qemu/hw/usb/dev-uas.c
<<
>>
Prefs
   1/*
   2 * UAS (USB Attached SCSI) emulation
   3 *
   4 * Copyright Red Hat, Inc. 2012
   5 *
   6 * Author: Gerd Hoffmann <kraxel@redhat.com>
   7 *
   8 * This work is licensed under the terms of the GNU GPL, version 2 or later.
   9 * See the COPYING file in the top-level directory.
  10 */
  11
  12#include "qemu/osdep.h"
  13#include "qemu-common.h"
  14#include "qemu/option.h"
  15#include "qemu/config-file.h"
  16#include "trace.h"
  17#include "qemu/error-report.h"
  18
  19#include "hw/usb.h"
  20#include "hw/usb/desc.h"
  21#include "hw/scsi/scsi.h"
  22#include "scsi/constants.h"
  23
  24/* --------------------------------------------------------------------- */
  25
  26#define UAS_UI_COMMAND              0x01
  27#define UAS_UI_SENSE                0x03
  28#define UAS_UI_RESPONSE             0x04
  29#define UAS_UI_TASK_MGMT            0x05
  30#define UAS_UI_READ_READY           0x06
  31#define UAS_UI_WRITE_READY          0x07
  32
  33#define UAS_RC_TMF_COMPLETE         0x00
  34#define UAS_RC_INVALID_INFO_UNIT    0x02
  35#define UAS_RC_TMF_NOT_SUPPORTED    0x04
  36#define UAS_RC_TMF_FAILED           0x05
  37#define UAS_RC_TMF_SUCCEEDED        0x08
  38#define UAS_RC_INCORRECT_LUN        0x09
  39#define UAS_RC_OVERLAPPED_TAG       0x0a
  40
  41#define UAS_TMF_ABORT_TASK          0x01
  42#define UAS_TMF_ABORT_TASK_SET      0x02
  43#define UAS_TMF_CLEAR_TASK_SET      0x04
  44#define UAS_TMF_LOGICAL_UNIT_RESET  0x08
  45#define UAS_TMF_I_T_NEXUS_RESET     0x10
  46#define UAS_TMF_CLEAR_ACA           0x40
  47#define UAS_TMF_QUERY_TASK          0x80
  48#define UAS_TMF_QUERY_TASK_SET      0x81
  49#define UAS_TMF_QUERY_ASYNC_EVENT   0x82
  50
  51#define UAS_PIPE_ID_COMMAND         0x01
  52#define UAS_PIPE_ID_STATUS          0x02
  53#define UAS_PIPE_ID_DATA_IN         0x03
  54#define UAS_PIPE_ID_DATA_OUT        0x04
  55
  56typedef struct {
  57    uint8_t    id;
  58    uint8_t    reserved;
  59    uint16_t   tag;
  60} QEMU_PACKED  uas_iu_header;
  61
  62typedef struct {
  63    uint8_t    prio_taskattr;   /* 6:3 priority, 2:0 task attribute   */
  64    uint8_t    reserved_1;
  65    uint8_t    add_cdb_length;  /* 7:2 additional adb length (dwords) */
  66    uint8_t    reserved_2;
  67    uint64_t   lun;
  68    uint8_t    cdb[16];
  69    uint8_t    add_cdb[];
  70} QEMU_PACKED  uas_iu_command;
  71
  72typedef struct {
  73    uint16_t   status_qualifier;
  74    uint8_t    status;
  75    uint8_t    reserved[7];
  76    uint16_t   sense_length;
  77    uint8_t    sense_data[18];
  78} QEMU_PACKED  uas_iu_sense;
  79
  80typedef struct {
  81    uint8_t    add_response_info[3];
  82    uint8_t    response_code;
  83} QEMU_PACKED  uas_iu_response;
  84
  85typedef struct {
  86    uint8_t    function;
  87    uint8_t    reserved;
  88    uint16_t   task_tag;
  89    uint64_t   lun;
  90} QEMU_PACKED  uas_iu_task_mgmt;
  91
  92typedef struct {
  93    uas_iu_header  hdr;
  94    union {
  95        uas_iu_command   command;
  96        uas_iu_sense     sense;
  97        uas_iu_task_mgmt task;
  98        uas_iu_response  response;
  99    };
 100} QEMU_PACKED  uas_iu;
 101
 102/* --------------------------------------------------------------------- */
 103
 104#define UAS_STREAM_BM_ATTR  4
 105#define UAS_MAX_STREAMS     (1 << UAS_STREAM_BM_ATTR)
 106
 107typedef struct UASDevice UASDevice;
 108typedef struct UASRequest UASRequest;
 109typedef struct UASStatus UASStatus;
 110
 111struct UASDevice {
 112    USBDevice                 dev;
 113    SCSIBus                   bus;
 114    QEMUBH                    *status_bh;
 115    QTAILQ_HEAD(, UASStatus)  results;
 116    QTAILQ_HEAD(, UASRequest) requests;
 117
 118    /* properties */
 119    uint32_t                  requestlog;
 120
 121    /* usb 2.0 only */
 122    USBPacket                 *status2;
 123    UASRequest                *datain2;
 124    UASRequest                *dataout2;
 125
 126    /* usb 3.0 only */
 127    USBPacket                 *data3[UAS_MAX_STREAMS + 1];
 128    USBPacket                 *status3[UAS_MAX_STREAMS + 1];
 129};
 130
 131#define TYPE_USB_UAS "usb-uas"
 132#define USB_UAS(obj) OBJECT_CHECK(UASDevice, (obj), TYPE_USB_UAS)
 133
 134struct UASRequest {
 135    uint16_t     tag;
 136    uint64_t     lun;
 137    UASDevice    *uas;
 138    SCSIDevice   *dev;
 139    SCSIRequest  *req;
 140    USBPacket    *data;
 141    bool         data_async;
 142    bool         active;
 143    bool         complete;
 144    uint32_t     buf_off;
 145    uint32_t     buf_size;
 146    uint32_t     data_off;
 147    uint32_t     data_size;
 148    QTAILQ_ENTRY(UASRequest)  next;
 149};
 150
 151struct UASStatus {
 152    uint32_t                  stream;
 153    uas_iu                    status;
 154    uint32_t                  length;
 155    QTAILQ_ENTRY(UASStatus)   next;
 156};
 157
 158/* --------------------------------------------------------------------- */
 159
 160enum {
 161    STR_MANUFACTURER = 1,
 162    STR_PRODUCT,
 163    STR_SERIALNUMBER,
 164    STR_CONFIG_HIGH,
 165    STR_CONFIG_SUPER,
 166};
 167
 168static const USBDescStrings desc_strings = {
 169    [STR_MANUFACTURER] = "QEMU",
 170    [STR_PRODUCT]      = "USB Attached SCSI HBA",
 171    [STR_SERIALNUMBER] = "27842",
 172    [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
 173    [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
 174};
 175
 176static const USBDescIface desc_iface_high = {
 177    .bInterfaceNumber              = 0,
 178    .bNumEndpoints                 = 4,
 179    .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 180    .bInterfaceSubClass            = 0x06, /* SCSI */
 181    .bInterfaceProtocol            = 0x62, /* UAS  */
 182    .eps = (USBDescEndpoint[]) {
 183        {
 184            .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_COMMAND,
 185            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 186            .wMaxPacketSize        = 512,
 187            .extra = (uint8_t[]) {
 188                0x04,  /*  u8  bLength */
 189                0x24,  /*  u8  bDescriptorType */
 190                UAS_PIPE_ID_COMMAND,
 191                0x00,  /*  u8  bReserved */
 192            },
 193        },{
 194            .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_STATUS,
 195            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 196            .wMaxPacketSize        = 512,
 197            .extra = (uint8_t[]) {
 198                0x04,  /*  u8  bLength */
 199                0x24,  /*  u8  bDescriptorType */
 200                UAS_PIPE_ID_STATUS,
 201                0x00,  /*  u8  bReserved */
 202            },
 203        },{
 204            .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_DATA_IN,
 205            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 206            .wMaxPacketSize        = 512,
 207            .extra = (uint8_t[]) {
 208                0x04,  /*  u8  bLength */
 209                0x24,  /*  u8  bDescriptorType */
 210                UAS_PIPE_ID_DATA_IN,
 211                0x00,  /*  u8  bReserved */
 212            },
 213        },{
 214            .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT,
 215            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 216            .wMaxPacketSize        = 512,
 217            .extra = (uint8_t[]) {
 218                0x04,  /*  u8  bLength */
 219                0x24,  /*  u8  bDescriptorType */
 220                UAS_PIPE_ID_DATA_OUT,
 221                0x00,  /*  u8  bReserved */
 222            },
 223        },
 224    }
 225};
 226
 227static const USBDescIface desc_iface_super = {
 228    .bInterfaceNumber              = 0,
 229    .bNumEndpoints                 = 4,
 230    .bInterfaceClass               = USB_CLASS_MASS_STORAGE,
 231    .bInterfaceSubClass            = 0x06, /* SCSI */
 232    .bInterfaceProtocol            = 0x62, /* UAS  */
 233    .eps = (USBDescEndpoint[]) {
 234        {
 235            .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_COMMAND,
 236            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 237            .wMaxPacketSize        = 1024,
 238            .bMaxBurst             = 15,
 239            .extra = (uint8_t[]) {
 240                0x04,  /*  u8  bLength */
 241                0x24,  /*  u8  bDescriptorType */
 242                UAS_PIPE_ID_COMMAND,
 243                0x00,  /*  u8  bReserved */
 244            },
 245        },{
 246            .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_STATUS,
 247            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 248            .wMaxPacketSize        = 1024,
 249            .bMaxBurst             = 15,
 250            .bmAttributes_super    = UAS_STREAM_BM_ATTR,
 251            .extra = (uint8_t[]) {
 252                0x04,  /*  u8  bLength */
 253                0x24,  /*  u8  bDescriptorType */
 254                UAS_PIPE_ID_STATUS,
 255                0x00,  /*  u8  bReserved */
 256            },
 257        },{
 258            .bEndpointAddress      = USB_DIR_IN | UAS_PIPE_ID_DATA_IN,
 259            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 260            .wMaxPacketSize        = 1024,
 261            .bMaxBurst             = 15,
 262            .bmAttributes_super    = UAS_STREAM_BM_ATTR,
 263            .extra = (uint8_t[]) {
 264                0x04,  /*  u8  bLength */
 265                0x24,  /*  u8  bDescriptorType */
 266                UAS_PIPE_ID_DATA_IN,
 267                0x00,  /*  u8  bReserved */
 268            },
 269        },{
 270            .bEndpointAddress      = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT,
 271            .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 272            .wMaxPacketSize        = 1024,
 273            .bMaxBurst             = 15,
 274            .bmAttributes_super    = UAS_STREAM_BM_ATTR,
 275            .extra = (uint8_t[]) {
 276                0x04,  /*  u8  bLength */
 277                0x24,  /*  u8  bDescriptorType */
 278                UAS_PIPE_ID_DATA_OUT,
 279                0x00,  /*  u8  bReserved */
 280            },
 281        },
 282    }
 283};
 284
 285static const USBDescDevice desc_device_high = {
 286    .bcdUSB                        = 0x0200,
 287    .bMaxPacketSize0               = 64,
 288    .bNumConfigurations            = 1,
 289    .confs = (USBDescConfig[]) {
 290        {
 291            .bNumInterfaces        = 1,
 292            .bConfigurationValue   = 1,
 293            .iConfiguration        = STR_CONFIG_HIGH,
 294            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 295            .nif = 1,
 296            .ifs = &desc_iface_high,
 297        },
 298    },
 299};
 300
 301static const USBDescDevice desc_device_super = {
 302    .bcdUSB                        = 0x0300,
 303    .bMaxPacketSize0               = 64,
 304    .bNumConfigurations            = 1,
 305    .confs = (USBDescConfig[]) {
 306        {
 307            .bNumInterfaces        = 1,
 308            .bConfigurationValue   = 1,
 309            .iConfiguration        = STR_CONFIG_SUPER,
 310            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 311            .nif = 1,
 312            .ifs = &desc_iface_super,
 313        },
 314    },
 315};
 316
 317static const USBDesc desc = {
 318    .id = {
 319        .idVendor          = 0x46f4, /* CRC16() of "QEMU" */
 320        .idProduct         = 0x0003,
 321        .bcdDevice         = 0,
 322        .iManufacturer     = STR_MANUFACTURER,
 323        .iProduct          = STR_PRODUCT,
 324        .iSerialNumber     = STR_SERIALNUMBER,
 325    },
 326    .high  = &desc_device_high,
 327    .super = &desc_device_super,
 328    .str   = desc_strings,
 329};
 330
 331/* --------------------------------------------------------------------- */
 332
 333static bool uas_using_streams(UASDevice *uas)
 334{
 335    return uas->dev.speed == USB_SPEED_SUPER;
 336}
 337
 338/* --------------------------------------------------------------------- */
 339
 340static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag)
 341{
 342    UASStatus *st = g_new0(UASStatus, 1);
 343
 344    st->status.hdr.id = id;
 345    st->status.hdr.tag = cpu_to_be16(tag);
 346    st->length = sizeof(uas_iu_header);
 347    if (uas_using_streams(uas)) {
 348        st->stream = tag;
 349    }
 350    return st;
 351}
 352
 353static void usb_uas_send_status_bh(void *opaque)
 354{
 355    UASDevice *uas = opaque;
 356    UASStatus *st;
 357    USBPacket *p;
 358
 359    while ((st = QTAILQ_FIRST(&uas->results)) != NULL) {
 360        if (uas_using_streams(uas)) {
 361            p = uas->status3[st->stream];
 362            uas->status3[st->stream] = NULL;
 363        } else {
 364            p = uas->status2;
 365            uas->status2 = NULL;
 366        }
 367        if (p == NULL) {
 368            break;
 369        }
 370
 371        usb_packet_copy(p, &st->status, st->length);
 372        QTAILQ_REMOVE(&uas->results, st, next);
 373        g_free(st);
 374
 375        p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 376        usb_packet_complete(&uas->dev, p);
 377    }
 378}
 379
 380static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length)
 381{
 382    USBPacket *p = uas_using_streams(uas) ?
 383        uas->status3[st->stream] : uas->status2;
 384
 385    st->length += length;
 386    QTAILQ_INSERT_TAIL(&uas->results, st, next);
 387    if (p) {
 388        /*
 389         * Just schedule bh make sure any in-flight data transaction
 390         * is finished before completing (sending) the status packet.
 391         */
 392        qemu_bh_schedule(uas->status_bh);
 393    } else {
 394        USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN,
 395                                     UAS_PIPE_ID_STATUS);
 396        usb_wakeup(ep, st->stream);
 397    }
 398}
 399
 400static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, uint8_t code)
 401{
 402    UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_RESPONSE, tag);
 403
 404    trace_usb_uas_response(uas->dev.addr, tag, code);
 405    st->status.response.response_code = code;
 406    usb_uas_queue_status(uas, st, sizeof(uas_iu_response));
 407}
 408
 409static void usb_uas_queue_sense(UASRequest *req, uint8_t status)
 410{
 411    UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_SENSE, req->tag);
 412    int len, slen = 0;
 413
 414    trace_usb_uas_sense(req->uas->dev.addr, req->tag, status);
 415    st->status.sense.status = status;
 416    st->status.sense.status_qualifier = cpu_to_be16(0);
 417    if (status != GOOD) {
 418        slen = scsi_req_get_sense(req->req, st->status.sense.sense_data,
 419                                  sizeof(st->status.sense.sense_data));
 420        st->status.sense.sense_length = cpu_to_be16(slen);
 421    }
 422    len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen;
 423    usb_uas_queue_status(req->uas, st, len);
 424}
 425
 426static void usb_uas_queue_fake_sense(UASDevice *uas, uint16_t tag,
 427                                     struct SCSISense sense)
 428{
 429    UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_SENSE, tag);
 430    int len, slen = 0;
 431
 432    st->status.sense.status = CHECK_CONDITION;
 433    st->status.sense.status_qualifier = cpu_to_be16(0);
 434    st->status.sense.sense_data[0] = 0x70;
 435    st->status.sense.sense_data[2] = sense.key;
 436    st->status.sense.sense_data[7] = 10;
 437    st->status.sense.sense_data[12] = sense.asc;
 438    st->status.sense.sense_data[13] = sense.ascq;
 439    slen = 18;
 440    len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen;
 441    usb_uas_queue_status(uas, st, len);
 442}
 443
 444static void usb_uas_queue_read_ready(UASRequest *req)
 445{
 446    UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_READ_READY,
 447                                         req->tag);
 448
 449    trace_usb_uas_read_ready(req->uas->dev.addr, req->tag);
 450    usb_uas_queue_status(req->uas, st, 0);
 451}
 452
 453static void usb_uas_queue_write_ready(UASRequest *req)
 454{
 455    UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_WRITE_READY,
 456                                         req->tag);
 457
 458    trace_usb_uas_write_ready(req->uas->dev.addr, req->tag);
 459    usb_uas_queue_status(req->uas, st, 0);
 460}
 461
 462/* --------------------------------------------------------------------- */
 463
 464static int usb_uas_get_lun(uint64_t lun64)
 465{
 466    return (lun64 >> 48) & 0xff;
 467}
 468
 469static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64)
 470{
 471    if ((lun64 >> 56) != 0x00) {
 472        return NULL;
 473    }
 474    return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64));
 475}
 476
 477static void usb_uas_complete_data_packet(UASRequest *req)
 478{
 479    USBPacket *p;
 480
 481    if (!req->data_async) {
 482        return;
 483    }
 484    p = req->data;
 485    req->data = NULL;
 486    req->data_async = false;
 487    p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 488    usb_packet_complete(&req->uas->dev, p);
 489}
 490
 491static void usb_uas_copy_data(UASRequest *req)
 492{
 493    uint32_t length;
 494
 495    length = MIN(req->buf_size - req->buf_off,
 496                 req->data->iov.size - req->data->actual_length);
 497    trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length,
 498                            req->data->actual_length, req->data->iov.size,
 499                            req->buf_off, req->buf_size);
 500    usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off,
 501                    length);
 502    req->buf_off += length;
 503    req->data_off += length;
 504
 505    if (req->data->actual_length == req->data->iov.size) {
 506        usb_uas_complete_data_packet(req);
 507    }
 508    if (req->buf_size && req->buf_off == req->buf_size) {
 509        req->buf_off = 0;
 510        req->buf_size = 0;
 511        scsi_req_continue(req->req);
 512    }
 513}
 514
 515static void usb_uas_start_next_transfer(UASDevice *uas)
 516{
 517    UASRequest *req;
 518
 519    if (uas_using_streams(uas)) {
 520        return;
 521    }
 522
 523    QTAILQ_FOREACH(req, &uas->requests, next) {
 524        if (req->active || req->complete) {
 525            continue;
 526        }
 527        if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain2 == NULL) {
 528            uas->datain2 = req;
 529            usb_uas_queue_read_ready(req);
 530            req->active = true;
 531            return;
 532        }
 533        if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout2 == NULL) {
 534            uas->dataout2 = req;
 535            usb_uas_queue_write_ready(req);
 536            req->active = true;
 537            return;
 538        }
 539    }
 540}
 541
 542static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_iu *iu)
 543{
 544    UASRequest *req;
 545
 546    req = g_new0(UASRequest, 1);
 547    req->uas = uas;
 548    req->tag = be16_to_cpu(iu->hdr.tag);
 549    req->lun = be64_to_cpu(iu->command.lun);
 550    req->dev = usb_uas_get_dev(req->uas, req->lun);
 551    return req;
 552}
 553
 554static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv)
 555{
 556    UASRequest *req = priv;
 557    UASDevice *uas = req->uas;
 558
 559    if (req == uas->datain2) {
 560        uas->datain2 = NULL;
 561    }
 562    if (req == uas->dataout2) {
 563        uas->dataout2 = NULL;
 564    }
 565    QTAILQ_REMOVE(&uas->requests, req, next);
 566    g_free(req);
 567    usb_uas_start_next_transfer(uas);
 568}
 569
 570static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag)
 571{
 572    UASRequest *req;
 573
 574    QTAILQ_FOREACH(req, &uas->requests, next) {
 575        if (req->tag == tag) {
 576            return req;
 577        }
 578    }
 579    return NULL;
 580}
 581
 582static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len)
 583{
 584    UASRequest *req = r->hba_private;
 585
 586    trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len);
 587    req->buf_off = 0;
 588    req->buf_size = len;
 589    if (req->data) {
 590        usb_uas_copy_data(req);
 591    } else {
 592        usb_uas_start_next_transfer(req->uas);
 593    }
 594}
 595
 596static void usb_uas_scsi_command_complete(SCSIRequest *r,
 597                                          uint32_t status, size_t resid)
 598{
 599    UASRequest *req = r->hba_private;
 600
 601    trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, status, resid);
 602    req->complete = true;
 603    if (req->data) {
 604        usb_uas_complete_data_packet(req);
 605    }
 606    usb_uas_queue_sense(req, status);
 607    scsi_req_unref(req->req);
 608}
 609
 610static void usb_uas_scsi_request_cancelled(SCSIRequest *r)
 611{
 612    UASRequest *req = r->hba_private;
 613
 614    /* FIXME: queue notification to status pipe? */
 615    scsi_req_unref(req->req);
 616}
 617
 618static const struct SCSIBusInfo usb_uas_scsi_info = {
 619    .tcq = true,
 620    .max_target = 0,
 621    .max_lun = 255,
 622
 623    .transfer_data = usb_uas_scsi_transfer_data,
 624    .complete = usb_uas_scsi_command_complete,
 625    .cancel = usb_uas_scsi_request_cancelled,
 626    .free_request = usb_uas_scsi_free_request,
 627};
 628
 629/* --------------------------------------------------------------------- */
 630
 631static void usb_uas_handle_reset(USBDevice *dev)
 632{
 633    UASDevice *uas = USB_UAS(dev);
 634    UASRequest *req, *nreq;
 635    UASStatus *st, *nst;
 636
 637    trace_usb_uas_reset(dev->addr);
 638    QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) {
 639        scsi_req_cancel(req->req);
 640    }
 641    QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) {
 642        QTAILQ_REMOVE(&uas->results, st, next);
 643        g_free(st);
 644    }
 645}
 646
 647static void usb_uas_handle_control(USBDevice *dev, USBPacket *p,
 648               int request, int value, int index, int length, uint8_t *data)
 649{
 650    int ret;
 651
 652    ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
 653    if (ret >= 0) {
 654        return;
 655    }
 656    error_report("%s: unhandled control request (req 0x%x, val 0x%x, idx 0x%x",
 657                 __func__, request, value, index);
 658    p->status = USB_RET_STALL;
 659}
 660
 661static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p)
 662{
 663    UASDevice *uas = USB_UAS(dev);
 664    UASRequest *req, *nreq;
 665    int i;
 666
 667    if (uas->status2 == p) {
 668        uas->status2 = NULL;
 669        qemu_bh_cancel(uas->status_bh);
 670        return;
 671    }
 672    if (uas_using_streams(uas)) {
 673        for (i = 0; i <= UAS_MAX_STREAMS; i++) {
 674            if (uas->status3[i] == p) {
 675                uas->status3[i] = NULL;
 676                return;
 677            }
 678            if (uas->data3[i] == p) {
 679                uas->data3[i] = NULL;
 680                return;
 681            }
 682        }
 683    }
 684    QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) {
 685        if (req->data == p) {
 686            req->data = NULL;
 687            return;
 688        }
 689    }
 690    assert(!"canceled usb packet not found");
 691}
 692
 693static void usb_uas_command(UASDevice *uas, uas_iu *iu)
 694{
 695    UASRequest *req;
 696    uint32_t len;
 697    uint16_t tag = be16_to_cpu(iu->hdr.tag);
 698
 699    if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
 700        goto invalid_tag;
 701    }
 702    req = usb_uas_find_request(uas, tag);
 703    if (req) {
 704        goto overlapped_tag;
 705    }
 706    req = usb_uas_alloc_request(uas, iu);
 707    if (req->dev == NULL) {
 708        goto bad_target;
 709    }
 710
 711    trace_usb_uas_command(uas->dev.addr, req->tag,
 712                          usb_uas_get_lun(req->lun),
 713                          req->lun >> 32, req->lun & 0xffffffff);
 714    QTAILQ_INSERT_TAIL(&uas->requests, req, next);
 715    if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) {
 716        req->data = uas->data3[req->tag];
 717        req->data_async = true;
 718        uas->data3[req->tag] = NULL;
 719    }
 720
 721    req->req = scsi_req_new(req->dev, req->tag,
 722                            usb_uas_get_lun(req->lun),
 723                            iu->command.cdb, req);
 724    if (uas->requestlog) {
 725        scsi_req_print(req->req);
 726    }
 727    len = scsi_req_enqueue(req->req);
 728    if (len) {
 729        req->data_size = len;
 730        scsi_req_continue(req->req);
 731    }
 732    return;
 733
 734invalid_tag:
 735    usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG);
 736    return;
 737
 738overlapped_tag:
 739    usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS);
 740    return;
 741
 742bad_target:
 743    usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED);
 744    g_free(req);
 745}
 746
 747static void usb_uas_task(UASDevice *uas, uas_iu *iu)
 748{
 749    uint16_t tag = be16_to_cpu(iu->hdr.tag);
 750    uint64_t lun64 = be64_to_cpu(iu->task.lun);
 751    SCSIDevice *dev = usb_uas_get_dev(uas, lun64);
 752    int lun = usb_uas_get_lun(lun64);
 753    UASRequest *req;
 754    uint16_t task_tag;
 755
 756    if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {
 757        goto invalid_tag;
 758    }
 759    req = usb_uas_find_request(uas, be16_to_cpu(iu->hdr.tag));
 760    if (req) {
 761        goto overlapped_tag;
 762    }
 763    if (dev == NULL) {
 764        goto incorrect_lun;
 765    }
 766
 767    switch (iu->task.function) {
 768    case UAS_TMF_ABORT_TASK:
 769        task_tag = be16_to_cpu(iu->task.task_tag);
 770        trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag);
 771        req = usb_uas_find_request(uas, task_tag);
 772        if (req && req->dev == dev) {
 773            scsi_req_cancel(req->req);
 774        }
 775        usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE);
 776        break;
 777
 778    case UAS_TMF_LOGICAL_UNIT_RESET:
 779        trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun);
 780        qdev_reset_all(&dev->qdev);
 781        usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE);
 782        break;
 783
 784    default:
 785        trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, iu->task.function);
 786        usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED);
 787        break;
 788    }
 789    return;
 790
 791invalid_tag:
 792    usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT);
 793    return;
 794
 795overlapped_tag:
 796    usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG);
 797    return;
 798
 799incorrect_lun:
 800    usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN);
 801}
 802
 803static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
 804{
 805    UASDevice *uas = USB_UAS(dev);
 806    uas_iu iu;
 807    UASStatus *st;
 808    UASRequest *req;
 809    int length;
 810
 811    switch (p->ep->nr) {
 812    case UAS_PIPE_ID_COMMAND:
 813        length = MIN(sizeof(iu), p->iov.size);
 814        usb_packet_copy(p, &iu, length);
 815        switch (iu.hdr.id) {
 816        case UAS_UI_COMMAND:
 817            usb_uas_command(uas, &iu);
 818            break;
 819        case UAS_UI_TASK_MGMT:
 820            usb_uas_task(uas, &iu);
 821            break;
 822        default:
 823            error_report("%s: unknown command iu: id 0x%x",
 824                         __func__, iu.hdr.id);
 825            p->status = USB_RET_STALL;
 826            break;
 827        }
 828        break;
 829    case UAS_PIPE_ID_STATUS:
 830        if (p->stream) {
 831            QTAILQ_FOREACH(st, &uas->results, next) {
 832                if (st->stream == p->stream) {
 833                    break;
 834                }
 835            }
 836            if (st == NULL) {
 837                assert(uas->status3[p->stream] == NULL);
 838                uas->status3[p->stream] = p;
 839                p->status = USB_RET_ASYNC;
 840                break;
 841            }
 842        } else {
 843            st = QTAILQ_FIRST(&uas->results);
 844            if (st == NULL) {
 845                assert(uas->status2 == NULL);
 846                uas->status2 = p;
 847                p->status = USB_RET_ASYNC;
 848                break;
 849            }
 850        }
 851        usb_packet_copy(p, &st->status, st->length);
 852        QTAILQ_REMOVE(&uas->results, st, next);
 853        g_free(st);
 854        break;
 855    case UAS_PIPE_ID_DATA_IN:
 856    case UAS_PIPE_ID_DATA_OUT:
 857        if (p->stream) {
 858            req = usb_uas_find_request(uas, p->stream);
 859        } else {
 860            req = (p->ep->nr == UAS_PIPE_ID_DATA_IN)
 861                ? uas->datain2 : uas->dataout2;
 862        }
 863        if (req == NULL) {
 864            if (p->stream) {
 865                assert(uas->data3[p->stream] == NULL);
 866                uas->data3[p->stream] = p;
 867                p->status = USB_RET_ASYNC;
 868                break;
 869            } else {
 870                error_report("%s: no inflight request", __func__);
 871                p->status = USB_RET_STALL;
 872                break;
 873            }
 874        }
 875        scsi_req_ref(req->req);
 876        req->data = p;
 877        usb_uas_copy_data(req);
 878        if (p->actual_length == p->iov.size || req->complete) {
 879            req->data = NULL;
 880        } else {
 881            req->data_async = true;
 882            p->status = USB_RET_ASYNC;
 883        }
 884        scsi_req_unref(req->req);
 885        usb_uas_start_next_transfer(uas);
 886        break;
 887    default:
 888        error_report("%s: invalid endpoint %d", __func__, p->ep->nr);
 889        p->status = USB_RET_STALL;
 890        break;
 891    }
 892}
 893
 894static void usb_uas_unrealize(USBDevice *dev, Error **errp)
 895{
 896    UASDevice *uas = USB_UAS(dev);
 897
 898    qemu_bh_delete(uas->status_bh);
 899
 900    object_unref(OBJECT(&uas->bus));
 901}
 902
 903static void usb_uas_realize(USBDevice *dev, Error **errp)
 904{
 905    UASDevice *uas = USB_UAS(dev);
 906    DeviceState *d = DEVICE(dev);
 907
 908    usb_desc_create_serial(dev);
 909    usb_desc_init(dev);
 910    if (d->hotplugged) {
 911        uas->dev.auto_attach = 0;
 912    }
 913
 914    QTAILQ_INIT(&uas->results);
 915    QTAILQ_INIT(&uas->requests);
 916    uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas);
 917
 918    scsi_bus_new(&uas->bus, sizeof(uas->bus), DEVICE(dev),
 919                 &usb_uas_scsi_info, NULL);
 920}
 921
 922static const VMStateDescription vmstate_usb_uas = {
 923    .name = "usb-uas",
 924    .unmigratable = 1,
 925    .fields = (VMStateField[]) {
 926        VMSTATE_USB_DEVICE(dev, UASDevice),
 927        VMSTATE_END_OF_LIST()
 928    }
 929};
 930
 931static Property uas_properties[] = {
 932    DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0),
 933    DEFINE_PROP_END_OF_LIST(),
 934};
 935
 936static void usb_uas_class_initfn(ObjectClass *klass, void *data)
 937{
 938    DeviceClass *dc = DEVICE_CLASS(klass);
 939    USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 940
 941    uc->realize        = usb_uas_realize;
 942    uc->product_desc   = desc_strings[STR_PRODUCT];
 943    uc->usb_desc       = &desc;
 944    uc->cancel_packet  = usb_uas_cancel_io;
 945    uc->handle_attach  = usb_desc_attach;
 946    uc->handle_reset   = usb_uas_handle_reset;
 947    uc->handle_control = usb_uas_handle_control;
 948    uc->handle_data    = usb_uas_handle_data;
 949    uc->unrealize      = usb_uas_unrealize;
 950    uc->attached_settable = true;
 951    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 952    dc->fw_name = "storage";
 953    dc->vmsd = &vmstate_usb_uas;
 954    dc->props = uas_properties;
 955}
 956
 957static const TypeInfo uas_info = {
 958    .name          = TYPE_USB_UAS,
 959    .parent        = TYPE_USB_DEVICE,
 960    .instance_size = sizeof(UASDevice),
 961    .class_init    = usb_uas_class_initfn,
 962};
 963
 964static void usb_uas_register_types(void)
 965{
 966    type_register_static(&uas_info);
 967}
 968
 969type_init(usb_uas_register_types)
 970