2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 #include "qemu-common.h"
11 #include "qemu-option.h"
12 #include "qemu-config.h"
22 #define DPRINTF(fmt, ...) \
23 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
25 #define DPRINTF(fmt, ...) do {} while(0)
29 #define MassStorageReset 0xff
30 #define GetMaxLun 0xfe
33 USB_MSDM_CBW
, /* Command Block. */
34 USB_MSDM_DATAOUT
, /* Tranfer data to device. */
35 USB_MSDM_DATAIN
, /* Transfer data from device. */
36 USB_MSDM_CSW
/* Command Status. */
53 /* For async completion. */
74 static const uint8_t qemu_msd_dev_descriptor
[] = {
75 0x12, /* u8 bLength; */
76 0x01, /* u8 bDescriptorType; Device */
77 0x00, 0x01, /* u16 bcdUSB; v1.0 */
79 0x00, /* u8 bDeviceClass; */
80 0x00, /* u8 bDeviceSubClass; */
81 0x00, /* u8 bDeviceProtocol; [ low/full speeds only ] */
82 0x08, /* u8 bMaxPacketSize0; 8 Bytes */
84 /* Vendor and product id are arbitrary. */
85 0x00, 0x00, /* u16 idVendor; */
86 0x00, 0x00, /* u16 idProduct; */
87 0x00, 0x00, /* u16 bcdDevice */
89 0x01, /* u8 iManufacturer; */
90 0x02, /* u8 iProduct; */
91 0x03, /* u8 iSerialNumber; */
92 0x01 /* u8 bNumConfigurations; */
95 static const uint8_t qemu_msd_config_descriptor
[] = {
97 /* one configuration */
98 0x09, /* u8 bLength; */
99 0x02, /* u8 bDescriptorType; Configuration */
100 0x20, 0x00, /* u16 wTotalLength; */
101 0x01, /* u8 bNumInterfaces; (1) */
102 0x01, /* u8 bConfigurationValue; */
103 0x00, /* u8 iConfiguration; */
104 0xc0, /* u8 bmAttributes;
109 0x00, /* u8 MaxPower; */
112 0x09, /* u8 if_bLength; */
113 0x04, /* u8 if_bDescriptorType; Interface */
114 0x00, /* u8 if_bInterfaceNumber; */
115 0x00, /* u8 if_bAlternateSetting; */
116 0x02, /* u8 if_bNumEndpoints; */
117 0x08, /* u8 if_bInterfaceClass; MASS STORAGE */
118 0x06, /* u8 if_bInterfaceSubClass; SCSI */
119 0x50, /* u8 if_bInterfaceProtocol; Bulk Only */
120 0x00, /* u8 if_iInterface; */
122 /* Bulk-In endpoint */
123 0x07, /* u8 ep_bLength; */
124 0x05, /* u8 ep_bDescriptorType; Endpoint */
125 0x81, /* u8 ep_bEndpointAddress; IN Endpoint 1 */
126 0x02, /* u8 ep_bmAttributes; Bulk */
127 0x40, 0x00, /* u16 ep_wMaxPacketSize; */
128 0x00, /* u8 ep_bInterval; */
130 /* Bulk-Out endpoint */
131 0x07, /* u8 ep_bLength; */
132 0x05, /* u8 ep_bDescriptorType; Endpoint */
133 0x02, /* u8 ep_bEndpointAddress; OUT Endpoint 2 */
134 0x02, /* u8 ep_bmAttributes; Bulk */
135 0x40, 0x00, /* u16 ep_wMaxPacketSize; */
136 0x00 /* u8 ep_bInterval; */
139 static void usb_msd_copy_data(MSDState
*s
)
143 if (len
> s
->scsi_len
)
145 if (s
->mode
== USB_MSDM_DATAIN
) {
146 memcpy(s
->usb_buf
, s
->scsi_buf
, len
);
148 memcpy(s
->scsi_buf
, s
->usb_buf
, len
);
155 if (s
->scsi_len
== 0) {
156 if (s
->mode
== USB_MSDM_DATAIN
) {
157 s
->scsi_dev
->info
->read_data(s
->scsi_dev
, s
->tag
);
158 } else if (s
->mode
== USB_MSDM_DATAOUT
) {
159 s
->scsi_dev
->info
->write_data(s
->scsi_dev
, s
->tag
);
164 static void usb_msd_send_status(MSDState
*s
)
166 struct usb_msd_csw csw
;
168 csw
.sig
= cpu_to_le32(0x53425355);
169 csw
.tag
= cpu_to_le32(s
->tag
);
170 csw
.residue
= s
->residue
;
171 csw
.status
= s
->result
;
172 memcpy(s
->usb_buf
, &csw
, 13);
175 static void usb_msd_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
178 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, bus
->qbus
.parent
);
179 USBPacket
*p
= s
->packet
;
182 fprintf(stderr
, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag
);
184 if (reason
== SCSI_REASON_DONE
) {
185 DPRINTF("Command complete %d\n", arg
);
186 s
->residue
= s
->data_len
;
187 s
->result
= arg
!= 0;
189 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
190 /* A deferred packet with no write data remaining must be
191 the status read packet. */
192 usb_msd_send_status(s
);
193 s
->mode
= USB_MSDM_CBW
;
196 s
->data_len
-= s
->usb_len
;
197 if (s
->mode
== USB_MSDM_DATAIN
)
198 memset(s
->usb_buf
, 0, s
->usb_len
);
201 if (s
->data_len
== 0)
202 s
->mode
= USB_MSDM_CSW
;
205 usb_packet_complete(p
);
206 } else if (s
->data_len
== 0) {
207 s
->mode
= USB_MSDM_CSW
;
212 s
->scsi_buf
= s
->scsi_dev
->info
->get_buf(s
->scsi_dev
, tag
);
214 usb_msd_copy_data(s
);
215 if (s
->usb_len
== 0) {
216 /* Set s->packet to NULL before calling usb_packet_complete
217 because annother request may be issued before
218 usb_packet_complete returns. */
219 DPRINTF("Packet complete %p\n", p
);
221 usb_packet_complete(p
);
226 static void usb_msd_handle_reset(USBDevice
*dev
)
228 MSDState
*s
= (MSDState
*)dev
;
231 s
->mode
= USB_MSDM_CBW
;
234 static int usb_msd_handle_control(USBDevice
*dev
, int request
, int value
,
235 int index
, int length
, uint8_t *data
)
237 MSDState
*s
= (MSDState
*)dev
;
241 case DeviceRequest
| USB_REQ_GET_STATUS
:
242 data
[0] = (1 << USB_DEVICE_SELF_POWERED
) |
243 (dev
->remote_wakeup
<< USB_DEVICE_REMOTE_WAKEUP
);
247 case DeviceOutRequest
| USB_REQ_CLEAR_FEATURE
:
248 if (value
== USB_DEVICE_REMOTE_WAKEUP
) {
249 dev
->remote_wakeup
= 0;
255 case DeviceOutRequest
| USB_REQ_SET_FEATURE
:
256 if (value
== USB_DEVICE_REMOTE_WAKEUP
) {
257 dev
->remote_wakeup
= 1;
263 case DeviceOutRequest
| USB_REQ_SET_ADDRESS
:
267 case DeviceRequest
| USB_REQ_GET_DESCRIPTOR
:
270 memcpy(data
, qemu_msd_dev_descriptor
,
271 sizeof(qemu_msd_dev_descriptor
));
272 ret
= sizeof(qemu_msd_dev_descriptor
);
275 memcpy(data
, qemu_msd_config_descriptor
,
276 sizeof(qemu_msd_config_descriptor
));
277 ret
= sizeof(qemu_msd_config_descriptor
);
280 switch(value
& 0xff) {
290 /* vendor description */
291 ret
= set_usb_string(data
, "QEMU " QEMU_VERSION
);
294 /* product description */
295 ret
= set_usb_string(data
, "QEMU USB HARDDRIVE");
299 ret
= set_usb_string(data
, "1");
309 case DeviceRequest
| USB_REQ_GET_CONFIGURATION
:
313 case DeviceOutRequest
| USB_REQ_SET_CONFIGURATION
:
316 case DeviceRequest
| USB_REQ_GET_INTERFACE
:
320 case DeviceOutRequest
| USB_REQ_SET_INTERFACE
:
323 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
326 case InterfaceOutRequest
| USB_REQ_SET_INTERFACE
:
329 /* Class specific requests. */
330 case (((USB_DIR_OUT
| USB_TYPE_CLASS
| USB_RECIP_INTERFACE
) << 8) | MassStorageReset
):
331 case MassStorageReset
:
332 /* Reset state ready for the next CBW. */
333 s
->mode
= USB_MSDM_CBW
;
336 case (((USB_DIR_IN
| USB_TYPE_CLASS
| USB_RECIP_INTERFACE
) << 8) | GetMaxLun
):
349 static void usb_msd_cancel_io(USBPacket
*p
, void *opaque
)
351 MSDState
*s
= opaque
;
352 s
->scsi_dev
->info
->cancel_io(s
->scsi_dev
, s
->tag
);
357 static int usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
359 MSDState
*s
= (MSDState
*)dev
;
361 struct usb_msd_cbw cbw
;
362 uint8_t devep
= p
->devep
;
363 uint8_t *data
= p
->data
;
374 fprintf(stderr
, "usb-msd: Bad CBW size");
377 memcpy(&cbw
, data
, 31);
378 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
379 fprintf(stderr
, "usb-msd: Bad signature %08x\n",
380 le32_to_cpu(cbw
.sig
));
383 DPRINTF("Command on LUN %d\n", cbw
.lun
);
385 fprintf(stderr
, "usb-msd: Bad LUN %d\n", cbw
.lun
);
388 s
->tag
= le32_to_cpu(cbw
.tag
);
389 s
->data_len
= le32_to_cpu(cbw
.data_len
);
390 if (s
->data_len
== 0) {
391 s
->mode
= USB_MSDM_CSW
;
392 } else if (cbw
.flags
& 0x80) {
393 s
->mode
= USB_MSDM_DATAIN
;
395 s
->mode
= USB_MSDM_DATAOUT
;
397 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
398 s
->tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
400 s
->scsi_dev
->info
->send_command(s
->scsi_dev
, s
->tag
, cbw
.cmd
, 0);
401 /* ??? Should check that USB and SCSI data transfer
403 if (s
->residue
== 0) {
404 if (s
->mode
== USB_MSDM_DATAIN
) {
405 s
->scsi_dev
->info
->read_data(s
->scsi_dev
, s
->tag
);
406 } else if (s
->mode
== USB_MSDM_DATAOUT
) {
407 s
->scsi_dev
->info
->write_data(s
->scsi_dev
, s
->tag
);
413 case USB_MSDM_DATAOUT
:
414 DPRINTF("Data out %d/%d\n", len
, s
->data_len
);
415 if (len
> s
->data_len
)
421 usb_msd_copy_data(s
);
423 if (s
->residue
&& s
->usb_len
) {
424 s
->data_len
-= s
->usb_len
;
425 if (s
->data_len
== 0)
426 s
->mode
= USB_MSDM_CSW
;
430 DPRINTF("Deferring packet %p\n", p
);
431 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
440 DPRINTF("Unexpected write (len %d)\n", len
);
450 case USB_MSDM_DATAOUT
:
451 if (s
->data_len
!= 0 || len
< 13)
453 /* Waiting for SCSI write to complete. */
454 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
460 DPRINTF("Command status %d tag 0x%x, len %d\n",
461 s
->result
, s
->tag
, len
);
467 usb_msd_send_status(s
);
468 s
->mode
= USB_MSDM_CBW
;
472 case USB_MSDM_DATAIN
:
473 DPRINTF("Data in %d/%d\n", len
, s
->data_len
);
474 if (len
> s
->data_len
)
479 usb_msd_copy_data(s
);
481 if (s
->residue
&& s
->usb_len
) {
482 s
->data_len
-= s
->usb_len
;
483 memset(s
->usb_buf
, 0, s
->usb_len
);
484 if (s
->data_len
== 0)
485 s
->mode
= USB_MSDM_CSW
;
489 DPRINTF("Deferring packet %p\n", p
);
490 usb_defer_packet(p
, usb_msd_cancel_io
, s
);
499 DPRINTF("Unexpected read (len %d)\n", len
);
505 DPRINTF("Bad token\n");
514 static void usb_msd_password_cb(void *opaque
, int err
)
516 MSDState
*s
= opaque
;
519 usb_device_attach(&s
->dev
);
521 qdev_unplug(&s
->dev
.qdev
);
524 static int usb_msd_initfn(USBDevice
*dev
)
526 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
528 if (!s
->conf
.dinfo
|| !s
->conf
.dinfo
->bdrv
) {
529 error_report("usb-msd: drive property not set");
533 s
->dev
.speed
= USB_SPEED_FULL
;
534 scsi_bus_new(&s
->bus
, &s
->dev
.qdev
, 0, 1, usb_msd_command_complete
);
535 s
->scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, s
->conf
.dinfo
, 0);
536 s
->bus
.qbus
.allow_hotplug
= 0;
537 usb_msd_handle_reset(dev
);
539 if (bdrv_key_required(s
->conf
.dinfo
->bdrv
)) {
541 monitor_read_bdrv_key_start(cur_mon
, s
->conf
.dinfo
->bdrv
,
542 usb_msd_password_cb
, s
);
543 s
->dev
.auto_attach
= 0;
552 static USBDevice
*usb_msd_init(const char *filename
)
563 /* parse -usbdevice disk: syntax into drive opts */
564 snprintf(id
, sizeof(id
), "usb%d", nr
++);
565 opts
= qemu_opts_create(&qemu_drive_opts
, id
, 0);
567 p1
= strchr(filename
, ':');
571 if (strstart(filename
, "format=", &p2
)) {
572 int len
= MIN(p1
- p2
, sizeof(fmt
));
573 pstrcpy(fmt
, len
, p2
);
574 qemu_opt_set(opts
, "format", fmt
);
575 } else if (*filename
!= ':') {
576 printf("unrecognized USB mass-storage option %s\n", filename
);
582 printf("block device specification needed\n");
585 qemu_opt_set(opts
, "file", filename
);
586 qemu_opt_set(opts
, "if", "none");
588 /* create host drive */
589 dinfo
= drive_init(opts
, NULL
, &fatal_error
);
595 /* create guest device */
596 dev
= usb_create(NULL
/* FIXME */, "usb-storage");
600 qdev_prop_set_drive(&dev
->qdev
, "drive", dinfo
);
601 if (qdev_init(&dev
->qdev
) < 0)
607 static struct USBDeviceInfo msd_info
= {
608 .product_desc
= "QEMU USB MSD",
609 .qdev
.name
= "usb-storage",
610 .qdev
.size
= sizeof(MSDState
),
611 .init
= usb_msd_initfn
,
612 .handle_packet
= usb_generic_handle_packet
,
613 .handle_reset
= usb_msd_handle_reset
,
614 .handle_control
= usb_msd_handle_control
,
615 .handle_data
= usb_msd_handle_data
,
616 .usbdevice_name
= "disk",
617 .usbdevice_init
= usb_msd_init
,
618 .qdev
.props
= (Property
[]) {
619 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
620 DEFINE_PROP_END_OF_LIST(),
624 static void usb_msd_register_devices(void)
626 usb_qdev_register(&msd_info
);
628 device_init(usb_msd_register_devices
)