hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "qemu-common.h"
  11 #include "qemu-option.h"
  12 #include "qemu-config.h"
  13 #include "usb.h"
  14 #include "usb-desc.h"
  15 #include "scsi.h"
  16 #include "console.h"
  17 #include "monitor.h"
  18 #include "sysemu.h"
  19 #include "blockdev.h"
  20
  21 //#define DEBUG_MSD
  22
  23 #ifdef DEBUG_MSD
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
  26 #else
  27 #define DPRINTF(fmt, ...) do {} while(0)
  28 #endif
  29
  30 /* USB requests.  */
  31 #define MassStorageReset  0xff
  32 #define GetMaxLun         0xfe
  33
  34 enum USBMSDMode {
  35     USB_MSDM_CBW, /* Command Block.  */
  36     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  37     USB_MSDM_DATAIN, /* Transfer data from device.  */
  38     USB_MSDM_CSW /* Command Status.  */
  39 };
  40
  41 typedef struct {
  42     USBDevice dev;
  43     enum USBMSDMode mode;
  44     uint32_t scsi_len;
  45     uint8_t *scsi_buf;
  46     uint32_t usb_len;
  47     uint8_t *usb_buf;
  48     uint32_t data_len;
  49     uint32_t residue;
  50     uint32_t tag;
  51     SCSIBus bus;
  52     BlockConf conf;
  53     SCSIDevice *scsi_dev;
  54     int result;
  55     /* For async completion.  */
  56     USBPacket *packet;
  57 } MSDState;
  58
  59 struct usb_msd_cbw {
  60     uint32_t sig;
  61     uint32_t tag;
  62     uint32_t data_len;
  63     uint8_t flags;
  64     uint8_t lun;
  65     uint8_t cmd_len;
  66     uint8_t cmd[16];
  67 };
  68
  69 struct usb_msd_csw {
  70     uint32_t sig;
  71     uint32_t tag;
  72     uint32_t residue;
  73     uint8_t status;
  74 };
  75
  76 enum {
  77     STR_MANUFACTURER = 1,
  78     STR_PRODUCT,
  79     STR_SERIALNUMBER,
  80     STR_CONFIG_FULL,
  81     STR_CONFIG_HIGH,
  82 };
  83
  84 static const USBDescStrings desc_strings = {
  85     [STR_MANUFACTURER] = "QEMU " QEMU_VERSION,
  86     [STR_PRODUCT]      = "QEMU USB HARDDRIVE",
  87     [STR_SERIALNUMBER] = "1",
  88     [STR_CONFIG_FULL]  = "Full speed config (usb 1.1)",
  89     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
  90 };
  91
  92 static const USBDescIface desc_iface_full = {
  93     .bInterfaceNumber              = 0,
  94     .bNumEndpoints                 = 2,
  95     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
  96     .bInterfaceSubClass            = 0x06, /* SCSI */
  97     .bInterfaceProtocol            = 0x50, /* Bulk */
  98     .eps = (USBDescEndpoint[]) {
  99         {
 100             .bEndpointAddress      = USB_DIR_IN | 0x01,
 101             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 102             .wMaxPacketSize        = 64,
 103         },{
 104             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 105             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 106             .wMaxPacketSize        = 64,
 107         },
 108     }
 109 };
 110
 111 static const USBDescDevice desc_device_full = {
 112     .bcdUSB                        = 0x0200,
 113     .bMaxPacketSize0               = 8,
 114     .bNumConfigurations            = 1,
 115     .confs = (USBDescConfig[]) {
 116         {
 117             .bNumInterfaces        = 1,
 118             .bConfigurationValue   = 1,
 119             .iConfiguration        = STR_CONFIG_FULL,
 120             .bmAttributes          = 0xc0,
 121             .ifs = &desc_iface_full,
 122         },
 123     },
 124 };
 125
 126 static const USBDescIface desc_iface_high = {
 127     .bInterfaceNumber              = 0,
 128     .bNumEndpoints                 = 2,
 129     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 130     .bInterfaceSubClass            = 0x06, /* SCSI */
 131     .bInterfaceProtocol            = 0x50, /* Bulk */
 132     .eps = (USBDescEndpoint[]) {
 133         {
 134             .bEndpointAddress      = USB_DIR_IN | 0x01,
 135             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 136             .wMaxPacketSize        = 512,
 137         },{
 138             .bEndpointAddress      = USB_DIR_OUT | 0x02,
 139             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 140             .wMaxPacketSize        = 512,
 141         },
 142     }
 143 };
 144
 145 static const USBDescDevice desc_device_high = {
 146     .bcdUSB                        = 0x0200,
 147     .bMaxPacketSize0               = 64,
 148     .bNumConfigurations            = 1,
 149     .confs = (USBDescConfig[]) {
 150         {
 151             .bNumInterfaces        = 1,
 152             .bConfigurationValue   = 1,
 153             .iConfiguration        = STR_CONFIG_HIGH,
 154             .bmAttributes          = 0xc0,
 155             .ifs = &desc_iface_high,
 156         },
 157     },
 158 };
 159
 160 static const USBDesc desc = {
 161     .id = {
 162         .idVendor          = 0,
 163         .idProduct         = 0,
 164         .bcdDevice         = 0,
 165         .iManufacturer     = STR_MANUFACTURER,
 166         .iProduct          = STR_PRODUCT,
 167         .iSerialNumber     = STR_SERIALNUMBER,
 168     },
 169     .full = &desc_device_full,
 170     .high = &desc_device_high,
 171     .str  = desc_strings,
 172 };
 173
 174 static void usb_msd_copy_data(MSDState *s)
 175 {
 176     uint32_t len;
 177     len = s->usb_len;
 178     if (len > s->scsi_len)
 179         len = s->scsi_len;
 180     if (s->mode == USB_MSDM_DATAIN) {
 181         memcpy(s->usb_buf, s->scsi_buf, len);
 182     } else {
 183         memcpy(s->scsi_buf, s->usb_buf, len);
 184     }
 185     s->usb_len -= len;
 186     s->scsi_len -= len;
 187     s->usb_buf += len;
 188     s->scsi_buf += len;
 189     s->data_len -= len;
 190     if (s->scsi_len == 0) {
 191         if (s->mode == USB_MSDM_DATAIN) {
 192             s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 193         } else if (s->mode == USB_MSDM_DATAOUT) {
 194             s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 195         }
 196     }
 197 }
 198
 199 static void usb_msd_send_status(MSDState *s)
 200 {
 201     struct usb_msd_csw csw;
 202
 203     csw.sig = cpu_to_le32(0x53425355);
 204     csw.tag = cpu_to_le32(s->tag);
 205     csw.residue = s->residue;
 206     csw.status = s->result;
 207     memcpy(s->usb_buf, &csw, 13);
 208 }
 209
 210 static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 211                                      uint32_t arg)
 212 {
 213     MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
 214     USBPacket *p = s->packet;
 215
 216     if (tag != s->tag) {
 217         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
 218     }
 219     if (reason == SCSI_REASON_DONE) {
 220         DPRINTF("Command complete %d\n", arg);
 221         s->residue = s->data_len;
 222         s->result = arg != 0;
 223         if (s->packet) {
 224             if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
 225                 /* A deferred packet with no write data remaining must be
 226                    the status read packet.  */
 227                 usb_msd_send_status(s);
 228                 s->mode = USB_MSDM_CBW;
 229             } else {
 230                 if (s->data_len) {
 231                     s->data_len -= s->usb_len;
 232                     if (s->mode == USB_MSDM_DATAIN)
 233                         memset(s->usb_buf, 0, s->usb_len);
 234                     s->usb_len = 0;
 235                 }
 236                 if (s->data_len == 0)
 237                     s->mode = USB_MSDM_CSW;
 238             }
 239             s->packet = NULL;
 240             usb_packet_complete(p);
 241         } else if (s->data_len == 0) {
 242             s->mode = USB_MSDM_CSW;
 243         }
 244         return;
 245     }
 246     s->scsi_len = arg;
 247     s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
 248     if (p) {
 249         usb_msd_copy_data(s);
 250         if (s->usb_len == 0) {
 251             /* Set s->packet to NULL before calling usb_packet_complete
 252                because annother request may be issued before
 253                usb_packet_complete returns.  */
 254             DPRINTF("Packet complete %p\n", p);
 255             s->packet = NULL;
 256             usb_packet_complete(p);
 257         }
 258     }
 259 }
 260
 261 static void usb_msd_handle_reset(USBDevice *dev)
 262 {
 263     MSDState *s = (MSDState *)dev;
 264
 265     DPRINTF("Reset\n");
 266     s->mode = USB_MSDM_CBW;
 267 }
 268
 269 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 270                                   int index, int length, uint8_t *data)
 271 {
 272     MSDState *s = (MSDState *)dev;
 273     int ret;
 274
 275     ret = usb_desc_handle_control(dev, request, value, index, length, data);
 276     if (ret >= 0) {
 277         return ret;
 278     }
 279
 280     ret = 0;
 281     switch (request) {
 282     case DeviceRequest | USB_REQ_GET_INTERFACE:
 283         data[0] = 0;
 284         ret = 1;
 285         break;
 286     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 287         ret = 0;
 288         break;
 289     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 290         ret = 0;
 291         break;
 292     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
 293         ret = 0;
 294         break;
 295         /* Class specific requests.  */
 296     case ClassInterfaceOutRequest | MassStorageReset:
 297         /* Reset state ready for the next CBW.  */
 298         s->mode = USB_MSDM_CBW;
 299         ret = 0;
 300         break;
 301     case ClassInterfaceRequest | GetMaxLun:
 302         data[0] = 0;
 303         ret = 1;
 304         break;
 305     default:
 306         ret = USB_RET_STALL;
 307         break;
 308     }
 309     return ret;
 310 }
 311
 312 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 313 {
 314     MSDState *s = opaque;
 315     s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
 316     s->packet = NULL;
 317     s->scsi_len = 0;
 318 }
 319
 320 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 321 {
 322     MSDState *s = (MSDState *)dev;
 323     int ret = 0;
 324     struct usb_msd_cbw cbw;
 325     uint8_t devep = p->devep;
 326     uint8_t *data = p->data;
 327     int len = p->len;
 328
 329     switch (p->pid) {
 330     case USB_TOKEN_OUT:
 331         if (devep != 2)
 332             goto fail;
 333
 334         switch (s->mode) {
 335         case USB_MSDM_CBW:
 336             if (len != 31) {
 337                 fprintf(stderr, "usb-msd: Bad CBW size");
 338                 goto fail;
 339             }
 340             memcpy(&cbw, data, 31);
 341             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 342                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 343                         le32_to_cpu(cbw.sig));
 344                 goto fail;
 345             }
 346             DPRINTF("Command on LUN %d\n", cbw.lun);
 347             if (cbw.lun != 0) {
 348                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 349                 goto fail;
 350             }
 351             s->tag = le32_to_cpu(cbw.tag);
 352             s->data_len = le32_to_cpu(cbw.data_len);
 353             if (s->data_len == 0) {
 354                 s->mode = USB_MSDM_CSW;
 355             } else if (cbw.flags & 0x80) {
 356                 s->mode = USB_MSDM_DATAIN;
 357             } else {
 358                 s->mode = USB_MSDM_DATAOUT;
 359             }
 360             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 361                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 362             s->residue = 0;
 363             s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 364             /* ??? Should check that USB and SCSI data transfer
 365                directions match.  */
 366             if (s->residue == 0) {
 367                 if (s->mode == USB_MSDM_DATAIN) {
 368                     s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
 369                 } else if (s->mode == USB_MSDM_DATAOUT) {
 370                     s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
 371                 }
 372             }
 373             ret = len;
 374             break;
 375
 376         case USB_MSDM_DATAOUT:
 377             DPRINTF("Data out %d/%d\n", len, s->data_len);
 378             if (len > s->data_len)
 379                 goto fail;
 380
 381             s->usb_buf = data;
 382             s->usb_len = len;
 383             if (s->scsi_len) {
 384                 usb_msd_copy_data(s);
 385             }
 386             if (s->residue && s->usb_len) {
 387                 s->data_len -= s->usb_len;
 388                 if (s->data_len == 0)
 389                     s->mode = USB_MSDM_CSW;
 390                 s->usb_len = 0;
 391             }
 392             if (s->usb_len) {
 393                 DPRINTF("Deferring packet %p\n", p);
 394                 usb_defer_packet(p, usb_msd_cancel_io, s);
 395                 s->packet = p;
 396                 ret = USB_RET_ASYNC;
 397             } else {
 398                 ret = len;
 399             }
 400             break;
 401
 402         default:
 403             DPRINTF("Unexpected write (len %d)\n", len);
 404             goto fail;
 405         }
 406         break;
 407
 408     case USB_TOKEN_IN:
 409         if (devep != 1)
 410             goto fail;
 411
 412         switch (s->mode) {
 413         case USB_MSDM_DATAOUT:
 414             if (s->data_len != 0 || len < 13)
 415                 goto fail;
 416             /* Waiting for SCSI write to complete.  */
 417             usb_defer_packet(p, usb_msd_cancel_io, s);
 418             s->packet = p;
 419             ret = USB_RET_ASYNC;
 420             break;
 421
 422         case USB_MSDM_CSW:
 423             DPRINTF("Command status %d tag 0x%x, len %d\n",
 424                     s->result, s->tag, len);
 425             if (len < 13)
 426                 goto fail;
 427
 428             s->usb_len = len;
 429             s->usb_buf = data;
 430             usb_msd_send_status(s);
 431             s->mode = USB_MSDM_CBW;
 432             ret = 13;
 433             break;
 434
 435         case USB_MSDM_DATAIN:
 436             DPRINTF("Data in %d/%d\n", len, s->data_len);
 437             if (len > s->data_len)
 438                 len = s->data_len;
 439             s->usb_buf = data;
 440             s->usb_len = len;
 441             if (s->scsi_len) {
 442                 usb_msd_copy_data(s);
 443             }
 444             if (s->residue && s->usb_len) {
 445                 s->data_len -= s->usb_len;
 446                 memset(s->usb_buf, 0, s->usb_len);
 447                 if (s->data_len == 0)
 448                     s->mode = USB_MSDM_CSW;
 449                 s->usb_len = 0;
 450             }
 451             if (s->usb_len) {
 452                 DPRINTF("Deferring packet %p\n", p);
 453                 usb_defer_packet(p, usb_msd_cancel_io, s);
 454                 s->packet = p;
 455                 ret = USB_RET_ASYNC;
 456             } else {
 457                 ret = len;
 458             }
 459             break;
 460
 461         default:
 462             DPRINTF("Unexpected read (len %d)\n", len);
 463             goto fail;
 464         }
 465         break;
 466
 467     default:
 468         DPRINTF("Bad token\n");
 469     fail:
 470         ret = USB_RET_STALL;
 471         break;
 472     }
 473
 474     return ret;
 475 }
 476
 477 static void usb_msd_password_cb(void *opaque, int err)
 478 {
 479     MSDState *s = opaque;
 480
 481     if (!err)
 482         usb_device_attach(&s->dev);
 483     else
 484         qdev_unplug(&s->dev.qdev);
 485 }
 486
 487 static int usb_msd_initfn(USBDevice *dev)
 488 {
 489     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 490     BlockDriverState *bs = s->conf.bs;
 491     DriveInfo *dinfo;
 492
 493     if (!bs) {
 494         error_report("usb-msd: drive property not set");
 495         return -1;
 496     }
 497
 498     /*
 499      * Hack alert: this pretends to be a block device, but it's really
 500      * a SCSI bus that can serve only a single device, which it
 501      * creates automatically.  But first it needs to detach from its
 502      * blockdev, or else scsi_bus_legacy_add_drive() dies when it
 503      * attaches again.
 504      *
 505      * The hack is probably a bad idea.
 506      */
 507     bdrv_detach(bs, &s->dev.qdev);
 508     s->conf.bs = NULL;
 509
 510     dinfo = drive_get_by_blockdev(bs);
 511     if (dinfo && dinfo->serial) {
 512         usb_desc_set_string(dev, STR_SERIALNUMBER, dinfo->serial);
 513     }
 514
 515     usb_desc_init(dev);
 516     scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
 517     s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
 518     if (!s->scsi_dev) {
 519         return -1;
 520     }
 521     s->bus.qbus.allow_hotplug = 0;
 522     usb_msd_handle_reset(dev);
 523
 524     if (bdrv_key_required(bs)) {
 525         if (cur_mon) {
 526             monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
 527             s->dev.auto_attach = 0;
 528         } else {
 529             autostart = 0;
 530         }
 531     }
 532
 533     return 0;
 534 }
 535
 536 static USBDevice *usb_msd_init(const char *filename)
 537 {
 538     static int nr=0;
 539     char id[8];
 540     QemuOpts *opts;
 541     DriveInfo *dinfo;
 542     USBDevice *dev;
 543     int fatal_error;
 544     const char *p1;
 545     char fmt[32];
 546
 547     /* parse -usbdevice disk: syntax into drive opts */
 548     snprintf(id, sizeof(id), "usb%d", nr++);
 549     opts = qemu_opts_create(qemu_find_opts("drive"), id, 0);
 550
 551     p1 = strchr(filename, ':');
 552     if (p1++) {
 553         const char *p2;
 554
 555         if (strstart(filename, "format=", &p2)) {
 556             int len = MIN(p1 - p2, sizeof(fmt));
 557             pstrcpy(fmt, len, p2);
 558             qemu_opt_set(opts, "format", fmt);
 559         } else if (*filename != ':') {
 560             printf("unrecognized USB mass-storage option %s\n", filename);
 561             return NULL;
 562         }
 563         filename = p1;
 564     }
 565     if (!*filename) {
 566         printf("block device specification needed\n");
 567         return NULL;
 568     }
 569     qemu_opt_set(opts, "file", filename);
 570     qemu_opt_set(opts, "if", "none");
 571
 572     /* create host drive */
 573     dinfo = drive_init(opts, 0, &fatal_error);
 574     if (!dinfo) {
 575         qemu_opts_del(opts);
 576         return NULL;
 577     }
 578
 579     /* create guest device */
 580     dev = usb_create(NULL /* FIXME */, "usb-storage");
 581     if (!dev) {
 582         return NULL;
 583     }
 584     if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
 585         qdev_free(&dev->qdev);
 586         return NULL;
 587     }
 588     if (qdev_init(&dev->qdev) < 0)
 589         return NULL;
 590
 591     return dev;
 592 }
 593
 594 static struct USBDeviceInfo msd_info = {
 595     .product_desc   = "QEMU USB MSD",
 596     .qdev.name      = "usb-storage",
 597     .qdev.size      = sizeof(MSDState),
 598     .usb_desc       = &desc,
 599     .init           = usb_msd_initfn,
 600     .handle_packet  = usb_generic_handle_packet,
 601     .handle_attach  = usb_desc_attach,
 602     .handle_reset   = usb_msd_handle_reset,
 603     .handle_control = usb_msd_handle_control,
 604     .handle_data    = usb_msd_handle_data,
 605     .usbdevice_name = "disk",
 606     .usbdevice_init = usb_msd_init,
 607     .qdev.props     = (Property[]) {
 608         DEFINE_BLOCK_PROPERTIES(MSDState, conf),
 609         DEFINE_PROP_END_OF_LIST(),
 610     },
 611 };
 612
 613 static void usb_msd_register_devices(void)
 614 {
 615     usb_qdev_register(&msd_info);
 616 }
 617 device_init(usb_msd_register_devices)