hw/usb-msd.c

   1 /*
   2  * USB Mass Storage Device emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 #include "vl.h"
  11
  12 //#define DEBUG_MSD
  13
  14 #ifdef DEBUG_MSD
  15 #define DPRINTF(fmt, args...) \
  16 do { printf("usb-msd: " fmt , ##args); } while (0)
  17 #else
  18 #define DPRINTF(fmt, args...) do {} while(0)
  19 #endif
  20
  21 /* USB requests.  */
  22 #define MassStorageReset  0xff
  23 #define GetMaxLun         0xfe
  24
  25 enum USBMSDMode {
  26     USB_MSDM_CBW, /* Command Block.  */
  27     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
  28     USB_MSDM_DATAIN, /* Transfer data from device.  */
  29     USB_MSDM_CSW /* Command Status.  */
  30 };
  31
  32 typedef struct {
  33     USBDevice dev;
  34     enum USBMSDMode mode;
  35     uint32_t data_len;
  36     uint32_t transfer_len;
  37     uint32_t tag;
  38     BlockDriverState *bs;
  39     SCSIDevice *scsi_dev;
  40     int result;
  41     /* For async completion.  */
  42     USBPacket *packet;
  43 } MSDState;
  44
  45 static const uint8_t qemu_msd_dev_descriptor[] = {
  46         0x12,       /*  u8 bLength; */
  47         0x01,       /*  u8 bDescriptorType; Device */
  48         0x10, 0x00, /*  u16 bcdUSB; v1.0 */
  49
  50         0x00,       /*  u8  bDeviceClass; */
  51         0x00,       /*  u8  bDeviceSubClass; */
  52         0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
  53         0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
  54
  55         /* Vendor and product id are arbitrary.  */
  56         0x00, 0x00, /*  u16 idVendor; */
  57         0x00, 0x00, /*  u16 idProduct; */
  58         0x00, 0x00, /*  u16 bcdDevice */
  59
  60         0x01,       /*  u8  iManufacturer; */
  61         0x02,       /*  u8  iProduct; */
  62         0x03,       /*  u8  iSerialNumber; */
  63         0x01        /*  u8  bNumConfigurations; */
  64 };
  65
  66 static const uint8_t qemu_msd_config_descriptor[] = {
  67
  68         /* one configuration */
  69         0x09,       /*  u8  bLength; */
  70         0x02,       /*  u8  bDescriptorType; Configuration */
  71         0x20, 0x00, /*  u16 wTotalLength; */
  72         0x01,       /*  u8  bNumInterfaces; (1) */
  73         0x01,       /*  u8  bConfigurationValue; */
  74         0x00,       /*  u8  iConfiguration; */
  75         0xc0,       /*  u8  bmAttributes;
  76                                  Bit 7: must be set,
  77                                      6: Self-powered,
  78                                      5: Remote wakeup,
  79                                      4..0: resvd */
  80         0x00,       /*  u8  MaxPower; */
  81
  82         /* one interface */
  83         0x09,       /*  u8  if_bLength; */
  84         0x04,       /*  u8  if_bDescriptorType; Interface */
  85         0x00,       /*  u8  if_bInterfaceNumber; */
  86         0x00,       /*  u8  if_bAlternateSetting; */
  87         0x02,       /*  u8  if_bNumEndpoints; */
  88         0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
  89         0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
  90         0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
  91         0x00,       /*  u8  if_iInterface; */
  92
  93         /* Bulk-In endpoint */
  94         0x07,       /*  u8  ep_bLength; */
  95         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
  96         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
  97         0x02,       /*  u8  ep_bmAttributes; Bulk */
  98         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
  99         0x00,       /*  u8  ep_bInterval; */
 100
 101         /* Bulk-Out endpoint */
 102         0x07,       /*  u8  ep_bLength; */
 103         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 104         0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 105         0x02,       /*  u8  ep_bmAttributes; Bulk */
 106         0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
 107         0x00        /*  u8  ep_bInterval; */
 108 };
 109
 110 static void usb_msd_command_complete(void *opaque, uint32_t reason, int fail)
 111 {
 112     MSDState *s = (MSDState *)opaque;
 113     USBPacket *p;
 114
 115     s->data_len -= s->transfer_len;
 116     s->transfer_len = 0;
 117     if (reason == SCSI_REASON_DONE) {
 118         DPRINTF("Command complete %d\n", fail);
 119         s->result = fail;
 120         s->mode = USB_MSDM_CSW;
 121     }
 122     if (s->packet) {
 123         /* Set s->packet to NULL before calling usb_packet_complete because
 124            annother request may be issues before usb_packet_complete returns.
 125          */
 126         DPRINTF("Packet complete %p\n", p);
 127         p = s->packet;
 128         s->packet = NULL;
 129         usb_packet_complete(p);
 130     }
 131 }
 132
 133 static void usb_msd_handle_reset(USBDevice *dev)
 134 {
 135     MSDState *s = (MSDState *)dev;
 136
 137     DPRINTF("Reset\n");
 138     s->mode = USB_MSDM_CBW;
 139 }
 140
 141 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
 142                                   int index, int length, uint8_t *data)
 143 {
 144     MSDState *s = (MSDState *)dev;
 145     int ret = 0;
 146
 147     switch (request) {
 148     case DeviceRequest | USB_REQ_GET_STATUS:
 149         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 150             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 151         data[1] = 0x00;
 152         ret = 2;
 153         break;
 154     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 155         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 156             dev->remote_wakeup = 0;
 157         } else {
 158             goto fail;
 159         }
 160         ret = 0;
 161         break;
 162     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 163         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 164             dev->remote_wakeup = 1;
 165         } else {
 166             goto fail;
 167         }
 168         ret = 0;
 169         break;
 170     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 171         dev->addr = value;
 172         ret = 0;
 173         break;
 174     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 175         switch(value >> 8) {
 176         case USB_DT_DEVICE:
 177             memcpy(data, qemu_msd_dev_descriptor,
 178                    sizeof(qemu_msd_dev_descriptor));
 179             ret = sizeof(qemu_msd_dev_descriptor);
 180             break;
 181         case USB_DT_CONFIG:
 182             memcpy(data, qemu_msd_config_descriptor,
 183                    sizeof(qemu_msd_config_descriptor));
 184             ret = sizeof(qemu_msd_config_descriptor);
 185             break;
 186         case USB_DT_STRING:
 187             switch(value & 0xff) {
 188             case 0:
 189                 /* language ids */
 190                 data[0] = 4;
 191                 data[1] = 3;
 192                 data[2] = 0x09;
 193                 data[3] = 0x04;
 194                 ret = 4;
 195                 break;
 196             case 1:
 197                 /* vendor description */
 198                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
 199                 break;
 200             case 2:
 201                 /* product description */
 202                 ret = set_usb_string(data, "QEMU USB HARDDRIVE");
 203                 break;
 204             case 3:
 205                 /* serial number */
 206                 ret = set_usb_string(data, "1");
 207                 break;
 208             default:
 209                 goto fail;
 210             }
 211             break;
 212         default:
 213             goto fail;
 214         }
 215         break;
 216     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 217         data[0] = 1;
 218         ret = 1;
 219         break;
 220     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 221         ret = 0;
 222         break;
 223     case DeviceRequest | USB_REQ_GET_INTERFACE:
 224         data[0] = 0;
 225         ret = 1;
 226         break;
 227     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 228         ret = 0;
 229         break;
 230     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 231         if (value == 0 && index != 0x81) { /* clear ep halt */
 232             goto fail;
 233         }
 234         ret = 0;
 235         break;
 236         /* Class specific requests.  */
 237     case MassStorageReset:
 238         /* Reset state ready for the next CBW.  */
 239         s->mode = USB_MSDM_CBW;
 240         ret = 0;
 241         break;
 242     case GetMaxLun:
 243         data[0] = 0;
 244         ret = 1;
 245         break;
 246     default:
 247     fail:
 248         ret = USB_RET_STALL;
 249         break;
 250     }
 251     return ret;
 252 }
 253
 254 struct usb_msd_cbw {
 255     uint32_t sig;
 256     uint32_t tag;
 257     uint32_t data_len;
 258     uint8_t flags;
 259     uint8_t lun;
 260     uint8_t cmd_len;
 261     uint8_t cmd[16];
 262 };
 263
 264 struct usb_msd_csw {
 265     uint32_t sig;
 266     uint32_t tag;
 267     uint32_t residue;
 268     uint8_t status;
 269 };
 270
 271 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
 272 {
 273     MSDState *s = opaque;
 274     scsi_cancel_io(s->scsi_dev);
 275     s->packet = NULL;
 276 }
 277
 278 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
 279 {
 280     MSDState *s = (MSDState *)dev;
 281     int ret = 0;
 282     struct usb_msd_cbw cbw;
 283     struct usb_msd_csw csw;
 284     uint8_t devep = p->devep;
 285     uint8_t *data = p->data;
 286     int len = p->len;
 287
 288     switch (p->pid) {
 289     case USB_TOKEN_OUT:
 290         if (devep != 2)
 291             goto fail;
 292
 293         switch (s->mode) {
 294         case USB_MSDM_CBW:
 295             if (len != 31) {
 296                 fprintf(stderr, "usb-msd: Bad CBW size");
 297                 goto fail;
 298             }
 299             memcpy(&cbw, data, 31);
 300             if (le32_to_cpu(cbw.sig) != 0x43425355) {
 301                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
 302                         le32_to_cpu(cbw.sig));
 303                 goto fail;
 304             }
 305             DPRINTF("Command on LUN %d\n", cbw.lun);
 306             if (cbw.lun != 0) {
 307                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
 308                 goto fail;
 309             }
 310             s->tag = le32_to_cpu(cbw.tag);
 311             s->data_len = le32_to_cpu(cbw.data_len);
 312             if (s->data_len == 0) {
 313                 s->mode = USB_MSDM_CSW;
 314             } else if (cbw.flags & 0x80) {
 315                 s->mode = USB_MSDM_DATAIN;
 316             } else {
 317                 s->mode = USB_MSDM_DATAOUT;
 318             }
 319             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
 320                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
 321             scsi_send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
 322             ret = len;
 323             break;
 324
 325         case USB_MSDM_DATAOUT:
 326             DPRINTF("Data out %d/%d\n", len, s->data_len);
 327             if (len > s->data_len)
 328                 goto fail;
 329
 330             s->transfer_len = len;
 331             if (scsi_write_data(s->scsi_dev, data, len))
 332                 goto fail;
 333
 334             if (s->transfer_len == 0) {
 335                 ret = len;
 336             } else {
 337                 DPRINTF("Deferring packet %p\n", p);
 338                 usb_defer_packet(p, usb_msd_cancel_io, s);
 339                 s->packet = p;
 340                 ret = USB_RET_ASYNC;
 341             }
 342             break;
 343
 344         default:
 345             DPRINTF("Unexpected write (len %d)\n", len);
 346             goto fail;
 347         }
 348         break;
 349
 350     case USB_TOKEN_IN:
 351         if (devep != 1)
 352             goto fail;
 353
 354         switch (s->mode) {
 355         case USB_MSDM_CSW:
 356             DPRINTF("Command status %d tag 0x%x, len %d\n",
 357                     s->result, s->tag, len);
 358             if (len < 13)
 359                 goto fail;
 360
 361             csw.sig = cpu_to_le32(0x53425355);
 362             csw.tag = cpu_to_le32(s->tag);
 363             csw.residue = 0;
 364             csw.status = s->result;
 365             memcpy(data, &csw, 13);
 366             ret = 13;
 367             s->mode = USB_MSDM_CBW;
 368             break;
 369
 370         case USB_MSDM_DATAIN:
 371             DPRINTF("Data in %d/%d\n", len, s->data_len);
 372             if (len > s->data_len)
 373                 len = s->data_len;
 374
 375             s->transfer_len = len;
 376             if (scsi_read_data(s->scsi_dev, data, len))
 377                 goto fail;
 378
 379             if (s->transfer_len == 0) {
 380                 ret = len;
 381             } else {
 382                 DPRINTF("Deferring packet %p\n", p);
 383                 usb_defer_packet(p, usb_msd_cancel_io, s);
 384                 s->packet = p;
 385                 ret = USB_RET_ASYNC;
 386             }
 387             break;
 388
 389         default:
 390             DPRINTF("Unexpected read (len %d)\n", len);
 391             goto fail;
 392         }
 393         break;
 394
 395     default:
 396         DPRINTF("Bad token\n");
 397     fail:
 398         ret = USB_RET_STALL;
 399         break;
 400     }
 401
 402     return ret;
 403 }
 404
 405 static void usb_msd_handle_destroy(USBDevice *dev)
 406 {
 407     MSDState *s = (MSDState *)dev;
 408
 409     scsi_disk_destroy(s->scsi_dev);
 410     bdrv_delete(s->bs);
 411     qemu_free(s);
 412 }
 413
 414 USBDevice *usb_msd_init(const char *filename)
 415 {
 416     MSDState *s;
 417     BlockDriverState *bdrv;
 418
 419     s = qemu_mallocz(sizeof(MSDState));
 420     if (!s)
 421         return NULL;
 422
 423     bdrv = bdrv_new("usb");
 424     if (bdrv_open(bdrv, filename, 0) < 0)
 425         goto fail;
 426     s->bs = bdrv;
 427
 428     s->dev.speed = USB_SPEED_FULL;
 429     s->dev.handle_packet = usb_generic_handle_packet;
 430
 431     s->dev.handle_reset = usb_msd_handle_reset;
 432     s->dev.handle_control = usb_msd_handle_control;
 433     s->dev.handle_data = usb_msd_handle_data;
 434     s->dev.handle_destroy = usb_msd_handle_destroy;
 435
 436     snprintf(s->dev.devname, sizeof(s->dev.devname), "QEMU USB MSD(%.16s)",
 437              filename);
 438
 439     s->scsi_dev = scsi_disk_init(bdrv, usb_msd_command_complete, s);
 440     usb_msd_handle_reset((USBDevice *)s);
 441     return (USBDevice *)s;
 442  fail:
 443     qemu_free(s);
 444     return NULL;
 445 }