hw/usb/dev-storage.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu/option.h"
  12 #include "qemu/config-file.h"
  13 #include "hw/usb.h"
  14 #include "hw/usb/desc.h"
  15 #include "hw/scsi/scsi.h"
  16 #include "ui/console.h"
  17 #include "monitor/monitor.h"
  18 #include "sysemu/sysemu.h"
  19 #include "sysemu/blockdev.h"
  20 #include "qapi/visitor.h"
  21
  22 //#define DEBUG_MSD
  23
  24 #ifdef DEBUG_MSD
  25 #define DPRINTF(fmt, ...) \
  26 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  27 #else
  28 #define DPRINTF(fmt, ...) do {} while(0)
  29 #endif
  30
  31 /* USB requests.  */
  32 #define MassStorageReset  0xff
  33 #define GetMaxLun         0xfe
  34
  35 enum USBMSDMode {
  36     USB_MSDM_CBW, /* Command Block.  */
  37     USB_MSDM_DATAOUT, /* Transfer data to device.  */
  38     USB_MSDM_DATAIN, /* Transfer data from device.  */
  39     USB_MSDM_CSW /* Command Status.  */
  40 };
  41
  42 struct usb_msd_csw {
  43     uint32_t sig;
  44     uint32_t tag;
  45     uint32_t residue;
  46     uint8_t status;
  47 };
  48
  49 typedef struct {
  50     USBDevice dev;
  51     enum USBMSDMode mode;
  52     uint32_t scsi_off;
  53     uint32_t scsi_len;
  54     uint32_t data_len;
  55     struct usb_msd_csw csw;
  56     SCSIRequest *req;
  57     SCSIBus bus;
  58     /* For async completion.  */
  59     USBPacket *packet;
  60     /* usb-storage only */
  61     BlockConf conf;
  62     uint32_t removable;
  63     SCSIDevice *scsi_dev;
  64 } MSDState;
  65
  66 struct usb_msd_cbw {
  67     uint32_t sig;
  68     uint32_t tag;
  69     uint32_t data_len;
  70     uint8_t flags;
  71     uint8_t lun;
  72     uint8_t cmd_len;
  73     uint8_t cmd[16];
  74 };
  75
  76 enum {
  77     STR_MANUFACTURER = 1,
  78     STR_PRODUCT,
  79     STR_SERIALNUMBER,
  80     STR_CONFIG_FULL,
  81     STR_CONFIG_HIGH,
  82     STR_CONFIG_SUPER,
  83 };
  84
  85 static const USBDescStrings desc_strings = {
  86     [STR_MANUFACTURER] = "QEMU",
  87     [STR_PRODUCT]      = "QEMU USB HARDDRIVE",
  88     [STR_SERIALNUMBER] = "1",
  89     [STR_CONFIG_FULL]  = "Full speed config (usb 1.1)",
  90     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
  91     [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
  92 };
  93
  94 static const USBDescIface desc_iface_full = {
  95     .bInterfaceNumber              = 0,
  96     .bNumEndpoints                 = 2,
  97     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
  98     .bInterfaceSubClass            = 0x06, /* SCSI */
  99     .bInterfaceProtocol            = 0x50, /* Bulk */
 100     .eps = (USBDescEndpoint[]) {
 101         {
 102             .bEndpointAddress      = USB_DIR_IN | 0x01,
 103             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 104             .wMaxPacketSize        = 64,
 105         },{
 106             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 107             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 108             .wMaxPacketSize        = 64,
 109         },
 110     }
 111 };
 112
 113 static const USBDescDevice desc_device_full = {
 114     .bcdUSB                        = 0x0200,
 115     .bMaxPacketSize0               = 8,
 116     .bNumConfigurations            = 1,
 117     .confs = (USBDescConfig[]) {
 118         {
 119             .bNumInterfaces        = 1,
 120             .bConfigurationValue   = 1,
 121             .iConfiguration        = STR_CONFIG_FULL,
 122             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 123             .nif = 1,
 124             .ifs = &desc_iface_full,
 125         },
 126     },
 127 };
 128
 129 static const USBDescIface desc_iface_high = {
 130     .bInterfaceNumber              = 0,
 131     .bNumEndpoints                 = 2,
 132     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 133     .bInterfaceSubClass            = 0x06, /* SCSI */
 134     .bInterfaceProtocol            = 0x50, /* Bulk */
 135     .eps = (USBDescEndpoint[]) {
 136         {
 137             .bEndpointAddress      = USB_DIR_IN | 0x01,
 138             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 139             .wMaxPacketSize        = 512,
 140         },{
 141             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 142             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 143             .wMaxPacketSize        = 512,
 144         },
 145     }
 146 };
 147
 148 static const USBDescDevice desc_device_high = {
 149     .bcdUSB                        = 0x0200,
 150     .bMaxPacketSize0               = 64,
 151     .bNumConfigurations            = 1,
 152     .confs = (USBDescConfig[]) {
 153         {
 154             .bNumInterfaces        = 1,
 155             .bConfigurationValue   = 1,
 156             .iConfiguration        = STR_CONFIG_HIGH,
 157             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 158             .nif = 1,
 159             .ifs = &desc_iface_high,
 160         },
 161     },
 162 };
 163
 164 static const USBDescIface desc_iface_super = {
 165     .bInterfaceNumber              = 0,
 166     .bNumEndpoints                 = 2,
 167     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 168     .bInterfaceSubClass            = 0x06, /* SCSI */
 169     .bInterfaceProtocol            = 0x50, /* Bulk */
 170     .eps = (USBDescEndpoint[]) {
 171         {
 172             .bEndpointAddress      = USB_DIR_IN | 0x01,
 173             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 174             .wMaxPacketSize        = 1024,
 175             .bMaxBurst             = 15,
 176         },{
 177             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 178             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 179             .wMaxPacketSize        = 1024,
 180             .bMaxBurst             = 15,
 181         },
 182     }
 183 };
 184
 185 static const USBDescDevice desc_device_super = {
 186     .bcdUSB                        = 0x0300,
 187     .bMaxPacketSize0               = 9,
 188     .bNumConfigurations            = 1,
 189     .confs = (USBDescConfig[]) {
 190         {
 191             .bNumInterfaces        = 1,
 192             .bConfigurationValue   = 1,
 193             .iConfiguration        = STR_CONFIG_SUPER,
 194             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 195             .nif = 1,
 196             .ifs = &desc_iface_super,
 197         },
 198     },
 199 };
 200
 201 static const USBDesc desc = {
 202     .id = {
 203         .idVendor          = 0x46f4, /* CRC16() of "QEMU" */
 204         .idProduct         = 0x0001,
 205         .bcdDevice         = 0,
 206         .iManufacturer     = STR_MANUFACTURER,
 207         .iProduct          = STR_PRODUCT,
 208         .iSerialNumber     = STR_SERIALNUMBER,
 209     },
 210     .full  = &desc_device_full,
 211     .high  = &desc_device_high,
 212     .super = &desc_device_super,
 213     .str   = desc_strings,
 214 };
 215
 216 static void usb_msd_copy_data(MSDState *s, USBPacket *p)
 217 {
 218     uint32_t len;
 219     len = p->iov.size - p->actual_length;
 220     if (len > s->scsi_len)
 221         len = s->scsi_len;
 222     usb_packet_copy(p, scsi_req_get_buf(s->req) + s->scsi_off, len);
 223     s->scsi_len -= len;
 224     s->scsi_off += len;
 225     s->data_len -= len;
 226     if (s->scsi_len == 0 || s->data_len == 0) {
 227         scsi_req_continue(s->req);
 228     }
 229 }
 230
 231 static void usb_msd_send_status(MSDState *s, USBPacket *p)
 232 {
 233     int len;
 234
 235     DPRINTF("Command status %d tag 0x%x, len %zd\n",
 236             s->csw.status, le32_to_cpu(s->csw.tag), p->iov.size);
 237
 238     assert(s->csw.sig == cpu_to_le32(0x53425355));
 239     len = MIN(sizeof(s->csw), p->iov.size);
 240     usb_packet_copy(p, &s->csw, len);
 241     memset(&s->csw, 0, sizeof(s->csw));
 242 }
 243
 244 static void usb_msd_packet_complete(MSDState *s)
 245 {
 246     USBPacket *p = s->packet;
 247
 248     /* Set s->packet to NULL before calling usb_packet_complete
 249        because another request may be issued before
 250        usb_packet_complete returns.  */
 251     DPRINTF("Packet complete %p\n", p);
 252     s->packet = NULL;
 253     usb_packet_complete(&s->dev, p);
 254 }
 255
 256 static void usb_msd_transfer_data(SCSIRequest *req, uint32_t len)
 257 {
 258     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 259     USBPacket *p = s->packet;
 260
 261     assert((s->mode == USB_MSDM_DATAOUT) == (req->cmd.mode == SCSI_XFER_TO_DEV));
 262     s->scsi_len = len;
 263     s->scsi_off = 0;
 264     if (p) {
 265         usb_msd_copy_data(s, p);
 266         p = s->packet;
 267         if (p && p->actual_length == p->iov.size) {
 268             p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 269             usb_msd_packet_complete(s);
 270         }
 271     }
 272 }
 273
 274 static void usb_msd_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 275 {
 276     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 277     USBPacket *p = s->packet;
 278
 279     DPRINTF("Command complete %d tag 0x%x\n", status, req->tag);
 280
 281     s->csw.sig = cpu_to_le32(0x53425355);
 282     s->csw.tag = cpu_to_le32(req->tag);
 283     s->csw.residue = cpu_to_le32(s->data_len);
 284     s->csw.status = status != 0;
 285
 286     if (s->packet) {
 287         if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 288             /* A deferred packet with no write data remaining must be
 289                the status read packet.  */
 290             usb_msd_send_status(s, p);
 291             s->mode = USB_MSDM_CBW;
 292         } else if (s->mode == USB_MSDM_CSW) {
 293             usb_msd_send_status(s, p);
 294             s->mode = USB_MSDM_CBW;
 295         } else {
 296             if (s->data_len) {
 297                 int len = (p->iov.size - p->actual_length);
 298                 usb_packet_skip(p, len);
 299                 s->data_len -= len;
 300             }
 301             if (s->data_len == 0) {
 302                 s->mode = USB_MSDM_CSW;
 303             }
 304         }
 305         p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 306         usb_msd_packet_complete(s);
 307     } else if (s->data_len == 0) {
 308         s->mode = USB_MSDM_CSW;
 309     }
 310     scsi_req_unref(req);
 311     s->req = NULL;
 312 }
 313
 314 static void usb_msd_request_cancelled(SCSIRequest *req)
 315 {
 316     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 317
 318     if (req == s->req) {
 319         scsi_req_unref(s->req);
 320         s->req = NULL;
 321         s->scsi_len = 0;
 322     }
 323 }
 324
 325 static void usb_msd_handle_reset(USBDevice *dev)
 326 {
 327     MSDState *s = (MSDState *)dev;
 328
 329     DPRINTF("Reset\n");
 330     if (s->req) {
 331         scsi_req_cancel(s->req);
 332     }
 333     assert(s->req == NULL);
 334
 335     if (s->packet) {
 336         s->packet->status = USB_RET_STALL;
 337         usb_msd_packet_complete(s);
 338     }
 339
 340     s->mode = USB_MSDM_CBW;
 341 }
 342
 343 static void usb_msd_handle_control(USBDevice *dev, USBPacket *p,
 344                int request, int value, int index, int length, uint8_t *data)
 345 {
 346     MSDState *s = (MSDState *)dev;
 347     SCSIDevice *scsi_dev;
 348     int ret, maxlun;
 349
 350     ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
 351     if (ret >= 0) {
 352         return;
 353     }
 354
 355     switch (request) {
 356     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 357         break;
 358         /* Class specific requests.  */
 359     case ClassInterfaceOutRequest | MassStorageReset:
 360         /* Reset state ready for the next CBW.  */
 361         s->mode = USB_MSDM_CBW;
 362         break;
 363     case ClassInterfaceRequest | GetMaxLun:
 364         maxlun = 0;
 365         for (;;) {
 366             scsi_dev = scsi_device_find(&s->bus, 0, 0, maxlun+1);
 367             if (scsi_dev == NULL) {
 368                 break;
 369             }
 370             if (scsi_dev->lun != maxlun+1) {
 371                 break;
 372             }
 373             maxlun++;
 374         }
 375         DPRINTF("MaxLun %d\n", maxlun);
 376         data[0] = maxlun;
 377         p->actual_length = 1;
 378         break;
 379     default:
 380         p->status = USB_RET_STALL;
 381         break;
 382     }
 383 }
 384
 385 static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
 386 {
 387     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 388
 389     assert(s->packet == p);
 390     s->packet = NULL;
 391
 392     if (s->req) {
 393         scsi_req_cancel(s->req);
 394     }
 395 }
 396
 397 static void usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 398 {
 399     MSDState *s = (MSDState *)dev;
 400     uint32_t tag;
 401     struct usb_msd_cbw cbw;
 402     uint8_t devep = p->ep->nr;
 403     SCSIDevice *scsi_dev;
 404     uint32_t len;
 405
 406     switch (p->pid) {
 407     case USB_TOKEN_OUT:
 408         if (devep != 2)
 409             goto fail;
 410
 411         switch (s->mode) {
 412         case USB_MSDM_CBW:
 413             if (p->iov.size != 31) {
 414                 error_report("usb-msd: Bad CBW size");
 415                 goto fail;
 416             }
 417             usb_packet_copy(p, &cbw, 31);
 418             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 419                 error_report("usb-msd: Bad signature %08x",
 420                              le32_to_cpu(cbw.sig));
 421                 goto fail;
 422             }
 423             DPRINTF("Command on LUN %d\n", cbw.lun);
 424             scsi_dev = scsi_device_find(&s->bus, 0, 0, cbw.lun);
 425             if (scsi_dev == NULL) {
 426                 error_report("usb-msd: Bad LUN %d", cbw.lun);
 427                 goto fail;
 428             }
 429             tag = le32_to_cpu(cbw.tag);
 430             s->data_len = le32_to_cpu(cbw.data_len);
 431             if (s->data_len == 0) {
 432                 s->mode = USB_MSDM_CSW;
 433             } else if (cbw.flags & 0x80) {
 434                 s->mode = USB_MSDM_DATAIN;
 435             } else {
 436                 s->mode = USB_MSDM_DATAOUT;
 437             }
 438             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 439                     tag, cbw.flags, cbw.cmd_len, s->data_len);
 440             assert(le32_to_cpu(s->csw.residue) == 0);
 441             s->scsi_len = 0;
 442             s->req = scsi_req_new(scsi_dev, tag, cbw.lun, cbw.cmd, NULL);
 443 #ifdef DEBUG_MSD
 444             scsi_req_print(s->req);
 445 #endif
 446             len = scsi_req_enqueue(s->req);
 447             if (len) {
 448                 scsi_req_continue(s->req);
 449             }
 450             break;
 451
 452         case USB_MSDM_DATAOUT:
 453             DPRINTF("Data out %zd/%d\n", p->iov.size, s->data_len);
 454             if (p->iov.size > s->data_len) {
 455                 goto fail;
 456             }
 457
 458             if (s->scsi_len) {
 459                 usb_msd_copy_data(s, p);
 460             }
 461             if (le32_to_cpu(s->csw.residue)) {
 462                 int len = p->iov.size - p->actual_length;
 463                 if (len) {
 464                     usb_packet_skip(p, len);
 465                     s->data_len -= len;
 466                     if (s->data_len == 0) {
 467                         s->mode = USB_MSDM_CSW;
 468                     }
 469                 }
 470             }
 471             if (p->actual_length < p->iov.size) {
 472                 DPRINTF("Deferring packet %p [wait data-out]\n", p);
 473                 s->packet = p;
 474                 p->status = USB_RET_ASYNC;
 475             }
 476             break;
 477
 478         default:
 479             DPRINTF("Unexpected write (len %zd)\n", p->iov.size);
 480             goto fail;
 481         }
 482         break;
 483
 484     case USB_TOKEN_IN:
 485         if (devep != 1)
 486             goto fail;
 487
 488         switch (s->mode) {
 489         case USB_MSDM_DATAOUT:
 490             if (s->data_len != 0 || p->iov.size < 13) {
 491                 goto fail;
 492             }
 493             /* Waiting for SCSI write to complete.  */
 494             s->packet = p;
 495             p->status = USB_RET_ASYNC;
 496             break;
 497
 498         case USB_MSDM_CSW:
 499             if (p->iov.size < 13) {
 500                 goto fail;
 501             }
 502
 503             if (s->req) {
 504                 /* still in flight */
 505                 DPRINTF("Deferring packet %p [wait status]\n", p);
 506                 s->packet = p;
 507                 p->status = USB_RET_ASYNC;
 508             } else {
 509                 usb_msd_send_status(s, p);
 510                 s->mode = USB_MSDM_CBW;
 511             }
 512             break;
 513
 514         case USB_MSDM_DATAIN:
 515             DPRINTF("Data in %zd/%d, scsi_len %d\n",
 516                     p->iov.size, s->data_len, s->scsi_len);
 517             if (s->scsi_len) {
 518                 usb_msd_copy_data(s, p);
 519             }
 520             if (le32_to_cpu(s->csw.residue)) {
 521                 int len = p->iov.size - p->actual_length;
 522                 if (len) {
 523                     usb_packet_skip(p, len);
 524                     s->data_len -= len;
 525                     if (s->data_len == 0) {
 526                         s->mode = USB_MSDM_CSW;
 527                     }
 528                 }
 529             }
 530             if (p->actual_length < p->iov.size) {
 531                 DPRINTF("Deferring packet %p [wait data-in]\n", p);
 532                 s->packet = p;
 533                 p->status = USB_RET_ASYNC;
 534             }
 535             break;
 536
 537         default:
 538             DPRINTF("Unexpected read (len %zd)\n", p->iov.size);
 539             goto fail;
 540         }
 541         break;
 542
 543     default:
 544         DPRINTF("Bad token\n");
 545     fail:
 546         p->status = USB_RET_STALL;
 547         break;
 548     }
 549 }
 550
 551 static void usb_msd_password_cb(void *opaque, int err)
 552 {
 553     MSDState *s = opaque;
 554     Error *local_err = NULL;
 555
 556     if (!err) {
 557         usb_device_attach(&s->dev, &local_err);
 558     }
 559
 560     if (local_err) {
 561         qerror_report_err(local_err);
 562         error_free(local_err);
 563         qdev_unplug(&s->dev.qdev, NULL);
 564     }
 565 }
 566
 567 static void *usb_msd_load_request(QEMUFile *f, SCSIRequest *req)
 568 {
 569     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 570
 571     /* nothing to load, just store req in our state struct */
 572     assert(s->req == NULL);
 573     scsi_req_ref(req);
 574     s->req = req;
 575     return NULL;
 576 }
 577
 578 static const struct SCSIBusInfo usb_msd_scsi_info_storage = {
 579     .tcq = false,
 580     .max_target = 0,
 581     .max_lun = 0,
 582
 583     .transfer_data = usb_msd_transfer_data,
 584     .complete = usb_msd_command_complete,
 585     .cancel = usb_msd_request_cancelled,
 586     .load_request = usb_msd_load_request,
 587 };
 588
 589 static const struct SCSIBusInfo usb_msd_scsi_info_bot = {
 590     .tcq = false,
 591     .max_target = 0,
 592     .max_lun = 15,
 593
 594     .transfer_data = usb_msd_transfer_data,
 595     .complete = usb_msd_command_complete,
 596     .cancel = usb_msd_request_cancelled,
 597     .load_request = usb_msd_load_request,
 598 };
 599
 600 static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
 601 {
 602     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 603     BlockDriverState *bs = s->conf.bs;
 604     SCSIDevice *scsi_dev;
 605     Error *err = NULL;
 606
 607     if (!bs) {
 608         error_setg(errp, "drive property not set");
 609         return;
 610     }
 611
 612     blkconf_serial(&s->conf, &dev->serial);
 613
 614     /*
 615      * Hack alert: this pretends to be a block device, but it's really
 616      * a SCSI bus that can serve only a single device, which it
 617      * creates automatically.  But first it needs to detach from its
 618      * blockdev, or else scsi_bus_legacy_add_drive() dies when it
 619      * attaches again.
 620      *
 621      * The hack is probably a bad idea.
 622      */
 623     bdrv_detach_dev(bs, &s->dev.qdev);
 624     s->conf.bs = NULL;
 625
 626     usb_desc_create_serial(dev);
 627     usb_desc_init(dev);
 628     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
 629                  &usb_msd_scsi_info_storage, NULL);
 630     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0, !!s->removable,
 631                                          s->conf.bootindex, dev->serial,
 632                                          &err);
 633     if (!scsi_dev) {
 634         error_propagate(errp, err);
 635         return;
 636     }
 637     s->bus.qbus.allow_hotplug = 0;
 638     usb_msd_handle_reset(dev);
 639     s->scsi_dev = scsi_dev;
 640
 641     if (bdrv_key_required(bs)) {
 642         if (cur_mon) {
 643             monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
 644             s->dev.auto_attach = 0;
 645         } else {
 646             autostart = 0;
 647         }
 648     }
 649 }
 650
 651 static void usb_msd_realize_bot(USBDevice *dev, Error **errp)
 652 {
 653     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 654
 655     usb_desc_create_serial(dev);
 656     usb_desc_init(dev);
 657     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
 658                  &usb_msd_scsi_info_bot, NULL);
 659     s->bus.qbus.allow_hotplug = 0;
 660     usb_msd_handle_reset(dev);
 661 }
 662
 663 static USBDevice *usb_msd_init(USBBus *bus, const char *filename)
 664 {
 665     static int nr=0;
 666     char id[8];
 667     QemuOpts *opts;
 668     DriveInfo *dinfo;
 669     USBDevice *dev;
 670     const char *p1;
 671     char fmt[32];
 672
 673     /* parse -usbdevice disk: syntax into drive opts */
 674     do {
 675         snprintf(id, sizeof(id), "usb%d", nr++);
 676         opts = qemu_opts_create(qemu_find_opts("drive"), id, 1, NULL);
 677     } while (!opts);
 678
 679     p1 = strchr(filename, ':');
 680     if (p1++) {
 681         const char *p2;
 682
 683         if (strstart(filename, "format=", &p2)) {
 684             int len = MIN(p1 - p2, sizeof(fmt));
 685             pstrcpy(fmt, len, p2);
 686             qemu_opt_set(opts, "format", fmt);
 687         } else if (*filename != ':') {
 688             error_report("unrecognized USB mass-storage option %s", filename);
 689             return NULL;
 690         }
 691         filename = p1;
 692     }
 693     if (!*filename) {
 694         error_report("block device specification needed");
 695         return NULL;
 696     }
 697     qemu_opt_set(opts, "file", filename);
 698     qemu_opt_set(opts, "if", "none");
 699
 700     /* create host drive */
 701     dinfo = drive_new(opts, 0);
 702     if (!dinfo) {
 703         qemu_opts_del(opts);
 704         return NULL;
 705     }
 706
 707     /* create guest device */
 708     dev = usb_create(bus, "usb-storage");
 709     if (!dev) {
 710         return NULL;
 711     }
 712     if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
 713         object_unparent(OBJECT(dev));
 714         return NULL;
 715     }
 716     if (qdev_init(&dev->qdev) < 0)
 717         return NULL;
 718
 719     return dev;
 720 }
 721
 722 static const VMStateDescription vmstate_usb_msd = {
 723     .name = "usb-storage",
 724     .version_id = 1,
 725     .minimum_version_id = 1,
 726     .fields = (VMStateField[]) {
 727         VMSTATE_USB_DEVICE(dev, MSDState),
 728         VMSTATE_UINT32(mode, MSDState),
 729         VMSTATE_UINT32(scsi_len, MSDState),
 730         VMSTATE_UINT32(scsi_off, MSDState),
 731         VMSTATE_UINT32(data_len, MSDState),
 732         VMSTATE_UINT32(csw.sig, MSDState),
 733         VMSTATE_UINT32(csw.tag, MSDState),
 734         VMSTATE_UINT32(csw.residue, MSDState),
 735         VMSTATE_UINT8(csw.status, MSDState),
 736         VMSTATE_END_OF_LIST()
 737     }
 738 };
 739
 740 static Property msd_properties[] = {
 741     DEFINE_BLOCK_PROPERTIES(MSDState, conf),
 742     DEFINE_PROP_BIT("removable", MSDState, removable, 0, false),
 743     DEFINE_PROP_END_OF_LIST(),
 744 };
 745
 746 static void usb_msd_class_initfn_common(ObjectClass *klass)
 747 {
 748     DeviceClass *dc = DEVICE_CLASS(klass);
 749     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 750
 751     uc->product_desc   = "QEMU USB MSD";
 752     uc->usb_desc       = &desc;
 753     uc->cancel_packet  = usb_msd_cancel_io;
 754     uc->handle_attach  = usb_desc_attach;
 755     uc->handle_reset   = usb_msd_handle_reset;
 756     uc->handle_control = usb_msd_handle_control;
 757     uc->handle_data    = usb_msd_handle_data;
 758     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 759     dc->fw_name = "storage";
 760     dc->vmsd = &vmstate_usb_msd;
 761 }
 762
 763 static void usb_msd_class_initfn_storage(ObjectClass *klass, void *data)
 764 {
 765     DeviceClass *dc = DEVICE_CLASS(klass);
 766     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 767
 768     uc->realize = usb_msd_realize_storage;
 769     dc->props = msd_properties;
 770     usb_msd_class_initfn_common(klass);
 771 }
 772
 773 static void usb_msd_get_bootindex(Object *obj, Visitor *v, void *opaque,
 774                                   const char *name, Error **errp)
 775 {
 776     USBDevice *dev = USB_DEVICE(obj);
 777     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 778
 779     visit_type_int32(v, &s->conf.bootindex, name, errp);
 780 }
 781
 782 static void usb_msd_set_bootindex(Object *obj, Visitor *v, void *opaque,
 783                                   const char *name, Error **errp)
 784 {
 785     USBDevice *dev = USB_DEVICE(obj);
 786     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 787     int32_t boot_index;
 788     Error *local_err = NULL;
 789
 790     visit_type_int32(v, &boot_index, name, &local_err);
 791     if (local_err) {
 792         goto out;
 793     }
 794     /* check whether bootindex is present in fw_boot_order list  */
 795     check_boot_index(boot_index, &local_err);
 796     if (local_err) {
 797         goto out;
 798     }
 799     /* change bootindex to a new one */
 800     s->conf.bootindex = boot_index;
 801
 802     if (s->scsi_dev) {
 803         object_property_set_int(OBJECT(s->scsi_dev), boot_index, "bootindex",
 804                                 &error_abort);
 805     }
 806
 807 out:
 808     if (local_err) {
 809         error_propagate(errp, local_err);
 810     }
 811 }
 812
 813 static void usb_msd_instance_init(Object *obj)
 814 {
 815     object_property_add(obj, "bootindex", "int32",
 816                         usb_msd_get_bootindex,
 817                         usb_msd_set_bootindex, NULL, NULL, NULL);
 818     object_property_set_int(obj, -1, "bootindex", NULL);
 819 }
 820
 821 static void usb_msd_class_initfn_bot(ObjectClass *klass, void *data)
 822 {
 823     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 824
 825     uc->realize = usb_msd_realize_bot;
 826     usb_msd_class_initfn_common(klass);
 827 }
 828
 829 static const TypeInfo msd_info = {
 830     .name          = "usb-storage",
 831     .parent        = TYPE_USB_DEVICE,
 832     .instance_size = sizeof(MSDState),
 833     .class_init    = usb_msd_class_initfn_storage,
 834     .instance_init = usb_msd_instance_init,
 835 };
 836
 837 static const TypeInfo bot_info = {
 838     .name          = "usb-bot",
 839     .parent        = TYPE_USB_DEVICE,
 840     .instance_size = sizeof(MSDState),
 841     .class_init    = usb_msd_class_initfn_bot,
 842 };
 843
 844 static void usb_msd_register_types(void)
 845 {
 846     type_register_static(&msd_info);
 847     type_register_static(&bot_info);
 848     usb_legacy_register("usb-storage", "disk", usb_msd_init);
 849 }
 850
 851 type_init(usb_msd_register_types)