2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu-common.h"
11 #include "qemu-option.h"
12 #include "qemu-config.h"
24 #define DPRINTF(fmt, ...) \
25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
27 #define DPRINTF(fmt, ...) do {} while(0)
31 #define MassStorageReset 0xff
32 #define GetMaxLun 0xfe
35 USB_MSDM_CBW
, /* Command Block. */
36 USB_MSDM_DATAOUT
, /* Transfer data to device. */
37 USB_MSDM_DATAIN
, /* Transfer data from device. */
38 USB_MSDM_CSW
/* Command Status. */
56 /* For async completion. */
85 static const USBDescStrings desc_strings
= {
86 [STR_MANUFACTURER
] = "QEMU " QEMU_VERSION
,
87 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
88 [STR_SERIALNUMBER
] = "1",
89 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
90 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
93 static const USBDescIface desc_iface_full
= {
94 .bInterfaceNumber
= 0,
96 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
97 .bInterfaceSubClass
= 0x06, /* SCSI */
98 .bInterfaceProtocol
= 0x50, /* Bulk */
99 .eps
= (USBDescEndpoint
[]) {
101 .bEndpointAddress
= USB_DIR_IN
| 0x01,
102 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
103 .wMaxPacketSize
= 64,
105 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
106 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
107 .wMaxPacketSize
= 64,
112 static const USBDescDevice desc_device_full
= {
114 .bMaxPacketSize0
= 8,
115 .bNumConfigurations
= 1,
116 .confs
= (USBDescConfig
[]) {
119 .bConfigurationValue
= 1,
120 .iConfiguration
= STR_CONFIG_FULL
,
121 .bmAttributes
= 0xc0,
123 .ifs
= &desc_iface_full
,
128 static const USBDescIface desc_iface_high
= {
129 .bInterfaceNumber
= 0,
131 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
132 .bInterfaceSubClass
= 0x06, /* SCSI */
133 .bInterfaceProtocol
= 0x50, /* Bulk */
134 .eps
= (USBDescEndpoint
[]) {
136 .bEndpointAddress
= USB_DIR_IN
| 0x01,
137 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
138 .wMaxPacketSize
= 512,
140 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
141 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
142 .wMaxPacketSize
= 512,
147 static const USBDescDevice desc_device_high
= {
149 .bMaxPacketSize0
= 64,
150 .bNumConfigurations
= 1,
151 .confs
= (USBDescConfig
[]) {
154 .bConfigurationValue
= 1,
155 .iConfiguration
= STR_CONFIG_HIGH
,
156 .bmAttributes
= 0xc0,
158 .ifs
= &desc_iface_high
,
163 static const USBDesc desc
= {
168 .iManufacturer
= STR_MANUFACTURER
,
169 .iProduct
= STR_PRODUCT
,
170 .iSerialNumber
= STR_SERIALNUMBER
,
172 .full
= &desc_device_full
,
173 .high
= &desc_device_high
,
177 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
180 len
= p
->iov
.size
- p
->result
;
181 if (len
> s
->scsi_len
)
183 usb_packet_copy(p
, s
->scsi_buf
, len
);
187 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
188 scsi_req_continue(s
->req
);
192 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
194 struct usb_msd_csw csw
;
197 csw
.sig
= cpu_to_le32(0x53425355);
198 csw
.tag
= cpu_to_le32(s
->tag
);
199 csw
.residue
= s
->residue
;
200 csw
.status
= s
->result
;
202 len
= MIN(sizeof(csw
), p
->iov
.size
);
203 usb_packet_copy(p
, &csw
, len
);
207 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
209 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
210 USBPacket
*p
= s
->packet
;
212 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
214 s
->scsi_buf
= scsi_req_get_buf(req
);
216 usb_msd_copy_data(s
, p
);
218 if (p
&& p
->result
== p
->iov
.size
) {
219 /* Set s->packet to NULL before calling usb_packet_complete
220 because another request may be issued before
221 usb_packet_complete returns. */
222 DPRINTF("Packet complete %p\n", p
);
224 usb_packet_complete(&s
->dev
, p
);
229 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
)
231 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
232 USBPacket
*p
= s
->packet
;
234 DPRINTF("Command complete %d\n", status
);
235 s
->residue
= s
->data_len
;
236 s
->result
= status
!= 0;
238 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
239 /* A deferred packet with no write data remaining must be
240 the status read packet. */
241 usb_msd_send_status(s
, p
);
242 s
->mode
= USB_MSDM_CBW
;
245 int len
= (p
->iov
.size
- p
->result
);
246 usb_packet_skip(p
, len
);
249 if (s
->data_len
== 0) {
250 s
->mode
= USB_MSDM_CSW
;
254 usb_packet_complete(&s
->dev
, p
);
255 } else if (s
->data_len
== 0) {
256 s
->mode
= USB_MSDM_CSW
;
262 static void usb_msd_request_cancelled(SCSIRequest
*req
)
264 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
267 scsi_req_unref(s
->req
);
274 static void usb_msd_handle_reset(USBDevice
*dev
)
276 MSDState
*s
= (MSDState
*)dev
;
279 s
->mode
= USB_MSDM_CBW
;
282 static int usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
283 int request
, int value
, int index
, int length
, uint8_t *data
)
285 MSDState
*s
= (MSDState
*)dev
;
288 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
295 case DeviceRequest
| USB_REQ_GET_INTERFACE
:
299 case DeviceOutRequest
| USB_REQ_SET_INTERFACE
:
302 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
305 case InterfaceOutRequest
| USB_REQ_SET_INTERFACE
:
308 /* Class specific requests. */
309 case ClassInterfaceOutRequest
| MassStorageReset
:
310 /* Reset state ready for the next CBW. */
311 s
->mode
= USB_MSDM_CBW
;
314 case ClassInterfaceRequest
| GetMaxLun
:
325 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
327 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
330 scsi_req_cancel(s
->req
);
334 static int usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
336 MSDState
*s
= (MSDState
*)dev
;
338 struct usb_msd_cbw cbw
;
339 uint8_t devep
= p
->devep
;
348 if (p
->iov
.size
!= 31) {
349 fprintf(stderr
, "usb-msd: Bad CBW size");
352 usb_packet_copy(p
, &cbw
, 31);
353 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
354 fprintf(stderr
, "usb-msd: Bad signature %08x\n",
355 le32_to_cpu(cbw
.sig
));
358 DPRINTF("Command on LUN %d\n", cbw
.lun
);
360 fprintf(stderr
, "usb-msd: Bad LUN %d\n", cbw
.lun
);
363 s
->tag
= le32_to_cpu(cbw
.tag
);
364 s
->data_len
= le32_to_cpu(cbw
.data_len
);
365 if (s
->data_len
== 0) {
366 s
->mode
= USB_MSDM_CSW
;
367 } else if (cbw
.flags
& 0x80) {
368 s
->mode
= USB_MSDM_DATAIN
;
370 s
->mode
= USB_MSDM_DATAOUT
;
372 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
373 s
->tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
376 s
->req
= scsi_req_new(s
->scsi_dev
, s
->tag
, 0, cbw
.cmd
, NULL
);
377 scsi_req_enqueue(s
->req
);
378 /* ??? Should check that USB and SCSI data transfer
380 if (s
->mode
!= USB_MSDM_CSW
&& s
->residue
== 0) {
381 scsi_req_continue(s
->req
);
386 case USB_MSDM_DATAOUT
:
387 DPRINTF("Data out %zd/%d\n", p
->iov
.size
, s
->data_len
);
388 if (p
->iov
.size
> s
->data_len
) {
393 usb_msd_copy_data(s
, p
);
396 int len
= p
->iov
.size
- p
->result
;
398 usb_packet_skip(p
, len
);
400 if (s
->data_len
== 0) {
401 s
->mode
= USB_MSDM_CSW
;
405 if (p
->result
< p
->iov
.size
) {
406 DPRINTF("Deferring packet %p\n", p
);
415 DPRINTF("Unexpected write (len %zd)\n", p
->iov
.size
);
425 case USB_MSDM_DATAOUT
:
426 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
429 /* Waiting for SCSI write to complete. */
435 DPRINTF("Command status %d tag 0x%x, len %zd\n",
436 s
->result
, s
->tag
, p
->iov
.size
);
437 if (p
->iov
.size
< 13) {
441 usb_msd_send_status(s
, p
);
442 s
->mode
= USB_MSDM_CBW
;
446 case USB_MSDM_DATAIN
:
447 DPRINTF("Data in %zd/%d, scsi_len %d\n",
448 p
->iov
.size
, s
->data_len
, s
->scsi_len
);
450 usb_msd_copy_data(s
, p
);
453 int len
= p
->iov
.size
- p
->result
;
455 usb_packet_skip(p
, len
);
457 if (s
->data_len
== 0) {
458 s
->mode
= USB_MSDM_CSW
;
462 if (p
->result
< p
->iov
.size
) {
463 DPRINTF("Deferring packet %p\n", p
);
472 DPRINTF("Unexpected read (len %zd)\n", p
->iov
.size
);
478 DPRINTF("Bad token\n");
487 static void usb_msd_password_cb(void *opaque
, int err
)
489 MSDState
*s
= opaque
;
492 err
= usb_device_attach(&s
->dev
);
495 qdev_unplug(&s
->dev
.qdev
);
498 static const struct SCSIBusInfo usb_msd_scsi_info
= {
502 .transfer_data
= usb_msd_transfer_data
,
503 .complete
= usb_msd_command_complete
,
504 .cancel
= usb_msd_request_cancelled
507 static int usb_msd_initfn(USBDevice
*dev
)
509 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
510 BlockDriverState
*bs
= s
->conf
.bs
;
514 error_report("usb-msd: drive property not set");
519 * Hack alert: this pretends to be a block device, but it's really
520 * a SCSI bus that can serve only a single device, which it
521 * creates automatically. But first it needs to detach from its
522 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
525 * The hack is probably a bad idea.
527 bdrv_detach_dev(bs
, &s
->dev
.qdev
);
531 /* try to fall back to value set with legacy -drive serial=... */
532 dinfo
= drive_get_by_blockdev(bs
);
533 if (*dinfo
->serial
) {
534 s
->serial
= strdup(dinfo
->serial
);
538 usb_desc_set_string(dev
, STR_SERIALNUMBER
, s
->serial
);
542 scsi_bus_new(&s
->bus
, &s
->dev
.qdev
, &usb_msd_scsi_info
);
543 s
->scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, bs
, 0, !!s
->removable
);
547 s
->bus
.qbus
.allow_hotplug
= 0;
548 usb_msd_handle_reset(dev
);
550 if (bdrv_key_required(bs
)) {
552 monitor_read_bdrv_key_start(cur_mon
, bs
, usb_msd_password_cb
, s
);
553 s
->dev
.auto_attach
= 0;
559 add_boot_device_path(s
->conf
.bootindex
, &dev
->qdev
, "/disk@0,0");
563 static USBDevice
*usb_msd_init(const char *filename
)
573 /* parse -usbdevice disk: syntax into drive opts */
574 snprintf(id
, sizeof(id
), "usb%d", nr
++);
575 opts
= qemu_opts_create(qemu_find_opts("drive"), id
, 0);
577 p1
= strchr(filename
, ':');
581 if (strstart(filename
, "format=", &p2
)) {
582 int len
= MIN(p1
- p2
, sizeof(fmt
));
583 pstrcpy(fmt
, len
, p2
);
584 qemu_opt_set(opts
, "format", fmt
);
585 } else if (*filename
!= ':') {
586 printf("unrecognized USB mass-storage option %s\n", filename
);
592 printf("block device specification needed\n");
595 qemu_opt_set(opts
, "file", filename
);
596 qemu_opt_set(opts
, "if", "none");
598 /* create host drive */
599 dinfo
= drive_init(opts
, 0);
605 /* create guest device */
606 dev
= usb_create(NULL
/* FIXME */, "usb-storage");
610 if (qdev_prop_set_drive(&dev
->qdev
, "drive", dinfo
->bdrv
) < 0) {
611 qdev_free(&dev
->qdev
);
614 if (qdev_init(&dev
->qdev
) < 0)
620 static const VMStateDescription vmstate_usb_msd
= {
621 .name
= "usb-storage",
622 .unmigratable
= 1, /* FIXME: handle transactions which are in flight */
624 .minimum_version_id
= 1,
625 .fields
= (VMStateField
[]) {
626 VMSTATE_USB_DEVICE(dev
, MSDState
),
627 VMSTATE_END_OF_LIST()
631 static struct USBDeviceInfo msd_info
= {
632 .product_desc
= "QEMU USB MSD",
633 .qdev
.name
= "usb-storage",
634 .qdev
.fw_name
= "storage",
635 .qdev
.size
= sizeof(MSDState
),
636 .qdev
.vmsd
= &vmstate_usb_msd
,
638 .init
= usb_msd_initfn
,
639 .handle_packet
= usb_generic_handle_packet
,
640 .cancel_packet
= usb_msd_cancel_io
,
641 .handle_attach
= usb_desc_attach
,
642 .handle_reset
= usb_msd_handle_reset
,
643 .handle_control
= usb_msd_handle_control
,
644 .handle_data
= usb_msd_handle_data
,
645 .usbdevice_name
= "disk",
646 .usbdevice_init
= usb_msd_init
,
647 .qdev
.props
= (Property
[]) {
648 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
649 DEFINE_PROP_STRING("serial", MSDState
, serial
),
650 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
651 DEFINE_PROP_END_OF_LIST(),
655 static void usb_msd_register_devices(void)
657 usb_qdev_register(&msd_info
);
659 device_init(usb_msd_register_devices
)