xref: /openbmc/qemu/hw/usb/redirect.c (revision 93f7c4f0)
1 /*
2  * USB redirector usb-guest
3  *
4  * Copyright (c) 2011-2012 Red Hat, Inc.
5  *
6  * Red Hat Authors:
7  * Hans de Goede <hdegoede@redhat.com>
8  *
9  * Permission is hereby granted, free of charge, to any person obtaining a copy
10  * of this software and associated documentation files (the "Software"), to deal
11  * in the Software without restriction, including without limitation the rights
12  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13  * copies of the Software, and to permit persons to whom the Software is
14  * furnished to do so, subject to the following conditions:
15  *
16  * The above copyright notice and this permission notice shall be included in
17  * all copies or substantial portions of the Software.
18  *
19  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25  * THE SOFTWARE.
26  */
27 
28 #include "qemu-common.h"
29 #include "qemu/timer.h"
30 #include "monitor/monitor.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/iov.h"
33 #include "sysemu/char.h"
34 
35 #include <dirent.h>
36 #include <sys/ioctl.h>
37 #include <signal.h>
38 #include <usbredirparser.h>
39 #include <usbredirfilter.h>
40 
41 #include "hw/usb.h"
42 
43 #define MAX_ENDPOINTS 32
44 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
45 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
46 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
47 #define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
48                          ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
49 #define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
50                        ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
51                        (i) & 0x0f))
52 
53 #ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
54 #define USBREDIR_VERSION 0
55 #endif
56 
57 typedef struct USBRedirDevice USBRedirDevice;
58 
59 /* Struct to hold buffered packets */
60 struct buf_packet {
61     uint8_t *data;
62     void *free_on_destroy;
63     uint16_t len;
64     uint16_t offset;
65     uint8_t status;
66     QTAILQ_ENTRY(buf_packet)next;
67 };
68 
69 struct endp_data {
70     USBRedirDevice *dev;
71     uint8_t type;
72     uint8_t interval;
73     uint8_t interface; /* bInterfaceNumber this ep belongs to */
74     uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
75     uint32_t max_streams;
76     uint8_t iso_started;
77     uint8_t iso_error; /* For reporting iso errors to the HC */
78     uint8_t interrupt_started;
79     uint8_t interrupt_error;
80     uint8_t bulk_receiving_enabled;
81     uint8_t bulk_receiving_started;
82     uint8_t bufpq_prefilled;
83     uint8_t bufpq_dropping_packets;
84     QTAILQ_HEAD(, buf_packet) bufpq;
85     int32_t bufpq_size;
86     int32_t bufpq_target_size;
87     USBPacket *pending_async_packet;
88 };
89 
90 struct PacketIdQueueEntry {
91     uint64_t id;
92     QTAILQ_ENTRY(PacketIdQueueEntry)next;
93 };
94 
95 struct PacketIdQueue {
96     USBRedirDevice *dev;
97     const char *name;
98     QTAILQ_HEAD(, PacketIdQueueEntry) head;
99     int size;
100 };
101 
102 struct USBRedirDevice {
103     USBDevice dev;
104     /* Properties */
105     CharDriverState *cs;
106     uint8_t debug;
107     char *filter_str;
108     int32_t bootindex;
109     /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
110     const uint8_t *read_buf;
111     int read_buf_size;
112     /* Active chardev-watch-tag */
113     guint watch;
114     /* For async handling of close / reject */
115     QEMUBH *chardev_close_bh;
116     QEMUBH *device_reject_bh;
117     /* To delay the usb attach in case of quick chardev close + open */
118     QEMUTimer *attach_timer;
119     int64_t next_attach_time;
120     struct usbredirparser *parser;
121     struct endp_data endpoint[MAX_ENDPOINTS];
122     struct PacketIdQueue cancelled;
123     struct PacketIdQueue already_in_flight;
124     void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
125     /* Data for device filtering */
126     struct usb_redir_device_connect_header device_info;
127     struct usb_redir_interface_info_header interface_info;
128     struct usbredirfilter_rule *filter_rules;
129     int filter_rules_count;
130     int compatible_speedmask;
131 };
132 
133 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
134 static void usbredir_device_connect(void *priv,
135     struct usb_redir_device_connect_header *device_connect);
136 static void usbredir_device_disconnect(void *priv);
137 static void usbredir_interface_info(void *priv,
138     struct usb_redir_interface_info_header *interface_info);
139 static void usbredir_ep_info(void *priv,
140     struct usb_redir_ep_info_header *ep_info);
141 static void usbredir_configuration_status(void *priv, uint64_t id,
142     struct usb_redir_configuration_status_header *configuration_status);
143 static void usbredir_alt_setting_status(void *priv, uint64_t id,
144     struct usb_redir_alt_setting_status_header *alt_setting_status);
145 static void usbredir_iso_stream_status(void *priv, uint64_t id,
146     struct usb_redir_iso_stream_status_header *iso_stream_status);
147 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
148     struct usb_redir_interrupt_receiving_status_header
149     *interrupt_receiving_status);
150 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
151     struct usb_redir_bulk_streams_status_header *bulk_streams_status);
152 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
153     struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
154 static void usbredir_control_packet(void *priv, uint64_t id,
155     struct usb_redir_control_packet_header *control_packet,
156     uint8_t *data, int data_len);
157 static void usbredir_bulk_packet(void *priv, uint64_t id,
158     struct usb_redir_bulk_packet_header *bulk_packet,
159     uint8_t *data, int data_len);
160 static void usbredir_iso_packet(void *priv, uint64_t id,
161     struct usb_redir_iso_packet_header *iso_packet,
162     uint8_t *data, int data_len);
163 static void usbredir_interrupt_packet(void *priv, uint64_t id,
164     struct usb_redir_interrupt_packet_header *interrupt_header,
165     uint8_t *data, int data_len);
166 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
167     struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
168     uint8_t *data, int data_len);
169 
170 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
171     int status);
172 
173 #define VERSION "qemu usb-redir guest " QEMU_VERSION
174 
175 /*
176  * Logging stuff
177  */
178 
179 #define ERROR(...) \
180     do { \
181         if (dev->debug >= usbredirparser_error) { \
182             error_report("usb-redir error: " __VA_ARGS__); \
183         } \
184     } while (0)
185 #define WARNING(...) \
186     do { \
187         if (dev->debug >= usbredirparser_warning) { \
188             error_report("usb-redir warning: " __VA_ARGS__); \
189         } \
190     } while (0)
191 #define INFO(...) \
192     do { \
193         if (dev->debug >= usbredirparser_info) { \
194             error_report("usb-redir: " __VA_ARGS__); \
195         } \
196     } while (0)
197 #define DPRINTF(...) \
198     do { \
199         if (dev->debug >= usbredirparser_debug) { \
200             error_report("usb-redir: " __VA_ARGS__); \
201         } \
202     } while (0)
203 #define DPRINTF2(...) \
204     do { \
205         if (dev->debug >= usbredirparser_debug_data) { \
206             error_report("usb-redir: " __VA_ARGS__); \
207         } \
208     } while (0)
209 
210 static void usbredir_log(void *priv, int level, const char *msg)
211 {
212     USBRedirDevice *dev = priv;
213 
214     if (dev->debug < level) {
215         return;
216     }
217 
218     error_report("%s", msg);
219 }
220 
221 static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
222     const uint8_t *data, int len)
223 {
224     int i, j, n;
225 
226     if (dev->debug < usbredirparser_debug_data) {
227         return;
228     }
229 
230     for (i = 0; i < len; i += j) {
231         char buf[128];
232 
233         n = sprintf(buf, "%s", desc);
234         for (j = 0; j < 8 && i + j < len; j++) {
235             n += sprintf(buf + n, " %02X", data[i + j]);
236         }
237         error_report("%s", buf);
238     }
239 }
240 
241 /*
242  * usbredirparser io functions
243  */
244 
245 static int usbredir_read(void *priv, uint8_t *data, int count)
246 {
247     USBRedirDevice *dev = priv;
248 
249     if (dev->read_buf_size < count) {
250         count = dev->read_buf_size;
251     }
252 
253     memcpy(data, dev->read_buf, count);
254 
255     dev->read_buf_size -= count;
256     if (dev->read_buf_size) {
257         dev->read_buf += count;
258     } else {
259         dev->read_buf = NULL;
260     }
261 
262     return count;
263 }
264 
265 static gboolean usbredir_write_unblocked(GIOChannel *chan, GIOCondition cond,
266                                          void *opaque)
267 {
268     USBRedirDevice *dev = opaque;
269 
270     dev->watch = 0;
271     usbredirparser_do_write(dev->parser);
272 
273     return FALSE;
274 }
275 
276 static int usbredir_write(void *priv, uint8_t *data, int count)
277 {
278     USBRedirDevice *dev = priv;
279     int r;
280 
281     if (!dev->cs->be_open) {
282         return 0;
283     }
284 
285     /* Don't send new data to the chardev until our state is fully synced */
286     if (!runstate_check(RUN_STATE_RUNNING)) {
287         return 0;
288     }
289 
290     r = qemu_chr_fe_write(dev->cs, data, count);
291     if (r < count) {
292         if (!dev->watch) {
293             dev->watch = qemu_chr_fe_add_watch(dev->cs, G_IO_OUT|G_IO_HUP,
294                                                usbredir_write_unblocked, dev);
295         }
296         if (r < 0) {
297             r = 0;
298         }
299     }
300     return r;
301 }
302 
303 /*
304  * Cancelled and buffered packets helpers
305  */
306 
307 static void packet_id_queue_init(struct PacketIdQueue *q,
308     USBRedirDevice *dev, const char *name)
309 {
310     q->dev = dev;
311     q->name = name;
312     QTAILQ_INIT(&q->head);
313     q->size = 0;
314 }
315 
316 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
317 {
318     USBRedirDevice *dev = q->dev;
319     struct PacketIdQueueEntry *e;
320 
321     DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
322 
323     e = g_malloc0(sizeof(struct PacketIdQueueEntry));
324     e->id = id;
325     QTAILQ_INSERT_TAIL(&q->head, e, next);
326     q->size++;
327 }
328 
329 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
330 {
331     USBRedirDevice *dev = q->dev;
332     struct PacketIdQueueEntry *e;
333 
334     QTAILQ_FOREACH(e, &q->head, next) {
335         if (e->id == id) {
336             DPRINTF("removing packet id %"PRIu64" from %s queue\n",
337                     id, q->name);
338             QTAILQ_REMOVE(&q->head, e, next);
339             q->size--;
340             g_free(e);
341             return 1;
342         }
343     }
344     return 0;
345 }
346 
347 static void packet_id_queue_empty(struct PacketIdQueue *q)
348 {
349     USBRedirDevice *dev = q->dev;
350     struct PacketIdQueueEntry *e, *next_e;
351 
352     DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
353 
354     QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
355         QTAILQ_REMOVE(&q->head, e, next);
356         g_free(e);
357     }
358     q->size = 0;
359 }
360 
361 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
362 {
363     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
364     int i = USBEP2I(p->ep);
365 
366     if (p->combined) {
367         usb_combined_packet_cancel(udev, p);
368         return;
369     }
370 
371     if (dev->endpoint[i].pending_async_packet) {
372         assert(dev->endpoint[i].pending_async_packet == p);
373         dev->endpoint[i].pending_async_packet = NULL;
374         return;
375     }
376 
377     packet_id_queue_add(&dev->cancelled, p->id);
378     usbredirparser_send_cancel_data_packet(dev->parser, p->id);
379     usbredirparser_do_write(dev->parser);
380 }
381 
382 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
383 {
384     if (!dev->dev.attached) {
385         return 1; /* Treat everything as cancelled after a disconnect */
386     }
387     return packet_id_queue_remove(&dev->cancelled, id);
388 }
389 
390 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
391     struct USBEndpoint *ep)
392 {
393     static USBPacket *p;
394 
395     /* async handled packets for bulk receiving eps do not count as inflight */
396     if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
397         return;
398     }
399 
400     QTAILQ_FOREACH(p, &ep->queue, queue) {
401         /* Skip combined packets, except for the first */
402         if (p->combined && p != p->combined->first) {
403             continue;
404         }
405         if (p->state == USB_PACKET_ASYNC) {
406             packet_id_queue_add(&dev->already_in_flight, p->id);
407         }
408     }
409 }
410 
411 static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
412 {
413     int ep;
414     struct USBDevice *udev = &dev->dev;
415 
416     usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
417 
418     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
419         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
420         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
421     }
422 }
423 
424 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
425 {
426     return packet_id_queue_remove(&dev->already_in_flight, id);
427 }
428 
429 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
430     uint8_t ep, uint64_t id)
431 {
432     USBPacket *p;
433 
434     if (usbredir_is_cancelled(dev, id)) {
435         return NULL;
436     }
437 
438     p = usb_ep_find_packet_by_id(&dev->dev,
439                             (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
440                             ep & 0x0f, id);
441     if (p == NULL) {
442         ERROR("could not find packet with id %"PRIu64"\n", id);
443     }
444     return p;
445 }
446 
447 static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
448     uint8_t status, uint8_t ep, void *free_on_destroy)
449 {
450     struct buf_packet *bufp;
451 
452     if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
453         dev->endpoint[EP2I(ep)].bufpq_size >
454             2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
455         DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
456         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
457     }
458     /* Since we're interupting the stream anyways, drop enough packets to get
459        back to our target buffer size */
460     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
461         if (dev->endpoint[EP2I(ep)].bufpq_size >
462                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
463             free(data);
464             return;
465         }
466         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
467     }
468 
469     bufp = g_malloc(sizeof(struct buf_packet));
470     bufp->data   = data;
471     bufp->len    = len;
472     bufp->offset = 0;
473     bufp->status = status;
474     bufp->free_on_destroy = free_on_destroy;
475     QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
476     dev->endpoint[EP2I(ep)].bufpq_size++;
477 }
478 
479 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
480     uint8_t ep)
481 {
482     QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
483     dev->endpoint[EP2I(ep)].bufpq_size--;
484     free(bufp->free_on_destroy);
485     g_free(bufp);
486 }
487 
488 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
489 {
490     struct buf_packet *buf, *buf_next;
491 
492     QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
493         bufp_free(dev, buf, ep);
494     }
495 }
496 
497 /*
498  * USBDevice callbacks
499  */
500 
501 static void usbredir_handle_reset(USBDevice *udev)
502 {
503     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
504 
505     DPRINTF("reset device\n");
506     usbredirparser_send_reset(dev->parser);
507     usbredirparser_do_write(dev->parser);
508 }
509 
510 static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
511                                      uint8_t ep)
512 {
513     int status, len;
514     if (!dev->endpoint[EP2I(ep)].iso_started &&
515             !dev->endpoint[EP2I(ep)].iso_error) {
516         struct usb_redir_start_iso_stream_header start_iso = {
517             .endpoint = ep,
518         };
519         int pkts_per_sec;
520 
521         if (dev->dev.speed == USB_SPEED_HIGH) {
522             pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
523         } else {
524             pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
525         }
526         /* Testing has shown that we need circa 60 ms buffer */
527         dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
528 
529         /* Aim for approx 100 interrupts / second on the client to
530            balance latency and interrupt load */
531         start_iso.pkts_per_urb = pkts_per_sec / 100;
532         if (start_iso.pkts_per_urb < 1) {
533             start_iso.pkts_per_urb = 1;
534         } else if (start_iso.pkts_per_urb > 32) {
535             start_iso.pkts_per_urb = 32;
536         }
537 
538         start_iso.no_urbs = (dev->endpoint[EP2I(ep)].bufpq_target_size +
539                              start_iso.pkts_per_urb - 1) /
540                             start_iso.pkts_per_urb;
541         /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
542            as overflow buffer. Also see the usbredir protocol documentation */
543         if (!(ep & USB_DIR_IN)) {
544             start_iso.no_urbs *= 2;
545         }
546         if (start_iso.no_urbs > 16) {
547             start_iso.no_urbs = 16;
548         }
549 
550         /* No id, we look at the ep when receiving a status back */
551         usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
552         usbredirparser_do_write(dev->parser);
553         DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
554                 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
555         dev->endpoint[EP2I(ep)].iso_started = 1;
556         dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
557         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
558     }
559 
560     if (ep & USB_DIR_IN) {
561         struct buf_packet *isop;
562 
563         if (dev->endpoint[EP2I(ep)].iso_started &&
564                 !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
565             if (dev->endpoint[EP2I(ep)].bufpq_size <
566                     dev->endpoint[EP2I(ep)].bufpq_target_size) {
567                 return;
568             }
569             dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
570         }
571 
572         isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
573         if (isop == NULL) {
574             DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
575                     ep, dev->endpoint[EP2I(ep)].iso_error);
576             /* Re-fill the buffer */
577             dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
578             /* Check iso_error for stream errors, otherwise its an underrun */
579             status = dev->endpoint[EP2I(ep)].iso_error;
580             dev->endpoint[EP2I(ep)].iso_error = 0;
581             p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
582             return;
583         }
584         DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
585                  isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
586 
587         status = isop->status;
588         len = isop->len;
589         if (len > p->iov.size) {
590             ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
591                   ep, len, (int)p->iov.size);
592             len = p->iov.size;
593             status = usb_redir_babble;
594         }
595         usb_packet_copy(p, isop->data, len);
596         bufp_free(dev, isop, ep);
597         usbredir_handle_status(dev, p, status);
598     } else {
599         /* If the stream was not started because of a pending error don't
600            send the packet to the usb-host */
601         if (dev->endpoint[EP2I(ep)].iso_started) {
602             struct usb_redir_iso_packet_header iso_packet = {
603                 .endpoint = ep,
604                 .length = p->iov.size
605             };
606             uint8_t buf[p->iov.size];
607             /* No id, we look at the ep when receiving a status back */
608             usb_packet_copy(p, buf, p->iov.size);
609             usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
610                                            buf, p->iov.size);
611             usbredirparser_do_write(dev->parser);
612         }
613         status = dev->endpoint[EP2I(ep)].iso_error;
614         dev->endpoint[EP2I(ep)].iso_error = 0;
615         DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
616                  p->iov.size);
617         usbredir_handle_status(dev, p, status);
618     }
619 }
620 
621 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
622 {
623     struct usb_redir_stop_iso_stream_header stop_iso_stream = {
624         .endpoint = ep
625     };
626     if (dev->endpoint[EP2I(ep)].iso_started) {
627         usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
628         DPRINTF("iso stream stopped ep %02X\n", ep);
629         dev->endpoint[EP2I(ep)].iso_started = 0;
630     }
631     dev->endpoint[EP2I(ep)].iso_error = 0;
632     usbredir_free_bufpq(dev, ep);
633 }
634 
635 /*
636  * The usb-host may poll the endpoint faster then our guest, resulting in lots
637  * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
638  * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
639  */
640 static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
641     struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
642 {
643     usb_packet_copy(p, bulkp->data + bulkp->offset, count);
644     bulkp->offset += count;
645     if (bulkp->offset == bulkp->len) {
646         /* Store status in the last packet with data from this bulkp */
647         usbredir_handle_status(dev, p, bulkp->status);
648         bufp_free(dev, bulkp, ep);
649     }
650 }
651 
652 static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
653     USBPacket *p, uint8_t ep)
654 {
655     struct buf_packet *bulkp;
656     int count;
657 
658     while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
659            p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
660         count = bulkp->len - bulkp->offset;
661         if (count > (p->iov.size - p->actual_length)) {
662             count = p->iov.size - p->actual_length;
663         }
664         usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
665     }
666 }
667 
668 static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
669     USBPacket *p, uint8_t ep)
670 {
671     const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
672     uint8_t header[2] = { 0, 0 };
673     struct buf_packet *bulkp;
674     int count;
675 
676     while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
677            p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
678         if (bulkp->len < 2) {
679             WARNING("malformed ftdi bulk in packet\n");
680             bufp_free(dev, bulkp, ep);
681             continue;
682         }
683 
684         if ((p->actual_length % maxp) == 0) {
685             usb_packet_copy(p, bulkp->data, 2);
686             memcpy(header, bulkp->data, 2);
687         } else {
688             if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
689                 break; /* Different header, add to next packet */
690             }
691         }
692 
693         if (bulkp->offset == 0) {
694             bulkp->offset = 2; /* Skip header */
695         }
696         count = bulkp->len - bulkp->offset;
697         /* Must repeat the header at maxp interval */
698         if (count > (maxp - (p->actual_length % maxp))) {
699             count = maxp - (p->actual_length % maxp);
700         }
701         usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
702     }
703 }
704 
705 static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
706     USBPacket *p, uint8_t ep)
707 {
708     p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
709     dev->buffered_bulk_in_complete(dev, p, ep);
710     DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
711             ep, p->status, p->actual_length, p->id);
712 }
713 
714 static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
715     USBPacket *p, uint8_t ep)
716 {
717     /* Input bulk endpoint, buffered packet input */
718     if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
719         int bpt;
720         struct usb_redir_start_bulk_receiving_header start = {
721             .endpoint = ep,
722             .stream_id = 0,
723             .no_transfers = 5,
724         };
725         /* Round bytes_per_transfer up to a multiple of max_packet_size */
726         bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
727         bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
728         bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
729         start.bytes_per_transfer = bpt;
730         /* No id, we look at the ep when receiving a status back */
731         usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
732         usbredirparser_do_write(dev->parser);
733         DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
734                 start.bytes_per_transfer, start.no_transfers, ep);
735         dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
736         /* We don't really want to drop bulk packets ever, but
737            having some upper limit to how much we buffer is good. */
738         dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
739         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
740     }
741 
742     if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
743         DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
744         assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
745         dev->endpoint[EP2I(ep)].pending_async_packet = p;
746         p->status = USB_RET_ASYNC;
747         return;
748     }
749     usbredir_buffered_bulk_in_complete(dev, p, ep);
750 }
751 
752 static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
753 {
754     struct usb_redir_stop_bulk_receiving_header stop_bulk = {
755         .endpoint = ep,
756         .stream_id = 0,
757     };
758     if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
759         usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
760         DPRINTF("bulk receiving stopped ep %02X\n", ep);
761         dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
762     }
763     usbredir_free_bufpq(dev, ep);
764 }
765 
766 static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
767                                       uint8_t ep)
768 {
769     struct usb_redir_bulk_packet_header bulk_packet;
770     size_t size = usb_packet_size(p);
771     const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
772 
773     if (usbredir_already_in_flight(dev, p->id)) {
774         p->status = USB_RET_ASYNC;
775         return;
776     }
777 
778     if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
779         if (size != 0 && (size % maxp) == 0) {
780             usbredir_handle_buffered_bulk_in_data(dev, p, ep);
781             return;
782         }
783         WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
784         assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
785         usbredir_stop_bulk_receiving(dev, ep);
786         dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
787     }
788 
789     DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
790             ep, p->stream, size, p->id);
791 
792     bulk_packet.endpoint  = ep;
793     bulk_packet.length    = size;
794     bulk_packet.stream_id = p->stream;
795     bulk_packet.length_high = size >> 16;
796     assert(bulk_packet.length_high == 0 ||
797            usbredirparser_peer_has_cap(dev->parser,
798                                        usb_redir_cap_32bits_bulk_length));
799 
800     if (ep & USB_DIR_IN) {
801         usbredirparser_send_bulk_packet(dev->parser, p->id,
802                                         &bulk_packet, NULL, 0);
803     } else {
804         uint8_t buf[size];
805         usb_packet_copy(p, buf, size);
806         usbredir_log_data(dev, "bulk data out:", buf, size);
807         usbredirparser_send_bulk_packet(dev->parser, p->id,
808                                         &bulk_packet, buf, size);
809     }
810     usbredirparser_do_write(dev->parser);
811     p->status = USB_RET_ASYNC;
812 }
813 
814 static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
815                                               USBPacket *p, uint8_t ep)
816 {
817     /* Input interrupt endpoint, buffered packet input */
818     struct buf_packet *intp;
819     int status, len;
820 
821     if (!dev->endpoint[EP2I(ep)].interrupt_started &&
822             !dev->endpoint[EP2I(ep)].interrupt_error) {
823         struct usb_redir_start_interrupt_receiving_header start_int = {
824             .endpoint = ep,
825         };
826         /* No id, we look at the ep when receiving a status back */
827         usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
828                                                       &start_int);
829         usbredirparser_do_write(dev->parser);
830         DPRINTF("interrupt recv started ep %02X\n", ep);
831         dev->endpoint[EP2I(ep)].interrupt_started = 1;
832         /* We don't really want to drop interrupt packets ever, but
833            having some upper limit to how much we buffer is good. */
834         dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
835         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
836     }
837 
838     intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
839     if (intp == NULL) {
840         DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep);
841         /* Check interrupt_error for stream errors */
842         status = dev->endpoint[EP2I(ep)].interrupt_error;
843         dev->endpoint[EP2I(ep)].interrupt_error = 0;
844         if (status) {
845             usbredir_handle_status(dev, p, status);
846         } else {
847             p->status = USB_RET_NAK;
848         }
849         return;
850     }
851     DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep,
852             intp->status, intp->len);
853 
854     status = intp->status;
855     len = intp->len;
856     if (len > p->iov.size) {
857         ERROR("received int data is larger then packet ep %02X\n", ep);
858         len = p->iov.size;
859         status = usb_redir_babble;
860     }
861     usb_packet_copy(p, intp->data, len);
862     bufp_free(dev, intp, ep);
863     usbredir_handle_status(dev, p, status);
864 }
865 
866 /*
867  * Handle interrupt out data, the usbredir protocol expects us to do this
868  * async, so that it can report back a completion status. But guests will
869  * expect immediate completion for an interrupt endpoint, and handling this
870  * async causes migration issues. So we report success directly, counting
871  * on the fact that output interrupt packets normally always succeed.
872  */
873 static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
874                                                USBPacket *p, uint8_t ep)
875 {
876     struct usb_redir_interrupt_packet_header interrupt_packet;
877     uint8_t buf[p->iov.size];
878 
879     DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
880             p->iov.size, p->id);
881 
882     interrupt_packet.endpoint  = ep;
883     interrupt_packet.length    = p->iov.size;
884 
885     usb_packet_copy(p, buf, p->iov.size);
886     usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
887     usbredirparser_send_interrupt_packet(dev->parser, p->id,
888                                     &interrupt_packet, buf, p->iov.size);
889     usbredirparser_do_write(dev->parser);
890 }
891 
892 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
893     uint8_t ep)
894 {
895     struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
896         .endpoint = ep
897     };
898     if (dev->endpoint[EP2I(ep)].interrupt_started) {
899         usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
900                                                      &stop_interrupt_recv);
901         DPRINTF("interrupt recv stopped ep %02X\n", ep);
902         dev->endpoint[EP2I(ep)].interrupt_started = 0;
903     }
904     dev->endpoint[EP2I(ep)].interrupt_error = 0;
905     usbredir_free_bufpq(dev, ep);
906 }
907 
908 static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
909 {
910     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
911     uint8_t ep;
912 
913     ep = p->ep->nr;
914     if (p->pid == USB_TOKEN_IN) {
915         ep |= USB_DIR_IN;
916     }
917 
918     switch (dev->endpoint[EP2I(ep)].type) {
919     case USB_ENDPOINT_XFER_CONTROL:
920         ERROR("handle_data called for control transfer on ep %02X\n", ep);
921         p->status = USB_RET_NAK;
922         break;
923     case USB_ENDPOINT_XFER_BULK:
924         if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
925                 p->ep->pipeline) {
926             p->status = USB_RET_ADD_TO_QUEUE;
927             break;
928         }
929         usbredir_handle_bulk_data(dev, p, ep);
930         break;
931     case USB_ENDPOINT_XFER_ISOC:
932         usbredir_handle_iso_data(dev, p, ep);
933         break;
934     case USB_ENDPOINT_XFER_INT:
935         if (ep & USB_DIR_IN) {
936             usbredir_handle_interrupt_in_data(dev, p, ep);
937         } else {
938             usbredir_handle_interrupt_out_data(dev, p, ep);
939         }
940         break;
941     default:
942         ERROR("handle_data ep %02X has unknown type %d\n", ep,
943               dev->endpoint[EP2I(ep)].type);
944         p->status = USB_RET_NAK;
945     }
946 }
947 
948 static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
949 {
950     if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
951         usb_ep_combine_input_packets(ep);
952     }
953 }
954 
955 static void usbredir_stop_ep(USBRedirDevice *dev, int i)
956 {
957     uint8_t ep = I2EP(i);
958 
959     switch (dev->endpoint[i].type) {
960     case USB_ENDPOINT_XFER_BULK:
961         if (ep & USB_DIR_IN) {
962             usbredir_stop_bulk_receiving(dev, ep);
963         }
964         break;
965     case USB_ENDPOINT_XFER_ISOC:
966         usbredir_stop_iso_stream(dev, ep);
967         break;
968     case USB_ENDPOINT_XFER_INT:
969         if (ep & USB_DIR_IN) {
970             usbredir_stop_interrupt_receiving(dev, ep);
971         }
972         break;
973     }
974     usbredir_free_bufpq(dev, ep);
975 }
976 
977 static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
978 {
979     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
980 
981     usbredir_stop_ep(dev, USBEP2I(uep));
982     usbredirparser_do_write(dev->parser);
983 }
984 
985 static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
986                                 int config)
987 {
988     struct usb_redir_set_configuration_header set_config;
989     int i;
990 
991     DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
992 
993     for (i = 0; i < MAX_ENDPOINTS; i++) {
994         usbredir_stop_ep(dev, i);
995     }
996 
997     set_config.configuration = config;
998     usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
999     usbredirparser_do_write(dev->parser);
1000     p->status = USB_RET_ASYNC;
1001 }
1002 
1003 static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1004 {
1005     DPRINTF("get config id %"PRIu64"\n", p->id);
1006 
1007     usbredirparser_send_get_configuration(dev->parser, p->id);
1008     usbredirparser_do_write(dev->parser);
1009     p->status = USB_RET_ASYNC;
1010 }
1011 
1012 static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1013                                    int interface, int alt)
1014 {
1015     struct usb_redir_set_alt_setting_header set_alt;
1016     int i;
1017 
1018     DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1019 
1020     for (i = 0; i < MAX_ENDPOINTS; i++) {
1021         if (dev->endpoint[i].interface == interface) {
1022             usbredir_stop_ep(dev, i);
1023         }
1024     }
1025 
1026     set_alt.interface = interface;
1027     set_alt.alt = alt;
1028     usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1029     usbredirparser_do_write(dev->parser);
1030     p->status = USB_RET_ASYNC;
1031 }
1032 
1033 static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1034                                    int interface)
1035 {
1036     struct usb_redir_get_alt_setting_header get_alt;
1037 
1038     DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1039 
1040     get_alt.interface = interface;
1041     usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1042     usbredirparser_do_write(dev->parser);
1043     p->status = USB_RET_ASYNC;
1044 }
1045 
1046 static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1047         int request, int value, int index, int length, uint8_t *data)
1048 {
1049     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1050     struct usb_redir_control_packet_header control_packet;
1051 
1052     if (usbredir_already_in_flight(dev, p->id)) {
1053         p->status = USB_RET_ASYNC;
1054         return;
1055     }
1056 
1057     /* Special cases for certain standard device requests */
1058     switch (request) {
1059     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1060         DPRINTF("set address %d\n", value);
1061         dev->dev.addr = value;
1062         return;
1063     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1064         usbredir_set_config(dev, p, value & 0xff);
1065         return;
1066     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1067         usbredir_get_config(dev, p);
1068         return;
1069     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1070         usbredir_set_interface(dev, p, index, value);
1071         return;
1072     case InterfaceRequest | USB_REQ_GET_INTERFACE:
1073         usbredir_get_interface(dev, p, index);
1074         return;
1075     }
1076 
1077     /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1078     DPRINTF(
1079         "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1080         request >> 8, request & 0xff, value, index, length, p->id);
1081 
1082     control_packet.request     = request & 0xFF;
1083     control_packet.requesttype = request >> 8;
1084     control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
1085     control_packet.value       = value;
1086     control_packet.index       = index;
1087     control_packet.length      = length;
1088 
1089     if (control_packet.requesttype & USB_DIR_IN) {
1090         usbredirparser_send_control_packet(dev->parser, p->id,
1091                                            &control_packet, NULL, 0);
1092     } else {
1093         usbredir_log_data(dev, "ctrl data out:", data, length);
1094         usbredirparser_send_control_packet(dev->parser, p->id,
1095                                            &control_packet, data, length);
1096     }
1097     usbredirparser_do_write(dev->parser);
1098     p->status = USB_RET_ASYNC;
1099 }
1100 
1101 static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1102                                   int nr_eps, int streams)
1103 {
1104     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1105 #if USBREDIR_VERSION >= 0x000700
1106     struct usb_redir_alloc_bulk_streams_header alloc_streams;
1107     int i;
1108 
1109     if (!usbredirparser_peer_has_cap(dev->parser,
1110                                      usb_redir_cap_bulk_streams)) {
1111         ERROR("peer does not support streams\n");
1112         goto reject;
1113     }
1114 
1115     if (streams == 0) {
1116         ERROR("request to allocate 0 streams\n");
1117         return -1;
1118     }
1119 
1120     alloc_streams.no_streams = streams;
1121     alloc_streams.endpoints = 0;
1122     for (i = 0; i < nr_eps; i++) {
1123         alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1124     }
1125     usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1126     usbredirparser_do_write(dev->parser);
1127 
1128     return 0;
1129 #else
1130     ERROR("usbredir_alloc_streams not implemented\n");
1131     goto reject;
1132 #endif
1133 reject:
1134     ERROR("streams are not available, disconnecting\n");
1135     qemu_bh_schedule(dev->device_reject_bh);
1136     return -1;
1137 }
1138 
1139 static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1140                                   int nr_eps)
1141 {
1142 #if USBREDIR_VERSION >= 0x000700
1143     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1144     struct usb_redir_free_bulk_streams_header free_streams;
1145     int i;
1146 
1147     if (!usbredirparser_peer_has_cap(dev->parser,
1148                                      usb_redir_cap_bulk_streams)) {
1149         return;
1150     }
1151 
1152     free_streams.endpoints = 0;
1153     for (i = 0; i < nr_eps; i++) {
1154         free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1155     }
1156     usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1157     usbredirparser_do_write(dev->parser);
1158 #endif
1159 }
1160 
1161 /*
1162  * Close events can be triggered by usbredirparser_do_write which gets called
1163  * from within the USBDevice data / control packet callbacks and doing a
1164  * usb_detach from within these callbacks is not a good idea.
1165  *
1166  * So we use a bh handler to take care of close events.
1167  */
1168 static void usbredir_chardev_close_bh(void *opaque)
1169 {
1170     USBRedirDevice *dev = opaque;
1171 
1172     qemu_bh_cancel(dev->device_reject_bh);
1173     usbredir_device_disconnect(dev);
1174 
1175     if (dev->parser) {
1176         DPRINTF("destroying usbredirparser\n");
1177         usbredirparser_destroy(dev->parser);
1178         dev->parser = NULL;
1179     }
1180     if (dev->watch) {
1181         g_source_remove(dev->watch);
1182         dev->watch = 0;
1183     }
1184 }
1185 
1186 static void usbredir_create_parser(USBRedirDevice *dev)
1187 {
1188     uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1189     int flags = 0;
1190 
1191     DPRINTF("creating usbredirparser\n");
1192 
1193     dev->parser = qemu_oom_check(usbredirparser_create());
1194     dev->parser->priv = dev;
1195     dev->parser->log_func = usbredir_log;
1196     dev->parser->read_func = usbredir_read;
1197     dev->parser->write_func = usbredir_write;
1198     dev->parser->hello_func = usbredir_hello;
1199     dev->parser->device_connect_func = usbredir_device_connect;
1200     dev->parser->device_disconnect_func = usbredir_device_disconnect;
1201     dev->parser->interface_info_func = usbredir_interface_info;
1202     dev->parser->ep_info_func = usbredir_ep_info;
1203     dev->parser->configuration_status_func = usbredir_configuration_status;
1204     dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1205     dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1206     dev->parser->interrupt_receiving_status_func =
1207         usbredir_interrupt_receiving_status;
1208     dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1209     dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1210     dev->parser->control_packet_func = usbredir_control_packet;
1211     dev->parser->bulk_packet_func = usbredir_bulk_packet;
1212     dev->parser->iso_packet_func = usbredir_iso_packet;
1213     dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1214     dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1215     dev->read_buf = NULL;
1216     dev->read_buf_size = 0;
1217 
1218     usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1219     usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1220     usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1221     usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1222     usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1223     usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1224 #if USBREDIR_VERSION >= 0x000700
1225     usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1226 #endif
1227 
1228     if (runstate_check(RUN_STATE_INMIGRATE)) {
1229         flags |= usbredirparser_fl_no_hello;
1230     }
1231     usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1232                         flags);
1233     usbredirparser_do_write(dev->parser);
1234 }
1235 
1236 static void usbredir_reject_device(USBRedirDevice *dev)
1237 {
1238     usbredir_device_disconnect(dev);
1239     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1240         usbredirparser_send_filter_reject(dev->parser);
1241         usbredirparser_do_write(dev->parser);
1242     }
1243 }
1244 
1245 /*
1246  * We may need to reject the device when the hcd calls alloc_streams, doing
1247  * an usb_detach from within a hcd call is not a good idea, hence this bh.
1248  */
1249 static void usbredir_device_reject_bh(void *opaque)
1250 {
1251     USBRedirDevice *dev = opaque;
1252 
1253     usbredir_reject_device(dev);
1254 }
1255 
1256 static void usbredir_do_attach(void *opaque)
1257 {
1258     USBRedirDevice *dev = opaque;
1259     Error *local_err = NULL;
1260 
1261     /* In order to work properly with XHCI controllers we need these caps */
1262     if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1263         usbredirparser_peer_has_cap(dev->parser,
1264                                     usb_redir_cap_ep_info_max_packet_size) &&
1265         usbredirparser_peer_has_cap(dev->parser,
1266                                     usb_redir_cap_32bits_bulk_length) &&
1267         usbredirparser_peer_has_cap(dev->parser,
1268                                     usb_redir_cap_64bits_ids))) {
1269         ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1270         usbredir_reject_device(dev);
1271         return;
1272     }
1273 
1274     usb_device_attach(&dev->dev, &local_err);
1275     if (local_err) {
1276         error_report_err(local_err);
1277         WARNING("rejecting device due to speed mismatch\n");
1278         usbredir_reject_device(dev);
1279     }
1280 }
1281 
1282 /*
1283  * chardev callbacks
1284  */
1285 
1286 static int usbredir_chardev_can_read(void *opaque)
1287 {
1288     USBRedirDevice *dev = opaque;
1289 
1290     if (!dev->parser) {
1291         WARNING("chardev_can_read called on non open chardev!\n");
1292         return 0;
1293     }
1294 
1295     /* Don't read new data from the chardev until our state is fully synced */
1296     if (!runstate_check(RUN_STATE_RUNNING)) {
1297         return 0;
1298     }
1299 
1300     /* usbredir_parser_do_read will consume *all* data we give it */
1301     return 1024 * 1024;
1302 }
1303 
1304 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1305 {
1306     USBRedirDevice *dev = opaque;
1307 
1308     /* No recursion allowed! */
1309     assert(dev->read_buf == NULL);
1310 
1311     dev->read_buf = buf;
1312     dev->read_buf_size = size;
1313 
1314     usbredirparser_do_read(dev->parser);
1315     /* Send any acks, etc. which may be queued now */
1316     usbredirparser_do_write(dev->parser);
1317 }
1318 
1319 static void usbredir_chardev_event(void *opaque, int event)
1320 {
1321     USBRedirDevice *dev = opaque;
1322 
1323     switch (event) {
1324     case CHR_EVENT_OPENED:
1325         DPRINTF("chardev open\n");
1326         /* Make sure any pending closes are handled (no-op if none pending) */
1327         usbredir_chardev_close_bh(dev);
1328         qemu_bh_cancel(dev->chardev_close_bh);
1329         usbredir_create_parser(dev);
1330         break;
1331     case CHR_EVENT_CLOSED:
1332         DPRINTF("chardev close\n");
1333         qemu_bh_schedule(dev->chardev_close_bh);
1334         break;
1335     }
1336 }
1337 
1338 /*
1339  * init + destroy
1340  */
1341 
1342 static void usbredir_vm_state_change(void *priv, int running, RunState state)
1343 {
1344     USBRedirDevice *dev = priv;
1345 
1346     if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
1347         usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1348     }
1349 }
1350 
1351 static void usbredir_init_endpoints(USBRedirDevice *dev)
1352 {
1353     int i;
1354 
1355     usb_ep_init(&dev->dev);
1356     memset(dev->endpoint, 0, sizeof(dev->endpoint));
1357     for (i = 0; i < MAX_ENDPOINTS; i++) {
1358         dev->endpoint[i].dev = dev;
1359         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1360     }
1361 }
1362 
1363 static void usbredir_realize(USBDevice *udev, Error **errp)
1364 {
1365     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1366     int i;
1367 
1368     if (dev->cs == NULL) {
1369         error_set(errp, QERR_MISSING_PARAMETER, "chardev");
1370         return;
1371     }
1372 
1373     if (dev->filter_str) {
1374         i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1375                                            &dev->filter_rules,
1376                                            &dev->filter_rules_count);
1377         if (i) {
1378             error_set(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1379                       "a usb device filter string");
1380             return;
1381         }
1382     }
1383 
1384     dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
1385     dev->device_reject_bh = qemu_bh_new(usbredir_device_reject_bh, dev);
1386     dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1387 
1388     packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1389     packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1390     usbredir_init_endpoints(dev);
1391 
1392     /* We'll do the attach once we receive the speed from the usb-host */
1393     udev->auto_attach = 0;
1394 
1395     /* Will be cleared during setup when we find conflicts */
1396     dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1397 
1398     /* Let the backend know we are ready */
1399     qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read,
1400                           usbredir_chardev_read, usbredir_chardev_event, dev);
1401 
1402     qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1403 }
1404 
1405 static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1406 {
1407     int i;
1408 
1409     packet_id_queue_empty(&dev->cancelled);
1410     packet_id_queue_empty(&dev->already_in_flight);
1411     for (i = 0; i < MAX_ENDPOINTS; i++) {
1412         usbredir_free_bufpq(dev, I2EP(i));
1413     }
1414 }
1415 
1416 static void usbredir_handle_destroy(USBDevice *udev)
1417 {
1418     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1419 
1420     qemu_chr_delete(dev->cs);
1421     dev->cs = NULL;
1422     /* Note must be done after qemu_chr_close, as that causes a close event */
1423     qemu_bh_delete(dev->chardev_close_bh);
1424     qemu_bh_delete(dev->device_reject_bh);
1425 
1426     timer_del(dev->attach_timer);
1427     timer_free(dev->attach_timer);
1428 
1429     usbredir_cleanup_device_queues(dev);
1430 
1431     if (dev->parser) {
1432         usbredirparser_destroy(dev->parser);
1433     }
1434     if (dev->watch) {
1435         g_source_remove(dev->watch);
1436     }
1437 
1438     free(dev->filter_rules);
1439 }
1440 
1441 static int usbredir_check_filter(USBRedirDevice *dev)
1442 {
1443     if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1444         ERROR("No interface info for device\n");
1445         goto error;
1446     }
1447 
1448     if (dev->filter_rules) {
1449         if (!usbredirparser_peer_has_cap(dev->parser,
1450                                     usb_redir_cap_connect_device_version)) {
1451             ERROR("Device filter specified and peer does not have the "
1452                   "connect_device_version capability\n");
1453             goto error;
1454         }
1455 
1456         if (usbredirfilter_check(
1457                 dev->filter_rules,
1458                 dev->filter_rules_count,
1459                 dev->device_info.device_class,
1460                 dev->device_info.device_subclass,
1461                 dev->device_info.device_protocol,
1462                 dev->interface_info.interface_class,
1463                 dev->interface_info.interface_subclass,
1464                 dev->interface_info.interface_protocol,
1465                 dev->interface_info.interface_count,
1466                 dev->device_info.vendor_id,
1467                 dev->device_info.product_id,
1468                 dev->device_info.device_version_bcd,
1469                 0) != 0) {
1470             goto error;
1471         }
1472     }
1473 
1474     return 0;
1475 
1476 error:
1477     usbredir_reject_device(dev);
1478     return -1;
1479 }
1480 
1481 static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1482 {
1483     int i, j, quirks;
1484 
1485     if (!usbredirparser_peer_has_cap(dev->parser,
1486                                      usb_redir_cap_bulk_receiving)) {
1487         return;
1488     }
1489 
1490     for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1491         dev->endpoint[i].bulk_receiving_enabled = 0;
1492     }
1493     for (i = 0; i < dev->interface_info.interface_count; i++) {
1494         quirks = usb_get_quirks(dev->device_info.vendor_id,
1495                                 dev->device_info.product_id,
1496                                 dev->interface_info.interface_class[i],
1497                                 dev->interface_info.interface_subclass[i],
1498                                 dev->interface_info.interface_protocol[i]);
1499         if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1500             continue;
1501         }
1502         if (quirks & USB_QUIRK_IS_FTDI) {
1503             dev->buffered_bulk_in_complete =
1504                 usbredir_buffered_bulk_in_complete_ftdi;
1505         } else {
1506             dev->buffered_bulk_in_complete =
1507                 usbredir_buffered_bulk_in_complete_raw;
1508         }
1509 
1510         for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1511             if (dev->endpoint[j].interface ==
1512                                     dev->interface_info.interface[i] &&
1513                     dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1514                     dev->endpoint[j].max_packet_size != 0) {
1515                 dev->endpoint[j].bulk_receiving_enabled = 1;
1516                 /*
1517                  * With buffering pipelining is not necessary. Also packet
1518                  * combining and bulk in buffering don't play nice together!
1519                  */
1520                 I2USBEP(dev, j)->pipeline = false;
1521                 break; /* Only buffer for the first ep of each intf */
1522             }
1523         }
1524     }
1525 }
1526 
1527 /*
1528  * usbredirparser packet complete callbacks
1529  */
1530 
1531 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1532     int status)
1533 {
1534     switch (status) {
1535     case usb_redir_success:
1536         p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1537         break;
1538     case usb_redir_stall:
1539         p->status = USB_RET_STALL;
1540         break;
1541     case usb_redir_cancelled:
1542         /*
1543          * When the usbredir-host unredirects a device, it will report a status
1544          * of cancelled for all pending packets, followed by a disconnect msg.
1545          */
1546         p->status = USB_RET_IOERROR;
1547         break;
1548     case usb_redir_inval:
1549         WARNING("got invalid param error from usb-host?\n");
1550         p->status = USB_RET_IOERROR;
1551         break;
1552     case usb_redir_babble:
1553         p->status = USB_RET_BABBLE;
1554         break;
1555     case usb_redir_ioerror:
1556     case usb_redir_timeout:
1557     default:
1558         p->status = USB_RET_IOERROR;
1559     }
1560 }
1561 
1562 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1563 {
1564     USBRedirDevice *dev = priv;
1565 
1566     /* Try to send the filter info now that we've the usb-host's caps */
1567     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1568             dev->filter_rules) {
1569         usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1570                                           dev->filter_rules_count);
1571         usbredirparser_do_write(dev->parser);
1572     }
1573 }
1574 
1575 static void usbredir_device_connect(void *priv,
1576     struct usb_redir_device_connect_header *device_connect)
1577 {
1578     USBRedirDevice *dev = priv;
1579     const char *speed;
1580 
1581     if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1582         ERROR("Received device connect while already connected\n");
1583         return;
1584     }
1585 
1586     switch (device_connect->speed) {
1587     case usb_redir_speed_low:
1588         speed = "low speed";
1589         dev->dev.speed = USB_SPEED_LOW;
1590         dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1591         dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1592         break;
1593     case usb_redir_speed_full:
1594         speed = "full speed";
1595         dev->dev.speed = USB_SPEED_FULL;
1596         dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1597         break;
1598     case usb_redir_speed_high:
1599         speed = "high speed";
1600         dev->dev.speed = USB_SPEED_HIGH;
1601         break;
1602     case usb_redir_speed_super:
1603         speed = "super speed";
1604         dev->dev.speed = USB_SPEED_SUPER;
1605         break;
1606     default:
1607         speed = "unknown speed";
1608         dev->dev.speed = USB_SPEED_FULL;
1609     }
1610 
1611     if (usbredirparser_peer_has_cap(dev->parser,
1612                                     usb_redir_cap_connect_device_version)) {
1613         INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1614              speed, device_connect->vendor_id, device_connect->product_id,
1615              ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1616              ((device_connect->device_version_bcd & 0x0f00) >>  8),
1617              ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1618              ((device_connect->device_version_bcd & 0x000f) >>  0),
1619              device_connect->device_class);
1620     } else {
1621         INFO("attaching %s device %04x:%04x class %02x\n", speed,
1622              device_connect->vendor_id, device_connect->product_id,
1623              device_connect->device_class);
1624     }
1625 
1626     dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1627     dev->device_info = *device_connect;
1628 
1629     if (usbredir_check_filter(dev)) {
1630         WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1631                 device_connect->vendor_id, device_connect->product_id);
1632         return;
1633     }
1634 
1635     usbredir_check_bulk_receiving(dev);
1636     timer_mod(dev->attach_timer, dev->next_attach_time);
1637 }
1638 
1639 static void usbredir_device_disconnect(void *priv)
1640 {
1641     USBRedirDevice *dev = priv;
1642 
1643     /* Stop any pending attaches */
1644     timer_del(dev->attach_timer);
1645 
1646     if (dev->dev.attached) {
1647         DPRINTF("detaching device\n");
1648         usb_device_detach(&dev->dev);
1649         /*
1650          * Delay next usb device attach to give the guest a chance to see
1651          * see the detach / attach in case of quick close / open succession
1652          */
1653         dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1654     }
1655 
1656     /* Reset state so that the next dev connected starts with a clean slate */
1657     usbredir_cleanup_device_queues(dev);
1658     usbredir_init_endpoints(dev);
1659     dev->interface_info.interface_count = NO_INTERFACE_INFO;
1660     dev->dev.addr = 0;
1661     dev->dev.speed = 0;
1662     dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1663 }
1664 
1665 static void usbredir_interface_info(void *priv,
1666     struct usb_redir_interface_info_header *interface_info)
1667 {
1668     USBRedirDevice *dev = priv;
1669 
1670     dev->interface_info = *interface_info;
1671 
1672     /*
1673      * If we receive interface info after the device has already been
1674      * connected (ie on a set_config), re-check interface dependent things.
1675      */
1676     if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1677         usbredir_check_bulk_receiving(dev);
1678         if (usbredir_check_filter(dev)) {
1679             ERROR("Device no longer matches filter after interface info "
1680                   "change, disconnecting!\n");
1681         }
1682     }
1683 }
1684 
1685 static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1686 {
1687     dev->compatible_speedmask &= ~(1 << speed);
1688     dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1689 }
1690 
1691 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1692 {
1693     if (uep->type != USB_ENDPOINT_XFER_BULK) {
1694         return;
1695     }
1696     if (uep->pid == USB_TOKEN_OUT) {
1697         uep->pipeline = true;
1698     }
1699     if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1700         usbredirparser_peer_has_cap(dev->parser,
1701                                     usb_redir_cap_32bits_bulk_length)) {
1702         uep->pipeline = true;
1703     }
1704 }
1705 
1706 static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1707 {
1708     struct USBEndpoint *usb_ep;
1709     int i;
1710 
1711     for (i = 0; i < MAX_ENDPOINTS; i++) {
1712         usb_ep = I2USBEP(dev, i);
1713         usb_ep->type = dev->endpoint[i].type;
1714         usb_ep->ifnum = dev->endpoint[i].interface;
1715         usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1716         usb_ep->max_streams = dev->endpoint[i].max_streams;
1717         usbredir_set_pipeline(dev, usb_ep);
1718     }
1719 }
1720 
1721 static void usbredir_ep_info(void *priv,
1722     struct usb_redir_ep_info_header *ep_info)
1723 {
1724     USBRedirDevice *dev = priv;
1725     int i;
1726 
1727     for (i = 0; i < MAX_ENDPOINTS; i++) {
1728         dev->endpoint[i].type = ep_info->type[i];
1729         dev->endpoint[i].interval = ep_info->interval[i];
1730         dev->endpoint[i].interface = ep_info->interface[i];
1731         if (usbredirparser_peer_has_cap(dev->parser,
1732                                      usb_redir_cap_ep_info_max_packet_size)) {
1733             dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1734         }
1735 #if USBREDIR_VERSION >= 0x000700
1736         if (usbredirparser_peer_has_cap(dev->parser,
1737                                         usb_redir_cap_bulk_streams)) {
1738             dev->endpoint[i].max_streams = ep_info->max_streams[i];
1739         }
1740 #endif
1741         switch (dev->endpoint[i].type) {
1742         case usb_redir_type_invalid:
1743             break;
1744         case usb_redir_type_iso:
1745             usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1746             usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1747             /* Fall through */
1748         case usb_redir_type_interrupt:
1749             if (!usbredirparser_peer_has_cap(dev->parser,
1750                                      usb_redir_cap_ep_info_max_packet_size) ||
1751                     ep_info->max_packet_size[i] > 64) {
1752                 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1753             }
1754             if (!usbredirparser_peer_has_cap(dev->parser,
1755                                      usb_redir_cap_ep_info_max_packet_size) ||
1756                     ep_info->max_packet_size[i] > 1024) {
1757                 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1758             }
1759             if (dev->endpoint[i].interval == 0) {
1760                 ERROR("Received 0 interval for isoc or irq endpoint\n");
1761                 usbredir_reject_device(dev);
1762                 return;
1763             }
1764             /* Fall through */
1765         case usb_redir_type_control:
1766         case usb_redir_type_bulk:
1767             DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1768                     dev->endpoint[i].type, dev->endpoint[i].interface);
1769             break;
1770         default:
1771             ERROR("Received invalid endpoint type\n");
1772             usbredir_reject_device(dev);
1773             return;
1774         }
1775     }
1776     /* The new ep info may have caused a speed incompatibility, recheck */
1777     if (dev->dev.attached &&
1778             !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1779         ERROR("Device no longer matches speed after endpoint info change, "
1780               "disconnecting!\n");
1781         usbredir_reject_device(dev);
1782         return;
1783     }
1784     usbredir_setup_usb_eps(dev);
1785     usbredir_check_bulk_receiving(dev);
1786 }
1787 
1788 static void usbredir_configuration_status(void *priv, uint64_t id,
1789     struct usb_redir_configuration_status_header *config_status)
1790 {
1791     USBRedirDevice *dev = priv;
1792     USBPacket *p;
1793 
1794     DPRINTF("set config status %d config %d id %"PRIu64"\n",
1795             config_status->status, config_status->configuration, id);
1796 
1797     p = usbredir_find_packet_by_id(dev, 0, id);
1798     if (p) {
1799         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1800             dev->dev.data_buf[0] = config_status->configuration;
1801             p->actual_length = 1;
1802         }
1803         usbredir_handle_status(dev, p, config_status->status);
1804         usb_generic_async_ctrl_complete(&dev->dev, p);
1805     }
1806 }
1807 
1808 static void usbredir_alt_setting_status(void *priv, uint64_t id,
1809     struct usb_redir_alt_setting_status_header *alt_setting_status)
1810 {
1811     USBRedirDevice *dev = priv;
1812     USBPacket *p;
1813 
1814     DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1815             alt_setting_status->status, alt_setting_status->interface,
1816             alt_setting_status->alt, id);
1817 
1818     p = usbredir_find_packet_by_id(dev, 0, id);
1819     if (p) {
1820         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1821             dev->dev.data_buf[0] = alt_setting_status->alt;
1822             p->actual_length = 1;
1823         }
1824         usbredir_handle_status(dev, p, alt_setting_status->status);
1825         usb_generic_async_ctrl_complete(&dev->dev, p);
1826     }
1827 }
1828 
1829 static void usbredir_iso_stream_status(void *priv, uint64_t id,
1830     struct usb_redir_iso_stream_status_header *iso_stream_status)
1831 {
1832     USBRedirDevice *dev = priv;
1833     uint8_t ep = iso_stream_status->endpoint;
1834 
1835     DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1836             ep, id);
1837 
1838     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1839         return;
1840     }
1841 
1842     dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1843     if (iso_stream_status->status == usb_redir_stall) {
1844         DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1845         dev->endpoint[EP2I(ep)].iso_started = 0;
1846     }
1847 }
1848 
1849 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1850     struct usb_redir_interrupt_receiving_status_header
1851     *interrupt_receiving_status)
1852 {
1853     USBRedirDevice *dev = priv;
1854     uint8_t ep = interrupt_receiving_status->endpoint;
1855 
1856     DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1857             interrupt_receiving_status->status, ep, id);
1858 
1859     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1860         return;
1861     }
1862 
1863     dev->endpoint[EP2I(ep)].interrupt_error =
1864         interrupt_receiving_status->status;
1865     if (interrupt_receiving_status->status == usb_redir_stall) {
1866         DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1867         dev->endpoint[EP2I(ep)].interrupt_started = 0;
1868     }
1869 }
1870 
1871 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1872     struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1873 {
1874 #if USBREDIR_VERSION >= 0x000700
1875     USBRedirDevice *dev = priv;
1876 
1877     if (bulk_streams_status->status == usb_redir_success) {
1878         DPRINTF("bulk streams status %d eps %08x\n",
1879                 bulk_streams_status->status, bulk_streams_status->endpoints);
1880     } else {
1881         ERROR("bulk streams %s failed status %d eps %08x\n",
1882               (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1883               bulk_streams_status->status, bulk_streams_status->endpoints);
1884         ERROR("usb-redir-host does not provide streams, disconnecting\n");
1885         usbredir_reject_device(dev);
1886     }
1887 #endif
1888 }
1889 
1890 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1891     struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1892 {
1893     USBRedirDevice *dev = priv;
1894     uint8_t ep = bulk_receiving_status->endpoint;
1895 
1896     DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1897             bulk_receiving_status->status, ep, id);
1898 
1899     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1900         return;
1901     }
1902 
1903     if (bulk_receiving_status->status == usb_redir_stall) {
1904         DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1905         dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1906     }
1907 }
1908 
1909 static void usbredir_control_packet(void *priv, uint64_t id,
1910     struct usb_redir_control_packet_header *control_packet,
1911     uint8_t *data, int data_len)
1912 {
1913     USBRedirDevice *dev = priv;
1914     USBPacket *p;
1915     int len = control_packet->length;
1916 
1917     DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1918             len, id);
1919 
1920     /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1921      * to work redirected to a not superspeed capable hcd */
1922     if (dev->dev.speed == USB_SPEED_SUPER &&
1923             !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1924             control_packet->requesttype == 0x80 &&
1925             control_packet->request == 6 &&
1926             control_packet->value == 0x100 && control_packet->index == 0 &&
1927             data_len >= 18 && data[7] == 9) {
1928         data[7] = 64;
1929     }
1930 
1931     p = usbredir_find_packet_by_id(dev, 0, id);
1932     if (p) {
1933         usbredir_handle_status(dev, p, control_packet->status);
1934         if (data_len > 0) {
1935             usbredir_log_data(dev, "ctrl data in:", data, data_len);
1936             if (data_len > sizeof(dev->dev.data_buf)) {
1937                 ERROR("ctrl buffer too small (%d > %zu)\n",
1938                       data_len, sizeof(dev->dev.data_buf));
1939                 p->status = USB_RET_STALL;
1940                 data_len = len = sizeof(dev->dev.data_buf);
1941             }
1942             memcpy(dev->dev.data_buf, data, data_len);
1943         }
1944         p->actual_length = len;
1945         usb_generic_async_ctrl_complete(&dev->dev, p);
1946     }
1947     free(data);
1948 }
1949 
1950 static void usbredir_bulk_packet(void *priv, uint64_t id,
1951     struct usb_redir_bulk_packet_header *bulk_packet,
1952     uint8_t *data, int data_len)
1953 {
1954     USBRedirDevice *dev = priv;
1955     uint8_t ep = bulk_packet->endpoint;
1956     int len = (bulk_packet->length_high << 16) | bulk_packet->length;
1957     USBPacket *p;
1958 
1959     DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
1960             bulk_packet->status, ep, bulk_packet->stream_id, len, id);
1961 
1962     p = usbredir_find_packet_by_id(dev, ep, id);
1963     if (p) {
1964         size_t size = usb_packet_size(p);
1965         usbredir_handle_status(dev, p, bulk_packet->status);
1966         if (data_len > 0) {
1967             usbredir_log_data(dev, "bulk data in:", data, data_len);
1968             if (data_len > size) {
1969                 ERROR("bulk got more data then requested (%d > %zd)\n",
1970                       data_len, p->iov.size);
1971                 p->status = USB_RET_BABBLE;
1972                 data_len = len = size;
1973             }
1974             usb_packet_copy(p, data, data_len);
1975         }
1976         p->actual_length = len;
1977         if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
1978             usb_combined_input_packet_complete(&dev->dev, p);
1979         } else {
1980             usb_packet_complete(&dev->dev, p);
1981         }
1982     }
1983     free(data);
1984 }
1985 
1986 static void usbredir_iso_packet(void *priv, uint64_t id,
1987     struct usb_redir_iso_packet_header *iso_packet,
1988     uint8_t *data, int data_len)
1989 {
1990     USBRedirDevice *dev = priv;
1991     uint8_t ep = iso_packet->endpoint;
1992 
1993     DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
1994              iso_packet->status, ep, data_len, id);
1995 
1996     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
1997         ERROR("received iso packet for non iso endpoint %02X\n", ep);
1998         free(data);
1999         return;
2000     }
2001 
2002     if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2003         DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2004         free(data);
2005         return;
2006     }
2007 
2008     /* bufp_alloc also adds the packet to the ep queue */
2009     bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2010 }
2011 
2012 static void usbredir_interrupt_packet(void *priv, uint64_t id,
2013     struct usb_redir_interrupt_packet_header *interrupt_packet,
2014     uint8_t *data, int data_len)
2015 {
2016     USBRedirDevice *dev = priv;
2017     uint8_t ep = interrupt_packet->endpoint;
2018 
2019     DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2020             interrupt_packet->status, ep, data_len, id);
2021 
2022     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2023         ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2024         free(data);
2025         return;
2026     }
2027 
2028     if (ep & USB_DIR_IN) {
2029         if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2030             DPRINTF("received int packet while not started ep %02X\n", ep);
2031             free(data);
2032             return;
2033         }
2034 
2035         if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
2036             usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2037         }
2038 
2039         /* bufp_alloc also adds the packet to the ep queue */
2040         bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2041     } else {
2042         /*
2043          * We report output interrupt packets as completed directly upon
2044          * submission, so all we can do here if one failed is warn.
2045          */
2046         if (interrupt_packet->status) {
2047             WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2048                     interrupt_packet->status, ep, id);
2049         }
2050     }
2051 }
2052 
2053 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2054     struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2055     uint8_t *data, int data_len)
2056 {
2057     USBRedirDevice *dev = priv;
2058     uint8_t status, ep = buffered_bulk_packet->endpoint;
2059     void *free_on_destroy;
2060     int i, len;
2061 
2062     DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2063             buffered_bulk_packet->status, ep, data_len, id);
2064 
2065     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2066         ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2067         free(data);
2068         return;
2069     }
2070 
2071     if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2072         DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2073         free(data);
2074         return;
2075     }
2076 
2077     /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2078     len = dev->endpoint[EP2I(ep)].max_packet_size;
2079     status = usb_redir_success;
2080     free_on_destroy = NULL;
2081     for (i = 0; i < data_len; i += len) {
2082         if (len >= (data_len - i)) {
2083             len = data_len - i;
2084             status = buffered_bulk_packet->status;
2085             free_on_destroy = data;
2086         }
2087         /* bufp_alloc also adds the packet to the ep queue */
2088         bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2089     }
2090 
2091     if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2092         USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2093         dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2094         usbredir_buffered_bulk_in_complete(dev, p, ep);
2095         usb_packet_complete(&dev->dev, p);
2096     }
2097 }
2098 
2099 /*
2100  * Migration code
2101  */
2102 
2103 static void usbredir_pre_save(void *priv)
2104 {
2105     USBRedirDevice *dev = priv;
2106 
2107     usbredir_fill_already_in_flight(dev);
2108 }
2109 
2110 static int usbredir_post_load(void *priv, int version_id)
2111 {
2112     USBRedirDevice *dev = priv;
2113 
2114     if (dev->parser == NULL) {
2115         return 0;
2116     }
2117 
2118     switch (dev->device_info.speed) {
2119     case usb_redir_speed_low:
2120         dev->dev.speed = USB_SPEED_LOW;
2121         break;
2122     case usb_redir_speed_full:
2123         dev->dev.speed = USB_SPEED_FULL;
2124         break;
2125     case usb_redir_speed_high:
2126         dev->dev.speed = USB_SPEED_HIGH;
2127         break;
2128     case usb_redir_speed_super:
2129         dev->dev.speed = USB_SPEED_SUPER;
2130         break;
2131     default:
2132         dev->dev.speed = USB_SPEED_FULL;
2133     }
2134     dev->dev.speedmask = (1 << dev->dev.speed);
2135 
2136     usbredir_setup_usb_eps(dev);
2137     usbredir_check_bulk_receiving(dev);
2138 
2139     return 0;
2140 }
2141 
2142 /* For usbredirparser migration */
2143 static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused)
2144 {
2145     USBRedirDevice *dev = priv;
2146     uint8_t *data;
2147     int len;
2148 
2149     if (dev->parser == NULL) {
2150         qemu_put_be32(f, 0);
2151         return;
2152     }
2153 
2154     usbredirparser_serialize(dev->parser, &data, &len);
2155     qemu_oom_check(data);
2156 
2157     qemu_put_be32(f, len);
2158     qemu_put_buffer(f, data, len);
2159 
2160     free(data);
2161 }
2162 
2163 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused)
2164 {
2165     USBRedirDevice *dev = priv;
2166     uint8_t *data;
2167     int len, ret;
2168 
2169     len = qemu_get_be32(f);
2170     if (len == 0) {
2171         return 0;
2172     }
2173 
2174     /*
2175      * If our chardev is not open already at this point the usbredir connection
2176      * has been broken (non seamless migration, or restore from disk).
2177      *
2178      * In this case create a temporary parser to receive the migration data,
2179      * and schedule the close_bh to report the device as disconnected to the
2180      * guest and to destroy the parser again.
2181      */
2182     if (dev->parser == NULL) {
2183         WARNING("usb-redir connection broken during migration\n");
2184         usbredir_create_parser(dev);
2185         qemu_bh_schedule(dev->chardev_close_bh);
2186     }
2187 
2188     data = g_malloc(len);
2189     qemu_get_buffer(f, data, len);
2190 
2191     ret = usbredirparser_unserialize(dev->parser, data, len);
2192 
2193     g_free(data);
2194 
2195     return ret;
2196 }
2197 
2198 static const VMStateInfo usbredir_parser_vmstate_info = {
2199     .name = "usb-redir-parser",
2200     .put  = usbredir_put_parser,
2201     .get  = usbredir_get_parser,
2202 };
2203 
2204 
2205 /* For buffered packets (iso/irq) queue migration */
2206 static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused)
2207 {
2208     struct endp_data *endp = priv;
2209     USBRedirDevice *dev = endp->dev;
2210     struct buf_packet *bufp;
2211     int len, i = 0;
2212 
2213     qemu_put_be32(f, endp->bufpq_size);
2214     QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2215         len = bufp->len - bufp->offset;
2216         DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2217                 len, bufp->status);
2218         qemu_put_be32(f, len);
2219         qemu_put_be32(f, bufp->status);
2220         qemu_put_buffer(f, bufp->data + bufp->offset, len);
2221         i++;
2222     }
2223     assert(i == endp->bufpq_size);
2224 }
2225 
2226 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused)
2227 {
2228     struct endp_data *endp = priv;
2229     USBRedirDevice *dev = endp->dev;
2230     struct buf_packet *bufp;
2231     int i;
2232 
2233     endp->bufpq_size = qemu_get_be32(f);
2234     for (i = 0; i < endp->bufpq_size; i++) {
2235         bufp = g_malloc(sizeof(struct buf_packet));
2236         bufp->len = qemu_get_be32(f);
2237         bufp->status = qemu_get_be32(f);
2238         bufp->offset = 0;
2239         bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */
2240         bufp->free_on_destroy = bufp->data;
2241         qemu_get_buffer(f, bufp->data, bufp->len);
2242         QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2243         DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2244                 bufp->len, bufp->status);
2245     }
2246     return 0;
2247 }
2248 
2249 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2250     .name = "usb-redir-bufpq",
2251     .put  = usbredir_put_bufpq,
2252     .get  = usbredir_get_bufpq,
2253 };
2254 
2255 
2256 /* For endp_data migration */
2257 static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2258     .name = "usb-redir-ep/bulk-receiving",
2259     .version_id = 1,
2260     .minimum_version_id = 1,
2261     .fields = (VMStateField[]) {
2262         VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2263         VMSTATE_END_OF_LIST()
2264     }
2265 };
2266 
2267 static bool usbredir_bulk_receiving_needed(void *priv)
2268 {
2269     struct endp_data *endp = priv;
2270 
2271     return endp->bulk_receiving_started;
2272 }
2273 
2274 static const VMStateDescription usbredir_stream_vmstate = {
2275     .name = "usb-redir-ep/stream-state",
2276     .version_id = 1,
2277     .minimum_version_id = 1,
2278     .fields = (VMStateField[]) {
2279         VMSTATE_UINT32(max_streams, struct endp_data),
2280         VMSTATE_END_OF_LIST()
2281     }
2282 };
2283 
2284 static bool usbredir_stream_needed(void *priv)
2285 {
2286     struct endp_data *endp = priv;
2287 
2288     return endp->max_streams;
2289 }
2290 
2291 static const VMStateDescription usbredir_ep_vmstate = {
2292     .name = "usb-redir-ep",
2293     .version_id = 1,
2294     .minimum_version_id = 1,
2295     .fields = (VMStateField[]) {
2296         VMSTATE_UINT8(type, struct endp_data),
2297         VMSTATE_UINT8(interval, struct endp_data),
2298         VMSTATE_UINT8(interface, struct endp_data),
2299         VMSTATE_UINT16(max_packet_size, struct endp_data),
2300         VMSTATE_UINT8(iso_started, struct endp_data),
2301         VMSTATE_UINT8(iso_error, struct endp_data),
2302         VMSTATE_UINT8(interrupt_started, struct endp_data),
2303         VMSTATE_UINT8(interrupt_error, struct endp_data),
2304         VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2305         VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2306         {
2307             .name         = "bufpq",
2308             .version_id   = 0,
2309             .field_exists = NULL,
2310             .size         = 0,
2311             .info         = &usbredir_ep_bufpq_vmstate_info,
2312             .flags        = VMS_SINGLE,
2313             .offset       = 0,
2314         },
2315         VMSTATE_INT32(bufpq_target_size, struct endp_data),
2316         VMSTATE_END_OF_LIST()
2317     },
2318     .subsections = (VMStateSubsection[]) {
2319         {
2320             .vmsd = &usbredir_bulk_receiving_vmstate,
2321             .needed = usbredir_bulk_receiving_needed,
2322         }, {
2323             .vmsd = &usbredir_stream_vmstate,
2324             .needed = usbredir_stream_needed,
2325         }, {
2326             /* empty */
2327         }
2328     }
2329 };
2330 
2331 
2332 /* For PacketIdQueue migration */
2333 static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused)
2334 {
2335     struct PacketIdQueue *q = priv;
2336     USBRedirDevice *dev = q->dev;
2337     struct PacketIdQueueEntry *e;
2338     int remain = q->size;
2339 
2340     DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2341     qemu_put_be32(f, q->size);
2342     QTAILQ_FOREACH(e, &q->head, next) {
2343         qemu_put_be64(f, e->id);
2344         remain--;
2345     }
2346     assert(remain == 0);
2347 }
2348 
2349 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused)
2350 {
2351     struct PacketIdQueue *q = priv;
2352     USBRedirDevice *dev = q->dev;
2353     int i, size;
2354     uint64_t id;
2355 
2356     size = qemu_get_be32(f);
2357     DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2358     for (i = 0; i < size; i++) {
2359         id = qemu_get_be64(f);
2360         packet_id_queue_add(q, id);
2361     }
2362     assert(q->size == size);
2363     return 0;
2364 }
2365 
2366 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2367     .name = "usb-redir-packet-id-q",
2368     .put  = usbredir_put_packet_id_q,
2369     .get  = usbredir_get_packet_id_q,
2370 };
2371 
2372 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2373     .name = "usb-redir-packet-id-queue",
2374     .version_id = 1,
2375     .minimum_version_id = 1,
2376     .fields = (VMStateField[]) {
2377         {
2378             .name         = "queue",
2379             .version_id   = 0,
2380             .field_exists = NULL,
2381             .size         = 0,
2382             .info         = &usbredir_ep_packet_id_q_vmstate_info,
2383             .flags        = VMS_SINGLE,
2384             .offset       = 0,
2385         },
2386         VMSTATE_END_OF_LIST()
2387     }
2388 };
2389 
2390 
2391 /* For usb_redir_device_connect_header migration */
2392 static const VMStateDescription usbredir_device_info_vmstate = {
2393     .name = "usb-redir-device-info",
2394     .version_id = 1,
2395     .minimum_version_id = 1,
2396     .fields = (VMStateField[]) {
2397         VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2398         VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2399         VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2400         VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2401         VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2402         VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2403         VMSTATE_UINT16(device_version_bcd,
2404                        struct usb_redir_device_connect_header),
2405         VMSTATE_END_OF_LIST()
2406     }
2407 };
2408 
2409 
2410 /* For usb_redir_interface_info_header migration */
2411 static const VMStateDescription usbredir_interface_info_vmstate = {
2412     .name = "usb-redir-interface-info",
2413     .version_id = 1,
2414     .minimum_version_id = 1,
2415     .fields = (VMStateField[]) {
2416         VMSTATE_UINT32(interface_count,
2417                        struct usb_redir_interface_info_header),
2418         VMSTATE_UINT8_ARRAY(interface,
2419                             struct usb_redir_interface_info_header, 32),
2420         VMSTATE_UINT8_ARRAY(interface_class,
2421                             struct usb_redir_interface_info_header, 32),
2422         VMSTATE_UINT8_ARRAY(interface_subclass,
2423                             struct usb_redir_interface_info_header, 32),
2424         VMSTATE_UINT8_ARRAY(interface_protocol,
2425                             struct usb_redir_interface_info_header, 32),
2426         VMSTATE_END_OF_LIST()
2427     }
2428 };
2429 
2430 
2431 /* And finally the USBRedirDevice vmstate itself */
2432 static const VMStateDescription usbredir_vmstate = {
2433     .name = "usb-redir",
2434     .version_id = 1,
2435     .minimum_version_id = 1,
2436     .pre_save = usbredir_pre_save,
2437     .post_load = usbredir_post_load,
2438     .fields = (VMStateField[]) {
2439         VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2440         VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2441         {
2442             .name         = "parser",
2443             .version_id   = 0,
2444             .field_exists = NULL,
2445             .size         = 0,
2446             .info         = &usbredir_parser_vmstate_info,
2447             .flags        = VMS_SINGLE,
2448             .offset       = 0,
2449         },
2450         VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2451                              usbredir_ep_vmstate, struct endp_data),
2452         VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2453                        usbredir_ep_packet_id_queue_vmstate,
2454                        struct PacketIdQueue),
2455         VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2456                        usbredir_ep_packet_id_queue_vmstate,
2457                        struct PacketIdQueue),
2458         VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2459                        usbredir_device_info_vmstate,
2460                        struct usb_redir_device_connect_header),
2461         VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2462                        usbredir_interface_info_vmstate,
2463                        struct usb_redir_interface_info_header),
2464         VMSTATE_END_OF_LIST()
2465     }
2466 };
2467 
2468 static Property usbredir_properties[] = {
2469     DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2470     DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2471     DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2472     DEFINE_PROP_END_OF_LIST(),
2473 };
2474 
2475 static void usbredir_class_initfn(ObjectClass *klass, void *data)
2476 {
2477     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2478     DeviceClass *dc = DEVICE_CLASS(klass);
2479 
2480     uc->realize        = usbredir_realize;
2481     uc->product_desc   = "USB Redirection Device";
2482     uc->handle_destroy = usbredir_handle_destroy;
2483     uc->cancel_packet  = usbredir_cancel_packet;
2484     uc->handle_reset   = usbredir_handle_reset;
2485     uc->handle_data    = usbredir_handle_data;
2486     uc->handle_control = usbredir_handle_control;
2487     uc->flush_ep_queue = usbredir_flush_ep_queue;
2488     uc->ep_stopped     = usbredir_ep_stopped;
2489     uc->alloc_streams  = usbredir_alloc_streams;
2490     uc->free_streams   = usbredir_free_streams;
2491     dc->vmsd           = &usbredir_vmstate;
2492     dc->props          = usbredir_properties;
2493     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2494 }
2495 
2496 static void usbredir_instance_init(Object *obj)
2497 {
2498     USBDevice *udev = USB_DEVICE(obj);
2499     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
2500 
2501     device_add_bootindex_property(obj, &dev->bootindex,
2502                                   "bootindex", NULL,
2503                                   &udev->qdev, NULL);
2504 }
2505 
2506 static const TypeInfo usbredir_dev_info = {
2507     .name          = "usb-redir",
2508     .parent        = TYPE_USB_DEVICE,
2509     .instance_size = sizeof(USBRedirDevice),
2510     .class_init    = usbredir_class_initfn,
2511     .instance_init = usbredir_instance_init,
2512 };
2513 
2514 static void usbredir_register_types(void)
2515 {
2516     type_register_static(&usbredir_dev_info);
2517 }
2518 
2519 type_init(usbredir_register_types)
2520