37
#include "qemu/osdep.h"
38
#include "qemu/units.h"
39
#include "qapi/error.h"
40
#include "qemu/cutils.h"
41
#include "qemu/error-report.h"
42
#include "qemu/module.h"
43
#include "hw/qdev-properties.h"
45
#include "migration/vmstate.h"
49
#include "qom/object.h"
51
#define DPRINTF(s, lvl, fmt, ...) \
53
if (lvl <= s->debug) { \
54
printf("usb-ccid: " fmt , ## __VA_ARGS__); \
63
#define TYPE_USB_CCID_DEV "usb-ccid"
64
OBJECT_DECLARE_SIMPLE_TYPE(USBCCIDState, USB_CCID_DEV)
71
#define BULK_OUT_DATA_SIZE (64 * KiB)
72
#define PENDING_ANSWERS_NUM 128
74
#define BULK_IN_BUF_SIZE 384
75
#define BULK_IN_PENDING_NUM 8
77
#define CCID_MAX_PACKET_SIZE 64
79
#define CCID_CONTROL_ABORT 0x1
80
#define CCID_CONTROL_GET_CLOCK_FREQUENCIES 0x2
81
#define CCID_CONTROL_GET_DATA_RATES 0x3
83
#define CCID_PRODUCT_DESCRIPTION "QEMU USB CCID"
84
#define CCID_VENDOR_DESCRIPTION "QEMU"
85
#define CCID_INTERFACE_NAME "CCID Interface"
86
#define CCID_SERIAL_NUMBER_STRING "1"
94
#define CCID_VENDOR_ID 0x08e6
95
#define CCID_PRODUCT_ID 0x4433
96
#define CCID_DEVICE_VERSION 0x0000
102
#define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn 0x62
103
#define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff 0x63
104
#define CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus 0x65
105
#define CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock 0x6f
106
#define CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters 0x6c
107
#define CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters 0x6d
108
#define CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters 0x61
109
#define CCID_MESSAGE_TYPE_PC_to_RDR_Escape 0x6b
110
#define CCID_MESSAGE_TYPE_PC_to_RDR_IccClock 0x6e
111
#define CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU 0x6a
112
#define CCID_MESSAGE_TYPE_PC_to_RDR_Secure 0x69
113
#define CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical 0x71
114
#define CCID_MESSAGE_TYPE_PC_to_RDR_Abort 0x72
115
#define CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency 0x73
121
#define CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock 0x80
122
#define CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus 0x81
123
#define CCID_MESSAGE_TYPE_RDR_to_PC_Parameters 0x82
124
#define CCID_MESSAGE_TYPE_RDR_to_PC_Escape 0x83
125
#define CCID_MESSAGE_TYPE_RDR_to_PC_DataRateAndClockFrequency 0x84
131
#define CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange 0x50
132
#define CCID_MESSAGE_TYPE_RDR_to_PC_HardwareError 0x51
140
#define CCID_INT_IN_EP 1
141
#define CCID_BULK_IN_EP 2
142
#define CCID_BULK_OUT_EP 3
145
#define SLOT_0_STATE_MASK 1
146
#define SLOT_0_CHANGED_MASK 2
150
ICC_STATUS_PRESENT_ACTIVE = 0,
151
ICC_STATUS_PRESENT_INACTIVE,
152
ICC_STATUS_NOT_PRESENT
156
COMMAND_STATUS_NO_ERROR = 0,
157
COMMAND_STATUS_FAILED,
158
COMMAND_STATUS_TIME_EXTENSION_REQUIRED
163
ERROR_CMD_NOT_SUPPORTED = 0,
164
ERROR_CMD_ABORTED = -1,
166
ERROR_XFR_PARITY_ERROR = -3,
167
ERROR_XFR_OVERRUN = -4,
173
CLOCK_STATUS_RUNNING = 0,
180
typedef struct QEMU_PACKED CCID_Header {
181
uint8_t bMessageType;
187
typedef struct QEMU_PACKED CCID_BULK_IN {
193
typedef struct QEMU_PACKED CCID_SlotStatus {
195
uint8_t bClockStatus;
198
typedef struct QEMU_PACKED CCID_T0ProtocolDataStructure {
199
uint8_t bmFindexDindex;
201
uint8_t bGuardTimeT0;
202
uint8_t bWaitingIntegerT0;
204
} CCID_T0ProtocolDataStructure;
206
typedef struct QEMU_PACKED CCID_T1ProtocolDataStructure {
207
uint8_t bmFindexDindex;
209
uint8_t bGuardTimeT1;
210
uint8_t bWaitingIntegerT1;
214
} CCID_T1ProtocolDataStructure;
216
typedef union CCID_ProtocolDataStructure {
217
CCID_T0ProtocolDataStructure t0;
218
CCID_T1ProtocolDataStructure t1;
220
} CCID_ProtocolDataStructure;
222
typedef struct QEMU_PACKED CCID_Parameter {
224
uint8_t bProtocolNum;
225
CCID_ProtocolDataStructure abProtocolDataStructure;
228
typedef struct QEMU_PACKED CCID_DataBlock {
230
uint8_t bChainParameter;
235
typedef struct QEMU_PACKED CCID_XferBlock {
238
uint16_t wLevelParameter;
242
typedef struct QEMU_PACKED CCID_IccPowerOn {
244
uint8_t bPowerSelect;
248
typedef struct QEMU_PACKED CCID_IccPowerOff {
253
typedef struct QEMU_PACKED CCID_SetParameters {
255
uint8_t bProtocolNum;
257
CCID_ProtocolDataStructure abProtocolDataStructure;
260
typedef struct CCID_Notify_Slot_Change {
261
uint8_t bMessageType;
262
uint8_t bmSlotICCState;
263
} CCID_Notify_Slot_Change;
266
typedef struct Answer {
272
typedef struct BulkIn {
273
uint8_t data[BULK_IN_BUF_SIZE];
282
#define TYPE_CCID_BUS "ccid-bus"
283
OBJECT_DECLARE_SIMPLE_TYPE(CCIDBus, CCID_BUS)
294
BulkIn bulk_in_pending[BULK_IN_PENDING_NUM];
295
uint32_t bulk_in_pending_start;
296
uint32_t bulk_in_pending_end;
297
uint32_t bulk_in_pending_num;
298
BulkIn *current_bulk_in;
299
uint8_t bulk_out_data[BULK_OUT_DATA_SIZE];
300
uint32_t bulk_out_pos;
301
uint64_t last_answer_error;
302
Answer pending_answers[PENDING_ANSWERS_NUM];
303
uint32_t pending_answers_start;
304
uint32_t pending_answers_end;
305
uint32_t pending_answers_num;
307
uint8_t bmCommandStatus;
308
uint8_t bProtocolNum;
309
CCID_ProtocolDataStructure abProtocolDataStructure;
310
uint32_t ulProtocolDataStructureSize;
311
uint32_t state_vmstate;
312
uint8_t bmSlotICCState;
314
uint8_t notify_slot_change;
328
static const uint8_t qemu_ccid_descriptor[] = {
343
0xa0, 0x0f, 0x00, 0x00,
345
0x00, 0x00, 0x01, 0x00,
349
0x80, 0x25, 0x00, 0x00,
351
0x00, 0xC2, 0x01, 0x00,
357
0xfe, 0x00, 0x00, 0x00,
359
0x00, 0x00, 0x00, 0x00,
361
0x00, 0x00, 0x00, 0x00,
384
0xfe, 0x04, 0x01, 0x00,
390
0x12, 0x00, 0x01, 0x00,
415
STR_MANUFACTURER = 1,
421
static const USBDescStrings desc_strings = {
422
[STR_MANUFACTURER] = "QEMU",
423
[STR_PRODUCT] = "QEMU USB CCID",
424
[STR_SERIALNUMBER] = "1",
425
[STR_INTERFACE] = "CCID Interface",
428
static const USBDescIface desc_iface0 = {
429
.bInterfaceNumber = 0,
431
.bInterfaceClass = USB_CLASS_CSCID,
432
.bInterfaceSubClass = USB_SUBCLASS_UNDEFINED,
433
.bInterfaceProtocol = 0x00,
434
.iInterface = STR_INTERFACE,
436
.descs = (USBDescOther[]) {
439
.data = qemu_ccid_descriptor,
442
.eps = (USBDescEndpoint[]) {
444
.bEndpointAddress = USB_DIR_IN | CCID_INT_IN_EP,
445
.bmAttributes = USB_ENDPOINT_XFER_INT,
447
.wMaxPacketSize = 64,
449
.bEndpointAddress = USB_DIR_IN | CCID_BULK_IN_EP,
450
.bmAttributes = USB_ENDPOINT_XFER_BULK,
451
.wMaxPacketSize = 64,
453
.bEndpointAddress = USB_DIR_OUT | CCID_BULK_OUT_EP,
454
.bmAttributes = USB_ENDPOINT_XFER_BULK,
455
.wMaxPacketSize = 64,
460
static const USBDescDevice desc_device = {
462
.bMaxPacketSize0 = 64,
463
.bNumConfigurations = 1,
464
.confs = (USBDescConfig[]) {
467
.bConfigurationValue = 1,
468
.bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER |
477
static const USBDesc desc_ccid = {
479
.idVendor = CCID_VENDOR_ID,
480
.idProduct = CCID_PRODUCT_ID,
481
.bcdDevice = CCID_DEVICE_VERSION,
482
.iManufacturer = STR_MANUFACTURER,
483
.iProduct = STR_PRODUCT,
484
.iSerialNumber = STR_SERIALNUMBER,
486
.full = &desc_device,
490
static const uint8_t *ccid_card_get_atr(CCIDCardState *card, uint32_t *len)
492
CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
495
return cc->get_atr(card, len);
500
static void ccid_card_apdu_from_guest(CCIDCardState *card,
504
CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
506
if (cc->apdu_from_guest) {
507
cc->apdu_from_guest(card, apdu, len);
511
static bool ccid_has_pending_answers(USBCCIDState *s)
513
return s->pending_answers_num > 0;
516
static void ccid_clear_pending_answers(USBCCIDState *s)
518
s->pending_answers_num = 0;
519
s->pending_answers_start = 0;
520
s->pending_answers_end = 0;
523
static void ccid_print_pending_answers(USBCCIDState *s)
528
DPRINTF(s, D_VERBOSE, "usb-ccid: pending answers:");
529
if (!ccid_has_pending_answers(s)) {
530
DPRINTF(s, D_VERBOSE, " empty\n");
533
for (i = s->pending_answers_start, count = s->pending_answers_num ;
534
count > 0; count--, i++) {
535
answer = &s->pending_answers[i % PENDING_ANSWERS_NUM];
537
DPRINTF(s, D_VERBOSE, "%d:%d\n", answer->slot, answer->seq);
539
DPRINTF(s, D_VERBOSE, "%d:%d,", answer->slot, answer->seq);
544
static void ccid_add_pending_answer(USBCCIDState *s, CCID_Header *hdr)
548
assert(s->pending_answers_num < PENDING_ANSWERS_NUM);
549
s->pending_answers_num++;
551
&s->pending_answers[(s->pending_answers_end++) % PENDING_ANSWERS_NUM];
552
answer->slot = hdr->bSlot;
553
answer->seq = hdr->bSeq;
554
ccid_print_pending_answers(s);
557
static void ccid_remove_pending_answer(USBCCIDState *s,
558
uint8_t *slot, uint8_t *seq)
562
assert(s->pending_answers_num > 0);
563
s->pending_answers_num--;
565
&s->pending_answers[(s->pending_answers_start++) % PENDING_ANSWERS_NUM];
566
*slot = answer->slot;
568
ccid_print_pending_answers(s);
571
static void ccid_bulk_in_clear(USBCCIDState *s)
573
s->bulk_in_pending_start = 0;
574
s->bulk_in_pending_end = 0;
575
s->bulk_in_pending_num = 0;
578
static void ccid_bulk_in_release(USBCCIDState *s)
580
assert(s->current_bulk_in != NULL);
581
s->current_bulk_in->pos = 0;
582
s->current_bulk_in = NULL;
585
static void ccid_bulk_in_get(USBCCIDState *s)
587
if (s->current_bulk_in != NULL || s->bulk_in_pending_num == 0) {
590
assert(s->bulk_in_pending_num > 0);
591
s->bulk_in_pending_num--;
593
&s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING_NUM];
596
static void *ccid_reserve_recv_buf(USBCCIDState *s, uint16_t len)
600
DPRINTF(s, D_VERBOSE, "%s: QUEUE: reserve %d bytes\n", __func__, len);
603
if (len > BULK_IN_BUF_SIZE) {
604
DPRINTF(s, D_WARN, "usb-ccid.c: %s: len larger then max (%d>%d). "
605
"discarding message.\n",
606
__func__, len, BULK_IN_BUF_SIZE);
609
if (s->bulk_in_pending_num >= BULK_IN_PENDING_NUM) {
610
DPRINTF(s, D_WARN, "usb-ccid.c: %s: No free bulk_in buffers. "
611
"discarding message.\n", __func__);
615
&s->bulk_in_pending[(s->bulk_in_pending_end++) % BULK_IN_PENDING_NUM];
616
s->bulk_in_pending_num++;
618
return bulk_in->data;
621
static void ccid_reset(USBCCIDState *s)
623
ccid_bulk_in_clear(s);
624
ccid_clear_pending_answers(s);
627
static void ccid_detach(USBCCIDState *s)
632
static void ccid_handle_reset(USBDevice *dev)
634
USBCCIDState *s = USB_CCID_DEV(dev);
636
DPRINTF(s, 1, "Reset\n");
641
static const char *ccid_control_to_str(USBCCIDState *s, int request)
645
case DeviceOutRequest | USB_REQ_SET_ADDRESS:
646
return "(generic) set address";
647
case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
648
return "(generic) get descriptor";
649
case DeviceRequest | USB_REQ_GET_CONFIGURATION:
650
return "(generic) get configuration";
651
case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
652
return "(generic) set configuration";
653
case DeviceRequest | USB_REQ_GET_STATUS:
654
return "(generic) get status";
655
case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
656
return "(generic) clear feature";
657
case DeviceOutRequest | USB_REQ_SET_FEATURE:
658
return "(generic) set_feature";
659
case InterfaceRequest | USB_REQ_GET_INTERFACE:
660
return "(generic) get interface";
661
case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
662
return "(generic) set interface";
664
case ClassInterfaceOutRequest | CCID_CONTROL_ABORT:
666
case ClassInterfaceRequest | CCID_CONTROL_GET_CLOCK_FREQUENCIES:
667
return "GET_CLOCK_FREQUENCIES";
668
case ClassInterfaceRequest | CCID_CONTROL_GET_DATA_RATES:
669
return "GET_DATA_RATES";
674
static void ccid_handle_control(USBDevice *dev, USBPacket *p, int request,
675
int value, int index, int length, uint8_t *data)
677
USBCCIDState *s = USB_CCID_DEV(dev);
680
DPRINTF(s, 1, "%s: got control %s (%x), value %x\n", __func__,
681
ccid_control_to_str(s, request), request, value);
682
ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
689
case ClassInterfaceOutRequest | CCID_CONTROL_ABORT:
690
DPRINTF(s, 1, "ccid_control abort UNIMPLEMENTED\n");
691
p->status = USB_RET_STALL;
693
case ClassInterfaceRequest | CCID_CONTROL_GET_CLOCK_FREQUENCIES:
694
DPRINTF(s, 1, "ccid_control get clock frequencies UNIMPLEMENTED\n");
695
p->status = USB_RET_STALL;
697
case ClassInterfaceRequest | CCID_CONTROL_GET_DATA_RATES:
698
DPRINTF(s, 1, "ccid_control get data rates UNIMPLEMENTED\n");
699
p->status = USB_RET_STALL;
702
DPRINTF(s, 1, "got unsupported/bogus control %x, value %x\n",
704
p->status = USB_RET_STALL;
709
static bool ccid_card_inserted(USBCCIDState *s)
711
return s->bmSlotICCState & SLOT_0_STATE_MASK;
714
static uint8_t ccid_card_status(USBCCIDState *s)
716
return ccid_card_inserted(s)
718
ICC_STATUS_PRESENT_ACTIVE
719
: ICC_STATUS_PRESENT_INACTIVE
721
: ICC_STATUS_NOT_PRESENT;
724
static uint8_t ccid_calc_status(USBCCIDState *s)
730
uint8_t ret = ccid_card_status(s) | (s->bmCommandStatus << 6);
731
DPRINTF(s, D_VERBOSE, "%s: status = %d\n", __func__, ret);
735
static void ccid_reset_error_status(USBCCIDState *s)
737
s->bError = ERROR_CMD_NOT_SUPPORTED;
738
s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
741
static void ccid_write_slot_status(USBCCIDState *s, CCID_Header *recv)
743
CCID_SlotStatus *h = ccid_reserve_recv_buf(s, sizeof(CCID_SlotStatus));
747
h->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus;
748
h->b.hdr.dwLength = 0;
749
h->b.hdr.bSlot = recv->bSlot;
750
h->b.hdr.bSeq = recv->bSeq;
751
h->b.bStatus = ccid_calc_status(s);
752
h->b.bError = s->bError;
753
h->bClockStatus = CLOCK_STATUS_RUNNING;
754
ccid_reset_error_status(s);
755
usb_wakeup(s->bulk, 0);
758
static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv)
761
uint32_t len = s->ulProtocolDataStructureSize;
763
h = ccid_reserve_recv_buf(s, sizeof(CCID_Parameter) + len);
767
h->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_Parameters;
768
h->b.hdr.dwLength = 0;
769
h->b.hdr.bSlot = recv->bSlot;
770
h->b.hdr.bSeq = recv->bSeq;
771
h->b.bStatus = ccid_calc_status(s);
772
h->b.bError = s->bError;
773
h->bProtocolNum = s->bProtocolNum;
774
h->abProtocolDataStructure = s->abProtocolDataStructure;
775
ccid_reset_error_status(s);
776
usb_wakeup(s->bulk, 0);
779
static void ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t seq,
780
const uint8_t *data, uint32_t len)
782
CCID_DataBlock *p = ccid_reserve_recv_buf(s, sizeof(*p) + len);
787
p->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock;
788
p->b.hdr.dwLength = cpu_to_le32(len);
789
p->b.hdr.bSlot = slot;
791
p->b.bStatus = ccid_calc_status(s);
792
p->b.bError = s->bError;
794
DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError);
798
memcpy(p->abData, data, len);
800
ccid_reset_error_status(s);
801
usb_wakeup(s->bulk, 0);
804
static void ccid_report_error_failed(USBCCIDState *s, uint8_t error)
806
s->bmCommandStatus = COMMAND_STATUS_FAILED;
810
static void ccid_write_data_block_answer(USBCCIDState *s,
811
const uint8_t *data, uint32_t len)
816
if (!ccid_has_pending_answers(s)) {
817
DPRINTF(s, D_WARN, "error: no pending answer to return to guest\n");
818
ccid_report_error_failed(s, ERROR_ICC_MUTE);
821
ccid_remove_pending_answer(s, &slot, &seq);
822
ccid_write_data_block(s, slot, seq, data, len);
825
static uint8_t atr_get_protocol_num(const uint8_t *atr, uint32_t len)
829
if (len < 2 || !(atr[1] & 0x80)) {
833
i = 1 + !!(atr[1] & 0x10) + !!(atr[1] & 0x20) + !!(atr[1] & 0x40);
834
i += !!(atr[1] & 0x80);
835
return atr[i] & 0x0f;
838
static void ccid_write_data_block_atr(USBCCIDState *s, CCID_Header *recv)
840
const uint8_t *atr = NULL;
842
uint8_t atr_protocol_num;
843
CCID_T0ProtocolDataStructure *t0 = &s->abProtocolDataStructure.t0;
844
CCID_T1ProtocolDataStructure *t1 = &s->abProtocolDataStructure.t1;
847
atr = ccid_card_get_atr(s->card, &len);
849
atr_protocol_num = atr_get_protocol_num(atr, len);
850
DPRINTF(s, D_VERBOSE, "%s: atr contains protocol=%d\n", __func__,
853
s->bProtocolNum = (atr_protocol_num <= 1 ? atr_protocol_num
855
switch (atr_protocol_num) {
858
t0->bmFindexDindex = 0;
860
t0->bGuardTimeT0 = 0;
861
t0->bWaitingIntegerT0 = 0;
866
t1->bmFindexDindex = 0;
868
t1->bGuardTimeT1 = 0;
869
t1->bWaitingIntegerT1 = 0;
875
DPRINTF(s, D_WARN, "%s: error: unsupported ATR protocol %d\n",
876
__func__, atr_protocol_num);
878
ccid_write_data_block(s, recv->bSlot, recv->bSeq, atr, len);
881
static void ccid_set_parameters(USBCCIDState *s, CCID_Header *recv)
883
CCID_SetParameters *ph = (CCID_SetParameters *) recv;
884
uint32_t protocol_num = ph->bProtocolNum & 3;
886
if (protocol_num != 0 && protocol_num != 1) {
887
ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED);
890
s->bProtocolNum = protocol_num;
891
s->abProtocolDataStructure = ph->abProtocolDataStructure;
898
static const CCID_ProtocolDataStructure defaultProtocolDataStructure = {
900
.bmFindexDindex = 0x77,
902
.bGuardTimeT1 = 0x00,
903
.bWaitingIntegerT1 = 0x00,
910
static void ccid_reset_parameters(USBCCIDState *s)
913
s->abProtocolDataStructure = defaultProtocolDataStructure;
917
static void ccid_on_slot_change(USBCCIDState *s, bool full)
920
uint8_t current = s->bmSlotICCState;
922
s->bmSlotICCState |= SLOT_0_STATE_MASK;
924
s->bmSlotICCState &= ~SLOT_0_STATE_MASK;
926
if (current != s->bmSlotICCState) {
927
s->bmSlotICCState |= SLOT_0_CHANGED_MASK;
929
s->notify_slot_change = true;
930
usb_wakeup(s->intr, 0);
933
static void ccid_write_data_block_error(
934
USBCCIDState *s, uint8_t slot, uint8_t seq)
936
ccid_write_data_block(s, slot, seq, NULL, 0);
939
static void ccid_on_apdu_from_guest(USBCCIDState *s, CCID_XferBlock *recv)
943
if (ccid_card_status(s) != ICC_STATUS_PRESENT_ACTIVE) {
945
"usb-ccid: not sending apdu to client, no card connected\n");
946
ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq);
949
len = le32_to_cpu(recv->hdr.dwLength);
950
DPRINTF(s, 1, "%s: seq %d, len %u\n", __func__,
951
recv->hdr.bSeq, len);
952
ccid_add_pending_answer(s, (CCID_Header *)recv);
953
if (s->card && len <= BULK_OUT_DATA_SIZE) {
954
ccid_card_apdu_from_guest(s->card, recv->abData, len);
956
DPRINTF(s, D_WARN, "warning: discarded apdu\n");
960
static const char *ccid_message_type_to_str(uint8_t type)
963
case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: return "IccPowerOn";
964
case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff: return "IccPowerOff";
965
case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus: return "GetSlotStatus";
966
case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: return "XfrBlock";
967
case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: return "GetParameters";
968
case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: return "ResetParameters";
969
case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: return "SetParameters";
970
case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: return "Escape";
971
case CCID_MESSAGE_TYPE_PC_to_RDR_IccClock: return "IccClock";
972
case CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU: return "T0APDU";
973
case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: return "Secure";
974
case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical: return "Mechanical";
975
case CCID_MESSAGE_TYPE_PC_to_RDR_Abort: return "Abort";
976
case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency:
977
return "SetDataRateAndClockFrequency";
982
static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p)
984
CCID_Header *ccid_header;
986
if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) {
989
usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, p->iov.size);
990
s->bulk_out_pos += p->iov.size;
991
if (s->bulk_out_pos < 10) {
992
DPRINTF(s, 1, "%s: header incomplete\n", __func__);
996
ccid_header = (CCID_Header *)s->bulk_out_data;
997
if ((s->bulk_out_pos - 10 < ccid_header->dwLength) &&
998
(p->iov.size == CCID_MAX_PACKET_SIZE)) {
999
DPRINTF(s, D_VERBOSE,
1000
"usb-ccid: bulk_in: expecting more packets (%u/%u)\n",
1001
s->bulk_out_pos - 10, ccid_header->dwLength);
1004
if (s->bulk_out_pos - 10 != ccid_header->dwLength) {
1006
"usb-ccid: bulk_in: message size mismatch (got %u, expected %u)\n",
1007
s->bulk_out_pos - 10, ccid_header->dwLength);
1011
DPRINTF(s, D_MORE_INFO, "%s %x %s\n", __func__,
1012
ccid_header->bMessageType,
1013
ccid_message_type_to_str(ccid_header->bMessageType));
1014
switch (ccid_header->bMessageType) {
1015
case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus:
1016
ccid_write_slot_status(s, ccid_header);
1018
case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn:
1019
DPRINTF(s, 1, "%s: PowerOn: %d\n", __func__,
1020
((CCID_IccPowerOn *)(ccid_header))->bPowerSelect);
1022
if (!ccid_card_inserted(s)) {
1023
ccid_report_error_failed(s, ERROR_ICC_MUTE);
1026
ccid_write_data_block_atr(s, ccid_header);
1028
case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff:
1029
ccid_reset_error_status(s);
1031
ccid_write_slot_status(s, ccid_header);
1033
case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock:
1034
ccid_on_apdu_from_guest(s, (CCID_XferBlock *)s->bulk_out_data);
1036
case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters:
1037
ccid_reset_error_status(s);
1038
ccid_set_parameters(s, ccid_header);
1039
ccid_write_parameters(s, ccid_header);
1041
case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters:
1042
ccid_reset_error_status(s);
1043
ccid_reset_parameters(s);
1044
ccid_write_parameters(s, ccid_header);
1046
case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters:
1047
ccid_reset_error_status(s);
1048
ccid_write_parameters(s, ccid_header);
1050
case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical:
1051
ccid_report_error_failed(s, 0);
1052
ccid_write_slot_status(s, ccid_header);
1056
"handle_data: ERROR: unhandled message type %Xh\n",
1057
ccid_header->bMessageType);
1062
ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED);
1063
ccid_write_slot_status(s, ccid_header);
1066
s->bulk_out_pos = 0;
1070
p->status = USB_RET_STALL;
1071
s->bulk_out_pos = 0;
1075
static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p,
1076
unsigned int max_packet_size)
1080
ccid_bulk_in_get(s);
1081
if (s->current_bulk_in != NULL) {
1082
len = MIN(s->current_bulk_in->len - s->current_bulk_in->pos,
1085
usb_packet_copy(p, s->current_bulk_in->data +
1086
s->current_bulk_in->pos, len);
1088
s->current_bulk_in->pos += len;
1089
if (s->current_bulk_in->pos == s->current_bulk_in->len
1090
&& len != max_packet_size) {
1091
ccid_bulk_in_release(s);
1095
p->status = USB_RET_NAK;
1098
DPRINTF(s, D_MORE_INFO,
1099
"%s: %zd/%d req/act to guest (BULK_IN)\n",
1100
__func__, p->iov.size, len);
1102
if (len < p->iov.size) {
1104
"%s: returning short (EREMOTEIO) %d < %zd\n",
1105
__func__, len, p->iov.size);
1109
static void ccid_handle_data(USBDevice *dev, USBPacket *p)
1111
USBCCIDState *s = USB_CCID_DEV(dev);
1116
ccid_handle_bulk_out(s, p);
1120
switch (p->ep->nr) {
1121
case CCID_BULK_IN_EP:
1122
ccid_bulk_in_copy_to_guest(s, p, dev->ep_ctl.max_packet_size);
1124
case CCID_INT_IN_EP:
1125
if (s->notify_slot_change) {
1127
buf[0] = CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange;
1128
buf[1] = s->bmSlotICCState;
1129
usb_packet_copy(p, buf, 2);
1130
s->notify_slot_change = false;
1131
s->bmSlotICCState &= ~SLOT_0_CHANGED_MASK;
1133
"handle_data: int_in: notify_slot_change %X, "
1134
"requested len %zd\n",
1135
s->bmSlotICCState, p->iov.size);
1137
p->status = USB_RET_NAK;
1141
DPRINTF(s, 1, "Bad endpoint\n");
1142
p->status = USB_RET_STALL;
1147
DPRINTF(s, 1, "Bad token\n");
1148
p->status = USB_RET_STALL;
1153
static void ccid_unrealize(USBDevice *dev)
1155
USBCCIDState *s = USB_CCID_DEV(dev);
1157
ccid_bulk_in_clear(s);
1160
static void ccid_flush_pending_answers(USBCCIDState *s)
1162
while (ccid_has_pending_answers(s)) {
1163
ccid_write_data_block_answer(s, NULL, 0);
1167
static Answer *ccid_peek_next_answer(USBCCIDState *s)
1169
return s->pending_answers_num == 0
1171
: &s->pending_answers[s->pending_answers_start % PENDING_ANSWERS_NUM];
1174
static Property ccid_props[] = {
1175
DEFINE_PROP_UINT32("slot", struct CCIDCardState, slot, 0),
1176
DEFINE_PROP_END_OF_LIST(),
1179
static const TypeInfo ccid_bus_info = {
1180
.name = TYPE_CCID_BUS,
1182
.instance_size = sizeof(CCIDBus),
1185
void ccid_card_send_apdu_to_guest(CCIDCardState *card,
1186
uint8_t *apdu, uint32_t len)
1188
DeviceState *qdev = DEVICE(card);
1189
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1190
USBCCIDState *s = USB_CCID_DEV(dev);
1193
if (!ccid_has_pending_answers(s)) {
1194
DPRINTF(s, 1, "CCID ERROR: got an APDU without pending answers\n");
1197
s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
1198
answer = ccid_peek_next_answer(s);
1199
if (answer == NULL) {
1200
DPRINTF(s, D_WARN, "%s: error: unexpected lack of answer\n", __func__);
1201
ccid_report_error_failed(s, ERROR_HW_ERROR);
1204
DPRINTF(s, 1, "APDU returned to guest %u (answer seq %d, slot %d)\n",
1205
len, answer->seq, answer->slot);
1206
ccid_write_data_block_answer(s, apdu, len);
1209
void ccid_card_card_removed(CCIDCardState *card)
1211
DeviceState *qdev = DEVICE(card);
1212
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1213
USBCCIDState *s = USB_CCID_DEV(dev);
1215
ccid_on_slot_change(s, false);
1216
ccid_flush_pending_answers(s);
1220
int ccid_card_ccid_attach(CCIDCardState *card)
1222
DeviceState *qdev = DEVICE(card);
1223
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1224
USBCCIDState *s = USB_CCID_DEV(dev);
1226
DPRINTF(s, 1, "CCID Attach\n");
1230
void ccid_card_ccid_detach(CCIDCardState *card)
1232
DeviceState *qdev = DEVICE(card);
1233
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1234
USBCCIDState *s = USB_CCID_DEV(dev);
1236
DPRINTF(s, 1, "CCID Detach\n");
1237
if (ccid_card_inserted(s)) {
1238
ccid_on_slot_change(s, false);
1243
void ccid_card_card_error(CCIDCardState *card, uint64_t error)
1245
DeviceState *qdev = DEVICE(card);
1246
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1247
USBCCIDState *s = USB_CCID_DEV(dev);
1249
s->bmCommandStatus = COMMAND_STATUS_FAILED;
1250
s->last_answer_error = error;
1251
DPRINTF(s, 1, "VSC_Error: %" PRIX64 "\n", s->last_answer_error);
1257
if (ccid_has_pending_answers(s)) {
1258
ccid_write_data_block_answer(s, NULL, 0);
1262
void ccid_card_card_inserted(CCIDCardState *card)
1264
DeviceState *qdev = DEVICE(card);
1265
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1266
USBCCIDState *s = USB_CCID_DEV(dev);
1268
s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
1269
ccid_flush_pending_answers(s);
1270
ccid_on_slot_change(s, true);
1273
static void ccid_card_unrealize(DeviceState *qdev)
1275
CCIDCardState *card = CCID_CARD(qdev);
1276
CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
1277
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1278
USBCCIDState *s = USB_CCID_DEV(dev);
1280
if (ccid_card_inserted(s)) {
1281
ccid_card_card_removed(card);
1283
if (cc->unrealize) {
1284
cc->unrealize(card);
1289
static void ccid_card_realize(DeviceState *qdev, Error **errp)
1291
CCIDCardState *card = CCID_CARD(qdev);
1292
CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
1293
USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1294
USBCCIDState *s = USB_CCID_DEV(dev);
1295
Error *local_err = NULL;
1297
if (card->slot != 0) {
1298
error_setg(errp, "usb-ccid supports one slot, can't add %d",
1302
if (s->card != NULL) {
1303
error_setg(errp, "usb-ccid card already full, not adding");
1307
cc->realize(card, &local_err);
1308
if (local_err != NULL) {
1309
error_propagate(errp, local_err);
1316
static void ccid_realize(USBDevice *dev, Error **errp)
1318
USBCCIDState *s = USB_CCID_DEV(dev);
1320
usb_desc_create_serial(dev);
1322
qbus_init(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev), NULL);
1323
qbus_set_hotplug_handler(BUS(&s->bus), OBJECT(dev));
1324
s->intr = usb_ep_get(dev, USB_TOKEN_IN, CCID_INT_IN_EP);
1325
s->bulk = usb_ep_get(dev, USB_TOKEN_IN, CCID_BULK_IN_EP);
1327
s->dev.speed = USB_SPEED_FULL;
1328
s->dev.speedmask = USB_SPEED_MASK_FULL;
1329
s->notify_slot_change = false;
1331
s->pending_answers_num = 0;
1332
s->last_answer_error = 0;
1333
s->bulk_in_pending_start = 0;
1334
s->bulk_in_pending_end = 0;
1335
s->current_bulk_in = NULL;
1336
ccid_reset_error_status(s);
1337
s->bulk_out_pos = 0;
1338
ccid_reset_parameters(s);
1340
s->debug = parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug);
1343
static int ccid_post_load(void *opaque, int version_id)
1345
USBCCIDState *s = opaque;
1353
s->dev.state = s->state_vmstate;
1357
static int ccid_pre_save(void *opaque)
1359
USBCCIDState *s = opaque;
1361
s->state_vmstate = s->dev.state;
1366
static const VMStateDescription bulk_in_vmstate = {
1367
.name = "CCID BulkIn state",
1369
.minimum_version_id = 1,
1370
.fields = (const VMStateField[]) {
1371
VMSTATE_BUFFER(data, BulkIn),
1372
VMSTATE_UINT32(len, BulkIn),
1373
VMSTATE_UINT32(pos, BulkIn),
1374
VMSTATE_END_OF_LIST()
1378
static const VMStateDescription answer_vmstate = {
1379
.name = "CCID Answer state",
1381
.minimum_version_id = 1,
1382
.fields = (const VMStateField[]) {
1383
VMSTATE_UINT8(slot, Answer),
1384
VMSTATE_UINT8(seq, Answer),
1385
VMSTATE_END_OF_LIST()
1389
static const VMStateDescription usb_device_vmstate = {
1390
.name = "usb_device",
1392
.minimum_version_id = 1,
1393
.fields = (const VMStateField[]) {
1394
VMSTATE_UINT8(addr, USBDevice),
1395
VMSTATE_BUFFER(setup_buf, USBDevice),
1396
VMSTATE_BUFFER(data_buf, USBDevice),
1397
VMSTATE_END_OF_LIST()
1401
static const VMStateDescription ccid_vmstate = {
1404
.minimum_version_id = 1,
1405
.post_load = ccid_post_load,
1406
.pre_save = ccid_pre_save,
1407
.fields = (const VMStateField[]) {
1408
VMSTATE_STRUCT(dev, USBCCIDState, 1, usb_device_vmstate, USBDevice),
1409
VMSTATE_UINT8(debug, USBCCIDState),
1410
VMSTATE_BUFFER(bulk_out_data, USBCCIDState),
1411
VMSTATE_UINT32(bulk_out_pos, USBCCIDState),
1412
VMSTATE_UINT8(bmSlotICCState, USBCCIDState),
1413
VMSTATE_UINT8(powered, USBCCIDState),
1414
VMSTATE_UINT8(notify_slot_change, USBCCIDState),
1415
VMSTATE_UINT64(last_answer_error, USBCCIDState),
1416
VMSTATE_UINT8(bError, USBCCIDState),
1417
VMSTATE_UINT8(bmCommandStatus, USBCCIDState),
1418
VMSTATE_UINT8(bProtocolNum, USBCCIDState),
1419
VMSTATE_BUFFER(abProtocolDataStructure.data, USBCCIDState),
1420
VMSTATE_UINT32(ulProtocolDataStructureSize, USBCCIDState),
1421
VMSTATE_STRUCT_ARRAY(bulk_in_pending, USBCCIDState,
1422
BULK_IN_PENDING_NUM, 1, bulk_in_vmstate, BulkIn),
1423
VMSTATE_UINT32(bulk_in_pending_start, USBCCIDState),
1424
VMSTATE_UINT32(bulk_in_pending_end, USBCCIDState),
1425
VMSTATE_STRUCT_ARRAY(pending_answers, USBCCIDState,
1426
PENDING_ANSWERS_NUM, 1, answer_vmstate, Answer),
1427
VMSTATE_UINT32(pending_answers_num, USBCCIDState),
1429
VMSTATE_UINT32(state_vmstate, USBCCIDState),
1430
VMSTATE_END_OF_LIST()
1434
static Property ccid_properties[] = {
1435
DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0),
1436
DEFINE_PROP_END_OF_LIST(),
1439
static void ccid_class_initfn(ObjectClass *klass, void *data)
1441
DeviceClass *dc = DEVICE_CLASS(klass);
1442
USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
1443
HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
1445
uc->realize = ccid_realize;
1446
uc->product_desc = "QEMU USB CCID";
1447
uc->usb_desc = &desc_ccid;
1448
uc->handle_reset = ccid_handle_reset;
1449
uc->handle_control = ccid_handle_control;
1450
uc->handle_data = ccid_handle_data;
1451
uc->unrealize = ccid_unrealize;
1452
dc->desc = "CCID Rev 1.1 smartcard reader";
1453
dc->vmsd = &ccid_vmstate;
1454
device_class_set_props(dc, ccid_properties);
1455
set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
1456
hc->unplug = qdev_simple_device_unplug_cb;
1459
static const TypeInfo ccid_info = {
1460
.name = TYPE_USB_CCID_DEV,
1461
.parent = TYPE_USB_DEVICE,
1462
.instance_size = sizeof(USBCCIDState),
1463
.class_init = ccid_class_initfn,
1464
.interfaces = (InterfaceInfo[]) {
1465
{ TYPE_HOTPLUG_HANDLER },
1470
static void ccid_card_class_init(ObjectClass *klass, void *data)
1472
DeviceClass *k = DEVICE_CLASS(klass);
1473
k->bus_type = TYPE_CCID_BUS;
1474
k->realize = ccid_card_realize;
1475
k->unrealize = ccid_card_unrealize;
1476
device_class_set_props(k, ccid_props);
1479
static const TypeInfo ccid_card_type_info = {
1480
.name = TYPE_CCID_CARD,
1481
.parent = TYPE_DEVICE,
1482
.instance_size = sizeof(CCIDCardState),
1484
.class_size = sizeof(CCIDCardClass),
1485
.class_init = ccid_card_class_init,
1488
static void ccid_register_types(void)
1490
type_register_static(&ccid_bus_info);
1491
type_register_static(&ccid_card_type_info);
1492
type_register_static(&ccid_info);
1495
type_init(ccid_register_types)