hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu-option.h"
  12 #include "qemu-config.h"
  13 #include "usb.h"
  14 #include "usb-desc.h"
  15 #include "scsi.h"
  16 #include "console.h"
  17 #include "monitor.h"
  18 #include "sysemu.h"
  19 #include "blockdev.h"
  20
  21 //#define DEBUG_MSD
  22
  23 #ifdef DEBUG_MSD
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  26 #else
  27 #define DPRINTF(fmt, ...) do {} while(0)
  28 #endif
  29
  30 /* USB requests.  */
  31 #define MassStorageReset  0xff
  32 #define GetMaxLun         0xfe
  33
  34 enum USBMSDMode {
  35     USB_MSDM_CBW, /* Command Block.  */
  36     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  37     USB_MSDM_DATAIN, /* Transfer data from device.  */
  38     USB_MSDM_CSW /* Command Status.  */
  39 };
  40
  41 typedef struct {
  42     USBDevice dev;
  43     enum USBMSDMode mode;
  44     uint32_t scsi_len;
  45     uint8_t *scsi_buf;
  46     uint32_t usb_len;
  47     uint8_t *usb_buf;
  48     uint32_t data_len;
  49     uint32_t residue;
  50     uint32_t tag;
  51     SCSIBus bus;
  52     BlockConf conf;
  53     SCSIDevice *scsi_dev;
  54     int result;
  55     /* For async completion.  */
  56     USBPacket *packet;
  57 } MSDState;
  58
  59 struct usb_msd_cbw {
  60     uint32_t sig;
  61     uint32_t tag;
  62     uint32_t data_len;
  63     uint8_t flags;
  64     uint8_t lun;
  65     uint8_t cmd_len;
  66     uint8_t cmd[16];
  67 };
  68
  69 struct usb_msd_csw {
  70     uint32_t sig;
  71     uint32_t tag;
  72     uint32_t residue;
  73     uint8_t status;
  74 };
  75
  76 enum {
  77     STR_MANUFACTURER = 1,
  78     STR_PRODUCT,
  79     STR_SERIALNUMBER,
  80     STR_CONFIG_FULL,
  81     STR_CONFIG_HIGH,
  82 };
  83
  84 static const USBDescStrings desc_strings = {
  85     [STR_MANUFACTURER] = "QEMU " QEMU_VERSION,
  86     [STR_PRODUCT]      = "QEMU USB HARDDRIVE",
  87     [STR_SERIALNUMBER] = "1",
  88     [STR_CONFIG_FULL]  = "Full speed config (usb 1.1)",
  89     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
  90 };
  91
  92 static const USBDescIface desc_iface_full = {
  93     .bInterfaceNumber              = 0,
  94     .bNumEndpoints                 = 2,
  95     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
  96     .bInterfaceSubClass            = 0x06, /* SCSI */
  97     .bInterfaceProtocol            = 0x50, /* Bulk */
  98     .eps = (USBDescEndpoint[]) {
  99         {
 100             .bEndpointAddress      = USB_DIR_IN | 0x01,
 101             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 102             .wMaxPacketSize        = 64,
 103         },{
 104             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 105             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 106             .wMaxPacketSize        = 64,
 107         },
 108     }
 109 };
 110
 111 static const USBDescDevice desc_device_full = {
 112     .bcdUSB                        = 0x0200,
 113     .bMaxPacketSize0               = 8,
 114     .bNumConfigurations            = 1,
 115     .confs = (USBDescConfig[]) {
 116         {
 117             .bNumInterfaces        = 1,
 118             .bConfigurationValue   = 1,
 119             .iConfiguration        = STR_CONFIG_FULL,
 120             .bmAttributes          = 0xc0,
 121             .ifs = &desc_iface_full,
 122         },
 123     },
 124 };
 125
 126 static const USBDescIface desc_iface_high = {
 127     .bInterfaceNumber              = 0,
 128     .bNumEndpoints                 = 2,
 129     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 130     .bInterfaceSubClass            = 0x06, /* SCSI */
 131     .bInterfaceProtocol            = 0x50, /* Bulk */
 132     .eps = (USBDescEndpoint[]) {
 133         {
 134             .bEndpointAddress      = USB_DIR_IN | 0x01,
 135             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 136             .wMaxPacketSize        = 512,
 137         },{
 138             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 139             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 140             .wMaxPacketSize        = 512,
 141         },
 142     }
 143 };
 144
 145 static const USBDescDevice desc_device_high = {
 146     .bcdUSB                        = 0x0200,
 147     .bMaxPacketSize0               = 64,
 148     .bNumConfigurations            = 1,
 149     .confs = (USBDescConfig[]) {
 150         {
 151             .bNumInterfaces        = 1,
 152             .bConfigurationValue   = 1,
 153             .iConfiguration        = STR_CONFIG_HIGH,
 154             .bmAttributes          = 0xc0,
 155             .ifs = &desc_iface_high,
 156         },
 157     },
 158 };
 159
 160 static const USBDesc desc = {
 161     .id = {
 162         .idVendor          = 0,
 163         .idProduct         = 0,
 164         .bcdDevice         = 0,
 165         .iManufacturer     = STR_MANUFACTURER,
 166         .iProduct          = STR_PRODUCT,
 167         .iSerialNumber     = STR_SERIALNUMBER,
 168     },
 169     .full = &desc_device_full,
 170     .high = &desc_device_high,
 171     .str  = desc_strings,
 172 };
 173
 174 static void usb_msd_copy_data(MSDState *s)
 175 {
 176     uint32_t len;
 177     len = s->usb_len;
 178     if (len > s->scsi_len)
 179         len = s->scsi_len;
 180     if (s->mode == USB_MSDM_DATAIN) {
 181         memcpy(s->usb_buf, s->scsi_buf, len);
 182     } else {
 183         memcpy(s->scsi_buf, s->usb_buf, len);
 184     }
 185     s->usb_len -= len;
 186     s->scsi_len -= len;
 187     s->usb_buf += len;
 188     s->scsi_buf += len;
 189     s->data_len -= len;
 190     if (s->scsi_len == 0 || s->data_len == 0) {
 191         if (s->mode == USB_MSDM_DATAIN) {
 192             s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 193         } else if (s->mode == USB_MSDM_DATAOUT) {
 194             s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 195         }
 196     }
 197 }
 198
 199 static void usb_msd_send_status(MSDState *s, USBPacket *p)
 200 {
 201     struct usb_msd_csw csw;
 202     int len;
 203
 204     csw.sig = cpu_to_le32(0x53425355);
 205     csw.tag = cpu_to_le32(s->tag);
 206     csw.residue = s->residue;
 207     csw.status = s->result;
 208
 209     len = MIN(sizeof(csw), p->len);
 210     memcpy(p->data, &csw, len);
 211 }
 212
 213 static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 214                                      uint32_t arg)
 215 {
 216     MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
 217     USBPacket *p = s->packet;
 218
 219     if (tag != s->tag) {
 220         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
 221     }
 222     if (reason == SCSI_REASON_DONE) {
 223         DPRINTF("Command complete %d\n", arg);
 224         s->residue = s->data_len;
 225         s->result = arg != 0;
 226         if (s->packet) {
 227             if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 228                 /* A deferred packet with no write data remaining must be
 229                    the status read packet.  */
 230                 usb_msd_send_status(s, p);
 231                 s->mode = USB_MSDM_CBW;
 232             } else {
 233                 if (s->data_len) {
 234                     s->data_len -= s->usb_len;
 235                     if (s->mode == USB_MSDM_DATAIN)
 236                         memset(s->usb_buf, 0, s->usb_len);
 237                     s->usb_len = 0;
 238                 }
 239                 if (s->data_len == 0)
 240                     s->mode = USB_MSDM_CSW;
 241             }
 242             s->packet = NULL;
 243             usb_packet_complete(p);
 244         } else if (s->data_len == 0) {
 245             s->mode = USB_MSDM_CSW;
 246         }
 247         return;
 248     }
 249     s->scsi_len = arg;
 250     s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
 251     if (p) {
 252         usb_msd_copy_data(s);
 253         if (s->usb_len == 0) {
 254             /* Set s->packet to NULL before calling usb_packet_complete
 255                because annother request may be issued before
 256                usb_packet_complete returns.  */
 257             DPRINTF("Packet complete %p\n", p);
 258             s->packet = NULL;
 259             usb_packet_complete(p);
 260         }
 261     }
 262 }
 263
 264 static void usb_msd_handle_reset(USBDevice *dev)
 265 {
 266     MSDState *s = (MSDState *)dev;
 267
 268     DPRINTF("Reset\n");
 269     s->mode = USB_MSDM_CBW;
 270 }
 271
 272 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 273                                   int index, int length, uint8_t *data)
 274 {
 275     MSDState *s = (MSDState *)dev;
 276     int ret;
 277
 278     ret = usb_desc_handle_control(dev, request, value, index, length, data);
 279     if (ret >= 0) {
 280         return ret;
 281     }
 282
 283     ret = 0;
 284     switch (request) {
 285     case DeviceRequest | USB_REQ_GET_INTERFACE:
 286         data[0] = 0;
 287         ret = 1;
 288         break;
 289     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 290         ret = 0;
 291         break;
 292     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 293         ret = 0;
 294         break;
 295     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
 296         ret = 0;
 297         break;
 298         /* Class specific requests.  */
 299     case ClassInterfaceOutRequest | MassStorageReset:
 300         /* Reset state ready for the next CBW.  */
 301         s->mode = USB_MSDM_CBW;
 302         ret = 0;
 303         break;
 304     case ClassInterfaceRequest | GetMaxLun:
 305         data[0] = 0;
 306         ret = 1;
 307         break;
 308     default:
 309         ret = USB_RET_STALL;
 310         break;
 311     }
 312     return ret;
 313 }
 314
 315 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 316 {
 317     MSDState *s = opaque;
 318     s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
 319     s->packet = NULL;
 320     s->scsi_len = 0;
 321 }
 322
 323 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 324 {
 325     MSDState *s = (MSDState *)dev;
 326     int ret = 0;
 327     struct usb_msd_cbw cbw;
 328     uint8_t devep = p->devep;
 329     uint8_t *data = p->data;
 330     int len = p->len;
 331
 332     switch (p->pid) {
 333     case USB_TOKEN_OUT:
 334         if (devep != 2)
 335             goto fail;
 336
 337         switch (s->mode) {
 338         case USB_MSDM_CBW:
 339             if (len != 31) {
 340                 fprintf(stderr, "usb-msd: Bad CBW size");
 341                 goto fail;
 342             }
 343             memcpy(&cbw, data, 31);
 344             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 345                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 346                         le32_to_cpu(cbw.sig));
 347                 goto fail;
 348             }
 349             DPRINTF("Command on LUN %d\n", cbw.lun);
 350             if (cbw.lun != 0) {
 351                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 352                 goto fail;
 353             }
 354             s->tag = le32_to_cpu(cbw.tag);
 355             s->data_len = le32_to_cpu(cbw.data_len);
 356             if (s->data_len == 0) {
 357                 s->mode = USB_MSDM_CSW;
 358             } else if (cbw.flags & 0x80) {
 359                 s->mode = USB_MSDM_DATAIN;
 360             } else {
 361                 s->mode = USB_MSDM_DATAOUT;
 362             }
 363             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 364                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 365             s->residue = 0;
 366             s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 367             /* ??? Should check that USB and SCSI data transfer
 368                directions match.  */
 369             if (s->residue == 0) {
 370                 if (s->mode == USB_MSDM_DATAIN) {
 371                     s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 372                 } else if (s->mode == USB_MSDM_DATAOUT) {
 373                     s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 374                 }
 375             }
 376             ret = len;
 377             break;
 378
 379         case USB_MSDM_DATAOUT:
 380             DPRINTF("Data out %d/%d\n", len, s->data_len);
 381             if (len > s->data_len)
 382                 goto fail;
 383
 384             s->usb_buf = data;
 385             s->usb_len = len;
 386             if (s->scsi_len) {
 387                 usb_msd_copy_data(s);
 388             }
 389             if (s->residue && s->usb_len) {
 390                 s->data_len -= s->usb_len;
 391                 if (s->data_len == 0)
 392                     s->mode = USB_MSDM_CSW;
 393                 s->usb_len = 0;
 394             }
 395             if (s->usb_len) {
 396                 DPRINTF("Deferring packet %p\n", p);
 397                 usb_defer_packet(p, usb_msd_cancel_io, s);
 398                 s->packet = p;
 399                 ret = USB_RET_ASYNC;
 400             } else {
 401                 ret = len;
 402             }
 403             break;
 404
 405         default:
 406             DPRINTF("Unexpected write (len %d)\n", len);
 407             goto fail;
 408         }
 409         break;
 410
 411     case USB_TOKEN_IN:
 412         if (devep != 1)
 413             goto fail;
 414
 415         switch (s->mode) {
 416         case USB_MSDM_DATAOUT:
 417             if (s->data_len != 0 || len < 13)
 418                 goto fail;
 419             /* Waiting for SCSI write to complete.  */
 420             usb_defer_packet(p, usb_msd_cancel_io, s);
 421             s->packet = p;
 422             ret = USB_RET_ASYNC;
 423             break;
 424
 425         case USB_MSDM_CSW:
 426             DPRINTF("Command status %d tag 0x%x, len %d\n",
 427                     s->result, s->tag, len);
 428             if (len < 13)
 429                 goto fail;
 430
 431             usb_msd_send_status(s, p);
 432             s->mode = USB_MSDM_CBW;
 433             ret = 13;
 434             break;
 435
 436         case USB_MSDM_DATAIN:
 437             DPRINTF("Data in %d/%d, scsi_len %d\n", len, s->data_len, s->scsi_len);
 438             if (len > s->data_len)
 439                 len = s->data_len;
 440             s->usb_buf = data;
 441             s->usb_len = len;
 442             if (s->scsi_len) {
 443                 usb_msd_copy_data(s);
 444             }
 445             if (s->residue && s->usb_len) {
 446                 s->data_len -= s->usb_len;
 447                 memset(s->usb_buf, 0, s->usb_len);
 448                 if (s->data_len == 0)
 449                     s->mode = USB_MSDM_CSW;
 450                 s->usb_len = 0;
 451             }
 452             if (s->usb_len) {
 453                 DPRINTF("Deferring packet %p\n", p);
 454                 usb_defer_packet(p, usb_msd_cancel_io, s);
 455                 s->packet = p;
 456                 ret = USB_RET_ASYNC;
 457             } else {
 458                 ret = len;
 459             }
 460             break;
 461
 462         default:
 463             DPRINTF("Unexpected read (len %d)\n", len);
 464             goto fail;
 465         }
 466         break;
 467
 468     default:
 469         DPRINTF("Bad token\n");
 470     fail:
 471         ret = USB_RET_STALL;
 472         break;
 473     }
 474
 475     return ret;
 476 }
 477
 478 static void usb_msd_password_cb(void *opaque, int err)
 479 {
 480     MSDState *s = opaque;
 481
 482     if (!err)
 483         usb_device_attach(&s->dev);
 484     else
 485         qdev_unplug(&s->dev.qdev);
 486 }
 487
 488 static int usb_msd_initfn(USBDevice *dev)
 489 {
 490     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 491     BlockDriverState *bs = s->conf.bs;
 492     DriveInfo *dinfo;
 493
 494     if (!bs) {
 495         error_report("usb-msd: drive property not set");
 496         return -1;
 497     }
 498
 499     /*
 500      * Hack alert: this pretends to be a block device, but it's really
 501      * a SCSI bus that can serve only a single device, which it
 502      * creates automatically.  But first it needs to detach from its
 503      * blockdev, or else scsi_bus_legacy_add_drive() dies when it
 504      * attaches again.
 505      *
 506      * The hack is probably a bad idea.
 507      */
 508     bdrv_detach(bs, &s->dev.qdev);
 509     s->conf.bs = NULL;
 510
 511     dinfo = drive_get_by_blockdev(bs);
 512     if (dinfo && dinfo->serial) {
 513         usb_desc_set_string(dev, STR_SERIALNUMBER, dinfo->serial);
 514     }
 515
 516     usb_desc_init(dev);
 517     scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
 518     s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
 519     if (!s->scsi_dev) {
 520         return -1;
 521     }
 522     s->bus.qbus.allow_hotplug = 0;
 523     usb_msd_handle_reset(dev);
 524
 525     if (bdrv_key_required(bs)) {
 526         if (cur_mon) {
 527             monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
 528             s->dev.auto_attach = 0;
 529         } else {
 530             autostart = 0;
 531         }
 532     }
 533
 534     return 0;
 535 }
 536
 537 static USBDevice *usb_msd_init(const char *filename)
 538 {
 539     static int nr=0;
 540     char id[8];
 541     QemuOpts *opts;
 542     DriveInfo *dinfo;
 543     USBDevice *dev;
 544     int fatal_error;
 545     const char *p1;
 546     char fmt[32];
 547
 548     /* parse -usbdevice disk: syntax into drive opts */
 549     snprintf(id, sizeof(id), "usb%d", nr++);
 550     opts = qemu_opts_create(qemu_find_opts("drive"), id, 0);
 551
 552     p1 = strchr(filename, ':');
 553     if (p1++) {
 554         const char *p2;
 555
 556         if (strstart(filename, "format=", &p2)) {
 557             int len = MIN(p1 - p2, sizeof(fmt));
 558             pstrcpy(fmt, len, p2);
 559             qemu_opt_set(opts, "format", fmt);
 560         } else if (*filename != ':') {
 561             printf("unrecognized USB mass-storage option %s\n", filename);
 562             return NULL;
 563         }
 564         filename = p1;
 565     }
 566     if (!*filename) {
 567         printf("block device specification needed\n");
 568         return NULL;
 569     }
 570     qemu_opt_set(opts, "file", filename);
 571     qemu_opt_set(opts, "if", "none");
 572
 573     /* create host drive */
 574     dinfo = drive_init(opts, 0, &fatal_error);
 575     if (!dinfo) {
 576         qemu_opts_del(opts);
 577         return NULL;
 578     }
 579
 580     /* create guest device */
 581     dev = usb_create(NULL /* FIXME */, "usb-storage");
 582     if (!dev) {
 583         return NULL;
 584     }
 585     if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
 586         qdev_free(&dev->qdev);
 587         return NULL;
 588     }
 589     if (qdev_init(&dev->qdev) < 0)
 590         return NULL;
 591
 592     return dev;
 593 }
 594
 595 static struct USBDeviceInfo msd_info = {
 596     .product_desc   = "QEMU USB MSD",
 597     .qdev.name      = "usb-storage",
 598     .qdev.size      = sizeof(MSDState),
 599     .usb_desc       = &desc,
 600     .init           = usb_msd_initfn,
 601     .handle_packet  = usb_generic_handle_packet,
 602     .handle_attach  = usb_desc_attach,
 603     .handle_reset   = usb_msd_handle_reset,
 604     .handle_control = usb_msd_handle_control,
 605     .handle_data    = usb_msd_handle_data,
 606     .usbdevice_name = "disk",
 607     .usbdevice_init = usb_msd_init,
 608     .qdev.props     = (Property[]) {
 609         DEFINE_BLOCK_PROPERTIES(MSDState, conf),
 610         DEFINE_PROP_END_OF_LIST(),
 611     },
 612 };
 613
 614 static void usb_msd_register_devices(void)
 615 {
 616     usb_qdev_register(&msd_info);
 617 }
 618 device_init(usb_msd_register_devices)