• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * USB Mass Storage Device emulation
3  *
4  * Copyright (c) 2006 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licenced under the LGPL.
8  */
9 
10 #include "qemu-common.h"
11 #include "usb.h"
12 #include "block.h"
13 #include "scsi-disk.h"
14 #include "console.h"
15 
16 //#define DEBUG_MSD
17 
18 #ifdef DEBUG_MSD
19 #define DPRINTF(fmt, ...) \
20 do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
21 #else
22 #define DPRINTF(fmt, ...) do {} while(0)
23 #endif
24 
25 /* USB requests.  */
26 #define MassStorageReset  0xff
27 #define GetMaxLun         0xfe
28 
29 enum USBMSDMode {
30     USB_MSDM_CBW, /* Command Block.  */
31     USB_MSDM_DATAOUT, /* Tranfer data to device.  */
32     USB_MSDM_DATAIN, /* Transfer data from device.  */
33     USB_MSDM_CSW /* Command Status.  */
34 };
35 
36 typedef struct {
37     USBDevice dev;
38     enum USBMSDMode mode;
39     uint32_t scsi_len;
40     uint8_t *scsi_buf;
41     uint32_t usb_len;
42     uint8_t *usb_buf;
43     uint32_t data_len;
44     uint32_t residue;
45     uint32_t tag;
46     BlockDriverState *bs;
47     SCSIDevice *scsi_dev;
48     int result;
49     /* For async completion.  */
50     USBPacket *packet;
51 } MSDState;
52 
53 struct usb_msd_cbw {
54     uint32_t sig;
55     uint32_t tag;
56     uint32_t data_len;
57     uint8_t flags;
58     uint8_t lun;
59     uint8_t cmd_len;
60     uint8_t cmd[16];
61 };
62 
63 struct usb_msd_csw {
64     uint32_t sig;
65     uint32_t tag;
66     uint32_t residue;
67     uint8_t status;
68 };
69 
70 static const uint8_t qemu_msd_dev_descriptor[] = {
71 	0x12,       /*  u8 bLength; */
72 	0x01,       /*  u8 bDescriptorType; Device */
73 	0x00, 0x01, /*  u16 bcdUSB; v1.0 */
74 
75 	0x00,	    /*  u8  bDeviceClass; */
76 	0x00,	    /*  u8  bDeviceSubClass; */
77 	0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
78 	0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
79 
80         /* Vendor and product id are arbitrary.  */
81 	0x00, 0x00, /*  u16 idVendor; */
82  	0x00, 0x00, /*  u16 idProduct; */
83 	0x00, 0x00, /*  u16 bcdDevice */
84 
85 	0x01,       /*  u8  iManufacturer; */
86 	0x02,       /*  u8  iProduct; */
87 	0x03,       /*  u8  iSerialNumber; */
88 	0x01        /*  u8  bNumConfigurations; */
89 };
90 
91 static const uint8_t qemu_msd_config_descriptor[] = {
92 
93 	/* one configuration */
94 	0x09,       /*  u8  bLength; */
95 	0x02,       /*  u8  bDescriptorType; Configuration */
96 	0x20, 0x00, /*  u16 wTotalLength; */
97 	0x01,       /*  u8  bNumInterfaces; (1) */
98 	0x01,       /*  u8  bConfigurationValue; */
99 	0x00,       /*  u8  iConfiguration; */
100 	0xc0,       /*  u8  bmAttributes;
101 				 Bit 7: must be set,
102 				     6: Self-powered,
103 				     5: Remote wakeup,
104 				     4..0: resvd */
105 	0x00,       /*  u8  MaxPower; */
106 
107 	/* one interface */
108 	0x09,       /*  u8  if_bLength; */
109 	0x04,       /*  u8  if_bDescriptorType; Interface */
110 	0x00,       /*  u8  if_bInterfaceNumber; */
111 	0x00,       /*  u8  if_bAlternateSetting; */
112 	0x02,       /*  u8  if_bNumEndpoints; */
113 	0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
114 	0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
115 	0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
116 	0x00,       /*  u8  if_iInterface; */
117 
118 	/* Bulk-In endpoint */
119 	0x07,       /*  u8  ep_bLength; */
120 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
121 	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
122  	0x02,       /*  u8  ep_bmAttributes; Bulk */
123  	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
124 	0x00,       /*  u8  ep_bInterval; */
125 
126 	/* Bulk-Out endpoint */
127 	0x07,       /*  u8  ep_bLength; */
128 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
129 	0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
130  	0x02,       /*  u8  ep_bmAttributes; Bulk */
131  	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
132 	0x00        /*  u8  ep_bInterval; */
133 };
134 
usb_msd_copy_data(MSDState * s)135 static void usb_msd_copy_data(MSDState *s)
136 {
137     uint32_t len;
138     len = s->usb_len;
139     if (len > s->scsi_len)
140         len = s->scsi_len;
141     if (s->mode == USB_MSDM_DATAIN) {
142         memcpy(s->usb_buf, s->scsi_buf, len);
143     } else {
144         memcpy(s->scsi_buf, s->usb_buf, len);
145     }
146     s->usb_len -= len;
147     s->scsi_len -= len;
148     s->usb_buf += len;
149     s->scsi_buf += len;
150     s->data_len -= len;
151     if (s->scsi_len == 0) {
152         if (s->mode == USB_MSDM_DATAIN) {
153             s->scsi_dev->read_data(s->scsi_dev, s->tag);
154         } else if (s->mode == USB_MSDM_DATAOUT) {
155             s->scsi_dev->write_data(s->scsi_dev, s->tag);
156         }
157     }
158 }
159 
usb_msd_send_status(MSDState * s)160 static void usb_msd_send_status(MSDState *s)
161 {
162     struct usb_msd_csw csw;
163 
164     csw.sig = cpu_to_le32(0x53425355);
165     csw.tag = cpu_to_le32(s->tag);
166     csw.residue = s->residue;
167     csw.status = s->result;
168     memcpy(s->usb_buf, &csw, 13);
169 }
170 
usb_msd_command_complete(void * opaque,int reason,uint32_t tag,uint32_t arg)171 static void usb_msd_command_complete(void *opaque, int reason, uint32_t tag,
172                                      uint32_t arg)
173 {
174     MSDState *s = (MSDState *)opaque;
175     USBPacket *p = s->packet;
176 
177     if (tag != s->tag) {
178         fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
179     }
180     if (reason == SCSI_REASON_DONE) {
181         DPRINTF("Command complete %d\n", arg);
182         s->residue = s->data_len;
183         s->result = arg != 0;
184         if (s->packet) {
185             if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
186                 /* A deferred packet with no write data remaining must be
187                    the status read packet.  */
188                 usb_msd_send_status(s);
189                 s->mode = USB_MSDM_CBW;
190             } else {
191                 if (s->data_len) {
192                     s->data_len -= s->usb_len;
193                     if (s->mode == USB_MSDM_DATAIN)
194                         memset(s->usb_buf, 0, s->usb_len);
195                     s->usb_len = 0;
196                 }
197                 if (s->data_len == 0)
198                     s->mode = USB_MSDM_CSW;
199             }
200             s->packet = NULL;
201             usb_packet_complete(p);
202         } else if (s->data_len == 0) {
203             s->mode = USB_MSDM_CSW;
204         }
205         return;
206     }
207     s->scsi_len = arg;
208     s->scsi_buf = s->scsi_dev->get_buf(s->scsi_dev, tag);
209     if (p) {
210         usb_msd_copy_data(s);
211         if (s->usb_len == 0) {
212             /* Set s->packet to NULL before calling usb_packet_complete
213                because annother request may be issued before
214                usb_packet_complete returns.  */
215             DPRINTF("Packet complete %p\n", p);
216             s->packet = NULL;
217             usb_packet_complete(p);
218         }
219     }
220 }
221 
usb_msd_handle_reset(USBDevice * dev)222 static void usb_msd_handle_reset(USBDevice *dev)
223 {
224     MSDState *s = (MSDState *)dev;
225 
226     DPRINTF("Reset\n");
227     s->mode = USB_MSDM_CBW;
228 }
229 
usb_msd_handle_control(USBDevice * dev,int request,int value,int index,int length,uint8_t * data)230 static int usb_msd_handle_control(USBDevice *dev, int request, int value,
231                                   int index, int length, uint8_t *data)
232 {
233     MSDState *s = (MSDState *)dev;
234     int ret = 0;
235 
236     switch (request) {
237     case DeviceRequest | USB_REQ_GET_STATUS:
238         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
239             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
240         data[1] = 0x00;
241         ret = 2;
242         break;
243     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
244         if (value == USB_DEVICE_REMOTE_WAKEUP) {
245             dev->remote_wakeup = 0;
246         } else {
247             goto fail;
248         }
249         ret = 0;
250         break;
251     case DeviceOutRequest | USB_REQ_SET_FEATURE:
252         if (value == USB_DEVICE_REMOTE_WAKEUP) {
253             dev->remote_wakeup = 1;
254         } else {
255             goto fail;
256         }
257         ret = 0;
258         break;
259     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
260         dev->addr = value;
261         ret = 0;
262         break;
263     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
264         switch(value >> 8) {
265         case USB_DT_DEVICE:
266             memcpy(data, qemu_msd_dev_descriptor,
267                    sizeof(qemu_msd_dev_descriptor));
268             ret = sizeof(qemu_msd_dev_descriptor);
269             break;
270         case USB_DT_CONFIG:
271             memcpy(data, qemu_msd_config_descriptor,
272                    sizeof(qemu_msd_config_descriptor));
273             ret = sizeof(qemu_msd_config_descriptor);
274             break;
275         case USB_DT_STRING:
276             switch(value & 0xff) {
277             case 0:
278                 /* language ids */
279                 data[0] = 4;
280                 data[1] = 3;
281                 data[2] = 0x09;
282                 data[3] = 0x04;
283                 ret = 4;
284                 break;
285             case 1:
286                 /* vendor description */
287                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
288                 break;
289             case 2:
290                 /* product description */
291                 ret = set_usb_string(data, "QEMU USB HARDDRIVE");
292                 break;
293             case 3:
294                 /* serial number */
295                 ret = set_usb_string(data, "1");
296                 break;
297             default:
298                 goto fail;
299             }
300             break;
301         default:
302             goto fail;
303         }
304         break;
305     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
306         data[0] = 1;
307         ret = 1;
308         break;
309     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
310         ret = 0;
311         break;
312     case DeviceRequest | USB_REQ_GET_INTERFACE:
313         data[0] = 0;
314         ret = 1;
315         break;
316     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
317         ret = 0;
318         break;
319     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
320         if (value == 0 && index != 0x81) { /* clear ep halt */
321             goto fail;
322         }
323         ret = 0;
324         break;
325         /* Class specific requests.  */
326     case MassStorageReset:
327         /* Reset state ready for the next CBW.  */
328         s->mode = USB_MSDM_CBW;
329         ret = 0;
330         break;
331     case GetMaxLun:
332         data[0] = 0;
333         ret = 1;
334         break;
335     default:
336     fail:
337         ret = USB_RET_STALL;
338         break;
339     }
340     return ret;
341 }
342 
usb_msd_cancel_io(USBPacket * p,void * opaque)343 static void usb_msd_cancel_io(USBPacket *p, void *opaque)
344 {
345     MSDState *s = opaque;
346     s->scsi_dev->cancel_io(s->scsi_dev, s->tag);
347     s->packet = NULL;
348     s->scsi_len = 0;
349 }
350 
usb_msd_handle_data(USBDevice * dev,USBPacket * p)351 static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
352 {
353     MSDState *s = (MSDState *)dev;
354     int ret = 0;
355     struct usb_msd_cbw cbw;
356     uint8_t devep = p->devep;
357     uint8_t *data = p->data;
358     int len = p->len;
359 
360     switch (p->pid) {
361     case USB_TOKEN_OUT:
362         if (devep != 2)
363             goto fail;
364 
365         switch (s->mode) {
366         case USB_MSDM_CBW:
367             if (len != 31) {
368                 fprintf(stderr, "usb-msd: Bad CBW size");
369                 goto fail;
370             }
371             memcpy(&cbw, data, 31);
372             if (le32_to_cpu(cbw.sig) != 0x43425355) {
373                 fprintf(stderr, "usb-msd: Bad signature %08x\n",
374                         le32_to_cpu(cbw.sig));
375                 goto fail;
376             }
377             DPRINTF("Command on LUN %d\n", cbw.lun);
378             if (cbw.lun != 0) {
379                 fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
380                 goto fail;
381             }
382             s->tag = le32_to_cpu(cbw.tag);
383             s->data_len = le32_to_cpu(cbw.data_len);
384             if (s->data_len == 0) {
385                 s->mode = USB_MSDM_CSW;
386             } else if (cbw.flags & 0x80) {
387                 s->mode = USB_MSDM_DATAIN;
388             } else {
389                 s->mode = USB_MSDM_DATAOUT;
390             }
391             DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
392                     s->tag, cbw.flags, cbw.cmd_len, s->data_len);
393             s->residue = 0;
394             s->scsi_dev->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
395             /* ??? Should check that USB and SCSI data transfer
396                directions match.  */
397             if (s->residue == 0) {
398                 if (s->mode == USB_MSDM_DATAIN) {
399                     s->scsi_dev->read_data(s->scsi_dev, s->tag);
400                 } else if (s->mode == USB_MSDM_DATAOUT) {
401                     s->scsi_dev->write_data(s->scsi_dev, s->tag);
402                 }
403             }
404             ret = len;
405             break;
406 
407         case USB_MSDM_DATAOUT:
408             DPRINTF("Data out %d/%d\n", len, s->data_len);
409             if (len > s->data_len)
410                 goto fail;
411 
412             s->usb_buf = data;
413             s->usb_len = len;
414             if (s->scsi_len) {
415                 usb_msd_copy_data(s);
416             }
417             if (s->residue && s->usb_len) {
418                 s->data_len -= s->usb_len;
419                 if (s->data_len == 0)
420                     s->mode = USB_MSDM_CSW;
421                 s->usb_len = 0;
422             }
423             if (s->usb_len) {
424                 DPRINTF("Deferring packet %p\n", p);
425                 usb_defer_packet(p, usb_msd_cancel_io, s);
426                 s->packet = p;
427                 ret = USB_RET_ASYNC;
428             } else {
429                 ret = len;
430             }
431             break;
432 
433         default:
434             DPRINTF("Unexpected write (len %d)\n", len);
435             goto fail;
436         }
437         break;
438 
439     case USB_TOKEN_IN:
440         if (devep != 1)
441             goto fail;
442 
443         switch (s->mode) {
444         case USB_MSDM_DATAOUT:
445             if (s->data_len != 0 || len < 13)
446                 goto fail;
447             /* Waiting for SCSI write to complete.  */
448             usb_defer_packet(p, usb_msd_cancel_io, s);
449             s->packet = p;
450             ret = USB_RET_ASYNC;
451             break;
452 
453         case USB_MSDM_CSW:
454             DPRINTF("Command status %d tag 0x%x, len %d\n",
455                     s->result, s->tag, len);
456             if (len < 13)
457                 goto fail;
458 
459             s->usb_len = len;
460             s->usb_buf = data;
461             usb_msd_send_status(s);
462             s->mode = USB_MSDM_CBW;
463             ret = 13;
464             break;
465 
466         case USB_MSDM_DATAIN:
467             DPRINTF("Data in %d/%d\n", len, s->data_len);
468             if (len > s->data_len)
469                 len = s->data_len;
470             s->usb_buf = data;
471             s->usb_len = len;
472             if (s->scsi_len) {
473                 usb_msd_copy_data(s);
474             }
475             if (s->residue && s->usb_len) {
476                 s->data_len -= s->usb_len;
477                 memset(s->usb_buf, 0, s->usb_len);
478                 if (s->data_len == 0)
479                     s->mode = USB_MSDM_CSW;
480                 s->usb_len = 0;
481             }
482             if (s->usb_len) {
483                 DPRINTF("Deferring packet %p\n", p);
484                 usb_defer_packet(p, usb_msd_cancel_io, s);
485                 s->packet = p;
486                 ret = USB_RET_ASYNC;
487             } else {
488                 ret = len;
489             }
490             break;
491 
492         default:
493             DPRINTF("Unexpected read (len %d)\n", len);
494             goto fail;
495         }
496         break;
497 
498     default:
499         DPRINTF("Bad token\n");
500     fail:
501         ret = USB_RET_STALL;
502         break;
503     }
504 
505     return ret;
506 }
507 
usb_msd_handle_destroy(USBDevice * dev)508 static void usb_msd_handle_destroy(USBDevice *dev)
509 {
510     MSDState *s = (MSDState *)dev;
511 
512     s->scsi_dev->destroy(s->scsi_dev);
513     bdrv_delete(s->bs);
514     qemu_free(s);
515 }
516 
usb_msd_init(const char * filename)517 USBDevice *usb_msd_init(const char *filename)
518 {
519     MSDState *s;
520     BlockDriverState *bdrv;
521     BlockDriver *drv = NULL;
522     const char *p1;
523     char fmt[32];
524 
525     p1 = strchr(filename, ':');
526     if (p1++) {
527         const char *p2;
528 
529         if (strstart(filename, "format=", &p2)) {
530             int len = MIN(p1 - p2, sizeof(fmt));
531             pstrcpy(fmt, len, p2);
532 
533             drv = bdrv_find_format(fmt);
534             if (!drv) {
535                 printf("invalid format %s\n", fmt);
536                 return NULL;
537             }
538         } else if (*filename != ':') {
539             printf("unrecognized USB mass-storage option %s\n", filename);
540             return NULL;
541         }
542 
543         filename = p1;
544     }
545 
546     if (!*filename) {
547         printf("block device specification needed\n");
548         return NULL;
549     }
550 
551     s = qemu_mallocz(sizeof(MSDState));
552 
553     bdrv = bdrv_new("usb");
554     if (bdrv_open2(bdrv, filename, 0, drv) < 0)
555         goto fail;
556     s->bs = bdrv;
557 
558     s->dev.speed = USB_SPEED_FULL;
559     s->dev.handle_packet = usb_generic_handle_packet;
560 
561     s->dev.handle_reset = usb_msd_handle_reset;
562     s->dev.handle_control = usb_msd_handle_control;
563     s->dev.handle_data = usb_msd_handle_data;
564     s->dev.handle_destroy = usb_msd_handle_destroy;
565 
566     snprintf(s->dev.devname, sizeof(s->dev.devname), "QEMU USB MSD(%.16s)",
567              filename);
568 
569     s->scsi_dev = scsi_disk_init(bdrv, 0, usb_msd_command_complete, s);
570     usb_msd_handle_reset((USBDevice *)s);
571     return (USBDevice *)s;
572  fail:
573     qemu_free(s);
574     return NULL;
575 }
576 
usb_msd_get_bdrv(USBDevice * dev)577 BlockDriverState *usb_msd_get_bdrv(USBDevice *dev)
578 {
579     MSDState *s = (MSDState *)dev;
580 
581     return s->bs;
582 }
583