Statistics
| Branch: | Revision:

root / hw / usb-msd.c @ 2bac6019

History | View | Annotate | Download (15.1 kB)

1
/* 
2
 * USB Mass Storage Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Written by Paul Brook
6
 *
7
 * This code is licenced under the LGPL.
8
 */
9

    
10
#include "vl.h"
11

    
12
//#define DEBUG_MSD
13

    
14
#ifdef DEBUG_MSD
15
#define DPRINTF(fmt, args...) \
16
do { printf("usb-msd: " fmt , ##args); } while (0)
17
#else
18
#define DPRINTF(fmt, args...) do {} while(0)
19
#endif
20

    
21
/* USB requests.  */
22
#define MassStorageReset  0xff
23
#define GetMaxLun         0xfe
24

    
25
enum USBMSDMode {
26
    USB_MSDM_CBW, /* Command Block.  */
27
    USB_MSDM_DATAOUT, /* Tranfer data to device.  */
28
    USB_MSDM_DATAIN, /* Transfer data from device.  */
29
    USB_MSDM_CSW /* Command Status.  */
30
};
31

    
32
typedef struct {
33
    USBDevice dev;
34
    enum USBMSDMode mode;
35
    uint32_t scsi_len;
36
    uint8_t *scsi_buf;
37
    uint32_t usb_len;
38
    uint8_t *usb_buf;
39
    uint32_t data_len;
40
    uint32_t residue;
41
    uint32_t tag;
42
    BlockDriverState *bs;
43
    SCSIDevice *scsi_dev;
44
    int result;
45
    /* For async completion.  */
46
    USBPacket *packet;
47
} MSDState;
48

    
49
struct usb_msd_cbw {
50
    uint32_t sig;
51
    uint32_t tag;
52
    uint32_t data_len;
53
    uint8_t flags;
54
    uint8_t lun;
55
    uint8_t cmd_len;
56
    uint8_t cmd[16];
57
};
58

    
59
struct usb_msd_csw {
60
    uint32_t sig;
61
    uint32_t tag;
62
    uint32_t residue;
63
    uint8_t status;
64
};
65

    
66
static const uint8_t qemu_msd_dev_descriptor[] = {
67
        0x12,       /*  u8 bLength; */
68
        0x01,       /*  u8 bDescriptorType; Device */
69
        0x00, 0x01, /*  u16 bcdUSB; v1.0 */
70

    
71
        0x00,            /*  u8  bDeviceClass; */
72
        0x00,            /*  u8  bDeviceSubClass; */
73
        0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
74
        0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
75

    
76
        /* Vendor and product id are arbitrary.  */
77
        0x00, 0x00, /*  u16 idVendor; */
78
         0x00, 0x00, /*  u16 idProduct; */
79
        0x00, 0x00, /*  u16 bcdDevice */
80

    
81
        0x01,       /*  u8  iManufacturer; */
82
        0x02,       /*  u8  iProduct; */
83
        0x03,       /*  u8  iSerialNumber; */
84
        0x01        /*  u8  bNumConfigurations; */
85
};
86

    
87
static const uint8_t qemu_msd_config_descriptor[] = {
88

    
89
        /* one configuration */
90
        0x09,       /*  u8  bLength; */
91
        0x02,       /*  u8  bDescriptorType; Configuration */
92
        0x20, 0x00, /*  u16 wTotalLength; */
93
        0x01,       /*  u8  bNumInterfaces; (1) */
94
        0x01,       /*  u8  bConfigurationValue; */
95
        0x00,       /*  u8  iConfiguration; */
96
        0xc0,       /*  u8  bmAttributes; 
97
                                 Bit 7: must be set,
98
                                     6: Self-powered,
99
                                     5: Remote wakeup,
100
                                     4..0: resvd */
101
        0x00,       /*  u8  MaxPower; */
102
      
103
        /* one interface */
104
        0x09,       /*  u8  if_bLength; */
105
        0x04,       /*  u8  if_bDescriptorType; Interface */
106
        0x00,       /*  u8  if_bInterfaceNumber; */
107
        0x00,       /*  u8  if_bAlternateSetting; */
108
        0x02,       /*  u8  if_bNumEndpoints; */
109
        0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
110
        0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
111
        0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
112
        0x00,       /*  u8  if_iInterface; */
113
     
114
        /* Bulk-In endpoint */
115
        0x07,       /*  u8  ep_bLength; */
116
        0x05,       /*  u8  ep_bDescriptorType; Endpoint */
117
        0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
118
         0x02,       /*  u8  ep_bmAttributes; Bulk */
119
         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
120
        0x00,       /*  u8  ep_bInterval; */
121

    
122
        /* Bulk-Out endpoint */
123
        0x07,       /*  u8  ep_bLength; */
124
        0x05,       /*  u8  ep_bDescriptorType; Endpoint */
125
        0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
126
         0x02,       /*  u8  ep_bmAttributes; Bulk */
127
         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
128
        0x00        /*  u8  ep_bInterval; */
129
};
130

    
131
static void usb_msd_copy_data(MSDState *s)
132
{
133
    uint32_t len;
134
    len = s->usb_len;
135
    if (len > s->scsi_len)
136
        len = s->scsi_len;
137
    if (s->mode == USB_MSDM_DATAIN) {
138
        memcpy(s->usb_buf, s->scsi_buf, len);
139
    } else {
140
        memcpy(s->scsi_buf, s->usb_buf, len);
141
    }
142
    s->usb_len -= len;
143
    s->scsi_len -= len;
144
    s->usb_buf += len;
145
    s->scsi_buf += len;
146
    s->data_len -= len;
147
    if (s->scsi_len == 0) {
148
        if (s->mode == USB_MSDM_DATAIN) {
149
            scsi_read_data(s->scsi_dev, s->tag);
150
        } else if (s->mode == USB_MSDM_DATAOUT) {
151
            scsi_write_data(s->scsi_dev, s->tag);
152
        }
153
    }
154
}
155

    
156
static void usb_msd_send_status(MSDState *s)
157
{
158
    struct usb_msd_csw csw;
159

    
160
    csw.sig = cpu_to_le32(0x53425355);
161
    csw.tag = cpu_to_le32(s->tag);
162
    csw.residue = s->residue;
163
    csw.status = s->result;
164
    memcpy(s->usb_buf, &csw, 13);
165
}
166

    
167
static void usb_msd_command_complete(void *opaque, int reason, uint32_t tag,
168
                                     uint32_t arg)
169
{
170
    MSDState *s = (MSDState *)opaque;
171
    USBPacket *p = s->packet;
172

    
173
    if (tag != s->tag) {
174
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
175
    }
176
    if (reason == SCSI_REASON_DONE) {
177
        DPRINTF("Command complete %d\n", arg);
178
        s->residue = s->data_len;
179
        s->result = arg != 0;
180
        if (s->packet) {
181
            if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
182
                /* A deferred packet with no write data remaining must be
183
                   the status read packet.  */
184
                usb_msd_send_status(s);
185
                s->mode = USB_MSDM_CBW;
186
            } else {
187
                if (s->data_len) {
188
                    s->data_len -= s->usb_len;
189
                    if (s->mode == USB_MSDM_DATAIN)
190
                        memset(s->usb_buf, 0, s->usb_len);
191
                    s->usb_len = 0;
192
                }
193
                if (s->data_len == 0)
194
                    s->mode = USB_MSDM_CSW;
195
            }
196
            s->packet = NULL;
197
            usb_packet_complete(p);
198
        } else if (s->data_len == 0) {
199
            s->mode = USB_MSDM_CSW;
200
        }
201
        return;
202
    }
203
    s->scsi_len = arg;
204
    s->scsi_buf = scsi_get_buf(s->scsi_dev, tag);
205
    if (p) {
206
        usb_msd_copy_data(s);
207
        if (s->usb_len == 0) {
208
            /* Set s->packet to NULL before calling usb_packet_complete
209
               because annother request may be issued before
210
               usb_packet_complete returns.  */
211
            DPRINTF("Packet complete %p\n", p);
212
            s->packet = NULL;
213
            usb_packet_complete(p);
214
        }
215
    }
216
}
217

    
218
static void usb_msd_handle_reset(USBDevice *dev)
219
{
220
    MSDState *s = (MSDState *)dev;
221

    
222
    DPRINTF("Reset\n");
223
    s->mode = USB_MSDM_CBW;
224
}
225

    
226
static int usb_msd_handle_control(USBDevice *dev, int request, int value,
227
                                  int index, int length, uint8_t *data)
228
{
229
    MSDState *s = (MSDState *)dev;
230
    int ret = 0;
231

    
232
    switch (request) {
233
    case DeviceRequest | USB_REQ_GET_STATUS:
234
        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
235
            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
236
        data[1] = 0x00;
237
        ret = 2;
238
        break;
239
    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
240
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
241
            dev->remote_wakeup = 0;
242
        } else {
243
            goto fail;
244
        }
245
        ret = 0;
246
        break;
247
    case DeviceOutRequest | USB_REQ_SET_FEATURE:
248
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
249
            dev->remote_wakeup = 1;
250
        } else {
251
            goto fail;
252
        }
253
        ret = 0;
254
        break;
255
    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
256
        dev->addr = value;
257
        ret = 0;
258
        break;
259
    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
260
        switch(value >> 8) {
261
        case USB_DT_DEVICE:
262
            memcpy(data, qemu_msd_dev_descriptor, 
263
                   sizeof(qemu_msd_dev_descriptor));
264
            ret = sizeof(qemu_msd_dev_descriptor);
265
            break;
266
        case USB_DT_CONFIG:
267
            memcpy(data, qemu_msd_config_descriptor, 
268
                   sizeof(qemu_msd_config_descriptor));
269
            ret = sizeof(qemu_msd_config_descriptor);
270
            break;
271
        case USB_DT_STRING:
272
            switch(value & 0xff) {
273
            case 0:
274
                /* language ids */
275
                data[0] = 4;
276
                data[1] = 3;
277
                data[2] = 0x09;
278
                data[3] = 0x04;
279
                ret = 4;
280
                break;
281
            case 1:
282
                /* vendor description */
283
                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
284
                break;
285
            case 2:
286
                /* product description */
287
                ret = set_usb_string(data, "QEMU USB HARDDRIVE");
288
                break;
289
            case 3:
290
                /* serial number */
291
                ret = set_usb_string(data, "1");
292
                break;
293
            default:
294
                goto fail;
295
            }
296
            break;
297
        default:
298
            goto fail;
299
        }
300
        break;
301
    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
302
        data[0] = 1;
303
        ret = 1;
304
        break;
305
    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
306
        ret = 0;
307
        break;
308
    case DeviceRequest | USB_REQ_GET_INTERFACE:
309
        data[0] = 0;
310
        ret = 1;
311
        break;
312
    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
313
        ret = 0;
314
        break;
315
    case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
316
        if (value == 0 && index != 0x81) { /* clear ep halt */
317
            goto fail;
318
        }
319
        ret = 0;
320
        break;
321
        /* Class specific requests.  */
322
    case MassStorageReset:
323
        /* Reset state ready for the next CBW.  */
324
        s->mode = USB_MSDM_CBW;
325
        ret = 0;
326
        break;
327
    case GetMaxLun:
328
        data[0] = 0;
329
        ret = 1;
330
        break;
331
    default:
332
    fail:
333
        ret = USB_RET_STALL;
334
        break;
335
    }
336
    return ret;
337
}
338

    
339
static void usb_msd_cancel_io(USBPacket *p, void *opaque)
340
{
341
    MSDState *s = opaque;
342
    scsi_cancel_io(s->scsi_dev, s->tag);
343
    s->packet = NULL;
344
    s->scsi_len = 0;
345
}
346

    
347
static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
348
{
349
    MSDState *s = (MSDState *)dev;
350
    int ret = 0;
351
    struct usb_msd_cbw cbw;
352
    uint8_t devep = p->devep;
353
    uint8_t *data = p->data;
354
    int len = p->len;
355

    
356
    switch (p->pid) {
357
    case USB_TOKEN_OUT:
358
        if (devep != 2)
359
            goto fail;
360

    
361
        switch (s->mode) {
362
        case USB_MSDM_CBW:
363
            if (len != 31) {
364
                fprintf(stderr, "usb-msd: Bad CBW size");
365
                goto fail;
366
            }
367
            memcpy(&cbw, data, 31);
368
            if (le32_to_cpu(cbw.sig) != 0x43425355) {
369
                fprintf(stderr, "usb-msd: Bad signature %08x\n",
370
                        le32_to_cpu(cbw.sig));
371
                goto fail;
372
            }
373
            DPRINTF("Command on LUN %d\n", cbw.lun);
374
            if (cbw.lun != 0) {
375
                fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
376
                goto fail;
377
            }
378
            s->tag = le32_to_cpu(cbw.tag);
379
            s->data_len = le32_to_cpu(cbw.data_len);
380
            if (s->data_len == 0) {
381
                s->mode = USB_MSDM_CSW;
382
            } else if (cbw.flags & 0x80) {
383
                s->mode = USB_MSDM_DATAIN;
384
            } else {
385
                s->mode = USB_MSDM_DATAOUT;
386
            }
387
            DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
388
                    s->tag, cbw.flags, cbw.cmd_len, s->data_len);
389
            s->residue = 0;
390
            scsi_send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
391
            /* ??? Should check that USB and SCSI data transfer
392
               directions match.  */
393
            if (s->residue == 0) {
394
                if (s->mode == USB_MSDM_DATAIN) {
395
                    scsi_read_data(s->scsi_dev, s->tag);
396
                } else if (s->mode == USB_MSDM_DATAOUT) {
397
                    scsi_write_data(s->scsi_dev, s->tag);
398
                }
399
            }
400
            ret = len;
401
            break;
402

    
403
        case USB_MSDM_DATAOUT:
404
            DPRINTF("Data out %d/%d\n", len, s->data_len);
405
            if (len > s->data_len)
406
                goto fail;
407

    
408
            s->usb_buf = data;
409
            s->usb_len = len;
410
            if (s->scsi_len) {
411
                usb_msd_copy_data(s);
412
            }
413
            if (s->residue && s->usb_len) {
414
                s->data_len -= s->usb_len;
415
                if (s->data_len == 0)
416
                    s->mode = USB_MSDM_CSW;
417
                s->usb_len = 0;
418
            }
419
            if (s->usb_len) {
420
                DPRINTF("Deferring packet %p\n", p);
421
                usb_defer_packet(p, usb_msd_cancel_io, s);
422
                s->packet = p;
423
                ret = USB_RET_ASYNC;
424
            } else {
425
                ret = len;
426
            }
427
            break;
428

    
429
        default:
430
            DPRINTF("Unexpected write (len %d)\n", len);
431
            goto fail;
432
        }
433
        break;
434

    
435
    case USB_TOKEN_IN:
436
        if (devep != 1)
437
            goto fail;
438

    
439
        switch (s->mode) {
440
        case USB_MSDM_DATAOUT:
441
            if (s->data_len != 0 || len < 13)
442
                goto fail;
443
            /* Waiting for SCSI write to complete.  */
444
            usb_defer_packet(p, usb_msd_cancel_io, s);
445
            s->packet = p;
446
            ret = USB_RET_ASYNC;
447
            break;
448

    
449
        case USB_MSDM_CSW:
450
            DPRINTF("Command status %d tag 0x%x, len %d\n",
451
                    s->result, s->tag, len);
452
            if (len < 13)
453
                goto fail;
454

    
455
            s->usb_len = len;
456
            s->usb_buf = data;
457
            usb_msd_send_status(s);
458
            s->mode = USB_MSDM_CBW;
459
            ret = 13;
460
            break;
461

    
462
        case USB_MSDM_DATAIN:
463
            DPRINTF("Data in %d/%d\n", len, s->data_len);
464
            if (len > s->data_len)
465
                len = s->data_len;
466
            s->usb_buf = data;
467
            s->usb_len = len;
468
            if (s->scsi_len) {
469
                usb_msd_copy_data(s);
470
            }
471
            if (s->residue && s->usb_len) {
472
                s->data_len -= s->usb_len;
473
                memset(s->usb_buf, 0, s->usb_len);
474
                if (s->data_len == 0)
475
                    s->mode = USB_MSDM_CSW;
476
                s->usb_len = 0;
477
            }
478
            if (s->usb_len) {
479
                DPRINTF("Deferring packet %p\n", p);
480
                usb_defer_packet(p, usb_msd_cancel_io, s);
481
                s->packet = p;
482
                ret = USB_RET_ASYNC;
483
            } else {
484
                ret = len;
485
            }
486
            break;
487

    
488
        default:
489
            DPRINTF("Unexpected read (len %d)\n", len);
490
            goto fail;
491
        }
492
        break;
493

    
494
    default:
495
        DPRINTF("Bad token\n");
496
    fail:
497
        ret = USB_RET_STALL;
498
        break;
499
    }
500

    
501
    return ret;
502
}
503

    
504
static void usb_msd_handle_destroy(USBDevice *dev)
505
{
506
    MSDState *s = (MSDState *)dev;
507

    
508
    scsi_disk_destroy(s->scsi_dev);
509
    bdrv_delete(s->bs);
510
    qemu_free(s);
511
}
512

    
513
USBDevice *usb_msd_init(const char *filename)
514
{
515
    MSDState *s;
516
    BlockDriverState *bdrv;
517

    
518
    s = qemu_mallocz(sizeof(MSDState));
519
    if (!s)
520
        return NULL;
521

    
522
    bdrv = bdrv_new("usb");
523
    if (bdrv_open(bdrv, filename, 0) < 0)
524
        goto fail;
525
    if (qemu_key_check(bdrv, filename))
526
        goto fail;
527
    s->bs = bdrv;
528

    
529
    s->dev.speed = USB_SPEED_FULL;
530
    s->dev.handle_packet = usb_generic_handle_packet;
531

    
532
    s->dev.handle_reset = usb_msd_handle_reset;
533
    s->dev.handle_control = usb_msd_handle_control;
534
    s->dev.handle_data = usb_msd_handle_data;
535
    s->dev.handle_destroy = usb_msd_handle_destroy;
536

    
537
    snprintf(s->dev.devname, sizeof(s->dev.devname), "QEMU USB MSD(%.16s)",
538
             filename);
539

    
540
    s->scsi_dev = scsi_disk_init(bdrv, 0, usb_msd_command_complete, s);
541
    usb_msd_handle_reset((USBDevice *)s);
542
    return (USBDevice *)s;
543
 fail:
544
    qemu_free(s);
545
    return NULL;
546
}