2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "qemu/error-report.h"
13 #include "qemu/module.h"
14 #include "qemu/option.h"
15 #include "qemu/config-file.h"
18 #include "hw/qdev-properties.h"
19 #include "hw/scsi/scsi.h"
20 #include "ui/console.h"
21 #include "migration/vmstate.h"
22 #include "monitor/monitor.h"
23 #include "sysemu/sysemu.h"
24 #include "sysemu/block-backend.h"
25 #include "qapi/visitor.h"
26 #include "qemu/cutils.h"
31 #define DPRINTF(fmt, ...) \
32 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
34 #define DPRINTF(fmt, ...) do {} while(0)
38 #define MassStorageReset 0xff
39 #define GetMaxLun 0xfe
42 USB_MSDM_CBW
, /* Command Block. */
43 USB_MSDM_DATAOUT
, /* Transfer data to device. */
44 USB_MSDM_DATAIN
, /* Transfer data from device. */
45 USB_MSDM_CSW
/* Command Status. */
61 struct usb_msd_csw csw
;
64 /* For async completion. */
66 /* usb-storage only */
72 #define TYPE_USB_STORAGE "usb-storage-dev"
73 #define USB_STORAGE_DEV(obj) OBJECT_CHECK(MSDState, (obj), TYPE_USB_STORAGE)
94 static const USBDescStrings desc_strings
= {
95 [STR_MANUFACTURER
] = "QEMU",
96 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
97 [STR_SERIALNUMBER
] = "1",
98 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
99 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
100 [STR_CONFIG_SUPER
] = "Super speed config (usb 3.0)",
103 static const USBDescIface desc_iface_full
= {
104 .bInterfaceNumber
= 0,
106 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
107 .bInterfaceSubClass
= 0x06, /* SCSI */
108 .bInterfaceProtocol
= 0x50, /* Bulk */
109 .eps
= (USBDescEndpoint
[]) {
111 .bEndpointAddress
= USB_DIR_IN
| 0x01,
112 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
113 .wMaxPacketSize
= 64,
115 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
116 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
117 .wMaxPacketSize
= 64,
122 static const USBDescDevice desc_device_full
= {
124 .bMaxPacketSize0
= 8,
125 .bNumConfigurations
= 1,
126 .confs
= (USBDescConfig
[]) {
129 .bConfigurationValue
= 1,
130 .iConfiguration
= STR_CONFIG_FULL
,
131 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
133 .ifs
= &desc_iface_full
,
138 static const USBDescIface desc_iface_high
= {
139 .bInterfaceNumber
= 0,
141 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
142 .bInterfaceSubClass
= 0x06, /* SCSI */
143 .bInterfaceProtocol
= 0x50, /* Bulk */
144 .eps
= (USBDescEndpoint
[]) {
146 .bEndpointAddress
= USB_DIR_IN
| 0x01,
147 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
148 .wMaxPacketSize
= 512,
150 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
151 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
152 .wMaxPacketSize
= 512,
157 static const USBDescDevice desc_device_high
= {
159 .bMaxPacketSize0
= 64,
160 .bNumConfigurations
= 1,
161 .confs
= (USBDescConfig
[]) {
164 .bConfigurationValue
= 1,
165 .iConfiguration
= STR_CONFIG_HIGH
,
166 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
168 .ifs
= &desc_iface_high
,
173 static const USBDescIface desc_iface_super
= {
174 .bInterfaceNumber
= 0,
176 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
177 .bInterfaceSubClass
= 0x06, /* SCSI */
178 .bInterfaceProtocol
= 0x50, /* Bulk */
179 .eps
= (USBDescEndpoint
[]) {
181 .bEndpointAddress
= USB_DIR_IN
| 0x01,
182 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
183 .wMaxPacketSize
= 1024,
186 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
187 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
188 .wMaxPacketSize
= 1024,
194 static const USBDescDevice desc_device_super
= {
196 .bMaxPacketSize0
= 9,
197 .bNumConfigurations
= 1,
198 .confs
= (USBDescConfig
[]) {
201 .bConfigurationValue
= 1,
202 .iConfiguration
= STR_CONFIG_SUPER
,
203 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
205 .ifs
= &desc_iface_super
,
210 static const USBDesc desc
= {
212 .idVendor
= 0x46f4, /* CRC16() of "QEMU" */
215 .iManufacturer
= STR_MANUFACTURER
,
216 .iProduct
= STR_PRODUCT
,
217 .iSerialNumber
= STR_SERIALNUMBER
,
219 .full
= &desc_device_full
,
220 .high
= &desc_device_high
,
221 .super
= &desc_device_super
,
225 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
228 len
= p
->iov
.size
- p
->actual_length
;
229 if (len
> s
->scsi_len
)
231 usb_packet_copy(p
, scsi_req_get_buf(s
->req
) + s
->scsi_off
, len
);
235 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
236 scsi_req_continue(s
->req
);
240 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
244 DPRINTF("Command status %d tag 0x%x, len %zd\n",
245 s
->csw
.status
, le32_to_cpu(s
->csw
.tag
), p
->iov
.size
);
247 assert(s
->csw
.sig
== cpu_to_le32(0x53425355));
248 len
= MIN(sizeof(s
->csw
), p
->iov
.size
);
249 usb_packet_copy(p
, &s
->csw
, len
);
250 memset(&s
->csw
, 0, sizeof(s
->csw
));
253 static void usb_msd_packet_complete(MSDState
*s
)
255 USBPacket
*p
= s
->packet
;
257 /* Set s->packet to NULL before calling usb_packet_complete
258 because another request may be issued before
259 usb_packet_complete returns. */
260 DPRINTF("Packet complete %p\n", p
);
262 usb_packet_complete(&s
->dev
, p
);
265 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
267 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
268 USBPacket
*p
= s
->packet
;
270 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
274 usb_msd_copy_data(s
, p
);
276 if (p
&& p
->actual_length
== p
->iov
.size
) {
277 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
278 usb_msd_packet_complete(s
);
283 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
285 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
286 USBPacket
*p
= s
->packet
;
288 DPRINTF("Command complete %d tag 0x%x\n", status
, req
->tag
);
290 s
->csw
.sig
= cpu_to_le32(0x53425355);
291 s
->csw
.tag
= cpu_to_le32(req
->tag
);
292 s
->csw
.residue
= cpu_to_le32(s
->data_len
);
293 s
->csw
.status
= status
!= 0;
296 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
297 /* A deferred packet with no write data remaining must be
298 the status read packet. */
299 usb_msd_send_status(s
, p
);
300 s
->mode
= USB_MSDM_CBW
;
301 } else if (s
->mode
== USB_MSDM_CSW
) {
302 usb_msd_send_status(s
, p
);
303 s
->mode
= USB_MSDM_CBW
;
306 int len
= (p
->iov
.size
- p
->actual_length
);
307 usb_packet_skip(p
, len
);
310 if (s
->data_len
== 0) {
311 s
->mode
= USB_MSDM_CSW
;
314 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
315 usb_msd_packet_complete(s
);
316 } else if (s
->data_len
== 0) {
317 s
->mode
= USB_MSDM_CSW
;
323 static void usb_msd_request_cancelled(SCSIRequest
*req
)
325 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
328 scsi_req_unref(s
->req
);
334 static void usb_msd_handle_reset(USBDevice
*dev
)
336 MSDState
*s
= (MSDState
*)dev
;
340 scsi_req_cancel(s
->req
);
342 assert(s
->req
== NULL
);
345 s
->packet
->status
= USB_RET_STALL
;
346 usb_msd_packet_complete(s
);
349 s
->mode
= USB_MSDM_CBW
;
352 static void usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
353 int request
, int value
, int index
, int length
, uint8_t *data
)
355 MSDState
*s
= (MSDState
*)dev
;
356 SCSIDevice
*scsi_dev
;
359 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
365 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
367 /* Class specific requests. */
368 case ClassInterfaceOutRequest
| MassStorageReset
:
369 /* Reset state ready for the next CBW. */
370 s
->mode
= USB_MSDM_CBW
;
372 case ClassInterfaceRequest
| GetMaxLun
:
375 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, maxlun
+1);
376 if (scsi_dev
== NULL
) {
379 if (scsi_dev
->lun
!= maxlun
+1) {
384 DPRINTF("MaxLun %d\n", maxlun
);
386 p
->actual_length
= 1;
389 p
->status
= USB_RET_STALL
;
394 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
396 MSDState
*s
= USB_STORAGE_DEV(dev
);
398 assert(s
->packet
== p
);
402 scsi_req_cancel(s
->req
);
406 static void usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
408 MSDState
*s
= (MSDState
*)dev
;
410 struct usb_msd_cbw cbw
;
411 uint8_t devep
= p
->ep
->nr
;
412 SCSIDevice
*scsi_dev
;
422 if (p
->iov
.size
!= 31) {
423 error_report("usb-msd: Bad CBW size");
426 usb_packet_copy(p
, &cbw
, 31);
427 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
428 error_report("usb-msd: Bad signature %08x",
429 le32_to_cpu(cbw
.sig
));
432 DPRINTF("Command on LUN %d\n", cbw
.lun
);
433 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, cbw
.lun
);
434 if (scsi_dev
== NULL
) {
435 error_report("usb-msd: Bad LUN %d", cbw
.lun
);
438 tag
= le32_to_cpu(cbw
.tag
);
439 s
->data_len
= le32_to_cpu(cbw
.data_len
);
440 if (s
->data_len
== 0) {
441 s
->mode
= USB_MSDM_CSW
;
442 } else if (cbw
.flags
& 0x80) {
443 s
->mode
= USB_MSDM_DATAIN
;
445 s
->mode
= USB_MSDM_DATAOUT
;
447 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
448 tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
449 assert(le32_to_cpu(s
->csw
.residue
) == 0);
451 s
->req
= scsi_req_new(scsi_dev
, tag
, cbw
.lun
, cbw
.cmd
, NULL
);
453 scsi_req_print(s
->req
);
455 len
= scsi_req_enqueue(s
->req
);
457 scsi_req_continue(s
->req
);
461 case USB_MSDM_DATAOUT
:
462 DPRINTF("Data out %zd/%d\n", p
->iov
.size
, s
->data_len
);
463 if (p
->iov
.size
> s
->data_len
) {
468 usb_msd_copy_data(s
, p
);
470 if (le32_to_cpu(s
->csw
.residue
)) {
471 int len
= p
->iov
.size
- p
->actual_length
;
473 usb_packet_skip(p
, len
);
475 if (s
->data_len
== 0) {
476 s
->mode
= USB_MSDM_CSW
;
480 if (p
->actual_length
< p
->iov
.size
) {
481 DPRINTF("Deferring packet %p [wait data-out]\n", p
);
483 p
->status
= USB_RET_ASYNC
;
488 DPRINTF("Unexpected write (len %zd)\n", p
->iov
.size
);
498 case USB_MSDM_DATAOUT
:
499 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
502 /* Waiting for SCSI write to complete. */
504 p
->status
= USB_RET_ASYNC
;
508 if (p
->iov
.size
< 13) {
513 /* still in flight */
514 DPRINTF("Deferring packet %p [wait status]\n", p
);
516 p
->status
= USB_RET_ASYNC
;
518 usb_msd_send_status(s
, p
);
519 s
->mode
= USB_MSDM_CBW
;
523 case USB_MSDM_DATAIN
:
524 DPRINTF("Data in %zd/%d, scsi_len %d\n",
525 p
->iov
.size
, s
->data_len
, s
->scsi_len
);
527 usb_msd_copy_data(s
, p
);
529 if (le32_to_cpu(s
->csw
.residue
)) {
530 int len
= p
->iov
.size
- p
->actual_length
;
532 usb_packet_skip(p
, len
);
534 if (s
->data_len
== 0) {
535 s
->mode
= USB_MSDM_CSW
;
539 if (p
->actual_length
< p
->iov
.size
) {
540 DPRINTF("Deferring packet %p [wait data-in]\n", p
);
542 p
->status
= USB_RET_ASYNC
;
547 DPRINTF("Unexpected read (len %zd)\n", p
->iov
.size
);
553 DPRINTF("Bad token\n");
555 p
->status
= USB_RET_STALL
;
560 static void *usb_msd_load_request(QEMUFile
*f
, SCSIRequest
*req
)
562 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
564 /* nothing to load, just store req in our state struct */
565 assert(s
->req
== NULL
);
571 static const struct SCSIBusInfo usb_msd_scsi_info_storage
= {
576 .transfer_data
= usb_msd_transfer_data
,
577 .complete
= usb_msd_command_complete
,
578 .cancel
= usb_msd_request_cancelled
,
579 .load_request
= usb_msd_load_request
,
582 static const struct SCSIBusInfo usb_msd_scsi_info_bot
= {
587 .transfer_data
= usb_msd_transfer_data
,
588 .complete
= usb_msd_command_complete
,
589 .cancel
= usb_msd_request_cancelled
,
590 .load_request
= usb_msd_load_request
,
593 static void usb_msd_storage_realize(USBDevice
*dev
, Error
**errp
)
595 MSDState
*s
= USB_STORAGE_DEV(dev
);
596 BlockBackend
*blk
= s
->conf
.blk
;
597 SCSIDevice
*scsi_dev
;
600 error_setg(errp
, "drive property not set");
604 blkconf_blocksizes(&s
->conf
);
605 if (!blkconf_apply_backend_options(&s
->conf
, blk_is_read_only(blk
), true,
611 * Hack alert: this pretends to be a block device, but it's really
612 * a SCSI bus that can serve only a single device, which it
613 * creates automatically. But first it needs to detach from its
614 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
615 * attaches again. We also need to take another reference so that
616 * blk_detach_dev() doesn't free blk while we still need it.
618 * The hack is probably a bad idea.
621 blk_detach_dev(blk
, DEVICE(s
));
624 usb_desc_create_serial(dev
);
626 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
627 &usb_msd_scsi_info_storage
, NULL
);
628 scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, blk
, 0, !!s
->removable
,
629 s
->conf
.bootindex
, s
->conf
.share_rw
,
630 s
->conf
.rerror
, s
->conf
.werror
,
637 usb_msd_handle_reset(dev
);
638 s
->scsi_dev
= scsi_dev
;
641 static void usb_msd_bot_realize(USBDevice
*dev
, Error
**errp
)
643 MSDState
*s
= USB_STORAGE_DEV(dev
);
644 DeviceState
*d
= DEVICE(dev
);
646 usb_desc_create_serial(dev
);
649 s
->dev
.auto_attach
= 0;
652 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
653 &usb_msd_scsi_info_bot
, NULL
);
654 usb_msd_handle_reset(dev
);
657 static const VMStateDescription vmstate_usb_msd
= {
658 .name
= "usb-storage",
660 .minimum_version_id
= 1,
661 .fields
= (VMStateField
[]) {
662 VMSTATE_USB_DEVICE(dev
, MSDState
),
663 VMSTATE_UINT32(mode
, MSDState
),
664 VMSTATE_UINT32(scsi_len
, MSDState
),
665 VMSTATE_UINT32(scsi_off
, MSDState
),
666 VMSTATE_UINT32(data_len
, MSDState
),
667 VMSTATE_UINT32(csw
.sig
, MSDState
),
668 VMSTATE_UINT32(csw
.tag
, MSDState
),
669 VMSTATE_UINT32(csw
.residue
, MSDState
),
670 VMSTATE_UINT8(csw
.status
, MSDState
),
671 VMSTATE_END_OF_LIST()
675 static Property msd_properties
[] = {
676 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
677 DEFINE_BLOCK_ERROR_PROPERTIES(MSDState
, conf
),
678 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
679 DEFINE_PROP_END_OF_LIST(),
682 static void usb_msd_class_initfn_common(ObjectClass
*klass
, void *data
)
684 DeviceClass
*dc
= DEVICE_CLASS(klass
);
685 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
687 uc
->product_desc
= "QEMU USB MSD";
688 uc
->usb_desc
= &desc
;
689 uc
->cancel_packet
= usb_msd_cancel_io
;
690 uc
->handle_attach
= usb_desc_attach
;
691 uc
->handle_reset
= usb_msd_handle_reset
;
692 uc
->handle_control
= usb_msd_handle_control
;
693 uc
->handle_data
= usb_msd_handle_data
;
694 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
695 dc
->fw_name
= "storage";
696 dc
->vmsd
= &vmstate_usb_msd
;
699 static void usb_msd_class_storage_initfn(ObjectClass
*klass
, void *data
)
701 DeviceClass
*dc
= DEVICE_CLASS(klass
);
702 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
704 uc
->realize
= usb_msd_storage_realize
;
705 dc
->props
= msd_properties
;
708 static void usb_msd_get_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
709 void *opaque
, Error
**errp
)
711 USBDevice
*dev
= USB_DEVICE(obj
);
712 MSDState
*s
= USB_STORAGE_DEV(dev
);
714 visit_type_int32(v
, name
, &s
->conf
.bootindex
, errp
);
717 static void usb_msd_set_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
718 void *opaque
, Error
**errp
)
720 USBDevice
*dev
= USB_DEVICE(obj
);
721 MSDState
*s
= USB_STORAGE_DEV(dev
);
723 Error
*local_err
= NULL
;
725 visit_type_int32(v
, name
, &boot_index
, &local_err
);
729 /* check whether bootindex is present in fw_boot_order list */
730 check_boot_index(boot_index
, &local_err
);
734 /* change bootindex to a new one */
735 s
->conf
.bootindex
= boot_index
;
738 object_property_set_int(OBJECT(s
->scsi_dev
), boot_index
, "bootindex",
743 error_propagate(errp
, local_err
);
746 static const TypeInfo usb_storage_dev_type_info
= {
747 .name
= TYPE_USB_STORAGE
,
748 .parent
= TYPE_USB_DEVICE
,
749 .instance_size
= sizeof(MSDState
),
751 .class_init
= usb_msd_class_initfn_common
,
754 static void usb_msd_instance_init(Object
*obj
)
756 object_property_add(obj
, "bootindex", "int32",
757 usb_msd_get_bootindex
,
758 usb_msd_set_bootindex
, NULL
, NULL
, NULL
);
759 object_property_set_int(obj
, -1, "bootindex", NULL
);
762 static void usb_msd_class_bot_initfn(ObjectClass
*klass
, void *data
)
764 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
766 uc
->realize
= usb_msd_bot_realize
;
767 uc
->attached_settable
= true;
770 static const TypeInfo msd_info
= {
771 .name
= "usb-storage",
772 .parent
= TYPE_USB_STORAGE
,
773 .class_init
= usb_msd_class_storage_initfn
,
774 .instance_init
= usb_msd_instance_init
,
777 static const TypeInfo bot_info
= {
779 .parent
= TYPE_USB_STORAGE
,
780 .class_init
= usb_msd_class_bot_initfn
,
783 static void usb_msd_register_types(void)
785 type_register_static(&usb_storage_dev_type_info
);
786 type_register_static(&msd_info
);
787 type_register_static(&bot_info
);
790 type_init(usb_msd_register_types
)