qemu/hw/usb/redirect.c
<<
>>
Prefs
   1/*
   2 * USB redirector usb-guest
   3 *
   4 * Copyright (c) 2011-2012 Red Hat, Inc.
   5 *
   6 * Red Hat Authors:
   7 * Hans de Goede <hdegoede@redhat.com>
   8 *
   9 * Permission is hereby granted, free of charge, to any person obtaining a copy
  10 * of this software and associated documentation files (the "Software"), to deal
  11 * in the Software without restriction, including without limitation the rights
  12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  13 * copies of the Software, and to permit persons to whom the Software is
  14 * furnished to do so, subject to the following conditions:
  15 *
  16 * The above copyright notice and this permission notice shall be included in
  17 * all copies or substantial portions of the Software.
  18 *
  19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  25 * THE SOFTWARE.
  26 */
  27
  28#include "qemu/osdep.h"
  29#include "qemu/units.h"
  30#include "qapi/error.h"
  31#include "qemu-common.h"
  32#include "qemu/timer.h"
  33#include "sysemu/sysemu.h"
  34#include "qapi/qmp/qerror.h"
  35#include "qemu/error-report.h"
  36#include "qemu/iov.h"
  37#include "chardev/char-fe.h"
  38
  39#include <usbredirparser.h>
  40#include <usbredirfilter.h>
  41
  42#include "hw/usb.h"
  43
  44/* ERROR is defined below. Remove any previous definition. */
  45#undef ERROR
  46
  47#define MAX_ENDPOINTS 32
  48#define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
  49#define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
  50#define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
  51#define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
  52                         ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
  53#define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
  54                       ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
  55                       (i) & 0x0f))
  56
  57#ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
  58#define USBREDIR_VERSION 0
  59#endif
  60
  61typedef struct USBRedirDevice USBRedirDevice;
  62
  63/* Struct to hold buffered packets */
  64struct buf_packet {
  65    uint8_t *data;
  66    void *free_on_destroy;
  67    uint16_t len;
  68    uint16_t offset;
  69    uint8_t status;
  70    QTAILQ_ENTRY(buf_packet)next;
  71};
  72
  73struct endp_data {
  74    USBRedirDevice *dev;
  75    uint8_t type;
  76    uint8_t interval;
  77    uint8_t interface; /* bInterfaceNumber this ep belongs to */
  78    uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
  79    uint32_t max_streams;
  80    uint8_t iso_started;
  81    uint8_t iso_error; /* For reporting iso errors to the HC */
  82    uint8_t interrupt_started;
  83    uint8_t interrupt_error;
  84    uint8_t bulk_receiving_enabled;
  85    uint8_t bulk_receiving_started;
  86    uint8_t bufpq_prefilled;
  87    uint8_t bufpq_dropping_packets;
  88    QTAILQ_HEAD(, buf_packet) bufpq;
  89    int32_t bufpq_size;
  90    int32_t bufpq_target_size;
  91    USBPacket *pending_async_packet;
  92};
  93
  94struct PacketIdQueueEntry {
  95    uint64_t id;
  96    QTAILQ_ENTRY(PacketIdQueueEntry)next;
  97};
  98
  99struct PacketIdQueue {
 100    USBRedirDevice *dev;
 101    const char *name;
 102    QTAILQ_HEAD(, PacketIdQueueEntry) head;
 103    int size;
 104};
 105
 106struct USBRedirDevice {
 107    USBDevice dev;
 108    /* Properties */
 109    CharBackend cs;
 110    bool enable_streams;
 111    uint8_t debug;
 112    int32_t bootindex;
 113    char *filter_str;
 114    /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
 115    const uint8_t *read_buf;
 116    int read_buf_size;
 117    /* Active chardev-watch-tag */
 118    guint watch;
 119    /* For async handling of close / reject */
 120    QEMUBH *chardev_close_bh;
 121    QEMUBH *device_reject_bh;
 122    /* To delay the usb attach in case of quick chardev close + open */
 123    QEMUTimer *attach_timer;
 124    int64_t next_attach_time;
 125    struct usbredirparser *parser;
 126    struct endp_data endpoint[MAX_ENDPOINTS];
 127    struct PacketIdQueue cancelled;
 128    struct PacketIdQueue already_in_flight;
 129    void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
 130    /* Data for device filtering */
 131    struct usb_redir_device_connect_header device_info;
 132    struct usb_redir_interface_info_header interface_info;
 133    struct usbredirfilter_rule *filter_rules;
 134    int filter_rules_count;
 135    int compatible_speedmask;
 136    VMChangeStateEntry *vmstate;
 137};
 138
 139#define TYPE_USB_REDIR "usb-redir"
 140#define USB_REDIRECT(obj) OBJECT_CHECK(USBRedirDevice, (obj), TYPE_USB_REDIR)
 141
 142static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
 143static void usbredir_device_connect(void *priv,
 144    struct usb_redir_device_connect_header *device_connect);
 145static void usbredir_device_disconnect(void *priv);
 146static void usbredir_interface_info(void *priv,
 147    struct usb_redir_interface_info_header *interface_info);
 148static void usbredir_ep_info(void *priv,
 149    struct usb_redir_ep_info_header *ep_info);
 150static void usbredir_configuration_status(void *priv, uint64_t id,
 151    struct usb_redir_configuration_status_header *configuration_status);
 152static void usbredir_alt_setting_status(void *priv, uint64_t id,
 153    struct usb_redir_alt_setting_status_header *alt_setting_status);
 154static void usbredir_iso_stream_status(void *priv, uint64_t id,
 155    struct usb_redir_iso_stream_status_header *iso_stream_status);
 156static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
 157    struct usb_redir_interrupt_receiving_status_header
 158    *interrupt_receiving_status);
 159static void usbredir_bulk_streams_status(void *priv, uint64_t id,
 160    struct usb_redir_bulk_streams_status_header *bulk_streams_status);
 161static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
 162    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
 163static void usbredir_control_packet(void *priv, uint64_t id,
 164    struct usb_redir_control_packet_header *control_packet,
 165    uint8_t *data, int data_len);
 166static void usbredir_bulk_packet(void *priv, uint64_t id,
 167    struct usb_redir_bulk_packet_header *bulk_packet,
 168    uint8_t *data, int data_len);
 169static void usbredir_iso_packet(void *priv, uint64_t id,
 170    struct usb_redir_iso_packet_header *iso_packet,
 171    uint8_t *data, int data_len);
 172static void usbredir_interrupt_packet(void *priv, uint64_t id,
 173    struct usb_redir_interrupt_packet_header *interrupt_header,
 174    uint8_t *data, int data_len);
 175static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
 176    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
 177    uint8_t *data, int data_len);
 178
 179static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
 180    int status);
 181
 182#define VERSION "qemu usb-redir guest " QEMU_VERSION
 183
 184/*
 185 * Logging stuff
 186 */
 187
 188#define ERROR(...) \
 189    do { \
 190        if (dev->debug >= usbredirparser_error) { \
 191            error_report("usb-redir error: " __VA_ARGS__); \
 192        } \
 193    } while (0)
 194#define WARNING(...) \
 195    do { \
 196        if (dev->debug >= usbredirparser_warning) { \
 197            warn_report("" __VA_ARGS__); \
 198        } \
 199    } while (0)
 200#define INFO(...) \
 201    do { \
 202        if (dev->debug >= usbredirparser_info) { \
 203            error_report("usb-redir: " __VA_ARGS__); \
 204        } \
 205    } while (0)
 206#define DPRINTF(...) \
 207    do { \
 208        if (dev->debug >= usbredirparser_debug) { \
 209            error_report("usb-redir: " __VA_ARGS__); \
 210        } \
 211    } while (0)
 212#define DPRINTF2(...) \
 213    do { \
 214        if (dev->debug >= usbredirparser_debug_data) { \
 215            error_report("usb-redir: " __VA_ARGS__); \
 216        } \
 217    } while (0)
 218
 219static void usbredir_log(void *priv, int level, const char *msg)
 220{
 221    USBRedirDevice *dev = priv;
 222
 223    if (dev->debug < level) {
 224        return;
 225    }
 226
 227    error_report("%s", msg);
 228}
 229
 230static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
 231    const uint8_t *data, int len)
 232{
 233    if (dev->debug < usbredirparser_debug_data) {
 234        return;
 235    }
 236    qemu_hexdump((char *)data, stderr, desc, len);
 237}
 238
 239/*
 240 * usbredirparser io functions
 241 */
 242
 243static int usbredir_read(void *priv, uint8_t *data, int count)
 244{
 245    USBRedirDevice *dev = priv;
 246
 247    if (dev->read_buf_size < count) {
 248        count = dev->read_buf_size;
 249    }
 250
 251    memcpy(data, dev->read_buf, count);
 252
 253    dev->read_buf_size -= count;
 254    if (dev->read_buf_size) {
 255        dev->read_buf += count;
 256    } else {
 257        dev->read_buf = NULL;
 258    }
 259
 260    return count;
 261}
 262
 263static gboolean usbredir_write_unblocked(GIOChannel *chan, GIOCondition cond,
 264                                         void *opaque)
 265{
 266    USBRedirDevice *dev = opaque;
 267
 268    dev->watch = 0;
 269    usbredirparser_do_write(dev->parser);
 270
 271    return FALSE;
 272}
 273
 274static int usbredir_write(void *priv, uint8_t *data, int count)
 275{
 276    USBRedirDevice *dev = priv;
 277    int r;
 278
 279    if (!qemu_chr_fe_backend_open(&dev->cs)) {
 280        return 0;
 281    }
 282
 283    /* Don't send new data to the chardev until our state is fully synced */
 284    if (!runstate_check(RUN_STATE_RUNNING)) {
 285        return 0;
 286    }
 287
 288    r = qemu_chr_fe_write(&dev->cs, data, count);
 289    if (r < count) {
 290        if (!dev->watch) {
 291            dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
 292                                               usbredir_write_unblocked, dev);
 293        }
 294        if (r < 0) {
 295            r = 0;
 296        }
 297    }
 298    return r;
 299}
 300
 301/*
 302 * Cancelled and buffered packets helpers
 303 */
 304
 305static void packet_id_queue_init(struct PacketIdQueue *q,
 306    USBRedirDevice *dev, const char *name)
 307{
 308    q->dev = dev;
 309    q->name = name;
 310    QTAILQ_INIT(&q->head);
 311    q->size = 0;
 312}
 313
 314static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
 315{
 316    USBRedirDevice *dev = q->dev;
 317    struct PacketIdQueueEntry *e;
 318
 319    DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
 320
 321    e = g_new0(struct PacketIdQueueEntry, 1);
 322    e->id = id;
 323    QTAILQ_INSERT_TAIL(&q->head, e, next);
 324    q->size++;
 325}
 326
 327static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
 328{
 329    USBRedirDevice *dev = q->dev;
 330    struct PacketIdQueueEntry *e;
 331
 332    QTAILQ_FOREACH(e, &q->head, next) {
 333        if (e->id == id) {
 334            DPRINTF("removing packet id %"PRIu64" from %s queue\n",
 335                    id, q->name);
 336            QTAILQ_REMOVE(&q->head, e, next);
 337            q->size--;
 338            g_free(e);
 339            return 1;
 340        }
 341    }
 342    return 0;
 343}
 344
 345static void packet_id_queue_empty(struct PacketIdQueue *q)
 346{
 347    USBRedirDevice *dev = q->dev;
 348    struct PacketIdQueueEntry *e, *next_e;
 349
 350    DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
 351
 352    QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
 353        QTAILQ_REMOVE(&q->head, e, next);
 354        g_free(e);
 355    }
 356    q->size = 0;
 357}
 358
 359static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
 360{
 361    USBRedirDevice *dev = USB_REDIRECT(udev);
 362    int i = USBEP2I(p->ep);
 363
 364    if (p->combined) {
 365        usb_combined_packet_cancel(udev, p);
 366        return;
 367    }
 368
 369    if (dev->endpoint[i].pending_async_packet) {
 370        assert(dev->endpoint[i].pending_async_packet == p);
 371        dev->endpoint[i].pending_async_packet = NULL;
 372        return;
 373    }
 374
 375    packet_id_queue_add(&dev->cancelled, p->id);
 376    usbredirparser_send_cancel_data_packet(dev->parser, p->id);
 377    usbredirparser_do_write(dev->parser);
 378}
 379
 380static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
 381{
 382    if (!dev->dev.attached) {
 383        return 1; /* Treat everything as cancelled after a disconnect */
 384    }
 385    return packet_id_queue_remove(&dev->cancelled, id);
 386}
 387
 388static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
 389    struct USBEndpoint *ep)
 390{
 391    static USBPacket *p;
 392
 393    /* async handled packets for bulk receiving eps do not count as inflight */
 394    if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
 395        return;
 396    }
 397
 398    QTAILQ_FOREACH(p, &ep->queue, queue) {
 399        /* Skip combined packets, except for the first */
 400        if (p->combined && p != p->combined->first) {
 401            continue;
 402        }
 403        if (p->state == USB_PACKET_ASYNC) {
 404            packet_id_queue_add(&dev->already_in_flight, p->id);
 405        }
 406    }
 407}
 408
 409static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
 410{
 411    int ep;
 412    struct USBDevice *udev = &dev->dev;
 413
 414    usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
 415
 416    for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
 417        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
 418        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
 419    }
 420}
 421
 422static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
 423{
 424    return packet_id_queue_remove(&dev->already_in_flight, id);
 425}
 426
 427static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
 428    uint8_t ep, uint64_t id)
 429{
 430    USBPacket *p;
 431
 432    if (usbredir_is_cancelled(dev, id)) {
 433        return NULL;
 434    }
 435
 436    p = usb_ep_find_packet_by_id(&dev->dev,
 437                            (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
 438                            ep & 0x0f, id);
 439    if (p == NULL) {
 440        ERROR("could not find packet with id %"PRIu64"\n", id);
 441    }
 442    return p;
 443}
 444
 445static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
 446    uint8_t status, uint8_t ep, void *free_on_destroy)
 447{
 448    struct buf_packet *bufp;
 449
 450    if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
 451        dev->endpoint[EP2I(ep)].bufpq_size >
 452            2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
 453        DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
 454        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
 455    }
 456    /* Since we're interupting the stream anyways, drop enough packets to get
 457       back to our target buffer size */
 458    if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
 459        if (dev->endpoint[EP2I(ep)].bufpq_size >
 460                dev->endpoint[EP2I(ep)].bufpq_target_size) {
 461            free(data);
 462            return -1;
 463        }
 464        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 465    }
 466
 467    bufp = g_new(struct buf_packet, 1);
 468    bufp->data   = data;
 469    bufp->len    = len;
 470    bufp->offset = 0;
 471    bufp->status = status;
 472    bufp->free_on_destroy = free_on_destroy;
 473    QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
 474    dev->endpoint[EP2I(ep)].bufpq_size++;
 475    return 0;
 476}
 477
 478static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
 479    uint8_t ep)
 480{
 481    QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
 482    dev->endpoint[EP2I(ep)].bufpq_size--;
 483    free(bufp->free_on_destroy);
 484    g_free(bufp);
 485}
 486
 487static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
 488{
 489    struct buf_packet *buf, *buf_next;
 490
 491    QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
 492        bufp_free(dev, buf, ep);
 493    }
 494}
 495
 496/*
 497 * USBDevice callbacks
 498 */
 499
 500static void usbredir_handle_reset(USBDevice *udev)
 501{
 502    USBRedirDevice *dev = USB_REDIRECT(udev);
 503
 504    DPRINTF("reset device\n");
 505    usbredirparser_send_reset(dev->parser);
 506    usbredirparser_do_write(dev->parser);
 507}
 508
 509static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
 510                                     uint8_t ep)
 511{
 512    int status, len;
 513    if (!dev->endpoint[EP2I(ep)].iso_started &&
 514            !dev->endpoint[EP2I(ep)].iso_error) {
 515        struct usb_redir_start_iso_stream_header start_iso = {
 516            .endpoint = ep,
 517        };
 518        int pkts_per_sec;
 519
 520        if (dev->dev.speed == USB_SPEED_HIGH) {
 521            pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
 522        } else {
 523            pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
 524        }
 525        /* Testing has shown that we need circa 60 ms buffer */
 526        dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
 527
 528        /* Aim for approx 100 interrupts / second on the client to
 529           balance latency and interrupt load */
 530        start_iso.pkts_per_urb = pkts_per_sec / 100;
 531        if (start_iso.pkts_per_urb < 1) {
 532            start_iso.pkts_per_urb = 1;
 533        } else if (start_iso.pkts_per_urb > 32) {
 534            start_iso.pkts_per_urb = 32;
 535        }
 536
 537        start_iso.no_urbs = DIV_ROUND_UP(
 538                                     dev->endpoint[EP2I(ep)].bufpq_target_size,
 539                                     start_iso.pkts_per_urb);
 540        /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
 541           as overflow buffer. Also see the usbredir protocol documentation */
 542        if (!(ep & USB_DIR_IN)) {
 543            start_iso.no_urbs *= 2;
 544        }
 545        if (start_iso.no_urbs > 16) {
 546            start_iso.no_urbs = 16;
 547        }
 548
 549        /* No id, we look at the ep when receiving a status back */
 550        usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
 551        usbredirparser_do_write(dev->parser);
 552        DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
 553                pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
 554        dev->endpoint[EP2I(ep)].iso_started = 1;
 555        dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
 556        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 557    }
 558
 559    if (ep & USB_DIR_IN) {
 560        struct buf_packet *isop;
 561
 562        if (dev->endpoint[EP2I(ep)].iso_started &&
 563                !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
 564            if (dev->endpoint[EP2I(ep)].bufpq_size <
 565                    dev->endpoint[EP2I(ep)].bufpq_target_size) {
 566                return;
 567            }
 568            dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
 569        }
 570
 571        isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
 572        if (isop == NULL) {
 573            DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
 574                    ep, dev->endpoint[EP2I(ep)].iso_error);
 575            /* Re-fill the buffer */
 576            dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
 577            /* Check iso_error for stream errors, otherwise its an underrun */
 578            status = dev->endpoint[EP2I(ep)].iso_error;
 579            dev->endpoint[EP2I(ep)].iso_error = 0;
 580            p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
 581            return;
 582        }
 583        DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
 584                 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
 585
 586        status = isop->status;
 587        len = isop->len;
 588        if (len > p->iov.size) {
 589            ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
 590                  ep, len, (int)p->iov.size);
 591            len = p->iov.size;
 592            status = usb_redir_babble;
 593        }
 594        usb_packet_copy(p, isop->data, len);
 595        bufp_free(dev, isop, ep);
 596        usbredir_handle_status(dev, p, status);
 597    } else {
 598        /* If the stream was not started because of a pending error don't
 599           send the packet to the usb-host */
 600        if (dev->endpoint[EP2I(ep)].iso_started) {
 601            struct usb_redir_iso_packet_header iso_packet = {
 602                .endpoint = ep,
 603                .length = p->iov.size
 604            };
 605            uint8_t buf[p->iov.size];
 606            /* No id, we look at the ep when receiving a status back */
 607            usb_packet_copy(p, buf, p->iov.size);
 608            usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
 609                                           buf, p->iov.size);
 610            usbredirparser_do_write(dev->parser);
 611        }
 612        status = dev->endpoint[EP2I(ep)].iso_error;
 613        dev->endpoint[EP2I(ep)].iso_error = 0;
 614        DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
 615                 p->iov.size);
 616        usbredir_handle_status(dev, p, status);
 617    }
 618}
 619
 620static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
 621{
 622    struct usb_redir_stop_iso_stream_header stop_iso_stream = {
 623        .endpoint = ep
 624    };
 625    if (dev->endpoint[EP2I(ep)].iso_started) {
 626        usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
 627        DPRINTF("iso stream stopped ep %02X\n", ep);
 628        dev->endpoint[EP2I(ep)].iso_started = 0;
 629    }
 630    dev->endpoint[EP2I(ep)].iso_error = 0;
 631    usbredir_free_bufpq(dev, ep);
 632}
 633
 634/*
 635 * The usb-host may poll the endpoint faster then our guest, resulting in lots
 636 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
 637 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
 638 */
 639static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
 640    struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
 641{
 642    usb_packet_copy(p, bulkp->data + bulkp->offset, count);
 643    bulkp->offset += count;
 644    if (bulkp->offset == bulkp->len) {
 645        /* Store status in the last packet with data from this bulkp */
 646        usbredir_handle_status(dev, p, bulkp->status);
 647        bufp_free(dev, bulkp, ep);
 648    }
 649}
 650
 651static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
 652    USBPacket *p, uint8_t ep)
 653{
 654    struct buf_packet *bulkp;
 655    int count;
 656
 657    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
 658           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
 659        count = bulkp->len - bulkp->offset;
 660        if (count > (p->iov.size - p->actual_length)) {
 661            count = p->iov.size - p->actual_length;
 662        }
 663        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
 664    }
 665}
 666
 667static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
 668    USBPacket *p, uint8_t ep)
 669{
 670    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
 671    uint8_t header[2] = { 0, 0 };
 672    struct buf_packet *bulkp;
 673    int count;
 674
 675    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
 676           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
 677        if (bulkp->len < 2) {
 678            WARNING("malformed ftdi bulk in packet\n");
 679            bufp_free(dev, bulkp, ep);
 680            continue;
 681        }
 682
 683        if ((p->actual_length % maxp) == 0) {
 684            usb_packet_copy(p, bulkp->data, 2);
 685            memcpy(header, bulkp->data, 2);
 686        } else {
 687            if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
 688                break; /* Different header, add to next packet */
 689            }
 690        }
 691
 692        if (bulkp->offset == 0) {
 693            bulkp->offset = 2; /* Skip header */
 694        }
 695        count = bulkp->len - bulkp->offset;
 696        /* Must repeat the header at maxp interval */
 697        if (count > (maxp - (p->actual_length % maxp))) {
 698            count = maxp - (p->actual_length % maxp);
 699        }
 700        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
 701    }
 702}
 703
 704static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
 705    USBPacket *p, uint8_t ep)
 706{
 707    p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 708    dev->buffered_bulk_in_complete(dev, p, ep);
 709    DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
 710            ep, p->status, p->actual_length, p->id);
 711}
 712
 713static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
 714    USBPacket *p, uint8_t ep)
 715{
 716    /* Input bulk endpoint, buffered packet input */
 717    if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
 718        int bpt;
 719        struct usb_redir_start_bulk_receiving_header start = {
 720            .endpoint = ep,
 721            .stream_id = 0,
 722            .no_transfers = 5,
 723        };
 724        /* Round bytes_per_transfer up to a multiple of max_packet_size */
 725        bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
 726        bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
 727        bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
 728        start.bytes_per_transfer = bpt;
 729        /* No id, we look at the ep when receiving a status back */
 730        usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
 731        usbredirparser_do_write(dev->parser);
 732        DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
 733                start.bytes_per_transfer, start.no_transfers, ep);
 734        dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
 735        /* We don't really want to drop bulk packets ever, but
 736           having some upper limit to how much we buffer is good. */
 737        dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
 738        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 739    }
 740
 741    if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
 742        DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
 743        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
 744        dev->endpoint[EP2I(ep)].pending_async_packet = p;
 745        p->status = USB_RET_ASYNC;
 746        return;
 747    }
 748    usbredir_buffered_bulk_in_complete(dev, p, ep);
 749}
 750
 751static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
 752{
 753    struct usb_redir_stop_bulk_receiving_header stop_bulk = {
 754        .endpoint = ep,
 755        .stream_id = 0,
 756    };
 757    if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
 758        usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
 759        DPRINTF("bulk receiving stopped ep %02X\n", ep);
 760        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
 761    }
 762    usbredir_free_bufpq(dev, ep);
 763}
 764
 765static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
 766                                      uint8_t ep)
 767{
 768    struct usb_redir_bulk_packet_header bulk_packet;
 769    size_t size = usb_packet_size(p);
 770    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
 771
 772    if (usbredir_already_in_flight(dev, p->id)) {
 773        p->status = USB_RET_ASYNC;
 774        return;
 775    }
 776
 777    if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
 778        if (size != 0 && (size % maxp) == 0) {
 779            usbredir_handle_buffered_bulk_in_data(dev, p, ep);
 780            return;
 781        }
 782        WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
 783        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
 784        usbredir_stop_bulk_receiving(dev, ep);
 785        dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
 786    }
 787
 788    DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
 789            ep, p->stream, size, p->id);
 790
 791    bulk_packet.endpoint  = ep;
 792    bulk_packet.length    = size;
 793    bulk_packet.stream_id = p->stream;
 794    bulk_packet.length_high = size >> 16;
 795    assert(bulk_packet.length_high == 0 ||
 796           usbredirparser_peer_has_cap(dev->parser,
 797                                       usb_redir_cap_32bits_bulk_length));
 798
 799    if (ep & USB_DIR_IN || size == 0) {
 800        usbredirparser_send_bulk_packet(dev->parser, p->id,
 801                                        &bulk_packet, NULL, 0);
 802    } else {
 803        uint8_t buf[size];
 804        usb_packet_copy(p, buf, size);
 805        usbredir_log_data(dev, "bulk data out:", buf, size);
 806        usbredirparser_send_bulk_packet(dev->parser, p->id,
 807                                        &bulk_packet, buf, size);
 808    }
 809    usbredirparser_do_write(dev->parser);
 810    p->status = USB_RET_ASYNC;
 811}
 812
 813static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
 814                                              USBPacket *p, uint8_t ep)
 815{
 816    /* Input interrupt endpoint, buffered packet input */
 817    struct buf_packet *intp;
 818    int status, len;
 819
 820    if (!dev->endpoint[EP2I(ep)].interrupt_started &&
 821            !dev->endpoint[EP2I(ep)].interrupt_error) {
 822        struct usb_redir_start_interrupt_receiving_header start_int = {
 823            .endpoint = ep,
 824        };
 825        /* No id, we look at the ep when receiving a status back */
 826        usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
 827                                                      &start_int);
 828        usbredirparser_do_write(dev->parser);
 829        DPRINTF("interrupt recv started ep %02X\n", ep);
 830        dev->endpoint[EP2I(ep)].interrupt_started = 1;
 831        /* We don't really want to drop interrupt packets ever, but
 832           having some upper limit to how much we buffer is good. */
 833        dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
 834        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 835    }
 836
 837    intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
 838    if (intp == NULL) {
 839        DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep);
 840        /* Check interrupt_error for stream errors */
 841        status = dev->endpoint[EP2I(ep)].interrupt_error;
 842        dev->endpoint[EP2I(ep)].interrupt_error = 0;
 843        if (status) {
 844            usbredir_handle_status(dev, p, status);
 845        } else {
 846            p->status = USB_RET_NAK;
 847        }
 848        return;
 849    }
 850    DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep,
 851            intp->status, intp->len);
 852
 853    status = intp->status;
 854    len = intp->len;
 855    if (len > p->iov.size) {
 856        ERROR("received int data is larger then packet ep %02X\n", ep);
 857        len = p->iov.size;
 858        status = usb_redir_babble;
 859    }
 860    usb_packet_copy(p, intp->data, len);
 861    bufp_free(dev, intp, ep);
 862    usbredir_handle_status(dev, p, status);
 863}
 864
 865/*
 866 * Handle interrupt out data, the usbredir protocol expects us to do this
 867 * async, so that it can report back a completion status. But guests will
 868 * expect immediate completion for an interrupt endpoint, and handling this
 869 * async causes migration issues. So we report success directly, counting
 870 * on the fact that output interrupt packets normally always succeed.
 871 */
 872static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
 873                                               USBPacket *p, uint8_t ep)
 874{
 875    struct usb_redir_interrupt_packet_header interrupt_packet;
 876    uint8_t buf[p->iov.size];
 877
 878    DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
 879            p->iov.size, p->id);
 880
 881    interrupt_packet.endpoint  = ep;
 882    interrupt_packet.length    = p->iov.size;
 883
 884    usb_packet_copy(p, buf, p->iov.size);
 885    usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
 886    usbredirparser_send_interrupt_packet(dev->parser, p->id,
 887                                    &interrupt_packet, buf, p->iov.size);
 888    usbredirparser_do_write(dev->parser);
 889}
 890
 891static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
 892    uint8_t ep)
 893{
 894    struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
 895        .endpoint = ep
 896    };
 897    if (dev->endpoint[EP2I(ep)].interrupt_started) {
 898        usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
 899                                                     &stop_interrupt_recv);
 900        DPRINTF("interrupt recv stopped ep %02X\n", ep);
 901        dev->endpoint[EP2I(ep)].interrupt_started = 0;
 902    }
 903    dev->endpoint[EP2I(ep)].interrupt_error = 0;
 904    usbredir_free_bufpq(dev, ep);
 905}
 906
 907static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
 908{
 909    USBRedirDevice *dev = USB_REDIRECT(udev);
 910    uint8_t ep;
 911
 912    ep = p->ep->nr;
 913    if (p->pid == USB_TOKEN_IN) {
 914        ep |= USB_DIR_IN;
 915    }
 916
 917    switch (dev->endpoint[EP2I(ep)].type) {
 918    case USB_ENDPOINT_XFER_CONTROL:
 919        ERROR("handle_data called for control transfer on ep %02X\n", ep);
 920        p->status = USB_RET_NAK;
 921        break;
 922    case USB_ENDPOINT_XFER_BULK:
 923        if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
 924                p->ep->pipeline) {
 925            p->status = USB_RET_ADD_TO_QUEUE;
 926            break;
 927        }
 928        usbredir_handle_bulk_data(dev, p, ep);
 929        break;
 930    case USB_ENDPOINT_XFER_ISOC:
 931        usbredir_handle_iso_data(dev, p, ep);
 932        break;
 933    case USB_ENDPOINT_XFER_INT:
 934        if (ep & USB_DIR_IN) {
 935            usbredir_handle_interrupt_in_data(dev, p, ep);
 936        } else {
 937            usbredir_handle_interrupt_out_data(dev, p, ep);
 938        }
 939        break;
 940    default:
 941        ERROR("handle_data ep %02X has unknown type %d\n", ep,
 942              dev->endpoint[EP2I(ep)].type);
 943        p->status = USB_RET_NAK;
 944    }
 945}
 946
 947static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
 948{
 949    if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
 950        usb_ep_combine_input_packets(ep);
 951    }
 952}
 953
 954static void usbredir_stop_ep(USBRedirDevice *dev, int i)
 955{
 956    uint8_t ep = I2EP(i);
 957
 958    switch (dev->endpoint[i].type) {
 959    case USB_ENDPOINT_XFER_BULK:
 960        if (ep & USB_DIR_IN) {
 961            usbredir_stop_bulk_receiving(dev, ep);
 962        }
 963        break;
 964    case USB_ENDPOINT_XFER_ISOC:
 965        usbredir_stop_iso_stream(dev, ep);
 966        break;
 967    case USB_ENDPOINT_XFER_INT:
 968        if (ep & USB_DIR_IN) {
 969            usbredir_stop_interrupt_receiving(dev, ep);
 970        }
 971        break;
 972    }
 973    usbredir_free_bufpq(dev, ep);
 974}
 975
 976static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
 977{
 978    USBRedirDevice *dev = USB_REDIRECT(udev);
 979
 980    usbredir_stop_ep(dev, USBEP2I(uep));
 981    usbredirparser_do_write(dev->parser);
 982}
 983
 984static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
 985                                int config)
 986{
 987    struct usb_redir_set_configuration_header set_config;
 988    int i;
 989
 990    DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
 991
 992    for (i = 0; i < MAX_ENDPOINTS; i++) {
 993        usbredir_stop_ep(dev, i);
 994    }
 995
 996    set_config.configuration = config;
 997    usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
 998    usbredirparser_do_write(dev->parser);
 999    p->status = USB_RET_ASYNC;
1000}
1001
1002static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1003{
1004    DPRINTF("get config id %"PRIu64"\n", p->id);
1005
1006    usbredirparser_send_get_configuration(dev->parser, p->id);
1007    usbredirparser_do_write(dev->parser);
1008    p->status = USB_RET_ASYNC;
1009}
1010
1011static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1012                                   int interface, int alt)
1013{
1014    struct usb_redir_set_alt_setting_header set_alt;
1015    int i;
1016
1017    DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1018
1019    for (i = 0; i < MAX_ENDPOINTS; i++) {
1020        if (dev->endpoint[i].interface == interface) {
1021            usbredir_stop_ep(dev, i);
1022        }
1023    }
1024
1025    set_alt.interface = interface;
1026    set_alt.alt = alt;
1027    usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1028    usbredirparser_do_write(dev->parser);
1029    p->status = USB_RET_ASYNC;
1030}
1031
1032static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1033                                   int interface)
1034{
1035    struct usb_redir_get_alt_setting_header get_alt;
1036
1037    DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1038
1039    get_alt.interface = interface;
1040    usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1041    usbredirparser_do_write(dev->parser);
1042    p->status = USB_RET_ASYNC;
1043}
1044
1045static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1046        int request, int value, int index, int length, uint8_t *data)
1047{
1048    USBRedirDevice *dev = USB_REDIRECT(udev);
1049    struct usb_redir_control_packet_header control_packet;
1050
1051    if (usbredir_already_in_flight(dev, p->id)) {
1052        p->status = USB_RET_ASYNC;
1053        return;
1054    }
1055
1056    /* Special cases for certain standard device requests */
1057    switch (request) {
1058    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1059        DPRINTF("set address %d\n", value);
1060        dev->dev.addr = value;
1061        return;
1062    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1063        usbredir_set_config(dev, p, value & 0xff);
1064        return;
1065    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1066        usbredir_get_config(dev, p);
1067        return;
1068    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1069        usbredir_set_interface(dev, p, index, value);
1070        return;
1071    case InterfaceRequest | USB_REQ_GET_INTERFACE:
1072        usbredir_get_interface(dev, p, index);
1073        return;
1074    }
1075
1076    /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1077    DPRINTF(
1078        "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1079        request >> 8, request & 0xff, value, index, length, p->id);
1080
1081    control_packet.request     = request & 0xFF;
1082    control_packet.requesttype = request >> 8;
1083    control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
1084    control_packet.value       = value;
1085    control_packet.index       = index;
1086    control_packet.length      = length;
1087
1088    if (control_packet.requesttype & USB_DIR_IN) {
1089        usbredirparser_send_control_packet(dev->parser, p->id,
1090                                           &control_packet, NULL, 0);
1091    } else {
1092        usbredir_log_data(dev, "ctrl data out:", data, length);
1093        usbredirparser_send_control_packet(dev->parser, p->id,
1094                                           &control_packet, data, length);
1095    }
1096    usbredirparser_do_write(dev->parser);
1097    p->status = USB_RET_ASYNC;
1098}
1099
1100static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1101                                  int nr_eps, int streams)
1102{
1103    USBRedirDevice *dev = USB_REDIRECT(udev);
1104#if USBREDIR_VERSION >= 0x000700
1105    struct usb_redir_alloc_bulk_streams_header alloc_streams;
1106    int i;
1107
1108    if (!usbredirparser_peer_has_cap(dev->parser,
1109                                     usb_redir_cap_bulk_streams)) {
1110        ERROR("peer does not support streams\n");
1111        goto reject;
1112    }
1113
1114    if (streams == 0) {
1115        ERROR("request to allocate 0 streams\n");
1116        return -1;
1117    }
1118
1119    alloc_streams.no_streams = streams;
1120    alloc_streams.endpoints = 0;
1121    for (i = 0; i < nr_eps; i++) {
1122        alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1123    }
1124    usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1125    usbredirparser_do_write(dev->parser);
1126
1127    return 0;
1128#else
1129    ERROR("usbredir_alloc_streams not implemented\n");
1130    goto reject;
1131#endif
1132reject:
1133    ERROR("streams are not available, disconnecting\n");
1134    qemu_bh_schedule(dev->device_reject_bh);
1135    return -1;
1136}
1137
1138static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1139                                  int nr_eps)
1140{
1141#if USBREDIR_VERSION >= 0x000700
1142    USBRedirDevice *dev = USB_REDIRECT(udev);
1143    struct usb_redir_free_bulk_streams_header free_streams;
1144    int i;
1145
1146    if (!usbredirparser_peer_has_cap(dev->parser,
1147                                     usb_redir_cap_bulk_streams)) {
1148        return;
1149    }
1150
1151    free_streams.endpoints = 0;
1152    for (i = 0; i < nr_eps; i++) {
1153        free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1154    }
1155    usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1156    usbredirparser_do_write(dev->parser);
1157#endif
1158}
1159
1160/*
1161 * Close events can be triggered by usbredirparser_do_write which gets called
1162 * from within the USBDevice data / control packet callbacks and doing a
1163 * usb_detach from within these callbacks is not a good idea.
1164 *
1165 * So we use a bh handler to take care of close events.
1166 */
1167static void usbredir_chardev_close_bh(void *opaque)
1168{
1169    USBRedirDevice *dev = opaque;
1170
1171    qemu_bh_cancel(dev->device_reject_bh);
1172    usbredir_device_disconnect(dev);
1173
1174    if (dev->parser) {
1175        DPRINTF("destroying usbredirparser\n");
1176        usbredirparser_destroy(dev->parser);
1177        dev->parser = NULL;
1178    }
1179    if (dev->watch) {
1180        g_source_remove(dev->watch);
1181        dev->watch = 0;
1182    }
1183}
1184
1185static void usbredir_create_parser(USBRedirDevice *dev)
1186{
1187    uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1188    int flags = 0;
1189
1190    DPRINTF("creating usbredirparser\n");
1191
1192    dev->parser = qemu_oom_check(usbredirparser_create());
1193    dev->parser->priv = dev;
1194    dev->parser->log_func = usbredir_log;
1195    dev->parser->read_func = usbredir_read;
1196    dev->parser->write_func = usbredir_write;
1197    dev->parser->hello_func = usbredir_hello;
1198    dev->parser->device_connect_func = usbredir_device_connect;
1199    dev->parser->device_disconnect_func = usbredir_device_disconnect;
1200    dev->parser->interface_info_func = usbredir_interface_info;
1201    dev->parser->ep_info_func = usbredir_ep_info;
1202    dev->parser->configuration_status_func = usbredir_configuration_status;
1203    dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1204    dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1205    dev->parser->interrupt_receiving_status_func =
1206        usbredir_interrupt_receiving_status;
1207    dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1208    dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1209    dev->parser->control_packet_func = usbredir_control_packet;
1210    dev->parser->bulk_packet_func = usbredir_bulk_packet;
1211    dev->parser->iso_packet_func = usbredir_iso_packet;
1212    dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1213    dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1214    dev->read_buf = NULL;
1215    dev->read_buf_size = 0;
1216
1217    usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1218    usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1219    usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1220    usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1221    usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1222    usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1223#if USBREDIR_VERSION >= 0x000700
1224    if (dev->enable_streams) {
1225        usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1226    }
1227#endif
1228
1229    if (runstate_check(RUN_STATE_INMIGRATE)) {
1230        flags |= usbredirparser_fl_no_hello;
1231    }
1232    usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1233                        flags);
1234    usbredirparser_do_write(dev->parser);
1235}
1236
1237static void usbredir_reject_device(USBRedirDevice *dev)
1238{
1239    usbredir_device_disconnect(dev);
1240    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1241        usbredirparser_send_filter_reject(dev->parser);
1242        usbredirparser_do_write(dev->parser);
1243    }
1244}
1245
1246/*
1247 * We may need to reject the device when the hcd calls alloc_streams, doing
1248 * an usb_detach from within a hcd call is not a good idea, hence this bh.
1249 */
1250static void usbredir_device_reject_bh(void *opaque)
1251{
1252    USBRedirDevice *dev = opaque;
1253
1254    usbredir_reject_device(dev);
1255}
1256
1257static void usbredir_do_attach(void *opaque)
1258{
1259    USBRedirDevice *dev = opaque;
1260    Error *local_err = NULL;
1261
1262    /* In order to work properly with XHCI controllers we need these caps */
1263    if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1264        usbredirparser_peer_has_cap(dev->parser,
1265                                    usb_redir_cap_ep_info_max_packet_size) &&
1266        usbredirparser_peer_has_cap(dev->parser,
1267                                    usb_redir_cap_32bits_bulk_length) &&
1268        usbredirparser_peer_has_cap(dev->parser,
1269                                    usb_redir_cap_64bits_ids))) {
1270        ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1271        usbredir_reject_device(dev);
1272        return;
1273    }
1274
1275    usb_device_attach(&dev->dev, &local_err);
1276    if (local_err) {
1277        error_report_err(local_err);
1278        WARNING("rejecting device due to speed mismatch\n");
1279        usbredir_reject_device(dev);
1280    }
1281}
1282
1283/*
1284 * chardev callbacks
1285 */
1286
1287static int usbredir_chardev_can_read(void *opaque)
1288{
1289    USBRedirDevice *dev = opaque;
1290
1291    if (!dev->parser) {
1292        WARNING("chardev_can_read called on non open chardev!\n");
1293        return 0;
1294    }
1295
1296    /* Don't read new data from the chardev until our state is fully synced */
1297    if (!runstate_check(RUN_STATE_RUNNING)) {
1298        return 0;
1299    }
1300
1301    /* usbredir_parser_do_read will consume *all* data we give it */
1302    return 1 * MiB;
1303}
1304
1305static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1306{
1307    USBRedirDevice *dev = opaque;
1308
1309    /* No recursion allowed! */
1310    assert(dev->read_buf == NULL);
1311
1312    dev->read_buf = buf;
1313    dev->read_buf_size = size;
1314
1315    usbredirparser_do_read(dev->parser);
1316    /* Send any acks, etc. which may be queued now */
1317    usbredirparser_do_write(dev->parser);
1318}
1319
1320static void usbredir_chardev_event(void *opaque, int event)
1321{
1322    USBRedirDevice *dev = opaque;
1323
1324    switch (event) {
1325    case CHR_EVENT_OPENED:
1326        DPRINTF("chardev open\n");
1327        /* Make sure any pending closes are handled (no-op if none pending) */
1328        usbredir_chardev_close_bh(dev);
1329        qemu_bh_cancel(dev->chardev_close_bh);
1330        usbredir_create_parser(dev);
1331        break;
1332    case CHR_EVENT_CLOSED:
1333        DPRINTF("chardev close\n");
1334        qemu_bh_schedule(dev->chardev_close_bh);
1335        break;
1336    }
1337}
1338
1339/*
1340 * init + destroy
1341 */
1342
1343static void usbredir_vm_state_change(void *priv, int running, RunState state)
1344{
1345    USBRedirDevice *dev = priv;
1346
1347    if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
1348        usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1349    }
1350}
1351
1352static void usbredir_init_endpoints(USBRedirDevice *dev)
1353{
1354    int i;
1355
1356    usb_ep_init(&dev->dev);
1357    memset(dev->endpoint, 0, sizeof(dev->endpoint));
1358    for (i = 0; i < MAX_ENDPOINTS; i++) {
1359        dev->endpoint[i].dev = dev;
1360        QTAILQ_INIT(&dev->endpoint[i].bufpq);
1361    }
1362}
1363
1364static void usbredir_realize(USBDevice *udev, Error **errp)
1365{
1366    USBRedirDevice *dev = USB_REDIRECT(udev);
1367    int i;
1368
1369    if (!qemu_chr_fe_backend_connected(&dev->cs)) {
1370        error_setg(errp, QERR_MISSING_PARAMETER, "chardev");
1371        return;
1372    }
1373
1374    if (dev->filter_str) {
1375        i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1376                                           &dev->filter_rules,
1377                                           &dev->filter_rules_count);
1378        if (i) {
1379            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1380                       "a usb device filter string");
1381            return;
1382        }
1383    }
1384
1385    dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
1386    dev->device_reject_bh = qemu_bh_new(usbredir_device_reject_bh, dev);
1387    dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1388
1389    packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1390    packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1391    usbredir_init_endpoints(dev);
1392
1393    /* We'll do the attach once we receive the speed from the usb-host */
1394    udev->auto_attach = 0;
1395
1396    /* Will be cleared during setup when we find conflicts */
1397    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1398
1399    /* Let the backend know we are ready */
1400    qemu_chr_fe_set_handlers(&dev->cs, usbredir_chardev_can_read,
1401                             usbredir_chardev_read, usbredir_chardev_event,
1402                             NULL, dev, NULL, true);
1403
1404    dev->vmstate =
1405        qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1406}
1407
1408static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1409{
1410    int i;
1411
1412    packet_id_queue_empty(&dev->cancelled);
1413    packet_id_queue_empty(&dev->already_in_flight);
1414    for (i = 0; i < MAX_ENDPOINTS; i++) {
1415        usbredir_free_bufpq(dev, I2EP(i));
1416    }
1417}
1418
1419static void usbredir_unrealize(USBDevice *udev, Error **errp)
1420{
1421    USBRedirDevice *dev = USB_REDIRECT(udev);
1422
1423    qemu_chr_fe_deinit(&dev->cs, true);
1424
1425    /* Note must be done after qemu_chr_close, as that causes a close event */
1426    qemu_bh_delete(dev->chardev_close_bh);
1427    qemu_bh_delete(dev->device_reject_bh);
1428
1429    timer_del(dev->attach_timer);
1430    timer_free(dev->attach_timer);
1431
1432    usbredir_cleanup_device_queues(dev);
1433
1434    if (dev->parser) {
1435        usbredirparser_destroy(dev->parser);
1436    }
1437    if (dev->watch) {
1438        g_source_remove(dev->watch);
1439    }
1440
1441    free(dev->filter_rules);
1442    qemu_del_vm_change_state_handler(dev->vmstate);
1443}
1444
1445static int usbredir_check_filter(USBRedirDevice *dev)
1446{
1447    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1448        ERROR("No interface info for device\n");
1449        goto error;
1450    }
1451
1452    if (dev->filter_rules) {
1453        if (!usbredirparser_peer_has_cap(dev->parser,
1454                                    usb_redir_cap_connect_device_version)) {
1455            ERROR("Device filter specified and peer does not have the "
1456                  "connect_device_version capability\n");
1457            goto error;
1458        }
1459
1460        if (usbredirfilter_check(
1461                dev->filter_rules,
1462                dev->filter_rules_count,
1463                dev->device_info.device_class,
1464                dev->device_info.device_subclass,
1465                dev->device_info.device_protocol,
1466                dev->interface_info.interface_class,
1467                dev->interface_info.interface_subclass,
1468                dev->interface_info.interface_protocol,
1469                dev->interface_info.interface_count,
1470                dev->device_info.vendor_id,
1471                dev->device_info.product_id,
1472                dev->device_info.device_version_bcd,
1473                0) != 0) {
1474            goto error;
1475        }
1476    }
1477
1478    return 0;
1479
1480error:
1481    usbredir_reject_device(dev);
1482    return -1;
1483}
1484
1485static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1486{
1487    int i, j, quirks;
1488
1489    if (!usbredirparser_peer_has_cap(dev->parser,
1490                                     usb_redir_cap_bulk_receiving)) {
1491        return;
1492    }
1493
1494    for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1495        dev->endpoint[i].bulk_receiving_enabled = 0;
1496    }
1497    for (i = 0; i < dev->interface_info.interface_count; i++) {
1498        quirks = usb_get_quirks(dev->device_info.vendor_id,
1499                                dev->device_info.product_id,
1500                                dev->interface_info.interface_class[i],
1501                                dev->interface_info.interface_subclass[i],
1502                                dev->interface_info.interface_protocol[i]);
1503        if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1504            continue;
1505        }
1506        if (quirks & USB_QUIRK_IS_FTDI) {
1507            dev->buffered_bulk_in_complete =
1508                usbredir_buffered_bulk_in_complete_ftdi;
1509        } else {
1510            dev->buffered_bulk_in_complete =
1511                usbredir_buffered_bulk_in_complete_raw;
1512        }
1513
1514        for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1515            if (dev->endpoint[j].interface ==
1516                                    dev->interface_info.interface[i] &&
1517                    dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1518                    dev->endpoint[j].max_packet_size != 0) {
1519                dev->endpoint[j].bulk_receiving_enabled = 1;
1520                /*
1521                 * With buffering pipelining is not necessary. Also packet
1522                 * combining and bulk in buffering don't play nice together!
1523                 */
1524                I2USBEP(dev, j)->pipeline = false;
1525                break; /* Only buffer for the first ep of each intf */
1526            }
1527        }
1528    }
1529}
1530
1531/*
1532 * usbredirparser packet complete callbacks
1533 */
1534
1535static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1536    int status)
1537{
1538    switch (status) {
1539    case usb_redir_success:
1540        p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1541        break;
1542    case usb_redir_stall:
1543        p->status = USB_RET_STALL;
1544        break;
1545    case usb_redir_cancelled:
1546        /*
1547         * When the usbredir-host unredirects a device, it will report a status
1548         * of cancelled for all pending packets, followed by a disconnect msg.
1549         */
1550        p->status = USB_RET_IOERROR;
1551        break;
1552    case usb_redir_inval:
1553        WARNING("got invalid param error from usb-host?\n");
1554        p->status = USB_RET_IOERROR;
1555        break;
1556    case usb_redir_babble:
1557        p->status = USB_RET_BABBLE;
1558        break;
1559    case usb_redir_ioerror:
1560    case usb_redir_timeout:
1561    default:
1562        p->status = USB_RET_IOERROR;
1563    }
1564}
1565
1566static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1567{
1568    USBRedirDevice *dev = priv;
1569
1570    /* Try to send the filter info now that we've the usb-host's caps */
1571    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1572            dev->filter_rules) {
1573        usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1574                                          dev->filter_rules_count);
1575        usbredirparser_do_write(dev->parser);
1576    }
1577}
1578
1579static void usbredir_device_connect(void *priv,
1580    struct usb_redir_device_connect_header *device_connect)
1581{
1582    USBRedirDevice *dev = priv;
1583    const char *speed;
1584
1585    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1586        ERROR("Received device connect while already connected\n");
1587        return;
1588    }
1589
1590    switch (device_connect->speed) {
1591    case usb_redir_speed_low:
1592        speed = "low speed";
1593        dev->dev.speed = USB_SPEED_LOW;
1594        dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1595        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1596        break;
1597    case usb_redir_speed_full:
1598        speed = "full speed";
1599        dev->dev.speed = USB_SPEED_FULL;
1600        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1601        break;
1602    case usb_redir_speed_high:
1603        speed = "high speed";
1604        dev->dev.speed = USB_SPEED_HIGH;
1605        break;
1606    case usb_redir_speed_super:
1607        speed = "super speed";
1608        dev->dev.speed = USB_SPEED_SUPER;
1609        break;
1610    default:
1611        speed = "unknown speed";
1612        dev->dev.speed = USB_SPEED_FULL;
1613    }
1614
1615    if (usbredirparser_peer_has_cap(dev->parser,
1616                                    usb_redir_cap_connect_device_version)) {
1617        INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1618             speed, device_connect->vendor_id, device_connect->product_id,
1619             ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1620             ((device_connect->device_version_bcd & 0x0f00) >>  8),
1621             ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1622             ((device_connect->device_version_bcd & 0x000f) >>  0),
1623             device_connect->device_class);
1624    } else {
1625        INFO("attaching %s device %04x:%04x class %02x\n", speed,
1626             device_connect->vendor_id, device_connect->product_id,
1627             device_connect->device_class);
1628    }
1629
1630    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1631    dev->device_info = *device_connect;
1632
1633    if (usbredir_check_filter(dev)) {
1634        WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1635                device_connect->vendor_id, device_connect->product_id);
1636        return;
1637    }
1638
1639    usbredir_check_bulk_receiving(dev);
1640    timer_mod(dev->attach_timer, dev->next_attach_time);
1641}
1642
1643static void usbredir_device_disconnect(void *priv)
1644{
1645    USBRedirDevice *dev = priv;
1646
1647    /* Stop any pending attaches */
1648    timer_del(dev->attach_timer);
1649
1650    if (dev->dev.attached) {
1651        DPRINTF("detaching device\n");
1652        usb_device_detach(&dev->dev);
1653        /*
1654         * Delay next usb device attach to give the guest a chance to see
1655         * see the detach / attach in case of quick close / open succession
1656         */
1657        dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1658    }
1659
1660    /* Reset state so that the next dev connected starts with a clean slate */
1661    usbredir_cleanup_device_queues(dev);
1662    usbredir_init_endpoints(dev);
1663    dev->interface_info.interface_count = NO_INTERFACE_INFO;
1664    dev->dev.addr = 0;
1665    dev->dev.speed = 0;
1666    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1667}
1668
1669static void usbredir_interface_info(void *priv,
1670    struct usb_redir_interface_info_header *interface_info)
1671{
1672    USBRedirDevice *dev = priv;
1673
1674    dev->interface_info = *interface_info;
1675
1676    /*
1677     * If we receive interface info after the device has already been
1678     * connected (ie on a set_config), re-check interface dependent things.
1679     */
1680    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1681        usbredir_check_bulk_receiving(dev);
1682        if (usbredir_check_filter(dev)) {
1683            ERROR("Device no longer matches filter after interface info "
1684                  "change, disconnecting!\n");
1685        }
1686    }
1687}
1688
1689static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1690{
1691    dev->compatible_speedmask &= ~(1 << speed);
1692    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1693}
1694
1695static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1696{
1697    if (uep->type != USB_ENDPOINT_XFER_BULK) {
1698        return;
1699    }
1700    if (uep->pid == USB_TOKEN_OUT) {
1701        uep->pipeline = true;
1702    }
1703    if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1704        usbredirparser_peer_has_cap(dev->parser,
1705                                    usb_redir_cap_32bits_bulk_length)) {
1706        uep->pipeline = true;
1707    }
1708}
1709
1710static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1711{
1712    struct USBEndpoint *usb_ep;
1713    int i;
1714
1715    for (i = 0; i < MAX_ENDPOINTS; i++) {
1716        usb_ep = I2USBEP(dev, i);
1717        usb_ep->type = dev->endpoint[i].type;
1718        usb_ep->ifnum = dev->endpoint[i].interface;
1719        usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1720        usb_ep->max_streams = dev->endpoint[i].max_streams;
1721        usbredir_set_pipeline(dev, usb_ep);
1722    }
1723}
1724
1725static void usbredir_ep_info(void *priv,
1726    struct usb_redir_ep_info_header *ep_info)
1727{
1728    USBRedirDevice *dev = priv;
1729    int i;
1730
1731    for (i = 0; i < MAX_ENDPOINTS; i++) {
1732        dev->endpoint[i].type = ep_info->type[i];
1733        dev->endpoint[i].interval = ep_info->interval[i];
1734        dev->endpoint[i].interface = ep_info->interface[i];
1735        if (usbredirparser_peer_has_cap(dev->parser,
1736                                     usb_redir_cap_ep_info_max_packet_size)) {
1737            dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1738        }
1739#if USBREDIR_VERSION >= 0x000700
1740        if (usbredirparser_peer_has_cap(dev->parser,
1741                                        usb_redir_cap_bulk_streams)) {
1742            dev->endpoint[i].max_streams = ep_info->max_streams[i];
1743        }
1744#endif
1745        switch (dev->endpoint[i].type) {
1746        case usb_redir_type_invalid:
1747            break;
1748        case usb_redir_type_iso:
1749            usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1750            usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1751            /* Fall through */
1752        case usb_redir_type_interrupt:
1753            if (!usbredirparser_peer_has_cap(dev->parser,
1754                                     usb_redir_cap_ep_info_max_packet_size) ||
1755                    ep_info->max_packet_size[i] > 64) {
1756                usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1757            }
1758            if (!usbredirparser_peer_has_cap(dev->parser,
1759                                     usb_redir_cap_ep_info_max_packet_size) ||
1760                    ep_info->max_packet_size[i] > 1024) {
1761                usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1762            }
1763            if (dev->endpoint[i].interval == 0) {
1764                ERROR("Received 0 interval for isoc or irq endpoint\n");
1765                usbredir_reject_device(dev);
1766                return;
1767            }
1768            /* Fall through */
1769        case usb_redir_type_control:
1770        case usb_redir_type_bulk:
1771            DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1772                    dev->endpoint[i].type, dev->endpoint[i].interface);
1773            break;
1774        default:
1775            ERROR("Received invalid endpoint type\n");
1776            usbredir_reject_device(dev);
1777            return;
1778        }
1779    }
1780    /* The new ep info may have caused a speed incompatibility, recheck */
1781    if (dev->dev.attached &&
1782            !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1783        ERROR("Device no longer matches speed after endpoint info change, "
1784              "disconnecting!\n");
1785        usbredir_reject_device(dev);
1786        return;
1787    }
1788    usbredir_setup_usb_eps(dev);
1789    usbredir_check_bulk_receiving(dev);
1790}
1791
1792static void usbredir_configuration_status(void *priv, uint64_t id,
1793    struct usb_redir_configuration_status_header *config_status)
1794{
1795    USBRedirDevice *dev = priv;
1796    USBPacket *p;
1797
1798    DPRINTF("set config status %d config %d id %"PRIu64"\n",
1799            config_status->status, config_status->configuration, id);
1800
1801    p = usbredir_find_packet_by_id(dev, 0, id);
1802    if (p) {
1803        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1804            dev->dev.data_buf[0] = config_status->configuration;
1805            p->actual_length = 1;
1806        }
1807        usbredir_handle_status(dev, p, config_status->status);
1808        usb_generic_async_ctrl_complete(&dev->dev, p);
1809    }
1810}
1811
1812static void usbredir_alt_setting_status(void *priv, uint64_t id,
1813    struct usb_redir_alt_setting_status_header *alt_setting_status)
1814{
1815    USBRedirDevice *dev = priv;
1816    USBPacket *p;
1817
1818    DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1819            alt_setting_status->status, alt_setting_status->interface,
1820            alt_setting_status->alt, id);
1821
1822    p = usbredir_find_packet_by_id(dev, 0, id);
1823    if (p) {
1824        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1825            dev->dev.data_buf[0] = alt_setting_status->alt;
1826            p->actual_length = 1;
1827        }
1828        usbredir_handle_status(dev, p, alt_setting_status->status);
1829        usb_generic_async_ctrl_complete(&dev->dev, p);
1830    }
1831}
1832
1833static void usbredir_iso_stream_status(void *priv, uint64_t id,
1834    struct usb_redir_iso_stream_status_header *iso_stream_status)
1835{
1836    USBRedirDevice *dev = priv;
1837    uint8_t ep = iso_stream_status->endpoint;
1838
1839    DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1840            ep, id);
1841
1842    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1843        return;
1844    }
1845
1846    dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1847    if (iso_stream_status->status == usb_redir_stall) {
1848        DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1849        dev->endpoint[EP2I(ep)].iso_started = 0;
1850    }
1851}
1852
1853static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1854    struct usb_redir_interrupt_receiving_status_header
1855    *interrupt_receiving_status)
1856{
1857    USBRedirDevice *dev = priv;
1858    uint8_t ep = interrupt_receiving_status->endpoint;
1859
1860    DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1861            interrupt_receiving_status->status, ep, id);
1862
1863    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1864        return;
1865    }
1866
1867    dev->endpoint[EP2I(ep)].interrupt_error =
1868        interrupt_receiving_status->status;
1869    if (interrupt_receiving_status->status == usb_redir_stall) {
1870        DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1871        dev->endpoint[EP2I(ep)].interrupt_started = 0;
1872    }
1873}
1874
1875static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1876    struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1877{
1878#if USBREDIR_VERSION >= 0x000700
1879    USBRedirDevice *dev = priv;
1880
1881    if (bulk_streams_status->status == usb_redir_success) {
1882        DPRINTF("bulk streams status %d eps %08x\n",
1883                bulk_streams_status->status, bulk_streams_status->endpoints);
1884    } else {
1885        ERROR("bulk streams %s failed status %d eps %08x\n",
1886              (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1887              bulk_streams_status->status, bulk_streams_status->endpoints);
1888        ERROR("usb-redir-host does not provide streams, disconnecting\n");
1889        usbredir_reject_device(dev);
1890    }
1891#endif
1892}
1893
1894static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1895    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1896{
1897    USBRedirDevice *dev = priv;
1898    uint8_t ep = bulk_receiving_status->endpoint;
1899
1900    DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1901            bulk_receiving_status->status, ep, id);
1902
1903    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1904        return;
1905    }
1906
1907    if (bulk_receiving_status->status == usb_redir_stall) {
1908        DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1909        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1910    }
1911}
1912
1913static void usbredir_control_packet(void *priv, uint64_t id,
1914    struct usb_redir_control_packet_header *control_packet,
1915    uint8_t *data, int data_len)
1916{
1917    USBRedirDevice *dev = priv;
1918    USBPacket *p;
1919    int len = control_packet->length;
1920
1921    DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1922            len, id);
1923
1924    /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1925     * to work redirected to a not superspeed capable hcd */
1926    if (dev->dev.speed == USB_SPEED_SUPER &&
1927            !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1928            control_packet->requesttype == 0x80 &&
1929            control_packet->request == 6 &&
1930            control_packet->value == 0x100 && control_packet->index == 0 &&
1931            data_len >= 18 && data[7] == 9) {
1932        data[7] = 64;
1933    }
1934
1935    p = usbredir_find_packet_by_id(dev, 0, id);
1936    if (p) {
1937        usbredir_handle_status(dev, p, control_packet->status);
1938        if (data_len > 0) {
1939            usbredir_log_data(dev, "ctrl data in:", data, data_len);
1940            if (data_len > sizeof(dev->dev.data_buf)) {
1941                ERROR("ctrl buffer too small (%d > %zu)\n",
1942                      data_len, sizeof(dev->dev.data_buf));
1943                p->status = USB_RET_STALL;
1944                data_len = len = sizeof(dev->dev.data_buf);
1945            }
1946            memcpy(dev->dev.data_buf, data, data_len);
1947        }
1948        p->actual_length = len;
1949        usb_generic_async_ctrl_complete(&dev->dev, p);
1950    }
1951    free(data);
1952}
1953
1954static void usbredir_bulk_packet(void *priv, uint64_t id,
1955    struct usb_redir_bulk_packet_header *bulk_packet,
1956    uint8_t *data, int data_len)
1957{
1958    USBRedirDevice *dev = priv;
1959    uint8_t ep = bulk_packet->endpoint;
1960    int len = (bulk_packet->length_high << 16) | bulk_packet->length;
1961    USBPacket *p;
1962
1963    DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
1964            bulk_packet->status, ep, bulk_packet->stream_id, len, id);
1965
1966    p = usbredir_find_packet_by_id(dev, ep, id);
1967    if (p) {
1968        size_t size = usb_packet_size(p);
1969        usbredir_handle_status(dev, p, bulk_packet->status);
1970        if (data_len > 0) {
1971            usbredir_log_data(dev, "bulk data in:", data, data_len);
1972            if (data_len > size) {
1973                ERROR("bulk got more data then requested (%d > %zd)\n",
1974                      data_len, p->iov.size);
1975                p->status = USB_RET_BABBLE;
1976                data_len = len = size;
1977            }
1978            usb_packet_copy(p, data, data_len);
1979        }
1980        p->actual_length = len;
1981        if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
1982            usb_combined_input_packet_complete(&dev->dev, p);
1983        } else {
1984            usb_packet_complete(&dev->dev, p);
1985        }
1986    }
1987    free(data);
1988}
1989
1990static void usbredir_iso_packet(void *priv, uint64_t id,
1991    struct usb_redir_iso_packet_header *iso_packet,
1992    uint8_t *data, int data_len)
1993{
1994    USBRedirDevice *dev = priv;
1995    uint8_t ep = iso_packet->endpoint;
1996
1997    DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
1998             iso_packet->status, ep, data_len, id);
1999
2000    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
2001        ERROR("received iso packet for non iso endpoint %02X\n", ep);
2002        free(data);
2003        return;
2004    }
2005
2006    if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2007        DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2008        free(data);
2009        return;
2010    }
2011
2012    /* bufp_alloc also adds the packet to the ep queue */
2013    bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2014}
2015
2016static void usbredir_interrupt_packet(void *priv, uint64_t id,
2017    struct usb_redir_interrupt_packet_header *interrupt_packet,
2018    uint8_t *data, int data_len)
2019{
2020    USBRedirDevice *dev = priv;
2021    uint8_t ep = interrupt_packet->endpoint;
2022
2023    DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2024            interrupt_packet->status, ep, data_len, id);
2025
2026    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2027        ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2028        free(data);
2029        return;
2030    }
2031
2032    if (ep & USB_DIR_IN) {
2033        bool q_was_empty;
2034
2035        if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2036            DPRINTF("received int packet while not started ep %02X\n", ep);
2037            free(data);
2038            return;
2039        }
2040
2041        q_was_empty = QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq);
2042
2043        /* bufp_alloc also adds the packet to the ep queue */
2044        bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2045
2046        if (q_was_empty) {
2047            usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2048        }
2049    } else {
2050        /*
2051         * We report output interrupt packets as completed directly upon
2052         * submission, so all we can do here if one failed is warn.
2053         */
2054        if (interrupt_packet->status) {
2055            WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2056                    interrupt_packet->status, ep, id);
2057        }
2058    }
2059}
2060
2061static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2062    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2063    uint8_t *data, int data_len)
2064{
2065    USBRedirDevice *dev = priv;
2066    uint8_t status, ep = buffered_bulk_packet->endpoint;
2067    void *free_on_destroy;
2068    int i, len;
2069
2070    DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2071            buffered_bulk_packet->status, ep, data_len, id);
2072
2073    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2074        ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2075        free(data);
2076        return;
2077    }
2078
2079    if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2080        DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2081        free(data);
2082        return;
2083    }
2084
2085    /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2086    len = dev->endpoint[EP2I(ep)].max_packet_size;
2087    status = usb_redir_success;
2088    free_on_destroy = NULL;
2089    for (i = 0; i < data_len; i += len) {
2090        int r;
2091        if (len >= (data_len - i)) {
2092            len = data_len - i;
2093            status = buffered_bulk_packet->status;
2094            free_on_destroy = data;
2095        }
2096        /* bufp_alloc also adds the packet to the ep queue */
2097        r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2098        if (r) {
2099            break;
2100        }
2101    }
2102
2103    if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2104        USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2105        dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2106        usbredir_buffered_bulk_in_complete(dev, p, ep);
2107        usb_packet_complete(&dev->dev, p);
2108    }
2109}
2110
2111/*
2112 * Migration code
2113 */
2114
2115static int usbredir_pre_save(void *priv)
2116{
2117    USBRedirDevice *dev = priv;
2118
2119    usbredir_fill_already_in_flight(dev);
2120
2121    return 0;
2122}
2123
2124static int usbredir_post_load(void *priv, int version_id)
2125{
2126    USBRedirDevice *dev = priv;
2127
2128    if (dev->parser == NULL) {
2129        return 0;
2130    }
2131
2132    switch (dev->device_info.speed) {
2133    case usb_redir_speed_low:
2134        dev->dev.speed = USB_SPEED_LOW;
2135        break;
2136    case usb_redir_speed_full:
2137        dev->dev.speed = USB_SPEED_FULL;
2138        break;
2139    case usb_redir_speed_high:
2140        dev->dev.speed = USB_SPEED_HIGH;
2141        break;
2142    case usb_redir_speed_super:
2143        dev->dev.speed = USB_SPEED_SUPER;
2144        break;
2145    default:
2146        dev->dev.speed = USB_SPEED_FULL;
2147    }
2148    dev->dev.speedmask = (1 << dev->dev.speed);
2149
2150    usbredir_setup_usb_eps(dev);
2151    usbredir_check_bulk_receiving(dev);
2152
2153    return 0;
2154}
2155
2156/* For usbredirparser migration */
2157static int usbredir_put_parser(QEMUFile *f, void *priv, size_t unused,
2158                               const VMStateField *field, QJSON *vmdesc)
2159{
2160    USBRedirDevice *dev = priv;
2161    uint8_t *data;
2162    int len;
2163
2164    if (dev->parser == NULL) {
2165        qemu_put_be32(f, 0);
2166        return 0;
2167    }
2168
2169    usbredirparser_serialize(dev->parser, &data, &len);
2170    qemu_oom_check(data);
2171
2172    qemu_put_be32(f, len);
2173    qemu_put_buffer(f, data, len);
2174
2175    free(data);
2176
2177    return 0;
2178}
2179
2180static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused,
2181                               const VMStateField *field)
2182{
2183    USBRedirDevice *dev = priv;
2184    uint8_t *data;
2185    int len, ret;
2186
2187    len = qemu_get_be32(f);
2188    if (len == 0) {
2189        return 0;
2190    }
2191
2192    /*
2193     * If our chardev is not open already at this point the usbredir connection
2194     * has been broken (non seamless migration, or restore from disk).
2195     *
2196     * In this case create a temporary parser to receive the migration data,
2197     * and schedule the close_bh to report the device as disconnected to the
2198     * guest and to destroy the parser again.
2199     */
2200    if (dev->parser == NULL) {
2201        WARNING("usb-redir connection broken during migration\n");
2202        usbredir_create_parser(dev);
2203        qemu_bh_schedule(dev->chardev_close_bh);
2204    }
2205
2206    data = g_malloc(len);
2207    qemu_get_buffer(f, data, len);
2208
2209    ret = usbredirparser_unserialize(dev->parser, data, len);
2210
2211    g_free(data);
2212
2213    return ret;
2214}
2215
2216static const VMStateInfo usbredir_parser_vmstate_info = {
2217    .name = "usb-redir-parser",
2218    .put  = usbredir_put_parser,
2219    .get  = usbredir_get_parser,
2220};
2221
2222
2223/* For buffered packets (iso/irq) queue migration */
2224static int usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused,
2225                              const VMStateField *field, QJSON *vmdesc)
2226{
2227    struct endp_data *endp = priv;
2228    USBRedirDevice *dev = endp->dev;
2229    struct buf_packet *bufp;
2230    int len, i = 0;
2231
2232    qemu_put_be32(f, endp->bufpq_size);
2233    QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2234        len = bufp->len - bufp->offset;
2235        DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2236                len, bufp->status);
2237        qemu_put_be32(f, len);
2238        qemu_put_be32(f, bufp->status);
2239        qemu_put_buffer(f, bufp->data + bufp->offset, len);
2240        i++;
2241    }
2242    assert(i == endp->bufpq_size);
2243
2244    return 0;
2245}
2246
2247static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused,
2248                              const VMStateField *field)
2249{
2250    struct endp_data *endp = priv;
2251    USBRedirDevice *dev = endp->dev;
2252    struct buf_packet *bufp;
2253    int i;
2254
2255    endp->bufpq_size = qemu_get_be32(f);
2256    for (i = 0; i < endp->bufpq_size; i++) {
2257        bufp = g_new(struct buf_packet, 1);
2258        bufp->len = qemu_get_be32(f);
2259        bufp->status = qemu_get_be32(f);
2260        bufp->offset = 0;
2261        bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */
2262        bufp->free_on_destroy = bufp->data;
2263        qemu_get_buffer(f, bufp->data, bufp->len);
2264        QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2265        DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2266                bufp->len, bufp->status);
2267    }
2268    return 0;
2269}
2270
2271static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2272    .name = "usb-redir-bufpq",
2273    .put  = usbredir_put_bufpq,
2274    .get  = usbredir_get_bufpq,
2275};
2276
2277
2278/* For endp_data migration */
2279static bool usbredir_bulk_receiving_needed(void *priv)
2280{
2281    struct endp_data *endp = priv;
2282
2283    return endp->bulk_receiving_started;
2284}
2285
2286static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2287    .name = "usb-redir-ep/bulk-receiving",
2288    .version_id = 1,
2289    .minimum_version_id = 1,
2290    .needed = usbredir_bulk_receiving_needed,
2291    .fields = (VMStateField[]) {
2292        VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2293        VMSTATE_END_OF_LIST()
2294    }
2295};
2296
2297static bool usbredir_stream_needed(void *priv)
2298{
2299    struct endp_data *endp = priv;
2300
2301    return endp->max_streams;
2302}
2303
2304static const VMStateDescription usbredir_stream_vmstate = {
2305    .name = "usb-redir-ep/stream-state",
2306    .version_id = 1,
2307    .minimum_version_id = 1,
2308    .needed = usbredir_stream_needed,
2309    .fields = (VMStateField[]) {
2310        VMSTATE_UINT32(max_streams, struct endp_data),
2311        VMSTATE_END_OF_LIST()
2312    }
2313};
2314
2315static const VMStateDescription usbredir_ep_vmstate = {
2316    .name = "usb-redir-ep",
2317    .version_id = 1,
2318    .minimum_version_id = 1,
2319    .fields = (VMStateField[]) {
2320        VMSTATE_UINT8(type, struct endp_data),
2321        VMSTATE_UINT8(interval, struct endp_data),
2322        VMSTATE_UINT8(interface, struct endp_data),
2323        VMSTATE_UINT16(max_packet_size, struct endp_data),
2324        VMSTATE_UINT8(iso_started, struct endp_data),
2325        VMSTATE_UINT8(iso_error, struct endp_data),
2326        VMSTATE_UINT8(interrupt_started, struct endp_data),
2327        VMSTATE_UINT8(interrupt_error, struct endp_data),
2328        VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2329        VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2330        {
2331            .name         = "bufpq",
2332            .version_id   = 0,
2333            .field_exists = NULL,
2334            .size         = 0,
2335            .info         = &usbredir_ep_bufpq_vmstate_info,
2336            .flags        = VMS_SINGLE,
2337            .offset       = 0,
2338        },
2339        VMSTATE_INT32(bufpq_target_size, struct endp_data),
2340        VMSTATE_END_OF_LIST()
2341    },
2342    .subsections = (const VMStateDescription*[]) {
2343        &usbredir_bulk_receiving_vmstate,
2344        &usbredir_stream_vmstate,
2345        NULL
2346    }
2347};
2348
2349
2350/* For PacketIdQueue migration */
2351static int usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2352                                    const VMStateField *field, QJSON *vmdesc)
2353{
2354    struct PacketIdQueue *q = priv;
2355    USBRedirDevice *dev = q->dev;
2356    struct PacketIdQueueEntry *e;
2357    int remain = q->size;
2358
2359    DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2360    qemu_put_be32(f, q->size);
2361    QTAILQ_FOREACH(e, &q->head, next) {
2362        qemu_put_be64(f, e->id);
2363        remain--;
2364    }
2365    assert(remain == 0);
2366
2367    return 0;
2368}
2369
2370static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2371                                    const VMStateField *field)
2372{
2373    struct PacketIdQueue *q = priv;
2374    USBRedirDevice *dev = q->dev;
2375    int i, size;
2376    uint64_t id;
2377
2378    size = qemu_get_be32(f);
2379    DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2380    for (i = 0; i < size; i++) {
2381        id = qemu_get_be64(f);
2382        packet_id_queue_add(q, id);
2383    }
2384    assert(q->size == size);
2385    return 0;
2386}
2387
2388static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2389    .name = "usb-redir-packet-id-q",
2390    .put  = usbredir_put_packet_id_q,
2391    .get  = usbredir_get_packet_id_q,
2392};
2393
2394static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2395    .name = "usb-redir-packet-id-queue",
2396    .version_id = 1,
2397    .minimum_version_id = 1,
2398    .fields = (VMStateField[]) {
2399        {
2400            .name         = "queue",
2401            .version_id   = 0,
2402            .field_exists = NULL,
2403            .size         = 0,
2404            .info         = &usbredir_ep_packet_id_q_vmstate_info,
2405            .flags        = VMS_SINGLE,
2406            .offset       = 0,
2407        },
2408        VMSTATE_END_OF_LIST()
2409    }
2410};
2411
2412
2413/* For usb_redir_device_connect_header migration */
2414static const VMStateDescription usbredir_device_info_vmstate = {
2415    .name = "usb-redir-device-info",
2416    .version_id = 1,
2417    .minimum_version_id = 1,
2418    .fields = (VMStateField[]) {
2419        VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2420        VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2421        VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2422        VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2423        VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2424        VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2425        VMSTATE_UINT16(device_version_bcd,
2426                       struct usb_redir_device_connect_header),
2427        VMSTATE_END_OF_LIST()
2428    }
2429};
2430
2431
2432/* For usb_redir_interface_info_header migration */
2433static const VMStateDescription usbredir_interface_info_vmstate = {
2434    .name = "usb-redir-interface-info",
2435    .version_id = 1,
2436    .minimum_version_id = 1,
2437    .fields = (VMStateField[]) {
2438        VMSTATE_UINT32(interface_count,
2439                       struct usb_redir_interface_info_header),
2440        VMSTATE_UINT8_ARRAY(interface,
2441                            struct usb_redir_interface_info_header, 32),
2442        VMSTATE_UINT8_ARRAY(interface_class,
2443                            struct usb_redir_interface_info_header, 32),
2444        VMSTATE_UINT8_ARRAY(interface_subclass,
2445                            struct usb_redir_interface_info_header, 32),
2446        VMSTATE_UINT8_ARRAY(interface_protocol,
2447                            struct usb_redir_interface_info_header, 32),
2448        VMSTATE_END_OF_LIST()
2449    }
2450};
2451
2452
2453/* And finally the USBRedirDevice vmstate itself */
2454static const VMStateDescription usbredir_vmstate = {
2455    .name = "usb-redir",
2456    .version_id = 1,
2457    .minimum_version_id = 1,
2458    .pre_save = usbredir_pre_save,
2459    .post_load = usbredir_post_load,
2460    .fields = (VMStateField[]) {
2461        VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2462        VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2463        {
2464            .name         = "parser",
2465            .version_id   = 0,
2466            .field_exists = NULL,
2467            .size         = 0,
2468            .info         = &usbredir_parser_vmstate_info,
2469            .flags        = VMS_SINGLE,
2470            .offset       = 0,
2471        },
2472        VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2473                             usbredir_ep_vmstate, struct endp_data),
2474        VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2475                       usbredir_ep_packet_id_queue_vmstate,
2476                       struct PacketIdQueue),
2477        VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2478                       usbredir_ep_packet_id_queue_vmstate,
2479                       struct PacketIdQueue),
2480        VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2481                       usbredir_device_info_vmstate,
2482                       struct usb_redir_device_connect_header),
2483        VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2484                       usbredir_interface_info_vmstate,
2485                       struct usb_redir_interface_info_header),
2486        VMSTATE_END_OF_LIST()
2487    }
2488};
2489
2490static Property usbredir_properties[] = {
2491    DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2492    DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2493    DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2494    DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
2495    DEFINE_PROP_END_OF_LIST(),
2496};
2497
2498static void usbredir_class_initfn(ObjectClass *klass, void *data)
2499{
2500    USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2501    DeviceClass *dc = DEVICE_CLASS(klass);
2502
2503    uc->realize        = usbredir_realize;
2504    uc->product_desc   = "USB Redirection Device";
2505    uc->unrealize      = usbredir_unrealize;
2506    uc->cancel_packet  = usbredir_cancel_packet;
2507    uc->handle_reset   = usbredir_handle_reset;
2508    uc->handle_data    = usbredir_handle_data;
2509    uc->handle_control = usbredir_handle_control;
2510    uc->flush_ep_queue = usbredir_flush_ep_queue;
2511    uc->ep_stopped     = usbredir_ep_stopped;
2512    uc->alloc_streams  = usbredir_alloc_streams;
2513    uc->free_streams   = usbredir_free_streams;
2514    dc->vmsd           = &usbredir_vmstate;
2515    dc->props          = usbredir_properties;
2516    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2517}
2518
2519static void usbredir_instance_init(Object *obj)
2520{
2521    USBDevice *udev = USB_DEVICE(obj);
2522    USBRedirDevice *dev = USB_REDIRECT(udev);
2523
2524    device_add_bootindex_property(obj, &dev->bootindex,
2525                                  "bootindex", NULL,
2526                                  &udev->qdev, NULL);
2527}
2528
2529static const TypeInfo usbredir_dev_info = {
2530    .name          = TYPE_USB_REDIR,
2531    .parent        = TYPE_USB_DEVICE,
2532    .instance_size = sizeof(USBRedirDevice),
2533    .class_init    = usbredir_class_initfn,
2534    .instance_init = usbredir_instance_init,
2535};
2536
2537static void usbredir_register_types(void)
2538{
2539    type_register_static(&usbredir_dev_info);
2540}
2541
2542type_init(usbredir_register_types)
2543