hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "vl.h"
  11
  12 //#define DEBUG_MSD
  13
  14 #ifdef DEBUG_MSD
  15 #define DPRINTF(fmt, args...) \
  16 do { printf("usb-msd: " fmt , ##args); } while (0)
  17 #else
  18 #define DPRINTF(fmt, args...) do {} while(0)
  19 #endif
  20
  21 /* USB requests.  */
  22 #define MassStorageReset  0xff
  23 #define GetMaxLun         0xfe
  24
  25 enum USBMSDMode {
  26     USB_MSDM_CBW, /* Command Block.  */
  27     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  28     USB_MSDM_DATAIN, /* Transfer data from device.  */
  29     USB_MSDM_CSW /* Command Status.  */
  30 };
  31
  32 typedef struct {
  33     USBDevice dev;
  34     enum USBMSDMode mode;
  35     uint32_t data_len;
  36     uint32_t tag;
  37     SCSIDevice *scsi_dev;
  38     int result;
  39 } MSDState;
  40
  41 static const uint8_t qemu_msd_dev_descriptor[] = {
  42         0x12,       /*  u8 bLength; */
  43         0x01,       /*  u8 bDescriptorType; Device */
  44         0x10, 0x00, /*  u16 bcdUSB; v1.0 */
  45
  46         0x00,       /*  u8  bDeviceClass; */
  47         0x00,       /*  u8  bDeviceSubClass; */
  48         0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
  49         0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
  50
  51         /* Vendor and product id are arbitrary.  */
  52         0x00, 0x00, /*  u16 idVendor; */
  53         0x00, 0x00, /*  u16 idProduct; */
  54         0x00, 0x00, /*  u16 bcdDevice */
  55
  56         0x01,       /*  u8  iManufacturer; */
  57         0x02,       /*  u8  iProduct; */
  58         0x03,       /*  u8  iSerialNumber; */
  59         0x01        /*  u8  bNumConfigurations; */
  60 };
  61
  62 static const uint8_t qemu_msd_config_descriptor[] = {
  63
  64         /* one configuration */
  65         0x09,       /*  u8  bLength; */
  66         0x02,       /*  u8  bDescriptorType; Configuration */
  67         0x20, 0x00, /*  u16 wTotalLength; */
  68         0x01,       /*  u8  bNumInterfaces; (1) */
  69         0x01,       /*  u8  bConfigurationValue; */
  70         0x00,       /*  u8  iConfiguration; */
  71         0xc0,       /*  u8  bmAttributes;
  72                                  Bit 7: must be set,
  73                                      6: Self-powered,
  74                                      5: Remote wakeup,
  75                                      4..0: resvd */
  76         0x00,       /*  u8  MaxPower; */
  77
  78         /* one interface */
  79         0x09,       /*  u8  if_bLength; */
  80         0x04,       /*  u8  if_bDescriptorType; Interface */
  81         0x00,       /*  u8  if_bInterfaceNumber; */
  82         0x00,       /*  u8  if_bAlternateSetting; */
  83         0x02,       /*  u8  if_bNumEndpoints; */
  84         0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
  85         0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
  86         0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
  87         0x00,       /*  u8  if_iInterface; */
  88
  89         /* Bulk-In endpoint */
  90         0x07,       /*  u8  ep_bLength; */
  91         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
  92         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
  93         0x02,       /*  u8  ep_bmAttributes; Bulk */
  94         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
  95         0x00,       /*  u8  ep_bInterval; */
  96
  97         /* Bulk-Out endpoint */
  98         0x07,       /*  u8  ep_bLength; */
  99         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 100         0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 101         0x02,       /*  u8  ep_bmAttributes; Bulk */
 102         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 103         0x00        /*  u8  ep_bInterval; */
 104 };
 105
 106 static void usb_msd_command_complete(void *opaque, uint32_t tag, int fail)
 107 {
 108     MSDState *s = (MSDState *)opaque;
 109
 110     DPRINTF("Command complete\n");
 111     s->result = fail;
 112     s->mode = USB_MSDM_CSW;
 113 }
 114
 115 static void usb_msd_handle_reset(USBDevice *dev, int destroy)
 116 {
 117     MSDState *s = (MSDState *)dev;
 118
 119     DPRINTF("Reset\n");
 120     s->mode = USB_MSDM_CBW;
 121     if (destroy) {
 122         scsi_disk_destroy(s->scsi_dev);
 123         qemu_free(s);
 124     }
 125 }
 126
 127 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 128                                   int index, int length, uint8_t *data)
 129 {
 130     MSDState *s = (MSDState *)dev;
 131     int ret = 0;
 132
 133     switch (request) {
 134     case DeviceRequest | USB_REQ_GET_STATUS:
 135         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 136             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 137         data[1] = 0x00;
 138         ret = 2;
 139         break;
 140     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 141         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 142             dev->remote_wakeup = 0;
 143         } else {
 144             goto fail;
 145         }
 146         ret = 0;
 147         break;
 148     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 149         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 150             dev->remote_wakeup = 1;
 151         } else {
 152             goto fail;
 153         }
 154         ret = 0;
 155         break;
 156     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 157         dev->addr = value;
 158         ret = 0;
 159         break;
 160     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 161         switch(value >> 8) {
 162         case USB_DT_DEVICE:
 163             memcpy(data, qemu_msd_dev_descriptor,
 164                    sizeof(qemu_msd_dev_descriptor));
 165             ret = sizeof(qemu_msd_dev_descriptor);
 166             break;
 167         case USB_DT_CONFIG:
 168             memcpy(data, qemu_msd_config_descriptor,
 169                    sizeof(qemu_msd_config_descriptor));
 170             ret = sizeof(qemu_msd_config_descriptor);
 171             break;
 172         case USB_DT_STRING:
 173             switch(value & 0xff) {
 174             case 0:
 175                 /* language ids */
 176                 data[0] = 4;
 177                 data[1] = 3;
 178                 data[2] = 0x09;
 179                 data[3] = 0x04;
 180                 ret = 4;
 181                 break;
 182             case 1:
 183                 /* vendor description */
 184                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
 185                 break;
 186             case 2:
 187                 /* product description */
 188                 ret = set_usb_string(data, "QEMU USB HARDDRIVE");
 189                 break;
 190             case 3:
 191                 /* serial number */
 192                 ret = set_usb_string(data, "1");
 193                 break;
 194             default:
 195                 goto fail;
 196             }
 197             break;
 198         default:
 199             goto fail;
 200         }
 201         break;
 202     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 203         data[0] = 1;
 204         ret = 1;
 205         break;
 206     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 207         ret = 0;
 208         break;
 209     case DeviceRequest | USB_REQ_GET_INTERFACE:
 210         data[0] = 0;
 211         ret = 1;
 212         break;
 213     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 214         ret = 0;
 215         break;
 216     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 217         if (value == 0 && index != 0x81) { /* clear ep halt */
 218             goto fail;
 219         }
 220         ret = 0;
 221         break;
 222         /* Class specific requests.  */
 223     case MassStorageReset:
 224         /* Reset state ready for the next CBW.  */
 225         s->mode = USB_MSDM_CBW;
 226         ret = 0;
 227         break;
 228     case GetMaxLun:
 229         data[0] = 0;
 230         ret = 1;
 231         break;
 232     default:
 233     fail:
 234         ret = USB_RET_STALL;
 235         break;
 236     }
 237     return ret;
 238 }
 239
 240 struct usb_msd_cbw {
 241     uint32_t sig;
 242     uint32_t tag;
 243     uint32_t data_len;
 244     uint8_t flags;
 245     uint8_t lun;
 246     uint8_t cmd_len;
 247     uint8_t cmd[16];
 248 };
 249
 250 struct usb_msd_csw {
 251     uint32_t sig;
 252     uint32_t tag;
 253     uint32_t residue;
 254     uint8_t status;
 255 };
 256
 257 static int usb_msd_handle_data(USBDevice *dev, int pid, uint8_t devep,
 258                                uint8_t *data, int len)
 259 {
 260     MSDState *s = (MSDState *)dev;
 261     int ret = 0;
 262     struct usb_msd_cbw cbw;
 263     struct usb_msd_csw csw;
 264
 265     switch (pid) {
 266     case USB_TOKEN_OUT:
 267         if (devep != 2)
 268             goto fail;
 269
 270         switch (s->mode) {
 271         case USB_MSDM_CBW:
 272             if (len != 31) {
 273                 fprintf(stderr, "usb-msd: Bad CBW size");
 274                 goto fail;
 275             }
 276             memcpy(&cbw, data, 31);
 277             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 278                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 279                         le32_to_cpu(cbw.sig));
 280                 goto fail;
 281             }
 282             DPRINTF("Command on LUN %d\n", cbw.lun);
 283             if (cbw.lun != 0) {
 284                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 285                 goto fail;
 286             }
 287             s->tag = le32_to_cpu(cbw.tag);
 288             s->data_len = le32_to_cpu(cbw.data_len);
 289             if (s->data_len == 0) {
 290                 s->mode = USB_MSDM_CSW;
 291             } else if (cbw.flags & 0x80) {
 292                 s->mode = USB_MSDM_DATAIN;
 293             } else {
 294                 s->mode = USB_MSDM_DATAOUT;
 295             }
 296             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 297                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 298             scsi_send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 299             ret = len;
 300             break;
 301
 302         case USB_MSDM_DATAOUT:
 303             DPRINTF("Data out %d/%d\n", len, s->data_len);
 304             if (len > s->data_len)
 305                 goto fail;
 306
 307             if (scsi_write_data(s->scsi_dev, data, len))
 308                 goto fail;
 309
 310             s->data_len -= len;
 311             if (s->data_len == 0)
 312                 s->mode = USB_MSDM_CSW;
 313             ret = len;
 314             break;
 315
 316         default:
 317             DPRINTF("Unexpected write (len %d)\n", len);
 318             goto fail;
 319         }
 320         break;
 321
 322     case USB_TOKEN_IN:
 323         if (devep != 1)
 324             goto fail;
 325
 326         switch (s->mode) {
 327         case USB_MSDM_CSW:
 328             DPRINTF("Command status %d tag 0x%x, len %d\n",
 329                     s->result, s->tag, len);
 330             if (len < 13)
 331                 goto fail;
 332
 333             csw.sig = cpu_to_le32(0x53425355);
 334             csw.tag = cpu_to_le32(s->tag);
 335             csw.residue = 0;
 336             csw.status = s->result;
 337             memcpy(data, &csw, 13);
 338             ret = 13;
 339             s->mode = USB_MSDM_CBW;
 340             break;
 341
 342         case USB_MSDM_DATAIN:
 343             DPRINTF("Data in %d/%d\n", len, s->data_len);
 344             if (len > s->data_len)
 345                 len = s->data_len;
 346
 347             if (scsi_read_data(s->scsi_dev, data, len))
 348                 goto fail;
 349
 350             s->data_len -= len;
 351             if (s->data_len == 0)
 352                 s->mode = USB_MSDM_CSW;
 353             ret = len;
 354             break;
 355
 356         default:
 357             DPRINTF("Unexpected read (len %d)\n", len);
 358             goto fail;
 359         }
 360         break;
 361
 362     default:
 363         DPRINTF("Bad token\n");
 364     fail:
 365         ret = USB_RET_STALL;
 366         break;
 367     }
 368
 369     return ret;
 370 }
 371
 372
 373 USBDevice *usb_msd_init(const char *filename)
 374 {
 375     MSDState *s;
 376     BlockDriverState *bdrv;
 377
 378     s = qemu_mallocz(sizeof(MSDState));
 379     if (!s)
 380         return NULL;
 381
 382     bdrv = bdrv_new("usb");
 383     bdrv_open(bdrv, filename, 0);
 384
 385     s->dev.speed = USB_SPEED_FULL;
 386     s->dev.handle_packet = usb_generic_handle_packet;
 387
 388     s->dev.handle_reset = usb_msd_handle_reset;
 389     s->dev.handle_control = usb_msd_handle_control;
 390     s->dev.handle_data = usb_msd_handle_data;
 391
 392     s->scsi_dev = scsi_disk_init(bdrv, usb_msd_command_complete, s);
 393     usb_msd_handle_reset((USBDevice *)s, 0);
 394     return (USBDevice *)s;
 395 }