xref: /openbmc/qemu/hw/usb/redirect.c (revision ed75658a)
1 /*
2  * USB redirector usb-guest
3  *
4  * Copyright (c) 2011-2012 Red Hat, Inc.
5  *
6  * Red Hat Authors:
7  * Hans de Goede <hdegoede@redhat.com>
8  *
9  * Permission is hereby granted, free of charge, to any person obtaining a copy
10  * of this software and associated documentation files (the "Software"), to deal
11  * in the Software without restriction, including without limitation the rights
12  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13  * copies of the Software, and to permit persons to whom the Software is
14  * furnished to do so, subject to the following conditions:
15  *
16  * The above copyright notice and this permission notice shall be included in
17  * all copies or substantial portions of the Software.
18  *
19  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25  * THE SOFTWARE.
26  */
27 
28 #include "qemu/osdep.h"
29 #include "qemu/cutils.h"
30 #include "qemu/units.h"
31 #include "qapi/error.h"
32 #include "qemu/timer.h"
33 #include "sysemu/runstate.h"
34 #include "sysemu/sysemu.h"
35 #include "qapi/qmp/qerror.h"
36 #include "qemu/error-report.h"
37 #include "qemu/iov.h"
38 #include "qemu/module.h"
39 #include "chardev/char-fe.h"
40 
41 #include <usbredirparser.h>
42 #include <usbredirfilter.h>
43 
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "hw/usb.h"
47 #include "migration/qemu-file-types.h"
48 #include "migration/vmstate.h"
49 #include "qom/object.h"
50 
51 /* ERROR is defined below. Remove any previous definition. */
52 #undef ERROR
53 
54 #define MAX_ENDPOINTS 32
55 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
56 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
57 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
58 #define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
59                          ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
60 #define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
61                        ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
62                        (i) & 0x0f))
63 
64 #ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
65 #define USBREDIR_VERSION 0
66 #endif
67 
68 typedef struct USBRedirDevice USBRedirDevice;
69 
70 /* Struct to hold buffered packets */
71 struct buf_packet {
72     uint8_t *data;
73     void *free_on_destroy;
74     uint16_t len;
75     uint16_t offset;
76     uint8_t status;
77     QTAILQ_ENTRY(buf_packet)next;
78 };
79 
80 struct endp_data {
81     USBRedirDevice *dev;
82     uint8_t type;
83     uint8_t interval;
84     uint8_t interface; /* bInterfaceNumber this ep belongs to */
85     uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
86     uint32_t max_streams;
87     uint8_t iso_started;
88     uint8_t iso_error; /* For reporting iso errors to the HC */
89     uint8_t interrupt_started;
90     uint8_t interrupt_error;
91     uint8_t bulk_receiving_enabled;
92     uint8_t bulk_receiving_started;
93     uint8_t bufpq_prefilled;
94     uint8_t bufpq_dropping_packets;
95     QTAILQ_HEAD(, buf_packet) bufpq;
96     int32_t bufpq_size;
97     int32_t bufpq_target_size;
98     USBPacket *pending_async_packet;
99 };
100 
101 struct PacketIdQueueEntry {
102     uint64_t id;
103     QTAILQ_ENTRY(PacketIdQueueEntry)next;
104 };
105 
106 struct PacketIdQueue {
107     USBRedirDevice *dev;
108     const char *name;
109     QTAILQ_HEAD(, PacketIdQueueEntry) head;
110     int size;
111 };
112 
113 struct USBRedirDevice {
114     USBDevice dev;
115     /* Properties */
116     CharBackend cs;
117     bool enable_streams;
118     bool suppress_remote_wake;
119     bool in_write;
120     uint8_t debug;
121     int32_t bootindex;
122     char *filter_str;
123     /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
124     const uint8_t *read_buf;
125     int read_buf_size;
126     /* Active chardev-watch-tag */
127     guint watch;
128     /* For async handling of close / reject */
129     QEMUBH *chardev_close_bh;
130     QEMUBH *device_reject_bh;
131     /* To delay the usb attach in case of quick chardev close + open */
132     QEMUTimer *attach_timer;
133     int64_t next_attach_time;
134     struct usbredirparser *parser;
135     struct endp_data endpoint[MAX_ENDPOINTS];
136     struct PacketIdQueue cancelled;
137     struct PacketIdQueue already_in_flight;
138     void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
139     /* Data for device filtering */
140     struct usb_redir_device_connect_header device_info;
141     struct usb_redir_interface_info_header interface_info;
142     struct usbredirfilter_rule *filter_rules;
143     int filter_rules_count;
144     int compatible_speedmask;
145     VMChangeStateEntry *vmstate;
146 };
147 
148 #define TYPE_USB_REDIR "usb-redir"
149 DECLARE_INSTANCE_CHECKER(USBRedirDevice, USB_REDIRECT,
150                          TYPE_USB_REDIR)
151 
152 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
153 static void usbredir_device_connect(void *priv,
154     struct usb_redir_device_connect_header *device_connect);
155 static void usbredir_device_disconnect(void *priv);
156 static void usbredir_interface_info(void *priv,
157     struct usb_redir_interface_info_header *interface_info);
158 static void usbredir_ep_info(void *priv,
159     struct usb_redir_ep_info_header *ep_info);
160 static void usbredir_configuration_status(void *priv, uint64_t id,
161     struct usb_redir_configuration_status_header *configuration_status);
162 static void usbredir_alt_setting_status(void *priv, uint64_t id,
163     struct usb_redir_alt_setting_status_header *alt_setting_status);
164 static void usbredir_iso_stream_status(void *priv, uint64_t id,
165     struct usb_redir_iso_stream_status_header *iso_stream_status);
166 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
167     struct usb_redir_interrupt_receiving_status_header
168     *interrupt_receiving_status);
169 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
170     struct usb_redir_bulk_streams_status_header *bulk_streams_status);
171 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
172     struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
173 static void usbredir_control_packet(void *priv, uint64_t id,
174     struct usb_redir_control_packet_header *control_packet,
175     uint8_t *data, int data_len);
176 static void usbredir_bulk_packet(void *priv, uint64_t id,
177     struct usb_redir_bulk_packet_header *bulk_packet,
178     uint8_t *data, int data_len);
179 static void usbredir_iso_packet(void *priv, uint64_t id,
180     struct usb_redir_iso_packet_header *iso_packet,
181     uint8_t *data, int data_len);
182 static void usbredir_interrupt_packet(void *priv, uint64_t id,
183     struct usb_redir_interrupt_packet_header *interrupt_header,
184     uint8_t *data, int data_len);
185 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
186     struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
187     uint8_t *data, int data_len);
188 
189 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
190     int status);
191 
192 #define VERSION "qemu usb-redir guest " QEMU_VERSION
193 
194 /*
195  * Logging stuff
196  */
197 
198 #define ERROR(...) \
199     do { \
200         if (dev->debug >= usbredirparser_error) { \
201             error_report("usb-redir error: " __VA_ARGS__); \
202         } \
203     } while (0)
204 #define WARNING(...) \
205     do { \
206         if (dev->debug >= usbredirparser_warning) { \
207             warn_report("" __VA_ARGS__); \
208         } \
209     } while (0)
210 #define INFO(...) \
211     do { \
212         if (dev->debug >= usbredirparser_info) { \
213             error_report("usb-redir: " __VA_ARGS__); \
214         } \
215     } while (0)
216 #define DPRINTF(...) \
217     do { \
218         if (dev->debug >= usbredirparser_debug) { \
219             error_report("usb-redir: " __VA_ARGS__); \
220         } \
221     } while (0)
222 #define DPRINTF2(...) \
223     do { \
224         if (dev->debug >= usbredirparser_debug_data) { \
225             error_report("usb-redir: " __VA_ARGS__); \
226         } \
227     } while (0)
228 
229 static void usbredir_log(void *priv, int level, const char *msg)
230 {
231     USBRedirDevice *dev = priv;
232 
233     if (dev->debug < level) {
234         return;
235     }
236 
237     error_report("%s", msg);
238 }
239 
240 static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
241     const uint8_t *data, int len)
242 {
243     if (dev->debug < usbredirparser_debug_data) {
244         return;
245     }
246     qemu_hexdump(stderr, desc, data, len);
247 }
248 
249 /*
250  * usbredirparser io functions
251  */
252 
253 static int usbredir_read(void *priv, uint8_t *data, int count)
254 {
255     USBRedirDevice *dev = priv;
256 
257     if (dev->read_buf_size < count) {
258         count = dev->read_buf_size;
259     }
260 
261     memcpy(data, dev->read_buf, count);
262 
263     dev->read_buf_size -= count;
264     if (dev->read_buf_size) {
265         dev->read_buf += count;
266     } else {
267         dev->read_buf = NULL;
268     }
269 
270     return count;
271 }
272 
273 static gboolean usbredir_write_unblocked(void *do_not_use, GIOCondition cond,
274                                          void *opaque)
275 {
276     USBRedirDevice *dev = opaque;
277 
278     dev->watch = 0;
279     usbredirparser_do_write(dev->parser);
280 
281     return G_SOURCE_REMOVE;
282 }
283 
284 static int usbredir_write(void *priv, uint8_t *data, int count)
285 {
286     USBRedirDevice *dev = priv;
287     int r;
288 
289     if (!qemu_chr_fe_backend_open(&dev->cs)) {
290         return 0;
291     }
292 
293     /* Don't send new data to the chardev until our state is fully synced */
294     if (!runstate_check(RUN_STATE_RUNNING)) {
295         return 0;
296     }
297 
298     /* Recursion check */
299     if (dev->in_write) {
300         DPRINTF("usbredir_write recursion\n");
301         return 0;
302     }
303     dev->in_write = true;
304 
305     r = qemu_chr_fe_write(&dev->cs, data, count);
306     if (r < count) {
307         if (!dev->watch) {
308             dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
309                                                usbredir_write_unblocked, dev);
310         }
311         if (r < 0) {
312             r = 0;
313         }
314     }
315     dev->in_write = false;
316     return r;
317 }
318 
319 /*
320  * Cancelled and buffered packets helpers
321  */
322 
323 static void packet_id_queue_init(struct PacketIdQueue *q,
324     USBRedirDevice *dev, const char *name)
325 {
326     q->dev = dev;
327     q->name = name;
328     QTAILQ_INIT(&q->head);
329     q->size = 0;
330 }
331 
332 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
333 {
334     USBRedirDevice *dev = q->dev;
335     struct PacketIdQueueEntry *e;
336 
337     DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
338 
339     e = g_new0(struct PacketIdQueueEntry, 1);
340     e->id = id;
341     QTAILQ_INSERT_TAIL(&q->head, e, next);
342     q->size++;
343 }
344 
345 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
346 {
347     USBRedirDevice *dev = q->dev;
348     struct PacketIdQueueEntry *e;
349 
350     QTAILQ_FOREACH(e, &q->head, next) {
351         if (e->id == id) {
352             DPRINTF("removing packet id %"PRIu64" from %s queue\n",
353                     id, q->name);
354             QTAILQ_REMOVE(&q->head, e, next);
355             q->size--;
356             g_free(e);
357             return 1;
358         }
359     }
360     return 0;
361 }
362 
363 static void packet_id_queue_empty(struct PacketIdQueue *q)
364 {
365     USBRedirDevice *dev = q->dev;
366     struct PacketIdQueueEntry *e, *next_e;
367 
368     DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
369 
370     QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
371         QTAILQ_REMOVE(&q->head, e, next);
372         g_free(e);
373     }
374     q->size = 0;
375 }
376 
377 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
378 {
379     USBRedirDevice *dev = USB_REDIRECT(udev);
380     int i = USBEP2I(p->ep);
381 
382     if (p->combined) {
383         usb_combined_packet_cancel(udev, p);
384         return;
385     }
386 
387     if (dev->endpoint[i].pending_async_packet) {
388         assert(dev->endpoint[i].pending_async_packet == p);
389         dev->endpoint[i].pending_async_packet = NULL;
390         return;
391     }
392 
393     packet_id_queue_add(&dev->cancelled, p->id);
394     usbredirparser_send_cancel_data_packet(dev->parser, p->id);
395     usbredirparser_do_write(dev->parser);
396 }
397 
398 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
399 {
400     if (!dev->dev.attached) {
401         return 1; /* Treat everything as cancelled after a disconnect */
402     }
403     return packet_id_queue_remove(&dev->cancelled, id);
404 }
405 
406 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
407     struct USBEndpoint *ep)
408 {
409     static USBPacket *p;
410 
411     /* async handled packets for bulk receiving eps do not count as inflight */
412     if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
413         return;
414     }
415 
416     QTAILQ_FOREACH(p, &ep->queue, queue) {
417         /* Skip combined packets, except for the first */
418         if (p->combined && p != p->combined->first) {
419             continue;
420         }
421         if (p->state == USB_PACKET_ASYNC) {
422             packet_id_queue_add(&dev->already_in_flight, p->id);
423         }
424     }
425 }
426 
427 static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
428 {
429     int ep;
430     struct USBDevice *udev = &dev->dev;
431 
432     usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
433 
434     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
435         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
436         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
437     }
438 }
439 
440 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
441 {
442     return packet_id_queue_remove(&dev->already_in_flight, id);
443 }
444 
445 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
446     uint8_t ep, uint64_t id)
447 {
448     USBPacket *p;
449 
450     if (usbredir_is_cancelled(dev, id)) {
451         return NULL;
452     }
453 
454     p = usb_ep_find_packet_by_id(&dev->dev,
455                             (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
456                             ep & 0x0f, id);
457     if (p == NULL) {
458         ERROR("could not find packet with id %"PRIu64"\n", id);
459     }
460     return p;
461 }
462 
463 static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
464     uint8_t status, uint8_t ep, void *free_on_destroy)
465 {
466     struct buf_packet *bufp;
467 
468     if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
469         dev->endpoint[EP2I(ep)].bufpq_size >
470             2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
471         DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
472         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
473     }
474     /* Since we're interrupting the stream anyways, drop enough packets to get
475        back to our target buffer size */
476     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
477         if (dev->endpoint[EP2I(ep)].bufpq_size >
478                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
479             free(free_on_destroy);
480             return -1;
481         }
482         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
483     }
484 
485     bufp = g_new(struct buf_packet, 1);
486     bufp->data   = data;
487     bufp->len    = len;
488     bufp->offset = 0;
489     bufp->status = status;
490     bufp->free_on_destroy = free_on_destroy;
491     QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
492     dev->endpoint[EP2I(ep)].bufpq_size++;
493     return 0;
494 }
495 
496 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
497     uint8_t ep)
498 {
499     QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
500     dev->endpoint[EP2I(ep)].bufpq_size--;
501     free(bufp->free_on_destroy);
502     g_free(bufp);
503 }
504 
505 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
506 {
507     struct buf_packet *buf, *buf_next;
508 
509     QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
510         bufp_free(dev, buf, ep);
511     }
512 }
513 
514 /*
515  * USBDevice callbacks
516  */
517 
518 static void usbredir_handle_reset(USBDevice *udev)
519 {
520     USBRedirDevice *dev = USB_REDIRECT(udev);
521 
522     DPRINTF("reset device\n");
523     usbredirparser_send_reset(dev->parser);
524     usbredirparser_do_write(dev->parser);
525 }
526 
527 static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
528                                      uint8_t ep)
529 {
530     int status, len;
531     if (!dev->endpoint[EP2I(ep)].iso_started &&
532             !dev->endpoint[EP2I(ep)].iso_error) {
533         struct usb_redir_start_iso_stream_header start_iso = {
534             .endpoint = ep,
535         };
536         int pkts_per_sec;
537 
538         if (dev->dev.speed == USB_SPEED_HIGH) {
539             pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
540         } else {
541             pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
542         }
543         /* Testing has shown that we need circa 60 ms buffer */
544         dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
545 
546         /* Aim for approx 100 interrupts / second on the client to
547            balance latency and interrupt load */
548         start_iso.pkts_per_urb = pkts_per_sec / 100;
549         if (start_iso.pkts_per_urb < 1) {
550             start_iso.pkts_per_urb = 1;
551         } else if (start_iso.pkts_per_urb > 32) {
552             start_iso.pkts_per_urb = 32;
553         }
554 
555         start_iso.no_urbs = DIV_ROUND_UP(
556                                      dev->endpoint[EP2I(ep)].bufpq_target_size,
557                                      start_iso.pkts_per_urb);
558         /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
559            as overflow buffer. Also see the usbredir protocol documentation */
560         if (!(ep & USB_DIR_IN)) {
561             start_iso.no_urbs *= 2;
562         }
563         if (start_iso.no_urbs > 16) {
564             start_iso.no_urbs = 16;
565         }
566 
567         /* No id, we look at the ep when receiving a status back */
568         usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
569         usbredirparser_do_write(dev->parser);
570         DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
571                 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
572         dev->endpoint[EP2I(ep)].iso_started = 1;
573         dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
574         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
575     }
576 
577     if (ep & USB_DIR_IN) {
578         struct buf_packet *isop;
579 
580         if (dev->endpoint[EP2I(ep)].iso_started &&
581                 !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
582             if (dev->endpoint[EP2I(ep)].bufpq_size <
583                     dev->endpoint[EP2I(ep)].bufpq_target_size) {
584                 return;
585             }
586             dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
587         }
588 
589         isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
590         if (isop == NULL) {
591             DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
592                     ep, dev->endpoint[EP2I(ep)].iso_error);
593             /* Re-fill the buffer */
594             dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
595             /* Check iso_error for stream errors, otherwise its an underrun */
596             status = dev->endpoint[EP2I(ep)].iso_error;
597             dev->endpoint[EP2I(ep)].iso_error = 0;
598             p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
599             return;
600         }
601         DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
602                  isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
603 
604         status = isop->status;
605         len = isop->len;
606         if (len > p->iov.size) {
607             ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
608                   ep, len, (int)p->iov.size);
609             len = p->iov.size;
610             status = usb_redir_babble;
611         }
612         usb_packet_copy(p, isop->data, len);
613         bufp_free(dev, isop, ep);
614         usbredir_handle_status(dev, p, status);
615     } else {
616         /* If the stream was not started because of a pending error don't
617            send the packet to the usb-host */
618         if (dev->endpoint[EP2I(ep)].iso_started) {
619             struct usb_redir_iso_packet_header iso_packet = {
620                 .endpoint = ep,
621                 .length = p->iov.size
622             };
623             g_autofree uint8_t *buf = g_malloc(p->iov.size);
624             /* No id, we look at the ep when receiving a status back */
625             usb_packet_copy(p, buf, p->iov.size);
626             usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
627                                            buf, p->iov.size);
628             usbredirparser_do_write(dev->parser);
629         }
630         status = dev->endpoint[EP2I(ep)].iso_error;
631         dev->endpoint[EP2I(ep)].iso_error = 0;
632         DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
633                  p->iov.size);
634         usbredir_handle_status(dev, p, status);
635     }
636 }
637 
638 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
639 {
640     struct usb_redir_stop_iso_stream_header stop_iso_stream = {
641         .endpoint = ep
642     };
643     if (dev->endpoint[EP2I(ep)].iso_started) {
644         usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
645         DPRINTF("iso stream stopped ep %02X\n", ep);
646         dev->endpoint[EP2I(ep)].iso_started = 0;
647     }
648     dev->endpoint[EP2I(ep)].iso_error = 0;
649     usbredir_free_bufpq(dev, ep);
650 }
651 
652 /*
653  * The usb-host may poll the endpoint faster then our guest, resulting in lots
654  * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
655  * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
656  */
657 static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
658     struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
659 {
660     usb_packet_copy(p, bulkp->data + bulkp->offset, count);
661     bulkp->offset += count;
662     if (bulkp->offset == bulkp->len) {
663         /* Store status in the last packet with data from this bulkp */
664         usbredir_handle_status(dev, p, bulkp->status);
665         bufp_free(dev, bulkp, ep);
666     }
667 }
668 
669 static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
670     USBPacket *p, uint8_t ep)
671 {
672     struct buf_packet *bulkp;
673     int count;
674 
675     while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
676            p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
677         count = bulkp->len - bulkp->offset;
678         if (count > (p->iov.size - p->actual_length)) {
679             count = p->iov.size - p->actual_length;
680         }
681         usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
682     }
683 }
684 
685 static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
686     USBPacket *p, uint8_t ep)
687 {
688     const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
689     uint8_t header[2] = { 0, 0 };
690     struct buf_packet *bulkp;
691     int count;
692 
693     while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
694            p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
695         if (bulkp->len < 2) {
696             WARNING("malformed ftdi bulk in packet\n");
697             bufp_free(dev, bulkp, ep);
698             continue;
699         }
700 
701         if ((p->actual_length % maxp) == 0) {
702             usb_packet_copy(p, bulkp->data, 2);
703             memcpy(header, bulkp->data, 2);
704         } else {
705             if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
706                 break; /* Different header, add to next packet */
707             }
708         }
709 
710         if (bulkp->offset == 0) {
711             bulkp->offset = 2; /* Skip header */
712         }
713         count = bulkp->len - bulkp->offset;
714         /* Must repeat the header at maxp interval */
715         if (count > (maxp - (p->actual_length % maxp))) {
716             count = maxp - (p->actual_length % maxp);
717         }
718         usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
719     }
720 }
721 
722 static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
723     USBPacket *p, uint8_t ep)
724 {
725     p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
726     dev->buffered_bulk_in_complete(dev, p, ep);
727     DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
728             ep, p->status, p->actual_length, p->id);
729 }
730 
731 static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
732     USBPacket *p, uint8_t ep)
733 {
734     /* Input bulk endpoint, buffered packet input */
735     if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
736         int bpt;
737         struct usb_redir_start_bulk_receiving_header start = {
738             .endpoint = ep,
739             .stream_id = 0,
740             .no_transfers = 5,
741         };
742         /* Round bytes_per_transfer up to a multiple of max_packet_size */
743         bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
744         bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
745         bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
746         start.bytes_per_transfer = bpt;
747         /* No id, we look at the ep when receiving a status back */
748         usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
749         usbredirparser_do_write(dev->parser);
750         DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
751                 start.bytes_per_transfer, start.no_transfers, ep);
752         dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
753         /* We don't really want to drop bulk packets ever, but
754            having some upper limit to how much we buffer is good. */
755         dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
756         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
757     }
758 
759     if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
760         DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
761         assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
762         dev->endpoint[EP2I(ep)].pending_async_packet = p;
763         p->status = USB_RET_ASYNC;
764         return;
765     }
766     usbredir_buffered_bulk_in_complete(dev, p, ep);
767 }
768 
769 static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
770 {
771     struct usb_redir_stop_bulk_receiving_header stop_bulk = {
772         .endpoint = ep,
773         .stream_id = 0,
774     };
775     if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
776         usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
777         DPRINTF("bulk receiving stopped ep %02X\n", ep);
778         dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
779     }
780     usbredir_free_bufpq(dev, ep);
781 }
782 
783 static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
784                                       uint8_t ep)
785 {
786     struct usb_redir_bulk_packet_header bulk_packet;
787     size_t size = usb_packet_size(p);
788     const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
789 
790     if (usbredir_already_in_flight(dev, p->id)) {
791         p->status = USB_RET_ASYNC;
792         return;
793     }
794 
795     if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
796         if (size != 0 && (size % maxp) == 0) {
797             usbredir_handle_buffered_bulk_in_data(dev, p, ep);
798             return;
799         }
800         WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
801         assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
802         usbredir_stop_bulk_receiving(dev, ep);
803         dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
804     }
805 
806     DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
807             ep, p->stream, size, p->id);
808 
809     bulk_packet.endpoint  = ep;
810     bulk_packet.length    = size;
811     bulk_packet.stream_id = p->stream;
812     bulk_packet.length_high = size >> 16;
813     assert(bulk_packet.length_high == 0 ||
814            usbredirparser_peer_has_cap(dev->parser,
815                                        usb_redir_cap_32bits_bulk_length));
816 
817     if (ep & USB_DIR_IN || size == 0) {
818         usbredirparser_send_bulk_packet(dev->parser, p->id,
819                                         &bulk_packet, NULL, 0);
820     } else {
821         g_autofree uint8_t *buf = g_malloc(size);
822         usb_packet_copy(p, buf, size);
823         usbredir_log_data(dev, "bulk data out:", buf, size);
824         usbredirparser_send_bulk_packet(dev->parser, p->id,
825                                         &bulk_packet, buf, size);
826     }
827     usbredirparser_do_write(dev->parser);
828     p->status = USB_RET_ASYNC;
829 }
830 
831 static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
832                                               USBPacket *p, uint8_t ep)
833 {
834     /* Input interrupt endpoint, buffered packet input */
835     struct buf_packet *intp, *intp_to_free;
836     int status, len, sum;
837 
838     if (!dev->endpoint[EP2I(ep)].interrupt_started &&
839             !dev->endpoint[EP2I(ep)].interrupt_error) {
840         struct usb_redir_start_interrupt_receiving_header start_int = {
841             .endpoint = ep,
842         };
843         /* No id, we look at the ep when receiving a status back */
844         usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
845                                                       &start_int);
846         usbredirparser_do_write(dev->parser);
847         DPRINTF("interrupt recv started ep %02X\n", ep);
848         dev->endpoint[EP2I(ep)].interrupt_started = 1;
849         /* We don't really want to drop interrupt packets ever, but
850            having some upper limit to how much we buffer is good. */
851         dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
852         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
853     }
854 
855     /* check for completed interrupt message (with all fragments) */
856     sum = 0;
857     QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
858         sum += intp->len;
859         if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
860             sum >= p->iov.size)
861             break;
862     }
863 
864     if (intp == NULL) {
865         DPRINTF2("interrupt-token-in ep %02X, no intp, buffered %d\n", ep, sum);
866         /* Check interrupt_error for stream errors */
867         status = dev->endpoint[EP2I(ep)].interrupt_error;
868         dev->endpoint[EP2I(ep)].interrupt_error = 0;
869         if (status) {
870             usbredir_handle_status(dev, p, status);
871         } else {
872             p->status = USB_RET_NAK;
873         }
874         return;
875     }
876 
877     /* copy of completed interrupt message */
878     sum = 0;
879     status = usb_redir_success;
880     intp_to_free = NULL;
881     QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
882         if (intp_to_free) {
883             bufp_free(dev, intp_to_free, ep);
884         }
885         DPRINTF("interrupt-token-in ep %02X fragment status %d len %d\n", ep,
886                 intp->status, intp->len);
887 
888         sum += intp->len;
889         len = intp->len;
890         if (status == usb_redir_success) {
891             status = intp->status;
892         }
893         if (sum > p->iov.size) {
894             ERROR("received int data is larger then packet ep %02X\n", ep);
895             len -= (sum - p->iov.size);
896             sum = p->iov.size;
897             status = usb_redir_babble;
898         }
899 
900         usb_packet_copy(p, intp->data, len);
901 
902         intp_to_free = intp;
903         if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
904             sum >= p->iov.size)
905             break;
906     }
907     if (intp_to_free) {
908         bufp_free(dev, intp_to_free, ep);
909     }
910     DPRINTF("interrupt-token-in ep %02X summary status %d len %d\n", ep,
911             status, sum);
912     usbredir_handle_status(dev, p, status);
913 }
914 
915 /*
916  * Handle interrupt out data, the usbredir protocol expects us to do this
917  * async, so that it can report back a completion status. But guests will
918  * expect immediate completion for an interrupt endpoint, and handling this
919  * async causes migration issues. So we report success directly, counting
920  * on the fact that output interrupt packets normally always succeed.
921  */
922 static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
923                                                USBPacket *p, uint8_t ep)
924 {
925     struct usb_redir_interrupt_packet_header interrupt_packet;
926     g_autofree uint8_t *buf = g_malloc(p->iov.size);
927 
928     DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
929             p->iov.size, p->id);
930 
931     interrupt_packet.endpoint  = ep;
932     interrupt_packet.length    = p->iov.size;
933 
934     usb_packet_copy(p, buf, p->iov.size);
935     usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
936     usbredirparser_send_interrupt_packet(dev->parser, p->id,
937                                     &interrupt_packet, buf, p->iov.size);
938     usbredirparser_do_write(dev->parser);
939 }
940 
941 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
942     uint8_t ep)
943 {
944     struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
945         .endpoint = ep
946     };
947     if (dev->endpoint[EP2I(ep)].interrupt_started) {
948         usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
949                                                      &stop_interrupt_recv);
950         DPRINTF("interrupt recv stopped ep %02X\n", ep);
951         dev->endpoint[EP2I(ep)].interrupt_started = 0;
952     }
953     dev->endpoint[EP2I(ep)].interrupt_error = 0;
954     usbredir_free_bufpq(dev, ep);
955 }
956 
957 static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
958 {
959     USBRedirDevice *dev = USB_REDIRECT(udev);
960     uint8_t ep;
961 
962     ep = p->ep->nr;
963     if (p->pid == USB_TOKEN_IN) {
964         ep |= USB_DIR_IN;
965     }
966 
967     switch (dev->endpoint[EP2I(ep)].type) {
968     case USB_ENDPOINT_XFER_CONTROL:
969         ERROR("handle_data called for control transfer on ep %02X\n", ep);
970         p->status = USB_RET_NAK;
971         break;
972     case USB_ENDPOINT_XFER_BULK:
973         if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
974                 p->ep->pipeline) {
975             p->status = USB_RET_ADD_TO_QUEUE;
976             break;
977         }
978         usbredir_handle_bulk_data(dev, p, ep);
979         break;
980     case USB_ENDPOINT_XFER_ISOC:
981         usbredir_handle_iso_data(dev, p, ep);
982         break;
983     case USB_ENDPOINT_XFER_INT:
984         if (ep & USB_DIR_IN) {
985             usbredir_handle_interrupt_in_data(dev, p, ep);
986         } else {
987             usbredir_handle_interrupt_out_data(dev, p, ep);
988         }
989         break;
990     default:
991         ERROR("handle_data ep %02X has unknown type %d\n", ep,
992               dev->endpoint[EP2I(ep)].type);
993         p->status = USB_RET_NAK;
994     }
995 }
996 
997 static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
998 {
999     if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
1000         usb_ep_combine_input_packets(ep);
1001     }
1002 }
1003 
1004 static void usbredir_stop_ep(USBRedirDevice *dev, int i)
1005 {
1006     uint8_t ep = I2EP(i);
1007 
1008     switch (dev->endpoint[i].type) {
1009     case USB_ENDPOINT_XFER_BULK:
1010         if (ep & USB_DIR_IN) {
1011             usbredir_stop_bulk_receiving(dev, ep);
1012         }
1013         break;
1014     case USB_ENDPOINT_XFER_ISOC:
1015         usbredir_stop_iso_stream(dev, ep);
1016         break;
1017     case USB_ENDPOINT_XFER_INT:
1018         if (ep & USB_DIR_IN) {
1019             usbredir_stop_interrupt_receiving(dev, ep);
1020         }
1021         break;
1022     }
1023     usbredir_free_bufpq(dev, ep);
1024 }
1025 
1026 static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
1027 {
1028     USBRedirDevice *dev = USB_REDIRECT(udev);
1029 
1030     usbredir_stop_ep(dev, USBEP2I(uep));
1031     usbredirparser_do_write(dev->parser);
1032 }
1033 
1034 static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
1035                                 int config)
1036 {
1037     struct usb_redir_set_configuration_header set_config;
1038     int i;
1039 
1040     DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
1041 
1042     for (i = 0; i < MAX_ENDPOINTS; i++) {
1043         usbredir_stop_ep(dev, i);
1044     }
1045 
1046     set_config.configuration = config;
1047     usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
1048     usbredirparser_do_write(dev->parser);
1049     p->status = USB_RET_ASYNC;
1050 }
1051 
1052 static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1053 {
1054     DPRINTF("get config id %"PRIu64"\n", p->id);
1055 
1056     usbredirparser_send_get_configuration(dev->parser, p->id);
1057     usbredirparser_do_write(dev->parser);
1058     p->status = USB_RET_ASYNC;
1059 }
1060 
1061 static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1062                                    int interface, int alt)
1063 {
1064     struct usb_redir_set_alt_setting_header set_alt;
1065     int i;
1066 
1067     DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1068 
1069     for (i = 0; i < MAX_ENDPOINTS; i++) {
1070         if (dev->endpoint[i].interface == interface) {
1071             usbredir_stop_ep(dev, i);
1072         }
1073     }
1074 
1075     set_alt.interface = interface;
1076     set_alt.alt = alt;
1077     usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1078     usbredirparser_do_write(dev->parser);
1079     p->status = USB_RET_ASYNC;
1080 }
1081 
1082 static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1083                                    int interface)
1084 {
1085     struct usb_redir_get_alt_setting_header get_alt;
1086 
1087     DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1088 
1089     get_alt.interface = interface;
1090     usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1091     usbredirparser_do_write(dev->parser);
1092     p->status = USB_RET_ASYNC;
1093 }
1094 
1095 static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1096         int request, int value, int index, int length, uint8_t *data)
1097 {
1098     USBRedirDevice *dev = USB_REDIRECT(udev);
1099     struct usb_redir_control_packet_header control_packet;
1100 
1101     if (usbredir_already_in_flight(dev, p->id)) {
1102         p->status = USB_RET_ASYNC;
1103         return;
1104     }
1105 
1106     /* Special cases for certain standard device requests */
1107     switch (request) {
1108     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1109         DPRINTF("set address %d\n", value);
1110         dev->dev.addr = value;
1111         return;
1112     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1113         usbredir_set_config(dev, p, value & 0xff);
1114         return;
1115     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1116         usbredir_get_config(dev, p);
1117         return;
1118     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1119         usbredir_set_interface(dev, p, index, value);
1120         return;
1121     case InterfaceRequest | USB_REQ_GET_INTERFACE:
1122         usbredir_get_interface(dev, p, index);
1123         return;
1124     }
1125 
1126     /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1127     DPRINTF(
1128         "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1129         request >> 8, request & 0xff, value, index, length, p->id);
1130 
1131     control_packet.request     = request & 0xFF;
1132     control_packet.requesttype = request >> 8;
1133     control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
1134     control_packet.value       = value;
1135     control_packet.index       = index;
1136     control_packet.length      = length;
1137 
1138     if (control_packet.requesttype & USB_DIR_IN) {
1139         usbredirparser_send_control_packet(dev->parser, p->id,
1140                                            &control_packet, NULL, 0);
1141     } else {
1142         usbredir_log_data(dev, "ctrl data out:", data, length);
1143         usbredirparser_send_control_packet(dev->parser, p->id,
1144                                            &control_packet, data, length);
1145     }
1146     usbredirparser_do_write(dev->parser);
1147     p->status = USB_RET_ASYNC;
1148 }
1149 
1150 static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1151                                   int nr_eps, int streams)
1152 {
1153     USBRedirDevice *dev = USB_REDIRECT(udev);
1154 #if USBREDIR_VERSION >= 0x000700
1155     struct usb_redir_alloc_bulk_streams_header alloc_streams;
1156     int i;
1157 
1158     if (!usbredirparser_peer_has_cap(dev->parser,
1159                                      usb_redir_cap_bulk_streams)) {
1160         ERROR("peer does not support streams\n");
1161         goto reject;
1162     }
1163 
1164     if (streams == 0) {
1165         ERROR("request to allocate 0 streams\n");
1166         return -1;
1167     }
1168 
1169     alloc_streams.no_streams = streams;
1170     alloc_streams.endpoints = 0;
1171     for (i = 0; i < nr_eps; i++) {
1172         alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1173     }
1174     usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1175     usbredirparser_do_write(dev->parser);
1176 
1177     return 0;
1178 #else
1179     ERROR("usbredir_alloc_streams not implemented\n");
1180     goto reject;
1181 #endif
1182 reject:
1183     ERROR("streams are not available, disconnecting\n");
1184     qemu_bh_schedule(dev->device_reject_bh);
1185     return -1;
1186 }
1187 
1188 static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1189                                   int nr_eps)
1190 {
1191 #if USBREDIR_VERSION >= 0x000700
1192     USBRedirDevice *dev = USB_REDIRECT(udev);
1193     struct usb_redir_free_bulk_streams_header free_streams;
1194     int i;
1195 
1196     if (!usbredirparser_peer_has_cap(dev->parser,
1197                                      usb_redir_cap_bulk_streams)) {
1198         return;
1199     }
1200 
1201     free_streams.endpoints = 0;
1202     for (i = 0; i < nr_eps; i++) {
1203         free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1204     }
1205     usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1206     usbredirparser_do_write(dev->parser);
1207 #endif
1208 }
1209 
1210 /*
1211  * Close events can be triggered by usbredirparser_do_write which gets called
1212  * from within the USBDevice data / control packet callbacks and doing a
1213  * usb_detach from within these callbacks is not a good idea.
1214  *
1215  * So we use a bh handler to take care of close events.
1216  */
1217 static void usbredir_chardev_close_bh(void *opaque)
1218 {
1219     USBRedirDevice *dev = opaque;
1220 
1221     qemu_bh_cancel(dev->device_reject_bh);
1222     usbredir_device_disconnect(dev);
1223 
1224     if (dev->parser) {
1225         DPRINTF("destroying usbredirparser\n");
1226         usbredirparser_destroy(dev->parser);
1227         dev->parser = NULL;
1228     }
1229     if (dev->watch) {
1230         g_source_remove(dev->watch);
1231         dev->watch = 0;
1232     }
1233 }
1234 
1235 static void usbredir_create_parser(USBRedirDevice *dev)
1236 {
1237     uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1238     int flags = 0;
1239 
1240     DPRINTF("creating usbredirparser\n");
1241 
1242     dev->parser = usbredirparser_create();
1243     if (!dev->parser) {
1244         error_report("usbredirparser_create() failed");
1245         exit(1);
1246     }
1247     dev->parser->priv = dev;
1248     dev->parser->log_func = usbredir_log;
1249     dev->parser->read_func = usbredir_read;
1250     dev->parser->write_func = usbredir_write;
1251     dev->parser->hello_func = usbredir_hello;
1252     dev->parser->device_connect_func = usbredir_device_connect;
1253     dev->parser->device_disconnect_func = usbredir_device_disconnect;
1254     dev->parser->interface_info_func = usbredir_interface_info;
1255     dev->parser->ep_info_func = usbredir_ep_info;
1256     dev->parser->configuration_status_func = usbredir_configuration_status;
1257     dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1258     dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1259     dev->parser->interrupt_receiving_status_func =
1260         usbredir_interrupt_receiving_status;
1261     dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1262     dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1263     dev->parser->control_packet_func = usbredir_control_packet;
1264     dev->parser->bulk_packet_func = usbredir_bulk_packet;
1265     dev->parser->iso_packet_func = usbredir_iso_packet;
1266     dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1267     dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1268     dev->read_buf = NULL;
1269     dev->read_buf_size = 0;
1270 
1271     usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1272     usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1273     usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1274     usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1275     usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1276     usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1277 #if USBREDIR_VERSION >= 0x000700
1278     if (dev->enable_streams) {
1279         usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1280     }
1281 #endif
1282 
1283     if (runstate_check(RUN_STATE_INMIGRATE)) {
1284         flags |= usbredirparser_fl_no_hello;
1285     }
1286     usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1287                         flags);
1288     usbredirparser_do_write(dev->parser);
1289 }
1290 
1291 static void usbredir_reject_device(USBRedirDevice *dev)
1292 {
1293     usbredir_device_disconnect(dev);
1294     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1295         usbredirparser_send_filter_reject(dev->parser);
1296         usbredirparser_do_write(dev->parser);
1297     }
1298 }
1299 
1300 /*
1301  * We may need to reject the device when the hcd calls alloc_streams, doing
1302  * an usb_detach from within a hcd call is not a good idea, hence this bh.
1303  */
1304 static void usbredir_device_reject_bh(void *opaque)
1305 {
1306     USBRedirDevice *dev = opaque;
1307 
1308     usbredir_reject_device(dev);
1309 }
1310 
1311 static void usbredir_do_attach(void *opaque)
1312 {
1313     USBRedirDevice *dev = opaque;
1314     Error *local_err = NULL;
1315 
1316     /* In order to work properly with XHCI controllers we need these caps */
1317     if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1318         usbredirparser_peer_has_cap(dev->parser,
1319                                     usb_redir_cap_ep_info_max_packet_size) &&
1320         usbredirparser_peer_has_cap(dev->parser,
1321                                     usb_redir_cap_32bits_bulk_length) &&
1322         usbredirparser_peer_has_cap(dev->parser,
1323                                     usb_redir_cap_64bits_ids))) {
1324         ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1325         usbredir_reject_device(dev);
1326         return;
1327     }
1328 
1329     usb_device_attach(&dev->dev, &local_err);
1330     if (local_err) {
1331         error_report_err(local_err);
1332         WARNING("rejecting device due to speed mismatch\n");
1333         usbredir_reject_device(dev);
1334     }
1335 }
1336 
1337 /*
1338  * chardev callbacks
1339  */
1340 
1341 static int usbredir_chardev_can_read(void *opaque)
1342 {
1343     USBRedirDevice *dev = opaque;
1344 
1345     if (!dev->parser) {
1346         WARNING("chardev_can_read called on non open chardev!\n");
1347         return 0;
1348     }
1349 
1350     /* Don't read new data from the chardev until our state is fully synced */
1351     if (!runstate_check(RUN_STATE_RUNNING)) {
1352         return 0;
1353     }
1354 
1355     /* usbredir_parser_do_read will consume *all* data we give it */
1356     return 1 * MiB;
1357 }
1358 
1359 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1360 {
1361     USBRedirDevice *dev = opaque;
1362 
1363     /* No recursion allowed! */
1364     assert(dev->read_buf == NULL);
1365 
1366     dev->read_buf = buf;
1367     dev->read_buf_size = size;
1368 
1369     usbredirparser_do_read(dev->parser);
1370     /* Send any acks, etc. which may be queued now */
1371     usbredirparser_do_write(dev->parser);
1372 }
1373 
1374 static void usbredir_chardev_event(void *opaque, QEMUChrEvent event)
1375 {
1376     USBRedirDevice *dev = opaque;
1377 
1378     switch (event) {
1379     case CHR_EVENT_OPENED:
1380         DPRINTF("chardev open\n");
1381         /* Make sure any pending closes are handled (no-op if none pending) */
1382         usbredir_chardev_close_bh(dev);
1383         qemu_bh_cancel(dev->chardev_close_bh);
1384         usbredir_create_parser(dev);
1385         break;
1386     case CHR_EVENT_CLOSED:
1387         DPRINTF("chardev close\n");
1388         qemu_bh_schedule(dev->chardev_close_bh);
1389         break;
1390     case CHR_EVENT_BREAK:
1391     case CHR_EVENT_MUX_IN:
1392     case CHR_EVENT_MUX_OUT:
1393         /* Ignore */
1394         break;
1395     }
1396 }
1397 
1398 /*
1399  * init + destroy
1400  */
1401 
1402 static void usbredir_vm_state_change(void *priv, bool running, RunState state)
1403 {
1404     USBRedirDevice *dev = priv;
1405 
1406     if (running && dev->parser != NULL) {
1407         usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1408     }
1409 }
1410 
1411 static void usbredir_init_endpoints(USBRedirDevice *dev)
1412 {
1413     int i;
1414 
1415     usb_ep_init(&dev->dev);
1416     memset(dev->endpoint, 0, sizeof(dev->endpoint));
1417     for (i = 0; i < MAX_ENDPOINTS; i++) {
1418         dev->endpoint[i].dev = dev;
1419         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1420     }
1421 }
1422 
1423 static void usbredir_realize(USBDevice *udev, Error **errp)
1424 {
1425     USBRedirDevice *dev = USB_REDIRECT(udev);
1426     int i;
1427 
1428     if (!qemu_chr_fe_backend_connected(&dev->cs)) {
1429         error_setg(errp, QERR_MISSING_PARAMETER, "chardev");
1430         return;
1431     }
1432 
1433     if (dev->filter_str) {
1434         i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1435                                            &dev->filter_rules,
1436                                            &dev->filter_rules_count);
1437         if (i) {
1438             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1439                        "a usb device filter string");
1440             return;
1441         }
1442     }
1443 
1444     dev->chardev_close_bh = qemu_bh_new_guarded(usbredir_chardev_close_bh, dev,
1445                                                 &DEVICE(dev)->mem_reentrancy_guard);
1446     dev->device_reject_bh = qemu_bh_new_guarded(usbredir_device_reject_bh, dev,
1447                                                 &DEVICE(dev)->mem_reentrancy_guard);
1448     dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1449 
1450     packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1451     packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1452     usbredir_init_endpoints(dev);
1453 
1454     /* We'll do the attach once we receive the speed from the usb-host */
1455     udev->auto_attach = 0;
1456 
1457     /* Will be cleared during setup when we find conflicts */
1458     dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1459 
1460     /* Let the backend know we are ready */
1461     qemu_chr_fe_set_handlers(&dev->cs, usbredir_chardev_can_read,
1462                              usbredir_chardev_read, usbredir_chardev_event,
1463                              NULL, dev, NULL, true);
1464 
1465     dev->vmstate =
1466         qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1467 }
1468 
1469 static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1470 {
1471     int i;
1472 
1473     packet_id_queue_empty(&dev->cancelled);
1474     packet_id_queue_empty(&dev->already_in_flight);
1475     for (i = 0; i < MAX_ENDPOINTS; i++) {
1476         usbredir_free_bufpq(dev, I2EP(i));
1477     }
1478 }
1479 
1480 static void usbredir_unrealize(USBDevice *udev)
1481 {
1482     USBRedirDevice *dev = USB_REDIRECT(udev);
1483 
1484     qemu_chr_fe_deinit(&dev->cs, true);
1485 
1486     /* Note must be done after qemu_chr_close, as that causes a close event */
1487     qemu_bh_delete(dev->chardev_close_bh);
1488     qemu_bh_delete(dev->device_reject_bh);
1489 
1490     timer_free(dev->attach_timer);
1491 
1492     usbredir_cleanup_device_queues(dev);
1493 
1494     if (dev->parser) {
1495         usbredirparser_destroy(dev->parser);
1496     }
1497     if (dev->watch) {
1498         g_source_remove(dev->watch);
1499     }
1500 
1501     free(dev->filter_rules);
1502     qemu_del_vm_change_state_handler(dev->vmstate);
1503 }
1504 
1505 static int usbredir_check_filter(USBRedirDevice *dev)
1506 {
1507     if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1508         ERROR("No interface info for device\n");
1509         goto error;
1510     }
1511 
1512     if (dev->filter_rules) {
1513         if (!usbredirparser_peer_has_cap(dev->parser,
1514                                     usb_redir_cap_connect_device_version)) {
1515             ERROR("Device filter specified and peer does not have the "
1516                   "connect_device_version capability\n");
1517             goto error;
1518         }
1519 
1520         if (usbredirfilter_check(
1521                 dev->filter_rules,
1522                 dev->filter_rules_count,
1523                 dev->device_info.device_class,
1524                 dev->device_info.device_subclass,
1525                 dev->device_info.device_protocol,
1526                 dev->interface_info.interface_class,
1527                 dev->interface_info.interface_subclass,
1528                 dev->interface_info.interface_protocol,
1529                 dev->interface_info.interface_count,
1530                 dev->device_info.vendor_id,
1531                 dev->device_info.product_id,
1532                 dev->device_info.device_version_bcd,
1533                 0) != 0) {
1534             goto error;
1535         }
1536     }
1537 
1538     return 0;
1539 
1540 error:
1541     usbredir_reject_device(dev);
1542     return -1;
1543 }
1544 
1545 static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1546 {
1547     int i, j, quirks;
1548 
1549     if (!usbredirparser_peer_has_cap(dev->parser,
1550                                      usb_redir_cap_bulk_receiving)) {
1551         return;
1552     }
1553 
1554     for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1555         dev->endpoint[i].bulk_receiving_enabled = 0;
1556     }
1557 
1558     if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1559         return;
1560     }
1561 
1562     for (i = 0; i < dev->interface_info.interface_count; i++) {
1563         quirks = usb_get_quirks(dev->device_info.vendor_id,
1564                                 dev->device_info.product_id,
1565                                 dev->interface_info.interface_class[i],
1566                                 dev->interface_info.interface_subclass[i],
1567                                 dev->interface_info.interface_protocol[i]);
1568         if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1569             continue;
1570         }
1571         if (quirks & USB_QUIRK_IS_FTDI) {
1572             dev->buffered_bulk_in_complete =
1573                 usbredir_buffered_bulk_in_complete_ftdi;
1574         } else {
1575             dev->buffered_bulk_in_complete =
1576                 usbredir_buffered_bulk_in_complete_raw;
1577         }
1578 
1579         for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1580             if (dev->endpoint[j].interface ==
1581                                     dev->interface_info.interface[i] &&
1582                     dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1583                     dev->endpoint[j].max_packet_size != 0) {
1584                 dev->endpoint[j].bulk_receiving_enabled = 1;
1585                 /*
1586                  * With buffering pipelining is not necessary. Also packet
1587                  * combining and bulk in buffering don't play nice together!
1588                  */
1589                 I2USBEP(dev, j)->pipeline = false;
1590                 break; /* Only buffer for the first ep of each intf */
1591             }
1592         }
1593     }
1594 }
1595 
1596 /*
1597  * usbredirparser packet complete callbacks
1598  */
1599 
1600 static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1601     int status)
1602 {
1603     switch (status) {
1604     case usb_redir_success:
1605         p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1606         break;
1607     case usb_redir_stall:
1608         p->status = USB_RET_STALL;
1609         break;
1610     case usb_redir_cancelled:
1611         /*
1612          * When the usbredir-host unredirects a device, it will report a status
1613          * of cancelled for all pending packets, followed by a disconnect msg.
1614          */
1615         p->status = USB_RET_IOERROR;
1616         break;
1617     case usb_redir_inval:
1618         WARNING("got invalid param error from usb-host?\n");
1619         p->status = USB_RET_IOERROR;
1620         break;
1621     case usb_redir_babble:
1622         p->status = USB_RET_BABBLE;
1623         break;
1624     case usb_redir_ioerror:
1625     case usb_redir_timeout:
1626     default:
1627         p->status = USB_RET_IOERROR;
1628     }
1629 }
1630 
1631 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1632 {
1633     USBRedirDevice *dev = priv;
1634 
1635     /* Try to send the filter info now that we've the usb-host's caps */
1636     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1637             dev->filter_rules) {
1638         usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1639                                           dev->filter_rules_count);
1640         usbredirparser_do_write(dev->parser);
1641     }
1642 }
1643 
1644 static void usbredir_device_connect(void *priv,
1645     struct usb_redir_device_connect_header *device_connect)
1646 {
1647     USBRedirDevice *dev = priv;
1648     const char *speed;
1649 
1650     if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1651         ERROR("Received device connect while already connected\n");
1652         return;
1653     }
1654 
1655     switch (device_connect->speed) {
1656     case usb_redir_speed_low:
1657         speed = "low speed";
1658         dev->dev.speed = USB_SPEED_LOW;
1659         dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1660         dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1661         break;
1662     case usb_redir_speed_full:
1663         speed = "full speed";
1664         dev->dev.speed = USB_SPEED_FULL;
1665         dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1666         break;
1667     case usb_redir_speed_high:
1668         speed = "high speed";
1669         dev->dev.speed = USB_SPEED_HIGH;
1670         break;
1671     case usb_redir_speed_super:
1672         speed = "super speed";
1673         dev->dev.speed = USB_SPEED_SUPER;
1674         break;
1675     default:
1676         speed = "unknown speed";
1677         dev->dev.speed = USB_SPEED_FULL;
1678     }
1679 
1680     if (usbredirparser_peer_has_cap(dev->parser,
1681                                     usb_redir_cap_connect_device_version)) {
1682         INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1683              speed, device_connect->vendor_id, device_connect->product_id,
1684              ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1685              ((device_connect->device_version_bcd & 0x0f00) >>  8),
1686              ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1687              ((device_connect->device_version_bcd & 0x000f) >>  0),
1688              device_connect->device_class);
1689     } else {
1690         INFO("attaching %s device %04x:%04x class %02x\n", speed,
1691              device_connect->vendor_id, device_connect->product_id,
1692              device_connect->device_class);
1693     }
1694 
1695     dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1696     dev->device_info = *device_connect;
1697 
1698     if (usbredir_check_filter(dev)) {
1699         WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1700                 device_connect->vendor_id, device_connect->product_id);
1701         return;
1702     }
1703 
1704     usbredir_check_bulk_receiving(dev);
1705     timer_mod(dev->attach_timer, dev->next_attach_time);
1706 }
1707 
1708 static void usbredir_device_disconnect(void *priv)
1709 {
1710     USBRedirDevice *dev = priv;
1711 
1712     /* Stop any pending attaches */
1713     timer_del(dev->attach_timer);
1714 
1715     if (dev->dev.attached) {
1716         DPRINTF("detaching device\n");
1717         usb_device_detach(&dev->dev);
1718         /*
1719          * Delay next usb device attach to give the guest a chance to see
1720          * see the detach / attach in case of quick close / open succession
1721          */
1722         dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1723     }
1724 
1725     /* Reset state so that the next dev connected starts with a clean slate */
1726     usbredir_cleanup_device_queues(dev);
1727     usbredir_init_endpoints(dev);
1728     dev->interface_info.interface_count = NO_INTERFACE_INFO;
1729     dev->dev.addr = 0;
1730     dev->dev.speed = 0;
1731     dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1732 }
1733 
1734 static void usbredir_interface_info(void *priv,
1735     struct usb_redir_interface_info_header *interface_info)
1736 {
1737     USBRedirDevice *dev = priv;
1738 
1739     dev->interface_info = *interface_info;
1740 
1741     /*
1742      * If we receive interface info after the device has already been
1743      * connected (ie on a set_config), re-check interface dependent things.
1744      */
1745     if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1746         usbredir_check_bulk_receiving(dev);
1747         if (usbredir_check_filter(dev)) {
1748             ERROR("Device no longer matches filter after interface info "
1749                   "change, disconnecting!\n");
1750         }
1751     }
1752 }
1753 
1754 static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1755 {
1756     dev->compatible_speedmask &= ~(1 << speed);
1757     dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1758 }
1759 
1760 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1761 {
1762     if (uep->type != USB_ENDPOINT_XFER_BULK) {
1763         return;
1764     }
1765     if (uep->pid == USB_TOKEN_OUT) {
1766         uep->pipeline = true;
1767     }
1768     if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1769         usbredirparser_peer_has_cap(dev->parser,
1770                                     usb_redir_cap_32bits_bulk_length)) {
1771         uep->pipeline = true;
1772     }
1773 }
1774 
1775 static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1776 {
1777     struct USBEndpoint *usb_ep;
1778     int i;
1779 
1780     for (i = 0; i < MAX_ENDPOINTS; i++) {
1781         usb_ep = I2USBEP(dev, i);
1782         usb_ep->type = dev->endpoint[i].type;
1783         usb_ep->ifnum = dev->endpoint[i].interface;
1784         usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1785         usb_ep->max_streams = dev->endpoint[i].max_streams;
1786         usbredir_set_pipeline(dev, usb_ep);
1787     }
1788 }
1789 
1790 static void usbredir_ep_info(void *priv,
1791     struct usb_redir_ep_info_header *ep_info)
1792 {
1793     USBRedirDevice *dev = priv;
1794     int i;
1795 
1796     assert(dev != NULL);
1797     for (i = 0; i < MAX_ENDPOINTS; i++) {
1798         dev->endpoint[i].type = ep_info->type[i];
1799         dev->endpoint[i].interval = ep_info->interval[i];
1800         dev->endpoint[i].interface = ep_info->interface[i];
1801         if (usbredirparser_peer_has_cap(dev->parser,
1802                                      usb_redir_cap_ep_info_max_packet_size)) {
1803             dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1804         }
1805 #if USBREDIR_VERSION >= 0x000700
1806         if (usbredirparser_peer_has_cap(dev->parser,
1807                                         usb_redir_cap_bulk_streams)) {
1808             dev->endpoint[i].max_streams = ep_info->max_streams[i];
1809         }
1810 #endif
1811         switch (dev->endpoint[i].type) {
1812         case usb_redir_type_invalid:
1813             break;
1814         case usb_redir_type_iso:
1815             usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1816             usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1817             /* Fall through */
1818         case usb_redir_type_interrupt:
1819             if (!usbredirparser_peer_has_cap(dev->parser,
1820                                      usb_redir_cap_ep_info_max_packet_size) ||
1821                     ep_info->max_packet_size[i] > 64) {
1822                 usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1823             }
1824             if (!usbredirparser_peer_has_cap(dev->parser,
1825                                      usb_redir_cap_ep_info_max_packet_size) ||
1826                     ep_info->max_packet_size[i] > 1024) {
1827                 usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1828             }
1829             if (dev->endpoint[i].interval == 0) {
1830                 ERROR("Received 0 interval for isoc or irq endpoint\n");
1831                 usbredir_reject_device(dev);
1832                 return;
1833             }
1834             /* Fall through */
1835         case usb_redir_type_control:
1836         case usb_redir_type_bulk:
1837             DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1838                     dev->endpoint[i].type, dev->endpoint[i].interface);
1839             break;
1840         default:
1841             ERROR("Received invalid endpoint type\n");
1842             usbredir_reject_device(dev);
1843             return;
1844         }
1845     }
1846     /* The new ep info may have caused a speed incompatibility, recheck */
1847     if (dev->dev.attached &&
1848             !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1849         ERROR("Device no longer matches speed after endpoint info change, "
1850               "disconnecting!\n");
1851         usbredir_reject_device(dev);
1852         return;
1853     }
1854     usbredir_setup_usb_eps(dev);
1855     usbredir_check_bulk_receiving(dev);
1856 }
1857 
1858 static void usbredir_configuration_status(void *priv, uint64_t id,
1859     struct usb_redir_configuration_status_header *config_status)
1860 {
1861     USBRedirDevice *dev = priv;
1862     USBPacket *p;
1863 
1864     DPRINTF("set config status %d config %d id %"PRIu64"\n",
1865             config_status->status, config_status->configuration, id);
1866 
1867     p = usbredir_find_packet_by_id(dev, 0, id);
1868     if (p) {
1869         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1870             dev->dev.data_buf[0] = config_status->configuration;
1871             p->actual_length = 1;
1872         }
1873         usbredir_handle_status(dev, p, config_status->status);
1874         usb_generic_async_ctrl_complete(&dev->dev, p);
1875     }
1876 }
1877 
1878 static void usbredir_alt_setting_status(void *priv, uint64_t id,
1879     struct usb_redir_alt_setting_status_header *alt_setting_status)
1880 {
1881     USBRedirDevice *dev = priv;
1882     USBPacket *p;
1883 
1884     DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1885             alt_setting_status->status, alt_setting_status->interface,
1886             alt_setting_status->alt, id);
1887 
1888     p = usbredir_find_packet_by_id(dev, 0, id);
1889     if (p) {
1890         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1891             dev->dev.data_buf[0] = alt_setting_status->alt;
1892             p->actual_length = 1;
1893         }
1894         usbredir_handle_status(dev, p, alt_setting_status->status);
1895         usb_generic_async_ctrl_complete(&dev->dev, p);
1896     }
1897 }
1898 
1899 static void usbredir_iso_stream_status(void *priv, uint64_t id,
1900     struct usb_redir_iso_stream_status_header *iso_stream_status)
1901 {
1902     USBRedirDevice *dev = priv;
1903     uint8_t ep = iso_stream_status->endpoint;
1904 
1905     DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1906             ep, id);
1907 
1908     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1909         return;
1910     }
1911 
1912     dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1913     if (iso_stream_status->status == usb_redir_stall) {
1914         DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1915         dev->endpoint[EP2I(ep)].iso_started = 0;
1916     }
1917 }
1918 
1919 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1920     struct usb_redir_interrupt_receiving_status_header
1921     *interrupt_receiving_status)
1922 {
1923     USBRedirDevice *dev = priv;
1924     uint8_t ep = interrupt_receiving_status->endpoint;
1925 
1926     DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1927             interrupt_receiving_status->status, ep, id);
1928 
1929     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1930         return;
1931     }
1932 
1933     dev->endpoint[EP2I(ep)].interrupt_error =
1934         interrupt_receiving_status->status;
1935     if (interrupt_receiving_status->status == usb_redir_stall) {
1936         DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1937         dev->endpoint[EP2I(ep)].interrupt_started = 0;
1938     }
1939 }
1940 
1941 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1942     struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1943 {
1944 #if USBREDIR_VERSION >= 0x000700
1945     USBRedirDevice *dev = priv;
1946 
1947     if (bulk_streams_status->status == usb_redir_success) {
1948         DPRINTF("bulk streams status %d eps %08x\n",
1949                 bulk_streams_status->status, bulk_streams_status->endpoints);
1950     } else {
1951         ERROR("bulk streams %s failed status %d eps %08x\n",
1952               (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1953               bulk_streams_status->status, bulk_streams_status->endpoints);
1954         ERROR("usb-redir-host does not provide streams, disconnecting\n");
1955         usbredir_reject_device(dev);
1956     }
1957 #endif
1958 }
1959 
1960 static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1961     struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1962 {
1963     USBRedirDevice *dev = priv;
1964     uint8_t ep = bulk_receiving_status->endpoint;
1965 
1966     DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1967             bulk_receiving_status->status, ep, id);
1968 
1969     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1970         return;
1971     }
1972 
1973     if (bulk_receiving_status->status == usb_redir_stall) {
1974         DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1975         dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1976     }
1977 }
1978 
1979 static void usbredir_control_packet(void *priv, uint64_t id,
1980     struct usb_redir_control_packet_header *control_packet,
1981     uint8_t *data, int data_len)
1982 {
1983     USBRedirDevice *dev = priv;
1984     USBPacket *p;
1985     int len = control_packet->length;
1986 
1987     DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1988             len, id);
1989 
1990     /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1991      * to work redirected to a not superspeed capable hcd */
1992     if (dev->dev.speed == USB_SPEED_SUPER &&
1993             !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1994             control_packet->requesttype == 0x80 &&
1995             control_packet->request == 6 &&
1996             control_packet->value == 0x100 && control_packet->index == 0 &&
1997             data_len >= 18 && data[7] == 9) {
1998         data[7] = 64;
1999     }
2000 
2001     p = usbredir_find_packet_by_id(dev, 0, id);
2002     if (p) {
2003         usbredir_handle_status(dev, p, control_packet->status);
2004         if (data_len > 0) {
2005             usbredir_log_data(dev, "ctrl data in:", data, data_len);
2006             if (data_len > sizeof(dev->dev.data_buf)) {
2007                 ERROR("ctrl buffer too small (%d > %zu)\n",
2008                       data_len, sizeof(dev->dev.data_buf));
2009                 p->status = USB_RET_STALL;
2010                 data_len = len = sizeof(dev->dev.data_buf);
2011             }
2012             memcpy(dev->dev.data_buf, data, data_len);
2013         }
2014         p->actual_length = len;
2015         /*
2016          * If this is GET_DESCRIPTOR request for configuration descriptor,
2017          * remove 'remote wakeup' flag from it to prevent idle power down
2018          * in Windows guest
2019          */
2020         if (dev->suppress_remote_wake &&
2021             control_packet->requesttype == USB_DIR_IN &&
2022             control_packet->request == USB_REQ_GET_DESCRIPTOR &&
2023             control_packet->value == (USB_DT_CONFIG << 8) &&
2024             control_packet->index == 0 &&
2025             /* bmAttributes field of config descriptor */
2026             len > 7 && (dev->dev.data_buf[7] & USB_CFG_ATT_WAKEUP)) {
2027                 DPRINTF("Removed remote wake %04X:%04X\n",
2028                     dev->device_info.vendor_id,
2029                     dev->device_info.product_id);
2030                 dev->dev.data_buf[7] &= ~USB_CFG_ATT_WAKEUP;
2031             }
2032         usb_generic_async_ctrl_complete(&dev->dev, p);
2033     }
2034     free(data);
2035 }
2036 
2037 static void usbredir_bulk_packet(void *priv, uint64_t id,
2038     struct usb_redir_bulk_packet_header *bulk_packet,
2039     uint8_t *data, int data_len)
2040 {
2041     USBRedirDevice *dev = priv;
2042     uint8_t ep = bulk_packet->endpoint;
2043     int len = (bulk_packet->length_high << 16) | bulk_packet->length;
2044     USBPacket *p;
2045 
2046     DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
2047             bulk_packet->status, ep, bulk_packet->stream_id, len, id);
2048 
2049     p = usbredir_find_packet_by_id(dev, ep, id);
2050     if (p) {
2051         size_t size = usb_packet_size(p);
2052         usbredir_handle_status(dev, p, bulk_packet->status);
2053         if (data_len > 0) {
2054             usbredir_log_data(dev, "bulk data in:", data, data_len);
2055             if (data_len > size) {
2056                 ERROR("bulk got more data then requested (%d > %zd)\n",
2057                       data_len, p->iov.size);
2058                 p->status = USB_RET_BABBLE;
2059                 data_len = len = size;
2060             }
2061             usb_packet_copy(p, data, data_len);
2062         }
2063         p->actual_length = len;
2064         if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
2065             usb_combined_input_packet_complete(&dev->dev, p);
2066         } else {
2067             usb_packet_complete(&dev->dev, p);
2068         }
2069     }
2070     free(data);
2071 }
2072 
2073 static void usbredir_iso_packet(void *priv, uint64_t id,
2074     struct usb_redir_iso_packet_header *iso_packet,
2075     uint8_t *data, int data_len)
2076 {
2077     USBRedirDevice *dev = priv;
2078     uint8_t ep = iso_packet->endpoint;
2079 
2080     DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
2081              iso_packet->status, ep, data_len, id);
2082 
2083     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
2084         ERROR("received iso packet for non iso endpoint %02X\n", ep);
2085         free(data);
2086         return;
2087     }
2088 
2089     if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2090         DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2091         free(data);
2092         return;
2093     }
2094 
2095     /* bufp_alloc also adds the packet to the ep queue */
2096     bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2097 }
2098 
2099 static void usbredir_interrupt_packet(void *priv, uint64_t id,
2100     struct usb_redir_interrupt_packet_header *interrupt_packet,
2101     uint8_t *data, int data_len)
2102 {
2103     USBRedirDevice *dev = priv;
2104     uint8_t ep = interrupt_packet->endpoint;
2105 
2106     DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2107             interrupt_packet->status, ep, data_len, id);
2108 
2109     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2110         ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2111         free(data);
2112         return;
2113     }
2114 
2115     if (ep & USB_DIR_IN) {
2116         if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2117             DPRINTF("received int packet while not started ep %02X\n", ep);
2118             free(data);
2119             return;
2120         }
2121 
2122         /* bufp_alloc also adds the packet to the ep queue */
2123         bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2124 
2125         /* insufficient data solved with USB_RET_NAK */
2126         usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2127     } else {
2128         /*
2129          * We report output interrupt packets as completed directly upon
2130          * submission, so all we can do here if one failed is warn.
2131          */
2132         if (interrupt_packet->status) {
2133             WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2134                     interrupt_packet->status, ep, id);
2135         }
2136     }
2137 }
2138 
2139 static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2140     struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2141     uint8_t *data, int data_len)
2142 {
2143     USBRedirDevice *dev = priv;
2144     uint8_t status, ep = buffered_bulk_packet->endpoint;
2145     void *free_on_destroy;
2146     int i, len;
2147 
2148     DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2149             buffered_bulk_packet->status, ep, data_len, id);
2150 
2151     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2152         ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2153         free(data);
2154         return;
2155     }
2156 
2157     if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2158         DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2159         free(data);
2160         return;
2161     }
2162 
2163     /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2164     len = dev->endpoint[EP2I(ep)].max_packet_size;
2165     status = usb_redir_success;
2166     free_on_destroy = NULL;
2167     for (i = 0; i < data_len; i += len) {
2168         int r;
2169         if (len >= (data_len - i)) {
2170             len = data_len - i;
2171             status = buffered_bulk_packet->status;
2172             free_on_destroy = data;
2173         }
2174         /* bufp_alloc also adds the packet to the ep queue */
2175         r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2176         if (r) {
2177             break;
2178         }
2179     }
2180 
2181     if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2182         USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2183         dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2184         usbredir_buffered_bulk_in_complete(dev, p, ep);
2185         usb_packet_complete(&dev->dev, p);
2186     }
2187 }
2188 
2189 /*
2190  * Migration code
2191  */
2192 
2193 static int usbredir_pre_save(void *priv)
2194 {
2195     USBRedirDevice *dev = priv;
2196 
2197     usbredir_fill_already_in_flight(dev);
2198 
2199     return 0;
2200 }
2201 
2202 static int usbredir_post_load(void *priv, int version_id)
2203 {
2204     USBRedirDevice *dev = priv;
2205 
2206     if (dev == NULL || dev->parser == NULL) {
2207         return 0;
2208     }
2209 
2210     switch (dev->device_info.speed) {
2211     case usb_redir_speed_low:
2212         dev->dev.speed = USB_SPEED_LOW;
2213         break;
2214     case usb_redir_speed_full:
2215         dev->dev.speed = USB_SPEED_FULL;
2216         break;
2217     case usb_redir_speed_high:
2218         dev->dev.speed = USB_SPEED_HIGH;
2219         break;
2220     case usb_redir_speed_super:
2221         dev->dev.speed = USB_SPEED_SUPER;
2222         break;
2223     default:
2224         dev->dev.speed = USB_SPEED_FULL;
2225     }
2226     dev->dev.speedmask = (1 << dev->dev.speed);
2227 
2228     usbredir_setup_usb_eps(dev);
2229     usbredir_check_bulk_receiving(dev);
2230 
2231     return 0;
2232 }
2233 
2234 /* For usbredirparser migration */
2235 static int usbredir_put_parser(QEMUFile *f, void *priv, size_t unused,
2236                                const VMStateField *field, JSONWriter *vmdesc)
2237 {
2238     USBRedirDevice *dev = priv;
2239     uint8_t *data;
2240     int len;
2241 
2242     if (dev->parser == NULL) {
2243         qemu_put_be32(f, 0);
2244         return 0;
2245     }
2246 
2247     usbredirparser_serialize(dev->parser, &data, &len);
2248     if (!data) {
2249         error_report("usbredirparser_serialize failed");
2250         exit(1);
2251     }
2252 
2253     qemu_put_be32(f, len);
2254     qemu_put_buffer(f, data, len);
2255 
2256     free(data);
2257 
2258     return 0;
2259 }
2260 
2261 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused,
2262                                const VMStateField *field)
2263 {
2264     USBRedirDevice *dev = priv;
2265     uint8_t *data;
2266     int len, ret;
2267 
2268     len = qemu_get_be32(f);
2269     if (len == 0) {
2270         return 0;
2271     }
2272 
2273     /*
2274      * If our chardev is not open already at this point the usbredir connection
2275      * has been broken (non seamless migration, or restore from disk).
2276      *
2277      * In this case create a temporary parser to receive the migration data,
2278      * and schedule the close_bh to report the device as disconnected to the
2279      * guest and to destroy the parser again.
2280      */
2281     if (dev->parser == NULL) {
2282         WARNING("usb-redir connection broken during migration\n");
2283         usbredir_create_parser(dev);
2284         qemu_bh_schedule(dev->chardev_close_bh);
2285     }
2286 
2287     data = g_malloc(len);
2288     qemu_get_buffer(f, data, len);
2289 
2290     ret = usbredirparser_unserialize(dev->parser, data, len);
2291 
2292     g_free(data);
2293 
2294     return ret;
2295 }
2296 
2297 static const VMStateInfo usbredir_parser_vmstate_info = {
2298     .name = "usb-redir-parser",
2299     .put  = usbredir_put_parser,
2300     .get  = usbredir_get_parser,
2301 };
2302 
2303 
2304 /* For buffered packets (iso/irq) queue migration */
2305 static int usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused,
2306                               const VMStateField *field, JSONWriter *vmdesc)
2307 {
2308     struct endp_data *endp = priv;
2309     USBRedirDevice *dev = endp->dev;
2310     struct buf_packet *bufp;
2311     int len, i = 0;
2312 
2313     qemu_put_be32(f, endp->bufpq_size);
2314     QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2315         len = bufp->len - bufp->offset;
2316         DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2317                 len, bufp->status);
2318         qemu_put_be32(f, len);
2319         qemu_put_be32(f, bufp->status);
2320         qemu_put_buffer(f, bufp->data + bufp->offset, len);
2321         i++;
2322     }
2323     assert(i == endp->bufpq_size);
2324 
2325     return 0;
2326 }
2327 
2328 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused,
2329                               const VMStateField *field)
2330 {
2331     struct endp_data *endp = priv;
2332     USBRedirDevice *dev = endp->dev;
2333     struct buf_packet *bufp;
2334     int i;
2335 
2336     endp->bufpq_size = qemu_get_be32(f);
2337     for (i = 0; i < endp->bufpq_size; i++) {
2338         bufp = g_new(struct buf_packet, 1);
2339         bufp->len = qemu_get_be32(f);
2340         bufp->status = qemu_get_be32(f);
2341         bufp->offset = 0;
2342         bufp->data = malloc(bufp->len); /* regular malloc! */
2343         if (!bufp->data) {
2344             error_report("usbredir_get_bufpq: out of memory");
2345             exit(1);
2346         }
2347         bufp->free_on_destroy = bufp->data;
2348         qemu_get_buffer(f, bufp->data, bufp->len);
2349         QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2350         DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2351                 bufp->len, bufp->status);
2352     }
2353     return 0;
2354 }
2355 
2356 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2357     .name = "usb-redir-bufpq",
2358     .put  = usbredir_put_bufpq,
2359     .get  = usbredir_get_bufpq,
2360 };
2361 
2362 
2363 /* For endp_data migration */
2364 static bool usbredir_bulk_receiving_needed(void *priv)
2365 {
2366     struct endp_data *endp = priv;
2367 
2368     return endp->bulk_receiving_started;
2369 }
2370 
2371 static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2372     .name = "usb-redir-ep/bulk-receiving",
2373     .version_id = 1,
2374     .minimum_version_id = 1,
2375     .needed = usbredir_bulk_receiving_needed,
2376     .fields = (const VMStateField[]) {
2377         VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2378         VMSTATE_END_OF_LIST()
2379     }
2380 };
2381 
2382 static bool usbredir_stream_needed(void *priv)
2383 {
2384     struct endp_data *endp = priv;
2385 
2386     return endp->max_streams;
2387 }
2388 
2389 static const VMStateDescription usbredir_stream_vmstate = {
2390     .name = "usb-redir-ep/stream-state",
2391     .version_id = 1,
2392     .minimum_version_id = 1,
2393     .needed = usbredir_stream_needed,
2394     .fields = (const VMStateField[]) {
2395         VMSTATE_UINT32(max_streams, struct endp_data),
2396         VMSTATE_END_OF_LIST()
2397     }
2398 };
2399 
2400 static const VMStateDescription usbredir_ep_vmstate = {
2401     .name = "usb-redir-ep",
2402     .version_id = 1,
2403     .minimum_version_id = 1,
2404     .fields = (const VMStateField[]) {
2405         VMSTATE_UINT8(type, struct endp_data),
2406         VMSTATE_UINT8(interval, struct endp_data),
2407         VMSTATE_UINT8(interface, struct endp_data),
2408         VMSTATE_UINT16(max_packet_size, struct endp_data),
2409         VMSTATE_UINT8(iso_started, struct endp_data),
2410         VMSTATE_UINT8(iso_error, struct endp_data),
2411         VMSTATE_UINT8(interrupt_started, struct endp_data),
2412         VMSTATE_UINT8(interrupt_error, struct endp_data),
2413         VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2414         VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2415         {
2416             .name         = "bufpq",
2417             .version_id   = 0,
2418             .field_exists = NULL,
2419             .size         = 0,
2420             .info         = &usbredir_ep_bufpq_vmstate_info,
2421             .flags        = VMS_SINGLE,
2422             .offset       = 0,
2423         },
2424         VMSTATE_INT32(bufpq_target_size, struct endp_data),
2425         VMSTATE_END_OF_LIST()
2426     },
2427     .subsections = (const VMStateDescription * const []) {
2428         &usbredir_bulk_receiving_vmstate,
2429         &usbredir_stream_vmstate,
2430         NULL
2431     }
2432 };
2433 
2434 
2435 /* For PacketIdQueue migration */
2436 static int usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2437                                     const VMStateField *field,
2438                                     JSONWriter *vmdesc)
2439 {
2440     struct PacketIdQueue *q = priv;
2441     USBRedirDevice *dev = q->dev;
2442     struct PacketIdQueueEntry *e;
2443     int remain = q->size;
2444 
2445     DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2446     qemu_put_be32(f, q->size);
2447     QTAILQ_FOREACH(e, &q->head, next) {
2448         qemu_put_be64(f, e->id);
2449         remain--;
2450     }
2451     assert(remain == 0);
2452 
2453     return 0;
2454 }
2455 
2456 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2457                                     const VMStateField *field)
2458 {
2459     struct PacketIdQueue *q = priv;
2460     USBRedirDevice *dev = q->dev;
2461     int i, size;
2462     uint64_t id;
2463 
2464     size = qemu_get_be32(f);
2465     DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2466     for (i = 0; i < size; i++) {
2467         id = qemu_get_be64(f);
2468         packet_id_queue_add(q, id);
2469     }
2470     assert(q->size == size);
2471     return 0;
2472 }
2473 
2474 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2475     .name = "usb-redir-packet-id-q",
2476     .put  = usbredir_put_packet_id_q,
2477     .get  = usbredir_get_packet_id_q,
2478 };
2479 
2480 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2481     .name = "usb-redir-packet-id-queue",
2482     .version_id = 1,
2483     .minimum_version_id = 1,
2484     .fields = (const VMStateField[]) {
2485         {
2486             .name         = "queue",
2487             .version_id   = 0,
2488             .field_exists = NULL,
2489             .size         = 0,
2490             .info         = &usbredir_ep_packet_id_q_vmstate_info,
2491             .flags        = VMS_SINGLE,
2492             .offset       = 0,
2493         },
2494         VMSTATE_END_OF_LIST()
2495     }
2496 };
2497 
2498 
2499 /* For usb_redir_device_connect_header migration */
2500 static const VMStateDescription usbredir_device_info_vmstate = {
2501     .name = "usb-redir-device-info",
2502     .version_id = 1,
2503     .minimum_version_id = 1,
2504     .fields = (const VMStateField[]) {
2505         VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2506         VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2507         VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2508         VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2509         VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2510         VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2511         VMSTATE_UINT16(device_version_bcd,
2512                        struct usb_redir_device_connect_header),
2513         VMSTATE_END_OF_LIST()
2514     }
2515 };
2516 
2517 
2518 /* For usb_redir_interface_info_header migration */
2519 static const VMStateDescription usbredir_interface_info_vmstate = {
2520     .name = "usb-redir-interface-info",
2521     .version_id = 1,
2522     .minimum_version_id = 1,
2523     .fields = (const VMStateField[]) {
2524         VMSTATE_UINT32(interface_count,
2525                        struct usb_redir_interface_info_header),
2526         VMSTATE_UINT8_ARRAY(interface,
2527                             struct usb_redir_interface_info_header, 32),
2528         VMSTATE_UINT8_ARRAY(interface_class,
2529                             struct usb_redir_interface_info_header, 32),
2530         VMSTATE_UINT8_ARRAY(interface_subclass,
2531                             struct usb_redir_interface_info_header, 32),
2532         VMSTATE_UINT8_ARRAY(interface_protocol,
2533                             struct usb_redir_interface_info_header, 32),
2534         VMSTATE_END_OF_LIST()
2535     }
2536 };
2537 
2538 
2539 /* And finally the USBRedirDevice vmstate itself */
2540 static const VMStateDescription usbredir_vmstate = {
2541     .name = "usb-redir",
2542     .version_id = 1,
2543     .minimum_version_id = 1,
2544     .pre_save = usbredir_pre_save,
2545     .post_load = usbredir_post_load,
2546     .fields = (const VMStateField[]) {
2547         VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2548         VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2549         {
2550             .name         = "parser",
2551             .version_id   = 0,
2552             .field_exists = NULL,
2553             .size         = 0,
2554             .info         = &usbredir_parser_vmstate_info,
2555             .flags        = VMS_SINGLE,
2556             .offset       = 0,
2557         },
2558         VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2559                              usbredir_ep_vmstate, struct endp_data),
2560         VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2561                        usbredir_ep_packet_id_queue_vmstate,
2562                        struct PacketIdQueue),
2563         VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2564                        usbredir_ep_packet_id_queue_vmstate,
2565                        struct PacketIdQueue),
2566         VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2567                        usbredir_device_info_vmstate,
2568                        struct usb_redir_device_connect_header),
2569         VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2570                        usbredir_interface_info_vmstate,
2571                        struct usb_redir_interface_info_header),
2572         VMSTATE_END_OF_LIST()
2573     }
2574 };
2575 
2576 static Property usbredir_properties[] = {
2577     DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2578     DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2579     DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2580     DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
2581     DEFINE_PROP_BOOL("suppress-remote-wake", USBRedirDevice,
2582                      suppress_remote_wake, true),
2583     DEFINE_PROP_END_OF_LIST(),
2584 };
2585 
2586 static void usbredir_class_initfn(ObjectClass *klass, void *data)
2587 {
2588     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2589     DeviceClass *dc = DEVICE_CLASS(klass);
2590 
2591     uc->realize        = usbredir_realize;
2592     uc->product_desc   = "USB Redirection Device";
2593     uc->unrealize      = usbredir_unrealize;
2594     uc->cancel_packet  = usbredir_cancel_packet;
2595     uc->handle_reset   = usbredir_handle_reset;
2596     uc->handle_data    = usbredir_handle_data;
2597     uc->handle_control = usbredir_handle_control;
2598     uc->flush_ep_queue = usbredir_flush_ep_queue;
2599     uc->ep_stopped     = usbredir_ep_stopped;
2600     uc->alloc_streams  = usbredir_alloc_streams;
2601     uc->free_streams   = usbredir_free_streams;
2602     dc->vmsd           = &usbredir_vmstate;
2603     device_class_set_props(dc, usbredir_properties);
2604     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2605 }
2606 
2607 static void usbredir_instance_init(Object *obj)
2608 {
2609     USBDevice *udev = USB_DEVICE(obj);
2610     USBRedirDevice *dev = USB_REDIRECT(udev);
2611 
2612     device_add_bootindex_property(obj, &dev->bootindex,
2613                                   "bootindex", NULL,
2614                                   &udev->qdev);
2615 }
2616 
2617 static const TypeInfo usbredir_dev_info = {
2618     .name          = TYPE_USB_REDIR,
2619     .parent        = TYPE_USB_DEVICE,
2620     .instance_size = sizeof(USBRedirDevice),
2621     .class_init    = usbredir_class_initfn,
2622     .instance_init = usbredir_instance_init,
2623 };
2624 module_obj(TYPE_USB_REDIR);
2625 module_kconfig(USB);
2626 
2627 static void usbredir_register_types(void)
2628 {
2629     type_register_static(&usbredir_dev_info);
2630 }
2631 
2632 type_init(usbredir_register_types)
2633