1 /* 2 * Media Transfer Protocol implementation, backed by host filesystem. 3 * 4 * Copyright Red Hat, Inc 2014 5 * 6 * Author: 7 * Gerd Hoffmann <kraxel@redhat.com> 8 * 9 * This code is licensed under the GPL v2 or later. 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu-common.h" 14 #include "qapi/error.h" 15 #include "qemu/error-report.h" 16 #include <wchar.h> 17 #include <dirent.h> 18 19 #include <sys/statvfs.h> 20 21 22 #include "qemu/iov.h" 23 #include "qemu/module.h" 24 #include "qemu/filemonitor.h" 25 #include "trace.h" 26 #include "hw/qdev-properties.h" 27 #include "hw/usb.h" 28 #include "migration/vmstate.h" 29 #include "desc.h" 30 #include "qemu/units.h" 31 #include "qom/object.h" 32 33 /* ----------------------------------------------------------------------- */ 34 35 enum mtp_container_type { 36 TYPE_COMMAND = 1, 37 TYPE_DATA = 2, 38 TYPE_RESPONSE = 3, 39 TYPE_EVENT = 4, 40 }; 41 42 /* MTP write stage, for internal use only */ 43 enum mtp_write_status { 44 WRITE_START = 1, 45 WRITE_CONTINUE = 2, 46 WRITE_END = 3, 47 }; 48 49 enum mtp_code { 50 /* command codes */ 51 CMD_GET_DEVICE_INFO = 0x1001, 52 CMD_OPEN_SESSION = 0x1002, 53 CMD_CLOSE_SESSION = 0x1003, 54 CMD_GET_STORAGE_IDS = 0x1004, 55 CMD_GET_STORAGE_INFO = 0x1005, 56 CMD_GET_NUM_OBJECTS = 0x1006, 57 CMD_GET_OBJECT_HANDLES = 0x1007, 58 CMD_GET_OBJECT_INFO = 0x1008, 59 CMD_GET_OBJECT = 0x1009, 60 CMD_DELETE_OBJECT = 0x100b, 61 CMD_SEND_OBJECT_INFO = 0x100c, 62 CMD_SEND_OBJECT = 0x100d, 63 CMD_GET_PARTIAL_OBJECT = 0x101b, 64 CMD_GET_OBJECT_PROPS_SUPPORTED = 0x9801, 65 CMD_GET_OBJECT_PROP_DESC = 0x9802, 66 CMD_GET_OBJECT_PROP_VALUE = 0x9803, 67 68 /* response codes */ 69 RES_OK = 0x2001, 70 RES_GENERAL_ERROR = 0x2002, 71 RES_SESSION_NOT_OPEN = 0x2003, 72 RES_INVALID_TRANSACTION_ID = 0x2004, 73 RES_OPERATION_NOT_SUPPORTED = 0x2005, 74 RES_PARAMETER_NOT_SUPPORTED = 0x2006, 75 RES_INCOMPLETE_TRANSFER = 0x2007, 76 RES_INVALID_STORAGE_ID = 0x2008, 77 RES_INVALID_OBJECT_HANDLE = 0x2009, 78 RES_INVALID_OBJECT_FORMAT_CODE = 0x200b, 79 RES_STORE_FULL = 0x200c, 80 RES_STORE_READ_ONLY = 0x200e, 81 RES_PARTIAL_DELETE = 0x2012, 82 RES_STORE_NOT_AVAILABLE = 0x2013, 83 RES_SPEC_BY_FORMAT_UNSUPPORTED = 0x2014, 84 RES_INVALID_OBJECTINFO = 0x2015, 85 RES_DESTINATION_UNSUPPORTED = 0x2020, 86 RES_INVALID_PARENT_OBJECT = 0x201a, 87 RES_INVALID_PARAMETER = 0x201d, 88 RES_SESSION_ALREADY_OPEN = 0x201e, 89 RES_INVALID_OBJECT_PROP_CODE = 0xA801, 90 91 /* format codes */ 92 FMT_UNDEFINED_OBJECT = 0x3000, 93 FMT_ASSOCIATION = 0x3001, 94 95 /* event codes */ 96 EVT_CANCEL_TRANSACTION = 0x4001, 97 EVT_OBJ_ADDED = 0x4002, 98 EVT_OBJ_REMOVED = 0x4003, 99 EVT_OBJ_INFO_CHANGED = 0x4007, 100 101 /* object properties */ 102 PROP_STORAGE_ID = 0xDC01, 103 PROP_OBJECT_FORMAT = 0xDC02, 104 PROP_OBJECT_COMPRESSED_SIZE = 0xDC04, 105 PROP_PARENT_OBJECT = 0xDC0B, 106 PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER = 0xDC41, 107 PROP_NAME = 0xDC44, 108 }; 109 110 enum mtp_data_type { 111 DATA_TYPE_UINT16 = 0x0004, 112 DATA_TYPE_UINT32 = 0x0006, 113 DATA_TYPE_UINT64 = 0x0008, 114 DATA_TYPE_UINT128 = 0x000a, 115 DATA_TYPE_STRING = 0xffff, 116 }; 117 118 typedef struct { 119 uint32_t length; 120 uint16_t type; 121 uint16_t code; 122 uint32_t trans; 123 } QEMU_PACKED mtp_container; 124 125 /* ----------------------------------------------------------------------- */ 126 127 typedef struct MTPState MTPState; 128 typedef struct MTPControl MTPControl; 129 typedef struct MTPData MTPData; 130 typedef struct MTPObject MTPObject; 131 132 enum { 133 EP_DATA_IN = 1, 134 EP_DATA_OUT, 135 EP_EVENT, 136 }; 137 138 typedef struct MTPMonEntry MTPMonEntry; 139 140 struct MTPMonEntry { 141 uint32_t event; 142 uint32_t handle; 143 144 QTAILQ_ENTRY(MTPMonEntry) next; 145 }; 146 147 struct MTPControl { 148 uint16_t code; 149 uint32_t trans; 150 int argc; 151 uint32_t argv[5]; 152 }; 153 154 struct MTPData { 155 uint16_t code; 156 uint32_t trans; 157 uint64_t offset; 158 uint64_t length; 159 uint64_t alloc; 160 uint8_t *data; 161 bool first; 162 /* Used for >4G file sizes */ 163 bool pending; 164 int fd; 165 uint8_t write_status; 166 /* Internal pointer per every MTP_WRITE_BUF_SZ */ 167 uint64_t data_offset; 168 }; 169 170 struct MTPObject { 171 uint32_t handle; 172 uint16_t format; 173 char *name; 174 char *path; 175 struct stat stat; 176 /* file monitor watch id */ 177 int64_t watchid; 178 MTPObject *parent; 179 uint32_t nchildren; 180 QLIST_HEAD(, MTPObject) children; 181 QLIST_ENTRY(MTPObject) list; 182 bool have_children; 183 QTAILQ_ENTRY(MTPObject) next; 184 }; 185 186 struct MTPState { 187 USBDevice dev; 188 char *root; 189 char *desc; 190 uint32_t flags; 191 192 MTPData *data_in; 193 MTPData *data_out; 194 MTPControl *result; 195 uint32_t session; 196 uint32_t next_handle; 197 bool readonly; 198 199 QTAILQ_HEAD(, MTPObject) objects; 200 QFileMonitor *file_monitor; 201 QTAILQ_HEAD(, MTPMonEntry) events; 202 /* Responder is expecting a write operation */ 203 bool write_pending; 204 struct { 205 uint32_t parent_handle; 206 uint16_t format; 207 uint32_t size; 208 char *filename; 209 } dataset; 210 }; 211 212 /* 213 * ObjectInfo dataset received from initiator 214 * Fields we don't care about are ignored 215 */ 216 typedef struct { 217 uint32_t storage_id; /*unused*/ 218 uint16_t format; 219 uint16_t protection_status; /*unused*/ 220 uint32_t size; 221 uint16_t thumb_format; /*unused*/ 222 uint32_t thumb_comp_sz; /*unused*/ 223 uint32_t thumb_pix_width; /*unused*/ 224 uint32_t thumb_pix_height; /*unused*/ 225 uint32_t image_pix_width; /*unused*/ 226 uint32_t image_pix_height; /*unused*/ 227 uint32_t image_bit_depth; /*unused*/ 228 uint32_t parent; /*unused*/ 229 uint16_t assoc_type; 230 uint32_t assoc_desc; 231 uint32_t seq_no; /*unused*/ 232 uint8_t length; /*part of filename field*/ 233 uint8_t filename[0]; /* UTF-16 encoded */ 234 char date_created[0]; /*unused*/ 235 char date_modified[0]; /*unused*/ 236 char keywords[0]; /*unused*/ 237 /* string and other data follows */ 238 } QEMU_PACKED ObjectInfo; 239 240 #define TYPE_USB_MTP "usb-mtp" 241 OBJECT_DECLARE_SIMPLE_TYPE(MTPState, USB_MTP) 242 243 #define QEMU_STORAGE_ID 0x00010001 244 245 #define MTP_FLAG_WRITABLE 0 246 247 #define FLAG_SET(_mtp, _flag) ((_mtp)->flags & (1 << (_flag))) 248 249 /* ----------------------------------------------------------------------- */ 250 251 #define MTP_MANUFACTURER "QEMU" 252 #define MTP_PRODUCT "QEMU filesharing" 253 #define MTP_WRITE_BUF_SZ (512 * KiB) 254 255 enum { 256 STR_MANUFACTURER = 1, 257 STR_PRODUCT, 258 STR_SERIALNUMBER, 259 STR_MTP, 260 STR_CONFIG_FULL, 261 STR_CONFIG_HIGH, 262 STR_CONFIG_SUPER, 263 }; 264 265 static const USBDescStrings desc_strings = { 266 [STR_MANUFACTURER] = MTP_MANUFACTURER, 267 [STR_PRODUCT] = MTP_PRODUCT, 268 [STR_SERIALNUMBER] = "34617", 269 [STR_MTP] = "MTP", 270 [STR_CONFIG_FULL] = "Full speed config (usb 1.1)", 271 [STR_CONFIG_HIGH] = "High speed config (usb 2.0)", 272 [STR_CONFIG_SUPER] = "Super speed config (usb 3.0)", 273 }; 274 275 static const USBDescIface desc_iface_full = { 276 .bInterfaceNumber = 0, 277 .bNumEndpoints = 3, 278 .bInterfaceClass = USB_CLASS_STILL_IMAGE, 279 .bInterfaceSubClass = 0x01, 280 .bInterfaceProtocol = 0x01, 281 .iInterface = STR_MTP, 282 .eps = (USBDescEndpoint[]) { 283 { 284 .bEndpointAddress = USB_DIR_IN | EP_DATA_IN, 285 .bmAttributes = USB_ENDPOINT_XFER_BULK, 286 .wMaxPacketSize = 64, 287 },{ 288 .bEndpointAddress = USB_DIR_OUT | EP_DATA_OUT, 289 .bmAttributes = USB_ENDPOINT_XFER_BULK, 290 .wMaxPacketSize = 64, 291 },{ 292 .bEndpointAddress = USB_DIR_IN | EP_EVENT, 293 .bmAttributes = USB_ENDPOINT_XFER_INT, 294 .wMaxPacketSize = 64, 295 .bInterval = 0x0a, 296 }, 297 } 298 }; 299 300 static const USBDescDevice desc_device_full = { 301 .bcdUSB = 0x0200, 302 .bMaxPacketSize0 = 8, 303 .bNumConfigurations = 1, 304 .confs = (USBDescConfig[]) { 305 { 306 .bNumInterfaces = 1, 307 .bConfigurationValue = 1, 308 .iConfiguration = STR_CONFIG_FULL, 309 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP, 310 .bMaxPower = 2, 311 .nif = 1, 312 .ifs = &desc_iface_full, 313 }, 314 }, 315 }; 316 317 static const USBDescIface desc_iface_high = { 318 .bInterfaceNumber = 0, 319 .bNumEndpoints = 3, 320 .bInterfaceClass = USB_CLASS_STILL_IMAGE, 321 .bInterfaceSubClass = 0x01, 322 .bInterfaceProtocol = 0x01, 323 .iInterface = STR_MTP, 324 .eps = (USBDescEndpoint[]) { 325 { 326 .bEndpointAddress = USB_DIR_IN | EP_DATA_IN, 327 .bmAttributes = USB_ENDPOINT_XFER_BULK, 328 .wMaxPacketSize = 512, 329 },{ 330 .bEndpointAddress = USB_DIR_OUT | EP_DATA_OUT, 331 .bmAttributes = USB_ENDPOINT_XFER_BULK, 332 .wMaxPacketSize = 512, 333 },{ 334 .bEndpointAddress = USB_DIR_IN | EP_EVENT, 335 .bmAttributes = USB_ENDPOINT_XFER_INT, 336 .wMaxPacketSize = 64, 337 .bInterval = 0x0a, 338 }, 339 } 340 }; 341 342 static const USBDescDevice desc_device_high = { 343 .bcdUSB = 0x0200, 344 .bMaxPacketSize0 = 64, 345 .bNumConfigurations = 1, 346 .confs = (USBDescConfig[]) { 347 { 348 .bNumInterfaces = 1, 349 .bConfigurationValue = 1, 350 .iConfiguration = STR_CONFIG_HIGH, 351 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_WAKEUP, 352 .bMaxPower = 2, 353 .nif = 1, 354 .ifs = &desc_iface_high, 355 }, 356 }, 357 }; 358 359 static const USBDescMSOS desc_msos = { 360 .CompatibleID = "MTP", 361 .SelectiveSuspendEnabled = true, 362 }; 363 364 static const USBDesc desc = { 365 .id = { 366 .idVendor = 0x46f4, /* CRC16() of "QEMU" */ 367 .idProduct = 0x0004, 368 .bcdDevice = 0, 369 .iManufacturer = STR_MANUFACTURER, 370 .iProduct = STR_PRODUCT, 371 .iSerialNumber = STR_SERIALNUMBER, 372 }, 373 .full = &desc_device_full, 374 .high = &desc_device_high, 375 .str = desc_strings, 376 .msos = &desc_msos, 377 }; 378 379 /* ----------------------------------------------------------------------- */ 380 381 static MTPObject *usb_mtp_object_alloc(MTPState *s, uint32_t handle, 382 MTPObject *parent, const char *name) 383 { 384 MTPObject *o = g_new0(MTPObject, 1); 385 386 if (name[0] == '.') { 387 goto ignore; 388 } 389 390 o->watchid = -1; 391 o->handle = handle; 392 o->parent = parent; 393 o->name = g_strdup(name); 394 if (parent == NULL) { 395 o->path = g_strdup(name); 396 } else { 397 o->path = g_strdup_printf("%s/%s", parent->path, name); 398 } 399 400 if (lstat(o->path, &o->stat) != 0) { 401 goto ignore; 402 } 403 if (S_ISREG(o->stat.st_mode)) { 404 o->format = FMT_UNDEFINED_OBJECT; 405 } else if (S_ISDIR(o->stat.st_mode)) { 406 o->format = FMT_ASSOCIATION; 407 } else { 408 goto ignore; 409 } 410 411 if (access(o->path, R_OK) != 0) { 412 goto ignore; 413 } 414 415 trace_usb_mtp_object_alloc(s->dev.addr, o->handle, o->path); 416 417 QTAILQ_INSERT_TAIL(&s->objects, o, next); 418 return o; 419 420 ignore: 421 g_free(o->name); 422 g_free(o->path); 423 g_free(o); 424 return NULL; 425 } 426 427 static void usb_mtp_object_free(MTPState *s, MTPObject *o) 428 { 429 MTPObject *iter; 430 431 if (!o) { 432 return; 433 } 434 435 trace_usb_mtp_object_free(s->dev.addr, o->handle, o->path); 436 437 if (o->watchid != -1 && s->file_monitor) { 438 qemu_file_monitor_remove_watch(s->file_monitor, o->path, o->watchid); 439 } 440 441 QTAILQ_REMOVE(&s->objects, o, next); 442 if (o->parent) { 443 QLIST_REMOVE(o, list); 444 o->parent->nchildren--; 445 } 446 447 while (!QLIST_EMPTY(&o->children)) { 448 iter = QLIST_FIRST(&o->children); 449 usb_mtp_object_free(s, iter); 450 } 451 g_free(o->name); 452 g_free(o->path); 453 g_free(o); 454 } 455 456 static MTPObject *usb_mtp_object_lookup(MTPState *s, uint32_t handle) 457 { 458 MTPObject *o; 459 460 QTAILQ_FOREACH(o, &s->objects, next) { 461 if (o->handle == handle) { 462 return o; 463 } 464 } 465 return NULL; 466 } 467 468 static MTPObject *usb_mtp_add_child(MTPState *s, MTPObject *o, 469 const char *name) 470 { 471 MTPObject *child = 472 usb_mtp_object_alloc(s, s->next_handle++, o, name); 473 474 if (child) { 475 trace_usb_mtp_add_child(s->dev.addr, child->handle, child->path); 476 QLIST_INSERT_HEAD(&o->children, child, list); 477 o->nchildren++; 478 479 if (child->format == FMT_ASSOCIATION) { 480 QLIST_INIT(&child->children); 481 } 482 } 483 484 return child; 485 } 486 487 static MTPObject *usb_mtp_object_lookup_name(MTPObject *parent, 488 const char *name, int len) 489 { 490 MTPObject *iter; 491 492 if (len == -1) { 493 len = strlen(name); 494 } 495 496 QLIST_FOREACH(iter, &parent->children, list) { 497 if (strncmp(iter->name, name, len) == 0) { 498 return iter; 499 } 500 } 501 502 return NULL; 503 } 504 505 static MTPObject *usb_mtp_object_lookup_id(MTPState *s, int64_t id) 506 { 507 MTPObject *iter; 508 509 QTAILQ_FOREACH(iter, &s->objects, next) { 510 if (iter->watchid == id) { 511 return iter; 512 } 513 } 514 515 return NULL; 516 } 517 518 static void file_monitor_event(int64_t id, 519 QFileMonitorEvent ev, 520 const char *name, 521 void *opaque) 522 { 523 MTPState *s = opaque; 524 MTPObject *parent = usb_mtp_object_lookup_id(s, id); 525 MTPMonEntry *entry = NULL; 526 MTPObject *o; 527 528 if (!parent) { 529 return; 530 } 531 532 switch (ev) { 533 case QFILE_MONITOR_EVENT_CREATED: 534 if (usb_mtp_object_lookup_name(parent, name, -1)) { 535 /* Duplicate create event */ 536 return; 537 } 538 entry = g_new0(MTPMonEntry, 1); 539 entry->handle = s->next_handle; 540 entry->event = EVT_OBJ_ADDED; 541 o = usb_mtp_add_child(s, parent, name); 542 if (!o) { 543 g_free(entry); 544 return; 545 } 546 trace_usb_mtp_file_monitor_event(s->dev.addr, name, "Obj Added"); 547 break; 548 549 case QFILE_MONITOR_EVENT_DELETED: 550 /* 551 * The kernel issues a IN_IGNORED event 552 * when a dir containing a watchpoint is 553 * deleted, so we don't have to delete the 554 * watchpoint 555 */ 556 o = usb_mtp_object_lookup_name(parent, name, -1); 557 if (!o) { 558 return; 559 } 560 entry = g_new0(MTPMonEntry, 1); 561 entry->handle = o->handle; 562 entry->event = EVT_OBJ_REMOVED; 563 trace_usb_mtp_file_monitor_event(s->dev.addr, o->path, "Obj Deleted"); 564 usb_mtp_object_free(s, o); 565 break; 566 567 case QFILE_MONITOR_EVENT_MODIFIED: 568 o = usb_mtp_object_lookup_name(parent, name, -1); 569 if (!o) { 570 return; 571 } 572 entry = g_new0(MTPMonEntry, 1); 573 entry->handle = o->handle; 574 entry->event = EVT_OBJ_INFO_CHANGED; 575 trace_usb_mtp_file_monitor_event(s->dev.addr, o->path, "Obj Modified"); 576 break; 577 578 case QFILE_MONITOR_EVENT_IGNORED: 579 trace_usb_mtp_file_monitor_event(s->dev.addr, parent->path, 580 "Obj parent dir ignored"); 581 break; 582 583 case QFILE_MONITOR_EVENT_ATTRIBUTES: 584 break; 585 586 default: 587 g_assert_not_reached(); 588 } 589 590 if (entry) { 591 QTAILQ_INSERT_HEAD(&s->events, entry, next); 592 } 593 } 594 595 static void usb_mtp_file_monitor_cleanup(MTPState *s) 596 { 597 MTPMonEntry *e, *p; 598 599 QTAILQ_FOREACH_SAFE(e, &s->events, next, p) { 600 QTAILQ_REMOVE(&s->events, e, next); 601 g_free(e); 602 } 603 604 qemu_file_monitor_free(s->file_monitor); 605 s->file_monitor = NULL; 606 } 607 608 609 static void usb_mtp_object_readdir(MTPState *s, MTPObject *o) 610 { 611 struct dirent *entry; 612 DIR *dir; 613 int fd; 614 Error *err = NULL; 615 616 if (o->have_children) { 617 return; 618 } 619 o->have_children = true; 620 621 fd = open(o->path, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW); 622 if (fd < 0) { 623 return; 624 } 625 dir = fdopendir(fd); 626 if (!dir) { 627 close(fd); 628 return; 629 } 630 631 if (s->file_monitor) { 632 int64_t id = qemu_file_monitor_add_watch(s->file_monitor, o->path, NULL, 633 file_monitor_event, s, &err); 634 if (id == -1) { 635 error_reportf_err(err, 636 "usb-mtp: failed to add watch for %s: ", 637 o->path); 638 } else { 639 trace_usb_mtp_file_monitor_event(s->dev.addr, o->path, 640 "Watch Added"); 641 o->watchid = id; 642 } 643 } 644 645 while ((entry = readdir(dir)) != NULL) { 646 usb_mtp_add_child(s, o, entry->d_name); 647 } 648 closedir(dir); 649 } 650 651 /* ----------------------------------------------------------------------- */ 652 653 static MTPData *usb_mtp_data_alloc(MTPControl *c) 654 { 655 MTPData *data = g_new0(MTPData, 1); 656 657 data->code = c->code; 658 data->trans = c->trans; 659 data->fd = -1; 660 data->first = true; 661 return data; 662 } 663 664 static void usb_mtp_data_free(MTPData *data) 665 { 666 if (data == NULL) { 667 return; 668 } 669 if (data->fd != -1) { 670 close(data->fd); 671 } 672 g_free(data->data); 673 g_free(data); 674 } 675 676 static void usb_mtp_realloc(MTPData *data, uint32_t bytes) 677 { 678 if (data->length + bytes <= data->alloc) { 679 return; 680 } 681 data->alloc = (data->length + bytes + 0xff) & ~0xff; 682 data->data = g_realloc(data->data, data->alloc); 683 } 684 685 static void usb_mtp_add_u8(MTPData *data, uint8_t val) 686 { 687 usb_mtp_realloc(data, 1); 688 data->data[data->length++] = val; 689 } 690 691 static void usb_mtp_add_u16(MTPData *data, uint16_t val) 692 { 693 usb_mtp_realloc(data, 2); 694 data->data[data->length++] = (val >> 0) & 0xff; 695 data->data[data->length++] = (val >> 8) & 0xff; 696 } 697 698 static void usb_mtp_add_u32(MTPData *data, uint32_t val) 699 { 700 usb_mtp_realloc(data, 4); 701 data->data[data->length++] = (val >> 0) & 0xff; 702 data->data[data->length++] = (val >> 8) & 0xff; 703 data->data[data->length++] = (val >> 16) & 0xff; 704 data->data[data->length++] = (val >> 24) & 0xff; 705 } 706 707 static void usb_mtp_add_u64(MTPData *data, uint64_t val) 708 { 709 usb_mtp_realloc(data, 8); 710 data->data[data->length++] = (val >> 0) & 0xff; 711 data->data[data->length++] = (val >> 8) & 0xff; 712 data->data[data->length++] = (val >> 16) & 0xff; 713 data->data[data->length++] = (val >> 24) & 0xff; 714 data->data[data->length++] = (val >> 32) & 0xff; 715 data->data[data->length++] = (val >> 40) & 0xff; 716 data->data[data->length++] = (val >> 48) & 0xff; 717 data->data[data->length++] = (val >> 56) & 0xff; 718 } 719 720 static void usb_mtp_add_u16_array(MTPData *data, uint32_t len, 721 const uint16_t *vals) 722 { 723 int i; 724 725 usb_mtp_add_u32(data, len); 726 for (i = 0; i < len; i++) { 727 usb_mtp_add_u16(data, vals[i]); 728 } 729 } 730 731 static void usb_mtp_add_u32_array(MTPData *data, uint32_t len, 732 const uint32_t *vals) 733 { 734 int i; 735 736 usb_mtp_add_u32(data, len); 737 for (i = 0; i < len; i++) { 738 usb_mtp_add_u32(data, vals[i]); 739 } 740 } 741 742 static void usb_mtp_add_wstr(MTPData *data, const wchar_t *str) 743 { 744 uint32_t len = wcslen(str); 745 int i; 746 747 if (len > 0) { 748 len++; /* include terminating L'\0' */ 749 } 750 751 usb_mtp_add_u8(data, len); 752 for (i = 0; i < len; i++) { 753 usb_mtp_add_u16(data, str[i]); 754 } 755 } 756 757 static void usb_mtp_add_str(MTPData *data, const char *str) 758 { 759 uint32_t len = strlen(str)+1; 760 wchar_t *wstr = g_new(wchar_t, len); 761 size_t ret; 762 763 ret = mbstowcs(wstr, str, len); 764 if (ret == -1) { 765 usb_mtp_add_wstr(data, L"Oops"); 766 } else { 767 usb_mtp_add_wstr(data, wstr); 768 } 769 770 g_free(wstr); 771 } 772 773 static void usb_mtp_add_time(MTPData *data, time_t time) 774 { 775 g_autoptr(GDateTime) then = g_date_time_new_from_unix_utc(time); 776 g_autofree char *thenstr = g_date_time_format(then, "%Y%m%dT%H%M%S"); 777 usb_mtp_add_str(data, thenstr); 778 } 779 780 /* ----------------------------------------------------------------------- */ 781 782 static void usb_mtp_queue_result(MTPState *s, uint16_t code, uint32_t trans, 783 int argc, uint32_t arg0, uint32_t arg1, 784 uint32_t arg2) 785 { 786 MTPControl *c = g_new0(MTPControl, 1); 787 788 c->code = code; 789 c->trans = trans; 790 c->argc = argc; 791 if (argc > 0) { 792 c->argv[0] = arg0; 793 } 794 if (argc > 1) { 795 c->argv[1] = arg1; 796 } 797 if (argc > 2) { 798 c->argv[2] = arg2; 799 } 800 801 assert(s->result == NULL); 802 s->result = c; 803 } 804 805 /* ----------------------------------------------------------------------- */ 806 807 static MTPData *usb_mtp_get_device_info(MTPState *s, MTPControl *c) 808 { 809 static const uint16_t ops[] = { 810 CMD_GET_DEVICE_INFO, 811 CMD_OPEN_SESSION, 812 CMD_CLOSE_SESSION, 813 CMD_GET_STORAGE_IDS, 814 CMD_GET_STORAGE_INFO, 815 CMD_GET_NUM_OBJECTS, 816 CMD_GET_OBJECT_HANDLES, 817 CMD_GET_OBJECT_INFO, 818 CMD_DELETE_OBJECT, 819 CMD_SEND_OBJECT_INFO, 820 CMD_SEND_OBJECT, 821 CMD_GET_OBJECT, 822 CMD_GET_PARTIAL_OBJECT, 823 CMD_GET_OBJECT_PROPS_SUPPORTED, 824 CMD_GET_OBJECT_PROP_DESC, 825 CMD_GET_OBJECT_PROP_VALUE, 826 }; 827 static const uint16_t fmt[] = { 828 FMT_UNDEFINED_OBJECT, 829 FMT_ASSOCIATION, 830 }; 831 MTPData *d = usb_mtp_data_alloc(c); 832 833 trace_usb_mtp_op_get_device_info(s->dev.addr); 834 835 usb_mtp_add_u16(d, 100); 836 usb_mtp_add_u32(d, 0x00000006); 837 usb_mtp_add_u16(d, 0x0064); 838 usb_mtp_add_wstr(d, L""); 839 usb_mtp_add_u16(d, 0x0000); 840 841 usb_mtp_add_u16_array(d, ARRAY_SIZE(ops), ops); 842 usb_mtp_add_u16_array(d, 0, NULL); 843 usb_mtp_add_u16_array(d, 0, NULL); 844 usb_mtp_add_u16_array(d, 0, NULL); 845 usb_mtp_add_u16_array(d, ARRAY_SIZE(fmt), fmt); 846 847 usb_mtp_add_wstr(d, L"" MTP_MANUFACTURER); 848 usb_mtp_add_wstr(d, L"" MTP_PRODUCT); 849 usb_mtp_add_wstr(d, L"0.1"); 850 usb_mtp_add_wstr(d, L"0123456789abcdef0123456789abcdef"); 851 852 return d; 853 } 854 855 static MTPData *usb_mtp_get_storage_ids(MTPState *s, MTPControl *c) 856 { 857 static const uint32_t ids[] = { 858 QEMU_STORAGE_ID, 859 }; 860 MTPData *d = usb_mtp_data_alloc(c); 861 862 trace_usb_mtp_op_get_storage_ids(s->dev.addr); 863 864 usb_mtp_add_u32_array(d, ARRAY_SIZE(ids), ids); 865 866 return d; 867 } 868 869 static MTPData *usb_mtp_get_storage_info(MTPState *s, MTPControl *c) 870 { 871 MTPData *d = usb_mtp_data_alloc(c); 872 struct statvfs buf; 873 int rc; 874 875 trace_usb_mtp_op_get_storage_info(s->dev.addr); 876 877 if (FLAG_SET(s, MTP_FLAG_WRITABLE)) { 878 usb_mtp_add_u16(d, 0x0003); 879 usb_mtp_add_u16(d, 0x0002); 880 usb_mtp_add_u16(d, 0x0000); 881 } else { 882 usb_mtp_add_u16(d, 0x0001); 883 usb_mtp_add_u16(d, 0x0002); 884 usb_mtp_add_u16(d, 0x0001); 885 } 886 887 rc = statvfs(s->root, &buf); 888 if (rc == 0) { 889 usb_mtp_add_u64(d, (uint64_t)buf.f_frsize * buf.f_blocks); 890 usb_mtp_add_u64(d, (uint64_t)buf.f_bavail * buf.f_blocks); 891 usb_mtp_add_u32(d, buf.f_ffree); 892 } else { 893 usb_mtp_add_u64(d, 0xffffffff); 894 usb_mtp_add_u64(d, 0xffffffff); 895 usb_mtp_add_u32(d, 0xffffffff); 896 } 897 898 usb_mtp_add_str(d, s->desc); 899 usb_mtp_add_wstr(d, L"123456789abcdef"); 900 return d; 901 } 902 903 static MTPData *usb_mtp_get_object_handles(MTPState *s, MTPControl *c, 904 MTPObject *o) 905 { 906 MTPData *d = usb_mtp_data_alloc(c); 907 uint32_t i = 0; 908 g_autofree uint32_t *handles = g_new(uint32_t, o->nchildren); 909 MTPObject *iter; 910 911 trace_usb_mtp_op_get_object_handles(s->dev.addr, o->handle, o->path); 912 913 QLIST_FOREACH(iter, &o->children, list) { 914 handles[i++] = iter->handle; 915 } 916 assert(i == o->nchildren); 917 usb_mtp_add_u32_array(d, o->nchildren, handles); 918 919 return d; 920 } 921 922 static MTPData *usb_mtp_get_object_info(MTPState *s, MTPControl *c, 923 MTPObject *o) 924 { 925 MTPData *d = usb_mtp_data_alloc(c); 926 927 trace_usb_mtp_op_get_object_info(s->dev.addr, o->handle, o->path); 928 929 usb_mtp_add_u32(d, QEMU_STORAGE_ID); 930 usb_mtp_add_u16(d, o->format); 931 usb_mtp_add_u16(d, 0); 932 933 if (o->stat.st_size > 0xFFFFFFFF) { 934 usb_mtp_add_u32(d, 0xFFFFFFFF); 935 } else { 936 usb_mtp_add_u32(d, o->stat.st_size); 937 } 938 939 usb_mtp_add_u16(d, 0); 940 usb_mtp_add_u32(d, 0); 941 usb_mtp_add_u32(d, 0); 942 usb_mtp_add_u32(d, 0); 943 usb_mtp_add_u32(d, 0); 944 usb_mtp_add_u32(d, 0); 945 usb_mtp_add_u32(d, 0); 946 947 if (o->parent) { 948 usb_mtp_add_u32(d, o->parent->handle); 949 } else { 950 usb_mtp_add_u32(d, 0); 951 } 952 if (o->format == FMT_ASSOCIATION) { 953 usb_mtp_add_u16(d, 0x0001); 954 usb_mtp_add_u32(d, 0x00000001); 955 usb_mtp_add_u32(d, 0); 956 } else { 957 usb_mtp_add_u16(d, 0); 958 usb_mtp_add_u32(d, 0); 959 usb_mtp_add_u32(d, 0); 960 } 961 962 usb_mtp_add_str(d, o->name); 963 usb_mtp_add_time(d, o->stat.st_ctime); 964 usb_mtp_add_time(d, o->stat.st_mtime); 965 usb_mtp_add_wstr(d, L""); 966 967 return d; 968 } 969 970 static MTPData *usb_mtp_get_object(MTPState *s, MTPControl *c, 971 MTPObject *o) 972 { 973 MTPData *d = usb_mtp_data_alloc(c); 974 975 trace_usb_mtp_op_get_object(s->dev.addr, o->handle, o->path); 976 977 d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW); 978 if (d->fd == -1) { 979 usb_mtp_data_free(d); 980 return NULL; 981 } 982 d->length = o->stat.st_size; 983 d->alloc = 512; 984 d->data = g_malloc(d->alloc); 985 return d; 986 } 987 988 static MTPData *usb_mtp_get_partial_object(MTPState *s, MTPControl *c, 989 MTPObject *o) 990 { 991 MTPData *d; 992 off_t offset; 993 994 if (c->argc <= 2) { 995 return NULL; 996 } 997 trace_usb_mtp_op_get_partial_object(s->dev.addr, o->handle, o->path, 998 c->argv[1], c->argv[2]); 999 1000 d = usb_mtp_data_alloc(c); 1001 d->fd = open(o->path, O_RDONLY | O_CLOEXEC | O_NOFOLLOW); 1002 if (d->fd == -1) { 1003 usb_mtp_data_free(d); 1004 return NULL; 1005 } 1006 1007 offset = c->argv[1]; 1008 if (offset > o->stat.st_size) { 1009 offset = o->stat.st_size; 1010 } 1011 if (lseek(d->fd, offset, SEEK_SET) < 0) { 1012 usb_mtp_data_free(d); 1013 return NULL; 1014 } 1015 1016 d->length = c->argv[2]; 1017 if (d->length > o->stat.st_size - offset) { 1018 d->length = o->stat.st_size - offset; 1019 } 1020 1021 return d; 1022 } 1023 1024 static MTPData *usb_mtp_get_object_props_supported(MTPState *s, MTPControl *c) 1025 { 1026 static const uint16_t props[] = { 1027 PROP_STORAGE_ID, 1028 PROP_OBJECT_FORMAT, 1029 PROP_OBJECT_COMPRESSED_SIZE, 1030 PROP_PARENT_OBJECT, 1031 PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER, 1032 PROP_NAME, 1033 }; 1034 MTPData *d = usb_mtp_data_alloc(c); 1035 usb_mtp_add_u16_array(d, ARRAY_SIZE(props), props); 1036 1037 return d; 1038 } 1039 1040 static MTPData *usb_mtp_get_object_prop_desc(MTPState *s, MTPControl *c) 1041 { 1042 MTPData *d = usb_mtp_data_alloc(c); 1043 switch (c->argv[0]) { 1044 case PROP_STORAGE_ID: 1045 usb_mtp_add_u16(d, PROP_STORAGE_ID); 1046 usb_mtp_add_u16(d, DATA_TYPE_UINT32); 1047 usb_mtp_add_u8(d, 0x00); 1048 usb_mtp_add_u32(d, 0x00000000); 1049 usb_mtp_add_u32(d, 0x00000000); 1050 usb_mtp_add_u8(d, 0x00); 1051 break; 1052 case PROP_OBJECT_FORMAT: 1053 usb_mtp_add_u16(d, PROP_OBJECT_FORMAT); 1054 usb_mtp_add_u16(d, DATA_TYPE_UINT16); 1055 usb_mtp_add_u8(d, 0x00); 1056 usb_mtp_add_u16(d, 0x0000); 1057 usb_mtp_add_u32(d, 0x00000000); 1058 usb_mtp_add_u8(d, 0x00); 1059 break; 1060 case PROP_OBJECT_COMPRESSED_SIZE: 1061 usb_mtp_add_u16(d, PROP_OBJECT_COMPRESSED_SIZE); 1062 usb_mtp_add_u16(d, DATA_TYPE_UINT64); 1063 usb_mtp_add_u8(d, 0x00); 1064 usb_mtp_add_u64(d, 0x0000000000000000); 1065 usb_mtp_add_u32(d, 0x00000000); 1066 usb_mtp_add_u8(d, 0x00); 1067 break; 1068 case PROP_PARENT_OBJECT: 1069 usb_mtp_add_u16(d, PROP_PARENT_OBJECT); 1070 usb_mtp_add_u16(d, DATA_TYPE_UINT32); 1071 usb_mtp_add_u8(d, 0x00); 1072 usb_mtp_add_u32(d, 0x00000000); 1073 usb_mtp_add_u32(d, 0x00000000); 1074 usb_mtp_add_u8(d, 0x00); 1075 break; 1076 case PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER: 1077 usb_mtp_add_u16(d, PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER); 1078 usb_mtp_add_u16(d, DATA_TYPE_UINT128); 1079 usb_mtp_add_u8(d, 0x00); 1080 usb_mtp_add_u64(d, 0x0000000000000000); 1081 usb_mtp_add_u64(d, 0x0000000000000000); 1082 usb_mtp_add_u32(d, 0x00000000); 1083 usb_mtp_add_u8(d, 0x00); 1084 break; 1085 case PROP_NAME: 1086 usb_mtp_add_u16(d, PROP_NAME); 1087 usb_mtp_add_u16(d, DATA_TYPE_STRING); 1088 usb_mtp_add_u8(d, 0x00); 1089 usb_mtp_add_u8(d, 0x00); 1090 usb_mtp_add_u32(d, 0x00000000); 1091 usb_mtp_add_u8(d, 0x00); 1092 break; 1093 default: 1094 usb_mtp_data_free(d); 1095 return NULL; 1096 } 1097 1098 return d; 1099 } 1100 1101 static MTPData *usb_mtp_get_object_prop_value(MTPState *s, MTPControl *c, 1102 MTPObject *o) 1103 { 1104 MTPData *d = usb_mtp_data_alloc(c); 1105 switch (c->argv[1]) { 1106 case PROP_STORAGE_ID: 1107 usb_mtp_add_u32(d, QEMU_STORAGE_ID); 1108 break; 1109 case PROP_OBJECT_FORMAT: 1110 usb_mtp_add_u16(d, o->format); 1111 break; 1112 case PROP_OBJECT_COMPRESSED_SIZE: 1113 usb_mtp_add_u64(d, o->stat.st_size); 1114 break; 1115 case PROP_PARENT_OBJECT: 1116 if (o->parent == NULL) { 1117 usb_mtp_add_u32(d, 0x00000000); 1118 } else { 1119 usb_mtp_add_u32(d, o->parent->handle); 1120 } 1121 break; 1122 case PROP_PERSISTENT_UNIQUE_OBJECT_IDENTIFIER: 1123 /* Should be persistent between sessions, 1124 * but using our objedt ID is "good enough" 1125 * for now */ 1126 usb_mtp_add_u64(d, 0x0000000000000000); 1127 usb_mtp_add_u64(d, o->handle); 1128 break; 1129 case PROP_NAME: 1130 usb_mtp_add_str(d, o->name); 1131 break; 1132 default: 1133 usb_mtp_data_free(d); 1134 return NULL; 1135 } 1136 1137 return d; 1138 } 1139 1140 /* 1141 * Return values when object @o is deleted. 1142 * If at least one of the deletions succeeded, 1143 * DELETE_SUCCESS is set and if at least one 1144 * of the deletions failed, DELETE_FAILURE is 1145 * set. Both bits being set (DELETE_PARTIAL) 1146 * signifies a RES_PARTIAL_DELETE being sent 1147 * back to the initiator. 1148 */ 1149 enum { 1150 DELETE_SUCCESS = (1 << 0), 1151 DELETE_FAILURE = (1 << 1), 1152 DELETE_PARTIAL = (DELETE_FAILURE | DELETE_SUCCESS), 1153 }; 1154 1155 static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans) 1156 { 1157 MTPObject *iter, *iter2; 1158 int ret = 0; 1159 1160 /* 1161 * TODO: Add support for Protection Status 1162 */ 1163 1164 QLIST_FOREACH(iter, &o->children, list) { 1165 if (iter->format == FMT_ASSOCIATION) { 1166 QLIST_FOREACH(iter2, &iter->children, list) { 1167 ret |= usb_mtp_deletefn(s, iter2, trans); 1168 } 1169 } 1170 } 1171 1172 if (o->format == FMT_UNDEFINED_OBJECT) { 1173 if (remove(o->path)) { 1174 ret |= DELETE_FAILURE; 1175 } else { 1176 usb_mtp_object_free(s, o); 1177 ret |= DELETE_SUCCESS; 1178 } 1179 } else if (o->format == FMT_ASSOCIATION) { 1180 if (rmdir(o->path)) { 1181 ret |= DELETE_FAILURE; 1182 } else { 1183 usb_mtp_object_free(s, o); 1184 ret |= DELETE_SUCCESS; 1185 } 1186 } 1187 1188 return ret; 1189 } 1190 1191 static void usb_mtp_object_delete(MTPState *s, uint32_t handle, 1192 uint32_t format_code, uint32_t trans) 1193 { 1194 MTPObject *o; 1195 int ret; 1196 1197 /* Return error if store is read-only */ 1198 if (!FLAG_SET(s, MTP_FLAG_WRITABLE)) { 1199 usb_mtp_queue_result(s, RES_STORE_READ_ONLY, 1200 trans, 0, 0, 0, 0); 1201 return; 1202 } 1203 1204 if (format_code != 0) { 1205 usb_mtp_queue_result(s, RES_SPEC_BY_FORMAT_UNSUPPORTED, 1206 trans, 0, 0, 0, 0); 1207 return; 1208 } 1209 1210 if (handle == 0xFFFFFFF) { 1211 o = QTAILQ_FIRST(&s->objects); 1212 } else { 1213 o = usb_mtp_object_lookup(s, handle); 1214 } 1215 if (o == NULL) { 1216 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1217 trans, 0, 0, 0, 0); 1218 return; 1219 } 1220 1221 ret = usb_mtp_deletefn(s, o, trans); 1222 switch (ret) { 1223 case DELETE_SUCCESS: 1224 usb_mtp_queue_result(s, RES_OK, trans, 1225 0, 0, 0, 0); 1226 break; 1227 case DELETE_FAILURE: 1228 usb_mtp_queue_result(s, RES_PARTIAL_DELETE, 1229 trans, 0, 0, 0, 0); 1230 break; 1231 case DELETE_PARTIAL: 1232 usb_mtp_queue_result(s, RES_PARTIAL_DELETE, 1233 trans, 0, 0, 0, 0); 1234 break; 1235 default: 1236 g_assert_not_reached(); 1237 } 1238 1239 return; 1240 } 1241 1242 static void usb_mtp_command(MTPState *s, MTPControl *c) 1243 { 1244 MTPData *data_in = NULL; 1245 MTPObject *o = NULL; 1246 uint32_t nres = 0, res0 = 0; 1247 Error *err = NULL; 1248 1249 /* sanity checks */ 1250 if (c->code >= CMD_CLOSE_SESSION && s->session == 0) { 1251 usb_mtp_queue_result(s, RES_SESSION_NOT_OPEN, 1252 c->trans, 0, 0, 0, 0); 1253 return; 1254 } 1255 1256 /* process commands */ 1257 switch (c->code) { 1258 case CMD_GET_DEVICE_INFO: 1259 data_in = usb_mtp_get_device_info(s, c); 1260 break; 1261 case CMD_OPEN_SESSION: 1262 if (s->session) { 1263 usb_mtp_queue_result(s, RES_SESSION_ALREADY_OPEN, 1264 c->trans, 1, s->session, 0, 0); 1265 return; 1266 } 1267 if (c->argv[0] == 0) { 1268 usb_mtp_queue_result(s, RES_INVALID_PARAMETER, 1269 c->trans, 0, 0, 0, 0); 1270 return; 1271 } 1272 trace_usb_mtp_op_open_session(s->dev.addr); 1273 s->session = c->argv[0]; 1274 usb_mtp_object_alloc(s, s->next_handle++, NULL, s->root); 1275 1276 s->file_monitor = qemu_file_monitor_new(&err); 1277 if (err) { 1278 error_reportf_err(err, 1279 "usb-mtp: file monitoring init failed: "); 1280 } else { 1281 QTAILQ_INIT(&s->events); 1282 } 1283 break; 1284 case CMD_CLOSE_SESSION: 1285 trace_usb_mtp_op_close_session(s->dev.addr); 1286 s->session = 0; 1287 s->next_handle = 0; 1288 usb_mtp_file_monitor_cleanup(s); 1289 usb_mtp_object_free(s, QTAILQ_FIRST(&s->objects)); 1290 assert(QTAILQ_EMPTY(&s->objects)); 1291 break; 1292 case CMD_GET_STORAGE_IDS: 1293 data_in = usb_mtp_get_storage_ids(s, c); 1294 break; 1295 case CMD_GET_STORAGE_INFO: 1296 if (c->argv[0] != QEMU_STORAGE_ID && 1297 c->argv[0] != 0xffffffff) { 1298 usb_mtp_queue_result(s, RES_INVALID_STORAGE_ID, 1299 c->trans, 0, 0, 0, 0); 1300 return; 1301 } 1302 data_in = usb_mtp_get_storage_info(s, c); 1303 break; 1304 case CMD_GET_NUM_OBJECTS: 1305 case CMD_GET_OBJECT_HANDLES: 1306 if (c->argv[0] != QEMU_STORAGE_ID && 1307 c->argv[0] != 0xffffffff) { 1308 usb_mtp_queue_result(s, RES_INVALID_STORAGE_ID, 1309 c->trans, 0, 0, 0, 0); 1310 return; 1311 } 1312 if (c->argv[1] != 0x00000000) { 1313 usb_mtp_queue_result(s, RES_SPEC_BY_FORMAT_UNSUPPORTED, 1314 c->trans, 0, 0, 0, 0); 1315 return; 1316 } 1317 if (c->argv[2] == 0x00000000 || 1318 c->argv[2] == 0xffffffff) { 1319 o = QTAILQ_FIRST(&s->objects); 1320 } else { 1321 o = usb_mtp_object_lookup(s, c->argv[2]); 1322 } 1323 if (o == NULL) { 1324 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1325 c->trans, 0, 0, 0, 0); 1326 return; 1327 } 1328 if (o->format != FMT_ASSOCIATION) { 1329 usb_mtp_queue_result(s, RES_INVALID_PARENT_OBJECT, 1330 c->trans, 0, 0, 0, 0); 1331 return; 1332 } 1333 usb_mtp_object_readdir(s, o); 1334 if (c->code == CMD_GET_NUM_OBJECTS) { 1335 trace_usb_mtp_op_get_num_objects(s->dev.addr, o->handle, o->path); 1336 nres = 1; 1337 res0 = o->nchildren; 1338 } else { 1339 data_in = usb_mtp_get_object_handles(s, c, o); 1340 } 1341 break; 1342 case CMD_GET_OBJECT_INFO: 1343 o = usb_mtp_object_lookup(s, c->argv[0]); 1344 if (o == NULL) { 1345 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1346 c->trans, 0, 0, 0, 0); 1347 return; 1348 } 1349 data_in = usb_mtp_get_object_info(s, c, o); 1350 break; 1351 case CMD_GET_OBJECT: 1352 o = usb_mtp_object_lookup(s, c->argv[0]); 1353 if (o == NULL) { 1354 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1355 c->trans, 0, 0, 0, 0); 1356 return; 1357 } 1358 if (o->format == FMT_ASSOCIATION) { 1359 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1360 c->trans, 0, 0, 0, 0); 1361 return; 1362 } 1363 data_in = usb_mtp_get_object(s, c, o); 1364 if (data_in == NULL) { 1365 usb_mtp_queue_result(s, RES_GENERAL_ERROR, 1366 c->trans, 0, 0, 0, 0); 1367 return; 1368 } 1369 break; 1370 case CMD_DELETE_OBJECT: 1371 usb_mtp_object_delete(s, c->argv[0], c->argv[1], c->trans); 1372 return; 1373 case CMD_GET_PARTIAL_OBJECT: 1374 o = usb_mtp_object_lookup(s, c->argv[0]); 1375 if (o == NULL) { 1376 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1377 c->trans, 0, 0, 0, 0); 1378 return; 1379 } 1380 if (o->format == FMT_ASSOCIATION) { 1381 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1382 c->trans, 0, 0, 0, 0); 1383 return; 1384 } 1385 data_in = usb_mtp_get_partial_object(s, c, o); 1386 if (data_in == NULL) { 1387 usb_mtp_queue_result(s, RES_GENERAL_ERROR, 1388 c->trans, 0, 0, 0, 0); 1389 return; 1390 } 1391 nres = 1; 1392 res0 = data_in->length; 1393 break; 1394 case CMD_SEND_OBJECT_INFO: 1395 /* Return error if store is read-only */ 1396 if (!FLAG_SET(s, MTP_FLAG_WRITABLE)) { 1397 usb_mtp_queue_result(s, RES_STORE_READ_ONLY, 1398 c->trans, 0, 0, 0, 0); 1399 } else if (c->argv[0] && (c->argv[0] != QEMU_STORAGE_ID)) { 1400 /* First parameter points to storage id or is 0 */ 1401 usb_mtp_queue_result(s, RES_STORE_NOT_AVAILABLE, c->trans, 1402 0, 0, 0, 0); 1403 } else if (c->argv[1] && !c->argv[0]) { 1404 /* If second parameter is specified, first must also be specified */ 1405 usb_mtp_queue_result(s, RES_DESTINATION_UNSUPPORTED, c->trans, 1406 0, 0, 0, 0); 1407 } else { 1408 uint32_t handle = c->argv[1]; 1409 if (handle == 0xFFFFFFFF || handle == 0) { 1410 /* root object */ 1411 o = QTAILQ_FIRST(&s->objects); 1412 } else { 1413 o = usb_mtp_object_lookup(s, handle); 1414 } 1415 if (o == NULL) { 1416 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, c->trans, 1417 0, 0, 0, 0); 1418 } else if (o->format != FMT_ASSOCIATION) { 1419 usb_mtp_queue_result(s, RES_INVALID_PARENT_OBJECT, c->trans, 1420 0, 0, 0, 0); 1421 } 1422 } 1423 if (o) { 1424 s->dataset.parent_handle = o->handle; 1425 } 1426 s->data_out = usb_mtp_data_alloc(c); 1427 return; 1428 case CMD_SEND_OBJECT: 1429 if (!FLAG_SET(s, MTP_FLAG_WRITABLE)) { 1430 usb_mtp_queue_result(s, RES_STORE_READ_ONLY, 1431 c->trans, 0, 0, 0, 0); 1432 return; 1433 } 1434 if (!s->write_pending) { 1435 usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 1436 c->trans, 0, 0, 0, 0); 1437 return; 1438 } 1439 s->data_out = usb_mtp_data_alloc(c); 1440 return; 1441 case CMD_GET_OBJECT_PROPS_SUPPORTED: 1442 if (c->argv[0] != FMT_UNDEFINED_OBJECT && 1443 c->argv[0] != FMT_ASSOCIATION) { 1444 usb_mtp_queue_result(s, RES_INVALID_OBJECT_FORMAT_CODE, 1445 c->trans, 0, 0, 0, 0); 1446 return; 1447 } 1448 data_in = usb_mtp_get_object_props_supported(s, c); 1449 break; 1450 case CMD_GET_OBJECT_PROP_DESC: 1451 if (c->argv[1] != FMT_UNDEFINED_OBJECT && 1452 c->argv[1] != FMT_ASSOCIATION) { 1453 usb_mtp_queue_result(s, RES_INVALID_OBJECT_FORMAT_CODE, 1454 c->trans, 0, 0, 0, 0); 1455 return; 1456 } 1457 data_in = usb_mtp_get_object_prop_desc(s, c); 1458 if (data_in == NULL) { 1459 usb_mtp_queue_result(s, RES_INVALID_OBJECT_PROP_CODE, 1460 c->trans, 0, 0, 0, 0); 1461 return; 1462 } 1463 break; 1464 case CMD_GET_OBJECT_PROP_VALUE: 1465 o = usb_mtp_object_lookup(s, c->argv[0]); 1466 if (o == NULL) { 1467 usb_mtp_queue_result(s, RES_INVALID_OBJECT_HANDLE, 1468 c->trans, 0, 0, 0, 0); 1469 return; 1470 } 1471 data_in = usb_mtp_get_object_prop_value(s, c, o); 1472 if (data_in == NULL) { 1473 usb_mtp_queue_result(s, RES_INVALID_OBJECT_PROP_CODE, 1474 c->trans, 0, 0, 0, 0); 1475 return; 1476 } 1477 break; 1478 default: 1479 trace_usb_mtp_op_unknown(s->dev.addr, c->code); 1480 usb_mtp_queue_result(s, RES_OPERATION_NOT_SUPPORTED, 1481 c->trans, 0, 0, 0, 0); 1482 return; 1483 } 1484 1485 /* return results on success */ 1486 if (data_in) { 1487 assert(s->data_in == NULL); 1488 s->data_in = data_in; 1489 } 1490 usb_mtp_queue_result(s, RES_OK, c->trans, nres, res0, 0, 0); 1491 } 1492 1493 /* ----------------------------------------------------------------------- */ 1494 1495 static void usb_mtp_handle_reset(USBDevice *dev) 1496 { 1497 MTPState *s = USB_MTP(dev); 1498 1499 trace_usb_mtp_reset(s->dev.addr); 1500 1501 usb_mtp_file_monitor_cleanup(s); 1502 usb_mtp_object_free(s, QTAILQ_FIRST(&s->objects)); 1503 s->session = 0; 1504 usb_mtp_data_free(s->data_in); 1505 s->data_in = NULL; 1506 usb_mtp_data_free(s->data_out); 1507 s->data_out = NULL; 1508 g_free(s->result); 1509 s->result = NULL; 1510 } 1511 1512 static void usb_mtp_handle_control(USBDevice *dev, USBPacket *p, 1513 int request, int value, int index, 1514 int length, uint8_t *data) 1515 { 1516 int ret; 1517 MTPState *s = USB_MTP(dev); 1518 uint16_t *event = (uint16_t *)data; 1519 1520 switch (request) { 1521 case ClassInterfaceOutRequest | 0x64: 1522 if (*event == EVT_CANCEL_TRANSACTION) { 1523 g_free(s->result); 1524 s->result = NULL; 1525 usb_mtp_data_free(s->data_in); 1526 s->data_in = NULL; 1527 if (s->write_pending) { 1528 g_free(s->dataset.filename); 1529 s->write_pending = false; 1530 s->dataset.size = 0; 1531 } 1532 usb_mtp_data_free(s->data_out); 1533 s->data_out = NULL; 1534 } else { 1535 p->status = USB_RET_STALL; 1536 } 1537 break; 1538 default: 1539 ret = usb_desc_handle_control(dev, p, request, 1540 value, index, length, data); 1541 if (ret >= 0) { 1542 return; 1543 } 1544 } 1545 1546 trace_usb_mtp_stall(dev->addr, "unknown control request"); 1547 } 1548 1549 static void usb_mtp_cancel_packet(USBDevice *dev, USBPacket *p) 1550 { 1551 /* we don't use async packets, so this should never be called */ 1552 fprintf(stderr, "%s\n", __func__); 1553 } 1554 1555 static char *utf16_to_str(uint8_t len, uint8_t *str16) 1556 { 1557 wchar_t *wstr = g_new0(wchar_t, len + 1); 1558 int count, dlen; 1559 char *dest; 1560 1561 for (count = 0; count < len; count++) { 1562 /* FIXME: not working for surrogate pairs */ 1563 wstr[count] = lduw_le_p(str16 + (count * 2)); 1564 } 1565 wstr[count] = 0; 1566 1567 dlen = wcstombs(NULL, wstr, 0) + 1; 1568 dest = g_malloc(dlen); 1569 wcstombs(dest, wstr, dlen); 1570 g_free(wstr); 1571 return dest; 1572 } 1573 1574 /* Wrapper around write, returns 0 on failure */ 1575 static uint64_t write_retry(int fd, void *buf, uint64_t size, off_t offset) 1576 { 1577 uint64_t ret = 0; 1578 1579 if (lseek(fd, offset, SEEK_SET) < 0) { 1580 goto done; 1581 } 1582 1583 ret = qemu_write_full(fd, buf, size); 1584 1585 done: 1586 return ret; 1587 } 1588 1589 static int usb_mtp_update_object(MTPObject *parent, char *name) 1590 { 1591 int ret = 0; 1592 1593 MTPObject *o = 1594 usb_mtp_object_lookup_name(parent, name, strlen(name)); 1595 1596 if (o) { 1597 ret = lstat(o->path, &o->stat); 1598 } 1599 1600 return ret; 1601 } 1602 1603 static void usb_mtp_write_data(MTPState *s, uint32_t handle) 1604 { 1605 MTPData *d = s->data_out; 1606 MTPObject *parent = 1607 usb_mtp_object_lookup(s, s->dataset.parent_handle); 1608 char *path = NULL; 1609 uint64_t rc; 1610 mode_t mask = 0755; 1611 int ret = 0; 1612 1613 assert(d != NULL); 1614 1615 switch (d->write_status) { 1616 case WRITE_START: 1617 if (!parent || !s->write_pending) { 1618 usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, d->trans, 1619 0, 0, 0, 0); 1620 return; 1621 } 1622 1623 if (s->dataset.filename) { 1624 path = g_strdup_printf("%s/%s", parent->path, s->dataset.filename); 1625 if (s->dataset.format == FMT_ASSOCIATION) { 1626 ret = mkdir(path, mask); 1627 if (!ret) { 1628 usb_mtp_queue_result(s, RES_OK, d->trans, 3, 1629 QEMU_STORAGE_ID, 1630 s->dataset.parent_handle, 1631 handle); 1632 goto close; 1633 } 1634 goto done; 1635 } 1636 1637 d->fd = open(path, O_CREAT | O_WRONLY | 1638 O_CLOEXEC | O_NOFOLLOW, mask & 0666); 1639 if (d->fd == -1) { 1640 ret = 1; 1641 goto done; 1642 } 1643 1644 /* Return success if initiator sent 0 sized data */ 1645 if (!s->dataset.size) { 1646 goto done; 1647 } 1648 if (d->length != MTP_WRITE_BUF_SZ && !d->pending) { 1649 d->write_status = WRITE_END; 1650 } 1651 } 1652 /* fall through */ 1653 case WRITE_CONTINUE: 1654 case WRITE_END: 1655 rc = write_retry(d->fd, d->data, d->data_offset, 1656 d->offset - d->data_offset); 1657 if (rc != d->data_offset) { 1658 ret = 1; 1659 goto done; 1660 } 1661 if (d->write_status != WRITE_END) { 1662 g_free(path); 1663 return; 1664 } else { 1665 /* 1666 * Return an incomplete transfer if file size doesn't match 1667 * for < 4G file or if lstat fails which will result in an incorrect 1668 * file size 1669 */ 1670 if ((s->dataset.size != 0xFFFFFFFF && 1671 d->offset != s->dataset.size) || 1672 usb_mtp_update_object(parent, s->dataset.filename)) { 1673 usb_mtp_queue_result(s, RES_INCOMPLETE_TRANSFER, d->trans, 1674 0, 0, 0, 0); 1675 goto close; 1676 } 1677 } 1678 } 1679 1680 done: 1681 if (ret) { 1682 usb_mtp_queue_result(s, RES_STORE_FULL, d->trans, 1683 0, 0, 0, 0); 1684 } else { 1685 usb_mtp_queue_result(s, RES_OK, d->trans, 1686 0, 0, 0, 0); 1687 } 1688 close: 1689 /* 1690 * The write dataset is kept around and freed only 1691 * on success or if another write request comes in 1692 */ 1693 if (d->fd != -1) { 1694 close(d->fd); 1695 d->fd = -1; 1696 } 1697 g_free(s->dataset.filename); 1698 s->dataset.size = 0; 1699 g_free(path); 1700 s->write_pending = false; 1701 } 1702 1703 static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) 1704 { 1705 MTPData *d = s->data_out; 1706 ObjectInfo *dataset = (ObjectInfo *)d->data; 1707 char *filename; 1708 MTPObject *o; 1709 MTPObject *p = usb_mtp_object_lookup(s, s->dataset.parent_handle); 1710 uint32_t next_handle = s->next_handle; 1711 size_t filename_chars = dlen - offsetof(ObjectInfo, filename); 1712 1713 /* 1714 * filename is utf-16. We're intentionally doing 1715 * integer division to truncate if malicious guest 1716 * sent an odd number of bytes. 1717 */ 1718 filename_chars /= 2; 1719 1720 assert(!s->write_pending); 1721 assert(p != NULL); 1722 1723 filename = utf16_to_str(MIN(dataset->length, filename_chars), 1724 dataset->filename); 1725 1726 if (strchr(filename, '/')) { 1727 usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans, 1728 0, 0, 0, 0); 1729 g_free(filename); 1730 return; 1731 } 1732 1733 o = usb_mtp_object_lookup_name(p, filename, -1); 1734 if (o != NULL) { 1735 next_handle = o->handle; 1736 } 1737 1738 s->dataset.filename = filename; 1739 s->dataset.format = dataset->format; 1740 s->dataset.size = dataset->size; 1741 s->write_pending = true; 1742 1743 if (s->dataset.format == FMT_ASSOCIATION) { 1744 usb_mtp_write_data(s, next_handle); 1745 } else { 1746 usb_mtp_queue_result(s, RES_OK, d->trans, 3, QEMU_STORAGE_ID, 1747 s->dataset.parent_handle, next_handle); 1748 } 1749 } 1750 1751 static void usb_mtp_get_data(MTPState *s, mtp_container *container, 1752 USBPacket *p) 1753 { 1754 MTPData *d = s->data_out; 1755 uint64_t dlen; 1756 uint32_t data_len = p->iov.size; 1757 uint64_t total_len; 1758 1759 if (!d) { 1760 usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, 0, 1761 0, 0, 0, 0); 1762 return; 1763 } 1764 if (d->first) { 1765 /* Total length of incoming data */ 1766 total_len = cpu_to_le32(container->length) - sizeof(mtp_container); 1767 /* Length of data in this packet */ 1768 data_len -= sizeof(mtp_container); 1769 if (total_len < MTP_WRITE_BUF_SZ) { 1770 usb_mtp_realloc(d, total_len); 1771 d->length += total_len; 1772 } else { 1773 usb_mtp_realloc(d, MTP_WRITE_BUF_SZ - sizeof(mtp_container)); 1774 d->length += MTP_WRITE_BUF_SZ - sizeof(mtp_container); 1775 } 1776 d->offset = 0; 1777 d->first = false; 1778 d->pending = false; 1779 d->data_offset = 0; 1780 d->write_status = WRITE_START; 1781 } 1782 1783 if (d->pending) { 1784 memset(d->data, 0, d->length); 1785 if (d->length != MTP_WRITE_BUF_SZ) { 1786 usb_mtp_realloc(d, MTP_WRITE_BUF_SZ - d->length); 1787 d->length += (MTP_WRITE_BUF_SZ - d->length); 1788 } 1789 d->pending = false; 1790 d->write_status = WRITE_CONTINUE; 1791 d->data_offset = 0; 1792 } 1793 1794 if (d->length - d->data_offset > data_len) { 1795 dlen = data_len; 1796 } else { 1797 dlen = d->length - d->data_offset; 1798 } 1799 1800 switch (d->code) { 1801 case CMD_SEND_OBJECT_INFO: 1802 usb_packet_copy(p, d->data + d->data_offset, dlen); 1803 d->offset += dlen; 1804 d->data_offset += dlen; 1805 if (d->data_offset == d->length) { 1806 /* The operation might have already failed */ 1807 if (!s->result) { 1808 usb_mtp_write_metadata(s, dlen); 1809 } 1810 usb_mtp_data_free(s->data_out); 1811 s->data_out = NULL; 1812 return; 1813 } 1814 break; 1815 case CMD_SEND_OBJECT: 1816 usb_packet_copy(p, d->data + d->data_offset, dlen); 1817 d->offset += dlen; 1818 d->data_offset += dlen; 1819 if ((p->iov.size % 64) || !p->iov.size) { 1820 assert((s->dataset.size == 0xFFFFFFFF) || 1821 (s->dataset.size == d->offset)); 1822 1823 if (d->length == MTP_WRITE_BUF_SZ) { 1824 d->write_status = WRITE_END; 1825 } else { 1826 d->write_status = WRITE_START; 1827 } 1828 usb_mtp_write_data(s, 0); 1829 usb_mtp_data_free(s->data_out); 1830 s->data_out = NULL; 1831 return; 1832 } 1833 if (d->data_offset == d->length) { 1834 d->pending = true; 1835 usb_mtp_write_data(s, 0); 1836 } 1837 break; 1838 default: 1839 p->status = USB_RET_STALL; 1840 return; 1841 } 1842 } 1843 1844 static void usb_mtp_handle_data(USBDevice *dev, USBPacket *p) 1845 { 1846 MTPState *s = USB_MTP(dev); 1847 MTPControl cmd; 1848 mtp_container container; 1849 uint32_t params[5]; 1850 uint16_t container_type; 1851 int i, rc; 1852 1853 switch (p->ep->nr) { 1854 case EP_DATA_IN: 1855 if (s->data_out != NULL) { 1856 /* guest bug */ 1857 trace_usb_mtp_stall(s->dev.addr, "awaiting data-out"); 1858 p->status = USB_RET_STALL; 1859 return; 1860 } 1861 if (p->iov.size < sizeof(container)) { 1862 trace_usb_mtp_stall(s->dev.addr, "packet too small"); 1863 p->status = USB_RET_STALL; 1864 return; 1865 } 1866 if (s->data_in != NULL) { 1867 MTPData *d = s->data_in; 1868 uint64_t dlen = d->length - d->offset; 1869 if (d->first) { 1870 trace_usb_mtp_data_in(s->dev.addr, d->trans, d->length); 1871 if (d->length + sizeof(container) > 0xFFFFFFFF) { 1872 container.length = cpu_to_le32(0xFFFFFFFF); 1873 } else { 1874 container.length = 1875 cpu_to_le32(d->length + sizeof(container)); 1876 } 1877 container.type = cpu_to_le16(TYPE_DATA); 1878 container.code = cpu_to_le16(d->code); 1879 container.trans = cpu_to_le32(d->trans); 1880 usb_packet_copy(p, &container, sizeof(container)); 1881 d->first = false; 1882 if (dlen > p->iov.size - sizeof(container)) { 1883 dlen = p->iov.size - sizeof(container); 1884 } 1885 } else { 1886 if (dlen > p->iov.size) { 1887 dlen = p->iov.size; 1888 } 1889 } 1890 if (d->fd == -1) { 1891 usb_packet_copy(p, d->data + d->offset, dlen); 1892 } else { 1893 if (d->alloc < p->iov.size) { 1894 d->alloc = p->iov.size; 1895 d->data = g_realloc(d->data, d->alloc); 1896 } 1897 rc = read(d->fd, d->data, dlen); 1898 if (rc != dlen) { 1899 memset(d->data, 0, dlen); 1900 s->result->code = RES_INCOMPLETE_TRANSFER; 1901 } 1902 usb_packet_copy(p, d->data, dlen); 1903 } 1904 d->offset += dlen; 1905 if (d->offset == d->length) { 1906 usb_mtp_data_free(s->data_in); 1907 s->data_in = NULL; 1908 } 1909 } else if (s->result != NULL) { 1910 MTPControl *r = s->result; 1911 int length = sizeof(container) + r->argc * sizeof(uint32_t); 1912 if (r->code == RES_OK) { 1913 trace_usb_mtp_success(s->dev.addr, r->trans, 1914 (r->argc > 0) ? r->argv[0] : 0, 1915 (r->argc > 1) ? r->argv[1] : 0); 1916 } else { 1917 trace_usb_mtp_error(s->dev.addr, r->code, r->trans, 1918 (r->argc > 0) ? r->argv[0] : 0, 1919 (r->argc > 1) ? r->argv[1] : 0); 1920 } 1921 container.length = cpu_to_le32(length); 1922 container.type = cpu_to_le16(TYPE_RESPONSE); 1923 container.code = cpu_to_le16(r->code); 1924 container.trans = cpu_to_le32(r->trans); 1925 for (i = 0; i < r->argc; i++) { 1926 params[i] = cpu_to_le32(r->argv[i]); 1927 } 1928 usb_packet_copy(p, &container, sizeof(container)); 1929 usb_packet_copy(p, ¶ms, length - sizeof(container)); 1930 g_free(s->result); 1931 s->result = NULL; 1932 } 1933 break; 1934 case EP_DATA_OUT: 1935 if (p->iov.size < sizeof(container)) { 1936 trace_usb_mtp_stall(s->dev.addr, "packet too small"); 1937 p->status = USB_RET_STALL; 1938 return; 1939 } 1940 if ((s->data_out != NULL) && !s->data_out->first) { 1941 container_type = TYPE_DATA; 1942 } else { 1943 usb_packet_copy(p, &container, sizeof(container)); 1944 container_type = le16_to_cpu(container.type); 1945 } 1946 switch (container_type) { 1947 case TYPE_COMMAND: 1948 if (s->data_in || s->data_out || s->result) { 1949 trace_usb_mtp_stall(s->dev.addr, "transaction inflight"); 1950 p->status = USB_RET_STALL; 1951 return; 1952 } 1953 cmd.code = le16_to_cpu(container.code); 1954 cmd.argc = (le32_to_cpu(container.length) - sizeof(container)) 1955 / sizeof(uint32_t); 1956 cmd.trans = le32_to_cpu(container.trans); 1957 if (cmd.argc > ARRAY_SIZE(cmd.argv)) { 1958 cmd.argc = ARRAY_SIZE(cmd.argv); 1959 } 1960 if (p->iov.size < sizeof(container) + cmd.argc * sizeof(uint32_t)) { 1961 trace_usb_mtp_stall(s->dev.addr, "packet too small"); 1962 p->status = USB_RET_STALL; 1963 return; 1964 } 1965 usb_packet_copy(p, ¶ms, cmd.argc * sizeof(uint32_t)); 1966 for (i = 0; i < cmd.argc; i++) { 1967 cmd.argv[i] = le32_to_cpu(params[i]); 1968 } 1969 trace_usb_mtp_command(s->dev.addr, cmd.code, cmd.trans, 1970 (cmd.argc > 0) ? cmd.argv[0] : 0, 1971 (cmd.argc > 1) ? cmd.argv[1] : 0, 1972 (cmd.argc > 2) ? cmd.argv[2] : 0, 1973 (cmd.argc > 3) ? cmd.argv[3] : 0, 1974 (cmd.argc > 4) ? cmd.argv[4] : 0); 1975 usb_mtp_command(s, &cmd); 1976 break; 1977 case TYPE_DATA: 1978 /* One of the previous transfers has already errored but the 1979 * responder is still sending data associated with it 1980 */ 1981 if (s->result != NULL) { 1982 return; 1983 } 1984 usb_mtp_get_data(s, &container, p); 1985 break; 1986 default: 1987 /* not needed as long as the mtp device is read-only */ 1988 p->status = USB_RET_STALL; 1989 return; 1990 } 1991 break; 1992 case EP_EVENT: 1993 if (!QTAILQ_EMPTY(&s->events)) { 1994 struct MTPMonEntry *e = QTAILQ_LAST(&s->events); 1995 uint32_t handle; 1996 int len = sizeof(container) + sizeof(uint32_t); 1997 1998 if (p->iov.size < len) { 1999 trace_usb_mtp_stall(s->dev.addr, 2000 "packet too small to send event"); 2001 p->status = USB_RET_STALL; 2002 return; 2003 } 2004 2005 QTAILQ_REMOVE(&s->events, e, next); 2006 container.length = cpu_to_le32(len); 2007 container.type = cpu_to_le32(TYPE_EVENT); 2008 container.code = cpu_to_le16(e->event); 2009 container.trans = 0; /* no trans specific events */ 2010 handle = cpu_to_le32(e->handle); 2011 usb_packet_copy(p, &container, sizeof(container)); 2012 usb_packet_copy(p, &handle, sizeof(uint32_t)); 2013 g_free(e); 2014 return; 2015 } 2016 p->status = USB_RET_NAK; 2017 return; 2018 default: 2019 trace_usb_mtp_stall(s->dev.addr, "invalid endpoint"); 2020 p->status = USB_RET_STALL; 2021 return; 2022 } 2023 2024 if (p->actual_length == 0) { 2025 trace_usb_mtp_nak(s->dev.addr, p->ep->nr); 2026 p->status = USB_RET_NAK; 2027 return; 2028 } else { 2029 trace_usb_mtp_xfer(s->dev.addr, p->ep->nr, p->actual_length, 2030 p->iov.size); 2031 return; 2032 } 2033 } 2034 2035 static void usb_mtp_realize(USBDevice *dev, Error **errp) 2036 { 2037 MTPState *s = USB_MTP(dev); 2038 2039 if ((s->root == NULL) || !g_path_is_absolute(s->root)) { 2040 error_setg(errp, "usb-mtp: rootdir must be configured and be an absolute path"); 2041 return; 2042 } 2043 2044 if (access(s->root, R_OK) != 0) { 2045 error_setg(errp, "usb-mtp: rootdir does not exist/not readable"); 2046 return; 2047 } else if (!s->readonly && access(s->root, W_OK) != 0) { 2048 error_setg(errp, "usb-mtp: rootdir does not have write permissions"); 2049 return; 2050 } 2051 2052 /* Mark store as RW */ 2053 if (!s->readonly) { 2054 s->flags |= (1 << MTP_FLAG_WRITABLE); 2055 } 2056 2057 if (s->desc == NULL) { 2058 /* 2059 * This does not check if path exists 2060 * but we have the checks above 2061 */ 2062 s->desc = g_path_get_basename(s->root); 2063 } 2064 2065 usb_desc_create_serial(dev); 2066 usb_desc_init(dev); 2067 QTAILQ_INIT(&s->objects); 2068 2069 } 2070 2071 static const VMStateDescription vmstate_usb_mtp = { 2072 .name = "usb-mtp", 2073 .unmigratable = 1, 2074 .version_id = 1, 2075 .minimum_version_id = 1, 2076 .fields = (VMStateField[]) { 2077 VMSTATE_USB_DEVICE(dev, MTPState), 2078 VMSTATE_END_OF_LIST() 2079 } 2080 }; 2081 2082 static Property mtp_properties[] = { 2083 DEFINE_PROP_STRING("rootdir", MTPState, root), 2084 DEFINE_PROP_STRING("desc", MTPState, desc), 2085 DEFINE_PROP_BOOL("readonly", MTPState, readonly, true), 2086 DEFINE_PROP_END_OF_LIST(), 2087 }; 2088 2089 static void usb_mtp_class_initfn(ObjectClass *klass, void *data) 2090 { 2091 DeviceClass *dc = DEVICE_CLASS(klass); 2092 USBDeviceClass *uc = USB_DEVICE_CLASS(klass); 2093 2094 uc->realize = usb_mtp_realize; 2095 uc->product_desc = "QEMU USB MTP"; 2096 uc->usb_desc = &desc; 2097 uc->cancel_packet = usb_mtp_cancel_packet; 2098 uc->handle_attach = usb_desc_attach; 2099 uc->handle_reset = usb_mtp_handle_reset; 2100 uc->handle_control = usb_mtp_handle_control; 2101 uc->handle_data = usb_mtp_handle_data; 2102 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 2103 dc->desc = "USB Media Transfer Protocol device"; 2104 dc->fw_name = "mtp"; 2105 dc->vmsd = &vmstate_usb_mtp; 2106 device_class_set_props(dc, mtp_properties); 2107 } 2108 2109 static const TypeInfo mtp_info = { 2110 .name = TYPE_USB_MTP, 2111 .parent = TYPE_USB_DEVICE, 2112 .instance_size = sizeof(MTPState), 2113 .class_init = usb_mtp_class_initfn, 2114 }; 2115 2116 static void usb_mtp_register_types(void) 2117 { 2118 type_register_static(&mtp_info); 2119 } 2120 2121 type_init(usb_mtp_register_types) 2122