2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu-common.h"
11 #include "qemu-option.h"
12 #include "qemu-config.h"
14 #include "hw/usb/desc.h"
24 #define DPRINTF(fmt, ...) \
25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
27 #define DPRINTF(fmt, ...) do {} while(0)
31 #define MassStorageReset 0xff
32 #define GetMaxLun 0xfe
35 USB_MSDM_CBW
, /* Command Block. */
36 USB_MSDM_DATAOUT
, /* Transfer data to device. */
37 USB_MSDM_DATAIN
, /* Transfer data from device. */
38 USB_MSDM_CSW
/* Command Status. */
54 struct usb_msd_csw csw
;
61 /* For async completion. */
83 static const USBDescStrings desc_strings
= {
84 [STR_MANUFACTURER
] = "QEMU",
85 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
86 [STR_SERIALNUMBER
] = "1",
87 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
88 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
91 static const USBDescIface desc_iface_full
= {
92 .bInterfaceNumber
= 0,
94 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
95 .bInterfaceSubClass
= 0x06, /* SCSI */
96 .bInterfaceProtocol
= 0x50, /* Bulk */
97 .eps
= (USBDescEndpoint
[]) {
99 .bEndpointAddress
= USB_DIR_IN
| 0x01,
100 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
101 .wMaxPacketSize
= 64,
103 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
104 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
105 .wMaxPacketSize
= 64,
110 static const USBDescDevice desc_device_full
= {
112 .bMaxPacketSize0
= 8,
113 .bNumConfigurations
= 1,
114 .confs
= (USBDescConfig
[]) {
117 .bConfigurationValue
= 1,
118 .iConfiguration
= STR_CONFIG_FULL
,
119 .bmAttributes
= 0xc0,
121 .ifs
= &desc_iface_full
,
126 static const USBDescIface desc_iface_high
= {
127 .bInterfaceNumber
= 0,
129 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
130 .bInterfaceSubClass
= 0x06, /* SCSI */
131 .bInterfaceProtocol
= 0x50, /* Bulk */
132 .eps
= (USBDescEndpoint
[]) {
134 .bEndpointAddress
= USB_DIR_IN
| 0x01,
135 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
136 .wMaxPacketSize
= 512,
138 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
139 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
140 .wMaxPacketSize
= 512,
145 static const USBDescDevice desc_device_high
= {
147 .bMaxPacketSize0
= 64,
148 .bNumConfigurations
= 1,
149 .confs
= (USBDescConfig
[]) {
152 .bConfigurationValue
= 1,
153 .iConfiguration
= STR_CONFIG_HIGH
,
154 .bmAttributes
= 0xc0,
156 .ifs
= &desc_iface_high
,
161 static const USBDesc desc
= {
163 .idVendor
= 0x46f4, /* CRC16() of "QEMU" */
166 .iManufacturer
= STR_MANUFACTURER
,
167 .iProduct
= STR_PRODUCT
,
168 .iSerialNumber
= STR_SERIALNUMBER
,
170 .full
= &desc_device_full
,
171 .high
= &desc_device_high
,
175 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
178 len
= p
->iov
.size
- p
->result
;
179 if (len
> s
->scsi_len
)
181 usb_packet_copy(p
, scsi_req_get_buf(s
->req
) + s
->scsi_off
, len
);
185 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
186 scsi_req_continue(s
->req
);
190 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
194 DPRINTF("Command status %d tag 0x%x, len %zd\n",
195 s
->csw
.status
, le32_to_cpu(s
->csw
.tag
), p
->iov
.size
);
197 assert(s
->csw
.sig
== cpu_to_le32(0x53425355));
198 len
= MIN(sizeof(s
->csw
), p
->iov
.size
);
199 usb_packet_copy(p
, &s
->csw
, len
);
200 memset(&s
->csw
, 0, sizeof(s
->csw
));
203 static void usb_msd_packet_complete(MSDState
*s
)
205 USBPacket
*p
= s
->packet
;
207 /* Set s->packet to NULL before calling usb_packet_complete
208 because another request may be issued before
209 usb_packet_complete returns. */
210 DPRINTF("Packet complete %p\n", p
);
212 usb_packet_complete(&s
->dev
, p
);
215 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
217 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
218 USBPacket
*p
= s
->packet
;
220 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
224 usb_msd_copy_data(s
, p
);
226 if (p
&& p
->result
== p
->iov
.size
) {
227 usb_msd_packet_complete(s
);
232 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
234 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
235 USBPacket
*p
= s
->packet
;
237 DPRINTF("Command complete %d tag 0x%x\n", status
, req
->tag
);
239 s
->csw
.sig
= cpu_to_le32(0x53425355);
240 s
->csw
.tag
= cpu_to_le32(req
->tag
);
241 s
->csw
.residue
= cpu_to_le32(s
->data_len
);
242 s
->csw
.status
= status
!= 0;
245 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
246 /* A deferred packet with no write data remaining must be
247 the status read packet. */
248 usb_msd_send_status(s
, p
);
249 s
->mode
= USB_MSDM_CBW
;
252 int len
= (p
->iov
.size
- p
->result
);
253 usb_packet_skip(p
, len
);
256 if (s
->data_len
== 0) {
257 s
->mode
= USB_MSDM_CSW
;
260 usb_msd_packet_complete(s
);
261 } else if (s
->data_len
== 0) {
262 s
->mode
= USB_MSDM_CSW
;
268 static void usb_msd_request_cancelled(SCSIRequest
*req
)
270 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
273 scsi_req_unref(s
->req
);
279 static void usb_msd_handle_reset(USBDevice
*dev
)
281 MSDState
*s
= (MSDState
*)dev
;
285 scsi_req_cancel(s
->req
);
287 assert(s
->req
== NULL
);
290 s
->packet
->result
= USB_RET_STALL
;
291 usb_msd_packet_complete(s
);
294 s
->mode
= USB_MSDM_CBW
;
297 static int usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
298 int request
, int value
, int index
, int length
, uint8_t *data
)
300 MSDState
*s
= (MSDState
*)dev
;
303 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
310 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
313 /* Class specific requests. */
314 case ClassInterfaceOutRequest
| MassStorageReset
:
315 /* Reset state ready for the next CBW. */
316 s
->mode
= USB_MSDM_CBW
;
319 case ClassInterfaceRequest
| GetMaxLun
:
330 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
332 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
334 assert(s
->packet
== p
);
338 scsi_req_cancel(s
->req
);
342 static int usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
344 MSDState
*s
= (MSDState
*)dev
;
347 struct usb_msd_cbw cbw
;
348 uint8_t devep
= p
->ep
->nr
;
357 if (p
->iov
.size
!= 31) {
358 fprintf(stderr
, "usb-msd: Bad CBW size");
361 usb_packet_copy(p
, &cbw
, 31);
362 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
363 fprintf(stderr
, "usb-msd: Bad signature %08x\n",
364 le32_to_cpu(cbw
.sig
));
367 DPRINTF("Command on LUN %d\n", cbw
.lun
);
369 fprintf(stderr
, "usb-msd: Bad LUN %d\n", cbw
.lun
);
372 tag
= le32_to_cpu(cbw
.tag
);
373 s
->data_len
= le32_to_cpu(cbw
.data_len
);
374 if (s
->data_len
== 0) {
375 s
->mode
= USB_MSDM_CSW
;
376 } else if (cbw
.flags
& 0x80) {
377 s
->mode
= USB_MSDM_DATAIN
;
379 s
->mode
= USB_MSDM_DATAOUT
;
381 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
382 tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
383 assert(le32_to_cpu(s
->csw
.residue
) == 0);
385 s
->req
= scsi_req_new(s
->scsi_dev
, tag
, 0, cbw
.cmd
, NULL
);
387 scsi_req_print(s
->req
);
389 scsi_req_enqueue(s
->req
);
390 if (s
->req
&& s
->req
->cmd
.xfer
!= SCSI_XFER_NONE
) {
391 scsi_req_continue(s
->req
);
396 case USB_MSDM_DATAOUT
:
397 DPRINTF("Data out %zd/%d\n", p
->iov
.size
, s
->data_len
);
398 if (p
->iov
.size
> s
->data_len
) {
403 usb_msd_copy_data(s
, p
);
405 if (le32_to_cpu(s
->csw
.residue
)) {
406 int len
= p
->iov
.size
- p
->result
;
408 usb_packet_skip(p
, len
);
410 if (s
->data_len
== 0) {
411 s
->mode
= USB_MSDM_CSW
;
415 if (p
->result
< p
->iov
.size
) {
416 DPRINTF("Deferring packet %p [wait data-out]\n", p
);
425 DPRINTF("Unexpected write (len %zd)\n", p
->iov
.size
);
435 case USB_MSDM_DATAOUT
:
436 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
439 /* Waiting for SCSI write to complete. */
445 if (p
->iov
.size
< 13) {
450 /* still in flight */
451 DPRINTF("Deferring packet %p [wait status]\n", p
);
455 usb_msd_send_status(s
, p
);
456 s
->mode
= USB_MSDM_CBW
;
461 case USB_MSDM_DATAIN
:
462 DPRINTF("Data in %zd/%d, scsi_len %d\n",
463 p
->iov
.size
, s
->data_len
, s
->scsi_len
);
465 usb_msd_copy_data(s
, p
);
467 if (le32_to_cpu(s
->csw
.residue
)) {
468 int len
= p
->iov
.size
- p
->result
;
470 usb_packet_skip(p
, len
);
472 if (s
->data_len
== 0) {
473 s
->mode
= USB_MSDM_CSW
;
477 if (p
->result
< p
->iov
.size
) {
478 DPRINTF("Deferring packet %p [wait data-in]\n", p
);
487 DPRINTF("Unexpected read (len %zd)\n", p
->iov
.size
);
493 DPRINTF("Bad token\n");
502 static void usb_msd_password_cb(void *opaque
, int err
)
504 MSDState
*s
= opaque
;
507 err
= usb_device_attach(&s
->dev
);
510 qdev_unplug(&s
->dev
.qdev
, NULL
);
513 static void *usb_msd_load_request(QEMUFile
*f
, SCSIRequest
*req
)
515 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
517 /* nothing to load, just store req in our state struct */
518 assert(s
->req
== NULL
);
524 static const struct SCSIBusInfo usb_msd_scsi_info
= {
529 .transfer_data
= usb_msd_transfer_data
,
530 .complete
= usb_msd_command_complete
,
531 .cancel
= usb_msd_request_cancelled
,
532 .load_request
= usb_msd_load_request
,
535 static int usb_msd_initfn(USBDevice
*dev
)
537 MSDState
*s
= DO_UPCAST(MSDState
, dev
, dev
);
538 BlockDriverState
*bs
= s
->conf
.bs
;
541 error_report("drive property not set");
545 blkconf_serial(&s
->conf
, &s
->serial
);
548 * Hack alert: this pretends to be a block device, but it's really
549 * a SCSI bus that can serve only a single device, which it
550 * creates automatically. But first it needs to detach from its
551 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
554 * The hack is probably a bad idea.
556 bdrv_detach_dev(bs
, &s
->dev
.qdev
);
560 usb_desc_set_string(dev
, STR_SERIALNUMBER
, s
->serial
);
562 usb_desc_create_serial(dev
);
566 scsi_bus_new(&s
->bus
, &s
->dev
.qdev
, &usb_msd_scsi_info
);
567 s
->scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, bs
, 0, !!s
->removable
,
572 s
->bus
.qbus
.allow_hotplug
= 0;
573 usb_msd_handle_reset(dev
);
575 if (bdrv_key_required(bs
)) {
577 monitor_read_bdrv_key_start(cur_mon
, bs
, usb_msd_password_cb
, s
);
578 s
->dev
.auto_attach
= 0;
587 static USBDevice
*usb_msd_init(USBBus
*bus
, const char *filename
)
597 /* parse -usbdevice disk: syntax into drive opts */
598 snprintf(id
, sizeof(id
), "usb%d", nr
++);
599 opts
= qemu_opts_create(qemu_find_opts("drive"), id
, 0, NULL
);
601 p1
= strchr(filename
, ':');
605 if (strstart(filename
, "format=", &p2
)) {
606 int len
= MIN(p1
- p2
, sizeof(fmt
));
607 pstrcpy(fmt
, len
, p2
);
608 qemu_opt_set(opts
, "format", fmt
);
609 } else if (*filename
!= ':') {
610 printf("unrecognized USB mass-storage option %s\n", filename
);
616 printf("block device specification needed\n");
619 qemu_opt_set(opts
, "file", filename
);
620 qemu_opt_set(opts
, "if", "none");
622 /* create host drive */
623 dinfo
= drive_init(opts
, 0);
629 /* create guest device */
630 dev
= usb_create(bus
, "usb-storage");
634 if (qdev_prop_set_drive(&dev
->qdev
, "drive", dinfo
->bdrv
) < 0) {
635 qdev_free(&dev
->qdev
);
638 if (qdev_init(&dev
->qdev
) < 0)
644 static const VMStateDescription vmstate_usb_msd
= {
645 .name
= "usb-storage",
647 .minimum_version_id
= 1,
648 .fields
= (VMStateField
[]) {
649 VMSTATE_USB_DEVICE(dev
, MSDState
),
650 VMSTATE_UINT32(mode
, MSDState
),
651 VMSTATE_UINT32(scsi_len
, MSDState
),
652 VMSTATE_UINT32(scsi_off
, MSDState
),
653 VMSTATE_UINT32(data_len
, MSDState
),
654 VMSTATE_UINT32(csw
.sig
, MSDState
),
655 VMSTATE_UINT32(csw
.tag
, MSDState
),
656 VMSTATE_UINT32(csw
.residue
, MSDState
),
657 VMSTATE_UINT8(csw
.status
, MSDState
),
658 VMSTATE_END_OF_LIST()
662 static Property msd_properties
[] = {
663 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
664 DEFINE_PROP_STRING("serial", MSDState
, serial
),
665 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
666 DEFINE_PROP_END_OF_LIST(),
669 static void usb_msd_class_initfn(ObjectClass
*klass
, void *data
)
671 DeviceClass
*dc
= DEVICE_CLASS(klass
);
672 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
674 uc
->init
= usb_msd_initfn
;
675 uc
->product_desc
= "QEMU USB MSD";
676 uc
->usb_desc
= &desc
;
677 uc
->cancel_packet
= usb_msd_cancel_io
;
678 uc
->handle_attach
= usb_desc_attach
;
679 uc
->handle_reset
= usb_msd_handle_reset
;
680 uc
->handle_control
= usb_msd_handle_control
;
681 uc
->handle_data
= usb_msd_handle_data
;
682 dc
->fw_name
= "storage";
683 dc
->vmsd
= &vmstate_usb_msd
;
684 dc
->props
= msd_properties
;
687 static TypeInfo msd_info
= {
688 .name
= "usb-storage",
689 .parent
= TYPE_USB_DEVICE
,
690 .instance_size
= sizeof(MSDState
),
691 .class_init
= usb_msd_class_initfn
,
694 static void usb_msd_register_types(void)
696 type_register_static(&msd_info
);
697 usb_legacy_register("usb-storage", "disk", usb_msd_init
);
700 type_init(usb_msd_register_types
)