[qemu.git] / hw / usb-msd.c

/*
 * USB Mass Storage Device emulation
 *
 * Copyright (c) 2006 CodeSourcery.
 * Written by Paul Brook
 *
 * This code is licenced under the LGPL.
 */

#include "qemu-common.h"
#include "qemu-option.h"
#include "qemu-config.h"
#include "usb.h"
#include "scsi.h"
#include "console.h"
#include "monitor.h"
#include "sysemu.h"
#include "blockdev.h"

//#define DEBUG_MSD

#ifdef DEBUG_MSD
#define DPRINTF(fmt, ...) \
do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
#else
#define DPRINTF(fmt, ...) do {} while(0)
#endif

/* USB requests.  */
#define MassStorageReset  0xff
#define GetMaxLun         0xfe

enum USBMSDMode {
    USB_MSDM_CBW, /* Command Block.  */
    USB_MSDM_DATAOUT, /* Tranfer data to device.  */
    USB_MSDM_DATAIN, /* Transfer data from device.  */
    USB_MSDM_CSW /* Command Status.  */
};

typedef struct {
    USBDevice dev;
    enum USBMSDMode mode;
    uint32_t scsi_len;
    uint8_t *scsi_buf;
    uint32_t usb_len;
    uint8_t *usb_buf;
    uint32_t data_len;
    uint32_t residue;
    uint32_t tag;
    SCSIBus bus;
    BlockConf conf;
    SCSIDevice *scsi_dev;
    int result;
    /* For async completion.  */
    USBPacket *packet;
} MSDState;

struct usb_msd_cbw {
    uint32_t sig;
    uint32_t tag;
    uint32_t data_len;
    uint8_t flags;
    uint8_t lun;
    uint8_t cmd_len;
    uint8_t cmd[16];
};

struct usb_msd_csw {
    uint32_t sig;
    uint32_t tag;
    uint32_t residue;
    uint8_t status;
};

static const uint8_t qemu_msd_dev_descriptor[] = {
	0x12,       /*  u8 bLength; */
	0x01,       /*  u8 bDescriptorType; Device */
	0x00, 0x01, /*  u16 bcdUSB; v1.0 */

	0x00,	    /*  u8  bDeviceClass; */
	0x00,	    /*  u8  bDeviceSubClass; */
	0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
	0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */

        /* Vendor and product id are arbitrary.  */
	0x00, 0x00, /*  u16 idVendor; */
 	0x00, 0x00, /*  u16 idProduct; */
	0x00, 0x00, /*  u16 bcdDevice */

	0x01,       /*  u8  iManufacturer; */
	0x02,       /*  u8  iProduct; */
	0x03,       /*  u8  iSerialNumber; */
	0x01        /*  u8  bNumConfigurations; */
};

static const uint8_t qemu_msd_config_descriptor[] = {

	/* one configuration */
	0x09,       /*  u8  bLength; */
	0x02,       /*  u8  bDescriptorType; Configuration */
	0x20, 0x00, /*  u16 wTotalLength; */
	0x01,       /*  u8  bNumInterfaces; (1) */
	0x01,       /*  u8  bConfigurationValue; */
	0x00,       /*  u8  iConfiguration; */
	0xc0,       /*  u8  bmAttributes;
				 Bit 7: must be set,
				     6: Self-powered,
				     5: Remote wakeup,
				     4..0: resvd */
	0x00,       /*  u8  MaxPower; */

	/* one interface */
	0x09,       /*  u8  if_bLength; */
	0x04,       /*  u8  if_bDescriptorType; Interface */
	0x00,       /*  u8  if_bInterfaceNumber; */
	0x00,       /*  u8  if_bAlternateSetting; */
	0x02,       /*  u8  if_bNumEndpoints; */
	0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
	0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
	0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
	0x00,       /*  u8  if_iInterface; */

	/* Bulk-In endpoint */
	0x07,       /*  u8  ep_bLength; */
	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 	0x02,       /*  u8  ep_bmAttributes; Bulk */
 	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
	0x00,       /*  u8  ep_bInterval; */

	/* Bulk-Out endpoint */
	0x07,       /*  u8  ep_bLength; */
	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
	0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 	0x02,       /*  u8  ep_bmAttributes; Bulk */
 	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
	0x00        /*  u8  ep_bInterval; */
};

static void usb_msd_copy_data(MSDState *s)
{
    uint32_t len;
    len = s->usb_len;
    if (len > s->scsi_len)
        len = s->scsi_len;
    if (s->mode == USB_MSDM_DATAIN) {
        memcpy(s->usb_buf, s->scsi_buf, len);
    } else {
        memcpy(s->scsi_buf, s->usb_buf, len);
    }
    s->usb_len -= len;
    s->scsi_len -= len;
    s->usb_buf += len;
    s->scsi_buf += len;
    s->data_len -= len;
    if (s->scsi_len == 0) {
        if (s->mode == USB_MSDM_DATAIN) {
            s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
        } else if (s->mode == USB_MSDM_DATAOUT) {
            s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
        }
    }
}

static void usb_msd_send_status(MSDState *s)
{
    struct usb_msd_csw csw;

    csw.sig = cpu_to_le32(0x53425355);
    csw.tag = cpu_to_le32(s->tag);
    csw.residue = s->residue;
    csw.status = s->result;
    memcpy(s->usb_buf, &csw, 13);
}

static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
                                     uint32_t arg)
{
    MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
    USBPacket *p = s->packet;

    if (tag != s->tag) {
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
    }
    if (reason == SCSI_REASON_DONE) {
        DPRINTF("Command complete %d\n", arg);
        s->residue = s->data_len;
        s->result = arg != 0;
        if (s->packet) {
            if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
                /* A deferred packet with no write data remaining must be
                   the status read packet.  */
                usb_msd_send_status(s);
                s->mode = USB_MSDM_CBW;
            } else {
                if (s->data_len) {
                    s->data_len -= s->usb_len;
                    if (s->mode == USB_MSDM_DATAIN)
                        memset(s->usb_buf, 0, s->usb_len);
                    s->usb_len = 0;
                }
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
            }
            s->packet = NULL;
            usb_packet_complete(p);
        } else if (s->data_len == 0) {
            s->mode = USB_MSDM_CSW;
        }
        return;
    }
    s->scsi_len = arg;
    s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
    if (p) {
        usb_msd_copy_data(s);
        if (s->usb_len == 0) {
            /* Set s->packet to NULL before calling usb_packet_complete
               because annother request may be issued before
               usb_packet_complete returns.  */
            DPRINTF("Packet complete %p\n", p);
            s->packet = NULL;
            usb_packet_complete(p);
        }
    }
}

static void usb_msd_handle_reset(USBDevice *dev)
{
    MSDState *s = (MSDState *)dev;

    DPRINTF("Reset\n");
    s->mode = USB_MSDM_CBW;
}

static int usb_msd_handle_control(USBDevice *dev, int request, int value,
                                  int index, int length, uint8_t *data)
{
    MSDState *s = (MSDState *)dev;
    int ret = 0;

    switch (request) {
    case DeviceRequest | USB_REQ_GET_STATUS:
        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
        data[1] = 0x00;
        ret = 2;
        break;
    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
            dev->remote_wakeup = 0;
        } else {
            goto fail;
        }
        ret = 0;
        break;
    case DeviceOutRequest | USB_REQ_SET_FEATURE:
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
            dev->remote_wakeup = 1;
        } else {
            goto fail;
        }
        ret = 0;
        break;
    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
        dev->addr = value;
        ret = 0;
        break;
    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
        switch(value >> 8) {
        case USB_DT_DEVICE:
            memcpy(data, qemu_msd_dev_descriptor,
                   sizeof(qemu_msd_dev_descriptor));
            ret = sizeof(qemu_msd_dev_descriptor);
            break;
        case USB_DT_CONFIG:
            memcpy(data, qemu_msd_config_descriptor,
                   sizeof(qemu_msd_config_descriptor));
            ret = sizeof(qemu_msd_config_descriptor);
            break;
        case USB_DT_STRING:
            switch(value & 0xff) {
            case 0:
                /* language ids */
                data[0] = 4;
                data[1] = 3;
                data[2] = 0x09;
                data[3] = 0x04;
                ret = 4;
                break;
            case 1:
                /* vendor description */
                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
                break;
            case 2:
                /* product description */
                ret = set_usb_string(data, "QEMU USB HARDDRIVE");
                break;
            case 3:
                /* serial number */
                ret = set_usb_string(data, "1");
                break;
            default:
                goto fail;
            }
            break;
        default:
            goto fail;
        }
        break;
    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
        data[0] = 1;
        ret = 1;
        break;
    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
        ret = 0;
        break;
    case DeviceRequest | USB_REQ_GET_INTERFACE:
        data[0] = 0;
        ret = 1;
        break;
    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
        ret = 0;
        break;
    case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
        ret = 0;
        break;
    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
        ret = 0;
        break;
        /* Class specific requests.  */
    case ClassInterfaceOutRequest | MassStorageReset:
        /* Reset state ready for the next CBW.  */
        s->mode = USB_MSDM_CBW;
        ret = 0;
        break;
    case ClassInterfaceRequest | GetMaxLun:
        data[0] = 0;
        ret = 1;
        break;
    default:
    fail:
        ret = USB_RET_STALL;
        break;
    }
    return ret;
}

static void usb_msd_cancel_io(USBPacket *p, void *opaque)
{
    MSDState *s = opaque;
    s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
    s->packet = NULL;
    s->scsi_len = 0;
}

static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
{
    MSDState *s = (MSDState *)dev;
    int ret = 0;
    struct usb_msd_cbw cbw;
    uint8_t devep = p->devep;
    uint8_t *data = p->data;
    int len = p->len;

    switch (p->pid) {
    case USB_TOKEN_OUT:
        if (devep != 2)
            goto fail;

        switch (s->mode) {
        case USB_MSDM_CBW:
            if (len != 31) {
                fprintf(stderr, "usb-msd: Bad CBW size");
                goto fail;
            }
            memcpy(&cbw, data, 31);
            if (le32_to_cpu(cbw.sig) != 0x43425355) {
                fprintf(stderr, "usb-msd: Bad signature %08x\n",
                        le32_to_cpu(cbw.sig));
                goto fail;
            }
            DPRINTF("Command on LUN %d\n", cbw.lun);
            if (cbw.lun != 0) {
                fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
                goto fail;
            }
            s->tag = le32_to_cpu(cbw.tag);
            s->data_len = le32_to_cpu(cbw.data_len);
            if (s->data_len == 0) {
                s->mode = USB_MSDM_CSW;
            } else if (cbw.flags & 0x80) {
                s->mode = USB_MSDM_DATAIN;
            } else {
                s->mode = USB_MSDM_DATAOUT;
            }
            DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
                    s->tag, cbw.flags, cbw.cmd_len, s->data_len);
            s->residue = 0;
            s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
            /* ??? Should check that USB and SCSI data transfer
               directions match.  */
            if (s->residue == 0) {
                if (s->mode == USB_MSDM_DATAIN) {
                    s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
                } else if (s->mode == USB_MSDM_DATAOUT) {
                    s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
                }
            }
            ret = len;
            break;

        case USB_MSDM_DATAOUT:
            DPRINTF("Data out %d/%d\n", len, s->data_len);
            if (len > s->data_len)
                goto fail;

            s->usb_buf = data;
            s->usb_len = len;
            if (s->scsi_len) {
                usb_msd_copy_data(s);
            }
            if (s->residue && s->usb_len) {
                s->data_len -= s->usb_len;
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
                s->usb_len = 0;
            }
            if (s->usb_len) {
                DPRINTF("Deferring packet %p\n", p);
                usb_defer_packet(p, usb_msd_cancel_io, s);
                s->packet = p;
                ret = USB_RET_ASYNC;
            } else {
                ret = len;
            }
            break;

        default:
            DPRINTF("Unexpected write (len %d)\n", len);
            goto fail;
        }
        break;

    case USB_TOKEN_IN:
        if (devep != 1)
            goto fail;

        switch (s->mode) {
        case USB_MSDM_DATAOUT:
            if (s->data_len != 0 || len < 13)
                goto fail;
            /* Waiting for SCSI write to complete.  */
            usb_defer_packet(p, usb_msd_cancel_io, s);
            s->packet = p;
            ret = USB_RET_ASYNC;
            break;

        case USB_MSDM_CSW:
            DPRINTF("Command status %d tag 0x%x, len %d\n",
                    s->result, s->tag, len);
            if (len < 13)
                goto fail;

            s->usb_len = len;
            s->usb_buf = data;
            usb_msd_send_status(s);
            s->mode = USB_MSDM_CBW;
            ret = 13;
            break;

        case USB_MSDM_DATAIN:
            DPRINTF("Data in %d/%d\n", len, s->data_len);
            if (len > s->data_len)
                len = s->data_len;
            s->usb_buf = data;
            s->usb_len = len;
            if (s->scsi_len) {
                usb_msd_copy_data(s);
            }
            if (s->residue && s->usb_len) {
                s->data_len -= s->usb_len;
                memset(s->usb_buf, 0, s->usb_len);
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
                s->usb_len = 0;
            }
            if (s->usb_len) {
                DPRINTF("Deferring packet %p\n", p);
                usb_defer_packet(p, usb_msd_cancel_io, s);
                s->packet = p;
                ret = USB_RET_ASYNC;
            } else {
                ret = len;
            }
            break;

        default:
            DPRINTF("Unexpected read (len %d)\n", len);
            goto fail;
        }
        break;

    default:
        DPRINTF("Bad token\n");
    fail:
        ret = USB_RET_STALL;
        break;
    }

    return ret;
}

static void usb_msd_password_cb(void *opaque, int err)
{
    MSDState *s = opaque;

    if (!err)
        usb_device_attach(&s->dev);
    else
        qdev_unplug(&s->dev.qdev);
}

static int usb_msd_initfn(USBDevice *dev)
{
    MSDState *s = DO_UPCAST(MSDState, dev, dev);
    BlockDriverState *bs = s->conf.bs;

    if (!bs) {
        error_report("usb-msd: drive property not set");
        return -1;
    }

    /*
     * Hack alert: this pretends to be a block device, but it's really
     * a SCSI bus that can serve only a single device, which it
     * creates automatically.  But first it needs to detach from its
     * blockdev, or else scsi_bus_legacy_add_drive() dies when it
     * attaches again.
     *
     * The hack is probably a bad idea.
     */
    bdrv_detach(bs, &s->dev.qdev);
    s->conf.bs = NULL;

    s->dev.speed = USB_SPEED_FULL;
    scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
    s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
    if (!s->scsi_dev) {
        return -1;
    }
    s->bus.qbus.allow_hotplug = 0;
    usb_msd_handle_reset(dev);

    if (bdrv_key_required(bs)) {
        if (cur_mon) {
            monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
            s->dev.auto_attach = 0;
        } else {
            autostart = 0;
        }
    }

    return 0;
}

static USBDevice *usb_msd_init(const char *filename)
{
    static int nr=0;
    char id[8];
    QemuOpts *opts;
    DriveInfo *dinfo;
    USBDevice *dev;
    int fatal_error;
    const char *p1;
    char fmt[32];

    /* parse -usbdevice disk: syntax into drive opts */
    snprintf(id, sizeof(id), "usb%d", nr++);
    opts = qemu_opts_create(qemu_find_opts("drive"), id, 0);

    p1 = strchr(filename, ':');
    if (p1++) {
        const char *p2;

        if (strstart(filename, "format=", &p2)) {
            int len = MIN(p1 - p2, sizeof(fmt));
            pstrcpy(fmt, len, p2);
            qemu_opt_set(opts, "format", fmt);
        } else if (*filename != ':') {
            printf("unrecognized USB mass-storage option %s\n", filename);
            return NULL;
        }
        filename = p1;
    }
    if (!*filename) {
        printf("block device specification needed\n");
        return NULL;
    }
    qemu_opt_set(opts, "file", filename);
    qemu_opt_set(opts, "if", "none");

    /* create host drive */
    dinfo = drive_init(opts, 0, &fatal_error);
    if (!dinfo) {
        qemu_opts_del(opts);
        return NULL;
    }

    /* create guest device */
    dev = usb_create(NULL /* FIXME */, "usb-storage");
    if (!dev) {
        return NULL;
    }
    if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
        qdev_free(&dev->qdev);
        return NULL;
    }
    if (qdev_init(&dev->qdev) < 0)
        return NULL;

    return dev;
}

static struct USBDeviceInfo msd_info = {
    .product_desc   = "QEMU USB MSD",
    .qdev.name      = "usb-storage",
    .qdev.size      = sizeof(MSDState),
    .init           = usb_msd_initfn,
    .handle_packet  = usb_generic_handle_packet,
    .handle_reset   = usb_msd_handle_reset,
    .handle_control = usb_msd_handle_control,
    .handle_data    = usb_msd_handle_data,
    .usbdevice_name = "disk",
    .usbdevice_init = usb_msd_init,
    .qdev.props     = (Property[]) {
        DEFINE_BLOCK_PROPERTIES(MSDState, conf),
        DEFINE_PROP_END_OF_LIST(),
    },
};

static void usb_msd_register_devices(void)
{
    usb_qdev_register(&msd_info);
}
device_init(usb_msd_register_devices)
Commit	Line	Data
5fafdf24	1	/*
2e5d83bb PB	2	* USB Mass Storage Device emulation
	3	*
	4	* Copyright (c) 2006 CodeSourcery.
	5	* Written by Paul Brook
	6	*
	7	* This code is licenced under the LGPL.
	8	*/
	9
87ecb68b	10	#include "qemu-common.h"
7fc2f2c0 GH	11	#include "qemu-option.h"
7fc2f2c0 GH	12	#include "qemu-config.h"
87ecb68b	13	#include "usb.h"
43b443b6	14	#include "scsi.h"
c0f4ce77	15	#include "console.h"
b3e461d3	16	#include "monitor.h"
666daa68	17	#include "sysemu.h"
2446333c	18	#include "blockdev.h"
2e5d83bb PB	19
	20	//#define DEBUG_MSD
	21
	22	#ifdef DEBUG_MSD
001faf32 BS	23	#define DPRINTF(fmt, ...) \
001faf32 BS	24	do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
2e5d83bb	25	#else
001faf32	26	#define DPRINTF(fmt, ...) do {} while(0)
2e5d83bb PB	27	#endif
	28
	29	/* USB requests. */
	30	#define MassStorageReset 0xff
	31	#define GetMaxLun 0xfe
	32
	33	enum USBMSDMode {
	34	USB_MSDM_CBW, /* Command Block. */
	35	USB_MSDM_DATAOUT, /* Tranfer data to device. */
	36	USB_MSDM_DATAIN, /* Transfer data from device. */
	37	USB_MSDM_CSW /* Command Status. */
	38	};
	39
	40	typedef struct {
	41	USBDevice dev;
	42	enum USBMSDMode mode;
a917d384 PB	43	uint32_t scsi_len;
	44	uint8_t *scsi_buf;
	45	uint32_t usb_len;
	46	uint8_t *usb_buf;
2e5d83bb	47	uint32_t data_len;
a917d384	48	uint32_t residue;
2e5d83bb	49	uint32_t tag;
ca9c39fa	50	SCSIBus bus;
428c149b	51	BlockConf conf;
2e5d83bb PB	52	SCSIDevice *scsi_dev;
2e5d83bb PB	53	int result;
4d611c9a PB	54	/* For async completion. */
4d611c9a PB	55	USBPacket *packet;
2e5d83bb PB	56	} MSDState;
2e5d83bb PB	57
a917d384 PB	58	struct usb_msd_cbw {
	59	uint32_t sig;
	60	uint32_t tag;
	61	uint32_t data_len;
	62	uint8_t flags;
	63	uint8_t lun;
	64	uint8_t cmd_len;
	65	uint8_t cmd[16];
	66	};
	67
	68	struct usb_msd_csw {
	69	uint32_t sig;
	70	uint32_t tag;
	71	uint32_t residue;
	72	uint8_t status;
	73	};
	74
2e5d83bb PB	75	static const uint8_t qemu_msd_dev_descriptor[] = {
	76	0x12, /* u8 bLength; */
	77	0x01, /* u8 bDescriptorType; Device */
e126cf13	78	0x00, 0x01, /* u16 bcdUSB; v1.0 */
2e5d83bb PB	79
	80	0x00, /* u8 bDeviceClass; */
	81	0x00, /* u8 bDeviceSubClass; */
	82	0x00, /* u8 bDeviceProtocol; [ low/full speeds only ] */
	83	0x08, /* u8 bMaxPacketSize0; 8 Bytes */
	84
	85	/* Vendor and product id are arbitrary. */
	86	0x00, 0x00, /* u16 idVendor; */
	87	0x00, 0x00, /* u16 idProduct; */
	88	0x00, 0x00, /* u16 bcdDevice */
	89
	90	0x01, /* u8 iManufacturer; */
	91	0x02, /* u8 iProduct; */
	92	0x03, /* u8 iSerialNumber; */
	93	0x01 /* u8 bNumConfigurations; */
	94	};
	95
	96	static const uint8_t qemu_msd_config_descriptor[] = {
	97
	98	/* one configuration */
	99	0x09, /* u8 bLength; */
	100	0x02, /* u8 bDescriptorType; Configuration */
	101	0x20, 0x00, /* u16 wTotalLength; */
	102	0x01, /* u8 bNumInterfaces; (1) */
	103	0x01, /* u8 bConfigurationValue; */
	104	0x00, /* u8 iConfiguration; */
5fafdf24	105	0xc0, /* u8 bmAttributes;
2e5d83bb PB	106	Bit 7: must be set,
	107	6: Self-powered,
	108	5: Remote wakeup,
	109	4..0: resvd */
	110	0x00, /* u8 MaxPower; */
3b46e624	111
2e5d83bb PB	112	/* one interface */
	113	0x09, /* u8 if_bLength; */
	114	0x04, /* u8 if_bDescriptorType; Interface */
	115	0x00, /* u8 if_bInterfaceNumber; */
	116	0x00, /* u8 if_bAlternateSetting; */
	117	0x02, /* u8 if_bNumEndpoints; */
	118	0x08, /* u8 if_bInterfaceClass; MASS STORAGE */
	119	0x06, /* u8 if_bInterfaceSubClass; SCSI */
	120	0x50, /* u8 if_bInterfaceProtocol; Bulk Only */
	121	0x00, /* u8 if_iInterface; */
3b46e624	122
2e5d83bb PB	123	/* Bulk-In endpoint */
	124	0x07, /* u8 ep_bLength; */
	125	0x05, /* u8 ep_bDescriptorType; Endpoint */
	126	0x81, /* u8 ep_bEndpointAddress; IN Endpoint 1 */
	127	0x02, /* u8 ep_bmAttributes; Bulk */
	128	0x40, 0x00, /* u16 ep_wMaxPacketSize; */
	129	0x00, /* u8 ep_bInterval; */
	130
	131	/* Bulk-Out endpoint */
	132	0x07, /* u8 ep_bLength; */
	133	0x05, /* u8 ep_bDescriptorType; Endpoint */
	134	0x02, /* u8 ep_bEndpointAddress; OUT Endpoint 2 */
	135	0x02, /* u8 ep_bmAttributes; Bulk */
	136	0x40, 0x00, /* u16 ep_wMaxPacketSize; */
	137	0x00 /* u8 ep_bInterval; */
	138	};
	139
a917d384 PB	140	static void usb_msd_copy_data(MSDState *s)
	141	{
	142	uint32_t len;
	143	len = s->usb_len;
	144	if (len > s->scsi_len)
	145	len = s->scsi_len;
	146	if (s->mode == USB_MSDM_DATAIN) {
	147	memcpy(s->usb_buf, s->scsi_buf, len);
	148	} else {
	149	memcpy(s->scsi_buf, s->usb_buf, len);
	150	}
	151	s->usb_len -= len;
	152	s->scsi_len -= len;
	153	s->usb_buf += len;
	154	s->scsi_buf += len;
	155	s->data_len -= len;
	156	if (s->scsi_len == 0) {
	157	if (s->mode == USB_MSDM_DATAIN) {
d52affa7	158	s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
a917d384	159	} else if (s->mode == USB_MSDM_DATAOUT) {
d52affa7	160	s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
a917d384 PB	161	}
	162	}
	163	}
	164
	165	static void usb_msd_send_status(MSDState *s)
	166	{
	167	struct usb_msd_csw csw;
	168
	169	csw.sig = cpu_to_le32(0x53425355);
	170	csw.tag = cpu_to_le32(s->tag);
	171	csw.residue = s->residue;
	172	csw.status = s->result;
	173	memcpy(s->usb_buf, &csw, 13);
	174	}
	175
d52affa7	176	static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
a917d384	177	uint32_t arg)
2e5d83bb	178	{
d52affa7	179	MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
a917d384	180	USBPacket *p = s->packet;
4d611c9a	181
a917d384 PB	182	if (tag != s->tag) {
	183	fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
	184	}
4d611c9a	185	if (reason == SCSI_REASON_DONE) {
a917d384 PB	186	DPRINTF("Command complete %d\n", arg);
	187	s->residue = s->data_len;
	188	s->result = arg != 0;
	189	if (s->packet) {
	190	if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
	191	/* A deferred packet with no write data remaining must be
	192	the status read packet. */
	193	usb_msd_send_status(s);
	194	s->mode = USB_MSDM_CBW;
	195	} else {
	196	if (s->data_len) {
	197	s->data_len -= s->usb_len;
	198	if (s->mode == USB_MSDM_DATAIN)
	199	memset(s->usb_buf, 0, s->usb_len);
	200	s->usb_len = 0;
	201	}
	202	if (s->data_len == 0)
	203	s->mode = USB_MSDM_CSW;
	204	}
	205	s->packet = NULL;
	206	usb_packet_complete(p);
	207	} else if (s->data_len == 0) {
	208	s->mode = USB_MSDM_CSW;
	209	}
	210	return;
4d611c9a	211	}
a917d384	212	s->scsi_len = arg;
d52affa7	213	s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
a917d384 PB	214	if (p) {
	215	usb_msd_copy_data(s);
	216	if (s->usb_len == 0) {
	217	/* Set s->packet to NULL before calling usb_packet_complete
	218	because annother request may be issued before
	219	usb_packet_complete returns. */
	220	DPRINTF("Packet complete %p\n", p);
	221	s->packet = NULL;
	222	usb_packet_complete(p);
	223	}
4d611c9a	224	}
2e5d83bb PB	225	}
2e5d83bb PB	226
059809e4	227	static void usb_msd_handle_reset(USBDevice *dev)
2e5d83bb PB	228	{
	229	MSDState s = (MSDState )dev;
	230
	231	DPRINTF("Reset\n");
	232	s->mode = USB_MSDM_CBW;
2e5d83bb PB	233	}
	234
	235	static int usb_msd_handle_control(USBDevice *dev, int request, int value,
	236	int index, int length, uint8_t *data)
	237	{
	238	MSDState s = (MSDState )dev;
	239	int ret = 0;
	240
	241	switch (request) {
	242	case DeviceRequest \| USB_REQ_GET_STATUS:
	243	data[0] = (1 << USB_DEVICE_SELF_POWERED) \|
	244	(dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
	245	data[1] = 0x00;
	246	ret = 2;
	247	break;
	248	case DeviceOutRequest \| USB_REQ_CLEAR_FEATURE:
	249	if (value == USB_DEVICE_REMOTE_WAKEUP) {
	250	dev->remote_wakeup = 0;
	251	} else {
	252	goto fail;
	253	}
	254	ret = 0;
	255	break;
	256	case DeviceOutRequest \| USB_REQ_SET_FEATURE:
	257	if (value == USB_DEVICE_REMOTE_WAKEUP) {
	258	dev->remote_wakeup = 1;
	259	} else {
	260	goto fail;
	261	}
	262	ret = 0;
	263	break;
	264	case DeviceOutRequest \| USB_REQ_SET_ADDRESS:
	265	dev->addr = value;
	266	ret = 0;
	267	break;
	268	case DeviceRequest \| USB_REQ_GET_DESCRIPTOR:
	269	switch(value >> 8) {
	270	case USB_DT_DEVICE:
5fafdf24	271	memcpy(data, qemu_msd_dev_descriptor,
2e5d83bb PB	272	sizeof(qemu_msd_dev_descriptor));
	273	ret = sizeof(qemu_msd_dev_descriptor);
	274	break;
	275	case USB_DT_CONFIG:
5fafdf24	276	memcpy(data, qemu_msd_config_descriptor,
2e5d83bb PB	277	sizeof(qemu_msd_config_descriptor));
	278	ret = sizeof(qemu_msd_config_descriptor);
	279	break;
	280	case USB_DT_STRING:
	281	switch(value & 0xff) {
	282	case 0:
	283	/* language ids */
	284	data[0] = 4;
	285	data[1] = 3;
	286	data[2] = 0x09;
	287	data[3] = 0x04;
	288	ret = 4;
	289	break;
	290	case 1:
	291	/* vendor description */
	292	ret = set_usb_string(data, "QEMU " QEMU_VERSION);
	293	break;
	294	case 2:
	295	/* product description */
	296	ret = set_usb_string(data, "QEMU USB HARDDRIVE");
	297	break;
	298	case 3:
	299	/* serial number */
	300	ret = set_usb_string(data, "1");
	301	break;
	302	default:
	303	goto fail;
	304	}
	305	break;
	306	default:
	307	goto fail;
	308	}
	309	break;
	310	case DeviceRequest \| USB_REQ_GET_CONFIGURATION:
	311	data[0] = 1;
	312	ret = 1;
	313	break;
	314	case DeviceOutRequest \| USB_REQ_SET_CONFIGURATION:
	315	ret = 0;
	316	break;
	317	case DeviceRequest \| USB_REQ_GET_INTERFACE:
	318	data[0] = 0;
	319	ret = 1;
	320	break;
	321	case DeviceOutRequest \| USB_REQ_SET_INTERFACE:
	322	ret = 0;
	323	break;
	324	case EndpointOutRequest \| USB_REQ_CLEAR_FEATURE:
e5322f76 APR	325	ret = 0;
	326	break;
	327	case InterfaceOutRequest \| USB_REQ_SET_INTERFACE:
2e5d83bb PB	328	ret = 0;
	329	break;
	330	/* Class specific requests. */
f3571b1a	331	case ClassInterfaceOutRequest \| MassStorageReset:
2e5d83bb PB	332	/* Reset state ready for the next CBW. */
	333	s->mode = USB_MSDM_CBW;
	334	ret = 0;
	335	break;
f3571b1a	336	case ClassInterfaceRequest \| GetMaxLun:
2e5d83bb PB	337	data[0] = 0;
	338	ret = 1;
	339	break;
	340	default:
	341	fail:
	342	ret = USB_RET_STALL;
	343	break;
	344	}
	345	return ret;
	346	}
	347
4d611c9a PB	348	static void usb_msd_cancel_io(USBPacket p, void opaque)
	349	{
	350	MSDState *s = opaque;
d52affa7	351	s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
4d611c9a	352	s->packet = NULL;
a917d384	353	s->scsi_len = 0;
4d611c9a PB	354	}
	355
	356	static int usb_msd_handle_data(USBDevice dev, USBPacket p)
2e5d83bb PB	357	{
	358	MSDState s = (MSDState )dev;
	359	int ret = 0;
	360	struct usb_msd_cbw cbw;
4d611c9a PB	361	uint8_t devep = p->devep;
	362	uint8_t *data = p->data;
	363	int len = p->len;
2e5d83bb	364
4d611c9a	365	switch (p->pid) {
2e5d83bb PB	366	case USB_TOKEN_OUT:
	367	if (devep != 2)
	368	goto fail;
	369
	370	switch (s->mode) {
	371	case USB_MSDM_CBW:
	372	if (len != 31) {
	373	fprintf(stderr, "usb-msd: Bad CBW size");
	374	goto fail;
	375	}
	376	memcpy(&cbw, data, 31);
	377	if (le32_to_cpu(cbw.sig) != 0x43425355) {
	378	fprintf(stderr, "usb-msd: Bad signature %08x\n",
	379	le32_to_cpu(cbw.sig));
	380	goto fail;
	381	}
	382	DPRINTF("Command on LUN %d\n", cbw.lun);
	383	if (cbw.lun != 0) {
	384	fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
	385	goto fail;
	386	}
	387	s->tag = le32_to_cpu(cbw.tag);
	388	s->data_len = le32_to_cpu(cbw.data_len);
	389	if (s->data_len == 0) {
	390	s->mode = USB_MSDM_CSW;
	391	} else if (cbw.flags & 0x80) {
	392	s->mode = USB_MSDM_DATAIN;
	393	} else {
	394	s->mode = USB_MSDM_DATAOUT;
	395	}
	396	DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
	397	s->tag, cbw.flags, cbw.cmd_len, s->data_len);
a917d384	398	s->residue = 0;
d52affa7	399	s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
a917d384 PB	400	/* ??? Should check that USB and SCSI data transfer
	401	directions match. */
	402	if (s->residue == 0) {
	403	if (s->mode == USB_MSDM_DATAIN) {
d52affa7	404	s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
a917d384	405	} else if (s->mode == USB_MSDM_DATAOUT) {
d52affa7	406	s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
a917d384 PB	407	}
a917d384 PB	408	}
2e5d83bb PB	409	ret = len;
	410	break;
	411
	412	case USB_MSDM_DATAOUT:
	413	DPRINTF("Data out %d/%d\n", len, s->data_len);
	414	if (len > s->data_len)
	415	goto fail;
	416
a917d384 PB	417	s->usb_buf = data;
	418	s->usb_len = len;
	419	if (s->scsi_len) {
	420	usb_msd_copy_data(s);
	421	}
	422	if (s->residue && s->usb_len) {
	423	s->data_len -= s->usb_len;
	424	if (s->data_len == 0)
	425	s->mode = USB_MSDM_CSW;
	426	s->usb_len = 0;
	427	}
	428	if (s->usb_len) {
4d611c9a PB	429	DPRINTF("Deferring packet %p\n", p);
	430	usb_defer_packet(p, usb_msd_cancel_io, s);
	431	s->packet = p;
	432	ret = USB_RET_ASYNC;
a917d384 PB	433	} else {
a917d384 PB	434	ret = len;
4d611c9a	435	}
2e5d83bb PB	436	break;
	437
	438	default:
	439	DPRINTF("Unexpected write (len %d)\n", len);
	440	goto fail;
	441	}
	442	break;
	443
	444	case USB_TOKEN_IN:
	445	if (devep != 1)
	446	goto fail;
	447
	448	switch (s->mode) {
a917d384 PB	449	case USB_MSDM_DATAOUT:
	450	if (s->data_len != 0 \|\| len < 13)
	451	goto fail;
	452	/* Waiting for SCSI write to complete. */
	453	usb_defer_packet(p, usb_msd_cancel_io, s);
	454	s->packet = p;
	455	ret = USB_RET_ASYNC;
	456	break;
	457
2e5d83bb PB	458	case USB_MSDM_CSW:
	459	DPRINTF("Command status %d tag 0x%x, len %d\n",
	460	s->result, s->tag, len);
	461	if (len < 13)
	462	goto fail;
	463
a917d384 PB	464	s->usb_len = len;
	465	s->usb_buf = data;
	466	usb_msd_send_status(s);
2e5d83bb	467	s->mode = USB_MSDM_CBW;
a917d384	468	ret = 13;
2e5d83bb PB	469	break;
	470
	471	case USB_MSDM_DATAIN:
	472	DPRINTF("Data in %d/%d\n", len, s->data_len);
	473	if (len > s->data_len)
	474	len = s->data_len;
a917d384 PB	475	s->usb_buf = data;
	476	s->usb_len = len;
	477	if (s->scsi_len) {
	478	usb_msd_copy_data(s);
	479	}
	480	if (s->residue && s->usb_len) {
	481	s->data_len -= s->usb_len;
	482	memset(s->usb_buf, 0, s->usb_len);
	483	if (s->data_len == 0)
	484	s->mode = USB_MSDM_CSW;
	485	s->usb_len = 0;
	486	}
	487	if (s->usb_len) {
4d611c9a PB	488	DPRINTF("Deferring packet %p\n", p);
	489	usb_defer_packet(p, usb_msd_cancel_io, s);
	490	s->packet = p;
	491	ret = USB_RET_ASYNC;
a917d384 PB	492	} else {
a917d384 PB	493	ret = len;
4d611c9a	494	}
2e5d83bb PB	495	break;
	496
	497	default:
	498	DPRINTF("Unexpected read (len %d)\n", len);
	499	goto fail;
	500	}
	501	break;
	502
	503	default:
	504	DPRINTF("Bad token\n");
	505	fail:
	506	ret = USB_RET_STALL;
	507	break;
	508	}
	509
	510	return ret;
	511	}
	512
b3e461d3 GH	513	static void usb_msd_password_cb(void *opaque, int err)
	514	{
	515	MSDState *s = opaque;
	516
	517	if (!err)
	518	usb_device_attach(&s->dev);
	519	else
	520	qdev_unplug(&s->dev.qdev);
	521	}
	522
806b6024 GH	523	static int usb_msd_initfn(USBDevice *dev)
	524	{
	525	MSDState *s = DO_UPCAST(MSDState, dev, dev);
f8b6cc00	526	BlockDriverState *bs = s->conf.bs;
806b6024	527
f8b6cc00	528	if (!bs) {
1ecda02b	529	error_report("usb-msd: drive property not set");
7fc2f2c0 GH	530	return -1;
	531	}
	532
14bafc54 MA	533	/*
	534	* Hack alert: this pretends to be a block device, but it's really
	535	* a SCSI bus that can serve only a single device, which it
18846dee MA	536	* creates automatically. But first it needs to detach from its
	537	* blockdev, or else scsi_bus_legacy_add_drive() dies when it
	538	* attaches again.
14bafc54 MA	539	*
	540	* The hack is probably a bad idea.
	541	*/
18846dee	542	bdrv_detach(bs, &s->dev.qdev);
f8b6cc00	543	s->conf.bs = NULL;
14bafc54	544
806b6024	545	s->dev.speed = USB_SPEED_FULL;
ca9c39fa	546	scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
f8b6cc00	547	s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
fa66b909 MA	548	if (!s->scsi_dev) {
	549	return -1;
	550	}
cb23117b	551	s->bus.qbus.allow_hotplug = 0;
7fc2f2c0	552	usb_msd_handle_reset(dev);
b3e461d3	553
f8b6cc00	554	if (bdrv_key_required(bs)) {
a4426488	555	if (cur_mon) {
f8b6cc00	556	monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
b3e461d3 GH	557	s->dev.auto_attach = 0;
	558	} else {
	559	autostart = 0;
	560	}
	561	}
	562
806b6024 GH	563	return 0;
	564	}
	565
b3e461d3	566	static USBDevice usb_msd_init(const char filename)
2e5d83bb	567	{
7fc2f2c0 GH	568	static int nr=0;
	569	char id[8];
	570	QemuOpts *opts;
	571	DriveInfo *dinfo;
806b6024	572	USBDevice *dev;
7fc2f2c0	573	int fatal_error;
334c0241 AJ	574	const char *p1;
	575	char fmt[32];
	576
7fc2f2c0 GH	577	/* parse -usbdevice disk: syntax into drive opts */
7fc2f2c0 GH	578	snprintf(id, sizeof(id), "usb%d", nr++);
3329f07b	579	opts = qemu_opts_create(qemu_find_opts("drive"), id, 0);
7fc2f2c0	580
334c0241 AJ	581	p1 = strchr(filename, ':');
	582	if (p1++) {
	583	const char *p2;
	584
	585	if (strstart(filename, "format=", &p2)) {
	586	int len = MIN(p1 - p2, sizeof(fmt));
	587	pstrcpy(fmt, len, p2);
7fc2f2c0	588	qemu_opt_set(opts, "format", fmt);
334c0241 AJ	589	} else if (*filename != ':') {
	590	printf("unrecognized USB mass-storage option %s\n", filename);
	591	return NULL;
	592	}
334c0241 AJ	593	filename = p1;
334c0241 AJ	594	}
334c0241 AJ	595	if (!*filename) {
	596	printf("block device specification needed\n");
	597	return NULL;
	598	}
7fc2f2c0 GH	599	qemu_opt_set(opts, "file", filename);
7fc2f2c0 GH	600	qemu_opt_set(opts, "if", "none");
2e5d83bb	601
7fc2f2c0	602	/* create host drive */
a803cb8e	603	dinfo = drive_init(opts, 0, &fatal_error);
7fc2f2c0 GH	604	if (!dinfo) {
7fc2f2c0 GH	605	qemu_opts_del(opts);
806b6024	606	return NULL;
7fc2f2c0	607	}
2e5d83bb	608
7fc2f2c0	609	/* create guest device */
556cd098	610	dev = usb_create(NULL /* FIXME */, "usb-storage");
d44168ff PB	611	if (!dev) {
	612	return NULL;
	613	}
18846dee MA	614	if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
	615	qdev_free(&dev->qdev);
	616	return NULL;
	617	}
33e66b86 MA	618	if (qdev_init(&dev->qdev) < 0)
33e66b86 MA	619	return NULL;
1f6e24e7	620
7fc2f2c0	621	return dev;
2e5d83bb	622	}
bb5fc20f	623
806b6024	624	static struct USBDeviceInfo msd_info = {
06384698	625	.product_desc = "QEMU USB MSD",
556cd098	626	.qdev.name = "usb-storage",
806b6024 GH	627	.qdev.size = sizeof(MSDState),
	628	.init = usb_msd_initfn,
	629	.handle_packet = usb_generic_handle_packet,
	630	.handle_reset = usb_msd_handle_reset,
	631	.handle_control = usb_msd_handle_control,
	632	.handle_data = usb_msd_handle_data,
b3e461d3 GH	633	.usbdevice_name = "disk",
b3e461d3 GH	634	.usbdevice_init = usb_msd_init,
7fc2f2c0	635	.qdev.props = (Property[]) {
428c149b	636	DEFINE_BLOCK_PROPERTIES(MSDState, conf),
7fc2f2c0 GH	637	DEFINE_PROP_END_OF_LIST(),
7fc2f2c0 GH	638	},
806b6024 GH	639	};
	640
	641	static void usb_msd_register_devices(void)
	642	{
	643	usb_qdev_register(&msd_info);
	644	}
	645	device_init(usb_msd_register_devices)