1 /* 2 * QEMU USB emulation 3 * 4 * Copyright (c) 2005 Fabrice Bellard 5 * 6 * 2008 Generic packet handler rewrite by Max Krasnyansky 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 #include "qemu-common.h" 27 #include "hw/usb.h" 28 #include "iov.h" 29 #include "trace.h" 30 31 void usb_attach(USBPort *port) 32 { 33 USBDevice *dev = port->dev; 34 35 assert(dev != NULL); 36 assert(dev->attached); 37 assert(dev->state == USB_STATE_NOTATTACHED); 38 port->ops->attach(port); 39 dev->state = USB_STATE_ATTACHED; 40 usb_device_handle_attach(dev); 41 } 42 43 void usb_detach(USBPort *port) 44 { 45 USBDevice *dev = port->dev; 46 47 assert(dev != NULL); 48 assert(dev->state != USB_STATE_NOTATTACHED); 49 port->ops->detach(port); 50 dev->state = USB_STATE_NOTATTACHED; 51 } 52 53 void usb_port_reset(USBPort *port) 54 { 55 USBDevice *dev = port->dev; 56 57 assert(dev != NULL); 58 usb_detach(port); 59 usb_attach(port); 60 usb_device_reset(dev); 61 } 62 63 void usb_device_reset(USBDevice *dev) 64 { 65 if (dev == NULL || !dev->attached) { 66 return; 67 } 68 dev->remote_wakeup = 0; 69 dev->addr = 0; 70 dev->state = USB_STATE_DEFAULT; 71 usb_device_handle_reset(dev); 72 } 73 74 void usb_wakeup(USBEndpoint *ep) 75 { 76 USBDevice *dev = ep->dev; 77 USBBus *bus = usb_bus_from_device(dev); 78 79 if (dev->remote_wakeup && dev->port && dev->port->ops->wakeup) { 80 dev->port->ops->wakeup(dev->port); 81 } 82 if (bus->ops->wakeup_endpoint) { 83 bus->ops->wakeup_endpoint(bus, ep); 84 } 85 } 86 87 /**********************/ 88 89 /* generic USB device helpers (you are not forced to use them when 90 writing your USB device driver, but they help handling the 91 protocol) 92 */ 93 94 #define SETUP_STATE_IDLE 0 95 #define SETUP_STATE_SETUP 1 96 #define SETUP_STATE_DATA 2 97 #define SETUP_STATE_ACK 3 98 #define SETUP_STATE_PARAM 4 99 100 static int do_token_setup(USBDevice *s, USBPacket *p) 101 { 102 int request, value, index; 103 int ret = 0; 104 105 if (p->iov.size != 8) { 106 return USB_RET_STALL; 107 } 108 109 usb_packet_copy(p, s->setup_buf, p->iov.size); 110 s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; 111 s->setup_index = 0; 112 113 request = (s->setup_buf[0] << 8) | s->setup_buf[1]; 114 value = (s->setup_buf[3] << 8) | s->setup_buf[2]; 115 index = (s->setup_buf[5] << 8) | s->setup_buf[4]; 116 117 if (s->setup_buf[0] & USB_DIR_IN) { 118 ret = usb_device_handle_control(s, p, request, value, index, 119 s->setup_len, s->data_buf); 120 if (ret == USB_RET_ASYNC) { 121 s->setup_state = SETUP_STATE_SETUP; 122 return USB_RET_ASYNC; 123 } 124 if (ret < 0) 125 return ret; 126 127 if (ret < s->setup_len) 128 s->setup_len = ret; 129 s->setup_state = SETUP_STATE_DATA; 130 } else { 131 if (s->setup_len > sizeof(s->data_buf)) { 132 fprintf(stderr, 133 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", 134 s->setup_len, sizeof(s->data_buf)); 135 return USB_RET_STALL; 136 } 137 if (s->setup_len == 0) 138 s->setup_state = SETUP_STATE_ACK; 139 else 140 s->setup_state = SETUP_STATE_DATA; 141 } 142 143 return ret; 144 } 145 146 static int do_token_in(USBDevice *s, USBPacket *p) 147 { 148 int request, value, index; 149 int ret = 0; 150 151 assert(p->ep->nr == 0); 152 153 request = (s->setup_buf[0] << 8) | s->setup_buf[1]; 154 value = (s->setup_buf[3] << 8) | s->setup_buf[2]; 155 index = (s->setup_buf[5] << 8) | s->setup_buf[4]; 156 157 switch(s->setup_state) { 158 case SETUP_STATE_ACK: 159 if (!(s->setup_buf[0] & USB_DIR_IN)) { 160 ret = usb_device_handle_control(s, p, request, value, index, 161 s->setup_len, s->data_buf); 162 if (ret == USB_RET_ASYNC) { 163 return USB_RET_ASYNC; 164 } 165 s->setup_state = SETUP_STATE_IDLE; 166 if (ret > 0) 167 return 0; 168 return ret; 169 } 170 171 /* return 0 byte */ 172 return 0; 173 174 case SETUP_STATE_DATA: 175 if (s->setup_buf[0] & USB_DIR_IN) { 176 int len = s->setup_len - s->setup_index; 177 if (len > p->iov.size) { 178 len = p->iov.size; 179 } 180 usb_packet_copy(p, s->data_buf + s->setup_index, len); 181 s->setup_index += len; 182 if (s->setup_index >= s->setup_len) 183 s->setup_state = SETUP_STATE_ACK; 184 return len; 185 } 186 187 s->setup_state = SETUP_STATE_IDLE; 188 return USB_RET_STALL; 189 190 default: 191 return USB_RET_STALL; 192 } 193 } 194 195 static int do_token_out(USBDevice *s, USBPacket *p) 196 { 197 assert(p->ep->nr == 0); 198 199 switch(s->setup_state) { 200 case SETUP_STATE_ACK: 201 if (s->setup_buf[0] & USB_DIR_IN) { 202 s->setup_state = SETUP_STATE_IDLE; 203 /* transfer OK */ 204 } else { 205 /* ignore additional output */ 206 } 207 return 0; 208 209 case SETUP_STATE_DATA: 210 if (!(s->setup_buf[0] & USB_DIR_IN)) { 211 int len = s->setup_len - s->setup_index; 212 if (len > p->iov.size) { 213 len = p->iov.size; 214 } 215 usb_packet_copy(p, s->data_buf + s->setup_index, len); 216 s->setup_index += len; 217 if (s->setup_index >= s->setup_len) 218 s->setup_state = SETUP_STATE_ACK; 219 return len; 220 } 221 222 s->setup_state = SETUP_STATE_IDLE; 223 return USB_RET_STALL; 224 225 default: 226 return USB_RET_STALL; 227 } 228 } 229 230 static int do_parameter(USBDevice *s, USBPacket *p) 231 { 232 int request, value, index; 233 int i, ret = 0; 234 235 for (i = 0; i < 8; i++) { 236 s->setup_buf[i] = p->parameter >> (i*8); 237 } 238 239 s->setup_state = SETUP_STATE_PARAM; 240 s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6]; 241 s->setup_index = 0; 242 243 request = (s->setup_buf[0] << 8) | s->setup_buf[1]; 244 value = (s->setup_buf[3] << 8) | s->setup_buf[2]; 245 index = (s->setup_buf[5] << 8) | s->setup_buf[4]; 246 247 if (s->setup_len > sizeof(s->data_buf)) { 248 fprintf(stderr, 249 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", 250 s->setup_len, sizeof(s->data_buf)); 251 return USB_RET_STALL; 252 } 253 254 if (p->pid == USB_TOKEN_OUT) { 255 usb_packet_copy(p, s->data_buf, s->setup_len); 256 } 257 258 ret = usb_device_handle_control(s, p, request, value, index, 259 s->setup_len, s->data_buf); 260 if (ret < 0) { 261 return ret; 262 } 263 264 if (ret < s->setup_len) { 265 s->setup_len = ret; 266 } 267 if (p->pid == USB_TOKEN_IN) { 268 usb_packet_copy(p, s->data_buf, s->setup_len); 269 } 270 271 return ret; 272 } 273 274 /* ctrl complete function for devices which use usb_generic_handle_packet and 275 may return USB_RET_ASYNC from their handle_control callback. Device code 276 which does this *must* call this function instead of the normal 277 usb_packet_complete to complete their async control packets. */ 278 void usb_generic_async_ctrl_complete(USBDevice *s, USBPacket *p) 279 { 280 if (p->result < 0) { 281 s->setup_state = SETUP_STATE_IDLE; 282 } 283 284 switch (s->setup_state) { 285 case SETUP_STATE_SETUP: 286 if (p->result < s->setup_len) { 287 s->setup_len = p->result; 288 } 289 s->setup_state = SETUP_STATE_DATA; 290 p->result = 8; 291 break; 292 293 case SETUP_STATE_ACK: 294 s->setup_state = SETUP_STATE_IDLE; 295 p->result = 0; 296 break; 297 298 case SETUP_STATE_PARAM: 299 if (p->result < s->setup_len) { 300 s->setup_len = p->result; 301 } 302 if (p->pid == USB_TOKEN_IN) { 303 p->result = 0; 304 usb_packet_copy(p, s->data_buf, s->setup_len); 305 } 306 break; 307 308 default: 309 break; 310 } 311 usb_packet_complete(s, p); 312 } 313 314 /* XXX: fix overflow */ 315 int set_usb_string(uint8_t *buf, const char *str) 316 { 317 int len, i; 318 uint8_t *q; 319 320 q = buf; 321 len = strlen(str); 322 *q++ = 2 * len + 2; 323 *q++ = 3; 324 for(i = 0; i < len; i++) { 325 *q++ = str[i]; 326 *q++ = 0; 327 } 328 return q - buf; 329 } 330 331 USBDevice *usb_find_device(USBPort *port, uint8_t addr) 332 { 333 USBDevice *dev = port->dev; 334 335 if (dev == NULL || !dev->attached || dev->state != USB_STATE_DEFAULT) { 336 return NULL; 337 } 338 if (dev->addr == addr) { 339 return dev; 340 } 341 return usb_device_find_device(dev, addr); 342 } 343 344 static int usb_process_one(USBPacket *p) 345 { 346 USBDevice *dev = p->ep->dev; 347 348 if (p->ep->nr == 0) { 349 /* control pipe */ 350 if (p->parameter) { 351 return do_parameter(dev, p); 352 } 353 switch (p->pid) { 354 case USB_TOKEN_SETUP: 355 return do_token_setup(dev, p); 356 case USB_TOKEN_IN: 357 return do_token_in(dev, p); 358 case USB_TOKEN_OUT: 359 return do_token_out(dev, p); 360 default: 361 return USB_RET_STALL; 362 } 363 } else { 364 /* data pipe */ 365 return usb_device_handle_data(dev, p); 366 } 367 } 368 369 /* Hand over a packet to a device for processing. Return value 370 USB_RET_ASYNC indicates the processing isn't finished yet, the 371 driver will call usb_packet_complete() when done processing it. */ 372 int usb_handle_packet(USBDevice *dev, USBPacket *p) 373 { 374 int ret; 375 376 if (dev == NULL) { 377 return USB_RET_NODEV; 378 } 379 assert(dev == p->ep->dev); 380 assert(dev->state == USB_STATE_DEFAULT); 381 usb_packet_check_state(p, USB_PACKET_SETUP); 382 assert(p->ep != NULL); 383 384 if (QTAILQ_EMPTY(&p->ep->queue) || p->ep->pipeline) { 385 ret = usb_process_one(p); 386 if (ret == USB_RET_ASYNC) { 387 usb_packet_set_state(p, USB_PACKET_ASYNC); 388 QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue); 389 } else { 390 p->result = ret; 391 usb_packet_set_state(p, USB_PACKET_COMPLETE); 392 } 393 } else { 394 ret = USB_RET_ASYNC; 395 usb_packet_set_state(p, USB_PACKET_QUEUED); 396 QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue); 397 } 398 return ret; 399 } 400 401 /* Notify the controller that an async packet is complete. This should only 402 be called for packets previously deferred by returning USB_RET_ASYNC from 403 handle_packet. */ 404 void usb_packet_complete(USBDevice *dev, USBPacket *p) 405 { 406 USBEndpoint *ep = p->ep; 407 int ret; 408 409 usb_packet_check_state(p, USB_PACKET_ASYNC); 410 assert(QTAILQ_FIRST(&ep->queue) == p); 411 usb_packet_set_state(p, USB_PACKET_COMPLETE); 412 QTAILQ_REMOVE(&ep->queue, p, queue); 413 dev->port->ops->complete(dev->port, p); 414 415 while (!QTAILQ_EMPTY(&ep->queue)) { 416 p = QTAILQ_FIRST(&ep->queue); 417 if (p->state == USB_PACKET_ASYNC) { 418 break; 419 } 420 usb_packet_check_state(p, USB_PACKET_QUEUED); 421 ret = usb_process_one(p); 422 if (ret == USB_RET_ASYNC) { 423 usb_packet_set_state(p, USB_PACKET_ASYNC); 424 break; 425 } 426 p->result = ret; 427 usb_packet_set_state(p, USB_PACKET_COMPLETE); 428 QTAILQ_REMOVE(&ep->queue, p, queue); 429 dev->port->ops->complete(dev->port, p); 430 } 431 } 432 433 /* Cancel an active packet. The packed must have been deferred by 434 returning USB_RET_ASYNC from handle_packet, and not yet 435 completed. */ 436 void usb_cancel_packet(USBPacket * p) 437 { 438 bool callback = (p->state == USB_PACKET_ASYNC); 439 assert(usb_packet_is_inflight(p)); 440 usb_packet_set_state(p, USB_PACKET_CANCELED); 441 QTAILQ_REMOVE(&p->ep->queue, p, queue); 442 if (callback) { 443 usb_device_cancel_packet(p->ep->dev, p); 444 } 445 } 446 447 448 void usb_packet_init(USBPacket *p) 449 { 450 qemu_iovec_init(&p->iov, 1); 451 } 452 453 static const char *usb_packet_state_name(USBPacketState state) 454 { 455 static const char *name[] = { 456 [USB_PACKET_UNDEFINED] = "undef", 457 [USB_PACKET_SETUP] = "setup", 458 [USB_PACKET_QUEUED] = "queued", 459 [USB_PACKET_ASYNC] = "async", 460 [USB_PACKET_COMPLETE] = "complete", 461 [USB_PACKET_CANCELED] = "canceled", 462 }; 463 if (state < ARRAY_SIZE(name)) { 464 return name[state]; 465 } 466 return "INVALID"; 467 } 468 469 void usb_packet_check_state(USBPacket *p, USBPacketState expected) 470 { 471 USBDevice *dev; 472 USBBus *bus; 473 474 if (p->state == expected) { 475 return; 476 } 477 dev = p->ep->dev; 478 bus = usb_bus_from_device(dev); 479 trace_usb_packet_state_fault(bus->busnr, dev->port->path, p->ep->nr, p, 480 usb_packet_state_name(p->state), 481 usb_packet_state_name(expected)); 482 assert(!"usb packet state check failed"); 483 } 484 485 void usb_packet_set_state(USBPacket *p, USBPacketState state) 486 { 487 if (p->ep) { 488 USBDevice *dev = p->ep->dev; 489 USBBus *bus = usb_bus_from_device(dev); 490 trace_usb_packet_state_change(bus->busnr, dev->port->path, p->ep->nr, p, 491 usb_packet_state_name(p->state), 492 usb_packet_state_name(state)); 493 } else { 494 trace_usb_packet_state_change(-1, "", -1, p, 495 usb_packet_state_name(p->state), 496 usb_packet_state_name(state)); 497 } 498 p->state = state; 499 } 500 501 void usb_packet_setup(USBPacket *p, int pid, USBEndpoint *ep) 502 { 503 assert(!usb_packet_is_inflight(p)); 504 p->pid = pid; 505 p->ep = ep; 506 p->result = 0; 507 p->parameter = 0; 508 qemu_iovec_reset(&p->iov); 509 usb_packet_set_state(p, USB_PACKET_SETUP); 510 } 511 512 void usb_packet_addbuf(USBPacket *p, void *ptr, size_t len) 513 { 514 qemu_iovec_add(&p->iov, ptr, len); 515 } 516 517 void usb_packet_copy(USBPacket *p, void *ptr, size_t bytes) 518 { 519 assert(p->result >= 0); 520 assert(p->result + bytes <= p->iov.size); 521 switch (p->pid) { 522 case USB_TOKEN_SETUP: 523 case USB_TOKEN_OUT: 524 iov_to_buf(p->iov.iov, p->iov.niov, ptr, p->result, bytes); 525 break; 526 case USB_TOKEN_IN: 527 iov_from_buf(p->iov.iov, p->iov.niov, ptr, p->result, bytes); 528 break; 529 default: 530 fprintf(stderr, "%s: invalid pid: %x\n", __func__, p->pid); 531 abort(); 532 } 533 p->result += bytes; 534 } 535 536 void usb_packet_skip(USBPacket *p, size_t bytes) 537 { 538 assert(p->result >= 0); 539 assert(p->result + bytes <= p->iov.size); 540 if (p->pid == USB_TOKEN_IN) { 541 iov_clear(p->iov.iov, p->iov.niov, p->result, bytes); 542 } 543 p->result += bytes; 544 } 545 546 void usb_packet_cleanup(USBPacket *p) 547 { 548 assert(!usb_packet_is_inflight(p)); 549 qemu_iovec_destroy(&p->iov); 550 } 551 552 void usb_ep_init(USBDevice *dev) 553 { 554 int ep; 555 556 dev->ep_ctl.nr = 0; 557 dev->ep_ctl.type = USB_ENDPOINT_XFER_CONTROL; 558 dev->ep_ctl.ifnum = 0; 559 dev->ep_ctl.dev = dev; 560 dev->ep_ctl.pipeline = false; 561 QTAILQ_INIT(&dev->ep_ctl.queue); 562 for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) { 563 dev->ep_in[ep].nr = ep + 1; 564 dev->ep_out[ep].nr = ep + 1; 565 dev->ep_in[ep].pid = USB_TOKEN_IN; 566 dev->ep_out[ep].pid = USB_TOKEN_OUT; 567 dev->ep_in[ep].type = USB_ENDPOINT_XFER_INVALID; 568 dev->ep_out[ep].type = USB_ENDPOINT_XFER_INVALID; 569 dev->ep_in[ep].ifnum = 0; 570 dev->ep_out[ep].ifnum = 0; 571 dev->ep_in[ep].dev = dev; 572 dev->ep_out[ep].dev = dev; 573 dev->ep_in[ep].pipeline = false; 574 dev->ep_out[ep].pipeline = false; 575 QTAILQ_INIT(&dev->ep_in[ep].queue); 576 QTAILQ_INIT(&dev->ep_out[ep].queue); 577 } 578 } 579 580 void usb_ep_dump(USBDevice *dev) 581 { 582 static const char *tname[] = { 583 [USB_ENDPOINT_XFER_CONTROL] = "control", 584 [USB_ENDPOINT_XFER_ISOC] = "isoc", 585 [USB_ENDPOINT_XFER_BULK] = "bulk", 586 [USB_ENDPOINT_XFER_INT] = "int", 587 }; 588 int ifnum, ep, first; 589 590 fprintf(stderr, "Device \"%s\", config %d\n", 591 dev->product_desc, dev->configuration); 592 for (ifnum = 0; ifnum < 16; ifnum++) { 593 first = 1; 594 for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) { 595 if (dev->ep_in[ep].type != USB_ENDPOINT_XFER_INVALID && 596 dev->ep_in[ep].ifnum == ifnum) { 597 if (first) { 598 first = 0; 599 fprintf(stderr, " Interface %d, alternative %d\n", 600 ifnum, dev->altsetting[ifnum]); 601 } 602 fprintf(stderr, " Endpoint %d, IN, %s, %d max\n", ep, 603 tname[dev->ep_in[ep].type], 604 dev->ep_in[ep].max_packet_size); 605 } 606 if (dev->ep_out[ep].type != USB_ENDPOINT_XFER_INVALID && 607 dev->ep_out[ep].ifnum == ifnum) { 608 if (first) { 609 first = 0; 610 fprintf(stderr, " Interface %d, alternative %d\n", 611 ifnum, dev->altsetting[ifnum]); 612 } 613 fprintf(stderr, " Endpoint %d, OUT, %s, %d max\n", ep, 614 tname[dev->ep_out[ep].type], 615 dev->ep_out[ep].max_packet_size); 616 } 617 } 618 } 619 fprintf(stderr, "--\n"); 620 } 621 622 struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep) 623 { 624 struct USBEndpoint *eps; 625 626 if (dev == NULL) { 627 return NULL; 628 } 629 eps = (pid == USB_TOKEN_IN) ? dev->ep_in : dev->ep_out; 630 if (ep == 0) { 631 return &dev->ep_ctl; 632 } 633 assert(pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT); 634 assert(ep > 0 && ep <= USB_MAX_ENDPOINTS); 635 return eps + ep - 1; 636 } 637 638 uint8_t usb_ep_get_type(USBDevice *dev, int pid, int ep) 639 { 640 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 641 return uep->type; 642 } 643 644 void usb_ep_set_type(USBDevice *dev, int pid, int ep, uint8_t type) 645 { 646 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 647 uep->type = type; 648 } 649 650 uint8_t usb_ep_get_ifnum(USBDevice *dev, int pid, int ep) 651 { 652 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 653 return uep->ifnum; 654 } 655 656 void usb_ep_set_ifnum(USBDevice *dev, int pid, int ep, uint8_t ifnum) 657 { 658 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 659 uep->ifnum = ifnum; 660 } 661 662 void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep, 663 uint16_t raw) 664 { 665 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 666 int size, microframes; 667 668 size = raw & 0x7ff; 669 switch ((raw >> 11) & 3) { 670 case 1: 671 microframes = 2; 672 break; 673 case 2: 674 microframes = 3; 675 break; 676 default: 677 microframes = 1; 678 break; 679 } 680 uep->max_packet_size = size * microframes; 681 } 682 683 int usb_ep_get_max_packet_size(USBDevice *dev, int pid, int ep) 684 { 685 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 686 return uep->max_packet_size; 687 } 688 689 void usb_ep_set_pipeline(USBDevice *dev, int pid, int ep, bool enabled) 690 { 691 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep); 692 uep->pipeline = enabled; 693 } 694