hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu-option.h"
  12 #include "qemu-config.h"
  13 #include "usb.h"
  14 #include "usb-desc.h"
  15 #include "scsi.h"
  16 #include "console.h"
  17 #include "monitor.h"
  18 #include "sysemu.h"
  19 #include "blockdev.h"
  20
  21 //#define DEBUG_MSD
  22
  23 #ifdef DEBUG_MSD
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  26 #else
  27 #define DPRINTF(fmt, ...) do {} while(0)
  28 #endif
  29
  30 /* USB requests.  */
  31 #define MassStorageReset  0xff
  32 #define GetMaxLun         0xfe
  33
  34 enum USBMSDMode {
  35     USB_MSDM_CBW, /* Command Block.  */
  36     USB_MSDM_DATAOUT, /* Transfer data to device.  */
  37     USB_MSDM_DATAIN, /* Transfer data from device.  */
  38     USB_MSDM_CSW /* Command Status.  */
  39 };
  40
  41 typedef struct {
  42     USBDevice dev;
  43     enum USBMSDMode mode;
  44     uint32_t scsi_len;
  45     uint8_t *scsi_buf;
  46     uint32_t usb_len;
  47     uint8_t *usb_buf;
  48     uint32_t data_len;
  49     uint32_t residue;
  50     uint32_t tag;
  51     SCSIRequest *req;
  52     SCSIBus bus;
  53     BlockConf conf;
  54     SCSIDevice *scsi_dev;
  55     uint32_t removable;
  56     int result;
  57     /* For async completion.  */
  58     USBPacket *packet;
  59 } MSDState;
  60
  61 struct usb_msd_cbw {
  62     uint32_t sig;
  63     uint32_t tag;
  64     uint32_t data_len;
  65     uint8_t flags;
  66     uint8_t lun;
  67     uint8_t cmd_len;
  68     uint8_t cmd[16];
  69 };
  70
  71 struct usb_msd_csw {
  72     uint32_t sig;
  73     uint32_t tag;
  74     uint32_t residue;
  75     uint8_t status;
  76 };
  77
  78 enum {
  79     STR_MANUFACTURER = 1,
  80     STR_PRODUCT,
  81     STR_SERIALNUMBER,
  82     STR_CONFIG_FULL,
  83     STR_CONFIG_HIGH,
  84 };
  85
  86 static const USBDescStrings desc_strings = {
  87     [STR_MANUFACTURER] = "QEMU " QEMU_VERSION,
  88     [STR_PRODUCT]      = "QEMU USB HARDDRIVE",
  89     [STR_SERIALNUMBER] = "1",
  90     [STR_CONFIG_FULL]  = "Full speed config (usb 1.1)",
  91     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
  92 };
  93
  94 static const USBDescIface desc_iface_full = {
  95     .bInterfaceNumber              = 0,
  96     .bNumEndpoints                 = 2,
  97     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
  98     .bInterfaceSubClass            = 0x06, /* SCSI */
  99     .bInterfaceProtocol            = 0x50, /* Bulk */
 100     .eps = (USBDescEndpoint[]) {
 101         {
 102             .bEndpointAddress      = USB_DIR_IN | 0x01,
 103             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 104             .wMaxPacketSize        = 64,
 105         },{
 106             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 107             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 108             .wMaxPacketSize        = 64,
 109         },
 110     }
 111 };
 112
 113 static const USBDescDevice desc_device_full = {
 114     .bcdUSB                        = 0x0200,
 115     .bMaxPacketSize0               = 8,
 116     .bNumConfigurations            = 1,
 117     .confs = (USBDescConfig[]) {
 118         {
 119             .bNumInterfaces        = 1,
 120             .bConfigurationValue   = 1,
 121             .iConfiguration        = STR_CONFIG_FULL,
 122             .bmAttributes          = 0xc0,
 123             .nif = 1,
 124             .ifs = &desc_iface_full,
 125         },
 126     },
 127 };
 128
 129 static const USBDescIface desc_iface_high = {
 130     .bInterfaceNumber              = 0,
 131     .bNumEndpoints                 = 2,
 132     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 133     .bInterfaceSubClass            = 0x06, /* SCSI */
 134     .bInterfaceProtocol            = 0x50, /* Bulk */
 135     .eps = (USBDescEndpoint[]) {
 136         {
 137             .bEndpointAddress      = USB_DIR_IN | 0x01,
 138             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 139             .wMaxPacketSize        = 512,
 140         },{
 141             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 142             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 143             .wMaxPacketSize        = 512,
 144         },
 145     }
 146 };
 147
 148 static const USBDescDevice desc_device_high = {
 149     .bcdUSB                        = 0x0200,
 150     .bMaxPacketSize0               = 64,
 151     .bNumConfigurations            = 1,
 152     .confs = (USBDescConfig[]) {
 153         {
 154             .bNumInterfaces        = 1,
 155             .bConfigurationValue   = 1,
 156             .iConfiguration        = STR_CONFIG_HIGH,
 157             .bmAttributes          = 0xc0,
 158             .nif = 1,
 159             .ifs = &desc_iface_high,
 160         },
 161     },
 162 };
 163
 164 static const USBDesc desc = {
 165     .id = {
 166         .idVendor          = 0,
 167         .idProduct         = 0,
 168         .bcdDevice         = 0,
 169         .iManufacturer     = STR_MANUFACTURER,
 170         .iProduct          = STR_PRODUCT,
 171         .iSerialNumber     = STR_SERIALNUMBER,
 172     },
 173     .full = &desc_device_full,
 174     .high = &desc_device_high,
 175     .str  = desc_strings,
 176 };
 177
 178 static void usb_msd_copy_data(MSDState *s)
 179 {
 180     uint32_t len;
 181     len = s->usb_len;
 182     if (len > s->scsi_len)
 183         len = s->scsi_len;
 184     if (s->mode == USB_MSDM_DATAIN) {
 185         memcpy(s->usb_buf, s->scsi_buf, len);
 186     } else {
 187         memcpy(s->scsi_buf, s->usb_buf, len);
 188     }
 189     s->usb_len -= len;
 190     s->scsi_len -= len;
 191     s->usb_buf += len;
 192     s->scsi_buf += len;
 193     s->data_len -= len;
 194     if (s->scsi_len == 0 || s->data_len == 0) {
 195         scsi_req_continue(s->req);
 196     }
 197 }
 198
 199 static void usb_msd_send_status(MSDState *s, USBPacket *p)
 200 {
 201     struct usb_msd_csw csw;
 202     int len;
 203
 204     csw.sig = cpu_to_le32(0x53425355);
 205     csw.tag = cpu_to_le32(s->tag);
 206     csw.residue = s->residue;
 207     csw.status = s->result;
 208
 209     len = MIN(sizeof(csw), p->len);
 210     memcpy(p->data, &csw, len);
 211 }
 212
 213 static void usb_msd_transfer_data(SCSIRequest *req, uint32_t len)
 214 {
 215     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 216     USBPacket *p = s->packet;
 217
 218     if (req->tag != s->tag) {
 219         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", req->tag);
 220     }
 221
 222     assert((s->mode == USB_MSDM_DATAOUT) == (req->cmd.mode == SCSI_XFER_TO_DEV));
 223     s->scsi_len = len;
 224     s->scsi_buf = scsi_req_get_buf(req);
 225     if (p) {
 226         usb_msd_copy_data(s);
 227         if (s->packet && s->usb_len == 0) {
 228             /* Set s->packet to NULL before calling usb_packet_complete
 229                because another request may be issued before
 230                usb_packet_complete returns.  */
 231             DPRINTF("Packet complete %p\n", p);
 232             s->packet = NULL;
 233             usb_packet_complete(&s->dev, p);
 234         }
 235     }
 236 }
 237
 238 static void usb_msd_command_complete(SCSIRequest *req, uint32_t status)
 239 {
 240     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 241     USBPacket *p = s->packet;
 242
 243     if (req->tag != s->tag) {
 244         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", req->tag);
 245     }
 246     DPRINTF("Command complete %d\n", status);
 247     s->residue = s->data_len;
 248     s->result = status != 0;
 249     if (s->packet) {
 250         if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 251             /* A deferred packet with no write data remaining must be
 252                the status read packet.  */
 253             usb_msd_send_status(s, p);
 254             s->mode = USB_MSDM_CBW;
 255         } else {
 256             if (s->data_len) {
 257                 s->data_len -= s->usb_len;
 258                 if (s->mode == USB_MSDM_DATAIN) {
 259                     memset(s->usb_buf, 0, s->usb_len);
 260                 }
 261                 s->usb_len = 0;
 262             }
 263             if (s->data_len == 0) {
 264                 s->mode = USB_MSDM_CSW;
 265             }
 266         }
 267         s->packet = NULL;
 268         usb_packet_complete(&s->dev, p);
 269     } else if (s->data_len == 0) {
 270         s->mode = USB_MSDM_CSW;
 271     }
 272     scsi_req_unref(req);
 273     s->req = NULL;
 274 }
 275
 276 static void usb_msd_request_cancelled(SCSIRequest *req)
 277 {
 278     MSDState *s = DO_UPCAST(MSDState, dev.qdev, req->bus->qbus.parent);
 279
 280     if (req == s->req) {
 281         scsi_req_unref(s->req);
 282         s->req = NULL;
 283         s->packet = NULL;
 284         s->scsi_len = 0;
 285     }
 286 }
 287
 288 static void usb_msd_handle_reset(USBDevice *dev)
 289 {
 290     MSDState *s = (MSDState *)dev;
 291
 292     DPRINTF("Reset\n");
 293     s->mode = USB_MSDM_CBW;
 294 }
 295
 296 static int usb_msd_handle_control(USBDevice *dev, USBPacket *p,
 297                int request, int value, int index, int length, uint8_t *data)
 298 {
 299     MSDState *s = (MSDState *)dev;
 300     int ret;
 301
 302     ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
 303     if (ret >= 0) {
 304         return ret;
 305     }
 306
 307     ret = 0;
 308     switch (request) {
 309     case DeviceRequest | USB_REQ_GET_INTERFACE:
 310         data[0] = 0;
 311         ret = 1;
 312         break;
 313     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 314         ret = 0;
 315         break;
 316     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 317         ret = 0;
 318         break;
 319     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
 320         ret = 0;
 321         break;
 322         /* Class specific requests.  */
 323     case ClassInterfaceOutRequest | MassStorageReset:
 324         /* Reset state ready for the next CBW.  */
 325         s->mode = USB_MSDM_CBW;
 326         ret = 0;
 327         break;
 328     case ClassInterfaceRequest | GetMaxLun:
 329         data[0] = 0;
 330         ret = 1;
 331         break;
 332     default:
 333         ret = USB_RET_STALL;
 334         break;
 335     }
 336     return ret;
 337 }
 338
 339 static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
 340 {
 341     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 342     scsi_req_cancel(s->req);
 343 }
 344
 345 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 346 {
 347     MSDState *s = (MSDState *)dev;
 348     int ret = 0;
 349     struct usb_msd_cbw cbw;
 350     uint8_t devep = p->devep;
 351     uint8_t *data = p->data;
 352     int len = p->len;
 353
 354     switch (p->pid) {
 355     case USB_TOKEN_OUT:
 356         if (devep != 2)
 357             goto fail;
 358
 359         switch (s->mode) {
 360         case USB_MSDM_CBW:
 361             if (len != 31) {
 362                 fprintf(stderr, "usb-msd: Bad CBW size");
 363                 goto fail;
 364             }
 365             memcpy(&cbw, data, 31);
 366             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 367                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 368                         le32_to_cpu(cbw.sig));
 369                 goto fail;
 370             }
 371             DPRINTF("Command on LUN %d\n", cbw.lun);
 372             if (cbw.lun != 0) {
 373                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 374                 goto fail;
 375             }
 376             s->tag = le32_to_cpu(cbw.tag);
 377             s->data_len = le32_to_cpu(cbw.data_len);
 378             if (s->data_len == 0) {
 379                 s->mode = USB_MSDM_CSW;
 380             } else if (cbw.flags & 0x80) {
 381                 s->mode = USB_MSDM_DATAIN;
 382             } else {
 383                 s->mode = USB_MSDM_DATAOUT;
 384             }
 385             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 386                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 387             s->residue = 0;
 388             s->scsi_len = 0;
 389             s->req = scsi_req_new(s->scsi_dev, s->tag, 0);
 390             scsi_req_enqueue(s->req, cbw.cmd);
 391             /* ??? Should check that USB and SCSI data transfer
 392                directions match.  */
 393             if (s->mode != USB_MSDM_CSW && s->residue == 0) {
 394                 scsi_req_continue(s->req);
 395             }
 396             ret = len;
 397             break;
 398
 399         case USB_MSDM_DATAOUT:
 400             DPRINTF("Data out %d/%d\n", len, s->data_len);
 401             if (len > s->data_len)
 402                 goto fail;
 403
 404             s->usb_buf = data;
 405             s->usb_len = len;
 406             if (s->scsi_len) {
 407                 usb_msd_copy_data(s);
 408             }
 409             if (s->residue && s->usb_len) {
 410                 s->data_len -= s->usb_len;
 411                 if (s->data_len == 0)
 412                     s->mode = USB_MSDM_CSW;
 413                 s->usb_len = 0;
 414             }
 415             if (s->usb_len) {
 416                 DPRINTF("Deferring packet %p\n", p);
 417                 s->packet = p;
 418                 ret = USB_RET_ASYNC;
 419             } else {
 420                 ret = len;
 421             }
 422             break;
 423
 424         default:
 425             DPRINTF("Unexpected write (len %d)\n", len);
 426             goto fail;
 427         }
 428         break;
 429
 430     case USB_TOKEN_IN:
 431         if (devep != 1)
 432             goto fail;
 433
 434         switch (s->mode) {
 435         case USB_MSDM_DATAOUT:
 436             if (s->data_len != 0 || len < 13)
 437                 goto fail;
 438             /* Waiting for SCSI write to complete.  */
 439             s->packet = p;
 440             ret = USB_RET_ASYNC;
 441             break;
 442
 443         case USB_MSDM_CSW:
 444             DPRINTF("Command status %d tag 0x%x, len %d\n",
 445                     s->result, s->tag, len);
 446             if (len < 13)
 447                 goto fail;
 448
 449             usb_msd_send_status(s, p);
 450             s->mode = USB_MSDM_CBW;
 451             ret = 13;
 452             break;
 453
 454         case USB_MSDM_DATAIN:
 455             DPRINTF("Data in %d/%d, scsi_len %d\n", len, s->data_len, s->scsi_len);
 456             if (len > s->data_len)
 457                 len = s->data_len;
 458             s->usb_buf = data;
 459             s->usb_len = len;
 460             if (s->scsi_len) {
 461                 usb_msd_copy_data(s);
 462             }
 463             if (s->residue && s->usb_len) {
 464                 s->data_len -= s->usb_len;
 465                 memset(s->usb_buf, 0, s->usb_len);
 466                 if (s->data_len == 0)
 467                     s->mode = USB_MSDM_CSW;
 468                 s->usb_len = 0;
 469             }
 470             if (s->usb_len) {
 471                 DPRINTF("Deferring packet %p\n", p);
 472                 s->packet = p;
 473                 ret = USB_RET_ASYNC;
 474             } else {
 475                 ret = len;
 476             }
 477             break;
 478
 479         default:
 480             DPRINTF("Unexpected read (len %d)\n", len);
 481             goto fail;
 482         }
 483         break;
 484
 485     default:
 486         DPRINTF("Bad token\n");
 487     fail:
 488         ret = USB_RET_STALL;
 489         break;
 490     }
 491
 492     return ret;
 493 }
 494
 495 static void usb_msd_password_cb(void *opaque, int err)
 496 {
 497     MSDState *s = opaque;
 498
 499     if (!err)
 500         usb_device_attach(&s->dev);
 501     else
 502         qdev_unplug(&s->dev.qdev);
 503 }
 504
 505 static const struct SCSIBusOps usb_msd_scsi_ops = {
 506     .transfer_data = usb_msd_transfer_data,
 507     .complete = usb_msd_command_complete,
 508     .cancel = usb_msd_request_cancelled
 509 };
 510
 511 static int usb_msd_initfn(USBDevice *dev)
 512 {
 513     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 514     BlockDriverState *bs = s->conf.bs;
 515     DriveInfo *dinfo;
 516
 517     if (!bs) {
 518         error_report("usb-msd: drive property not set");
 519         return -1;
 520     }
 521
 522     /*
 523      * Hack alert: this pretends to be a block device, but it's really
 524      * a SCSI bus that can serve only a single device, which it
 525      * creates automatically.  But first it needs to detach from its
 526      * blockdev, or else scsi_bus_legacy_add_drive() dies when it
 527      * attaches again.
 528      *
 529      * The hack is probably a bad idea.
 530      */
 531     bdrv_detach(bs, &s->dev.qdev);
 532     s->conf.bs = NULL;
 533
 534     dinfo = drive_get_by_blockdev(bs);
 535     if (dinfo && dinfo->serial) {
 536         usb_desc_set_string(dev, STR_SERIALNUMBER, dinfo->serial);
 537     }
 538
 539     usb_desc_init(dev);
 540     scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, &usb_msd_scsi_ops);
 541     s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0, !!s->removable);
 542     if (!s->scsi_dev) {
 543         return -1;
 544     }
 545     s->bus.qbus.allow_hotplug = 0;
 546     usb_msd_handle_reset(dev);
 547
 548     if (bdrv_key_required(bs)) {
 549         if (cur_mon) {
 550             monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
 551             s->dev.auto_attach = 0;
 552         } else {
 553             autostart = 0;
 554         }
 555     }
 556
 557     add_boot_device_path(s->conf.bootindex, &dev->qdev, "/disk@0,0");
 558     return 0;
 559 }
 560
 561 static USBDevice *usb_msd_init(const char *filename)
 562 {
 563     static int nr=0;
 564     char id[8];
 565     QemuOpts *opts;
 566     DriveInfo *dinfo;
 567     USBDevice *dev;
 568     const char *p1;
 569     char fmt[32];
 570
 571     /* parse -usbdevice disk: syntax into drive opts */
 572     snprintf(id, sizeof(id), "usb%d", nr++);
 573     opts = qemu_opts_create(qemu_find_opts("drive"), id, 0);
 574
 575     p1 = strchr(filename, ':');
 576     if (p1++) {
 577         const char *p2;
 578
 579         if (strstart(filename, "format=", &p2)) {
 580             int len = MIN(p1 - p2, sizeof(fmt));
 581             pstrcpy(fmt, len, p2);
 582             qemu_opt_set(opts, "format", fmt);
 583         } else if (*filename != ':') {
 584             printf("unrecognized USB mass-storage option %s\n", filename);
 585             return NULL;
 586         }
 587         filename = p1;
 588     }
 589     if (!*filename) {
 590         printf("block device specification needed\n");
 591         return NULL;
 592     }
 593     qemu_opt_set(opts, "file", filename);
 594     qemu_opt_set(opts, "if", "none");
 595
 596     /* create host drive */
 597     dinfo = drive_init(opts, 0);
 598     if (!dinfo) {
 599         qemu_opts_del(opts);
 600         return NULL;
 601     }
 602
 603     /* create guest device */
 604     dev = usb_create(NULL /* FIXME */, "usb-storage");
 605     if (!dev) {
 606         return NULL;
 607     }
 608     if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
 609         qdev_free(&dev->qdev);
 610         return NULL;
 611     }
 612     if (qdev_init(&dev->qdev) < 0)
 613         return NULL;
 614
 615     return dev;
 616 }
 617
 618 static struct USBDeviceInfo msd_info = {
 619     .product_desc   = "QEMU USB MSD",
 620     .qdev.name      = "usb-storage",
 621     .qdev.fw_name      = "storage",
 622     .qdev.size      = sizeof(MSDState),
 623     .usb_desc       = &desc,
 624     .init           = usb_msd_initfn,
 625     .handle_packet  = usb_generic_handle_packet,
 626     .cancel_packet  = usb_msd_cancel_io,
 627     .handle_attach  = usb_desc_attach,
 628     .handle_reset   = usb_msd_handle_reset,
 629     .handle_control = usb_msd_handle_control,
 630     .handle_data    = usb_msd_handle_data,
 631     .usbdevice_name = "disk",
 632     .usbdevice_init = usb_msd_init,
 633     .qdev.props     = (Property[]) {
 634         DEFINE_BLOCK_PROPERTIES(MSDState, conf),
 635         DEFINE_PROP_BIT("removable", MSDState, removable, 0, false),
 636         DEFINE_PROP_END_OF_LIST(),
 637     },
 638 };
 639
 640 static void usb_msd_register_devices(void)
 641 {
 642     usb_qdev_register(&msd_info);
 643 }
 644 device_init(usb_msd_register_devices)