2 * Copyright (C) 2011 Red Hat, Inc.
4 * CCID Device emulation
6 * Written by Alon Levy, with contributions from Robert Relyea.
8 * Based on usb-serial.c, see its copyright and attributions below.
10 * This work is licensed under the terms of the GNU GPL, version 2.1 or later.
11 * See the COPYING file in the top-level directory.
12 * ------- (original copyright & attribution for usb-serial.c below) --------
13 * Copyright (c) 2006 CodeSourcery.
14 * Copyright (c) 2008 Samuel Thibault <samuel.thibault@ens-lyon.org>
15 * Written by Paul Brook, reused for FTDI by Samuel Thibault,
21 * CCID Specification Revision 1.1 April 22nd 2005
22 * "Universal Serial Bus, Device Class: Smart Card"
23 * Specification for Integrated Circuit(s) Cards Interface Devices
25 * Endianness note: from the spec (1.3)
26 * "Fields that are larger than a byte are stored in little endian"
29 * 1. remove/insert can sometimes result in removed state instead of inserted.
30 * This is a result of the following:
31 * symptom: dmesg shows ERMOTEIO (-121), pcscd shows -99. This can happen
32 * when a short packet is sent, as seen in uhci-usb.c, resulting from a urb
33 * from the guest requesting SPD and us returning a smaller packet.
34 * Not sure which messages trigger this.
37 #include "qemu/osdep.h"
38 #include "qemu/units.h"
39 #include "qapi/error.h"
40 #include "qemu-common.h"
41 #include "qemu/error-report.h"
42 #include "qemu/module.h"
48 #define DPRINTF(s, lvl, fmt, ...) \
50 if (lvl <= s->debug) { \
51 printf("usb-ccid: " fmt , ## __VA_ARGS__); \
60 #define CCID_DEV_NAME "usb-ccid"
61 #define USB_CCID_DEV(obj) OBJECT_CHECK(USBCCIDState, (obj), CCID_DEV_NAME)
63 * The two options for variable sized buffers:
64 * make them constant size, for large enough constant,
65 * or handle the migration complexity - VMState doesn't handle this case.
66 * sizes are expected never to be exceeded, unless guest misbehaves.
68 #define BULK_OUT_DATA_SIZE (64 * KiB)
69 #define PENDING_ANSWERS_NUM 128
71 #define BULK_IN_BUF_SIZE 384
72 #define BULK_IN_PENDING_NUM 8
74 #define CCID_MAX_PACKET_SIZE 64
76 #define CCID_CONTROL_ABORT 0x1
77 #define CCID_CONTROL_GET_CLOCK_FREQUENCIES 0x2
78 #define CCID_CONTROL_GET_DATA_RATES 0x3
80 #define CCID_PRODUCT_DESCRIPTION "QEMU USB CCID"
81 #define CCID_VENDOR_DESCRIPTION "QEMU"
82 #define CCID_INTERFACE_NAME "CCID Interface"
83 #define CCID_SERIAL_NUMBER_STRING "1"
85 * Using Gemplus Vendor and Product id
86 * Effect on various drivers:
87 * usbccid.sys (winxp, others untested) is a class driver so it doesn't care.
88 * linux has a number of class drivers, but openct filters based on
89 * vendor/product (/etc/openct.conf under fedora), hence Gemplus.
91 #define CCID_VENDOR_ID 0x08e6
92 #define CCID_PRODUCT_ID 0x4433
93 #define CCID_DEVICE_VERSION 0x0000
96 * BULK_OUT messages from PC to Reader
97 * Defined in CCID Rev 1.1 6.1 (page 26)
99 #define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn 0x62
100 #define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff 0x63
101 #define CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus 0x65
102 #define CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock 0x6f
103 #define CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters 0x6c
104 #define CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters 0x6d
105 #define CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters 0x61
106 #define CCID_MESSAGE_TYPE_PC_to_RDR_Escape 0x6b
107 #define CCID_MESSAGE_TYPE_PC_to_RDR_IccClock 0x6e
108 #define CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU 0x6a
109 #define CCID_MESSAGE_TYPE_PC_to_RDR_Secure 0x69
110 #define CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical 0x71
111 #define CCID_MESSAGE_TYPE_PC_to_RDR_Abort 0x72
112 #define CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency 0x73
115 * BULK_IN messages from Reader to PC
116 * Defined in CCID Rev 1.1 6.2 (page 48)
118 #define CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock 0x80
119 #define CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus 0x81
120 #define CCID_MESSAGE_TYPE_RDR_to_PC_Parameters 0x82
121 #define CCID_MESSAGE_TYPE_RDR_to_PC_Escape 0x83
122 #define CCID_MESSAGE_TYPE_RDR_to_PC_DataRateAndClockFrequency 0x84
125 * INTERRUPT_IN messages from Reader to PC
126 * Defined in CCID Rev 1.1 6.3 (page 56)
128 #define CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange 0x50
129 #define CCID_MESSAGE_TYPE_RDR_to_PC_HardwareError 0x51
132 * Endpoints for CCID - addresses are up to us to decide.
133 * To support slot insertion and removal we must have an interrupt in ep
134 * in addition we need a bulk in and bulk out ep
137 #define CCID_INT_IN_EP 1
138 #define CCID_BULK_IN_EP 2
139 #define CCID_BULK_OUT_EP 3
141 /* bmSlotICCState masks */
142 #define SLOT_0_STATE_MASK 1
143 #define SLOT_0_CHANGED_MASK 2
145 /* Status codes that go in bStatus (see 6.2.6) */
147 ICC_STATUS_PRESENT_ACTIVE
= 0,
148 ICC_STATUS_PRESENT_INACTIVE
,
149 ICC_STATUS_NOT_PRESENT
153 COMMAND_STATUS_NO_ERROR
= 0,
154 COMMAND_STATUS_FAILED
,
155 COMMAND_STATUS_TIME_EXTENSION_REQUIRED
158 /* Error codes that go in bError (see 6.2.6) */
160 ERROR_CMD_NOT_SUPPORTED
= 0,
161 ERROR_CMD_ABORTED
= -1,
163 ERROR_XFR_PARITY_ERROR
= -3,
164 ERROR_XFR_OVERRUN
= -4,
168 /* 6.2.6 RDR_to_PC_SlotStatus definitions */
170 CLOCK_STATUS_RUNNING
= 0,
172 * 0 - Clock Running, 1 - Clock stopped in State L, 2 - H,
173 * 3 - unknown state. rest are RFU
177 typedef struct QEMU_PACKED CCID_Header
{
178 uint8_t bMessageType
;
184 typedef struct QEMU_PACKED CCID_BULK_IN
{
186 uint8_t bStatus
; /* Only used in BULK_IN */
187 uint8_t bError
; /* Only used in BULK_IN */
190 typedef struct QEMU_PACKED CCID_SlotStatus
{
192 uint8_t bClockStatus
;
195 typedef struct QEMU_PACKED CCID_T0ProtocolDataStructure
{
196 uint8_t bmFindexDindex
;
198 uint8_t bGuardTimeT0
;
199 uint8_t bWaitingIntegerT0
;
201 } CCID_T0ProtocolDataStructure
;
203 typedef struct QEMU_PACKED CCID_T1ProtocolDataStructure
{
204 uint8_t bmFindexDindex
;
206 uint8_t bGuardTimeT1
;
207 uint8_t bWaitingIntegerT1
;
211 } CCID_T1ProtocolDataStructure
;
213 typedef union CCID_ProtocolDataStructure
{
214 CCID_T0ProtocolDataStructure t0
;
215 CCID_T1ProtocolDataStructure t1
;
216 uint8_t data
[7]; /* must be = max(sizeof(t0), sizeof(t1)) */
217 } CCID_ProtocolDataStructure
;
219 typedef struct QEMU_PACKED CCID_Parameter
{
221 uint8_t bProtocolNum
;
222 CCID_ProtocolDataStructure abProtocolDataStructure
;
225 typedef struct QEMU_PACKED CCID_DataBlock
{
227 uint8_t bChainParameter
;
231 /* 6.1.4 PC_to_RDR_XfrBlock */
232 typedef struct QEMU_PACKED CCID_XferBlock
{
234 uint8_t bBWI
; /* Block Waiting Timeout */
235 uint16_t wLevelParameter
; /* XXX currently unused */
239 typedef struct QEMU_PACKED CCID_IccPowerOn
{
241 uint8_t bPowerSelect
;
245 typedef struct QEMU_PACKED CCID_IccPowerOff
{
250 typedef struct QEMU_PACKED CCID_SetParameters
{
252 uint8_t bProtocolNum
;
254 CCID_ProtocolDataStructure abProtocolDataStructure
;
255 } CCID_SetParameters
;
257 typedef struct CCID_Notify_Slot_Change
{
258 uint8_t bMessageType
; /* CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange */
259 uint8_t bmSlotICCState
;
260 } CCID_Notify_Slot_Change
;
262 /* used for DataBlock response to XferBlock */
263 typedef struct Answer
{
268 /* pending BULK_IN messages */
269 typedef struct BulkIn
{
270 uint8_t data
[BULK_IN_BUF_SIZE
];
275 typedef struct CCIDBus
{
280 * powered - defaults to true, changed by PowerOn/PowerOff messages
282 typedef struct USBCCIDState
{
288 BulkIn bulk_in_pending
[BULK_IN_PENDING_NUM
]; /* circular */
289 uint32_t bulk_in_pending_start
;
290 uint32_t bulk_in_pending_end
; /* first free */
291 uint32_t bulk_in_pending_num
;
292 BulkIn
*current_bulk_in
;
293 uint8_t bulk_out_data
[BULK_OUT_DATA_SIZE
];
294 uint32_t bulk_out_pos
;
295 uint64_t last_answer_error
;
296 Answer pending_answers
[PENDING_ANSWERS_NUM
];
297 uint32_t pending_answers_start
;
298 uint32_t pending_answers_end
;
299 uint32_t pending_answers_num
;
301 uint8_t bmCommandStatus
;
302 uint8_t bProtocolNum
;
303 CCID_ProtocolDataStructure abProtocolDataStructure
;
304 uint32_t ulProtocolDataStructureSize
;
305 uint32_t state_vmstate
;
306 uint8_t bmSlotICCState
;
308 uint8_t notify_slot_change
;
313 * CCID Spec chapter 4: CCID uses a standard device descriptor per Chapter 9,
314 * "USB Device Framework", section 9.6.1, in the Universal Serial Bus
317 * This device implemented based on the spec and with an Athena Smart Card
318 * Reader as reference:
319 * 0dc3:1004 Athena Smartcard Solutions, Inc.
322 static const uint8_t qemu_ccid_descriptor
[] = {
323 /* Smart Card Device Class Descriptor */
324 0x36, /* u8 bLength; */
325 0x21, /* u8 bDescriptorType; Functional */
326 0x10, 0x01, /* u16 bcdCCID; CCID Specification Release Number. */
328 * u8 bMaxSlotIndex; The index of the highest available
329 * slot on this device. All slots are consecutive starting
332 0x07, /* u8 bVoltageSupport; 01h - 5.0v, 02h - 3.0, 03 - 1.8 */
334 0x01, 0x00, /* u32 dwProtocols; RRRR PPPP. RRRR = 0000h.*/
335 0x00, 0x00, /* PPPP: 0001h = Protocol T=0, 0002h = Protocol T=1 */
336 /* u32 dwDefaultClock; in kHZ (0x0fa0 is 4 MHz) */
337 0xa0, 0x0f, 0x00, 0x00,
338 /* u32 dwMaximumClock; */
339 0x00, 0x00, 0x01, 0x00,
340 0x00, /* u8 bNumClockSupported; *
341 * 0 means just the default and max. */
342 /* u32 dwDataRate ;bps. 9600 == 00002580h */
343 0x80, 0x25, 0x00, 0x00,
344 /* u32 dwMaxDataRate ; 11520 bps == 0001C200h */
345 0x00, 0xC2, 0x01, 0x00,
346 0x00, /* u8 bNumDataRatesSupported; 00 means all rates between
349 * maximum IFSD supported by CCID for protocol *
350 * T=1 (Maximum seen from various cards) */
351 0xfe, 0x00, 0x00, 0x00,
352 /* u32 dwSyncProtocols; 1 - 2-wire, 2 - 3-wire, 4 - I2C */
353 0x00, 0x00, 0x00, 0x00,
354 /* u32 dwMechanical; 0 - no special characteristics. */
355 0x00, 0x00, 0x00, 0x00,
358 * 0 - No special characteristics
359 * + 2 Automatic parameter configuration based on ATR data
360 * + 4 Automatic activation of ICC on inserting
361 * + 8 Automatic ICC voltage selection
362 * + 10 Automatic ICC clock frequency change
363 * + 20 Automatic baud rate change
364 * + 40 Automatic parameters negotiation made by the CCID
365 * + 80 automatic PPS made by the CCID
366 * 100 CCID can set ICC in clock stop mode
367 * 200 NAD value other then 00 accepted (T=1 protocol)
368 * + 400 Automatic IFSD exchange as first exchange (T=1)
369 * One of the following only:
370 * + 10000 TPDU level exchanges with CCID
371 * 20000 Short APDU level exchange with CCID
372 * 40000 Short and Extended APDU level exchange with CCID
374 * 100000 USB Wake up signaling supported on card
375 * insertion and removal. Must set bit 5 in bmAttributes
376 * in Configuration descriptor if 100000 is set.
378 0xfe, 0x04, 0x01, 0x00,
380 * u32 dwMaxCCIDMessageLength; For extended APDU in
381 * [261 + 10 , 65544 + 10]. Otherwise the minimum is
382 * wMaxPacketSize of the Bulk-OUT endpoint
384 0x12, 0x00, 0x01, 0x00,
386 * u8 bClassGetResponse; Significant only for CCID that
387 * offers an APDU level for exchanges. Indicates the
388 * default class value used by the CCID when it sends a
389 * Get Response command to perform the transportation of
390 * an APDU by T=0 protocol
391 * FFh indicates that the CCID echos the class of the APDU.
394 * u8 bClassEnvelope; EAPDU only. Envelope command for
398 * u16 wLcdLayout; XXYY Number of lines (XX) and chars per
399 * line for LCD display used for PIN entry. 0000 - no LCD
402 * u8 bPINSupport; 01h PIN Verification,
403 * 02h PIN Modification
405 0x01, /* u8 bMaxCCIDBusySlots; */
409 STR_MANUFACTURER
= 1,
415 static const USBDescStrings desc_strings
= {
416 [STR_MANUFACTURER
] = "QEMU",
417 [STR_PRODUCT
] = "QEMU USB CCID",
418 [STR_SERIALNUMBER
] = "1",
419 [STR_INTERFACE
] = "CCID Interface",
422 static const USBDescIface desc_iface0
= {
423 .bInterfaceNumber
= 0,
425 .bInterfaceClass
= USB_CLASS_CSCID
,
426 .bInterfaceSubClass
= USB_SUBCLASS_UNDEFINED
,
427 .bInterfaceProtocol
= 0x00,
428 .iInterface
= STR_INTERFACE
,
430 .descs
= (USBDescOther
[]) {
432 /* smartcard descriptor */
433 .data
= qemu_ccid_descriptor
,
436 .eps
= (USBDescEndpoint
[]) {
438 .bEndpointAddress
= USB_DIR_IN
| CCID_INT_IN_EP
,
439 .bmAttributes
= USB_ENDPOINT_XFER_INT
,
441 .wMaxPacketSize
= 64,
443 .bEndpointAddress
= USB_DIR_IN
| CCID_BULK_IN_EP
,
444 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
445 .wMaxPacketSize
= 64,
447 .bEndpointAddress
= USB_DIR_OUT
| CCID_BULK_OUT_EP
,
448 .bmAttributes
= USB_ENDPOINT_XFER_BULK
,
449 .wMaxPacketSize
= 64,
454 static const USBDescDevice desc_device
= {
456 .bMaxPacketSize0
= 64,
457 .bNumConfigurations
= 1,
458 .confs
= (USBDescConfig
[]) {
461 .bConfigurationValue
= 1,
462 .bmAttributes
= USB_CFG_ATT_ONE
| USB_CFG_ATT_SELFPOWER
|
471 static const USBDesc desc_ccid
= {
473 .idVendor
= CCID_VENDOR_ID
,
474 .idProduct
= CCID_PRODUCT_ID
,
475 .bcdDevice
= CCID_DEVICE_VERSION
,
476 .iManufacturer
= STR_MANUFACTURER
,
477 .iProduct
= STR_PRODUCT
,
478 .iSerialNumber
= STR_SERIALNUMBER
,
480 .full
= &desc_device
,
484 static const uint8_t *ccid_card_get_atr(CCIDCardState
*card
, uint32_t *len
)
486 CCIDCardClass
*cc
= CCID_CARD_GET_CLASS(card
);
489 return cc
->get_atr(card
, len
);
494 static void ccid_card_apdu_from_guest(CCIDCardState
*card
,
498 CCIDCardClass
*cc
= CCID_CARD_GET_CLASS(card
);
500 if (cc
->apdu_from_guest
) {
501 cc
->apdu_from_guest(card
, apdu
, len
);
505 static bool ccid_has_pending_answers(USBCCIDState
*s
)
507 return s
->pending_answers_num
> 0;
510 static void ccid_clear_pending_answers(USBCCIDState
*s
)
512 s
->pending_answers_num
= 0;
513 s
->pending_answers_start
= 0;
514 s
->pending_answers_end
= 0;
517 static void ccid_print_pending_answers(USBCCIDState
*s
)
522 DPRINTF(s
, D_VERBOSE
, "usb-ccid: pending answers:");
523 if (!ccid_has_pending_answers(s
)) {
524 DPRINTF(s
, D_VERBOSE
, " empty\n");
527 for (i
= s
->pending_answers_start
, count
= s
->pending_answers_num
;
528 count
> 0; count
--, i
++) {
529 answer
= &s
->pending_answers
[i
% PENDING_ANSWERS_NUM
];
531 DPRINTF(s
, D_VERBOSE
, "%d:%d\n", answer
->slot
, answer
->seq
);
533 DPRINTF(s
, D_VERBOSE
, "%d:%d,", answer
->slot
, answer
->seq
);
538 static void ccid_add_pending_answer(USBCCIDState
*s
, CCID_Header
*hdr
)
542 assert(s
->pending_answers_num
< PENDING_ANSWERS_NUM
);
543 s
->pending_answers_num
++;
545 &s
->pending_answers
[(s
->pending_answers_end
++) % PENDING_ANSWERS_NUM
];
546 answer
->slot
= hdr
->bSlot
;
547 answer
->seq
= hdr
->bSeq
;
548 ccid_print_pending_answers(s
);
551 static void ccid_remove_pending_answer(USBCCIDState
*s
,
552 uint8_t *slot
, uint8_t *seq
)
556 assert(s
->pending_answers_num
> 0);
557 s
->pending_answers_num
--;
559 &s
->pending_answers
[(s
->pending_answers_start
++) % PENDING_ANSWERS_NUM
];
560 *slot
= answer
->slot
;
562 ccid_print_pending_answers(s
);
565 static void ccid_bulk_in_clear(USBCCIDState
*s
)
567 s
->bulk_in_pending_start
= 0;
568 s
->bulk_in_pending_end
= 0;
569 s
->bulk_in_pending_num
= 0;
572 static void ccid_bulk_in_release(USBCCIDState
*s
)
574 assert(s
->current_bulk_in
!= NULL
);
575 s
->current_bulk_in
->pos
= 0;
576 s
->current_bulk_in
= NULL
;
579 static void ccid_bulk_in_get(USBCCIDState
*s
)
581 if (s
->current_bulk_in
!= NULL
|| s
->bulk_in_pending_num
== 0) {
584 assert(s
->bulk_in_pending_num
> 0);
585 s
->bulk_in_pending_num
--;
587 &s
->bulk_in_pending
[(s
->bulk_in_pending_start
++) % BULK_IN_PENDING_NUM
];
590 static void *ccid_reserve_recv_buf(USBCCIDState
*s
, uint16_t len
)
594 DPRINTF(s
, D_VERBOSE
, "%s: QUEUE: reserve %d bytes\n", __func__
, len
);
596 /* look for an existing element */
597 if (len
> BULK_IN_BUF_SIZE
) {
598 DPRINTF(s
, D_WARN
, "usb-ccid.c: %s: len larger then max (%d>%d). "
599 "discarding message.\n",
600 __func__
, len
, BULK_IN_BUF_SIZE
);
603 if (s
->bulk_in_pending_num
>= BULK_IN_PENDING_NUM
) {
604 DPRINTF(s
, D_WARN
, "usb-ccid.c: %s: No free bulk_in buffers. "
605 "discarding message.\n", __func__
);
609 &s
->bulk_in_pending
[(s
->bulk_in_pending_end
++) % BULK_IN_PENDING_NUM
];
610 s
->bulk_in_pending_num
++;
612 return bulk_in
->data
;
615 static void ccid_reset(USBCCIDState
*s
)
617 ccid_bulk_in_clear(s
);
618 ccid_clear_pending_answers(s
);
621 static void ccid_detach(USBCCIDState
*s
)
626 static void ccid_handle_reset(USBDevice
*dev
)
628 USBCCIDState
*s
= USB_CCID_DEV(dev
);
630 DPRINTF(s
, 1, "Reset\n");
635 static const char *ccid_control_to_str(USBCCIDState
*s
, int request
)
638 /* generic - should be factored out if there are other debugees */
639 case DeviceOutRequest
| USB_REQ_SET_ADDRESS
:
640 return "(generic) set address";
641 case DeviceRequest
| USB_REQ_GET_DESCRIPTOR
:
642 return "(generic) get descriptor";
643 case DeviceRequest
| USB_REQ_GET_CONFIGURATION
:
644 return "(generic) get configuration";
645 case DeviceOutRequest
| USB_REQ_SET_CONFIGURATION
:
646 return "(generic) set configuration";
647 case DeviceRequest
| USB_REQ_GET_STATUS
:
648 return "(generic) get status";
649 case DeviceOutRequest
| USB_REQ_CLEAR_FEATURE
:
650 return "(generic) clear feature";
651 case DeviceOutRequest
| USB_REQ_SET_FEATURE
:
652 return "(generic) set_feature";
653 case InterfaceRequest
| USB_REQ_GET_INTERFACE
:
654 return "(generic) get interface";
655 case InterfaceOutRequest
| USB_REQ_SET_INTERFACE
:
656 return "(generic) set interface";
658 case ClassInterfaceOutRequest
| CCID_CONTROL_ABORT
:
660 case ClassInterfaceRequest
| CCID_CONTROL_GET_CLOCK_FREQUENCIES
:
661 return "GET_CLOCK_FREQUENCIES";
662 case ClassInterfaceRequest
| CCID_CONTROL_GET_DATA_RATES
:
663 return "GET_DATA_RATES";
668 static void ccid_handle_control(USBDevice
*dev
, USBPacket
*p
, int request
,
669 int value
, int index
, int length
, uint8_t *data
)
671 USBCCIDState
*s
= USB_CCID_DEV(dev
);
674 DPRINTF(s
, 1, "%s: got control %s (%x), value %x\n", __func__
,
675 ccid_control_to_str(s
, request
), request
, value
);
676 ret
= usb_desc_handle_control(dev
, p
, request
, value
, index
, length
, data
);
682 /* Class specific requests. */
683 case ClassInterfaceOutRequest
| CCID_CONTROL_ABORT
:
684 DPRINTF(s
, 1, "ccid_control abort UNIMPLEMENTED\n");
685 p
->status
= USB_RET_STALL
;
687 case ClassInterfaceRequest
| CCID_CONTROL_GET_CLOCK_FREQUENCIES
:
688 DPRINTF(s
, 1, "ccid_control get clock frequencies UNIMPLEMENTED\n");
689 p
->status
= USB_RET_STALL
;
691 case ClassInterfaceRequest
| CCID_CONTROL_GET_DATA_RATES
:
692 DPRINTF(s
, 1, "ccid_control get data rates UNIMPLEMENTED\n");
693 p
->status
= USB_RET_STALL
;
696 DPRINTF(s
, 1, "got unsupported/bogus control %x, value %x\n",
698 p
->status
= USB_RET_STALL
;
703 static bool ccid_card_inserted(USBCCIDState
*s
)
705 return s
->bmSlotICCState
& SLOT_0_STATE_MASK
;
708 static uint8_t ccid_card_status(USBCCIDState
*s
)
710 return ccid_card_inserted(s
)
712 ICC_STATUS_PRESENT_ACTIVE
713 : ICC_STATUS_PRESENT_INACTIVE
715 : ICC_STATUS_NOT_PRESENT
;
718 static uint8_t ccid_calc_status(USBCCIDState
*s
)
721 * page 55, 6.2.6, calculation of bStatus from bmICCStatus and
724 uint8_t ret
= ccid_card_status(s
) | (s
->bmCommandStatus
<< 6);
725 DPRINTF(s
, D_VERBOSE
, "%s: status = %d\n", __func__
, ret
);
729 static void ccid_reset_error_status(USBCCIDState
*s
)
731 s
->bError
= ERROR_CMD_NOT_SUPPORTED
;
732 s
->bmCommandStatus
= COMMAND_STATUS_NO_ERROR
;
735 static void ccid_write_slot_status(USBCCIDState
*s
, CCID_Header
*recv
)
737 CCID_SlotStatus
*h
= ccid_reserve_recv_buf(s
, sizeof(CCID_SlotStatus
));
741 h
->b
.hdr
.bMessageType
= CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus
;
742 h
->b
.hdr
.dwLength
= 0;
743 h
->b
.hdr
.bSlot
= recv
->bSlot
;
744 h
->b
.hdr
.bSeq
= recv
->bSeq
;
745 h
->b
.bStatus
= ccid_calc_status(s
);
746 h
->b
.bError
= s
->bError
;
747 h
->bClockStatus
= CLOCK_STATUS_RUNNING
;
748 ccid_reset_error_status(s
);
749 usb_wakeup(s
->bulk
, 0);
752 static void ccid_write_parameters(USBCCIDState
*s
, CCID_Header
*recv
)
755 uint32_t len
= s
->ulProtocolDataStructureSize
;
757 h
= ccid_reserve_recv_buf(s
, sizeof(CCID_Parameter
) + len
);
761 h
->b
.hdr
.bMessageType
= CCID_MESSAGE_TYPE_RDR_to_PC_Parameters
;
762 h
->b
.hdr
.dwLength
= 0;
763 h
->b
.hdr
.bSlot
= recv
->bSlot
;
764 h
->b
.hdr
.bSeq
= recv
->bSeq
;
765 h
->b
.bStatus
= ccid_calc_status(s
);
766 h
->b
.bError
= s
->bError
;
767 h
->bProtocolNum
= s
->bProtocolNum
;
768 h
->abProtocolDataStructure
= s
->abProtocolDataStructure
;
769 ccid_reset_error_status(s
);
770 usb_wakeup(s
->bulk
, 0);
773 static void ccid_write_data_block(USBCCIDState
*s
, uint8_t slot
, uint8_t seq
,
774 const uint8_t *data
, uint32_t len
)
776 CCID_DataBlock
*p
= ccid_reserve_recv_buf(s
, sizeof(*p
) + len
);
781 p
->b
.hdr
.bMessageType
= CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock
;
782 p
->b
.hdr
.dwLength
= cpu_to_le32(len
);
783 p
->b
.hdr
.bSlot
= slot
;
785 p
->b
.bStatus
= ccid_calc_status(s
);
786 p
->b
.bError
= s
->bError
;
788 DPRINTF(s
, D_VERBOSE
, "error %d\n", p
->b
.bError
);
792 memcpy(p
->abData
, data
, len
);
794 ccid_reset_error_status(s
);
795 usb_wakeup(s
->bulk
, 0);
798 static void ccid_report_error_failed(USBCCIDState
*s
, uint8_t error
)
800 s
->bmCommandStatus
= COMMAND_STATUS_FAILED
;
804 static void ccid_write_data_block_answer(USBCCIDState
*s
,
805 const uint8_t *data
, uint32_t len
)
810 if (!ccid_has_pending_answers(s
)) {
811 DPRINTF(s
, D_WARN
, "error: no pending answer to return to guest\n");
812 ccid_report_error_failed(s
, ERROR_ICC_MUTE
);
815 ccid_remove_pending_answer(s
, &slot
, &seq
);
816 ccid_write_data_block(s
, slot
, seq
, data
, len
);
819 static uint8_t atr_get_protocol_num(const uint8_t *atr
, uint32_t len
)
823 if (len
< 2 || !(atr
[1] & 0x80)) {
824 /* too short or TD1 not included */
825 return 0; /* T=0, default */
827 i
= 1 + !!(atr
[1] & 0x10) + !!(atr
[1] & 0x20) + !!(atr
[1] & 0x40);
828 i
+= !!(atr
[1] & 0x80);
829 return atr
[i
] & 0x0f;
832 static void ccid_write_data_block_atr(USBCCIDState
*s
, CCID_Header
*recv
)
834 const uint8_t *atr
= NULL
;
836 uint8_t atr_protocol_num
;
837 CCID_T0ProtocolDataStructure
*t0
= &s
->abProtocolDataStructure
.t0
;
838 CCID_T1ProtocolDataStructure
*t1
= &s
->abProtocolDataStructure
.t1
;
841 atr
= ccid_card_get_atr(s
->card
, &len
);
843 atr_protocol_num
= atr_get_protocol_num(atr
, len
);
844 DPRINTF(s
, D_VERBOSE
, "%s: atr contains protocol=%d\n", __func__
,
846 /* set parameters from ATR - see spec page 109 */
847 s
->bProtocolNum
= (atr_protocol_num
<= 1 ? atr_protocol_num
849 switch (atr_protocol_num
) {
851 /* TODO: unimplemented ATR T0 parameters */
852 t0
->bmFindexDindex
= 0;
854 t0
->bGuardTimeT0
= 0;
855 t0
->bWaitingIntegerT0
= 0;
859 /* TODO: unimplemented ATR T1 parameters */
860 t1
->bmFindexDindex
= 0;
862 t1
->bGuardTimeT1
= 0;
863 t1
->bWaitingIntegerT1
= 0;
869 DPRINTF(s
, D_WARN
, "%s: error: unsupported ATR protocol %d\n",
870 __func__
, atr_protocol_num
);
872 ccid_write_data_block(s
, recv
->bSlot
, recv
->bSeq
, atr
, len
);
875 static void ccid_set_parameters(USBCCIDState
*s
, CCID_Header
*recv
)
877 CCID_SetParameters
*ph
= (CCID_SetParameters
*) recv
;
878 uint32_t protocol_num
= ph
->bProtocolNum
& 3;
880 if (protocol_num
!= 0 && protocol_num
!= 1) {
881 ccid_report_error_failed(s
, ERROR_CMD_NOT_SUPPORTED
);
884 s
->bProtocolNum
= protocol_num
;
885 s
->abProtocolDataStructure
= ph
->abProtocolDataStructure
;
889 * must be 5 bytes for T=0, 7 bytes for T=1
892 static const CCID_ProtocolDataStructure defaultProtocolDataStructure
= {
894 .bmFindexDindex
= 0x77,
896 .bGuardTimeT1
= 0x00,
897 .bWaitingIntegerT1
= 0x00,
904 static void ccid_reset_parameters(USBCCIDState
*s
)
906 s
->bProtocolNum
= 0; /* T=0 */
907 s
->abProtocolDataStructure
= defaultProtocolDataStructure
;
910 /* NOTE: only a single slot is supported (SLOT_0) */
911 static void ccid_on_slot_change(USBCCIDState
*s
, bool full
)
913 /* RDR_to_PC_NotifySlotChange, 6.3.1 page 56 */
914 uint8_t current
= s
->bmSlotICCState
;
916 s
->bmSlotICCState
|= SLOT_0_STATE_MASK
;
918 s
->bmSlotICCState
&= ~SLOT_0_STATE_MASK
;
920 if (current
!= s
->bmSlotICCState
) {
921 s
->bmSlotICCState
|= SLOT_0_CHANGED_MASK
;
923 s
->notify_slot_change
= true;
924 usb_wakeup(s
->intr
, 0);
927 static void ccid_write_data_block_error(
928 USBCCIDState
*s
, uint8_t slot
, uint8_t seq
)
930 ccid_write_data_block(s
, slot
, seq
, NULL
, 0);
933 static void ccid_on_apdu_from_guest(USBCCIDState
*s
, CCID_XferBlock
*recv
)
937 if (ccid_card_status(s
) != ICC_STATUS_PRESENT_ACTIVE
) {
939 "usb-ccid: not sending apdu to client, no card connected\n");
940 ccid_write_data_block_error(s
, recv
->hdr
.bSlot
, recv
->hdr
.bSeq
);
943 len
= le32_to_cpu(recv
->hdr
.dwLength
);
944 DPRINTF(s
, 1, "%s: seq %d, len %d\n", __func__
,
945 recv
->hdr
.bSeq
, len
);
946 ccid_add_pending_answer(s
, (CCID_Header
*)recv
);
947 if (s
->card
&& len
<= BULK_OUT_DATA_SIZE
) {
948 ccid_card_apdu_from_guest(s
->card
, recv
->abData
, len
);
950 DPRINTF(s
, D_WARN
, "warning: discarded apdu\n");
954 static const char *ccid_message_type_to_str(uint8_t type
)
957 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn
: return "IccPowerOn";
958 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff
: return "IccPowerOff";
959 case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus
: return "GetSlotStatus";
960 case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock
: return "XfrBlock";
961 case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters
: return "GetParameters";
962 case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters
: return "ResetParameters";
963 case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters
: return "SetParameters";
964 case CCID_MESSAGE_TYPE_PC_to_RDR_Escape
: return "Escape";
965 case CCID_MESSAGE_TYPE_PC_to_RDR_IccClock
: return "IccClock";
966 case CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU
: return "T0APDU";
967 case CCID_MESSAGE_TYPE_PC_to_RDR_Secure
: return "Secure";
968 case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical
: return "Mechanical";
969 case CCID_MESSAGE_TYPE_PC_to_RDR_Abort
: return "Abort";
970 case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency
:
971 return "SetDataRateAndClockFrequency";
976 static void ccid_handle_bulk_out(USBCCIDState
*s
, USBPacket
*p
)
978 CCID_Header
*ccid_header
;
980 if (p
->iov
.size
+ s
->bulk_out_pos
> BULK_OUT_DATA_SIZE
) {
983 usb_packet_copy(p
, s
->bulk_out_data
+ s
->bulk_out_pos
, p
->iov
.size
);
984 s
->bulk_out_pos
+= p
->iov
.size
;
985 if (s
->bulk_out_pos
< 10) {
986 DPRINTF(s
, 1, "%s: header incomplete\n", __func__
);
990 ccid_header
= (CCID_Header
*)s
->bulk_out_data
;
991 if ((s
->bulk_out_pos
- 10 < ccid_header
->dwLength
) &&
992 (p
->iov
.size
== CCID_MAX_PACKET_SIZE
)) {
993 DPRINTF(s
, D_VERBOSE
,
994 "usb-ccid: bulk_in: expecting more packets (%d/%d)\n",
995 s
->bulk_out_pos
- 10, ccid_header
->dwLength
);
998 if (s
->bulk_out_pos
- 10 != ccid_header
->dwLength
) {
1000 "usb-ccid: bulk_in: message size mismatch (got %d, expected %d)\n",
1001 s
->bulk_out_pos
- 10, ccid_header
->dwLength
);
1005 DPRINTF(s
, D_MORE_INFO
, "%s %x %s\n", __func__
,
1006 ccid_header
->bMessageType
,
1007 ccid_message_type_to_str(ccid_header
->bMessageType
));
1008 switch (ccid_header
->bMessageType
) {
1009 case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus
:
1010 ccid_write_slot_status(s
, ccid_header
);
1012 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn
:
1013 DPRINTF(s
, 1, "%s: PowerOn: %d\n", __func__
,
1014 ((CCID_IccPowerOn
*)(ccid_header
))->bPowerSelect
);
1016 if (!ccid_card_inserted(s
)) {
1017 ccid_report_error_failed(s
, ERROR_ICC_MUTE
);
1019 /* atr is written regardless of error. */
1020 ccid_write_data_block_atr(s
, ccid_header
);
1022 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff
:
1023 ccid_reset_error_status(s
);
1025 ccid_write_slot_status(s
, ccid_header
);
1027 case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock
:
1028 ccid_on_apdu_from_guest(s
, (CCID_XferBlock
*)s
->bulk_out_data
);
1030 case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters
:
1031 ccid_reset_error_status(s
);
1032 ccid_set_parameters(s
, ccid_header
);
1033 ccid_write_parameters(s
, ccid_header
);
1035 case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters
:
1036 ccid_reset_error_status(s
);
1037 ccid_reset_parameters(s
);
1038 ccid_write_parameters(s
, ccid_header
);
1040 case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters
:
1041 ccid_reset_error_status(s
);
1042 ccid_write_parameters(s
, ccid_header
);
1044 case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical
:
1045 ccid_report_error_failed(s
, 0);
1046 ccid_write_slot_status(s
, ccid_header
);
1050 "handle_data: ERROR: unhandled message type %Xh\n",
1051 ccid_header
->bMessageType
);
1053 * The caller is expecting the device to respond, tell it we
1054 * don't support the operation.
1056 ccid_report_error_failed(s
, ERROR_CMD_NOT_SUPPORTED
);
1057 ccid_write_slot_status(s
, ccid_header
);
1060 s
->bulk_out_pos
= 0;
1064 p
->status
= USB_RET_STALL
;
1065 s
->bulk_out_pos
= 0;
1069 static void ccid_bulk_in_copy_to_guest(USBCCIDState
*s
, USBPacket
*p
,
1070 unsigned int max_packet_size
)
1074 ccid_bulk_in_get(s
);
1075 if (s
->current_bulk_in
!= NULL
) {
1076 len
= MIN(s
->current_bulk_in
->len
- s
->current_bulk_in
->pos
,
1079 usb_packet_copy(p
, s
->current_bulk_in
->data
+
1080 s
->current_bulk_in
->pos
, len
);
1082 s
->current_bulk_in
->pos
+= len
;
1083 if (s
->current_bulk_in
->pos
== s
->current_bulk_in
->len
1084 && len
!= max_packet_size
) {
1085 ccid_bulk_in_release(s
);
1088 /* return when device has no data - usb 2.0 spec Table 8-4 */
1089 p
->status
= USB_RET_NAK
;
1092 DPRINTF(s
, D_MORE_INFO
,
1093 "%s: %zd/%d req/act to guest (BULK_IN)\n",
1094 __func__
, p
->iov
.size
, len
);
1096 if (len
< p
->iov
.size
) {
1098 "%s: returning short (EREMOTEIO) %d < %zd\n",
1099 __func__
, len
, p
->iov
.size
);
1103 static void ccid_handle_data(USBDevice
*dev
, USBPacket
*p
)
1105 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1110 ccid_handle_bulk_out(s
, p
);
1114 switch (p
->ep
->nr
) {
1115 case CCID_BULK_IN_EP
:
1116 ccid_bulk_in_copy_to_guest(s
, p
, dev
->ep_ctl
.max_packet_size
);
1118 case CCID_INT_IN_EP
:
1119 if (s
->notify_slot_change
) {
1120 /* page 56, RDR_to_PC_NotifySlotChange */
1121 buf
[0] = CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange
;
1122 buf
[1] = s
->bmSlotICCState
;
1123 usb_packet_copy(p
, buf
, 2);
1124 s
->notify_slot_change
= false;
1125 s
->bmSlotICCState
&= ~SLOT_0_CHANGED_MASK
;
1127 "handle_data: int_in: notify_slot_change %X, "
1128 "requested len %zd\n",
1129 s
->bmSlotICCState
, p
->iov
.size
);
1131 p
->status
= USB_RET_NAK
;
1135 DPRINTF(s
, 1, "Bad endpoint\n");
1136 p
->status
= USB_RET_STALL
;
1141 DPRINTF(s
, 1, "Bad token\n");
1142 p
->status
= USB_RET_STALL
;
1147 static void ccid_unrealize(USBDevice
*dev
, Error
**errp
)
1149 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1151 ccid_bulk_in_clear(s
);
1154 static void ccid_flush_pending_answers(USBCCIDState
*s
)
1156 while (ccid_has_pending_answers(s
)) {
1157 ccid_write_data_block_answer(s
, NULL
, 0);
1161 static Answer
*ccid_peek_next_answer(USBCCIDState
*s
)
1163 return s
->pending_answers_num
== 0
1165 : &s
->pending_answers
[s
->pending_answers_start
% PENDING_ANSWERS_NUM
];
1168 static Property ccid_props
[] = {
1169 DEFINE_PROP_UINT32("slot", struct CCIDCardState
, slot
, 0),
1170 DEFINE_PROP_END_OF_LIST(),
1173 #define TYPE_CCID_BUS "ccid-bus"
1174 #define CCID_BUS(obj) OBJECT_CHECK(CCIDBus, (obj), TYPE_CCID_BUS)
1176 static const TypeInfo ccid_bus_info
= {
1177 .name
= TYPE_CCID_BUS
,
1179 .instance_size
= sizeof(CCIDBus
),
1182 void ccid_card_send_apdu_to_guest(CCIDCardState
*card
,
1183 uint8_t *apdu
, uint32_t len
)
1185 DeviceState
*qdev
= DEVICE(card
);
1186 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1187 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1190 if (!ccid_has_pending_answers(s
)) {
1191 DPRINTF(s
, 1, "CCID ERROR: got an APDU without pending answers\n");
1194 s
->bmCommandStatus
= COMMAND_STATUS_NO_ERROR
;
1195 answer
= ccid_peek_next_answer(s
);
1196 if (answer
== NULL
) {
1197 DPRINTF(s
, D_WARN
, "%s: error: unexpected lack of answer\n", __func__
);
1198 ccid_report_error_failed(s
, ERROR_HW_ERROR
);
1201 DPRINTF(s
, 1, "APDU returned to guest %d (answer seq %d, slot %d)\n",
1202 len
, answer
->seq
, answer
->slot
);
1203 ccid_write_data_block_answer(s
, apdu
, len
);
1206 void ccid_card_card_removed(CCIDCardState
*card
)
1208 DeviceState
*qdev
= DEVICE(card
);
1209 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1210 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1212 ccid_on_slot_change(s
, false);
1213 ccid_flush_pending_answers(s
);
1217 int ccid_card_ccid_attach(CCIDCardState
*card
)
1219 DeviceState
*qdev
= DEVICE(card
);
1220 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1221 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1223 DPRINTF(s
, 1, "CCID Attach\n");
1227 void ccid_card_ccid_detach(CCIDCardState
*card
)
1229 DeviceState
*qdev
= DEVICE(card
);
1230 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1231 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1233 DPRINTF(s
, 1, "CCID Detach\n");
1234 if (ccid_card_inserted(s
)) {
1235 ccid_on_slot_change(s
, false);
1240 void ccid_card_card_error(CCIDCardState
*card
, uint64_t error
)
1242 DeviceState
*qdev
= DEVICE(card
);
1243 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1244 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1246 s
->bmCommandStatus
= COMMAND_STATUS_FAILED
;
1247 s
->last_answer_error
= error
;
1248 DPRINTF(s
, 1, "VSC_Error: %" PRIX64
"\n", s
->last_answer_error
);
1249 /* TODO: these errors should be more verbose and propagated to the guest.*/
1251 * We flush all pending answers on CardRemove message in ccid-card-passthru,
1252 * so check that first to not trigger abort
1254 if (ccid_has_pending_answers(s
)) {
1255 ccid_write_data_block_answer(s
, NULL
, 0);
1259 void ccid_card_card_inserted(CCIDCardState
*card
)
1261 DeviceState
*qdev
= DEVICE(card
);
1262 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1263 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1265 s
->bmCommandStatus
= COMMAND_STATUS_NO_ERROR
;
1266 ccid_flush_pending_answers(s
);
1267 ccid_on_slot_change(s
, true);
1270 static void ccid_card_unrealize(DeviceState
*qdev
, Error
**errp
)
1272 CCIDCardState
*card
= CCID_CARD(qdev
);
1273 CCIDCardClass
*cc
= CCID_CARD_GET_CLASS(card
);
1274 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1275 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1276 Error
*local_err
= NULL
;
1278 if (ccid_card_inserted(s
)) {
1279 ccid_card_card_removed(card
);
1281 if (cc
->unrealize
) {
1282 cc
->unrealize(card
, &local_err
);
1283 if (local_err
!= NULL
) {
1284 error_propagate(errp
, local_err
);
1291 static void ccid_card_realize(DeviceState
*qdev
, Error
**errp
)
1293 CCIDCardState
*card
= CCID_CARD(qdev
);
1294 CCIDCardClass
*cc
= CCID_CARD_GET_CLASS(card
);
1295 USBDevice
*dev
= USB_DEVICE(qdev
->parent_bus
->parent
);
1296 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1297 Error
*local_err
= NULL
;
1299 if (card
->slot
!= 0) {
1300 error_setg(errp
, "usb-ccid supports one slot, can't add %d",
1304 if (s
->card
!= NULL
) {
1305 error_setg(errp
, "usb-ccid card already full, not adding");
1309 cc
->realize(card
, &local_err
);
1310 if (local_err
!= NULL
) {
1311 error_propagate(errp
, local_err
);
1318 static void ccid_realize(USBDevice
*dev
, Error
**errp
)
1320 USBCCIDState
*s
= USB_CCID_DEV(dev
);
1322 usb_desc_create_serial(dev
);
1324 qbus_create_inplace(&s
->bus
, sizeof(s
->bus
), TYPE_CCID_BUS
, DEVICE(dev
),
1326 qbus_set_hotplug_handler(BUS(&s
->bus
), OBJECT(dev
), &error_abort
);
1327 s
->intr
= usb_ep_get(dev
, USB_TOKEN_IN
, CCID_INT_IN_EP
);
1328 s
->bulk
= usb_ep_get(dev
, USB_TOKEN_IN
, CCID_BULK_IN_EP
);
1330 s
->dev
.speed
= USB_SPEED_FULL
;
1331 s
->dev
.speedmask
= USB_SPEED_MASK_FULL
;
1332 s
->notify_slot_change
= false;
1334 s
->pending_answers_num
= 0;
1335 s
->last_answer_error
= 0;
1336 s
->bulk_in_pending_start
= 0;
1337 s
->bulk_in_pending_end
= 0;
1338 s
->current_bulk_in
= NULL
;
1339 ccid_reset_error_status(s
);
1340 s
->bulk_out_pos
= 0;
1341 ccid_reset_parameters(s
);
1343 s
->debug
= parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE
, s
->debug
);
1346 static int ccid_post_load(void *opaque
, int version_id
)
1348 USBCCIDState
*s
= opaque
;
1351 * This must be done after usb_device_attach, which sets state to ATTACHED,
1352 * while it must be DEFAULT in order to accept packets (like it is after
1353 * reset, but reset will reset our addr and call our reset handler which
1354 * may change state, and we don't want to do that when migrating).
1356 s
->dev
.state
= s
->state_vmstate
;
1360 static int ccid_pre_save(void *opaque
)
1362 USBCCIDState
*s
= opaque
;
1364 s
->state_vmstate
= s
->dev
.state
;
1369 static VMStateDescription bulk_in_vmstate
= {
1370 .name
= "CCID BulkIn state",
1372 .minimum_version_id
= 1,
1373 .fields
= (VMStateField
[]) {
1374 VMSTATE_BUFFER(data
, BulkIn
),
1375 VMSTATE_UINT32(len
, BulkIn
),
1376 VMSTATE_UINT32(pos
, BulkIn
),
1377 VMSTATE_END_OF_LIST()
1381 static VMStateDescription answer_vmstate
= {
1382 .name
= "CCID Answer state",
1384 .minimum_version_id
= 1,
1385 .fields
= (VMStateField
[]) {
1386 VMSTATE_UINT8(slot
, Answer
),
1387 VMSTATE_UINT8(seq
, Answer
),
1388 VMSTATE_END_OF_LIST()
1392 static VMStateDescription usb_device_vmstate
= {
1393 .name
= "usb_device",
1395 .minimum_version_id
= 1,
1396 .fields
= (VMStateField
[]) {
1397 VMSTATE_UINT8(addr
, USBDevice
),
1398 VMSTATE_BUFFER(setup_buf
, USBDevice
),
1399 VMSTATE_BUFFER(data_buf
, USBDevice
),
1400 VMSTATE_END_OF_LIST()
1404 static VMStateDescription ccid_vmstate
= {
1407 .minimum_version_id
= 1,
1408 .post_load
= ccid_post_load
,
1409 .pre_save
= ccid_pre_save
,
1410 .fields
= (VMStateField
[]) {
1411 VMSTATE_STRUCT(dev
, USBCCIDState
, 1, usb_device_vmstate
, USBDevice
),
1412 VMSTATE_UINT8(debug
, USBCCIDState
),
1413 VMSTATE_BUFFER(bulk_out_data
, USBCCIDState
),
1414 VMSTATE_UINT32(bulk_out_pos
, USBCCIDState
),
1415 VMSTATE_UINT8(bmSlotICCState
, USBCCIDState
),
1416 VMSTATE_UINT8(powered
, USBCCIDState
),
1417 VMSTATE_UINT8(notify_slot_change
, USBCCIDState
),
1418 VMSTATE_UINT64(last_answer_error
, USBCCIDState
),
1419 VMSTATE_UINT8(bError
, USBCCIDState
),
1420 VMSTATE_UINT8(bmCommandStatus
, USBCCIDState
),
1421 VMSTATE_UINT8(bProtocolNum
, USBCCIDState
),
1422 VMSTATE_BUFFER(abProtocolDataStructure
.data
, USBCCIDState
),
1423 VMSTATE_UINT32(ulProtocolDataStructureSize
, USBCCIDState
),
1424 VMSTATE_STRUCT_ARRAY(bulk_in_pending
, USBCCIDState
,
1425 BULK_IN_PENDING_NUM
, 1, bulk_in_vmstate
, BulkIn
),
1426 VMSTATE_UINT32(bulk_in_pending_start
, USBCCIDState
),
1427 VMSTATE_UINT32(bulk_in_pending_end
, USBCCIDState
),
1428 VMSTATE_STRUCT_ARRAY(pending_answers
, USBCCIDState
,
1429 PENDING_ANSWERS_NUM
, 1, answer_vmstate
, Answer
),
1430 VMSTATE_UINT32(pending_answers_num
, USBCCIDState
),
1431 VMSTATE_UNUSED(1), /* was migration_state */
1432 VMSTATE_UINT32(state_vmstate
, USBCCIDState
),
1433 VMSTATE_END_OF_LIST()
1437 static Property ccid_properties
[] = {
1438 DEFINE_PROP_UINT8("debug", USBCCIDState
, debug
, 0),
1439 DEFINE_PROP_END_OF_LIST(),
1442 static void ccid_class_initfn(ObjectClass
*klass
, void *data
)
1444 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1445 USBDeviceClass
*uc
= USB_DEVICE_CLASS(klass
);
1446 HotplugHandlerClass
*hc
= HOTPLUG_HANDLER_CLASS(klass
);
1448 uc
->realize
= ccid_realize
;
1449 uc
->product_desc
= "QEMU USB CCID";
1450 uc
->usb_desc
= &desc_ccid
;
1451 uc
->handle_reset
= ccid_handle_reset
;
1452 uc
->handle_control
= ccid_handle_control
;
1453 uc
->handle_data
= ccid_handle_data
;
1454 uc
->unrealize
= ccid_unrealize
;
1455 dc
->desc
= "CCID Rev 1.1 smartcard reader";
1456 dc
->vmsd
= &ccid_vmstate
;
1457 dc
->props
= ccid_properties
;
1458 set_bit(DEVICE_CATEGORY_INPUT
, dc
->categories
);
1459 hc
->unplug
= qdev_simple_device_unplug_cb
;
1462 static const TypeInfo ccid_info
= {
1463 .name
= CCID_DEV_NAME
,
1464 .parent
= TYPE_USB_DEVICE
,
1465 .instance_size
= sizeof(USBCCIDState
),
1466 .class_init
= ccid_class_initfn
,
1467 .interfaces
= (InterfaceInfo
[]) {
1468 { TYPE_HOTPLUG_HANDLER
},
1473 static void ccid_card_class_init(ObjectClass
*klass
, void *data
)
1475 DeviceClass
*k
= DEVICE_CLASS(klass
);
1476 k
->bus_type
= TYPE_CCID_BUS
;
1477 k
->realize
= ccid_card_realize
;
1478 k
->unrealize
= ccid_card_unrealize
;
1479 k
->props
= ccid_props
;
1482 static const TypeInfo ccid_card_type_info
= {
1483 .name
= TYPE_CCID_CARD
,
1484 .parent
= TYPE_DEVICE
,
1485 .instance_size
= sizeof(CCIDCardState
),
1487 .class_size
= sizeof(CCIDCardClass
),
1488 .class_init
= ccid_card_class_init
,
1491 static void ccid_register_types(void)
1493 type_register_static(&ccid_bus_info
);
1494 type_register_static(&ccid_card_type_info
);
1495 type_register_static(&ccid_info
);
1496 usb_legacy_register(CCID_DEV_NAME
, "ccid", NULL
);
1499 type_init(ccid_register_types
)