qemu

1
/*
2
 * USB redirector usb-guest
3
 *
4
 * Copyright (c) 2011-2012 Red Hat, Inc.
5
 *
6
 * Red Hat Authors:
7
 * Hans de Goede <hdegoede@redhat.com>
8
 *
9
 * Permission is hereby granted, free of charge, to any person obtaining a copy
10
 * of this software and associated documentation files (the "Software"), to deal
11
 * in the Software without restriction, including without limitation the rights
12
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13
 * copies of the Software, and to permit persons to whom the Software is
14
 * furnished to do so, subject to the following conditions:
15
 *
16
 * The above copyright notice and this permission notice shall be included in
17
 * all copies or substantial portions of the Software.
18
 *
19
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25
 * THE SOFTWARE.
26
 */
27

28
#include "qemu/osdep.h"
29
#include "qemu/cutils.h"
30
#include "qemu/units.h"
31
#include "qapi/error.h"
32
#include "qemu/timer.h"
33
#include "sysemu/runstate.h"
34
#include "sysemu/sysemu.h"
35
#include "qapi/qmp/qerror.h"
36
#include "qemu/error-report.h"
37
#include "qemu/iov.h"
38
#include "qemu/module.h"
39
#include "chardev/char-fe.h"
40

41
#include <usbredirparser.h>
42
#include <usbredirfilter.h>
43

44
#include "hw/qdev-properties.h"
45
#include "hw/qdev-properties-system.h"
46
#include "hw/usb.h"
47
#include "migration/qemu-file-types.h"
48
#include "migration/vmstate.h"
49
#include "qom/object.h"
50

51
/* ERROR is defined below. Remove any previous definition. */
52
#undef ERROR
53

54
#define MAX_ENDPOINTS 32
55
#define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
56
#define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
57
#define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
58
#define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
59
                         ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
60
#define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
61
                       ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
62
                       (i) & 0x0f))
63

64
#ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
65
#define USBREDIR_VERSION 0
66
#endif
67

68
typedef struct USBRedirDevice USBRedirDevice;
69

70
/* Struct to hold buffered packets */
71
struct buf_packet {
72
    uint8_t *data;
73
    void *free_on_destroy;
74
    uint16_t len;
75
    uint16_t offset;
76
    uint8_t status;
77
    QTAILQ_ENTRY(buf_packet)next;
78
};
79

80
struct endp_data {
81
    USBRedirDevice *dev;
82
    uint8_t type;
83
    uint8_t interval;
84
    uint8_t interface; /* bInterfaceNumber this ep belongs to */
85
    uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
86
    uint32_t max_streams;
87
    uint8_t iso_started;
88
    uint8_t iso_error; /* For reporting iso errors to the HC */
89
    uint8_t interrupt_started;
90
    uint8_t interrupt_error;
91
    uint8_t bulk_receiving_enabled;
92
    uint8_t bulk_receiving_started;
93
    uint8_t bufpq_prefilled;
94
    uint8_t bufpq_dropping_packets;
95
    QTAILQ_HEAD(, buf_packet) bufpq;
96
    int32_t bufpq_size;
97
    int32_t bufpq_target_size;
98
    USBPacket *pending_async_packet;
99
};
100

101
struct PacketIdQueueEntry {
102
    uint64_t id;
103
    QTAILQ_ENTRY(PacketIdQueueEntry)next;
104
};
105

106
struct PacketIdQueue {
107
    USBRedirDevice *dev;
108
    const char *name;
109
    QTAILQ_HEAD(, PacketIdQueueEntry) head;
110
    int size;
111
};
112

113
struct USBRedirDevice {
114
    USBDevice dev;
115
    /* Properties */
116
    CharBackend cs;
117
    bool enable_streams;
118
    bool suppress_remote_wake;
119
    bool in_write;
120
    uint8_t debug;
121
    int32_t bootindex;
122
    char *filter_str;
123
    /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
124
    const uint8_t *read_buf;
125
    int read_buf_size;
126
    /* Active chardev-watch-tag */
127
    guint watch;
128
    /* For async handling of close / reject */
129
    QEMUBH *chardev_close_bh;
130
    QEMUBH *device_reject_bh;
131
    /* To delay the usb attach in case of quick chardev close + open */
132
    QEMUTimer *attach_timer;
133
    int64_t next_attach_time;
134
    struct usbredirparser *parser;
135
    struct endp_data endpoint[MAX_ENDPOINTS];
136
    struct PacketIdQueue cancelled;
137
    struct PacketIdQueue already_in_flight;
138
    void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
139
    /* Data for device filtering */
140
    struct usb_redir_device_connect_header device_info;
141
    struct usb_redir_interface_info_header interface_info;
142
    struct usbredirfilter_rule *filter_rules;
143
    int filter_rules_count;
144
    int compatible_speedmask;
145
    VMChangeStateEntry *vmstate;
146
};
147

148
#define TYPE_USB_REDIR "usb-redir"
149
DECLARE_INSTANCE_CHECKER(USBRedirDevice, USB_REDIRECT,
150
                         TYPE_USB_REDIR)
151

152
static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
153
static void usbredir_device_connect(void *priv,
154
    struct usb_redir_device_connect_header *device_connect);
155
static void usbredir_device_disconnect(void *priv);
156
static void usbredir_interface_info(void *priv,
157
    struct usb_redir_interface_info_header *interface_info);
158
static void usbredir_ep_info(void *priv,
159
    struct usb_redir_ep_info_header *ep_info);
160
static void usbredir_configuration_status(void *priv, uint64_t id,
161
    struct usb_redir_configuration_status_header *configuration_status);
162
static void usbredir_alt_setting_status(void *priv, uint64_t id,
163
    struct usb_redir_alt_setting_status_header *alt_setting_status);
164
static void usbredir_iso_stream_status(void *priv, uint64_t id,
165
    struct usb_redir_iso_stream_status_header *iso_stream_status);
166
static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
167
    struct usb_redir_interrupt_receiving_status_header
168
    *interrupt_receiving_status);
169
static void usbredir_bulk_streams_status(void *priv, uint64_t id,
170
    struct usb_redir_bulk_streams_status_header *bulk_streams_status);
171
static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
172
    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
173
static void usbredir_control_packet(void *priv, uint64_t id,
174
    struct usb_redir_control_packet_header *control_packet,
175
    uint8_t *data, int data_len);
176
static void usbredir_bulk_packet(void *priv, uint64_t id,
177
    struct usb_redir_bulk_packet_header *bulk_packet,
178
    uint8_t *data, int data_len);
179
static void usbredir_iso_packet(void *priv, uint64_t id,
180
    struct usb_redir_iso_packet_header *iso_packet,
181
    uint8_t *data, int data_len);
182
static void usbredir_interrupt_packet(void *priv, uint64_t id,
183
    struct usb_redir_interrupt_packet_header *interrupt_header,
184
    uint8_t *data, int data_len);
185
static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
186
    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
187
    uint8_t *data, int data_len);
188

189
static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
190
    int status);
191

192
#define VERSION "qemu usb-redir guest " QEMU_VERSION
193

194
/*
195
 * Logging stuff
196
 */
197

198
#define ERROR(...) \
199
    do { \
200
        if (dev->debug >= usbredirparser_error) { \
201
            error_report("usb-redir error: " __VA_ARGS__); \
202
        } \
203
    } while (0)
204
#define WARNING(...) \
205
    do { \
206
        if (dev->debug >= usbredirparser_warning) { \
207
            warn_report("" __VA_ARGS__); \
208
        } \
209
    } while (0)
210
#define INFO(...) \
211
    do { \
212
        if (dev->debug >= usbredirparser_info) { \
213
            error_report("usb-redir: " __VA_ARGS__); \
214
        } \
215
    } while (0)
216
#define DPRINTF(...) \
217
    do { \
218
        if (dev->debug >= usbredirparser_debug) { \
219
            error_report("usb-redir: " __VA_ARGS__); \
220
        } \
221
    } while (0)
222
#define DPRINTF2(...) \
223
    do { \
224
        if (dev->debug >= usbredirparser_debug_data) { \
225
            error_report("usb-redir: " __VA_ARGS__); \
226
        } \
227
    } while (0)
228

229
static void usbredir_log(void *priv, int level, const char *msg)
230
{
231
    USBRedirDevice *dev = priv;
232

233
    if (dev->debug < level) {
234
        return;
235
    }
236

237
    error_report("%s", msg);
238
}
239

240
static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
241
    const uint8_t *data, int len)
242
{
243
    if (dev->debug < usbredirparser_debug_data) {
244
        return;
245
    }
246
    qemu_hexdump(stderr, desc, data, len);
247
}
248

249
/*
250
 * usbredirparser io functions
251
 */
252

253
static int usbredir_read(void *priv, uint8_t *data, int count)
254
{
255
    USBRedirDevice *dev = priv;
256

257
    if (dev->read_buf_size < count) {
258
        count = dev->read_buf_size;
259
    }
260

261
    memcpy(data, dev->read_buf, count);
262

263
    dev->read_buf_size -= count;
264
    if (dev->read_buf_size) {
265
        dev->read_buf += count;
266
    } else {
267
        dev->read_buf = NULL;
268
    }
269

270
    return count;
271
}
272

273
static gboolean usbredir_write_unblocked(void *do_not_use, GIOCondition cond,
274
                                         void *opaque)
275
{
276
    USBRedirDevice *dev = opaque;
277

278
    dev->watch = 0;
279
    usbredirparser_do_write(dev->parser);
280

281
    return G_SOURCE_REMOVE;
282
}
283

284
static int usbredir_write(void *priv, uint8_t *data, int count)
285
{
286
    USBRedirDevice *dev = priv;
287
    int r;
288

289
    if (!qemu_chr_fe_backend_open(&dev->cs)) {
290
        return 0;
291
    }
292

293
    /* Don't send new data to the chardev until our state is fully synced */
294
    if (!runstate_check(RUN_STATE_RUNNING)) {
295
        return 0;
296
    }
297

298
    /* Recursion check */
299
    if (dev->in_write) {
300
        DPRINTF("usbredir_write recursion\n");
301
        return 0;
302
    }
303
    dev->in_write = true;
304

305
    r = qemu_chr_fe_write(&dev->cs, data, count);
306
    if (r < count) {
307
        if (!dev->watch) {
308
            dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
309
                                               usbredir_write_unblocked, dev);
310
        }
311
        if (r < 0) {
312
            r = 0;
313
        }
314
    }
315
    dev->in_write = false;
316
    return r;
317
}
318

319
/*
320
 * Cancelled and buffered packets helpers
321
 */
322

323
static void packet_id_queue_init(struct PacketIdQueue *q,
324
    USBRedirDevice *dev, const char *name)
325
{
326
    q->dev = dev;
327
    q->name = name;
328
    QTAILQ_INIT(&q->head);
329
    q->size = 0;
330
}
331

332
static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
333
{
334
    USBRedirDevice *dev = q->dev;
335
    struct PacketIdQueueEntry *e;
336

337
    DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
338

339
    e = g_new0(struct PacketIdQueueEntry, 1);
340
    e->id = id;
341
    QTAILQ_INSERT_TAIL(&q->head, e, next);
342
    q->size++;
343
}
344

345
static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
346
{
347
    USBRedirDevice *dev = q->dev;
348
    struct PacketIdQueueEntry *e;
349

350
    QTAILQ_FOREACH(e, &q->head, next) {
351
        if (e->id == id) {
352
            DPRINTF("removing packet id %"PRIu64" from %s queue\n",
353
                    id, q->name);
354
            QTAILQ_REMOVE(&q->head, e, next);
355
            q->size--;
356
            g_free(e);
357
            return 1;
358
        }
359
    }
360
    return 0;
361
}
362

363
static void packet_id_queue_empty(struct PacketIdQueue *q)
364
{
365
    USBRedirDevice *dev = q->dev;
366
    struct PacketIdQueueEntry *e, *next_e;
367

368
    DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
369

370
    QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
371
        QTAILQ_REMOVE(&q->head, e, next);
372
        g_free(e);
373
    }
374
    q->size = 0;
375
}
376

377
static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
378
{
379
    USBRedirDevice *dev = USB_REDIRECT(udev);
380
    int i = USBEP2I(p->ep);
381

382
    if (p->combined) {
383
        usb_combined_packet_cancel(udev, p);
384
        return;
385
    }
386

387
    if (dev->endpoint[i].pending_async_packet) {
388
        assert(dev->endpoint[i].pending_async_packet == p);
389
        dev->endpoint[i].pending_async_packet = NULL;
390
        return;
391
    }
392

393
    packet_id_queue_add(&dev->cancelled, p->id);
394
    usbredirparser_send_cancel_data_packet(dev->parser, p->id);
395
    usbredirparser_do_write(dev->parser);
396
}
397

398
static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
399
{
400
    if (!dev->dev.attached) {
401
        return 1; /* Treat everything as cancelled after a disconnect */
402
    }
403
    return packet_id_queue_remove(&dev->cancelled, id);
404
}
405

406
static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
407
    struct USBEndpoint *ep)
408
{
409
    static USBPacket *p;
410

411
    /* async handled packets for bulk receiving eps do not count as inflight */
412
    if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
413
        return;
414
    }
415

416
    QTAILQ_FOREACH(p, &ep->queue, queue) {
417
        /* Skip combined packets, except for the first */
418
        if (p->combined && p != p->combined->first) {
419
            continue;
420
        }
421
        if (p->state == USB_PACKET_ASYNC) {
422
            packet_id_queue_add(&dev->already_in_flight, p->id);
423
        }
424
    }
425
}
426

427
static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
428
{
429
    int ep;
430
    struct USBDevice *udev = &dev->dev;
431

432
    usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
433

434
    for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
435
        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
436
        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
437
    }
438
}
439

440
static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
441
{
442
    return packet_id_queue_remove(&dev->already_in_flight, id);
443
}
444

445
static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
446
    uint8_t ep, uint64_t id)
447
{
448
    USBPacket *p;
449

450
    if (usbredir_is_cancelled(dev, id)) {
451
        return NULL;
452
    }
453

454
    p = usb_ep_find_packet_by_id(&dev->dev,
455
                            (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
456
                            ep & 0x0f, id);
457
    if (p == NULL) {
458
        ERROR("could not find packet with id %"PRIu64"\n", id);
459
    }
460
    return p;
461
}
462

463
static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
464
    uint8_t status, uint8_t ep, void *free_on_destroy)
465
{
466
    struct buf_packet *bufp;
467

468
    if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
469
        dev->endpoint[EP2I(ep)].bufpq_size >
470
            2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
471
        DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
472
        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
473
    }
474
    /* Since we're interrupting the stream anyways, drop enough packets to get
475
       back to our target buffer size */
476
    if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
477
        if (dev->endpoint[EP2I(ep)].bufpq_size >
478
                dev->endpoint[EP2I(ep)].bufpq_target_size) {
479
            free(free_on_destroy);
480
            return -1;
481
        }
482
        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
483
    }
484

485
    bufp = g_new(struct buf_packet, 1);
486
    bufp->data   = data;
487
    bufp->len    = len;
488
    bufp->offset = 0;
489
    bufp->status = status;
490
    bufp->free_on_destroy = free_on_destroy;
491
    QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
492
    dev->endpoint[EP2I(ep)].bufpq_size++;
493
    return 0;
494
}
495

496
static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
497
    uint8_t ep)
498
{
499
    QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
500
    dev->endpoint[EP2I(ep)].bufpq_size--;
501
    free(bufp->free_on_destroy);
502
    g_free(bufp);
503
}
504

505
static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
506
{
507
    struct buf_packet *buf, *buf_next;
508

509
    QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
510
        bufp_free(dev, buf, ep);
511
    }
512
}
513

514
/*
515
 * USBDevice callbacks
516
 */
517

518
static void usbredir_handle_reset(USBDevice *udev)
519
{
520
    USBRedirDevice *dev = USB_REDIRECT(udev);
521

522
    DPRINTF("reset device\n");
523
    usbredirparser_send_reset(dev->parser);
524
    usbredirparser_do_write(dev->parser);
525
}
526

527
static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
528
                                     uint8_t ep)
529
{
530
    int status, len;
531
    if (!dev->endpoint[EP2I(ep)].iso_started &&
532
            !dev->endpoint[EP2I(ep)].iso_error) {
533
        struct usb_redir_start_iso_stream_header start_iso = {
534
            .endpoint = ep,
535
        };
536
        int pkts_per_sec;
537

538
        if (dev->dev.speed == USB_SPEED_HIGH) {
539
            pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
540
        } else {
541
            pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
542
        }
543
        /* Testing has shown that we need circa 60 ms buffer */
544
        dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
545

546
        /* Aim for approx 100 interrupts / second on the client to
547
           balance latency and interrupt load */
548
        start_iso.pkts_per_urb = pkts_per_sec / 100;
549
        if (start_iso.pkts_per_urb < 1) {
550
            start_iso.pkts_per_urb = 1;
551
        } else if (start_iso.pkts_per_urb > 32) {
552
            start_iso.pkts_per_urb = 32;
553
        }
554

555
        start_iso.no_urbs = DIV_ROUND_UP(
556
                                     dev->endpoint[EP2I(ep)].bufpq_target_size,
557
                                     start_iso.pkts_per_urb);
558
        /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
559
           as overflow buffer. Also see the usbredir protocol documentation */
560
        if (!(ep & USB_DIR_IN)) {
561
            start_iso.no_urbs *= 2;
562
        }
563
        if (start_iso.no_urbs > 16) {
564
            start_iso.no_urbs = 16;
565
        }
566

567
        /* No id, we look at the ep when receiving a status back */
568
        usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
569
        usbredirparser_do_write(dev->parser);
570
        DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
571
                pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
572
        dev->endpoint[EP2I(ep)].iso_started = 1;
573
        dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
574
        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
575
    }
576

577
    if (ep & USB_DIR_IN) {
578
        struct buf_packet *isop;
579

580
        if (dev->endpoint[EP2I(ep)].iso_started &&
581
                !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
582
            if (dev->endpoint[EP2I(ep)].bufpq_size <
583
                    dev->endpoint[EP2I(ep)].bufpq_target_size) {
584
                return;
585
            }
586
            dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
587
        }
588

589
        isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
590
        if (isop == NULL) {
591
            DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
592
                    ep, dev->endpoint[EP2I(ep)].iso_error);
593
            /* Re-fill the buffer */
594
            dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
595
            /* Check iso_error for stream errors, otherwise its an underrun */
596
            status = dev->endpoint[EP2I(ep)].iso_error;
597
            dev->endpoint[EP2I(ep)].iso_error = 0;
598
            p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
599
            return;
600
        }
601
        DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
602
                 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
603

604
        status = isop->status;
605
        len = isop->len;
606
        if (len > p->iov.size) {
607
            ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
608
                  ep, len, (int)p->iov.size);
609
            len = p->iov.size;
610
            status = usb_redir_babble;
611
        }
612
        usb_packet_copy(p, isop->data, len);
613
        bufp_free(dev, isop, ep);
614
        usbredir_handle_status(dev, p, status);
615
    } else {
616
        /* If the stream was not started because of a pending error don't
617
           send the packet to the usb-host */
618
        if (dev->endpoint[EP2I(ep)].iso_started) {
619
            struct usb_redir_iso_packet_header iso_packet = {
620
                .endpoint = ep,
621
                .length = p->iov.size
622
            };
623
            g_autofree uint8_t *buf = g_malloc(p->iov.size);
624
            /* No id, we look at the ep when receiving a status back */
625
            usb_packet_copy(p, buf, p->iov.size);
626
            usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
627
                                           buf, p->iov.size);
628
            usbredirparser_do_write(dev->parser);
629
        }
630
        status = dev->endpoint[EP2I(ep)].iso_error;
631
        dev->endpoint[EP2I(ep)].iso_error = 0;
632
        DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
633
                 p->iov.size);
634
        usbredir_handle_status(dev, p, status);
635
    }
636
}
637

638
static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
639
{
640
    struct usb_redir_stop_iso_stream_header stop_iso_stream = {
641
        .endpoint = ep
642
    };
643
    if (dev->endpoint[EP2I(ep)].iso_started) {
644
        usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
645
        DPRINTF("iso stream stopped ep %02X\n", ep);
646
        dev->endpoint[EP2I(ep)].iso_started = 0;
647
    }
648
    dev->endpoint[EP2I(ep)].iso_error = 0;
649
    usbredir_free_bufpq(dev, ep);
650
}
651

652
/*
653
 * The usb-host may poll the endpoint faster then our guest, resulting in lots
654
 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
655
 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
656
 */
657
static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
658
    struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
659
{
660
    usb_packet_copy(p, bulkp->data + bulkp->offset, count);
661
    bulkp->offset += count;
662
    if (bulkp->offset == bulkp->len) {
663
        /* Store status in the last packet with data from this bulkp */
664
        usbredir_handle_status(dev, p, bulkp->status);
665
        bufp_free(dev, bulkp, ep);
666
    }
667
}
668

669
static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
670
    USBPacket *p, uint8_t ep)
671
{
672
    struct buf_packet *bulkp;
673
    int count;
674

675
    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
676
           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
677
        count = bulkp->len - bulkp->offset;
678
        if (count > (p->iov.size - p->actual_length)) {
679
            count = p->iov.size - p->actual_length;
680
        }
681
        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
682
    }
683
}
684

685
static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
686
    USBPacket *p, uint8_t ep)
687
{
688
    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
689
    uint8_t header[2] = { 0, 0 };
690
    struct buf_packet *bulkp;
691
    int count;
692

693
    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
694
           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
695
        if (bulkp->len < 2) {
696
            WARNING("malformed ftdi bulk in packet\n");
697
            bufp_free(dev, bulkp, ep);
698
            continue;
699
        }
700

701
        if ((p->actual_length % maxp) == 0) {
702
            usb_packet_copy(p, bulkp->data, 2);
703
            memcpy(header, bulkp->data, 2);
704
        } else {
705
            if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
706
                break; /* Different header, add to next packet */
707
            }
708
        }
709

710
        if (bulkp->offset == 0) {
711
            bulkp->offset = 2; /* Skip header */
712
        }
713
        count = bulkp->len - bulkp->offset;
714
        /* Must repeat the header at maxp interval */
715
        if (count > (maxp - (p->actual_length % maxp))) {
716
            count = maxp - (p->actual_length % maxp);
717
        }
718
        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
719
    }
720
}
721

722
static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
723
    USBPacket *p, uint8_t ep)
724
{
725
    p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
726
    dev->buffered_bulk_in_complete(dev, p, ep);
727
    DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
728
            ep, p->status, p->actual_length, p->id);
729
}
730

731
static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
732
    USBPacket *p, uint8_t ep)
733
{
734
    /* Input bulk endpoint, buffered packet input */
735
    if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
736
        int bpt;
737
        struct usb_redir_start_bulk_receiving_header start = {
738
            .endpoint = ep,
739
            .stream_id = 0,
740
            .no_transfers = 5,
741
        };
742
        /* Round bytes_per_transfer up to a multiple of max_packet_size */
743
        bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
744
        bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
745
        bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
746
        start.bytes_per_transfer = bpt;
747
        /* No id, we look at the ep when receiving a status back */
748
        usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
749
        usbredirparser_do_write(dev->parser);
750
        DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
751
                start.bytes_per_transfer, start.no_transfers, ep);
752
        dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
753
        /* We don't really want to drop bulk packets ever, but
754
           having some upper limit to how much we buffer is good. */
755
        dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
756
        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
757
    }
758

759
    if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
760
        DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
761
        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
762
        dev->endpoint[EP2I(ep)].pending_async_packet = p;
763
        p->status = USB_RET_ASYNC;
764
        return;
765
    }
766
    usbredir_buffered_bulk_in_complete(dev, p, ep);
767
}
768

769
static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
770
{
771
    struct usb_redir_stop_bulk_receiving_header stop_bulk = {
772
        .endpoint = ep,
773
        .stream_id = 0,
774
    };
775
    if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
776
        usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
777
        DPRINTF("bulk receiving stopped ep %02X\n", ep);
778
        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
779
    }
780
    usbredir_free_bufpq(dev, ep);
781
}
782

783
static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
784
                                      uint8_t ep)
785
{
786
    struct usb_redir_bulk_packet_header bulk_packet;
787
    size_t size = usb_packet_size(p);
788
    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
789

790
    if (usbredir_already_in_flight(dev, p->id)) {
791
        p->status = USB_RET_ASYNC;
792
        return;
793
    }
794

795
    if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
796
        if (size != 0 && (size % maxp) == 0) {
797
            usbredir_handle_buffered_bulk_in_data(dev, p, ep);
798
            return;
799
        }
800
        WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
801
        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
802
        usbredir_stop_bulk_receiving(dev, ep);
803
        dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
804
    }
805

806
    DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
807
            ep, p->stream, size, p->id);
808

809
    bulk_packet.endpoint  = ep;
810
    bulk_packet.length    = size;
811
    bulk_packet.stream_id = p->stream;
812
    bulk_packet.length_high = size >> 16;
813
    assert(bulk_packet.length_high == 0 ||
814
           usbredirparser_peer_has_cap(dev->parser,
815
                                       usb_redir_cap_32bits_bulk_length));
816

817
    if (ep & USB_DIR_IN || size == 0) {
818
        usbredirparser_send_bulk_packet(dev->parser, p->id,
819
                                        &bulk_packet, NULL, 0);
820
    } else {
821
        g_autofree uint8_t *buf = g_malloc(size);
822
        usb_packet_copy(p, buf, size);
823
        usbredir_log_data(dev, "bulk data out:", buf, size);
824
        usbredirparser_send_bulk_packet(dev->parser, p->id,
825
                                        &bulk_packet, buf, size);
826
    }
827
    usbredirparser_do_write(dev->parser);
828
    p->status = USB_RET_ASYNC;
829
}
830

831
static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
832
                                              USBPacket *p, uint8_t ep)
833
{
834
    /* Input interrupt endpoint, buffered packet input */
835
    struct buf_packet *intp, *intp_to_free;
836
    int status, len, sum;
837

838
    if (!dev->endpoint[EP2I(ep)].interrupt_started &&
839
            !dev->endpoint[EP2I(ep)].interrupt_error) {
840
        struct usb_redir_start_interrupt_receiving_header start_int = {
841
            .endpoint = ep,
842
        };
843
        /* No id, we look at the ep when receiving a status back */
844
        usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
845
                                                      &start_int);
846
        usbredirparser_do_write(dev->parser);
847
        DPRINTF("interrupt recv started ep %02X\n", ep);
848
        dev->endpoint[EP2I(ep)].interrupt_started = 1;
849
        /* We don't really want to drop interrupt packets ever, but
850
           having some upper limit to how much we buffer is good. */
851
        dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
852
        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
853
    }
854

855
    /* check for completed interrupt message (with all fragments) */
856
    sum = 0;
857
    QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
858
        sum += intp->len;
859
        if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
860
            sum >= p->iov.size)
861
            break;
862
    }
863

864
    if (intp == NULL) {
865
        DPRINTF2("interrupt-token-in ep %02X, no intp, buffered %d\n", ep, sum);
866
        /* Check interrupt_error for stream errors */
867
        status = dev->endpoint[EP2I(ep)].interrupt_error;
868
        dev->endpoint[EP2I(ep)].interrupt_error = 0;
869
        if (status) {
870
            usbredir_handle_status(dev, p, status);
871
        } else {
872
            p->status = USB_RET_NAK;
873
        }
874
        return;
875
    }
876

877
    /* copy of completed interrupt message */
878
    sum = 0;
879
    status = usb_redir_success;
880
    intp_to_free = NULL;
881
    QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
882
        if (intp_to_free) {
883
            bufp_free(dev, intp_to_free, ep);
884
        }
885
        DPRINTF("interrupt-token-in ep %02X fragment status %d len %d\n", ep,
886
                intp->status, intp->len);
887

888
        sum += intp->len;
889
        len = intp->len;
890
        if (status == usb_redir_success) {
891
            status = intp->status;
892
        }
893
        if (sum > p->iov.size) {
894
            ERROR("received int data is larger then packet ep %02X\n", ep);
895
            len -= (sum - p->iov.size);
896
            sum = p->iov.size;
897
            status = usb_redir_babble;
898
        }
899

900
        usb_packet_copy(p, intp->data, len);
901

902
        intp_to_free = intp;
903
        if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
904
            sum >= p->iov.size)
905
            break;
906
    }
907
    if (intp_to_free) {
908
        bufp_free(dev, intp_to_free, ep);
909
    }
910
    DPRINTF("interrupt-token-in ep %02X summary status %d len %d\n", ep,
911
            status, sum);
912
    usbredir_handle_status(dev, p, status);
913
}
914

915
/*
916
 * Handle interrupt out data, the usbredir protocol expects us to do this
917
 * async, so that it can report back a completion status. But guests will
918
 * expect immediate completion for an interrupt endpoint, and handling this
919
 * async causes migration issues. So we report success directly, counting
920
 * on the fact that output interrupt packets normally always succeed.
921
 */
922
static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
923
                                               USBPacket *p, uint8_t ep)
924
{
925
    struct usb_redir_interrupt_packet_header interrupt_packet;
926
    g_autofree uint8_t *buf = g_malloc(p->iov.size);
927

928
    DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
929
            p->iov.size, p->id);
930

931
    interrupt_packet.endpoint  = ep;
932
    interrupt_packet.length    = p->iov.size;
933

934
    usb_packet_copy(p, buf, p->iov.size);
935
    usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
936
    usbredirparser_send_interrupt_packet(dev->parser, p->id,
937
                                    &interrupt_packet, buf, p->iov.size);
938
    usbredirparser_do_write(dev->parser);
939
}
940

941
static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
942
    uint8_t ep)
943
{
944
    struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
945
        .endpoint = ep
946
    };
947
    if (dev->endpoint[EP2I(ep)].interrupt_started) {
948
        usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
949
                                                     &stop_interrupt_recv);
950
        DPRINTF("interrupt recv stopped ep %02X\n", ep);
951
        dev->endpoint[EP2I(ep)].interrupt_started = 0;
952
    }
953
    dev->endpoint[EP2I(ep)].interrupt_error = 0;
954
    usbredir_free_bufpq(dev, ep);
955
}
956

957
static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
958
{
959
    USBRedirDevice *dev = USB_REDIRECT(udev);
960
    uint8_t ep;
961

962
    ep = p->ep->nr;
963
    if (p->pid == USB_TOKEN_IN) {
964
        ep |= USB_DIR_IN;
965
    }
966

967
    switch (dev->endpoint[EP2I(ep)].type) {
968
    case USB_ENDPOINT_XFER_CONTROL:
969
        ERROR("handle_data called for control transfer on ep %02X\n", ep);
970
        p->status = USB_RET_NAK;
971
        break;
972
    case USB_ENDPOINT_XFER_BULK:
973
        if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
974
                p->ep->pipeline) {
975
            p->status = USB_RET_ADD_TO_QUEUE;
976
            break;
977
        }
978
        usbredir_handle_bulk_data(dev, p, ep);
979
        break;
980
    case USB_ENDPOINT_XFER_ISOC:
981
        usbredir_handle_iso_data(dev, p, ep);
982
        break;
983
    case USB_ENDPOINT_XFER_INT:
984
        if (ep & USB_DIR_IN) {
985
            usbredir_handle_interrupt_in_data(dev, p, ep);
986
        } else {
987
            usbredir_handle_interrupt_out_data(dev, p, ep);
988
        }
989
        break;
990
    default:
991
        ERROR("handle_data ep %02X has unknown type %d\n", ep,
992
              dev->endpoint[EP2I(ep)].type);
993
        p->status = USB_RET_NAK;
994
    }
995
}
996

997
static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
998
{
999
    if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
1000
        usb_ep_combine_input_packets(ep);
1001
    }
1002
}
1003

1004
static void usbredir_stop_ep(USBRedirDevice *dev, int i)
1005
{
1006
    uint8_t ep = I2EP(i);
1007

1008
    switch (dev->endpoint[i].type) {
1009
    case USB_ENDPOINT_XFER_BULK:
1010
        if (ep & USB_DIR_IN) {
1011
            usbredir_stop_bulk_receiving(dev, ep);
1012
        }
1013
        break;
1014
    case USB_ENDPOINT_XFER_ISOC:
1015
        usbredir_stop_iso_stream(dev, ep);
1016
        break;
1017
    case USB_ENDPOINT_XFER_INT:
1018
        if (ep & USB_DIR_IN) {
1019
            usbredir_stop_interrupt_receiving(dev, ep);
1020
        }
1021
        break;
1022
    }
1023
    usbredir_free_bufpq(dev, ep);
1024
}
1025

1026
static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
1027
{
1028
    USBRedirDevice *dev = USB_REDIRECT(udev);
1029

1030
    usbredir_stop_ep(dev, USBEP2I(uep));
1031
    usbredirparser_do_write(dev->parser);
1032
}
1033

1034
static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
1035
                                int config)
1036
{
1037
    struct usb_redir_set_configuration_header set_config;
1038
    int i;
1039

1040
    DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
1041

1042
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1043
        usbredir_stop_ep(dev, i);
1044
    }
1045

1046
    set_config.configuration = config;
1047
    usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
1048
    usbredirparser_do_write(dev->parser);
1049
    p->status = USB_RET_ASYNC;
1050
}
1051

1052
static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1053
{
1054
    DPRINTF("get config id %"PRIu64"\n", p->id);
1055

1056
    usbredirparser_send_get_configuration(dev->parser, p->id);
1057
    usbredirparser_do_write(dev->parser);
1058
    p->status = USB_RET_ASYNC;
1059
}
1060

1061
static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1062
                                   int interface, int alt)
1063
{
1064
    struct usb_redir_set_alt_setting_header set_alt;
1065
    int i;
1066

1067
    DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1068

1069
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1070
        if (dev->endpoint[i].interface == interface) {
1071
            usbredir_stop_ep(dev, i);
1072
        }
1073
    }
1074

1075
    set_alt.interface = interface;
1076
    set_alt.alt = alt;
1077
    usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1078
    usbredirparser_do_write(dev->parser);
1079
    p->status = USB_RET_ASYNC;
1080
}
1081

1082
static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1083
                                   int interface)
1084
{
1085
    struct usb_redir_get_alt_setting_header get_alt;
1086

1087
    DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1088

1089
    get_alt.interface = interface;
1090
    usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1091
    usbredirparser_do_write(dev->parser);
1092
    p->status = USB_RET_ASYNC;
1093
}
1094

1095
static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1096
        int request, int value, int index, int length, uint8_t *data)
1097
{
1098
    USBRedirDevice *dev = USB_REDIRECT(udev);
1099
    struct usb_redir_control_packet_header control_packet;
1100

1101
    if (usbredir_already_in_flight(dev, p->id)) {
1102
        p->status = USB_RET_ASYNC;
1103
        return;
1104
    }
1105

1106
    /* Special cases for certain standard device requests */
1107
    switch (request) {
1108
    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1109
        DPRINTF("set address %d\n", value);
1110
        dev->dev.addr = value;
1111
        return;
1112
    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1113
        usbredir_set_config(dev, p, value & 0xff);
1114
        return;
1115
    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1116
        usbredir_get_config(dev, p);
1117
        return;
1118
    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1119
        usbredir_set_interface(dev, p, index, value);
1120
        return;
1121
    case InterfaceRequest | USB_REQ_GET_INTERFACE:
1122
        usbredir_get_interface(dev, p, index);
1123
        return;
1124
    }
1125

1126
    /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1127
    DPRINTF(
1128
        "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1129
        request >> 8, request & 0xff, value, index, length, p->id);
1130

1131
    control_packet.request     = request & 0xFF;
1132
    control_packet.requesttype = request >> 8;
1133
    control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
1134
    control_packet.value       = value;
1135
    control_packet.index       = index;
1136
    control_packet.length      = length;
1137

1138
    if (control_packet.requesttype & USB_DIR_IN) {
1139
        usbredirparser_send_control_packet(dev->parser, p->id,
1140
                                           &control_packet, NULL, 0);
1141
    } else {
1142
        usbredir_log_data(dev, "ctrl data out:", data, length);
1143
        usbredirparser_send_control_packet(dev->parser, p->id,
1144
                                           &control_packet, data, length);
1145
    }
1146
    usbredirparser_do_write(dev->parser);
1147
    p->status = USB_RET_ASYNC;
1148
}
1149

1150
static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1151
                                  int nr_eps, int streams)
1152
{
1153
    USBRedirDevice *dev = USB_REDIRECT(udev);
1154
#if USBREDIR_VERSION >= 0x000700
1155
    struct usb_redir_alloc_bulk_streams_header alloc_streams;
1156
    int i;
1157

1158
    if (!usbredirparser_peer_has_cap(dev->parser,
1159
                                     usb_redir_cap_bulk_streams)) {
1160
        ERROR("peer does not support streams\n");
1161
        goto reject;
1162
    }
1163

1164
    if (streams == 0) {
1165
        ERROR("request to allocate 0 streams\n");
1166
        return -1;
1167
    }
1168

1169
    alloc_streams.no_streams = streams;
1170
    alloc_streams.endpoints = 0;
1171
    for (i = 0; i < nr_eps; i++) {
1172
        alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1173
    }
1174
    usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1175
    usbredirparser_do_write(dev->parser);
1176

1177
    return 0;
1178
#else
1179
    ERROR("usbredir_alloc_streams not implemented\n");
1180
    goto reject;
1181
#endif
1182
reject:
1183
    ERROR("streams are not available, disconnecting\n");
1184
    qemu_bh_schedule(dev->device_reject_bh);
1185
    return -1;
1186
}
1187

1188
static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1189
                                  int nr_eps)
1190
{
1191
#if USBREDIR_VERSION >= 0x000700
1192
    USBRedirDevice *dev = USB_REDIRECT(udev);
1193
    struct usb_redir_free_bulk_streams_header free_streams;
1194
    int i;
1195

1196
    if (!usbredirparser_peer_has_cap(dev->parser,
1197
                                     usb_redir_cap_bulk_streams)) {
1198
        return;
1199
    }
1200

1201
    free_streams.endpoints = 0;
1202
    for (i = 0; i < nr_eps; i++) {
1203
        free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1204
    }
1205
    usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1206
    usbredirparser_do_write(dev->parser);
1207
#endif
1208
}
1209

1210
/*
1211
 * Close events can be triggered by usbredirparser_do_write which gets called
1212
 * from within the USBDevice data / control packet callbacks and doing a
1213
 * usb_detach from within these callbacks is not a good idea.
1214
 *
1215
 * So we use a bh handler to take care of close events.
1216
 */
1217
static void usbredir_chardev_close_bh(void *opaque)
1218
{
1219
    USBRedirDevice *dev = opaque;
1220

1221
    qemu_bh_cancel(dev->device_reject_bh);
1222
    usbredir_device_disconnect(dev);
1223

1224
    if (dev->parser) {
1225
        DPRINTF("destroying usbredirparser\n");
1226
        usbredirparser_destroy(dev->parser);
1227
        dev->parser = NULL;
1228
    }
1229
    if (dev->watch) {
1230
        g_source_remove(dev->watch);
1231
        dev->watch = 0;
1232
    }
1233
}
1234

1235
static void usbredir_create_parser(USBRedirDevice *dev)
1236
{
1237
    uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1238
    int flags = 0;
1239

1240
    DPRINTF("creating usbredirparser\n");
1241

1242
    dev->parser = usbredirparser_create();
1243
    if (!dev->parser) {
1244
        error_report("usbredirparser_create() failed");
1245
        exit(1);
1246
    }
1247
    dev->parser->priv = dev;
1248
    dev->parser->log_func = usbredir_log;
1249
    dev->parser->read_func = usbredir_read;
1250
    dev->parser->write_func = usbredir_write;
1251
    dev->parser->hello_func = usbredir_hello;
1252
    dev->parser->device_connect_func = usbredir_device_connect;
1253
    dev->parser->device_disconnect_func = usbredir_device_disconnect;
1254
    dev->parser->interface_info_func = usbredir_interface_info;
1255
    dev->parser->ep_info_func = usbredir_ep_info;
1256
    dev->parser->configuration_status_func = usbredir_configuration_status;
1257
    dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1258
    dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1259
    dev->parser->interrupt_receiving_status_func =
1260
        usbredir_interrupt_receiving_status;
1261
    dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1262
    dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1263
    dev->parser->control_packet_func = usbredir_control_packet;
1264
    dev->parser->bulk_packet_func = usbredir_bulk_packet;
1265
    dev->parser->iso_packet_func = usbredir_iso_packet;
1266
    dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1267
    dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1268
    dev->read_buf = NULL;
1269
    dev->read_buf_size = 0;
1270

1271
    usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1272
    usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1273
    usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1274
    usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1275
    usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1276
    usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1277
#if USBREDIR_VERSION >= 0x000700
1278
    if (dev->enable_streams) {
1279
        usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1280
    }
1281
#endif
1282

1283
    if (runstate_check(RUN_STATE_INMIGRATE)) {
1284
        flags |= usbredirparser_fl_no_hello;
1285
    }
1286
    usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1287
                        flags);
1288
    usbredirparser_do_write(dev->parser);
1289
}
1290

1291
static void usbredir_reject_device(USBRedirDevice *dev)
1292
{
1293
    usbredir_device_disconnect(dev);
1294
    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1295
        usbredirparser_send_filter_reject(dev->parser);
1296
        usbredirparser_do_write(dev->parser);
1297
    }
1298
}
1299

1300
/*
1301
 * We may need to reject the device when the hcd calls alloc_streams, doing
1302
 * an usb_detach from within a hcd call is not a good idea, hence this bh.
1303
 */
1304
static void usbredir_device_reject_bh(void *opaque)
1305
{
1306
    USBRedirDevice *dev = opaque;
1307

1308
    usbredir_reject_device(dev);
1309
}
1310

1311
static void usbredir_do_attach(void *opaque)
1312
{
1313
    USBRedirDevice *dev = opaque;
1314
    Error *local_err = NULL;
1315

1316
    /* In order to work properly with XHCI controllers we need these caps */
1317
    if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1318
        usbredirparser_peer_has_cap(dev->parser,
1319
                                    usb_redir_cap_ep_info_max_packet_size) &&
1320
        usbredirparser_peer_has_cap(dev->parser,
1321
                                    usb_redir_cap_32bits_bulk_length) &&
1322
        usbredirparser_peer_has_cap(dev->parser,
1323
                                    usb_redir_cap_64bits_ids))) {
1324
        ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1325
        usbredir_reject_device(dev);
1326
        return;
1327
    }
1328

1329
    usb_device_attach(&dev->dev, &local_err);
1330
    if (local_err) {
1331
        error_report_err(local_err);
1332
        WARNING("rejecting device due to speed mismatch\n");
1333
        usbredir_reject_device(dev);
1334
    }
1335
}
1336

1337
/*
1338
 * chardev callbacks
1339
 */
1340

1341
static int usbredir_chardev_can_read(void *opaque)
1342
{
1343
    USBRedirDevice *dev = opaque;
1344

1345
    if (!dev->parser) {
1346
        WARNING("chardev_can_read called on non open chardev!\n");
1347
        return 0;
1348
    }
1349

1350
    /* Don't read new data from the chardev until our state is fully synced */
1351
    if (!runstate_check(RUN_STATE_RUNNING)) {
1352
        return 0;
1353
    }
1354

1355
    /* usbredir_parser_do_read will consume *all* data we give it */
1356
    return 1 * MiB;
1357
}
1358

1359
static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1360
{
1361
    USBRedirDevice *dev = opaque;
1362

1363
    /* No recursion allowed! */
1364
    assert(dev->read_buf == NULL);
1365

1366
    dev->read_buf = buf;
1367
    dev->read_buf_size = size;
1368

1369
    usbredirparser_do_read(dev->parser);
1370
    /* Send any acks, etc. which may be queued now */
1371
    usbredirparser_do_write(dev->parser);
1372
}
1373

1374
static void usbredir_chardev_event(void *opaque, QEMUChrEvent event)
1375
{
1376
    USBRedirDevice *dev = opaque;
1377

1378
    switch (event) {
1379
    case CHR_EVENT_OPENED:
1380
        DPRINTF("chardev open\n");
1381
        /* Make sure any pending closes are handled (no-op if none pending) */
1382
        usbredir_chardev_close_bh(dev);
1383
        qemu_bh_cancel(dev->chardev_close_bh);
1384
        usbredir_create_parser(dev);
1385
        break;
1386
    case CHR_EVENT_CLOSED:
1387
        DPRINTF("chardev close\n");
1388
        qemu_bh_schedule(dev->chardev_close_bh);
1389
        break;
1390
    case CHR_EVENT_BREAK:
1391
    case CHR_EVENT_MUX_IN:
1392
    case CHR_EVENT_MUX_OUT:
1393
        /* Ignore */
1394
        break;
1395
    }
1396
}
1397

1398
/*
1399
 * init + destroy
1400
 */
1401

1402
static void usbredir_vm_state_change(void *priv, bool running, RunState state)
1403
{
1404
    USBRedirDevice *dev = priv;
1405

1406
    if (running && dev->parser != NULL) {
1407
        usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1408
    }
1409
}
1410

1411
static void usbredir_init_endpoints(USBRedirDevice *dev)
1412
{
1413
    int i;
1414

1415
    usb_ep_init(&dev->dev);
1416
    memset(dev->endpoint, 0, sizeof(dev->endpoint));
1417
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1418
        dev->endpoint[i].dev = dev;
1419
        QTAILQ_INIT(&dev->endpoint[i].bufpq);
1420
    }
1421
}
1422

1423
static void usbredir_realize(USBDevice *udev, Error **errp)
1424
{
1425
    USBRedirDevice *dev = USB_REDIRECT(udev);
1426
    int i;
1427

1428
    if (!qemu_chr_fe_backend_connected(&dev->cs)) {
1429
        error_setg(errp, QERR_MISSING_PARAMETER, "chardev");
1430
        return;
1431
    }
1432

1433
    if (dev->filter_str) {
1434
        i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1435
                                           &dev->filter_rules,
1436
                                           &dev->filter_rules_count);
1437
        if (i) {
1438
            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1439
                       "a usb device filter string");
1440
            return;
1441
        }
1442
    }
1443

1444
    dev->chardev_close_bh = qemu_bh_new_guarded(usbredir_chardev_close_bh, dev,
1445
                                                &DEVICE(dev)->mem_reentrancy_guard);
1446
    dev->device_reject_bh = qemu_bh_new_guarded(usbredir_device_reject_bh, dev,
1447
                                                &DEVICE(dev)->mem_reentrancy_guard);
1448
    dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1449

1450
    packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1451
    packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1452
    usbredir_init_endpoints(dev);
1453

1454
    /* We'll do the attach once we receive the speed from the usb-host */
1455
    udev->auto_attach = 0;
1456

1457
    /* Will be cleared during setup when we find conflicts */
1458
    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1459

1460
    /* Let the backend know we are ready */
1461
    qemu_chr_fe_set_handlers(&dev->cs, usbredir_chardev_can_read,
1462
                             usbredir_chardev_read, usbredir_chardev_event,
1463
                             NULL, dev, NULL, true);
1464

1465
    dev->vmstate =
1466
        qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1467
}
1468

1469
static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1470
{
1471
    int i;
1472

1473
    packet_id_queue_empty(&dev->cancelled);
1474
    packet_id_queue_empty(&dev->already_in_flight);
1475
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1476
        usbredir_free_bufpq(dev, I2EP(i));
1477
    }
1478
}
1479

1480
static void usbredir_unrealize(USBDevice *udev)
1481
{
1482
    USBRedirDevice *dev = USB_REDIRECT(udev);
1483

1484
    qemu_chr_fe_deinit(&dev->cs, true);
1485

1486
    /* Note must be done after qemu_chr_close, as that causes a close event */
1487
    qemu_bh_delete(dev->chardev_close_bh);
1488
    qemu_bh_delete(dev->device_reject_bh);
1489

1490
    timer_free(dev->attach_timer);
1491

1492
    usbredir_cleanup_device_queues(dev);
1493

1494
    if (dev->parser) {
1495
        usbredirparser_destroy(dev->parser);
1496
    }
1497
    if (dev->watch) {
1498
        g_source_remove(dev->watch);
1499
    }
1500

1501
    free(dev->filter_rules);
1502
    qemu_del_vm_change_state_handler(dev->vmstate);
1503
}
1504

1505
static int usbredir_check_filter(USBRedirDevice *dev)
1506
{
1507
    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1508
        ERROR("No interface info for device\n");
1509
        goto error;
1510
    }
1511

1512
    if (dev->filter_rules) {
1513
        if (!usbredirparser_peer_has_cap(dev->parser,
1514
                                    usb_redir_cap_connect_device_version)) {
1515
            ERROR("Device filter specified and peer does not have the "
1516
                  "connect_device_version capability\n");
1517
            goto error;
1518
        }
1519

1520
        if (usbredirfilter_check(
1521
                dev->filter_rules,
1522
                dev->filter_rules_count,
1523
                dev->device_info.device_class,
1524
                dev->device_info.device_subclass,
1525
                dev->device_info.device_protocol,
1526
                dev->interface_info.interface_class,
1527
                dev->interface_info.interface_subclass,
1528
                dev->interface_info.interface_protocol,
1529
                dev->interface_info.interface_count,
1530
                dev->device_info.vendor_id,
1531
                dev->device_info.product_id,
1532
                dev->device_info.device_version_bcd,
1533
                0) != 0) {
1534
            goto error;
1535
        }
1536
    }
1537

1538
    return 0;
1539

1540
error:
1541
    usbredir_reject_device(dev);
1542
    return -1;
1543
}
1544

1545
static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1546
{
1547
    int i, j, quirks;
1548

1549
    if (!usbredirparser_peer_has_cap(dev->parser,
1550
                                     usb_redir_cap_bulk_receiving)) {
1551
        return;
1552
    }
1553

1554
    for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1555
        dev->endpoint[i].bulk_receiving_enabled = 0;
1556
    }
1557

1558
    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1559
        return;
1560
    }
1561

1562
    for (i = 0; i < dev->interface_info.interface_count; i++) {
1563
        quirks = usb_get_quirks(dev->device_info.vendor_id,
1564
                                dev->device_info.product_id,
1565
                                dev->interface_info.interface_class[i],
1566
                                dev->interface_info.interface_subclass[i],
1567
                                dev->interface_info.interface_protocol[i]);
1568
        if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1569
            continue;
1570
        }
1571
        if (quirks & USB_QUIRK_IS_FTDI) {
1572
            dev->buffered_bulk_in_complete =
1573
                usbredir_buffered_bulk_in_complete_ftdi;
1574
        } else {
1575
            dev->buffered_bulk_in_complete =
1576
                usbredir_buffered_bulk_in_complete_raw;
1577
        }
1578

1579
        for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1580
            if (dev->endpoint[j].interface ==
1581
                                    dev->interface_info.interface[i] &&
1582
                    dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1583
                    dev->endpoint[j].max_packet_size != 0) {
1584
                dev->endpoint[j].bulk_receiving_enabled = 1;
1585
                /*
1586
                 * With buffering pipelining is not necessary. Also packet
1587
                 * combining and bulk in buffering don't play nice together!
1588
                 */
1589
                I2USBEP(dev, j)->pipeline = false;
1590
                break; /* Only buffer for the first ep of each intf */
1591
            }
1592
        }
1593
    }
1594
}
1595

1596
/*
1597
 * usbredirparser packet complete callbacks
1598
 */
1599

1600
static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1601
    int status)
1602
{
1603
    switch (status) {
1604
    case usb_redir_success:
1605
        p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1606
        break;
1607
    case usb_redir_stall:
1608
        p->status = USB_RET_STALL;
1609
        break;
1610
    case usb_redir_cancelled:
1611
        /*
1612
         * When the usbredir-host unredirects a device, it will report a status
1613
         * of cancelled for all pending packets, followed by a disconnect msg.
1614
         */
1615
        p->status = USB_RET_IOERROR;
1616
        break;
1617
    case usb_redir_inval:
1618
        WARNING("got invalid param error from usb-host?\n");
1619
        p->status = USB_RET_IOERROR;
1620
        break;
1621
    case usb_redir_babble:
1622
        p->status = USB_RET_BABBLE;
1623
        break;
1624
    case usb_redir_ioerror:
1625
    case usb_redir_timeout:
1626
    default:
1627
        p->status = USB_RET_IOERROR;
1628
    }
1629
}
1630

1631
static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1632
{
1633
    USBRedirDevice *dev = priv;
1634

1635
    /* Try to send the filter info now that we've the usb-host's caps */
1636
    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1637
            dev->filter_rules) {
1638
        usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1639
                                          dev->filter_rules_count);
1640
        usbredirparser_do_write(dev->parser);
1641
    }
1642
}
1643

1644
static void usbredir_device_connect(void *priv,
1645
    struct usb_redir_device_connect_header *device_connect)
1646
{
1647
    USBRedirDevice *dev = priv;
1648
    const char *speed;
1649

1650
    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1651
        ERROR("Received device connect while already connected\n");
1652
        return;
1653
    }
1654

1655
    switch (device_connect->speed) {
1656
    case usb_redir_speed_low:
1657
        speed = "low speed";
1658
        dev->dev.speed = USB_SPEED_LOW;
1659
        dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1660
        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1661
        break;
1662
    case usb_redir_speed_full:
1663
        speed = "full speed";
1664
        dev->dev.speed = USB_SPEED_FULL;
1665
        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1666
        break;
1667
    case usb_redir_speed_high:
1668
        speed = "high speed";
1669
        dev->dev.speed = USB_SPEED_HIGH;
1670
        break;
1671
    case usb_redir_speed_super:
1672
        speed = "super speed";
1673
        dev->dev.speed = USB_SPEED_SUPER;
1674
        break;
1675
    default:
1676
        speed = "unknown speed";
1677
        dev->dev.speed = USB_SPEED_FULL;
1678
    }
1679

1680
    if (usbredirparser_peer_has_cap(dev->parser,
1681
                                    usb_redir_cap_connect_device_version)) {
1682
        INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1683
             speed, device_connect->vendor_id, device_connect->product_id,
1684
             ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1685
             ((device_connect->device_version_bcd & 0x0f00) >>  8),
1686
             ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1687
             ((device_connect->device_version_bcd & 0x000f) >>  0),
1688
             device_connect->device_class);
1689
    } else {
1690
        INFO("attaching %s device %04x:%04x class %02x\n", speed,
1691
             device_connect->vendor_id, device_connect->product_id,
1692
             device_connect->device_class);
1693
    }
1694

1695
    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1696
    dev->device_info = *device_connect;
1697

1698
    if (usbredir_check_filter(dev)) {
1699
        WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1700
                device_connect->vendor_id, device_connect->product_id);
1701
        return;
1702
    }
1703

1704
    usbredir_check_bulk_receiving(dev);
1705
    timer_mod(dev->attach_timer, dev->next_attach_time);
1706
}
1707

1708
static void usbredir_device_disconnect(void *priv)
1709
{
1710
    USBRedirDevice *dev = priv;
1711

1712
    /* Stop any pending attaches */
1713
    timer_del(dev->attach_timer);
1714

1715
    if (dev->dev.attached) {
1716
        DPRINTF("detaching device\n");
1717
        usb_device_detach(&dev->dev);
1718
        /*
1719
         * Delay next usb device attach to give the guest a chance to see
1720
         * see the detach / attach in case of quick close / open succession
1721
         */
1722
        dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1723
    }
1724

1725
    /* Reset state so that the next dev connected starts with a clean slate */
1726
    usbredir_cleanup_device_queues(dev);
1727
    usbredir_init_endpoints(dev);
1728
    dev->interface_info.interface_count = NO_INTERFACE_INFO;
1729
    dev->dev.addr = 0;
1730
    dev->dev.speed = 0;
1731
    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1732
}
1733

1734
static void usbredir_interface_info(void *priv,
1735
    struct usb_redir_interface_info_header *interface_info)
1736
{
1737
    USBRedirDevice *dev = priv;
1738

1739
    dev->interface_info = *interface_info;
1740

1741
    /*
1742
     * If we receive interface info after the device has already been
1743
     * connected (ie on a set_config), re-check interface dependent things.
1744
     */
1745
    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1746
        usbredir_check_bulk_receiving(dev);
1747
        if (usbredir_check_filter(dev)) {
1748
            ERROR("Device no longer matches filter after interface info "
1749
                  "change, disconnecting!\n");
1750
        }
1751
    }
1752
}
1753

1754
static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1755
{
1756
    dev->compatible_speedmask &= ~(1 << speed);
1757
    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1758
}
1759

1760
static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1761
{
1762
    if (uep->type != USB_ENDPOINT_XFER_BULK) {
1763
        return;
1764
    }
1765
    if (uep->pid == USB_TOKEN_OUT) {
1766
        uep->pipeline = true;
1767
    }
1768
    if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1769
        usbredirparser_peer_has_cap(dev->parser,
1770
                                    usb_redir_cap_32bits_bulk_length)) {
1771
        uep->pipeline = true;
1772
    }
1773
}
1774

1775
static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1776
{
1777
    struct USBEndpoint *usb_ep;
1778
    int i;
1779

1780
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1781
        usb_ep = I2USBEP(dev, i);
1782
        usb_ep->type = dev->endpoint[i].type;
1783
        usb_ep->ifnum = dev->endpoint[i].interface;
1784
        usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1785
        usb_ep->max_streams = dev->endpoint[i].max_streams;
1786
        usbredir_set_pipeline(dev, usb_ep);
1787
    }
1788
}
1789

1790
static void usbredir_ep_info(void *priv,
1791
    struct usb_redir_ep_info_header *ep_info)
1792
{
1793
    USBRedirDevice *dev = priv;
1794
    int i;
1795

1796
    assert(dev != NULL);
1797
    for (i = 0; i < MAX_ENDPOINTS; i++) {
1798
        dev->endpoint[i].type = ep_info->type[i];
1799
        dev->endpoint[i].interval = ep_info->interval[i];
1800
        dev->endpoint[i].interface = ep_info->interface[i];
1801
        if (usbredirparser_peer_has_cap(dev->parser,
1802
                                     usb_redir_cap_ep_info_max_packet_size)) {
1803
            dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1804
        }
1805
#if USBREDIR_VERSION >= 0x000700
1806
        if (usbredirparser_peer_has_cap(dev->parser,
1807
                                        usb_redir_cap_bulk_streams)) {
1808
            dev->endpoint[i].max_streams = ep_info->max_streams[i];
1809
        }
1810
#endif
1811
        switch (dev->endpoint[i].type) {
1812
        case usb_redir_type_invalid:
1813
            break;
1814
        case usb_redir_type_iso:
1815
            usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1816
            usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1817
            /* Fall through */
1818
        case usb_redir_type_interrupt:
1819
            if (!usbredirparser_peer_has_cap(dev->parser,
1820
                                     usb_redir_cap_ep_info_max_packet_size) ||
1821
                    ep_info->max_packet_size[i] > 64) {
1822
                usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1823
            }
1824
            if (!usbredirparser_peer_has_cap(dev->parser,
1825
                                     usb_redir_cap_ep_info_max_packet_size) ||
1826
                    ep_info->max_packet_size[i] > 1024) {
1827
                usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1828
            }
1829
            if (dev->endpoint[i].interval == 0) {
1830
                ERROR("Received 0 interval for isoc or irq endpoint\n");
1831
                usbredir_reject_device(dev);
1832
                return;
1833
            }
1834
            /* Fall through */
1835
        case usb_redir_type_control:
1836
        case usb_redir_type_bulk:
1837
            DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1838
                    dev->endpoint[i].type, dev->endpoint[i].interface);
1839
            break;
1840
        default:
1841
            ERROR("Received invalid endpoint type\n");
1842
            usbredir_reject_device(dev);
1843
            return;
1844
        }
1845
    }
1846
    /* The new ep info may have caused a speed incompatibility, recheck */
1847
    if (dev->dev.attached &&
1848
            !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1849
        ERROR("Device no longer matches speed after endpoint info change, "
1850
              "disconnecting!\n");
1851
        usbredir_reject_device(dev);
1852
        return;
1853
    }
1854
    usbredir_setup_usb_eps(dev);
1855
    usbredir_check_bulk_receiving(dev);
1856
}
1857

1858
static void usbredir_configuration_status(void *priv, uint64_t id,
1859
    struct usb_redir_configuration_status_header *config_status)
1860
{
1861
    USBRedirDevice *dev = priv;
1862
    USBPacket *p;
1863

1864
    DPRINTF("set config status %d config %d id %"PRIu64"\n",
1865
            config_status->status, config_status->configuration, id);
1866

1867
    p = usbredir_find_packet_by_id(dev, 0, id);
1868
    if (p) {
1869
        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1870
            dev->dev.data_buf[0] = config_status->configuration;
1871
            p->actual_length = 1;
1872
        }
1873
        usbredir_handle_status(dev, p, config_status->status);
1874
        usb_generic_async_ctrl_complete(&dev->dev, p);
1875
    }
1876
}
1877

1878
static void usbredir_alt_setting_status(void *priv, uint64_t id,
1879
    struct usb_redir_alt_setting_status_header *alt_setting_status)
1880
{
1881
    USBRedirDevice *dev = priv;
1882
    USBPacket *p;
1883

1884
    DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1885
            alt_setting_status->status, alt_setting_status->interface,
1886
            alt_setting_status->alt, id);
1887

1888
    p = usbredir_find_packet_by_id(dev, 0, id);
1889
    if (p) {
1890
        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1891
            dev->dev.data_buf[0] = alt_setting_status->alt;
1892
            p->actual_length = 1;
1893
        }
1894
        usbredir_handle_status(dev, p, alt_setting_status->status);
1895
        usb_generic_async_ctrl_complete(&dev->dev, p);
1896
    }
1897
}
1898

1899
static void usbredir_iso_stream_status(void *priv, uint64_t id,
1900
    struct usb_redir_iso_stream_status_header *iso_stream_status)
1901
{
1902
    USBRedirDevice *dev = priv;
1903
    uint8_t ep = iso_stream_status->endpoint;
1904

1905
    DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1906
            ep, id);
1907

1908
    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1909
        return;
1910
    }
1911

1912
    dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1913
    if (iso_stream_status->status == usb_redir_stall) {
1914
        DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1915
        dev->endpoint[EP2I(ep)].iso_started = 0;
1916
    }
1917
}
1918

1919
static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1920
    struct usb_redir_interrupt_receiving_status_header
1921
    *interrupt_receiving_status)
1922
{
1923
    USBRedirDevice *dev = priv;
1924
    uint8_t ep = interrupt_receiving_status->endpoint;
1925

1926
    DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1927
            interrupt_receiving_status->status, ep, id);
1928

1929
    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1930
        return;
1931
    }
1932

1933
    dev->endpoint[EP2I(ep)].interrupt_error =
1934
        interrupt_receiving_status->status;
1935
    if (interrupt_receiving_status->status == usb_redir_stall) {
1936
        DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1937
        dev->endpoint[EP2I(ep)].interrupt_started = 0;
1938
    }
1939
}
1940

1941
static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1942
    struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1943
{
1944
#if USBREDIR_VERSION >= 0x000700
1945
    USBRedirDevice *dev = priv;
1946

1947
    if (bulk_streams_status->status == usb_redir_success) {
1948
        DPRINTF("bulk streams status %d eps %08x\n",
1949
                bulk_streams_status->status, bulk_streams_status->endpoints);
1950
    } else {
1951
        ERROR("bulk streams %s failed status %d eps %08x\n",
1952
              (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1953
              bulk_streams_status->status, bulk_streams_status->endpoints);
1954
        ERROR("usb-redir-host does not provide streams, disconnecting\n");
1955
        usbredir_reject_device(dev);
1956
    }
1957
#endif
1958
}
1959

1960
static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1961
    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1962
{
1963
    USBRedirDevice *dev = priv;
1964
    uint8_t ep = bulk_receiving_status->endpoint;
1965

1966
    DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1967
            bulk_receiving_status->status, ep, id);
1968

1969
    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1970
        return;
1971
    }
1972

1973
    if (bulk_receiving_status->status == usb_redir_stall) {
1974
        DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1975
        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1976
    }
1977
}
1978

1979
static void usbredir_control_packet(void *priv, uint64_t id,
1980
    struct usb_redir_control_packet_header *control_packet,
1981
    uint8_t *data, int data_len)
1982
{
1983
    USBRedirDevice *dev = priv;
1984
    USBPacket *p;
1985
    int len = control_packet->length;
1986

1987
    DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1988
            len, id);
1989

1990
    /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1991
     * to work redirected to a not superspeed capable hcd */
1992
    if (dev->dev.speed == USB_SPEED_SUPER &&
1993
            !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1994
            control_packet->requesttype == 0x80 &&
1995
            control_packet->request == 6 &&
1996
            control_packet->value == 0x100 && control_packet->index == 0 &&
1997
            data_len >= 18 && data[7] == 9) {
1998
        data[7] = 64;
1999
    }
2000

2001
    p = usbredir_find_packet_by_id(dev, 0, id);
2002
    if (p) {
2003
        usbredir_handle_status(dev, p, control_packet->status);
2004
        if (data_len > 0) {
2005
            usbredir_log_data(dev, "ctrl data in:", data, data_len);
2006
            if (data_len > sizeof(dev->dev.data_buf)) {
2007
                ERROR("ctrl buffer too small (%d > %zu)\n",
2008
                      data_len, sizeof(dev->dev.data_buf));
2009
                p->status = USB_RET_STALL;
2010
                data_len = len = sizeof(dev->dev.data_buf);
2011
            }
2012
            memcpy(dev->dev.data_buf, data, data_len);
2013
        }
2014
        p->actual_length = len;
2015
        /*
2016
         * If this is GET_DESCRIPTOR request for configuration descriptor,
2017
         * remove 'remote wakeup' flag from it to prevent idle power down
2018
         * in Windows guest
2019
         */
2020
        if (dev->suppress_remote_wake &&
2021
            control_packet->requesttype == USB_DIR_IN &&
2022
            control_packet->request == USB_REQ_GET_DESCRIPTOR &&
2023
            control_packet->value == (USB_DT_CONFIG << 8) &&
2024
            control_packet->index == 0 &&
2025
            /* bmAttributes field of config descriptor */
2026
            len > 7 && (dev->dev.data_buf[7] & USB_CFG_ATT_WAKEUP)) {
2027
                DPRINTF("Removed remote wake %04X:%04X\n",
2028
                    dev->device_info.vendor_id,
2029
                    dev->device_info.product_id);
2030
                dev->dev.data_buf[7] &= ~USB_CFG_ATT_WAKEUP;
2031
            }
2032
        usb_generic_async_ctrl_complete(&dev->dev, p);
2033
    }
2034
    free(data);
2035
}
2036

2037
static void usbredir_bulk_packet(void *priv, uint64_t id,
2038
    struct usb_redir_bulk_packet_header *bulk_packet,
2039
    uint8_t *data, int data_len)
2040
{
2041
    USBRedirDevice *dev = priv;
2042
    uint8_t ep = bulk_packet->endpoint;
2043
    int len = (bulk_packet->length_high << 16) | bulk_packet->length;
2044
    USBPacket *p;
2045

2046
    DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
2047
            bulk_packet->status, ep, bulk_packet->stream_id, len, id);
2048

2049
    p = usbredir_find_packet_by_id(dev, ep, id);
2050
    if (p) {
2051
        size_t size = usb_packet_size(p);
2052
        usbredir_handle_status(dev, p, bulk_packet->status);
2053
        if (data_len > 0) {
2054
            usbredir_log_data(dev, "bulk data in:", data, data_len);
2055
            if (data_len > size) {
2056
                ERROR("bulk got more data then requested (%d > %zd)\n",
2057
                      data_len, p->iov.size);
2058
                p->status = USB_RET_BABBLE;
2059
                data_len = len = size;
2060
            }
2061
            usb_packet_copy(p, data, data_len);
2062
        }
2063
        p->actual_length = len;
2064
        if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
2065
            usb_combined_input_packet_complete(&dev->dev, p);
2066
        } else {
2067
            usb_packet_complete(&dev->dev, p);
2068
        }
2069
    }
2070
    free(data);
2071
}
2072

2073
static void usbredir_iso_packet(void *priv, uint64_t id,
2074
    struct usb_redir_iso_packet_header *iso_packet,
2075
    uint8_t *data, int data_len)
2076
{
2077
    USBRedirDevice *dev = priv;
2078
    uint8_t ep = iso_packet->endpoint;
2079

2080
    DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
2081
             iso_packet->status, ep, data_len, id);
2082

2083
    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
2084
        ERROR("received iso packet for non iso endpoint %02X\n", ep);
2085
        free(data);
2086
        return;
2087
    }
2088

2089
    if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2090
        DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2091
        free(data);
2092
        return;
2093
    }
2094

2095
    /* bufp_alloc also adds the packet to the ep queue */
2096
    bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2097
}
2098

2099
static void usbredir_interrupt_packet(void *priv, uint64_t id,
2100
    struct usb_redir_interrupt_packet_header *interrupt_packet,
2101
    uint8_t *data, int data_len)
2102
{
2103
    USBRedirDevice *dev = priv;
2104
    uint8_t ep = interrupt_packet->endpoint;
2105

2106
    DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2107
            interrupt_packet->status, ep, data_len, id);
2108

2109
    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2110
        ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2111
        free(data);
2112
        return;
2113
    }
2114

2115
    if (ep & USB_DIR_IN) {
2116
        if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2117
            DPRINTF("received int packet while not started ep %02X\n", ep);
2118
            free(data);
2119
            return;
2120
        }
2121

2122
        /* bufp_alloc also adds the packet to the ep queue */
2123
        bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2124

2125
        /* insufficient data solved with USB_RET_NAK */
2126
        usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2127
    } else {
2128
        /*
2129
         * We report output interrupt packets as completed directly upon
2130
         * submission, so all we can do here if one failed is warn.
2131
         */
2132
        if (interrupt_packet->status) {
2133
            WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2134
                    interrupt_packet->status, ep, id);
2135
        }
2136
    }
2137
}
2138

2139
static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2140
    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2141
    uint8_t *data, int data_len)
2142
{
2143
    USBRedirDevice *dev = priv;
2144
    uint8_t status, ep = buffered_bulk_packet->endpoint;
2145
    void *free_on_destroy;
2146
    int i, len;
2147

2148
    DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2149
            buffered_bulk_packet->status, ep, data_len, id);
2150

2151
    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2152
        ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2153
        free(data);
2154
        return;
2155
    }
2156

2157
    if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2158
        DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2159
        free(data);
2160
        return;
2161
    }
2162

2163
    /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2164
    len = dev->endpoint[EP2I(ep)].max_packet_size;
2165
    status = usb_redir_success;
2166
    free_on_destroy = NULL;
2167
    for (i = 0; i < data_len; i += len) {
2168
        int r;
2169
        if (len >= (data_len - i)) {
2170
            len = data_len - i;
2171
            status = buffered_bulk_packet->status;
2172
            free_on_destroy = data;
2173
        }
2174
        /* bufp_alloc also adds the packet to the ep queue */
2175
        r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2176
        if (r) {
2177
            break;
2178
        }
2179
    }
2180

2181
    if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2182
        USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2183
        dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2184
        usbredir_buffered_bulk_in_complete(dev, p, ep);
2185
        usb_packet_complete(&dev->dev, p);
2186
    }
2187
}
2188

2189
/*
2190
 * Migration code
2191
 */
2192

2193
static int usbredir_pre_save(void *priv)
2194
{
2195
    USBRedirDevice *dev = priv;
2196

2197
    usbredir_fill_already_in_flight(dev);
2198

2199
    return 0;
2200
}
2201

2202
static int usbredir_post_load(void *priv, int version_id)
2203
{
2204
    USBRedirDevice *dev = priv;
2205

2206
    if (dev == NULL || dev->parser == NULL) {
2207
        return 0;
2208
    }
2209

2210
    switch (dev->device_info.speed) {
2211
    case usb_redir_speed_low:
2212
        dev->dev.speed = USB_SPEED_LOW;
2213
        break;
2214
    case usb_redir_speed_full:
2215
        dev->dev.speed = USB_SPEED_FULL;
2216
        break;
2217
    case usb_redir_speed_high:
2218
        dev->dev.speed = USB_SPEED_HIGH;
2219
        break;
2220
    case usb_redir_speed_super:
2221
        dev->dev.speed = USB_SPEED_SUPER;
2222
        break;
2223
    default:
2224
        dev->dev.speed = USB_SPEED_FULL;
2225
    }
2226
    dev->dev.speedmask = (1 << dev->dev.speed);
2227

2228
    usbredir_setup_usb_eps(dev);
2229
    usbredir_check_bulk_receiving(dev);
2230

2231
    return 0;
2232
}
2233

2234
/* For usbredirparser migration */
2235
static int usbredir_put_parser(QEMUFile *f, void *priv, size_t unused,
2236
                               const VMStateField *field, JSONWriter *vmdesc)
2237
{
2238
    USBRedirDevice *dev = priv;
2239
    uint8_t *data;
2240
    int len;
2241

2242
    if (dev->parser == NULL) {
2243
        qemu_put_be32(f, 0);
2244
        return 0;
2245
    }
2246

2247
    usbredirparser_serialize(dev->parser, &data, &len);
2248
    if (!data) {
2249
        error_report("usbredirparser_serialize failed");
2250
        exit(1);
2251
    }
2252

2253
    qemu_put_be32(f, len);
2254
    qemu_put_buffer(f, data, len);
2255

2256
    free(data);
2257

2258
    return 0;
2259
}
2260

2261
static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused,
2262
                               const VMStateField *field)
2263
{
2264
    USBRedirDevice *dev = priv;
2265
    uint8_t *data;
2266
    int len, ret;
2267

2268
    len = qemu_get_be32(f);
2269
    if (len == 0) {
2270
        return 0;
2271
    }
2272

2273
    /*
2274
     * If our chardev is not open already at this point the usbredir connection
2275
     * has been broken (non seamless migration, or restore from disk).
2276
     *
2277
     * In this case create a temporary parser to receive the migration data,
2278
     * and schedule the close_bh to report the device as disconnected to the
2279
     * guest and to destroy the parser again.
2280
     */
2281
    if (dev->parser == NULL) {
2282
        WARNING("usb-redir connection broken during migration\n");
2283
        usbredir_create_parser(dev);
2284
        qemu_bh_schedule(dev->chardev_close_bh);
2285
    }
2286

2287
    data = g_malloc(len);
2288
    qemu_get_buffer(f, data, len);
2289

2290
    ret = usbredirparser_unserialize(dev->parser, data, len);
2291

2292
    g_free(data);
2293

2294
    return ret;
2295
}
2296

2297
static const VMStateInfo usbredir_parser_vmstate_info = {
2298
    .name = "usb-redir-parser",
2299
    .put  = usbredir_put_parser,
2300
    .get  = usbredir_get_parser,
2301
};
2302

2303

2304
/* For buffered packets (iso/irq) queue migration */
2305
static int usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused,
2306
                              const VMStateField *field, JSONWriter *vmdesc)
2307
{
2308
    struct endp_data *endp = priv;
2309
    USBRedirDevice *dev = endp->dev;
2310
    struct buf_packet *bufp;
2311
    int len, i = 0;
2312

2313
    qemu_put_be32(f, endp->bufpq_size);
2314
    QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2315
        len = bufp->len - bufp->offset;
2316
        DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2317
                len, bufp->status);
2318
        qemu_put_be32(f, len);
2319
        qemu_put_be32(f, bufp->status);
2320
        qemu_put_buffer(f, bufp->data + bufp->offset, len);
2321
        i++;
2322
    }
2323
    assert(i == endp->bufpq_size);
2324

2325
    return 0;
2326
}
2327

2328
static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused,
2329
                              const VMStateField *field)
2330
{
2331
    struct endp_data *endp = priv;
2332
    USBRedirDevice *dev = endp->dev;
2333
    struct buf_packet *bufp;
2334
    int i;
2335

2336
    endp->bufpq_size = qemu_get_be32(f);
2337
    for (i = 0; i < endp->bufpq_size; i++) {
2338
        bufp = g_new(struct buf_packet, 1);
2339
        bufp->len = qemu_get_be32(f);
2340
        bufp->status = qemu_get_be32(f);
2341
        bufp->offset = 0;
2342
        bufp->data = malloc(bufp->len); /* regular malloc! */
2343
        if (!bufp->data) {
2344
            error_report("usbredir_get_bufpq: out of memory");
2345
            exit(1);
2346
        }
2347
        bufp->free_on_destroy = bufp->data;
2348
        qemu_get_buffer(f, bufp->data, bufp->len);
2349
        QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2350
        DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2351
                bufp->len, bufp->status);
2352
    }
2353
    return 0;
2354
}
2355

2356
static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2357
    .name = "usb-redir-bufpq",
2358
    .put  = usbredir_put_bufpq,
2359
    .get  = usbredir_get_bufpq,
2360
};
2361

2362

2363
/* For endp_data migration */
2364
static bool usbredir_bulk_receiving_needed(void *priv)
2365
{
2366
    struct endp_data *endp = priv;
2367

2368
    return endp->bulk_receiving_started;
2369
}
2370

2371
static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2372
    .name = "usb-redir-ep/bulk-receiving",
2373
    .version_id = 1,
2374
    .minimum_version_id = 1,
2375
    .needed = usbredir_bulk_receiving_needed,
2376
    .fields = (const VMStateField[]) {
2377
        VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2378
        VMSTATE_END_OF_LIST()
2379
    }
2380
};
2381

2382
static bool usbredir_stream_needed(void *priv)
2383
{
2384
    struct endp_data *endp = priv;
2385

2386
    return endp->max_streams;
2387
}
2388

2389
static const VMStateDescription usbredir_stream_vmstate = {
2390
    .name = "usb-redir-ep/stream-state",
2391
    .version_id = 1,
2392
    .minimum_version_id = 1,
2393
    .needed = usbredir_stream_needed,
2394
    .fields = (const VMStateField[]) {
2395
        VMSTATE_UINT32(max_streams, struct endp_data),
2396
        VMSTATE_END_OF_LIST()
2397
    }
2398
};
2399

2400
static const VMStateDescription usbredir_ep_vmstate = {
2401
    .name = "usb-redir-ep",
2402
    .version_id = 1,
2403
    .minimum_version_id = 1,
2404
    .fields = (const VMStateField[]) {
2405
        VMSTATE_UINT8(type, struct endp_data),
2406
        VMSTATE_UINT8(interval, struct endp_data),
2407
        VMSTATE_UINT8(interface, struct endp_data),
2408
        VMSTATE_UINT16(max_packet_size, struct endp_data),
2409
        VMSTATE_UINT8(iso_started, struct endp_data),
2410
        VMSTATE_UINT8(iso_error, struct endp_data),
2411
        VMSTATE_UINT8(interrupt_started, struct endp_data),
2412
        VMSTATE_UINT8(interrupt_error, struct endp_data),
2413
        VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2414
        VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2415
        {
2416
            .name         = "bufpq",
2417
            .version_id   = 0,
2418
            .field_exists = NULL,
2419
            .size         = 0,
2420
            .info         = &usbredir_ep_bufpq_vmstate_info,
2421
            .flags        = VMS_SINGLE,
2422
            .offset       = 0,
2423
        },
2424
        VMSTATE_INT32(bufpq_target_size, struct endp_data),
2425
        VMSTATE_END_OF_LIST()
2426
    },
2427
    .subsections = (const VMStateDescription * const []) {
2428
        &usbredir_bulk_receiving_vmstate,
2429
        &usbredir_stream_vmstate,
2430
        NULL
2431
    }
2432
};
2433

2434

2435
/* For PacketIdQueue migration */
2436
static int usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2437
                                    const VMStateField *field,
2438
                                    JSONWriter *vmdesc)
2439
{
2440
    struct PacketIdQueue *q = priv;
2441
    USBRedirDevice *dev = q->dev;
2442
    struct PacketIdQueueEntry *e;
2443
    int remain = q->size;
2444

2445
    DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2446
    qemu_put_be32(f, q->size);
2447
    QTAILQ_FOREACH(e, &q->head, next) {
2448
        qemu_put_be64(f, e->id);
2449
        remain--;
2450
    }
2451
    assert(remain == 0);
2452

2453
    return 0;
2454
}
2455

2456
static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2457
                                    const VMStateField *field)
2458
{
2459
    struct PacketIdQueue *q = priv;
2460
    USBRedirDevice *dev = q->dev;
2461
    int i, size;
2462
    uint64_t id;
2463

2464
    size = qemu_get_be32(f);
2465
    DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2466
    for (i = 0; i < size; i++) {
2467
        id = qemu_get_be64(f);
2468
        packet_id_queue_add(q, id);
2469
    }
2470
    assert(q->size == size);
2471
    return 0;
2472
}
2473

2474
static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2475
    .name = "usb-redir-packet-id-q",
2476
    .put  = usbredir_put_packet_id_q,
2477
    .get  = usbredir_get_packet_id_q,
2478
};
2479

2480
static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2481
    .name = "usb-redir-packet-id-queue",
2482
    .version_id = 1,
2483
    .minimum_version_id = 1,
2484
    .fields = (const VMStateField[]) {
2485
        {
2486
            .name         = "queue",
2487
            .version_id   = 0,
2488
            .field_exists = NULL,
2489
            .size         = 0,
2490
            .info         = &usbredir_ep_packet_id_q_vmstate_info,
2491
            .flags        = VMS_SINGLE,
2492
            .offset       = 0,
2493
        },
2494
        VMSTATE_END_OF_LIST()
2495
    }
2496
};
2497

2498

2499
/* For usb_redir_device_connect_header migration */
2500
static const VMStateDescription usbredir_device_info_vmstate = {
2501
    .name = "usb-redir-device-info",
2502
    .version_id = 1,
2503
    .minimum_version_id = 1,
2504
    .fields = (const VMStateField[]) {
2505
        VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2506
        VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2507
        VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2508
        VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2509
        VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2510
        VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2511
        VMSTATE_UINT16(device_version_bcd,
2512
                       struct usb_redir_device_connect_header),
2513
        VMSTATE_END_OF_LIST()
2514
    }
2515
};
2516

2517

2518
/* For usb_redir_interface_info_header migration */
2519
static const VMStateDescription usbredir_interface_info_vmstate = {
2520
    .name = "usb-redir-interface-info",
2521
    .version_id = 1,
2522
    .minimum_version_id = 1,
2523
    .fields = (const VMStateField[]) {
2524
        VMSTATE_UINT32(interface_count,
2525
                       struct usb_redir_interface_info_header),
2526
        VMSTATE_UINT8_ARRAY(interface,
2527
                            struct usb_redir_interface_info_header, 32),
2528
        VMSTATE_UINT8_ARRAY(interface_class,
2529
                            struct usb_redir_interface_info_header, 32),
2530
        VMSTATE_UINT8_ARRAY(interface_subclass,
2531
                            struct usb_redir_interface_info_header, 32),
2532
        VMSTATE_UINT8_ARRAY(interface_protocol,
2533
                            struct usb_redir_interface_info_header, 32),
2534
        VMSTATE_END_OF_LIST()
2535
    }
2536
};
2537

2538

2539
/* And finally the USBRedirDevice vmstate itself */
2540
static const VMStateDescription usbredir_vmstate = {
2541
    .name = "usb-redir",
2542
    .version_id = 1,
2543
    .minimum_version_id = 1,
2544
    .pre_save = usbredir_pre_save,
2545
    .post_load = usbredir_post_load,
2546
    .fields = (const VMStateField[]) {
2547
        VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2548
        VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2549
        {
2550
            .name         = "parser",
2551
            .version_id   = 0,
2552
            .field_exists = NULL,
2553
            .size         = 0,
2554
            .info         = &usbredir_parser_vmstate_info,
2555
            .flags        = VMS_SINGLE,
2556
            .offset       = 0,
2557
        },
2558
        VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2559
                             usbredir_ep_vmstate, struct endp_data),
2560
        VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2561
                       usbredir_ep_packet_id_queue_vmstate,
2562
                       struct PacketIdQueue),
2563
        VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2564
                       usbredir_ep_packet_id_queue_vmstate,
2565
                       struct PacketIdQueue),
2566
        VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2567
                       usbredir_device_info_vmstate,
2568
                       struct usb_redir_device_connect_header),
2569
        VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2570
                       usbredir_interface_info_vmstate,
2571
                       struct usb_redir_interface_info_header),
2572
        VMSTATE_END_OF_LIST()
2573
    }
2574
};
2575

2576
static Property usbredir_properties[] = {
2577
    DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2578
    DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2579
    DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2580
    DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
2581
    DEFINE_PROP_BOOL("suppress-remote-wake", USBRedirDevice,
2582
                     suppress_remote_wake, true),
2583
    DEFINE_PROP_END_OF_LIST(),
2584
};
2585

2586
static void usbredir_class_initfn(ObjectClass *klass, void *data)
2587
{
2588
    USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2589
    DeviceClass *dc = DEVICE_CLASS(klass);
2590

2591
    uc->realize        = usbredir_realize;
2592
    uc->product_desc   = "USB Redirection Device";
2593
    uc->unrealize      = usbredir_unrealize;
2594
    uc->cancel_packet  = usbredir_cancel_packet;
2595
    uc->handle_reset   = usbredir_handle_reset;
2596
    uc->handle_data    = usbredir_handle_data;
2597
    uc->handle_control = usbredir_handle_control;
2598
    uc->flush_ep_queue = usbredir_flush_ep_queue;
2599
    uc->ep_stopped     = usbredir_ep_stopped;
2600
    uc->alloc_streams  = usbredir_alloc_streams;
2601
    uc->free_streams   = usbredir_free_streams;
2602
    dc->vmsd           = &usbredir_vmstate;
2603
    device_class_set_props(dc, usbredir_properties);
2604
    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2605
}
2606

2607
static void usbredir_instance_init(Object *obj)
2608
{
2609
    USBDevice *udev = USB_DEVICE(obj);
2610
    USBRedirDevice *dev = USB_REDIRECT(udev);
2611

2612
    device_add_bootindex_property(obj, &dev->bootindex,
2613
                                  "bootindex", NULL,
2614
                                  &udev->qdev);
2615
}
2616

2617
static const TypeInfo usbredir_dev_info = {
2618
    .name          = TYPE_USB_REDIR,
2619
    .parent        = TYPE_USB_DEVICE,
2620
    .instance_size = sizeof(USBRedirDevice),
2621
    .class_init    = usbredir_class_initfn,
2622
    .instance_init = usbredir_instance_init,
2623
};
2624
module_obj(TYPE_USB_REDIR);
2625
module_kconfig(USB);
2626

2627
static void usbredir_register_types(void)
2628
{
2629
    type_register_static(&usbredir_dev_info);
2630
}
2631

2632
type_init(usbredir_register_types)
2633