cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

usb.rst (13388B)


      1.. _pcsys_005fusb:
      2
      3USB emulation
      4-------------
      5
      6QEMU can emulate a PCI UHCI, OHCI, EHCI or XHCI USB controller. You can
      7plug virtual USB devices or real host USB devices (only works with
      8certain host operating systems). QEMU will automatically create and
      9connect virtual USB hubs as necessary to connect multiple USB devices.
     10
     11USB controllers
     12~~~~~~~~~~~~~~~
     13
     14XHCI controller support
     15^^^^^^^^^^^^^^^^^^^^^^^
     16
     17QEMU has XHCI host adapter support.  The XHCI hardware design is much
     18more virtualization-friendly when compared to EHCI and UHCI, thus XHCI
     19emulation uses less resources (especially CPU).  So if your guest
     20supports XHCI (which should be the case for any operating system
     21released around 2010 or later) we recommend using it:
     22
     23    qemu -device qemu-xhci
     24
     25XHCI supports USB 1.1, USB 2.0 and USB 3.0 devices, so this is the
     26only controller you need.  With only a single USB controller (and
     27therefore only a single USB bus) present in the system there is no
     28need to use the bus= parameter when adding USB devices.
     29
     30
     31EHCI controller support
     32^^^^^^^^^^^^^^^^^^^^^^^
     33
     34The QEMU EHCI Adapter supports USB 2.0 devices.  It can be used either
     35standalone or with companion controllers (UHCI, OHCI) for USB 1.1
     36devices.  The companion controller setup is more convenient to use
     37because it provides a single USB bus supporting both USB 2.0 and USB
     381.1 devices.  See next section for details.
     39
     40When running EHCI in standalone mode you can add UHCI or OHCI
     41controllers for USB 1.1 devices too.  Each controller creates its own
     42bus though, so there are two completely separate USB buses: One USB
     431.1 bus driven by the UHCI controller and one USB 2.0 bus driven by
     44the EHCI controller.  Devices must be attached to the correct
     45controller manually.
     46
     47The easiest way to add a UHCI controller to a ``pc`` machine is the
     48``-usb`` switch.  QEMU will create the UHCI controller as function of
     49the PIIX3 chipset.  The USB 1.1 bus will carry the name ``usb-bus.0``.
     50
     51You can use the standard ``-device`` switch to add a EHCI controller to
     52your virtual machine.  It is strongly recommended to specify an ID for
     53the controller so the USB 2.0 bus gets an individual name, for example
     54``-device usb-ehci,id=ehci``.  This will give you a USB 2.0 bus named
     55``ehci.0``.
     56
     57When adding USB devices using the ``-device`` switch you can specify the
     58bus they should be attached to.  Here is a complete example:
     59
     60.. parsed-literal::
     61
     62    |qemu_system| -M pc ${otheroptions}                        \\
     63        -drive if=none,id=usbstick,format=raw,file=/path/to/image   \\
     64        -usb                                                        \\
     65        -device usb-ehci,id=ehci                                    \\
     66        -device usb-tablet,bus=usb-bus.0                            \\
     67        -device usb-storage,bus=ehci.0,drive=usbstick
     68
     69This attaches a USB tablet to the UHCI adapter and a USB mass storage
     70device to the EHCI adapter.
     71
     72
     73Companion controller support
     74^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     75
     76The UHCI and OHCI controllers can attach to a USB bus created by EHCI
     77as companion controllers.  This is done by specifying the ``masterbus``
     78and ``firstport`` properties.  ``masterbus`` specifies the bus name the
     79controller should attach to.  ``firstport`` specifies the first port the
     80controller should attach to, which is needed as usually one EHCI
     81controller with six ports has three UHCI companion controllers with
     82two ports each.
     83
     84There is a config file in docs which will do all this for
     85you, which you can use like this:
     86
     87.. parsed-literal::
     88
     89   |qemu_system| -readconfig docs/config/ich9-ehci-uhci.cfg
     90
     91Then use ``bus=ehci.0`` to assign your USB devices to that bus.
     92
     93Using the ``-usb`` switch for ``q35`` machines will create a similar
     94USB controller configuration.
     95
     96
     97.. _Connecting USB devices:
     98
     99Connecting USB devices
    100~~~~~~~~~~~~~~~~~~~~~~
    101
    102USB devices can be connected with the ``-device usb-...`` command line
    103option or the ``device_add`` monitor command. Available devices are:
    104
    105``usb-mouse``
    106   Virtual Mouse. This will override the PS/2 mouse emulation when
    107   activated.
    108
    109``usb-tablet``
    110   Pointer device that uses absolute coordinates (like a touchscreen).
    111   This means QEMU is able to report the mouse position without having
    112   to grab the mouse. Also overrides the PS/2 mouse emulation when
    113   activated.
    114
    115``usb-storage,drive=drive_id``
    116   Mass storage device backed by drive_id (see the :ref:`disk images`
    117   chapter in the System Emulation Users Guide). This is the classic
    118   bulk-only transport protocol used by 99% of USB sticks. This
    119   example shows it connected to an XHCI USB controller and with
    120   a drive backed by a raw format disk image:
    121
    122   .. parsed-literal::
    123
    124       |qemu_system| [...]                                   \\
    125        -drive if=none,id=stick,format=raw,file=/path/to/file.img \\
    126        -device nec-usb-xhci,id=xhci                              \\
    127        -device usb-storage,bus=xhci.0,drive=stick
    128
    129``usb-uas``
    130   USB attached SCSI device. This does not create a SCSI disk, so
    131   you need to explicitly create a ``scsi-hd`` or ``scsi-cd`` device
    132   on the command line, as well as using the ``-drive`` option to
    133   specify what those disks are backed by. One ``usb-uas`` device can
    134   handle multiple logical units (disks). This example creates three
    135   logical units: two disks and one cdrom drive:
    136
    137   .. parsed-literal::
    138
    139      |qemu_system| [...]                                         \\
    140       -drive if=none,id=uas-disk1,format=raw,file=/path/to/file1.img  \\
    141       -drive if=none,id=uas-disk2,format=raw,file=/path/to/file2.img  \\
    142       -drive if=none,id=uas-cdrom,media=cdrom,format=raw,file=/path/to/image.iso \\
    143       -device nec-usb-xhci,id=xhci                                    \\
    144       -device usb-uas,id=uas,bus=xhci.0                               \\
    145       -device scsi-hd,bus=uas.0,scsi-id=0,lun=0,drive=uas-disk1       \\
    146       -device scsi-hd,bus=uas.0,scsi-id=0,lun=1,drive=uas-disk2       \\
    147       -device scsi-cd,bus=uas.0,scsi-id=0,lun=5,drive=uas-cdrom
    148
    149``usb-bot``
    150   Bulk-only transport storage device. This presents the guest with the
    151   same USB bulk-only transport protocol interface as ``usb-storage``, but
    152   the QEMU command line option works like ``usb-uas`` and does not
    153   automatically create SCSI disks for you. ``usb-bot`` supports up to
    154   16 LUNs. Unlike ``usb-uas``, the LUN numbers must be continuous,
    155   i.e. for three devices you must use 0+1+2. The 0+1+5 numbering from the
    156   ``usb-uas`` example above won't work with ``usb-bot``.
    157
    158``usb-mtp,rootdir=dir``
    159   Media transfer protocol device, using dir as root of the file tree
    160   that is presented to the guest.
    161
    162``usb-host,hostbus=bus,hostaddr=addr``
    163   Pass through the host device identified by bus and addr
    164
    165``usb-host,vendorid=vendor,productid=product``
    166   Pass through the host device identified by vendor and product ID
    167
    168``usb-wacom-tablet``
    169   Virtual Wacom PenPartner tablet. This device is similar to the
    170   ``tablet`` above but it can be used with the tslib library because in
    171   addition to touch coordinates it reports touch pressure.
    172
    173``usb-kbd``
    174   Standard USB keyboard. Will override the PS/2 keyboard (if present).
    175
    176``usb-serial,chardev=id``
    177   Serial converter. This emulates an FTDI FT232BM chip connected to
    178   host character device id.
    179
    180``usb-braille,chardev=id``
    181   Braille device. This will use BrlAPI to display the braille output on
    182   a real or fake device referenced by id.
    183
    184``usb-net[,netdev=id]``
    185   Network adapter that supports CDC ethernet and RNDIS protocols. id
    186   specifies a netdev defined with ``-netdev …,id=id``. For instance,
    187   user-mode networking can be used with
    188
    189   .. parsed-literal::
    190
    191      |qemu_system| [...] -netdev user,id=net0 -device usb-net,netdev=net0
    192
    193``usb-ccid``
    194   Smartcard reader device
    195
    196``usb-audio``
    197   USB audio device
    198
    199``u2f-{emulated,passthru}``
    200   Universal Second Factor device
    201
    202Physical port addressing
    203^^^^^^^^^^^^^^^^^^^^^^^^
    204
    205For all the above USB devices, by default QEMU will plug the device
    206into the next available port on the specified USB bus, or onto
    207some available USB bus if you didn't specify one explicitly.
    208If you need to, you can also specify the physical port where
    209the device will show up in the guest.  This can be done using the
    210``port`` property.  UHCI has two root ports (1,2).  EHCI has six root
    211ports (1-6), and the emulated (1.1) USB hub has eight ports.
    212
    213Plugging a tablet into UHCI port 1 works like this::
    214
    215        -device usb-tablet,bus=usb-bus.0,port=1
    216
    217Plugging a hub into UHCI port 2 works like this::
    218
    219        -device usb-hub,bus=usb-bus.0,port=2
    220
    221Plugging a virtual USB stick into port 4 of the hub just plugged works
    222this way::
    223
    224        -device usb-storage,bus=usb-bus.0,port=2.4,drive=...
    225
    226In the monitor, the ``device_add` command also accepts a ``port``
    227property specification. If you want to unplug devices too you should
    228specify some unique id which you can use to refer to the device.
    229You can then use ``device_del`` to unplug the device later.
    230For example::
    231
    232        (qemu) device_add usb-tablet,bus=usb-bus.0,port=1,id=my-tablet
    233        (qemu) device_del my-tablet
    234
    235Hotplugging USB storage
    236~~~~~~~~~~~~~~~~~~~~~~~
    237
    238The ``usb-bot`` and ``usb-uas`` devices can be hotplugged.  In the hotplug
    239case they are added with ``attached = false`` so the guest will not see
    240the device until the ``attached`` property is explicitly set to true.
    241That allows you to attach one or more scsi devices before making the
    242device visible to the guest. The workflow looks like this:
    243
    244#. ``device-add usb-bot,id=foo``
    245#. ``device-add scsi-{hd,cd},bus=foo.0,lun=0``
    246#. optionally add more devices (luns 1 ... 15)
    247#. ``scripts/qmp/qom-set foo.attached = true``
    248
    249.. _host_005fusb_005fdevices:
    250
    251Using host USB devices on a Linux host
    252~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    253
    254WARNING: this is an experimental feature. QEMU will slow down when using
    255it. USB devices requiring real time streaming (i.e. USB Video Cameras)
    256are not supported yet.
    257
    2581. If you use an early Linux 2.4 kernel, verify that no Linux driver is
    259   actually using the USB device. A simple way to do that is simply to
    260   disable the corresponding kernel module by renaming it from
    261   ``mydriver.o`` to ``mydriver.o.disabled``.
    262
    2632. Verify that ``/proc/bus/usb`` is working (most Linux distributions
    264   should enable it by default). You should see something like that:
    265
    266   ::
    267
    268      ls /proc/bus/usb
    269      001  devices  drivers
    270
    2713. Since only root can access to the USB devices directly, you can
    272   either launch QEMU as root or change the permissions of the USB
    273   devices you want to use. For testing, the following suffices:
    274
    275   ::
    276
    277      chown -R myuid /proc/bus/usb
    278
    2794. Launch QEMU and do in the monitor:
    280
    281   ::
    282
    283      info usbhost
    284        Device 1.2, speed 480 Mb/s
    285          Class 00: USB device 1234:5678, USB DISK
    286
    287   You should see the list of the devices you can use (Never try to use
    288   hubs, it won't work).
    289
    2905. Add the device in QEMU by using:
    291
    292   ::
    293
    294      device_add usb-host,vendorid=0x1234,productid=0x5678
    295
    296   Normally the guest OS should report that a new USB device is plugged.
    297   You can use the option ``-device usb-host,...`` to do the same.
    298
    2996. Now you can try to use the host USB device in QEMU.
    300
    301When relaunching QEMU, you may have to unplug and plug again the USB
    302device to make it work again (this is a bug).
    303
    304``usb-host`` properties for specifying the host device
    305^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    306
    307The example above uses the ``vendorid`` and ``productid`` to
    308specify which host device to pass through, but this is not
    309the only way to specify the host device. ``usb-host`` supports
    310the following properties:
    311
    312``hostbus=<nr>``
    313  Specifies the bus number the device must be attached to
    314``hostaddr=<nr>``
    315  Specifies the device address the device got assigned by the guest os
    316``hostport=<str>``
    317  Specifies the physical port the device is attached to
    318``vendorid=<hexnr>``
    319  Specifies the vendor ID of the device
    320``productid=<hexnr>``
    321  Specifies the product ID of the device.
    322
    323In theory you can combine all these properties as you like.  In
    324practice only a few combinations are useful:
    325
    326- ``vendorid`` and ``productid`` -- match for a specific device, pass it to
    327  the guest when it shows up somewhere in the host.
    328
    329- ``hostbus`` and ``hostport`` -- match for a specific physical port in the
    330  host, any device which is plugged in there gets passed to the
    331  guest.
    332
    333- ``hostbus`` and ``hostaddr`` -- most useful for ad-hoc pass through as the
    334  hostaddr isn't stable. The next time you plug the device into the host it
    335  will get a new hostaddr.
    336
    337Note that on the host USB 1.1 devices are handled by UHCI/OHCI and USB
    3382.0 by EHCI.  That means different USB devices plugged into the very
    339same physical port on the host may show up on different host buses
    340depending on the speed. Supposing that devices plugged into a given
    341physical port appear as bus 1 + port 1 for 2.0 devices and bus 3 + port 1
    342for 1.1 devices, you can pass through any device plugged into that port
    343and also assign it to the correct USB bus in QEMU like this:
    344
    345.. parsed-literal::
    346
    347   |qemu_system| -M pc [...]                            \\
    348        -usb                                                 \\
    349        -device usb-ehci,id=ehci                             \\
    350        -device usb-host,bus=usb-bus.0,hostbus=3,hostport=1  \\
    351        -device usb-host,bus=ehci.0,hostbus=1,hostport=1