1 /*

     2  * Linux host USB redirector

     3  *

     4  * Copyright (c) 2005 Fabrice Bellard

     5  *

     6  * Copyright (c) 2008 Max Krasnyansky

     7  *      Support for host device auto connect & disconnect

     8  *      Major rewrite to support fully async operation

     9  *

    10  * Copyright 2008 TJ <linux@tjworld.net>

    11  *      Added flexible support for /dev/bus/usb /sys/bus/usb/devices in addition

    12  *      to the legacy /proc/bus/usb USB device discovery and handling

    13  *

    14  * Permission is hereby granted, free of charge, to any person obtaining a copy

    15  * of this software and associated documentation files (the "Software"), to deal

    16  * in the Software without restriction, including without limitation the rights

    17  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

    18  * copies of the Software, and to permit persons to whom the Software is

    19  * furnished to do so, subject to the following conditions:

    20  *

    21  * The above copyright notice and this permission notice shall be included in

    22  * all copies or substantial portions of the Software.

    23  *

    24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

    25  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

    26  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

    27  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

    28  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

    29  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

    30  * THE SOFTWARE.

    31  */

    32 

    33 #include "qemu-common.h"

    34 #include "qemu-timer.h"

    35 #include "console.h"

    36 

    37 #include <dirent.h>

    38 #include <sys/ioctl.h>

    39 #include <signal.h>

    40 

    41 #include <linux/usbdevice_fs.h>

    42 #include <linux/version.h>

    43 #include "hw/usb.h"

    44 

    45 /* We redefine it to avoid version problems */

    46 struct usb_ctrltransfer {

    47     uint8_t  bRequestType;

    48     uint8_t  bRequest;

    49     uint16_t wValue;

    50     uint16_t wIndex;

    51     uint16_t wLength;

    52     uint32_t timeout;

    53     void *data;

    54 };

    55 

    56 struct usb_ctrlrequest {

    57     uint8_t bRequestType;

    58     uint8_t bRequest;

    59     uint16_t wValue;

    60     uint16_t wIndex;

    61     uint16_t wLength;

    62 };

    63 

    64 typedef int USBScanFunc(void *opaque, int bus_num, int addr, int class_id,

    65                         int vendor_id, int product_id,

    66                         const char *product_name, int speed);

    67 static int usb_host_find_device(int *pbus_num, int *paddr,

    68                                 char *product_name, int product_name_size,

    69                                 const char *devname);

    70 //#define DEBUG

    71 

    72 #ifdef DEBUG

    73 #define dprintf printf

    74 #else

    75 #define dprintf(...)

    76 #endif

    77 

    78 #define USBDBG_DEVOPENED "husb: opened %s/devices\n"

    79 

    80 #define USBPROCBUS_PATH "/proc/bus/usb"

    81 #define PRODUCT_NAME_SZ 32

    82 #define MAX_ENDPOINTS 16

    83 #define USBDEVBUS_PATH "/dev/bus/usb"

    84 #define USBSYSBUS_PATH "/sys/bus/usb"

    85 

    86 static char *usb_host_device_path;

    87 

    88 #define USB_FS_NONE 0

    89 #define USB_FS_PROC 1

    90 #define USB_FS_DEV 2

    91 #define USB_FS_SYS 3

    92 

    93 static int usb_fs_type;

    94 

    95 /* endpoint association data */

    96 struct endp_data {

    97     uint8_t type;

    98     uint8_t halted;

    99 };

   100 

   101 enum {

   102     CTRL_STATE_IDLE = 0,

   103     CTRL_STATE_SETUP,

   104     CTRL_STATE_DATA,

   105     CTRL_STATE_ACK

   106 };

   107 

   108 /*

   109  * Control transfer state.

   110  * Note that 'buffer' _must_ follow 'req' field because 

   111  * we need contigious buffer when we submit control URB.

   112  */ 

   113 struct ctrl_struct {

   114     uint16_t len;

   115     uint16_t offset;

   116     uint8_t  state;

   117     struct   usb_ctrlrequest req;

   118     uint8_t  buffer[1024];

   119 };

   120 

   121 typedef struct USBHostDevice {

   122     USBDevice dev;

   123     int       fd;

   124 

   125     uint8_t   descr[1024];

   126     int       descr_len;

   127     int       configuration;

   128     int       ninterfaces;

   129     int       closing;

   130 

   131     struct ctrl_struct ctrl;

   132     struct endp_data endp_table[MAX_ENDPOINTS];

   133 

   134     /* Host side address */

   135     int bus_num;

   136     int addr;

   137 

   138     struct USBHostDevice *next;

   139 } USBHostDevice;

   140 

   141 static int is_isoc(USBHostDevice *s, int ep)

   142 {

   143     return s->endp_table[ep - 1].type == USBDEVFS_URB_TYPE_ISO;

   144 }

   145 

   146 static int is_halted(USBHostDevice *s, int ep)

   147 {

   148     return s->endp_table[ep - 1].halted;

   149 }

   150 

   151 static void clear_halt(USBHostDevice *s, int ep)

   152 {

   153     s->endp_table[ep - 1].halted = 0;

   154 }

   155 

   156 static void set_halt(USBHostDevice *s, int ep)

   157 {

   158     s->endp_table[ep - 1].halted = 1;

   159 }

   160 

   161 static USBHostDevice *hostdev_list;

   162 

   163 static void hostdev_link(USBHostDevice *dev)

   164 {

   165     dev->next = hostdev_list;

   166     hostdev_list = dev;

   167 }

   168 

   169 static void hostdev_unlink(USBHostDevice *dev)

   170 {

   171     USBHostDevice *pdev = hostdev_list;

   172     USBHostDevice **prev = &hostdev_list;

   173 

   174     while (pdev) {

   175 	if (pdev == dev) {

   176             *prev = dev->next;

   177             return;

   178         }

   179 

   180         prev = &pdev->next;

   181         pdev = pdev->next;

   182     }

   183 }

   184 

   185 static USBHostDevice *hostdev_find(int bus_num, int addr)

   186 {

   187     USBHostDevice *s = hostdev_list;

   188     while (s) {

   189         if (s->bus_num == bus_num && s->addr == addr)

   190             return s;

   191         s = s->next;

   192     }

   193     return NULL;

   194 }

   195 

   196 /* 

   197  * Async URB state.

   198  * We always allocate one isoc descriptor even for bulk transfers

   199  * to simplify allocation and casts. 

   200  */

   201 typedef struct AsyncURB

   202 {

   203     struct usbdevfs_urb urb;

   204     struct usbdevfs_iso_packet_desc isocpd;

   205 

   206     USBPacket     *packet;

   207     USBHostDevice *hdev;

   208 } AsyncURB;

   209 

   210 static AsyncURB *async_alloc(void)

   211 {

   212     return (AsyncURB *) qemu_mallocz(sizeof(AsyncURB));

   213 }

   214 

   215 static void async_free(AsyncURB *aurb)

   216 {

   217     qemu_free(aurb);

   218 }

   219 

   220 static void async_complete_ctrl(USBHostDevice *s, USBPacket *p)

   221 {

   222     switch(s->ctrl.state) {

   223     case CTRL_STATE_SETUP:

   224         if (p->len < s->ctrl.len)

   225             s->ctrl.len = p->len;

   226         s->ctrl.state = CTRL_STATE_DATA;

   227         p->len = 8;

   228         break;

   229 

   230     case CTRL_STATE_ACK:

   231         s->ctrl.state = CTRL_STATE_IDLE;

   232         p->len = 0;

   233         break;

   234 

   235     default:

   236         break;

   237     }

   238 }

   239 

   240 static void async_complete(void *opaque)

   241 {

   242     USBHostDevice *s = opaque;

   243     AsyncURB *aurb;

   244 

   245     while (1) {

   246     	USBPacket *p;

   247 

   248 	int r = ioctl(s->fd, USBDEVFS_REAPURBNDELAY, &aurb);

   249         if (r < 0) {

   250             if (errno == EAGAIN)

   251                 return;

   252 

   253             if (errno == ENODEV && !s->closing) {

   254                 printf("husb: device %d.%d disconnected\n", s->bus_num, s->addr);

   255 	        usb_device_del_addr(0, s->dev.addr);

   256                 return;

   257             }

   258 

   259             dprintf("husb: async. reap urb failed errno %d\n", errno);

   260             return;

   261         }

   262 

   263         p = aurb->packet;

   264 

   265 	dprintf("husb: async completed. aurb %p status %d alen %d\n", 

   266                 aurb, aurb->urb.status, aurb->urb.actual_length);

   267 

   268 	if (p) {

   269             switch (aurb->urb.status) {

   270             case 0:

   271                 p->len = aurb->urb.actual_length;

   272                 if (aurb->urb.type == USBDEVFS_URB_TYPE_CONTROL)

   273                     async_complete_ctrl(s, p);

   274                 break;

   275 

   276             case -EPIPE:

   277                 set_halt(s, p->devep);

   278                 /* fall through */

   279             default:

   280                 p->len = USB_RET_NAK;

   281                 break;

   282             }

   283 

   284             usb_packet_complete(p);

   285 	}

   286 

   287         async_free(aurb);

   288     }

   289 }

   290 

   291 static void async_cancel(USBPacket *unused, void *opaque)

   292 {

   293     AsyncURB *aurb = opaque;

   294     USBHostDevice *s = aurb->hdev;

   295 

   296     dprintf("husb: async cancel. aurb %p\n", aurb);

   297 

   298     /* Mark it as dead (see async_complete above) */

   299     aurb->packet = NULL;

   300 

   301     int r = ioctl(s->fd, USBDEVFS_DISCARDURB, aurb);

   302     if (r < 0) {

   303         dprintf("husb: async. discard urb failed errno %d\n", errno);

   304     }

   305 }

   306 

   307 static int usb_host_claim_interfaces(USBHostDevice *dev, int configuration)

   308 {

   309     int dev_descr_len, config_descr_len;

   310     int interface, nb_interfaces, nb_configurations;

   311     int ret, i;

   312 

   313     if (configuration == 0) /* address state - ignore */

   314         return 1;

   315 

   316     dprintf("husb: claiming interfaces. config %d\n", configuration);

   317 

   318     i = 0;

   319     dev_descr_len = dev->descr[0];

   320     if (dev_descr_len > dev->descr_len)

   321         goto fail;

   322     nb_configurations = dev->descr[17];

   323 

   324     i += dev_descr_len;

   325     while (i < dev->descr_len) {

   326         dprintf("husb: i is %d, descr_len is %d, dl %d, dt %d\n", i, dev->descr_len,

   327                dev->descr[i], dev->descr[i+1]);

   328 

   329         if (dev->descr[i+1] != USB_DT_CONFIG) {

   330             i += dev->descr[i];

   331             continue;

   332         }

   333         config_descr_len = dev->descr[i];

   334 

   335 	printf("husb: config #%d need %d\n", dev->descr[i + 5], configuration); 

   336 

   337         if (configuration < 0 || configuration == dev->descr[i + 5]) {

   338             configuration = dev->descr[i + 5];

   339             break;

   340         }

   341 

   342         i += config_descr_len;

   343     }

   344 

   345     if (i >= dev->descr_len) {

   346         fprintf(stderr, "husb: update iface failed. no matching configuration\n");

   347         goto fail;

   348     }

   349     nb_interfaces = dev->descr[i + 4];

   350 

   351 #ifdef USBDEVFS_DISCONNECT

   352     /* earlier Linux 2.4 do not support that */

   353     {

   354         struct usbdevfs_ioctl ctrl;

   355         for (interface = 0; interface < nb_interfaces; interface++) {

   356             ctrl.ioctl_code = USBDEVFS_DISCONNECT;

   357             ctrl.ifno = interface;

   358             ret = ioctl(dev->fd, USBDEVFS_IOCTL, &ctrl);

   359             if (ret < 0 && errno != ENODATA) {

   360                 perror("USBDEVFS_DISCONNECT");

   361                 goto fail;

   362             }

   363         }

   364     }

   365 #endif

   366 

   367     /* XXX: only grab if all interfaces are free */

   368     for (interface = 0; interface < nb_interfaces; interface++) {

   369         ret = ioctl(dev->fd, USBDEVFS_CLAIMINTERFACE, &interface);

   370         if (ret < 0) {

   371             if (errno == EBUSY) {

   372                 printf("husb: update iface. device already grabbed\n");

   373             } else {

   374                 perror("husb: failed to claim interface");

   375             }

   376         fail:

   377             return 0;

   378         }

   379     }

   380 

   381     printf("husb: %d interfaces claimed for configuration %d\n",

   382            nb_interfaces, configuration);

   383 

   384     dev->ninterfaces   = nb_interfaces;

   385     dev->configuration = configuration;

   386     return 1;

   387 }

   388 

   389 static int usb_host_release_interfaces(USBHostDevice *s)

   390 {

   391     int ret, i;

   392 

   393     dprintf("husb: releasing interfaces\n");

   394 

   395     for (i = 0; i < s->ninterfaces; i++) {

   396         ret = ioctl(s->fd, USBDEVFS_RELEASEINTERFACE, &i);

   397         if (ret < 0) {

   398             perror("husb: failed to release interface");

   399             return 0;

   400         }

   401     }

   402 

   403     return 1;

   404 }

   405 

   406 static void usb_host_handle_reset(USBDevice *dev)

   407 {

   408     USBHostDevice *s = (USBHostDevice *) dev;

   409 

   410     dprintf("husb: reset device %u.%u\n", s->bus_num, s->addr);

   411 

   412     ioctl(s->fd, USBDEVFS_RESET);

   413 

   414     usb_host_claim_interfaces(s, s->configuration);

   415 }

   416 

   417 static void usb_host_handle_destroy(USBDevice *dev)

   418 {

   419     USBHostDevice *s = (USBHostDevice *)dev;

   420 

   421     s->closing = 1;

   422 

   423     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);

   424 

   425     hostdev_unlink(s);

   426 

   427     async_complete(s);

   428 

   429     if (s->fd >= 0)

   430         close(s->fd);

   431 

   432     qemu_free(s);

   433 }

   434 

   435 static int usb_linux_update_endp_table(USBHostDevice *s);

   436 

   437 static int usb_host_handle_data(USBHostDevice *s, USBPacket *p)

   438 {

   439     struct usbdevfs_urb *urb;

   440     AsyncURB *aurb;

   441     int ret;

   442 

   443     aurb = async_alloc();

   444     if (!aurb) {

   445         dprintf("husb: async malloc failed\n");

   446         return USB_RET_NAK;

   447     }

   448     aurb->hdev   = s;

   449     aurb->packet = p;

   450 

   451     urb = &aurb->urb;

   452 

   453     if (p->pid == USB_TOKEN_IN)

   454     	urb->endpoint = p->devep | 0x80;

   455     else

   456     	urb->endpoint = p->devep;

   457 

   458     if (is_halted(s, p->devep)) {

   459 	ret = ioctl(s->fd, USBDEVFS_CLEAR_HALT, &urb->endpoint);

   460         if (ret < 0) {

   461             dprintf("husb: failed to clear halt. ep 0x%x errno %d\n", 

   462                    urb->endpoint, errno);

   463             return USB_RET_NAK;

   464         }

   465         clear_halt(s, p->devep);

   466     }

   467 

   468     urb->buffer        = p->data;

   469     urb->buffer_length = p->len;

   470 

   471     if (is_isoc(s, p->devep)) {

   472         /* Setup ISOC transfer */

   473         urb->type     = USBDEVFS_URB_TYPE_ISO;

   474         urb->flags    = USBDEVFS_URB_ISO_ASAP;

   475         urb->number_of_packets = 1;

   476         urb->iso_frame_desc[0].length = p->len;

   477     } else {

   478         /* Setup bulk transfer */

   479         urb->type     = USBDEVFS_URB_TYPE_BULK;

   480     }

   481 

   482     urb->usercontext = s;

   483 

   484     ret = ioctl(s->fd, USBDEVFS_SUBMITURB, urb);

   485 

   486     dprintf("husb: data submit. ep 0x%x len %u aurb %p\n", urb->endpoint, p->len, aurb);

   487 

   488     if (ret < 0) {

   489         dprintf("husb: submit failed. errno %d\n", errno);

   490         async_free(aurb);

   491 

   492         switch(errno) {

   493         case ETIMEDOUT:

   494             return USB_RET_NAK;

   495         case EPIPE:

   496         default:

   497             return USB_RET_STALL;

   498         }

   499     }

   500 

   501     usb_defer_packet(p, async_cancel, aurb);

   502     return USB_RET_ASYNC;

   503 }

   504 

   505 static int ctrl_error(void)

   506 {

   507     if (errno == ETIMEDOUT)

   508         return USB_RET_NAK;

   509     else 

   510         return USB_RET_STALL;

   511 }

   512 

   513 static int usb_host_set_address(USBHostDevice *s, int addr)

   514 {

   515     dprintf("husb: ctrl set addr %u\n", addr);

   516     s->dev.addr = addr;

   517     return 0;

   518 }

   519 

   520 static int usb_host_set_config(USBHostDevice *s, int config)

   521 {

   522     usb_host_release_interfaces(s);

   523 

   524     int ret = ioctl(s->fd, USBDEVFS_SETCONFIGURATION, &config);

   525  

   526     dprintf("husb: ctrl set config %d ret %d errno %d\n", config, ret, errno);

   527     

   528     if (ret < 0)

   529         return ctrl_error();

   530  

   531     usb_host_claim_interfaces(s, config);

   532     return 0;

   533 }

   534 

   535 static int usb_host_set_interface(USBHostDevice *s, int iface, int alt)

   536 {

   537     struct usbdevfs_setinterface si;

   538     int ret;

   539 

   540     si.interface  = iface;

   541     si.altsetting = alt;

   542     ret = ioctl(s->fd, USBDEVFS_SETINTERFACE, &si);

   543     

   544     dprintf("husb: ctrl set iface %d altset %d ret %d errno %d\n", 

   545     	iface, alt, ret, errno);

   546     

   547     if (ret < 0)

   548         return ctrl_error();

   549 

   550     usb_linux_update_endp_table(s);

   551     return 0;

   552 }

   553 

   554 static int usb_host_handle_control(USBHostDevice *s, USBPacket *p)

   555 {

   556     struct usbdevfs_urb *urb;

   557     AsyncURB *aurb;

   558     int ret, value, index;

   559 

   560     /* 

   561      * Process certain standard device requests.

   562      * These are infrequent and are processed synchronously.

   563      */

   564     value = le16_to_cpu(s->ctrl.req.wValue);

   565     index = le16_to_cpu(s->ctrl.req.wIndex);

   566 

   567     dprintf("husb: ctrl type 0x%x req 0x%x val 0x%x index %u len %u\n",

   568         s->ctrl.req.bRequestType, s->ctrl.req.bRequest, value, index, 

   569         s->ctrl.len);

   570 

   571     if (s->ctrl.req.bRequestType == 0) {

   572         switch (s->ctrl.req.bRequest) {

   573         case USB_REQ_SET_ADDRESS:

   574             return usb_host_set_address(s, value);

   575 

   576         case USB_REQ_SET_CONFIGURATION:

   577             return usb_host_set_config(s, value & 0xff);

   578         }

   579     }

   580 

   581     if (s->ctrl.req.bRequestType == 1 &&

   582                   s->ctrl.req.bRequest == USB_REQ_SET_INTERFACE)

   583         return usb_host_set_interface(s, index, value);

   584 

   585     /* The rest are asynchronous */

   586 

   587     aurb = async_alloc();

   588     if (!aurb) {

   589         dprintf("husb: async malloc failed\n");

   590         return USB_RET_NAK;

   591     }

   592     aurb->hdev   = s;

   593     aurb->packet = p;

   594 

   595     /* 

   596      * Setup ctrl transfer.

   597      *

   598      * s->ctrl is layed out such that data buffer immediately follows

   599      * 'req' struct which is exactly what usbdevfs expects.

   600      */ 

   601     urb = &aurb->urb;

   602 

   603     urb->type     = USBDEVFS_URB_TYPE_CONTROL;

   604     urb->endpoint = p->devep;

   605 

   606     urb->buffer        = &s->ctrl.req;

   607     urb->buffer_length = 8 + s->ctrl.len;

   608 

   609     urb->usercontext = s;

   610 

   611     ret = ioctl(s->fd, USBDEVFS_SUBMITURB, urb);

   612 

   613     dprintf("husb: submit ctrl. len %u aurb %p\n", urb->buffer_length, aurb);

   614 

   615     if (ret < 0) {

   616         dprintf("husb: submit failed. errno %d\n", errno);

   617         async_free(aurb);

   618 

   619         switch(errno) {

   620         case ETIMEDOUT:

   621             return USB_RET_NAK;

   622         case EPIPE:

   623         default:

   624             return USB_RET_STALL;

   625         }

   626     }

   627 

   628     usb_defer_packet(p, async_cancel, aurb);

   629     return USB_RET_ASYNC;

   630 }

   631 

   632 static int do_token_setup(USBDevice *dev, USBPacket *p)

   633 {

   634     USBHostDevice *s = (USBHostDevice *) dev;

   635     int ret = 0;

   636 

   637     if (p->len != 8)

   638         return USB_RET_STALL;

   639  

   640     memcpy(&s->ctrl.req, p->data, 8);

   641     s->ctrl.len    = le16_to_cpu(s->ctrl.req.wLength);

   642     s->ctrl.offset = 0;

   643     s->ctrl.state  = CTRL_STATE_SETUP;

   644 

   645     if (s->ctrl.req.bRequestType & USB_DIR_IN) {

   646         ret = usb_host_handle_control(s, p);

   647         if (ret < 0)

   648             return ret;

   649 

   650         if (ret < s->ctrl.len)

   651             s->ctrl.len = ret;

   652         s->ctrl.state = CTRL_STATE_DATA;

   653     } else {

   654         if (s->ctrl.len == 0)

   655             s->ctrl.state = CTRL_STATE_ACK;

   656         else

   657             s->ctrl.state = CTRL_STATE_DATA;

   658     }

   659 

   660     return ret;

   661 }

   662 

   663 static int do_token_in(USBDevice *dev, USBPacket *p)

   664 {

   665     USBHostDevice *s = (USBHostDevice *) dev;

   666     int ret = 0;

   667 

   668     if (p->devep != 0)

   669         return usb_host_handle_data(s, p);

   670 

   671     switch(s->ctrl.state) {

   672     case CTRL_STATE_ACK:

   673         if (!(s->ctrl.req.bRequestType & USB_DIR_IN)) {

   674             ret = usb_host_handle_control(s, p);

   675             if (ret == USB_RET_ASYNC)

   676                 return USB_RET_ASYNC;

   677 

   678             s->ctrl.state = CTRL_STATE_IDLE;

   679             return ret > 0 ? 0 : ret;

   680         }

   681 

   682         return 0;

   683 

   684     case CTRL_STATE_DATA:

   685         if (s->ctrl.req.bRequestType & USB_DIR_IN) {

   686             int len = s->ctrl.len - s->ctrl.offset;

   687             if (len > p->len)

   688                 len = p->len;

   689             memcpy(p->data, s->ctrl.buffer + s->ctrl.offset, len);

   690             s->ctrl.offset += len;

   691             if (s->ctrl.offset >= s->ctrl.len)

   692                 s->ctrl.state = CTRL_STATE_ACK;

   693             return len;

   694         }

   695 

   696         s->ctrl.state = CTRL_STATE_IDLE;

   697         return USB_RET_STALL;

   698 

   699     default:

   700         return USB_RET_STALL;

   701     }

   702 }

   703 

   704 static int do_token_out(USBDevice *dev, USBPacket *p)

   705 {

   706     USBHostDevice *s = (USBHostDevice *) dev;

   707 

   708     if (p->devep != 0)

   709         return usb_host_handle_data(s, p);

   710 

   711     switch(s->ctrl.state) {

   712     case CTRL_STATE_ACK:

   713         if (s->ctrl.req.bRequestType & USB_DIR_IN) {

   714             s->ctrl.state = CTRL_STATE_IDLE;

   715             /* transfer OK */

   716         } else {

   717             /* ignore additional output */

   718         }

   719         return 0;

   720 

   721     case CTRL_STATE_DATA:

   722         if (!(s->ctrl.req.bRequestType & USB_DIR_IN)) {

   723             int len = s->ctrl.len - s->ctrl.offset;

   724             if (len > p->len)

   725                 len = p->len;

   726             memcpy(s->ctrl.buffer + s->ctrl.offset, p->data, len);

   727             s->ctrl.offset += len;

   728             if (s->ctrl.offset >= s->ctrl.len)

   729                 s->ctrl.state = CTRL_STATE_ACK;

   730             return len;

   731         }

   732 

   733         s->ctrl.state = CTRL_STATE_IDLE;

   734         return USB_RET_STALL;

   735 

   736     default:

   737         return USB_RET_STALL;

   738     }

   739 }

   740 

   741 /*

   742  * Packet handler.

   743  * Called by the HC (host controller).

   744  *

   745  * Returns length of the transaction or one of the USB_RET_XXX codes.

   746  */

   747 static int usb_host_handle_packet(USBDevice *s, USBPacket *p)

   748 {

   749     switch(p->pid) {

   750     case USB_MSG_ATTACH:

   751         s->state = USB_STATE_ATTACHED;

   752         return 0;

   753 

   754     case USB_MSG_DETACH:

   755         s->state = USB_STATE_NOTATTACHED;

   756         return 0;

   757 

   758     case USB_MSG_RESET:

   759         s->remote_wakeup = 0;

   760         s->addr = 0;

   761         s->state = USB_STATE_DEFAULT;

   762         s->handle_reset(s);

   763         return 0;

   764     }

   765 

   766     /* Rest of the PIDs must match our address */

   767     if (s->state < USB_STATE_DEFAULT || p->devaddr != s->addr)

   768         return USB_RET_NODEV;

   769 

   770     switch (p->pid) {

   771     case USB_TOKEN_SETUP:

   772         return do_token_setup(s, p);

   773 

   774     case USB_TOKEN_IN:

   775         return do_token_in(s, p);

   776 

   777     case USB_TOKEN_OUT:

   778         return do_token_out(s, p);

   779  

   780     default:

   781         return USB_RET_STALL;

   782     }

   783 }

   784 

   785 /* returns 1 on problem encountered or 0 for success */

   786 static int usb_linux_update_endp_table(USBHostDevice *s)

   787 {

   788     uint8_t *descriptors;

   789     uint8_t devep, type, configuration, alt_interface;

   790     struct usb_ctrltransfer ct;

   791     int interface, ret, length, i;

   792 

   793     ct.bRequestType = USB_DIR_IN;

   794     ct.bRequest = USB_REQ_GET_CONFIGURATION;

   795     ct.wValue = 0;

   796     ct.wIndex = 0;

   797     ct.wLength = 1;

   798     ct.data = &configuration;

   799     ct.timeout = 50;

   800 

   801     ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);

   802     if (ret < 0) {

   803         perror("usb_linux_update_endp_table");

   804         return 1;

   805     }

   806 

   807     /* in address state */

   808     if (configuration == 0)

   809         return 1;

   810 

   811     /* get the desired configuration, interface, and endpoint descriptors

   812      * from device description */

   813     descriptors = &s->descr[18];

   814     length = s->descr_len - 18;

   815     i = 0;

   816 

   817     if (descriptors[i + 1] != USB_DT_CONFIG ||

   818         descriptors[i + 5] != configuration) {

   819         dprintf("invalid descriptor data - configuration\n");

   820         return 1;

   821     }

   822     i += descriptors[i];

   823 

   824     while (i < length) {

   825         if (descriptors[i + 1] != USB_DT_INTERFACE ||

   826             (descriptors[i + 1] == USB_DT_INTERFACE &&

   827              descriptors[i + 4] == 0)) {

   828             i += descriptors[i];

   829             continue;

   830         }

   831 

   832         interface = descriptors[i + 2];

   833 

   834         ct.bRequestType = USB_DIR_IN | USB_RECIP_INTERFACE;

   835         ct.bRequest = USB_REQ_GET_INTERFACE;

   836         ct.wValue = 0;

   837         ct.wIndex = interface;

   838         ct.wLength = 1;

   839         ct.data = &alt_interface;

   840         ct.timeout = 50;

   841 

   842         ret = ioctl(s->fd, USBDEVFS_CONTROL, &ct);

   843         if (ret < 0) {

   844             perror("usb_linux_update_endp_table");

   845             return 1;

   846         }

   847 

   848         /* the current interface descriptor is the active interface

   849          * and has endpoints */

   850         if (descriptors[i + 3] != alt_interface) {

   851             i += descriptors[i];

   852             continue;

   853         }

   854 

   855         /* advance to the endpoints */

   856         while (i < length && descriptors[i +1] != USB_DT_ENDPOINT)

   857             i += descriptors[i];

   858 

   859         if (i >= length)

   860             break;

   861 

   862         while (i < length) {

   863             if (descriptors[i + 1] != USB_DT_ENDPOINT)

   864                 break;

   865 

   866             devep = descriptors[i + 2];

   867             switch (descriptors[i + 3] & 0x3) {

   868             case 0x00:

   869                 type = USBDEVFS_URB_TYPE_CONTROL;

   870                 break;

   871             case 0x01:

   872                 type = USBDEVFS_URB_TYPE_ISO;

   873                 break;

   874             case 0x02:

   875                 type = USBDEVFS_URB_TYPE_BULK;

   876                 break;

   877             case 0x03:

   878                 type = USBDEVFS_URB_TYPE_INTERRUPT;

   879                 break;

   880             default:

   881                 dprintf("usb_host: malformed endpoint type\n");

   882                 type = USBDEVFS_URB_TYPE_BULK;

   883             }

   884             s->endp_table[(devep & 0xf) - 1].type = type;

   885             s->endp_table[(devep & 0xf) - 1].halted = 0;

   886 

   887             i += descriptors[i];

   888         }

   889     }

   890     return 0;

   891 }

   892 

   893 static USBDevice *usb_host_device_open_addr(int bus_num, int addr, const char *prod_name)

   894 {

   895     int fd = -1, ret;

   896     USBHostDevice *dev = NULL;

   897     struct usbdevfs_connectinfo ci;

   898     char buf[1024];

   899 

   900     dev = qemu_mallocz(sizeof(USBHostDevice));

   901     if (!dev)

   902         goto fail;

   903 

   904     dev->bus_num = bus_num;

   905     dev->addr = addr;

   906 

   907     printf("husb: open device %d.%d\n", bus_num, addr);

   908 

   909     if (!usb_host_device_path) {

   910         perror("husb: USB Host Device Path not set");

   911         goto fail;

   912     }

   913     snprintf(buf, sizeof(buf), "%s/%03d/%03d", usb_host_device_path,

   914              bus_num, addr);

   915     fd = open(buf, O_RDWR | O_NONBLOCK);

   916     if (fd < 0) {

   917         perror(buf);

   918         goto fail;

   919     }

   920     dprintf("husb: opened %s\n", buf);

   921 

   922     /* read the device description */

   923     dev->descr_len = read(fd, dev->descr, sizeof(dev->descr));

   924     if (dev->descr_len <= 0) {

   925         perror("husb: reading device data failed");

   926         goto fail;

   927     }

   928 

   929 #ifdef DEBUG

   930     {

   931         int x;

   932         printf("=== begin dumping device descriptor data ===\n");

   933         for (x = 0; x < dev->descr_len; x++)

   934             printf("%02x ", dev->descr[x]);

   935         printf("\n=== end dumping device descriptor data ===\n");

   936     }

   937 #endif

   938 

   939     dev->fd = fd;

   940 

   941     /* 

   942      * Initial configuration is -1 which makes us claim first 

   943      * available config. We used to start with 1, which does not

   944      * always work. I've seen devices where first config starts 

   945      * with 2.

   946      */

   947     if (!usb_host_claim_interfaces(dev, -1))

   948         goto fail;

   949 

   950     ret = ioctl(fd, USBDEVFS_CONNECTINFO, &ci);

   951     if (ret < 0) {

   952         perror("usb_host_device_open: USBDEVFS_CONNECTINFO");

   953         goto fail;

   954     }

   955 

   956     printf("husb: grabbed usb device %d.%d\n", bus_num, addr);

   957 

   958     ret = usb_linux_update_endp_table(dev);

   959     if (ret)

   960         goto fail;

   961 

   962     if (ci.slow)

   963         dev->dev.speed = USB_SPEED_LOW;

   964     else

   965         dev->dev.speed = USB_SPEED_HIGH;

   966 

   967     dev->dev.handle_packet  = usb_host_handle_packet;

   968     dev->dev.handle_reset   = usb_host_handle_reset;

   969     dev->dev.handle_destroy = usb_host_handle_destroy;

   970 

   971     if (!prod_name || prod_name[0] == '\0')

   972         snprintf(dev->dev.devname, sizeof(dev->dev.devname),

   973                  "host:%d.%d", bus_num, addr);

   974     else

   975         pstrcpy(dev->dev.devname, sizeof(dev->dev.devname),

   976                 prod_name);

   977 

   978     /* USB devio uses 'write' flag to check for async completions */

   979     qemu_set_fd_handler(dev->fd, NULL, async_complete, dev);

   980 

   981     hostdev_link(dev);

   982 

   983     return (USBDevice *) dev;

   984 

   985 fail:

   986     if (dev)

   987         qemu_free(dev);

   988 

   989     close(fd);

   990     return NULL;

   991 }

   992 

   993 static int usb_host_auto_add(const char *spec);

   994 static int usb_host_auto_del(const char *spec);

   995 

   996 USBDevice *usb_host_device_open(const char *devname)

   997 {

   998     int bus_num, addr;

   999     char product_name[PRODUCT_NAME_SZ];

  1000 

  1001     if (strstr(devname, "auto:")) {

  1002         usb_host_auto_add(devname);

  1003         return NULL;

  1004     }

  1005 

  1006     if (usb_host_find_device(&bus_num, &addr, product_name, sizeof(product_name),

  1007                              devname) < 0)

  1008         return NULL;

  1009 

  1010     if (hostdev_find(bus_num, addr)) {

  1011        term_printf("husb: host usb device %d.%d is already open\n", bus_num, addr);

  1012        return NULL;

  1013     }

  1014 

  1015     return usb_host_device_open_addr(bus_num, addr, product_name);

  1016 }

  1017 

  1018 int usb_host_device_close(const char *devname)

  1019 {

  1020     char product_name[PRODUCT_NAME_SZ];

  1021     int bus_num, addr;

  1022     USBHostDevice *s;

  1023 

  1024     if (strstr(devname, "auto:"))

  1025         return usb_host_auto_del(devname);

  1026 

  1027     if (usb_host_find_device(&bus_num, &addr, product_name, sizeof(product_name),

  1028                              devname) < 0)

  1029         return -1;

  1030  

  1031     s = hostdev_find(bus_num, addr);

  1032     if (s) {

  1033         usb_device_del_addr(0, s->dev.addr);

  1034         return 0;

  1035     }

  1036 

  1037     return -1;

  1038 }

  1039  

  1040 static int get_tag_value(char *buf, int buf_size,

  1041                          const char *str, const char *tag,

  1042                          const char *stopchars)

  1043 {

  1044     const char *p;

  1045     char *q;

  1046     p = strstr(str, tag);

  1047     if (!p)

  1048         return -1;

  1049     p += strlen(tag);

  1050     while (qemu_isspace(*p))

  1051         p++;

  1052     q = buf;

  1053     while (*p != '\0' && !strchr(stopchars, *p)) {

  1054         if ((q - buf) < (buf_size - 1))

  1055             *q++ = *p;

  1056         p++;

  1057     }

  1058     *q = '\0';

  1059     return q - buf;

  1060 }

  1061 

  1062 /*

  1063  * Use /proc/bus/usb/devices or /dev/bus/usb/devices file to determine

  1064  * host's USB devices. This is legacy support since many distributions

  1065  * are moving to /sys/bus/usb

  1066  */

  1067 static int usb_host_scan_dev(void *opaque, USBScanFunc *func)

  1068 {

  1069     FILE *f = 0;

  1070     char line[1024];

  1071     char buf[1024];

  1072     int bus_num, addr, speed, device_count, class_id, product_id, vendor_id;

  1073     char product_name[512];

  1074     int ret = 0;

  1075 

  1076     if (!usb_host_device_path) {

  1077         perror("husb: USB Host Device Path not set");

  1078         goto the_end;

  1079     }

  1080     snprintf(line, sizeof(line), "%s/devices", usb_host_device_path);

  1081     f = fopen(line, "r");

  1082     if (!f) {

  1083         perror("husb: cannot open devices file");

  1084         goto the_end;

  1085     }

  1086 

  1087     device_count = 0;

  1088     bus_num = addr = speed = class_id = product_id = vendor_id = 0;

  1089     for(;;) {

  1090         if (fgets(line, sizeof(line), f) == NULL)

  1091             break;

  1092         if (strlen(line) > 0)

  1093             line[strlen(line) - 1] = '\0';

  1094         if (line[0] == 'T' && line[1] == ':') {

  1095             if (device_count && (vendor_id || product_id)) {

  1096                 /* New device.  Add the previously discovered device.  */

  1097                 ret = func(opaque, bus_num, addr, class_id, vendor_id,

  1098                            product_id, product_name, speed);

  1099                 if (ret)

  1100                     goto the_end;

  1101             }

  1102             if (get_tag_value(buf, sizeof(buf), line, "Bus=", " ") < 0)

  1103                 goto fail;

  1104             bus_num = atoi(buf);

  1105             if (get_tag_value(buf, sizeof(buf), line, "Dev#=", " ") < 0)

  1106                 goto fail;

  1107             addr = atoi(buf);

  1108             if (get_tag_value(buf, sizeof(buf), line, "Spd=", " ") < 0)

  1109                 goto fail;

  1110             if (!strcmp(buf, "480"))

  1111                 speed = USB_SPEED_HIGH;

  1112             else if (!strcmp(buf, "1.5"))

  1113                 speed = USB_SPEED_LOW;

  1114             else

  1115                 speed = USB_SPEED_FULL;

  1116             product_name[0] = '\0';

  1117             class_id = 0xff;

  1118             device_count++;

  1119             product_id = 0;

  1120             vendor_id = 0;

  1121         } else if (line[0] == 'P' && line[1] == ':') {

  1122             if (get_tag_value(buf, sizeof(buf), line, "Vendor=", " ") < 0)

  1123                 goto fail;

  1124             vendor_id = strtoul(buf, NULL, 16);

  1125             if (get_tag_value(buf, sizeof(buf), line, "ProdID=", " ") < 0)

  1126                 goto fail;

  1127             product_id = strtoul(buf, NULL, 16);

  1128         } else if (line[0] == 'S' && line[1] == ':') {

  1129             if (get_tag_value(buf, sizeof(buf), line, "Product=", "") < 0)

  1130                 goto fail;

  1131             pstrcpy(product_name, sizeof(product_name), buf);

  1132         } else if (line[0] == 'D' && line[1] == ':') {

  1133             if (get_tag_value(buf, sizeof(buf), line, "Cls=", " (") < 0)

  1134                 goto fail;

  1135             class_id = strtoul(buf, NULL, 16);