Statistics
| Branch: | Revision:

root / hw / usb-msd.c @ 33e66b86

History | View | Annotate | Download (16.9 kB)

1
/*
2
 * USB Mass Storage Device emulation
3
 *
4
 * Copyright (c) 2006 CodeSourcery.
5
 * Written by Paul Brook
6
 *
7
 * This code is licenced under the LGPL.
8
 */
9

    
10
#include "qemu-common.h"
11
#include "qemu-option.h"
12
#include "qemu-config.h"
13
#include "usb.h"
14
#include "block.h"
15
#include "scsi-disk.h"
16
#include "console.h"
17

    
18
//#define DEBUG_MSD
19

    
20
#ifdef DEBUG_MSD
21
#define DPRINTF(fmt, ...) \
22
do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
23
#else
24
#define DPRINTF(fmt, ...) do {} while(0)
25
#endif
26

    
27
/* USB requests.  */
28
#define MassStorageReset  0xff
29
#define GetMaxLun         0xfe
30

    
31
enum USBMSDMode {
32
    USB_MSDM_CBW, /* Command Block.  */
33
    USB_MSDM_DATAOUT, /* Tranfer data to device.  */
34
    USB_MSDM_DATAIN, /* Transfer data from device.  */
35
    USB_MSDM_CSW /* Command Status.  */
36
};
37

    
38
typedef struct {
39
    USBDevice dev;
40
    enum USBMSDMode mode;
41
    uint32_t scsi_len;
42
    uint8_t *scsi_buf;
43
    uint32_t usb_len;
44
    uint8_t *usb_buf;
45
    uint32_t data_len;
46
    uint32_t residue;
47
    uint32_t tag;
48
    SCSIBus bus;
49
    DriveInfo *dinfo;
50
    SCSIDevice *scsi_dev;
51
    int result;
52
    /* For async completion.  */
53
    USBPacket *packet;
54
} MSDState;
55

    
56
struct usb_msd_cbw {
57
    uint32_t sig;
58
    uint32_t tag;
59
    uint32_t data_len;
60
    uint8_t flags;
61
    uint8_t lun;
62
    uint8_t cmd_len;
63
    uint8_t cmd[16];
64
};
65

    
66
struct usb_msd_csw {
67
    uint32_t sig;
68
    uint32_t tag;
69
    uint32_t residue;
70
    uint8_t status;
71
};
72

    
73
static const uint8_t qemu_msd_dev_descriptor[] = {
74
        0x12,       /*  u8 bLength; */
75
        0x01,       /*  u8 bDescriptorType; Device */
76
        0x00, 0x01, /*  u16 bcdUSB; v1.0 */
77

    
78
        0x00,            /*  u8  bDeviceClass; */
79
        0x00,            /*  u8  bDeviceSubClass; */
80
        0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
81
        0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
82

    
83
        /* Vendor and product id are arbitrary.  */
84
        0x00, 0x00, /*  u16 idVendor; */
85
         0x00, 0x00, /*  u16 idProduct; */
86
        0x00, 0x00, /*  u16 bcdDevice */
87

    
88
        0x01,       /*  u8  iManufacturer; */
89
        0x02,       /*  u8  iProduct; */
90
        0x03,       /*  u8  iSerialNumber; */
91
        0x01        /*  u8  bNumConfigurations; */
92
};
93

    
94
static const uint8_t qemu_msd_config_descriptor[] = {
95

    
96
        /* one configuration */
97
        0x09,       /*  u8  bLength; */
98
        0x02,       /*  u8  bDescriptorType; Configuration */
99
        0x20, 0x00, /*  u16 wTotalLength; */
100
        0x01,       /*  u8  bNumInterfaces; (1) */
101
        0x01,       /*  u8  bConfigurationValue; */
102
        0x00,       /*  u8  iConfiguration; */
103
        0xc0,       /*  u8  bmAttributes;
104
                                 Bit 7: must be set,
105
                                     6: Self-powered,
106
                                     5: Remote wakeup,
107
                                     4..0: resvd */
108
        0x00,       /*  u8  MaxPower; */
109

    
110
        /* one interface */
111
        0x09,       /*  u8  if_bLength; */
112
        0x04,       /*  u8  if_bDescriptorType; Interface */
113
        0x00,       /*  u8  if_bInterfaceNumber; */
114
        0x00,       /*  u8  if_bAlternateSetting; */
115
        0x02,       /*  u8  if_bNumEndpoints; */
116
        0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
117
        0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
118
        0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
119
        0x00,       /*  u8  if_iInterface; */
120

    
121
        /* Bulk-In endpoint */
122
        0x07,       /*  u8  ep_bLength; */
123
        0x05,       /*  u8  ep_bDescriptorType; Endpoint */
124
        0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
125
         0x02,       /*  u8  ep_bmAttributes; Bulk */
126
         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
127
        0x00,       /*  u8  ep_bInterval; */
128

    
129
        /* Bulk-Out endpoint */
130
        0x07,       /*  u8  ep_bLength; */
131
        0x05,       /*  u8  ep_bDescriptorType; Endpoint */
132
        0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
133
         0x02,       /*  u8  ep_bmAttributes; Bulk */
134
         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
135
        0x00        /*  u8  ep_bInterval; */
136
};
137

    
138
static void usb_msd_copy_data(MSDState *s)
139
{
140
    uint32_t len;
141
    len = s->usb_len;
142
    if (len > s->scsi_len)
143
        len = s->scsi_len;
144
    if (s->mode == USB_MSDM_DATAIN) {
145
        memcpy(s->usb_buf, s->scsi_buf, len);
146
    } else {
147
        memcpy(s->scsi_buf, s->usb_buf, len);
148
    }
149
    s->usb_len -= len;
150
    s->scsi_len -= len;
151
    s->usb_buf += len;
152
    s->scsi_buf += len;
153
    s->data_len -= len;
154
    if (s->scsi_len == 0) {
155
        if (s->mode == USB_MSDM_DATAIN) {
156
            s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
157
        } else if (s->mode == USB_MSDM_DATAOUT) {
158
            s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
159
        }
160
    }
161
}
162

    
163
static void usb_msd_send_status(MSDState *s)
164
{
165
    struct usb_msd_csw csw;
166

    
167
    csw.sig = cpu_to_le32(0x53425355);
168
    csw.tag = cpu_to_le32(s->tag);
169
    csw.residue = s->residue;
170
    csw.status = s->result;
171
    memcpy(s->usb_buf, &csw, 13);
172
}
173

    
174
static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
175
                                     uint32_t arg)
176
{
177
    MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
178
    USBPacket *p = s->packet;
179

    
180
    if (tag != s->tag) {
181
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
182
    }
183
    if (reason == SCSI_REASON_DONE) {
184
        DPRINTF("Command complete %d\n", arg);
185
        s->residue = s->data_len;
186
        s->result = arg != 0;
187
        if (s->packet) {
188
            if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
189
                /* A deferred packet with no write data remaining must be
190
                   the status read packet.  */
191
                usb_msd_send_status(s);
192
                s->mode = USB_MSDM_CBW;
193
            } else {
194
                if (s->data_len) {
195
                    s->data_len -= s->usb_len;
196
                    if (s->mode == USB_MSDM_DATAIN)
197
                        memset(s->usb_buf, 0, s->usb_len);
198
                    s->usb_len = 0;
199
                }
200
                if (s->data_len == 0)
201
                    s->mode = USB_MSDM_CSW;
202
            }
203
            s->packet = NULL;
204
            usb_packet_complete(p);
205
        } else if (s->data_len == 0) {
206
            s->mode = USB_MSDM_CSW;
207
        }
208
        return;
209
    }
210
    s->scsi_len = arg;
211
    s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
212
    if (p) {
213
        usb_msd_copy_data(s);
214
        if (s->usb_len == 0) {
215
            /* Set s->packet to NULL before calling usb_packet_complete
216
               because annother request may be issued before
217
               usb_packet_complete returns.  */
218
            DPRINTF("Packet complete %p\n", p);
219
            s->packet = NULL;
220
            usb_packet_complete(p);
221
        }
222
    }
223
}
224

    
225
static void usb_msd_handle_reset(USBDevice *dev)
226
{
227
    MSDState *s = (MSDState *)dev;
228

    
229
    DPRINTF("Reset\n");
230
    s->mode = USB_MSDM_CBW;
231
}
232

    
233
static int usb_msd_handle_control(USBDevice *dev, int request, int value,
234
                                  int index, int length, uint8_t *data)
235
{
236
    MSDState *s = (MSDState *)dev;
237
    int ret = 0;
238

    
239
    switch (request) {
240
    case DeviceRequest | USB_REQ_GET_STATUS:
241
        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
242
            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
243
        data[1] = 0x00;
244
        ret = 2;
245
        break;
246
    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
247
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
248
            dev->remote_wakeup = 0;
249
        } else {
250
            goto fail;
251
        }
252
        ret = 0;
253
        break;
254
    case DeviceOutRequest | USB_REQ_SET_FEATURE:
255
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
256
            dev->remote_wakeup = 1;
257
        } else {
258
            goto fail;
259
        }
260
        ret = 0;
261
        break;
262
    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
263
        dev->addr = value;
264
        ret = 0;
265
        break;
266
    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
267
        switch(value >> 8) {
268
        case USB_DT_DEVICE:
269
            memcpy(data, qemu_msd_dev_descriptor,
270
                   sizeof(qemu_msd_dev_descriptor));
271
            ret = sizeof(qemu_msd_dev_descriptor);
272
            break;
273
        case USB_DT_CONFIG:
274
            memcpy(data, qemu_msd_config_descriptor,
275
                   sizeof(qemu_msd_config_descriptor));
276
            ret = sizeof(qemu_msd_config_descriptor);
277
            break;
278
        case USB_DT_STRING:
279
            switch(value & 0xff) {
280
            case 0:
281
                /* language ids */
282
                data[0] = 4;
283
                data[1] = 3;
284
                data[2] = 0x09;
285
                data[3] = 0x04;
286
                ret = 4;
287
                break;
288
            case 1:
289
                /* vendor description */
290
                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
291
                break;
292
            case 2:
293
                /* product description */
294
                ret = set_usb_string(data, "QEMU USB HARDDRIVE");
295
                break;
296
            case 3:
297
                /* serial number */
298
                ret = set_usb_string(data, "1");
299
                break;
300
            default:
301
                goto fail;
302
            }
303
            break;
304
        default:
305
            goto fail;
306
        }
307
        break;
308
    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
309
        data[0] = 1;
310
        ret = 1;
311
        break;
312
    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
313
        ret = 0;
314
        break;
315
    case DeviceRequest | USB_REQ_GET_INTERFACE:
316
        data[0] = 0;
317
        ret = 1;
318
        break;
319
    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
320
        ret = 0;
321
        break;
322
    case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
323
        if (value == 0 && index != 0x81) { /* clear ep halt */
324
            goto fail;
325
        }
326
        ret = 0;
327
        break;
328
        /* Class specific requests.  */
329
    case MassStorageReset:
330
        /* Reset state ready for the next CBW.  */
331
        s->mode = USB_MSDM_CBW;
332
        ret = 0;
333
        break;
334
    case GetMaxLun:
335
        data[0] = 0;
336
        ret = 1;
337
        break;
338
    default:
339
    fail:
340
        ret = USB_RET_STALL;
341
        break;
342
    }
343
    return ret;
344
}
345

    
346
static void usb_msd_cancel_io(USBPacket *p, void *opaque)
347
{
348
    MSDState *s = opaque;
349
    s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
350
    s->packet = NULL;
351
    s->scsi_len = 0;
352
}
353

    
354
static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
355
{
356
    MSDState *s = (MSDState *)dev;
357
    int ret = 0;
358
    struct usb_msd_cbw cbw;
359
    uint8_t devep = p->devep;
360
    uint8_t *data = p->data;
361
    int len = p->len;
362

    
363
    switch (p->pid) {
364
    case USB_TOKEN_OUT:
365
        if (devep != 2)
366
            goto fail;
367

    
368
        switch (s->mode) {
369
        case USB_MSDM_CBW:
370
            if (len != 31) {
371
                fprintf(stderr, "usb-msd: Bad CBW size");
372
                goto fail;
373
            }
374
            memcpy(&cbw, data, 31);
375
            if (le32_to_cpu(cbw.sig) != 0x43425355) {
376
                fprintf(stderr, "usb-msd: Bad signature %08x\n",
377
                        le32_to_cpu(cbw.sig));
378
                goto fail;
379
            }
380
            DPRINTF("Command on LUN %d\n", cbw.lun);
381
            if (cbw.lun != 0) {
382
                fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
383
                goto fail;
384
            }
385
            s->tag = le32_to_cpu(cbw.tag);
386
            s->data_len = le32_to_cpu(cbw.data_len);
387
            if (s->data_len == 0) {
388
                s->mode = USB_MSDM_CSW;
389
            } else if (cbw.flags & 0x80) {
390
                s->mode = USB_MSDM_DATAIN;
391
            } else {
392
                s->mode = USB_MSDM_DATAOUT;
393
            }
394
            DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
395
                    s->tag, cbw.flags, cbw.cmd_len, s->data_len);
396
            s->residue = 0;
397
            s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
398
            /* ??? Should check that USB and SCSI data transfer
399
               directions match.  */
400
            if (s->residue == 0) {
401
                if (s->mode == USB_MSDM_DATAIN) {
402
                    s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
403
                } else if (s->mode == USB_MSDM_DATAOUT) {
404
                    s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
405
                }
406
            }
407
            ret = len;
408
            break;
409

    
410
        case USB_MSDM_DATAOUT:
411
            DPRINTF("Data out %d/%d\n", len, s->data_len);
412
            if (len > s->data_len)
413
                goto fail;
414

    
415
            s->usb_buf = data;
416
            s->usb_len = len;
417
            if (s->scsi_len) {
418
                usb_msd_copy_data(s);
419
            }
420
            if (s->residue && s->usb_len) {
421
                s->data_len -= s->usb_len;
422
                if (s->data_len == 0)
423
                    s->mode = USB_MSDM_CSW;
424
                s->usb_len = 0;
425
            }
426
            if (s->usb_len) {
427
                DPRINTF("Deferring packet %p\n", p);
428
                usb_defer_packet(p, usb_msd_cancel_io, s);
429
                s->packet = p;
430
                ret = USB_RET_ASYNC;
431
            } else {
432
                ret = len;
433
            }
434
            break;
435

    
436
        default:
437
            DPRINTF("Unexpected write (len %d)\n", len);
438
            goto fail;
439
        }
440
        break;
441

    
442
    case USB_TOKEN_IN:
443
        if (devep != 1)
444
            goto fail;
445

    
446
        switch (s->mode) {
447
        case USB_MSDM_DATAOUT:
448
            if (s->data_len != 0 || len < 13)
449
                goto fail;
450
            /* Waiting for SCSI write to complete.  */
451
            usb_defer_packet(p, usb_msd_cancel_io, s);
452
            s->packet = p;
453
            ret = USB_RET_ASYNC;
454
            break;
455

    
456
        case USB_MSDM_CSW:
457
            DPRINTF("Command status %d tag 0x%x, len %d\n",
458
                    s->result, s->tag, len);
459
            if (len < 13)
460
                goto fail;
461

    
462
            s->usb_len = len;
463
            s->usb_buf = data;
464
            usb_msd_send_status(s);
465
            s->mode = USB_MSDM_CBW;
466
            ret = 13;
467
            break;
468

    
469
        case USB_MSDM_DATAIN:
470
            DPRINTF("Data in %d/%d\n", len, s->data_len);
471
            if (len > s->data_len)
472
                len = s->data_len;
473
            s->usb_buf = data;
474
            s->usb_len = len;
475
            if (s->scsi_len) {
476
                usb_msd_copy_data(s);
477
            }
478
            if (s->residue && s->usb_len) {
479
                s->data_len -= s->usb_len;
480
                memset(s->usb_buf, 0, s->usb_len);
481
                if (s->data_len == 0)
482
                    s->mode = USB_MSDM_CSW;
483
                s->usb_len = 0;
484
            }
485
            if (s->usb_len) {
486
                DPRINTF("Deferring packet %p\n", p);
487
                usb_defer_packet(p, usb_msd_cancel_io, s);
488
                s->packet = p;
489
                ret = USB_RET_ASYNC;
490
            } else {
491
                ret = len;
492
            }
493
            break;
494

    
495
        default:
496
            DPRINTF("Unexpected read (len %d)\n", len);
497
            goto fail;
498
        }
499
        break;
500

    
501
    default:
502
        DPRINTF("Bad token\n");
503
    fail:
504
        ret = USB_RET_STALL;
505
        break;
506
    }
507

    
508
    return ret;
509
}
510

    
511
static int usb_msd_initfn(USBDevice *dev)
512
{
513
    MSDState *s = DO_UPCAST(MSDState, dev, dev);
514

    
515
    if (!s->dinfo || !s->dinfo->bdrv) {
516
        qemu_error("usb-msd: drive property not set\n");
517
        return -1;
518
    }
519

    
520
    s->dev.speed = USB_SPEED_FULL;
521
    scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
522
    s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, s->dinfo, 0);
523
    s->bus.qbus.allow_hotplug = 0;
524
    usb_msd_handle_reset(dev);
525
    return 0;
526
}
527

    
528
USBDevice *usb_msd_init(const char *filename)
529
{
530
    static int nr=0;
531
    char id[8];
532
    QemuOpts *opts;
533
    DriveInfo *dinfo;
534
    USBDevice *dev;
535
    int fatal_error;
536
    const char *p1;
537
    char fmt[32];
538

    
539
    /* parse -usbdevice disk: syntax into drive opts */
540
    snprintf(id, sizeof(id), "usb%d", nr++);
541
    opts = qemu_opts_create(&qemu_drive_opts, id, 0);
542

    
543
    p1 = strchr(filename, ':');
544
    if (p1++) {
545
        const char *p2;
546

    
547
        if (strstart(filename, "format=", &p2)) {
548
            int len = MIN(p1 - p2, sizeof(fmt));
549
            pstrcpy(fmt, len, p2);
550
            qemu_opt_set(opts, "format", fmt);
551
        } else if (*filename != ':') {
552
            printf("unrecognized USB mass-storage option %s\n", filename);
553
            return NULL;
554
        }
555
        filename = p1;
556
    }
557
    if (!*filename) {
558
        printf("block device specification needed\n");
559
        return NULL;
560
    }
561
    qemu_opt_set(opts, "file", filename);
562
    qemu_opt_set(opts, "if", "none");
563

    
564
    /* create host drive */
565
    dinfo = drive_init(opts, NULL, &fatal_error);
566
    if (!dinfo) {
567
        qemu_opts_del(opts);
568
        return NULL;
569
    }
570

    
571
    /* create guest device */
572
    dev = usb_create(NULL /* FIXME */, "QEMU USB MSD");
573
    qdev_prop_set_drive(&dev->qdev, "drive", dinfo);
574
    if (qdev_init(&dev->qdev) < 0)
575
        return NULL;
576

    
577
    return dev;
578
}
579

    
580
BlockDriverState *usb_msd_get_bdrv(USBDevice *dev)
581
{
582
    MSDState *s = (MSDState *)dev;
583

    
584
    return s->dinfo->bdrv;
585
}
586

    
587
static struct USBDeviceInfo msd_info = {
588
    .qdev.name      = "QEMU USB MSD",
589
    .qdev.alias     = "usb-storage",
590
    .qdev.size      = sizeof(MSDState),
591
    .init           = usb_msd_initfn,
592
    .handle_packet  = usb_generic_handle_packet,
593
    .handle_reset   = usb_msd_handle_reset,
594
    .handle_control = usb_msd_handle_control,
595
    .handle_data    = usb_msd_handle_data,
596
    .qdev.props     = (Property[]) {
597
        DEFINE_PROP_DRIVE("drive", MSDState, dinfo),
598
        DEFINE_PROP_END_OF_LIST(),
599
    },
600
};
601

    
602
static void usb_msd_register_devices(void)
603
{
604
    usb_qdev_register(&msd_info);
605
}
606
device_init(usb_msd_register_devices)