qemu/hw/usb/redirect.c
<<
>>
Prefs
   1/*
   2 * USB redirector usb-guest
   3 *
   4 * Copyright (c) 2011-2012 Red Hat, Inc.
   5 *
   6 * Red Hat Authors:
   7 * Hans de Goede <hdegoede@redhat.com>
   8 *
   9 * Permission is hereby granted, free of charge, to any person obtaining a copy
  10 * of this software and associated documentation files (the "Software"), to deal
  11 * in the Software without restriction, including without limitation the rights
  12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  13 * copies of the Software, and to permit persons to whom the Software is
  14 * furnished to do so, subject to the following conditions:
  15 *
  16 * The above copyright notice and this permission notice shall be included in
  17 * all copies or substantial portions of the Software.
  18 *
  19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  25 * THE SOFTWARE.
  26 */
  27
  28#include "qemu/osdep.h"
  29#include "qemu/cutils.h"
  30#include "qemu/units.h"
  31#include "qapi/error.h"
  32#include "qemu/timer.h"
  33#include "sysemu/runstate.h"
  34#include "sysemu/sysemu.h"
  35#include "qapi/qmp/qerror.h"
  36#include "qemu/error-report.h"
  37#include "qemu/iov.h"
  38#include "qemu/module.h"
  39#include "chardev/char-fe.h"
  40
  41#include <usbredirparser.h>
  42#include <usbredirfilter.h>
  43
  44#include "hw/qdev-properties.h"
  45#include "hw/qdev-properties-system.h"
  46#include "hw/usb.h"
  47#include "migration/qemu-file-types.h"
  48#include "migration/vmstate.h"
  49#include "qom/object.h"
  50
  51/* ERROR is defined below. Remove any previous definition. */
  52#undef ERROR
  53
  54#define MAX_ENDPOINTS 32
  55#define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
  56#define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
  57#define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
  58#define USBEP2I(usb_ep) (((usb_ep)->pid == USB_TOKEN_IN) ? \
  59                         ((usb_ep)->nr | 0x10) : ((usb_ep)->nr))
  60#define I2USBEP(d, i) (usb_ep_get(&(d)->dev, \
  61                       ((i) & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT, \
  62                       (i) & 0x0f))
  63
  64#ifndef USBREDIR_VERSION /* This is not defined in older usbredir versions */
  65#define USBREDIR_VERSION 0
  66#endif
  67
  68typedef struct USBRedirDevice USBRedirDevice;
  69
  70/* Struct to hold buffered packets */
  71struct buf_packet {
  72    uint8_t *data;
  73    void *free_on_destroy;
  74    uint16_t len;
  75    uint16_t offset;
  76    uint8_t status;
  77    QTAILQ_ENTRY(buf_packet)next;
  78};
  79
  80struct endp_data {
  81    USBRedirDevice *dev;
  82    uint8_t type;
  83    uint8_t interval;
  84    uint8_t interface; /* bInterfaceNumber this ep belongs to */
  85    uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
  86    uint32_t max_streams;
  87    uint8_t iso_started;
  88    uint8_t iso_error; /* For reporting iso errors to the HC */
  89    uint8_t interrupt_started;
  90    uint8_t interrupt_error;
  91    uint8_t bulk_receiving_enabled;
  92    uint8_t bulk_receiving_started;
  93    uint8_t bufpq_prefilled;
  94    uint8_t bufpq_dropping_packets;
  95    QTAILQ_HEAD(, buf_packet) bufpq;
  96    int32_t bufpq_size;
  97    int32_t bufpq_target_size;
  98    USBPacket *pending_async_packet;
  99};
 100
 101struct PacketIdQueueEntry {
 102    uint64_t id;
 103    QTAILQ_ENTRY(PacketIdQueueEntry)next;
 104};
 105
 106struct PacketIdQueue {
 107    USBRedirDevice *dev;
 108    const char *name;
 109    QTAILQ_HEAD(, PacketIdQueueEntry) head;
 110    int size;
 111};
 112
 113struct USBRedirDevice {
 114    USBDevice dev;
 115    /* Properties */
 116    CharBackend cs;
 117    bool enable_streams;
 118    bool suppress_remote_wake;
 119    bool in_write;
 120    uint8_t debug;
 121    int32_t bootindex;
 122    char *filter_str;
 123    /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
 124    const uint8_t *read_buf;
 125    int read_buf_size;
 126    /* Active chardev-watch-tag */
 127    guint watch;
 128    /* For async handling of close / reject */
 129    QEMUBH *chardev_close_bh;
 130    QEMUBH *device_reject_bh;
 131    /* To delay the usb attach in case of quick chardev close + open */
 132    QEMUTimer *attach_timer;
 133    int64_t next_attach_time;
 134    struct usbredirparser *parser;
 135    struct endp_data endpoint[MAX_ENDPOINTS];
 136    struct PacketIdQueue cancelled;
 137    struct PacketIdQueue already_in_flight;
 138    void (*buffered_bulk_in_complete)(USBRedirDevice *, USBPacket *, uint8_t);
 139    /* Data for device filtering */
 140    struct usb_redir_device_connect_header device_info;
 141    struct usb_redir_interface_info_header interface_info;
 142    struct usbredirfilter_rule *filter_rules;
 143    int filter_rules_count;
 144    int compatible_speedmask;
 145    VMChangeStateEntry *vmstate;
 146};
 147
 148#define TYPE_USB_REDIR "usb-redir"
 149DECLARE_INSTANCE_CHECKER(USBRedirDevice, USB_REDIRECT,
 150                         TYPE_USB_REDIR)
 151
 152static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
 153static void usbredir_device_connect(void *priv,
 154    struct usb_redir_device_connect_header *device_connect);
 155static void usbredir_device_disconnect(void *priv);
 156static void usbredir_interface_info(void *priv,
 157    struct usb_redir_interface_info_header *interface_info);
 158static void usbredir_ep_info(void *priv,
 159    struct usb_redir_ep_info_header *ep_info);
 160static void usbredir_configuration_status(void *priv, uint64_t id,
 161    struct usb_redir_configuration_status_header *configuration_status);
 162static void usbredir_alt_setting_status(void *priv, uint64_t id,
 163    struct usb_redir_alt_setting_status_header *alt_setting_status);
 164static void usbredir_iso_stream_status(void *priv, uint64_t id,
 165    struct usb_redir_iso_stream_status_header *iso_stream_status);
 166static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
 167    struct usb_redir_interrupt_receiving_status_header
 168    *interrupt_receiving_status);
 169static void usbredir_bulk_streams_status(void *priv, uint64_t id,
 170    struct usb_redir_bulk_streams_status_header *bulk_streams_status);
 171static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
 172    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status);
 173static void usbredir_control_packet(void *priv, uint64_t id,
 174    struct usb_redir_control_packet_header *control_packet,
 175    uint8_t *data, int data_len);
 176static void usbredir_bulk_packet(void *priv, uint64_t id,
 177    struct usb_redir_bulk_packet_header *bulk_packet,
 178    uint8_t *data, int data_len);
 179static void usbredir_iso_packet(void *priv, uint64_t id,
 180    struct usb_redir_iso_packet_header *iso_packet,
 181    uint8_t *data, int data_len);
 182static void usbredir_interrupt_packet(void *priv, uint64_t id,
 183    struct usb_redir_interrupt_packet_header *interrupt_header,
 184    uint8_t *data, int data_len);
 185static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
 186    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
 187    uint8_t *data, int data_len);
 188
 189static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
 190    int status);
 191
 192#define VERSION "qemu usb-redir guest " QEMU_VERSION
 193
 194/*
 195 * Logging stuff
 196 */
 197
 198#define ERROR(...) \
 199    do { \
 200        if (dev->debug >= usbredirparser_error) { \
 201            error_report("usb-redir error: " __VA_ARGS__); \
 202        } \
 203    } while (0)
 204#define WARNING(...) \
 205    do { \
 206        if (dev->debug >= usbredirparser_warning) { \
 207            warn_report("" __VA_ARGS__); \
 208        } \
 209    } while (0)
 210#define INFO(...) \
 211    do { \
 212        if (dev->debug >= usbredirparser_info) { \
 213            error_report("usb-redir: " __VA_ARGS__); \
 214        } \
 215    } while (0)
 216#define DPRINTF(...) \
 217    do { \
 218        if (dev->debug >= usbredirparser_debug) { \
 219            error_report("usb-redir: " __VA_ARGS__); \
 220        } \
 221    } while (0)
 222#define DPRINTF2(...) \
 223    do { \
 224        if (dev->debug >= usbredirparser_debug_data) { \
 225            error_report("usb-redir: " __VA_ARGS__); \
 226        } \
 227    } while (0)
 228
 229static void usbredir_log(void *priv, int level, const char *msg)
 230{
 231    USBRedirDevice *dev = priv;
 232
 233    if (dev->debug < level) {
 234        return;
 235    }
 236
 237    error_report("%s", msg);
 238}
 239
 240static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
 241    const uint8_t *data, int len)
 242{
 243    if (dev->debug < usbredirparser_debug_data) {
 244        return;
 245    }
 246    qemu_hexdump(stderr, desc, data, len);
 247}
 248
 249/*
 250 * usbredirparser io functions
 251 */
 252
 253static int usbredir_read(void *priv, uint8_t *data, int count)
 254{
 255    USBRedirDevice *dev = priv;
 256
 257    if (dev->read_buf_size < count) {
 258        count = dev->read_buf_size;
 259    }
 260
 261    memcpy(data, dev->read_buf, count);
 262
 263    dev->read_buf_size -= count;
 264    if (dev->read_buf_size) {
 265        dev->read_buf += count;
 266    } else {
 267        dev->read_buf = NULL;
 268    }
 269
 270    return count;
 271}
 272
 273static gboolean usbredir_write_unblocked(void *do_not_use, GIOCondition cond,
 274                                         void *opaque)
 275{
 276    USBRedirDevice *dev = opaque;
 277
 278    dev->watch = 0;
 279    usbredirparser_do_write(dev->parser);
 280
 281    return FALSE;
 282}
 283
 284static int usbredir_write(void *priv, uint8_t *data, int count)
 285{
 286    USBRedirDevice *dev = priv;
 287    int r;
 288
 289    if (!qemu_chr_fe_backend_open(&dev->cs)) {
 290        return 0;
 291    }
 292
 293    /* Don't send new data to the chardev until our state is fully synced */
 294    if (!runstate_check(RUN_STATE_RUNNING)) {
 295        return 0;
 296    }
 297
 298    /* Recursion check */
 299    if (dev->in_write) {
 300        DPRINTF("usbredir_write recursion\n");
 301        return 0;
 302    }
 303    dev->in_write = true;
 304
 305    r = qemu_chr_fe_write(&dev->cs, data, count);
 306    if (r < count) {
 307        if (!dev->watch) {
 308            dev->watch = qemu_chr_fe_add_watch(&dev->cs, G_IO_OUT | G_IO_HUP,
 309                                               usbredir_write_unblocked, dev);
 310        }
 311        if (r < 0) {
 312            r = 0;
 313        }
 314    }
 315    dev->in_write = false;
 316    return r;
 317}
 318
 319/*
 320 * Cancelled and buffered packets helpers
 321 */
 322
 323static void packet_id_queue_init(struct PacketIdQueue *q,
 324    USBRedirDevice *dev, const char *name)
 325{
 326    q->dev = dev;
 327    q->name = name;
 328    QTAILQ_INIT(&q->head);
 329    q->size = 0;
 330}
 331
 332static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
 333{
 334    USBRedirDevice *dev = q->dev;
 335    struct PacketIdQueueEntry *e;
 336
 337    DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
 338
 339    e = g_new0(struct PacketIdQueueEntry, 1);
 340    e->id = id;
 341    QTAILQ_INSERT_TAIL(&q->head, e, next);
 342    q->size++;
 343}
 344
 345static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
 346{
 347    USBRedirDevice *dev = q->dev;
 348    struct PacketIdQueueEntry *e;
 349
 350    QTAILQ_FOREACH(e, &q->head, next) {
 351        if (e->id == id) {
 352            DPRINTF("removing packet id %"PRIu64" from %s queue\n",
 353                    id, q->name);
 354            QTAILQ_REMOVE(&q->head, e, next);
 355            q->size--;
 356            g_free(e);
 357            return 1;
 358        }
 359    }
 360    return 0;
 361}
 362
 363static void packet_id_queue_empty(struct PacketIdQueue *q)
 364{
 365    USBRedirDevice *dev = q->dev;
 366    struct PacketIdQueueEntry *e, *next_e;
 367
 368    DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
 369
 370    QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
 371        QTAILQ_REMOVE(&q->head, e, next);
 372        g_free(e);
 373    }
 374    q->size = 0;
 375}
 376
 377static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
 378{
 379    USBRedirDevice *dev = USB_REDIRECT(udev);
 380    int i = USBEP2I(p->ep);
 381
 382    if (p->combined) {
 383        usb_combined_packet_cancel(udev, p);
 384        return;
 385    }
 386
 387    if (dev->endpoint[i].pending_async_packet) {
 388        assert(dev->endpoint[i].pending_async_packet == p);
 389        dev->endpoint[i].pending_async_packet = NULL;
 390        return;
 391    }
 392
 393    packet_id_queue_add(&dev->cancelled, p->id);
 394    usbredirparser_send_cancel_data_packet(dev->parser, p->id);
 395    usbredirparser_do_write(dev->parser);
 396}
 397
 398static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
 399{
 400    if (!dev->dev.attached) {
 401        return 1; /* Treat everything as cancelled after a disconnect */
 402    }
 403    return packet_id_queue_remove(&dev->cancelled, id);
 404}
 405
 406static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
 407    struct USBEndpoint *ep)
 408{
 409    static USBPacket *p;
 410
 411    /* async handled packets for bulk receiving eps do not count as inflight */
 412    if (dev->endpoint[USBEP2I(ep)].bulk_receiving_started) {
 413        return;
 414    }
 415
 416    QTAILQ_FOREACH(p, &ep->queue, queue) {
 417        /* Skip combined packets, except for the first */
 418        if (p->combined && p != p->combined->first) {
 419            continue;
 420        }
 421        if (p->state == USB_PACKET_ASYNC) {
 422            packet_id_queue_add(&dev->already_in_flight, p->id);
 423        }
 424    }
 425}
 426
 427static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
 428{
 429    int ep;
 430    struct USBDevice *udev = &dev->dev;
 431
 432    usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
 433
 434    for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
 435        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
 436        usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
 437    }
 438}
 439
 440static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
 441{
 442    return packet_id_queue_remove(&dev->already_in_flight, id);
 443}
 444
 445static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
 446    uint8_t ep, uint64_t id)
 447{
 448    USBPacket *p;
 449
 450    if (usbredir_is_cancelled(dev, id)) {
 451        return NULL;
 452    }
 453
 454    p = usb_ep_find_packet_by_id(&dev->dev,
 455                            (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
 456                            ep & 0x0f, id);
 457    if (p == NULL) {
 458        ERROR("could not find packet with id %"PRIu64"\n", id);
 459    }
 460    return p;
 461}
 462
 463static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
 464    uint8_t status, uint8_t ep, void *free_on_destroy)
 465{
 466    struct buf_packet *bufp;
 467
 468    if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
 469        dev->endpoint[EP2I(ep)].bufpq_size >
 470            2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
 471        DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
 472        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
 473    }
 474    /* Since we're interupting the stream anyways, drop enough packets to get
 475       back to our target buffer size */
 476    if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
 477        if (dev->endpoint[EP2I(ep)].bufpq_size >
 478                dev->endpoint[EP2I(ep)].bufpq_target_size) {
 479            free(free_on_destroy);
 480            return -1;
 481        }
 482        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 483    }
 484
 485    bufp = g_new(struct buf_packet, 1);
 486    bufp->data   = data;
 487    bufp->len    = len;
 488    bufp->offset = 0;
 489    bufp->status = status;
 490    bufp->free_on_destroy = free_on_destroy;
 491    QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
 492    dev->endpoint[EP2I(ep)].bufpq_size++;
 493    return 0;
 494}
 495
 496static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
 497    uint8_t ep)
 498{
 499    QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
 500    dev->endpoint[EP2I(ep)].bufpq_size--;
 501    free(bufp->free_on_destroy);
 502    g_free(bufp);
 503}
 504
 505static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
 506{
 507    struct buf_packet *buf, *buf_next;
 508
 509    QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
 510        bufp_free(dev, buf, ep);
 511    }
 512}
 513
 514/*
 515 * USBDevice callbacks
 516 */
 517
 518static void usbredir_handle_reset(USBDevice *udev)
 519{
 520    USBRedirDevice *dev = USB_REDIRECT(udev);
 521
 522    DPRINTF("reset device\n");
 523    usbredirparser_send_reset(dev->parser);
 524    usbredirparser_do_write(dev->parser);
 525}
 526
 527static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
 528                                     uint8_t ep)
 529{
 530    int status, len;
 531    if (!dev->endpoint[EP2I(ep)].iso_started &&
 532            !dev->endpoint[EP2I(ep)].iso_error) {
 533        struct usb_redir_start_iso_stream_header start_iso = {
 534            .endpoint = ep,
 535        };
 536        int pkts_per_sec;
 537
 538        if (dev->dev.speed == USB_SPEED_HIGH) {
 539            pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
 540        } else {
 541            pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
 542        }
 543        /* Testing has shown that we need circa 60 ms buffer */
 544        dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
 545
 546        /* Aim for approx 100 interrupts / second on the client to
 547           balance latency and interrupt load */
 548        start_iso.pkts_per_urb = pkts_per_sec / 100;
 549        if (start_iso.pkts_per_urb < 1) {
 550            start_iso.pkts_per_urb = 1;
 551        } else if (start_iso.pkts_per_urb > 32) {
 552            start_iso.pkts_per_urb = 32;
 553        }
 554
 555        start_iso.no_urbs = DIV_ROUND_UP(
 556                                     dev->endpoint[EP2I(ep)].bufpq_target_size,
 557                                     start_iso.pkts_per_urb);
 558        /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
 559           as overflow buffer. Also see the usbredir protocol documentation */
 560        if (!(ep & USB_DIR_IN)) {
 561            start_iso.no_urbs *= 2;
 562        }
 563        if (start_iso.no_urbs > 16) {
 564            start_iso.no_urbs = 16;
 565        }
 566
 567        /* No id, we look at the ep when receiving a status back */
 568        usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
 569        usbredirparser_do_write(dev->parser);
 570        DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
 571                pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
 572        dev->endpoint[EP2I(ep)].iso_started = 1;
 573        dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
 574        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 575    }
 576
 577    if (ep & USB_DIR_IN) {
 578        struct buf_packet *isop;
 579
 580        if (dev->endpoint[EP2I(ep)].iso_started &&
 581                !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
 582            if (dev->endpoint[EP2I(ep)].bufpq_size <
 583                    dev->endpoint[EP2I(ep)].bufpq_target_size) {
 584                return;
 585            }
 586            dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
 587        }
 588
 589        isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
 590        if (isop == NULL) {
 591            DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
 592                    ep, dev->endpoint[EP2I(ep)].iso_error);
 593            /* Re-fill the buffer */
 594            dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
 595            /* Check iso_error for stream errors, otherwise its an underrun */
 596            status = dev->endpoint[EP2I(ep)].iso_error;
 597            dev->endpoint[EP2I(ep)].iso_error = 0;
 598            p->status = status ? USB_RET_IOERROR : USB_RET_SUCCESS;
 599            return;
 600        }
 601        DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
 602                 isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
 603
 604        status = isop->status;
 605        len = isop->len;
 606        if (len > p->iov.size) {
 607            ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
 608                  ep, len, (int)p->iov.size);
 609            len = p->iov.size;
 610            status = usb_redir_babble;
 611        }
 612        usb_packet_copy(p, isop->data, len);
 613        bufp_free(dev, isop, ep);
 614        usbredir_handle_status(dev, p, status);
 615    } else {
 616        /* If the stream was not started because of a pending error don't
 617           send the packet to the usb-host */
 618        if (dev->endpoint[EP2I(ep)].iso_started) {
 619            struct usb_redir_iso_packet_header iso_packet = {
 620                .endpoint = ep,
 621                .length = p->iov.size
 622            };
 623            g_autofree uint8_t *buf = g_malloc(p->iov.size);
 624            /* No id, we look at the ep when receiving a status back */
 625            usb_packet_copy(p, buf, p->iov.size);
 626            usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
 627                                           buf, p->iov.size);
 628            usbredirparser_do_write(dev->parser);
 629        }
 630        status = dev->endpoint[EP2I(ep)].iso_error;
 631        dev->endpoint[EP2I(ep)].iso_error = 0;
 632        DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
 633                 p->iov.size);
 634        usbredir_handle_status(dev, p, status);
 635    }
 636}
 637
 638static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
 639{
 640    struct usb_redir_stop_iso_stream_header stop_iso_stream = {
 641        .endpoint = ep
 642    };
 643    if (dev->endpoint[EP2I(ep)].iso_started) {
 644        usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
 645        DPRINTF("iso stream stopped ep %02X\n", ep);
 646        dev->endpoint[EP2I(ep)].iso_started = 0;
 647    }
 648    dev->endpoint[EP2I(ep)].iso_error = 0;
 649    usbredir_free_bufpq(dev, ep);
 650}
 651
 652/*
 653 * The usb-host may poll the endpoint faster then our guest, resulting in lots
 654 * of smaller bulkp-s. The below buffered_bulk_in_complete* functions combine
 655 * data from multiple bulkp-s into a single packet, avoiding bufpq overflows.
 656 */
 657static void usbredir_buffered_bulk_add_data_to_packet(USBRedirDevice *dev,
 658    struct buf_packet *bulkp, int count, USBPacket *p, uint8_t ep)
 659{
 660    usb_packet_copy(p, bulkp->data + bulkp->offset, count);
 661    bulkp->offset += count;
 662    if (bulkp->offset == bulkp->len) {
 663        /* Store status in the last packet with data from this bulkp */
 664        usbredir_handle_status(dev, p, bulkp->status);
 665        bufp_free(dev, bulkp, ep);
 666    }
 667}
 668
 669static void usbredir_buffered_bulk_in_complete_raw(USBRedirDevice *dev,
 670    USBPacket *p, uint8_t ep)
 671{
 672    struct buf_packet *bulkp;
 673    int count;
 674
 675    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
 676           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
 677        count = bulkp->len - bulkp->offset;
 678        if (count > (p->iov.size - p->actual_length)) {
 679            count = p->iov.size - p->actual_length;
 680        }
 681        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
 682    }
 683}
 684
 685static void usbredir_buffered_bulk_in_complete_ftdi(USBRedirDevice *dev,
 686    USBPacket *p, uint8_t ep)
 687{
 688    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
 689    uint8_t header[2] = { 0, 0 };
 690    struct buf_packet *bulkp;
 691    int count;
 692
 693    while ((bulkp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq)) &&
 694           p->actual_length < p->iov.size && p->status == USB_RET_SUCCESS) {
 695        if (bulkp->len < 2) {
 696            WARNING("malformed ftdi bulk in packet\n");
 697            bufp_free(dev, bulkp, ep);
 698            continue;
 699        }
 700
 701        if ((p->actual_length % maxp) == 0) {
 702            usb_packet_copy(p, bulkp->data, 2);
 703            memcpy(header, bulkp->data, 2);
 704        } else {
 705            if (bulkp->data[0] != header[0] || bulkp->data[1] != header[1]) {
 706                break; /* Different header, add to next packet */
 707            }
 708        }
 709
 710        if (bulkp->offset == 0) {
 711            bulkp->offset = 2; /* Skip header */
 712        }
 713        count = bulkp->len - bulkp->offset;
 714        /* Must repeat the header at maxp interval */
 715        if (count > (maxp - (p->actual_length % maxp))) {
 716            count = maxp - (p->actual_length % maxp);
 717        }
 718        usbredir_buffered_bulk_add_data_to_packet(dev, bulkp, count, p, ep);
 719    }
 720}
 721
 722static void usbredir_buffered_bulk_in_complete(USBRedirDevice *dev,
 723    USBPacket *p, uint8_t ep)
 724{
 725    p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
 726    dev->buffered_bulk_in_complete(dev, p, ep);
 727    DPRINTF("bulk-token-in ep %02X status %d len %d id %"PRIu64"\n",
 728            ep, p->status, p->actual_length, p->id);
 729}
 730
 731static void usbredir_handle_buffered_bulk_in_data(USBRedirDevice *dev,
 732    USBPacket *p, uint8_t ep)
 733{
 734    /* Input bulk endpoint, buffered packet input */
 735    if (!dev->endpoint[EP2I(ep)].bulk_receiving_started) {
 736        int bpt;
 737        struct usb_redir_start_bulk_receiving_header start = {
 738            .endpoint = ep,
 739            .stream_id = 0,
 740            .no_transfers = 5,
 741        };
 742        /* Round bytes_per_transfer up to a multiple of max_packet_size */
 743        bpt = 512 + dev->endpoint[EP2I(ep)].max_packet_size - 1;
 744        bpt /= dev->endpoint[EP2I(ep)].max_packet_size;
 745        bpt *= dev->endpoint[EP2I(ep)].max_packet_size;
 746        start.bytes_per_transfer = bpt;
 747        /* No id, we look at the ep when receiving a status back */
 748        usbredirparser_send_start_bulk_receiving(dev->parser, 0, &start);
 749        usbredirparser_do_write(dev->parser);
 750        DPRINTF("bulk receiving started bytes/transfer %u count %d ep %02X\n",
 751                start.bytes_per_transfer, start.no_transfers, ep);
 752        dev->endpoint[EP2I(ep)].bulk_receiving_started = 1;
 753        /* We don't really want to drop bulk packets ever, but
 754           having some upper limit to how much we buffer is good. */
 755        dev->endpoint[EP2I(ep)].bufpq_target_size = 5000;
 756        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 757    }
 758
 759    if (QTAILQ_EMPTY(&dev->endpoint[EP2I(ep)].bufpq)) {
 760        DPRINTF("bulk-token-in ep %02X, no bulkp\n", ep);
 761        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
 762        dev->endpoint[EP2I(ep)].pending_async_packet = p;
 763        p->status = USB_RET_ASYNC;
 764        return;
 765    }
 766    usbredir_buffered_bulk_in_complete(dev, p, ep);
 767}
 768
 769static void usbredir_stop_bulk_receiving(USBRedirDevice *dev, uint8_t ep)
 770{
 771    struct usb_redir_stop_bulk_receiving_header stop_bulk = {
 772        .endpoint = ep,
 773        .stream_id = 0,
 774    };
 775    if (dev->endpoint[EP2I(ep)].bulk_receiving_started) {
 776        usbredirparser_send_stop_bulk_receiving(dev->parser, 0, &stop_bulk);
 777        DPRINTF("bulk receiving stopped ep %02X\n", ep);
 778        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
 779    }
 780    usbredir_free_bufpq(dev, ep);
 781}
 782
 783static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
 784                                      uint8_t ep)
 785{
 786    struct usb_redir_bulk_packet_header bulk_packet;
 787    size_t size = usb_packet_size(p);
 788    const int maxp = dev->endpoint[EP2I(ep)].max_packet_size;
 789
 790    if (usbredir_already_in_flight(dev, p->id)) {
 791        p->status = USB_RET_ASYNC;
 792        return;
 793    }
 794
 795    if (dev->endpoint[EP2I(ep)].bulk_receiving_enabled) {
 796        if (size != 0 && (size % maxp) == 0) {
 797            usbredir_handle_buffered_bulk_in_data(dev, p, ep);
 798            return;
 799        }
 800        WARNING("bulk recv invalid size %zd ep %02x, disabling\n", size, ep);
 801        assert(dev->endpoint[EP2I(ep)].pending_async_packet == NULL);
 802        usbredir_stop_bulk_receiving(dev, ep);
 803        dev->endpoint[EP2I(ep)].bulk_receiving_enabled = 0;
 804    }
 805
 806    DPRINTF("bulk-out ep %02X stream %u len %zd id %"PRIu64"\n",
 807            ep, p->stream, size, p->id);
 808
 809    bulk_packet.endpoint  = ep;
 810    bulk_packet.length    = size;
 811    bulk_packet.stream_id = p->stream;
 812    bulk_packet.length_high = size >> 16;
 813    assert(bulk_packet.length_high == 0 ||
 814           usbredirparser_peer_has_cap(dev->parser,
 815                                       usb_redir_cap_32bits_bulk_length));
 816
 817    if (ep & USB_DIR_IN || size == 0) {
 818        usbredirparser_send_bulk_packet(dev->parser, p->id,
 819                                        &bulk_packet, NULL, 0);
 820    } else {
 821        g_autofree uint8_t *buf = g_malloc(size);
 822        usb_packet_copy(p, buf, size);
 823        usbredir_log_data(dev, "bulk data out:", buf, size);
 824        usbredirparser_send_bulk_packet(dev->parser, p->id,
 825                                        &bulk_packet, buf, size);
 826    }
 827    usbredirparser_do_write(dev->parser);
 828    p->status = USB_RET_ASYNC;
 829}
 830
 831static void usbredir_handle_interrupt_in_data(USBRedirDevice *dev,
 832                                              USBPacket *p, uint8_t ep)
 833{
 834    /* Input interrupt endpoint, buffered packet input */
 835    struct buf_packet *intp, *intp_to_free;
 836    int status, len, sum;
 837
 838    if (!dev->endpoint[EP2I(ep)].interrupt_started &&
 839            !dev->endpoint[EP2I(ep)].interrupt_error) {
 840        struct usb_redir_start_interrupt_receiving_header start_int = {
 841            .endpoint = ep,
 842        };
 843        /* No id, we look at the ep when receiving a status back */
 844        usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
 845                                                      &start_int);
 846        usbredirparser_do_write(dev->parser);
 847        DPRINTF("interrupt recv started ep %02X\n", ep);
 848        dev->endpoint[EP2I(ep)].interrupt_started = 1;
 849        /* We don't really want to drop interrupt packets ever, but
 850           having some upper limit to how much we buffer is good. */
 851        dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
 852        dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
 853    }
 854
 855    /* check for completed interrupt message (with all fragments) */
 856    sum = 0;
 857    QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
 858        sum += intp->len;
 859        if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
 860            sum >= p->iov.size)
 861            break;
 862    }
 863
 864    if (intp == NULL) {
 865        DPRINTF2("interrupt-token-in ep %02X, no intp, buffered %d\n", ep, sum);
 866        /* Check interrupt_error for stream errors */
 867        status = dev->endpoint[EP2I(ep)].interrupt_error;
 868        dev->endpoint[EP2I(ep)].interrupt_error = 0;
 869        if (status) {
 870            usbredir_handle_status(dev, p, status);
 871        } else {
 872            p->status = USB_RET_NAK;
 873        }
 874        return;
 875    }
 876
 877    /* copy of completed interrupt message */
 878    sum = 0;
 879    status = usb_redir_success;
 880    intp_to_free = NULL;
 881    QTAILQ_FOREACH(intp, &dev->endpoint[EP2I(ep)].bufpq, next) {
 882        if (intp_to_free) {
 883            bufp_free(dev, intp_to_free, ep);
 884        }
 885        DPRINTF("interrupt-token-in ep %02X fragment status %d len %d\n", ep,
 886                intp->status, intp->len);
 887
 888        sum += intp->len;
 889        len = intp->len;
 890        if (status == usb_redir_success) {
 891            status = intp->status;
 892        }
 893        if (sum > p->iov.size) {
 894            ERROR("received int data is larger then packet ep %02X\n", ep);
 895            len -= (sum - p->iov.size);
 896            sum = p->iov.size;
 897            status = usb_redir_babble;
 898        }
 899
 900        usb_packet_copy(p, intp->data, len);
 901
 902        intp_to_free = intp;
 903        if (intp->len < dev->endpoint[EP2I(ep)].max_packet_size ||
 904            sum >= p->iov.size)
 905            break;
 906    }
 907    if (intp_to_free) {
 908        bufp_free(dev, intp_to_free, ep);
 909    }
 910    DPRINTF("interrupt-token-in ep %02X summary status %d len %d\n", ep,
 911            status, sum);
 912    usbredir_handle_status(dev, p, status);
 913}
 914
 915/*
 916 * Handle interrupt out data, the usbredir protocol expects us to do this
 917 * async, so that it can report back a completion status. But guests will
 918 * expect immediate completion for an interrupt endpoint, and handling this
 919 * async causes migration issues. So we report success directly, counting
 920 * on the fact that output interrupt packets normally always succeed.
 921 */
 922static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
 923                                               USBPacket *p, uint8_t ep)
 924{
 925    struct usb_redir_interrupt_packet_header interrupt_packet;
 926    g_autofree uint8_t *buf = g_malloc(p->iov.size);
 927
 928    DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
 929            p->iov.size, p->id);
 930
 931    interrupt_packet.endpoint  = ep;
 932    interrupt_packet.length    = p->iov.size;
 933
 934    usb_packet_copy(p, buf, p->iov.size);
 935    usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
 936    usbredirparser_send_interrupt_packet(dev->parser, p->id,
 937                                    &interrupt_packet, buf, p->iov.size);
 938    usbredirparser_do_write(dev->parser);
 939}
 940
 941static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
 942    uint8_t ep)
 943{
 944    struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
 945        .endpoint = ep
 946    };
 947    if (dev->endpoint[EP2I(ep)].interrupt_started) {
 948        usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
 949                                                     &stop_interrupt_recv);
 950        DPRINTF("interrupt recv stopped ep %02X\n", ep);
 951        dev->endpoint[EP2I(ep)].interrupt_started = 0;
 952    }
 953    dev->endpoint[EP2I(ep)].interrupt_error = 0;
 954    usbredir_free_bufpq(dev, ep);
 955}
 956
 957static void usbredir_handle_data(USBDevice *udev, USBPacket *p)
 958{
 959    USBRedirDevice *dev = USB_REDIRECT(udev);
 960    uint8_t ep;
 961
 962    ep = p->ep->nr;
 963    if (p->pid == USB_TOKEN_IN) {
 964        ep |= USB_DIR_IN;
 965    }
 966
 967    switch (dev->endpoint[EP2I(ep)].type) {
 968    case USB_ENDPOINT_XFER_CONTROL:
 969        ERROR("handle_data called for control transfer on ep %02X\n", ep);
 970        p->status = USB_RET_NAK;
 971        break;
 972    case USB_ENDPOINT_XFER_BULK:
 973        if (p->state == USB_PACKET_SETUP && p->pid == USB_TOKEN_IN &&
 974                p->ep->pipeline) {
 975            p->status = USB_RET_ADD_TO_QUEUE;
 976            break;
 977        }
 978        usbredir_handle_bulk_data(dev, p, ep);
 979        break;
 980    case USB_ENDPOINT_XFER_ISOC:
 981        usbredir_handle_iso_data(dev, p, ep);
 982        break;
 983    case USB_ENDPOINT_XFER_INT:
 984        if (ep & USB_DIR_IN) {
 985            usbredir_handle_interrupt_in_data(dev, p, ep);
 986        } else {
 987            usbredir_handle_interrupt_out_data(dev, p, ep);
 988        }
 989        break;
 990    default:
 991        ERROR("handle_data ep %02X has unknown type %d\n", ep,
 992              dev->endpoint[EP2I(ep)].type);
 993        p->status = USB_RET_NAK;
 994    }
 995}
 996
 997static void usbredir_flush_ep_queue(USBDevice *dev, USBEndpoint *ep)
 998{
 999    if (ep->pid == USB_TOKEN_IN && ep->pipeline) {
1000        usb_ep_combine_input_packets(ep);
1001    }
1002}
1003
1004static void usbredir_stop_ep(USBRedirDevice *dev, int i)
1005{
1006    uint8_t ep = I2EP(i);
1007
1008    switch (dev->endpoint[i].type) {
1009    case USB_ENDPOINT_XFER_BULK:
1010        if (ep & USB_DIR_IN) {
1011            usbredir_stop_bulk_receiving(dev, ep);
1012        }
1013        break;
1014    case USB_ENDPOINT_XFER_ISOC:
1015        usbredir_stop_iso_stream(dev, ep);
1016        break;
1017    case USB_ENDPOINT_XFER_INT:
1018        if (ep & USB_DIR_IN) {
1019            usbredir_stop_interrupt_receiving(dev, ep);
1020        }
1021        break;
1022    }
1023    usbredir_free_bufpq(dev, ep);
1024}
1025
1026static void usbredir_ep_stopped(USBDevice *udev, USBEndpoint *uep)
1027{
1028    USBRedirDevice *dev = USB_REDIRECT(udev);
1029
1030    usbredir_stop_ep(dev, USBEP2I(uep));
1031    usbredirparser_do_write(dev->parser);
1032}
1033
1034static void usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
1035                                int config)
1036{
1037    struct usb_redir_set_configuration_header set_config;
1038    int i;
1039
1040    DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
1041
1042    for (i = 0; i < MAX_ENDPOINTS; i++) {
1043        usbredir_stop_ep(dev, i);
1044    }
1045
1046    set_config.configuration = config;
1047    usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
1048    usbredirparser_do_write(dev->parser);
1049    p->status = USB_RET_ASYNC;
1050}
1051
1052static void usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
1053{
1054    DPRINTF("get config id %"PRIu64"\n", p->id);
1055
1056    usbredirparser_send_get_configuration(dev->parser, p->id);
1057    usbredirparser_do_write(dev->parser);
1058    p->status = USB_RET_ASYNC;
1059}
1060
1061static void usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
1062                                   int interface, int alt)
1063{
1064    struct usb_redir_set_alt_setting_header set_alt;
1065    int i;
1066
1067    DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
1068
1069    for (i = 0; i < MAX_ENDPOINTS; i++) {
1070        if (dev->endpoint[i].interface == interface) {
1071            usbredir_stop_ep(dev, i);
1072        }
1073    }
1074
1075    set_alt.interface = interface;
1076    set_alt.alt = alt;
1077    usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
1078    usbredirparser_do_write(dev->parser);
1079    p->status = USB_RET_ASYNC;
1080}
1081
1082static void usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
1083                                   int interface)
1084{
1085    struct usb_redir_get_alt_setting_header get_alt;
1086
1087    DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
1088
1089    get_alt.interface = interface;
1090    usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
1091    usbredirparser_do_write(dev->parser);
1092    p->status = USB_RET_ASYNC;
1093}
1094
1095static void usbredir_handle_control(USBDevice *udev, USBPacket *p,
1096        int request, int value, int index, int length, uint8_t *data)
1097{
1098    USBRedirDevice *dev = USB_REDIRECT(udev);
1099    struct usb_redir_control_packet_header control_packet;
1100
1101    if (usbredir_already_in_flight(dev, p->id)) {
1102        p->status = USB_RET_ASYNC;
1103        return;
1104    }
1105
1106    /* Special cases for certain standard device requests */
1107    switch (request) {
1108    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
1109        DPRINTF("set address %d\n", value);
1110        dev->dev.addr = value;
1111        return;
1112    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
1113        usbredir_set_config(dev, p, value & 0xff);
1114        return;
1115    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
1116        usbredir_get_config(dev, p);
1117        return;
1118    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
1119        usbredir_set_interface(dev, p, index, value);
1120        return;
1121    case InterfaceRequest | USB_REQ_GET_INTERFACE:
1122        usbredir_get_interface(dev, p, index);
1123        return;
1124    }
1125
1126    /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
1127    DPRINTF(
1128        "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
1129        request >> 8, request & 0xff, value, index, length, p->id);
1130
1131    control_packet.request     = request & 0xFF;
1132    control_packet.requesttype = request >> 8;
1133    control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
1134    control_packet.value       = value;
1135    control_packet.index       = index;
1136    control_packet.length      = length;
1137
1138    if (control_packet.requesttype & USB_DIR_IN) {
1139        usbredirparser_send_control_packet(dev->parser, p->id,
1140                                           &control_packet, NULL, 0);
1141    } else {
1142        usbredir_log_data(dev, "ctrl data out:", data, length);
1143        usbredirparser_send_control_packet(dev->parser, p->id,
1144                                           &control_packet, data, length);
1145    }
1146    usbredirparser_do_write(dev->parser);
1147    p->status = USB_RET_ASYNC;
1148}
1149
1150static int usbredir_alloc_streams(USBDevice *udev, USBEndpoint **eps,
1151                                  int nr_eps, int streams)
1152{
1153    USBRedirDevice *dev = USB_REDIRECT(udev);
1154#if USBREDIR_VERSION >= 0x000700
1155    struct usb_redir_alloc_bulk_streams_header alloc_streams;
1156    int i;
1157
1158    if (!usbredirparser_peer_has_cap(dev->parser,
1159                                     usb_redir_cap_bulk_streams)) {
1160        ERROR("peer does not support streams\n");
1161        goto reject;
1162    }
1163
1164    if (streams == 0) {
1165        ERROR("request to allocate 0 streams\n");
1166        return -1;
1167    }
1168
1169    alloc_streams.no_streams = streams;
1170    alloc_streams.endpoints = 0;
1171    for (i = 0; i < nr_eps; i++) {
1172        alloc_streams.endpoints |= 1 << USBEP2I(eps[i]);
1173    }
1174    usbredirparser_send_alloc_bulk_streams(dev->parser, 0, &alloc_streams);
1175    usbredirparser_do_write(dev->parser);
1176
1177    return 0;
1178#else
1179    ERROR("usbredir_alloc_streams not implemented\n");
1180    goto reject;
1181#endif
1182reject:
1183    ERROR("streams are not available, disconnecting\n");
1184    qemu_bh_schedule(dev->device_reject_bh);
1185    return -1;
1186}
1187
1188static void usbredir_free_streams(USBDevice *udev, USBEndpoint **eps,
1189                                  int nr_eps)
1190{
1191#if USBREDIR_VERSION >= 0x000700
1192    USBRedirDevice *dev = USB_REDIRECT(udev);
1193    struct usb_redir_free_bulk_streams_header free_streams;
1194    int i;
1195
1196    if (!usbredirparser_peer_has_cap(dev->parser,
1197                                     usb_redir_cap_bulk_streams)) {
1198        return;
1199    }
1200
1201    free_streams.endpoints = 0;
1202    for (i = 0; i < nr_eps; i++) {
1203        free_streams.endpoints |= 1 << USBEP2I(eps[i]);
1204    }
1205    usbredirparser_send_free_bulk_streams(dev->parser, 0, &free_streams);
1206    usbredirparser_do_write(dev->parser);
1207#endif
1208}
1209
1210/*
1211 * Close events can be triggered by usbredirparser_do_write which gets called
1212 * from within the USBDevice data / control packet callbacks and doing a
1213 * usb_detach from within these callbacks is not a good idea.
1214 *
1215 * So we use a bh handler to take care of close events.
1216 */
1217static void usbredir_chardev_close_bh(void *opaque)
1218{
1219    USBRedirDevice *dev = opaque;
1220
1221    qemu_bh_cancel(dev->device_reject_bh);
1222    usbredir_device_disconnect(dev);
1223
1224    if (dev->parser) {
1225        DPRINTF("destroying usbredirparser\n");
1226        usbredirparser_destroy(dev->parser);
1227        dev->parser = NULL;
1228    }
1229    if (dev->watch) {
1230        g_source_remove(dev->watch);
1231        dev->watch = 0;
1232    }
1233}
1234
1235static void usbredir_create_parser(USBRedirDevice *dev)
1236{
1237    uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
1238    int flags = 0;
1239
1240    DPRINTF("creating usbredirparser\n");
1241
1242    dev->parser = usbredirparser_create();
1243    if (!dev->parser) {
1244        error_report("usbredirparser_create() failed");
1245        exit(1);
1246    }
1247    dev->parser->priv = dev;
1248    dev->parser->log_func = usbredir_log;
1249    dev->parser->read_func = usbredir_read;
1250    dev->parser->write_func = usbredir_write;
1251    dev->parser->hello_func = usbredir_hello;
1252    dev->parser->device_connect_func = usbredir_device_connect;
1253    dev->parser->device_disconnect_func = usbredir_device_disconnect;
1254    dev->parser->interface_info_func = usbredir_interface_info;
1255    dev->parser->ep_info_func = usbredir_ep_info;
1256    dev->parser->configuration_status_func = usbredir_configuration_status;
1257    dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
1258    dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
1259    dev->parser->interrupt_receiving_status_func =
1260        usbredir_interrupt_receiving_status;
1261    dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
1262    dev->parser->bulk_receiving_status_func = usbredir_bulk_receiving_status;
1263    dev->parser->control_packet_func = usbredir_control_packet;
1264    dev->parser->bulk_packet_func = usbredir_bulk_packet;
1265    dev->parser->iso_packet_func = usbredir_iso_packet;
1266    dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
1267    dev->parser->buffered_bulk_packet_func = usbredir_buffered_bulk_packet;
1268    dev->read_buf = NULL;
1269    dev->read_buf_size = 0;
1270
1271    usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
1272    usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
1273    usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
1274    usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
1275    usbredirparser_caps_set_cap(caps, usb_redir_cap_32bits_bulk_length);
1276    usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_receiving);
1277#if USBREDIR_VERSION >= 0x000700
1278    if (dev->enable_streams) {
1279        usbredirparser_caps_set_cap(caps, usb_redir_cap_bulk_streams);
1280    }
1281#endif
1282
1283    if (runstate_check(RUN_STATE_INMIGRATE)) {
1284        flags |= usbredirparser_fl_no_hello;
1285    }
1286    usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
1287                        flags);
1288    usbredirparser_do_write(dev->parser);
1289}
1290
1291static void usbredir_reject_device(USBRedirDevice *dev)
1292{
1293    usbredir_device_disconnect(dev);
1294    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
1295        usbredirparser_send_filter_reject(dev->parser);
1296        usbredirparser_do_write(dev->parser);
1297    }
1298}
1299
1300/*
1301 * We may need to reject the device when the hcd calls alloc_streams, doing
1302 * an usb_detach from within a hcd call is not a good idea, hence this bh.
1303 */
1304static void usbredir_device_reject_bh(void *opaque)
1305{
1306    USBRedirDevice *dev = opaque;
1307
1308    usbredir_reject_device(dev);
1309}
1310
1311static void usbredir_do_attach(void *opaque)
1312{
1313    USBRedirDevice *dev = opaque;
1314    Error *local_err = NULL;
1315
1316    /* In order to work properly with XHCI controllers we need these caps */
1317    if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
1318        usbredirparser_peer_has_cap(dev->parser,
1319                                    usb_redir_cap_ep_info_max_packet_size) &&
1320        usbredirparser_peer_has_cap(dev->parser,
1321                                    usb_redir_cap_32bits_bulk_length) &&
1322        usbredirparser_peer_has_cap(dev->parser,
1323                                    usb_redir_cap_64bits_ids))) {
1324        ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
1325        usbredir_reject_device(dev);
1326        return;
1327    }
1328
1329    usb_device_attach(&dev->dev, &local_err);
1330    if (local_err) {
1331        error_report_err(local_err);
1332        WARNING("rejecting device due to speed mismatch\n");
1333        usbredir_reject_device(dev);
1334    }
1335}
1336
1337/*
1338 * chardev callbacks
1339 */
1340
1341static int usbredir_chardev_can_read(void *opaque)
1342{
1343    USBRedirDevice *dev = opaque;
1344
1345    if (!dev->parser) {
1346        WARNING("chardev_can_read called on non open chardev!\n");
1347        return 0;
1348    }
1349
1350    /* Don't read new data from the chardev until our state is fully synced */
1351    if (!runstate_check(RUN_STATE_RUNNING)) {
1352        return 0;
1353    }
1354
1355    /* usbredir_parser_do_read will consume *all* data we give it */
1356    return 1 * MiB;
1357}
1358
1359static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
1360{
1361    USBRedirDevice *dev = opaque;
1362
1363    /* No recursion allowed! */
1364    assert(dev->read_buf == NULL);
1365
1366    dev->read_buf = buf;
1367    dev->read_buf_size = size;
1368
1369    usbredirparser_do_read(dev->parser);
1370    /* Send any acks, etc. which may be queued now */
1371    usbredirparser_do_write(dev->parser);
1372}
1373
1374static void usbredir_chardev_event(void *opaque, QEMUChrEvent event)
1375{
1376    USBRedirDevice *dev = opaque;
1377
1378    switch (event) {
1379    case CHR_EVENT_OPENED:
1380        DPRINTF("chardev open\n");
1381        /* Make sure any pending closes are handled (no-op if none pending) */
1382        usbredir_chardev_close_bh(dev);
1383        qemu_bh_cancel(dev->chardev_close_bh);
1384        usbredir_create_parser(dev);
1385        break;
1386    case CHR_EVENT_CLOSED:
1387        DPRINTF("chardev close\n");
1388        qemu_bh_schedule(dev->chardev_close_bh);
1389        break;
1390    case CHR_EVENT_BREAK:
1391    case CHR_EVENT_MUX_IN:
1392    case CHR_EVENT_MUX_OUT:
1393        /* Ignore */
1394        break;
1395    }
1396}
1397
1398/*
1399 * init + destroy
1400 */
1401
1402static void usbredir_vm_state_change(void *priv, bool running, RunState state)
1403{
1404    USBRedirDevice *dev = priv;
1405
1406    if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
1407        usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1408    }
1409}
1410
1411static void usbredir_init_endpoints(USBRedirDevice *dev)
1412{
1413    int i;
1414
1415    usb_ep_init(&dev->dev);
1416    memset(dev->endpoint, 0, sizeof(dev->endpoint));
1417    for (i = 0; i < MAX_ENDPOINTS; i++) {
1418        dev->endpoint[i].dev = dev;
1419        QTAILQ_INIT(&dev->endpoint[i].bufpq);
1420    }
1421}
1422
1423static void usbredir_realize(USBDevice *udev, Error **errp)
1424{
1425    USBRedirDevice *dev = USB_REDIRECT(udev);
1426    int i;
1427
1428    if (!qemu_chr_fe_backend_connected(&dev->cs)) {
1429        error_setg(errp, QERR_MISSING_PARAMETER, "chardev");
1430        return;
1431    }
1432
1433    if (dev->filter_str) {
1434        i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1435                                           &dev->filter_rules,
1436                                           &dev->filter_rules_count);
1437        if (i) {
1438            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "filter",
1439                       "a usb device filter string");
1440            return;
1441        }
1442    }
1443
1444    dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
1445    dev->device_reject_bh = qemu_bh_new(usbredir_device_reject_bh, dev);
1446    dev->attach_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, usbredir_do_attach, dev);
1447
1448    packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1449    packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1450    usbredir_init_endpoints(dev);
1451
1452    /* We'll do the attach once we receive the speed from the usb-host */
1453    udev->auto_attach = 0;
1454
1455    /* Will be cleared during setup when we find conflicts */
1456    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1457
1458    /* Let the backend know we are ready */
1459    qemu_chr_fe_set_handlers(&dev->cs, usbredir_chardev_can_read,
1460                             usbredir_chardev_read, usbredir_chardev_event,
1461                             NULL, dev, NULL, true);
1462
1463    dev->vmstate =
1464        qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1465}
1466
1467static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1468{
1469    int i;
1470
1471    packet_id_queue_empty(&dev->cancelled);
1472    packet_id_queue_empty(&dev->already_in_flight);
1473    for (i = 0; i < MAX_ENDPOINTS; i++) {
1474        usbredir_free_bufpq(dev, I2EP(i));
1475    }
1476}
1477
1478static void usbredir_unrealize(USBDevice *udev)
1479{
1480    USBRedirDevice *dev = USB_REDIRECT(udev);
1481
1482    qemu_chr_fe_deinit(&dev->cs, true);
1483
1484    /* Note must be done after qemu_chr_close, as that causes a close event */
1485    qemu_bh_delete(dev->chardev_close_bh);
1486    qemu_bh_delete(dev->device_reject_bh);
1487
1488    timer_free(dev->attach_timer);
1489
1490    usbredir_cleanup_device_queues(dev);
1491
1492    if (dev->parser) {
1493        usbredirparser_destroy(dev->parser);
1494    }
1495    if (dev->watch) {
1496        g_source_remove(dev->watch);
1497    }
1498
1499    free(dev->filter_rules);
1500    qemu_del_vm_change_state_handler(dev->vmstate);
1501}
1502
1503static int usbredir_check_filter(USBRedirDevice *dev)
1504{
1505    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1506        ERROR("No interface info for device\n");
1507        goto error;
1508    }
1509
1510    if (dev->filter_rules) {
1511        if (!usbredirparser_peer_has_cap(dev->parser,
1512                                    usb_redir_cap_connect_device_version)) {
1513            ERROR("Device filter specified and peer does not have the "
1514                  "connect_device_version capability\n");
1515            goto error;
1516        }
1517
1518        if (usbredirfilter_check(
1519                dev->filter_rules,
1520                dev->filter_rules_count,
1521                dev->device_info.device_class,
1522                dev->device_info.device_subclass,
1523                dev->device_info.device_protocol,
1524                dev->interface_info.interface_class,
1525                dev->interface_info.interface_subclass,
1526                dev->interface_info.interface_protocol,
1527                dev->interface_info.interface_count,
1528                dev->device_info.vendor_id,
1529                dev->device_info.product_id,
1530                dev->device_info.device_version_bcd,
1531                0) != 0) {
1532            goto error;
1533        }
1534    }
1535
1536    return 0;
1537
1538error:
1539    usbredir_reject_device(dev);
1540    return -1;
1541}
1542
1543static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
1544{
1545    int i, j, quirks;
1546
1547    if (!usbredirparser_peer_has_cap(dev->parser,
1548                                     usb_redir_cap_bulk_receiving)) {
1549        return;
1550    }
1551
1552    for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
1553        dev->endpoint[i].bulk_receiving_enabled = 0;
1554    }
1555
1556    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1557        return;
1558    }
1559
1560    for (i = 0; i < dev->interface_info.interface_count; i++) {
1561        quirks = usb_get_quirks(dev->device_info.vendor_id,
1562                                dev->device_info.product_id,
1563                                dev->interface_info.interface_class[i],
1564                                dev->interface_info.interface_subclass[i],
1565                                dev->interface_info.interface_protocol[i]);
1566        if (!(quirks & USB_QUIRK_BUFFER_BULK_IN)) {
1567            continue;
1568        }
1569        if (quirks & USB_QUIRK_IS_FTDI) {
1570            dev->buffered_bulk_in_complete =
1571                usbredir_buffered_bulk_in_complete_ftdi;
1572        } else {
1573            dev->buffered_bulk_in_complete =
1574                usbredir_buffered_bulk_in_complete_raw;
1575        }
1576
1577        for (j = EP2I(USB_DIR_IN); j < MAX_ENDPOINTS; j++) {
1578            if (dev->endpoint[j].interface ==
1579                                    dev->interface_info.interface[i] &&
1580                    dev->endpoint[j].type == USB_ENDPOINT_XFER_BULK &&
1581                    dev->endpoint[j].max_packet_size != 0) {
1582                dev->endpoint[j].bulk_receiving_enabled = 1;
1583                /*
1584                 * With buffering pipelining is not necessary. Also packet
1585                 * combining and bulk in buffering don't play nice together!
1586                 */
1587                I2USBEP(dev, j)->pipeline = false;
1588                break; /* Only buffer for the first ep of each intf */
1589            }
1590        }
1591    }
1592}
1593
1594/*
1595 * usbredirparser packet complete callbacks
1596 */
1597
1598static void usbredir_handle_status(USBRedirDevice *dev, USBPacket *p,
1599    int status)
1600{
1601    switch (status) {
1602    case usb_redir_success:
1603        p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */
1604        break;
1605    case usb_redir_stall:
1606        p->status = USB_RET_STALL;
1607        break;
1608    case usb_redir_cancelled:
1609        /*
1610         * When the usbredir-host unredirects a device, it will report a status
1611         * of cancelled for all pending packets, followed by a disconnect msg.
1612         */
1613        p->status = USB_RET_IOERROR;
1614        break;
1615    case usb_redir_inval:
1616        WARNING("got invalid param error from usb-host?\n");
1617        p->status = USB_RET_IOERROR;
1618        break;
1619    case usb_redir_babble:
1620        p->status = USB_RET_BABBLE;
1621        break;
1622    case usb_redir_ioerror:
1623    case usb_redir_timeout:
1624    default:
1625        p->status = USB_RET_IOERROR;
1626    }
1627}
1628
1629static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1630{
1631    USBRedirDevice *dev = priv;
1632
1633    /* Try to send the filter info now that we've the usb-host's caps */
1634    if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1635            dev->filter_rules) {
1636        usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1637                                          dev->filter_rules_count);
1638        usbredirparser_do_write(dev->parser);
1639    }
1640}
1641
1642static void usbredir_device_connect(void *priv,
1643    struct usb_redir_device_connect_header *device_connect)
1644{
1645    USBRedirDevice *dev = priv;
1646    const char *speed;
1647
1648    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1649        ERROR("Received device connect while already connected\n");
1650        return;
1651    }
1652
1653    switch (device_connect->speed) {
1654    case usb_redir_speed_low:
1655        speed = "low speed";
1656        dev->dev.speed = USB_SPEED_LOW;
1657        dev->compatible_speedmask &= ~USB_SPEED_MASK_FULL;
1658        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1659        break;
1660    case usb_redir_speed_full:
1661        speed = "full speed";
1662        dev->dev.speed = USB_SPEED_FULL;
1663        dev->compatible_speedmask &= ~USB_SPEED_MASK_HIGH;
1664        break;
1665    case usb_redir_speed_high:
1666        speed = "high speed";
1667        dev->dev.speed = USB_SPEED_HIGH;
1668        break;
1669    case usb_redir_speed_super:
1670        speed = "super speed";
1671        dev->dev.speed = USB_SPEED_SUPER;
1672        break;
1673    default:
1674        speed = "unknown speed";
1675        dev->dev.speed = USB_SPEED_FULL;
1676    }
1677
1678    if (usbredirparser_peer_has_cap(dev->parser,
1679                                    usb_redir_cap_connect_device_version)) {
1680        INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1681             speed, device_connect->vendor_id, device_connect->product_id,
1682             ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1683             ((device_connect->device_version_bcd & 0x0f00) >>  8),
1684             ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1685             ((device_connect->device_version_bcd & 0x000f) >>  0),
1686             device_connect->device_class);
1687    } else {
1688        INFO("attaching %s device %04x:%04x class %02x\n", speed,
1689             device_connect->vendor_id, device_connect->product_id,
1690             device_connect->device_class);
1691    }
1692
1693    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1694    dev->device_info = *device_connect;
1695
1696    if (usbredir_check_filter(dev)) {
1697        WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1698                device_connect->vendor_id, device_connect->product_id);
1699        return;
1700    }
1701
1702    usbredir_check_bulk_receiving(dev);
1703    timer_mod(dev->attach_timer, dev->next_attach_time);
1704}
1705
1706static void usbredir_device_disconnect(void *priv)
1707{
1708    USBRedirDevice *dev = priv;
1709
1710    /* Stop any pending attaches */
1711    timer_del(dev->attach_timer);
1712
1713    if (dev->dev.attached) {
1714        DPRINTF("detaching device\n");
1715        usb_device_detach(&dev->dev);
1716        /*
1717         * Delay next usb device attach to give the guest a chance to see
1718         * see the detach / attach in case of quick close / open succession
1719         */
1720        dev->next_attach_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 200;
1721    }
1722
1723    /* Reset state so that the next dev connected starts with a clean slate */
1724    usbredir_cleanup_device_queues(dev);
1725    usbredir_init_endpoints(dev);
1726    dev->interface_info.interface_count = NO_INTERFACE_INFO;
1727    dev->dev.addr = 0;
1728    dev->dev.speed = 0;
1729    dev->compatible_speedmask = USB_SPEED_MASK_FULL | USB_SPEED_MASK_HIGH;
1730}
1731
1732static void usbredir_interface_info(void *priv,
1733    struct usb_redir_interface_info_header *interface_info)
1734{
1735    USBRedirDevice *dev = priv;
1736
1737    dev->interface_info = *interface_info;
1738
1739    /*
1740     * If we receive interface info after the device has already been
1741     * connected (ie on a set_config), re-check interface dependent things.
1742     */
1743    if (timer_pending(dev->attach_timer) || dev->dev.attached) {
1744        usbredir_check_bulk_receiving(dev);
1745        if (usbredir_check_filter(dev)) {
1746            ERROR("Device no longer matches filter after interface info "
1747                  "change, disconnecting!\n");
1748        }
1749    }
1750}
1751
1752static void usbredir_mark_speed_incompatible(USBRedirDevice *dev, int speed)
1753{
1754    dev->compatible_speedmask &= ~(1 << speed);
1755    dev->dev.speedmask = (1 << dev->dev.speed) | dev->compatible_speedmask;
1756}
1757
1758static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1759{
1760    if (uep->type != USB_ENDPOINT_XFER_BULK) {
1761        return;
1762    }
1763    if (uep->pid == USB_TOKEN_OUT) {
1764        uep->pipeline = true;
1765    }
1766    if (uep->pid == USB_TOKEN_IN && uep->max_packet_size != 0 &&
1767        usbredirparser_peer_has_cap(dev->parser,
1768                                    usb_redir_cap_32bits_bulk_length)) {
1769        uep->pipeline = true;
1770    }
1771}
1772
1773static void usbredir_setup_usb_eps(USBRedirDevice *dev)
1774{
1775    struct USBEndpoint *usb_ep;
1776    int i;
1777
1778    for (i = 0; i < MAX_ENDPOINTS; i++) {
1779        usb_ep = I2USBEP(dev, i);
1780        usb_ep->type = dev->endpoint[i].type;
1781        usb_ep->ifnum = dev->endpoint[i].interface;
1782        usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1783        usb_ep->max_streams = dev->endpoint[i].max_streams;
1784        usbredir_set_pipeline(dev, usb_ep);
1785    }
1786}
1787
1788static void usbredir_ep_info(void *priv,
1789    struct usb_redir_ep_info_header *ep_info)
1790{
1791    USBRedirDevice *dev = priv;
1792    int i;
1793
1794    assert(dev != NULL);
1795    for (i = 0; i < MAX_ENDPOINTS; i++) {
1796        dev->endpoint[i].type = ep_info->type[i];
1797        dev->endpoint[i].interval = ep_info->interval[i];
1798        dev->endpoint[i].interface = ep_info->interface[i];
1799        if (usbredirparser_peer_has_cap(dev->parser,
1800                                     usb_redir_cap_ep_info_max_packet_size)) {
1801            dev->endpoint[i].max_packet_size = ep_info->max_packet_size[i];
1802        }
1803#if USBREDIR_VERSION >= 0x000700
1804        if (usbredirparser_peer_has_cap(dev->parser,
1805                                        usb_redir_cap_bulk_streams)) {
1806            dev->endpoint[i].max_streams = ep_info->max_streams[i];
1807        }
1808#endif
1809        switch (dev->endpoint[i].type) {
1810        case usb_redir_type_invalid:
1811            break;
1812        case usb_redir_type_iso:
1813            usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1814            usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1815            /* Fall through */
1816        case usb_redir_type_interrupt:
1817            if (!usbredirparser_peer_has_cap(dev->parser,
1818                                     usb_redir_cap_ep_info_max_packet_size) ||
1819                    ep_info->max_packet_size[i] > 64) {
1820                usbredir_mark_speed_incompatible(dev, USB_SPEED_FULL);
1821            }
1822            if (!usbredirparser_peer_has_cap(dev->parser,
1823                                     usb_redir_cap_ep_info_max_packet_size) ||
1824                    ep_info->max_packet_size[i] > 1024) {
1825                usbredir_mark_speed_incompatible(dev, USB_SPEED_HIGH);
1826            }
1827            if (dev->endpoint[i].interval == 0) {
1828                ERROR("Received 0 interval for isoc or irq endpoint\n");
1829                usbredir_reject_device(dev);
1830                return;
1831            }
1832            /* Fall through */
1833        case usb_redir_type_control:
1834        case usb_redir_type_bulk:
1835            DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1836                    dev->endpoint[i].type, dev->endpoint[i].interface);
1837            break;
1838        default:
1839            ERROR("Received invalid endpoint type\n");
1840            usbredir_reject_device(dev);
1841            return;
1842        }
1843    }
1844    /* The new ep info may have caused a speed incompatibility, recheck */
1845    if (dev->dev.attached &&
1846            !(dev->dev.port->speedmask & dev->dev.speedmask)) {
1847        ERROR("Device no longer matches speed after endpoint info change, "
1848              "disconnecting!\n");
1849        usbredir_reject_device(dev);
1850        return;
1851    }
1852    usbredir_setup_usb_eps(dev);
1853    usbredir_check_bulk_receiving(dev);
1854}
1855
1856static void usbredir_configuration_status(void *priv, uint64_t id,
1857    struct usb_redir_configuration_status_header *config_status)
1858{
1859    USBRedirDevice *dev = priv;
1860    USBPacket *p;
1861
1862    DPRINTF("set config status %d config %d id %"PRIu64"\n",
1863            config_status->status, config_status->configuration, id);
1864
1865    p = usbredir_find_packet_by_id(dev, 0, id);
1866    if (p) {
1867        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1868            dev->dev.data_buf[0] = config_status->configuration;
1869            p->actual_length = 1;
1870        }
1871        usbredir_handle_status(dev, p, config_status->status);
1872        usb_generic_async_ctrl_complete(&dev->dev, p);
1873    }
1874}
1875
1876static void usbredir_alt_setting_status(void *priv, uint64_t id,
1877    struct usb_redir_alt_setting_status_header *alt_setting_status)
1878{
1879    USBRedirDevice *dev = priv;
1880    USBPacket *p;
1881
1882    DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1883            alt_setting_status->status, alt_setting_status->interface,
1884            alt_setting_status->alt, id);
1885
1886    p = usbredir_find_packet_by_id(dev, 0, id);
1887    if (p) {
1888        if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1889            dev->dev.data_buf[0] = alt_setting_status->alt;
1890            p->actual_length = 1;
1891        }
1892        usbredir_handle_status(dev, p, alt_setting_status->status);
1893        usb_generic_async_ctrl_complete(&dev->dev, p);
1894    }
1895}
1896
1897static void usbredir_iso_stream_status(void *priv, uint64_t id,
1898    struct usb_redir_iso_stream_status_header *iso_stream_status)
1899{
1900    USBRedirDevice *dev = priv;
1901    uint8_t ep = iso_stream_status->endpoint;
1902
1903    DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1904            ep, id);
1905
1906    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1907        return;
1908    }
1909
1910    dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1911    if (iso_stream_status->status == usb_redir_stall) {
1912        DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1913        dev->endpoint[EP2I(ep)].iso_started = 0;
1914    }
1915}
1916
1917static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1918    struct usb_redir_interrupt_receiving_status_header
1919    *interrupt_receiving_status)
1920{
1921    USBRedirDevice *dev = priv;
1922    uint8_t ep = interrupt_receiving_status->endpoint;
1923
1924    DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1925            interrupt_receiving_status->status, ep, id);
1926
1927    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1928        return;
1929    }
1930
1931    dev->endpoint[EP2I(ep)].interrupt_error =
1932        interrupt_receiving_status->status;
1933    if (interrupt_receiving_status->status == usb_redir_stall) {
1934        DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1935        dev->endpoint[EP2I(ep)].interrupt_started = 0;
1936    }
1937}
1938
1939static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1940    struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1941{
1942#if USBREDIR_VERSION >= 0x000700
1943    USBRedirDevice *dev = priv;
1944
1945    if (bulk_streams_status->status == usb_redir_success) {
1946        DPRINTF("bulk streams status %d eps %08x\n",
1947                bulk_streams_status->status, bulk_streams_status->endpoints);
1948    } else {
1949        ERROR("bulk streams %s failed status %d eps %08x\n",
1950              (bulk_streams_status->no_streams == 0) ? "free" : "alloc",
1951              bulk_streams_status->status, bulk_streams_status->endpoints);
1952        ERROR("usb-redir-host does not provide streams, disconnecting\n");
1953        usbredir_reject_device(dev);
1954    }
1955#endif
1956}
1957
1958static void usbredir_bulk_receiving_status(void *priv, uint64_t id,
1959    struct usb_redir_bulk_receiving_status_header *bulk_receiving_status)
1960{
1961    USBRedirDevice *dev = priv;
1962    uint8_t ep = bulk_receiving_status->endpoint;
1963
1964    DPRINTF("bulk recv status %d ep %02X id %"PRIu64"\n",
1965            bulk_receiving_status->status, ep, id);
1966
1967    if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].bulk_receiving_started) {
1968        return;
1969    }
1970
1971    if (bulk_receiving_status->status == usb_redir_stall) {
1972        DPRINTF("bulk receiving stopped by peer ep %02X\n", ep);
1973        dev->endpoint[EP2I(ep)].bulk_receiving_started = 0;
1974    }
1975}
1976
1977static void usbredir_control_packet(void *priv, uint64_t id,
1978    struct usb_redir_control_packet_header *control_packet,
1979    uint8_t *data, int data_len)
1980{
1981    USBRedirDevice *dev = priv;
1982    USBPacket *p;
1983    int len = control_packet->length;
1984
1985    DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1986            len, id);
1987
1988    /* Fix up USB-3 ep0 maxpacket size to allow superspeed connected devices
1989     * to work redirected to a not superspeed capable hcd */
1990    if (dev->dev.speed == USB_SPEED_SUPER &&
1991            !((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER)) &&
1992            control_packet->requesttype == 0x80 &&
1993            control_packet->request == 6 &&
1994            control_packet->value == 0x100 && control_packet->index == 0 &&
1995            data_len >= 18 && data[7] == 9) {
1996        data[7] = 64;
1997    }
1998
1999    p = usbredir_find_packet_by_id(dev, 0, id);
2000    if (p) {
2001        usbredir_handle_status(dev, p, control_packet->status);
2002        if (data_len > 0) {
2003            usbredir_log_data(dev, "ctrl data in:", data, data_len);
2004            if (data_len > sizeof(dev->dev.data_buf)) {
2005                ERROR("ctrl buffer too small (%d > %zu)\n",
2006                      data_len, sizeof(dev->dev.data_buf));
2007                p->status = USB_RET_STALL;
2008                data_len = len = sizeof(dev->dev.data_buf);
2009            }
2010            memcpy(dev->dev.data_buf, data, data_len);
2011        }
2012        p->actual_length = len;
2013        /*
2014         * If this is GET_DESCRIPTOR request for configuration descriptor,
2015         * remove 'remote wakeup' flag from it to prevent idle power down
2016         * in Windows guest
2017         */
2018        if (dev->suppress_remote_wake &&
2019            control_packet->requesttype == USB_DIR_IN &&
2020            control_packet->request == USB_REQ_GET_DESCRIPTOR &&
2021            control_packet->value == (USB_DT_CONFIG << 8) &&
2022            control_packet->index == 0 &&
2023            /* bmAttributes field of config descriptor */
2024            len > 7 && (dev->dev.data_buf[7] & USB_CFG_ATT_WAKEUP)) {
2025                DPRINTF("Removed remote wake %04X:%04X\n",
2026                    dev->device_info.vendor_id,
2027                    dev->device_info.product_id);
2028                dev->dev.data_buf[7] &= ~USB_CFG_ATT_WAKEUP;
2029            }
2030        usb_generic_async_ctrl_complete(&dev->dev, p);
2031    }
2032    free(data);
2033}
2034
2035static void usbredir_bulk_packet(void *priv, uint64_t id,
2036    struct usb_redir_bulk_packet_header *bulk_packet,
2037    uint8_t *data, int data_len)
2038{
2039    USBRedirDevice *dev = priv;
2040    uint8_t ep = bulk_packet->endpoint;
2041    int len = (bulk_packet->length_high << 16) | bulk_packet->length;
2042    USBPacket *p;
2043
2044    DPRINTF("bulk-in status %d ep %02X stream %u len %d id %"PRIu64"\n",
2045            bulk_packet->status, ep, bulk_packet->stream_id, len, id);
2046
2047    p = usbredir_find_packet_by_id(dev, ep, id);
2048    if (p) {
2049        size_t size = usb_packet_size(p);
2050        usbredir_handle_status(dev, p, bulk_packet->status);
2051        if (data_len > 0) {
2052            usbredir_log_data(dev, "bulk data in:", data, data_len);
2053            if (data_len > size) {
2054                ERROR("bulk got more data then requested (%d > %zd)\n",
2055                      data_len, p->iov.size);
2056                p->status = USB_RET_BABBLE;
2057                data_len = len = size;
2058            }
2059            usb_packet_copy(p, data, data_len);
2060        }
2061        p->actual_length = len;
2062        if (p->pid == USB_TOKEN_IN && p->ep->pipeline) {
2063            usb_combined_input_packet_complete(&dev->dev, p);
2064        } else {
2065            usb_packet_complete(&dev->dev, p);
2066        }
2067    }
2068    free(data);
2069}
2070
2071static void usbredir_iso_packet(void *priv, uint64_t id,
2072    struct usb_redir_iso_packet_header *iso_packet,
2073    uint8_t *data, int data_len)
2074{
2075    USBRedirDevice *dev = priv;
2076    uint8_t ep = iso_packet->endpoint;
2077
2078    DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
2079             iso_packet->status, ep, data_len, id);
2080
2081    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
2082        ERROR("received iso packet for non iso endpoint %02X\n", ep);
2083        free(data);
2084        return;
2085    }
2086
2087    if (dev->endpoint[EP2I(ep)].iso_started == 0) {
2088        DPRINTF("received iso packet for non started stream ep %02X\n", ep);
2089        free(data);
2090        return;
2091    }
2092
2093    /* bufp_alloc also adds the packet to the ep queue */
2094    bufp_alloc(dev, data, data_len, iso_packet->status, ep, data);
2095}
2096
2097static void usbredir_interrupt_packet(void *priv, uint64_t id,
2098    struct usb_redir_interrupt_packet_header *interrupt_packet,
2099    uint8_t *data, int data_len)
2100{
2101    USBRedirDevice *dev = priv;
2102    uint8_t ep = interrupt_packet->endpoint;
2103
2104    DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
2105            interrupt_packet->status, ep, data_len, id);
2106
2107    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
2108        ERROR("received int packet for non interrupt endpoint %02X\n", ep);
2109        free(data);
2110        return;
2111    }
2112
2113    if (ep & USB_DIR_IN) {
2114        if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
2115            DPRINTF("received int packet while not started ep %02X\n", ep);
2116            free(data);
2117            return;
2118        }
2119
2120        /* bufp_alloc also adds the packet to the ep queue */
2121        bufp_alloc(dev, data, data_len, interrupt_packet->status, ep, data);
2122
2123        /* insufficient data solved with USB_RET_NAK */
2124        usb_wakeup(usb_ep_get(&dev->dev, USB_TOKEN_IN, ep & 0x0f), 0);
2125    } else {
2126        /*
2127         * We report output interrupt packets as completed directly upon
2128         * submission, so all we can do here if one failed is warn.
2129         */
2130        if (interrupt_packet->status) {
2131            WARNING("interrupt output failed status %d ep %02X id %"PRIu64"\n",
2132                    interrupt_packet->status, ep, id);
2133        }
2134    }
2135}
2136
2137static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
2138    struct usb_redir_buffered_bulk_packet_header *buffered_bulk_packet,
2139    uint8_t *data, int data_len)
2140{
2141    USBRedirDevice *dev = priv;
2142    uint8_t status, ep = buffered_bulk_packet->endpoint;
2143    void *free_on_destroy;
2144    int i, len;
2145
2146    DPRINTF("buffered-bulk-in status %d ep %02X len %d id %"PRIu64"\n",
2147            buffered_bulk_packet->status, ep, data_len, id);
2148
2149    if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_BULK) {
2150        ERROR("received buffered-bulk packet for non bulk ep %02X\n", ep);
2151        free(data);
2152        return;
2153    }
2154
2155    if (dev->endpoint[EP2I(ep)].bulk_receiving_started == 0) {
2156        DPRINTF("received buffered-bulk packet on not started ep %02X\n", ep);
2157        free(data);
2158        return;
2159    }
2160
2161    /* Data must be in maxp chunks for buffered_bulk_add_*_data_to_packet */
2162    len = dev->endpoint[EP2I(ep)].max_packet_size;
2163    status = usb_redir_success;
2164    free_on_destroy = NULL;
2165    for (i = 0; i < data_len; i += len) {
2166        int r;
2167        if (len >= (data_len - i)) {
2168            len = data_len - i;
2169            status = buffered_bulk_packet->status;
2170            free_on_destroy = data;
2171        }
2172        /* bufp_alloc also adds the packet to the ep queue */
2173        r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
2174        if (r) {
2175            break;
2176        }
2177    }
2178
2179    if (dev->endpoint[EP2I(ep)].pending_async_packet) {
2180        USBPacket *p = dev->endpoint[EP2I(ep)].pending_async_packet;
2181        dev->endpoint[EP2I(ep)].pending_async_packet = NULL;
2182        usbredir_buffered_bulk_in_complete(dev, p, ep);
2183        usb_packet_complete(&dev->dev, p);
2184    }
2185}
2186
2187/*
2188 * Migration code
2189 */
2190
2191static int usbredir_pre_save(void *priv)
2192{
2193    USBRedirDevice *dev = priv;
2194
2195    usbredir_fill_already_in_flight(dev);
2196
2197    return 0;
2198}
2199
2200static int usbredir_post_load(void *priv, int version_id)
2201{
2202    USBRedirDevice *dev = priv;
2203
2204    if (dev == NULL || dev->parser == NULL) {
2205        return 0;
2206    }
2207
2208    switch (dev->device_info.speed) {
2209    case usb_redir_speed_low:
2210        dev->dev.speed = USB_SPEED_LOW;
2211        break;
2212    case usb_redir_speed_full:
2213        dev->dev.speed = USB_SPEED_FULL;
2214        break;
2215    case usb_redir_speed_high:
2216        dev->dev.speed = USB_SPEED_HIGH;
2217        break;
2218    case usb_redir_speed_super:
2219        dev->dev.speed = USB_SPEED_SUPER;
2220        break;
2221    default:
2222        dev->dev.speed = USB_SPEED_FULL;
2223    }
2224    dev->dev.speedmask = (1 << dev->dev.speed);
2225
2226    usbredir_setup_usb_eps(dev);
2227    usbredir_check_bulk_receiving(dev);
2228
2229    return 0;
2230}
2231
2232/* For usbredirparser migration */
2233static int usbredir_put_parser(QEMUFile *f, void *priv, size_t unused,
2234                               const VMStateField *field, JSONWriter *vmdesc)
2235{
2236    USBRedirDevice *dev = priv;
2237    uint8_t *data;
2238    int len;
2239
2240    if (dev->parser == NULL) {
2241        qemu_put_be32(f, 0);
2242        return 0;
2243    }
2244
2245    usbredirparser_serialize(dev->parser, &data, &len);
2246    if (!data) {
2247        error_report("usbredirparser_serialize failed");
2248        exit(1);
2249    }
2250
2251    qemu_put_be32(f, len);
2252    qemu_put_buffer(f, data, len);
2253
2254    free(data);
2255
2256    return 0;
2257}
2258
2259static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused,
2260                               const VMStateField *field)
2261{
2262    USBRedirDevice *dev = priv;
2263    uint8_t *data;
2264    int len, ret;
2265
2266    len = qemu_get_be32(f);
2267    if (len == 0) {
2268        return 0;
2269    }
2270
2271    /*
2272     * If our chardev is not open already at this point the usbredir connection
2273     * has been broken (non seamless migration, or restore from disk).
2274     *
2275     * In this case create a temporary parser to receive the migration data,
2276     * and schedule the close_bh to report the device as disconnected to the
2277     * guest and to destroy the parser again.
2278     */
2279    if (dev->parser == NULL) {
2280        WARNING("usb-redir connection broken during migration\n");
2281        usbredir_create_parser(dev);
2282        qemu_bh_schedule(dev->chardev_close_bh);
2283    }
2284
2285    data = g_malloc(len);
2286    qemu_get_buffer(f, data, len);
2287
2288    ret = usbredirparser_unserialize(dev->parser, data, len);
2289
2290    g_free(data);
2291
2292    return ret;
2293}
2294
2295static const VMStateInfo usbredir_parser_vmstate_info = {
2296    .name = "usb-redir-parser",
2297    .put  = usbredir_put_parser,
2298    .get  = usbredir_get_parser,
2299};
2300
2301
2302/* For buffered packets (iso/irq) queue migration */
2303static int usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused,
2304                              const VMStateField *field, JSONWriter *vmdesc)
2305{
2306    struct endp_data *endp = priv;
2307    USBRedirDevice *dev = endp->dev;
2308    struct buf_packet *bufp;
2309    int len, i = 0;
2310
2311    qemu_put_be32(f, endp->bufpq_size);
2312    QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
2313        len = bufp->len - bufp->offset;
2314        DPRINTF("put_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2315                len, bufp->status);
2316        qemu_put_be32(f, len);
2317        qemu_put_be32(f, bufp->status);
2318        qemu_put_buffer(f, bufp->data + bufp->offset, len);
2319        i++;
2320    }
2321    assert(i == endp->bufpq_size);
2322
2323    return 0;
2324}
2325
2326static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused,
2327                              const VMStateField *field)
2328{
2329    struct endp_data *endp = priv;
2330    USBRedirDevice *dev = endp->dev;
2331    struct buf_packet *bufp;
2332    int i;
2333
2334    endp->bufpq_size = qemu_get_be32(f);
2335    for (i = 0; i < endp->bufpq_size; i++) {
2336        bufp = g_new(struct buf_packet, 1);
2337        bufp->len = qemu_get_be32(f);
2338        bufp->status = qemu_get_be32(f);
2339        bufp->offset = 0;
2340        bufp->data = malloc(bufp->len); /* regular malloc! */
2341        if (!bufp->data) {
2342            error_report("usbredir_get_bufpq: out of memory");
2343            exit(1);
2344        }
2345        bufp->free_on_destroy = bufp->data;
2346        qemu_get_buffer(f, bufp->data, bufp->len);
2347        QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
2348        DPRINTF("get_bufpq %d/%d len %d status %d\n", i + 1, endp->bufpq_size,
2349                bufp->len, bufp->status);
2350    }
2351    return 0;
2352}
2353
2354static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
2355    .name = "usb-redir-bufpq",
2356    .put  = usbredir_put_bufpq,
2357    .get  = usbredir_get_bufpq,
2358};
2359
2360
2361/* For endp_data migration */
2362static bool usbredir_bulk_receiving_needed(void *priv)
2363{
2364    struct endp_data *endp = priv;
2365
2366    return endp->bulk_receiving_started;
2367}
2368
2369static const VMStateDescription usbredir_bulk_receiving_vmstate = {
2370    .name = "usb-redir-ep/bulk-receiving",
2371    .version_id = 1,
2372    .minimum_version_id = 1,
2373    .needed = usbredir_bulk_receiving_needed,
2374    .fields = (VMStateField[]) {
2375        VMSTATE_UINT8(bulk_receiving_started, struct endp_data),
2376        VMSTATE_END_OF_LIST()
2377    }
2378};
2379
2380static bool usbredir_stream_needed(void *priv)
2381{
2382    struct endp_data *endp = priv;
2383
2384    return endp->max_streams;
2385}
2386
2387static const VMStateDescription usbredir_stream_vmstate = {
2388    .name = "usb-redir-ep/stream-state",
2389    .version_id = 1,
2390    .minimum_version_id = 1,
2391    .needed = usbredir_stream_needed,
2392    .fields = (VMStateField[]) {
2393        VMSTATE_UINT32(max_streams, struct endp_data),
2394        VMSTATE_END_OF_LIST()
2395    }
2396};
2397
2398static const VMStateDescription usbredir_ep_vmstate = {
2399    .name = "usb-redir-ep",
2400    .version_id = 1,
2401    .minimum_version_id = 1,
2402    .fields = (VMStateField[]) {
2403        VMSTATE_UINT8(type, struct endp_data),
2404        VMSTATE_UINT8(interval, struct endp_data),
2405        VMSTATE_UINT8(interface, struct endp_data),
2406        VMSTATE_UINT16(max_packet_size, struct endp_data),
2407        VMSTATE_UINT8(iso_started, struct endp_data),
2408        VMSTATE_UINT8(iso_error, struct endp_data),
2409        VMSTATE_UINT8(interrupt_started, struct endp_data),
2410        VMSTATE_UINT8(interrupt_error, struct endp_data),
2411        VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
2412        VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
2413        {
2414            .name         = "bufpq",
2415            .version_id   = 0,
2416            .field_exists = NULL,
2417            .size         = 0,
2418            .info         = &usbredir_ep_bufpq_vmstate_info,
2419            .flags        = VMS_SINGLE,
2420            .offset       = 0,
2421        },
2422        VMSTATE_INT32(bufpq_target_size, struct endp_data),
2423        VMSTATE_END_OF_LIST()
2424    },
2425    .subsections = (const VMStateDescription*[]) {
2426        &usbredir_bulk_receiving_vmstate,
2427        &usbredir_stream_vmstate,
2428        NULL
2429    }
2430};
2431
2432
2433/* For PacketIdQueue migration */
2434static int usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2435                                    const VMStateField *field,
2436                                    JSONWriter *vmdesc)
2437{
2438    struct PacketIdQueue *q = priv;
2439    USBRedirDevice *dev = q->dev;
2440    struct PacketIdQueueEntry *e;
2441    int remain = q->size;
2442
2443    DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
2444    qemu_put_be32(f, q->size);
2445    QTAILQ_FOREACH(e, &q->head, next) {
2446        qemu_put_be64(f, e->id);
2447        remain--;
2448    }
2449    assert(remain == 0);
2450
2451    return 0;
2452}
2453
2454static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused,
2455                                    const VMStateField *field)
2456{
2457    struct PacketIdQueue *q = priv;
2458    USBRedirDevice *dev = q->dev;
2459    int i, size;
2460    uint64_t id;
2461
2462    size = qemu_get_be32(f);
2463    DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
2464    for (i = 0; i < size; i++) {
2465        id = qemu_get_be64(f);
2466        packet_id_queue_add(q, id);
2467    }
2468    assert(q->size == size);
2469    return 0;
2470}
2471
2472static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
2473    .name = "usb-redir-packet-id-q",
2474    .put  = usbredir_put_packet_id_q,
2475    .get  = usbredir_get_packet_id_q,
2476};
2477
2478static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
2479    .name = "usb-redir-packet-id-queue",
2480    .version_id = 1,
2481    .minimum_version_id = 1,
2482    .fields = (VMStateField[]) {
2483        {
2484            .name         = "queue",
2485            .version_id   = 0,
2486            .field_exists = NULL,
2487            .size         = 0,
2488            .info         = &usbredir_ep_packet_id_q_vmstate_info,
2489            .flags        = VMS_SINGLE,
2490            .offset       = 0,
2491        },
2492        VMSTATE_END_OF_LIST()
2493    }
2494};
2495
2496
2497/* For usb_redir_device_connect_header migration */
2498static const VMStateDescription usbredir_device_info_vmstate = {
2499    .name = "usb-redir-device-info",
2500    .version_id = 1,
2501    .minimum_version_id = 1,
2502    .fields = (VMStateField[]) {
2503        VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
2504        VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
2505        VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
2506        VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
2507        VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
2508        VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
2509        VMSTATE_UINT16(device_version_bcd,
2510                       struct usb_redir_device_connect_header),
2511        VMSTATE_END_OF_LIST()
2512    }
2513};
2514
2515
2516/* For usb_redir_interface_info_header migration */
2517static const VMStateDescription usbredir_interface_info_vmstate = {
2518    .name = "usb-redir-interface-info",
2519    .version_id = 1,
2520    .minimum_version_id = 1,
2521    .fields = (VMStateField[]) {
2522        VMSTATE_UINT32(interface_count,
2523                       struct usb_redir_interface_info_header),
2524        VMSTATE_UINT8_ARRAY(interface,
2525                            struct usb_redir_interface_info_header, 32),
2526        VMSTATE_UINT8_ARRAY(interface_class,
2527                            struct usb_redir_interface_info_header, 32),
2528        VMSTATE_UINT8_ARRAY(interface_subclass,
2529                            struct usb_redir_interface_info_header, 32),
2530        VMSTATE_UINT8_ARRAY(interface_protocol,
2531                            struct usb_redir_interface_info_header, 32),
2532        VMSTATE_END_OF_LIST()
2533    }
2534};
2535
2536
2537/* And finally the USBRedirDevice vmstate itself */
2538static const VMStateDescription usbredir_vmstate = {
2539    .name = "usb-redir",
2540    .version_id = 1,
2541    .minimum_version_id = 1,
2542    .pre_save = usbredir_pre_save,
2543    .post_load = usbredir_post_load,
2544    .fields = (VMStateField[]) {
2545        VMSTATE_USB_DEVICE(dev, USBRedirDevice),
2546        VMSTATE_TIMER_PTR(attach_timer, USBRedirDevice),
2547        {
2548            .name         = "parser",
2549            .version_id   = 0,
2550            .field_exists = NULL,
2551            .size         = 0,
2552            .info         = &usbredir_parser_vmstate_info,
2553            .flags        = VMS_SINGLE,
2554            .offset       = 0,
2555        },
2556        VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
2557                             usbredir_ep_vmstate, struct endp_data),
2558        VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
2559                       usbredir_ep_packet_id_queue_vmstate,
2560                       struct PacketIdQueue),
2561        VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
2562                       usbredir_ep_packet_id_queue_vmstate,
2563                       struct PacketIdQueue),
2564        VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
2565                       usbredir_device_info_vmstate,
2566                       struct usb_redir_device_connect_header),
2567        VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
2568                       usbredir_interface_info_vmstate,
2569                       struct usb_redir_interface_info_header),
2570        VMSTATE_END_OF_LIST()
2571    }
2572};
2573
2574static Property usbredir_properties[] = {
2575    DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
2576    DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, usbredirparser_warning),
2577    DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
2578    DEFINE_PROP_BOOL("streams", USBRedirDevice, enable_streams, true),
2579    DEFINE_PROP_BOOL("suppress-remote-wake", USBRedirDevice,
2580                     suppress_remote_wake, true),
2581    DEFINE_PROP_END_OF_LIST(),
2582};
2583
2584static void usbredir_class_initfn(ObjectClass *klass, void *data)
2585{
2586    USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
2587    DeviceClass *dc = DEVICE_CLASS(klass);
2588
2589    uc->realize        = usbredir_realize;
2590    uc->product_desc   = "USB Redirection Device";
2591    uc->unrealize      = usbredir_unrealize;
2592    uc->cancel_packet  = usbredir_cancel_packet;
2593    uc->handle_reset   = usbredir_handle_reset;
2594    uc->handle_data    = usbredir_handle_data;
2595    uc->handle_control = usbredir_handle_control;
2596    uc->flush_ep_queue = usbredir_flush_ep_queue;
2597    uc->ep_stopped     = usbredir_ep_stopped;
2598    uc->alloc_streams  = usbredir_alloc_streams;
2599    uc->free_streams   = usbredir_free_streams;
2600    dc->vmsd           = &usbredir_vmstate;
2601    device_class_set_props(dc, usbredir_properties);
2602    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
2603}
2604
2605static void usbredir_instance_init(Object *obj)
2606{
2607    USBDevice *udev = USB_DEVICE(obj);
2608    USBRedirDevice *dev = USB_REDIRECT(udev);
2609
2610    device_add_bootindex_property(obj, &dev->bootindex,
2611                                  "bootindex", NULL,
2612                                  &udev->qdev);
2613}
2614
2615static const TypeInfo usbredir_dev_info = {
2616    .name          = TYPE_USB_REDIR,
2617    .parent        = TYPE_USB_DEVICE,
2618    .instance_size = sizeof(USBRedirDevice),
2619    .class_init    = usbredir_class_initfn,
2620    .instance_init = usbredir_instance_init,
2621};
2622module_obj(TYPE_USB_REDIR);
2623module_kconfig(USB);
2624
2625static void usbredir_register_types(void)
2626{
2627    type_register_static(&usbredir_dev_info);
2628}
2629
2630type_init(usbredir_register_types)
2631