1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37#include "qemu/osdep.h"
38#include "qapi/error.h"
39#include "qemu-common.h"
40#include "qemu/error-report.h"
41#include "hw/usb.h"
42#include "hw/usb/desc.h"
43
44#include "ccid.h"
45
46#define DPRINTF(s, lvl, fmt, ...) \
47do { \
48 if (lvl <= s->debug) { \
49 printf("usb-ccid: " fmt , ## __VA_ARGS__); \
50 } \
51} while (0)
52
53#define D_WARN 1
54#define D_INFO 2
55#define D_MORE_INFO 3
56#define D_VERBOSE 4
57
58#define CCID_DEV_NAME "usb-ccid"
59#define USB_CCID_DEV(obj) OBJECT_CHECK(USBCCIDState, (obj), CCID_DEV_NAME)
60
61
62
63
64
65
66#define BULK_OUT_DATA_SIZE 65536
67#define PENDING_ANSWERS_NUM 128
68
69#define BULK_IN_BUF_SIZE 384
70#define BULK_IN_PENDING_NUM 8
71
72#define CCID_MAX_PACKET_SIZE 64
73
74#define CCID_CONTROL_ABORT 0x1
75#define CCID_CONTROL_GET_CLOCK_FREQUENCIES 0x2
76#define CCID_CONTROL_GET_DATA_RATES 0x3
77
78#define CCID_PRODUCT_DESCRIPTION "QEMU USB CCID"
79#define CCID_VENDOR_DESCRIPTION "QEMU"
80#define CCID_INTERFACE_NAME "CCID Interface"
81#define CCID_SERIAL_NUMBER_STRING "1"
82
83
84
85
86
87
88
89#define CCID_VENDOR_ID 0x08e6
90#define CCID_PRODUCT_ID 0x4433
91#define CCID_DEVICE_VERSION 0x0000
92
93
94
95
96
97#define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn 0x62
98#define CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff 0x63
99#define CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus 0x65
100#define CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock 0x6f
101#define CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters 0x6c
102#define CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters 0x6d
103#define CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters 0x61
104#define CCID_MESSAGE_TYPE_PC_to_RDR_Escape 0x6b
105#define CCID_MESSAGE_TYPE_PC_to_RDR_IccClock 0x6e
106#define CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU 0x6a
107#define CCID_MESSAGE_TYPE_PC_to_RDR_Secure 0x69
108#define CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical 0x71
109#define CCID_MESSAGE_TYPE_PC_to_RDR_Abort 0x72
110#define CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency 0x73
111
112
113
114
115
116#define CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock 0x80
117#define CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus 0x81
118#define CCID_MESSAGE_TYPE_RDR_to_PC_Parameters 0x82
119#define CCID_MESSAGE_TYPE_RDR_to_PC_Escape 0x83
120#define CCID_MESSAGE_TYPE_RDR_to_PC_DataRateAndClockFrequency 0x84
121
122
123
124
125
126#define CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange 0x50
127#define CCID_MESSAGE_TYPE_RDR_to_PC_HardwareError 0x51
128
129
130
131
132
133
134
135#define CCID_INT_IN_EP 1
136#define CCID_BULK_IN_EP 2
137#define CCID_BULK_OUT_EP 3
138
139
140#define SLOT_0_STATE_MASK 1
141#define SLOT_0_CHANGED_MASK 2
142
143
144enum {
145 ICC_STATUS_PRESENT_ACTIVE = 0,
146 ICC_STATUS_PRESENT_INACTIVE,
147 ICC_STATUS_NOT_PRESENT
148};
149
150enum {
151 COMMAND_STATUS_NO_ERROR = 0,
152 COMMAND_STATUS_FAILED,
153 COMMAND_STATUS_TIME_EXTENSION_REQUIRED
154};
155
156
157enum {
158 ERROR_CMD_NOT_SUPPORTED = 0,
159 ERROR_CMD_ABORTED = -1,
160 ERROR_ICC_MUTE = -2,
161 ERROR_XFR_PARITY_ERROR = -3,
162 ERROR_XFR_OVERRUN = -4,
163 ERROR_HW_ERROR = -5,
164};
165
166
167enum {
168 CLOCK_STATUS_RUNNING = 0,
169
170
171
172
173};
174
175typedef struct QEMU_PACKED CCID_Header {
176 uint8_t bMessageType;
177 uint32_t dwLength;
178 uint8_t bSlot;
179 uint8_t bSeq;
180} CCID_Header;
181
182typedef struct QEMU_PACKED CCID_BULK_IN {
183 CCID_Header hdr;
184 uint8_t bStatus;
185 uint8_t bError;
186} CCID_BULK_IN;
187
188typedef struct QEMU_PACKED CCID_SlotStatus {
189 CCID_BULK_IN b;
190 uint8_t bClockStatus;
191} CCID_SlotStatus;
192
193typedef struct QEMU_PACKED CCID_T0ProtocolDataStructure {
194 uint8_t bmFindexDindex;
195 uint8_t bmTCCKST0;
196 uint8_t bGuardTimeT0;
197 uint8_t bWaitingIntegerT0;
198 uint8_t bClockStop;
199} CCID_T0ProtocolDataStructure;
200
201typedef struct QEMU_PACKED CCID_T1ProtocolDataStructure {
202 uint8_t bmFindexDindex;
203 uint8_t bmTCCKST1;
204 uint8_t bGuardTimeT1;
205 uint8_t bWaitingIntegerT1;
206 uint8_t bClockStop;
207 uint8_t bIFSC;
208 uint8_t bNadValue;
209} CCID_T1ProtocolDataStructure;
210
211typedef union CCID_ProtocolDataStructure {
212 CCID_T0ProtocolDataStructure t0;
213 CCID_T1ProtocolDataStructure t1;
214 uint8_t data[7];
215} CCID_ProtocolDataStructure;
216
217typedef struct QEMU_PACKED CCID_Parameter {
218 CCID_BULK_IN b;
219 uint8_t bProtocolNum;
220 CCID_ProtocolDataStructure abProtocolDataStructure;
221} CCID_Parameter;
222
223typedef struct QEMU_PACKED CCID_DataBlock {
224 CCID_BULK_IN b;
225 uint8_t bChainParameter;
226 uint8_t abData[0];
227} CCID_DataBlock;
228
229
230typedef struct QEMU_PACKED CCID_XferBlock {
231 CCID_Header hdr;
232 uint8_t bBWI;
233 uint16_t wLevelParameter;
234 uint8_t abData[0];
235} CCID_XferBlock;
236
237typedef struct QEMU_PACKED CCID_IccPowerOn {
238 CCID_Header hdr;
239 uint8_t bPowerSelect;
240 uint16_t abRFU;
241} CCID_IccPowerOn;
242
243typedef struct QEMU_PACKED CCID_IccPowerOff {
244 CCID_Header hdr;
245 uint16_t abRFU;
246} CCID_IccPowerOff;
247
248typedef struct QEMU_PACKED CCID_SetParameters {
249 CCID_Header hdr;
250 uint8_t bProtocolNum;
251 uint16_t abRFU;
252 CCID_ProtocolDataStructure abProtocolDataStructure;
253} CCID_SetParameters;
254
255typedef struct CCID_Notify_Slot_Change {
256 uint8_t bMessageType;
257 uint8_t bmSlotICCState;
258} CCID_Notify_Slot_Change;
259
260
261typedef struct Answer {
262 uint8_t slot;
263 uint8_t seq;
264} Answer;
265
266
267typedef struct BulkIn {
268 uint8_t data[BULK_IN_BUF_SIZE];
269 uint32_t len;
270 uint32_t pos;
271} BulkIn;
272
273typedef struct CCIDBus {
274 BusState qbus;
275} CCIDBus;
276
277
278
279
280typedef struct USBCCIDState {
281 USBDevice dev;
282 USBEndpoint *intr;
283 USBEndpoint *bulk;
284 CCIDBus bus;
285 CCIDCardState *card;
286 BulkIn bulk_in_pending[BULK_IN_PENDING_NUM];
287 uint32_t bulk_in_pending_start;
288 uint32_t bulk_in_pending_end;
289 uint32_t bulk_in_pending_num;
290 BulkIn *current_bulk_in;
291 uint8_t bulk_out_data[BULK_OUT_DATA_SIZE];
292 uint32_t bulk_out_pos;
293 uint64_t last_answer_error;
294 Answer pending_answers[PENDING_ANSWERS_NUM];
295 uint32_t pending_answers_start;
296 uint32_t pending_answers_end;
297 uint32_t pending_answers_num;
298 uint8_t bError;
299 uint8_t bmCommandStatus;
300 uint8_t bProtocolNum;
301 CCID_ProtocolDataStructure abProtocolDataStructure;
302 uint32_t ulProtocolDataStructureSize;
303 uint32_t state_vmstate;
304 uint8_t bmSlotICCState;
305 uint8_t powered;
306 uint8_t notify_slot_change;
307 uint8_t debug;
308} USBCCIDState;
309
310
311
312
313
314
315
316
317
318
319
320static const uint8_t qemu_ccid_descriptor[] = {
321
322 0x36,
323 0x21,
324 0x10, 0x01,
325 0x00,
326
327
328
329
330 0x07,
331
332 0x00, 0x00,
333 0x01, 0x00,
334
335 0xa0, 0x0f, 0x00, 0x00,
336
337 0x00, 0x00, 0x01, 0x00,
338 0x00,
339
340
341 0x80, 0x25, 0x00, 0x00,
342
343 0x00, 0xC2, 0x01, 0x00,
344 0x00,
345
346
347
348
349 0xfe, 0x00, 0x00, 0x00,
350
351 0x00, 0x00, 0x00, 0x00,
352
353 0x00, 0x00, 0x00, 0x00,
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376 0xfe, 0x04, 0x01, 0x00,
377
378
379
380
381
382 0x12, 0x00, 0x01, 0x00,
383 0xFF,
384
385
386
387
388
389
390
391 0xFF,
392
393
394
395 0x00, 0x00,
396
397
398
399 0x01,
400
401
402
403 0x01,
404};
405
406enum {
407 STR_MANUFACTURER = 1,
408 STR_PRODUCT,
409 STR_SERIALNUMBER,
410 STR_INTERFACE,
411};
412
413static const USBDescStrings desc_strings = {
414 [STR_MANUFACTURER] = "QEMU",
415 [STR_PRODUCT] = "QEMU USB CCID",
416 [STR_SERIALNUMBER] = "1",
417 [STR_INTERFACE] = "CCID Interface",
418};
419
420static const USBDescIface desc_iface0 = {
421 .bInterfaceNumber = 0,
422 .bNumEndpoints = 3,
423 .bInterfaceClass = USB_CLASS_CSCID,
424 .bInterfaceSubClass = USB_SUBCLASS_UNDEFINED,
425 .bInterfaceProtocol = 0x00,
426 .iInterface = STR_INTERFACE,
427 .ndesc = 1,
428 .descs = (USBDescOther[]) {
429 {
430
431 .data = qemu_ccid_descriptor,
432 },
433 },
434 .eps = (USBDescEndpoint[]) {
435 {
436 .bEndpointAddress = USB_DIR_IN | CCID_INT_IN_EP,
437 .bmAttributes = USB_ENDPOINT_XFER_INT,
438 .bInterval = 255,
439 .wMaxPacketSize = 64,
440 },{
441 .bEndpointAddress = USB_DIR_IN | CCID_BULK_IN_EP,
442 .bmAttributes = USB_ENDPOINT_XFER_BULK,
443 .wMaxPacketSize = 64,
444 },{
445 .bEndpointAddress = USB_DIR_OUT | CCID_BULK_OUT_EP,
446 .bmAttributes = USB_ENDPOINT_XFER_BULK,
447 .wMaxPacketSize = 64,
448 },
449 }
450};
451
452static const USBDescDevice desc_device = {
453 .bcdUSB = 0x0110,
454 .bMaxPacketSize0 = 64,
455 .bNumConfigurations = 1,
456 .confs = (USBDescConfig[]) {
457 {
458 .bNumInterfaces = 1,
459 .bConfigurationValue = 1,
460 .bmAttributes = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER |
461 USB_CFG_ATT_WAKEUP,
462 .bMaxPower = 50,
463 .nif = 1,
464 .ifs = &desc_iface0,
465 },
466 },
467};
468
469static const USBDesc desc_ccid = {
470 .id = {
471 .idVendor = CCID_VENDOR_ID,
472 .idProduct = CCID_PRODUCT_ID,
473 .bcdDevice = CCID_DEVICE_VERSION,
474 .iManufacturer = STR_MANUFACTURER,
475 .iProduct = STR_PRODUCT,
476 .iSerialNumber = STR_SERIALNUMBER,
477 },
478 .full = &desc_device,
479 .str = desc_strings,
480};
481
482static const uint8_t *ccid_card_get_atr(CCIDCardState *card, uint32_t *len)
483{
484 CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
485
486 if (cc->get_atr) {
487 return cc->get_atr(card, len);
488 }
489 return NULL;
490}
491
492static void ccid_card_apdu_from_guest(CCIDCardState *card,
493 const uint8_t *apdu,
494 uint32_t len)
495{
496 CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
497
498 if (cc->apdu_from_guest) {
499 cc->apdu_from_guest(card, apdu, len);
500 }
501}
502
503static bool ccid_has_pending_answers(USBCCIDState *s)
504{
505 return s->pending_answers_num > 0;
506}
507
508static void ccid_clear_pending_answers(USBCCIDState *s)
509{
510 s->pending_answers_num = 0;
511 s->pending_answers_start = 0;
512 s->pending_answers_end = 0;
513}
514
515static void ccid_print_pending_answers(USBCCIDState *s)
516{
517 Answer *answer;
518 int i, count;
519
520 DPRINTF(s, D_VERBOSE, "usb-ccid: pending answers:");
521 if (!ccid_has_pending_answers(s)) {
522 DPRINTF(s, D_VERBOSE, " empty\n");
523 return;
524 }
525 for (i = s->pending_answers_start, count = s->pending_answers_num ;
526 count > 0; count--, i++) {
527 answer = &s->pending_answers[i % PENDING_ANSWERS_NUM];
528 if (count == 1) {
529 DPRINTF(s, D_VERBOSE, "%d:%d\n", answer->slot, answer->seq);
530 } else {
531 DPRINTF(s, D_VERBOSE, "%d:%d,", answer->slot, answer->seq);
532 }
533 }
534}
535
536static void ccid_add_pending_answer(USBCCIDState *s, CCID_Header *hdr)
537{
538 Answer *answer;
539
540 assert(s->pending_answers_num < PENDING_ANSWERS_NUM);
541 s->pending_answers_num++;
542 answer =
543 &s->pending_answers[(s->pending_answers_end++) % PENDING_ANSWERS_NUM];
544 answer->slot = hdr->bSlot;
545 answer->seq = hdr->bSeq;
546 ccid_print_pending_answers(s);
547}
548
549static void ccid_remove_pending_answer(USBCCIDState *s,
550 uint8_t *slot, uint8_t *seq)
551{
552 Answer *answer;
553
554 assert(s->pending_answers_num > 0);
555 s->pending_answers_num--;
556 answer =
557 &s->pending_answers[(s->pending_answers_start++) % PENDING_ANSWERS_NUM];
558 *slot = answer->slot;
559 *seq = answer->seq;
560 ccid_print_pending_answers(s);
561}
562
563static void ccid_bulk_in_clear(USBCCIDState *s)
564{
565 s->bulk_in_pending_start = 0;
566 s->bulk_in_pending_end = 0;
567 s->bulk_in_pending_num = 0;
568}
569
570static void ccid_bulk_in_release(USBCCIDState *s)
571{
572 assert(s->current_bulk_in != NULL);
573 s->current_bulk_in->pos = 0;
574 s->current_bulk_in = NULL;
575}
576
577static void ccid_bulk_in_get(USBCCIDState *s)
578{
579 if (s->current_bulk_in != NULL || s->bulk_in_pending_num == 0) {
580 return;
581 }
582 assert(s->bulk_in_pending_num > 0);
583 s->bulk_in_pending_num--;
584 s->current_bulk_in =
585 &s->bulk_in_pending[(s->bulk_in_pending_start++) % BULK_IN_PENDING_NUM];
586}
587
588static void *ccid_reserve_recv_buf(USBCCIDState *s, uint16_t len)
589{
590 BulkIn *bulk_in;
591
592 DPRINTF(s, D_VERBOSE, "%s: QUEUE: reserve %d bytes\n", __func__, len);
593
594
595 if (len > BULK_IN_BUF_SIZE) {
596 DPRINTF(s, D_WARN, "usb-ccid.c: %s: len larger then max (%d>%d). "
597 "discarding message.\n",
598 __func__, len, BULK_IN_BUF_SIZE);
599 return NULL;
600 }
601 if (s->bulk_in_pending_num >= BULK_IN_PENDING_NUM) {
602 DPRINTF(s, D_WARN, "usb-ccid.c: %s: No free bulk_in buffers. "
603 "discarding message.\n", __func__);
604 return NULL;
605 }
606 bulk_in =
607 &s->bulk_in_pending[(s->bulk_in_pending_end++) % BULK_IN_PENDING_NUM];
608 s->bulk_in_pending_num++;
609 bulk_in->len = len;
610 return bulk_in->data;
611}
612
613static void ccid_reset(USBCCIDState *s)
614{
615 ccid_bulk_in_clear(s);
616 ccid_clear_pending_answers(s);
617}
618
619static void ccid_detach(USBCCIDState *s)
620{
621 ccid_reset(s);
622}
623
624static void ccid_handle_reset(USBDevice *dev)
625{
626 USBCCIDState *s = USB_CCID_DEV(dev);
627
628 DPRINTF(s, 1, "Reset\n");
629
630 ccid_reset(s);
631}
632
633static const char *ccid_control_to_str(USBCCIDState *s, int request)
634{
635 switch (request) {
636
637 case DeviceOutRequest | USB_REQ_SET_ADDRESS:
638 return "(generic) set address";
639 case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
640 return "(generic) get descriptor";
641 case DeviceRequest | USB_REQ_GET_CONFIGURATION:
642 return "(generic) get configuration";
643 case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
644 return "(generic) set configuration";
645 case DeviceRequest | USB_REQ_GET_STATUS:
646 return "(generic) get status";
647 case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
648 return "(generic) clear feature";
649 case DeviceOutRequest | USB_REQ_SET_FEATURE:
650 return "(generic) set_feature";
651 case InterfaceRequest | USB_REQ_GET_INTERFACE:
652 return "(generic) get interface";
653 case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
654 return "(generic) set interface";
655
656 case ClassInterfaceOutRequest | CCID_CONTROL_ABORT:
657 return "ABORT";
658 case ClassInterfaceRequest | CCID_CONTROL_GET_CLOCK_FREQUENCIES:
659 return "GET_CLOCK_FREQUENCIES";
660 case ClassInterfaceRequest | CCID_CONTROL_GET_DATA_RATES:
661 return "GET_DATA_RATES";
662 }
663 return "unknown";
664}
665
666static void ccid_handle_control(USBDevice *dev, USBPacket *p, int request,
667 int value, int index, int length, uint8_t *data)
668{
669 USBCCIDState *s = USB_CCID_DEV(dev);
670 int ret;
671
672 DPRINTF(s, 1, "%s: got control %s (%x), value %x\n", __func__,
673 ccid_control_to_str(s, request), request, value);
674 ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
675 if (ret >= 0) {
676 return;
677 }
678
679 switch (request) {
680
681 case ClassInterfaceOutRequest | CCID_CONTROL_ABORT:
682 DPRINTF(s, 1, "ccid_control abort UNIMPLEMENTED\n");
683 p->status = USB_RET_STALL;
684 break;
685 case ClassInterfaceRequest | CCID_CONTROL_GET_CLOCK_FREQUENCIES:
686 DPRINTF(s, 1, "ccid_control get clock frequencies UNIMPLEMENTED\n");
687 p->status = USB_RET_STALL;
688 break;
689 case ClassInterfaceRequest | CCID_CONTROL_GET_DATA_RATES:
690 DPRINTF(s, 1, "ccid_control get data rates UNIMPLEMENTED\n");
691 p->status = USB_RET_STALL;
692 break;
693 default:
694 DPRINTF(s, 1, "got unsupported/bogus control %x, value %x\n",
695 request, value);
696 p->status = USB_RET_STALL;
697 break;
698 }
699}
700
701static bool ccid_card_inserted(USBCCIDState *s)
702{
703 return s->bmSlotICCState & SLOT_0_STATE_MASK;
704}
705
706static uint8_t ccid_card_status(USBCCIDState *s)
707{
708 return ccid_card_inserted(s)
709 ? (s->powered ?
710 ICC_STATUS_PRESENT_ACTIVE
711 : ICC_STATUS_PRESENT_INACTIVE
712 )
713 : ICC_STATUS_NOT_PRESENT;
714}
715
716static uint8_t ccid_calc_status(USBCCIDState *s)
717{
718
719
720
721
722 uint8_t ret = ccid_card_status(s) | (s->bmCommandStatus << 6);
723 DPRINTF(s, D_VERBOSE, "%s: status = %d\n", __func__, ret);
724 return ret;
725}
726
727static void ccid_reset_error_status(USBCCIDState *s)
728{
729 s->bError = ERROR_CMD_NOT_SUPPORTED;
730 s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
731}
732
733static void ccid_write_slot_status(USBCCIDState *s, CCID_Header *recv)
734{
735 CCID_SlotStatus *h = ccid_reserve_recv_buf(s, sizeof(CCID_SlotStatus));
736 if (h == NULL) {
737 return;
738 }
739 h->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_SlotStatus;
740 h->b.hdr.dwLength = 0;
741 h->b.hdr.bSlot = recv->bSlot;
742 h->b.hdr.bSeq = recv->bSeq;
743 h->b.bStatus = ccid_calc_status(s);
744 h->b.bError = s->bError;
745 h->bClockStatus = CLOCK_STATUS_RUNNING;
746 ccid_reset_error_status(s);
747 usb_wakeup(s->bulk, 0);
748}
749
750static void ccid_write_parameters(USBCCIDState *s, CCID_Header *recv)
751{
752 CCID_Parameter *h;
753 uint32_t len = s->ulProtocolDataStructureSize;
754
755 h = ccid_reserve_recv_buf(s, sizeof(CCID_Parameter) + len);
756 if (h == NULL) {
757 return;
758 }
759 h->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_Parameters;
760 h->b.hdr.dwLength = 0;
761 h->b.hdr.bSlot = recv->bSlot;
762 h->b.hdr.bSeq = recv->bSeq;
763 h->b.bStatus = ccid_calc_status(s);
764 h->b.bError = s->bError;
765 h->bProtocolNum = s->bProtocolNum;
766 h->abProtocolDataStructure = s->abProtocolDataStructure;
767 ccid_reset_error_status(s);
768 usb_wakeup(s->bulk, 0);
769}
770
771static void ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t seq,
772 const uint8_t *data, uint32_t len)
773{
774 CCID_DataBlock *p = ccid_reserve_recv_buf(s, sizeof(*p) + len);
775
776 if (p == NULL) {
777 return;
778 }
779 p->b.hdr.bMessageType = CCID_MESSAGE_TYPE_RDR_to_PC_DataBlock;
780 p->b.hdr.dwLength = cpu_to_le32(len);
781 p->b.hdr.bSlot = slot;
782 p->b.hdr.bSeq = seq;
783 p->b.bStatus = ccid_calc_status(s);
784 p->b.bError = s->bError;
785 if (p->b.bError) {
786 DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError);
787 }
788 if (len) {
789 g_assert_nonnull(data);
790 memcpy(p->abData, data, len);
791 }
792 ccid_reset_error_status(s);
793 usb_wakeup(s->bulk, 0);
794}
795
796static void ccid_report_error_failed(USBCCIDState *s, uint8_t error)
797{
798 s->bmCommandStatus = COMMAND_STATUS_FAILED;
799 s->bError = error;
800}
801
802static void ccid_write_data_block_answer(USBCCIDState *s,
803 const uint8_t *data, uint32_t len)
804{
805 uint8_t seq;
806 uint8_t slot;
807
808 if (!ccid_has_pending_answers(s)) {
809 DPRINTF(s, D_WARN, "error: no pending answer to return to guest\n");
810 ccid_report_error_failed(s, ERROR_ICC_MUTE);
811 return;
812 }
813 ccid_remove_pending_answer(s, &slot, &seq);
814 ccid_write_data_block(s, slot, seq, data, len);
815}
816
817static uint8_t atr_get_protocol_num(const uint8_t *atr, uint32_t len)
818{
819 int i;
820
821 if (len < 2 || !(atr[1] & 0x80)) {
822
823 return 0;
824 }
825 i = 1 + !!(atr[1] & 0x10) + !!(atr[1] & 0x20) + !!(atr[1] & 0x40);
826 i += !!(atr[1] & 0x80);
827 return atr[i] & 0x0f;
828}
829
830static void ccid_write_data_block_atr(USBCCIDState *s, CCID_Header *recv)
831{
832 const uint8_t *atr = NULL;
833 uint32_t len = 0;
834 uint8_t atr_protocol_num;
835 CCID_T0ProtocolDataStructure *t0 = &s->abProtocolDataStructure.t0;
836 CCID_T1ProtocolDataStructure *t1 = &s->abProtocolDataStructure.t1;
837
838 if (s->card) {
839 atr = ccid_card_get_atr(s->card, &len);
840 }
841 atr_protocol_num = atr_get_protocol_num(atr, len);
842 DPRINTF(s, D_VERBOSE, "%s: atr contains protocol=%d\n", __func__,
843 atr_protocol_num);
844
845 s->bProtocolNum = (atr_protocol_num <= 1 ? atr_protocol_num
846 : s->bProtocolNum);
847 switch (atr_protocol_num) {
848 case 0:
849
850 t0->bmFindexDindex = 0;
851 t0->bmTCCKST0 = 0;
852 t0->bGuardTimeT0 = 0;
853 t0->bWaitingIntegerT0 = 0;
854 t0->bClockStop = 0;
855 break;
856 case 1:
857
858 t1->bmFindexDindex = 0;
859 t1->bmTCCKST1 = 0;
860 t1->bGuardTimeT1 = 0;
861 t1->bWaitingIntegerT1 = 0;
862 t1->bClockStop = 0;
863 t1->bIFSC = 0;
864 t1->bNadValue = 0;
865 break;
866 default:
867 DPRINTF(s, D_WARN, "%s: error: unsupported ATR protocol %d\n",
868 __func__, atr_protocol_num);
869 }
870 ccid_write_data_block(s, recv->bSlot, recv->bSeq, atr, len);
871}
872
873static void ccid_set_parameters(USBCCIDState *s, CCID_Header *recv)
874{
875 CCID_SetParameters *ph = (CCID_SetParameters *) recv;
876 uint32_t protocol_num = ph->bProtocolNum & 3;
877
878 if (protocol_num != 0 && protocol_num != 1) {
879 ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED);
880 return;
881 }
882 s->bProtocolNum = protocol_num;
883 s->abProtocolDataStructure = ph->abProtocolDataStructure;
884}
885
886
887
888
889
890static const CCID_ProtocolDataStructure defaultProtocolDataStructure = {
891 .t1 = {
892 .bmFindexDindex = 0x77,
893 .bmTCCKST1 = 0x00,
894 .bGuardTimeT1 = 0x00,
895 .bWaitingIntegerT1 = 0x00,
896 .bClockStop = 0x00,
897 .bIFSC = 0xfe,
898 .bNadValue = 0x00,
899 }
900};
901
902static void ccid_reset_parameters(USBCCIDState *s)
903{
904 s->bProtocolNum = 0;
905 s->abProtocolDataStructure = defaultProtocolDataStructure;
906}
907
908
909static void ccid_on_slot_change(USBCCIDState *s, bool full)
910{
911
912 uint8_t current = s->bmSlotICCState;
913 if (full) {
914 s->bmSlotICCState |= SLOT_0_STATE_MASK;
915 } else {
916 s->bmSlotICCState &= ~SLOT_0_STATE_MASK;
917 }
918 if (current != s->bmSlotICCState) {
919 s->bmSlotICCState |= SLOT_0_CHANGED_MASK;
920 }
921 s->notify_slot_change = true;
922 usb_wakeup(s->intr, 0);
923}
924
925static void ccid_write_data_block_error(
926 USBCCIDState *s, uint8_t slot, uint8_t seq)
927{
928 ccid_write_data_block(s, slot, seq, NULL, 0);
929}
930
931static void ccid_on_apdu_from_guest(USBCCIDState *s, CCID_XferBlock *recv)
932{
933 uint32_t len;
934
935 if (ccid_card_status(s) != ICC_STATUS_PRESENT_ACTIVE) {
936 DPRINTF(s, 1,
937 "usb-ccid: not sending apdu to client, no card connected\n");
938 ccid_write_data_block_error(s, recv->hdr.bSlot, recv->hdr.bSeq);
939 return;
940 }
941 len = le32_to_cpu(recv->hdr.dwLength);
942 DPRINTF(s, 1, "%s: seq %d, len %d\n", __func__,
943 recv->hdr.bSeq, len);
944 ccid_add_pending_answer(s, (CCID_Header *)recv);
945 if (s->card && len <= BULK_OUT_DATA_SIZE) {
946 ccid_card_apdu_from_guest(s->card, recv->abData, len);
947 } else {
948 DPRINTF(s, D_WARN, "warning: discarded apdu\n");
949 }
950}
951
952static const char *ccid_message_type_to_str(uint8_t type)
953{
954 switch (type) {
955 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn: return "IccPowerOn";
956 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff: return "IccPowerOff";
957 case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus: return "GetSlotStatus";
958 case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock: return "XfrBlock";
959 case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters: return "GetParameters";
960 case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters: return "ResetParameters";
961 case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters: return "SetParameters";
962 case CCID_MESSAGE_TYPE_PC_to_RDR_Escape: return "Escape";
963 case CCID_MESSAGE_TYPE_PC_to_RDR_IccClock: return "IccClock";
964 case CCID_MESSAGE_TYPE_PC_to_RDR_T0APDU: return "T0APDU";
965 case CCID_MESSAGE_TYPE_PC_to_RDR_Secure: return "Secure";
966 case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical: return "Mechanical";
967 case CCID_MESSAGE_TYPE_PC_to_RDR_Abort: return "Abort";
968 case CCID_MESSAGE_TYPE_PC_to_RDR_SetDataRateAndClockFrequency:
969 return "SetDataRateAndClockFrequency";
970 }
971 return "unknown";
972}
973
974static void ccid_handle_bulk_out(USBCCIDState *s, USBPacket *p)
975{
976 CCID_Header *ccid_header;
977
978 if (p->iov.size + s->bulk_out_pos > BULK_OUT_DATA_SIZE) {
979 goto err;
980 }
981 usb_packet_copy(p, s->bulk_out_data + s->bulk_out_pos, p->iov.size);
982 s->bulk_out_pos += p->iov.size;
983 if (s->bulk_out_pos < 10) {
984 DPRINTF(s, 1, "%s: header incomplete\n", __func__);
985 goto err;
986 }
987
988 ccid_header = (CCID_Header *)s->bulk_out_data;
989 if ((s->bulk_out_pos - 10 < ccid_header->dwLength) &&
990 (p->iov.size == CCID_MAX_PACKET_SIZE)) {
991 DPRINTF(s, D_VERBOSE,
992 "usb-ccid: bulk_in: expecting more packets (%d/%d)\n",
993 s->bulk_out_pos - 10, ccid_header->dwLength);
994 return;
995 }
996 if (s->bulk_out_pos - 10 != ccid_header->dwLength) {
997 DPRINTF(s, 1,
998 "usb-ccid: bulk_in: message size mismatch (got %d, expected %d)\n",
999 s->bulk_out_pos - 10, ccid_header->dwLength);
1000 goto err;
1001 }
1002
1003 DPRINTF(s, D_MORE_INFO, "%s %x %s\n", __func__,
1004 ccid_header->bMessageType,
1005 ccid_message_type_to_str(ccid_header->bMessageType));
1006 switch (ccid_header->bMessageType) {
1007 case CCID_MESSAGE_TYPE_PC_to_RDR_GetSlotStatus:
1008 ccid_write_slot_status(s, ccid_header);
1009 break;
1010 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOn:
1011 DPRINTF(s, 1, "%s: PowerOn: %d\n", __func__,
1012 ((CCID_IccPowerOn *)(ccid_header))->bPowerSelect);
1013 s->powered = true;
1014 if (!ccid_card_inserted(s)) {
1015 ccid_report_error_failed(s, ERROR_ICC_MUTE);
1016 }
1017
1018 ccid_write_data_block_atr(s, ccid_header);
1019 break;
1020 case CCID_MESSAGE_TYPE_PC_to_RDR_IccPowerOff:
1021 ccid_reset_error_status(s);
1022 s->powered = false;
1023 ccid_write_slot_status(s, ccid_header);
1024 break;
1025 case CCID_MESSAGE_TYPE_PC_to_RDR_XfrBlock:
1026 ccid_on_apdu_from_guest(s, (CCID_XferBlock *)s->bulk_out_data);
1027 break;
1028 case CCID_MESSAGE_TYPE_PC_to_RDR_SetParameters:
1029 ccid_reset_error_status(s);
1030 ccid_set_parameters(s, ccid_header);
1031 ccid_write_parameters(s, ccid_header);
1032 break;
1033 case CCID_MESSAGE_TYPE_PC_to_RDR_ResetParameters:
1034 ccid_reset_error_status(s);
1035 ccid_reset_parameters(s);
1036 ccid_write_parameters(s, ccid_header);
1037 break;
1038 case CCID_MESSAGE_TYPE_PC_to_RDR_GetParameters:
1039 ccid_reset_error_status(s);
1040 ccid_write_parameters(s, ccid_header);
1041 break;
1042 case CCID_MESSAGE_TYPE_PC_to_RDR_Mechanical:
1043 ccid_report_error_failed(s, 0);
1044 ccid_write_slot_status(s, ccid_header);
1045 break;
1046 default:
1047 DPRINTF(s, 1,
1048 "handle_data: ERROR: unhandled message type %Xh\n",
1049 ccid_header->bMessageType);
1050
1051
1052
1053
1054 ccid_report_error_failed(s, ERROR_CMD_NOT_SUPPORTED);
1055 ccid_write_slot_status(s, ccid_header);
1056 break;
1057 }
1058 s->bulk_out_pos = 0;
1059 return;
1060
1061err:
1062 p->status = USB_RET_STALL;
1063 s->bulk_out_pos = 0;
1064 return;
1065}
1066
1067static void ccid_bulk_in_copy_to_guest(USBCCIDState *s, USBPacket *p)
1068{
1069 int len = 0;
1070
1071 ccid_bulk_in_get(s);
1072 if (s->current_bulk_in != NULL) {
1073 len = MIN(s->current_bulk_in->len - s->current_bulk_in->pos,
1074 p->iov.size);
1075 usb_packet_copy(p, s->current_bulk_in->data +
1076 s->current_bulk_in->pos, len);
1077 s->current_bulk_in->pos += len;
1078 if (s->current_bulk_in->pos == s->current_bulk_in->len) {
1079 ccid_bulk_in_release(s);
1080 }
1081 } else {
1082
1083 p->status = USB_RET_NAK;
1084 }
1085 if (len) {
1086 DPRINTF(s, D_MORE_INFO,
1087 "%s: %zd/%d req/act to guest (BULK_IN)\n",
1088 __func__, p->iov.size, len);
1089 }
1090 if (len < p->iov.size) {
1091 DPRINTF(s, 1,
1092 "%s: returning short (EREMOTEIO) %d < %zd\n",
1093 __func__, len, p->iov.size);
1094 }
1095}
1096
1097static void ccid_handle_data(USBDevice *dev, USBPacket *p)
1098{
1099 USBCCIDState *s = USB_CCID_DEV(dev);
1100 uint8_t buf[2];
1101
1102 switch (p->pid) {
1103 case USB_TOKEN_OUT:
1104 ccid_handle_bulk_out(s, p);
1105 break;
1106
1107 case USB_TOKEN_IN:
1108 switch (p->ep->nr) {
1109 case CCID_BULK_IN_EP:
1110 ccid_bulk_in_copy_to_guest(s, p);
1111 break;
1112 case CCID_INT_IN_EP:
1113 if (s->notify_slot_change) {
1114
1115 buf[0] = CCID_MESSAGE_TYPE_RDR_to_PC_NotifySlotChange;
1116 buf[1] = s->bmSlotICCState;
1117 usb_packet_copy(p, buf, 2);
1118 s->notify_slot_change = false;
1119 s->bmSlotICCState &= ~SLOT_0_CHANGED_MASK;
1120 DPRINTF(s, D_INFO,
1121 "handle_data: int_in: notify_slot_change %X, "
1122 "requested len %zd\n",
1123 s->bmSlotICCState, p->iov.size);
1124 } else {
1125 p->status = USB_RET_NAK;
1126 }
1127 break;
1128 default:
1129 DPRINTF(s, 1, "Bad endpoint\n");
1130 p->status = USB_RET_STALL;
1131 break;
1132 }
1133 break;
1134 default:
1135 DPRINTF(s, 1, "Bad token\n");
1136 p->status = USB_RET_STALL;
1137 break;
1138 }
1139}
1140
1141static void ccid_unrealize(USBDevice *dev, Error **errp)
1142{
1143 USBCCIDState *s = USB_CCID_DEV(dev);
1144
1145 ccid_bulk_in_clear(s);
1146}
1147
1148static void ccid_flush_pending_answers(USBCCIDState *s)
1149{
1150 while (ccid_has_pending_answers(s)) {
1151 ccid_write_data_block_answer(s, NULL, 0);
1152 }
1153}
1154
1155static Answer *ccid_peek_next_answer(USBCCIDState *s)
1156{
1157 return s->pending_answers_num == 0
1158 ? NULL
1159 : &s->pending_answers[s->pending_answers_start % PENDING_ANSWERS_NUM];
1160}
1161
1162static Property ccid_props[] = {
1163 DEFINE_PROP_UINT32("slot", struct CCIDCardState, slot, 0),
1164 DEFINE_PROP_END_OF_LIST(),
1165};
1166
1167#define TYPE_CCID_BUS "ccid-bus"
1168#define CCID_BUS(obj) OBJECT_CHECK(CCIDBus, (obj), TYPE_CCID_BUS)
1169
1170static const TypeInfo ccid_bus_info = {
1171 .name = TYPE_CCID_BUS,
1172 .parent = TYPE_BUS,
1173 .instance_size = sizeof(CCIDBus),
1174};
1175
1176void ccid_card_send_apdu_to_guest(CCIDCardState *card,
1177 uint8_t *apdu, uint32_t len)
1178{
1179 DeviceState *qdev = DEVICE(card);
1180 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1181 USBCCIDState *s = USB_CCID_DEV(dev);
1182 Answer *answer;
1183
1184 if (!ccid_has_pending_answers(s)) {
1185 DPRINTF(s, 1, "CCID ERROR: got an APDU without pending answers\n");
1186 return;
1187 }
1188 s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
1189 answer = ccid_peek_next_answer(s);
1190 if (answer == NULL) {
1191 DPRINTF(s, D_WARN, "%s: error: unexpected lack of answer\n", __func__);
1192 ccid_report_error_failed(s, ERROR_HW_ERROR);
1193 return;
1194 }
1195 DPRINTF(s, 1, "APDU returned to guest %d (answer seq %d, slot %d)\n",
1196 len, answer->seq, answer->slot);
1197 ccid_write_data_block_answer(s, apdu, len);
1198}
1199
1200void ccid_card_card_removed(CCIDCardState *card)
1201{
1202 DeviceState *qdev = DEVICE(card);
1203 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1204 USBCCIDState *s = USB_CCID_DEV(dev);
1205
1206 ccid_on_slot_change(s, false);
1207 ccid_flush_pending_answers(s);
1208 ccid_reset(s);
1209}
1210
1211int ccid_card_ccid_attach(CCIDCardState *card)
1212{
1213 DeviceState *qdev = DEVICE(card);
1214 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1215 USBCCIDState *s = USB_CCID_DEV(dev);
1216
1217 DPRINTF(s, 1, "CCID Attach\n");
1218 return 0;
1219}
1220
1221void ccid_card_ccid_detach(CCIDCardState *card)
1222{
1223 DeviceState *qdev = DEVICE(card);
1224 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1225 USBCCIDState *s = USB_CCID_DEV(dev);
1226
1227 DPRINTF(s, 1, "CCID Detach\n");
1228 if (ccid_card_inserted(s)) {
1229 ccid_on_slot_change(s, false);
1230 }
1231 ccid_detach(s);
1232}
1233
1234void ccid_card_card_error(CCIDCardState *card, uint64_t error)
1235{
1236 DeviceState *qdev = DEVICE(card);
1237 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1238 USBCCIDState *s = USB_CCID_DEV(dev);
1239
1240 s->bmCommandStatus = COMMAND_STATUS_FAILED;
1241 s->last_answer_error = error;
1242 DPRINTF(s, 1, "VSC_Error: %" PRIX64 "\n", s->last_answer_error);
1243
1244
1245
1246
1247
1248 if (ccid_has_pending_answers(s)) {
1249 ccid_write_data_block_answer(s, NULL, 0);
1250 }
1251}
1252
1253void ccid_card_card_inserted(CCIDCardState *card)
1254{
1255 DeviceState *qdev = DEVICE(card);
1256 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1257 USBCCIDState *s = USB_CCID_DEV(dev);
1258
1259 s->bmCommandStatus = COMMAND_STATUS_NO_ERROR;
1260 ccid_flush_pending_answers(s);
1261 ccid_on_slot_change(s, true);
1262}
1263
1264static void ccid_card_unrealize(DeviceState *qdev, Error **errp)
1265{
1266 CCIDCardState *card = CCID_CARD(qdev);
1267 CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
1268 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1269 USBCCIDState *s = USB_CCID_DEV(dev);
1270 Error *local_err = NULL;
1271
1272 if (ccid_card_inserted(s)) {
1273 ccid_card_card_removed(card);
1274 }
1275 if (cc->unrealize) {
1276 cc->unrealize(card, &local_err);
1277 if (local_err != NULL) {
1278 error_propagate(errp, local_err);
1279 return;
1280 }
1281 }
1282 s->card = NULL;
1283}
1284
1285static void ccid_card_realize(DeviceState *qdev, Error **errp)
1286{
1287 CCIDCardState *card = CCID_CARD(qdev);
1288 CCIDCardClass *cc = CCID_CARD_GET_CLASS(card);
1289 USBDevice *dev = USB_DEVICE(qdev->parent_bus->parent);
1290 USBCCIDState *s = USB_CCID_DEV(dev);
1291 Error *local_err = NULL;
1292
1293 if (card->slot != 0) {
1294 error_setg(errp, "usb-ccid supports one slot, can't add %d",
1295 card->slot);
1296 return;
1297 }
1298 if (s->card != NULL) {
1299 error_setg(errp, "usb-ccid card already full, not adding");
1300 return;
1301 }
1302 if (cc->realize) {
1303 cc->realize(card, &local_err);
1304 if (local_err != NULL) {
1305 error_propagate(errp, local_err);
1306 return;
1307 }
1308 }
1309 s->card = card;
1310}
1311
1312static void ccid_realize(USBDevice *dev, Error **errp)
1313{
1314 USBCCIDState *s = USB_CCID_DEV(dev);
1315
1316 usb_desc_create_serial(dev);
1317 usb_desc_init(dev);
1318 qbus_create_inplace(&s->bus, sizeof(s->bus), TYPE_CCID_BUS, DEVICE(dev),
1319 NULL);
1320 qbus_set_hotplug_handler(BUS(&s->bus), DEVICE(dev), &error_abort);
1321 s->intr = usb_ep_get(dev, USB_TOKEN_IN, CCID_INT_IN_EP);
1322 s->bulk = usb_ep_get(dev, USB_TOKEN_IN, CCID_BULK_IN_EP);
1323 s->card = NULL;
1324 s->dev.speed = USB_SPEED_FULL;
1325 s->dev.speedmask = USB_SPEED_MASK_FULL;
1326 s->notify_slot_change = false;
1327 s->powered = true;
1328 s->pending_answers_num = 0;
1329 s->last_answer_error = 0;
1330 s->bulk_in_pending_start = 0;
1331 s->bulk_in_pending_end = 0;
1332 s->current_bulk_in = NULL;
1333 ccid_reset_error_status(s);
1334 s->bulk_out_pos = 0;
1335 ccid_reset_parameters(s);
1336 ccid_reset(s);
1337 s->debug = parse_debug_env("QEMU_CCID_DEBUG", D_VERBOSE, s->debug);
1338}
1339
1340static int ccid_post_load(void *opaque, int version_id)
1341{
1342 USBCCIDState *s = opaque;
1343
1344
1345
1346
1347
1348
1349
1350 s->dev.state = s->state_vmstate;
1351 return 0;
1352}
1353
1354static int ccid_pre_save(void *opaque)
1355{
1356 USBCCIDState *s = opaque;
1357
1358 s->state_vmstate = s->dev.state;
1359
1360 return 0;
1361}
1362
1363static VMStateDescription bulk_in_vmstate = {
1364 .name = "CCID BulkIn state",
1365 .version_id = 1,
1366 .minimum_version_id = 1,
1367 .fields = (VMStateField[]) {
1368 VMSTATE_BUFFER(data, BulkIn),
1369 VMSTATE_UINT32(len, BulkIn),
1370 VMSTATE_UINT32(pos, BulkIn),
1371 VMSTATE_END_OF_LIST()
1372 }
1373};
1374
1375static VMStateDescription answer_vmstate = {
1376 .name = "CCID Answer state",
1377 .version_id = 1,
1378 .minimum_version_id = 1,
1379 .fields = (VMStateField[]) {
1380 VMSTATE_UINT8(slot, Answer),
1381 VMSTATE_UINT8(seq, Answer),
1382 VMSTATE_END_OF_LIST()
1383 }
1384};
1385
1386static VMStateDescription usb_device_vmstate = {
1387 .name = "usb_device",
1388 .version_id = 1,
1389 .minimum_version_id = 1,
1390 .fields = (VMStateField[]) {
1391 VMSTATE_UINT8(addr, USBDevice),
1392 VMSTATE_BUFFER(setup_buf, USBDevice),
1393 VMSTATE_BUFFER(data_buf, USBDevice),
1394 VMSTATE_END_OF_LIST()
1395 }
1396};
1397
1398static VMStateDescription ccid_vmstate = {
1399 .name = "usb-ccid",
1400 .version_id = 1,
1401 .minimum_version_id = 1,
1402 .post_load = ccid_post_load,
1403 .pre_save = ccid_pre_save,
1404 .fields = (VMStateField[]) {
1405 VMSTATE_STRUCT(dev, USBCCIDState, 1, usb_device_vmstate, USBDevice),
1406 VMSTATE_UINT8(debug, USBCCIDState),
1407 VMSTATE_BUFFER(bulk_out_data, USBCCIDState),
1408 VMSTATE_UINT32(bulk_out_pos, USBCCIDState),
1409 VMSTATE_UINT8(bmSlotICCState, USBCCIDState),
1410 VMSTATE_UINT8(powered, USBCCIDState),
1411 VMSTATE_UINT8(notify_slot_change, USBCCIDState),
1412 VMSTATE_UINT64(last_answer_error, USBCCIDState),
1413 VMSTATE_UINT8(bError, USBCCIDState),
1414 VMSTATE_UINT8(bmCommandStatus, USBCCIDState),
1415 VMSTATE_UINT8(bProtocolNum, USBCCIDState),
1416 VMSTATE_BUFFER(abProtocolDataStructure.data, USBCCIDState),
1417 VMSTATE_UINT32(ulProtocolDataStructureSize, USBCCIDState),
1418 VMSTATE_STRUCT_ARRAY(bulk_in_pending, USBCCIDState,
1419 BULK_IN_PENDING_NUM, 1, bulk_in_vmstate, BulkIn),
1420 VMSTATE_UINT32(bulk_in_pending_start, USBCCIDState),
1421 VMSTATE_UINT32(bulk_in_pending_end, USBCCIDState),
1422 VMSTATE_STRUCT_ARRAY(pending_answers, USBCCIDState,
1423 PENDING_ANSWERS_NUM, 1, answer_vmstate, Answer),
1424 VMSTATE_UINT32(pending_answers_num, USBCCIDState),
1425 VMSTATE_UNUSED(1),
1426 VMSTATE_UINT32(state_vmstate, USBCCIDState),
1427 VMSTATE_END_OF_LIST()
1428 }
1429};
1430
1431static Property ccid_properties[] = {
1432 DEFINE_PROP_UINT8("debug", USBCCIDState, debug, 0),
1433 DEFINE_PROP_END_OF_LIST(),
1434};
1435
1436static void ccid_class_initfn(ObjectClass *klass, void *data)
1437{
1438 DeviceClass *dc = DEVICE_CLASS(klass);
1439 USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
1440 HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
1441
1442 uc->realize = ccid_realize;
1443 uc->product_desc = "QEMU USB CCID";
1444 uc->usb_desc = &desc_ccid;
1445 uc->handle_reset = ccid_handle_reset;
1446 uc->handle_control = ccid_handle_control;
1447 uc->handle_data = ccid_handle_data;
1448 uc->unrealize = ccid_unrealize;
1449 dc->desc = "CCID Rev 1.1 smartcard reader";
1450 dc->vmsd = &ccid_vmstate;
1451 dc->props = ccid_properties;
1452 set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
1453 hc->unplug = qdev_simple_device_unplug_cb;
1454}
1455
1456static const TypeInfo ccid_info = {
1457 .name = CCID_DEV_NAME,
1458 .parent = TYPE_USB_DEVICE,
1459 .instance_size = sizeof(USBCCIDState),
1460 .class_init = ccid_class_initfn,
1461 .interfaces = (InterfaceInfo[]) {
1462 { TYPE_HOTPLUG_HANDLER },
1463 { }
1464 }
1465};
1466
1467static void ccid_card_class_init(ObjectClass *klass, void *data)
1468{
1469 DeviceClass *k = DEVICE_CLASS(klass);
1470 k->bus_type = TYPE_CCID_BUS;
1471 k->realize = ccid_card_realize;
1472 k->unrealize = ccid_card_unrealize;
1473 k->props = ccid_props;
1474}
1475
1476static const TypeInfo ccid_card_type_info = {
1477 .name = TYPE_CCID_CARD,
1478 .parent = TYPE_DEVICE,
1479 .instance_size = sizeof(CCIDCardState),
1480 .abstract = true,
1481 .class_size = sizeof(CCIDCardClass),
1482 .class_init = ccid_card_class_init,
1483};
1484
1485static void ccid_register_types(void)
1486{
1487 type_register_static(&ccid_bus_info);
1488 type_register_static(&ccid_card_type_info);
1489 type_register_static(&ccid_info);
1490 usb_legacy_register(CCID_DEV_NAME, "ccid", NULL);
1491}
1492
1493type_init(ccid_register_types)
1494