1 /* 2 * UAS (USB Attached SCSI) emulation 3 * 4 * Copyright Red Hat, Inc. 2012 5 * 6 * Author: Gerd Hoffmann <kraxel@redhat.com> 7 * 8 * This work is licensed under the terms of the GNU GPL, version 2 or later. 9 * See the COPYING file in the top-level directory. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu/option.h" 14 #include "qemu/config-file.h" 15 #include "trace.h" 16 #include "qemu/error-report.h" 17 #include "qemu/main-loop.h" 18 #include "qemu/module.h" 19 #include "qemu/log.h" 20 21 #include "hw/usb.h" 22 #include "migration/vmstate.h" 23 #include "desc.h" 24 #include "hw/qdev-properties.h" 25 #include "hw/scsi/scsi.h" 26 #include "scsi/constants.h" 27 #include "qom/object.h" 28 29 /* --------------------------------------------------------------------- */ 30 31 #define UAS_UI_COMMAND 0x01 32 #define UAS_UI_SENSE 0x03 33 #define UAS_UI_RESPONSE 0x04 34 #define UAS_UI_TASK_MGMT 0x05 35 #define UAS_UI_READ_READY 0x06 36 #define UAS_UI_WRITE_READY 0x07 37 38 #define UAS_RC_TMF_COMPLETE 0x00 39 #define UAS_RC_INVALID_INFO_UNIT 0x02 40 #define UAS_RC_TMF_NOT_SUPPORTED 0x04 41 #define UAS_RC_TMF_FAILED 0x05 42 #define UAS_RC_TMF_SUCCEEDED 0x08 43 #define UAS_RC_INCORRECT_LUN 0x09 44 #define UAS_RC_OVERLAPPED_TAG 0x0a 45 46 #define UAS_TMF_ABORT_TASK 0x01 47 #define UAS_TMF_ABORT_TASK_SET 0x02 48 #define UAS_TMF_CLEAR_TASK_SET 0x04 49 #define UAS_TMF_LOGICAL_UNIT_RESET 0x08 50 #define UAS_TMF_I_T_NEXUS_RESET 0x10 51 #define UAS_TMF_CLEAR_ACA 0x40 52 #define UAS_TMF_QUERY_TASK 0x80 53 #define UAS_TMF_QUERY_TASK_SET 0x81 54 #define UAS_TMF_QUERY_ASYNC_EVENT 0x82 55 56 #define UAS_PIPE_ID_COMMAND 0x01 57 #define UAS_PIPE_ID_STATUS 0x02 58 #define UAS_PIPE_ID_DATA_IN 0x03 59 #define UAS_PIPE_ID_DATA_OUT 0x04 60 61 typedef struct { 62 uint8_t id; 63 uint8_t reserved; 64 uint16_t tag; 65 } QEMU_PACKED uas_iu_header; 66 67 typedef struct { 68 uint8_t prio_taskattr; /* 6:3 priority, 2:0 task attribute */ 69 uint8_t reserved_1; 70 uint8_t add_cdb_length; /* 7:2 additional adb length (dwords) */ 71 uint8_t reserved_2; 72 uint64_t lun; 73 uint8_t cdb[16]; 74 uint8_t add_cdb[1]; 75 } QEMU_PACKED uas_iu_command; 76 77 typedef struct { 78 uint16_t status_qualifier; 79 uint8_t status; 80 uint8_t reserved[7]; 81 uint16_t sense_length; 82 uint8_t sense_data[18]; 83 } QEMU_PACKED uas_iu_sense; 84 85 typedef struct { 86 uint8_t add_response_info[3]; 87 uint8_t response_code; 88 } QEMU_PACKED uas_iu_response; 89 90 typedef struct { 91 uint8_t function; 92 uint8_t reserved; 93 uint16_t task_tag; 94 uint64_t lun; 95 } QEMU_PACKED uas_iu_task_mgmt; 96 97 typedef struct { 98 uas_iu_header hdr; 99 union { 100 uas_iu_command command; 101 uas_iu_sense sense; 102 uas_iu_task_mgmt task; 103 uas_iu_response response; 104 }; 105 } QEMU_PACKED uas_iu; 106 107 /* --------------------------------------------------------------------- */ 108 109 #define UAS_STREAM_BM_ATTR 4 110 #define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR) 111 112 typedef struct UASDevice UASDevice; 113 typedef struct UASRequest UASRequest; 114 typedef struct UASStatus UASStatus; 115 116 struct UASDevice { 117 USBDevice dev; 118 SCSIBus bus; 119 QEMUBH *status_bh; 120 QTAILQ_HEAD(, UASStatus) results; 121 QTAILQ_HEAD(, UASRequest) requests; 122 123 /* properties */ 124 uint32_t requestlog; 125 126 /* usb 2.0 only */ 127 USBPacket *status2; 128 UASRequest *datain2; 129 UASRequest *dataout2; 130 131 /* usb 3.0 only */ 132 USBPacket *data3[UAS_MAX_STREAMS + 1]; 133 USBPacket *status3[UAS_MAX_STREAMS + 1]; 134 }; 135 136 #define TYPE_USB_UAS "usb-uas" 137 OBJECT_DECLARE_SIMPLE_TYPE(UASDevice, USB_UAS) 138 139 struct UASRequest { 140 uint16_t tag; 141 uint64_t lun; 142 UASDevice *uas; 143 SCSIDevice *dev; 144 SCSIRequest *req; 145 USBPacket *data; 146 bool data_async; 147 bool active; 148 bool complete; 149 uint32_t buf_off; 150 uint32_t buf_size; 151 uint32_t data_off; 152 uint32_t data_size; 153 QTAILQ_ENTRY(UASRequest) next; 154 }; 155 156 struct UASStatus { 157 uint32_t stream; 158 uas_iu status; 159 uint32_t length; 160 QTAILQ_ENTRY(UASStatus) next; 161 }; 162 163 /* --------------------------------------------------------------------- */ 164 165 enum { 166 STR_MANUFACTURER = 1, 167 STR_PRODUCT, 168 STR_SERIALNUMBER, 169 STR_CONFIG_HIGH, 170 STR_CONFIG_SUPER, 171 }; 172 173 static const USBDescStrings desc_strings = { 174 [STR_MANUFACTURER] = "QEMU", 175 [STR_PRODUCT] = "USB Attached SCSI HBA", 176 [STR_SERIALNUMBER] = "27842", 177 [STR_CONFIG_HIGH] = "High speed config (usb 2.0)", 178 [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)", 179 }; 180 181 static const USBDescIface desc_iface_high = { 182 .bInterfaceNumber = 0, 183 .bNumEndpoints = 4, 184 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 185 .bInterfaceSubClass = 0x06, /* SCSI */ 186 .bInterfaceProtocol = 0x62, /* UAS */ 187 .eps = (USBDescEndpoint[]) { 188 { 189 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 190 .bmAttributes = USB_ENDPOINT_XFER_BULK, 191 .wMaxPacketSize = 512, 192 .extra = (uint8_t[]) { 193 0x04, /* u8 bLength */ 194 0x24, /* u8 bDescriptorType */ 195 UAS_PIPE_ID_COMMAND, 196 0x00, /* u8 bReserved */ 197 }, 198 },{ 199 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 200 .bmAttributes = USB_ENDPOINT_XFER_BULK, 201 .wMaxPacketSize = 512, 202 .extra = (uint8_t[]) { 203 0x04, /* u8 bLength */ 204 0x24, /* u8 bDescriptorType */ 205 UAS_PIPE_ID_STATUS, 206 0x00, /* u8 bReserved */ 207 }, 208 },{ 209 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 210 .bmAttributes = USB_ENDPOINT_XFER_BULK, 211 .wMaxPacketSize = 512, 212 .extra = (uint8_t[]) { 213 0x04, /* u8 bLength */ 214 0x24, /* u8 bDescriptorType */ 215 UAS_PIPE_ID_DATA_IN, 216 0x00, /* u8 bReserved */ 217 }, 218 },{ 219 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 220 .bmAttributes = USB_ENDPOINT_XFER_BULK, 221 .wMaxPacketSize = 512, 222 .extra = (uint8_t[]) { 223 0x04, /* u8 bLength */ 224 0x24, /* u8 bDescriptorType */ 225 UAS_PIPE_ID_DATA_OUT, 226 0x00, /* u8 bReserved */ 227 }, 228 }, 229 } 230 }; 231 232 static const USBDescIface desc_iface_super = { 233 .bInterfaceNumber = 0, 234 .bNumEndpoints = 4, 235 .bInterfaceClass = USB_CLASS_MASS_STORAGE, 236 .bInterfaceSubClass = 0x06, /* SCSI */ 237 .bInterfaceProtocol = 0x62, /* UAS */ 238 .eps = (USBDescEndpoint[]) { 239 { 240 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_COMMAND, 241 .bmAttributes = USB_ENDPOINT_XFER_BULK, 242 .wMaxPacketSize = 1024, 243 .bMaxBurst = 15, 244 .extra = (uint8_t[]) { 245 0x04, /* u8 bLength */ 246 0x24, /* u8 bDescriptorType */ 247 UAS_PIPE_ID_COMMAND, 248 0x00, /* u8 bReserved */ 249 }, 250 },{ 251 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_STATUS, 252 .bmAttributes = USB_ENDPOINT_XFER_BULK, 253 .wMaxPacketSize = 1024, 254 .bMaxBurst = 15, 255 .bmAttributes_super = UAS_STREAM_BM_ATTR, 256 .extra = (uint8_t[]) { 257 0x04, /* u8 bLength */ 258 0x24, /* u8 bDescriptorType */ 259 UAS_PIPE_ID_STATUS, 260 0x00, /* u8 bReserved */ 261 }, 262 },{ 263 .bEndpointAddress = USB_DIR_IN | UAS_PIPE_ID_DATA_IN, 264 .bmAttributes = USB_ENDPOINT_XFER_BULK, 265 .wMaxPacketSize = 1024, 266 .bMaxBurst = 15, 267 .bmAttributes_super = UAS_STREAM_BM_ATTR, 268 .extra = (uint8_t[]) { 269 0x04, /* u8 bLength */ 270 0x24, /* u8 bDescriptorType */ 271 UAS_PIPE_ID_DATA_IN, 272 0x00, /* u8 bReserved */ 273 }, 274 },{ 275 .bEndpointAddress = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT, 276 .bmAttributes = USB_ENDPOINT_XFER_BULK, 277 .wMaxPacketSize = 1024, 278 .bMaxBurst = 15, 279 .bmAttributes_super = UAS_STREAM_BM_ATTR, 280 .extra = (uint8_t[]) { 281 0x04, /* u8 bLength */ 282 0x24, /* u8 bDescriptorType */ 283 UAS_PIPE_ID_DATA_OUT, 284 0x00, /* u8 bReserved */ 285 }, 286 }, 287 } 288 }; 289 290 static const USBDescDevice desc_device_high = { 291 .bcdUSB = 0x0200, 292 .bMaxPacketSize0 = 64, 293 .bNumConfigurations = 1, 294 .confs = (USBDescConfig[]) { 295 { 296 .bNumInterfaces = 1, 297 .bConfigurationValue = 1, 298 .iConfiguration = STR_CONFIG_HIGH, 299 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 300 .nif = 1, 301 .ifs = &desc_iface_high, 302 }, 303 }, 304 }; 305 306 static const USBDescDevice desc_device_super = { 307 .bcdUSB = 0x0300, 308 .bMaxPacketSize0 = 9, 309 .bNumConfigurations = 1, 310 .confs = (USBDescConfig[]) { 311 { 312 .bNumInterfaces = 1, 313 .bConfigurationValue = 1, 314 .iConfiguration = STR_CONFIG_SUPER, 315 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER, 316 .nif = 1, 317 .ifs = &desc_iface_super, 318 }, 319 }, 320 }; 321 322 static const USBDesc desc = { 323 .id = { 324 .idVendor = 0x46f4, /* CRC16() of "QEMU" */ 325 .idProduct = 0x0003, 326 .bcdDevice = 0, 327 .iManufacturer = STR_MANUFACTURER, 328 .iProduct = STR_PRODUCT, 329 .iSerialNumber = STR_SERIALNUMBER, 330 }, 331 .high = &desc_device_high, 332 .super = &desc_device_super, 333 .str = desc_strings, 334 }; 335 336 /* --------------------------------------------------------------------- */ 337 338 static bool uas_using_streams(UASDevice *uas) 339 { 340 return uas->dev.speed == USB_SPEED_SUPER; 341 } 342 343 /* --------------------------------------------------------------------- */ 344 345 static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag) 346 { 347 UASStatus *st = g_new0(UASStatus, 1); 348 349 st->status.hdr.id = id; 350 st->status.hdr.tag = cpu_to_be16(tag); 351 st->length = sizeof(uas_iu_header); 352 if (uas_using_streams(uas)) { 353 st->stream = tag; 354 } 355 return st; 356 } 357 358 static void usb_uas_send_status_bh(void *opaque) 359 { 360 UASDevice *uas = opaque; 361 UASStatus *st; 362 USBPacket *p; 363 364 while ((st = QTAILQ_FIRST(&uas->results)) != NULL) { 365 if (uas_using_streams(uas)) { 366 p = uas->status3[st->stream]; 367 uas->status3[st->stream] = NULL; 368 } else { 369 p = uas->status2; 370 uas->status2 = NULL; 371 } 372 if (p == NULL) { 373 break; 374 } 375 376 usb_packet_copy(p, &st->status, st->length); 377 QTAILQ_REMOVE(&uas->results, st, next); 378 g_free(st); 379 380 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 381 usb_packet_complete(&uas->dev, p); 382 } 383 } 384 385 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) 386 { 387 USBPacket *p = uas_using_streams(uas) ? 388 uas->status3[st->stream] : uas->status2; 389 390 st->length += length; 391 QTAILQ_INSERT_TAIL(&uas->results, st, next); 392 if (p) { 393 /* 394 * Just schedule bh make sure any in-flight data transaction 395 * is finished before completing (sending) the status packet. 396 */ 397 qemu_bh_schedule(uas->status_bh); 398 } else { 399 USBEndpoint *ep = usb_ep_get(&uas->dev, USB_TOKEN_IN, 400 UAS_PIPE_ID_STATUS); 401 usb_wakeup(ep, st->stream); 402 } 403 } 404 405 static void usb_uas_queue_response(UASDevice *uas, uint16_t tag, uint8_t code) 406 { 407 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_RESPONSE, tag); 408 409 trace_usb_uas_response(uas->dev.addr, tag, code); 410 st->status.response.response_code = code; 411 usb_uas_queue_status(uas, st, sizeof(uas_iu_response)); 412 } 413 414 static void usb_uas_queue_sense(UASRequest *req, uint8_t status) 415 { 416 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_SENSE, req->tag); 417 int len, slen = 0; 418 419 trace_usb_uas_sense(req->uas->dev.addr, req->tag, status); 420 st->status.sense.status = status; 421 st->status.sense.status_qualifier = cpu_to_be16(0); 422 if (status != GOOD) { 423 slen = scsi_req_get_sense(req->req, st->status.sense.sense_data, 424 sizeof(st->status.sense.sense_data)); 425 st->status.sense.sense_length = cpu_to_be16(slen); 426 } 427 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 428 usb_uas_queue_status(req->uas, st, len); 429 } 430 431 static void usb_uas_queue_fake_sense(UASDevice *uas, uint16_t tag, 432 struct SCSISense sense) 433 { 434 UASStatus *st = usb_uas_alloc_status(uas, UAS_UI_SENSE, tag); 435 int len, slen = 0; 436 437 st->status.sense.status = CHECK_CONDITION; 438 st->status.sense.status_qualifier = cpu_to_be16(0); 439 st->status.sense.sense_data[0] = 0x70; 440 st->status.sense.sense_data[2] = sense.key; 441 st->status.sense.sense_data[7] = 10; 442 st->status.sense.sense_data[12] = sense.asc; 443 st->status.sense.sense_data[13] = sense.ascq; 444 slen = 18; 445 len = sizeof(uas_iu_sense) - sizeof(st->status.sense.sense_data) + slen; 446 usb_uas_queue_status(uas, st, len); 447 } 448 449 static void usb_uas_queue_read_ready(UASRequest *req) 450 { 451 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_READ_READY, 452 req->tag); 453 454 trace_usb_uas_read_ready(req->uas->dev.addr, req->tag); 455 usb_uas_queue_status(req->uas, st, 0); 456 } 457 458 static void usb_uas_queue_write_ready(UASRequest *req) 459 { 460 UASStatus *st = usb_uas_alloc_status(req->uas, UAS_UI_WRITE_READY, 461 req->tag); 462 463 trace_usb_uas_write_ready(req->uas->dev.addr, req->tag); 464 usb_uas_queue_status(req->uas, st, 0); 465 } 466 467 /* --------------------------------------------------------------------- */ 468 469 static int usb_uas_get_lun(uint64_t lun64) 470 { 471 return (lun64 >> 48) & 0xff; 472 } 473 474 static SCSIDevice *usb_uas_get_dev(UASDevice *uas, uint64_t lun64) 475 { 476 if ((lun64 >> 56) != 0x00) { 477 return NULL; 478 } 479 return scsi_device_find(&uas->bus, 0, 0, usb_uas_get_lun(lun64)); 480 } 481 482 static void usb_uas_complete_data_packet(UASRequest *req) 483 { 484 USBPacket *p; 485 486 if (!req->data_async) { 487 return; 488 } 489 p = req->data; 490 req->data = NULL; 491 req->data_async = false; 492 p->status = USB_RET_SUCCESS; /* Clear previous ASYNC status */ 493 usb_packet_complete(&req->uas->dev, p); 494 } 495 496 static void usb_uas_copy_data(UASRequest *req) 497 { 498 uint32_t length; 499 500 length = MIN(req->buf_size - req->buf_off, 501 req->data->iov.size - req->data->actual_length); 502 trace_usb_uas_xfer_data(req->uas->dev.addr, req->tag, length, 503 req->data->actual_length, req->data->iov.size, 504 req->buf_off, req->buf_size); 505 usb_packet_copy(req->data, scsi_req_get_buf(req->req) + req->buf_off, 506 length); 507 req->buf_off += length; 508 req->data_off += length; 509 510 if (req->data->actual_length == req->data->iov.size) { 511 usb_uas_complete_data_packet(req); 512 } 513 if (req->buf_size && req->buf_off == req->buf_size) { 514 req->buf_off = 0; 515 req->buf_size = 0; 516 scsi_req_continue(req->req); 517 } 518 } 519 520 static void usb_uas_start_next_transfer(UASDevice *uas) 521 { 522 UASRequest *req; 523 524 if (uas_using_streams(uas)) { 525 return; 526 } 527 528 QTAILQ_FOREACH(req, &uas->requests, next) { 529 if (req->active || req->complete) { 530 continue; 531 } 532 if (req->req->cmd.mode == SCSI_XFER_FROM_DEV && uas->datain2 == NULL) { 533 uas->datain2 = req; 534 usb_uas_queue_read_ready(req); 535 req->active = true; 536 return; 537 } 538 if (req->req->cmd.mode == SCSI_XFER_TO_DEV && uas->dataout2 == NULL) { 539 uas->dataout2 = req; 540 usb_uas_queue_write_ready(req); 541 req->active = true; 542 return; 543 } 544 } 545 } 546 547 static UASRequest *usb_uas_alloc_request(UASDevice *uas, uas_iu *iu) 548 { 549 UASRequest *req; 550 551 req = g_new0(UASRequest, 1); 552 req->uas = uas; 553 req->tag = be16_to_cpu(iu->hdr.tag); 554 req->lun = be64_to_cpu(iu->command.lun); 555 req->dev = usb_uas_get_dev(req->uas, req->lun); 556 return req; 557 } 558 559 static void usb_uas_scsi_free_request(SCSIBus *bus, void *priv) 560 { 561 UASRequest *req = priv; 562 UASDevice *uas = req->uas; 563 564 if (req == uas->datain2) { 565 uas->datain2 = NULL; 566 } 567 if (req == uas->dataout2) { 568 uas->dataout2 = NULL; 569 } 570 QTAILQ_REMOVE(&uas->requests, req, next); 571 g_free(req); 572 usb_uas_start_next_transfer(uas); 573 } 574 575 static UASRequest *usb_uas_find_request(UASDevice *uas, uint16_t tag) 576 { 577 UASRequest *req; 578 579 QTAILQ_FOREACH(req, &uas->requests, next) { 580 if (req->tag == tag) { 581 return req; 582 } 583 } 584 return NULL; 585 } 586 587 static void usb_uas_scsi_transfer_data(SCSIRequest *r, uint32_t len) 588 { 589 UASRequest *req = r->hba_private; 590 591 trace_usb_uas_scsi_data(req->uas->dev.addr, req->tag, len); 592 req->buf_off = 0; 593 req->buf_size = len; 594 if (req->data) { 595 usb_uas_copy_data(req); 596 } else { 597 usb_uas_start_next_transfer(req->uas); 598 } 599 } 600 601 static void usb_uas_scsi_command_complete(SCSIRequest *r, size_t resid) 602 { 603 UASRequest *req = r->hba_private; 604 605 trace_usb_uas_scsi_complete(req->uas->dev.addr, req->tag, r->status, resid); 606 req->complete = true; 607 if (req->data) { 608 usb_uas_complete_data_packet(req); 609 } 610 usb_uas_queue_sense(req, r->status); 611 scsi_req_unref(req->req); 612 } 613 614 static void usb_uas_scsi_request_cancelled(SCSIRequest *r) 615 { 616 UASRequest *req = r->hba_private; 617 618 /* FIXME: queue notification to status pipe? */ 619 scsi_req_unref(req->req); 620 } 621 622 static const struct SCSIBusInfo usb_uas_scsi_info = { 623 .tcq = true, 624 .max_target = 0, 625 .max_lun = 255, 626 627 .transfer_data = usb_uas_scsi_transfer_data, 628 .complete = usb_uas_scsi_command_complete, 629 .cancel = usb_uas_scsi_request_cancelled, 630 .free_request = usb_uas_scsi_free_request, 631 }; 632 633 /* --------------------------------------------------------------------- */ 634 635 static void usb_uas_handle_reset(USBDevice *dev) 636 { 637 UASDevice *uas = USB_UAS(dev); 638 UASRequest *req, *nreq; 639 UASStatus *st, *nst; 640 641 trace_usb_uas_reset(dev->addr); 642 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 643 scsi_req_cancel(req->req); 644 } 645 QTAILQ_FOREACH_SAFE(st, &uas->results, next, nst) { 646 QTAILQ_REMOVE(&uas->results, st, next); 647 g_free(st); 648 } 649 } 650 651 static void usb_uas_handle_control(USBDevice *dev, USBPacket *p, 652 int request, int value, int index, int length, uint8_t *data) 653 { 654 int ret; 655 656 ret = usb_desc_handle_control(dev, p, request, value, index, length, data); 657 if (ret >= 0) { 658 return; 659 } 660 error_report("%s: unhandled control request (req 0x%x, val 0x%x, idx 0x%x", 661 __func__, request, value, index); 662 p->status = USB_RET_STALL; 663 } 664 665 static void usb_uas_cancel_io(USBDevice *dev, USBPacket *p) 666 { 667 UASDevice *uas = USB_UAS(dev); 668 UASRequest *req, *nreq; 669 int i; 670 671 if (uas->status2 == p) { 672 uas->status2 = NULL; 673 qemu_bh_cancel(uas->status_bh); 674 return; 675 } 676 if (uas_using_streams(uas)) { 677 for (i = 0; i <= UAS_MAX_STREAMS; i++) { 678 if (uas->status3[i] == p) { 679 uas->status3[i] = NULL; 680 return; 681 } 682 if (uas->data3[i] == p) { 683 uas->data3[i] = NULL; 684 return; 685 } 686 } 687 } 688 QTAILQ_FOREACH_SAFE(req, &uas->requests, next, nreq) { 689 if (req->data == p) { 690 req->data = NULL; 691 return; 692 } 693 } 694 assert(!"canceled usb packet not found"); 695 } 696 697 static void usb_uas_command(UASDevice *uas, uas_iu *iu) 698 { 699 UASRequest *req; 700 uint32_t len; 701 uint16_t tag = be16_to_cpu(iu->hdr.tag); 702 size_t cdb_len = sizeof(iu->command.cdb) + iu->command.add_cdb_length; 703 704 if (iu->command.add_cdb_length > 0) { 705 qemu_log_mask(LOG_UNIMP, "additional adb length not yet supported\n"); 706 goto unsupported_len; 707 } 708 709 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 710 goto invalid_tag; 711 } 712 req = usb_uas_find_request(uas, tag); 713 if (req) { 714 goto overlapped_tag; 715 } 716 req = usb_uas_alloc_request(uas, iu); 717 if (req->dev == NULL) { 718 goto bad_target; 719 } 720 721 trace_usb_uas_command(uas->dev.addr, req->tag, 722 usb_uas_get_lun(req->lun), 723 req->lun >> 32, req->lun & 0xffffffff); 724 QTAILQ_INSERT_TAIL(&uas->requests, req, next); 725 if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) { 726 req->data = uas->data3[req->tag]; 727 req->data_async = true; 728 uas->data3[req->tag] = NULL; 729 } 730 731 req->req = scsi_req_new(req->dev, req->tag, 732 usb_uas_get_lun(req->lun), 733 iu->command.cdb, cdb_len, req); 734 if (uas->requestlog) { 735 scsi_req_print(req->req); 736 } 737 len = scsi_req_enqueue(req->req); 738 if (len) { 739 req->data_size = len; 740 scsi_req_continue(req->req); 741 } 742 return; 743 744 unsupported_len: 745 usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_PARAM_VALUE); 746 return; 747 748 invalid_tag: 749 usb_uas_queue_fake_sense(uas, tag, sense_code_INVALID_TAG); 750 return; 751 752 overlapped_tag: 753 usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS); 754 return; 755 756 bad_target: 757 usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED); 758 g_free(req); 759 } 760 761 static void usb_uas_task(UASDevice *uas, uas_iu *iu) 762 { 763 uint16_t tag = be16_to_cpu(iu->hdr.tag); 764 uint64_t lun64 = be64_to_cpu(iu->task.lun); 765 SCSIDevice *dev = usb_uas_get_dev(uas, lun64); 766 int lun = usb_uas_get_lun(lun64); 767 UASRequest *req; 768 uint16_t task_tag; 769 770 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { 771 goto invalid_tag; 772 } 773 req = usb_uas_find_request(uas, be16_to_cpu(iu->hdr.tag)); 774 if (req) { 775 goto overlapped_tag; 776 } 777 if (dev == NULL) { 778 goto incorrect_lun; 779 } 780 781 switch (iu->task.function) { 782 case UAS_TMF_ABORT_TASK: 783 task_tag = be16_to_cpu(iu->task.task_tag); 784 trace_usb_uas_tmf_abort_task(uas->dev.addr, tag, task_tag); 785 req = usb_uas_find_request(uas, task_tag); 786 if (req && req->dev == dev) { 787 scsi_req_cancel(req->req); 788 } 789 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 790 break; 791 792 case UAS_TMF_LOGICAL_UNIT_RESET: 793 trace_usb_uas_tmf_logical_unit_reset(uas->dev.addr, tag, lun); 794 device_cold_reset(&dev->qdev); 795 usb_uas_queue_response(uas, tag, UAS_RC_TMF_COMPLETE); 796 break; 797 798 default: 799 trace_usb_uas_tmf_unsupported(uas->dev.addr, tag, iu->task.function); 800 usb_uas_queue_response(uas, tag, UAS_RC_TMF_NOT_SUPPORTED); 801 break; 802 } 803 return; 804 805 invalid_tag: 806 usb_uas_queue_response(uas, tag, UAS_RC_INVALID_INFO_UNIT); 807 return; 808 809 overlapped_tag: 810 usb_uas_queue_response(uas, req->tag, UAS_RC_OVERLAPPED_TAG); 811 return; 812 813 incorrect_lun: 814 usb_uas_queue_response(uas, tag, UAS_RC_INCORRECT_LUN); 815 } 816 817 static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) 818 { 819 UASDevice *uas = USB_UAS(dev); 820 uas_iu iu; 821 UASStatus *st; 822 UASRequest *req; 823 int length; 824 825 switch (p->ep->nr) { 826 case UAS_PIPE_ID_COMMAND: 827 length = MIN(sizeof(iu), p->iov.size); 828 usb_packet_copy(p, &iu, length); 829 switch (iu.hdr.id) { 830 case UAS_UI_COMMAND: 831 usb_uas_command(uas, &iu); 832 break; 833 case UAS_UI_TASK_MGMT: 834 usb_uas_task(uas, &iu); 835 break; 836 default: 837 error_report("%s: unknown command iu: id 0x%x", 838 __func__, iu.hdr.id); 839 p->status = USB_RET_STALL; 840 break; 841 } 842 break; 843 case UAS_PIPE_ID_STATUS: 844 if (p->stream > UAS_MAX_STREAMS) { 845 goto err_stream; 846 } 847 if (p->stream) { 848 QTAILQ_FOREACH(st, &uas->results, next) { 849 if (st->stream == p->stream) { 850 break; 851 } 852 } 853 if (st == NULL) { 854 assert(uas->status3[p->stream] == NULL); 855 uas->status3[p->stream] = p; 856 p->status = USB_RET_ASYNC; 857 break; 858 } 859 } else { 860 st = QTAILQ_FIRST(&uas->results); 861 if (st == NULL) { 862 assert(uas->status2 == NULL); 863 uas->status2 = p; 864 p->status = USB_RET_ASYNC; 865 break; 866 } 867 } 868 usb_packet_copy(p, &st->status, st->length); 869 QTAILQ_REMOVE(&uas->results, st, next); 870 g_free(st); 871 break; 872 case UAS_PIPE_ID_DATA_IN: 873 case UAS_PIPE_ID_DATA_OUT: 874 if (p->stream > UAS_MAX_STREAMS) { 875 goto err_stream; 876 } 877 if (p->stream) { 878 req = usb_uas_find_request(uas, p->stream); 879 } else { 880 req = (p->ep->nr == UAS_PIPE_ID_DATA_IN) 881 ? uas->datain2 : uas->dataout2; 882 } 883 if (req == NULL) { 884 if (p->stream) { 885 assert(uas->data3[p->stream] == NULL); 886 uas->data3[p->stream] = p; 887 p->status = USB_RET_ASYNC; 888 break; 889 } else { 890 error_report("%s: no inflight request", __func__); 891 p->status = USB_RET_STALL; 892 break; 893 } 894 } 895 scsi_req_ref(req->req); 896 req->data = p; 897 usb_uas_copy_data(req); 898 if (p->actual_length == p->iov.size || req->complete) { 899 req->data = NULL; 900 } else { 901 req->data_async = true; 902 p->status = USB_RET_ASYNC; 903 } 904 scsi_req_unref(req->req); 905 usb_uas_start_next_transfer(uas); 906 break; 907 default: 908 error_report("%s: invalid endpoint %d", __func__, p->ep->nr); 909 p->status = USB_RET_STALL; 910 break; 911 } 912 return; 913 914 err_stream: 915 error_report("%s: invalid stream %d", __func__, p->stream); 916 p->status = USB_RET_STALL; 917 return; 918 } 919 920 static void usb_uas_unrealize(USBDevice *dev) 921 { 922 UASDevice *uas = USB_UAS(dev); 923 924 qemu_bh_delete(uas->status_bh); 925 } 926 927 static void usb_uas_realize(USBDevice *dev, Error **errp) 928 { 929 UASDevice *uas = USB_UAS(dev); 930 DeviceState *d = DEVICE(dev); 931 932 usb_desc_create_serial(dev); 933 usb_desc_init(dev); 934 if (d->hotplugged) { 935 uas->dev.auto_attach = 0; 936 } 937 938 QTAILQ_INIT(&uas->results); 939 QTAILQ_INIT(&uas->requests); 940 uas->status_bh = qemu_bh_new(usb_uas_send_status_bh, uas); 941 942 dev->flags |= (1 << USB_DEV_FLAG_IS_SCSI_STORAGE); 943 scsi_bus_init(&uas->bus, sizeof(uas->bus), DEVICE(dev), &usb_uas_scsi_info); 944 } 945 946 static const VMStateDescription vmstate_usb_uas = { 947 .name = "usb-uas", 948 .unmigratable = 1, 949 .fields = (VMStateField[]) { 950 VMSTATE_USB_DEVICE(dev, UASDevice), 951 VMSTATE_END_OF_LIST() 952 } 953 }; 954 955 static Property uas_properties[] = { 956 DEFINE_PROP_UINT32("log-scsi-req", UASDevice, requestlog, 0), 957 DEFINE_PROP_END_OF_LIST(), 958 }; 959 960 static void usb_uas_class_initfn(ObjectClass *klass, void *data) 961 { 962 DeviceClass *dc = DEVICE_CLASS(klass); 963 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 964 965 uc->realize = usb_uas_realize; 966 uc->product_desc = desc_strings[STR_PRODUCT]; 967 uc->usb_desc = &desc; 968 uc->cancel_packet = usb_uas_cancel_io; 969 uc->handle_attach = usb_desc_attach; 970 uc->handle_reset = usb_uas_handle_reset; 971 uc->handle_control = usb_uas_handle_control; 972 uc->handle_data = usb_uas_handle_data; 973 uc->unrealize = usb_uas_unrealize; 974 uc->attached_settable = true; 975 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 976 dc->fw_name = "storage"; 977 dc->vmsd = &vmstate_usb_uas; 978 device_class_set_props(dc, uas_properties); 979 } 980 981 static const TypeInfo uas_info = { 982 .name = TYPE_USB_UAS, 983 .parent = TYPE_USB_DEVICE, 984 .instance_size = sizeof(UASDevice), 985 .class_init = usb_uas_class_initfn, 986 }; 987 988 static void usb_uas_register_types(void) 989 { 990 type_register_static(&uas_info); 991 } 992 993 type_init(usb_uas_register_types) 994