xref: /openbmc/qemu/hw/usb/dev-uas.c (revision 6d559996)
1 /*
2  * UAS (USB Attached SCSI) emulation
3  *
4  * Copyright Red Hat, Inc. 2012
5  *
6  * Author: Gerd Hoffmann <kraxel@redhat.com>
7  *
8  * This work is licensed under the terms of the GNU GPL, version 2 or later.
9  * See the COPYING file in the top-level directory.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qemu/option.h"
14 #include "qemu/config-file.h"
15 #include "trace.h"
16 #include "qemu/error-report.h"
17 #include "qemu/main-loop.h"
18 #include "qemu/module.h"
19 #include "qemu/log.h"
20 
21 #include "hw/usb.h"
22 #include "migration/vmstate.h"
23 #include "desc.h"
24 #include "hw/qdev-properties.h"
25 #include "hw/scsi/scsi.h"
26 #include "scsi/constants.h"
27 #include "qom/object.h"
28 
29 /* --------------------------------------------------------------------- */
30 
31 #define UAS_UI_COMMAND              0x01
32 #define UAS_UI_SENSE                0x03
33 #define UAS_UI_RESPONSE             0x04
34 #define UAS_UI_TASK_MGMT            0x05
35 #define UAS_UI_READ_READY           0x06
36 #define UAS_UI_WRITE_READY          0x07
37 
38 #define UAS_RC_TMF_COMPLETE         0x00
39 #define UAS_RC_INVALID_INFO_UNIT    0x02
40 #define UAS_RC_TMF_NOT_SUPPORTED    0x04
41 #define UAS_RC_TMF_FAILED           0x05
42 #define UAS_RC_TMF_SUCCEEDED        0x08
43 #define UAS_RC_INCORRECT_LUN        0x09
44 #define UAS_RC_OVERLAPPED_TAG       0x0a
45 
46 #define UAS_TMF_ABORT_TASK          0x01
47 #define UAS_TMF_ABORT_TASK_SET      0x02
48 #define UAS_TMF_CLEAR_TASK_SET      0x04
49 #define UAS_TMF_LOGICAL_UNIT_RESET  0x08
50 #define UAS_TMF_I_T_NEXUS_RESET     0x10
51 #define UAS_TMF_CLEAR_ACA           0x40
52 #define UAS_TMF_QUERY_TASK          0x80
53 #define UAS_TMF_QUERY_TASK_SET      0x81
54 #define UAS_TMF_QUERY_ASYNC_EVENT   0x82
55 
56 #define UAS_PIPE_ID_COMMAND         0x01
57 #define UAS_PIPE_ID_STATUS          0x02
58 #define UAS_PIPE_ID_DATA_IN         0x03
59 #define UAS_PIPE_ID_DATA_OUT        0x04
60 
61 typedef struct {
62     uint8_t    id;
63     uint8_t    reserved;
64     uint16_t   tag;
65 } QEMU_PACKED  uas_iu_header;
66 
67 typedef struct {
68     uint8_t    prio_taskattr;   /* 6:3 priority, 2:0 task attribute   */
69     uint8_t    reserved_1;
70     uint8_t    add_cdb_length;  /* 7:2 additional adb length (dwords) */
71     uint8_t    reserved_2;
72     uint64_t   lun;
73     uint8_t    cdb[16];
74     uint8_t    add_cdb[1];
75 } QEMU_PACKED  uas_iu_command;
76 
77 typedef struct {
78     uint16_t   status_qualifier;
79     uint8_t    status;
80     uint8_t    reserved[7];
81     uint16_t   sense_length;
82     uint8_t    sense_data[18];
83 } QEMU_PACKED  uas_iu_sense;
84 
85 typedef struct {
86     uint8_t    add_response_info[3];
87     uint8_t    response_code;
88 } QEMU_PACKED  uas_iu_response;
89 
90 typedef struct {
91     uint8_t    function;
92     uint8_t    reserved;
93     uint16_t   task_tag;
94     uint64_t   lun;
95 } QEMU_PACKED  uas_iu_task_mgmt;
96 
97 typedef struct {
98     uas_iu_header  hdr;
99     union {
100         uas_iu_command   command;
101         uas_iu_sense     sense;
102         uas_iu_task_mgmt task;
103         uas_iu_response  response;
104     };
105 } QEMU_PACKED  uas_iu;
106 
107 /* --------------------------------------------------------------------- */
108 
109 #define UAS_STREAM_BM_ATTR  4
110 #define UAS_MAX_STREAMS     (1 << UAS_STREAM_BM_ATTR)
111 
112 typedef struct UASDevice UASDevice;
113 typedef struct UASRequest UASRequest;
114 typedef struct UASStatus UASStatus;
115 
116 struct UASDevice {
117     USBDevice                 dev;
118     SCSIBus                   bus;
119     QEMUBH                    *status_bh;
120     QTAILQ_HEAD(, UASStatus)  results;
121     QTAILQ_HEAD(, UASRequest) requests;
122 
123     /* properties */
124     uint32_t                  requestlog;
125 
126     /* usb 2.0 only */
127     USBPacket                 *status2;
128     UASRequest                *datain2;
129     UASRequest                *dataout2;
130 
131     /* usb 3.0 only */
132     USBPacket                 *data3[UAS_MAX_STREAMS + 1];
133     USBPacket                 *status3[UAS_MAX_STREAMS + 1];
134 };
135 
136 #define TYPE_USB_UAS "usb-uas"
137 OBJECT_DECLARE_SIMPLE_TYPE(UASDevice, USB_UAS)
138 
139 struct UASRequest {
140     uint16_t     tag;
141     uint64_t     lun;
142     UASDevice    *uas;
143     SCSIDevice   *dev;
144     SCSIRequest  *req;
145     USBPacket    *data;
146     bool         data_async;
147     bool         active;
148     bool         complete;
149     uint32_t     buf_off;
150     uint32_t     buf_size;
151     uint32_t     data_off;
152     uint32_t     data_size;
153     QTAILQ_ENTRY(UASRequest)  next;
154 };
155 
156 struct UASStatus {
157     uint32_t                  stream;
158     uas_iu                    status;
159     uint32_t                  length;
160     QTAILQ_ENTRY(UASStatus)   next;
161 };
162 
163 /* --------------------------------------------------------------------- */
164 
165 enum {
166     STR_MANUFACTURER = 1,
167     STR_PRODUCT,
168     STR_SERIALNUMBER,
169     STR_CONFIG_HIGH,
170     STR_CONFIG_SUPER,
171 };
172 
173 static const USBDescStrings desc_strings = {
174     [STR_MANUFACTURER] = "QEMU",
175     [STR_PRODUCT]      = "USB Attached SCSI HBA",
176     [STR_SERIALNUMBER] = "27842",
177     [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
178     [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
179 };
180 
181 static const USBDescIface desc_iface_high = {
182     .bInterfaceNumber              = 0,
183     .bNumEndpoints                 = 4,
184     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
185     .bInterfaceSubClass            = 0x06, /* SCSI */
186     .bInterfaceProtocol            = 0x62, /* UAS  */
187     .eps = (USBDescEndpoint[]) {
188         {
189             .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_COMMAND,
190             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
191             .wMaxPacketSize        = 512,
192             .extra = (uint8_t[]) {
193                 0x04,  /*  u8  bLength */
194                 0x24,  /*  u8  bDescriptorType */
195                 UAS_PIPE_ID_COMMAND,
196                 0x00,  /*  u8  bReserved */
197             },
198         },{
199             .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_STATUS,
200             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
201             .wMaxPacketSize        = 512,
202             .extra = (uint8_t[]) {
203                 0x04,  /*  u8  bLength */
204                 0x24,  /*  u8  bDescriptorType */
205                 UAS_PIPE_ID_STATUS,
206                 0x00,  /*  u8  bReserved */
207             },
208         },{
209             .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_DATA_IN,
210             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
211             .wMaxPacketSize        = 512,
212             .extra = (uint8_t[]) {
213                 0x04,  /*  u8  bLength */
214                 0x24,  /*  u8  bDescriptorType */
215                 UAS_PIPE_ID_DATA_IN,
216                 0x00,  /*  u8  bReserved */
217             },
218         },{
219             .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT,
220             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
221             .wMaxPacketSize        = 512,
222             .extra = (uint8_t[]) {
223                 0x04,  /*  u8  bLength */
224                 0x24,  /*  u8  bDescriptorType */
225                 UAS_PIPE_ID_DATA_OUT,
226                 0x00,  /*  u8  bReserved */
227             },
228         },
229     }
230 };
231 
232 static const USBDescIface desc_iface_super = {
233     .bInterfaceNumber              = 0,
234     .bNumEndpoints                 = 4,
235     .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
236     .bInterfaceSubClass            = 0x06, /* SCSI */
237     .bInterfaceProtocol            = 0x62, /* UAS  */
238     .eps = (USBDescEndpoint[]) {
239         {
240             .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_COMMAND,
241             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
242             .wMaxPacketSize        = 1024,
243             .bMaxBurst             = 15,
244             .extra = (uint8_t[]) {
245                 0x04,  /*  u8  bLength */
246                 0x24,  /*  u8  bDescriptorType */
247                 UAS_PIPE_ID_COMMAND,
248                 0x00,  /*  u8  bReserved */
249             },
250         },{
251             .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_STATUS,
252             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
253             .wMaxPacketSize        = 1024,
254             .bMaxBurst             = 15,
255             .bmAttributes_super    = UAS_STREAM_BM_ATTR,
256             .extra = (uint8_t[]) {
257                 0x04,  /*  u8  bLength */
258                 0x24,  /*  u8  bDescriptorType */
259                 UAS_PIPE_ID_STATUS,
260                 0x00,  /*  u8  bReserved */
261             },
262         },{
263             .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_DATA_IN,
264             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
265             .wMaxPacketSize        = 1024,
266             .bMaxBurst             = 15,
267             .bmAttributes_super    = UAS_STREAM_BM_ATTR,
268             .extra = (uint8_t[]) {
269                 0x04,  /*  u8  bLength */
270                 0x24,  /*  u8  bDescriptorType */
271                 UAS_PIPE_ID_DATA_IN,
272                 0x00,  /*  u8  bReserved */
273             },
274         },{
275             .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT,
276             .bmAttributes          = USB_ENDPOINT_XFER_BULK,
277             .wMaxPacketSize        = 1024,
278             .bMaxBurst             = 15,
279             .bmAttributes_super    = UAS_STREAM_BM_ATTR,
280             .extra = (uint8_t[]) {
281                 0x04,  /*  u8  bLength */
282                 0x24,  /*  u8  bDescriptorType */
283                 UAS_PIPE_ID_DATA_OUT,
284                 0x00,  /*  u8  bReserved */
285             },
286         },
287     }
288 };
289 
290 static const USBDescDevice desc_device_high = {
291     .bcdUSB                        = 0x0200,
292     .bMaxPacketSize0               = 64,
293     .bNumConfigurations            = 1,
294     .confs = (USBDescConfig[]) {
295         {
296             .bNumInterfaces        = 1,
297             .bConfigurationValue   = 1,
298             .iConfiguration        = STR_CONFIG_HIGH,
299             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
300             .nif = 1,
301             .ifs = &desc_iface_high,
302         },
303     },
304 };
305 
306 static const USBDescDevice desc_device_super = {
307     .bcdUSB                        = 0x0300,
308     .bMaxPacketSize0               = 9,
309     .bNumConfigurations            = 1,
310     .confs = (USBDescConfig[]) {
311         {
312             .bNumInterfaces        = 1,
313             .bConfigurationValue   = 1,
314             .iConfiguration        = STR_CONFIG_SUPER,
315             .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
316             .nif = 1,
317             .ifs = &desc_iface_super,
318         },
319     },
320 };
321 
322 static const USBDesc desc = {
323     .id = {
324         .idVendor          = 0x46f4, /* CRC16() of "QEMU" */
325         .idProduct         = 0x0003,
326         .bcdDevice         = 0,
327         .iManufacturer     = STR_MANUFACTURER,
328         .iProduct          = STR_PRODUCT,
329         .iSerialNumber     = STR_SERIALNUMBER,
330     },
331     .high  = &desc_device_high,
332     .super = &desc_device_super,
333     .str   = desc_strings,
334 };
335 
336 /* --------------------------------------------------------------------- */
337 
338 static bool uas_using_streams(UASDevice *uas)
339 {
340     return uas->dev.speed == USB_SPEED_SUPER;
341 }
342 
343 /* --------------------------------------------------------------------- */
344 
345 static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag)
346 {
347     UASStatus *st = g_new0(UASStatus, 1);
348 
349     st->status.hdr.id = id;
350     st->status.hdr.tag = cpu_to_be16(tag);
351     st->length = sizeof(uas_iu_header);
352     if (uas_using_streams(uas)) {
353         st->stream = tag;
354     }
355     return st;
356 }
357 
358 static void usb_uas_send_status_bh(void *opaque)
359 {
360     UASDevice *uas = opaque;
361     UASStatus *st;
362     USBPacket *p;
363 
364     while ((st = QTAILQ_FIRST(&uas->results)) != NULL) {
365         if (uas_using_streams(uas)) {
366             p = uas->status3[st->stream];
367             uas->status3[st->stream] = NULL;
368         } else {
369             p = uas->status2;
370             uas->status2 = NULL;
371         }
372         if (p == NULL) {
373             break;
374         }
375 
376         usb_packet_copy(p, &st->status, st->length);
377         QTAILQ_REMOVE(&uas->results, st, next);
378         g_free(st);
379 
380         p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
381         usb_packet_complete(&uas->dev, p);
382     }
383 }
384 
385 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length)
386 {
387     USBPacket *p = uas_using_streams(uas) ?
388         uas->status3[st->stream] : uas->status2;
389 
390     st->length += length;
391     QTAILQ_INSERT_TAIL(&uas->results, st, next);
392     if (p) {
393         /*
394          * Just schedule bh make sure any in-flight data transaction
395          * is finished before completing (sending) the status packet.
396          */
397         qemu_bh_schedule(uas->status_bh);
398     } else {
399         USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN,
400                                      UAS_PIPE_ID_STATUS);
401         usb_wakeup(ep, st->stream);
402     }
403 }
404 
405 static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, uint8_t code)
406 {
407     UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_RESPONSE, tag);
408 
409     trace_usb_uas_response(uas->dev.addr, tag, code);
410     st->status.response.response_code = code;
411     usb_uas_queue_status(uas, st, sizeof(uas_iu_response));
412 }
413 
414 static void usb_uas_queue_sense(UASRequest *req, uint8_t status)
415 {
416     UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_SENSE, req->tag);
417     int len, slen = 0;
418 
419     trace_usb_uas_sense(req->uas->dev.addr, req->tag, status);
420     st->status.sense.status = status;
421     st->status.sense.status_qualifier = cpu_to_be16(0);
422     if (status != GOOD) {
423         slen = scsi_req_get_sense(req->req, st->status.sense.sense_data,
424                                   sizeof(st->status.sense.sense_data));
425         st->status.sense.sense_length = cpu_to_be16(slen);
426     }
427     len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen;
428     usb_uas_queue_status(req->uas, st, len);
429 }
430 
431 static void usb_uas_queue_fake_sense(UASDevice *uas, uint16_t tag,
432                                      struct SCSISense sense)
433 {
434     UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_SENSE, tag);
435     int len, slen = 0;
436 
437     st->status.sense.status = CHECK_CONDITION;
438     st->status.sense.status_qualifier = cpu_to_be16(0);
439     st->status.sense.sense_data[0] = 0x70;
440     st->status.sense.sense_data[2] = sense.key;
441     st->status.sense.sense_data[7] = 10;
442     st->status.sense.sense_data[12] = sense.asc;
443     st->status.sense.sense_data[13] = sense.ascq;
444     slen = 18;
445     len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen;
446     usb_uas_queue_status(uas, st, len);
447 }
448 
449 static void usb_uas_queue_read_ready(UASRequest *req)
450 {
451     UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_READ_READY,
452                                          req->tag);
453 
454     trace_usb_uas_read_ready(req->uas->dev.addr, req->tag);
455     usb_uas_queue_status(req->uas, st, 0);
456 }
457 
458 static void usb_uas_queue_write_ready(UASRequest *req)
459 {
460     UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_WRITE_READY,
461                                          req->tag);
462 
463     trace_usb_uas_write_ready(req->uas->dev.addr, req->tag);
464     usb_uas_queue_status(req->uas, st, 0);
465 }
466 
467 /* --------------------------------------------------------------------- */
468 
469 static int usb_uas_get_lun(uint64_t lun64)
470 {
471     return (lun64 >> 48) & 0xff;
472 }
473 
474 static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64)
475 {
476     if ((lun64 >> 56) != 0x00) {
477         return NULL;
478     }
479     return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64));
480 }
481 
482 static void usb_uas_complete_data_packet(UASRequest *req)
483 {
484     USBPacket *p;
485 
486     if (!req->data_async) {
487         return;
488     }
489     p = req->data;
490     req->data = NULL;
491     req->data_async = false;
492     p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
493     usb_packet_complete(&req->uas->dev, p);
494 }
495 
496 static void usb_uas_copy_data(UASRequest *req)
497 {
498     uint32_t length;
499 
500     length = MIN(req->buf_size - req->buf_off,
501                  req->data->iov.size - req->data->actual_length);
502     trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length,
503                             req->data->actual_length, req->data->iov.size,
504                             req->buf_off, req->buf_size);
505     usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off,
506                     length);
507     req->buf_off += length;
508     req->data_off += length;
509 
510     if (req->data->actual_length == req->data->iov.size) {
511         usb_uas_complete_data_packet(req);
512     }
513     if (req->buf_size && req->buf_off == req->buf_size) {
514         req->buf_off = 0;
515         req->buf_size = 0;
516         scsi_req_continue(req->req);
517     }
518 }
519 
520 static void usb_uas_start_next_transfer(UASDevice *uas)
521 {
522     UASRequest *req;
523 
524     if (uas_using_streams(uas)) {
525         return;
526     }
527 
528     QTAILQ_FOREACH(req, &uas->requests, next) {
529         if (req->active || req->complete) {
530             continue;
531         }
532         if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain2 == NULL) {
533             uas->datain2 = req;
534             usb_uas_queue_read_ready(req);
535             req->active = true;
536             return;
537         }
538         if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout2 == NULL) {
539             uas->dataout2 = req;
540             usb_uas_queue_write_ready(req);
541             req->active = true;
542             return;
543         }
544     }
545 }
546 
547 static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_iu *iu)
548 {
549     UASRequest *req;
550 
551     req = g_new0(UASRequest, 1);
552     req->uas = uas;
553     req->tag = be16_to_cpu(iu->hdr.tag);
554     req->lun = be64_to_cpu(iu->command.lun);
555     req->dev = usb_uas_get_dev(req->uas, req->lun);
556     return req;
557 }
558 
559 static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv)
560 {
561     UASRequest *req = priv;
562     UASDevice *uas = req->uas;
563 
564     if (req == uas->datain2) {
565         uas->datain2 = NULL;
566     }
567     if (req == uas->dataout2) {
568         uas->dataout2 = NULL;
569     }
570     QTAILQ_REMOVE(&uas->requests, req, next);
571     g_free(req);
572     usb_uas_start_next_transfer(uas);
573 }
574 
575 static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag)
576 {
577     UASRequest *req;
578 
579     QTAILQ_FOREACH(req, &uas->requests, next) {
580         if (req->tag == tag) {
581             return req;
582         }
583     }
584     return NULL;
585 }
586 
587 static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len)
588 {
589     UASRequest *req = r->hba_private;
590 
591     trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len);
592     req->buf_off = 0;
593     req->buf_size = len;
594     if (req->data) {
595         usb_uas_copy_data(req);
596     } else {
597         usb_uas_start_next_transfer(req->uas);
598     }
599 }
600 
601 static void usb_uas_scsi_command_complete(SCSIRequest *r, size_t resid)
602 {
603     UASRequest *req = r->hba_private;
604 
605     trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, r->status, resid);
606     req->complete = true;
607     if (req->data) {
608         usb_uas_complete_data_packet(req);
609     }
610     usb_uas_queue_sense(req, r->status);
611     scsi_req_unref(req->req);
612 }
613 
614 static void usb_uas_scsi_request_cancelled(SCSIRequest *r)
615 {
616     UASRequest *req = r->hba_private;
617 
618     /* FIXME: queue notification to status pipe? */
619     scsi_req_unref(req->req);
620 }
621 
622 static const struct SCSIBusInfo usb_uas_scsi_info = {
623     .tcq = true,
624     .max_target = 0,
625     .max_lun = 255,
626 
627     .transfer_data = usb_uas_scsi_transfer_data,
628     .complete = usb_uas_scsi_command_complete,
629     .cancel = usb_uas_scsi_request_cancelled,
630     .free_request = usb_uas_scsi_free_request,
631 };
632 
633 /* --------------------------------------------------------------------- */
634 
635 static void usb_uas_handle_reset(USBDevice *dev)
636 {
637     UASDevice *uas = USB_UAS(dev);
638     UASRequest *req, *nreq;
639     UASStatus *st, *nst;
640 
641     trace_usb_uas_reset(dev->addr);
642     QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) {
643         scsi_req_cancel(req->req);
644     }
645     QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) {
646         QTAILQ_REMOVE(&uas->results, st, next);
647         g_free(st);
648     }
649 }
650 
651 static void usb_uas_handle_control(USBDevice *dev, USBPacket *p,
652                int request, int value, int index, int length, uint8_t *data)
653 {
654     int ret;
655 
656     ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
657     if (ret >= 0) {
658         return;
659     }
660     error_report("%s: unhandled control request (req 0x%x, val 0x%x, idx 0x%x",
661                  __func__, request, value, index);
662     p->status = USB_RET_STALL;
663 }
664 
665 static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p)
666 {
667     UASDevice *uas = USB_UAS(dev);
668     UASRequest *req, *nreq;
669     int i;
670 
671     if (uas->status2 == p) {
672         uas->status2 = NULL;
673         qemu_bh_cancel(uas->status_bh);
674         return;
675     }
676     if (uas_using_streams(uas)) {
677         for (i = 0; i <= UAS_MAX_STREAMS; i++) {
678             if (uas->status3[i] == p) {
679                 uas->status3[i] = NULL;
680                 return;
681             }
682             if (uas->data3[i] == p) {
683                 uas->data3[i] = NULL;
684                 return;
685             }
686         }
687     }
688     QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) {
689         if (req->data == p) {
690             req->data = NULL;
691             return;
692         }
693     }
694     assert(!"canceled usb packet not found");
695 }
696 
697 static void usb_uas_command(UASDevice *uas, uas_iu *iu)
698 {
699     UASRequest *req;
700     uint32_t len;
701     uint16_t tag = be16_to_cpu(iu->hdr.tag);
702     size_t cdb_len = sizeof(iu->command.cdb) + iu->command.add_cdb_length;
703 
704     if (iu->command.add_cdb_length > 0) {
705         qemu_log_mask(LOG_UNIMP, "additional adb length not yet supported\n");
706         goto unsupported_len;
707     }
708 
709     if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
710         goto invalid_tag;
711     }
712     req = usb_uas_find_request(uas, tag);
713     if (req) {
714         goto overlapped_tag;
715     }
716     req = usb_uas_alloc_request(uas, iu);
717     if (req->dev == NULL) {
718         goto bad_target;
719     }
720 
721     trace_usb_uas_command(uas->dev.addr, req->tag,
722                           usb_uas_get_lun(req->lun),
723                           req->lun >> 32, req->lun & 0xffffffff);
724     QTAILQ_INSERT_TAIL(&uas->requests, req, next);
725     if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) {
726         req->data = uas->data3[req->tag];
727         req->data_async = true;
728         uas->data3[req->tag] = NULL;
729     }
730 
731     req->req = scsi_req_new(req->dev, req->tag,
732                             usb_uas_get_lun(req->lun),
733                             iu->command.cdb, cdb_len, req);
734     if (uas->requestlog) {
735         scsi_req_print(req->req);
736     }
737     len = scsi_req_enqueue(req->req);
738     if (len) {
739         req->data_size = len;
740         scsi_req_continue(req->req);
741     }
742     return;
743 
744 unsupported_len:
745     usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_PARAM_VALUE);
746     return;
747 
748 invalid_tag:
749     usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG);
750     return;
751 
752 overlapped_tag:
753     usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS);
754     return;
755 
756 bad_target:
757     usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED);
758     g_free(req);
759 }
760 
761 static void usb_uas_task(UASDevice *uas, uas_iu *iu)
762 {
763     uint16_t tag = be16_to_cpu(iu->hdr.tag);
764     uint64_t lun64 = be64_to_cpu(iu->task.lun);
765     SCSIDevice *dev = usb_uas_get_dev(uas, lun64);
766     int lun = usb_uas_get_lun(lun64);
767     UASRequest *req;
768     uint16_t task_tag;
769 
770     if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
771         goto invalid_tag;
772     }
773     req = usb_uas_find_request(uas, be16_to_cpu(iu->hdr.tag));
774     if (req) {
775         goto overlapped_tag;
776     }
777     if (dev == NULL) {
778         goto incorrect_lun;
779     }
780 
781     switch (iu->task.function) {
782     case UAS_TMF_ABORT_TASK:
783         task_tag = be16_to_cpu(iu->task.task_tag);
784         trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag);
785         req = usb_uas_find_request(uas, task_tag);
786         if (req && req->dev == dev) {
787             scsi_req_cancel(req->req);
788         }
789         usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE);
790         break;
791 
792     case UAS_TMF_LOGICAL_UNIT_RESET:
793         trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun);
794         device_cold_reset(&dev->qdev);
795         usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE);
796         break;
797 
798     default:
799         trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, iu->task.function);
800         usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED);
801         break;
802     }
803     return;
804 
805 invalid_tag:
806     usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT);
807     return;
808 
809 overlapped_tag:
810     usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG);
811     return;
812 
813 incorrect_lun:
814     usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN);
815 }
816 
817 static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
818 {
819     UASDevice *uas = USB_UAS(dev);
820     uas_iu iu;
821     UASStatus *st;
822     UASRequest *req;
823     int length;
824 
825     switch (p->ep->nr) {
826     case UAS_PIPE_ID_COMMAND:
827         length = MIN(sizeof(iu), p->iov.size);
828         usb_packet_copy(p, &iu, length);
829         switch (iu.hdr.id) {
830         case UAS_UI_COMMAND:
831             usb_uas_command(uas, &iu);
832             break;
833         case UAS_UI_TASK_MGMT:
834             usb_uas_task(uas, &iu);
835             break;
836         default:
837             error_report("%s: unknown command iu: id 0x%x",
838                          __func__, iu.hdr.id);
839             p->status = USB_RET_STALL;
840             break;
841         }
842         break;
843     case UAS_PIPE_ID_STATUS:
844         if (p->stream > UAS_MAX_STREAMS) {
845             goto err_stream;
846         }
847         if (p->stream) {
848             QTAILQ_FOREACH(st, &uas->results, next) {
849                 if (st->stream == p->stream) {
850                     break;
851                 }
852             }
853             if (st == NULL) {
854                 assert(uas->status3[p->stream] == NULL);
855                 uas->status3[p->stream] = p;
856                 p->status = USB_RET_ASYNC;
857                 break;
858             }
859         } else {
860             st = QTAILQ_FIRST(&uas->results);
861             if (st == NULL) {
862                 assert(uas->status2 == NULL);
863                 uas->status2 = p;
864                 p->status = USB_RET_ASYNC;
865                 break;
866             }
867         }
868         usb_packet_copy(p, &st->status, st->length);
869         QTAILQ_REMOVE(&uas->results, st, next);
870         g_free(st);
871         break;
872     case UAS_PIPE_ID_DATA_IN:
873     case UAS_PIPE_ID_DATA_OUT:
874         if (p->stream > UAS_MAX_STREAMS) {
875             goto err_stream;
876         }
877         if (p->stream) {
878             req = usb_uas_find_request(uas, p->stream);
879         } else {
880             req = (p->ep->nr == UAS_PIPE_ID_DATA_IN)
881                 ? uas->datain2 : uas->dataout2;
882         }
883         if (req == NULL) {
884             if (p->stream) {
885                 assert(uas->data3[p->stream] == NULL);
886                 uas->data3[p->stream] = p;
887                 p->status = USB_RET_ASYNC;
888                 break;
889             } else {
890                 error_report("%s: no inflight request", __func__);
891                 p->status = USB_RET_STALL;
892                 break;
893             }
894         }
895         scsi_req_ref(req->req);
896         req->data = p;
897         usb_uas_copy_data(req);
898         if (p->actual_length == p->iov.size || req->complete) {
899             req->data = NULL;
900         } else {
901             req->data_async = true;
902             p->status = USB_RET_ASYNC;
903         }
904         scsi_req_unref(req->req);
905         usb_uas_start_next_transfer(uas);
906         break;
907     default:
908         error_report("%s: invalid endpoint %d", __func__, p->ep->nr);
909         p->status = USB_RET_STALL;
910         break;
911     }
912     return;
913 
914 err_stream:
915     error_report("%s: invalid stream %d", __func__, p->stream);
916     p->status = USB_RET_STALL;
917     return;
918 }
919 
920 static void usb_uas_unrealize(USBDevice *dev)
921 {
922     UASDevice *uas = USB_UAS(dev);
923 
924     qemu_bh_delete(uas->status_bh);
925 }
926 
927 static void usb_uas_realize(USBDevice *dev, Error **errp)
928 {
929     UASDevice *uas = USB_UAS(dev);
930     DeviceState *d = DEVICE(dev);
931 
932     usb_desc_create_serial(dev);
933     usb_desc_init(dev);
934     if (d->hotplugged) {
935         uas->dev.auto_attach = 0;
936     }
937 
938     QTAILQ_INIT(&uas->results);
939     QTAILQ_INIT(&uas->requests);
940     uas->status_bh = qemu_bh_new_guarded(usb_uas_send_status_bh, uas,
941                                          &d->mem_reentrancy_guard);
942 
943     dev->flags |= (1 << USB_DEV_FLAG_IS_SCSI_STORAGE);
944     scsi_bus_init(&uas->bus, sizeof(uas->bus), DEVICE(dev), &usb_uas_scsi_info);
945 }
946 
947 static const VMStateDescription vmstate_usb_uas = {
948     .name = "usb-uas",
949     .unmigratable = 1,
950     .fields = (VMStateField[]) {
951         VMSTATE_USB_DEVICE(dev, UASDevice),
952         VMSTATE_END_OF_LIST()
953     }
954 };
955 
956 static Property uas_properties[] = {
957     DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0),
958     DEFINE_PROP_END_OF_LIST(),
959 };
960 
961 static void usb_uas_class_initfn(ObjectClass *klass, void *data)
962 {
963     DeviceClass *dc = DEVICE_CLASS(klass);
964     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
965 
966     uc->realize        = usb_uas_realize;
967     uc->product_desc   = desc_strings[STR_PRODUCT];
968     uc->usb_desc       = &desc;
969     uc->cancel_packet  = usb_uas_cancel_io;
970     uc->handle_attach  = usb_desc_attach;
971     uc->handle_reset   = usb_uas_handle_reset;
972     uc->handle_control = usb_uas_handle_control;
973     uc->handle_data    = usb_uas_handle_data;
974     uc->unrealize      = usb_uas_unrealize;
975     uc->attached_settable = true;
976     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
977     dc->fw_name = "storage";
978     dc->vmsd = &vmstate_usb_uas;
979     device_class_set_props(dc, uas_properties);
980 }
981 
982 static const TypeInfo uas_info = {
983     .name          = TYPE_USB_UAS,
984     .parent        = TYPE_USB_DEVICE,
985     .instance_size = sizeof(UASDevice),
986     .class_init    = usb_uas_class_initfn,
987 };
988 
989 static void usb_uas_register_types(void)
990 {
991     type_register_static(&uas_info);
992 }
993 
994 type_init(usb_uas_register_types)
995