1 /* 2 * UAS (USB Attached SCSI) emulation 3 * 4 * Copyright Red Hat, Inc. 2012 5 * 6 * Author: Gerd Hoffmann <kraxel@redhat.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or later. 9 * See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu-common.h" 14 #include "qemu/option.h" 15 #include "qemu/config-file.h" 16 #include "trace.h" 17 #include "qemu/error-report.h" 18 19 #include "hw/usb.h" 20 #include "hw/usb/desc.h" 21 #include "hw/scsi/scsi.h" 22 #include "scsi/constants.h" 23 24 /* --------------------------------------------------------------------- */ 25 26 #define UAS_UI_COMMAND 0x01 27 #define UAS_UI_SENSE 0x03 28 #define UAS_UI_RESPONSE 0x04 29 #define UAS_UI_TASK_MGMT 0x05 30 #define UAS_UI_READ_READY 0x06 31 #define UAS_UI_WRITE_READY 0x07 32 33 #define UAS_RC_TMF_COMPLETE 0x00 34 #define UAS_RC_INVALID_INFO_UNIT 0x02 35 #define UAS_RC_TMF_NOT_SUPPORTED 0x04 36 #define UAS_RC_TMF_FAILED 0x05 37 #define UAS_RC_TMF_SUCCEEDED 0x08 38 #define UAS_RC_INCORRECT_LUN 0x09 39 #define UAS_RC_OVERLAPPED_TAG 0x0a 40 41 #define UAS_TMF_ABORT_TASK 0x01 42 #define UAS_TMF_ABORT_TASK_SET 0x02 43 #define UAS_TMF_CLEAR_TASK_SET 0x04 44 #define UAS_TMF_LOGICAL_UNIT_RESET 0x08 45 #define UAS_TMF_I_T_NEXUS_RESET 0x10 46 #define UAS_TMF_CLEAR_ACA 0x40 47 #define UAS_TMF_QUERY_TASK 0x80 48 #define UAS_TMF_QUERY_TASK_SET 0x81 49 #define UAS_TMF_QUERY_ASYNC_EVENT 0x82 50 51 #define UAS_PIPE_ID_COMMAND 0x01 52 #define UAS_PIPE_ID_STATUS 0x02 53 #define UAS_PIPE_ID_DATA_IN 0x03 54 #define UAS_PIPE_ID_DATA_OUT 0x04 55 56 typedef struct { 57 uint8_t id; 58 uint8_t reserved; 59 uint16_t tag; 60 } QEMU_PACKED uas_iu_header; 61 62 typedef struct { 63 uint8_t prio_taskattr; /* 6:3 priority, 2:0 task attribute */ 64 uint8_t reserved_1; 65 uint8_t add_cdb_length; /* 7:2 additional adb length (dwords) */ 66 uint8_t reserved_2; 67 uint64_t lun; 68 uint8_t cdb[16]; 69 uint8_t add_cdb[]; 70 } QEMU_PACKED uas_iu_command; 71 72 typedef struct { 73 uint16_t status_qualifier; 74 uint8_t status; 75 uint8_t reserved[7]; 76 uint16_t sense_length; 77 uint8_t sense_data[18]; 78 } QEMU_PACKED uas_iu_sense; 79 80 typedef struct { 81 uint8_t add_response_info[3]; 82 uint8_t response_code; 83 } QEMU_PACKED uas_iu_response; 84 85 typedef struct { 86 uint8_t function; 87 uint8_t reserved; 88 uint16_t task_tag; 89 uint64_t lun; 90 } QEMU_PACKED uas_iu_task_mgmt; 91 92 typedef struct { 93 uas_iu_header hdr; 94 union { 95 uas_iu_command command; 96 uas_iu_sense sense; 97 uas_iu_task_mgmt task; 98 uas_iu_response response; 99 }; 100 } QEMU_PACKED uas_iu; 101 102 /* --------------------------------------------------------------------- */ 103 104 #define UAS_STREAM_BM_ATTR 4 105 #define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR) 106 107 typedef struct UASDevice UASDevice; 108 typedef struct UASRequest UASRequest; 109 typedef struct UASStatus UASStatus; 110 111 struct UASDevice { 112 USBDevice dev; 113 SCSIBus bus; 114 QEMUBH *status_bh; 115 QTAILQ_HEAD(, UASStatus) results; 116 QTAILQ_HEAD(, UASRequest) requests; 117 118 /* properties */ 119 uint32_t requestlog; 120 121 /* usb 2.0 only */ 122 USBPacket *status2; 123 UASRequest *datain2; 124 UASRequest *dataout2; 125 126 /* usb 3.0 only */ 127 USBPacket *data3[UAS_MAX_STREAMS + 1]; 128 USBPacket *status3[UAS_MAX_STREAMS + 1]; 129 }; 130 131 #define TYPE_USB_UAS "usb-uas" 132 #define USB_UAS(obj) OBJECT_CHECK(UASDevice, (obj), TYPE_USB_UAS) 133 134 struct UASRequest { 135 uint16_t tag; 136 uint64_t lun; 137 UASDevice *uas; 138 SCSIDevice *dev; 139 SCSIRequest *req; 140 USBPacket *data; 141 bool data_async; 142 bool active; 143 bool complete; 144 uint32_t buf_off; 145 uint32_t buf_size; 146 uint32_t data_off; 147 uint32_t data_size; 148 QTAILQ_ENTRY(UASRequest) next; 149 }; 150 151 struct UASStatus { 152 uint32_t stream; 153 uas_iu status; 154 uint32_t length; 155 QTAILQ_ENTRY(UASStatus) next; 156 }; 157 158 /* --------------------------------------------------------------------- */ 159 160 enum { 161 STR_MANUFACTURER = 1, 162 STR_PRODUCT, 163 STR_SERIALNUMBER, 164 STR_CONFIG_HIGH, 165 STR_CONFIG_SUPER, 166 }; 167 168 static const USBDescStrings desc_strings = { 169 [STR_MANUFACTURER] = "QEMU", 170 [STR_PRODUCT] = "USB Attached SCSI HBA", 171 [STR_SERIALNUMBER] = "27842", 172 [STR_CONFIG_HIGH] = "High speed config (usb 2.0)", 173 [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)", 174 }; 175 176 static const USBDescIface desc_iface_high = { 177 .bInterfaceNumber = 0, 178 .bNumEndpoints = 4, 179 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 180 .bInterfaceSubClass = 0x06, /* SCSI */ 181 .bInterfaceProtocol = 0x62, /* UAS */ 182 .eps = (USBDescEndpoint[]) { 183 { 184 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 185 .bmAttributes = USB_ENDPOINT_XFER_BULK, 186 .wMaxPacketSize = 512, 187 .extra = (uint8_t[]) { 188 0x04, /* u8 bLength */ 189 0x24, /* u8 bDescriptorType */ 190 UAS_PIPE_ID_COMMAND, 191 0x00, /* u8 bReserved */ 192 }, 193 },{ 194 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 195 .bmAttributes = USB_ENDPOINT_XFER_BULK, 196 .wMaxPacketSize = 512, 197 .extra = (uint8_t[]) { 198 0x04, /* u8 bLength */ 199 0x24, /* u8 bDescriptorType */ 200 UAS_PIPE_ID_STATUS, 201 0x00, /* u8 bReserved */ 202 }, 203 },{ 204 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 205 .bmAttributes = USB_ENDPOINT_XFER_BULK, 206 .wMaxPacketSize = 512, 207 .extra = (uint8_t[]) { 208 0x04, /* u8 bLength */ 209 0x24, /* u8 bDescriptorType */ 210 UAS_PIPE_ID_DATA_IN, 211 0x00, /* u8 bReserved */ 212 }, 213 },{ 214 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 215 .bmAttributes = USB_ENDPOINT_XFER_BULK, 216 .wMaxPacketSize = 512, 217 .extra = (uint8_t[]) { 218 0x04, /* u8 bLength */ 219 0x24, /* u8 bDescriptorType */ 220 UAS_PIPE_ID_DATA_OUT, 221 0x00, /* u8 bReserved */ 222 }, 223 }, 224 } 225 }; 226 227 static const USBDescIface desc_iface_super = { 228 .bInterfaceNumber = 0, 229 .bNumEndpoints = 4, 230 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 231 .bInterfaceSubClass = 0x06, /* SCSI */ 232 .bInterfaceProtocol = 0x62, /* UAS */ 233 .eps = (USBDescEndpoint[]) { 234 { 235 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 236 .bmAttributes = USB_ENDPOINT_XFER_BULK, 237 .wMaxPacketSize = 1024, 238 .bMaxBurst = 15, 239 .extra = (uint8_t[]) { 240 0x04, /* u8 bLength */ 241 0x24, /* u8 bDescriptorType */ 242 UAS_PIPE_ID_COMMAND, 243 0x00, /* u8 bReserved */ 244 }, 245 },{ 246 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 247 .bmAttributes = USB_ENDPOINT_XFER_BULK, 248 .wMaxPacketSize = 1024, 249 .bMaxBurst = 15, 250 .bmAttributes_super = UAS_STREAM_BM_ATTR, 251 .extra = (uint8_t[]) { 252 0x04, /* u8 bLength */ 253 0x24, /* u8 bDescriptorType */ 254 UAS_PIPE_ID_STATUS, 255 0x00, /* u8 bReserved */ 256 }, 257 },{ 258 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 259 .bmAttributes = USB_ENDPOINT_XFER_BULK, 260 .wMaxPacketSize = 1024, 261 .bMaxBurst = 15, 262 .bmAttributes_super = UAS_STREAM_BM_ATTR, 263 .extra = (uint8_t[]) { 264 0x04, /* u8 bLength */ 265 0x24, /* u8 bDescriptorType */ 266 UAS_PIPE_ID_DATA_IN, 267 0x00, /* u8 bReserved */ 268 }, 269 },{ 270 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 271 .bmAttributes = USB_ENDPOINT_XFER_BULK, 272 .wMaxPacketSize = 1024, 273 .bMaxBurst = 15, 274 .bmAttributes_super = UAS_STREAM_BM_ATTR, 275 .extra = (uint8_t[]) { 276 0x04, /* u8 bLength */ 277 0x24, /* u8 bDescriptorType */ 278 UAS_PIPE_ID_DATA_OUT, 279 0x00, /* u8 bReserved */ 280 }, 281 }, 282 } 283 }; 284 285 static const USBDescDevice desc_device_high = { 286 .bcdUSB = 0x0200, 287 .bMaxPacketSize0 = 64, 288 .bNumConfigurations = 1, 289 .confs = (USBDescConfig[]) { 290 { 291 .bNumInterfaces = 1, 292 .bConfigurationValue = 1, 293 .iConfiguration = STR_CONFIG_HIGH, 294 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 295 .nif = 1, 296 .ifs = &desc_iface_high, 297 }, 298 }, 299 }; 300 301 static const USBDescDevice desc_device_super = { 302 .bcdUSB = 0x0300, 303 .bMaxPacketSize0 = 64, 304 .bNumConfigurations = 1, 305 .confs = (USBDescConfig[]) { 306 { 307 .bNumInterfaces = 1, 308 .bConfigurationValue = 1, 309 .iConfiguration = STR_CONFIG_SUPER, 310 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 311 .nif = 1, 312 .ifs = &desc_iface_super, 313 }, 314 }, 315 }; 316 317 static const USBDesc desc = { 318 .id = { 319 .idVendor = 0x46f4, /* CRC16() of "QEMU" */ 320 .idProduct = 0x0003, 321 .bcdDevice = 0, 322 .iManufacturer = STR_MANUFACTURER, 323 .iProduct = STR_PRODUCT, 324 .iSerialNumber = STR_SERIALNUMBER, 325 }, 326 .high = &desc_device_high, 327 .super = &desc_device_super, 328 .str = desc_strings, 329 }; 330 331 /* --------------------------------------------------------------------- */ 332 333 static bool uas_using_streams(UASDevice *uas) 334 { 335 return uas->dev.speed == USB_SPEED_SUPER; 336 } 337 338 /* --------------------------------------------------------------------- */ 339 340 static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag) 341 { 342 UASStatus *st = g_new0(UASStatus, 1); 343 344 st->status.hdr.id = id; 345 st->status.hdr.tag = cpu_to_be16(tag); 346 st->length = sizeof(uas_iu_header); 347 if (uas_using_streams(uas)) { 348 st->stream = tag; 349 } 350 return st; 351 } 352 353 static void usb_uas_send_status_bh(void *opaque) 354 { 355 UASDevice *uas = opaque; 356 UASStatus *st; 357 USBPacket *p; 358 359 while ((st = QTAILQ_FIRST(&uas->results)) != NULL) { 360 if (uas_using_streams(uas)) { 361 p = uas->status3[st->stream]; 362 uas->status3[st->stream] = NULL; 363 } else { 364 p = uas->status2; 365 uas->status2 = NULL; 366 } 367 if (p == NULL) { 368 break; 369 } 370 371 usb_packet_copy(p, &st->status, st->length); 372 QTAILQ_REMOVE(&uas->results, st, next); 373 g_free(st); 374 375 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 376 usb_packet_complete(&uas->dev, p); 377 } 378 } 379 380 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) 381 { 382 USBPacket *p = uas_using_streams(uas) ? 383 uas->status3[st->stream] : uas->status2; 384 385 st->length += length; 386 QTAILQ_INSERT_TAIL(&uas->results, st, next); 387 if (p) { 388 /* 389 * Just schedule bh make sure any in-flight data transaction 390 * is finished before completing (sending) the status packet. 391 */ 392 qemu_bh_schedule(uas->status_bh); 393 } else { 394 USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN, 395 UAS_PIPE_ID_STATUS); 396 usb_wakeup(ep, st->stream); 397 } 398 } 399 400 static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, uint8_t code) 401 { 402 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_RESPONSE, tag); 403 404 trace_usb_uas_response(uas->dev.addr, tag, code); 405 st->status.response.response_code = code; 406 usb_uas_queue_status(uas, st, sizeof(uas_iu_response)); 407 } 408 409 static void usb_uas_queue_sense(UASRequest *req, uint8_t status) 410 { 411 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_SENSE, req->tag); 412 int len, slen = 0; 413 414 trace_usb_uas_sense(req->uas->dev.addr, req->tag, status); 415 st->status.sense.status = status; 416 st->status.sense.status_qualifier = cpu_to_be16(0); 417 if (status != GOOD) { 418 slen = scsi_req_get_sense(req->req, st->status.sense.sense_data, 419 sizeof(st->status.sense.sense_data)); 420 st->status.sense.sense_length = cpu_to_be16(slen); 421 } 422 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 423 usb_uas_queue_status(req->uas, st, len); 424 } 425 426 static void usb_uas_queue_fake_sense(UASDevice *uas, uint16_t tag, 427 struct SCSISense sense) 428 { 429 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_SENSE, tag); 430 int len, slen = 0; 431 432 st->status.sense.status = CHECK_CONDITION; 433 st->status.sense.status_qualifier = cpu_to_be16(0); 434 st->status.sense.sense_data[0] = 0x70; 435 st->status.sense.sense_data[2] = sense.key; 436 st->status.sense.sense_data[7] = 10; 437 st->status.sense.sense_data[12] = sense.asc; 438 st->status.sense.sense_data[13] = sense.ascq; 439 slen = 18; 440 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 441 usb_uas_queue_status(uas, st, len); 442 } 443 444 static void usb_uas_queue_read_ready(UASRequest *req) 445 { 446 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_READ_READY, 447 req->tag); 448 449 trace_usb_uas_read_ready(req->uas->dev.addr, req->tag); 450 usb_uas_queue_status(req->uas, st, 0); 451 } 452 453 static void usb_uas_queue_write_ready(UASRequest *req) 454 { 455 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_WRITE_READY, 456 req->tag); 457 458 trace_usb_uas_write_ready(req->uas->dev.addr, req->tag); 459 usb_uas_queue_status(req->uas, st, 0); 460 } 461 462 /* --------------------------------------------------------------------- */ 463 464 static int usb_uas_get_lun(uint64_t lun64) 465 { 466 return (lun64 >> 48) & 0xff; 467 } 468 469 static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64) 470 { 471 if ((lun64 >> 56) != 0x00) { 472 return NULL; 473 } 474 return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64)); 475 } 476 477 static void usb_uas_complete_data_packet(UASRequest *req) 478 { 479 USBPacket *p; 480 481 if (!req->data_async) { 482 return; 483 } 484 p = req->data; 485 req->data = NULL; 486 req->data_async = false; 487 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 488 usb_packet_complete(&req->uas->dev, p); 489 } 490 491 static void usb_uas_copy_data(UASRequest *req) 492 { 493 uint32_t length; 494 495 length = MIN(req->buf_size - req->buf_off, 496 req->data->iov.size - req->data->actual_length); 497 trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length, 498 req->data->actual_length, req->data->iov.size, 499 req->buf_off, req->buf_size); 500 usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off, 501 length); 502 req->buf_off += length; 503 req->data_off += length; 504 505 if (req->data->actual_length == req->data->iov.size) { 506 usb_uas_complete_data_packet(req); 507 } 508 if (req->buf_size && req->buf_off == req->buf_size) { 509 req->buf_off = 0; 510 req->buf_size = 0; 511 scsi_req_continue(req->req); 512 } 513 } 514 515 static void usb_uas_start_next_transfer(UASDevice *uas) 516 { 517 UASRequest *req; 518 519 if (uas_using_streams(uas)) { 520 return; 521 } 522 523 QTAILQ_FOREACH(req, &uas->requests, next) { 524 if (req->active || req->complete) { 525 continue; 526 } 527 if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain2 == NULL) { 528 uas->datain2 = req; 529 usb_uas_queue_read_ready(req); 530 req->active = true; 531 return; 532 } 533 if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout2 == NULL) { 534 uas->dataout2 = req; 535 usb_uas_queue_write_ready(req); 536 req->active = true; 537 return; 538 } 539 } 540 } 541 542 static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_iu *iu) 543 { 544 UASRequest *req; 545 546 req = g_new0(UASRequest, 1); 547 req->uas = uas; 548 req->tag = be16_to_cpu(iu->hdr.tag); 549 req->lun = be64_to_cpu(iu->command.lun); 550 req->dev = usb_uas_get_dev(req->uas, req->lun); 551 return req; 552 } 553 554 static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv) 555 { 556 UASRequest *req = priv; 557 UASDevice *uas = req->uas; 558 559 if (req == uas->datain2) { 560 uas->datain2 = NULL; 561 } 562 if (req == uas->dataout2) { 563 uas->dataout2 = NULL; 564 } 565 QTAILQ_REMOVE(&uas->requests, req, next); 566 g_free(req); 567 usb_uas_start_next_transfer(uas); 568 } 569 570 static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag) 571 { 572 UASRequest *req; 573 574 QTAILQ_FOREACH(req, &uas->requests, next) { 575 if (req->tag == tag) { 576 return req; 577 } 578 } 579 return NULL; 580 } 581 582 static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len) 583 { 584 UASRequest *req = r->hba_private; 585 586 trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len); 587 req->buf_off = 0; 588 req->buf_size = len; 589 if (req->data) { 590 usb_uas_copy_data(req); 591 } else { 592 usb_uas_start_next_transfer(req->uas); 593 } 594 } 595 596 static void usb_uas_scsi_command_complete(SCSIRequest *r, 597 uint32_t status, size_t resid) 598 { 599 UASRequest *req = r->hba_private; 600 601 trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, status, resid); 602 req->complete = true; 603 if (req->data) { 604 usb_uas_complete_data_packet(req); 605 } 606 usb_uas_queue_sense(req, status); 607 scsi_req_unref(req->req); 608 } 609 610 static void usb_uas_scsi_request_cancelled(SCSIRequest *r) 611 { 612 UASRequest *req = r->hba_private; 613 614 /* FIXME: queue notification to status pipe? */ 615 scsi_req_unref(req->req); 616 } 617 618 static const struct SCSIBusInfo usb_uas_scsi_info = { 619 .tcq = true, 620 .max_target = 0, 621 .max_lun = 255, 622 623 .transfer_data = usb_uas_scsi_transfer_data, 624 .complete = usb_uas_scsi_command_complete, 625 .cancel = usb_uas_scsi_request_cancelled, 626 .free_request = usb_uas_scsi_free_request, 627 }; 628 629 /* --------------------------------------------------------------------- */ 630 631 static void usb_uas_handle_reset(USBDevice *dev) 632 { 633 UASDevice *uas = USB_UAS(dev); 634 UASRequest *req, *nreq; 635 UASStatus *st, *nst; 636 637 trace_usb_uas_reset(dev->addr); 638 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 639 scsi_req_cancel(req->req); 640 } 641 QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) { 642 QTAILQ_REMOVE(&uas->results, st, next); 643 g_free(st); 644 } 645 } 646 647 static void usb_uas_handle_control(USBDevice *dev, USBPacket *p, 648 int request, int value, int index, int length, uint8_t *data) 649 { 650 int ret; 651 652 ret = usb_desc_handle_control(dev, p, request, value, index, length, data); 653 if (ret >= 0) { 654 return; 655 } 656 error_report("%s: unhandled control request (req 0x%x, val 0x%x, idx 0x%x", 657 __func__, request, value, index); 658 p->status = USB_RET_STALL; 659 } 660 661 static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p) 662 { 663 UASDevice *uas = USB_UAS(dev); 664 UASRequest *req, *nreq; 665 int i; 666 667 if (uas->status2 == p) { 668 uas->status2 = NULL; 669 qemu_bh_cancel(uas->status_bh); 670 return; 671 } 672 if (uas_using_streams(uas)) { 673 for (i = 0; i <= UAS_MAX_STREAMS; i++) { 674 if (uas->status3[i] == p) { 675 uas->status3[i] = NULL; 676 return; 677 } 678 if (uas->data3[i] == p) { 679 uas->data3[i] = NULL; 680 return; 681 } 682 } 683 } 684 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 685 if (req->data == p) { 686 req->data = NULL; 687 return; 688 } 689 } 690 assert(!"canceled usb packet not found"); 691 } 692 693 static void usb_uas_command(UASDevice *uas, uas_iu *iu) 694 { 695 UASRequest *req; 696 uint32_t len; 697 uint16_t tag = be16_to_cpu(iu->hdr.tag); 698 699 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 700 goto invalid_tag; 701 } 702 req = usb_uas_find_request(uas, tag); 703 if (req) { 704 goto overlapped_tag; 705 } 706 req = usb_uas_alloc_request(uas, iu); 707 if (req->dev == NULL) { 708 goto bad_target; 709 } 710 711 trace_usb_uas_command(uas->dev.addr, req->tag, 712 usb_uas_get_lun(req->lun), 713 req->lun >> 32, req->lun & 0xffffffff); 714 QTAILQ_INSERT_TAIL(&uas->requests, req, next); 715 if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) { 716 req->data = uas->data3[req->tag]; 717 req->data_async = true; 718 uas->data3[req->tag] = NULL; 719 } 720 721 req->req = scsi_req_new(req->dev, req->tag, 722 usb_uas_get_lun(req->lun), 723 iu->command.cdb, req); 724 if (uas->requestlog) { 725 scsi_req_print(req->req); 726 } 727 len = scsi_req_enqueue(req->req); 728 if (len) { 729 req->data_size = len; 730 scsi_req_continue(req->req); 731 } 732 return; 733 734 invalid_tag: 735 usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG); 736 return; 737 738 overlapped_tag: 739 usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS); 740 return; 741 742 bad_target: 743 usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED); 744 g_free(req); 745 } 746 747 static void usb_uas_task(UASDevice *uas, uas_iu *iu) 748 { 749 uint16_t tag = be16_to_cpu(iu->hdr.tag); 750 uint64_t lun64 = be64_to_cpu(iu->task.lun); 751 SCSIDevice *dev = usb_uas_get_dev(uas, lun64); 752 int lun = usb_uas_get_lun(lun64); 753 UASRequest *req; 754 uint16_t task_tag; 755 756 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 757 goto invalid_tag; 758 } 759 req = usb_uas_find_request(uas, be16_to_cpu(iu->hdr.tag)); 760 if (req) { 761 goto overlapped_tag; 762 } 763 if (dev == NULL) { 764 goto incorrect_lun; 765 } 766 767 switch (iu->task.function) { 768 case UAS_TMF_ABORT_TASK: 769 task_tag = be16_to_cpu(iu->task.task_tag); 770 trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag); 771 req = usb_uas_find_request(uas, task_tag); 772 if (req && req->dev == dev) { 773 scsi_req_cancel(req->req); 774 } 775 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 776 break; 777 778 case UAS_TMF_LOGICAL_UNIT_RESET: 779 trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun); 780 qdev_reset_all(&dev->qdev); 781 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 782 break; 783 784 default: 785 trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, iu->task.function); 786 usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED); 787 break; 788 } 789 return; 790 791 invalid_tag: 792 usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT); 793 return; 794 795 overlapped_tag: 796 usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG); 797 return; 798 799 incorrect_lun: 800 usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN); 801 } 802 803 static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) 804 { 805 UASDevice *uas = USB_UAS(dev); 806 uas_iu iu; 807 UASStatus *st; 808 UASRequest *req; 809 int length; 810 811 switch (p->ep->nr) { 812 case UAS_PIPE_ID_COMMAND: 813 length = MIN(sizeof(iu), p->iov.size); 814 usb_packet_copy(p, &iu, length); 815 switch (iu.hdr.id) { 816 case UAS_UI_COMMAND: 817 usb_uas_command(uas, &iu); 818 break; 819 case UAS_UI_TASK_MGMT: 820 usb_uas_task(uas, &iu); 821 break; 822 default: 823 error_report("%s: unknown command iu: id 0x%x", 824 __func__, iu.hdr.id); 825 p->status = USB_RET_STALL; 826 break; 827 } 828 break; 829 case UAS_PIPE_ID_STATUS: 830 if (p->stream) { 831 QTAILQ_FOREACH(st, &uas->results, next) { 832 if (st->stream == p->stream) { 833 break; 834 } 835 } 836 if (st == NULL) { 837 assert(uas->status3[p->stream] == NULL); 838 uas->status3[p->stream] = p; 839 p->status = USB_RET_ASYNC; 840 break; 841 } 842 } else { 843 st = QTAILQ_FIRST(&uas->results); 844 if (st == NULL) { 845 assert(uas->status2 == NULL); 846 uas->status2 = p; 847 p->status = USB_RET_ASYNC; 848 break; 849 } 850 } 851 usb_packet_copy(p, &st->status, st->length); 852 QTAILQ_REMOVE(&uas->results, st, next); 853 g_free(st); 854 break; 855 case UAS_PIPE_ID_DATA_IN: 856 case UAS_PIPE_ID_DATA_OUT: 857 if (p->stream) { 858 req = usb_uas_find_request(uas, p->stream); 859 } else { 860 req = (p->ep->nr == UAS_PIPE_ID_DATA_IN) 861 ? uas->datain2 : uas->dataout2; 862 } 863 if (req == NULL) { 864 if (p->stream) { 865 assert(uas->data3[p->stream] == NULL); 866 uas->data3[p->stream] = p; 867 p->status = USB_RET_ASYNC; 868 break; 869 } else { 870 error_report("%s: no inflight request", __func__); 871 p->status = USB_RET_STALL; 872 break; 873 } 874 } 875 scsi_req_ref(req->req); 876 req->data = p; 877 usb_uas_copy_data(req); 878 if (p->actual_length == p->iov.size || req->complete) { 879 req->data = NULL; 880 } else { 881 req->data_async = true; 882 p->status = USB_RET_ASYNC; 883 } 884 scsi_req_unref(req->req); 885 usb_uas_start_next_transfer(uas); 886 break; 887 default: 888 error_report("%s: invalid endpoint %d", __func__, p->ep->nr); 889 p->status = USB_RET_STALL; 890 break; 891 } 892 } 893 894 static void usb_uas_unrealize(USBDevice *dev, Error **errp) 895 { 896 UASDevice *uas = USB_UAS(dev); 897 898 qemu_bh_delete(uas->status_bh); 899 900 object_unref(OBJECT(&uas->bus)); 901 } 902 903 static void usb_uas_realize(USBDevice *dev, Error **errp) 904 { 905 UASDevice *uas = USB_UAS(dev); 906 DeviceState *d = DEVICE(dev); 907 908 usb_desc_create_serial(dev); 909 usb_desc_init(dev); 910 if (d->hotplugged) { 911 uas->dev.auto_attach = 0; 912 } 913 914 QTAILQ_INIT(&uas->results); 915 QTAILQ_INIT(&uas->requests); 916 uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas); 917 918 scsi_bus_new(&uas->bus, sizeof(uas->bus), DEVICE(dev), 919 &usb_uas_scsi_info, NULL); 920 } 921 922 static const VMStateDescription vmstate_usb_uas = { 923 .name = "usb-uas", 924 .unmigratable = 1, 925 .fields = (VMStateField[]) { 926 VMSTATE_USB_DEVICE(dev, UASDevice), 927 VMSTATE_END_OF_LIST() 928 } 929 }; 930 931 static Property uas_properties[] = { 932 DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0), 933 DEFINE_PROP_END_OF_LIST(), 934 }; 935 936 static void usb_uas_class_initfn(ObjectClass *klass, void *data) 937 { 938 DeviceClass *dc = DEVICE_CLASS(klass); 939 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 940 941 uc->realize = usb_uas_realize; 942 uc->product_desc = desc_strings[STR_PRODUCT]; 943 uc->usb_desc = &desc; 944 uc->cancel_packet = usb_uas_cancel_io; 945 uc->handle_attach = usb_desc_attach; 946 uc->handle_reset = usb_uas_handle_reset; 947 uc->handle_control = usb_uas_handle_control; 948 uc->handle_data = usb_uas_handle_data; 949 uc->unrealize = usb_uas_unrealize; 950 uc->attached_settable = true; 951 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 952 dc->fw_name = "storage"; 953 dc->vmsd = &vmstate_usb_uas; 954 dc->props = uas_properties; 955 } 956 957 static const TypeInfo uas_info = { 958 .name = TYPE_USB_UAS, 959 .parent = TYPE_USB_DEVICE, 960 .instance_size = sizeof(UASDevice), 961 .class_init = usb_uas_class_initfn, 962 }; 963 964 static void usb_uas_register_types(void) 965 { 966 type_register_static(&uas_info); 967 } 968 969 type_init(usb_uas_register_types) 970