n", filename);
 561             return NULL;
 562         }
 563         filename = p1;
 564     }
 565     if (!*filename) {
 566         printf("block device specification needed\n");
 567         return NULL;
 568     }
 569     qemu_opt_set(opts, "file", filename);
 570     qemu_opt_set(opts, "if", "none");
 571
 572     /* create host drive */
 573     dinfo = drive_init(opts, NULL, &fatal_error);
 574     if (!dinfo) {
 575         qemu_opts_del(opts);
 576         return NULL;
 577     }
 578
 579     /* create guest device */
 580     dev = usb_create(NULL /* FIXME */, "QEMU USB MSD");
 581     qdev_prop_set_drive(&dev->qdev, "drive", dinfo);
 582     qdev_init(&dev->qdev);
 583
 584     return dev;
 585 }
 586
 587 BlockDriverState *usb_msd_get_bdrv(USBDevice *dev)
 588 {
 589     MSDState *s = (MSDState *)dev;
 590
 591     return s->dinfo->bdrv;
 592 }
 593
 594 static struct USBDeviceInfo msd_info = {
 595     .qdev.name      = "QEMU USB MSD",
 596     .qdev.alias     = "usb-storage",
 597     .qdev.size      = sizeof(MSDState),
 598     .init           = usb_msd_initfn,
 599     .handle_packet  = usb_generic_handle_packet,
 600     .handle_reset   = usb_msd_handle_reset,
 601     .handle_control = usb_msd_handle_control,
 602     .handle_data    = usb_msd_handle_data,
 603     .handle_destroy = usb_msd_handle_destroy,
 604     .qdev.props     = (Property[]) {
 605         DEFINE_PROP_DRIVE("drive", MSDState, dinfo),
 606         DEFINE_PROP_END_OF_LIST(),
 607     },
 608 };
 609
 610 static void usb_msd_register_devices(void)
 611 {
 612     usb_qdev_register(&msd_info);
 613 }
 614 device_init(usb_msd_register_devices)