1 /*
2 * USB redirector usb-guest
3 *
4 * Copyright (c) 2011-2012 Red Hat, Inc.
5 *
6 * Red Hat Authors:
7 * Hans de Goede <hdegoede@redhat.com>
8 *
9 * Permission is hereby granted, free of charge, to any person obtaining a copy
10 * of this software and associated documentation files (the "Software"), to deal
11 * in the Software without restriction, including without limitation the rights
12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13 * copies of the Software, and to permit persons to whom the Software is
14 * furnished to do so, subject to the following conditions:
15 *
16 * The above copyright notice and this permission notice shall be included in
17 * all copies or substantial portions of the Software.
18 *
19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 * THE SOFTWARE.
26 */
27
28 #include "qemu/osdep.h"
29 #include "qemu/cutils.h"
30 #include "qemu/units.h"
31 #include "qapi/error.h"
32 #include "qemu/timer.h"
33 #include "sysemu/runstate.h"
34 #include "sysemu/sysemu.h"
35 #include "qapi/qmp/qerror.h"
36 #include "qemu/error-report.h"
37 #include "qemu/iov.h"
38 #include "qemu/module.h"
39 #include "chardev/char-fe.h"
40
41 #include <usbredirparser.h>
42 #include <usbredirfilter.h>
43
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "hw/usb.h"
47 #include "migration/qemu-file-types.h"
48 #include "migration/vmstate.h"
49 #include "qom/object.h"
50
51 /* ERROR is defined below. Remove any previous definition. */
52 #undef ERROR
53
54 #define MAX_ENDPOINTS 32
55 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
56 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
57 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
58 #define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
59 ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
60 #define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
61 ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
62 (i) & 0x0f))
63
64 #ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
65 #define USBREDIR_VERSION 0
66 #endif
67
68 typedef struct USBRedirDevice USBRedirDevice;
69
70 /* Struct to hold buffered packets */
71 struct buf_packet {
72 uint8_t *data;
73 void *free_on_destroy;
74 uint16_t len;
75 uint16_t offset;
76 uint8_t status;
77 QTAILQ_ENTRY(buf_packet)next;
78 };
79
80 struct endp_data {
81 USBRedirDevice *dev;
82 uint8_t type;
83 uint8_t interval;
84 uint8_t interface; /* bInterfaceNumber this ep belongs to */
85 uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
86 uint32_t max_streams;
87 uint8_t iso_started;
88 uint8_t iso_error; /* For reporting iso errors to the HC */
89 uint8_t interrupt_started;
90 uint8_t interrupt_error;
91 uint8_t bulk_receiving_enabled;
92 uint8_t bulk_receiving_started;
93 uint8_t bufpq_prefilled;
94 uint8_t bufpq_dropping_packets;
95 QTAILQ_HEAD(, buf_packet) bufpq;
96 int32_t bufpq_size;
97 int32_t bufpq_target_size;
98 USBPacket *pending_async_packet;
99 };
100
101 struct PacketIdQueueEntry {
102 uint64_t id;
103 QTAILQ_ENTRY(PacketIdQueueEntry)next;
104 };
105
106 struct PacketIdQueue {
107 USBRedirDevice *dev;
108 const char *name;
109 QTAILQ_HEAD(, PacketIdQueueEntry) head;
110 int size;
111 };
112
113 struct USBRedirDevice {
114 USBDevice dev;
115 /* Properties */
116 CharBackend cs;
117 bool enable_streams;
118 bool suppress_remote_wake;
119 bool in_write;
120 uint8_t debug;
121 int32_t bootindex;
122 char *filter_str;
123 /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
124 const uint8_t *read_buf;
125 int read_buf_size;
126 /* Active chardev-watch-tag */
127 guint watch;
128 /* For async handling of close / reject */
129 QEMUBH *chardev_close_bh;
130 QEMUBH *device_reject_bh;
131 /* To delay the usb attach in case of quick chardev close + open */
132 QEMUTimer *attach_timer;
133 int64_t next_attach_time;
134 struct usbredirparser *parser;
135 struct endp_data endpoint[MAX_ENDPOINTS];
136 struct PacketIdQueue cancelled;
137 struct PacketIdQueue already_in_flight;
138 void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
139 /* Data for device filtering */
140 struct usb_redir_device_connect_header device_info;
141 struct usb_redir_interface_info_header interface_info;
142 struct usbredirfilter_rule *filter_rules;
143 int filter_rules_count;
144 int compatible_speedmask;
145 VMChangeStateEntry *vmstate;
146 };
147
148 #define TYPE_USB_REDIR "usb-redir"
149 DECLARE_INSTANCE_CHECKER(USBRedirDevice, USB_REDIRECT,
150 TYPE_USB_REDIR)
151
152 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
153 static void usbredir_device_connect(void *priv,
154 struct usb_redir_device_connect_header *device_connect);
155 static void usbredir_device_disconnect(void *priv);
156 static void usbredir_interface_info(void *priv,
157 struct usb_redir_interface_info_header *interface_info);
158 static void usbredir_ep_info(void *priv,
159 struct usb_redir_ep_info_header *ep_info);
160 static void usbredir_configuration_status(void *priv, uint64_t id,
161 struct usb_redir_configuration_status_header *configuration_status);
162 static void usbredir_alt_setting_status(void *priv, uint64_t id,
163 struct usb_redir_alt_setting_status_header *alt_setting_status);
164 static void usbredir_iso_stream_status(void *priv, uint64_t id,
165 struct usb_redir_iso_stream_status_header *iso_stream_status);
166 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
167 struct usb_redir_interrupt_receiving_status_header
168 *interrupt_receiving_status);
169 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
170 struct usb_redir_bulk_streams_status_header *bulk_streams_status);
171 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
172 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
173 static void usbredir_control_packet(void *priv, uint64_t id,
174 struct usb_redir_control_packet_header *control_packet,
175 uint8_t *data, int data_len);
176 static void usbredir_bulk_packet(void *priv, uint64_t id,
177 struct usb_redir_bulk_packet_header *bulk_packet,
178 uint8_t *data, int data_len);
179 static void usbredir_iso_packet(void *priv, uint64_t id,
180 struct usb_redir_iso_packet_header *iso_packet,
181 uint8_t *data, int data_len);
182 static void usbredir_interrupt_packet(void *priv, uint64_t id,
183 struct usb_redir_interrupt_packet_header *interrupt_header,
184 uint8_t *data, int data_len);
185 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
186 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
187 uint8_t *data, int data_len);
188
189 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
190 int status);
191
192 #define VERSION "qemu usb-redir guest " QEMU_VERSION
193
194 /*
195 * Logging stuff
196 */
197
198 #define ERROR(...) \
199 do { \
200 if (dev->debug >= usbredirparser_error) { \
201 error_report("usb-redir error: " __VA_ARGS__); \
202 } \
203 } while (0)
204 #define WARNING(...) \
205 do { \
206 if (dev->debug >= usbredirparser_warning) { \
207 warn_report("" __VA_ARGS__); \
208 } \
209 } while (0)
210 #define INFO(...) \
211 do { \
212 if (dev->debug >= usbredirparser_info) { \
213 error_report("usb-redir: " __VA_ARGS__); \
214 } \
215 } while (0)
216 #define DPRINTF(...) \
217 do { \
218 if (dev->debug >= usbredirparser_debug) { \
219 error_report("usb-redir: " __VA_ARGS__); \
220 } \
221 } while (0)
222 #define DPRINTF2(...) \
223 do { \
224 if (dev->debug >= usbredirparser_debug_data) { \
225 error_report("usb-redir: " __VA_ARGS__); \
226 } \
227 } while (0)
228
usbredir_log(void * priv,int level,const char * msg)229 static void usbredir_log(void *priv, int level, const char *msg)
230 {
231 USBRedirDevice *dev = priv;
232
233 if (dev->debug < level) {
234 return;
235 }
236
237 error_report("%s", msg);
238 }
239
usbredir_log_data(USBRedirDevice * dev,const char * desc,const uint8_t * data,int len)240 static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
241 const uint8_t *data, int len)
242 {
243 if (dev->debug < usbredirparser_debug_data) {
244 return;
245 }
246 qemu_hexdump(stderr, desc, data, len);
247 }
248
249 /*
250 * usbredirparser io functions
251 */
252
usbredir_read(void * priv,uint8_t * data,int count)253 static int usbredir_read(void *priv, uint8_t *data, int count)
254 {
255 USBRedirDevice *dev = priv;
256
257 if (dev->read_buf_size < count) {
258 count = dev->read_buf_size;
259 }
260
261 memcpy(data, dev->read_buf, count);
262
263 dev->read_buf_size -= count;
264 if (dev->read_buf_size) {
265 dev->read_buf += count;
266 } else {
267 dev->read_buf = NULL;
268 }
269
270 return count;
271 }
272
usbredir_write_unblocked(void * do_not_use,GIOCondition cond,void * opaque)273 static gboolean usbredir_write_unblocked(void *do_not_use, GIOCondition cond,
274 void *opaque)
275 {
276 USBRedirDevice *dev = opaque;
277
278 dev->watch = 0;
279 usbredirparser_do_write(dev->parser);
280
281 return G_SOURCE_REMOVE;
282 }
283
usbredir_write(void * priv,uint8_t * data,int count)284 static int usbredir_write(void *priv, uint8_t *data, int count)
285 {
286 USBRedirDevice *dev = priv;
287 int r;
288
289 if (!qemu_chr_fe_backend_open(&dev->cs)) {
290 return 0;
291 }
292
293 /* Don't send new data to the chardev until our state is fully synced */
294 if (!runstate_check(RUN_STATE_RUNNING)) {
295 return 0;
296 }
297
298 /* Recursion check */
299 if (dev->in_write) {
300 DPRINTF("usbredir_write recursion\n");
301 return 0;
302 }
303 dev->in_write = true;
304
305 r = qemu_chr_fe_write(&dev->cs, data, count);
306 if (r < count) {
307 if (!dev->watch) {
308 dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
309 usbredir_write_unblocked, dev);
310 }
311 if (r < 0) {
312 r = 0;
313 }
314 }
315 dev->in_write = false;
316 return r;
317 }
318
319 /*
320 * Cancelled and buffered packets helpers
321 */
322
packet_id_queue_init(struct PacketIdQueue * q,USBRedirDevice * dev,const char * name)323 static void packet_id_queue_init(struct PacketIdQueue *q,
324 USBRedirDevice *dev, const char *name)
325 {
326 q->dev = dev;
327 q->name = name;
328 QTAILQ_INIT(&q->head);
329 q->size = 0;
330 }
331
packet_id_queue_add(struct PacketIdQueue * q,uint64_t id)332 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
333 {
334 USBRedirDevice *dev = q->dev;
335 struct PacketIdQueueEntry *e;
336
337 DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
338
339 e = g_new0(struct PacketIdQueueEntry, 1);
340 e->id = id;
341 QTAILQ_INSERT_TAIL(&q->head, e, next);
342 q->size++;
343 }
344
packet_id_queue_remove(struct PacketIdQueue * q,uint64_t id)345 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
346 {
347 USBRedirDevice *dev = q->dev;
348 struct PacketIdQueueEntry *e;
349
350 QTAILQ_FOREACH(e, &q->head, next) {
351 if (e->id == id) {
352 DPRINTF("removing packet id %"PRIu64" from %s queue\n",
353 id, q->name);
354 QTAILQ_REMOVE(&q->head, e, next);
355 q->size--;
356 g_free(e);
357 return 1;
358 }
359 }
360 return 0;
361 }
362
packet_id_queue_empty(struct PacketIdQueue * q)363 static void packet_id_queue_empty(struct PacketIdQueue *q)
364 {
365 USBRedirDevice *dev = q->dev;
366 struct PacketIdQueueEntry *e, *next_e;
367
368 DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
369
370 QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
371 QTAILQ_REMOVE(&q->head, e, next);
372 g_free(e);
373 }
374 q->size = 0;
375 }
376
usbredir_cancel_packet(USBDevice * udev,USBPacket * p)377 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
378 {
379 USBRedirDevice *dev = USB_REDIRECT(udev);
380 int i = USBEP2I(p->ep);
381
382 if (p->combined) {
383 usb_combined_packet_cancel(udev, p);
384 return;
385 }
386
387 if (dev->endpoint[i].pending_async_packet) {
388 assert(dev->endpoint[i].pending_async_packet == p);
389 dev->endpoint[i].pending_async_packet = NULL;
390 return;
391 }
392
393 packet_id_queue_add(&dev->cancelled, p->id);
394 usbredirparser_send_cancel_data_packet(dev->parser, p->id);
395 usbredirparser_do_write(dev->parser);
396 }
397
usbredir_is_cancelled(USBRedirDevice * dev,uint64_t id)398 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
399 {
400 if (!dev->dev.attached) {
401 return 1; /* Treat everything as cancelled after a disconnect */
402 }
403 return packet_id_queue_remove(&dev->cancelled, id);
404 }
405
usbredir_fill_already_in_flight_from_ep(USBRedirDevice * dev,struct USBEndpoint * ep)406 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
407 struct USBEndpoint *ep)
408 {
409 static USBPacket *p;
410
411 /* async handled packets for bulk receiving eps do not count as inflight */
412 if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
413 return;
414 }
415
416 QTAILQ_FOREACH(p, &ep->queue, queue) {
417 /* Skip combined packets, except for the first */
418 if (p->combined && p != p->combined->first) {
419 continue;
420 }
421 if (p->state == USB_PACKET_ASYNC) {
422 packet_id_queue_add(&dev->already_in_flight, p->id);
423 }
424 }
425 }
426
usbredir_fill_already_in_flight(USBRedirDevice * dev)427 static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
428 {
429 int ep;
430 struct USBDevice *udev = &dev->dev;
431
432 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
433
434 for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
435 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
436 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
437 }
438 }
439
usbredir_already_in_flight(USBRedirDevice * dev,uint64_t id)440 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
441 {
442 return packet_id_queue_remove(&dev->already_in_flight, id);
443 }
444
usbredir_find_packet_by_id(USBRedirDevice * dev,uint8_t ep,uint64_t id)445 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
446 uint8_t ep, uint64_t id)
447 {
448 USBPacket *p;
449
450 if (usbredir_is_cancelled(dev, id)) {
451 return NULL;
452 }
453
454 p = usb_ep_find_packet_by_id(&dev->dev,
455 (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
456 ep & 0x0f, id);
457 if (p == NULL) {
458 ERROR("could not find packet with id %"PRIu64"\n", id);
459 }
460 return p;
461 }
462
bufp_alloc(USBRedirDevice * dev,uint8_t * data,uint16_t len,uint8_t status,uint8_t ep,void * free_on_destroy)463 static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
464 uint8_t status, uint8_t ep, void *free_on_destroy)
465 {
466 struct buf_packet *bufp;
467
468 if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
469 dev->endpoint[EP2I(ep)].bufpq_size >
470 2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
471 DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
472 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
473 }
474 /* Since we're interrupting the stream anyways, drop enough packets to get
475 back to our target buffer size */
476 if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
477 if (dev->endpoint[EP2I(ep)].bufpq_size >
478 dev->endpoint[EP2I(ep)].bufpq_target_size) {
479 free(free_on_destroy);
480 return -1;
481 }
482 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
483 }
484
485 bufp = g_new(struct buf_packet, 1);
486 bufp->data = data;
487 bufp->len = len;
488 bufp->offset = 0;
489 bufp->status = status;
490 bufp->free_on_destroy = free_on_destroy;
491 QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
492 dev->endpoint[EP2I(ep)].bufpq_size++;
493 return 0;
494 }
495
bufp_free(USBRedirDevice * dev,struct buf_packet * bufp,uint8_t ep)496 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
497 uint8_t ep)
498 {
499 QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
500 dev->endpoint[EP2I(ep)].bufpq_size--;
501 free(bufp->free_on_destroy);
502 g_free(bufp);
503 }
504
usbredir_free_bufpq(USBRedirDevice * dev,uint8_t ep)505 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
506 {
507 struct buf_packet *buf, *buf_next;
508
509 QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
510 bufp_free(dev, buf, ep);
511 }
512 }
513
514 /*
515 * USBDevice callbacks
516 */
517
usbredir_handle_reset(USBDevice * udev)518 static void usbredir_handle_reset(USBDevice *udev)
519 {
520 USBRedirDevice *dev = USB_REDIRECT(udev);
521
522 DPRINTF("reset device\n");
523 usbredirparser_send_reset(dev->parser);
524 usbredirparser_do_write(dev->parser);
525 }
526
usbredir_handle_iso_data(USBRedirDevice * dev,USBPacket * p,uint8_t ep)527 static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
528 uint8_t ep)
529 {
530 int status, len;
531 if (!dev->endpoint[EP2I(ep)].iso_started &&
532 !dev->endpoint[EP2I(ep)].iso_error) {
533 struct usb_redir_start_iso_stream_header start_iso = {
534 .endpoint = ep,
535 };
536 int pkts_per_sec;
537
538 if (dev->dev.speed == USB_SPEED_HIGH) {
539 pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
540 } else {
541 pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
542 }
543 /* Testing has shown that we need circa 60 ms buffer */
544 dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
545
546 /* Aim for approx 100 interrupts / second on the client to
547 balance latency and interrupt load */
548 start_iso.pkts_per_urb = pkts_per_sec / 100;
549 if (start_iso.pkts_per_urb < 1) {
550 start_iso.pkts_per_urb = 1;
551 } else if (start_iso.pkts_per_urb > 32) {
552 start_iso.pkts_per_urb = 32;
553 }
554
555 start_iso.no_urbs = DIV_ROUND_UP(
556 dev->endpoint[EP2I(ep)].bufpq_target_size,
557 start_iso.pkts_per_urb);
558 /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
559 as overflow buffer. Also see the usbredir protocol documentation */
560 if (!(ep & USB_DIR_IN)) {
561 start_iso.no_urbs *= 2;
562 }
563 if (start_iso.no_urbs > 16) {
564 start_iso.no_urbs = 16;
565 }
566
567 /* No id, we look at the ep when receiving a status back */
568 usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
569 usbredirparser_do_write(dev->parser);
570 DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
571 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
572 dev->endpoint[EP2I(ep)].iso_started = 1;
573 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
574 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
575 }
576
577 if (ep & USB_DIR_IN) {
578 struct buf_packet *isop;
579
580 if (dev->endpoint[EP2I(ep)].iso_started &&
581 !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
582 if (dev->endpoint[EP2I(ep)].bufpq_size <
583 dev->endpoint[EP2I(ep)].bufpq_target_size) {
584 return;
585 }
586 dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
587 }
588
589 isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
590 if (isop == NULL) {
591 DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
592 ep, dev->endpoint[EP2I(ep)].iso_error);
593 /* Re-fill the buffer */
594 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
595 /* Check iso_error for stream errors, otherwise its an underrun */
596 status = dev->endpoint[EP2I(ep)].iso_error;
597 dev->endpoint[EP2I(ep)].iso_error = 0;
598 p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
599 return;
600 }
601 DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
602 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
603
604 status = isop->status;
605 len = isop->len;
606 if (len > p->iov.size) {
607 ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
608 ep, len, (int)p->iov.size);
609 len = p->iov.size;
610 status = usb_redir_babble;
611 }
612 usb_packet_copy(p, isop->data, len);
613 bufp_free(dev, isop, ep);
614 usbredir_handle_status(dev, p, status);
615 } else {
616 /* If the stream was not started because of a pending error don't
617 send the packet to the usb-host */
618 if (dev->endpoint[EP2I(ep)].iso_started) {
619 struct usb_redir_iso_packet_header iso_packet = {
620 .endpoint = ep,
621 .length = p->iov.size
622 };
623 g_autofree uint8_t *buf = g_malloc(p->iov.size);
624 /* No id, we look at the ep when receiving a status back */
625 usb_packet_copy(p, buf, p->iov.size);
626 usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
627 buf, p->iov.size);
628 usbredirparser_do_write(dev->parser);
629 }
630 status = dev->endpoint[EP2I(ep)].iso_error;
631 dev->endpoint[EP2I(ep)].iso_error = 0;
632 DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
633 p->iov.size);
634 usbredir_handle_status(dev, p, status);
635 }
636 }
637
usbredir_stop_iso_stream(USBRedirDevice * dev,uint8_t ep)638 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
639 {
640 struct usb_redir_stop_iso_stream_header stop_iso_stream = {
641 .endpoint = ep
642 };
643 if (dev->endpoint[EP2I(ep)].iso_started) {
644 usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
645 DPRINTF("iso stream stopped ep %02X\n", ep);
646 dev->endpoint[EP2I(ep)].iso_started = 0;
647 }
648 dev->endpoint[EP2I(ep)].iso_error = 0;
649 usbredir_free_bufpq(dev, ep);
650 }
651
652 /*
653 * The usb-host may poll the endpoint faster then our guest, resulting in lots
654 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
655 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
656 */
usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice * dev,struct buf_packet * bulkp,int count,USBPacket * p,uint8_t ep)657 static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
658 struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
659 {
660 usb_packet_copy(p, bulkp->data + bulkp->offset, count);
661 bulkp->offset += count;
662 if (bulkp->offset == bulkp->len) {
663 /* Store status in the last packet with data from this bulkp */
664 usbredir_handle_status(dev, p, bulkp->status);
665 bufp_free(dev, bulkp, ep);
666 }
667 }
668
usbredir_buffered_bulk_in_complete_raw(USBRedirDevice * dev,USBPacket * p,uint8_t ep)669 static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
670 USBPacket *p, uint8_t ep)
671 {
672 struct buf_packet *bulkp;
673 int count;
674
675 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
676 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
677 count = bulkp->len - bulkp->offset;
678 if (count > (p->iov.size - p->actual_length)) {
679 count = p->iov.size - p->actual_length;
680 }
681 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
682 }
683 }
684
usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice * dev,USBPacket * p,uint8_t ep)685 static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
686 USBPacket *p, uint8_t ep)
687 {
688 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
689 uint8_t header[2] = { 0, 0 };
690 struct buf_packet *bulkp;
691 int count;
692
693 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
694 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
695 if (bulkp->len < 2) {
696 WARNING("malformed ftdi bulk in packet\n");
697 bufp_free(dev, bulkp, ep);
698 continue;
699 }
700
701 if ((p->actual_length % maxp) == 0) {
702 usb_packet_copy(p, bulkp->data, 2);
703 memcpy(header, bulkp->data, 2);
704 } else {
705 if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
706 break; /* Different header, add to next packet */
707 }
708 }
709
710 if (bulkp->offset == 0) {
711 bulkp->offset = 2; /* Skip header */
712 }
713 count = bulkp->len - bulkp->offset;
714 /* Must repeat the header at maxp interval */
715 if (count > (maxp - (p->actual_length % maxp))) {
716 count = maxp - (p->actual_length % maxp);
717 }
718 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
719 }
720 }
721
usbredir_buffered_bulk_in_complete(USBRedirDevice * dev,USBPacket * p,uint8_t ep)722 static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
723 USBPacket *p, uint8_t ep)
724 {
725 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
726 dev->buffered_bulk_in_complete(dev, p, ep);
727 DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
728 ep, p->status, p->actual_length, p->id);
729 }
730
usbredir_handle_buffered_bulk_in_data(USBRedirDevice * dev,USBPacket * p,uint8_t ep)731 static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
732 USBPacket *p, uint8_t ep)
733 {
734 /* Input bulk endpoint, buffered packet input */
735 if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
736 int bpt;
737 struct usb_redir_start_bulk_receiving_header start = {
738 .endpoint = ep,
739 .stream_id = 0,
740 .no_transfers = 5,
741 };
742 /* Round bytes_per_transfer up to a multiple of max_packet_size */
743 bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
744 bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
745 bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
746 start.bytes_per_transfer = bpt;
747 /* No id, we look at the ep when receiving a status back */
748 usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
749 usbredirparser_do_write(dev->parser);
750 DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
751 start.bytes_per_transfer, start.no_transfers, ep);
752 dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
753 /* We don't really want to drop bulk packets ever, but
754 having some upper limit to how much we buffer is good. */
755 dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
756 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
757 }
758
759 if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
760 DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
761 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
762 dev->endpoint[EP2I(ep)].pending_async_packet = p;
763 p->status = USB_RET_ASYNC;
764 return;
765 }
766 usbredir_buffered_bulk_in_complete(dev, p, ep);
767 }
768
usbredir_stop_bulk_receiving(USBRedirDevice * dev,uint8_t ep)769 static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
770 {
771 struct usb_redir_stop_bulk_receiving_header stop_bulk = {
772 .endpoint = ep,
773 .stream_id = 0,
774 };
775 if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
776 usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
777 DPRINTF("bulk receiving stopped ep %02X\n", ep);
778 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
779 }
780 usbredir_free_bufpq(dev, ep);
781 }
782
usbredir_handle_bulk_data(USBRedirDevice * dev,USBPacket * p,uint8_t ep)783 static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
784 uint8_t ep)
785 {
786 struct usb_redir_bulk_packet_header bulk_packet;
787 size_t size = usb_packet_size(p);
788 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
789
790 if (usbredir_already_in_flight(dev, p->id)) {
791 p->status = USB_RET_ASYNC;
792 return;
793 }
794
795 if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
796 if (size != 0 && (size % maxp) == 0) {
797 usbredir_handle_buffered_bulk_in_data(dev, p, ep);
798 return;
799 }
800 WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
801 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
802 usbredir_stop_bulk_receiving(dev, ep);
803 dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
804 }
805
806 DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
807 ep, p->stream, size, p->id);
808
809 bulk_packet.endpoint = ep;
810 bulk_packet.length = size;
811 bulk_packet.stream_id = p->stream;
812 bulk_packet.length_high = size >> 16;
813 assert(bulk_packet.length_high == 0 ||
814 usbredirparser_peer_has_cap(dev->parser,
815 usb_redir_cap_32bits_bulk_length));
816
817 if (ep & USB_DIR_IN || size == 0) {
818 usbredirparser_send_bulk_packet(dev->parser, p->id,
819 &bulk_packet, NULL, 0);
820 } else {
821 g_autofree uint8_t *buf = g_malloc(size);
822 usb_packet_copy(p, buf, size);
823 usbredir_log_data(dev, "bulk data out:", buf, size);
824 usbredirparser_send_bulk_packet(dev->parser, p->id,
825 &bulk_packet, buf, size);
826 }
827 usbredirparser_do_write(dev->parser);
828 p->status = USB_RET_ASYNC;
829 }
830
usbredir_handle_interrupt_in_data(USBRedirDevice * dev,USBPacket * p,uint8_t ep)831 static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
832 USBPacket *p, uint8_t ep)
833 {
834 /* Input interrupt endpoint, buffered packet input */
835 struct buf_packet *intp, *intp_to_free;
836 int status, len, sum;
837
838 if (!dev->endpoint[EP2I(ep)].interrupt_started &&
839 !dev->endpoint[EP2I(ep)].interrupt_error) {
840 struct usb_redir_start_interrupt_receiving_header start_int = {
841 .endpoint = ep,
842 };
843 /* No id, we look at the ep when receiving a status back */
844 usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
845 &start_int);
846 usbredirparser_do_write(dev->parser);
847 DPRINTF("interrupt recv started ep %02X\n", ep);
848 dev->endpoint[EP2I(ep)].interrupt_started = 1;
849 /* We don't really want to drop interrupt packets ever, but
850 having some upper limit to how much we buffer is good. */
851 dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
852 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
853 }
854
855 /* check for completed interrupt message (with all fragments) */
856 sum = 0;
857 QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
858 sum += intp->len;
859 if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
860 sum >= p->iov.size)
861 break;
862 }
863
864 if (intp == NULL) {
865 DPRINTF2("interrupt-token-in ep %02X, no intp, buffered %d\n", ep, sum);
866 /* Check interrupt_error for stream errors */
867 status = dev->endpoint[EP2I(ep)].interrupt_error;
868 dev->endpoint[EP2I(ep)].interrupt_error = 0;
869 if (status) {
870 usbredir_handle_status(dev, p, status);
871 } else {
872 p->status = USB_RET_NAK;
873 }
874 return;
875 }
876
877 /* copy of completed interrupt message */
878 sum = 0;
879 status = usb_redir_success;
880 intp_to_free = NULL;
881 QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
882 if (intp_to_free) {
883 bufp_free(dev, intp_to_free, ep);
884 }
885 DPRINTF("interrupt-token-in ep %02X fragment status %d len %d\n", ep,
886 intp->status, intp->len);
887
888 sum += intp->len;
889 len = intp->len;
890 if (status == usb_redir_success) {
891 status = intp->status;
892 }
893 if (sum > p->iov.size) {
894 ERROR("received int data is larger then packet ep %02X\n", ep);
895 len -= (sum - p->iov.size);
896 sum = p->iov.size;
897 status = usb_redir_babble;
898 }
899
900 usb_packet_copy(p, intp->data, len);
901
902 intp_to_free = intp;
903 if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
904 sum >= p->iov.size)
905 break;
906 }
907 if (intp_to_free) {
908 bufp_free(dev, intp_to_free, ep);
909 }
910 DPRINTF("interrupt-token-in ep %02X summary status %d len %d\n", ep,
911 status, sum);
912 usbredir_handle_status(dev, p, status);
913 }
914
915 /*
916 * Handle interrupt out data, the usbredir protocol expects us to do this
917 * async, so that it can report back a completion status. But guests will
918 * expect immediate completion for an interrupt endpoint, and handling this
919 * async causes migration issues. So we report success directly, counting
920 * on the fact that output interrupt packets normally always succeed.
921 */
usbredir_handle_interrupt_out_data(USBRedirDevice * dev,USBPacket * p,uint8_t ep)922 static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
923 USBPacket *p, uint8_t ep)
924 {
925 struct usb_redir_interrupt_packet_header interrupt_packet;
926 g_autofree uint8_t *buf = g_malloc(p->iov.size);
927
928 DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
929 p->iov.size, p->id);
930
931 interrupt_packet.endpoint = ep;
932 interrupt_packet.length = p->iov.size;
933
934 usb_packet_copy(p, buf, p->iov.size);
935 usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
936 usbredirparser_send_interrupt_packet(dev->parser, p->id,
937 &interrupt_packet, buf, p->iov.size);
938 usbredirparser_do_write(dev->parser);
939 }
940
usbredir_stop_interrupt_receiving(USBRedirDevice * dev,uint8_t ep)941 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
942 uint8_t ep)
943 {
944 struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
945 .endpoint = ep
946 };
947 if (dev->endpoint[EP2I(ep)].interrupt_started) {
948 usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
949 &stop_interrupt_recv);
950 DPRINTF("interrupt recv stopped ep %02X\n", ep);
951 dev->endpoint[EP2I(ep)].interrupt_started = 0;
952 }
953 dev->endpoint[EP2I(ep)].interrupt_error = 0;
954 usbredir_free_bufpq(dev, ep);
955 }
956
usbredir_handle_data(USBDevice * udev,USBPacket * p)957 static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
958 {
959 USBRedirDevice *dev = USB_REDIRECT(udev);
960 uint8_t ep;
961
962 ep = p->ep->nr;
963 if (p->pid == USB_TOKEN_IN) {
964 ep |= USB_DIR_IN;
965 }
966
967 switch (dev->endpoint[EP2I(ep)].type) {
968 case USB_ENDPOINT_XFER_CONTROL:
969 ERROR("handle_data called for control transfer on ep %02X\n", ep);
970 p->status = USB_RET_NAK;
971 break;
972 case USB_ENDPOINT_XFER_BULK:
973 if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
974 p->ep->pipeline) {
975 p->status = USB_RET_ADD_TO_QUEUE;
976 break;
977 }
978 usbredir_handle_bulk_data(dev, p, ep);
979 break;
980 case USB_ENDPOINT_XFER_ISOC:
981 usbredir_handle_iso_data(dev, p, ep);
982 break;
983 case USB_ENDPOINT_XFER_INT:
984 if (ep & USB_DIR_IN) {
985 usbredir_handle_interrupt_in_data(dev, p, ep);
986 } else {
987 usbredir_handle_interrupt_out_data(dev, p, ep);
988 }
989 break;
990 default:
991 ERROR("handle_data ep %02X has unknown type %d\n", ep,
992 dev->endpoint[EP2I(ep)].type);
993 p->status = USB_RET_NAK;
994 }
995 }
996
usbredir_flush_ep_queue(USBDevice * dev,USBEndpoint * ep)997 static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
998 {
999 if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
1000 usb_ep_combine_input_packets(ep);
1001 }
1002 }
1003
usbredir_stop_ep(USBRedirDevice * dev,int i)1004 static void usbredir_stop_ep(USBRedirDevice *dev, int i)
1005 {
1006 uint8_t ep = I2EP(i);
1007
1008 switch (dev->endpoint[i].type) {
1009 case USB_ENDPOINT_XFER_BULK:
1010 if (ep & USB_DIR_IN) {
1011 usbredir_stop_bulk_receiving(dev, ep);
1012 }
1013 break;
1014 case USB_ENDPOINT_XFER_ISOC:
1015 usbredir_stop_iso_stream(dev, ep);
1016 break;
1017 case USB_ENDPOINT_XFER_INT:
1018 if (ep & USB_DIR_IN) {
1019 usbredir_stop_interrupt_receiving(dev, ep);
1020 }
1021 break;
1022 }
1023 usbredir_free_bufpq(dev, ep);
1024 }
1025
usbredir_ep_stopped(USBDevice * udev,USBEndpoint * uep)1026 static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
1027 {
1028 USBRedirDevice *dev = USB_REDIRECT(udev);
1029
1030 usbredir_stop_ep(dev, USBEP2I(uep));
1031 usbredirparser_do_write(dev->parser);
1032 }
1033
usbredir_set_config(USBRedirDevice * dev,USBPacket * p,int config)1034 static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
1035 int config)
1036 {
1037 struct usb_redir_set_configuration_header set_config;
1038 int i;
1039
1040 DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
1041
1042 for (i = 0; i < MAX_ENDPOINTS; i++) {
1043 usbredir_stop_ep(dev, i);
1044 }
1045
1046 set_config.configuration = config;
1047 usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
1048 usbredirparser_do_write(dev->parser);
1049 p->status = USB_RET_ASYNC;
1050 }
1051
usbredir_get_config(USBRedirDevice * dev,USBPacket * p)1052 static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1053 {
1054 DPRINTF("get config id %"PRIu64"\n", p->id);
1055
1056 usbredirparser_send_get_configuration(dev->parser, p->id);
1057 usbredirparser_do_write(dev->parser);
1058 p->status = USB_RET_ASYNC;
1059 }
1060
usbredir_set_interface(USBRedirDevice * dev,USBPacket * p,int interface,int alt)1061 static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1062 int interface, int alt)
1063 {
1064 struct usb_redir_set_alt_setting_header set_alt;
1065 int i;
1066
1067 DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1068
1069 for (i = 0; i < MAX_ENDPOINTS; i++) {
1070 if (dev->endpoint[i].interface == interface) {
1071 usbredir_stop_ep(dev, i);
1072 }
1073 }
1074
1075 set_alt.interface = interface;
1076 set_alt.alt = alt;
1077 usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1078 usbredirparser_do_write(dev->parser);
1079 p->status = USB_RET_ASYNC;
1080 }
1081
usbredir_get_interface(USBRedirDevice * dev,USBPacket * p,int interface)1082 static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1083 int interface)
1084 {
1085 struct usb_redir_get_alt_setting_header get_alt;
1086
1087 DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1088
1089 get_alt.interface = interface;
1090 usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1091 usbredirparser_do_write(dev->parser);
1092 p->status = USB_RET_ASYNC;
1093 }
1094
usbredir_handle_control(USBDevice * udev,USBPacket * p,int request,int value,int index,int length,uint8_t * data)1095 static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1096 int request, int value, int index, int length, uint8_t *data)
1097 {
1098 USBRedirDevice *dev = USB_REDIRECT(udev);
1099 struct usb_redir_control_packet_header control_packet;
1100
1101 if (usbredir_already_in_flight(dev, p->id)) {
1102 p->status = USB_RET_ASYNC;
1103 return;
1104 }
1105
1106 /* Special cases for certain standard device requests */
1107 switch (request) {
1108 case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1109 DPRINTF("set address %d\n", value);
1110 dev->dev.addr = value;
1111 return;
1112 case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1113 usbredir_set_config(dev, p, value & 0xff);
1114 return;
1115 case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1116 usbredir_get_config(dev, p);
1117 return;
1118 case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1119 usbredir_set_interface(dev, p, index, value);
1120 return;
1121 case InterfaceRequest | USB_REQ_GET_INTERFACE:
1122 usbredir_get_interface(dev, p, index);
1123 return;
1124 }
1125
1126 /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1127 DPRINTF(
1128 "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1129 request >> 8, request & 0xff, value, index, length, p->id);
1130
1131 control_packet.request = request & 0xFF;
1132 control_packet.requesttype = request >> 8;
1133 control_packet.endpoint = control_packet.requesttype & USB_DIR_IN;
1134 control_packet.value = value;
1135 control_packet.index = index;
1136 control_packet.length = length;
1137
1138 if (control_packet.requesttype & USB_DIR_IN) {
1139 usbredirparser_send_control_packet(dev->parser, p->id,
1140 &control_packet, NULL, 0);
1141 } else {
1142 usbredir_log_data(dev, "ctrl data out:", data, length);
1143 usbredirparser_send_control_packet(dev->parser, p->id,
1144 &control_packet, data, length);
1145 }
1146 usbredirparser_do_write(dev->parser);
1147 p->status = USB_RET_ASYNC;
1148 }
1149
usbredir_alloc_streams(USBDevice * udev,USBEndpoint ** eps,int nr_eps,int streams)1150 static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1151 int nr_eps, int streams)
1152 {
1153 USBRedirDevice *dev = USB_REDIRECT(udev);
1154 #if USBREDIR_VERSION >= 0x000700
1155 struct usb_redir_alloc_bulk_streams_header alloc_streams;
1156 int i;
1157
1158 if (!usbredirparser_peer_has_cap(dev->parser,
1159 usb_redir_cap_bulk_streams)) {
1160 ERROR("peer does not support streams\n");
1161 goto reject;
1162 }
1163
1164 if (streams == 0) {
1165 ERROR("request to allocate 0 streams\n");
1166 return -1;
1167 }
1168
1169 alloc_streams.no_streams = streams;
1170 alloc_streams.endpoints = 0;
1171 for (i = 0; i < nr_eps; i++) {
1172 alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1173 }
1174 usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1175 usbredirparser_do_write(dev->parser);
1176
1177 return 0;
1178 #else
1179 ERROR("usbredir_alloc_streams not implemented\n");
1180 goto reject;
1181 #endif
1182 reject:
1183 ERROR("streams are not available, disconnecting\n");
1184 qemu_bh_schedule(dev->device_reject_bh);
1185 return -1;
1186 }
1187
usbredir_free_streams(USBDevice * udev,USBEndpoint ** eps,int nr_eps)1188 static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1189 int nr_eps)
1190 {
1191 #if USBREDIR_VERSION >= 0x000700
1192 USBRedirDevice *dev = USB_REDIRECT(udev);
1193 struct usb_redir_free_bulk_streams_header free_streams;
1194 int i;
1195
1196 if (!usbredirparser_peer_has_cap(dev->parser,
1197 usb_redir_cap_bulk_streams)) {
1198 return;
1199 }
1200
1201 free_streams.endpoints = 0;
1202 for (i = 0; i < nr_eps; i++) {
1203 free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1204 }
1205 usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1206 usbredirparser_do_write(dev->parser);
1207 #endif
1208 }
1209
1210 /*
1211 * Close events can be triggered by usbredirparser_do_write which gets called
1212 * from within the USBDevice data / control packet callbacks and doing a
1213 * usb_detach from within these callbacks is not a good idea.
1214 *
1215 * So we use a bh handler to take care of close events.
1216 */
usbredir_chardev_close_bh(void * opaque)1217 static void usbredir_chardev_close_bh(void *opaque)
1218 {
1219 USBRedirDevice *dev = opaque;
1220
1221 qemu_bh_cancel(dev->device_reject_bh);
1222 usbredir_device_disconnect(dev);
1223
1224 if (dev->parser) {
1225 DPRINTF("destroying usbredirparser\n");
1226 usbredirparser_destroy(dev->parser);
1227 dev->parser = NULL;
1228 }
1229 if (dev->watch) {
1230 g_source_remove(dev->watch);
1231 dev->watch = 0;
1232 }
1233 }
1234
usbredir_create_parser(USBRedirDevice * dev)1235 static void usbredir_create_parser(USBRedirDevice *dev)
1236 {
1237 uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1238 int flags = 0;
1239
1240 DPRINTF("creating usbredirparser\n");
1241
1242 dev->parser = usbredirparser_create();
1243 if (!dev->parser) {
1244 error_report("usbredirparser_create() failed");
1245 exit(1);
1246 }
1247 dev->parser->priv = dev;
1248 dev->parser->log_func = usbredir_log;
1249 dev->parser->read_func = usbredir_read;
1250 dev->parser->write_func = usbredir_write;
1251 dev->parser->hello_func = usbredir_hello;
1252 dev->parser->device_connect_func = usbredir_device_connect;
1253 dev->parser->device_disconnect_func = usbredir_device_disconnect;
1254 dev->parser->interface_info_func = usbredir_interface_info;
1255 dev->parser->ep_info_func = usbredir_ep_info;
1256 dev->parser->configuration_status_func = usbredir_configuration_status;
1257 dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1258 dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1259 dev->parser->interrupt_receiving_status_func =
1260 usbredir_interrupt_receiving_status;
1261 dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1262 dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1263 dev->parser->control_packet_func = usbredir_control_packet;
1264 dev->parser->bulk_packet_func = usbredir_bulk_packet;
1265 dev->parser->iso_packet_func = usbredir_iso_packet;
1266 dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1267 dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1268 dev->read_buf = NULL;
1269 dev->read_buf_size = 0;
1270
1271 usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1272 usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1273 usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1274 usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1275 usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1276 usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1277 #if USBREDIR_VERSION >= 0x000700
1278 if (dev->enable_streams) {
1279 usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1280 }
1281 #endif
1282
1283 if (runstate_check(RUN_STATE_INMIGRATE)) {
1284 flags |= usbredirparser_fl_no_hello;
1285 }
1286 usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1287 flags);
1288 usbredirparser_do_write(dev->parser);
1289 }
1290
usbredir_reject_device(USBRedirDevice * dev)1291 static void usbredir_reject_device(USBRedirDevice *dev)
1292 {
1293 usbredir_device_disconnect(dev);
1294 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1295 usbredirparser_send_filter_reject(dev->parser);
1296 usbredirparser_do_write(dev->parser);
1297 }
1298 }
1299
1300 /*
1301 * We may need to reject the device when the hcd calls alloc_streams, doing
1302 * an usb_detach from within a hcd call is not a good idea, hence this bh.
1303 */
usbredir_device_reject_bh(void * opaque)1304 static void usbredir_device_reject_bh(void *opaque)
1305 {
1306 USBRedirDevice *dev = opaque;
1307
1308 usbredir_reject_device(dev);
1309 }
1310
usbredir_do_attach(void * opaque)1311 static void usbredir_do_attach(void *opaque)
1312 {
1313 USBRedirDevice *dev = opaque;
1314 Error *local_err = NULL;
1315
1316 /* In order to work properly with XHCI controllers we need these caps */
1317 if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1318 usbredirparser_peer_has_cap(dev->parser,
1319 usb_redir_cap_ep_info_max_packet_size) &&
1320 usbredirparser_peer_has_cap(dev->parser,
1321 usb_redir_cap_32bits_bulk_length) &&
1322 usbredirparser_peer_has_cap(dev->parser,
1323 usb_redir_cap_64bits_ids))) {
1324 ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1325 usbredir_reject_device(dev);
1326 return;
1327 }
1328
1329 usb_device_attach(&dev->dev, &local_err);
1330 if (local_err) {
1331 error_report_err(local_err);
1332 WARNING("rejecting device due to speed mismatch\n");
1333 usbredir_reject_device(dev);
1334 }
1335 }
1336
1337 /*
1338 * chardev callbacks
1339 */
1340
usbredir_chardev_can_read(void * opaque)1341 static int usbredir_chardev_can_read(void *opaque)
1342 {
1343 USBRedirDevice *dev = opaque;
1344
1345 if (!dev->parser) {
1346 WARNING("chardev_can_read called on non open chardev!\n");
1347 return 0;
1348 }
1349
1350 /* Don't read new data from the chardev until our state is fully synced */
1351 if (!runstate_check(RUN_STATE_RUNNING)) {
1352 return 0;
1353 }
1354
1355 /* usbredir_parser_do_read will consume *all* data we give it */
1356 return 1 * MiB;
1357 }
1358
usbredir_chardev_read(void * opaque,const uint8_t * buf,int size)1359 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1360 {
1361 USBRedirDevice *dev = opaque;
1362
1363 /* No recursion allowed! */
1364 assert(dev->read_buf == NULL);
1365
1366 dev->read_buf = buf;
1367 dev->read_buf_size = size;
1368
1369 usbredirparser_do_read(dev->parser);
1370 /* Send any acks, etc. which may be queued now */
1371 usbredirparser_do_write(dev->parser);
1372 }
1373
usbredir_chardev_event(void * opaque,QEMUChrEvent event)1374 static void usbredir_chardev_event(void *opaque, QEMUChrEvent event)
1375 {
1376 USBRedirDevice *dev = opaque;
1377
1378 switch (event) {
1379 case CHR_EVENT_OPENED:
1380 DPRINTF("chardev open\n");
1381 /* Make sure any pending closes are handled (no-op if none pending) */
1382 usbredir_chardev_close_bh(dev);
1383 qemu_bh_cancel(dev->chardev_close_bh);
1384 usbredir_create_parser(dev);
1385 break;
1386 case CHR_EVENT_CLOSED:
1387 DPRINTF("chardev close\n");
1388 qemu_bh_schedule(dev->chardev_close_bh);
1389 break;
1390 case CHR_EVENT_BREAK:
1391 case CHR_EVENT_MUX_IN:
1392 case CHR_EVENT_MUX_OUT:
1393 /* Ignore */
1394 break;
1395 }
1396 }
1397
1398 /*
1399 * init + destroy
1400 */
1401
usbredir_vm_state_change(void * priv,bool running,RunState state)1402 static void usbredir_vm_state_change(void *priv, bool running, RunState state)
1403 {
1404 USBRedirDevice *dev = priv;
1405
1406 if (running && dev->parser != NULL) {
1407 usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1408 }
1409 }
1410
usbredir_init_endpoints(USBRedirDevice * dev)1411 static void usbredir_init_endpoints(USBRedirDevice *dev)
1412 {
1413 int i;
1414
1415 usb_ep_init(&dev->dev);
1416 memset(dev->endpoint, 0, sizeof(dev->endpoint));
1417 for (i = 0; i < MAX_ENDPOINTS; i++) {
1418 dev->endpoint[i].dev = dev;
1419 QTAILQ_INIT(&dev->endpoint[i].bufpq);
1420 }
1421 }
1422
usbredir_realize(USBDevice * udev,Error ** errp)1423 static void usbredir_realize(USBDevice *udev, Error **errp)
1424 {
1425 USBRedirDevice *dev = USB_REDIRECT(udev);
1426 int i;
1427
1428 if (!qemu_chr_fe_backend_connected(&dev->cs)) {
1429 error_setg(errp, QERR_MISSING_PARAMETER, "chardev");
1430 return;
1431 }
1432
1433 if (dev->filter_str) {
1434 i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1435 &dev->filter_rules,
1436 &dev->filter_rules_count);
1437 if (i) {
1438 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1439 "a usb device filter string");
1440 return;
1441 }
1442 }
1443
1444 dev->chardev_close_bh = qemu_bh_new_guarded(usbredir_chardev_close_bh, dev,
1445 &DEVICE(dev)->mem_reentrancy_guard);
1446 dev->device_reject_bh = qemu_bh_new_guarded(usbredir_device_reject_bh, dev,
1447 &DEVICE(dev)->mem_reentrancy_guard);
1448 dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1449
1450 packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1451 packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1452 usbredir_init_endpoints(dev);
1453
1454 /* We'll do the attach once we receive the speed from the usb-host */
1455 udev->auto_attach = 0;
1456
1457 /* Will be cleared during setup when we find conflicts */
1458 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1459
1460 /* Let the backend know we are ready */
1461 qemu_chr_fe_set_handlers(&dev->cs, usbredir_chardev_can_read,
1462 usbredir_chardev_read, usbredir_chardev_event,
1463 NULL, dev, NULL, true);
1464
1465 dev->vmstate =
1466 qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1467 }
1468
usbredir_cleanup_device_queues(USBRedirDevice * dev)1469 static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1470 {
1471 int i;
1472
1473 packet_id_queue_empty(&dev->cancelled);
1474 packet_id_queue_empty(&dev->already_in_flight);
1475 for (i = 0; i < MAX_ENDPOINTS; i++) {
1476 usbredir_free_bufpq(dev, I2EP(i));
1477 }
1478 }
1479
usbredir_unrealize(USBDevice * udev)1480 static void usbredir_unrealize(USBDevice *udev)
1481 {
1482 USBRedirDevice *dev = USB_REDIRECT(udev);
1483
1484 qemu_chr_fe_deinit(&dev->cs, true);
1485
1486 /* Note must be done after qemu_chr_close, as that causes a close event */
1487 qemu_bh_delete(dev->chardev_close_bh);
1488 qemu_bh_delete(dev->device_reject_bh);
1489
1490 timer_free(dev->attach_timer);
1491
1492 usbredir_cleanup_device_queues(dev);
1493
1494 if (dev->parser) {
1495 usbredirparser_destroy(dev->parser);
1496 }
1497 if (dev->watch) {
1498 g_source_remove(dev->watch);
1499 }
1500
1501 free(dev->filter_rules);
1502 qemu_del_vm_change_state_handler(dev->vmstate);
1503 }
1504
usbredir_check_filter(USBRedirDevice * dev)1505 static int usbredir_check_filter(USBRedirDevice *dev)
1506 {
1507 if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1508 ERROR("No interface info for device\n");
1509 goto error;
1510 }
1511
1512 if (dev->filter_rules) {
1513 if (!usbredirparser_peer_has_cap(dev->parser,
1514 usb_redir_cap_connect_device_version)) {
1515 ERROR("Device filter specified and peer does not have the "
1516 "connect_device_version capability\n");
1517 goto error;
1518 }
1519
1520 if (usbredirfilter_check(
1521 dev->filter_rules,
1522 dev->filter_rules_count,
1523 dev->device_info.device_class,
1524 dev->device_info.device_subclass,
1525 dev->device_info.device_protocol,
1526 dev->interface_info.interface_class,
1527 dev->interface_info.interface_subclass,
1528 dev->interface_info.interface_protocol,
1529 dev->interface_info.interface_count,
1530 dev->device_info.vendor_id,
1531 dev->device_info.product_id,
1532 dev->device_info.device_version_bcd,
1533 0) != 0) {
1534 goto error;
1535 }
1536 }
1537
1538 return 0;
1539
1540 error:
1541 usbredir_reject_device(dev);
1542 return -1;
1543 }
1544
usbredir_check_bulk_receiving(USBRedirDevice * dev)1545 static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1546 {
1547 int i, j, quirks;
1548
1549 if (!usbredirparser_peer_has_cap(dev->parser,
1550 usb_redir_cap_bulk_receiving)) {
1551 return;
1552 }
1553
1554 for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1555 dev->endpoint[i].bulk_receiving_enabled = 0;
1556 }
1557
1558 if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1559 return;
1560 }
1561
1562 for (i = 0; i < dev->interface_info.interface_count; i++) {
1563 quirks = usb_get_quirks(dev->device_info.vendor_id,
1564 dev->device_info.product_id,
1565 dev->interface_info.interface_class[i],
1566 dev->interface_info.interface_subclass[i],
1567 dev->interface_info.interface_protocol[i]);
1568 if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1569 continue;
1570 }
1571 if (quirks & USB_QUIRK_IS_FTDI) {
1572 dev->buffered_bulk_in_complete =
1573 usbredir_buffered_bulk_in_complete_ftdi;
1574 } else {
1575 dev->buffered_bulk_in_complete =
1576 usbredir_buffered_bulk_in_complete_raw;
1577 }
1578
1579 for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1580 if (dev->endpoint[j].interface ==
1581 dev->interface_info.interface[i] &&
1582 dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1583 dev->endpoint[j].max_packet_size != 0) {
1584 dev->endpoint[j].bulk_receiving_enabled = 1;
1585 /*
1586 * With buffering pipelining is not necessary. Also packet
1587 * combining and bulk in buffering don't play nice together!
1588 */
1589 I2USBEP(dev, j)->pipeline = false;
1590 break; /* Only buffer for the first ep of each intf */
1591 }
1592 }
1593 }
1594 }
1595
1596 /*
1597 * usbredirparser packet complete callbacks
1598 */
1599
usbredir_handle_status(USBRedirDevice * dev,USBPacket * p,int status)1600 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1601 int status)
1602 {
1603 switch (status) {
1604 case usb_redir_success:
1605 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1606 break;
1607 case usb_redir_stall:
1608 p->status = USB_RET_STALL;
1609 break;
1610 case usb_redir_cancelled:
1611 /*
1612 * When the usbredir-host unredirects a device, it will report a status
1613 * of cancelled for all pending packets, followed by a disconnect msg.
1614 */
1615 p->status = USB_RET_IOERROR;
1616 break;
1617 case usb_redir_inval:
1618 WARNING("got invalid param error from usb-host?\n");
1619 p->status = USB_RET_IOERROR;
1620 break;
1621 case usb_redir_babble:
1622 p->status = USB_RET_BABBLE;
1623 break;
1624 case usb_redir_ioerror:
1625 case usb_redir_timeout:
1626 default:
1627 p->status = USB_RET_IOERROR;
1628 }
1629 }
1630
usbredir_hello(void * priv,struct usb_redir_hello_header * h)1631 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1632 {
1633 USBRedirDevice *dev = priv;
1634
1635 /* Try to send the filter info now that we've the usb-host's caps */
1636 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1637 dev->filter_rules) {
1638 usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1639 dev->filter_rules_count);
1640 usbredirparser_do_write(dev->parser);
1641 }
1642 }
1643
usbredir_device_connect(void * priv,struct usb_redir_device_connect_header * device_connect)1644 static void usbredir_device_connect(void *priv,
1645 struct usb_redir_device_connect_header *device_connect)
1646 {
1647 USBRedirDevice *dev = priv;
1648 const char *speed;
1649
1650 if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1651 ERROR("Received device connect while already connected\n");
1652 return;
1653 }
1654
1655 switch (device_connect->speed) {
1656 case usb_redir_speed_low:
1657 speed = "low speed";
1658 dev->dev.speed = USB_SPEED_LOW;
1659 dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1660 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1661 break;
1662 case usb_redir_speed_full:
1663 speed = "full speed";
1664 dev->dev.speed = USB_SPEED_FULL;
1665 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1666 break;
1667 case usb_redir_speed_high:
1668 speed = "high speed";
1669 dev->dev.speed = USB_SPEED_HIGH;
1670 break;
1671 case usb_redir_speed_super:
1672 speed = "super speed";
1673 dev->dev.speed = USB_SPEED_SUPER;
1674 break;
1675 default:
1676 speed = "unknown speed";
1677 dev->dev.speed = USB_SPEED_FULL;
1678 }
1679
1680 if (usbredirparser_peer_has_cap(dev->parser,
1681 usb_redir_cap_connect_device_version)) {
1682 INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1683 speed, device_connect->vendor_id, device_connect->product_id,
1684 ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1685 ((device_connect->device_version_bcd & 0x0f00) >> 8),
1686 ((device_connect->device_version_bcd & 0x00f0) >> 4) * 10 +
1687 ((device_connect->device_version_bcd & 0x000f) >> 0),
1688 device_connect->device_class);
1689 } else {
1690 INFO("attaching %s device %04x:%04x class %02x\n", speed,
1691 device_connect->vendor_id, device_connect->product_id,
1692 device_connect->device_class);
1693 }
1694
1695 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1696 dev->device_info = *device_connect;
1697
1698 if (usbredir_check_filter(dev)) {
1699 WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1700 device_connect->vendor_id, device_connect->product_id);
1701 return;
1702 }
1703
1704 usbredir_check_bulk_receiving(dev);
1705 timer_mod(dev->attach_timer, dev->next_attach_time);
1706 }
1707
usbredir_device_disconnect(void * priv)1708 static void usbredir_device_disconnect(void *priv)
1709 {
1710 USBRedirDevice *dev = priv;
1711
1712 /* Stop any pending attaches */
1713 timer_del(dev->attach_timer);
1714
1715 if (dev->dev.attached) {
1716 DPRINTF("detaching device\n");
1717 usb_device_detach(&dev->dev);
1718 /*
1719 * Delay next usb device attach to give the guest a chance to see
1720 * see the detach / attach in case of quick close / open succession
1721 */
1722 dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1723 }
1724
1725 /* Reset state so that the next dev connected starts with a clean slate */
1726 usbredir_cleanup_device_queues(dev);
1727 usbredir_init_endpoints(dev);
1728 dev->interface_info.interface_count = NO_INTERFACE_INFO;
1729 dev->dev.addr = 0;
1730 dev->dev.speed = 0;
1731 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1732 }
1733
usbredir_interface_info(void * priv,struct usb_redir_interface_info_header * interface_info)1734 static void usbredir_interface_info(void *priv,
1735 struct usb_redir_interface_info_header *interface_info)
1736 {
1737 USBRedirDevice *dev = priv;
1738
1739 dev->interface_info = *interface_info;
1740
1741 /*
1742 * If we receive interface info after the device has already been
1743 * connected (ie on a set_config), re-check interface dependent things.
1744 */
1745 if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1746 usbredir_check_bulk_receiving(dev);
1747 if (usbredir_check_filter(dev)) {
1748 ERROR("Device no longer matches filter after interface info "
1749 "change, disconnecting!\n");
1750 }
1751 }
1752 }
1753
usbredir_mark_speed_incompatible(USBRedirDevice * dev,int speed)1754 static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1755 {
1756 dev->compatible_speedmask &= ~(1 << speed);
1757 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1758 }
1759
usbredir_set_pipeline(USBRedirDevice * dev,struct USBEndpoint * uep)1760 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1761 {
1762 if (uep->type != USB_ENDPOINT_XFER_BULK) {
1763 return;
1764 }
1765 if (uep->pid == USB_TOKEN_OUT) {
1766 uep->pipeline = true;
1767 }
1768 if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1769 usbredirparser_peer_has_cap(dev->parser,
1770 usb_redir_cap_32bits_bulk_length)) {
1771 uep->pipeline = true;
1772 }
1773 }
1774
usbredir_setup_usb_eps(USBRedirDevice * dev)1775 static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1776 {
1777 struct USBEndpoint *usb_ep;
1778 int i;
1779
1780 for (i = 0; i < MAX_ENDPOINTS; i++) {
1781 usb_ep = I2USBEP(dev, i);
1782 usb_ep->type = dev->endpoint[i].type;
1783 usb_ep->ifnum = dev->endpoint[i].interface;
1784 usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1785 usb_ep->max_streams = dev->endpoint[i].max_streams;
1786 usbredir_set_pipeline(dev, usb_ep);
1787 }
1788 }
1789
usbredir_ep_info(void * priv,struct usb_redir_ep_info_header * ep_info)1790 static void usbredir_ep_info(void *priv,
1791 struct usb_redir_ep_info_header *ep_info)
1792 {
1793 USBRedirDevice *dev = priv;
1794 int i;
1795
1796 assert(dev != NULL);
1797 for (i = 0; i < MAX_ENDPOINTS; i++) {
1798 dev->endpoint[i].type = ep_info->type[i];
1799 dev->endpoint[i].interval = ep_info->interval[i];
1800 dev->endpoint[i].interface = ep_info->interface[i];
1801 if (usbredirparser_peer_has_cap(dev->parser,
1802 usb_redir_cap_ep_info_max_packet_size)) {
1803 dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1804 }
1805 #if USBREDIR_VERSION >= 0x000700
1806 if (usbredirparser_peer_has_cap(dev->parser,
1807 usb_redir_cap_bulk_streams)) {
1808 dev->endpoint[i].max_streams = ep_info->max_streams[i];
1809 }
1810 #endif
1811 switch (dev->endpoint[i].type) {
1812 case usb_redir_type_invalid:
1813 break;
1814 case usb_redir_type_iso:
1815 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1816 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1817 /* Fall through */
1818 case usb_redir_type_interrupt:
1819 if (!usbredirparser_peer_has_cap(dev->parser,
1820 usb_redir_cap_ep_info_max_packet_size) ||
1821 ep_info->max_packet_size[i] > 64) {
1822 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1823 }
1824 if (!usbredirparser_peer_has_cap(dev->parser,
1825 usb_redir_cap_ep_info_max_packet_size) ||
1826 ep_info->max_packet_size[i] > 1024) {
1827 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1828 }
1829 if (dev->endpoint[i].interval == 0) {
1830 ERROR("Received 0 interval for isoc or irq endpoint\n");
1831 usbredir_reject_device(dev);
1832 return;
1833 }
1834 /* Fall through */
1835 case usb_redir_type_control:
1836 case usb_redir_type_bulk:
1837 DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1838 dev->endpoint[i].type, dev->endpoint[i].interface);
1839 break;
1840 default:
1841 ERROR("Received invalid endpoint type\n");
1842 usbredir_reject_device(dev);
1843 return;
1844 }
1845 }
1846 /* The new ep info may have caused a speed incompatibility, recheck */
1847 if (dev->dev.attached &&
1848 !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1849 ERROR("Device no longer matches speed after endpoint info change, "
1850 "disconnecting!\n");
1851 usbredir_reject_device(dev);
1852 return;
1853 }
1854 usbredir_setup_usb_eps(dev);
1855 usbredir_check_bulk_receiving(dev);
1856 }
1857
usbredir_configuration_status(void * priv,uint64_t id,struct usb_redir_configuration_status_header * config_status)1858 static void usbredir_configuration_status(void *priv, uint64_t id,
1859 struct usb_redir_configuration_status_header *config_status)
1860 {
1861 USBRedirDevice *dev = priv;
1862 USBPacket *p;
1863
1864 DPRINTF("set config status %d config %d id %"PRIu64"\n",
1865 config_status->status, config_status->configuration, id);
1866
1867 p = usbredir_find_packet_by_id(dev, 0, id);
1868 if (p) {
1869 if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1870 dev->dev.data_buf[0] = config_status->configuration;
1871 p->actual_length = 1;
1872 }
1873 usbredir_handle_status(dev, p, config_status->status);
1874 usb_generic_async_ctrl_complete(&dev->dev, p);
1875 }
1876 }
1877
usbredir_alt_setting_status(void * priv,uint64_t id,struct usb_redir_alt_setting_status_header * alt_setting_status)1878 static void usbredir_alt_setting_status(void *priv, uint64_t id,
1879 struct usb_redir_alt_setting_status_header *alt_setting_status)
1880 {
1881 USBRedirDevice *dev = priv;
1882 USBPacket *p;
1883
1884 DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1885 alt_setting_status->status, alt_setting_status->interface,
1886 alt_setting_status->alt, id);
1887
1888 p = usbredir_find_packet_by_id(dev, 0, id);
1889 if (p) {
1890 if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1891 dev->dev.data_buf[0] = alt_setting_status->alt;
1892 p->actual_length = 1;
1893 }
1894 usbredir_handle_status(dev, p, alt_setting_status->status);
1895 usb_generic_async_ctrl_complete(&dev->dev, p);
1896 }
1897 }
1898
usbredir_iso_stream_status(void * priv,uint64_t id,struct usb_redir_iso_stream_status_header * iso_stream_status)1899 static void usbredir_iso_stream_status(void *priv, uint64_t id,
1900 struct usb_redir_iso_stream_status_header *iso_stream_status)
1901 {
1902 USBRedirDevice *dev = priv;
1903 uint8_t ep = iso_stream_status->endpoint;
1904
1905 DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1906 ep, id);
1907
1908 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1909 return;
1910 }
1911
1912 dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1913 if (iso_stream_status->status == usb_redir_stall) {
1914 DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1915 dev->endpoint[EP2I(ep)].iso_started = 0;
1916 }
1917 }
1918
usbredir_interrupt_receiving_status(void * priv,uint64_t id,struct usb_redir_interrupt_receiving_status_header * interrupt_receiving_status)1919 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1920 struct usb_redir_interrupt_receiving_status_header
1921 *interrupt_receiving_status)
1922 {
1923 USBRedirDevice *dev = priv;
1924 uint8_t ep = interrupt_receiving_status->endpoint;
1925
1926 DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1927 interrupt_receiving_status->status, ep, id);
1928
1929 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1930 return;
1931 }
1932
1933 dev->endpoint[EP2I(ep)].interrupt_error =
1934 interrupt_receiving_status->status;
1935 if (interrupt_receiving_status->status == usb_redir_stall) {
1936 DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1937 dev->endpoint[EP2I(ep)].interrupt_started = 0;
1938 }
1939 }
1940
usbredir_bulk_streams_status(void * priv,uint64_t id,struct usb_redir_bulk_streams_status_header * bulk_streams_status)1941 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1942 struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1943 {
1944 #if USBREDIR_VERSION >= 0x000700
1945 USBRedirDevice *dev = priv;
1946
1947 if (bulk_streams_status->status == usb_redir_success) {
1948 DPRINTF("bulk streams status %d eps %08x\n",
1949 bulk_streams_status->status, bulk_streams_status->endpoints);
1950 } else {
1951 ERROR("bulk streams %s failed status %d eps %08x\n",
1952 (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1953 bulk_streams_status->status, bulk_streams_status->endpoints);
1954 ERROR("usb-redir-host does not provide streams, disconnecting\n");
1955 usbredir_reject_device(dev);
1956 }
1957 #endif
1958 }
1959
usbredir_bulk_receiving_status(void * priv,uint64_t id,struct usb_redir_bulk_receiving_status_header * bulk_receiving_status)1960 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1961 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1962 {
1963 USBRedirDevice *dev = priv;
1964 uint8_t ep = bulk_receiving_status->endpoint;
1965
1966 DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1967 bulk_receiving_status->status, ep, id);
1968
1969 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1970 return;
1971 }
1972
1973 if (bulk_receiving_status->status == usb_redir_stall) {
1974 DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1975 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1976 }
1977 }
1978
usbredir_control_packet(void * priv,uint64_t id,struct usb_redir_control_packet_header * control_packet,uint8_t * data,int data_len)1979 static void usbredir_control_packet(void *priv, uint64_t id,
1980 struct usb_redir_control_packet_header *control_packet,
1981 uint8_t *data, int data_len)
1982 {
1983 USBRedirDevice *dev = priv;
1984 USBPacket *p;
1985 int len = control_packet->length;
1986
1987 DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1988 len, id);
1989
1990 /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1991 * to work redirected to a not superspeed capable hcd */
1992 if (dev->dev.speed == USB_SPEED_SUPER &&
1993 !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1994 control_packet->requesttype == 0x80 &&
1995 control_packet->request == 6 &&
1996 control_packet->value == 0x100 && control_packet->index == 0 &&
1997 data_len >= 18 && data[7] == 9) {
1998 data[7] = 64;
1999 }
2000
2001 p = usbredir_find_packet_by_id(dev, 0, id);
2002 if (p) {
2003 usbredir_handle_status(dev, p, control_packet->status);
2004 if (data_len > 0) {
2005 usbredir_log_data(dev, "ctrl data in:", data, data_len);
2006 if (data_len > sizeof(dev->dev.data_buf)) {
2007 ERROR("ctrl buffer too small (%d > %zu)\n",
2008 data_len, sizeof(dev->dev.data_buf));
2009 p->status = USB_RET_STALL;
2010 data_len = len = sizeof(dev->dev.data_buf);
2011 }
2012 memcpy(dev->dev.data_buf, data, data_len);
2013 }
2014 p->actual_length = len;
2015 /*
2016 * If this is GET_DESCRIPTOR request for configuration descriptor,
2017 * remove 'remote wakeup' flag from it to prevent idle power down
2018 * in Windows guest
2019 */
2020 if (dev->suppress_remote_wake &&
2021 control_packet->requesttype == USB_DIR_IN &&
2022 control_packet->request == USB_REQ_GET_DESCRIPTOR &&
2023 control_packet->value == (USB_DT_CONFIG << 8) &&
2024 control_packet->index == 0 &&
2025 /* bmAttributes field of config descriptor */
2026 len > 7 && (dev->dev.data_buf[7] & USB_CFG_ATT_WAKEUP)) {
2027 DPRINTF("Removed remote wake %04X:%04X\n",
2028 dev->device_info.vendor_id,
2029 dev->device_info.product_id);
2030 dev->dev.data_buf[7] &= ~USB_CFG_ATT_WAKEUP;
2031 }
2032 usb_generic_async_ctrl_complete(&dev->dev, p);
2033 }
2034 free(data);
2035 }
2036
usbredir_bulk_packet(void * priv,uint64_t id,struct usb_redir_bulk_packet_header * bulk_packet,uint8_t * data,int data_len)2037 static void usbredir_bulk_packet(void *priv, uint64_t id,
2038 struct usb_redir_bulk_packet_header *bulk_packet,
2039 uint8_t *data, int data_len)
2040 {
2041 USBRedirDevice *dev = priv;
2042 uint8_t ep = bulk_packet->endpoint;
2043 int len = (bulk_packet->length_high << 16) | bulk_packet->length;
2044 USBPacket *p;
2045
2046 DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
2047 bulk_packet->status, ep, bulk_packet->stream_id, len, id);
2048
2049 p = usbredir_find_packet_by_id(dev, ep, id);
2050 if (p) {
2051 size_t size = usb_packet_size(p);
2052 usbredir_handle_status(dev, p, bulk_packet->status);
2053 if (data_len > 0) {
2054 usbredir_log_data(dev, "bulk data in:", data, data_len);
2055 if (data_len > size) {
2056 ERROR("bulk got more data then requested (%d > %zd)\n",
2057 data_len, p->iov.size);
2058 p->status = USB_RET_BABBLE;
2059 data_len = len = size;
2060 }
2061 usb_packet_copy(p, data, data_len);
2062 }
2063 p->actual_length = len;
2064 if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
2065 usb_combined_input_packet_complete(&dev->dev, p);
2066 } else {
2067 usb_packet_complete(&dev->dev, p);
2068 }
2069 }
2070 free(data);
2071 }
2072
usbredir_iso_packet(void * priv,uint64_t id,struct usb_redir_iso_packet_header * iso_packet,uint8_t * data,int data_len)2073 static void usbredir_iso_packet(void *priv, uint64_t id,
2074 struct usb_redir_iso_packet_header *iso_packet,
2075 uint8_t *data, int data_len)
2076 {
2077 USBRedirDevice *dev = priv;
2078 uint8_t ep = iso_packet->endpoint;
2079
2080 DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
2081 iso_packet->status, ep, data_len, id);
2082
2083 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
2084 ERROR("received iso packet for non iso endpoint %02X\n", ep);
2085 free(data);
2086 return;
2087 }
2088
2089 if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2090 DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2091 free(data);
2092 return;
2093 }
2094
2095 /* bufp_alloc also adds the packet to the ep queue */
2096 bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2097 }
2098
usbredir_interrupt_packet(void * priv,uint64_t id,struct usb_redir_interrupt_packet_header * interrupt_packet,uint8_t * data,int data_len)2099 static void usbredir_interrupt_packet(void *priv, uint64_t id,
2100 struct usb_redir_interrupt_packet_header *interrupt_packet,
2101 uint8_t *data, int data_len)
2102 {
2103 USBRedirDevice *dev = priv;
2104 uint8_t ep = interrupt_packet->endpoint;
2105
2106 DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2107 interrupt_packet->status, ep, data_len, id);
2108
2109 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2110 ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2111 free(data);
2112 return;
2113 }
2114
2115 if (ep & USB_DIR_IN) {
2116 if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2117 DPRINTF("received int packet while not started ep %02X\n", ep);
2118 free(data);
2119 return;
2120 }
2121
2122 /* bufp_alloc also adds the packet to the ep queue */
2123 bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2124
2125 /* insufficient data solved with USB_RET_NAK */
2126 usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2127 } else {
2128 /*
2129 * We report output interrupt packets as completed directly upon
2130 * submission, so all we can do here if one failed is warn.
2131 */
2132 if (interrupt_packet->status) {
2133 WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2134 interrupt_packet->status, ep, id);
2135 }
2136 }
2137 }
2138
usbredir_buffered_bulk_packet(void * priv,uint64_t id,struct usb_redir_buffered_bulk_packet_header * buffered_bulk_packet,uint8_t * data,int data_len)2139 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2140 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2141 uint8_t *data, int data_len)
2142 {
2143 USBRedirDevice *dev = priv;
2144 uint8_t status, ep = buffered_bulk_packet->endpoint;
2145 void *free_on_destroy;
2146 int i, len;
2147
2148 DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2149 buffered_bulk_packet->status, ep, data_len, id);
2150
2151 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2152 ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2153 free(data);
2154 return;
2155 }
2156
2157 if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2158 DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2159 free(data);
2160 return;
2161 }
2162
2163 /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2164 len = dev->endpoint[EP2I(ep)].max_packet_size;
2165 status = usb_redir_success;
2166 free_on_destroy = NULL;
2167 for (i = 0; i < data_len; i += len) {
2168 int r;
2169 if (len >= (data_len - i)) {
2170 len = data_len - i;
2171 status = buffered_bulk_packet->status;
2172 free_on_destroy = data;
2173 }
2174 /* bufp_alloc also adds the packet to the ep queue */
2175 r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2176 if (r) {
2177 break;
2178 }
2179 }
2180
2181 if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2182 USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2183 dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2184 usbredir_buffered_bulk_in_complete(dev, p, ep);
2185 usb_packet_complete(&dev->dev, p);
2186 }
2187 }
2188
2189 /*
2190 * Migration code
2191 */
2192
usbredir_pre_save(void * priv)2193 static int usbredir_pre_save(void *priv)
2194 {
2195 USBRedirDevice *dev = priv;
2196
2197 usbredir_fill_already_in_flight(dev);
2198
2199 return 0;
2200 }
2201
usbredir_post_load(void * priv,int version_id)2202 static int usbredir_post_load(void *priv, int version_id)
2203 {
2204 USBRedirDevice *dev = priv;
2205
2206 if (dev == NULL || dev->parser == NULL) {
2207 return 0;
2208 }
2209
2210 switch (dev->device_info.speed) {
2211 case usb_redir_speed_low:
2212 dev->dev.speed = USB_SPEED_LOW;
2213 break;
2214 case usb_redir_speed_full:
2215 dev->dev.speed = USB_SPEED_FULL;
2216 break;
2217 case usb_redir_speed_high:
2218 dev->dev.speed = USB_SPEED_HIGH;
2219 break;
2220 case usb_redir_speed_super:
2221 dev->dev.speed = USB_SPEED_SUPER;
2222 break;
2223 default:
2224 dev->dev.speed = USB_SPEED_FULL;
2225 }
2226 dev->dev.speedmask = (1 << dev->dev.speed);
2227
2228 usbredir_setup_usb_eps(dev);
2229 usbredir_check_bulk_receiving(dev);
2230
2231 return 0;
2232 }
2233
2234 /* For usbredirparser migration */
usbredir_put_parser(QEMUFile * f,void * priv,size_t unused,const VMStateField * field,JSONWriter * vmdesc)2235 static int usbredir_put_parser(QEMUFile *f, void *priv, size_t unused,
2236 const VMStateField *field, JSONWriter *vmdesc)
2237 {
2238 USBRedirDevice *dev = priv;
2239 uint8_t *data;
2240 int len;
2241
2242 if (dev->parser == NULL) {
2243 qemu_put_be32(f, 0);
2244 return 0;
2245 }
2246
2247 usbredirparser_serialize(dev->parser, &data, &len);
2248 if (!data) {
2249 error_report("usbredirparser_serialize failed");
2250 exit(1);
2251 }
2252
2253 qemu_put_be32(f, len);
2254 qemu_put_buffer(f, data, len);
2255
2256 free(data);
2257
2258 return 0;
2259 }
2260
usbredir_get_parser(QEMUFile * f,void * priv,size_t unused,const VMStateField * field)2261 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused,
2262 const VMStateField *field)
2263 {
2264 USBRedirDevice *dev = priv;
2265 uint8_t *data;
2266 int len, ret;
2267
2268 len = qemu_get_be32(f);
2269 if (len == 0) {
2270 return 0;
2271 }
2272
2273 /*
2274 * If our chardev is not open already at this point the usbredir connection
2275 * has been broken (non seamless migration, or restore from disk).
2276 *
2277 * In this case create a temporary parser to receive the migration data,
2278 * and schedule the close_bh to report the device as disconnected to the
2279 * guest and to destroy the parser again.
2280 */
2281 if (dev->parser == NULL) {
2282 WARNING("usb-redir connection broken during migration\n");
2283 usbredir_create_parser(dev);
2284 qemu_bh_schedule(dev->chardev_close_bh);
2285 }
2286
2287 data = g_malloc(len);
2288 qemu_get_buffer(f, data, len);
2289
2290 ret = usbredirparser_unserialize(dev->parser, data, len);
2291
2292 g_free(data);
2293
2294 return ret;
2295 }
2296
2297 static const VMStateInfo usbredir_parser_vmstate_info = {
2298 .name = "usb-redir-parser",
2299 .put = usbredir_put_parser,
2300 .get = usbredir_get_parser,
2301 };
2302
2303
2304 /* For buffered packets (iso/irq) queue migration */
usbredir_put_bufpq(QEMUFile * f,void * priv,size_t unused,const VMStateField * field,JSONWriter * vmdesc)2305 static int usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused,
2306 const VMStateField *field, JSONWriter *vmdesc)
2307 {
2308 struct endp_data *endp = priv;
2309 USBRedirDevice *dev = endp->dev;
2310 struct buf_packet *bufp;
2311 int len, i = 0;
2312
2313 qemu_put_be32(f, endp->bufpq_size);
2314 QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2315 len = bufp->len - bufp->offset;
2316 DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2317 len, bufp->status);
2318 qemu_put_be32(f, len);
2319 qemu_put_be32(f, bufp->status);
2320 qemu_put_buffer(f, bufp->data + bufp->offset, len);
2321 i++;
2322 }
2323 assert(i == endp->bufpq_size);
2324
2325 return 0;
2326 }
2327
usbredir_get_bufpq(QEMUFile * f,void * priv,size_t unused,const VMStateField * field)2328 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused,
2329 const VMStateField *field)
2330 {
2331 struct endp_data *endp = priv;
2332 USBRedirDevice *dev = endp->dev;
2333 struct buf_packet *bufp;
2334 int i;
2335
2336 endp->bufpq_size = qemu_get_be32(f);
2337 for (i = 0; i < endp->bufpq_size; i++) {
2338 bufp = g_new(struct buf_packet, 1);
2339 bufp->len = qemu_get_be32(f);
2340 bufp->status = qemu_get_be32(f);
2341 bufp->offset = 0;
2342 bufp->data = malloc(bufp->len); /* regular malloc! */
2343 if (!bufp->data) {
2344 error_report("usbredir_get_bufpq: out of memory");
2345 exit(1);
2346 }
2347 bufp->free_on_destroy = bufp->data;
2348 qemu_get_buffer(f, bufp->data, bufp->len);
2349 QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2350 DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2351 bufp->len, bufp->status);
2352 }
2353 return 0;
2354 }
2355
2356 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2357 .name = "usb-redir-bufpq",
2358 .put = usbredir_put_bufpq,
2359 .get = usbredir_get_bufpq,
2360 };
2361
2362
2363 /* For endp_data migration */
usbredir_bulk_receiving_needed(void * priv)2364 static bool usbredir_bulk_receiving_needed(void *priv)
2365 {
2366 struct endp_data *endp = priv;
2367
2368 return endp->bulk_receiving_started;
2369 }
2370
2371 static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2372 .name = "usb-redir-ep/bulk-receiving",
2373 .version_id = 1,
2374 .minimum_version_id = 1,
2375 .needed = usbredir_bulk_receiving_needed,
2376 .fields = (const VMStateField[]) {
2377 VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2378 VMSTATE_END_OF_LIST()
2379 }
2380 };
2381
usbredir_stream_needed(void * priv)2382 static bool usbredir_stream_needed(void *priv)
2383 {
2384 struct endp_data *endp = priv;
2385
2386 return endp->max_streams;
2387 }
2388
2389 static const VMStateDescription usbredir_stream_vmstate = {
2390 .name = "usb-redir-ep/stream-state",
2391 .version_id = 1,
2392 .minimum_version_id = 1,
2393 .needed = usbredir_stream_needed,
2394 .fields = (const VMStateField[]) {
2395 VMSTATE_UINT32(max_streams, struct endp_data),
2396 VMSTATE_END_OF_LIST()
2397 }
2398 };
2399
2400 static const VMStateDescription usbredir_ep_vmstate = {
2401 .name = "usb-redir-ep",
2402 .version_id = 1,
2403 .minimum_version_id = 1,
2404 .fields = (const VMStateField[]) {
2405 VMSTATE_UINT8(type, struct endp_data),
2406 VMSTATE_UINT8(interval, struct endp_data),
2407 VMSTATE_UINT8(interface, struct endp_data),
2408 VMSTATE_UINT16(max_packet_size, struct endp_data),
2409 VMSTATE_UINT8(iso_started, struct endp_data),
2410 VMSTATE_UINT8(iso_error, struct endp_data),
2411 VMSTATE_UINT8(interrupt_started, struct endp_data),
2412 VMSTATE_UINT8(interrupt_error, struct endp_data),
2413 VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2414 VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2415 {
2416 .name = "bufpq",
2417 .version_id = 0,
2418 .field_exists = NULL,
2419 .size = 0,
2420 .info = &usbredir_ep_bufpq_vmstate_info,
2421 .flags = VMS_SINGLE,
2422 .offset = 0,
2423 },
2424 VMSTATE_INT32(bufpq_target_size, struct endp_data),
2425 VMSTATE_END_OF_LIST()
2426 },
2427 .subsections = (const VMStateDescription * const []) {
2428 &usbredir_bulk_receiving_vmstate,
2429 &usbredir_stream_vmstate,
2430 NULL
2431 }
2432 };
2433
2434
2435 /* For PacketIdQueue migration */
usbredir_put_packet_id_q(QEMUFile * f,void * priv,size_t unused,const VMStateField * field,JSONWriter * vmdesc)2436 static int usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2437 const VMStateField *field,
2438 JSONWriter *vmdesc)
2439 {
2440 struct PacketIdQueue *q = priv;
2441 USBRedirDevice *dev = q->dev;
2442 struct PacketIdQueueEntry *e;
2443 int remain = q->size;
2444
2445 DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2446 qemu_put_be32(f, q->size);
2447 QTAILQ_FOREACH(e, &q->head, next) {
2448 qemu_put_be64(f, e->id);
2449 remain--;
2450 }
2451 assert(remain == 0);
2452
2453 return 0;
2454 }
2455
usbredir_get_packet_id_q(QEMUFile * f,void * priv,size_t unused,const VMStateField * field)2456 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2457 const VMStateField *field)
2458 {
2459 struct PacketIdQueue *q = priv;
2460 USBRedirDevice *dev = q->dev;
2461 int i, size;
2462 uint64_t id;
2463
2464 size = qemu_get_be32(f);
2465 DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2466 for (i = 0; i < size; i++) {
2467 id = qemu_get_be64(f);
2468 packet_id_queue_add(q, id);
2469 }
2470 assert(q->size == size);
2471 return 0;
2472 }
2473
2474 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2475 .name = "usb-redir-packet-id-q",
2476 .put = usbredir_put_packet_id_q,
2477 .get = usbredir_get_packet_id_q,
2478 };
2479
2480 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2481 .name = "usb-redir-packet-id-queue",
2482 .version_id = 1,
2483 .minimum_version_id = 1,
2484 .fields = (const VMStateField[]) {
2485 {
2486 .name = "queue",
2487 .version_id = 0,
2488 .field_exists = NULL,
2489 .size = 0,
2490 .info = &usbredir_ep_packet_id_q_vmstate_info,
2491 .flags = VMS_SINGLE,
2492 .offset = 0,
2493 },
2494 VMSTATE_END_OF_LIST()
2495 }
2496 };
2497
2498
2499 /* For usb_redir_device_connect_header migration */
2500 static const VMStateDescription usbredir_device_info_vmstate = {
2501 .name = "usb-redir-device-info",
2502 .version_id = 1,
2503 .minimum_version_id = 1,
2504 .fields = (const VMStateField[]) {
2505 VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2506 VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2507 VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2508 VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2509 VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2510 VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2511 VMSTATE_UINT16(device_version_bcd,
2512 struct usb_redir_device_connect_header),
2513 VMSTATE_END_OF_LIST()
2514 }
2515 };
2516
2517
2518 /* For usb_redir_interface_info_header migration */
2519 static const VMStateDescription usbredir_interface_info_vmstate = {
2520 .name = "usb-redir-interface-info",
2521 .version_id = 1,
2522 .minimum_version_id = 1,
2523 .fields = (const VMStateField[]) {
2524 VMSTATE_UINT32(interface_count,
2525 struct usb_redir_interface_info_header),
2526 VMSTATE_UINT8_ARRAY(interface,
2527 struct usb_redir_interface_info_header, 32),
2528 VMSTATE_UINT8_ARRAY(interface_class,
2529 struct usb_redir_interface_info_header, 32),
2530 VMSTATE_UINT8_ARRAY(interface_subclass,
2531 struct usb_redir_interface_info_header, 32),
2532 VMSTATE_UINT8_ARRAY(interface_protocol,
2533 struct usb_redir_interface_info_header, 32),
2534 VMSTATE_END_OF_LIST()
2535 }
2536 };
2537
2538
2539 /* And finally the USBRedirDevice vmstate itself */
2540 static const VMStateDescription usbredir_vmstate = {
2541 .name = "usb-redir",
2542 .version_id = 1,
2543 .minimum_version_id = 1,
2544 .pre_save = usbredir_pre_save,
2545 .post_load = usbredir_post_load,
2546 .fields = (const VMStateField[]) {
2547 VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2548 VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2549 {
2550 .name = "parser",
2551 .version_id = 0,
2552 .field_exists = NULL,
2553 .size = 0,
2554 .info = &usbredir_parser_vmstate_info,
2555 .flags = VMS_SINGLE,
2556 .offset = 0,
2557 },
2558 VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2559 usbredir_ep_vmstate, struct endp_data),
2560 VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2561 usbredir_ep_packet_id_queue_vmstate,
2562 struct PacketIdQueue),
2563 VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2564 usbredir_ep_packet_id_queue_vmstate,
2565 struct PacketIdQueue),
2566 VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2567 usbredir_device_info_vmstate,
2568 struct usb_redir_device_connect_header),
2569 VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2570 usbredir_interface_info_vmstate,
2571 struct usb_redir_interface_info_header),
2572 VMSTATE_END_OF_LIST()
2573 }
2574 };
2575
2576 static Property usbredir_properties[] = {
2577 DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2578 DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2579 DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2580 DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
2581 DEFINE_PROP_BOOL("suppress-remote-wake", USBRedirDevice,
2582 suppress_remote_wake, true),
2583 DEFINE_PROP_END_OF_LIST(),
2584 };
2585
usbredir_class_initfn(ObjectClass * klass,void * data)2586 static void usbredir_class_initfn(ObjectClass *klass, void *data)
2587 {
2588 USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2589 DeviceClass *dc = DEVICE_CLASS(klass);
2590
2591 uc->realize = usbredir_realize;
2592 uc->product_desc = "USB Redirection Device";
2593 uc->unrealize = usbredir_unrealize;
2594 uc->cancel_packet = usbredir_cancel_packet;
2595 uc->handle_reset = usbredir_handle_reset;
2596 uc->handle_data = usbredir_handle_data;
2597 uc->handle_control = usbredir_handle_control;
2598 uc->flush_ep_queue = usbredir_flush_ep_queue;
2599 uc->ep_stopped = usbredir_ep_stopped;
2600 uc->alloc_streams = usbredir_alloc_streams;
2601 uc->free_streams = usbredir_free_streams;
2602 dc->vmsd = &usbredir_vmstate;
2603 device_class_set_props(dc, usbredir_properties);
2604 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2605 }
2606
usbredir_instance_init(Object * obj)2607 static void usbredir_instance_init(Object *obj)
2608 {
2609 USBDevice *udev = USB_DEVICE(obj);
2610 USBRedirDevice *dev = USB_REDIRECT(udev);
2611
2612 device_add_bootindex_property(obj, &dev->bootindex,
2613 "bootindex", NULL,
2614 &udev->qdev);
2615 }
2616
2617 static const TypeInfo usbredir_dev_info = {
2618 .name = TYPE_USB_REDIR,
2619 .parent = TYPE_USB_DEVICE,
2620 .instance_size = sizeof(USBRedirDevice),
2621 .class_init = usbredir_class_initfn,
2622 .instance_init = usbredir_instance_init,
2623 };
2624 module_obj(TYPE_USB_REDIR);
2625 module_kconfig(USB);
2626
usbredir_register_types(void)2627 static void usbredir_register_types(void)
2628 {
2629 type_register_static(&usbredir_dev_info);
2630 }
2631
2632 type_init(usbredir_register_types)
2633