2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 #include "qemu-common.h"
11 #include "qemu-option.h"
12 #include "qemu-config.h"
24 #define DPRINTF(fmt, ...) \
25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
27 #define DPRINTF(fmt, ...) do {} while(0)
31 #define MassStorageReset 0xff
32 #define GetMaxLun 0xfe
35 USB_MSDM_CBW
, /* Command Block. */
36 USB_MSDM_DATAOUT
, /* Tranfer data to device. */
37 USB_MSDM_DATAIN
, /* Transfer data from device. */
38 USB_MSDM_CSW
/* Command Status. */
55 /* For async completion. */
82 static const USBDescStrings desc_strings
= {
83 [STR_MANUFACTURER
] = "QEMU " QEMU_VERSION
,
84 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
85 [STR_SERIALNUMBER
] = "1",
88 static const USBDescIface desc_iface0
= {
89 .bInterfaceNumber
= 0,
91 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
92 .bInterfaceSubClass
= 0x06, /* SCSI */
93 .bInterfaceProtocol
= 0x50, /* Bulk */
94 .eps
= (USBDescEndpoint
[]) {
96 .bEndpointAddress
= USB_DIR_IN
| 0x01,
97 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
100 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
101 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
102 .wMaxPacketSize
= 64,
107 static const USBDescDevice desc_device
= {
109 .bMaxPacketSize0
= 8,
110 .bNumConfigurations
= 1,
111 .confs
= (USBDescConfig
[]) {
114 .bConfigurationValue
= 1,
115 .bmAttributes
= 0xc0,
121 static const USBDesc desc
= {
126 .iManufacturer
= STR_MANUFACTURER
,
127 .iProduct
= STR_PRODUCT
,
128 .iSerialNumber
= STR_SERIALNUMBER
,
130 .full
= &desc_device
,
134 static void usb_msd_copy_data(MSDState
*s
)
138 if (len
> s
->scsi_len
)
140 if (s
->mode
== USB_MSDM_DATAIN
) {
141 memcpy(s
->usb_buf
, s
->scsi_buf
, len
);
143 memcpy(s
->scsi_buf
, s
->usb_buf
, len
);
150 if (s
->scsi_len
== 0) {
151 if (s
->mode
== USB_MSDM_DATAIN
) {
152 s
->scsi_dev
->info
->read_data(s
->scsi_dev
, s
->tag
);
153 } else if (s
->mode
== USB_MSDM_DATAOUT
) {
154 s
->scsi_dev
->info
->write_data(s
->scsi_dev
, s
->tag
);
159 static void usb_msd_send_status(MSDState
*s
)
161 struct usb_msd_csw csw
;
163 csw
.sig
= cpu_to_le32(0x53425355);
164 csw
.tag
= cpu_to_le32(s
->tag
);
165 csw
.residue
= s
->residue
;
166 csw
.status
= s
->result
;
167 memcpy(s
->usb_buf
, &csw
, 13);
170 static void usb_msd_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
173 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, bus
->qbus
.parent
);
174 USBPacket
*p
= s
->packet
;
177 fprintf(stderr
, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag
);
179 if (reason
== SCSI_REASON_DONE
) {
180 DPRINTF("Command complete %d\n", arg
);
181 s
->residue
= s
->data_len
;
182 s
->result
= arg
!= 0;
184 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
185 /* A deferred packet with no write data remaining must be
186 the status read packet. */
187 usb_msd_send_status(s
);
188 s
->mode
= USB_MSDM_CBW
;
191 s
->data_len
-= s
->usb_len
;
192 if (s
->mode
== USB_MSDM_DATAIN
)
193 memset(s
->usb_buf
, 0, s
->usb_len
);
196 if (s
->data_len
== 0)
197 s
->mode
= USB_MSDM_CSW
;
200 usb_packet_complete(p
);
201 } else if (s
->data_len
== 0) {
202 s
->mode
= USB_MSDM_CSW
;
207 s
->scsi_buf
= s
->scsi_dev
->info
->get_buf(s
->scsi_dev
, tag
);
209 usb_msd_copy_data(s
);
210 if (s
->usb_len
== 0) {
211 /* Set s->packet to NULL before calling usb_packet_complete
212 because annother request may be issued before
213 usb_packet_complete returns. */
214 DPRINTF("Packet complete %p\n", p
);
216 usb_packet_complete(p
);
221 static void usb_msd_handle_reset(USBDevice
*dev
)
223 MSDState
*s
= (MSDState
*)dev
;
226 s
->mode
= USB_MSDM_CBW
;
229 static int usb_msd_handle_control(USBDevice
*dev
, int request
, int value
,
230 int index
, int length
, uint8_t *data
)
232 MSDState
*s
= (MSDState
*)dev
;
235 ret
= usb_desc_handle_control(dev
, request
, value
, index
, length
, data
);
242 case DeviceRequest
| USB_REQ_GET_STATUS
:
243 data
[0] = (1 << USB_DEVICE_SELF_POWERED
) |
244 (dev
->remote_wakeup
<< USB_DEVICE_REMOTE_WAKEUP
);
248 case DeviceOutRequest
| USB_REQ_CLEAR_FEATURE
:
249 if (value
== USB_DEVICE_REMOTE_WAKEUP
) {
250 dev
->remote_wakeup
= 0;
256 case DeviceOutRequest
| USB_REQ_SET_FEATURE
:
257 if (value
== USB_DEVICE_REMOTE_WAKEUP
) {
258 dev
->remote_wakeup
= 1;
264 case DeviceOutRequest
| USB_REQ_SET_ADDRESS
:
268 case DeviceRequest
| USB_REQ_GET_CONFIGURATION
:
272 case DeviceOutRequest
| USB_REQ_SET_CONFIGURATION
:
275 case DeviceRequest
| USB_REQ_GET_INTERFACE
:
279 case DeviceOutRequest
| USB_REQ_SET_INTERFACE
:
282 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
285 case InterfaceOutRequest
| USB_REQ_SET_INTERFACE
:
288 /* Class specific requests. */
289 case ClassInterfaceOutRequest
| MassStorageReset
:
290 /* Reset state ready for the next CBW. */
291 s
->mode
= USB_MSDM_CBW
;
294 case ClassInterfaceRequest
| GetMaxLun
:
306 static void usb_msd_cancel_io(USBPacket
*p
, void *opaque
)
308 MSDState
*s
= opaque
;
309 s
->scsi_dev
->info
->cancel_io(s
->scsi_dev
, s
->tag
);
314 static int usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
316 MSDState
*s
= (MSDState
*)dev
;
318 struct usb_msd_cbw cbw
;
319 uint8_t devep
= p
->devep
;
320 uint8_t *data
= p
->data
;
331 fprintf(stderr
, "usb-msd: Bad CBW size");
334 memcpy(&cbw
, data
, 31);
335 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
336 fprintf(stderr
, "usb-msd: Bad signature %08x\n",
337 le32_to_cpu(cbw
.sig
));
340 DPRINTF("Command on LUN %d\n", cbw
.lun
);
342 fprintf(stderr
, "usb-msd: Bad LUN %d\n", cbw
.lun
);
345 s
->tag
= le32_to_cpu(cbw
.tag
);
346 s
->data_len
= le32_to_cpu(cbw
.data_len
);
347 if (s
->data_len
== 0) {
348 s
->mode
= USB_MSDM_CSW
;
349 } else if (cbw
.flags
& 0x80) {
350 s
->mode
= USB_MSDM_DATAIN
;
352 s
->mode
= USB_MSDM_DATAOUT
;
354 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
355 s
->tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
357 s
->scsi_dev
->info
->send_command(s
->scsi_dev
, s
->tag
, cbw
.cmd
, 0);
358 /* ??? Should check that USB and SCSI data transfer
360 if (s
->residue
== 0) {
361 if (s
->mode
== USB_MSDM_DATAIN
) {
362 s
->scsi_dev
->info
->read_data(s
->scsi_dev
, s
->tag
);
363 } else if (s
->mode
== USB_MSDM_DATAOUT
) {
364 s
->scsi_dev
->info
->write_data(s
->scsi_dev
, s
->tag
);
370 case USB_MSDM_DATAOUT
:
371 DPRINTF("Data out %d/%d\n", len
, s
->data_len
);
372 if (len
> s
->data_len
)
378 usb_msd_copy_data(s
);
380 if (s
->residue
&& s
->usb_len
) {
381 s
->data_len
-= s
->usb_len
;
382 if (s
->data_len
== 0)
383 s
->mode
= USB_MSDM_CSW
;
387 DPRINTF("Deferring packet %p\n", p
);
388 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
397 DPRINTF("Unexpected write (len %d)\n", len
);
407 case USB_MSDM_DATAOUT
:
408 if (s
->data_len
!= 0 || len
< 13)
410 /* Waiting for SCSI write to complete. */
411 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
417 DPRINTF("Command status %d tag 0x%x, len %d\n",
418 s
->result
, s
->tag
, len
);
424 usb_msd_send_status(s
);
425 s
->mode
= USB_MSDM_CBW
;
429 case USB_MSDM_DATAIN
:
430 DPRINTF("Data in %d/%d\n", len
, s
->data_len
);
431 if (len
> s
->data_len
)
436 usb_msd_copy_data(s
);
438 if (s
->residue
&& s
->usb_len
) {
439 s
->data_len
-= s
->usb_len
;
440 memset(s
->usb_buf
, 0, s
->usb_len
);
441 if (s
->data_len
== 0)
442 s
->mode
= USB_MSDM_CSW
;
446 DPRINTF("Deferring packet %p\n", p
);
447 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
456 DPRINTF("Unexpected read (len %d)\n", len
);
462 DPRINTF("Bad token\n");
471 static void usb_msd_password_cb(void *opaque
, int err
)
473 MSDState
*s
= opaque
;
476 usb_device_attach(&s
->dev
);
478 qdev_unplug(&s
->dev
.qdev
);
481 static int usb_msd_initfn(USBDevice
*dev
)
483 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
484 BlockDriverState
*bs
= s
->conf
.bs
;
487 error_report("usb-msd: drive property not set");
492 * Hack alert: this pretends to be a block device, but it's really
493 * a SCSI bus that can serve only a single device, which it
494 * creates automatically. But first it needs to detach from its
495 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
498 * The hack is probably a bad idea.
500 bdrv_detach(bs
, &s
->dev
.qdev
);
503 s
->dev
.speed
= USB_SPEED_FULL
;
504 scsi_bus_new(&s
->bus
, &s
->dev
.qdev
, 0, 1, usb_msd_command_complete
);
505 s
->scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, bs
, 0);
509 s
->bus
.qbus
.allow_hotplug
= 0;
510 usb_msd_handle_reset(dev
);
512 if (bdrv_key_required(bs
)) {
514 monitor_read_bdrv_key_start(cur_mon
, bs
, usb_msd_password_cb
, s
);
515 s
->dev
.auto_attach
= 0;
524 static USBDevice
*usb_msd_init(const char *filename
)
535 /* parse -usbdevice disk: syntax into drive opts */
536 snprintf(id
, sizeof(id
), "usb%d", nr
++);
537 opts
= qemu_opts_create(qemu_find_opts("drive"), id
, 0);
539 p1
= strchr(filename
, ':');
543 if (strstart(filename
, "format=", &p2
)) {
544 int len
= MIN(p1
- p2
, sizeof(fmt
));
545 pstrcpy(fmt
, len
, p2
);
546 qemu_opt_set(opts
, "format", fmt
);
547 } else if (*filename
!= ':') {
548 printf("unrecognized USB mass-storage option %s\n", filename
);
554 printf("block device specification needed\n");
557 qemu_opt_set(opts
, "file", filename
);
558 qemu_opt_set(opts
, "if", "none");
560 /* create host drive */
561 dinfo
= drive_init(opts
, 0, &fatal_error
);
567 /* create guest device */
568 dev
= usb_create(NULL
/* FIXME */, "usb-storage");
572 if (qdev_prop_set_drive(&dev
->qdev
, "drive", dinfo
->bdrv
) < 0) {
573 qdev_free(&dev
->qdev
);
576 if (qdev_init(&dev
->qdev
) < 0)
582 static struct USBDeviceInfo msd_info
= {
583 .product_desc
= "QEMU USB MSD",
584 .qdev
.name
= "usb-storage",
585 .qdev
.size
= sizeof(MSDState
),
587 .init
= usb_msd_initfn
,
588 .handle_packet
= usb_generic_handle_packet
,
589 .handle_reset
= usb_msd_handle_reset
,
590 .handle_control
= usb_msd_handle_control
,
591 .handle_data
= usb_msd_handle_data
,
592 .usbdevice_name
= "disk",
593 .usbdevice_init
= usb_msd_init
,
594 .qdev
.props
= (Property
[]) {
595 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
596 DEFINE_PROP_END_OF_LIST(),
600 static void usb_msd_register_devices(void)
602 usb_qdev_register(&msd_info
);
604 device_init(usb_msd_register_devices
)