1 /* 2 * UAS (USB Attached SCSI) emulation 3 * 4 * Copyright Red Hat, Inc. 2012 5 * 6 * Author: Gerd Hoffmann <kraxel@redhat.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or later. 9 * See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu-common.h" 13 #include "qemu/option.h" 14 #include "qemu/config-file.h" 15 #include "trace.h" 16 #include "qemu/error-report.h" 17 18 #include "hw/usb.h" 19 #include "hw/usb/desc.h" 20 #include "hw/scsi/scsi.h" 21 #include "block/scsi.h" 22 23 /* --------------------------------------------------------------------- */ 24 25 #define UAS_UI_COMMAND 0x01 26 #define UAS_UI_SENSE 0x03 27 #define UAS_UI_RESPONSE 0x04 28 #define UAS_UI_TASK_MGMT 0x05 29 #define UAS_UI_READ_READY 0x06 30 #define UAS_UI_WRITE_READY 0x07 31 32 #define UAS_RC_TMF_COMPLETE 0x00 33 #define UAS_RC_INVALID_INFO_UNIT 0x02 34 #define UAS_RC_TMF_NOT_SUPPORTED 0x04 35 #define UAS_RC_TMF_FAILED 0x05 36 #define UAS_RC_TMF_SUCCEEDED 0x08 37 #define UAS_RC_INCORRECT_LUN 0x09 38 #define UAS_RC_OVERLAPPED_TAG 0x0a 39 40 #define UAS_TMF_ABORT_TASK 0x01 41 #define UAS_TMF_ABORT_TASK_SET 0x02 42 #define UAS_TMF_CLEAR_TASK_SET 0x04 43 #define UAS_TMF_LOGICAL_UNIT_RESET 0x08 44 #define UAS_TMF_I_T_NEXUS_RESET 0x10 45 #define UAS_TMF_CLEAR_ACA 0x40 46 #define UAS_TMF_QUERY_TASK 0x80 47 #define UAS_TMF_QUERY_TASK_SET 0x81 48 #define UAS_TMF_QUERY_ASYNC_EVENT 0x82 49 50 #define UAS_PIPE_ID_COMMAND 0x01 51 #define UAS_PIPE_ID_STATUS 0x02 52 #define UAS_PIPE_ID_DATA_IN 0x03 53 #define UAS_PIPE_ID_DATA_OUT 0x04 54 55 typedef struct { 56 uint8_t id; 57 uint8_t reserved; 58 uint16_t tag; 59 } QEMU_PACKED uas_iu_header; 60 61 typedef struct { 62 uint8_t prio_taskattr; /* 6:3 priority, 2:0 task attribute */ 63 uint8_t reserved_1; 64 uint8_t add_cdb_length; /* 7:2 additional adb length (dwords) */ 65 uint8_t reserved_2; 66 uint64_t lun; 67 uint8_t cdb[16]; 68 uint8_t add_cdb[]; 69 } QEMU_PACKED uas_iu_command; 70 71 typedef struct { 72 uint16_t status_qualifier; 73 uint8_t status; 74 uint8_t reserved[7]; 75 uint16_t sense_length; 76 uint8_t sense_data[18]; 77 } QEMU_PACKED uas_iu_sense; 78 79 typedef struct { 80 uint8_t add_response_info[3]; 81 uint8_t response_code; 82 } QEMU_PACKED uas_iu_response; 83 84 typedef struct { 85 uint8_t function; 86 uint8_t reserved; 87 uint16_t task_tag; 88 uint64_t lun; 89 } QEMU_PACKED uas_iu_task_mgmt; 90 91 typedef struct { 92 uas_iu_header hdr; 93 union { 94 uas_iu_command command; 95 uas_iu_sense sense; 96 uas_iu_task_mgmt task; 97 uas_iu_response response; 98 }; 99 } QEMU_PACKED uas_iu; 100 101 /* --------------------------------------------------------------------- */ 102 103 #define UAS_STREAM_BM_ATTR 4 104 #define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR) 105 106 typedef struct UASDevice UASDevice; 107 typedef struct UASRequest UASRequest; 108 typedef struct UASStatus UASStatus; 109 110 struct UASDevice { 111 USBDevice dev; 112 SCSIBus bus; 113 QEMUBH *status_bh; 114 QTAILQ_HEAD(, UASStatus) results; 115 QTAILQ_HEAD(, UASRequest) requests; 116 117 /* properties */ 118 uint32_t requestlog; 119 120 /* usb 2.0 only */ 121 USBPacket *status2; 122 UASRequest *datain2; 123 UASRequest *dataout2; 124 125 /* usb 3.0 only */ 126 USBPacket *data3[UAS_MAX_STREAMS + 1]; 127 USBPacket *status3[UAS_MAX_STREAMS + 1]; 128 }; 129 130 struct UASRequest { 131 uint16_t tag; 132 uint64_t lun; 133 UASDevice *uas; 134 SCSIDevice *dev; 135 SCSIRequest *req; 136 USBPacket *data; 137 bool data_async; 138 bool active; 139 bool complete; 140 uint32_t buf_off; 141 uint32_t buf_size; 142 uint32_t data_off; 143 uint32_t data_size; 144 QTAILQ_ENTRY(UASRequest) next; 145 }; 146 147 struct UASStatus { 148 uint32_t stream; 149 uas_iu status; 150 uint32_t length; 151 QTAILQ_ENTRY(UASStatus) next; 152 }; 153 154 /* --------------------------------------------------------------------- */ 155 156 enum { 157 STR_MANUFACTURER = 1, 158 STR_PRODUCT, 159 STR_SERIALNUMBER, 160 STR_CONFIG_HIGH, 161 STR_CONFIG_SUPER, 162 }; 163 164 static const USBDescStrings desc_strings = { 165 [STR_MANUFACTURER] = "QEMU", 166 [STR_PRODUCT] = "USB Attached SCSI HBA", 167 [STR_SERIALNUMBER] = "27842", 168 [STR_CONFIG_HIGH] = "High speed config (usb 2.0)", 169 [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)", 170 }; 171 172 static const USBDescIface desc_iface_high = { 173 .bInterfaceNumber = 0, 174 .bNumEndpoints = 4, 175 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 176 .bInterfaceSubClass = 0x06, /* SCSI */ 177 .bInterfaceProtocol = 0x62, /* UAS */ 178 .eps = (USBDescEndpoint[]) { 179 { 180 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 181 .bmAttributes = USB_ENDPOINT_XFER_BULK, 182 .wMaxPacketSize = 512, 183 .extra = (uint8_t[]) { 184 0x04, /* u8 bLength */ 185 0x24, /* u8 bDescriptorType */ 186 UAS_PIPE_ID_COMMAND, 187 0x00, /* u8 bReserved */ 188 }, 189 },{ 190 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 191 .bmAttributes = USB_ENDPOINT_XFER_BULK, 192 .wMaxPacketSize = 512, 193 .extra = (uint8_t[]) { 194 0x04, /* u8 bLength */ 195 0x24, /* u8 bDescriptorType */ 196 UAS_PIPE_ID_STATUS, 197 0x00, /* u8 bReserved */ 198 }, 199 },{ 200 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 201 .bmAttributes = USB_ENDPOINT_XFER_BULK, 202 .wMaxPacketSize = 512, 203 .extra = (uint8_t[]) { 204 0x04, /* u8 bLength */ 205 0x24, /* u8 bDescriptorType */ 206 UAS_PIPE_ID_DATA_IN, 207 0x00, /* u8 bReserved */ 208 }, 209 },{ 210 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 211 .bmAttributes = USB_ENDPOINT_XFER_BULK, 212 .wMaxPacketSize = 512, 213 .extra = (uint8_t[]) { 214 0x04, /* u8 bLength */ 215 0x24, /* u8 bDescriptorType */ 216 UAS_PIPE_ID_DATA_OUT, 217 0x00, /* u8 bReserved */ 218 }, 219 }, 220 } 221 }; 222 223 static const USBDescIface desc_iface_super = { 224 .bInterfaceNumber = 0, 225 .bNumEndpoints = 4, 226 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 227 .bInterfaceSubClass = 0x06, /* SCSI */ 228 .bInterfaceProtocol = 0x62, /* UAS */ 229 .eps = (USBDescEndpoint[]) { 230 { 231 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 232 .bmAttributes = USB_ENDPOINT_XFER_BULK, 233 .wMaxPacketSize = 1024, 234 .bMaxBurst = 15, 235 .extra = (uint8_t[]) { 236 0x04, /* u8 bLength */ 237 0x24, /* u8 bDescriptorType */ 238 UAS_PIPE_ID_COMMAND, 239 0x00, /* u8 bReserved */ 240 }, 241 },{ 242 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 243 .bmAttributes = USB_ENDPOINT_XFER_BULK, 244 .wMaxPacketSize = 1024, 245 .bMaxBurst = 15, 246 .bmAttributes_super = UAS_STREAM_BM_ATTR, 247 .extra = (uint8_t[]) { 248 0x04, /* u8 bLength */ 249 0x24, /* u8 bDescriptorType */ 250 UAS_PIPE_ID_STATUS, 251 0x00, /* u8 bReserved */ 252 }, 253 },{ 254 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 255 .bmAttributes = USB_ENDPOINT_XFER_BULK, 256 .wMaxPacketSize = 1024, 257 .bMaxBurst = 15, 258 .bmAttributes_super = UAS_STREAM_BM_ATTR, 259 .extra = (uint8_t[]) { 260 0x04, /* u8 bLength */ 261 0x24, /* u8 bDescriptorType */ 262 UAS_PIPE_ID_DATA_IN, 263 0x00, /* u8 bReserved */ 264 }, 265 },{ 266 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 267 .bmAttributes = USB_ENDPOINT_XFER_BULK, 268 .wMaxPacketSize = 1024, 269 .bMaxBurst = 15, 270 .bmAttributes_super = UAS_STREAM_BM_ATTR, 271 .extra = (uint8_t[]) { 272 0x04, /* u8 bLength */ 273 0x24, /* u8 bDescriptorType */ 274 UAS_PIPE_ID_DATA_OUT, 275 0x00, /* u8 bReserved */ 276 }, 277 }, 278 } 279 }; 280 281 static const USBDescDevice desc_device_high = { 282 .bcdUSB = 0x0200, 283 .bMaxPacketSize0 = 64, 284 .bNumConfigurations = 1, 285 .confs = (USBDescConfig[]) { 286 { 287 .bNumInterfaces = 1, 288 .bConfigurationValue = 1, 289 .iConfiguration = STR_CONFIG_HIGH, 290 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 291 .nif = 1, 292 .ifs = &desc_iface_high, 293 }, 294 }, 295 }; 296 297 static const USBDescDevice desc_device_super = { 298 .bcdUSB = 0x0300, 299 .bMaxPacketSize0 = 64, 300 .bNumConfigurations = 1, 301 .confs = (USBDescConfig[]) { 302 { 303 .bNumInterfaces = 1, 304 .bConfigurationValue = 1, 305 .iConfiguration = STR_CONFIG_SUPER, 306 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 307 .nif = 1, 308 .ifs = &desc_iface_super, 309 }, 310 }, 311 }; 312 313 static const USBDesc desc = { 314 .id = { 315 .idVendor = 0x46f4, /* CRC16() of "QEMU" */ 316 .idProduct = 0x0003, 317 .bcdDevice = 0, 318 .iManufacturer = STR_MANUFACTURER, 319 .iProduct = STR_PRODUCT, 320 .iSerialNumber = STR_SERIALNUMBER, 321 }, 322 .high = &desc_device_high, 323 .super = &desc_device_super, 324 .str = desc_strings, 325 }; 326 327 /* --------------------------------------------------------------------- */ 328 329 static bool uas_using_streams(UASDevice *uas) 330 { 331 return uas->dev.speed == USB_SPEED_SUPER; 332 } 333 334 /* --------------------------------------------------------------------- */ 335 336 static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag) 337 { 338 UASStatus *st = g_new0(UASStatus, 1); 339 340 st->status.hdr.id = id; 341 st->status.hdr.tag = cpu_to_be16(tag); 342 st->length = sizeof(uas_iu_header); 343 if (uas_using_streams(uas)) { 344 st->stream = tag; 345 } 346 return st; 347 } 348 349 static void usb_uas_send_status_bh(void *opaque) 350 { 351 UASDevice *uas = opaque; 352 UASStatus *st; 353 USBPacket *p; 354 355 while ((st = QTAILQ_FIRST(&uas->results)) != NULL) { 356 if (uas_using_streams(uas)) { 357 p = uas->status3[st->stream]; 358 uas->status3[st->stream] = NULL; 359 } else { 360 p = uas->status2; 361 uas->status2 = NULL; 362 } 363 if (p == NULL) { 364 break; 365 } 366 367 usb_packet_copy(p, &st->status, st->length); 368 QTAILQ_REMOVE(&uas->results, st, next); 369 g_free(st); 370 371 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 372 usb_packet_complete(&uas->dev, p); 373 } 374 } 375 376 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) 377 { 378 USBPacket *p = uas_using_streams(uas) ? 379 uas->status3[st->stream] : uas->status2; 380 381 st->length += length; 382 QTAILQ_INSERT_TAIL(&uas->results, st, next); 383 if (p) { 384 /* 385 * Just schedule bh make sure any in-flight data transaction 386 * is finished before completing (sending) the status packet. 387 */ 388 qemu_bh_schedule(uas->status_bh); 389 } else { 390 USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN, 391 UAS_PIPE_ID_STATUS); 392 usb_wakeup(ep, st->stream); 393 } 394 } 395 396 static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, uint8_t code) 397 { 398 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_RESPONSE, tag); 399 400 trace_usb_uas_response(uas->dev.addr, tag, code); 401 st->status.response.response_code = code; 402 usb_uas_queue_status(uas, st, sizeof(uas_iu_response)); 403 } 404 405 static void usb_uas_queue_sense(UASRequest *req, uint8_t status) 406 { 407 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_SENSE, req->tag); 408 int len, slen = 0; 409 410 trace_usb_uas_sense(req->uas->dev.addr, req->tag, status); 411 st->status.sense.status = status; 412 st->status.sense.status_qualifier = cpu_to_be16(0); 413 if (status != GOOD) { 414 slen = scsi_req_get_sense(req->req, st->status.sense.sense_data, 415 sizeof(st->status.sense.sense_data)); 416 st->status.sense.sense_length = cpu_to_be16(slen); 417 } 418 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 419 usb_uas_queue_status(req->uas, st, len); 420 } 421 422 static void usb_uas_queue_fake_sense(UASDevice *uas, uint16_t tag, 423 struct SCSISense sense) 424 { 425 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_SENSE, tag); 426 int len, slen = 0; 427 428 st->status.sense.status = CHECK_CONDITION; 429 st->status.sense.status_qualifier = cpu_to_be16(0); 430 st->status.sense.sense_data[0] = 0x70; 431 st->status.sense.sense_data[2] = sense.key; 432 st->status.sense.sense_data[7] = 10; 433 st->status.sense.sense_data[12] = sense.asc; 434 st->status.sense.sense_data[13] = sense.ascq; 435 slen = 18; 436 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 437 usb_uas_queue_status(uas, st, len); 438 } 439 440 static void usb_uas_queue_read_ready(UASRequest *req) 441 { 442 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_READ_READY, 443 req->tag); 444 445 trace_usb_uas_read_ready(req->uas->dev.addr, req->tag); 446 usb_uas_queue_status(req->uas, st, 0); 447 } 448 449 static void usb_uas_queue_write_ready(UASRequest *req) 450 { 451 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_WRITE_READY, 452 req->tag); 453 454 trace_usb_uas_write_ready(req->uas->dev.addr, req->tag); 455 usb_uas_queue_status(req->uas, st, 0); 456 } 457 458 /* --------------------------------------------------------------------- */ 459 460 static int usb_uas_get_lun(uint64_t lun64) 461 { 462 return (lun64 >> 48) & 0xff; 463 } 464 465 static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64) 466 { 467 if ((lun64 >> 56) != 0x00) { 468 return NULL; 469 } 470 return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64)); 471 } 472 473 static void usb_uas_complete_data_packet(UASRequest *req) 474 { 475 USBPacket *p; 476 477 if (!req->data_async) { 478 return; 479 } 480 p = req->data; 481 req->data = NULL; 482 req->data_async = false; 483 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 484 usb_packet_complete(&req->uas->dev, p); 485 } 486 487 static void usb_uas_copy_data(UASRequest *req) 488 { 489 uint32_t length; 490 491 length = MIN(req->buf_size - req->buf_off, 492 req->data->iov.size - req->data->actual_length); 493 trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length, 494 req->data->actual_length, req->data->iov.size, 495 req->buf_off, req->buf_size); 496 usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off, 497 length); 498 req->buf_off += length; 499 req->data_off += length; 500 501 if (req->data->actual_length == req->data->iov.size) { 502 usb_uas_complete_data_packet(req); 503 } 504 if (req->buf_size && req->buf_off == req->buf_size) { 505 req->buf_off = 0; 506 req->buf_size = 0; 507 scsi_req_continue(req->req); 508 } 509 } 510 511 static void usb_uas_start_next_transfer(UASDevice *uas) 512 { 513 UASRequest *req; 514 515 if (uas_using_streams(uas)) { 516 return; 517 } 518 519 QTAILQ_FOREACH(req, &uas->requests, next) { 520 if (req->active || req->complete) { 521 continue; 522 } 523 if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain2 == NULL) { 524 uas->datain2 = req; 525 usb_uas_queue_read_ready(req); 526 req->active = true; 527 return; 528 } 529 if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout2 == NULL) { 530 uas->dataout2 = req; 531 usb_uas_queue_write_ready(req); 532 req->active = true; 533 return; 534 } 535 } 536 } 537 538 static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_iu *iu) 539 { 540 UASRequest *req; 541 542 req = g_new0(UASRequest, 1); 543 req->uas = uas; 544 req->tag = be16_to_cpu(iu->hdr.tag); 545 req->lun = be64_to_cpu(iu->command.lun); 546 req->dev = usb_uas_get_dev(req->uas, req->lun); 547 return req; 548 } 549 550 static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv) 551 { 552 UASRequest *req = priv; 553 UASDevice *uas = req->uas; 554 555 if (req == uas->datain2) { 556 uas->datain2 = NULL; 557 } 558 if (req == uas->dataout2) { 559 uas->dataout2 = NULL; 560 } 561 QTAILQ_REMOVE(&uas->requests, req, next); 562 g_free(req); 563 usb_uas_start_next_transfer(uas); 564 } 565 566 static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag) 567 { 568 UASRequest *req; 569 570 QTAILQ_FOREACH(req, &uas->requests, next) { 571 if (req->tag == tag) { 572 return req; 573 } 574 } 575 return NULL; 576 } 577 578 static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len) 579 { 580 UASRequest *req = r->hba_private; 581 582 trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len); 583 req->buf_off = 0; 584 req->buf_size = len; 585 if (req->data) { 586 usb_uas_copy_data(req); 587 } else { 588 usb_uas_start_next_transfer(req->uas); 589 } 590 } 591 592 static void usb_uas_scsi_command_complete(SCSIRequest *r, 593 uint32_t status, size_t resid) 594 { 595 UASRequest *req = r->hba_private; 596 597 trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, status, resid); 598 req->complete = true; 599 if (req->data) { 600 usb_uas_complete_data_packet(req); 601 } 602 usb_uas_queue_sense(req, status); 603 scsi_req_unref(req->req); 604 } 605 606 static void usb_uas_scsi_request_cancelled(SCSIRequest *r) 607 { 608 UASRequest *req = r->hba_private; 609 610 /* FIXME: queue notification to status pipe? */ 611 scsi_req_unref(req->req); 612 } 613 614 static const struct SCSIBusInfo usb_uas_scsi_info = { 615 .tcq = true, 616 .max_target = 0, 617 .max_lun = 255, 618 619 .transfer_data = usb_uas_scsi_transfer_data, 620 .complete = usb_uas_scsi_command_complete, 621 .cancel = usb_uas_scsi_request_cancelled, 622 .free_request = usb_uas_scsi_free_request, 623 }; 624 625 /* --------------------------------------------------------------------- */ 626 627 static void usb_uas_handle_reset(USBDevice *dev) 628 { 629 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 630 UASRequest *req, *nreq; 631 UASStatus *st, *nst; 632 633 trace_usb_uas_reset(dev->addr); 634 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 635 scsi_req_cancel(req->req); 636 } 637 QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) { 638 QTAILQ_REMOVE(&uas->results, st, next); 639 g_free(st); 640 } 641 } 642 643 static void usb_uas_handle_control(USBDevice *dev, USBPacket *p, 644 int request, int value, int index, int length, uint8_t *data) 645 { 646 int ret; 647 648 ret = usb_desc_handle_control(dev, p, request, value, index, length, data); 649 if (ret >= 0) { 650 return; 651 } 652 error_report("%s: unhandled control request", __func__); 653 p->status = USB_RET_STALL; 654 } 655 656 static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p) 657 { 658 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 659 UASRequest *req, *nreq; 660 int i; 661 662 if (uas->status2 == p) { 663 uas->status2 = NULL; 664 qemu_bh_cancel(uas->status_bh); 665 return; 666 } 667 if (uas_using_streams(uas)) { 668 for (i = 0; i <= UAS_MAX_STREAMS; i++) { 669 if (uas->status3[i] == p) { 670 uas->status3[i] = NULL; 671 return; 672 } 673 if (uas->data3[i] == p) { 674 uas->data3[i] = NULL; 675 return; 676 } 677 } 678 } 679 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 680 if (req->data == p) { 681 req->data = NULL; 682 return; 683 } 684 } 685 assert(!"canceled usb packet not found"); 686 } 687 688 static void usb_uas_command(UASDevice *uas, uas_iu *iu) 689 { 690 UASRequest *req; 691 uint32_t len; 692 uint16_t tag = be16_to_cpu(iu->hdr.tag); 693 694 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 695 goto invalid_tag; 696 } 697 req = usb_uas_find_request(uas, tag); 698 if (req) { 699 goto overlapped_tag; 700 } 701 req = usb_uas_alloc_request(uas, iu); 702 if (req->dev == NULL) { 703 goto bad_target; 704 } 705 706 trace_usb_uas_command(uas->dev.addr, req->tag, 707 usb_uas_get_lun(req->lun), 708 req->lun >> 32, req->lun & 0xffffffff); 709 QTAILQ_INSERT_TAIL(&uas->requests, req, next); 710 if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) { 711 req->data = uas->data3[req->tag]; 712 req->data_async = true; 713 uas->data3[req->tag] = NULL; 714 } 715 716 req->req = scsi_req_new(req->dev, req->tag, 717 usb_uas_get_lun(req->lun), 718 iu->command.cdb, req); 719 if (uas->requestlog) { 720 scsi_req_print(req->req); 721 } 722 len = scsi_req_enqueue(req->req); 723 if (len) { 724 req->data_size = len; 725 scsi_req_continue(req->req); 726 } 727 return; 728 729 invalid_tag: 730 usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG); 731 return; 732 733 overlapped_tag: 734 usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS); 735 return; 736 737 bad_target: 738 usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED); 739 g_free(req); 740 } 741 742 static void usb_uas_task(UASDevice *uas, uas_iu *iu) 743 { 744 uint16_t tag = be16_to_cpu(iu->hdr.tag); 745 uint64_t lun64 = be64_to_cpu(iu->task.lun); 746 SCSIDevice *dev = usb_uas_get_dev(uas, lun64); 747 int lun = usb_uas_get_lun(lun64); 748 UASRequest *req; 749 uint16_t task_tag; 750 751 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 752 goto invalid_tag; 753 } 754 req = usb_uas_find_request(uas, be16_to_cpu(iu->hdr.tag)); 755 if (req) { 756 goto overlapped_tag; 757 } 758 if (dev == NULL) { 759 goto incorrect_lun; 760 } 761 762 switch (iu->task.function) { 763 case UAS_TMF_ABORT_TASK: 764 task_tag = be16_to_cpu(iu->task.task_tag); 765 trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag); 766 req = usb_uas_find_request(uas, task_tag); 767 if (req && req->dev == dev) { 768 scsi_req_cancel(req->req); 769 } 770 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 771 break; 772 773 case UAS_TMF_LOGICAL_UNIT_RESET: 774 trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun); 775 qdev_reset_all(&dev->qdev); 776 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 777 break; 778 779 default: 780 trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, iu->task.function); 781 usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED); 782 break; 783 } 784 return; 785 786 invalid_tag: 787 usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT); 788 return; 789 790 overlapped_tag: 791 usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG); 792 return; 793 794 incorrect_lun: 795 usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN); 796 } 797 798 static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) 799 { 800 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 801 uas_iu iu; 802 UASStatus *st; 803 UASRequest *req; 804 int length; 805 806 switch (p->ep->nr) { 807 case UAS_PIPE_ID_COMMAND: 808 length = MIN(sizeof(iu), p->iov.size); 809 usb_packet_copy(p, &iu, length); 810 switch (iu.hdr.id) { 811 case UAS_UI_COMMAND: 812 usb_uas_command(uas, &iu); 813 break; 814 case UAS_UI_TASK_MGMT: 815 usb_uas_task(uas, &iu); 816 break; 817 default: 818 error_report("%s: unknown command iu: id 0x%x", 819 __func__, iu.hdr.id); 820 p->status = USB_RET_STALL; 821 break; 822 } 823 break; 824 case UAS_PIPE_ID_STATUS: 825 if (p->stream) { 826 QTAILQ_FOREACH(st, &uas->results, next) { 827 if (st->stream == p->stream) { 828 break; 829 } 830 } 831 if (st == NULL) { 832 assert(uas->status3[p->stream] == NULL); 833 uas->status3[p->stream] = p; 834 p->status = USB_RET_ASYNC; 835 break; 836 } 837 } else { 838 st = QTAILQ_FIRST(&uas->results); 839 if (st == NULL) { 840 assert(uas->status2 == NULL); 841 uas->status2 = p; 842 p->status = USB_RET_ASYNC; 843 break; 844 } 845 } 846 usb_packet_copy(p, &st->status, st->length); 847 QTAILQ_REMOVE(&uas->results, st, next); 848 g_free(st); 849 break; 850 case UAS_PIPE_ID_DATA_IN: 851 case UAS_PIPE_ID_DATA_OUT: 852 if (p->stream) { 853 req = usb_uas_find_request(uas, p->stream); 854 } else { 855 req = (p->ep->nr == UAS_PIPE_ID_DATA_IN) 856 ? uas->datain2 : uas->dataout2; 857 } 858 if (req == NULL) { 859 if (p->stream) { 860 assert(uas->data3[p->stream] == NULL); 861 uas->data3[p->stream] = p; 862 p->status = USB_RET_ASYNC; 863 break; 864 } else { 865 error_report("%s: no inflight request", __func__); 866 p->status = USB_RET_STALL; 867 break; 868 } 869 } 870 scsi_req_ref(req->req); 871 req->data = p; 872 usb_uas_copy_data(req); 873 if (p->actual_length == p->iov.size || req->complete) { 874 req->data = NULL; 875 } else { 876 req->data_async = true; 877 p->status = USB_RET_ASYNC; 878 } 879 scsi_req_unref(req->req); 880 usb_uas_start_next_transfer(uas); 881 break; 882 default: 883 error_report("%s: invalid endpoint %d", __func__, p->ep->nr); 884 p->status = USB_RET_STALL; 885 break; 886 } 887 } 888 889 static void usb_uas_handle_destroy(USBDevice *dev) 890 { 891 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 892 893 qemu_bh_delete(uas->status_bh); 894 } 895 896 static void usb_uas_realize(USBDevice *dev, Error **errp) 897 { 898 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 899 900 usb_desc_create_serial(dev); 901 usb_desc_init(dev); 902 903 QTAILQ_INIT(&uas->results); 904 QTAILQ_INIT(&uas->requests); 905 uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas); 906 907 scsi_bus_new(&uas->bus, sizeof(uas->bus), DEVICE(dev), 908 &usb_uas_scsi_info, NULL); 909 } 910 911 static const VMStateDescription vmstate_usb_uas = { 912 .name = "usb-uas", 913 .unmigratable = 1, 914 .fields = (VMStateField[]) { 915 VMSTATE_USB_DEVICE(dev, UASDevice), 916 VMSTATE_END_OF_LIST() 917 } 918 }; 919 920 static Property uas_properties[] = { 921 DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0), 922 DEFINE_PROP_END_OF_LIST(), 923 }; 924 925 static void usb_uas_class_initfn(ObjectClass *klass, void *data) 926 { 927 DeviceClass *dc = DEVICE_CLASS(klass); 928 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 929 930 uc->realize = usb_uas_realize; 931 uc->product_desc = desc_strings[STR_PRODUCT]; 932 uc->usb_desc = &desc; 933 uc->cancel_packet = usb_uas_cancel_io; 934 uc->handle_attach = usb_desc_attach; 935 uc->handle_reset = usb_uas_handle_reset; 936 uc->handle_control = usb_uas_handle_control; 937 uc->handle_data = usb_uas_handle_data; 938 uc->handle_destroy = usb_uas_handle_destroy; 939 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 940 dc->fw_name = "storage"; 941 dc->vmsd = &vmstate_usb_uas; 942 dc->props = uas_properties; 943 } 944 945 static const TypeInfo uas_info = { 946 .name = "usb-uas", 947 .parent = TYPE_USB_DEVICE, 948 .instance_size = sizeof(UASDevice), 949 .class_init = usb_uas_class_initfn, 950 }; 951 952 static void usb_uas_register_types(void) 953 { 954 type_register_static(&uas_info); 955 } 956 957 type_init(usb_uas_register_types) 958