1 /* 2 * USB redirector usb-guest 3 * 4 * Copyright (c) 2011-2012 Red Hat, Inc. 5 * 6 * Red Hat Authors: 7 * Hans de Goede <hdegoede@redhat.com> 8 * 9 * Permission is hereby granted, free of charge, to any person obtaining a copy 10 * of this software and associated documentation files (the "Software"), to deal 11 * in the Software without restriction, including without limitation the rights 12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 13 * copies of the Software, and to permit persons to whom the Software is 14 * furnished to do so, subject to the following conditions: 15 * 16 * The above copyright notice and this permission notice shall be included in 17 * all copies or substantial portions of the Software. 18 * 19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 25 * THE SOFTWARE. 26 */ 27 28 #include "qemu-common.h" 29 #include "qemu/timer.h" 30 #include "monitor/monitor.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/iov.h" 33 #include "char/char.h" 34 35 #include <dirent.h> 36 #include <sys/ioctl.h> 37 #include <signal.h> 38 #include <usbredirparser.h> 39 #include <usbredirfilter.h> 40 41 #include "hw/usb.h" 42 43 #define MAX_ENDPOINTS 32 44 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */ 45 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f)) 46 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f)) 47 #define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \ 48 ((usb_ep)->nr | 0x10) : ((usb_ep)->nr)) 49 #define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \ 50 ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \ 51 (i) & 0x0f)) 52 53 typedef struct USBRedirDevice USBRedirDevice; 54 55 /* Struct to hold buffered packets */ 56 struct buf_packet { 57 uint8_t *data; 58 void *free_on_destroy; 59 uint16_t len; 60 uint16_t offset; 61 uint8_t status; 62 QTAILQ_ENTRY(buf_packet)next; 63 }; 64 65 struct endp_data { 66 USBRedirDevice *dev; 67 uint8_t type; 68 uint8_t interval; 69 uint8_t interface; /* bInterfaceNumber this ep belongs to */ 70 uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */ 71 uint8_t iso_started; 72 uint8_t iso_error; /* For reporting iso errors to the HC */ 73 uint8_t interrupt_started; 74 uint8_t interrupt_error; 75 uint8_t bulk_receiving_enabled; 76 uint8_t bulk_receiving_started; 77 uint8_t bufpq_prefilled; 78 uint8_t bufpq_dropping_packets; 79 QTAILQ_HEAD(, buf_packet) bufpq; 80 int32_t bufpq_size; 81 int32_t bufpq_target_size; 82 USBPacket *pending_async_packet; 83 }; 84 85 struct PacketIdQueueEntry { 86 uint64_t id; 87 QTAILQ_ENTRY(PacketIdQueueEntry)next; 88 }; 89 90 struct PacketIdQueue { 91 USBRedirDevice *dev; 92 const char *name; 93 QTAILQ_HEAD(, PacketIdQueueEntry) head; 94 int size; 95 }; 96 97 struct USBRedirDevice { 98 USBDevice dev; 99 /* Properties */ 100 CharDriverState *cs; 101 uint8_t debug; 102 char *filter_str; 103 int32_t bootindex; 104 /* Data passed from chardev the fd_read cb to the usbredirparser read cb */ 105 const uint8_t *read_buf; 106 int read_buf_size; 107 /* For async handling of close */ 108 QEMUBH *chardev_close_bh; 109 /* To delay the usb attach in case of quick chardev close + open */ 110 QEMUTimer *attach_timer; 111 int64_t next_attach_time; 112 struct usbredirparser *parser; 113 struct endp_data endpoint[MAX_ENDPOINTS]; 114 struct PacketIdQueue cancelled; 115 struct PacketIdQueue already_in_flight; 116 void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t); 117 /* Data for device filtering */ 118 struct usb_redir_device_connect_header device_info; 119 struct usb_redir_interface_info_header interface_info; 120 struct usbredirfilter_rule *filter_rules; 121 int filter_rules_count; 122 int compatible_speedmask; 123 }; 124 125 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h); 126 static void usbredir_device_connect(void *priv, 127 struct usb_redir_device_connect_header *device_connect); 128 static void usbredir_device_disconnect(void *priv); 129 static void usbredir_interface_info(void *priv, 130 struct usb_redir_interface_info_header *interface_info); 131 static void usbredir_ep_info(void *priv, 132 struct usb_redir_ep_info_header *ep_info); 133 static void usbredir_configuration_status(void *priv, uint64_t id, 134 struct usb_redir_configuration_status_header *configuration_status); 135 static void usbredir_alt_setting_status(void *priv, uint64_t id, 136 struct usb_redir_alt_setting_status_header *alt_setting_status); 137 static void usbredir_iso_stream_status(void *priv, uint64_t id, 138 struct usb_redir_iso_stream_status_header *iso_stream_status); 139 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id, 140 struct usb_redir_interrupt_receiving_status_header 141 *interrupt_receiving_status); 142 static void usbredir_bulk_streams_status(void *priv, uint64_t id, 143 struct usb_redir_bulk_streams_status_header *bulk_streams_status); 144 static void usbredir_bulk_receiving_status(void *priv, uint64_t id, 145 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status); 146 static void usbredir_control_packet(void *priv, uint64_t id, 147 struct usb_redir_control_packet_header *control_packet, 148 uint8_t *data, int data_len); 149 static void usbredir_bulk_packet(void *priv, uint64_t id, 150 struct usb_redir_bulk_packet_header *bulk_packet, 151 uint8_t *data, int data_len); 152 static void usbredir_iso_packet(void *priv, uint64_t id, 153 struct usb_redir_iso_packet_header *iso_packet, 154 uint8_t *data, int data_len); 155 static void usbredir_interrupt_packet(void *priv, uint64_t id, 156 struct usb_redir_interrupt_packet_header *interrupt_header, 157 uint8_t *data, int data_len); 158 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id, 159 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet, 160 uint8_t *data, int data_len); 161 162 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p, 163 int status); 164 165 #define VERSION "qemu usb-redir guest " QEMU_VERSION 166 167 /* 168 * Logging stuff 169 */ 170 171 #define ERROR(...) \ 172 do { \ 173 if (dev->debug >= usbredirparser_error) { \ 174 error_report("usb-redir error: " __VA_ARGS__); \ 175 } \ 176 } while (0) 177 #define WARNING(...) \ 178 do { \ 179 if (dev->debug >= usbredirparser_warning) { \ 180 error_report("usb-redir warning: " __VA_ARGS__); \ 181 } \ 182 } while (0) 183 #define INFO(...) \ 184 do { \ 185 if (dev->debug >= usbredirparser_info) { \ 186 error_report("usb-redir: " __VA_ARGS__); \ 187 } \ 188 } while (0) 189 #define DPRINTF(...) \ 190 do { \ 191 if (dev->debug >= usbredirparser_debug) { \ 192 error_report("usb-redir: " __VA_ARGS__); \ 193 } \ 194 } while (0) 195 #define DPRINTF2(...) \ 196 do { \ 197 if (dev->debug >= usbredirparser_debug_data) { \ 198 error_report("usb-redir: " __VA_ARGS__); \ 199 } \ 200 } while (0) 201 202 static void usbredir_log(void *priv, int level, const char *msg) 203 { 204 USBRedirDevice *dev = priv; 205 206 if (dev->debug < level) { 207 return; 208 } 209 210 error_report("%s", msg); 211 } 212 213 static void usbredir_log_data(USBRedirDevice *dev, const char *desc, 214 const uint8_t *data, int len) 215 { 216 int i, j, n; 217 218 if (dev->debug < usbredirparser_debug_data) { 219 return; 220 } 221 222 for (i = 0; i < len; i += j) { 223 char buf[128]; 224 225 n = sprintf(buf, "%s", desc); 226 for (j = 0; j < 8 && i + j < len; j++) { 227 n += sprintf(buf + n, " %02X", data[i + j]); 228 } 229 error_report("%s", buf); 230 } 231 } 232 233 /* 234 * usbredirparser io functions 235 */ 236 237 static int usbredir_read(void *priv, uint8_t *data, int count) 238 { 239 USBRedirDevice *dev = priv; 240 241 if (dev->read_buf_size < count) { 242 count = dev->read_buf_size; 243 } 244 245 memcpy(data, dev->read_buf, count); 246 247 dev->read_buf_size -= count; 248 if (dev->read_buf_size) { 249 dev->read_buf += count; 250 } else { 251 dev->read_buf = NULL; 252 } 253 254 return count; 255 } 256 257 static int usbredir_write(void *priv, uint8_t *data, int count) 258 { 259 USBRedirDevice *dev = priv; 260 261 if (!dev->cs->be_open) { 262 return 0; 263 } 264 265 /* Don't send new data to the chardev until our state is fully synced */ 266 if (!runstate_check(RUN_STATE_RUNNING)) { 267 return 0; 268 } 269 270 return qemu_chr_fe_write(dev->cs, data, count); 271 } 272 273 /* 274 * Cancelled and buffered packets helpers 275 */ 276 277 static void packet_id_queue_init(struct PacketIdQueue *q, 278 USBRedirDevice *dev, const char *name) 279 { 280 q->dev = dev; 281 q->name = name; 282 QTAILQ_INIT(&q->head); 283 q->size = 0; 284 } 285 286 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id) 287 { 288 USBRedirDevice *dev = q->dev; 289 struct PacketIdQueueEntry *e; 290 291 DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name); 292 293 e = g_malloc0(sizeof(struct PacketIdQueueEntry)); 294 e->id = id; 295 QTAILQ_INSERT_TAIL(&q->head, e, next); 296 q->size++; 297 } 298 299 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id) 300 { 301 USBRedirDevice *dev = q->dev; 302 struct PacketIdQueueEntry *e; 303 304 QTAILQ_FOREACH(e, &q->head, next) { 305 if (e->id == id) { 306 DPRINTF("removing packet id %"PRIu64" from %s queue\n", 307 id, q->name); 308 QTAILQ_REMOVE(&q->head, e, next); 309 q->size--; 310 g_free(e); 311 return 1; 312 } 313 } 314 return 0; 315 } 316 317 static void packet_id_queue_empty(struct PacketIdQueue *q) 318 { 319 USBRedirDevice *dev = q->dev; 320 struct PacketIdQueueEntry *e, *next_e; 321 322 DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name); 323 324 QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) { 325 QTAILQ_REMOVE(&q->head, e, next); 326 g_free(e); 327 } 328 q->size = 0; 329 } 330 331 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p) 332 { 333 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 334 int i = USBEP2I(p->ep); 335 336 if (p->combined) { 337 usb_combined_packet_cancel(udev, p); 338 return; 339 } 340 341 if (dev->endpoint[i].pending_async_packet) { 342 assert(dev->endpoint[i].pending_async_packet == p); 343 dev->endpoint[i].pending_async_packet = NULL; 344 return; 345 } 346 347 packet_id_queue_add(&dev->cancelled, p->id); 348 usbredirparser_send_cancel_data_packet(dev->parser, p->id); 349 usbredirparser_do_write(dev->parser); 350 } 351 352 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id) 353 { 354 if (!dev->dev.attached) { 355 return 1; /* Treat everything as cancelled after a disconnect */ 356 } 357 return packet_id_queue_remove(&dev->cancelled, id); 358 } 359 360 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev, 361 struct USBEndpoint *ep) 362 { 363 static USBPacket *p; 364 365 /* async handled packets for bulk receiving eps do not count as inflight */ 366 if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) { 367 return; 368 } 369 370 QTAILQ_FOREACH(p, &ep->queue, queue) { 371 /* Skip combined packets, except for the first */ 372 if (p->combined && p != p->combined->first) { 373 continue; 374 } 375 if (p->state == USB_PACKET_ASYNC) { 376 packet_id_queue_add(&dev->already_in_flight, p->id); 377 } 378 } 379 } 380 381 static void usbredir_fill_already_in_flight(USBRedirDevice *dev) 382 { 383 int ep; 384 struct USBDevice *udev = &dev->dev; 385 386 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl); 387 388 for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) { 389 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]); 390 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]); 391 } 392 } 393 394 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id) 395 { 396 return packet_id_queue_remove(&dev->already_in_flight, id); 397 } 398 399 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev, 400 uint8_t ep, uint64_t id) 401 { 402 USBPacket *p; 403 404 if (usbredir_is_cancelled(dev, id)) { 405 return NULL; 406 } 407 408 p = usb_ep_find_packet_by_id(&dev->dev, 409 (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT, 410 ep & 0x0f, id); 411 if (p == NULL) { 412 ERROR("could not find packet with id %"PRIu64"\n", id); 413 } 414 return p; 415 } 416 417 static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, 418 uint8_t status, uint8_t ep, void *free_on_destroy) 419 { 420 struct buf_packet *bufp; 421 422 if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets && 423 dev->endpoint[EP2I(ep)].bufpq_size > 424 2 * dev->endpoint[EP2I(ep)].bufpq_target_size) { 425 DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep); 426 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1; 427 } 428 /* Since we're interupting the stream anyways, drop enough packets to get 429 back to our target buffer size */ 430 if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) { 431 if (dev->endpoint[EP2I(ep)].bufpq_size > 432 dev->endpoint[EP2I(ep)].bufpq_target_size) { 433 free(data); 434 return; 435 } 436 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 437 } 438 439 bufp = g_malloc(sizeof(struct buf_packet)); 440 bufp->data = data; 441 bufp->len = len; 442 bufp->offset = 0; 443 bufp->status = status; 444 bufp->free_on_destroy = free_on_destroy; 445 QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); 446 dev->endpoint[EP2I(ep)].bufpq_size++; 447 } 448 449 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp, 450 uint8_t ep) 451 { 452 QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); 453 dev->endpoint[EP2I(ep)].bufpq_size--; 454 free(bufp->free_on_destroy); 455 g_free(bufp); 456 } 457 458 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep) 459 { 460 struct buf_packet *buf, *buf_next; 461 462 QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) { 463 bufp_free(dev, buf, ep); 464 } 465 } 466 467 /* 468 * USBDevice callbacks 469 */ 470 471 static void usbredir_handle_reset(USBDevice *udev) 472 { 473 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 474 475 DPRINTF("reset device\n"); 476 usbredirparser_send_reset(dev->parser); 477 usbredirparser_do_write(dev->parser); 478 } 479 480 static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p, 481 uint8_t ep) 482 { 483 int status, len; 484 if (!dev->endpoint[EP2I(ep)].iso_started && 485 !dev->endpoint[EP2I(ep)].iso_error) { 486 struct usb_redir_start_iso_stream_header start_iso = { 487 .endpoint = ep, 488 }; 489 int pkts_per_sec; 490 491 if (dev->dev.speed == USB_SPEED_HIGH) { 492 pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval; 493 } else { 494 pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval; 495 } 496 /* Testing has shown that we need circa 60 ms buffer */ 497 dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000; 498 499 /* Aim for approx 100 interrupts / second on the client to 500 balance latency and interrupt load */ 501 start_iso.pkts_per_urb = pkts_per_sec / 100; 502 if (start_iso.pkts_per_urb < 1) { 503 start_iso.pkts_per_urb = 1; 504 } else if (start_iso.pkts_per_urb > 32) { 505 start_iso.pkts_per_urb = 32; 506 } 507 508 start_iso.no_urbs = (dev->endpoint[EP2I(ep)].bufpq_target_size + 509 start_iso.pkts_per_urb - 1) / 510 start_iso.pkts_per_urb; 511 /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest 512 as overflow buffer. Also see the usbredir protocol documentation */ 513 if (!(ep & USB_DIR_IN)) { 514 start_iso.no_urbs *= 2; 515 } 516 if (start_iso.no_urbs > 16) { 517 start_iso.no_urbs = 16; 518 } 519 520 /* No id, we look at the ep when receiving a status back */ 521 usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso); 522 usbredirparser_do_write(dev->parser); 523 DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n", 524 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep); 525 dev->endpoint[EP2I(ep)].iso_started = 1; 526 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0; 527 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 528 } 529 530 if (ep & USB_DIR_IN) { 531 struct buf_packet *isop; 532 533 if (dev->endpoint[EP2I(ep)].iso_started && 534 !dev->endpoint[EP2I(ep)].bufpq_prefilled) { 535 if (dev->endpoint[EP2I(ep)].bufpq_size < 536 dev->endpoint[EP2I(ep)].bufpq_target_size) { 537 return; 538 } 539 dev->endpoint[EP2I(ep)].bufpq_prefilled = 1; 540 } 541 542 isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq); 543 if (isop == NULL) { 544 DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n", 545 ep, dev->endpoint[EP2I(ep)].iso_error); 546 /* Re-fill the buffer */ 547 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0; 548 /* Check iso_error for stream errors, otherwise its an underrun */ 549 status = dev->endpoint[EP2I(ep)].iso_error; 550 dev->endpoint[EP2I(ep)].iso_error = 0; 551 p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS; 552 return; 553 } 554 DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep, 555 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size); 556 557 status = isop->status; 558 len = isop->len; 559 if (len > p->iov.size) { 560 ERROR("received iso data is larger then packet ep %02X (%d > %d)\n", 561 ep, len, (int)p->iov.size); 562 len = p->iov.size; 563 status = usb_redir_babble; 564 } 565 usb_packet_copy(p, isop->data, len); 566 bufp_free(dev, isop, ep); 567 usbredir_handle_status(dev, p, status); 568 } else { 569 /* If the stream was not started because of a pending error don't 570 send the packet to the usb-host */ 571 if (dev->endpoint[EP2I(ep)].iso_started) { 572 struct usb_redir_iso_packet_header iso_packet = { 573 .endpoint = ep, 574 .length = p->iov.size 575 }; 576 uint8_t buf[p->iov.size]; 577 /* No id, we look at the ep when receiving a status back */ 578 usb_packet_copy(p, buf, p->iov.size); 579 usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet, 580 buf, p->iov.size); 581 usbredirparser_do_write(dev->parser); 582 } 583 status = dev->endpoint[EP2I(ep)].iso_error; 584 dev->endpoint[EP2I(ep)].iso_error = 0; 585 DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status, 586 p->iov.size); 587 usbredir_handle_status(dev, p, status); 588 } 589 } 590 591 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep) 592 { 593 struct usb_redir_stop_iso_stream_header stop_iso_stream = { 594 .endpoint = ep 595 }; 596 if (dev->endpoint[EP2I(ep)].iso_started) { 597 usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream); 598 DPRINTF("iso stream stopped ep %02X\n", ep); 599 dev->endpoint[EP2I(ep)].iso_started = 0; 600 } 601 dev->endpoint[EP2I(ep)].iso_error = 0; 602 usbredir_free_bufpq(dev, ep); 603 } 604 605 /* 606 * The usb-host may poll the endpoint faster then our guest, resulting in lots 607 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine 608 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows. 609 */ 610 static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev, 611 struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep) 612 { 613 usb_packet_copy(p, bulkp->data + bulkp->offset, count); 614 bulkp->offset += count; 615 if (bulkp->offset == bulkp->len) { 616 /* Store status in the last packet with data from this bulkp */ 617 usbredir_handle_status(dev, p, bulkp->status); 618 bufp_free(dev, bulkp, ep); 619 } 620 } 621 622 static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev, 623 USBPacket *p, uint8_t ep) 624 { 625 struct buf_packet *bulkp; 626 int count; 627 628 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) && 629 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) { 630 count = bulkp->len - bulkp->offset; 631 if (count > (p->iov.size - p->actual_length)) { 632 count = p->iov.size - p->actual_length; 633 } 634 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep); 635 } 636 } 637 638 static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev, 639 USBPacket *p, uint8_t ep) 640 { 641 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size; 642 uint8_t header[2] = { 0, 0 }; 643 struct buf_packet *bulkp; 644 int count; 645 646 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) && 647 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) { 648 if (bulkp->len < 2) { 649 WARNING("malformed ftdi bulk in packet\n"); 650 bufp_free(dev, bulkp, ep); 651 continue; 652 } 653 654 if ((p->actual_length % maxp) == 0) { 655 usb_packet_copy(p, bulkp->data, 2); 656 memcpy(header, bulkp->data, 2); 657 } else { 658 if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) { 659 break; /* Different header, add to next packet */ 660 } 661 } 662 663 if (bulkp->offset == 0) { 664 bulkp->offset = 2; /* Skip header */ 665 } 666 count = bulkp->len - bulkp->offset; 667 /* Must repeat the header at maxp interval */ 668 if (count > (maxp - (p->actual_length % maxp))) { 669 count = maxp - (p->actual_length % maxp); 670 } 671 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep); 672 } 673 } 674 675 static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev, 676 USBPacket *p, uint8_t ep) 677 { 678 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 679 dev->buffered_bulk_in_complete(dev, p, ep); 680 DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n", 681 ep, p->status, p->actual_length, p->id); 682 } 683 684 static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev, 685 USBPacket *p, uint8_t ep) 686 { 687 /* Input bulk endpoint, buffered packet input */ 688 if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) { 689 int bpt; 690 struct usb_redir_start_bulk_receiving_header start = { 691 .endpoint = ep, 692 .stream_id = 0, 693 .no_transfers = 5, 694 }; 695 /* Round bytes_per_transfer up to a multiple of max_packet_size */ 696 bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1; 697 bpt /= dev->endpoint[EP2I(ep)].max_packet_size; 698 bpt *= dev->endpoint[EP2I(ep)].max_packet_size; 699 start.bytes_per_transfer = bpt; 700 /* No id, we look at the ep when receiving a status back */ 701 usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start); 702 usbredirparser_do_write(dev->parser); 703 DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n", 704 start.bytes_per_transfer, start.no_transfers, ep); 705 dev->endpoint[EP2I(ep)].bulk_receiving_started = 1; 706 /* We don't really want to drop bulk packets ever, but 707 having some upper limit to how much we buffer is good. */ 708 dev->endpoint[EP2I(ep)].bufpq_target_size = 5000; 709 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 710 } 711 712 if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) { 713 DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep); 714 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL); 715 dev->endpoint[EP2I(ep)].pending_async_packet = p; 716 p->status = USB_RET_ASYNC; 717 return; 718 } 719 usbredir_buffered_bulk_in_complete(dev, p, ep); 720 } 721 722 static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep) 723 { 724 struct usb_redir_stop_bulk_receiving_header stop_bulk = { 725 .endpoint = ep, 726 .stream_id = 0, 727 }; 728 if (dev->endpoint[EP2I(ep)].bulk_receiving_started) { 729 usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk); 730 DPRINTF("bulk receiving stopped ep %02X\n", ep); 731 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0; 732 } 733 usbredir_free_bufpq(dev, ep); 734 } 735 736 static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p, 737 uint8_t ep) 738 { 739 struct usb_redir_bulk_packet_header bulk_packet; 740 size_t size = usb_packet_size(p); 741 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size; 742 743 if (usbredir_already_in_flight(dev, p->id)) { 744 p->status = USB_RET_ASYNC; 745 return; 746 } 747 748 if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) { 749 if (size != 0 && (size % maxp) == 0) { 750 usbredir_handle_buffered_bulk_in_data(dev, p, ep); 751 return; 752 } 753 WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep); 754 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL); 755 usbredir_stop_bulk_receiving(dev, ep); 756 dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0; 757 } 758 759 DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, size, p->id); 760 761 bulk_packet.endpoint = ep; 762 bulk_packet.length = size; 763 bulk_packet.stream_id = 0; 764 bulk_packet.length_high = size >> 16; 765 assert(bulk_packet.length_high == 0 || 766 usbredirparser_peer_has_cap(dev->parser, 767 usb_redir_cap_32bits_bulk_length)); 768 769 if (ep & USB_DIR_IN) { 770 usbredirparser_send_bulk_packet(dev->parser, p->id, 771 &bulk_packet, NULL, 0); 772 } else { 773 uint8_t buf[size]; 774 usb_packet_copy(p, buf, size); 775 usbredir_log_data(dev, "bulk data out:", buf, size); 776 usbredirparser_send_bulk_packet(dev->parser, p->id, 777 &bulk_packet, buf, size); 778 } 779 usbredirparser_do_write(dev->parser); 780 p->status = USB_RET_ASYNC; 781 } 782 783 static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev, 784 USBPacket *p, uint8_t ep) 785 { 786 /* Input interrupt endpoint, buffered packet input */ 787 struct buf_packet *intp; 788 int status, len; 789 790 if (!dev->endpoint[EP2I(ep)].interrupt_started && 791 !dev->endpoint[EP2I(ep)].interrupt_error) { 792 struct usb_redir_start_interrupt_receiving_header start_int = { 793 .endpoint = ep, 794 }; 795 /* No id, we look at the ep when receiving a status back */ 796 usbredirparser_send_start_interrupt_receiving(dev->parser, 0, 797 &start_int); 798 usbredirparser_do_write(dev->parser); 799 DPRINTF("interrupt recv started ep %02X\n", ep); 800 dev->endpoint[EP2I(ep)].interrupt_started = 1; 801 /* We don't really want to drop interrupt packets ever, but 802 having some upper limit to how much we buffer is good. */ 803 dev->endpoint[EP2I(ep)].bufpq_target_size = 1000; 804 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 805 } 806 807 intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq); 808 if (intp == NULL) { 809 DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep); 810 /* Check interrupt_error for stream errors */ 811 status = dev->endpoint[EP2I(ep)].interrupt_error; 812 dev->endpoint[EP2I(ep)].interrupt_error = 0; 813 if (status) { 814 usbredir_handle_status(dev, p, status); 815 } else { 816 p->status = USB_RET_NAK; 817 } 818 return; 819 } 820 DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep, 821 intp->status, intp->len); 822 823 status = intp->status; 824 len = intp->len; 825 if (len > p->iov.size) { 826 ERROR("received int data is larger then packet ep %02X\n", ep); 827 len = p->iov.size; 828 status = usb_redir_babble; 829 } 830 usb_packet_copy(p, intp->data, len); 831 bufp_free(dev, intp, ep); 832 usbredir_handle_status(dev, p, status); 833 } 834 835 /* 836 * Handle interrupt out data, the usbredir protocol expects us to do this 837 * async, so that it can report back a completion status. But guests will 838 * expect immediate completion for an interrupt endpoint, and handling this 839 * async causes migration issues. So we report success directly, counting 840 * on the fact that output interrupt packets normally always succeed. 841 */ 842 static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev, 843 USBPacket *p, uint8_t ep) 844 { 845 struct usb_redir_interrupt_packet_header interrupt_packet; 846 uint8_t buf[p->iov.size]; 847 848 DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep, 849 p->iov.size, p->id); 850 851 interrupt_packet.endpoint = ep; 852 interrupt_packet.length = p->iov.size; 853 854 usb_packet_copy(p, buf, p->iov.size); 855 usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size); 856 usbredirparser_send_interrupt_packet(dev->parser, p->id, 857 &interrupt_packet, buf, p->iov.size); 858 usbredirparser_do_write(dev->parser); 859 } 860 861 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev, 862 uint8_t ep) 863 { 864 struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = { 865 .endpoint = ep 866 }; 867 if (dev->endpoint[EP2I(ep)].interrupt_started) { 868 usbredirparser_send_stop_interrupt_receiving(dev->parser, 0, 869 &stop_interrupt_recv); 870 DPRINTF("interrupt recv stopped ep %02X\n", ep); 871 dev->endpoint[EP2I(ep)].interrupt_started = 0; 872 } 873 dev->endpoint[EP2I(ep)].interrupt_error = 0; 874 usbredir_free_bufpq(dev, ep); 875 } 876 877 static void usbredir_handle_data(USBDevice *udev, USBPacket *p) 878 { 879 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 880 uint8_t ep; 881 882 ep = p->ep->nr; 883 if (p->pid == USB_TOKEN_IN) { 884 ep |= USB_DIR_IN; 885 } 886 887 switch (dev->endpoint[EP2I(ep)].type) { 888 case USB_ENDPOINT_XFER_CONTROL: 889 ERROR("handle_data called for control transfer on ep %02X\n", ep); 890 p->status = USB_RET_NAK; 891 break; 892 case USB_ENDPOINT_XFER_BULK: 893 if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN && 894 p->ep->pipeline) { 895 p->status = USB_RET_ADD_TO_QUEUE; 896 break; 897 } 898 usbredir_handle_bulk_data(dev, p, ep); 899 break; 900 case USB_ENDPOINT_XFER_ISOC: 901 usbredir_handle_iso_data(dev, p, ep); 902 break; 903 case USB_ENDPOINT_XFER_INT: 904 if (ep & USB_DIR_IN) { 905 usbredir_handle_interrupt_in_data(dev, p, ep); 906 } else { 907 usbredir_handle_interrupt_out_data(dev, p, ep); 908 } 909 break; 910 default: 911 ERROR("handle_data ep %02X has unknown type %d\n", ep, 912 dev->endpoint[EP2I(ep)].type); 913 p->status = USB_RET_NAK; 914 } 915 } 916 917 static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep) 918 { 919 if (ep->pid == USB_TOKEN_IN && ep->pipeline) { 920 usb_ep_combine_input_packets(ep); 921 } 922 } 923 924 static void usbredir_stop_ep(USBRedirDevice *dev, int i) 925 { 926 uint8_t ep = I2EP(i); 927 928 switch (dev->endpoint[i].type) { 929 case USB_ENDPOINT_XFER_BULK: 930 if (ep & USB_DIR_IN) { 931 usbredir_stop_bulk_receiving(dev, ep); 932 } 933 break; 934 case USB_ENDPOINT_XFER_ISOC: 935 usbredir_stop_iso_stream(dev, ep); 936 break; 937 case USB_ENDPOINT_XFER_INT: 938 if (ep & USB_DIR_IN) { 939 usbredir_stop_interrupt_receiving(dev, ep); 940 } 941 break; 942 } 943 usbredir_free_bufpq(dev, ep); 944 } 945 946 static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep) 947 { 948 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 949 950 usbredir_stop_ep(dev, USBEP2I(uep)); 951 usbredirparser_do_write(dev->parser); 952 } 953 954 static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p, 955 int config) 956 { 957 struct usb_redir_set_configuration_header set_config; 958 int i; 959 960 DPRINTF("set config %d id %"PRIu64"\n", config, p->id); 961 962 for (i = 0; i < MAX_ENDPOINTS; i++) { 963 usbredir_stop_ep(dev, i); 964 } 965 966 set_config.configuration = config; 967 usbredirparser_send_set_configuration(dev->parser, p->id, &set_config); 968 usbredirparser_do_write(dev->parser); 969 p->status = USB_RET_ASYNC; 970 } 971 972 static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p) 973 { 974 DPRINTF("get config id %"PRIu64"\n", p->id); 975 976 usbredirparser_send_get_configuration(dev->parser, p->id); 977 usbredirparser_do_write(dev->parser); 978 p->status = USB_RET_ASYNC; 979 } 980 981 static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p, 982 int interface, int alt) 983 { 984 struct usb_redir_set_alt_setting_header set_alt; 985 int i; 986 987 DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id); 988 989 for (i = 0; i < MAX_ENDPOINTS; i++) { 990 if (dev->endpoint[i].interface == interface) { 991 usbredir_stop_ep(dev, i); 992 } 993 } 994 995 set_alt.interface = interface; 996 set_alt.alt = alt; 997 usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt); 998 usbredirparser_do_write(dev->parser); 999 p->status = USB_RET_ASYNC; 1000 } 1001 1002 static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p, 1003 int interface) 1004 { 1005 struct usb_redir_get_alt_setting_header get_alt; 1006 1007 DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id); 1008 1009 get_alt.interface = interface; 1010 usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt); 1011 usbredirparser_do_write(dev->parser); 1012 p->status = USB_RET_ASYNC; 1013 } 1014 1015 static void usbredir_handle_control(USBDevice *udev, USBPacket *p, 1016 int request, int value, int index, int length, uint8_t *data) 1017 { 1018 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1019 struct usb_redir_control_packet_header control_packet; 1020 1021 if (usbredir_already_in_flight(dev, p->id)) { 1022 p->status = USB_RET_ASYNC; 1023 return; 1024 } 1025 1026 /* Special cases for certain standard device requests */ 1027 switch (request) { 1028 case DeviceOutRequest | USB_REQ_SET_ADDRESS: 1029 DPRINTF("set address %d\n", value); 1030 dev->dev.addr = value; 1031 return; 1032 case DeviceOutRequest | USB_REQ_SET_CONFIGURATION: 1033 usbredir_set_config(dev, p, value & 0xff); 1034 return; 1035 case DeviceRequest | USB_REQ_GET_CONFIGURATION: 1036 usbredir_get_config(dev, p); 1037 return; 1038 case InterfaceOutRequest | USB_REQ_SET_INTERFACE: 1039 usbredir_set_interface(dev, p, index, value); 1040 return; 1041 case InterfaceRequest | USB_REQ_GET_INTERFACE: 1042 usbredir_get_interface(dev, p, index); 1043 return; 1044 } 1045 1046 /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */ 1047 DPRINTF( 1048 "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n", 1049 request >> 8, request & 0xff, value, index, length, p->id); 1050 1051 control_packet.request = request & 0xFF; 1052 control_packet.requesttype = request >> 8; 1053 control_packet.endpoint = control_packet.requesttype & USB_DIR_IN; 1054 control_packet.value = value; 1055 control_packet.index = index; 1056 control_packet.length = length; 1057 1058 if (control_packet.requesttype & USB_DIR_IN) { 1059 usbredirparser_send_control_packet(dev->parser, p->id, 1060 &control_packet, NULL, 0); 1061 } else { 1062 usbredir_log_data(dev, "ctrl data out:", data, length); 1063 usbredirparser_send_control_packet(dev->parser, p->id, 1064 &control_packet, data, length); 1065 } 1066 usbredirparser_do_write(dev->parser); 1067 p->status = USB_RET_ASYNC; 1068 } 1069 1070 /* 1071 * Close events can be triggered by usbredirparser_do_write which gets called 1072 * from within the USBDevice data / control packet callbacks and doing a 1073 * usb_detach from within these callbacks is not a good idea. 1074 * 1075 * So we use a bh handler to take care of close events. 1076 */ 1077 static void usbredir_chardev_close_bh(void *opaque) 1078 { 1079 USBRedirDevice *dev = opaque; 1080 1081 usbredir_device_disconnect(dev); 1082 1083 if (dev->parser) { 1084 DPRINTF("destroying usbredirparser\n"); 1085 usbredirparser_destroy(dev->parser); 1086 dev->parser = NULL; 1087 } 1088 } 1089 1090 static void usbredir_create_parser(USBRedirDevice *dev) 1091 { 1092 uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, }; 1093 int flags = 0; 1094 1095 DPRINTF("creating usbredirparser\n"); 1096 1097 dev->parser = qemu_oom_check(usbredirparser_create()); 1098 dev->parser->priv = dev; 1099 dev->parser->log_func = usbredir_log; 1100 dev->parser->read_func = usbredir_read; 1101 dev->parser->write_func = usbredir_write; 1102 dev->parser->hello_func = usbredir_hello; 1103 dev->parser->device_connect_func = usbredir_device_connect; 1104 dev->parser->device_disconnect_func = usbredir_device_disconnect; 1105 dev->parser->interface_info_func = usbredir_interface_info; 1106 dev->parser->ep_info_func = usbredir_ep_info; 1107 dev->parser->configuration_status_func = usbredir_configuration_status; 1108 dev->parser->alt_setting_status_func = usbredir_alt_setting_status; 1109 dev->parser->iso_stream_status_func = usbredir_iso_stream_status; 1110 dev->parser->interrupt_receiving_status_func = 1111 usbredir_interrupt_receiving_status; 1112 dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status; 1113 dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status; 1114 dev->parser->control_packet_func = usbredir_control_packet; 1115 dev->parser->bulk_packet_func = usbredir_bulk_packet; 1116 dev->parser->iso_packet_func = usbredir_iso_packet; 1117 dev->parser->interrupt_packet_func = usbredir_interrupt_packet; 1118 dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet; 1119 dev->read_buf = NULL; 1120 dev->read_buf_size = 0; 1121 1122 usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version); 1123 usbredirparser_caps_set_cap(caps, usb_redir_cap_filter); 1124 usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size); 1125 usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids); 1126 usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length); 1127 usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving); 1128 1129 if (runstate_check(RUN_STATE_INMIGRATE)) { 1130 flags |= usbredirparser_fl_no_hello; 1131 } 1132 usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 1133 flags); 1134 usbredirparser_do_write(dev->parser); 1135 } 1136 1137 static void usbredir_reject_device(USBRedirDevice *dev) 1138 { 1139 usbredir_device_disconnect(dev); 1140 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) { 1141 usbredirparser_send_filter_reject(dev->parser); 1142 usbredirparser_do_write(dev->parser); 1143 } 1144 } 1145 1146 static void usbredir_do_attach(void *opaque) 1147 { 1148 USBRedirDevice *dev = opaque; 1149 1150 /* In order to work properly with XHCI controllers we need these caps */ 1151 if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !( 1152 usbredirparser_peer_has_cap(dev->parser, 1153 usb_redir_cap_ep_info_max_packet_size) && 1154 usbredirparser_peer_has_cap(dev->parser, 1155 usb_redir_cap_32bits_bulk_length) && 1156 usbredirparser_peer_has_cap(dev->parser, 1157 usb_redir_cap_64bits_ids))) { 1158 ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n"); 1159 usbredir_reject_device(dev); 1160 return; 1161 } 1162 1163 if (usb_device_attach(&dev->dev) != 0) { 1164 WARNING("rejecting device due to speed mismatch\n"); 1165 usbredir_reject_device(dev); 1166 } 1167 } 1168 1169 /* 1170 * chardev callbacks 1171 */ 1172 1173 static int usbredir_chardev_can_read(void *opaque) 1174 { 1175 USBRedirDevice *dev = opaque; 1176 1177 if (!dev->parser) { 1178 WARNING("chardev_can_read called on non open chardev!\n"); 1179 return 0; 1180 } 1181 1182 /* Don't read new data from the chardev until our state is fully synced */ 1183 if (!runstate_check(RUN_STATE_RUNNING)) { 1184 return 0; 1185 } 1186 1187 /* usbredir_parser_do_read will consume *all* data we give it */ 1188 return 1024 * 1024; 1189 } 1190 1191 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size) 1192 { 1193 USBRedirDevice *dev = opaque; 1194 1195 /* No recursion allowed! */ 1196 assert(dev->read_buf == NULL); 1197 1198 dev->read_buf = buf; 1199 dev->read_buf_size = size; 1200 1201 usbredirparser_do_read(dev->parser); 1202 /* Send any acks, etc. which may be queued now */ 1203 usbredirparser_do_write(dev->parser); 1204 } 1205 1206 static void usbredir_chardev_event(void *opaque, int event) 1207 { 1208 USBRedirDevice *dev = opaque; 1209 1210 switch (event) { 1211 case CHR_EVENT_OPENED: 1212 DPRINTF("chardev open\n"); 1213 /* Make sure any pending closes are handled (no-op if none pending) */ 1214 usbredir_chardev_close_bh(dev); 1215 qemu_bh_cancel(dev->chardev_close_bh); 1216 usbredir_create_parser(dev); 1217 break; 1218 case CHR_EVENT_CLOSED: 1219 DPRINTF("chardev close\n"); 1220 qemu_bh_schedule(dev->chardev_close_bh); 1221 break; 1222 } 1223 } 1224 1225 /* 1226 * init + destroy 1227 */ 1228 1229 static void usbredir_vm_state_change(void *priv, int running, RunState state) 1230 { 1231 USBRedirDevice *dev = priv; 1232 1233 if (state == RUN_STATE_RUNNING && dev->parser != NULL) { 1234 usbredirparser_do_write(dev->parser); /* Flush any pending writes */ 1235 } 1236 } 1237 1238 static void usbredir_init_endpoints(USBRedirDevice *dev) 1239 { 1240 int i; 1241 1242 usb_ep_init(&dev->dev); 1243 memset(dev->endpoint, 0, sizeof(dev->endpoint)); 1244 for (i = 0; i < MAX_ENDPOINTS; i++) { 1245 dev->endpoint[i].dev = dev; 1246 QTAILQ_INIT(&dev->endpoint[i].bufpq); 1247 } 1248 } 1249 1250 static int usbredir_initfn(USBDevice *udev) 1251 { 1252 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1253 int i; 1254 1255 if (dev->cs == NULL) { 1256 qerror_report(QERR_MISSING_PARAMETER, "chardev"); 1257 return -1; 1258 } 1259 1260 if (dev->filter_str) { 1261 i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|", 1262 &dev->filter_rules, 1263 &dev->filter_rules_count); 1264 if (i) { 1265 qerror_report(QERR_INVALID_PARAMETER_VALUE, "filter", 1266 "a usb device filter string"); 1267 return -1; 1268 } 1269 } 1270 1271 dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev); 1272 dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev); 1273 1274 packet_id_queue_init(&dev->cancelled, dev, "cancelled"); 1275 packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight"); 1276 usbredir_init_endpoints(dev); 1277 1278 /* We'll do the attach once we receive the speed from the usb-host */ 1279 udev->auto_attach = 0; 1280 1281 /* Will be cleared during setup when we find conflicts */ 1282 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH; 1283 1284 /* Let the backend know we are ready */ 1285 qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read, 1286 usbredir_chardev_read, usbredir_chardev_event, dev); 1287 1288 qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev); 1289 add_boot_device_path(dev->bootindex, &udev->qdev, NULL); 1290 return 0; 1291 } 1292 1293 static void usbredir_cleanup_device_queues(USBRedirDevice *dev) 1294 { 1295 int i; 1296 1297 packet_id_queue_empty(&dev->cancelled); 1298 packet_id_queue_empty(&dev->already_in_flight); 1299 for (i = 0; i < MAX_ENDPOINTS; i++) { 1300 usbredir_free_bufpq(dev, I2EP(i)); 1301 } 1302 } 1303 1304 static void usbredir_handle_destroy(USBDevice *udev) 1305 { 1306 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1307 1308 qemu_chr_delete(dev->cs); 1309 /* Note must be done after qemu_chr_close, as that causes a close event */ 1310 qemu_bh_delete(dev->chardev_close_bh); 1311 1312 qemu_del_timer(dev->attach_timer); 1313 qemu_free_timer(dev->attach_timer); 1314 1315 usbredir_cleanup_device_queues(dev); 1316 1317 if (dev->parser) { 1318 usbredirparser_destroy(dev->parser); 1319 } 1320 1321 free(dev->filter_rules); 1322 } 1323 1324 static int usbredir_check_filter(USBRedirDevice *dev) 1325 { 1326 if (dev->interface_info.interface_count == NO_INTERFACE_INFO) { 1327 ERROR("No interface info for device\n"); 1328 goto error; 1329 } 1330 1331 if (dev->filter_rules) { 1332 if (!usbredirparser_peer_has_cap(dev->parser, 1333 usb_redir_cap_connect_device_version)) { 1334 ERROR("Device filter specified and peer does not have the " 1335 "connect_device_version capability\n"); 1336 goto error; 1337 } 1338 1339 if (usbredirfilter_check( 1340 dev->filter_rules, 1341 dev->filter_rules_count, 1342 dev->device_info.device_class, 1343 dev->device_info.device_subclass, 1344 dev->device_info.device_protocol, 1345 dev->interface_info.interface_class, 1346 dev->interface_info.interface_subclass, 1347 dev->interface_info.interface_protocol, 1348 dev->interface_info.interface_count, 1349 dev->device_info.vendor_id, 1350 dev->device_info.product_id, 1351 dev->device_info.device_version_bcd, 1352 0) != 0) { 1353 goto error; 1354 } 1355 } 1356 1357 return 0; 1358 1359 error: 1360 usbredir_reject_device(dev); 1361 return -1; 1362 } 1363 1364 static void usbredir_check_bulk_receiving(USBRedirDevice *dev) 1365 { 1366 int i, j, quirks; 1367 1368 if (!usbredirparser_peer_has_cap(dev->parser, 1369 usb_redir_cap_bulk_receiving)) { 1370 return; 1371 } 1372 1373 for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) { 1374 dev->endpoint[i].bulk_receiving_enabled = 0; 1375 } 1376 for (i = 0; i < dev->interface_info.interface_count; i++) { 1377 quirks = usb_get_quirks(dev->device_info.vendor_id, 1378 dev->device_info.product_id, 1379 dev->interface_info.interface_class[i], 1380 dev->interface_info.interface_subclass[i], 1381 dev->interface_info.interface_protocol[i]); 1382 if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) { 1383 continue; 1384 } 1385 if (quirks & USB_QUIRK_IS_FTDI) { 1386 dev->buffered_bulk_in_complete = 1387 usbredir_buffered_bulk_in_complete_ftdi; 1388 } else { 1389 dev->buffered_bulk_in_complete = 1390 usbredir_buffered_bulk_in_complete_raw; 1391 } 1392 1393 for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) { 1394 if (dev->endpoint[j].interface == 1395 dev->interface_info.interface[i] && 1396 dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK && 1397 dev->endpoint[j].max_packet_size != 0) { 1398 dev->endpoint[j].bulk_receiving_enabled = 1; 1399 /* 1400 * With buffering pipelining is not necessary. Also packet 1401 * combining and bulk in buffering don't play nice together! 1402 */ 1403 I2USBEP(dev, j)->pipeline = false; 1404 break; /* Only buffer for the first ep of each intf */ 1405 } 1406 } 1407 } 1408 } 1409 1410 /* 1411 * usbredirparser packet complete callbacks 1412 */ 1413 1414 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p, 1415 int status) 1416 { 1417 switch (status) { 1418 case usb_redir_success: 1419 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 1420 break; 1421 case usb_redir_stall: 1422 p->status = USB_RET_STALL; 1423 break; 1424 case usb_redir_cancelled: 1425 /* 1426 * When the usbredir-host unredirects a device, it will report a status 1427 * of cancelled for all pending packets, followed by a disconnect msg. 1428 */ 1429 p->status = USB_RET_IOERROR; 1430 break; 1431 case usb_redir_inval: 1432 WARNING("got invalid param error from usb-host?\n"); 1433 p->status = USB_RET_IOERROR; 1434 break; 1435 case usb_redir_babble: 1436 p->status = USB_RET_BABBLE; 1437 break; 1438 case usb_redir_ioerror: 1439 case usb_redir_timeout: 1440 default: 1441 p->status = USB_RET_IOERROR; 1442 } 1443 } 1444 1445 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h) 1446 { 1447 USBRedirDevice *dev = priv; 1448 1449 /* Try to send the filter info now that we've the usb-host's caps */ 1450 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) && 1451 dev->filter_rules) { 1452 usbredirparser_send_filter_filter(dev->parser, dev->filter_rules, 1453 dev->filter_rules_count); 1454 usbredirparser_do_write(dev->parser); 1455 } 1456 } 1457 1458 static void usbredir_device_connect(void *priv, 1459 struct usb_redir_device_connect_header *device_connect) 1460 { 1461 USBRedirDevice *dev = priv; 1462 const char *speed; 1463 1464 if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) { 1465 ERROR("Received device connect while already connected\n"); 1466 return; 1467 } 1468 1469 switch (device_connect->speed) { 1470 case usb_redir_speed_low: 1471 speed = "low speed"; 1472 dev->dev.speed = USB_SPEED_LOW; 1473 dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL; 1474 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH; 1475 break; 1476 case usb_redir_speed_full: 1477 speed = "full speed"; 1478 dev->dev.speed = USB_SPEED_FULL; 1479 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH; 1480 break; 1481 case usb_redir_speed_high: 1482 speed = "high speed"; 1483 dev->dev.speed = USB_SPEED_HIGH; 1484 break; 1485 case usb_redir_speed_super: 1486 speed = "super speed"; 1487 dev->dev.speed = USB_SPEED_SUPER; 1488 break; 1489 default: 1490 speed = "unknown speed"; 1491 dev->dev.speed = USB_SPEED_FULL; 1492 } 1493 1494 if (usbredirparser_peer_has_cap(dev->parser, 1495 usb_redir_cap_connect_device_version)) { 1496 INFO("attaching %s device %04x:%04x version %d.%d class %02x\n", 1497 speed, device_connect->vendor_id, device_connect->product_id, 1498 ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 + 1499 ((device_connect->device_version_bcd & 0x0f00) >> 8), 1500 ((device_connect->device_version_bcd & 0x00f0) >> 4) * 10 + 1501 ((device_connect->device_version_bcd & 0x000f) >> 0), 1502 device_connect->device_class); 1503 } else { 1504 INFO("attaching %s device %04x:%04x class %02x\n", speed, 1505 device_connect->vendor_id, device_connect->product_id, 1506 device_connect->device_class); 1507 } 1508 1509 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask; 1510 dev->device_info = *device_connect; 1511 1512 if (usbredir_check_filter(dev)) { 1513 WARNING("Device %04x:%04x rejected by device filter, not attaching\n", 1514 device_connect->vendor_id, device_connect->product_id); 1515 return; 1516 } 1517 1518 usbredir_check_bulk_receiving(dev); 1519 qemu_mod_timer(dev->attach_timer, dev->next_attach_time); 1520 } 1521 1522 static void usbredir_device_disconnect(void *priv) 1523 { 1524 USBRedirDevice *dev = priv; 1525 1526 /* Stop any pending attaches */ 1527 qemu_del_timer(dev->attach_timer); 1528 1529 if (dev->dev.attached) { 1530 DPRINTF("detaching device\n"); 1531 usb_device_detach(&dev->dev); 1532 /* 1533 * Delay next usb device attach to give the guest a chance to see 1534 * see the detach / attach in case of quick close / open succession 1535 */ 1536 dev->next_attach_time = qemu_get_clock_ms(vm_clock) + 200; 1537 } 1538 1539 /* Reset state so that the next dev connected starts with a clean slate */ 1540 usbredir_cleanup_device_queues(dev); 1541 usbredir_init_endpoints(dev); 1542 dev->interface_info.interface_count = NO_INTERFACE_INFO; 1543 dev->dev.addr = 0; 1544 dev->dev.speed = 0; 1545 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH; 1546 } 1547 1548 static void usbredir_interface_info(void *priv, 1549 struct usb_redir_interface_info_header *interface_info) 1550 { 1551 USBRedirDevice *dev = priv; 1552 1553 dev->interface_info = *interface_info; 1554 1555 /* 1556 * If we receive interface info after the device has already been 1557 * connected (ie on a set_config), re-check interface dependent things. 1558 */ 1559 if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) { 1560 usbredir_check_bulk_receiving(dev); 1561 if (usbredir_check_filter(dev)) { 1562 ERROR("Device no longer matches filter after interface info " 1563 "change, disconnecting!\n"); 1564 } 1565 } 1566 } 1567 1568 static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed) 1569 { 1570 dev->compatible_speedmask &= ~(1 << speed); 1571 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask; 1572 } 1573 1574 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep) 1575 { 1576 if (uep->type != USB_ENDPOINT_XFER_BULK) { 1577 return; 1578 } 1579 if (uep->pid == USB_TOKEN_OUT) { 1580 uep->pipeline = true; 1581 } 1582 if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 && 1583 usbredirparser_peer_has_cap(dev->parser, 1584 usb_redir_cap_32bits_bulk_length)) { 1585 uep->pipeline = true; 1586 } 1587 } 1588 1589 static void usbredir_setup_usb_eps(USBRedirDevice *dev) 1590 { 1591 struct USBEndpoint *usb_ep; 1592 int i; 1593 1594 for (i = 0; i < MAX_ENDPOINTS; i++) { 1595 usb_ep = I2USBEP(dev, i); 1596 usb_ep->type = dev->endpoint[i].type; 1597 usb_ep->ifnum = dev->endpoint[i].interface; 1598 usb_ep->max_packet_size = dev->endpoint[i].max_packet_size; 1599 usbredir_set_pipeline(dev, usb_ep); 1600 } 1601 } 1602 1603 static void usbredir_ep_info(void *priv, 1604 struct usb_redir_ep_info_header *ep_info) 1605 { 1606 USBRedirDevice *dev = priv; 1607 int i; 1608 1609 for (i = 0; i < MAX_ENDPOINTS; i++) { 1610 dev->endpoint[i].type = ep_info->type[i]; 1611 dev->endpoint[i].interval = ep_info->interval[i]; 1612 dev->endpoint[i].interface = ep_info->interface[i]; 1613 if (usbredirparser_peer_has_cap(dev->parser, 1614 usb_redir_cap_ep_info_max_packet_size)) { 1615 dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i]; 1616 } 1617 switch (dev->endpoint[i].type) { 1618 case usb_redir_type_invalid: 1619 break; 1620 case usb_redir_type_iso: 1621 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL); 1622 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH); 1623 /* Fall through */ 1624 case usb_redir_type_interrupt: 1625 if (!usbredirparser_peer_has_cap(dev->parser, 1626 usb_redir_cap_ep_info_max_packet_size) || 1627 ep_info->max_packet_size[i] > 64) { 1628 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL); 1629 } 1630 if (!usbredirparser_peer_has_cap(dev->parser, 1631 usb_redir_cap_ep_info_max_packet_size) || 1632 ep_info->max_packet_size[i] > 1024) { 1633 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH); 1634 } 1635 if (dev->endpoint[i].interval == 0) { 1636 ERROR("Received 0 interval for isoc or irq endpoint\n"); 1637 usbredir_reject_device(dev); 1638 return; 1639 } 1640 /* Fall through */ 1641 case usb_redir_type_control: 1642 case usb_redir_type_bulk: 1643 DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i), 1644 dev->endpoint[i].type, dev->endpoint[i].interface); 1645 break; 1646 default: 1647 ERROR("Received invalid endpoint type\n"); 1648 usbredir_reject_device(dev); 1649 return; 1650 } 1651 } 1652 /* The new ep info may have caused a speed incompatibility, recheck */ 1653 if (dev->dev.attached && 1654 !(dev->dev.port->speedmask & dev->dev.speedmask)) { 1655 ERROR("Device no longer matches speed after endpoint info change, " 1656 "disconnecting!\n"); 1657 usbredir_reject_device(dev); 1658 return; 1659 } 1660 usbredir_setup_usb_eps(dev); 1661 usbredir_check_bulk_receiving(dev); 1662 } 1663 1664 static void usbredir_configuration_status(void *priv, uint64_t id, 1665 struct usb_redir_configuration_status_header *config_status) 1666 { 1667 USBRedirDevice *dev = priv; 1668 USBPacket *p; 1669 1670 DPRINTF("set config status %d config %d id %"PRIu64"\n", 1671 config_status->status, config_status->configuration, id); 1672 1673 p = usbredir_find_packet_by_id(dev, 0, id); 1674 if (p) { 1675 if (dev->dev.setup_buf[0] & USB_DIR_IN) { 1676 dev->dev.data_buf[0] = config_status->configuration; 1677 p->actual_length = 1; 1678 } 1679 usbredir_handle_status(dev, p, config_status->status); 1680 usb_generic_async_ctrl_complete(&dev->dev, p); 1681 } 1682 } 1683 1684 static void usbredir_alt_setting_status(void *priv, uint64_t id, 1685 struct usb_redir_alt_setting_status_header *alt_setting_status) 1686 { 1687 USBRedirDevice *dev = priv; 1688 USBPacket *p; 1689 1690 DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n", 1691 alt_setting_status->status, alt_setting_status->interface, 1692 alt_setting_status->alt, id); 1693 1694 p = usbredir_find_packet_by_id(dev, 0, id); 1695 if (p) { 1696 if (dev->dev.setup_buf[0] & USB_DIR_IN) { 1697 dev->dev.data_buf[0] = alt_setting_status->alt; 1698 p->actual_length = 1; 1699 } 1700 usbredir_handle_status(dev, p, alt_setting_status->status); 1701 usb_generic_async_ctrl_complete(&dev->dev, p); 1702 } 1703 } 1704 1705 static void usbredir_iso_stream_status(void *priv, uint64_t id, 1706 struct usb_redir_iso_stream_status_header *iso_stream_status) 1707 { 1708 USBRedirDevice *dev = priv; 1709 uint8_t ep = iso_stream_status->endpoint; 1710 1711 DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status, 1712 ep, id); 1713 1714 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) { 1715 return; 1716 } 1717 1718 dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status; 1719 if (iso_stream_status->status == usb_redir_stall) { 1720 DPRINTF("iso stream stopped by peer ep %02X\n", ep); 1721 dev->endpoint[EP2I(ep)].iso_started = 0; 1722 } 1723 } 1724 1725 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id, 1726 struct usb_redir_interrupt_receiving_status_header 1727 *interrupt_receiving_status) 1728 { 1729 USBRedirDevice *dev = priv; 1730 uint8_t ep = interrupt_receiving_status->endpoint; 1731 1732 DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n", 1733 interrupt_receiving_status->status, ep, id); 1734 1735 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) { 1736 return; 1737 } 1738 1739 dev->endpoint[EP2I(ep)].interrupt_error = 1740 interrupt_receiving_status->status; 1741 if (interrupt_receiving_status->status == usb_redir_stall) { 1742 DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep); 1743 dev->endpoint[EP2I(ep)].interrupt_started = 0; 1744 } 1745 } 1746 1747 static void usbredir_bulk_streams_status(void *priv, uint64_t id, 1748 struct usb_redir_bulk_streams_status_header *bulk_streams_status) 1749 { 1750 } 1751 1752 static void usbredir_bulk_receiving_status(void *priv, uint64_t id, 1753 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status) 1754 { 1755 USBRedirDevice *dev = priv; 1756 uint8_t ep = bulk_receiving_status->endpoint; 1757 1758 DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n", 1759 bulk_receiving_status->status, ep, id); 1760 1761 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) { 1762 return; 1763 } 1764 1765 if (bulk_receiving_status->status == usb_redir_stall) { 1766 DPRINTF("bulk receiving stopped by peer ep %02X\n", ep); 1767 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0; 1768 } 1769 } 1770 1771 static void usbredir_control_packet(void *priv, uint64_t id, 1772 struct usb_redir_control_packet_header *control_packet, 1773 uint8_t *data, int data_len) 1774 { 1775 USBRedirDevice *dev = priv; 1776 USBPacket *p; 1777 int len = control_packet->length; 1778 1779 DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status, 1780 len, id); 1781 1782 /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices 1783 * to work redirected to a not superspeed capable hcd */ 1784 if (dev->dev.speed == USB_SPEED_SUPER && 1785 !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) && 1786 control_packet->requesttype == 0x80 && 1787 control_packet->request == 6 && 1788 control_packet->value == 0x100 && control_packet->index == 0 && 1789 data_len >= 18 && data[7] == 9) { 1790 data[7] = 64; 1791 } 1792 1793 p = usbredir_find_packet_by_id(dev, 0, id); 1794 if (p) { 1795 usbredir_handle_status(dev, p, control_packet->status); 1796 if (data_len > 0) { 1797 usbredir_log_data(dev, "ctrl data in:", data, data_len); 1798 if (data_len > sizeof(dev->dev.data_buf)) { 1799 ERROR("ctrl buffer too small (%d > %zu)\n", 1800 data_len, sizeof(dev->dev.data_buf)); 1801 p->status = USB_RET_STALL; 1802 data_len = len = sizeof(dev->dev.data_buf); 1803 } 1804 memcpy(dev->dev.data_buf, data, data_len); 1805 } 1806 p->actual_length = len; 1807 usb_generic_async_ctrl_complete(&dev->dev, p); 1808 } 1809 free(data); 1810 } 1811 1812 static void usbredir_bulk_packet(void *priv, uint64_t id, 1813 struct usb_redir_bulk_packet_header *bulk_packet, 1814 uint8_t *data, int data_len) 1815 { 1816 USBRedirDevice *dev = priv; 1817 uint8_t ep = bulk_packet->endpoint; 1818 int len = (bulk_packet->length_high << 16) | bulk_packet->length; 1819 USBPacket *p; 1820 1821 DPRINTF("bulk-in status %d ep %02X len %d id %"PRIu64"\n", 1822 bulk_packet->status, ep, len, id); 1823 1824 p = usbredir_find_packet_by_id(dev, ep, id); 1825 if (p) { 1826 size_t size = usb_packet_size(p); 1827 usbredir_handle_status(dev, p, bulk_packet->status); 1828 if (data_len > 0) { 1829 usbredir_log_data(dev, "bulk data in:", data, data_len); 1830 if (data_len > size) { 1831 ERROR("bulk got more data then requested (%d > %zd)\n", 1832 data_len, p->iov.size); 1833 p->status = USB_RET_BABBLE; 1834 data_len = len = size; 1835 } 1836 usb_packet_copy(p, data, data_len); 1837 } 1838 p->actual_length = len; 1839 if (p->pid == USB_TOKEN_IN && p->ep->pipeline) { 1840 usb_combined_input_packet_complete(&dev->dev, p); 1841 } else { 1842 usb_packet_complete(&dev->dev, p); 1843 } 1844 } 1845 free(data); 1846 } 1847 1848 static void usbredir_iso_packet(void *priv, uint64_t id, 1849 struct usb_redir_iso_packet_header *iso_packet, 1850 uint8_t *data, int data_len) 1851 { 1852 USBRedirDevice *dev = priv; 1853 uint8_t ep = iso_packet->endpoint; 1854 1855 DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n", 1856 iso_packet->status, ep, data_len, id); 1857 1858 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) { 1859 ERROR("received iso packet for non iso endpoint %02X\n", ep); 1860 free(data); 1861 return; 1862 } 1863 1864 if (dev->endpoint[EP2I(ep)].iso_started == 0) { 1865 DPRINTF("received iso packet for non started stream ep %02X\n", ep); 1866 free(data); 1867 return; 1868 } 1869 1870 /* bufp_alloc also adds the packet to the ep queue */ 1871 bufp_alloc(dev, data, data_len, iso_packet->status, ep, data); 1872 } 1873 1874 static void usbredir_interrupt_packet(void *priv, uint64_t id, 1875 struct usb_redir_interrupt_packet_header *interrupt_packet, 1876 uint8_t *data, int data_len) 1877 { 1878 USBRedirDevice *dev = priv; 1879 uint8_t ep = interrupt_packet->endpoint; 1880 1881 DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n", 1882 interrupt_packet->status, ep, data_len, id); 1883 1884 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) { 1885 ERROR("received int packet for non interrupt endpoint %02X\n", ep); 1886 free(data); 1887 return; 1888 } 1889 1890 if (ep & USB_DIR_IN) { 1891 if (dev->endpoint[EP2I(ep)].interrupt_started == 0) { 1892 DPRINTF("received int packet while not started ep %02X\n", ep); 1893 free(data); 1894 return; 1895 } 1896 1897 if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) { 1898 usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0); 1899 } 1900 1901 /* bufp_alloc also adds the packet to the ep queue */ 1902 bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data); 1903 } else { 1904 /* 1905 * We report output interrupt packets as completed directly upon 1906 * submission, so all we can do here if one failed is warn. 1907 */ 1908 if (interrupt_packet->status) { 1909 WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n", 1910 interrupt_packet->status, ep, id); 1911 } 1912 } 1913 } 1914 1915 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id, 1916 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet, 1917 uint8_t *data, int data_len) 1918 { 1919 USBRedirDevice *dev = priv; 1920 uint8_t status, ep = buffered_bulk_packet->endpoint; 1921 void *free_on_destroy; 1922 int i, len; 1923 1924 DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n", 1925 buffered_bulk_packet->status, ep, data_len, id); 1926 1927 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) { 1928 ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep); 1929 free(data); 1930 return; 1931 } 1932 1933 if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) { 1934 DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep); 1935 free(data); 1936 return; 1937 } 1938 1939 /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */ 1940 len = dev->endpoint[EP2I(ep)].max_packet_size; 1941 status = usb_redir_success; 1942 free_on_destroy = NULL; 1943 for (i = 0; i < data_len; i += len) { 1944 if (len >= (data_len - i)) { 1945 len = data_len - i; 1946 status = buffered_bulk_packet->status; 1947 free_on_destroy = data; 1948 } 1949 /* bufp_alloc also adds the packet to the ep queue */ 1950 bufp_alloc(dev, data + i, len, status, ep, free_on_destroy); 1951 } 1952 1953 if (dev->endpoint[EP2I(ep)].pending_async_packet) { 1954 USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet; 1955 dev->endpoint[EP2I(ep)].pending_async_packet = NULL; 1956 usbredir_buffered_bulk_in_complete(dev, p, ep); 1957 usb_packet_complete(&dev->dev, p); 1958 } 1959 } 1960 1961 /* 1962 * Migration code 1963 */ 1964 1965 static void usbredir_pre_save(void *priv) 1966 { 1967 USBRedirDevice *dev = priv; 1968 1969 usbredir_fill_already_in_flight(dev); 1970 } 1971 1972 static int usbredir_post_load(void *priv, int version_id) 1973 { 1974 USBRedirDevice *dev = priv; 1975 1976 switch (dev->device_info.speed) { 1977 case usb_redir_speed_low: 1978 dev->dev.speed = USB_SPEED_LOW; 1979 break; 1980 case usb_redir_speed_full: 1981 dev->dev.speed = USB_SPEED_FULL; 1982 break; 1983 case usb_redir_speed_high: 1984 dev->dev.speed = USB_SPEED_HIGH; 1985 break; 1986 case usb_redir_speed_super: 1987 dev->dev.speed = USB_SPEED_SUPER; 1988 break; 1989 default: 1990 dev->dev.speed = USB_SPEED_FULL; 1991 } 1992 dev->dev.speedmask = (1 << dev->dev.speed); 1993 1994 usbredir_setup_usb_eps(dev); 1995 usbredir_check_bulk_receiving(dev); 1996 1997 return 0; 1998 } 1999 2000 /* For usbredirparser migration */ 2001 static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused) 2002 { 2003 USBRedirDevice *dev = priv; 2004 uint8_t *data; 2005 int len; 2006 2007 if (dev->parser == NULL) { 2008 qemu_put_be32(f, 0); 2009 return; 2010 } 2011 2012 usbredirparser_serialize(dev->parser, &data, &len); 2013 qemu_oom_check(data); 2014 2015 qemu_put_be32(f, len); 2016 qemu_put_buffer(f, data, len); 2017 2018 free(data); 2019 } 2020 2021 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused) 2022 { 2023 USBRedirDevice *dev = priv; 2024 uint8_t *data; 2025 int len, ret; 2026 2027 len = qemu_get_be32(f); 2028 if (len == 0) { 2029 return 0; 2030 } 2031 2032 /* 2033 * If our chardev is not open already at this point the usbredir connection 2034 * has been broken (non seamless migration, or restore from disk). 2035 * 2036 * In this case create a temporary parser to receive the migration data, 2037 * and schedule the close_bh to report the device as disconnected to the 2038 * guest and to destroy the parser again. 2039 */ 2040 if (dev->parser == NULL) { 2041 WARNING("usb-redir connection broken during migration\n"); 2042 usbredir_create_parser(dev); 2043 qemu_bh_schedule(dev->chardev_close_bh); 2044 } 2045 2046 data = g_malloc(len); 2047 qemu_get_buffer(f, data, len); 2048 2049 ret = usbredirparser_unserialize(dev->parser, data, len); 2050 2051 g_free(data); 2052 2053 return ret; 2054 } 2055 2056 static const VMStateInfo usbredir_parser_vmstate_info = { 2057 .name = "usb-redir-parser", 2058 .put = usbredir_put_parser, 2059 .get = usbredir_get_parser, 2060 }; 2061 2062 2063 /* For buffered packets (iso/irq) queue migration */ 2064 static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused) 2065 { 2066 struct endp_data *endp = priv; 2067 USBRedirDevice *dev = endp->dev; 2068 struct buf_packet *bufp; 2069 int len, i = 0; 2070 2071 qemu_put_be32(f, endp->bufpq_size); 2072 QTAILQ_FOREACH(bufp, &endp->bufpq, next) { 2073 len = bufp->len - bufp->offset; 2074 DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size, 2075 len, bufp->status); 2076 qemu_put_be32(f, len); 2077 qemu_put_be32(f, bufp->status); 2078 qemu_put_buffer(f, bufp->data + bufp->offset, len); 2079 i++; 2080 } 2081 assert(i == endp->bufpq_size); 2082 } 2083 2084 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused) 2085 { 2086 struct endp_data *endp = priv; 2087 USBRedirDevice *dev = endp->dev; 2088 struct buf_packet *bufp; 2089 int i; 2090 2091 endp->bufpq_size = qemu_get_be32(f); 2092 for (i = 0; i < endp->bufpq_size; i++) { 2093 bufp = g_malloc(sizeof(struct buf_packet)); 2094 bufp->len = qemu_get_be32(f); 2095 bufp->status = qemu_get_be32(f); 2096 bufp->offset = 0; 2097 bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */ 2098 bufp->free_on_destroy = bufp->data; 2099 qemu_get_buffer(f, bufp->data, bufp->len); 2100 QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next); 2101 DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size, 2102 bufp->len, bufp->status); 2103 } 2104 return 0; 2105 } 2106 2107 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = { 2108 .name = "usb-redir-bufpq", 2109 .put = usbredir_put_bufpq, 2110 .get = usbredir_get_bufpq, 2111 }; 2112 2113 2114 /* For endp_data migration */ 2115 static const VMStateDescription usbredir_bulk_receiving_vmstate = { 2116 .name = "usb-redir-ep/bulk-receiving", 2117 .version_id = 1, 2118 .minimum_version_id = 1, 2119 .fields = (VMStateField[]) { 2120 VMSTATE_UINT8(bulk_receiving_started, struct endp_data), 2121 VMSTATE_END_OF_LIST() 2122 } 2123 }; 2124 2125 static bool usbredir_bulk_receiving_needed(void *priv) 2126 { 2127 struct endp_data *endp = priv; 2128 2129 return endp->bulk_receiving_started; 2130 } 2131 2132 static const VMStateDescription usbredir_ep_vmstate = { 2133 .name = "usb-redir-ep", 2134 .version_id = 1, 2135 .minimum_version_id = 1, 2136 .fields = (VMStateField[]) { 2137 VMSTATE_UINT8(type, struct endp_data), 2138 VMSTATE_UINT8(interval, struct endp_data), 2139 VMSTATE_UINT8(interface, struct endp_data), 2140 VMSTATE_UINT16(max_packet_size, struct endp_data), 2141 VMSTATE_UINT8(iso_started, struct endp_data), 2142 VMSTATE_UINT8(iso_error, struct endp_data), 2143 VMSTATE_UINT8(interrupt_started, struct endp_data), 2144 VMSTATE_UINT8(interrupt_error, struct endp_data), 2145 VMSTATE_UINT8(bufpq_prefilled, struct endp_data), 2146 VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data), 2147 { 2148 .name = "bufpq", 2149 .version_id = 0, 2150 .field_exists = NULL, 2151 .size = 0, 2152 .info = &usbredir_ep_bufpq_vmstate_info, 2153 .flags = VMS_SINGLE, 2154 .offset = 0, 2155 }, 2156 VMSTATE_INT32(bufpq_target_size, struct endp_data), 2157 VMSTATE_END_OF_LIST() 2158 }, 2159 .subsections = (VMStateSubsection[]) { 2160 { 2161 .vmsd = &usbredir_bulk_receiving_vmstate, 2162 .needed = usbredir_bulk_receiving_needed, 2163 }, { 2164 /* empty */ 2165 } 2166 } 2167 }; 2168 2169 2170 /* For PacketIdQueue migration */ 2171 static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused) 2172 { 2173 struct PacketIdQueue *q = priv; 2174 USBRedirDevice *dev = q->dev; 2175 struct PacketIdQueueEntry *e; 2176 int remain = q->size; 2177 2178 DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size); 2179 qemu_put_be32(f, q->size); 2180 QTAILQ_FOREACH(e, &q->head, next) { 2181 qemu_put_be64(f, e->id); 2182 remain--; 2183 } 2184 assert(remain == 0); 2185 } 2186 2187 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused) 2188 { 2189 struct PacketIdQueue *q = priv; 2190 USBRedirDevice *dev = q->dev; 2191 int i, size; 2192 uint64_t id; 2193 2194 size = qemu_get_be32(f); 2195 DPRINTF("get_packet_id_q %s size %d\n", q->name, size); 2196 for (i = 0; i < size; i++) { 2197 id = qemu_get_be64(f); 2198 packet_id_queue_add(q, id); 2199 } 2200 assert(q->size == size); 2201 return 0; 2202 } 2203 2204 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = { 2205 .name = "usb-redir-packet-id-q", 2206 .put = usbredir_put_packet_id_q, 2207 .get = usbredir_get_packet_id_q, 2208 }; 2209 2210 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = { 2211 .name = "usb-redir-packet-id-queue", 2212 .version_id = 1, 2213 .minimum_version_id = 1, 2214 .fields = (VMStateField[]) { 2215 { 2216 .name = "queue", 2217 .version_id = 0, 2218 .field_exists = NULL, 2219 .size = 0, 2220 .info = &usbredir_ep_packet_id_q_vmstate_info, 2221 .flags = VMS_SINGLE, 2222 .offset = 0, 2223 }, 2224 VMSTATE_END_OF_LIST() 2225 } 2226 }; 2227 2228 2229 /* For usb_redir_device_connect_header migration */ 2230 static const VMStateDescription usbredir_device_info_vmstate = { 2231 .name = "usb-redir-device-info", 2232 .version_id = 1, 2233 .minimum_version_id = 1, 2234 .fields = (VMStateField[]) { 2235 VMSTATE_UINT8(speed, struct usb_redir_device_connect_header), 2236 VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header), 2237 VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header), 2238 VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header), 2239 VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header), 2240 VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header), 2241 VMSTATE_UINT16(device_version_bcd, 2242 struct usb_redir_device_connect_header), 2243 VMSTATE_END_OF_LIST() 2244 } 2245 }; 2246 2247 2248 /* For usb_redir_interface_info_header migration */ 2249 static const VMStateDescription usbredir_interface_info_vmstate = { 2250 .name = "usb-redir-interface-info", 2251 .version_id = 1, 2252 .minimum_version_id = 1, 2253 .fields = (VMStateField[]) { 2254 VMSTATE_UINT32(interface_count, 2255 struct usb_redir_interface_info_header), 2256 VMSTATE_UINT8_ARRAY(interface, 2257 struct usb_redir_interface_info_header, 32), 2258 VMSTATE_UINT8_ARRAY(interface_class, 2259 struct usb_redir_interface_info_header, 32), 2260 VMSTATE_UINT8_ARRAY(interface_subclass, 2261 struct usb_redir_interface_info_header, 32), 2262 VMSTATE_UINT8_ARRAY(interface_protocol, 2263 struct usb_redir_interface_info_header, 32), 2264 VMSTATE_END_OF_LIST() 2265 } 2266 }; 2267 2268 2269 /* And finally the USBRedirDevice vmstate itself */ 2270 static const VMStateDescription usbredir_vmstate = { 2271 .name = "usb-redir", 2272 .version_id = 1, 2273 .minimum_version_id = 1, 2274 .pre_save = usbredir_pre_save, 2275 .post_load = usbredir_post_load, 2276 .fields = (VMStateField[]) { 2277 VMSTATE_USB_DEVICE(dev, USBRedirDevice), 2278 VMSTATE_TIMER(attach_timer, USBRedirDevice), 2279 { 2280 .name = "parser", 2281 .version_id = 0, 2282 .field_exists = NULL, 2283 .size = 0, 2284 .info = &usbredir_parser_vmstate_info, 2285 .flags = VMS_SINGLE, 2286 .offset = 0, 2287 }, 2288 VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1, 2289 usbredir_ep_vmstate, struct endp_data), 2290 VMSTATE_STRUCT(cancelled, USBRedirDevice, 1, 2291 usbredir_ep_packet_id_queue_vmstate, 2292 struct PacketIdQueue), 2293 VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1, 2294 usbredir_ep_packet_id_queue_vmstate, 2295 struct PacketIdQueue), 2296 VMSTATE_STRUCT(device_info, USBRedirDevice, 1, 2297 usbredir_device_info_vmstate, 2298 struct usb_redir_device_connect_header), 2299 VMSTATE_STRUCT(interface_info, USBRedirDevice, 1, 2300 usbredir_interface_info_vmstate, 2301 struct usb_redir_interface_info_header), 2302 VMSTATE_END_OF_LIST() 2303 } 2304 }; 2305 2306 static Property usbredir_properties[] = { 2307 DEFINE_PROP_CHR("chardev", USBRedirDevice, cs), 2308 DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning), 2309 DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str), 2310 DEFINE_PROP_INT32("bootindex", USBRedirDevice, bootindex, -1), 2311 DEFINE_PROP_END_OF_LIST(), 2312 }; 2313 2314 static void usbredir_class_initfn(ObjectClass *klass, void *data) 2315 { 2316 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 2317 DeviceClass *dc = DEVICE_CLASS(klass); 2318 2319 uc->init = usbredir_initfn; 2320 uc->product_desc = "USB Redirection Device"; 2321 uc->handle_destroy = usbredir_handle_destroy; 2322 uc->cancel_packet = usbredir_cancel_packet; 2323 uc->handle_reset = usbredir_handle_reset; 2324 uc->handle_data = usbredir_handle_data; 2325 uc->handle_control = usbredir_handle_control; 2326 uc->flush_ep_queue = usbredir_flush_ep_queue; 2327 uc->ep_stopped = usbredir_ep_stopped; 2328 dc->vmsd = &usbredir_vmstate; 2329 dc->props = usbredir_properties; 2330 } 2331 2332 static const TypeInfo usbredir_dev_info = { 2333 .name = "usb-redir", 2334 .parent = TYPE_USB_DEVICE, 2335 .instance_size = sizeof(USBRedirDevice), 2336 .class_init = usbredir_class_initfn, 2337 }; 2338 2339 static void usbredir_register_types(void) 2340 { 2341 type_register_static(&usbredir_dev_info); 2342 } 2343 2344 type_init(usbredir_register_types) 2345