[qemu.git] / hw / usb-msd.c

/*
 * USB Mass Storage Device emulation
 *
 * Copyright (c) 2006 CodeSourcery.
 * Written by Paul Brook
 *
 * This code is licenced under the LGPL.
 */

#include "qemu-common.h"
#include "qemu-option.h"
#include "qemu-config.h"
#include "usb.h"
#include "scsi.h"
#include "console.h"
#include "monitor.h"
#include "sysemu.h"

//#define DEBUG_MSD

#ifdef DEBUG_MSD
#define DPRINTF(fmt, ...) \
do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
#else
#define DPRINTF(fmt, ...) do {} while(0)
#endif

/* USB requests.  */
#define MassStorageReset  0xff
#define GetMaxLun         0xfe

enum USBMSDMode {
    USB_MSDM_CBW, /* Command Block.  */
    USB_MSDM_DATAOUT, /* Tranfer data to device.  */
    USB_MSDM_DATAIN, /* Transfer data from device.  */
    USB_MSDM_CSW /* Command Status.  */
};

typedef struct {
    USBDevice dev;
    enum USBMSDMode mode;
    uint32_t scsi_len;
    uint8_t *scsi_buf;
    uint32_t usb_len;
    uint8_t *usb_buf;
    uint32_t data_len;
    uint32_t residue;
    uint32_t tag;
    SCSIBus bus;
    BlockConf conf;
    SCSIDevice *scsi_dev;
    int result;
    /* For async completion.  */
    USBPacket *packet;
} MSDState;

struct usb_msd_cbw {
    uint32_t sig;
    uint32_t tag;
    uint32_t data_len;
    uint8_t flags;
    uint8_t lun;
    uint8_t cmd_len;
    uint8_t cmd[16];
};

struct usb_msd_csw {
    uint32_t sig;
    uint32_t tag;
    uint32_t residue;
    uint8_t status;
};

static const uint8_t qemu_msd_dev_descriptor[] = {
	0x12,       /*  u8 bLength; */
	0x01,       /*  u8 bDescriptorType; Device */
	0x00, 0x01, /*  u16 bcdUSB; v1.0 */

	0x00,	    /*  u8  bDeviceClass; */
	0x00,	    /*  u8  bDeviceSubClass; */
	0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
	0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */

        /* Vendor and product id are arbitrary.  */
	0x00, 0x00, /*  u16 idVendor; */
 	0x00, 0x00, /*  u16 idProduct; */
	0x00, 0x00, /*  u16 bcdDevice */

	0x01,       /*  u8  iManufacturer; */
	0x02,       /*  u8  iProduct; */
	0x03,       /*  u8  iSerialNumber; */
	0x01        /*  u8  bNumConfigurations; */
};

static const uint8_t qemu_msd_config_descriptor[] = {

	/* one configuration */
	0x09,       /*  u8  bLength; */
	0x02,       /*  u8  bDescriptorType; Configuration */
	0x20, 0x00, /*  u16 wTotalLength; */
	0x01,       /*  u8  bNumInterfaces; (1) */
	0x01,       /*  u8  bConfigurationValue; */
	0x00,       /*  u8  iConfiguration; */
	0xc0,       /*  u8  bmAttributes;
				 Bit 7: must be set,
				     6: Self-powered,
				     5: Remote wakeup,
				     4..0: resvd */
	0x00,       /*  u8  MaxPower; */

	/* one interface */
	0x09,       /*  u8  if_bLength; */
	0x04,       /*  u8  if_bDescriptorType; Interface */
	0x00,       /*  u8  if_bInterfaceNumber; */
	0x00,       /*  u8  if_bAlternateSetting; */
	0x02,       /*  u8  if_bNumEndpoints; */
	0x08,       /*  u8  if_bInterfaceClass; MASS STORAGE */
	0x06,       /*  u8  if_bInterfaceSubClass; SCSI */
	0x50,       /*  u8  if_bInterfaceProtocol; Bulk Only */
	0x00,       /*  u8  if_iInterface; */

	/* Bulk-In endpoint */
	0x07,       /*  u8  ep_bLength; */
	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 	0x02,       /*  u8  ep_bmAttributes; Bulk */
 	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
	0x00,       /*  u8  ep_bInterval; */

	/* Bulk-Out endpoint */
	0x07,       /*  u8  ep_bLength; */
	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
	0x02,       /*  u8  ep_bEndpointAddress; OUT Endpoint 2 */
 	0x02,       /*  u8  ep_bmAttributes; Bulk */
 	0x40, 0x00, /*  u16 ep_wMaxPacketSize; */
	0x00        /*  u8  ep_bInterval; */
};

static void usb_msd_copy_data(MSDState *s)
{
    uint32_t len;
    len = s->usb_len;
    if (len > s->scsi_len)
        len = s->scsi_len;
    if (s->mode == USB_MSDM_DATAIN) {
        memcpy(s->usb_buf, s->scsi_buf, len);
    } else {
        memcpy(s->scsi_buf, s->usb_buf, len);
    }
    s->usb_len -= len;
    s->scsi_len -= len;
    s->usb_buf += len;
    s->scsi_buf += len;
    s->data_len -= len;
    if (s->scsi_len == 0) {
        if (s->mode == USB_MSDM_DATAIN) {
            s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
        } else if (s->mode == USB_MSDM_DATAOUT) {
            s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
        }
    }
}

static void usb_msd_send_status(MSDState *s)
{
    struct usb_msd_csw csw;

    csw.sig = cpu_to_le32(0x53425355);
    csw.tag = cpu_to_le32(s->tag);
    csw.residue = s->residue;
    csw.status = s->result;
    memcpy(s->usb_buf, &csw, 13);
}

static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
                                     uint32_t arg)
{
    MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
    USBPacket *p = s->packet;

    if (tag != s->tag) {
        fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
    }
    if (reason == SCSI_REASON_DONE) {
        DPRINTF("Command complete %d\n", arg);
        s->residue = s->data_len;
        s->result = arg != 0;
        if (s->packet) {
            if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
                /* A deferred packet with no write data remaining must be
                   the status read packet.  */
                usb_msd_send_status(s);
                s->mode = USB_MSDM_CBW;
            } else {
                if (s->data_len) {
                    s->data_len -= s->usb_len;
                    if (s->mode == USB_MSDM_DATAIN)
                        memset(s->usb_buf, 0, s->usb_len);
                    s->usb_len = 0;
                }
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
            }
            s->packet = NULL;
            usb_packet_complete(p);
        } else if (s->data_len == 0) {
            s->mode = USB_MSDM_CSW;
        }
        return;
    }
    s->scsi_len = arg;
    s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
    if (p) {
        usb_msd_copy_data(s);
        if (s->usb_len == 0) {
            /* Set s->packet to NULL before calling usb_packet_complete
               because annother request may be issued before
               usb_packet_complete returns.  */
            DPRINTF("Packet complete %p\n", p);
            s->packet = NULL;
            usb_packet_complete(p);
        }
    }
}

static void usb_msd_handle_reset(USBDevice *dev)
{
    MSDState *s = (MSDState *)dev;

    DPRINTF("Reset\n");
    s->mode = USB_MSDM_CBW;
}

static int usb_msd_handle_control(USBDevice *dev, int request, int value,
                                  int index, int length, uint8_t *data)
{
    MSDState *s = (MSDState *)dev;
    int ret = 0;

    switch (request) {
    case DeviceRequest | USB_REQ_GET_STATUS:
        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
        data[1] = 0x00;
        ret = 2;
        break;
    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
            dev->remote_wakeup = 0;
        } else {
            goto fail;
        }
        ret = 0;
        break;
    case DeviceOutRequest | USB_REQ_SET_FEATURE:
        if (value == USB_DEVICE_REMOTE_WAKEUP) {
            dev->remote_wakeup = 1;
        } else {
            goto fail;
        }
        ret = 0;
        break;
    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
        dev->addr = value;
        ret = 0;
        break;
    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
        switch(value >> 8) {
        case USB_DT_DEVICE:
            memcpy(data, qemu_msd_dev_descriptor,
                   sizeof(qemu_msd_dev_descriptor));
            ret = sizeof(qemu_msd_dev_descriptor);
            break;
        case USB_DT_CONFIG:
            memcpy(data, qemu_msd_config_descriptor,
                   sizeof(qemu_msd_config_descriptor));
            ret = sizeof(qemu_msd_config_descriptor);
            break;
        case USB_DT_STRING:
            switch(value & 0xff) {
            case 0:
                /* language ids */
                data[0] = 4;
                data[1] = 3;
                data[2] = 0x09;
                data[3] = 0x04;
                ret = 4;
                break;
            case 1:
                /* vendor description */
                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
                break;
            case 2:
                /* product description */
                ret = set_usb_string(data, "QEMU USB HARDDRIVE");
                break;
            case 3:
                /* serial number */
                ret = set_usb_string(data, "1");
                break;
            default:
                goto fail;
            }
            break;
        default:
            goto fail;
        }
        break;
    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
        data[0] = 1;
        ret = 1;
        break;
    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
        ret = 0;
        break;
    case DeviceRequest | USB_REQ_GET_INTERFACE:
        data[0] = 0;
        ret = 1;
        break;
    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
        ret = 0;
        break;
    case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
        ret = 0;
        break;
    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
        ret = 0;
        break;
        /* Class specific requests.  */
    case ClassInterfaceOutRequest | MassStorageReset:
        /* Reset state ready for the next CBW.  */
        s->mode = USB_MSDM_CBW;
        ret = 0;
        break;
    case ClassInterfaceRequest | GetMaxLun:
        data[0] = 0;
        ret = 1;
        break;
    default:
    fail:
        ret = USB_RET_STALL;
        break;
    }
    return ret;
}

static void usb_msd_cancel_io(USBPacket *p, void *opaque)
{
    MSDState *s = opaque;
    s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
    s->packet = NULL;
    s->scsi_len = 0;
}

static int usb_msd_handle_data(USBDevice *dev, USBPacket *p)
{
    MSDState *s = (MSDState *)dev;
    int ret = 0;
    struct usb_msd_cbw cbw;
    uint8_t devep = p->devep;
    uint8_t *data = p->data;
    int len = p->len;

    switch (p->pid) {
    case USB_TOKEN_OUT:
        if (devep != 2)
            goto fail;

        switch (s->mode) {
        case USB_MSDM_CBW:
            if (len != 31) {
                fprintf(stderr, "usb-msd: Bad CBW size");
                goto fail;
            }
            memcpy(&cbw, data, 31);
            if (le32_to_cpu(cbw.sig) != 0x43425355) {
                fprintf(stderr, "usb-msd: Bad signature %08x\n",
                        le32_to_cpu(cbw.sig));
                goto fail;
            }
            DPRINTF("Command on LUN %d\n", cbw.lun);
            if (cbw.lun != 0) {
                fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
                goto fail;
            }
            s->tag = le32_to_cpu(cbw.tag);
            s->data_len = le32_to_cpu(cbw.data_len);
            if (s->data_len == 0) {
                s->mode = USB_MSDM_CSW;
            } else if (cbw.flags & 0x80) {
                s->mode = USB_MSDM_DATAIN;
            } else {
                s->mode = USB_MSDM_DATAOUT;
            }
            DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
                    s->tag, cbw.flags, cbw.cmd_len, s->data_len);
            s->residue = 0;
            s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
            /* ??? Should check that USB and SCSI data transfer
               directions match.  */
            if (s->residue == 0) {
                if (s->mode == USB_MSDM_DATAIN) {
                    s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
                } else if (s->mode == USB_MSDM_DATAOUT) {
                    s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
                }
            }
            ret = len;
            break;

        case USB_MSDM_DATAOUT:
            DPRINTF("Data out %d/%d\n", len, s->data_len);
            if (len > s->data_len)
                goto fail;

            s->usb_buf = data;
            s->usb_len = len;
            if (s->scsi_len) {
                usb_msd_copy_data(s);
            }
            if (s->residue && s->usb_len) {
                s->data_len -= s->usb_len;
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
                s->usb_len = 0;
            }
            if (s->usb_len) {
                DPRINTF("Deferring packet %p\n", p);
                usb_defer_packet(p, usb_msd_cancel_io, s);
                s->packet = p;
                ret = USB_RET_ASYNC;
            } else {
                ret = len;
            }
            break;

        default:
            DPRINTF("Unexpected write (len %d)\n", len);
            goto fail;
        }
        break;

    case USB_TOKEN_IN:
        if (devep != 1)
            goto fail;

        switch (s->mode) {
        case USB_MSDM_DATAOUT:
            if (s->data_len != 0 || len < 13)
                goto fail;
            /* Waiting for SCSI write to complete.  */
            usb_defer_packet(p, usb_msd_cancel_io, s);
            s->packet = p;
            ret = USB_RET_ASYNC;
            break;

        case USB_MSDM_CSW:
            DPRINTF("Command status %d tag 0x%x, len %d\n",
                    s->result, s->tag, len);
            if (len < 13)
                goto fail;

            s->usb_len = len;
            s->usb_buf = data;
            usb_msd_send_status(s);
            s->mode = USB_MSDM_CBW;
            ret = 13;
            break;

        case USB_MSDM_DATAIN:
            DPRINTF("Data in %d/%d\n", len, s->data_len);
            if (len > s->data_len)
                len = s->data_len;
            s->usb_buf = data;
            s->usb_len = len;
            if (s->scsi_len) {
                usb_msd_copy_data(s);
            }
            if (s->residue && s->usb_len) {
                s->data_len -= s->usb_len;
                memset(s->usb_buf, 0, s->usb_len);
                if (s->data_len == 0)
                    s->mode = USB_MSDM_CSW;
                s->usb_len = 0;
            }
            if (s->usb_len) {
                DPRINTF("Deferring packet %p\n", p);
                usb_defer_packet(p, usb_msd_cancel_io, s);
                s->packet = p;
                ret = USB_RET_ASYNC;
            } else {
                ret = len;
            }
            break;

        default:
            DPRINTF("Unexpected read (len %d)\n", len);
            goto fail;
        }
        break;

    default:
        DPRINTF("Bad token\n");
    fail:
        ret = USB_RET_STALL;
        break;
    }

    return ret;
}

static void usb_msd_password_cb(void *opaque, int err)
{
    MSDState *s = opaque;

    if (!err)
        usb_device_attach(&s->dev);
    else
        qdev_unplug(&s->dev.qdev);
}

static int usb_msd_initfn(USBDevice *dev)
{
    MSDState *s = DO_UPCAST(MSDState, dev, dev);
    BlockDriverState *bs = s->conf.bs;

    if (!bs) {
        error_report("usb-msd: drive property not set");
        return -1;
    }

    /*
     * Hack alert: this pretends to be a block device, but it's really
     * a SCSI bus that can serve only a single device, which it
     * creates automatically.  But first it needs to detach from its
     * blockdev, or else scsi_bus_legacy_add_drive() dies when it
     * attaches again.
     *
     * The hack is probably a bad idea.
     */
    bdrv_detach(bs, &s->dev.qdev);
    s->conf.bs = NULL;

    s->dev.speed = USB_SPEED_FULL;
    scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
    s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
    if (!s->scsi_dev) {
        return -1;
    }
    s->bus.qbus.allow_hotplug = 0;
    usb_msd_handle_reset(dev);

    if (bdrv_key_required(bs)) {
        if (cur_mon) {
            monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
            s->dev.auto_attach = 0;
        } else {
            autostart = 0;
        }
    }

    return 0;
}

static USBDevice *usb_msd_init(const char *filename)
{
    static int nr=0;
    char id[8];
    QemuOpts *opts;
    DriveInfo *dinfo;
    USBDevice *dev;
    int fatal_error;
    const char *p1;
    char fmt[32];

    /* parse -usbdevice disk: syntax into drive opts */
    snprintf(id, sizeof(id), "usb%d", nr++);
    opts = qemu_opts_create(&qemu_drive_opts, id, 0);

    p1 = strchr(filename, ':');
    if (p1++) {
        const char *p2;

        if (strstart(filename, "format=", &p2)) {
            int len = MIN(p1 - p2, sizeof(fmt));
            pstrcpy(fmt, len, p2);
            qemu_opt_set(opts, "format", fmt);
        } else if (*filename != ':') {
            printf("unrecognized USB mass-storage option %s\n", filename);
            return NULL;
        }
        filename = p1;
    }
    if (!*filename) {
        printf("block device specification needed\n");
        return NULL;
    }
    qemu_opt_set(opts, "file", filename);
    qemu_opt_set(opts, "if", "none");

    /* create host drive */
    dinfo = drive_init(opts, 0, &fatal_error);
    if (!dinfo) {
        qemu_opts_del(opts);
        return NULL;
    }

    /* create guest device */
    dev = usb_create(NULL /* FIXME */, "usb-storage");
    if (!dev) {
        return NULL;
    }
    if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
        qdev_free(&dev->qdev);
        return NULL;
    }
    if (qdev_init(&dev->qdev) < 0)
        return NULL;

    return dev;
}

static struct USBDeviceInfo msd_info = {
    .product_desc   = "QEMU USB MSD",
    .qdev.name      = "usb-storage",
    .qdev.size      = sizeof(MSDState),
    .init           = usb_msd_initfn,
    .handle_packet  = usb_generic_handle_packet,
    .handle_reset   = usb_msd_handle_reset,
    .handle_control = usb_msd_handle_control,
    .handle_data    = usb_msd_handle_data,
    .usbdevice_name = "disk",
    .usbdevice_init = usb_msd_init,
    .qdev.props     = (Property[]) {
        DEFINE_BLOCK_PROPERTIES(MSDState, conf),
        DEFINE_PROP_END_OF_LIST(),
    },
};

static void usb_msd_register_devices(void)
{
    usb_qdev_register(&msd_info);
}
device_init(usb_msd_register_devices)
Commit	Line	Data
5fafdf24	1	/*
2e5d83bb PB	2	* USB Mass Storage Device emulation
	3	*
	4	* Copyright (c) 2006 CodeSourcery.
	5	* Written by Paul Brook
	6	*
	7	* This code is licenced under the LGPL.
	8	*/
	9
87ecb68b	10	#include "qemu-common.h"
7fc2f2c0 GH	11	#include "qemu-option.h"
7fc2f2c0 GH	12	#include "qemu-config.h"
87ecb68b	13	#include "usb.h"
43b443b6	14	#include "scsi.h"
c0f4ce77	15	#include "console.h"
b3e461d3	16	#include "monitor.h"
666daa68	17	#include "sysemu.h"
2e5d83bb PB	18
	19	//#define DEBUG_MSD
	20
	21	#ifdef DEBUG_MSD
001faf32 BS	22	#define DPRINTF(fmt, ...) \
001faf32 BS	23	do { printf("usb-msd: " fmt , ## __VA_ARGS__); } while (0)
2e5d83bb	24	#else
001faf32	25	#define DPRINTF(fmt, ...) do {} while(0)
2e5d83bb PB	26	#endif
	27
	28	/* USB requests. */
	29	#define MassStorageReset 0xff
	30	#define GetMaxLun 0xfe
	31
	32	enum USBMSDMode {
	33	USB_MSDM_CBW, /* Command Block. */
	34	USB_MSDM_DATAOUT, /* Tranfer data to device. */
	35	USB_MSDM_DATAIN, /* Transfer data from device. */
	36	USB_MSDM_CSW /* Command Status. */
	37	};
	38
	39	typedef struct {
	40	USBDevice dev;
	41	enum USBMSDMode mode;
a917d384 PB	42	uint32_t scsi_len;
	43	uint8_t *scsi_buf;
	44	uint32_t usb_len;
	45	uint8_t *usb_buf;
2e5d83bb	46	uint32_t data_len;
a917d384	47	uint32_t residue;
2e5d83bb	48	uint32_t tag;
ca9c39fa	49	SCSIBus bus;
428c149b	50	BlockConf conf;
2e5d83bb PB	51	SCSIDevice *scsi_dev;
2e5d83bb PB	52	int result;
4d611c9a PB	53	/* For async completion. */
4d611c9a PB	54	USBPacket *packet;
2e5d83bb PB	55	} MSDState;
2e5d83bb PB	56
a917d384 PB	57	struct usb_msd_cbw {
	58	uint32_t sig;
	59	uint32_t tag;
	60	uint32_t data_len;
	61	uint8_t flags;
	62	uint8_t lun;
	63	uint8_t cmd_len;
	64	uint8_t cmd[16];
	65	};
	66
	67	struct usb_msd_csw {
	68	uint32_t sig;
	69	uint32_t tag;
	70	uint32_t residue;
	71	uint8_t status;
	72	};
	73
2e5d83bb PB	74	static const uint8_t qemu_msd_dev_descriptor[] = {
	75	0x12, /* u8 bLength; */
	76	0x01, /* u8 bDescriptorType; Device */
e126cf13	77	0x00, 0x01, /* u16 bcdUSB; v1.0 */
2e5d83bb PB	78
	79	0x00, /* u8 bDeviceClass; */
	80	0x00, /* u8 bDeviceSubClass; */
	81	0x00, /* u8 bDeviceProtocol; [ low/full speeds only ] */
	82	0x08, /* u8 bMaxPacketSize0; 8 Bytes */
	83
	84	/* Vendor and product id are arbitrary. */
	85	0x00, 0x00, /* u16 idVendor; */
	86	0x00, 0x00, /* u16 idProduct; */
	87	0x00, 0x00, /* u16 bcdDevice */
	88
	89	0x01, /* u8 iManufacturer; */
	90	0x02, /* u8 iProduct; */
	91	0x03, /* u8 iSerialNumber; */
	92	0x01 /* u8 bNumConfigurations; */
	93	};
	94
	95	static const uint8_t qemu_msd_config_descriptor[] = {
	96
	97	/* one configuration */
	98	0x09, /* u8 bLength; */
	99	0x02, /* u8 bDescriptorType; Configuration */
	100	0x20, 0x00, /* u16 wTotalLength; */
	101	0x01, /* u8 bNumInterfaces; (1) */
	102	0x01, /* u8 bConfigurationValue; */
	103	0x00, /* u8 iConfiguration; */
5fafdf24	104	0xc0, /* u8 bmAttributes;
2e5d83bb PB	105	Bit 7: must be set,
	106	6: Self-powered,
	107	5: Remote wakeup,
	108	4..0: resvd */
	109	0x00, /* u8 MaxPower; */
3b46e624	110
2e5d83bb PB	111	/* one interface */
	112	0x09, /* u8 if_bLength; */
	113	0x04, /* u8 if_bDescriptorType; Interface */
	114	0x00, /* u8 if_bInterfaceNumber; */
	115	0x00, /* u8 if_bAlternateSetting; */
	116	0x02, /* u8 if_bNumEndpoints; */
	117	0x08, /* u8 if_bInterfaceClass; MASS STORAGE */
	118	0x06, /* u8 if_bInterfaceSubClass; SCSI */
	119	0x50, /* u8 if_bInterfaceProtocol; Bulk Only */
	120	0x00, /* u8 if_iInterface; */
3b46e624	121
2e5d83bb PB	122	/* Bulk-In endpoint */
	123	0x07, /* u8 ep_bLength; */
	124	0x05, /* u8 ep_bDescriptorType; Endpoint */
	125	0x81, /* u8 ep_bEndpointAddress; IN Endpoint 1 */
	126	0x02, /* u8 ep_bmAttributes; Bulk */
	127	0x40, 0x00, /* u16 ep_wMaxPacketSize; */
	128	0x00, /* u8 ep_bInterval; */
	129
	130	/* Bulk-Out endpoint */
	131	0x07, /* u8 ep_bLength; */
	132	0x05, /* u8 ep_bDescriptorType; Endpoint */
	133	0x02, /* u8 ep_bEndpointAddress; OUT Endpoint 2 */
	134	0x02, /* u8 ep_bmAttributes; Bulk */
	135	0x40, 0x00, /* u16 ep_wMaxPacketSize; */
	136	0x00 /* u8 ep_bInterval; */
	137	};
	138
a917d384 PB	139	static void usb_msd_copy_data(MSDState *s)
	140	{
	141	uint32_t len;
	142	len = s->usb_len;
	143	if (len > s->scsi_len)
	144	len = s->scsi_len;
	145	if (s->mode == USB_MSDM_DATAIN) {
	146	memcpy(s->usb_buf, s->scsi_buf, len);
	147	} else {
	148	memcpy(s->scsi_buf, s->usb_buf, len);
	149	}
	150	s->usb_len -= len;
	151	s->scsi_len -= len;
	152	s->usb_buf += len;
	153	s->scsi_buf += len;
	154	s->data_len -= len;
	155	if (s->scsi_len == 0) {
	156	if (s->mode == USB_MSDM_DATAIN) {
d52affa7	157	s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
a917d384	158	} else if (s->mode == USB_MSDM_DATAOUT) {
d52affa7	159	s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
a917d384 PB	160	}
	161	}
	162	}
	163
	164	static void usb_msd_send_status(MSDState *s)
	165	{
	166	struct usb_msd_csw csw;
	167
	168	csw.sig = cpu_to_le32(0x53425355);
	169	csw.tag = cpu_to_le32(s->tag);
	170	csw.residue = s->residue;
	171	csw.status = s->result;
	172	memcpy(s->usb_buf, &csw, 13);
	173	}
	174
d52affa7	175	static void usb_msd_command_complete(SCSIBus *bus, int reason, uint32_t tag,
a917d384	176	uint32_t arg)
2e5d83bb	177	{
d52affa7	178	MSDState *s = DO_UPCAST(MSDState, dev.qdev, bus->qbus.parent);
a917d384	179	USBPacket *p = s->packet;
4d611c9a	180
a917d384 PB	181	if (tag != s->tag) {
	182	fprintf(stderr, "usb-msd: Unexpected SCSI Tag 0x%x\n", tag);
	183	}
4d611c9a	184	if (reason == SCSI_REASON_DONE) {
a917d384 PB	185	DPRINTF("Command complete %d\n", arg);
	186	s->residue = s->data_len;
	187	s->result = arg != 0;
	188	if (s->packet) {
	189	if (s->data_len == 0 && s->mode == USB_MSDM_DATAOUT) {
	190	/* A deferred packet with no write data remaining must be
	191	the status read packet. */
	192	usb_msd_send_status(s);
	193	s->mode = USB_MSDM_CBW;
	194	} else {
	195	if (s->data_len) {
	196	s->data_len -= s->usb_len;
	197	if (s->mode == USB_MSDM_DATAIN)
	198	memset(s->usb_buf, 0, s->usb_len);
	199	s->usb_len = 0;
	200	}
	201	if (s->data_len == 0)
	202	s->mode = USB_MSDM_CSW;
	203	}
	204	s->packet = NULL;
	205	usb_packet_complete(p);
	206	} else if (s->data_len == 0) {
	207	s->mode = USB_MSDM_CSW;
	208	}
	209	return;
4d611c9a	210	}
a917d384	211	s->scsi_len = arg;
d52affa7	212	s->scsi_buf = s->scsi_dev->info->get_buf(s->scsi_dev, tag);
a917d384 PB	213	if (p) {
	214	usb_msd_copy_data(s);
	215	if (s->usb_len == 0) {
	216	/* Set s->packet to NULL before calling usb_packet_complete
	217	because annother request may be issued before
	218	usb_packet_complete returns. */
	219	DPRINTF("Packet complete %p\n", p);
	220	s->packet = NULL;
	221	usb_packet_complete(p);
	222	}
4d611c9a	223	}
2e5d83bb PB	224	}
2e5d83bb PB	225
059809e4	226	static void usb_msd_handle_reset(USBDevice *dev)
2e5d83bb PB	227	{
	228	MSDState s = (MSDState )dev;
	229
	230	DPRINTF("Reset\n");
	231	s->mode = USB_MSDM_CBW;
2e5d83bb PB	232	}
	233
	234	static int usb_msd_handle_control(USBDevice *dev, int request, int value,
	235	int index, int length, uint8_t *data)
	236	{
	237	MSDState s = (MSDState )dev;
	238	int ret = 0;
	239
	240	switch (request) {
	241	case DeviceRequest \| USB_REQ_GET_STATUS:
	242	data[0] = (1 << USB_DEVICE_SELF_POWERED) \|
	243	(dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
	244	data[1] = 0x00;
	245	ret = 2;
	246	break;
	247	case DeviceOutRequest \| USB_REQ_CLEAR_FEATURE:
	248	if (value == USB_DEVICE_REMOTE_WAKEUP) {
	249	dev->remote_wakeup = 0;
	250	} else {
	251	goto fail;
	252	}
	253	ret = 0;
	254	break;
	255	case DeviceOutRequest \| USB_REQ_SET_FEATURE:
	256	if (value == USB_DEVICE_REMOTE_WAKEUP) {
	257	dev->remote_wakeup = 1;
	258	} else {
	259	goto fail;
	260	}
	261	ret = 0;
	262	break;
	263	case DeviceOutRequest \| USB_REQ_SET_ADDRESS:
	264	dev->addr = value;
	265	ret = 0;
	266	break;
	267	case DeviceRequest \| USB_REQ_GET_DESCRIPTOR:
	268	switch(value >> 8) {
	269	case USB_DT_DEVICE:
5fafdf24	270	memcpy(data, qemu_msd_dev_descriptor,
2e5d83bb PB	271	sizeof(qemu_msd_dev_descriptor));
	272	ret = sizeof(qemu_msd_dev_descriptor);
	273	break;
	274	case USB_DT_CONFIG:
5fafdf24	275	memcpy(data, qemu_msd_config_descriptor,
2e5d83bb PB	276	sizeof(qemu_msd_config_descriptor));
	277	ret = sizeof(qemu_msd_config_descriptor);
	278	break;
	279	case USB_DT_STRING:
	280	switch(value & 0xff) {
	281	case 0:
	282	/* language ids */
	283	data[0] = 4;
	284	data[1] = 3;
	285	data[2] = 0x09;
	286	data[3] = 0x04;
	287	ret = 4;
	288	break;
	289	case 1:
	290	/* vendor description */
	291	ret = set_usb_string(data, "QEMU " QEMU_VERSION);
	292	break;
	293	case 2:
	294	/* product description */
	295	ret = set_usb_string(data, "QEMU USB HARDDRIVE");
	296	break;
	297	case 3:
	298	/* serial number */
	299	ret = set_usb_string(data, "1");
	300	break;
	301	default:
	302	goto fail;
	303	}
	304	break;
	305	default:
	306	goto fail;
	307	}
	308	break;
	309	case DeviceRequest \| USB_REQ_GET_CONFIGURATION:
	310	data[0] = 1;
	311	ret = 1;
	312	break;
	313	case DeviceOutRequest \| USB_REQ_SET_CONFIGURATION:
	314	ret = 0;
	315	break;
	316	case DeviceRequest \| USB_REQ_GET_INTERFACE:
	317	data[0] = 0;
	318	ret = 1;
	319	break;
	320	case DeviceOutRequest \| USB_REQ_SET_INTERFACE:
	321	ret = 0;
	322	break;
	323	case EndpointOutRequest \| USB_REQ_CLEAR_FEATURE:
e5322f76 APR	324	ret = 0;
	325	break;
	326	case InterfaceOutRequest \| USB_REQ_SET_INTERFACE:
2e5d83bb PB	327	ret = 0;
	328	break;
	329	/* Class specific requests. */
f3571b1a	330	case ClassInterfaceOutRequest \| MassStorageReset:
2e5d83bb PB	331	/* Reset state ready for the next CBW. */
	332	s->mode = USB_MSDM_CBW;
	333	ret = 0;
	334	break;
f3571b1a	335	case ClassInterfaceRequest \| GetMaxLun:
2e5d83bb PB	336	data[0] = 0;
	337	ret = 1;
	338	break;
	339	default:
	340	fail:
	341	ret = USB_RET_STALL;
	342	break;
	343	}
	344	return ret;
	345	}
	346
4d611c9a PB	347	static void usb_msd_cancel_io(USBPacket p, void opaque)
	348	{
	349	MSDState *s = opaque;
d52affa7	350	s->scsi_dev->info->cancel_io(s->scsi_dev, s->tag);
4d611c9a	351	s->packet = NULL;
a917d384	352	s->scsi_len = 0;
4d611c9a PB	353	}
	354
	355	static int usb_msd_handle_data(USBDevice dev, USBPacket p)
2e5d83bb PB	356	{
	357	MSDState s = (MSDState )dev;
	358	int ret = 0;
	359	struct usb_msd_cbw cbw;
4d611c9a PB	360	uint8_t devep = p->devep;
	361	uint8_t *data = p->data;
	362	int len = p->len;
2e5d83bb	363
4d611c9a	364	switch (p->pid) {
2e5d83bb PB	365	case USB_TOKEN_OUT:
	366	if (devep != 2)
	367	goto fail;
	368
	369	switch (s->mode) {
	370	case USB_MSDM_CBW:
	371	if (len != 31) {
	372	fprintf(stderr, "usb-msd: Bad CBW size");
	373	goto fail;
	374	}
	375	memcpy(&cbw, data, 31);
	376	if (le32_to_cpu(cbw.sig) != 0x43425355) {
	377	fprintf(stderr, "usb-msd: Bad signature %08x\n",
	378	le32_to_cpu(cbw.sig));
	379	goto fail;
	380	}
	381	DPRINTF("Command on LUN %d\n", cbw.lun);
	382	if (cbw.lun != 0) {
	383	fprintf(stderr, "usb-msd: Bad LUN %d\n", cbw.lun);
	384	goto fail;
	385	}
	386	s->tag = le32_to_cpu(cbw.tag);
	387	s->data_len = le32_to_cpu(cbw.data_len);
	388	if (s->data_len == 0) {
	389	s->mode = USB_MSDM_CSW;
	390	} else if (cbw.flags & 0x80) {
	391	s->mode = USB_MSDM_DATAIN;
	392	} else {
	393	s->mode = USB_MSDM_DATAOUT;
	394	}
	395	DPRINTF("Command tag 0x%x flags %08x len %d data %d\n",
	396	s->tag, cbw.flags, cbw.cmd_len, s->data_len);
a917d384	397	s->residue = 0;
d52affa7	398	s->scsi_dev->info->send_command(s->scsi_dev, s->tag, cbw.cmd, 0);
a917d384 PB	399	/* ??? Should check that USB and SCSI data transfer
	400	directions match. */
	401	if (s->residue == 0) {
	402	if (s->mode == USB_MSDM_DATAIN) {
d52affa7	403	s->scsi_dev->info->read_data(s->scsi_dev, s->tag);
a917d384	404	} else if (s->mode == USB_MSDM_DATAOUT) {
d52affa7	405	s->scsi_dev->info->write_data(s->scsi_dev, s->tag);
a917d384 PB	406	}
a917d384 PB	407	}
2e5d83bb PB	408	ret = len;
	409	break;
	410
	411	case USB_MSDM_DATAOUT:
	412	DPRINTF("Data out %d/%d\n", len, s->data_len);
	413	if (len > s->data_len)
	414	goto fail;
	415
a917d384 PB	416	s->usb_buf = data;
	417	s->usb_len = len;
	418	if (s->scsi_len) {
	419	usb_msd_copy_data(s);
	420	}
	421	if (s->residue && s->usb_len) {
	422	s->data_len -= s->usb_len;
	423	if (s->data_len == 0)
	424	s->mode = USB_MSDM_CSW;
	425	s->usb_len = 0;
	426	}
	427	if (s->usb_len) {
4d611c9a PB	428	DPRINTF("Deferring packet %p\n", p);
	429	usb_defer_packet(p, usb_msd_cancel_io, s);
	430	s->packet = p;
	431	ret = USB_RET_ASYNC;
a917d384 PB	432	} else {
a917d384 PB	433	ret = len;
4d611c9a	434	}
2e5d83bb PB	435	break;
	436
	437	default:
	438	DPRINTF("Unexpected write (len %d)\n", len);
	439	goto fail;
	440	}
	441	break;
	442
	443	case USB_TOKEN_IN:
	444	if (devep != 1)
	445	goto fail;
	446
	447	switch (s->mode) {
a917d384 PB	448	case USB_MSDM_DATAOUT:
	449	if (s->data_len != 0 \|\| len < 13)
	450	goto fail;
	451	/* Waiting for SCSI write to complete. */
	452	usb_defer_packet(p, usb_msd_cancel_io, s);
	453	s->packet = p;
	454	ret = USB_RET_ASYNC;
	455	break;
	456
2e5d83bb PB	457	case USB_MSDM_CSW:
	458	DPRINTF("Command status %d tag 0x%x, len %d\n",
	459	s->result, s->tag, len);
	460	if (len < 13)
	461	goto fail;
	462
a917d384 PB	463	s->usb_len = len;
	464	s->usb_buf = data;
	465	usb_msd_send_status(s);
2e5d83bb	466	s->mode = USB_MSDM_CBW;
a917d384	467	ret = 13;
2e5d83bb PB	468	break;
	469
	470	case USB_MSDM_DATAIN:
	471	DPRINTF("Data in %d/%d\n", len, s->data_len);
	472	if (len > s->data_len)
	473	len = s->data_len;
a917d384 PB	474	s->usb_buf = data;
	475	s->usb_len = len;
	476	if (s->scsi_len) {
	477	usb_msd_copy_data(s);
	478	}
	479	if (s->residue && s->usb_len) {
	480	s->data_len -= s->usb_len;
	481	memset(s->usb_buf, 0, s->usb_len);
	482	if (s->data_len == 0)
	483	s->mode = USB_MSDM_CSW;
	484	s->usb_len = 0;
	485	}
	486	if (s->usb_len) {
4d611c9a PB	487	DPRINTF("Deferring packet %p\n", p);
	488	usb_defer_packet(p, usb_msd_cancel_io, s);
	489	s->packet = p;
	490	ret = USB_RET_ASYNC;
a917d384 PB	491	} else {
a917d384 PB	492	ret = len;
4d611c9a	493	}
2e5d83bb PB	494	break;
	495
	496	default:
	497	DPRINTF("Unexpected read (len %d)\n", len);
	498	goto fail;
	499	}
	500	break;
	501
	502	default:
	503	DPRINTF("Bad token\n");
	504	fail:
	505	ret = USB_RET_STALL;
	506	break;
	507	}
	508
	509	return ret;
	510	}
	511
b3e461d3 GH	512	static void usb_msd_password_cb(void *opaque, int err)
	513	{
	514	MSDState *s = opaque;
	515
	516	if (!err)
	517	usb_device_attach(&s->dev);
	518	else
	519	qdev_unplug(&s->dev.qdev);
	520	}
	521
806b6024 GH	522	static int usb_msd_initfn(USBDevice *dev)
	523	{
	524	MSDState *s = DO_UPCAST(MSDState, dev, dev);
f8b6cc00	525	BlockDriverState *bs = s->conf.bs;
806b6024	526
f8b6cc00	527	if (!bs) {
1ecda02b	528	error_report("usb-msd: drive property not set");
7fc2f2c0 GH	529	return -1;
	530	}
	531
14bafc54 MA	532	/*
	533	* Hack alert: this pretends to be a block device, but it's really
	534	* a SCSI bus that can serve only a single device, which it
18846dee MA	535	* creates automatically. But first it needs to detach from its
	536	* blockdev, or else scsi_bus_legacy_add_drive() dies when it
	537	* attaches again.
14bafc54 MA	538	*
	539	* The hack is probably a bad idea.
	540	*/
18846dee	541	bdrv_detach(bs, &s->dev.qdev);
f8b6cc00	542	s->conf.bs = NULL;
14bafc54	543
806b6024	544	s->dev.speed = USB_SPEED_FULL;
ca9c39fa	545	scsi_bus_new(&s->bus, &s->dev.qdev, 0, 1, usb_msd_command_complete);
f8b6cc00	546	s->scsi_dev = scsi_bus_legacy_add_drive(&s->bus, bs, 0);
fa66b909 MA	547	if (!s->scsi_dev) {
	548	return -1;
	549	}
cb23117b	550	s->bus.qbus.allow_hotplug = 0;
7fc2f2c0	551	usb_msd_handle_reset(dev);
b3e461d3	552
f8b6cc00	553	if (bdrv_key_required(bs)) {
a4426488	554	if (cur_mon) {
f8b6cc00	555	monitor_read_bdrv_key_start(cur_mon, bs, usb_msd_password_cb, s);
b3e461d3 GH	556	s->dev.auto_attach = 0;
	557	} else {
	558	autostart = 0;
	559	}
	560	}
	561
806b6024 GH	562	return 0;
	563	}
	564
b3e461d3	565	static USBDevice usb_msd_init(const char filename)
2e5d83bb	566	{
7fc2f2c0 GH	567	static int nr=0;
	568	char id[8];
	569	QemuOpts *opts;
	570	DriveInfo *dinfo;
806b6024	571	USBDevice *dev;
7fc2f2c0	572	int fatal_error;
334c0241 AJ	573	const char *p1;
	574	char fmt[32];
	575
7fc2f2c0 GH	576	/* parse -usbdevice disk: syntax into drive opts */
	577	snprintf(id, sizeof(id), "usb%d", nr++);
	578	opts = qemu_opts_create(&qemu_drive_opts, id, 0);
	579
334c0241 AJ	580	p1 = strchr(filename, ':');
	581	if (p1++) {
	582	const char *p2;
	583
	584	if (strstart(filename, "format=", &p2)) {
	585	int len = MIN(p1 - p2, sizeof(fmt));
	586	pstrcpy(fmt, len, p2);
7fc2f2c0	587	qemu_opt_set(opts, "format", fmt);
334c0241 AJ	588	} else if (*filename != ':') {
	589	printf("unrecognized USB mass-storage option %s\n", filename);
	590	return NULL;
	591	}
334c0241 AJ	592	filename = p1;
334c0241 AJ	593	}
334c0241 AJ	594	if (!*filename) {
	595	printf("block device specification needed\n");
	596	return NULL;
	597	}
7fc2f2c0 GH	598	qemu_opt_set(opts, "file", filename);
7fc2f2c0 GH	599	qemu_opt_set(opts, "if", "none");
2e5d83bb	600
7fc2f2c0	601	/* create host drive */
a803cb8e	602	dinfo = drive_init(opts, 0, &fatal_error);
7fc2f2c0 GH	603	if (!dinfo) {
7fc2f2c0 GH	604	qemu_opts_del(opts);
806b6024	605	return NULL;
7fc2f2c0	606	}
2e5d83bb	607
7fc2f2c0	608	/* create guest device */
556cd098	609	dev = usb_create(NULL /* FIXME */, "usb-storage");
d44168ff PB	610	if (!dev) {
	611	return NULL;
	612	}
18846dee MA	613	if (qdev_prop_set_drive(&dev->qdev, "drive", dinfo->bdrv) < 0) {
	614	qdev_free(&dev->qdev);
	615	return NULL;
	616	}
33e66b86 MA	617	if (qdev_init(&dev->qdev) < 0)
33e66b86 MA	618	return NULL;
1f6e24e7	619
7fc2f2c0	620	return dev;
2e5d83bb	621	}
bb5fc20f	622
806b6024	623	static struct USBDeviceInfo msd_info = {
06384698	624	.product_desc = "QEMU USB MSD",
556cd098	625	.qdev.name = "usb-storage",
806b6024 GH	626	.qdev.size = sizeof(MSDState),
	627	.init = usb_msd_initfn,
	628	.handle_packet = usb_generic_handle_packet,
	629	.handle_reset = usb_msd_handle_reset,
	630	.handle_control = usb_msd_handle_control,
	631	.handle_data = usb_msd_handle_data,
b3e461d3 GH	632	.usbdevice_name = "disk",
b3e461d3 GH	633	.usbdevice_init = usb_msd_init,
7fc2f2c0	634	.qdev.props = (Property[]) {
428c149b	635	DEFINE_BLOCK_PROPERTIES(MSDState, conf),
7fc2f2c0 GH	636	DEFINE_PROP_END_OF_LIST(),
7fc2f2c0 GH	637	},
806b6024 GH	638	};
	639
	640	static void usb_msd_register_devices(void)
	641	{
	642	usb_qdev_register(&msd_info);
	643	}
	644	device_init(usb_msd_register_devices)