1 /* 2 * UAS (USB Attached SCSI) emulation 3 * 4 * Copyright Red Hat, Inc. 2012 5 * 6 * Author: Gerd Hoffmann <kraxel@redhat.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or later. 9 * See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu-common.h" 13 #include "qemu-option.h" 14 #include "qemu-config.h" 15 #include "trace.h" 16 17 #include "hw/usb.h" 18 #include "hw/usb/desc.h" 19 #include "hw/scsi.h" 20 #include "hw/scsi-defs.h" 21 22 /* --------------------------------------------------------------------- */ 23 24 #define UAS_UI_COMMAND 0x01 25 #define UAS_UI_SENSE 0x03 26 #define UAS_UI_RESPONSE 0x04 27 #define UAS_UI_TASK_MGMT 0x05 28 #define UAS_UI_READ_READY 0x06 29 #define UAS_UI_WRITE_READY 0x07 30 31 #define UAS_RC_TMF_COMPLETE 0x00 32 #define UAS_RC_INVALID_INFO_UNIT 0x02 33 #define UAS_RC_TMF_NOT_SUPPORTED 0x04 34 #define UAS_RC_TMF_FAILED 0x05 35 #define UAS_RC_TMF_SUCCEEDED 0x08 36 #define UAS_RC_INCORRECT_LUN 0x09 37 #define UAS_RC_OVERLAPPED_TAG 0x0a 38 39 #define UAS_TMF_ABORT_TASK 0x01 40 #define UAS_TMF_ABORT_TASK_SET 0x02 41 #define UAS_TMF_CLEAR_TASK_SET 0x04 42 #define UAS_TMF_LOGICAL_UNIT_RESET 0x08 43 #define UAS_TMF_I_T_NEXUS_RESET 0x10 44 #define UAS_TMF_CLEAR_ACA 0x40 45 #define UAS_TMF_QUERY_TASK 0x80 46 #define UAS_TMF_QUERY_TASK_SET 0x81 47 #define UAS_TMF_QUERY_ASYNC_EVENT 0x82 48 49 #define UAS_PIPE_ID_COMMAND 0x01 50 #define UAS_PIPE_ID_STATUS 0x02 51 #define UAS_PIPE_ID_DATA_IN 0x03 52 #define UAS_PIPE_ID_DATA_OUT 0x04 53 54 typedef struct { 55 uint8_t id; 56 uint8_t reserved; 57 uint16_t tag; 58 } QEMU_PACKED uas_ui_header; 59 60 typedef struct { 61 uint8_t prio_taskattr; /* 6:3 priority, 2:0 task attribute */ 62 uint8_t reserved_1; 63 uint8_t add_cdb_length; /* 7:2 additional adb length (dwords) */ 64 uint8_t reserved_2; 65 uint64_t lun; 66 uint8_t cdb[16]; 67 uint8_t add_cdb[]; 68 } QEMU_PACKED uas_ui_command; 69 70 typedef struct { 71 uint16_t status_qualifier; 72 uint8_t status; 73 uint8_t reserved[7]; 74 uint16_t sense_length; 75 uint8_t sense_data[18]; 76 } QEMU_PACKED uas_ui_sense; 77 78 typedef struct { 79 uint16_t add_response_info; 80 uint8_t response_code; 81 } QEMU_PACKED uas_ui_response; 82 83 typedef struct { 84 uint8_t function; 85 uint8_t reserved; 86 uint16_t task_tag; 87 uint64_t lun; 88 } QEMU_PACKED uas_ui_task_mgmt; 89 90 typedef struct { 91 uas_ui_header hdr; 92 union { 93 uas_ui_command command; 94 uas_ui_sense sense; 95 uas_ui_task_mgmt task; 96 uas_ui_response response; 97 }; 98 } QEMU_PACKED uas_ui; 99 100 /* --------------------------------------------------------------------- */ 101 102 typedef struct UASDevice UASDevice; 103 typedef struct UASRequest UASRequest; 104 typedef struct UASStatus UASStatus; 105 106 struct UASDevice { 107 USBDevice dev; 108 SCSIBus bus; 109 UASRequest *datain; 110 UASRequest *dataout; 111 USBPacket *status; 112 QEMUBH *status_bh; 113 QTAILQ_HEAD(, UASStatus) results; 114 QTAILQ_HEAD(, UASRequest) requests; 115 }; 116 117 struct UASRequest { 118 uint16_t tag; 119 uint64_t lun; 120 UASDevice *uas; 121 SCSIDevice *dev; 122 SCSIRequest *req; 123 USBPacket *data; 124 bool data_async; 125 bool active; 126 bool complete; 127 uint32_t buf_off; 128 uint32_t buf_size; 129 uint32_t data_off; 130 uint32_t data_size; 131 QTAILQ_ENTRY(UASRequest) next; 132 }; 133 134 struct UASStatus { 135 uas_ui status; 136 uint32_t length; 137 QTAILQ_ENTRY(UASStatus) next; 138 }; 139 140 /* --------------------------------------------------------------------- */ 141 142 enum { 143 STR_MANUFACTURER = 1, 144 STR_PRODUCT, 145 STR_SERIALNUMBER, 146 STR_CONFIG_HIGH, 147 }; 148 149 static const USBDescStrings desc_strings = { 150 [STR_MANUFACTURER] = "QEMU", 151 [STR_PRODUCT] = "USB Attached SCSI HBA", 152 [STR_SERIALNUMBER] = "27842", 153 [STR_CONFIG_HIGH] = "High speed config (usb 2.0)", 154 }; 155 156 static const USBDescIface desc_iface_high = { 157 .bInterfaceNumber = 0, 158 .bNumEndpoints = 4, 159 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 160 .bInterfaceSubClass = 0x06, /* SCSI */ 161 .bInterfaceProtocol = 0x62, /* UAS */ 162 .eps = (USBDescEndpoint[]) { 163 { 164 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 165 .bmAttributes = USB_ENDPOINT_XFER_BULK, 166 .wMaxPacketSize = 512, 167 .extra = (uint8_t[]) { 168 0x04, /* u8 bLength */ 169 0x24, /* u8 bDescriptorType */ 170 UAS_PIPE_ID_COMMAND, 171 0x00, /* u8 bReserved */ 172 }, 173 },{ 174 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 175 .bmAttributes = USB_ENDPOINT_XFER_BULK, 176 .wMaxPacketSize = 512, 177 .extra = (uint8_t[]) { 178 0x04, /* u8 bLength */ 179 0x24, /* u8 bDescriptorType */ 180 UAS_PIPE_ID_STATUS, 181 0x00, /* u8 bReserved */ 182 }, 183 },{ 184 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 185 .bmAttributes = USB_ENDPOINT_XFER_BULK, 186 .wMaxPacketSize = 512, 187 .extra = (uint8_t[]) { 188 0x04, /* u8 bLength */ 189 0x24, /* u8 bDescriptorType */ 190 UAS_PIPE_ID_DATA_IN, 191 0x00, /* u8 bReserved */ 192 }, 193 },{ 194 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 195 .bmAttributes = USB_ENDPOINT_XFER_BULK, 196 .wMaxPacketSize = 512, 197 .extra = (uint8_t[]) { 198 0x04, /* u8 bLength */ 199 0x24, /* u8 bDescriptorType */ 200 UAS_PIPE_ID_DATA_OUT, 201 0x00, /* u8 bReserved */ 202 }, 203 }, 204 } 205 }; 206 207 static const USBDescDevice desc_device_high = { 208 .bcdUSB = 0x0200, 209 .bMaxPacketSize0 = 64, 210 .bNumConfigurations = 1, 211 .confs = (USBDescConfig[]) { 212 { 213 .bNumInterfaces = 1, 214 .bConfigurationValue = 1, 215 .iConfiguration = STR_CONFIG_HIGH, 216 .bmAttributes = 0xc0, 217 .nif = 1, 218 .ifs = &desc_iface_high, 219 }, 220 }, 221 }; 222 223 static const USBDesc desc = { 224 .id = { 225 .idVendor = 0x46f4, /* CRC16() of "QEMU" */ 226 .idProduct = 0x0002, 227 .bcdDevice = 0, 228 .iManufacturer = STR_MANUFACTURER, 229 .iProduct = STR_PRODUCT, 230 .iSerialNumber = STR_SERIALNUMBER, 231 }, 232 .high = &desc_device_high, 233 .str = desc_strings, 234 }; 235 236 /* --------------------------------------------------------------------- */ 237 238 static UASStatus *usb_uas_alloc_status(uint8_t id, uint16_t tag) 239 { 240 UASStatus *st = g_new0(UASStatus, 1); 241 242 st->status.hdr.id = id; 243 st->status.hdr.tag = cpu_to_be16(tag); 244 st->length = sizeof(uas_ui_header); 245 return st; 246 } 247 248 static void usb_uas_send_status_bh(void *opaque) 249 { 250 UASDevice *uas = opaque; 251 UASStatus *st = QTAILQ_FIRST(&uas->results); 252 USBPacket *p = uas->status; 253 254 assert(p != NULL); 255 assert(st != NULL); 256 257 uas->status = NULL; 258 usb_packet_copy(p, &st->status, st->length); 259 p->result = st->length; 260 QTAILQ_REMOVE(&uas->results, st, next); 261 g_free(st); 262 263 usb_packet_complete(&uas->dev, p); 264 } 265 266 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) 267 { 268 st->length += length; 269 QTAILQ_INSERT_TAIL(&uas->results, st, next); 270 if (uas->status) { 271 /* 272 * Just schedule bh make sure any in-flight data transaction 273 * is finished before completing (sending) the status packet. 274 */ 275 qemu_bh_schedule(uas->status_bh); 276 } else { 277 USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN, 278 UAS_PIPE_ID_STATUS); 279 usb_wakeup(ep); 280 } 281 } 282 283 static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, 284 uint8_t code, uint16_t add_info) 285 { 286 UASStatus *st = usb_uas_alloc_status(UAS_UI_RESPONSE, tag); 287 288 trace_usb_uas_response(uas->dev.addr, tag, code); 289 st->status.response.response_code = code; 290 st->status.response.add_response_info = cpu_to_be16(add_info); 291 usb_uas_queue_status(uas, st, sizeof(uas_ui_response)); 292 } 293 294 static void usb_uas_queue_sense(UASRequest *req, uint8_t status) 295 { 296 UASStatus *st = usb_uas_alloc_status(UAS_UI_SENSE, req->tag); 297 int len, slen = 0; 298 299 trace_usb_uas_sense(req->uas->dev.addr, req->tag, status); 300 st->status.sense.status = status; 301 st->status.sense.status_qualifier = cpu_to_be16(0); 302 if (status != GOOD) { 303 slen = scsi_req_get_sense(req->req, st->status.sense.sense_data, 304 sizeof(st->status.sense.sense_data)); 305 st->status.sense.sense_length = cpu_to_be16(slen); 306 } 307 len = sizeof(uas_ui_sense) - sizeof(st->status.sense.sense_data) + slen; 308 usb_uas_queue_status(req->uas, st, len); 309 } 310 311 static void usb_uas_queue_read_ready(UASRequest *req) 312 { 313 UASStatus *st = usb_uas_alloc_status(UAS_UI_READ_READY, req->tag); 314 315 trace_usb_uas_read_ready(req->uas->dev.addr, req->tag); 316 usb_uas_queue_status(req->uas, st, 0); 317 } 318 319 static void usb_uas_queue_write_ready(UASRequest *req) 320 { 321 UASStatus *st = usb_uas_alloc_status(UAS_UI_WRITE_READY, req->tag); 322 323 trace_usb_uas_write_ready(req->uas->dev.addr, req->tag); 324 usb_uas_queue_status(req->uas, st, 0); 325 } 326 327 /* --------------------------------------------------------------------- */ 328 329 static int usb_uas_get_lun(uint64_t lun64) 330 { 331 return (lun64 >> 48) & 0xff; 332 } 333 334 static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64) 335 { 336 if ((lun64 >> 56) != 0x00) { 337 return NULL; 338 } 339 return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64)); 340 } 341 342 static void usb_uas_complete_data_packet(UASRequest *req) 343 { 344 USBPacket *p; 345 346 if (!req->data_async) { 347 return; 348 } 349 p = req->data; 350 req->data = NULL; 351 req->data_async = false; 352 usb_packet_complete(&req->uas->dev, p); 353 } 354 355 static void usb_uas_copy_data(UASRequest *req) 356 { 357 uint32_t length; 358 359 length = MIN(req->buf_size - req->buf_off, 360 req->data->iov.size - req->data->result); 361 trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length, 362 req->data->result, req->data->iov.size, 363 req->buf_off, req->buf_size); 364 usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off, 365 length); 366 req->buf_off += length; 367 req->data_off += length; 368 369 if (req->data->result == req->data->iov.size) { 370 usb_uas_complete_data_packet(req); 371 } 372 if (req->buf_size && req->buf_off == req->buf_size) { 373 req->buf_off = 0; 374 req->buf_size = 0; 375 scsi_req_continue(req->req); 376 } 377 } 378 379 static void usb_uas_start_next_transfer(UASDevice *uas) 380 { 381 UASRequest *req; 382 383 QTAILQ_FOREACH(req, &uas->requests, next) { 384 if (req->active || req->complete) { 385 continue; 386 } 387 if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain == NULL) { 388 uas->datain = req; 389 usb_uas_queue_read_ready(req); 390 req->active = true; 391 return; 392 } 393 if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout == NULL) { 394 uas->dataout = req; 395 usb_uas_queue_write_ready(req); 396 req->active = true; 397 return; 398 } 399 } 400 } 401 402 static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_ui *ui) 403 { 404 UASRequest *req; 405 406 req = g_new0(UASRequest, 1); 407 req->uas = uas; 408 req->tag = be16_to_cpu(ui->hdr.tag); 409 req->lun = be64_to_cpu(ui->command.lun); 410 req->dev = usb_uas_get_dev(req->uas, req->lun); 411 return req; 412 } 413 414 static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv) 415 { 416 UASRequest *req = priv; 417 UASDevice *uas = req->uas; 418 419 if (req == uas->datain) { 420 uas->datain = NULL; 421 } 422 if (req == uas->dataout) { 423 uas->dataout = NULL; 424 } 425 QTAILQ_REMOVE(&uas->requests, req, next); 426 g_free(req); 427 } 428 429 static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag) 430 { 431 UASRequest *req; 432 433 QTAILQ_FOREACH(req, &uas->requests, next) { 434 if (req->tag == tag) { 435 return req; 436 } 437 } 438 return NULL; 439 } 440 441 static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len) 442 { 443 UASRequest *req = r->hba_private; 444 445 trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len); 446 req->buf_off = 0; 447 req->buf_size = len; 448 if (req->data) { 449 usb_uas_copy_data(req); 450 } else { 451 usb_uas_start_next_transfer(req->uas); 452 } 453 } 454 455 static void usb_uas_scsi_command_complete(SCSIRequest *r, 456 uint32_t status, size_t resid) 457 { 458 UASRequest *req = r->hba_private; 459 UASDevice *uas = req->uas; 460 461 trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, status, resid); 462 req->complete = true; 463 if (req->data) { 464 usb_uas_complete_data_packet(req); 465 } 466 usb_uas_queue_sense(req, status); 467 scsi_req_unref(req->req); 468 usb_uas_start_next_transfer(uas); 469 } 470 471 static void usb_uas_scsi_request_cancelled(SCSIRequest *r) 472 { 473 UASRequest *req = r->hba_private; 474 475 /* FIXME: queue notification to status pipe? */ 476 scsi_req_unref(req->req); 477 } 478 479 static const struct SCSIBusInfo usb_uas_scsi_info = { 480 .tcq = true, 481 .max_target = 0, 482 .max_lun = 255, 483 484 .transfer_data = usb_uas_scsi_transfer_data, 485 .complete = usb_uas_scsi_command_complete, 486 .cancel = usb_uas_scsi_request_cancelled, 487 .free_request = usb_uas_scsi_free_request, 488 }; 489 490 /* --------------------------------------------------------------------- */ 491 492 static void usb_uas_handle_reset(USBDevice *dev) 493 { 494 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 495 UASRequest *req, *nreq; 496 UASStatus *st, *nst; 497 498 trace_usb_uas_reset(dev->addr); 499 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 500 scsi_req_cancel(req->req); 501 } 502 QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) { 503 QTAILQ_REMOVE(&uas->results, st, next); 504 g_free(st); 505 } 506 } 507 508 static int usb_uas_handle_control(USBDevice *dev, USBPacket *p, 509 int request, int value, int index, int length, uint8_t *data) 510 { 511 int ret; 512 513 ret = usb_desc_handle_control(dev, p, request, value, index, length, data); 514 if (ret >= 0) { 515 return ret; 516 } 517 fprintf(stderr, "%s: unhandled control request\n", __func__); 518 return USB_RET_STALL; 519 } 520 521 static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p) 522 { 523 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 524 UASRequest *req, *nreq; 525 526 if (uas->status == p) { 527 uas->status = NULL; 528 qemu_bh_cancel(uas->status_bh); 529 return; 530 } 531 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 532 if (req->data == p) { 533 req->data = NULL; 534 return; 535 } 536 } 537 assert(!"canceled usb packet not found"); 538 } 539 540 static void usb_uas_command(UASDevice *uas, uas_ui *ui) 541 { 542 UASRequest *req; 543 uint32_t len; 544 545 req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag)); 546 if (req) { 547 goto overlapped_tag; 548 } 549 req = usb_uas_alloc_request(uas, ui); 550 if (req->dev == NULL) { 551 goto bad_target; 552 } 553 554 trace_usb_uas_command(uas->dev.addr, req->tag, 555 usb_uas_get_lun(req->lun), 556 req->lun >> 32, req->lun & 0xffffffff); 557 QTAILQ_INSERT_TAIL(&uas->requests, req, next); 558 req->req = scsi_req_new(req->dev, req->tag, 559 usb_uas_get_lun(req->lun), 560 ui->command.cdb, req); 561 len = scsi_req_enqueue(req->req); 562 if (len) { 563 req->data_size = len; 564 scsi_req_continue(req->req); 565 } 566 return; 567 568 overlapped_tag: 569 usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0); 570 return; 571 572 bad_target: 573 /* 574 * FIXME: Seems to upset linux, is this wrong? 575 * NOTE: Happens only with no scsi devices at the bus, not sure 576 * this is a valid UAS setup in the first place. 577 */ 578 usb_uas_queue_response(uas, req->tag, UAS_RC_INVALID_INFO_UNIT, 0); 579 g_free(req); 580 return; 581 } 582 583 static void usb_uas_task(UASDevice *uas, uas_ui *ui) 584 { 585 uint16_t tag = be16_to_cpu(ui->hdr.tag); 586 uint64_t lun64 = be64_to_cpu(ui->task.lun); 587 SCSIDevice *dev = usb_uas_get_dev(uas, lun64); 588 int lun = usb_uas_get_lun(lun64); 589 UASRequest *req; 590 uint16_t task_tag; 591 592 req = usb_uas_find_request(uas, be16_to_cpu(ui->hdr.tag)); 593 if (req) { 594 goto overlapped_tag; 595 } 596 597 switch (ui->task.function) { 598 case UAS_TMF_ABORT_TASK: 599 task_tag = be16_to_cpu(ui->task.task_tag); 600 trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag); 601 if (dev == NULL) { 602 goto bad_target; 603 } 604 if (dev->lun != lun) { 605 goto incorrect_lun; 606 } 607 req = usb_uas_find_request(uas, task_tag); 608 if (req && req->dev == dev) { 609 scsi_req_cancel(req->req); 610 } 611 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE, 0); 612 break; 613 614 case UAS_TMF_LOGICAL_UNIT_RESET: 615 trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun); 616 if (dev == NULL) { 617 goto bad_target; 618 } 619 if (dev->lun != lun) { 620 goto incorrect_lun; 621 } 622 qdev_reset_all(&dev->qdev); 623 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE, 0); 624 break; 625 626 default: 627 trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, ui->task.function); 628 usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED, 0); 629 break; 630 } 631 return; 632 633 overlapped_tag: 634 usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG, 0); 635 return; 636 637 bad_target: 638 /* FIXME: correct? [see long comment in usb_uas_command()] */ 639 usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT, 0); 640 return; 641 642 incorrect_lun: 643 usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN, 0); 644 return; 645 } 646 647 static int usb_uas_handle_data(USBDevice *dev, USBPacket *p) 648 { 649 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 650 uas_ui ui; 651 UASStatus *st; 652 UASRequest *req; 653 int length, ret = 0; 654 655 switch (p->ep->nr) { 656 case UAS_PIPE_ID_COMMAND: 657 length = MIN(sizeof(ui), p->iov.size); 658 usb_packet_copy(p, &ui, length); 659 switch (ui.hdr.id) { 660 case UAS_UI_COMMAND: 661 usb_uas_command(uas, &ui); 662 ret = length; 663 break; 664 case UAS_UI_TASK_MGMT: 665 usb_uas_task(uas, &ui); 666 ret = length; 667 break; 668 default: 669 fprintf(stderr, "%s: unknown command ui: id 0x%x\n", 670 __func__, ui.hdr.id); 671 ret = USB_RET_STALL; 672 break; 673 } 674 break; 675 case UAS_PIPE_ID_STATUS: 676 st = QTAILQ_FIRST(&uas->results); 677 if (st == NULL) { 678 assert(uas->status == NULL); 679 uas->status = p; 680 ret = USB_RET_ASYNC; 681 break; 682 } 683 usb_packet_copy(p, &st->status, st->length); 684 ret = st->length; 685 QTAILQ_REMOVE(&uas->results, st, next); 686 g_free(st); 687 break; 688 case UAS_PIPE_ID_DATA_IN: 689 case UAS_PIPE_ID_DATA_OUT: 690 req = (p->ep->nr == UAS_PIPE_ID_DATA_IN) ? uas->datain : uas->dataout; 691 if (req == NULL) { 692 fprintf(stderr, "%s: no inflight request\n", __func__); 693 ret = USB_RET_STALL; 694 break; 695 } 696 scsi_req_ref(req->req); 697 req->data = p; 698 usb_uas_copy_data(req); 699 if (p->result == p->iov.size || req->complete) { 700 req->data = NULL; 701 ret = p->result; 702 } else { 703 req->data_async = true; 704 ret = USB_RET_ASYNC; 705 } 706 scsi_req_unref(req->req); 707 usb_uas_start_next_transfer(uas); 708 break; 709 default: 710 fprintf(stderr, "%s: invalid endpoint %d\n", __func__, p->ep->nr); 711 ret = USB_RET_STALL; 712 break; 713 } 714 return ret; 715 } 716 717 static void usb_uas_handle_destroy(USBDevice *dev) 718 { 719 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 720 721 qemu_bh_delete(uas->status_bh); 722 } 723 724 static int usb_uas_init(USBDevice *dev) 725 { 726 UASDevice *uas = DO_UPCAST(UASDevice, dev, dev); 727 728 usb_desc_create_serial(dev); 729 usb_desc_init(dev); 730 731 QTAILQ_INIT(&uas->results); 732 QTAILQ_INIT(&uas->requests); 733 uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas); 734 735 scsi_bus_new(&uas->bus, &uas->dev.qdev, &usb_uas_scsi_info); 736 737 return 0; 738 } 739 740 static const VMStateDescription vmstate_usb_uas = { 741 .name = "usb-uas", 742 .unmigratable = 1, 743 .fields = (VMStateField[]) { 744 VMSTATE_USB_DEVICE(dev, UASDevice), 745 VMSTATE_END_OF_LIST() 746 } 747 }; 748 749 static void usb_uas_class_initfn(ObjectClass *klass, void *data) 750 { 751 DeviceClass *dc = DEVICE_CLASS(klass); 752 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 753 754 uc->init = usb_uas_init; 755 uc->product_desc = desc_strings[STR_PRODUCT]; 756 uc->usb_desc = &desc; 757 uc->cancel_packet = usb_uas_cancel_io; 758 uc->handle_attach = usb_desc_attach; 759 uc->handle_reset = usb_uas_handle_reset; 760 uc->handle_control = usb_uas_handle_control; 761 uc->handle_data = usb_uas_handle_data; 762 uc->handle_destroy = usb_uas_handle_destroy; 763 dc->fw_name = "storage"; 764 dc->vmsd = &vmstate_usb_uas; 765 } 766 767 static TypeInfo uas_info = { 768 .name = "usb-uas", 769 .parent = TYPE_USB_DEVICE, 770 .instance_size = sizeof(UASDevice), 771 .class_init = usb_uas_class_initfn, 772 }; 773 774 static void usb_uas_register_types(void) 775 { 776 type_register_static(&uas_info); 777 } 778 779 type_init(usb_uas_register_types) 780