2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "qemu/error-report.h"
13 #include "qemu/module.h"
14 #include "qemu/option.h"
15 #include "qemu/config-file.h"
18 #include "hw/qdev-properties.h"
19 #include "hw/scsi/scsi.h"
20 #include "migration/vmstate.h"
21 #include "sysemu/sysemu.h"
22 #include "sysemu/block-backend.h"
23 #include "qapi/visitor.h"
24 #include "qemu/cutils.h"
25 #include "qom/object.h"
31 #define MassStorageReset 0xff
32 #define GetMaxLun 0xfe
35 USB_MSDM_CBW
, /* Command Block. */
36 USB_MSDM_DATAOUT
, /* Transfer data to device. */
37 USB_MSDM_DATAIN
, /* Transfer data from device. */
38 USB_MSDM_CSW
/* Command Status. */
54 struct usb_msd_csw csw
;
57 /* For async completion. */
59 /* usb-storage only */
64 typedef struct MSDState MSDState
;
66 #define TYPE_USB_STORAGE "usb-storage-dev"
67 DECLARE_INSTANCE_CHECKER(MSDState
, USB_STORAGE_DEV
,
89 static const USBDescStrings desc_strings
= {
90 [STR_MANUFACTURER
] = "QEMU",
91 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
92 [STR_SERIALNUMBER
] = "1",
93 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
94 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
95 [STR_CONFIG_SUPER
] = "Super speed config (usb 3.0)",
98 static const USBDescIface desc_iface_full
= {
99 .bInterfaceNumber
= 0,
101 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
102 .bInterfaceSubClass
= 0x06, /* SCSI */
103 .bInterfaceProtocol
= 0x50, /* Bulk */
104 .eps
= (USBDescEndpoint
[]) {
106 .bEndpointAddress
= USB_DIR_IN
| 0x01,
107 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
108 .wMaxPacketSize
= 64,
110 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
111 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
112 .wMaxPacketSize
= 64,
117 static const USBDescDevice desc_device_full
= {
119 .bMaxPacketSize0
= 8,
120 .bNumConfigurations
= 1,
121 .confs
= (USBDescConfig
[]) {
124 .bConfigurationValue
= 1,
125 .iConfiguration
= STR_CONFIG_FULL
,
126 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
128 .ifs
= &desc_iface_full
,
133 static const USBDescIface desc_iface_high
= {
134 .bInterfaceNumber
= 0,
136 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
137 .bInterfaceSubClass
= 0x06, /* SCSI */
138 .bInterfaceProtocol
= 0x50, /* Bulk */
139 .eps
= (USBDescEndpoint
[]) {
141 .bEndpointAddress
= USB_DIR_IN
| 0x01,
142 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
143 .wMaxPacketSize
= 512,
145 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
146 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
147 .wMaxPacketSize
= 512,
152 static const USBDescDevice desc_device_high
= {
154 .bMaxPacketSize0
= 64,
155 .bNumConfigurations
= 1,
156 .confs
= (USBDescConfig
[]) {
159 .bConfigurationValue
= 1,
160 .iConfiguration
= STR_CONFIG_HIGH
,
161 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
163 .ifs
= &desc_iface_high
,
168 static const USBDescIface desc_iface_super
= {
169 .bInterfaceNumber
= 0,
171 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
172 .bInterfaceSubClass
= 0x06, /* SCSI */
173 .bInterfaceProtocol
= 0x50, /* Bulk */
174 .eps
= (USBDescEndpoint
[]) {
176 .bEndpointAddress
= USB_DIR_IN
| 0x01,
177 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
178 .wMaxPacketSize
= 1024,
181 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
182 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
183 .wMaxPacketSize
= 1024,
189 static const USBDescDevice desc_device_super
= {
191 .bMaxPacketSize0
= 9,
192 .bNumConfigurations
= 1,
193 .confs
= (USBDescConfig
[]) {
196 .bConfigurationValue
= 1,
197 .iConfiguration
= STR_CONFIG_SUPER
,
198 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
200 .ifs
= &desc_iface_super
,
205 static const USBDesc desc
= {
207 .idVendor
= 0x46f4, /* CRC16() of "QEMU" */
210 .iManufacturer
= STR_MANUFACTURER
,
211 .iProduct
= STR_PRODUCT
,
212 .iSerialNumber
= STR_SERIALNUMBER
,
214 .full
= &desc_device_full
,
215 .high
= &desc_device_high
,
216 .super
= &desc_device_super
,
220 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
223 len
= p
->iov
.size
- p
->actual_length
;
224 if (len
> s
->scsi_len
)
226 usb_packet_copy(p
, scsi_req_get_buf(s
->req
) + s
->scsi_off
, len
);
229 if (len
> s
->data_len
) {
233 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
234 scsi_req_continue(s
->req
);
238 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
242 trace_usb_msd_send_status(s
->csw
.status
, le32_to_cpu(s
->csw
.tag
),
245 assert(s
->csw
.sig
== cpu_to_le32(0x53425355));
246 len
= MIN(sizeof(s
->csw
), p
->iov
.size
);
247 usb_packet_copy(p
, &s
->csw
, len
);
248 memset(&s
->csw
, 0, sizeof(s
->csw
));
251 static void usb_msd_packet_complete(MSDState
*s
)
253 USBPacket
*p
= s
->packet
;
255 /* Set s->packet to NULL before calling usb_packet_complete
256 because another request may be issued before
257 usb_packet_complete returns. */
258 trace_usb_msd_packet_complete();
260 usb_packet_complete(&s
->dev
, p
);
263 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
265 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
266 USBPacket
*p
= s
->packet
;
268 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
272 usb_msd_copy_data(s
, p
);
274 if (p
&& p
->actual_length
== p
->iov
.size
) {
275 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
276 usb_msd_packet_complete(s
);
281 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
283 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
284 USBPacket
*p
= s
->packet
;
286 trace_usb_msd_cmd_complete(status
, req
->tag
);
288 s
->csw
.sig
= cpu_to_le32(0x53425355);
289 s
->csw
.tag
= cpu_to_le32(req
->tag
);
290 s
->csw
.residue
= cpu_to_le32(s
->data_len
);
291 s
->csw
.status
= status
!= 0;
294 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
295 /* A deferred packet with no write data remaining must be
296 the status read packet. */
297 usb_msd_send_status(s
, p
);
298 s
->mode
= USB_MSDM_CBW
;
299 } else if (s
->mode
== USB_MSDM_CSW
) {
300 usb_msd_send_status(s
, p
);
301 s
->mode
= USB_MSDM_CBW
;
304 int len
= (p
->iov
.size
- p
->actual_length
);
305 usb_packet_skip(p
, len
);
306 if (len
> s
->data_len
) {
311 if (s
->data_len
== 0) {
312 s
->mode
= USB_MSDM_CSW
;
315 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
316 usb_msd_packet_complete(s
);
317 } else if (s
->data_len
== 0) {
318 s
->mode
= USB_MSDM_CSW
;
324 static void usb_msd_request_cancelled(SCSIRequest
*req
)
326 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
328 trace_usb_msd_cmd_cancel(req
->tag
);
331 scsi_req_unref(s
->req
);
337 static void usb_msd_handle_reset(USBDevice
*dev
)
339 MSDState
*s
= (MSDState
*)dev
;
341 trace_usb_msd_reset();
343 scsi_req_cancel(s
->req
);
345 assert(s
->req
== NULL
);
348 s
->packet
->status
= USB_RET_STALL
;
349 usb_msd_packet_complete(s
);
352 s
->mode
= USB_MSDM_CBW
;
355 static void usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
356 int request
, int value
, int index
, int length
, uint8_t *data
)
358 MSDState
*s
= (MSDState
*)dev
;
359 SCSIDevice
*scsi_dev
;
362 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
368 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
370 /* Class specific requests. */
371 case ClassInterfaceOutRequest
| MassStorageReset
:
372 /* Reset state ready for the next CBW. */
373 s
->mode
= USB_MSDM_CBW
;
375 case ClassInterfaceRequest
| GetMaxLun
:
378 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, maxlun
+1);
379 if (scsi_dev
== NULL
) {
382 if (scsi_dev
->lun
!= maxlun
+1) {
387 trace_usb_msd_maxlun(maxlun
);
389 p
->actual_length
= 1;
392 p
->status
= USB_RET_STALL
;
397 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
399 MSDState
*s
= USB_STORAGE_DEV(dev
);
401 assert(s
->packet
== p
);
405 scsi_req_cancel(s
->req
);
409 static void usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
411 MSDState
*s
= (MSDState
*)dev
;
413 struct usb_msd_cbw cbw
;
414 uint8_t devep
= p
->ep
->nr
;
415 SCSIDevice
*scsi_dev
;
425 if (p
->iov
.size
!= 31) {
426 error_report("usb-msd: Bad CBW size");
429 usb_packet_copy(p
, &cbw
, 31);
430 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
431 error_report("usb-msd: Bad signature %08x",
432 le32_to_cpu(cbw
.sig
));
435 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, cbw
.lun
);
436 if (scsi_dev
== NULL
) {
437 error_report("usb-msd: Bad LUN %d", cbw
.lun
);
440 tag
= le32_to_cpu(cbw
.tag
);
441 s
->data_len
= le32_to_cpu(cbw
.data_len
);
442 if (s
->data_len
== 0) {
443 s
->mode
= USB_MSDM_CSW
;
444 } else if (cbw
.flags
& 0x80) {
445 s
->mode
= USB_MSDM_DATAIN
;
447 s
->mode
= USB_MSDM_DATAOUT
;
449 trace_usb_msd_cmd_submit(cbw
.lun
, tag
, cbw
.flags
,
450 cbw
.cmd_len
, s
->data_len
);
451 assert(le32_to_cpu(s
->csw
.residue
) == 0);
453 s
->req
= scsi_req_new(scsi_dev
, tag
, cbw
.lun
, cbw
.cmd
, NULL
);
455 scsi_req_print(s
->req
);
457 len
= scsi_req_enqueue(s
->req
);
459 scsi_req_continue(s
->req
);
463 case USB_MSDM_DATAOUT
:
464 trace_usb_msd_data_out(p
->iov
.size
, s
->data_len
);
465 if (p
->iov
.size
> s
->data_len
) {
470 usb_msd_copy_data(s
, p
);
472 if (le32_to_cpu(s
->csw
.residue
)) {
473 int len
= p
->iov
.size
- p
->actual_length
;
475 usb_packet_skip(p
, len
);
476 if (len
> s
->data_len
) {
480 if (s
->data_len
== 0) {
481 s
->mode
= USB_MSDM_CSW
;
485 if (p
->actual_length
< p
->iov
.size
) {
486 trace_usb_msd_packet_async();
488 p
->status
= USB_RET_ASYNC
;
502 case USB_MSDM_DATAOUT
:
503 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
506 /* Waiting for SCSI write to complete. */
507 trace_usb_msd_packet_async();
509 p
->status
= USB_RET_ASYNC
;
513 if (p
->iov
.size
< 13) {
518 /* still in flight */
519 trace_usb_msd_packet_async();
521 p
->status
= USB_RET_ASYNC
;
523 usb_msd_send_status(s
, p
);
524 s
->mode
= USB_MSDM_CBW
;
528 case USB_MSDM_DATAIN
:
529 trace_usb_msd_data_in(p
->iov
.size
, s
->data_len
, s
->scsi_len
);
531 usb_msd_copy_data(s
, p
);
533 if (le32_to_cpu(s
->csw
.residue
)) {
534 int len
= p
->iov
.size
- p
->actual_length
;
536 usb_packet_skip(p
, len
);
537 if (len
> s
->data_len
) {
541 if (s
->data_len
== 0) {
542 s
->mode
= USB_MSDM_CSW
;
546 if (p
->actual_length
< p
->iov
.size
&& s
->mode
== USB_MSDM_DATAIN
) {
547 trace_usb_msd_packet_async();
549 p
->status
= USB_RET_ASYNC
;
560 p
->status
= USB_RET_STALL
;
565 static void *usb_msd_load_request(QEMUFile
*f
, SCSIRequest
*req
)
567 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
569 /* nothing to load, just store req in our state struct */
570 assert(s
->req
== NULL
);
576 static const struct SCSIBusInfo usb_msd_scsi_info_storage
= {
581 .transfer_data
= usb_msd_transfer_data
,
582 .complete
= usb_msd_command_complete
,
583 .cancel
= usb_msd_request_cancelled
,
584 .load_request
= usb_msd_load_request
,
587 static const struct SCSIBusInfo usb_msd_scsi_info_bot
= {
592 .transfer_data
= usb_msd_transfer_data
,
593 .complete
= usb_msd_command_complete
,
594 .cancel
= usb_msd_request_cancelled
,
595 .load_request
= usb_msd_load_request
,
598 static void usb_msd_storage_realize(USBDevice
*dev
, Error
**errp
)
600 MSDState
*s
= USB_STORAGE_DEV(dev
);
601 BlockBackend
*blk
= s
->conf
.blk
;
602 SCSIDevice
*scsi_dev
;
605 error_setg(errp
, "drive property not set");
609 if (!blkconf_blocksizes(&s
->conf
, errp
)) {
613 if (!blkconf_apply_backend_options(&s
->conf
, blk_is_read_only(blk
), true,
619 * Hack alert: this pretends to be a block device, but it's really
620 * a SCSI bus that can serve only a single device, which it
621 * creates automatically. But first it needs to detach from its
622 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
623 * attaches again. We also need to take another reference so that
624 * blk_detach_dev() doesn't free blk while we still need it.
626 * The hack is probably a bad idea.
629 blk_detach_dev(blk
, DEVICE(s
));
632 usb_desc_create_serial(dev
);
634 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
635 &usb_msd_scsi_info_storage
, NULL
);
636 scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, blk
, 0, !!s
->removable
,
637 s
->conf
.bootindex
, s
->conf
.share_rw
,
638 s
->conf
.rerror
, s
->conf
.werror
,
645 usb_msd_handle_reset(dev
);
646 s
->scsi_dev
= scsi_dev
;
649 static void usb_msd_bot_realize(USBDevice
*dev
, Error
**errp
)
651 MSDState
*s
= USB_STORAGE_DEV(dev
);
652 DeviceState
*d
= DEVICE(dev
);
654 usb_desc_create_serial(dev
);
657 s
->dev
.auto_attach
= 0;
660 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
661 &usb_msd_scsi_info_bot
, NULL
);
662 usb_msd_handle_reset(dev
);
665 static const VMStateDescription vmstate_usb_msd
= {
666 .name
= "usb-storage",
668 .minimum_version_id
= 1,
669 .fields
= (VMStateField
[]) {
670 VMSTATE_USB_DEVICE(dev
, MSDState
),
671 VMSTATE_UINT32(mode
, MSDState
),
672 VMSTATE_UINT32(scsi_len
, MSDState
),
673 VMSTATE_UINT32(scsi_off
, MSDState
),
674 VMSTATE_UINT32(data_len
, MSDState
),
675 VMSTATE_UINT32(csw
.sig
, MSDState
),
676 VMSTATE_UINT32(csw
.tag
, MSDState
),
677 VMSTATE_UINT32(csw
.residue
, MSDState
),
678 VMSTATE_UINT8(csw
.status
, MSDState
),
679 VMSTATE_END_OF_LIST()
683 static Property msd_properties
[] = {
684 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
685 DEFINE_BLOCK_ERROR_PROPERTIES(MSDState
, conf
),
686 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
687 DEFINE_PROP_END_OF_LIST(),
690 static void usb_msd_class_initfn_common(ObjectClass
*klass
, void *data
)
692 DeviceClass
*dc
= DEVICE_CLASS(klass
);
693 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
695 uc
->product_desc
= "QEMU USB MSD";
696 uc
->usb_desc
= &desc
;
697 uc
->cancel_packet
= usb_msd_cancel_io
;
698 uc
->handle_attach
= usb_desc_attach
;
699 uc
->handle_reset
= usb_msd_handle_reset
;
700 uc
->handle_control
= usb_msd_handle_control
;
701 uc
->handle_data
= usb_msd_handle_data
;
702 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
703 dc
->fw_name
= "storage";
704 dc
->vmsd
= &vmstate_usb_msd
;
707 static void usb_msd_class_storage_initfn(ObjectClass
*klass
, void *data
)
709 DeviceClass
*dc
= DEVICE_CLASS(klass
);
710 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
712 uc
->realize
= usb_msd_storage_realize
;
713 device_class_set_props(dc
, msd_properties
);
716 static void usb_msd_get_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
717 void *opaque
, Error
**errp
)
719 USBDevice
*dev
= USB_DEVICE(obj
);
720 MSDState
*s
= USB_STORAGE_DEV(dev
);
722 visit_type_int32(v
, name
, &s
->conf
.bootindex
, errp
);
725 static void usb_msd_set_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
726 void *opaque
, Error
**errp
)
728 USBDevice
*dev
= USB_DEVICE(obj
);
729 MSDState
*s
= USB_STORAGE_DEV(dev
);
731 Error
*local_err
= NULL
;
733 if (!visit_type_int32(v
, name
, &boot_index
, errp
)) {
736 /* check whether bootindex is present in fw_boot_order list */
737 check_boot_index(boot_index
, &local_err
);
741 /* change bootindex to a new one */
742 s
->conf
.bootindex
= boot_index
;
745 object_property_set_int(OBJECT(s
->scsi_dev
), "bootindex", boot_index
,
750 error_propagate(errp
, local_err
);
753 static const TypeInfo usb_storage_dev_type_info
= {
754 .name
= TYPE_USB_STORAGE
,
755 .parent
= TYPE_USB_DEVICE
,
756 .instance_size
= sizeof(MSDState
),
758 .class_init
= usb_msd_class_initfn_common
,
761 static void usb_msd_instance_init(Object
*obj
)
763 object_property_add(obj
, "bootindex", "int32",
764 usb_msd_get_bootindex
,
765 usb_msd_set_bootindex
, NULL
, NULL
);
766 object_property_set_int(obj
, "bootindex", -1, NULL
);
769 static void usb_msd_class_bot_initfn(ObjectClass
*klass
, void *data
)
771 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
773 uc
->realize
= usb_msd_bot_realize
;
774 uc
->attached_settable
= true;
777 static const TypeInfo msd_info
= {
778 .name
= "usb-storage",
779 .parent
= TYPE_USB_STORAGE
,
780 .class_init
= usb_msd_class_storage_initfn
,
781 .instance_init
= usb_msd_instance_init
,
784 static const TypeInfo bot_info
= {
786 .parent
= TYPE_USB_STORAGE
,
787 .class_init
= usb_msd_class_bot_initfn
,
790 static void usb_msd_register_types(void)
792 type_register_static(&usb_storage_dev_type_info
);
793 type_register_static(&msd_info
);
794 type_register_static(&bot_info
);
797 type_init(usb_msd_register_types
)