vvfat: fat_chksum(): fix access above array bounds
[qemu.git] / hw / usb-hub.c
blob2a1edfc956228704df087555b33b77ed5d6e5f0b
1 /*
2 * QEMU USB HUB emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
24 #include "qemu-common.h"
25 #include "usb.h"
27 //#define DEBUG
29 #define MAX_PORTS 8
31 typedef struct USBHubPort {
32 USBPort port;
33 uint16_t wPortStatus;
34 uint16_t wPortChange;
35 } USBHubPort;
37 typedef struct USBHubState {
38 USBDevice dev;
39 int nb_ports;
40 USBHubPort ports[MAX_PORTS];
41 } USBHubState;
43 #define ClearHubFeature (0x2000 | USB_REQ_CLEAR_FEATURE)
44 #define ClearPortFeature (0x2300 | USB_REQ_CLEAR_FEATURE)
45 #define GetHubDescriptor (0xa000 | USB_REQ_GET_DESCRIPTOR)
46 #define GetHubStatus (0xa000 | USB_REQ_GET_STATUS)
47 #define GetPortStatus (0xa300 | USB_REQ_GET_STATUS)
48 #define SetHubFeature (0x2000 | USB_REQ_SET_FEATURE)
49 #define SetPortFeature (0x2300 | USB_REQ_SET_FEATURE)
51 #define PORT_STAT_CONNECTION 0x0001
52 #define PORT_STAT_ENABLE 0x0002
53 #define PORT_STAT_SUSPEND 0x0004
54 #define PORT_STAT_OVERCURRENT 0x0008
55 #define PORT_STAT_RESET 0x0010
56 #define PORT_STAT_POWER 0x0100
57 #define PORT_STAT_LOW_SPEED 0x0200
58 #define PORT_STAT_HIGH_SPEED 0x0400
59 #define PORT_STAT_TEST 0x0800
60 #define PORT_STAT_INDICATOR 0x1000
62 #define PORT_STAT_C_CONNECTION 0x0001
63 #define PORT_STAT_C_ENABLE 0x0002
64 #define PORT_STAT_C_SUSPEND 0x0004
65 #define PORT_STAT_C_OVERCURRENT 0x0008
66 #define PORT_STAT_C_RESET 0x0010
68 #define PORT_CONNECTION 0
69 #define PORT_ENABLE 1
70 #define PORT_SUSPEND 2
71 #define PORT_OVERCURRENT 3
72 #define PORT_RESET 4
73 #define PORT_POWER 8
74 #define PORT_LOWSPEED 9
75 #define PORT_HIGHSPEED 10
76 #define PORT_C_CONNECTION 16
77 #define PORT_C_ENABLE 17
78 #define PORT_C_SUSPEND 18
79 #define PORT_C_OVERCURRENT 19
80 #define PORT_C_RESET 20
81 #define PORT_TEST 21
82 #define PORT_INDICATOR 22
84 /* same as Linux kernel root hubs */
86 static const uint8_t qemu_hub_dev_descriptor[] = {
87 0x12, /* u8 bLength; */
88 0x01, /* u8 bDescriptorType; Device */
89 0x10, 0x01, /* u16 bcdUSB; v1.1 */
91 0x09, /* u8 bDeviceClass; HUB_CLASSCODE */
92 0x00, /* u8 bDeviceSubClass; */
93 0x00, /* u8 bDeviceProtocol; [ low/full speeds only ] */
94 0x08, /* u8 bMaxPacketSize0; 8 Bytes */
96 0x00, 0x00, /* u16 idVendor; */
97 0x00, 0x00, /* u16 idProduct; */
98 0x01, 0x01, /* u16 bcdDevice */
100 0x03, /* u8 iManufacturer; */
101 0x02, /* u8 iProduct; */
102 0x01, /* u8 iSerialNumber; */
103 0x01 /* u8 bNumConfigurations; */
106 /* XXX: patch interrupt size */
107 static const uint8_t qemu_hub_config_descriptor[] = {
109 /* one configuration */
110 0x09, /* u8 bLength; */
111 0x02, /* u8 bDescriptorType; Configuration */
112 0x19, 0x00, /* u16 wTotalLength; */
113 0x01, /* u8 bNumInterfaces; (1) */
114 0x01, /* u8 bConfigurationValue; */
115 0x00, /* u8 iConfiguration; */
116 0xe0, /* u8 bmAttributes;
117 Bit 7: must be set,
118 6: Self-powered,
119 5: Remote wakeup,
120 4..0: resvd */
121 0x00, /* u8 MaxPower; */
123 /* USB 1.1:
124 * USB 2.0, single TT organization (mandatory):
125 * one interface, protocol 0
127 * USB 2.0, multiple TT organization (optional):
128 * two interfaces, protocols 1 (like single TT)
129 * and 2 (multiple TT mode) ... config is
130 * sometimes settable
131 * NOT IMPLEMENTED
134 /* one interface */
135 0x09, /* u8 if_bLength; */
136 0x04, /* u8 if_bDescriptorType; Interface */
137 0x00, /* u8 if_bInterfaceNumber; */
138 0x00, /* u8 if_bAlternateSetting; */
139 0x01, /* u8 if_bNumEndpoints; */
140 0x09, /* u8 if_bInterfaceClass; HUB_CLASSCODE */
141 0x00, /* u8 if_bInterfaceSubClass; */
142 0x00, /* u8 if_bInterfaceProtocol; [usb1.1 or single tt] */
143 0x00, /* u8 if_iInterface; */
145 /* one endpoint (status change endpoint) */
146 0x07, /* u8 ep_bLength; */
147 0x05, /* u8 ep_bDescriptorType; Endpoint */
148 0x81, /* u8 ep_bEndpointAddress; IN Endpoint 1 */
149 0x03, /* u8 ep_bmAttributes; Interrupt */
150 0x02, 0x00, /* u16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8) */
151 0xff /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
154 static const uint8_t qemu_hub_hub_descriptor[] =
156 0x00, /* u8 bLength; patched in later */
157 0x29, /* u8 bDescriptorType; Hub-descriptor */
158 0x00, /* u8 bNbrPorts; (patched later) */
159 0x0a, /* u16 wHubCharacteristics; */
160 0x00, /* (per-port OC, no power switching) */
161 0x01, /* u8 bPwrOn2pwrGood; 2ms */
162 0x00 /* u8 bHubContrCurrent; 0 mA */
164 /* DeviceRemovable and PortPwrCtrlMask patched in later */
167 static void usb_hub_attach(USBPort *port1, USBDevice *dev)
169 USBHubState *s = port1->opaque;
170 USBHubPort *port = &s->ports[port1->index];
172 if (dev) {
173 if (port->port.dev)
174 usb_attach(port1, NULL);
176 port->wPortStatus |= PORT_STAT_CONNECTION;
177 port->wPortChange |= PORT_STAT_C_CONNECTION;
178 if (dev->speed == USB_SPEED_LOW)
179 port->wPortStatus |= PORT_STAT_LOW_SPEED;
180 else
181 port->wPortStatus &= ~PORT_STAT_LOW_SPEED;
182 port->port.dev = dev;
183 /* send the attach message */
184 usb_send_msg(dev, USB_MSG_ATTACH);
185 } else {
186 dev = port->port.dev;
187 if (dev) {
188 port->wPortStatus &= ~PORT_STAT_CONNECTION;
189 port->wPortChange |= PORT_STAT_C_CONNECTION;
190 if (port->wPortStatus & PORT_STAT_ENABLE) {
191 port->wPortStatus &= ~PORT_STAT_ENABLE;
192 port->wPortChange |= PORT_STAT_C_ENABLE;
194 /* send the detach message */
195 usb_send_msg(dev, USB_MSG_DETACH);
196 port->port.dev = NULL;
201 static void usb_hub_handle_reset(USBDevice *dev)
203 /* XXX: do it */
206 static int usb_hub_handle_control(USBDevice *dev, int request, int value,
207 int index, int length, uint8_t *data)
209 USBHubState *s = (USBHubState *)dev;
210 int ret;
212 switch(request) {
213 case DeviceRequest | USB_REQ_GET_STATUS:
214 data[0] = (1 << USB_DEVICE_SELF_POWERED) |
215 (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
216 data[1] = 0x00;
217 ret = 2;
218 break;
219 case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
220 if (value == USB_DEVICE_REMOTE_WAKEUP) {
221 dev->remote_wakeup = 0;
222 } else {
223 goto fail;
225 ret = 0;
226 break;
227 case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
228 if (value == 0 && index != 0x81) { /* clear ep halt */
229 goto fail;
231 ret = 0;
232 break;
233 case DeviceOutRequest | USB_REQ_SET_FEATURE:
234 if (value == USB_DEVICE_REMOTE_WAKEUP) {
235 dev->remote_wakeup = 1;
236 } else {
237 goto fail;
239 ret = 0;
240 break;
241 case DeviceOutRequest | USB_REQ_SET_ADDRESS:
242 dev->addr = value;
243 ret = 0;
244 break;
245 case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
246 switch(value >> 8) {
247 case USB_DT_DEVICE:
248 memcpy(data, qemu_hub_dev_descriptor,
249 sizeof(qemu_hub_dev_descriptor));
250 ret = sizeof(qemu_hub_dev_descriptor);
251 break;
252 case USB_DT_CONFIG:
253 memcpy(data, qemu_hub_config_descriptor,
254 sizeof(qemu_hub_config_descriptor));
256 /* status change endpoint size based on number
257 * of ports */
258 data[22] = (s->nb_ports + 1 + 7) / 8;
260 ret = sizeof(qemu_hub_config_descriptor);
261 break;
262 case USB_DT_STRING:
263 switch(value & 0xff) {
264 case 0:
265 /* language ids */
266 data[0] = 4;
267 data[1] = 3;
268 data[2] = 0x09;
269 data[3] = 0x04;
270 ret = 4;
271 break;
272 case 1:
273 /* serial number */
274 ret = set_usb_string(data, "314159");
275 break;
276 case 2:
277 /* product description */
278 ret = set_usb_string(data, "QEMU USB Hub");
279 break;
280 case 3:
281 /* vendor description */
282 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
283 break;
284 default:
285 goto fail;
287 break;
288 default:
289 goto fail;
291 break;
292 case DeviceRequest | USB_REQ_GET_CONFIGURATION:
293 data[0] = 1;
294 ret = 1;
295 break;
296 case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
297 ret = 0;
298 break;
299 case DeviceRequest | USB_REQ_GET_INTERFACE:
300 data[0] = 0;
301 ret = 1;
302 break;
303 case DeviceOutRequest | USB_REQ_SET_INTERFACE:
304 ret = 0;
305 break;
306 /* usb specific requests */
307 case GetHubStatus:
308 data[0] = 0;
309 data[1] = 0;
310 data[2] = 0;
311 data[3] = 0;
312 ret = 4;
313 break;
314 case GetPortStatus:
316 unsigned int n = index - 1;
317 USBHubPort *port;
318 if (n >= s->nb_ports)
319 goto fail;
320 port = &s->ports[n];
321 data[0] = port->wPortStatus;
322 data[1] = port->wPortStatus >> 8;
323 data[2] = port->wPortChange;
324 data[3] = port->wPortChange >> 8;
325 ret = 4;
327 break;
328 case SetHubFeature:
329 case ClearHubFeature:
330 if (value == 0 || value == 1) {
331 } else {
332 goto fail;
334 ret = 0;
335 break;
336 case SetPortFeature:
338 unsigned int n = index - 1;
339 USBHubPort *port;
340 USBDevice *dev;
341 if (n >= s->nb_ports)
342 goto fail;
343 port = &s->ports[n];
344 dev = port->port.dev;
345 switch(value) {
346 case PORT_SUSPEND:
347 port->wPortStatus |= PORT_STAT_SUSPEND;
348 break;
349 case PORT_RESET:
350 if (dev) {
351 usb_send_msg(dev, USB_MSG_RESET);
352 port->wPortChange |= PORT_STAT_C_RESET;
353 /* set enable bit */
354 port->wPortStatus |= PORT_STAT_ENABLE;
356 break;
357 case PORT_POWER:
358 break;
359 default:
360 goto fail;
362 ret = 0;
364 break;
365 case ClearPortFeature:
367 unsigned int n = index - 1;
368 USBHubPort *port;
370 if (n >= s->nb_ports)
371 goto fail;
372 port = &s->ports[n];
373 switch(value) {
374 case PORT_ENABLE:
375 port->wPortStatus &= ~PORT_STAT_ENABLE;
376 break;
377 case PORT_C_ENABLE:
378 port->wPortChange &= ~PORT_STAT_C_ENABLE;
379 break;
380 case PORT_SUSPEND:
381 port->wPortStatus &= ~PORT_STAT_SUSPEND;
382 break;
383 case PORT_C_SUSPEND:
384 port->wPortChange &= ~PORT_STAT_C_SUSPEND;
385 break;
386 case PORT_C_CONNECTION:
387 port->wPortChange &= ~PORT_STAT_C_CONNECTION;
388 break;
389 case PORT_C_OVERCURRENT:
390 port->wPortChange &= ~PORT_STAT_C_OVERCURRENT;
391 break;
392 case PORT_C_RESET:
393 port->wPortChange &= ~PORT_STAT_C_RESET;
394 break;
395 default:
396 goto fail;
398 ret = 0;
400 break;
401 case GetHubDescriptor:
403 unsigned int n, limit, var_hub_size = 0;
404 memcpy(data, qemu_hub_hub_descriptor,
405 sizeof(qemu_hub_hub_descriptor));
406 data[2] = s->nb_ports;
408 /* fill DeviceRemovable bits */
409 limit = ((s->nb_ports + 1 + 7) / 8) + 7;
410 for (n = 7; n < limit; n++) {
411 data[n] = 0x00;
412 var_hub_size++;
415 /* fill PortPwrCtrlMask bits */
416 limit = limit + ((s->nb_ports + 7) / 8);
417 for (;n < limit; n++) {
418 data[n] = 0xff;
419 var_hub_size++;
422 ret = sizeof(qemu_hub_hub_descriptor) + var_hub_size;
423 data[0] = ret;
424 break;
426 default:
427 fail:
428 ret = USB_RET_STALL;
429 break;
431 return ret;
434 static int usb_hub_handle_data(USBDevice *dev, USBPacket *p)
436 USBHubState *s = (USBHubState *)dev;
437 int ret;
439 switch(p->pid) {
440 case USB_TOKEN_IN:
441 if (p->devep == 1) {
442 USBHubPort *port;
443 unsigned int status;
444 int i, n;
445 n = (s->nb_ports + 1 + 7) / 8;
446 if (p->len == 1) { /* FreeBSD workaround */
447 n = 1;
448 } else if (n > p->len) {
449 return USB_RET_BABBLE;
451 status = 0;
452 for(i = 0; i < s->nb_ports; i++) {
453 port = &s->ports[i];
454 if (port->wPortChange)
455 status |= (1 << (i + 1));
457 if (status != 0) {
458 for(i = 0; i < n; i++) {
459 p->data[i] = status >> (8 * i);
461 ret = n;
462 } else {
463 ret = USB_RET_NAK; /* usb11 11.13.1 */
465 } else {
466 goto fail;
468 break;
469 case USB_TOKEN_OUT:
470 default:
471 fail:
472 ret = USB_RET_STALL;
473 break;
475 return ret;
478 static int usb_hub_broadcast_packet(USBHubState *s, USBPacket *p)
480 USBHubPort *port;
481 USBDevice *dev;
482 int i, ret;
484 for(i = 0; i < s->nb_ports; i++) {
485 port = &s->ports[i];
486 dev = port->port.dev;
487 if (dev && (port->wPortStatus & PORT_STAT_ENABLE)) {
488 ret = dev->info->handle_packet(dev, p);
489 if (ret != USB_RET_NODEV) {
490 return ret;
494 return USB_RET_NODEV;
497 static int usb_hub_handle_packet(USBDevice *dev, USBPacket *p)
499 USBHubState *s = (USBHubState *)dev;
501 #if defined(DEBUG) && 0
502 printf("usb_hub: pid=0x%x\n", pid);
503 #endif
504 if (dev->state == USB_STATE_DEFAULT &&
505 dev->addr != 0 &&
506 p->devaddr != dev->addr &&
507 (p->pid == USB_TOKEN_SETUP ||
508 p->pid == USB_TOKEN_OUT ||
509 p->pid == USB_TOKEN_IN)) {
510 /* broadcast the packet to the devices */
511 return usb_hub_broadcast_packet(s, p);
513 return usb_generic_handle_packet(dev, p);
516 static void usb_hub_handle_destroy(USBDevice *dev)
518 USBHubState *s = (USBHubState *)dev;
519 int i;
521 for (i = 0; i < s->nb_ports; i++) {
522 usb_unregister_port(usb_bus_from_device(dev),
523 &s->ports[i].port);
527 static int usb_hub_initfn(USBDevice *dev)
529 USBHubState *s = DO_UPCAST(USBHubState, dev, dev);
530 USBHubPort *port;
531 int i;
533 s->dev.speed = USB_SPEED_FULL,
534 s->nb_ports = MAX_PORTS; /* FIXME: make configurable */
535 for (i = 0; i < s->nb_ports; i++) {
536 port = &s->ports[i];
537 usb_register_port(usb_bus_from_device(dev),
538 &port->port, s, i, usb_hub_attach);
539 port->wPortStatus = PORT_STAT_POWER;
540 port->wPortChange = 0;
542 return 0;
545 static struct USBDeviceInfo hub_info = {
546 .product_desc = "QEMU USB Hub",
547 .qdev.name = "usb-hub",
548 .qdev.size = sizeof(USBHubState),
549 .init = usb_hub_initfn,
550 .handle_packet = usb_hub_handle_packet,
551 .handle_reset = usb_hub_handle_reset,
552 .handle_control = usb_hub_handle_control,
553 .handle_data = usb_hub_handle_data,
554 .handle_destroy = usb_hub_handle_destroy,
557 static void usb_hub_register_devices(void)
559 usb_qdev_register(&hub_info);
561 device_init(usb_hub_register_devices)