2 * USB Mass Storage Device emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
10 #include "qemu/osdep.h"
11 #include "qapi/error.h"
12 #include "qemu-common.h"
13 #include "qemu/error-report.h"
14 #include "qemu/option.h"
15 #include "qemu/config-file.h"
18 #include "hw/scsi/scsi.h"
19 #include "ui/console.h"
20 #include "monitor/monitor.h"
21 #include "sysemu/sysemu.h"
22 #include "sysemu/block-backend.h"
23 #include "qapi/visitor.h"
24 #include "qemu/cutils.h"
29 #define DPRINTF(fmt, ...) \
30 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
32 #define DPRINTF(fmt, ...) do {} while(0)
36 #define MassStorageReset 0xff
37 #define GetMaxLun 0xfe
40 USB_MSDM_CBW
, /* Command Block. */
41 USB_MSDM_DATAOUT
, /* Transfer data to device. */
42 USB_MSDM_DATAIN
, /* Transfer data from device. */
43 USB_MSDM_CSW
/* Command Status. */
59 struct usb_msd_csw csw
;
62 /* For async completion. */
64 /* usb-storage only */
70 #define TYPE_USB_STORAGE "usb-storage-dev"
71 #define USB_STORAGE_DEV(obj) OBJECT_CHECK(MSDState, (obj), TYPE_USB_STORAGE)
92 static const USBDescStrings desc_strings
= {
93 [STR_MANUFACTURER
] = "QEMU",
94 [STR_PRODUCT
] = "QEMU USB HARDDRIVE",
95 [STR_SERIALNUMBER
] = "1",
96 [STR_CONFIG_FULL
] = "Full speed config (usb 1.1)",
97 [STR_CONFIG_HIGH
] = "High speed config (usb 2.0)",
98 [STR_CONFIG_SUPER
] = "Super speed config (usb 3.0)",
101 static const USBDescIface desc_iface_full
= {
102 .bInterfaceNumber
= 0,
104 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
105 .bInterfaceSubClass
= 0x06, /* SCSI */
106 .bInterfaceProtocol
= 0x50, /* Bulk */
107 .eps
= (USBDescEndpoint
[]) {
109 .bEndpointAddress
= USB_DIR_IN
| 0x01,
110 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
111 .wMaxPacketSize
= 64,
113 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
114 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
115 .wMaxPacketSize
= 64,
120 static const USBDescDevice desc_device_full
= {
122 .bMaxPacketSize0
= 8,
123 .bNumConfigurations
= 1,
124 .confs
= (USBDescConfig
[]) {
127 .bConfigurationValue
= 1,
128 .iConfiguration
= STR_CONFIG_FULL
,
129 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
131 .ifs
= &desc_iface_full
,
136 static const USBDescIface desc_iface_high
= {
137 .bInterfaceNumber
= 0,
139 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
140 .bInterfaceSubClass
= 0x06, /* SCSI */
141 .bInterfaceProtocol
= 0x50, /* Bulk */
142 .eps
= (USBDescEndpoint
[]) {
144 .bEndpointAddress
= USB_DIR_IN
| 0x01,
145 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
146 .wMaxPacketSize
= 512,
148 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
149 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
150 .wMaxPacketSize
= 512,
155 static const USBDescDevice desc_device_high
= {
157 .bMaxPacketSize0
= 64,
158 .bNumConfigurations
= 1,
159 .confs
= (USBDescConfig
[]) {
162 .bConfigurationValue
= 1,
163 .iConfiguration
= STR_CONFIG_HIGH
,
164 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
166 .ifs
= &desc_iface_high
,
171 static const USBDescIface desc_iface_super
= {
172 .bInterfaceNumber
= 0,
174 .bInterfaceClass
= USB_CLASS_MASS_STORAGE
,
175 .bInterfaceSubClass
= 0x06, /* SCSI */
176 .bInterfaceProtocol
= 0x50, /* Bulk */
177 .eps
= (USBDescEndpoint
[]) {
179 .bEndpointAddress
= USB_DIR_IN
| 0x01,
180 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
181 .wMaxPacketSize
= 1024,
184 .bEndpointAddress
= USB_DIR_OUT
| 0x02,
185 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
186 .wMaxPacketSize
= 1024,
192 static const USBDescDevice desc_device_super
= {
194 .bMaxPacketSize0
= 9,
195 .bNumConfigurations
= 1,
196 .confs
= (USBDescConfig
[]) {
199 .bConfigurationValue
= 1,
200 .iConfiguration
= STR_CONFIG_SUPER
,
201 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
,
203 .ifs
= &desc_iface_super
,
208 static const USBDesc desc
= {
210 .idVendor
= 0x46f4, /* CRC16() of "QEMU" */
213 .iManufacturer
= STR_MANUFACTURER
,
214 .iProduct
= STR_PRODUCT
,
215 .iSerialNumber
= STR_SERIALNUMBER
,
217 .full
= &desc_device_full
,
218 .high
= &desc_device_high
,
219 .super
= &desc_device_super
,
223 static void usb_msd_copy_data(MSDState
*s
, USBPacket
*p
)
226 len
= p
->iov
.size
- p
->actual_length
;
227 if (len
> s
->scsi_len
)
229 usb_packet_copy(p
, scsi_req_get_buf(s
->req
) + s
->scsi_off
, len
);
233 if (s
->scsi_len
== 0 || s
->data_len
== 0) {
234 scsi_req_continue(s
->req
);
238 static void usb_msd_send_status(MSDState
*s
, USBPacket
*p
)
242 DPRINTF("Command status %d tag 0x%x, len %zd\n",
243 s
->csw
.status
, le32_to_cpu(s
->csw
.tag
), p
->iov
.size
);
245 assert(s
->csw
.sig
== cpu_to_le32(0x53425355));
246 len
= MIN(sizeof(s
->csw
), p
->iov
.size
);
247 usb_packet_copy(p
, &s
->csw
, len
);
248 memset(&s
->csw
, 0, sizeof(s
->csw
));
251 static void usb_msd_packet_complete(MSDState
*s
)
253 USBPacket
*p
= s
->packet
;
255 /* Set s->packet to NULL before calling usb_packet_complete
256 because another request may be issued before
257 usb_packet_complete returns. */
258 DPRINTF("Packet complete %p\n", p
);
260 usb_packet_complete(&s
->dev
, p
);
263 static void usb_msd_transfer_data(SCSIRequest
*req
, uint32_t len
)
265 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
266 USBPacket
*p
= s
->packet
;
268 assert((s
->mode
== USB_MSDM_DATAOUT
) == (req
->cmd
.mode
== SCSI_XFER_TO_DEV
));
272 usb_msd_copy_data(s
, p
);
274 if (p
&& p
->actual_length
== p
->iov
.size
) {
275 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
276 usb_msd_packet_complete(s
);
281 static void usb_msd_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
283 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
284 USBPacket
*p
= s
->packet
;
286 DPRINTF("Command complete %d tag 0x%x\n", status
, req
->tag
);
288 s
->csw
.sig
= cpu_to_le32(0x53425355);
289 s
->csw
.tag
= cpu_to_le32(req
->tag
);
290 s
->csw
.residue
= cpu_to_le32(s
->data_len
);
291 s
->csw
.status
= status
!= 0;
294 if (s
->data_len
== 0 && s
->mode
== USB_MSDM_DATAOUT
) {
295 /* A deferred packet with no write data remaining must be
296 the status read packet. */
297 usb_msd_send_status(s
, p
);
298 s
->mode
= USB_MSDM_CBW
;
299 } else if (s
->mode
== USB_MSDM_CSW
) {
300 usb_msd_send_status(s
, p
);
301 s
->mode
= USB_MSDM_CBW
;
304 int len
= (p
->iov
.size
- p
->actual_length
);
305 usb_packet_skip(p
, len
);
308 if (s
->data_len
== 0) {
309 s
->mode
= USB_MSDM_CSW
;
312 p
->status
= USB_RET_SUCCESS
; /* Clear previous ASYNC status */
313 usb_msd_packet_complete(s
);
314 } else if (s
->data_len
== 0) {
315 s
->mode
= USB_MSDM_CSW
;
321 static void usb_msd_request_cancelled(SCSIRequest
*req
)
323 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
326 scsi_req_unref(s
->req
);
332 static void usb_msd_handle_reset(USBDevice
*dev
)
334 MSDState
*s
= (MSDState
*)dev
;
338 scsi_req_cancel(s
->req
);
340 assert(s
->req
== NULL
);
343 s
->packet
->status
= USB_RET_STALL
;
344 usb_msd_packet_complete(s
);
347 s
->mode
= USB_MSDM_CBW
;
350 static void usb_msd_handle_control(USBDevice
*dev
, USBPacket
*p
,
351 int request
, int value
, int index
, int length
, uint8_t *data
)
353 MSDState
*s
= (MSDState
*)dev
;
354 SCSIDevice
*scsi_dev
;
357 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
363 case EndpointOutRequest
| USB_REQ_CLEAR_FEATURE
:
365 /* Class specific requests. */
366 case ClassInterfaceOutRequest
| MassStorageReset
:
367 /* Reset state ready for the next CBW. */
368 s
->mode
= USB_MSDM_CBW
;
370 case ClassInterfaceRequest
| GetMaxLun
:
373 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, maxlun
+1);
374 if (scsi_dev
== NULL
) {
377 if (scsi_dev
->lun
!= maxlun
+1) {
382 DPRINTF("MaxLun %d\n", maxlun
);
384 p
->actual_length
= 1;
387 p
->status
= USB_RET_STALL
;
392 static void usb_msd_cancel_io(USBDevice
*dev
, USBPacket
*p
)
394 MSDState
*s
= USB_STORAGE_DEV(dev
);
396 assert(s
->packet
== p
);
400 scsi_req_cancel(s
->req
);
404 static void usb_msd_handle_data(USBDevice
*dev
, USBPacket
*p
)
406 MSDState
*s
= (MSDState
*)dev
;
408 struct usb_msd_cbw cbw
;
409 uint8_t devep
= p
->ep
->nr
;
410 SCSIDevice
*scsi_dev
;
420 if (p
->iov
.size
!= 31) {
421 error_report("usb-msd: Bad CBW size");
424 usb_packet_copy(p
, &cbw
, 31);
425 if (le32_to_cpu(cbw
.sig
) != 0x43425355) {
426 error_report("usb-msd: Bad signature %08x",
427 le32_to_cpu(cbw
.sig
));
430 DPRINTF("Command on LUN %d\n", cbw
.lun
);
431 scsi_dev
= scsi_device_find(&s
->bus
, 0, 0, cbw
.lun
);
432 if (scsi_dev
== NULL
) {
433 error_report("usb-msd: Bad LUN %d", cbw
.lun
);
436 tag
= le32_to_cpu(cbw
.tag
);
437 s
->data_len
= le32_to_cpu(cbw
.data_len
);
438 if (s
->data_len
== 0) {
439 s
->mode
= USB_MSDM_CSW
;
440 } else if (cbw
.flags
& 0x80) {
441 s
->mode
= USB_MSDM_DATAIN
;
443 s
->mode
= USB_MSDM_DATAOUT
;
445 DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
446 tag
, cbw
.flags
, cbw
.cmd_len
, s
->data_len
);
447 assert(le32_to_cpu(s
->csw
.residue
) == 0);
449 s
->req
= scsi_req_new(scsi_dev
, tag
, cbw
.lun
, cbw
.cmd
, NULL
);
451 scsi_req_print(s
->req
);
453 len
= scsi_req_enqueue(s
->req
);
455 scsi_req_continue(s
->req
);
459 case USB_MSDM_DATAOUT
:
460 DPRINTF("Data out %zd/%d\n", p
->iov
.size
, s
->data_len
);
461 if (p
->iov
.size
> s
->data_len
) {
466 usb_msd_copy_data(s
, p
);
468 if (le32_to_cpu(s
->csw
.residue
)) {
469 int len
= p
->iov
.size
- p
->actual_length
;
471 usb_packet_skip(p
, len
);
473 if (s
->data_len
== 0) {
474 s
->mode
= USB_MSDM_CSW
;
478 if (p
->actual_length
< p
->iov
.size
) {
479 DPRINTF("Deferring packet %p [wait data-out]\n", p
);
481 p
->status
= USB_RET_ASYNC
;
486 DPRINTF("Unexpected write (len %zd)\n", p
->iov
.size
);
496 case USB_MSDM_DATAOUT
:
497 if (s
->data_len
!= 0 || p
->iov
.size
< 13) {
500 /* Waiting for SCSI write to complete. */
502 p
->status
= USB_RET_ASYNC
;
506 if (p
->iov
.size
< 13) {
511 /* still in flight */
512 DPRINTF("Deferring packet %p [wait status]\n", p
);
514 p
->status
= USB_RET_ASYNC
;
516 usb_msd_send_status(s
, p
);
517 s
->mode
= USB_MSDM_CBW
;
521 case USB_MSDM_DATAIN
:
522 DPRINTF("Data in %zd/%d, scsi_len %d\n",
523 p
->iov
.size
, s
->data_len
, s
->scsi_len
);
525 usb_msd_copy_data(s
, p
);
527 if (le32_to_cpu(s
->csw
.residue
)) {
528 int len
= p
->iov
.size
- p
->actual_length
;
530 usb_packet_skip(p
, len
);
532 if (s
->data_len
== 0) {
533 s
->mode
= USB_MSDM_CSW
;
537 if (p
->actual_length
< p
->iov
.size
) {
538 DPRINTF("Deferring packet %p [wait data-in]\n", p
);
540 p
->status
= USB_RET_ASYNC
;
545 DPRINTF("Unexpected read (len %zd)\n", p
->iov
.size
);
551 DPRINTF("Bad token\n");
553 p
->status
= USB_RET_STALL
;
558 static void *usb_msd_load_request(QEMUFile
*f
, SCSIRequest
*req
)
560 MSDState
*s
= DO_UPCAST(MSDState
, dev
.qdev
, req
->bus
->qbus
.parent
);
562 /* nothing to load, just store req in our state struct */
563 assert(s
->req
== NULL
);
569 static const struct SCSIBusInfo usb_msd_scsi_info_storage
= {
574 .transfer_data
= usb_msd_transfer_data
,
575 .complete
= usb_msd_command_complete
,
576 .cancel
= usb_msd_request_cancelled
,
577 .load_request
= usb_msd_load_request
,
580 static const struct SCSIBusInfo usb_msd_scsi_info_bot
= {
585 .transfer_data
= usb_msd_transfer_data
,
586 .complete
= usb_msd_command_complete
,
587 .cancel
= usb_msd_request_cancelled
,
588 .load_request
= usb_msd_load_request
,
591 static void usb_msd_unrealize_storage(USBDevice
*dev
, Error
**errp
)
593 MSDState
*s
= USB_STORAGE_DEV(dev
);
595 object_unref(OBJECT(&s
->bus
));
598 static void usb_msd_storage_realize(USBDevice
*dev
, Error
**errp
)
600 MSDState
*s
= USB_STORAGE_DEV(dev
);
601 BlockBackend
*blk
= s
->conf
.blk
;
602 SCSIDevice
*scsi_dev
;
605 error_setg(errp
, "drive property not set");
609 blkconf_blocksizes(&s
->conf
);
610 if (!blkconf_apply_backend_options(&s
->conf
, blk_is_read_only(blk
), true,
616 * Hack alert: this pretends to be a block device, but it's really
617 * a SCSI bus that can serve only a single device, which it
618 * creates automatically. But first it needs to detach from its
619 * blockdev, or else scsi_bus_legacy_add_drive() dies when it
620 * attaches again. We also need to take another reference so that
621 * blk_detach_dev() doesn't free blk while we still need it.
623 * The hack is probably a bad idea.
626 blk_detach_dev(blk
, &s
->dev
.qdev
);
629 usb_desc_create_serial(dev
);
631 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
632 &usb_msd_scsi_info_storage
, NULL
);
633 scsi_dev
= scsi_bus_legacy_add_drive(&s
->bus
, blk
, 0, !!s
->removable
,
634 s
->conf
.bootindex
, s
->conf
.share_rw
,
641 usb_msd_handle_reset(dev
);
642 s
->scsi_dev
= scsi_dev
;
645 static void usb_msd_bot_unrealize(USBDevice
*dev
, Error
**errp
)
647 MSDState
*s
= USB_STORAGE_DEV(dev
);
649 object_unref(OBJECT(&s
->bus
));
652 static void usb_msd_bot_realize(USBDevice
*dev
, Error
**errp
)
654 MSDState
*s
= USB_STORAGE_DEV(dev
);
655 DeviceState
*d
= DEVICE(dev
);
657 usb_desc_create_serial(dev
);
660 s
->dev
.auto_attach
= 0;
663 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), DEVICE(dev
),
664 &usb_msd_scsi_info_bot
, NULL
);
665 usb_msd_handle_reset(dev
);
668 static const VMStateDescription vmstate_usb_msd
= {
669 .name
= "usb-storage",
671 .minimum_version_id
= 1,
672 .fields
= (VMStateField
[]) {
673 VMSTATE_USB_DEVICE(dev
, MSDState
),
674 VMSTATE_UINT32(mode
, MSDState
),
675 VMSTATE_UINT32(scsi_len
, MSDState
),
676 VMSTATE_UINT32(scsi_off
, MSDState
),
677 VMSTATE_UINT32(data_len
, MSDState
),
678 VMSTATE_UINT32(csw
.sig
, MSDState
),
679 VMSTATE_UINT32(csw
.tag
, MSDState
),
680 VMSTATE_UINT32(csw
.residue
, MSDState
),
681 VMSTATE_UINT8(csw
.status
, MSDState
),
682 VMSTATE_END_OF_LIST()
686 static Property msd_properties
[] = {
687 DEFINE_BLOCK_PROPERTIES(MSDState
, conf
),
688 DEFINE_PROP_BIT("removable", MSDState
, removable
, 0, false),
689 DEFINE_PROP_END_OF_LIST(),
692 static void usb_msd_class_initfn_common(ObjectClass
*klass
, void *data
)
694 DeviceClass
*dc
= DEVICE_CLASS(klass
);
695 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
697 uc
->product_desc
= "QEMU USB MSD";
698 uc
->usb_desc
= &desc
;
699 uc
->cancel_packet
= usb_msd_cancel_io
;
700 uc
->handle_attach
= usb_desc_attach
;
701 uc
->handle_reset
= usb_msd_handle_reset
;
702 uc
->handle_control
= usb_msd_handle_control
;
703 uc
->handle_data
= usb_msd_handle_data
;
704 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
705 dc
->fw_name
= "storage";
706 dc
->vmsd
= &vmstate_usb_msd
;
709 static void usb_msd_class_storage_initfn(ObjectClass
*klass
, void *data
)
711 DeviceClass
*dc
= DEVICE_CLASS(klass
);
712 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
714 uc
->realize
= usb_msd_storage_realize
;
715 uc
->unrealize
= usb_msd_unrealize_storage
;
716 dc
->props
= msd_properties
;
719 static void usb_msd_get_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
720 void *opaque
, Error
**errp
)
722 USBDevice
*dev
= USB_DEVICE(obj
);
723 MSDState
*s
= USB_STORAGE_DEV(dev
);
725 visit_type_int32(v
, name
, &s
->conf
.bootindex
, errp
);
728 static void usb_msd_set_bootindex(Object
*obj
, Visitor
*v
, const char *name
,
729 void *opaque
, Error
**errp
)
731 USBDevice
*dev
= USB_DEVICE(obj
);
732 MSDState
*s
= USB_STORAGE_DEV(dev
);
734 Error
*local_err
= NULL
;
736 visit_type_int32(v
, name
, &boot_index
, &local_err
);
740 /* check whether bootindex is present in fw_boot_order list */
741 check_boot_index(boot_index
, &local_err
);
745 /* change bootindex to a new one */
746 s
->conf
.bootindex
= boot_index
;
749 object_property_set_int(OBJECT(s
->scsi_dev
), boot_index
, "bootindex",
754 error_propagate(errp
, local_err
);
757 static const TypeInfo usb_storage_dev_type_info
= {
758 .name
= TYPE_USB_STORAGE
,
759 .parent
= TYPE_USB_DEVICE
,
760 .instance_size
= sizeof(MSDState
),
762 .class_init
= usb_msd_class_initfn_common
,
765 static void usb_msd_instance_init(Object
*obj
)
767 object_property_add(obj
, "bootindex", "int32",
768 usb_msd_get_bootindex
,
769 usb_msd_set_bootindex
, NULL
, NULL
, NULL
);
770 object_property_set_int(obj
, -1, "bootindex", NULL
);
773 static void usb_msd_class_bot_initfn(ObjectClass
*klass
, void *data
)
775 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
777 uc
->realize
= usb_msd_bot_realize
;
778 uc
->unrealize
= usb_msd_bot_unrealize
;
779 uc
->attached_settable
= true;
782 static const TypeInfo msd_info
= {
783 .name
= "usb-storage",
784 .parent
= TYPE_USB_STORAGE
,
785 .class_init
= usb_msd_class_storage_initfn
,
786 .instance_init
= usb_msd_instance_init
,
789 static const TypeInfo bot_info
= {
791 .parent
= TYPE_USB_STORAGE
,
792 .class_init
= usb_msd_class_bot_initfn
,
795 static void usb_msd_register_types(void)
797 type_register_static(&usb_storage_dev_type_info
);
798 type_register_static(&msd_info
);
799 type_register_static(&bot_info
);
802 type_init(usb_msd_register_types
)