1 /* 2 * USB redirector usb-guest 3 * 4 * Copyright (c) 2011-2012 Red Hat, Inc. 5 * 6 * Red Hat Authors: 7 * Hans de Goede <hdegoede@redhat.com> 8 * 9 * Permission is hereby granted, free of charge, to any person obtaining a copy 10 * of this software and associated documentation files (the "Software"), to deal 11 * in the Software without restriction, including without limitation the rights 12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 13 * copies of the Software, and to permit persons to whom the Software is 14 * furnished to do so, subject to the following conditions: 15 * 16 * The above copyright notice and this permission notice shall be included in 17 * all copies or substantial portions of the Software. 18 * 19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 25 * THE SOFTWARE. 26 */ 27 28 #include "qemu-common.h" 29 #include "qemu/timer.h" 30 #include "monitor/monitor.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/iov.h" 33 #include "char/char.h" 34 35 #include <dirent.h> 36 #include <sys/ioctl.h> 37 #include <signal.h> 38 #include <usbredirparser.h> 39 #include <usbredirfilter.h> 40 41 #include "hw/usb.h" 42 43 #define MAX_ENDPOINTS 32 44 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */ 45 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f)) 46 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f)) 47 #define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \ 48 ((usb_ep)->nr | 0x10) : ((usb_ep)->nr)) 49 #define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \ 50 ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \ 51 (i) & 0x0f)) 52 53 typedef struct USBRedirDevice USBRedirDevice; 54 55 /* Struct to hold buffered packets */ 56 struct buf_packet { 57 uint8_t *data; 58 void *free_on_destroy; 59 uint16_t len; 60 uint16_t offset; 61 uint8_t status; 62 QTAILQ_ENTRY(buf_packet)next; 63 }; 64 65 struct endp_data { 66 USBRedirDevice *dev; 67 uint8_t type; 68 uint8_t interval; 69 uint8_t interface; /* bInterfaceNumber this ep belongs to */ 70 uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */ 71 uint8_t iso_started; 72 uint8_t iso_error; /* For reporting iso errors to the HC */ 73 uint8_t interrupt_started; 74 uint8_t interrupt_error; 75 uint8_t bulk_receiving_enabled; 76 uint8_t bulk_receiving_started; 77 uint8_t bufpq_prefilled; 78 uint8_t bufpq_dropping_packets; 79 QTAILQ_HEAD(, buf_packet) bufpq; 80 int32_t bufpq_size; 81 int32_t bufpq_target_size; 82 USBPacket *pending_async_packet; 83 }; 84 85 struct PacketIdQueueEntry { 86 uint64_t id; 87 QTAILQ_ENTRY(PacketIdQueueEntry)next; 88 }; 89 90 struct PacketIdQueue { 91 USBRedirDevice *dev; 92 const char *name; 93 QTAILQ_HEAD(, PacketIdQueueEntry) head; 94 int size; 95 }; 96 97 struct USBRedirDevice { 98 USBDevice dev; 99 /* Properties */ 100 CharDriverState *cs; 101 uint8_t debug; 102 char *filter_str; 103 int32_t bootindex; 104 /* Data passed from chardev the fd_read cb to the usbredirparser read cb */ 105 const uint8_t *read_buf; 106 int read_buf_size; 107 /* For async handling of close */ 108 QEMUBH *chardev_close_bh; 109 /* To delay the usb attach in case of quick chardev close + open */ 110 QEMUTimer *attach_timer; 111 int64_t next_attach_time; 112 struct usbredirparser *parser; 113 struct endp_data endpoint[MAX_ENDPOINTS]; 114 struct PacketIdQueue cancelled; 115 struct PacketIdQueue already_in_flight; 116 void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t); 117 /* Data for device filtering */ 118 struct usb_redir_device_connect_header device_info; 119 struct usb_redir_interface_info_header interface_info; 120 struct usbredirfilter_rule *filter_rules; 121 int filter_rules_count; 122 int compatible_speedmask; 123 }; 124 125 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h); 126 static void usbredir_device_connect(void *priv, 127 struct usb_redir_device_connect_header *device_connect); 128 static void usbredir_device_disconnect(void *priv); 129 static void usbredir_interface_info(void *priv, 130 struct usb_redir_interface_info_header *interface_info); 131 static void usbredir_ep_info(void *priv, 132 struct usb_redir_ep_info_header *ep_info); 133 static void usbredir_configuration_status(void *priv, uint64_t id, 134 struct usb_redir_configuration_status_header *configuration_status); 135 static void usbredir_alt_setting_status(void *priv, uint64_t id, 136 struct usb_redir_alt_setting_status_header *alt_setting_status); 137 static void usbredir_iso_stream_status(void *priv, uint64_t id, 138 struct usb_redir_iso_stream_status_header *iso_stream_status); 139 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id, 140 struct usb_redir_interrupt_receiving_status_header 141 *interrupt_receiving_status); 142 static void usbredir_bulk_streams_status(void *priv, uint64_t id, 143 struct usb_redir_bulk_streams_status_header *bulk_streams_status); 144 static void usbredir_bulk_receiving_status(void *priv, uint64_t id, 145 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status); 146 static void usbredir_control_packet(void *priv, uint64_t id, 147 struct usb_redir_control_packet_header *control_packet, 148 uint8_t *data, int data_len); 149 static void usbredir_bulk_packet(void *priv, uint64_t id, 150 struct usb_redir_bulk_packet_header *bulk_packet, 151 uint8_t *data, int data_len); 152 static void usbredir_iso_packet(void *priv, uint64_t id, 153 struct usb_redir_iso_packet_header *iso_packet, 154 uint8_t *data, int data_len); 155 static void usbredir_interrupt_packet(void *priv, uint64_t id, 156 struct usb_redir_interrupt_packet_header *interrupt_header, 157 uint8_t *data, int data_len); 158 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id, 159 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet, 160 uint8_t *data, int data_len); 161 162 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p, 163 int status); 164 165 #define VERSION "qemu usb-redir guest " QEMU_VERSION 166 167 /* 168 * Logging stuff 169 */ 170 171 #define ERROR(...) \ 172 do { \ 173 if (dev->debug >= usbredirparser_error) { \ 174 error_report("usb-redir error: " __VA_ARGS__); \ 175 } \ 176 } while (0) 177 #define WARNING(...) \ 178 do { \ 179 if (dev->debug >= usbredirparser_warning) { \ 180 error_report("usb-redir warning: " __VA_ARGS__); \ 181 } \ 182 } while (0) 183 #define INFO(...) \ 184 do { \ 185 if (dev->debug >= usbredirparser_info) { \ 186 error_report("usb-redir: " __VA_ARGS__); \ 187 } \ 188 } while (0) 189 #define DPRINTF(...) \ 190 do { \ 191 if (dev->debug >= usbredirparser_debug) { \ 192 error_report("usb-redir: " __VA_ARGS__); \ 193 } \ 194 } while (0) 195 #define DPRINTF2(...) \ 196 do { \ 197 if (dev->debug >= usbredirparser_debug_data) { \ 198 error_report("usb-redir: " __VA_ARGS__); \ 199 } \ 200 } while (0) 201 202 static void usbredir_log(void *priv, int level, const char *msg) 203 { 204 USBRedirDevice *dev = priv; 205 206 if (dev->debug < level) { 207 return; 208 } 209 210 error_report("%s", msg); 211 } 212 213 static void usbredir_log_data(USBRedirDevice *dev, const char *desc, 214 const uint8_t *data, int len) 215 { 216 int i, j, n; 217 218 if (dev->debug < usbredirparser_debug_data) { 219 return; 220 } 221 222 for (i = 0; i < len; i += j) { 223 char buf[128]; 224 225 n = sprintf(buf, "%s", desc); 226 for (j = 0; j < 8 && i + j < len; j++) { 227 n += sprintf(buf + n, " %02X", data[i + j]); 228 } 229 error_report("%s", buf); 230 } 231 } 232 233 /* 234 * usbredirparser io functions 235 */ 236 237 static int usbredir_read(void *priv, uint8_t *data, int count) 238 { 239 USBRedirDevice *dev = priv; 240 241 if (dev->read_buf_size < count) { 242 count = dev->read_buf_size; 243 } 244 245 memcpy(data, dev->read_buf, count); 246 247 dev->read_buf_size -= count; 248 if (dev->read_buf_size) { 249 dev->read_buf += count; 250 } else { 251 dev->read_buf = NULL; 252 } 253 254 return count; 255 } 256 257 static int usbredir_write(void *priv, uint8_t *data, int count) 258 { 259 USBRedirDevice *dev = priv; 260 261 if (!dev->cs->opened) { 262 return 0; 263 } 264 265 /* Don't send new data to the chardev until our state is fully synced */ 266 if (!runstate_check(RUN_STATE_RUNNING)) { 267 return 0; 268 } 269 270 return qemu_chr_fe_write(dev->cs, data, count); 271 } 272 273 /* 274 * Cancelled and buffered packets helpers 275 */ 276 277 static void packet_id_queue_init(struct PacketIdQueue *q, 278 USBRedirDevice *dev, const char *name) 279 { 280 q->dev = dev; 281 q->name = name; 282 QTAILQ_INIT(&q->head); 283 q->size = 0; 284 } 285 286 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id) 287 { 288 USBRedirDevice *dev = q->dev; 289 struct PacketIdQueueEntry *e; 290 291 DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name); 292 293 e = g_malloc0(sizeof(struct PacketIdQueueEntry)); 294 e->id = id; 295 QTAILQ_INSERT_TAIL(&q->head, e, next); 296 q->size++; 297 } 298 299 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id) 300 { 301 USBRedirDevice *dev = q->dev; 302 struct PacketIdQueueEntry *e; 303 304 QTAILQ_FOREACH(e, &q->head, next) { 305 if (e->id == id) { 306 DPRINTF("removing packet id %"PRIu64" from %s queue\n", 307 id, q->name); 308 QTAILQ_REMOVE(&q->head, e, next); 309 q->size--; 310 g_free(e); 311 return 1; 312 } 313 } 314 return 0; 315 } 316 317 static void packet_id_queue_empty(struct PacketIdQueue *q) 318 { 319 USBRedirDevice *dev = q->dev; 320 struct PacketIdQueueEntry *e, *next_e; 321 322 DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name); 323 324 QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) { 325 QTAILQ_REMOVE(&q->head, e, next); 326 g_free(e); 327 } 328 q->size = 0; 329 } 330 331 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p) 332 { 333 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 334 int i = USBEP2I(p->ep); 335 336 if (p->combined) { 337 usb_combined_packet_cancel(udev, p); 338 return; 339 } 340 341 if (dev->endpoint[i].pending_async_packet) { 342 assert(dev->endpoint[i].pending_async_packet == p); 343 dev->endpoint[i].pending_async_packet = NULL; 344 return; 345 } 346 347 packet_id_queue_add(&dev->cancelled, p->id); 348 usbredirparser_send_cancel_data_packet(dev->parser, p->id); 349 usbredirparser_do_write(dev->parser); 350 } 351 352 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id) 353 { 354 if (!dev->dev.attached) { 355 return 1; /* Treat everything as cancelled after a disconnect */ 356 } 357 return packet_id_queue_remove(&dev->cancelled, id); 358 } 359 360 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev, 361 struct USBEndpoint *ep) 362 { 363 static USBPacket *p; 364 365 /* async handled packets for bulk receiving eps do not count as inflight */ 366 if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) { 367 return; 368 } 369 370 QTAILQ_FOREACH(p, &ep->queue, queue) { 371 /* Skip combined packets, except for the first */ 372 if (p->combined && p != p->combined->first) { 373 continue; 374 } 375 if (p->state == USB_PACKET_ASYNC) { 376 packet_id_queue_add(&dev->already_in_flight, p->id); 377 } 378 } 379 } 380 381 static void usbredir_fill_already_in_flight(USBRedirDevice *dev) 382 { 383 int ep; 384 struct USBDevice *udev = &dev->dev; 385 386 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl); 387 388 for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) { 389 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]); 390 usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]); 391 } 392 } 393 394 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id) 395 { 396 return packet_id_queue_remove(&dev->already_in_flight, id); 397 } 398 399 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev, 400 uint8_t ep, uint64_t id) 401 { 402 USBPacket *p; 403 404 if (usbredir_is_cancelled(dev, id)) { 405 return NULL; 406 } 407 408 p = usb_ep_find_packet_by_id(&dev->dev, 409 (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT, 410 ep & 0x0f, id); 411 if (p == NULL) { 412 ERROR("could not find packet with id %"PRIu64"\n", id); 413 } 414 return p; 415 } 416 417 static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, 418 uint8_t status, uint8_t ep, void *free_on_destroy) 419 { 420 struct buf_packet *bufp; 421 422 if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets && 423 dev->endpoint[EP2I(ep)].bufpq_size > 424 2 * dev->endpoint[EP2I(ep)].bufpq_target_size) { 425 DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep); 426 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1; 427 } 428 /* Since we're interupting the stream anyways, drop enough packets to get 429 back to our target buffer size */ 430 if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) { 431 if (dev->endpoint[EP2I(ep)].bufpq_size > 432 dev->endpoint[EP2I(ep)].bufpq_target_size) { 433 free(data); 434 return; 435 } 436 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 437 } 438 439 bufp = g_malloc(sizeof(struct buf_packet)); 440 bufp->data = data; 441 bufp->len = len; 442 bufp->offset = 0; 443 bufp->status = status; 444 bufp->free_on_destroy = free_on_destroy; 445 QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); 446 dev->endpoint[EP2I(ep)].bufpq_size++; 447 } 448 449 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp, 450 uint8_t ep) 451 { 452 QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); 453 dev->endpoint[EP2I(ep)].bufpq_size--; 454 free(bufp->free_on_destroy); 455 g_free(bufp); 456 } 457 458 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep) 459 { 460 struct buf_packet *buf, *buf_next; 461 462 QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) { 463 bufp_free(dev, buf, ep); 464 } 465 } 466 467 /* 468 * USBDevice callbacks 469 */ 470 471 static void usbredir_handle_reset(USBDevice *udev) 472 { 473 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 474 475 DPRINTF("reset device\n"); 476 usbredirparser_send_reset(dev->parser); 477 usbredirparser_do_write(dev->parser); 478 } 479 480 static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p, 481 uint8_t ep) 482 { 483 int status, len; 484 if (!dev->endpoint[EP2I(ep)].iso_started && 485 !dev->endpoint[EP2I(ep)].iso_error) { 486 struct usb_redir_start_iso_stream_header start_iso = { 487 .endpoint = ep, 488 }; 489 int pkts_per_sec; 490 491 if (dev->dev.speed == USB_SPEED_HIGH) { 492 pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval; 493 } else { 494 pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval; 495 } 496 /* Testing has shown that we need circa 60 ms buffer */ 497 dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000; 498 499 /* Aim for approx 100 interrupts / second on the client to 500 balance latency and interrupt load */ 501 start_iso.pkts_per_urb = pkts_per_sec / 100; 502 if (start_iso.pkts_per_urb < 1) { 503 start_iso.pkts_per_urb = 1; 504 } else if (start_iso.pkts_per_urb > 32) { 505 start_iso.pkts_per_urb = 32; 506 } 507 508 start_iso.no_urbs = (dev->endpoint[EP2I(ep)].bufpq_target_size + 509 start_iso.pkts_per_urb - 1) / 510 start_iso.pkts_per_urb; 511 /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest 512 as overflow buffer. Also see the usbredir protocol documentation */ 513 if (!(ep & USB_DIR_IN)) { 514 start_iso.no_urbs *= 2; 515 } 516 if (start_iso.no_urbs > 16) { 517 start_iso.no_urbs = 16; 518 } 519 520 /* No id, we look at the ep when receiving a status back */ 521 usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso); 522 usbredirparser_do_write(dev->parser); 523 DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n", 524 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep); 525 dev->endpoint[EP2I(ep)].iso_started = 1; 526 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0; 527 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 528 } 529 530 if (ep & USB_DIR_IN) { 531 struct buf_packet *isop; 532 533 if (dev->endpoint[EP2I(ep)].iso_started && 534 !dev->endpoint[EP2I(ep)].bufpq_prefilled) { 535 if (dev->endpoint[EP2I(ep)].bufpq_size < 536 dev->endpoint[EP2I(ep)].bufpq_target_size) { 537 return; 538 } 539 dev->endpoint[EP2I(ep)].bufpq_prefilled = 1; 540 } 541 542 isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq); 543 if (isop == NULL) { 544 DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n", 545 ep, dev->endpoint[EP2I(ep)].iso_error); 546 /* Re-fill the buffer */ 547 dev->endpoint[EP2I(ep)].bufpq_prefilled = 0; 548 /* Check iso_error for stream errors, otherwise its an underrun */ 549 status = dev->endpoint[EP2I(ep)].iso_error; 550 dev->endpoint[EP2I(ep)].iso_error = 0; 551 p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS; 552 return; 553 } 554 DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep, 555 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size); 556 557 status = isop->status; 558 len = isop->len; 559 if (len > p->iov.size) { 560 ERROR("received iso data is larger then packet ep %02X (%d > %d)\n", 561 ep, len, (int)p->iov.size); 562 len = p->iov.size; 563 status = usb_redir_babble; 564 } 565 usb_packet_copy(p, isop->data, len); 566 bufp_free(dev, isop, ep); 567 usbredir_handle_status(dev, p, status); 568 } else { 569 /* If the stream was not started because of a pending error don't 570 send the packet to the usb-host */ 571 if (dev->endpoint[EP2I(ep)].iso_started) { 572 struct usb_redir_iso_packet_header iso_packet = { 573 .endpoint = ep, 574 .length = p->iov.size 575 }; 576 uint8_t buf[p->iov.size]; 577 /* No id, we look at the ep when receiving a status back */ 578 usb_packet_copy(p, buf, p->iov.size); 579 usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet, 580 buf, p->iov.size); 581 usbredirparser_do_write(dev->parser); 582 } 583 status = dev->endpoint[EP2I(ep)].iso_error; 584 dev->endpoint[EP2I(ep)].iso_error = 0; 585 DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status, 586 p->iov.size); 587 usbredir_handle_status(dev, p, status); 588 } 589 } 590 591 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep) 592 { 593 struct usb_redir_stop_iso_stream_header stop_iso_stream = { 594 .endpoint = ep 595 }; 596 if (dev->endpoint[EP2I(ep)].iso_started) { 597 usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream); 598 DPRINTF("iso stream stopped ep %02X\n", ep); 599 dev->endpoint[EP2I(ep)].iso_started = 0; 600 } 601 dev->endpoint[EP2I(ep)].iso_error = 0; 602 usbredir_free_bufpq(dev, ep); 603 } 604 605 /* 606 * The usb-host may poll the endpoint faster then our guest, resulting in lots 607 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine 608 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows. 609 */ 610 static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev, 611 struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep) 612 { 613 usb_packet_copy(p, bulkp->data + bulkp->offset, count); 614 bulkp->offset += count; 615 if (bulkp->offset == bulkp->len) { 616 /* Store status in the last packet with data from this bulkp */ 617 usbredir_handle_status(dev, p, bulkp->status); 618 bufp_free(dev, bulkp, ep); 619 } 620 } 621 622 static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev, 623 USBPacket *p, uint8_t ep) 624 { 625 struct buf_packet *bulkp; 626 int count; 627 628 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) && 629 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) { 630 count = bulkp->len - bulkp->offset; 631 if (count > (p->iov.size - p->actual_length)) { 632 count = p->iov.size - p->actual_length; 633 } 634 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep); 635 } 636 } 637 638 static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev, 639 USBPacket *p, uint8_t ep) 640 { 641 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size; 642 uint8_t header[2] = { 0, 0 }; 643 struct buf_packet *bulkp; 644 int count; 645 646 while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) && 647 p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) { 648 if (bulkp->len < 2) { 649 WARNING("malformed ftdi bulk in packet\n"); 650 bufp_free(dev, bulkp, ep); 651 continue; 652 } 653 654 if ((p->actual_length % maxp) == 0) { 655 usb_packet_copy(p, bulkp->data, 2); 656 memcpy(header, bulkp->data, 2); 657 } else { 658 if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) { 659 break; /* Different header, add to next packet */ 660 } 661 } 662 663 if (bulkp->offset == 0) { 664 bulkp->offset = 2; /* Skip header */ 665 } 666 count = bulkp->len - bulkp->offset; 667 /* Must repeat the header at maxp interval */ 668 if (count > (maxp - (p->actual_length % maxp))) { 669 count = maxp - (p->actual_length % maxp); 670 } 671 usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep); 672 } 673 } 674 675 static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev, 676 USBPacket *p, uint8_t ep) 677 { 678 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 679 dev->buffered_bulk_in_complete(dev, p, ep); 680 DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n", 681 ep, p->status, p->actual_length, p->id); 682 } 683 684 static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev, 685 USBPacket *p, uint8_t ep) 686 { 687 /* Input bulk endpoint, buffered packet input */ 688 if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) { 689 int bpt; 690 struct usb_redir_start_bulk_receiving_header start = { 691 .endpoint = ep, 692 .stream_id = 0, 693 .no_transfers = 5, 694 }; 695 /* Round bytes_per_transfer up to a multiple of max_packet_size */ 696 bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1; 697 bpt /= dev->endpoint[EP2I(ep)].max_packet_size; 698 bpt *= dev->endpoint[EP2I(ep)].max_packet_size; 699 start.bytes_per_transfer = bpt; 700 /* No id, we look at the ep when receiving a status back */ 701 usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start); 702 usbredirparser_do_write(dev->parser); 703 DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n", 704 start.bytes_per_transfer, start.no_transfers, ep); 705 dev->endpoint[EP2I(ep)].bulk_receiving_started = 1; 706 /* We don't really want to drop bulk packets ever, but 707 having some upper limit to how much we buffer is good. */ 708 dev->endpoint[EP2I(ep)].bufpq_target_size = 5000; 709 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 710 } 711 712 if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) { 713 DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep); 714 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL); 715 dev->endpoint[EP2I(ep)].pending_async_packet = p; 716 p->status = USB_RET_ASYNC; 717 return; 718 } 719 usbredir_buffered_bulk_in_complete(dev, p, ep); 720 } 721 722 static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep) 723 { 724 struct usb_redir_stop_bulk_receiving_header stop_bulk = { 725 .endpoint = ep, 726 .stream_id = 0, 727 }; 728 if (dev->endpoint[EP2I(ep)].bulk_receiving_started) { 729 usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk); 730 DPRINTF("bulk receiving stopped ep %02X\n", ep); 731 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0; 732 } 733 usbredir_free_bufpq(dev, ep); 734 } 735 736 static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p, 737 uint8_t ep) 738 { 739 struct usb_redir_bulk_packet_header bulk_packet; 740 size_t size = usb_packet_size(p); 741 const int maxp = dev->endpoint[EP2I(ep)].max_packet_size; 742 743 if (usbredir_already_in_flight(dev, p->id)) { 744 p->status = USB_RET_ASYNC; 745 return; 746 } 747 748 if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) { 749 if (size != 0 && (size % maxp) == 0) { 750 usbredir_handle_buffered_bulk_in_data(dev, p, ep); 751 return; 752 } 753 WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep); 754 assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL); 755 usbredir_stop_bulk_receiving(dev, ep); 756 dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0; 757 } 758 759 DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, size, p->id); 760 761 bulk_packet.endpoint = ep; 762 bulk_packet.length = size; 763 bulk_packet.stream_id = 0; 764 bulk_packet.length_high = size >> 16; 765 assert(bulk_packet.length_high == 0 || 766 usbredirparser_peer_has_cap(dev->parser, 767 usb_redir_cap_32bits_bulk_length)); 768 769 if (ep & USB_DIR_IN) { 770 usbredirparser_send_bulk_packet(dev->parser, p->id, 771 &bulk_packet, NULL, 0); 772 } else { 773 uint8_t buf[size]; 774 usb_packet_copy(p, buf, size); 775 usbredir_log_data(dev, "bulk data out:", buf, size); 776 usbredirparser_send_bulk_packet(dev->parser, p->id, 777 &bulk_packet, buf, size); 778 } 779 usbredirparser_do_write(dev->parser); 780 p->status = USB_RET_ASYNC; 781 } 782 783 static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev, 784 USBPacket *p, uint8_t ep) 785 { 786 /* Input interrupt endpoint, buffered packet input */ 787 struct buf_packet *intp; 788 int status, len; 789 790 if (!dev->endpoint[EP2I(ep)].interrupt_started && 791 !dev->endpoint[EP2I(ep)].interrupt_error) { 792 struct usb_redir_start_interrupt_receiving_header start_int = { 793 .endpoint = ep, 794 }; 795 /* No id, we look at the ep when receiving a status back */ 796 usbredirparser_send_start_interrupt_receiving(dev->parser, 0, 797 &start_int); 798 usbredirparser_do_write(dev->parser); 799 DPRINTF("interrupt recv started ep %02X\n", ep); 800 dev->endpoint[EP2I(ep)].interrupt_started = 1; 801 /* We don't really want to drop interrupt packets ever, but 802 having some upper limit to how much we buffer is good. */ 803 dev->endpoint[EP2I(ep)].bufpq_target_size = 1000; 804 dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; 805 } 806 807 intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq); 808 if (intp == NULL) { 809 DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep); 810 /* Check interrupt_error for stream errors */ 811 status = dev->endpoint[EP2I(ep)].interrupt_error; 812 dev->endpoint[EP2I(ep)].interrupt_error = 0; 813 if (status) { 814 usbredir_handle_status(dev, p, status); 815 } else { 816 p->status = USB_RET_NAK; 817 } 818 return; 819 } 820 DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep, 821 intp->status, intp->len); 822 823 status = intp->status; 824 len = intp->len; 825 if (len > p->iov.size) { 826 ERROR("received int data is larger then packet ep %02X\n", ep); 827 len = p->iov.size; 828 status = usb_redir_babble; 829 } 830 usb_packet_copy(p, intp->data, len); 831 bufp_free(dev, intp, ep); 832 usbredir_handle_status(dev, p, status); 833 } 834 835 /* 836 * Handle interrupt out data, the usbredir protocol expects us to do this 837 * async, so that it can report back a completion status. But guests will 838 * expect immediate completion for an interrupt endpoint, and handling this 839 * async causes migration issues. So we report success directly, counting 840 * on the fact that output interrupt packets normally always succeed. 841 */ 842 static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev, 843 USBPacket *p, uint8_t ep) 844 { 845 struct usb_redir_interrupt_packet_header interrupt_packet; 846 uint8_t buf[p->iov.size]; 847 848 DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep, 849 p->iov.size, p->id); 850 851 interrupt_packet.endpoint = ep; 852 interrupt_packet.length = p->iov.size; 853 854 usb_packet_copy(p, buf, p->iov.size); 855 usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size); 856 usbredirparser_send_interrupt_packet(dev->parser, p->id, 857 &interrupt_packet, buf, p->iov.size); 858 usbredirparser_do_write(dev->parser); 859 } 860 861 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev, 862 uint8_t ep) 863 { 864 struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = { 865 .endpoint = ep 866 }; 867 if (dev->endpoint[EP2I(ep)].interrupt_started) { 868 usbredirparser_send_stop_interrupt_receiving(dev->parser, 0, 869 &stop_interrupt_recv); 870 DPRINTF("interrupt recv stopped ep %02X\n", ep); 871 dev->endpoint[EP2I(ep)].interrupt_started = 0; 872 } 873 dev->endpoint[EP2I(ep)].interrupt_error = 0; 874 usbredir_free_bufpq(dev, ep); 875 } 876 877 static void usbredir_handle_data(USBDevice *udev, USBPacket *p) 878 { 879 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 880 uint8_t ep; 881 882 ep = p->ep->nr; 883 if (p->pid == USB_TOKEN_IN) { 884 ep |= USB_DIR_IN; 885 } 886 887 switch (dev->endpoint[EP2I(ep)].type) { 888 case USB_ENDPOINT_XFER_CONTROL: 889 ERROR("handle_data called for control transfer on ep %02X\n", ep); 890 p->status = USB_RET_NAK; 891 break; 892 case USB_ENDPOINT_XFER_BULK: 893 if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN && 894 p->ep->pipeline) { 895 p->status = USB_RET_ADD_TO_QUEUE; 896 break; 897 } 898 usbredir_handle_bulk_data(dev, p, ep); 899 break; 900 case USB_ENDPOINT_XFER_ISOC: 901 usbredir_handle_iso_data(dev, p, ep); 902 break; 903 case USB_ENDPOINT_XFER_INT: 904 if (ep & USB_DIR_IN) { 905 usbredir_handle_interrupt_in_data(dev, p, ep); 906 } else { 907 usbredir_handle_interrupt_out_data(dev, p, ep); 908 } 909 break; 910 default: 911 ERROR("handle_data ep %02X has unknown type %d\n", ep, 912 dev->endpoint[EP2I(ep)].type); 913 p->status = USB_RET_NAK; 914 } 915 } 916 917 static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep) 918 { 919 if (ep->pid == USB_TOKEN_IN && ep->pipeline) { 920 usb_ep_combine_input_packets(ep); 921 } 922 } 923 924 static void usbredir_stop_ep(USBRedirDevice *dev, int i) 925 { 926 uint8_t ep = I2EP(i); 927 928 switch (dev->endpoint[i].type) { 929 case USB_ENDPOINT_XFER_BULK: 930 if (ep & USB_DIR_IN) { 931 usbredir_stop_bulk_receiving(dev, ep); 932 } 933 break; 934 case USB_ENDPOINT_XFER_ISOC: 935 usbredir_stop_iso_stream(dev, ep); 936 break; 937 case USB_ENDPOINT_XFER_INT: 938 if (ep & USB_DIR_IN) { 939 usbredir_stop_interrupt_receiving(dev, ep); 940 } 941 break; 942 } 943 usbredir_free_bufpq(dev, ep); 944 } 945 946 static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep) 947 { 948 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 949 950 usbredir_stop_ep(dev, USBEP2I(uep)); 951 usbredirparser_do_write(dev->parser); 952 } 953 954 static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p, 955 int config) 956 { 957 struct usb_redir_set_configuration_header set_config; 958 int i; 959 960 DPRINTF("set config %d id %"PRIu64"\n", config, p->id); 961 962 for (i = 0; i < MAX_ENDPOINTS; i++) { 963 usbredir_stop_ep(dev, i); 964 } 965 966 set_config.configuration = config; 967 usbredirparser_send_set_configuration(dev->parser, p->id, &set_config); 968 usbredirparser_do_write(dev->parser); 969 p->status = USB_RET_ASYNC; 970 } 971 972 static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p) 973 { 974 DPRINTF("get config id %"PRIu64"\n", p->id); 975 976 usbredirparser_send_get_configuration(dev->parser, p->id); 977 usbredirparser_do_write(dev->parser); 978 p->status = USB_RET_ASYNC; 979 } 980 981 static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p, 982 int interface, int alt) 983 { 984 struct usb_redir_set_alt_setting_header set_alt; 985 int i; 986 987 DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id); 988 989 for (i = 0; i < MAX_ENDPOINTS; i++) { 990 if (dev->endpoint[i].interface == interface) { 991 usbredir_stop_ep(dev, i); 992 } 993 } 994 995 set_alt.interface = interface; 996 set_alt.alt = alt; 997 usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt); 998 usbredirparser_do_write(dev->parser); 999 p->status = USB_RET_ASYNC; 1000 } 1001 1002 static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p, 1003 int interface) 1004 { 1005 struct usb_redir_get_alt_setting_header get_alt; 1006 1007 DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id); 1008 1009 get_alt.interface = interface; 1010 usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt); 1011 usbredirparser_do_write(dev->parser); 1012 p->status = USB_RET_ASYNC; 1013 } 1014 1015 static void usbredir_handle_control(USBDevice *udev, USBPacket *p, 1016 int request, int value, int index, int length, uint8_t *data) 1017 { 1018 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1019 struct usb_redir_control_packet_header control_packet; 1020 1021 if (usbredir_already_in_flight(dev, p->id)) { 1022 p->status = USB_RET_ASYNC; 1023 return; 1024 } 1025 1026 /* Special cases for certain standard device requests */ 1027 switch (request) { 1028 case DeviceOutRequest | USB_REQ_SET_ADDRESS: 1029 DPRINTF("set address %d\n", value); 1030 dev->dev.addr = value; 1031 return; 1032 case DeviceOutRequest | USB_REQ_SET_CONFIGURATION: 1033 usbredir_set_config(dev, p, value & 0xff); 1034 return; 1035 case DeviceRequest | USB_REQ_GET_CONFIGURATION: 1036 usbredir_get_config(dev, p); 1037 return; 1038 case InterfaceOutRequest | USB_REQ_SET_INTERFACE: 1039 usbredir_set_interface(dev, p, index, value); 1040 return; 1041 case InterfaceRequest | USB_REQ_GET_INTERFACE: 1042 usbredir_get_interface(dev, p, index); 1043 return; 1044 } 1045 1046 /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */ 1047 DPRINTF( 1048 "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n", 1049 request >> 8, request & 0xff, value, index, length, p->id); 1050 1051 control_packet.request = request & 0xFF; 1052 control_packet.requesttype = request >> 8; 1053 control_packet.endpoint = control_packet.requesttype & USB_DIR_IN; 1054 control_packet.value = value; 1055 control_packet.index = index; 1056 control_packet.length = length; 1057 1058 if (control_packet.requesttype & USB_DIR_IN) { 1059 usbredirparser_send_control_packet(dev->parser, p->id, 1060 &control_packet, NULL, 0); 1061 } else { 1062 usbredir_log_data(dev, "ctrl data out:", data, length); 1063 usbredirparser_send_control_packet(dev->parser, p->id, 1064 &control_packet, data, length); 1065 } 1066 usbredirparser_do_write(dev->parser); 1067 p->status = USB_RET_ASYNC; 1068 } 1069 1070 /* 1071 * Close events can be triggered by usbredirparser_do_write which gets called 1072 * from within the USBDevice data / control packet callbacks and doing a 1073 * usb_detach from within these callbacks is not a good idea. 1074 * 1075 * So we use a bh handler to take care of close events. 1076 */ 1077 static void usbredir_chardev_close_bh(void *opaque) 1078 { 1079 USBRedirDevice *dev = opaque; 1080 1081 usbredir_device_disconnect(dev); 1082 1083 if (dev->parser) { 1084 DPRINTF("destroying usbredirparser\n"); 1085 usbredirparser_destroy(dev->parser); 1086 dev->parser = NULL; 1087 } 1088 } 1089 1090 static void usbredir_create_parser(USBRedirDevice *dev) 1091 { 1092 uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, }; 1093 int flags = 0; 1094 1095 DPRINTF("creating usbredirparser\n"); 1096 1097 dev->parser = qemu_oom_check(usbredirparser_create()); 1098 dev->parser->priv = dev; 1099 dev->parser->log_func = usbredir_log; 1100 dev->parser->read_func = usbredir_read; 1101 dev->parser->write_func = usbredir_write; 1102 dev->parser->hello_func = usbredir_hello; 1103 dev->parser->device_connect_func = usbredir_device_connect; 1104 dev->parser->device_disconnect_func = usbredir_device_disconnect; 1105 dev->parser->interface_info_func = usbredir_interface_info; 1106 dev->parser->ep_info_func = usbredir_ep_info; 1107 dev->parser->configuration_status_func = usbredir_configuration_status; 1108 dev->parser->alt_setting_status_func = usbredir_alt_setting_status; 1109 dev->parser->iso_stream_status_func = usbredir_iso_stream_status; 1110 dev->parser->interrupt_receiving_status_func = 1111 usbredir_interrupt_receiving_status; 1112 dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status; 1113 dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status; 1114 dev->parser->control_packet_func = usbredir_control_packet; 1115 dev->parser->bulk_packet_func = usbredir_bulk_packet; 1116 dev->parser->iso_packet_func = usbredir_iso_packet; 1117 dev->parser->interrupt_packet_func = usbredir_interrupt_packet; 1118 dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet; 1119 dev->read_buf = NULL; 1120 dev->read_buf_size = 0; 1121 1122 usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version); 1123 usbredirparser_caps_set_cap(caps, usb_redir_cap_filter); 1124 usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size); 1125 usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids); 1126 usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length); 1127 usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving); 1128 1129 if (runstate_check(RUN_STATE_INMIGRATE)) { 1130 flags |= usbredirparser_fl_no_hello; 1131 } 1132 usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE, 1133 flags); 1134 usbredirparser_do_write(dev->parser); 1135 } 1136 1137 static void usbredir_reject_device(USBRedirDevice *dev) 1138 { 1139 usbredir_device_disconnect(dev); 1140 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) { 1141 usbredirparser_send_filter_reject(dev->parser); 1142 usbredirparser_do_write(dev->parser); 1143 } 1144 } 1145 1146 static void usbredir_do_attach(void *opaque) 1147 { 1148 USBRedirDevice *dev = opaque; 1149 1150 /* In order to work properly with XHCI controllers we need these caps */ 1151 if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !( 1152 usbredirparser_peer_has_cap(dev->parser, 1153 usb_redir_cap_ep_info_max_packet_size) && 1154 usbredirparser_peer_has_cap(dev->parser, 1155 usb_redir_cap_32bits_bulk_length) && 1156 usbredirparser_peer_has_cap(dev->parser, 1157 usb_redir_cap_64bits_ids))) { 1158 ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n"); 1159 usbredir_reject_device(dev); 1160 return; 1161 } 1162 1163 if (usb_device_attach(&dev->dev) != 0) { 1164 WARNING("rejecting device due to speed mismatch\n"); 1165 usbredir_reject_device(dev); 1166 } 1167 } 1168 1169 /* 1170 * chardev callbacks 1171 */ 1172 1173 static int usbredir_chardev_can_read(void *opaque) 1174 { 1175 USBRedirDevice *dev = opaque; 1176 1177 if (!dev->parser) { 1178 WARNING("chardev_can_read called on non open chardev!\n"); 1179 return 0; 1180 } 1181 1182 /* Don't read new data from the chardev until our state is fully synced */ 1183 if (!runstate_check(RUN_STATE_RUNNING)) { 1184 return 0; 1185 } 1186 1187 /* usbredir_parser_do_read will consume *all* data we give it */ 1188 return 1024 * 1024; 1189 } 1190 1191 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size) 1192 { 1193 USBRedirDevice *dev = opaque; 1194 1195 /* No recursion allowed! */ 1196 assert(dev->read_buf == NULL); 1197 1198 dev->read_buf = buf; 1199 dev->read_buf_size = size; 1200 1201 usbredirparser_do_read(dev->parser); 1202 /* Send any acks, etc. which may be queued now */ 1203 usbredirparser_do_write(dev->parser); 1204 } 1205 1206 static void usbredir_chardev_event(void *opaque, int event) 1207 { 1208 USBRedirDevice *dev = opaque; 1209 1210 switch (event) { 1211 case CHR_EVENT_OPENED: 1212 DPRINTF("chardev open\n"); 1213 /* Make sure any pending closes are handled (no-op if none pending) */ 1214 usbredir_chardev_close_bh(dev); 1215 qemu_bh_cancel(dev->chardev_close_bh); 1216 usbredir_create_parser(dev); 1217 break; 1218 case CHR_EVENT_CLOSED: 1219 DPRINTF("chardev close\n"); 1220 qemu_bh_schedule(dev->chardev_close_bh); 1221 break; 1222 } 1223 } 1224 1225 /* 1226 * init + destroy 1227 */ 1228 1229 static void usbredir_vm_state_change(void *priv, int running, RunState state) 1230 { 1231 USBRedirDevice *dev = priv; 1232 1233 if (state == RUN_STATE_RUNNING && dev->parser != NULL) { 1234 usbredirparser_do_write(dev->parser); /* Flush any pending writes */ 1235 } 1236 } 1237 1238 static void usbredir_init_endpoints(USBRedirDevice *dev) 1239 { 1240 int i; 1241 1242 usb_ep_init(&dev->dev); 1243 memset(dev->endpoint, 0, sizeof(dev->endpoint)); 1244 for (i = 0; i < MAX_ENDPOINTS; i++) { 1245 dev->endpoint[i].dev = dev; 1246 QTAILQ_INIT(&dev->endpoint[i].bufpq); 1247 } 1248 } 1249 1250 static int usbredir_initfn(USBDevice *udev) 1251 { 1252 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1253 int i; 1254 1255 if (dev->cs == NULL) { 1256 qerror_report(QERR_MISSING_PARAMETER, "chardev"); 1257 return -1; 1258 } 1259 1260 if (dev->filter_str) { 1261 i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|", 1262 &dev->filter_rules, 1263 &dev->filter_rules_count); 1264 if (i) { 1265 qerror_report(QERR_INVALID_PARAMETER_VALUE, "filter", 1266 "a usb device filter string"); 1267 return -1; 1268 } 1269 } 1270 1271 dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev); 1272 dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev); 1273 1274 packet_id_queue_init(&dev->cancelled, dev, "cancelled"); 1275 packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight"); 1276 usbredir_init_endpoints(dev); 1277 1278 /* We'll do the attach once we receive the speed from the usb-host */ 1279 udev->auto_attach = 0; 1280 1281 /* Will be cleared during setup when we find conflicts */ 1282 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH; 1283 1284 /* Let the backend know we are ready */ 1285 qemu_chr_fe_open(dev->cs); 1286 qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read, 1287 usbredir_chardev_read, usbredir_chardev_event, dev); 1288 1289 qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev); 1290 add_boot_device_path(dev->bootindex, &udev->qdev, NULL); 1291 return 0; 1292 } 1293 1294 static void usbredir_cleanup_device_queues(USBRedirDevice *dev) 1295 { 1296 int i; 1297 1298 packet_id_queue_empty(&dev->cancelled); 1299 packet_id_queue_empty(&dev->already_in_flight); 1300 for (i = 0; i < MAX_ENDPOINTS; i++) { 1301 usbredir_free_bufpq(dev, I2EP(i)); 1302 } 1303 } 1304 1305 static void usbredir_handle_destroy(USBDevice *udev) 1306 { 1307 USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); 1308 1309 qemu_chr_fe_close(dev->cs); 1310 qemu_chr_delete(dev->cs); 1311 /* Note must be done after qemu_chr_close, as that causes a close event */ 1312 qemu_bh_delete(dev->chardev_close_bh); 1313 1314 qemu_del_timer(dev->attach_timer); 1315 qemu_free_timer(dev->attach_timer); 1316 1317 usbredir_cleanup_device_queues(dev); 1318 1319 if (dev->parser) { 1320 usbredirparser_destroy(dev->parser); 1321 } 1322 1323 free(dev->filter_rules); 1324 } 1325 1326 static int usbredir_check_filter(USBRedirDevice *dev) 1327 { 1328 if (dev->interface_info.interface_count == NO_INTERFACE_INFO) { 1329 ERROR("No interface info for device\n"); 1330 goto error; 1331 } 1332 1333 if (dev->filter_rules) { 1334 if (!usbredirparser_peer_has_cap(dev->parser, 1335 usb_redir_cap_connect_device_version)) { 1336 ERROR("Device filter specified and peer does not have the " 1337 "connect_device_version capability\n"); 1338 goto error; 1339 } 1340 1341 if (usbredirfilter_check( 1342 dev->filter_rules, 1343 dev->filter_rules_count, 1344 dev->device_info.device_class, 1345 dev->device_info.device_subclass, 1346 dev->device_info.device_protocol, 1347 dev->interface_info.interface_class, 1348 dev->interface_info.interface_subclass, 1349 dev->interface_info.interface_protocol, 1350 dev->interface_info.interface_count, 1351 dev->device_info.vendor_id, 1352 dev->device_info.product_id, 1353 dev->device_info.device_version_bcd, 1354 0) != 0) { 1355 goto error; 1356 } 1357 } 1358 1359 return 0; 1360 1361 error: 1362 usbredir_reject_device(dev); 1363 return -1; 1364 } 1365 1366 static void usbredir_check_bulk_receiving(USBRedirDevice *dev) 1367 { 1368 int i, j, quirks; 1369 1370 if (!usbredirparser_peer_has_cap(dev->parser, 1371 usb_redir_cap_bulk_receiving)) { 1372 return; 1373 } 1374 1375 for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) { 1376 dev->endpoint[i].bulk_receiving_enabled = 0; 1377 } 1378 for (i = 0; i < dev->interface_info.interface_count; i++) { 1379 quirks = usb_get_quirks(dev->device_info.vendor_id, 1380 dev->device_info.product_id, 1381 dev->interface_info.interface_class[i], 1382 dev->interface_info.interface_subclass[i], 1383 dev->interface_info.interface_protocol[i]); 1384 if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) { 1385 continue; 1386 } 1387 if (quirks & USB_QUIRK_IS_FTDI) { 1388 dev->buffered_bulk_in_complete = 1389 usbredir_buffered_bulk_in_complete_ftdi; 1390 } else { 1391 dev->buffered_bulk_in_complete = 1392 usbredir_buffered_bulk_in_complete_raw; 1393 } 1394 1395 for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) { 1396 if (dev->endpoint[j].interface == 1397 dev->interface_info.interface[i] && 1398 dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK && 1399 dev->endpoint[j].max_packet_size != 0) { 1400 dev->endpoint[j].bulk_receiving_enabled = 1; 1401 /* 1402 * With buffering pipelining is not necessary. Also packet 1403 * combining and bulk in buffering don't play nice together! 1404 */ 1405 I2USBEP(dev, j)->pipeline = false; 1406 break; /* Only buffer for the first ep of each intf */ 1407 } 1408 } 1409 } 1410 } 1411 1412 /* 1413 * usbredirparser packet complete callbacks 1414 */ 1415 1416 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p, 1417 int status) 1418 { 1419 switch (status) { 1420 case usb_redir_success: 1421 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 1422 break; 1423 case usb_redir_stall: 1424 p->status = USB_RET_STALL; 1425 break; 1426 case usb_redir_cancelled: 1427 /* 1428 * When the usbredir-host unredirects a device, it will report a status 1429 * of cancelled for all pending packets, followed by a disconnect msg. 1430 */ 1431 p->status = USB_RET_IOERROR; 1432 break; 1433 case usb_redir_inval: 1434 WARNING("got invalid param error from usb-host?\n"); 1435 p->status = USB_RET_IOERROR; 1436 break; 1437 case usb_redir_babble: 1438 p->status = USB_RET_BABBLE; 1439 break; 1440 case usb_redir_ioerror: 1441 case usb_redir_timeout: 1442 default: 1443 p->status = USB_RET_IOERROR; 1444 } 1445 } 1446 1447 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h) 1448 { 1449 USBRedirDevice *dev = priv; 1450 1451 /* Try to send the filter info now that we've the usb-host's caps */ 1452 if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) && 1453 dev->filter_rules) { 1454 usbredirparser_send_filter_filter(dev->parser, dev->filter_rules, 1455 dev->filter_rules_count); 1456 usbredirparser_do_write(dev->parser); 1457 } 1458 } 1459 1460 static void usbredir_device_connect(void *priv, 1461 struct usb_redir_device_connect_header *device_connect) 1462 { 1463 USBRedirDevice *dev = priv; 1464 const char *speed; 1465 1466 if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) { 1467 ERROR("Received device connect while already connected\n"); 1468 return; 1469 } 1470 1471 switch (device_connect->speed) { 1472 case usb_redir_speed_low: 1473 speed = "low speed"; 1474 dev->dev.speed = USB_SPEED_LOW; 1475 dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL; 1476 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH; 1477 break; 1478 case usb_redir_speed_full: 1479 speed = "full speed"; 1480 dev->dev.speed = USB_SPEED_FULL; 1481 dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH; 1482 break; 1483 case usb_redir_speed_high: 1484 speed = "high speed"; 1485 dev->dev.speed = USB_SPEED_HIGH; 1486 break; 1487 case usb_redir_speed_super: 1488 speed = "super speed"; 1489 dev->dev.speed = USB_SPEED_SUPER; 1490 break; 1491 default: 1492 speed = "unknown speed"; 1493 dev->dev.speed = USB_SPEED_FULL; 1494 } 1495 1496 if (usbredirparser_peer_has_cap(dev->parser, 1497 usb_redir_cap_connect_device_version)) { 1498 INFO("attaching %s device %04x:%04x version %d.%d class %02x\n", 1499 speed, device_connect->vendor_id, device_connect->product_id, 1500 ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 + 1501 ((device_connect->device_version_bcd & 0x0f00) >> 8), 1502 ((device_connect->device_version_bcd & 0x00f0) >> 4) * 10 + 1503 ((device_connect->device_version_bcd & 0x000f) >> 0), 1504 device_connect->device_class); 1505 } else { 1506 INFO("attaching %s device %04x:%04x class %02x\n", speed, 1507 device_connect->vendor_id, device_connect->product_id, 1508 device_connect->device_class); 1509 } 1510 1511 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask; 1512 dev->device_info = *device_connect; 1513 1514 if (usbredir_check_filter(dev)) { 1515 WARNING("Device %04x:%04x rejected by device filter, not attaching\n", 1516 device_connect->vendor_id, device_connect->product_id); 1517 return; 1518 } 1519 1520 usbredir_check_bulk_receiving(dev); 1521 qemu_mod_timer(dev->attach_timer, dev->next_attach_time); 1522 } 1523 1524 static void usbredir_device_disconnect(void *priv) 1525 { 1526 USBRedirDevice *dev = priv; 1527 1528 /* Stop any pending attaches */ 1529 qemu_del_timer(dev->attach_timer); 1530 1531 if (dev->dev.attached) { 1532 DPRINTF("detaching device\n"); 1533 usb_device_detach(&dev->dev); 1534 /* 1535 * Delay next usb device attach to give the guest a chance to see 1536 * see the detach / attach in case of quick close / open succession 1537 */ 1538 dev->next_attach_time = qemu_get_clock_ms(vm_clock) + 200; 1539 } 1540 1541 /* Reset state so that the next dev connected starts with a clean slate */ 1542 usbredir_cleanup_device_queues(dev); 1543 usbredir_init_endpoints(dev); 1544 dev->interface_info.interface_count = NO_INTERFACE_INFO; 1545 dev->dev.addr = 0; 1546 dev->dev.speed = 0; 1547 dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH; 1548 } 1549 1550 static void usbredir_interface_info(void *priv, 1551 struct usb_redir_interface_info_header *interface_info) 1552 { 1553 USBRedirDevice *dev = priv; 1554 1555 dev->interface_info = *interface_info; 1556 1557 /* 1558 * If we receive interface info after the device has already been 1559 * connected (ie on a set_config), re-check interface dependent things. 1560 */ 1561 if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) { 1562 usbredir_check_bulk_receiving(dev); 1563 if (usbredir_check_filter(dev)) { 1564 ERROR("Device no longer matches filter after interface info " 1565 "change, disconnecting!\n"); 1566 } 1567 } 1568 } 1569 1570 static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed) 1571 { 1572 dev->compatible_speedmask &= ~(1 << speed); 1573 dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask; 1574 } 1575 1576 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep) 1577 { 1578 if (uep->type != USB_ENDPOINT_XFER_BULK) { 1579 return; 1580 } 1581 if (uep->pid == USB_TOKEN_OUT) { 1582 uep->pipeline = true; 1583 } 1584 if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 && 1585 usbredirparser_peer_has_cap(dev->parser, 1586 usb_redir_cap_32bits_bulk_length)) { 1587 uep->pipeline = true; 1588 } 1589 } 1590 1591 static void usbredir_setup_usb_eps(USBRedirDevice *dev) 1592 { 1593 struct USBEndpoint *usb_ep; 1594 int i; 1595 1596 for (i = 0; i < MAX_ENDPOINTS; i++) { 1597 usb_ep = I2USBEP(dev, i); 1598 usb_ep->type = dev->endpoint[i].type; 1599 usb_ep->ifnum = dev->endpoint[i].interface; 1600 usb_ep->max_packet_size = dev->endpoint[i].max_packet_size; 1601 usbredir_set_pipeline(dev, usb_ep); 1602 } 1603 } 1604 1605 static void usbredir_ep_info(void *priv, 1606 struct usb_redir_ep_info_header *ep_info) 1607 { 1608 USBRedirDevice *dev = priv; 1609 int i; 1610 1611 for (i = 0; i < MAX_ENDPOINTS; i++) { 1612 dev->endpoint[i].type = ep_info->type[i]; 1613 dev->endpoint[i].interval = ep_info->interval[i]; 1614 dev->endpoint[i].interface = ep_info->interface[i]; 1615 if (usbredirparser_peer_has_cap(dev->parser, 1616 usb_redir_cap_ep_info_max_packet_size)) { 1617 dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i]; 1618 } 1619 switch (dev->endpoint[i].type) { 1620 case usb_redir_type_invalid: 1621 break; 1622 case usb_redir_type_iso: 1623 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL); 1624 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH); 1625 /* Fall through */ 1626 case usb_redir_type_interrupt: 1627 if (!usbredirparser_peer_has_cap(dev->parser, 1628 usb_redir_cap_ep_info_max_packet_size) || 1629 ep_info->max_packet_size[i] > 64) { 1630 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL); 1631 } 1632 if (!usbredirparser_peer_has_cap(dev->parser, 1633 usb_redir_cap_ep_info_max_packet_size) || 1634 ep_info->max_packet_size[i] > 1024) { 1635 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH); 1636 } 1637 if (dev->endpoint[i].interval == 0) { 1638 ERROR("Received 0 interval for isoc or irq endpoint\n"); 1639 usbredir_reject_device(dev); 1640 return; 1641 } 1642 /* Fall through */ 1643 case usb_redir_type_control: 1644 case usb_redir_type_bulk: 1645 DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i), 1646 dev->endpoint[i].type, dev->endpoint[i].interface); 1647 break; 1648 default: 1649 ERROR("Received invalid endpoint type\n"); 1650 usbredir_reject_device(dev); 1651 return; 1652 } 1653 } 1654 /* The new ep info may have caused a speed incompatibility, recheck */ 1655 if (dev->dev.attached && 1656 !(dev->dev.port->speedmask & dev->dev.speedmask)) { 1657 ERROR("Device no longer matches speed after endpoint info change, " 1658 "disconnecting!\n"); 1659 usbredir_reject_device(dev); 1660 return; 1661 } 1662 usbredir_setup_usb_eps(dev); 1663 usbredir_check_bulk_receiving(dev); 1664 } 1665 1666 static void usbredir_configuration_status(void *priv, uint64_t id, 1667 struct usb_redir_configuration_status_header *config_status) 1668 { 1669 USBRedirDevice *dev = priv; 1670 USBPacket *p; 1671 1672 DPRINTF("set config status %d config %d id %"PRIu64"\n", 1673 config_status->status, config_status->configuration, id); 1674 1675 p = usbredir_find_packet_by_id(dev, 0, id); 1676 if (p) { 1677 if (dev->dev.setup_buf[0] & USB_DIR_IN) { 1678 dev->dev.data_buf[0] = config_status->configuration; 1679 p->actual_length = 1; 1680 } 1681 usbredir_handle_status(dev, p, config_status->status); 1682 usb_generic_async_ctrl_complete(&dev->dev, p); 1683 } 1684 } 1685 1686 static void usbredir_alt_setting_status(void *priv, uint64_t id, 1687 struct usb_redir_alt_setting_status_header *alt_setting_status) 1688 { 1689 USBRedirDevice *dev = priv; 1690 USBPacket *p; 1691 1692 DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n", 1693 alt_setting_status->status, alt_setting_status->interface, 1694 alt_setting_status->alt, id); 1695 1696 p = usbredir_find_packet_by_id(dev, 0, id); 1697 if (p) { 1698 if (dev->dev.setup_buf[0] & USB_DIR_IN) { 1699 dev->dev.data_buf[0] = alt_setting_status->alt; 1700 p->actual_length = 1; 1701 } 1702 usbredir_handle_status(dev, p, alt_setting_status->status); 1703 usb_generic_async_ctrl_complete(&dev->dev, p); 1704 } 1705 } 1706 1707 static void usbredir_iso_stream_status(void *priv, uint64_t id, 1708 struct usb_redir_iso_stream_status_header *iso_stream_status) 1709 { 1710 USBRedirDevice *dev = priv; 1711 uint8_t ep = iso_stream_status->endpoint; 1712 1713 DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status, 1714 ep, id); 1715 1716 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) { 1717 return; 1718 } 1719 1720 dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status; 1721 if (iso_stream_status->status == usb_redir_stall) { 1722 DPRINTF("iso stream stopped by peer ep %02X\n", ep); 1723 dev->endpoint[EP2I(ep)].iso_started = 0; 1724 } 1725 } 1726 1727 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id, 1728 struct usb_redir_interrupt_receiving_status_header 1729 *interrupt_receiving_status) 1730 { 1731 USBRedirDevice *dev = priv; 1732 uint8_t ep = interrupt_receiving_status->endpoint; 1733 1734 DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n", 1735 interrupt_receiving_status->status, ep, id); 1736 1737 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) { 1738 return; 1739 } 1740 1741 dev->endpoint[EP2I(ep)].interrupt_error = 1742 interrupt_receiving_status->status; 1743 if (interrupt_receiving_status->status == usb_redir_stall) { 1744 DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep); 1745 dev->endpoint[EP2I(ep)].interrupt_started = 0; 1746 } 1747 } 1748 1749 static void usbredir_bulk_streams_status(void *priv, uint64_t id, 1750 struct usb_redir_bulk_streams_status_header *bulk_streams_status) 1751 { 1752 } 1753 1754 static void usbredir_bulk_receiving_status(void *priv, uint64_t id, 1755 struct usb_redir_bulk_receiving_status_header *bulk_receiving_status) 1756 { 1757 USBRedirDevice *dev = priv; 1758 uint8_t ep = bulk_receiving_status->endpoint; 1759 1760 DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n", 1761 bulk_receiving_status->status, ep, id); 1762 1763 if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) { 1764 return; 1765 } 1766 1767 if (bulk_receiving_status->status == usb_redir_stall) { 1768 DPRINTF("bulk receiving stopped by peer ep %02X\n", ep); 1769 dev->endpoint[EP2I(ep)].bulk_receiving_started = 0; 1770 } 1771 } 1772 1773 static void usbredir_control_packet(void *priv, uint64_t id, 1774 struct usb_redir_control_packet_header *control_packet, 1775 uint8_t *data, int data_len) 1776 { 1777 USBRedirDevice *dev = priv; 1778 USBPacket *p; 1779 int len = control_packet->length; 1780 1781 DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status, 1782 len, id); 1783 1784 /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices 1785 * to work redirected to a not superspeed capable hcd */ 1786 if (dev->dev.speed == USB_SPEED_SUPER && 1787 !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) && 1788 control_packet->requesttype == 0x80 && 1789 control_packet->request == 6 && 1790 control_packet->value == 0x100 && control_packet->index == 0 && 1791 data_len >= 18 && data[7] == 9) { 1792 data[7] = 64; 1793 } 1794 1795 p = usbredir_find_packet_by_id(dev, 0, id); 1796 if (p) { 1797 usbredir_handle_status(dev, p, control_packet->status); 1798 if (data_len > 0) { 1799 usbredir_log_data(dev, "ctrl data in:", data, data_len); 1800 if (data_len > sizeof(dev->dev.data_buf)) { 1801 ERROR("ctrl buffer too small (%d > %zu)\n", 1802 data_len, sizeof(dev->dev.data_buf)); 1803 p->status = USB_RET_STALL; 1804 data_len = len = sizeof(dev->dev.data_buf); 1805 } 1806 memcpy(dev->dev.data_buf, data, data_len); 1807 } 1808 p->actual_length = len; 1809 usb_generic_async_ctrl_complete(&dev->dev, p); 1810 } 1811 free(data); 1812 } 1813 1814 static void usbredir_bulk_packet(void *priv, uint64_t id, 1815 struct usb_redir_bulk_packet_header *bulk_packet, 1816 uint8_t *data, int data_len) 1817 { 1818 USBRedirDevice *dev = priv; 1819 uint8_t ep = bulk_packet->endpoint; 1820 int len = (bulk_packet->length_high << 16) | bulk_packet->length; 1821 USBPacket *p; 1822 1823 DPRINTF("bulk-in status %d ep %02X len %d id %"PRIu64"\n", 1824 bulk_packet->status, ep, len, id); 1825 1826 p = usbredir_find_packet_by_id(dev, ep, id); 1827 if (p) { 1828 size_t size = usb_packet_size(p); 1829 usbredir_handle_status(dev, p, bulk_packet->status); 1830 if (data_len > 0) { 1831 usbredir_log_data(dev, "bulk data in:", data, data_len); 1832 if (data_len > size) { 1833 ERROR("bulk got more data then requested (%d > %zd)\n", 1834 data_len, p->iov.size); 1835 p->status = USB_RET_BABBLE; 1836 data_len = len = size; 1837 } 1838 usb_packet_copy(p, data, data_len); 1839 } 1840 p->actual_length = len; 1841 if (p->pid == USB_TOKEN_IN && p->ep->pipeline) { 1842 usb_combined_input_packet_complete(&dev->dev, p); 1843 } else { 1844 usb_packet_complete(&dev->dev, p); 1845 } 1846 } 1847 free(data); 1848 } 1849 1850 static void usbredir_iso_packet(void *priv, uint64_t id, 1851 struct usb_redir_iso_packet_header *iso_packet, 1852 uint8_t *data, int data_len) 1853 { 1854 USBRedirDevice *dev = priv; 1855 uint8_t ep = iso_packet->endpoint; 1856 1857 DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n", 1858 iso_packet->status, ep, data_len, id); 1859 1860 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) { 1861 ERROR("received iso packet for non iso endpoint %02X\n", ep); 1862 free(data); 1863 return; 1864 } 1865 1866 if (dev->endpoint[EP2I(ep)].iso_started == 0) { 1867 DPRINTF("received iso packet for non started stream ep %02X\n", ep); 1868 free(data); 1869 return; 1870 } 1871 1872 /* bufp_alloc also adds the packet to the ep queue */ 1873 bufp_alloc(dev, data, data_len, iso_packet->status, ep, data); 1874 } 1875 1876 static void usbredir_interrupt_packet(void *priv, uint64_t id, 1877 struct usb_redir_interrupt_packet_header *interrupt_packet, 1878 uint8_t *data, int data_len) 1879 { 1880 USBRedirDevice *dev = priv; 1881 uint8_t ep = interrupt_packet->endpoint; 1882 1883 DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n", 1884 interrupt_packet->status, ep, data_len, id); 1885 1886 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) { 1887 ERROR("received int packet for non interrupt endpoint %02X\n", ep); 1888 free(data); 1889 return; 1890 } 1891 1892 if (ep & USB_DIR_IN) { 1893 if (dev->endpoint[EP2I(ep)].interrupt_started == 0) { 1894 DPRINTF("received int packet while not started ep %02X\n", ep); 1895 free(data); 1896 return; 1897 } 1898 1899 if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) { 1900 usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0); 1901 } 1902 1903 /* bufp_alloc also adds the packet to the ep queue */ 1904 bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data); 1905 } else { 1906 /* 1907 * We report output interrupt packets as completed directly upon 1908 * submission, so all we can do here if one failed is warn. 1909 */ 1910 if (interrupt_packet->status) { 1911 WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n", 1912 interrupt_packet->status, ep, id); 1913 } 1914 } 1915 } 1916 1917 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id, 1918 struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet, 1919 uint8_t *data, int data_len) 1920 { 1921 USBRedirDevice *dev = priv; 1922 uint8_t status, ep = buffered_bulk_packet->endpoint; 1923 void *free_on_destroy; 1924 int i, len; 1925 1926 DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n", 1927 buffered_bulk_packet->status, ep, data_len, id); 1928 1929 if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) { 1930 ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep); 1931 free(data); 1932 return; 1933 } 1934 1935 if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) { 1936 DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep); 1937 free(data); 1938 return; 1939 } 1940 1941 /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */ 1942 len = dev->endpoint[EP2I(ep)].max_packet_size; 1943 status = usb_redir_success; 1944 free_on_destroy = NULL; 1945 for (i = 0; i < data_len; i += len) { 1946 if (len >= (data_len - i)) { 1947 len = data_len - i; 1948 status = buffered_bulk_packet->status; 1949 free_on_destroy = data; 1950 } 1951 /* bufp_alloc also adds the packet to the ep queue */ 1952 bufp_alloc(dev, data + i, len, status, ep, free_on_destroy); 1953 } 1954 1955 if (dev->endpoint[EP2I(ep)].pending_async_packet) { 1956 USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet; 1957 dev->endpoint[EP2I(ep)].pending_async_packet = NULL; 1958 usbredir_buffered_bulk_in_complete(dev, p, ep); 1959 usb_packet_complete(&dev->dev, p); 1960 } 1961 } 1962 1963 /* 1964 * Migration code 1965 */ 1966 1967 static void usbredir_pre_save(void *priv) 1968 { 1969 USBRedirDevice *dev = priv; 1970 1971 usbredir_fill_already_in_flight(dev); 1972 } 1973 1974 static int usbredir_post_load(void *priv, int version_id) 1975 { 1976 USBRedirDevice *dev = priv; 1977 1978 switch (dev->device_info.speed) { 1979 case usb_redir_speed_low: 1980 dev->dev.speed = USB_SPEED_LOW; 1981 break; 1982 case usb_redir_speed_full: 1983 dev->dev.speed = USB_SPEED_FULL; 1984 break; 1985 case usb_redir_speed_high: 1986 dev->dev.speed = USB_SPEED_HIGH; 1987 break; 1988 case usb_redir_speed_super: 1989 dev->dev.speed = USB_SPEED_SUPER; 1990 break; 1991 default: 1992 dev->dev.speed = USB_SPEED_FULL; 1993 } 1994 dev->dev.speedmask = (1 << dev->dev.speed); 1995 1996 usbredir_setup_usb_eps(dev); 1997 usbredir_check_bulk_receiving(dev); 1998 1999 return 0; 2000 } 2001 2002 /* For usbredirparser migration */ 2003 static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused) 2004 { 2005 USBRedirDevice *dev = priv; 2006 uint8_t *data; 2007 int len; 2008 2009 if (dev->parser == NULL) { 2010 qemu_put_be32(f, 0); 2011 return; 2012 } 2013 2014 usbredirparser_serialize(dev->parser, &data, &len); 2015 qemu_oom_check(data); 2016 2017 qemu_put_be32(f, len); 2018 qemu_put_buffer(f, data, len); 2019 2020 free(data); 2021 } 2022 2023 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused) 2024 { 2025 USBRedirDevice *dev = priv; 2026 uint8_t *data; 2027 int len, ret; 2028 2029 len = qemu_get_be32(f); 2030 if (len == 0) { 2031 return 0; 2032 } 2033 2034 /* 2035 * If our chardev is not open already at this point the usbredir connection 2036 * has been broken (non seamless migration, or restore from disk). 2037 * 2038 * In this case create a temporary parser to receive the migration data, 2039 * and schedule the close_bh to report the device as disconnected to the 2040 * guest and to destroy the parser again. 2041 */ 2042 if (dev->parser == NULL) { 2043 WARNING("usb-redir connection broken during migration\n"); 2044 usbredir_create_parser(dev); 2045 qemu_bh_schedule(dev->chardev_close_bh); 2046 } 2047 2048 data = g_malloc(len); 2049 qemu_get_buffer(f, data, len); 2050 2051 ret = usbredirparser_unserialize(dev->parser, data, len); 2052 2053 g_free(data); 2054 2055 return ret; 2056 } 2057 2058 static const VMStateInfo usbredir_parser_vmstate_info = { 2059 .name = "usb-redir-parser", 2060 .put = usbredir_put_parser, 2061 .get = usbredir_get_parser, 2062 }; 2063 2064 2065 /* For buffered packets (iso/irq) queue migration */ 2066 static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused) 2067 { 2068 struct endp_data *endp = priv; 2069 USBRedirDevice *dev = endp->dev; 2070 struct buf_packet *bufp; 2071 int len, i = 0; 2072 2073 qemu_put_be32(f, endp->bufpq_size); 2074 QTAILQ_FOREACH(bufp, &endp->bufpq, next) { 2075 len = bufp->len - bufp->offset; 2076 DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size, 2077 len, bufp->status); 2078 qemu_put_be32(f, len); 2079 qemu_put_be32(f, bufp->status); 2080 qemu_put_buffer(f, bufp->data + bufp->offset, len); 2081 i++; 2082 } 2083 assert(i == endp->bufpq_size); 2084 } 2085 2086 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused) 2087 { 2088 struct endp_data *endp = priv; 2089 USBRedirDevice *dev = endp->dev; 2090 struct buf_packet *bufp; 2091 int i; 2092 2093 endp->bufpq_size = qemu_get_be32(f); 2094 for (i = 0; i < endp->bufpq_size; i++) { 2095 bufp = g_malloc(sizeof(struct buf_packet)); 2096 bufp->len = qemu_get_be32(f); 2097 bufp->status = qemu_get_be32(f); 2098 bufp->offset = 0; 2099 bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */ 2100 bufp->free_on_destroy = bufp->data; 2101 qemu_get_buffer(f, bufp->data, bufp->len); 2102 QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next); 2103 DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size, 2104 bufp->len, bufp->status); 2105 } 2106 return 0; 2107 } 2108 2109 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = { 2110 .name = "usb-redir-bufpq", 2111 .put = usbredir_put_bufpq, 2112 .get = usbredir_get_bufpq, 2113 }; 2114 2115 2116 /* For endp_data migration */ 2117 static const VMStateDescription usbredir_bulk_receiving_vmstate = { 2118 .name = "usb-redir-ep/bulk-receiving", 2119 .version_id = 1, 2120 .minimum_version_id = 1, 2121 .fields = (VMStateField[]) { 2122 VMSTATE_UINT8(bulk_receiving_started, struct endp_data), 2123 VMSTATE_END_OF_LIST() 2124 } 2125 }; 2126 2127 static bool usbredir_bulk_receiving_needed(void *priv) 2128 { 2129 struct endp_data *endp = priv; 2130 2131 return endp->bulk_receiving_started; 2132 } 2133 2134 static const VMStateDescription usbredir_ep_vmstate = { 2135 .name = "usb-redir-ep", 2136 .version_id = 1, 2137 .minimum_version_id = 1, 2138 .fields = (VMStateField[]) { 2139 VMSTATE_UINT8(type, struct endp_data), 2140 VMSTATE_UINT8(interval, struct endp_data), 2141 VMSTATE_UINT8(interface, struct endp_data), 2142 VMSTATE_UINT16(max_packet_size, struct endp_data), 2143 VMSTATE_UINT8(iso_started, struct endp_data), 2144 VMSTATE_UINT8(iso_error, struct endp_data), 2145 VMSTATE_UINT8(interrupt_started, struct endp_data), 2146 VMSTATE_UINT8(interrupt_error, struct endp_data), 2147 VMSTATE_UINT8(bufpq_prefilled, struct endp_data), 2148 VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data), 2149 { 2150 .name = "bufpq", 2151 .version_id = 0, 2152 .field_exists = NULL, 2153 .size = 0, 2154 .info = &usbredir_ep_bufpq_vmstate_info, 2155 .flags = VMS_SINGLE, 2156 .offset = 0, 2157 }, 2158 VMSTATE_INT32(bufpq_target_size, struct endp_data), 2159 VMSTATE_END_OF_LIST() 2160 }, 2161 .subsections = (VMStateSubsection[]) { 2162 { 2163 .vmsd = &usbredir_bulk_receiving_vmstate, 2164 .needed = usbredir_bulk_receiving_needed, 2165 }, { 2166 /* empty */ 2167 } 2168 } 2169 }; 2170 2171 2172 /* For PacketIdQueue migration */ 2173 static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused) 2174 { 2175 struct PacketIdQueue *q = priv; 2176 USBRedirDevice *dev = q->dev; 2177 struct PacketIdQueueEntry *e; 2178 int remain = q->size; 2179 2180 DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size); 2181 qemu_put_be32(f, q->size); 2182 QTAILQ_FOREACH(e, &q->head, next) { 2183 qemu_put_be64(f, e->id); 2184 remain--; 2185 } 2186 assert(remain == 0); 2187 } 2188 2189 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused) 2190 { 2191 struct PacketIdQueue *q = priv; 2192 USBRedirDevice *dev = q->dev; 2193 int i, size; 2194 uint64_t id; 2195 2196 size = qemu_get_be32(f); 2197 DPRINTF("get_packet_id_q %s size %d\n", q->name, size); 2198 for (i = 0; i < size; i++) { 2199 id = qemu_get_be64(f); 2200 packet_id_queue_add(q, id); 2201 } 2202 assert(q->size == size); 2203 return 0; 2204 } 2205 2206 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = { 2207 .name = "usb-redir-packet-id-q", 2208 .put = usbredir_put_packet_id_q, 2209 .get = usbredir_get_packet_id_q, 2210 }; 2211 2212 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = { 2213 .name = "usb-redir-packet-id-queue", 2214 .version_id = 1, 2215 .minimum_version_id = 1, 2216 .fields = (VMStateField[]) { 2217 { 2218 .name = "queue", 2219 .version_id = 0, 2220 .field_exists = NULL, 2221 .size = 0, 2222 .info = &usbredir_ep_packet_id_q_vmstate_info, 2223 .flags = VMS_SINGLE, 2224 .offset = 0, 2225 }, 2226 VMSTATE_END_OF_LIST() 2227 } 2228 }; 2229 2230 2231 /* For usb_redir_device_connect_header migration */ 2232 static const VMStateDescription usbredir_device_info_vmstate = { 2233 .name = "usb-redir-device-info", 2234 .version_id = 1, 2235 .minimum_version_id = 1, 2236 .fields = (VMStateField[]) { 2237 VMSTATE_UINT8(speed, struct usb_redir_device_connect_header), 2238 VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header), 2239 VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header), 2240 VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header), 2241 VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header), 2242 VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header), 2243 VMSTATE_UINT16(device_version_bcd, 2244 struct usb_redir_device_connect_header), 2245 VMSTATE_END_OF_LIST() 2246 } 2247 }; 2248 2249 2250 /* For usb_redir_interface_info_header migration */ 2251 static const VMStateDescription usbredir_interface_info_vmstate = { 2252 .name = "usb-redir-interface-info", 2253 .version_id = 1, 2254 .minimum_version_id = 1, 2255 .fields = (VMStateField[]) { 2256 VMSTATE_UINT32(interface_count, 2257 struct usb_redir_interface_info_header), 2258 VMSTATE_UINT8_ARRAY(interface, 2259 struct usb_redir_interface_info_header, 32), 2260 VMSTATE_UINT8_ARRAY(interface_class, 2261 struct usb_redir_interface_info_header, 32), 2262 VMSTATE_UINT8_ARRAY(interface_subclass, 2263 struct usb_redir_interface_info_header, 32), 2264 VMSTATE_UINT8_ARRAY(interface_protocol, 2265 struct usb_redir_interface_info_header, 32), 2266 VMSTATE_END_OF_LIST() 2267 } 2268 }; 2269 2270 2271 /* And finally the USBRedirDevice vmstate itself */ 2272 static const VMStateDescription usbredir_vmstate = { 2273 .name = "usb-redir", 2274 .version_id = 1, 2275 .minimum_version_id = 1, 2276 .pre_save = usbredir_pre_save, 2277 .post_load = usbredir_post_load, 2278 .fields = (VMStateField[]) { 2279 VMSTATE_USB_DEVICE(dev, USBRedirDevice), 2280 VMSTATE_TIMER(attach_timer, USBRedirDevice), 2281 { 2282 .name = "parser", 2283 .version_id = 0, 2284 .field_exists = NULL, 2285 .size = 0, 2286 .info = &usbredir_parser_vmstate_info, 2287 .flags = VMS_SINGLE, 2288 .offset = 0, 2289 }, 2290 VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1, 2291 usbredir_ep_vmstate, struct endp_data), 2292 VMSTATE_STRUCT(cancelled, USBRedirDevice, 1, 2293 usbredir_ep_packet_id_queue_vmstate, 2294 struct PacketIdQueue), 2295 VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1, 2296 usbredir_ep_packet_id_queue_vmstate, 2297 struct PacketIdQueue), 2298 VMSTATE_STRUCT(device_info, USBRedirDevice, 1, 2299 usbredir_device_info_vmstate, 2300 struct usb_redir_device_connect_header), 2301 VMSTATE_STRUCT(interface_info, USBRedirDevice, 1, 2302 usbredir_interface_info_vmstate, 2303 struct usb_redir_interface_info_header), 2304 VMSTATE_END_OF_LIST() 2305 } 2306 }; 2307 2308 static Property usbredir_properties[] = { 2309 DEFINE_PROP_CHR("chardev", USBRedirDevice, cs), 2310 DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning), 2311 DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str), 2312 DEFINE_PROP_INT32("bootindex", USBRedirDevice, bootindex, -1), 2313 DEFINE_PROP_END_OF_LIST(), 2314 }; 2315 2316 static void usbredir_class_initfn(ObjectClass *klass, void *data) 2317 { 2318 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 2319 DeviceClass *dc = DEVICE_CLASS(klass); 2320 2321 uc->init = usbredir_initfn; 2322 uc->product_desc = "USB Redirection Device"; 2323 uc->handle_destroy = usbredir_handle_destroy; 2324 uc->cancel_packet = usbredir_cancel_packet; 2325 uc->handle_reset = usbredir_handle_reset; 2326 uc->handle_data = usbredir_handle_data; 2327 uc->handle_control = usbredir_handle_control; 2328 uc->flush_ep_queue = usbredir_flush_ep_queue; 2329 uc->ep_stopped = usbredir_ep_stopped; 2330 dc->vmsd = &usbredir_vmstate; 2331 dc->props = usbredir_properties; 2332 } 2333 2334 static const TypeInfo usbredir_dev_info = { 2335 .name = "usb-redir", 2336 .parent = TYPE_USB_DEVICE, 2337 .instance_size = sizeof(USBRedirDevice), 2338 .class_init = usbredir_class_initfn, 2339 }; 2340 2341 static void usbredir_register_types(void) 2342 { 2343 type_register_static(&usbredir_dev_info); 2344 } 2345 2346 type_init(usbredir_register_types) 2347