USB Network Redirection protocol description version 0.3 (14 July 2011)

Revisions
---------

Version 0.1
-Initial version (released as initial RFC without a version number)

Version 0.2
-Version demo-ed at FOSDEM 2011
-Remove usb_redir_report_descriptor packet, as it is not possible to get
 the cached descriptors from the OS on all platforms and we can do without
-Replace vm-host with usb-guest
-Replace the synchroneous / asynchroneous commands nomenclature with
 control / data packets
-Move the packet id to the main packet header shared by all packets
-Add note: "All integers in the protocol are send over the pipe in least
 significant byte first order."
-Add note: "All structs are packed"
-s/data_size/length/
-Add a usb_redir_cancel_data_packet packet
-Add usb_redir_reset and usb_redir_reset_status packets

Version 0.3, released 14 July 2011
-First "stable" version, all later versions should be compatible with this
 version
-Add a usb_redir_device_connect packet
-Add a usb_redir_device_disconnect packet
-Add a usb_redir_interface_info packet
-Add a usb_redir_ep_info packet
-Add support for interrupt transfers, add the following packets:
 usb_redir_start_interrupt_receiving
 usb_redir_stop_interrupt_receiving
 usb_redir_interrupt_receiving_status
 usb_redir_interrupt_packet
-Add a list with the possible values for the status field
-Report usb_redir_stall as iso status error to indicate a stream stop
-Drop usb_redir_disconnect status, instead the usb-host should always
 send a usb_redir_device_disconnect packet on device disconnection. The
 reason behind this is that having to handle disconnection from data packet
 handlers make things unnecessarily hard for the usb-guest
-Drop usb_redir_reset_status, instead if reconnecting to the device fails
 after reset the usb-host will send a usb_redir_device_disconnect packet


USB redirerection protocol version 0.3
--------------------------------------

The protocol described in this document is meant for tunneling usb transfers
to a single usb device. Note: not an entire hub, only a single device.

The most significant use case for this is taking a usb device attached to
some machine "a" which acts as a client / viewer to a virtual machine "v"
hosted on another machine "b", and make the usb device show up inside the
virtual machine as if it were attached directly to the virtual machine "v".

The described protocol assumes a reliable ordered bidirectional transport is
available, for example a tcp socket. All integers in the protocol are send
over the pipe in least significant byte first order. All structs send over
the pipe are packed (no padding).

Definitions:
usb-device: The usb-device whose usb transfers are being tunneled.
usb-guest: The entity connecting to the usb-device and using it as if
    connected directly to it. For example a virtual machine running a guest
    os which accesses a usb-device over the network as if it is part of the
    virtual machine.
usb-host: The entity making the usb-device available for use by a usb-guest.
    For example a deamon on a machine which "exports" the usb-device over the
    network which then "appears" inside a virtual machine on another machine.


Basic packet structure / communication
--------------------------------------

Each packet exchanged between the usb-guest and the usb-host starts with a
usb_redir_header, followed by an optional packet type specific header
follow by optional additional data.

The usb_redir_header each packet starts with looks as follows:

struct usb_redir_header {
    uint32_t type;
    uint32_t length;
    uint32_t id;
}

type:    This identifies the type of packet, from the type enum
length:  Length of the optional type specific packet header + the optional
         additional data. Can be 0.
id:      A unique id, generated by the usb-guest when sending a packet,
         the usb-host will use the same id in its response packet, allowing
         the usb-guest to match responses to its original requests.

There are 2 types of packets:

1) control packets
2) data packets

Control packets are handled synchroneously inside the usb-host, it will hand
the request over to the host os and then *wait* for a response. The usb-host
will thus stop processing further packets. Where as for data packets the
usb-host hands them over to the host os with the request to let the usb-host
process know when there is a respone from the usb-device.

Note that control packets should only be send to the usb-host when no data
packets are pending on the device / interface / endpoint affected by the
control packet. Any pending data packets will get dropped, and any active
iso streams / allocated bulk streams will get stopped / free-ed.


Packet type list
----------------

control packets:
usb_redir_hello
usb_redir_device_connect
usb_redir_device_disconnect
usb_redir_reset
usb_redir_interface_info
usb_redir_ep_info
usb_redir_set_configuration
usb_redir_get_configuration
usb_redir_configuration_status
usb_redir_set_alt_setting
usb_redir_get_alt_setting
usb_redir_alt_setting_status
usb_redir_start_iso_stream
usb_redir_stop_iso_stream
usb_redir_iso_stream_status
usb_redir_start_interrupt_receiving
usb_redir_stop_interrupt_receiving
usb_redir_interrupt_receiving_status
usb_redir_alloc_bulk_streams
usb_redir_free_bulk_streams
usb_redir_bulk_streams_status
usb_redir_cancel_data_packet

data packets:
usb_redir_control_packet
usb_redir_bulk_packet
usb_redir_iso_packet
usb_redir_interrupt_packet

Status code list
----------------

Many usb-host replies have a status field, this field can have the following
values:

enum {
    usb_redir_success,
    usb_redir_cancelled,    /* The transfer was cancelled */
    usb_redir_inval,        /* Invalid packet type / length / ep, etc. */
    usb_redir_ioerror,      /* IO error */
    usb_redir_stall,        /* Stalled */
    usb_redir_timeout,      /* Request timed out */
};

Note that in future versions there may be additional status codes to signal
new / other *error* conditions. So any unknown status value should be
interpreted as an error.


usb_redir_hello
---------------

usb_redir_header.type:    usb_redir_hello
usb_redir_header.length:  <see description>
usb_redir_header.id:      0 (always as this is an unsolicited packet)

struct usb_redir_hello_header {
    char     version[64];
    uint32_t capabilities[0];
}

No packet type specific additional data.

A packet of this type is send by both sides as soon as a connection is
establised. This packet contains:
version:       A free form 0 terminated version string, useful for logging
               should not be parsed! Suggested format: "qemu 0.13",
               "usb-redir-daemon 0.1", etc.
capabilities:  A variable length array for announcing capabilities.

The value of the length field depends on the size of the capabilities array.
If we cross the 32 capabilities count, it will go from 1 uint32_t to 2,
etc. the value is 64 + capabilities-array-size * sizeof(uint32_t).

Currently the following capabilities are defined:

enum {
    usb_redir_cap_bulk_streams, /* USB 3 bulk streams are supported */
};

usb_redir_device_connect
------------------------

usb_redir_header.type:    usb_redir_device_connect
usb_redir_header.length:  sizeof(usb_redir_device_connect_header)
usb_redir_header.id:      0 (always as this is an unsolicited packet)

enum {
    usb_redir_speed_low,
    usb_redir_speed_full,
    usb_redir_speed_high,
    usb_redir_speed_super,
    usb_redir_speed_unknown = 255
}

struct usb_redir_device_connect_header {
    uint8_t speed;
    uint8_t device_class;
    uint8_t device_subclass;
    uint8_t device_protocol;
    uint16_t vendor_id;
    uint16_t product_id;
}

No packet type specific additional data.

This packet gets send by the usb-host when a device becomes available (it is
possible for the usb-host to wait for a device to get plugged in).

Note that a usb-host may re-use the existing connection for a new / re-plugged
device in this case this packet can be send after a usb_redir_device_disconnect
message to notify the usb-guest that a new device is available.

usb_redir_device_disconnect
---------------------------

usb_redir_header.type:    usb_redir_device_disconnect
usb_redir_header.length:  0 (always as this is an unsolicited packet)

No packet type specific header.

No packet type specific additional data.

This packet may be send by the usb-host to indicate that the device has been
disconnect (unplugged). Note on some platforms the usb-host may not become
aware of the disconnection until a usb packet is send to the device.

usb_redir_reset
---------------

usb_redir_header.type:    usb_redir_reset
usb_redir_header.length:  0

No packet type specific header.

No packet type specific additional data.

This packet can be send by the usb-guest to cause a reset of the usb
device. Note that of things go wrong the usb-host may be unable to re-connect
to the device after the reset! If this happens a usb_redir_device_disconnect
packet will be send by the usb-host.

usb_redir_interface_info
------------------------

usb_redir_header.type:    usb_redir_interface_info
usb_redir_header.length:  sizeof(usb_redir_interface_info_header)
usb_redir_header.id:      0 (always as this is an unsolicited packet)

struct usb_redir_interface_info_header {
    uint32_t interface_count;
    uint8_t interface[32];
    uint8_t interface_class[32];
    uint8_t interface_subclass[32];
    uint8_t interface_protocol[32];
}

No packet type specific additional data.

This packet gets send by the usb-host to inform the usb-guest about the
interfaces of the device. It contains the interface number, class and protocol
info for interface_count interfaces. This gets send after a (successful)
initial connection, reset, set_config and set_alt_setting.

usb_redir_ep_info
-----------------

usb_redir_header.type:    usb_redir_ep_info
usb_redir_header.length:  sizeof(usb_redir_ep_info_header)
usb_redir_header.id:      0 (always as this is an unsolicited packet)

enum {
    /* Note these 4 match the usb spec! */
    usb_redir_type_control,
    usb_redir_type_iso,
    usb_redir_type_bulk,
    usb_redir_type_interrupt,
    usb_redir_type_invalid = 255
}

struct usb_redir_ep_info_header {
    uint8_t type[32];
    uint8_t interval[32];
    uint8_t interface[32];
}

No packet type specific additional data.

This packet gets send by the usb-host to let the usb-guest know the endpoint
type, interval and interface it belongs to for all possible endpoints,
first 0-15 out, then 0-15 in. This gets send after a (successful) initial
connection, reset, set_config and set_alt_setting.


usb_redir_set_configuration
---------------------------

usb_redir_header.type:    usb_redir_set_configuration
usb_redir_header.length:  sizeof(usb_redir_set_configuration_header)

struct usb_redir_set_configuration_header {
    uint8_t configuration;
}

No packet type specific additional data.

This packet can be send by the usb-guest to set (change) the active
configuration of the usb-device.

usb_redir_get_configuration
---------------------------

usb_redir_header.type:    usb_redir_get_configuration
usb_redir_header.length:  0

No packet type specific header.

No packet type specific additional data.

This packet can be send by the usb-guest to get (query) the active
configuration of the usb-device.

usb_redir_configuration_status
------------------------------

usb_redir_header.type:    usb_redir_configuration_status
usb_redir_header.length:  sizeof(usb_redir_configuration_status_header)

struct usb_redir_configuration_status_header {
    uint8_t status;
    uint8_t configuration;
}

No packet type specific additional data.

This is send by the usb-host in response to a usb_redir_set_configuration /
usb_redir_get_configuration packet. It reports a status code and on success
the resulting / active configuration.


usb_redir_set_alt_setting
-------------------------

usb_redir_header.type:    usb_redir_set_alt_setting
usb_redir_header.length:  sizeof(usb_redir_set_alt_setting_header)

struct usb_redir_set_alt_setting_header {
    uint8_t interface;
    uint8_t alt;
}

No packet type specific additional data.

This packet can be send by the usb-guest to set (change) the alt_setting of
interface <interface> to <alt>.

usb_redir_get_alt_setting
---------------------------

usb_redir_header.type:    usb_redir_get_alt_setting
usb_redir_header.length:  sizeof(usb_redir_get_alt_setting_header)

struct usb_redir_get_alt_setting_header {
    uint8_t interface;
}

No packet type specific additional data.

This packet can be send by the usb-guest to get (query) the active
alt_setting of an interface of the usb-device.

usb_redir_alt_setting_status
----------------------------

usb_redir_header.type:    usb_redir_alt_setting_status
usb_redir_header.length:  sizeof(usb_redir_alt_setting_status_header)

struct usb_redir_alt_setting_status_header {
    uint8_t status;
    uint8_t interface;
    uint8_t alt;
}

No packet type specific additional data.

This is send by the usb-host in response to a usb_redir_set_alt_setting /
usb_redir_get_alt_setting packet. It reports a status code, the affected
interface and on success the resulting / active alt_setting for that interface.


usb_redir_start_iso_stream
--------------------------

usb_redir_header.type:    usb_redir_start_iso_stream
usb_redir_header.length:  sizeof(usb_redir_start_iso_stream_header)

struct usb_redir_start_iso_stream_header {
    uint8_t endpoint;
    uint8_t pkts_per_urb;
    uint8_t no_urbs;
}

No packet type specific additional data.

This packet can be send by the usb-guest to start a iso stream on the
designated endpoint of the usb-device.

This function allocates no_urbs urbs with pkts_per_urb iso packets/frames
per urb. For iso input endpoints these urbs will get submitted to the
device *immediately*, for iso output endpoints the usb-host will wait till
it has received (pkts_per_urb * no_urbs / 2) packets to fill its buffers,
before submitting the first urb.

usb_redir_stop_iso_stream
-------------------------

usb_redir_header.type:    usb_redir_stop_iso_stream
usb_redir_header.length:  sizeof(struct usb_redir_start_iso_stream_header)

struct usb_redir_stop_iso_stream_header {
    uint8_t endpoint;
}

No packet type specific additional data.

This packet can be send by the usb-guest to stop an iso stream on the
designated endpoint. This will cancel all pending urbs, flush the usb-host's
buffers and free all relevant resources. Note that the usb-guest can still
receive isoc data packets from an isoc in endpoint after sending this, as
some data packets may already be inside the transport pipe.

usb_redir_iso_stream_status
---------------------------

usb_redir_header.type:    usb_redir_iso_stream_status
usb_redir_header.length:  sizeof(usb_redir_iso_stream_status_header)

struct usb_redir_iso_stream_status_header {
    uint8_t status;
    uint8_t endpoint;
}

No packet type specific additional data.

This packet is send by the usb-host in response to a
usb_redir_start_iso_stream or usb_redir_stop_iso_stream packet. Note that
for the starting of output iso streams a success status only indicates that
all the buffers were successfully allocated, the actual stream is not
started until enough packets are buffered.

Note that this can also be send unsolicited by a usb-host in case of an
error with an iso output stream, see usb_redir_iso_packet.

To allow the usb-guest to detect if the stream was adversely stopped, the
usb-host will always report usb_redir_stall as status if the stream was
stopped for any reason other then an usb_redir_stop_iso_stream.


usb_redir_start_interrupt_receiving
-----------------------------------

usb_redir_header.type:    usb_redir_start_interrupt_receiving
usb_redir_header.length:  sizeof(usb_redir_start_interrupt_receiving_header)

struct usb_redir_start_interrupt_receiving_header {
    uint8_t endpoint;
}

No packet type specific additional data.

This packet can be send by the usb-guest to start receiving interrupts
from the designated endpoint of the usb-device.

This function is for *input* interrupt endpoints only. Input interrupt
endpoints need to be polled timely otherwise data may get lost. So for
input interrupt endpoints the usb-host takes care of the submitting and
re-submitting of urbs.

On receiving this packet the usb-host will start an interrupt transfer
to the endpoint using the interval and maxPacketSize from the descriptors.
When this transfer completes, the usb-host will send an
usb_redir_interrupt_packet to the usb-guest, and will re-submit the urb.

usb_redir_stop_interrupt_receiving
----------------------------------

usb_redir_header.type:    usb_redir_stop_interrupt_receiving
usb_redir_header.length:  sizeof(struct usb_redir_start_interrupt_receiving_header)

struct usb_redir_stop_interrupt_receiving_header {
    uint8_t endpoint;
}

No packet type specific additional data.

This packet can be send by the usb-guest to stop interrupt receiving on the
designated endpoint. This will cancel the pending urb. Note that the usb-guest
can still receive usb_redir_interrupt_packet-s after sending this, as
some data packets may already be inside the transport pipe.

usb_redir_interrupt_receiving_status
------------------------------------

usb_redir_header.type:    usb_redir_interrupt_receiving_status
usb_redir_header.length:  sizeof(usb_redir_interrupt_receiving_status_header)

struct usb_redir_interrupt_receiving_status_header {
    uint8_t status;
    uint8_t endpoint;
}

No packet type specific additional data.

This packet is send by the usb-host in response to a
usb_redir_start_interrupt_receiving or usb_redir_stop_interrupt_receiving
packet.

Note that this can also be send unsolicited by a usb-host in case of an
error re-submitting the interrupt urb.

To allow the usb-guest to detect if the stream was adversely stopped, the
usb-host will always report usb_redir_stall as status if the stream was
stopped for any reason other then an usb_redir_stop_interrupt_receiving.


usb_redir_alloc_bulk_streams
----------------------------

usb_redir_header.type:    usb_redir_alloc_bulk_streams
usb_redir_header.length:  sizeof(usb_redir_alloc_bulk_streams_header)

struct usb_redir_alloc_bulk_streams_header {
    uint8_t endpoint;
    uint8_t no_streams;
}

No packet type specific additional data.

This packet can be send by the usb-guest to the usb-host to request
that the usb-host allocates IDs so the usb-guest can use up to no_streams
stream IDs.

usb_redir_free_bulk_streams
----------------------------

usb_redir_header.type:    usb_redir_free_bulk_streams
usb_redir_header.length:  sizeof(usb_redir_free_bulk_streams_header)

struct usb_redir_free_bulk_streams_header {
    uint8_t endpoint;
}

No packet type specific additional data.

This packet can be send by the usb-guest to the usb-host to free any
bulk streams previouisly allocated on the endpoint.

usb_redir_bulk_streams_status
-----------------------------

usb_redir_header.type:    usb_redir_bulk_streams_status
usb_redir_header.length:  sizeof(usb_redir_bulk_streams_status_header)

struct usb_redir_bulk_streams_status_header {
    uint8_t status;
    uint8_t endpoint;
    uint8_t no_streams;
}

No packet type specific additional data.

This packet is send by the usb-host in response to a
usb_redir_alloc_bulk_streams or usb_redir_free_bulk_streams packet. Note
that on a success status in response to a usb_redir_alloc_bulk_streams
no_streams may be less then requested due to host controller / device
limitations. On a success status in response to a usb_redir_alloc_bulk_streams
the usb-guest may use stream ids 1 through no_streams.


usb_redir_cancel_data_packet
----------------------------

usb_redir_header.type:    usb_redir_cancel_data_packet
usb_redir_header.id       <id of packet to cancel>
usb_redir_header.length:  0

No packet type specific header.

No packet type specific additional data.

This packet can be send by the usb-guest to cancel an earlier send data
packet, the id should be set to the id used when sending the packet the
guest no wishes to cancel.

Note that the usb-guest will always receive back a data packet of the same type
and with the same id, the usb-giuest can check if the packet completed
normally (before the cancel packet was processed by the usb-host), or was
cancelled by looking at the return data packet's status field.


usb_redir_control_packet
------------------------

usb_redir_header.type:    usb_redir_control_packet
usb_redir_header.length:  sizeof(usb_redir_control_packet_header) [+ length]

struct usb_redir_control_packet_header {
    uint8_t endpoint;
    uint8_t request;
    uint8_t requesttype;
    uint8_t status;
    uint16_t value;
    uint16_t index;
    uint16_t length;
}

The additional data contains the control msg data to be send / received.

Packets of this type can be send by the usb-guest to the usb-host to
initiate a control transfer on the usb-device. endpoint, request, requesttype,
value and index have their standard meaning for usb control messages.
The status field is only used in the usb-host's response.

length is the amount of data the usb-guest is sending / expects to read
(in the USB_DIR_IN case). Note that the length should only be added
to usb_redir_header.length in one direction (and the actual packet
length should match).

When the control msg has been processed by the usb-device the usb-host sends
a usb_redir_control_packet back to the usb-guest, with all fields unchanged
except for the status field and length which get updated to match the
actual results.


usb_redir_bulk_packet
---------------------

usb_redir_header.type:    usb_redir_bulk_packet
usb_redir_header.length:  sizeof(usb_redir_bulk_packet_header) [+ length]

struct usb_redir_bulk_packet_header {
    uint8_t endpoint;
    uint8_t status;
    uint16_t length;
    uint32_t stream_id;
}

The additional data contains the bulk msg data to be send / received.

Packets of this type can be send by the usb-guest to the usb-host to
initiate a bulk transfer on the usb-device. endpoint and stream_id have
their standard meaning for usb bulk messages. The status field is only used
in the usb-host's response. length is the amount of data the usb-guest is
sending / expects to read (depending on the direction of the endpoint).

When the bulk msg has been processed by the usb-device the usb-host sends
a usb_redir_bulk_packet back to the usb-guest, with the status field and
length updated to match the actual results.

Note just as usb_redir_control_packet this packet only has additional data
in one direction depending on the direction of the endpoint.


usb_redir_iso_packet
--------------------

usb_redir_header.type:    usb_redir_iso_packet
usb_redir_header.length:  sizeof(usb_redir_iso_packet_header) + length

struct usb_redir_iso_packet_header {
    uint8_t endpoint;
    uint8_t status;
    uint16_t length;
}

The additional data contains the iso msg data to be send / received.

Packets of this type should be send continuesly (at the endpoint interval
speed) as soon as an iso stream is started using usb_redir_start_iso_stream
the direction in which they gets send depends on the endpoints direction.

The status field only has meaning for packets send from the usb-host to
the usb-guest (for iso input endpoints). Due to buffering it is not possibly
to timely notify the usb-guest of transfer errors for iso output packets. The
usb-host will try to clear any error conditions itself. If it fails to do
so it will send a usb_redir_iso_stream_status to the usb-guest indicating
there is a problem with the iso stream.

Since usb_redir_iso_packet's are send continuously by the usb-host once
a stream is started on an iso input endpoint, the usb-host cannot set the
usb_redir_header.id to the id of the corresponding received packet. So for
usb_redir_iso_packet's the usb-host simply starts with an id of 0 and
increments this every packet. Note that when the usb-host has recovered from
a stall the id will restart at 0!


usb_redir_interrupt_packet
--------------------------

usb_redir_header.type:    usb_redir_interrupt_packet
usb_redir_header.length:  sizeof(usb_redir_interrupt_packet_header) [+ length]

struct usb_redir_interrupt_packet_header {
    uint8_t endpoint;
    uint8_t status;
    uint16_t length;
}

The additional data contains the interrupt msg data to be send / received.

The handling of interrupt endpoints differs significantly depending on wether
the endpoint is an input or output endpoint.

Input endpoints:
================

Input interrupt endpoints need to
be polled timely otherwise data may get lost. So for input interrupt endpoints
the usb-host takes care of the submitting and re-submitting of urbs, the
usb-guest can start / stop the receiving of interrupt packets using the
usb_redir_start_interrupt_receiving / usb_redir_stop_interrupt_receiving
packets. Note that for an input interrupt endpoint usb_redir_interrupt_packet-s
are only send in one direction, from the usb-host to the usb-guest!

Since usb_redir_interrupt_packet's are send unsolicited by the usb-host once
interrupt receiving has started, the usb-host cannot set the
usb_redir_header.id to the id of the corresponding received packet. So for
usb_redir_interrupt_packet's the usb-host simply starts with an id of 0 and
increments this every packet. Note that when the usb-host has recovered from
a stall the id will restart at 0!

Output endpoints:
=================

For interrupt output endpoints the normal asynchroneous mechanism also used
for control and bulk transfers is used:

The usb-guest sends a usb_redir_interrupt_packet to the usb-host. When the
interrupt msg has been processed by the usb-device the usb-host sends
a usb_redir_interrupt_packet back to the usb-guest, with the status field and
length updated to match the actual results. This packet only has additional
data (the data to output) when send from usb-guest to usb-host.

Note that since unlike with iso data there is usually no notion of a stream
with interrupt data, buffering makes no sense for output interrupt packets,
instead they are delivered asap. Despite this asap delivery it is likely
that the timing constraints which apply to interrupt output transfers will
not be met. The consequences of this will vary from device to device.
