[Qemu-devel] RFC; usb redirection protocol

[Hans de Goede]

Hi All,

Here is what I have in mind as usb redirection protocol:

USB redirerection protocol (draft)
----------------------------------

The protocol described in this document is meant for tunneling usb transfers
to a single usb device. Note: not an entire hub, only a single device.

The most significant use case for this is taking a usb device attached to
some machine "a" which acts as a client / viewer to a virtual machine "v"
hosted on another machine "b", and make the usb device show up inside the
virtual machine as if it were attached directly to the virtual machine "v".

The described protocol assumes a reliable ordered bidirectional transport is
available, for example a tcp socket.

Definitions:
vm-host:  machine running the virtual machine with the guest os accessing
          the usb device
usb-host: machine which has the usb device which "appears" inside the vm


Basic packet structure / communication
--------------------------------------

Each packet exchanged between the vm-host and the usb-host starts with a
usb_redir_header, followed by an optional command specific header
follow by optional additional data.

The usb_redir_header each packet starts with looks as follows:

struct usb_redir_header {
    uint32_t command;
    uint32_t length;
}

command: A command code, from the command enum
length:  length of the optional command specific header + the optional
         additional data. Can be 0.

There are 3 types of commands:

1) Connection setup commands
2) Synchroneous commands
3) Asynchroneous commands

Given that everything is done over a potentially slow transport in practice
the diferentiating between synchroneous and asynchroneous commands may seem
odd. The difference is how the usb-host will handle them once received. For
synchroneous commands the usb-host will hand the request over to the host os
and then *wait* for a response. This means that the vm-host is guaranteed to
get an "immediate" response. Where as for asynchroneous commands to usb-host
hands the request over to the host os with the request to let the usb-host
process know when the request is done.

Also note that all synchroneous commands should only be executed when no
asynchroneous commands are pending on the device / interface / endpoint
affected by the synchroneous command. Any pending commands will get
dropped, and any active iso streams / allocated bulk streams will get
stopped / free-ed.


Command list
------------

Connection setup commands:
usb_redir_hello
usb_redir_report_descriptor

Synchroneous commands:
usb_redir_set_configuration
usb_redir_get_configuration
usb_redir_configuration_status
usb_redir_set_alt_setting
usb_redir_get_alt_setting
usb_redir_alt_setting_status
usb_redir_start_iso_stream
usb_redir_stop_iso_stream
usb_redir_iso_stream_status
usb_redir_alloc_bulk_streams
usb_redir_free_bulk_streams
usb_redir_bulk_streams_status

Asynchroneous commands:
usb_redir_control_packet
usb_redir_bulk_packet
usb_redir_iso_packet


usb_redir_hello
---------------

usb_redir_header.command: usb_redir_hello
usb_redir_header.length:  <see description>

struct usb_redir_hello_header {
    char     version[64];
    uint32_t capabilities[0];
}

No command specific additional data.

A packet of this type is send by both sides as soon as a connection is
establised. This commands consists of:
version:       A free form 0 terminated version string, useful for logging
               should not be parsed! Suggested format: "qemu 0.13",
               "usb-redir-daemon 0.1", etc.
capabilities:  A variable length array for announcing capabilities.

The value of the length field depends on the size of the capabilities array.
If we cross the 32 capabilities count, it will go from 1 uint32_t to 2,
etc. the value is 64 + capabilities-array-size * sizeof(uint32_t).

Currently the following capabilities are defined:
usb_redir_cap_bulk_streams: USB 3 bulk streams are supported


usb_redir_report_descriptor
---------------------------

usb_redir_header.command: usb_redir_report_desciptor
usb_redir_header.length:  <sizeof usb device descriptors>

No command specific header.

The command specific additional data contains the entire descriptors for
the usb device.

A packet of this type is send by the usb-host directly after the hello packet
it contains the usb descriptor tables for the usb device.


usb_redir_set_configuration
---------------------------

usb_redir_header.command: usb_redir_set_configuration
usb_redir_header.length:  sizeof(usb_redir_set_configuration_header)

struct usb_redir_set_configuration_header {
    uint8_t configuration;
}

No command specific additional data.

This command can be send by the vm-host to set (change) the active
configuration of the usb device.

usb_redir_get_configuration
---------------------------

usb_redir_header.command: usb_redir_get_configuration
usb_redir_header.length:  0

No command specific header.

No command specific additional data.

This command can be send by the vm-host to get (query) the active
configuration of the usb device.

usb_redir_configuration_status
------------------------------

usb_redir_header.command: usb_redir_configuration_status
usb_redir_header.length:  sizeof(usb_redir_configuration_status_header)

struct usb_redir_configuration_status_header {
    uint8_t status;
    uint8_t configuration;
}

No command specific additional data.

This command is send by the usb-host in response to a
usb_redir_set_configuration/usb_redir_get_configuration
command. It reports a status code and the active
configuration after the command.


usb_redir_set_alt_setting
-------------------------

usb_redir_header.command: usb_redir_set_alt_setting
usb_redir_header.length:  sizeof(usb_redir_set_alt_setting_header)

struct usb_redir_set_alt_setting_header {
    uint8_t interface;
    uint8_t alt;
}

No command specific additional data.

This command can be send by the vm-host to set (change) the alt_setting of
interface <interface> to <alt>.

usb_redir_get_alt_setting
---------------------------

usb_redir_header.command: usb_redir_get_alt_setting
usb_redir_header.length:  sizeof(usb_redir_get_alt_setting_header)

struct usb_redir_get_alt_setting_header {
    uint8_t interface;
}

No command specific additional data.

The command specific additional data is a single byte specifing the
interface for which to get the alt setting.

This command can be send by the vm-host to get (query) the active
alt_setting of an interface of the usb device.

usb_redir_alt_setting_status
----------------------------

usb_redir_header.command: usb_redir_alt_setting_status
usb_redir_header.length:  sizeof(usb_redir_alt_setting_status_header)

struct usb_redir_alt_setting_status_header {
    uint8_t status;
    uint8_t interface;
    uint8_t alt;
}

No command specific additional data.

This command is send by the usb-host in response to a
usb_redir_set_alt_setting/usb_redir_get_alt_setting
command. It reports a status code, the affected interface
and the active alt_setting for that interface after the command.


usb_redir_start_iso_stream
--------------------------

usb_redir_header.command: usb_redir_start_iso_stream
usb_redir_header.length:  sizeof(usb_redir_start_iso_stream_header)

struct usb_redir_start_iso_stream_header {
    uint8_t endpoint;
    uint8_t pkts_per_urb;
    uint8_t no_urbs;
}

No command specific additional data.

This command can be send by the vm-host to start a iso stream on the
designated endpoint of the usb device.

This function allocates no_urbs urbs with pkts_per_urb iso packets/frames
per urb. For iso input endpoints these urbs will get submitted to the
device *immediately*, for iso output endpoints the usb-host will wait till
it has received 1.5 * pkts_per_urb iso packets to fill its ring buffer
before submitting the first urb.

usb_redir_stop_iso_stream
-------------------------

usb_redir_header.command: usb_redir_stop_iso_stream
usb_redir_header.length:  1

No command specific header.

The command specific additional data is a single byte specifing the
endpoint on which to stop the stream.

This command can be send by the vm-host to stop an iso stream on the
designated endpoint. This will cancel all pending urbs, flush the usb-host's
buffers and free all relevant resources.

usb_redir_iso_stream_status
---------------------------

usb_redir_header.command: usb_redir_iso_stream_status
usb_redir_header.length:  sizeof(usb_redir_iso_stream_status_header)

struct usb_redir_alt_setting_status_header {
    uint8_t status;
    uint8_t endpoint;
}

No command specific additional data.

This command is send by the usb-host in response to a
usb_redir_start_iso_stream or usb_redir_stop_iso_stream command. Note that
for the starting of output iso streams a success status only indicates that
all the buffers were successfully allocated, the actual stream is not
started until enough packets are buffered.

Note that this can also be send unsolicited by a usb-host in case of an
error with an iso output stream, see usb_redir_iso_packet.


usb_redir_alloc_bulk_streams
----------------------------

usb_redir_header.command: usb_redir_alloc_bulk_streams
usb_redir_header.length:  sizeof(usb_redir_alloc_bulk_streams_header)

struct usb_redir_alloc_bulk_streams_header {
    uint8_t endpoint;
    uint8_t no_streams;
}

No command specific additional data.

This command can be send by the vm-host to the usb-host to request
that the usb-host allocates IDs so the vm-host can use up to no_streams
stream IDs.

usb_redir_free_bulk_streams
----------------------------

usb_redir_header.command: usb_redir_free_bulk_streams
usb_redir_header.length:  sizeof(usb_redir_free_bulk_streams_header)

struct usb_redir_free_bulk_streams_header {
    uint8_t endpoint;
}

No command specific additional data.

This command can be send by the vm-host to the usb-host to free any
bulk streams previouisly allocated on the endpoint.

usb_redir_bulk_streams_status
-----------------------------

usb_redir_header.command: usb_redir_bulk_streams_status
usb_redir_header.length:  sizeof(usb_redir_bulk_streams_status_header)

struct usb_redir_bulk_streams_status_header {
    uint8_t status;
    uint8_t endpoint;
    uint8_t no_streams;
}

No command specific additional data.

This command is send by the usb-host in response to a
usb_redir_alloc_bulk_streams or usb_redir_free_bulk_streams command. Note
that on a success status in response to a usb_redir_alloc_bulk_streams
no_streams may be less then requested due to host controller / device
limitations. On a success status in response to a usb_redir_alloc_bulk_streams
the usb-host may use stream ids 1 through no_streams.


usb_redir_control_packet
------------------------

usb_redir_header.command: usb_redir_control_packet
usb_redir_header.length:  sizeof(usb_redir_control_packet_header) + data_size

struct usb_redir_control_packet_header {
    uint64_t pid;
    uint8_t endpoint;
    uint8_t request;
    uint8_t requesttype;
    uint8_t status;
    uint16_t value;
    uint16_t index;
    uint16_t data_size;
}

The additional data contains the control msg data to be send / received.

Packets of this type initially get send by the vm-host to the usb-host.
Where pid is a unique Packet ID to be able to match the async response from
the usb-host to the original request. endpoint, request, requesttype, value
and index have their standard meaning for usb control messages. status is
only used when the usb-host sends its response, data_size is the amount
of data the vm_host is sending / expects to read (in the USB_DIR_IN case).

When the control msg has been processed by the device the usb device sends
a usb_redir_control_packet back to the vm-host, with all fields unchanged
except for the status field and data_size which get updated to match the
actual results.

Note how this packet only has additional data in one direction depending
on the USB_DIR_IN flag of the requesttype.


usb_redir_bulk_packet
---------------------

usb_redir_header.command: usb_redir_bulk_packet
usb_redir_header.length:  sizeof(usb_redir_bulk_packet_header) + data_size

struct usb_redir_bulk_packet_header {
    uint64_t pid;
    uint8_t endpoint;
    uint8_t status;
    uint16_t data_size;
}

The additional data contains the bulk msg data to be send / received.

Packets of this type initially get send by the vm-host to the usb-host.
Where pid is a unique Packet ID to be able to match the async response from
the usb-host to the original request. data_size is the amount of data the
vm_host is sending / expects to read (depending on the direction of the
endpoint).

When the bulk msg has been processed by the device the usb device sends
a usb_redir_bulk_packet back to the vm-host, with the pid and endpoint
fields unchanged and the status field and data_size updated to match the
actual results.

Note how this packet only has additional data in one direction depending
on the direction of the endpoint.


usb_redir_iso_packet
--------------------

usb_redir_header.command: usb_redir_iso_packet
usb_redir_header.length:  sizeof(usb_redir_iso_packet_header) + data_size

struct usb_redir_iso_packet_header {
    uint8_t endpoint;
    uint8_t status;
    uint16_t data_size;
}

The additional data contains the iso msg data to be send / received.

Packets of this type should be send continuesly (at the endpoint interval
speed) as soon as an iso stream is started using usb_redir_start_iso_stream
the direction in which they gets send depends on the endpoints direction.

The status field only has meaning for packets send from the usb-host to
the vm-host (for iso input endpoints). Due to buffering it is not possibly
to timely notify the vm-host of transfer errors for iso output packets. The
usb-host will try to clear any error conditions itself. If it fails to do
so it will send a usb_redir_iso_stream_status to the vm-host indicating
there is a problem with the iso stream.

###

Please let me know what you think of this.

Thanks & Regards,

Hans