2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu-common.h"
11 #include "qemu-option.h"
12 #include "qemu-config.h"
14 #include "hw/usb/desc.h"
24 #define DPRINTF(fmt, ...) \
25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
27 #define DPRINTF(fmt, ...) do {} while(0)
31 #define MassStorageReset 0xff
32 #define GetMaxLun 0xfe
35 USB_MSDM_CBW
, /* Command Block. */
36 USB_MSDM_DATAOUT
, /* Transfer data to device. */
37 USB_MSDM_DATAIN
, /* Transfer data from device. */
38 USB_MSDM_CSW
/* Command Status. */
54 struct usb_msd_csw csw
;
61 /* For async completion. */
84 static const USBDescStrings desc_strings
= {
85 [STR_MANUFACTURER
] = "QEMU",
86 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
87 [STR_SERIALNUMBER
] = "1",
88 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
89 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
90 [STR_CONFIG_SUPER
] = "Super speed config (usb 3.0)",
93 static const USBDescIface desc_iface_full
= {
94 .bInterfaceNumber
= 0,
96 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
97 .bInterfaceSubClass
= 0x06, /* SCSI */
98 .bInterfaceProtocol
= 0x50, /* Bulk */
99 .eps
= (USBDescEndpoint
[]) {
101 .bEndpointAddress
= USB_DIR_IN
| 0x01,
102 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
103 .wMaxPacketSize
= 64,
105 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
106 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
107 .wMaxPacketSize
= 64,
112 static const USBDescDevice desc_device_full
= {
114 .bMaxPacketSize0
= 8,
115 .bNumConfigurations
= 1,
116 .confs
= (USBDescConfig
[]) {
119 .bConfigurationValue
= 1,
120 .iConfiguration
= STR_CONFIG_FULL
,
121 .bmAttributes
= 0xc0,
123 .ifs
= &desc_iface_full
,
128 static const USBDescIface desc_iface_high
= {
129 .bInterfaceNumber
= 0,
131 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
132 .bInterfaceSubClass
= 0x06, /* SCSI */
133 .bInterfaceProtocol
= 0x50, /* Bulk */
134 .eps
= (USBDescEndpoint
[]) {
136 .bEndpointAddress
= USB_DIR_IN
| 0x01,
137 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
138 .wMaxPacketSize
= 512,
140 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
141 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
142 .wMaxPacketSize
= 512,
147 static const USBDescDevice desc_device_high
= {
149 .bMaxPacketSize0
= 64,
150 .bNumConfigurations
= 1,
151 .confs
= (USBDescConfig
[]) {
154 .bConfigurationValue
= 1,
155 .iConfiguration
= STR_CONFIG_HIGH
,
156 .bmAttributes
= 0xc0,
158 .ifs
= &desc_iface_high
,
163 static const USBDescIface desc_iface_super
= {
164 .bInterfaceNumber
= 0,
166 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
167 .bInterfaceSubClass
= 0x06, /* SCSI */
168 .bInterfaceProtocol
= 0x50, /* Bulk */
169 .eps
= (USBDescEndpoint
[]) {
171 .bEndpointAddress
= USB_DIR_IN
| 0x01,
172 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
173 .wMaxPacketSize
= 1024,
176 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
177 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
178 .wMaxPacketSize
= 1024,
184 static const USBDescDevice desc_device_super
= {
186 .bMaxPacketSize0
= 9,
187 .bNumConfigurations
= 1,
188 .confs
= (USBDescConfig
[]) {
191 .bConfigurationValue
= 1,
192 .iConfiguration
= STR_CONFIG_SUPER
,
193 .bmAttributes
= 0xc0,
195 .ifs
= &desc_iface_super
,
200 static const USBDesc desc
= {
202 .idVendor
= 0x46f4, /* CRC16() of "QEMU" */
205 .iManufacturer
= STR_MANUFACTURER
,
206 .iProduct
= STR_PRODUCT
,
207 .iSerialNumber
= STR_SERIALNUMBER
,
209 .full
= &desc_device_full
,
210 .high
= &desc_device_high
,
211 .super
= &desc_device_super
,
215 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
218 len
= p
->iov
.size
- p
->result
;
219 if (len
> s
->scsi_len
)
221 usb_packet_copy(p
, scsi_req_get_buf(s
->req
) + s
->scsi_off
, len
);
225 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
226 scsi_req_continue(s
->req
);
230 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
234 DPRINTF("Command status %d tag 0x%x, len %zd\n",
235 s
->csw
.status
, le32_to_cpu(s
->csw
.tag
), p
->iov
.size
);
237 assert(s
->csw
.sig
== cpu_to_le32(0x53425355));
238 len
= MIN(sizeof(s
->csw
), p
->iov
.size
);
239 usb_packet_copy(p
, &s
->csw
, len
);
240 memset(&s
->csw
, 0, sizeof(s
->csw
));
243 static void usb_msd_packet_complete(MSDState
*s
)
245 USBPacket
*p
= s
->packet
;
247 /* Set s->packet to NULL before calling usb_packet_complete
248 because another request may be issued before
249 usb_packet_complete returns. */
250 DPRINTF("Packet complete %p\n", p
);
252 usb_packet_complete(&s
->dev
, p
);
255 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
257 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
258 USBPacket
*p
= s
->packet
;
260 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
264 usb_msd_copy_data(s
, p
);
266 if (p
&& p
->result
== p
->iov
.size
) {
267 usb_msd_packet_complete(s
);
272 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
274 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
275 USBPacket
*p
= s
->packet
;
277 DPRINTF("Command complete %d tag 0x%x\n", status
, req
->tag
);
279 s
->csw
.sig
= cpu_to_le32(0x53425355);
280 s
->csw
.tag
= cpu_to_le32(req
->tag
);
281 s
->csw
.residue
= cpu_to_le32(s
->data_len
);
282 s
->csw
.status
= status
!= 0;
285 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
286 /* A deferred packet with no write data remaining must be
287 the status read packet. */
288 usb_msd_send_status(s
, p
);
289 s
->mode
= USB_MSDM_CBW
;
290 } else if (s
->mode
== USB_MSDM_CSW
) {
291 usb_msd_send_status(s
, p
);
292 s
->mode
= USB_MSDM_CBW
;
295 int len
= (p
->iov
.size
- p
->result
);
296 usb_packet_skip(p
, len
);
299 if (s
->data_len
== 0) {
300 s
->mode
= USB_MSDM_CSW
;
303 usb_msd_packet_complete(s
);
304 } else if (s
->data_len
== 0) {
305 s
->mode
= USB_MSDM_CSW
;
311 static void usb_msd_request_cancelled(SCSIRequest
*req
)
313 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
316 scsi_req_unref(s
->req
);
322 static void usb_msd_handle_reset(USBDevice
*dev
)
324 MSDState
*s
= (MSDState
*)dev
;
328 scsi_req_cancel(s
->req
);
330 assert(s
->req
== NULL
);
333 s
->packet
->result
= USB_RET_STALL
;
334 usb_msd_packet_complete(s
);
337 s
->mode
= USB_MSDM_CBW
;
340 static int usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
341 int request
, int value
, int index
, int length
, uint8_t *data
)
343 MSDState
*s
= (MSDState
*)dev
;
346 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
353 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
356 /* Class specific requests. */
357 case ClassInterfaceOutRequest
| MassStorageReset
:
358 /* Reset state ready for the next CBW. */
359 s
->mode
= USB_MSDM_CBW
;
362 case ClassInterfaceRequest
| GetMaxLun
:
373 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
375 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
377 assert(s
->packet
== p
);
381 scsi_req_cancel(s
->req
);
385 static int usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
387 MSDState
*s
= (MSDState
*)dev
;
390 struct usb_msd_cbw cbw
;
391 uint8_t devep
= p
->ep
->nr
;
400 if (p
->iov
.size
!= 31) {
401 fprintf(stderr
, "usb-msd: Bad CBW size");
404 usb_packet_copy(p
, &cbw
, 31);
405 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
406 fprintf(stderr
, "usb-msd: Bad signature %08x\n",
407 le32_to_cpu(cbw
.sig
));
410 DPRINTF("Command on LUN %d\n", cbw
.lun
);
412 fprintf(stderr
, "usb-msd: Bad LUN %d\n", cbw
.lun
);
415 tag
= le32_to_cpu(cbw
.tag
);
416 s
->data_len
= le32_to_cpu(cbw
.data_len
);
417 if (s
->data_len
== 0) {
418 s
->mode
= USB_MSDM_CSW
;
419 } else if (cbw
.flags
& 0x80) {
420 s
->mode
= USB_MSDM_DATAIN
;
422 s
->mode
= USB_MSDM_DATAOUT
;
424 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
425 tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
426 assert(le32_to_cpu(s
->csw
.residue
) == 0);
428 s
->req
= scsi_req_new(s
->scsi_dev
, tag
, 0, cbw
.cmd
, NULL
);
430 scsi_req_print(s
->req
);
432 scsi_req_enqueue(s
->req
);
433 if (s
->req
&& s
->req
->cmd
.xfer
!= SCSI_XFER_NONE
) {
434 scsi_req_continue(s
->req
);
439 case USB_MSDM_DATAOUT
:
440 DPRINTF("Data out %zd/%d\n", p
->iov
.size
, s
->data_len
);
441 if (p
->iov
.size
> s
->data_len
) {
446 usb_msd_copy_data(s
, p
);
448 if (le32_to_cpu(s
->csw
.residue
)) {
449 int len
= p
->iov
.size
- p
->result
;
451 usb_packet_skip(p
, len
);
453 if (s
->data_len
== 0) {
454 s
->mode
= USB_MSDM_CSW
;
458 if (p
->result
< p
->iov
.size
) {
459 DPRINTF("Deferring packet %p [wait data-out]\n", p
);
468 DPRINTF("Unexpected write (len %zd)\n", p
->iov
.size
);
478 case USB_MSDM_DATAOUT
:
479 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
482 /* Waiting for SCSI write to complete. */
488 if (p
->iov
.size
< 13) {
493 /* still in flight */
494 DPRINTF("Deferring packet %p [wait status]\n", p
);
498 usb_msd_send_status(s
, p
);
499 s
->mode
= USB_MSDM_CBW
;
504 case USB_MSDM_DATAIN
:
505 DPRINTF("Data in %zd/%d, scsi_len %d\n",
506 p
->iov
.size
, s
->data_len
, s
->scsi_len
);
508 usb_msd_copy_data(s
, p
);
510 if (le32_to_cpu(s
->csw
.residue
)) {
511 int len
= p
->iov
.size
- p
->result
;
513 usb_packet_skip(p
, len
);
515 if (s
->data_len
== 0) {
516 s
->mode
= USB_MSDM_CSW
;
520 if (p
->result
< p
->iov
.size
) {
521 DPRINTF("Deferring packet %p [wait data-in]\n", p
);
530 DPRINTF("Unexpected read (len %zd)\n", p
->iov
.size
);
536 DPRINTF("Bad token\n");
545 static void usb_msd_password_cb(void *opaque
, int err
)
547 MSDState
*s
= opaque
;
550 err
= usb_device_attach(&s
->dev
);
553 qdev_unplug(&s
->dev
.qdev
, NULL
);
556 static void *usb_msd_load_request(QEMUFile
*f
, SCSIRequest
*req
)
558 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
560 /* nothing to load, just store req in our state struct */
561 assert(s
->req
== NULL
);
567 static const struct SCSIBusInfo usb_msd_scsi_info
= {
572 .transfer_data
= usb_msd_transfer_data
,
573 .complete
= usb_msd_command_complete
,
574 .cancel
= usb_msd_request_cancelled
,
575 .load_request
= usb_msd_load_request
,
578 static int usb_msd_initfn(USBDevice
*dev
)
580 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
581 BlockDriverState
*bs
= s
->conf
.bs
;
584 error_report("drive property not set");
588 blkconf_serial(&s
->conf
, &s
->serial
);
591 * Hack alert: this pretends to be a block device, but it's really
592 * a SCSI bus that can serve only a single device, which it
593 * creates automatically. But first it needs to detach from its
594 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
597 * The hack is probably a bad idea.
599 bdrv_detach_dev(bs
, &s
->dev
.qdev
);
603 usb_desc_set_string(dev
, STR_SERIALNUMBER
, s
->serial
);
605 usb_desc_create_serial(dev
);
609 scsi_bus_new(&s
->bus
, &s
->dev
.qdev
, &usb_msd_scsi_info
);
610 s
->scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, bs
, 0, !!s
->removable
,
615 s
->bus
.qbus
.allow_hotplug
= 0;
616 usb_msd_handle_reset(dev
);
618 if (bdrv_key_required(bs
)) {
620 monitor_read_bdrv_key_start(cur_mon
, bs
, usb_msd_password_cb
, s
);
621 s
->dev
.auto_attach
= 0;
630 static USBDevice
*usb_msd_init(USBBus
*bus
, const char *filename
)
640 /* parse -usbdevice disk: syntax into drive opts */
641 snprintf(id
, sizeof(id
), "usb%d", nr
++);
642 opts
= qemu_opts_create(qemu_find_opts("drive"), id
, 0, NULL
);
644 p1
= strchr(filename
, ':');
648 if (strstart(filename
, "format=", &p2
)) {
649 int len
= MIN(p1
- p2
, sizeof(fmt
));
650 pstrcpy(fmt
, len
, p2
);
651 qemu_opt_set(opts
, "format", fmt
);
652 } else if (*filename
!= ':') {
653 printf("unrecognized USB mass-storage option %s\n", filename
);
659 printf("block device specification needed\n");
662 qemu_opt_set(opts
, "file", filename
);
663 qemu_opt_set(opts
, "if", "none");
665 /* create host drive */
666 dinfo
= drive_init(opts
, 0);
672 /* create guest device */
673 dev
= usb_create(bus
, "usb-storage");
677 if (qdev_prop_set_drive(&dev
->qdev
, "drive", dinfo
->bdrv
) < 0) {
678 qdev_free(&dev
->qdev
);
681 if (qdev_init(&dev
->qdev
) < 0)
687 static const VMStateDescription vmstate_usb_msd
= {
688 .name
= "usb-storage",
690 .minimum_version_id
= 1,
691 .fields
= (VMStateField
[]) {
692 VMSTATE_USB_DEVICE(dev
, MSDState
),
693 VMSTATE_UINT32(mode
, MSDState
),
694 VMSTATE_UINT32(scsi_len
, MSDState
),
695 VMSTATE_UINT32(scsi_off
, MSDState
),
696 VMSTATE_UINT32(data_len
, MSDState
),
697 VMSTATE_UINT32(csw
.sig
, MSDState
),
698 VMSTATE_UINT32(csw
.tag
, MSDState
),
699 VMSTATE_UINT32(csw
.residue
, MSDState
),
700 VMSTATE_UINT8(csw
.status
, MSDState
),
701 VMSTATE_END_OF_LIST()
705 static Property msd_properties
[] = {
706 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
707 DEFINE_PROP_STRING("serial", MSDState
, serial
),
708 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
709 DEFINE_PROP_END_OF_LIST(),
712 static void usb_msd_class_initfn(ObjectClass
*klass
, void *data
)
714 DeviceClass
*dc
= DEVICE_CLASS(klass
);
715 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
717 uc
->init
= usb_msd_initfn
;
718 uc
->product_desc
= "QEMU USB MSD";
719 uc
->usb_desc
= &desc
;
720 uc
->cancel_packet
= usb_msd_cancel_io
;
721 uc
->handle_attach
= usb_desc_attach
;
722 uc
->handle_reset
= usb_msd_handle_reset
;
723 uc
->handle_control
= usb_msd_handle_control
;
724 uc
->handle_data
= usb_msd_handle_data
;
725 dc
->fw_name
= "storage";
726 dc
->vmsd
= &vmstate_usb_msd
;
727 dc
->props
= msd_properties
;
730 static TypeInfo msd_info
= {
731 .name
= "usb-storage",
732 .parent
= TYPE_USB_DEVICE
,
733 .instance_size
= sizeof(MSDState
),
734 .class_init
= usb_msd_class_initfn
,
737 static void usb_msd_register_types(void)
739 type_register_static(&msd_info
);
740 usb_legacy_register("usb-storage", "disk", usb_msd_init
);
743 type_init(usb_msd_register_types
)