?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ehci: Add support for packets with both data and an error status
[qemu.git] / hw / usb / hcd-ehci.c
blobee6c9ae302393ed732d1774fdc1b6f6d21289be8
1 /*
2 * QEMU USB EHCI Emulation
3 *
4 * Copyright(c) 2008 Emutex Ltd. (address@hidden)
5 * Copyright(c) 2011-2012 Red Hat, Inc.
6 *
7 * Red Hat Authors:
8 * Gerd Hoffmann <kraxel@redhat.com>
9 * Hans de Goede <hdegoede@redhat.com>
10 *
11 * EHCI project was started by Mark Burkley, with contributions by
12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14 *
15 *
16 * This library is free software; you can redistribute it and/or
17 * modify it under the terms of the GNU Lesser General Public
18 * License as published by the Free Software Foundation; either
19 * version 2 of the License, or(at your option) any later version.
20 *
21 * This library is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
24 * Lesser General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 #include "hw/usb/hcd-ehci.h"
31
32 /* Capability Registers Base Address - section 2.2 */
33 #define CAPLENGTH 0x0000 /* 1-byte, 0x0001 reserved */
34 #define HCIVERSION 0x0002 /* 2-bytes, i/f version # */
35 #define HCSPARAMS 0x0004 /* 4-bytes, structural params */
36 #define HCCPARAMS 0x0008 /* 4-bytes, capability params */
37 #define EECP HCCPARAMS + 1
38 #define HCSPPORTROUTE1 0x000c
39 #define HCSPPORTROUTE2 0x0010
40
41 #define USBCMD 0x0000
42 #define USBCMD_RUNSTOP (1 << 0) // run / Stop
43 #define USBCMD_HCRESET (1 << 1) // HC Reset
44 #define USBCMD_FLS (3 << 2) // Frame List Size
45 #define USBCMD_FLS_SH 2 // Frame List Size Shift
46 #define USBCMD_PSE (1 << 4) // Periodic Schedule Enable
47 #define USBCMD_ASE (1 << 5) // Asynch Schedule Enable
48 #define USBCMD_IAAD (1 << 6) // Int Asynch Advance Doorbell
49 #define USBCMD_LHCR (1 << 7) // Light Host Controller Reset
50 #define USBCMD_ASPMC (3 << 8) // Async Sched Park Mode Count
51 #define USBCMD_ASPME (1 << 11) // Async Sched Park Mode Enable
52 #define USBCMD_ITC (0x7f << 16) // Int Threshold Control
53 #define USBCMD_ITC_SH 16 // Int Threshold Control Shift
54
55 #define USBSTS 0x0004
56 #define USBSTS_RO_MASK 0x0000003f
57 #define USBSTS_INT (1 << 0) // USB Interrupt
58 #define USBSTS_ERRINT (1 << 1) // Error Interrupt
59 #define USBSTS_PCD (1 << 2) // Port Change Detect
60 #define USBSTS_FLR (1 << 3) // Frame List Rollover
61 #define USBSTS_HSE (1 << 4) // Host System Error
62 #define USBSTS_IAA (1 << 5) // Interrupt on Async Advance
63 #define USBSTS_HALT (1 << 12) // HC Halted
64 #define USBSTS_REC (1 << 13) // Reclamation
65 #define USBSTS_PSS (1 << 14) // Periodic Schedule Status
66 #define USBSTS_ASS (1 << 15) // Asynchronous Schedule Status
67
68 /*
69 * Interrupt enable bits correspond to the interrupt active bits in USBSTS
70 * so no need to redefine here.
71 */
72 #define USBINTR 0x0008
73 #define USBINTR_MASK 0x0000003f
74
75 #define FRINDEX 0x000c
76 #define CTRLDSSEGMENT 0x0010
77 #define PERIODICLISTBASE 0x0014
78 #define ASYNCLISTADDR 0x0018
79 #define ASYNCLISTADDR_MASK 0xffffffe0
80
81 #define CONFIGFLAG 0x0040
82
83 /*
84 * Bits that are reserved or are read-only are masked out of values
85 * written to us by software
86 */
87 #define PORTSC_RO_MASK 0x007001c0
88 #define PORTSC_RWC_MASK 0x0000002a
89 #define PORTSC_WKOC_E (1 << 22) // Wake on Over Current Enable
90 #define PORTSC_WKDS_E (1 << 21) // Wake on Disconnect Enable
91 #define PORTSC_WKCN_E (1 << 20) // Wake on Connect Enable
92 #define PORTSC_PTC (15 << 16) // Port Test Control
93 #define PORTSC_PTC_SH 16 // Port Test Control shift
94 #define PORTSC_PIC (3 << 14) // Port Indicator Control
95 #define PORTSC_PIC_SH 14 // Port Indicator Control Shift
96 #define PORTSC_POWNER (1 << 13) // Port Owner
97 #define PORTSC_PPOWER (1 << 12) // Port Power
98 #define PORTSC_LINESTAT (3 << 10) // Port Line Status
99 #define PORTSC_LINESTAT_SH 10 // Port Line Status Shift
100 #define PORTSC_PRESET (1 << 8) // Port Reset
101 #define PORTSC_SUSPEND (1 << 7) // Port Suspend
102 #define PORTSC_FPRES (1 << 6) // Force Port Resume
103 #define PORTSC_OCC (1 << 5) // Over Current Change
104 #define PORTSC_OCA (1 << 4) // Over Current Active
105 #define PORTSC_PEDC (1 << 3) // Port Enable/Disable Change
106 #define PORTSC_PED (1 << 2) // Port Enable/Disable
107 #define PORTSC_CSC (1 << 1) // Connect Status Change
108 #define PORTSC_CONNECT (1 << 0) // Current Connect Status
109
110 #define FRAME_TIMER_FREQ 1000
111 #define FRAME_TIMER_NS (1000000000 / FRAME_TIMER_FREQ)
112
113 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints
114 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction
115 #define MAX_QH 100 // Max allowable queue heads in a chain
116 #define MIN_FR_PER_TICK 3 // Min frames to process when catching up
117
118 /* Internal periodic / asynchronous schedule state machine states
119 */
120 typedef enum {
121 EST_INACTIVE = 1000,
122 EST_ACTIVE,
123 EST_EXECUTING,
124 EST_SLEEPING,
125 /* The following states are internal to the state machine function
126 */
127 EST_WAITLISTHEAD,
128 EST_FETCHENTRY,
129 EST_FETCHQH,
130 EST_FETCHITD,
131 EST_FETCHSITD,
132 EST_ADVANCEQUEUE,
133 EST_FETCHQTD,
134 EST_EXECUTE,
135 EST_WRITEBACK,
136 EST_HORIZONTALQH
137 } EHCI_STATES;
138
139 /* macros for accessing fields within next link pointer entry */
140 #define NLPTR_GET(x) ((x) & 0xffffffe0)
141 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
142 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid
143
144 /* link pointer types */
145 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor
146 #define NLPTR_TYPE_QH 1 // queue head
147 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor
148 #define NLPTR_TYPE_FSTN 3 // frame span traversal node
149
150 #define SET_LAST_RUN_CLOCK(s) \
151 (s)->last_run_ns = qemu_get_clock_ns(vm_clock);
152
153 /* nifty macros from Arnon's EHCI version */
154 #define get_field(data, field) \
155 (((data) & field##_MASK) >> field##_SH)
156
157 #define set_field(data, newval, field) do { \
158 uint32_t val = *data; \
159 val &= ~ field##_MASK; \
160 val |= ((newval) << field##_SH) & field##_MASK; \
161 *data = val; \
162 } while(0)
163
164 static const char *ehci_state_names[] = {
165 [EST_INACTIVE] = "INACTIVE",
166 [EST_ACTIVE] = "ACTIVE",
167 [EST_EXECUTING] = "EXECUTING",
168 [EST_SLEEPING] = "SLEEPING",
169 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
170 [EST_FETCHENTRY] = "FETCH ENTRY",
171 [EST_FETCHQH] = "FETCH QH",
172 [EST_FETCHITD] = "FETCH ITD",
173 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
174 [EST_FETCHQTD] = "FETCH QTD",
175 [EST_EXECUTE] = "EXECUTE",
176 [EST_WRITEBACK] = "WRITEBACK",
177 [EST_HORIZONTALQH] = "HORIZONTALQH",
178 };
179
180 static const char *ehci_mmio_names[] = {
181 [USBCMD] = "USBCMD",
182 [USBSTS] = "USBSTS",
183 [USBINTR] = "USBINTR",
184 [FRINDEX] = "FRINDEX",
185 [PERIODICLISTBASE] = "P-LIST BASE",
186 [ASYNCLISTADDR] = "A-LIST ADDR",
187 [CONFIGFLAG] = "CONFIGFLAG",
188 };
189
190 static int ehci_state_executing(EHCIQueue *q);
191 static int ehci_state_writeback(EHCIQueue *q);
192 static int ehci_fill_queue(EHCIPacket *p);
193
194 static const char *nr2str(const char **n, size_t len, uint32_t nr)
195 {
196 if (nr < len && n[nr] != NULL) {
197 return n[nr];
198 } else {
199 return "unknown";
200 }
201 }
202
203 static const char *state2str(uint32_t state)
204 {
205 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
206 }
207
208 static const char *addr2str(hwaddr addr)
209 {
210 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
211 }
212
213 static void ehci_trace_usbsts(uint32_t mask, int state)
214 {
215 /* interrupts */
216 if (mask & USBSTS_INT) {
217 trace_usb_ehci_usbsts("INT", state);
218 }
219 if (mask & USBSTS_ERRINT) {
220 trace_usb_ehci_usbsts("ERRINT", state);
221 }
222 if (mask & USBSTS_PCD) {
223 trace_usb_ehci_usbsts("PCD", state);
224 }
225 if (mask & USBSTS_FLR) {
226 trace_usb_ehci_usbsts("FLR", state);
227 }
228 if (mask & USBSTS_HSE) {
229 trace_usb_ehci_usbsts("HSE", state);
230 }
231 if (mask & USBSTS_IAA) {
232 trace_usb_ehci_usbsts("IAA", state);
233 }
234
235 /* status */
236 if (mask & USBSTS_HALT) {
237 trace_usb_ehci_usbsts("HALT", state);
238 }
239 if (mask & USBSTS_REC) {
240 trace_usb_ehci_usbsts("REC", state);
241 }
242 if (mask & USBSTS_PSS) {
243 trace_usb_ehci_usbsts("PSS", state);
244 }
245 if (mask & USBSTS_ASS) {
246 trace_usb_ehci_usbsts("ASS", state);
247 }
248 }
249
250 static inline void ehci_set_usbsts(EHCIState *s, int mask)
251 {
252 if ((s->usbsts & mask) == mask) {
253 return;
254 }
255 ehci_trace_usbsts(mask, 1);
256 s->usbsts |= mask;
257 }
258
259 static inline void ehci_clear_usbsts(EHCIState *s, int mask)
260 {
261 if ((s->usbsts & mask) == 0) {
262 return;
263 }
264 ehci_trace_usbsts(mask, 0);
265 s->usbsts &= ~mask;
266 }
267
268 /* update irq line */
269 static inline void ehci_update_irq(EHCIState *s)
270 {
271 int level = 0;
272
273 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
274 level = 1;
275 }
276
277 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
278 qemu_set_irq(s->irq, level);
279 }
280
281 /* flag interrupt condition */
282 static inline void ehci_raise_irq(EHCIState *s, int intr)
283 {
284 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
285 s->usbsts |= intr;
286 ehci_update_irq(s);
287 } else {
288 s->usbsts_pending |= intr;
289 }
290 }
291
292 /*
293 * Commit pending interrupts (added via ehci_raise_irq),
294 * at the rate allowed by "Interrupt Threshold Control".
295 */
296 static inline void ehci_commit_irq(EHCIState *s)
297 {
298 uint32_t itc;
299
300 if (!s->usbsts_pending) {
301 return;
302 }
303 if (s->usbsts_frindex > s->frindex) {
304 return;
305 }
306
307 itc = (s->usbcmd >> 16) & 0xff;
308 s->usbsts |= s->usbsts_pending;
309 s->usbsts_pending = 0;
310 s->usbsts_frindex = s->frindex + itc;
311 ehci_update_irq(s);
312 }
313
314 static void ehci_update_halt(EHCIState *s)
315 {
316 if (s->usbcmd & USBCMD_RUNSTOP) {
317 ehci_clear_usbsts(s, USBSTS_HALT);
318 } else {
319 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
320 ehci_set_usbsts(s, USBSTS_HALT);
321 }
322 }
323 }
324
325 static void ehci_set_state(EHCIState *s, int async, int state)
326 {
327 if (async) {
328 trace_usb_ehci_state("async", state2str(state));
329 s->astate = state;
330 if (s->astate == EST_INACTIVE) {
331 ehci_clear_usbsts(s, USBSTS_ASS);
332 ehci_update_halt(s);
333 } else {
334 ehci_set_usbsts(s, USBSTS_ASS);
335 }
336 } else {
337 trace_usb_ehci_state("periodic", state2str(state));
338 s->pstate = state;
339 if (s->pstate == EST_INACTIVE) {
340 ehci_clear_usbsts(s, USBSTS_PSS);
341 ehci_update_halt(s);
342 } else {
343 ehci_set_usbsts(s, USBSTS_PSS);
344 }
345 }
346 }
347
348 static int ehci_get_state(EHCIState *s, int async)
349 {
350 return async ? s->astate : s->pstate;
351 }
352
353 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
354 {
355 if (async) {
356 s->a_fetch_addr = addr;
357 } else {
358 s->p_fetch_addr = addr;
359 }
360 }
361
362 static int ehci_get_fetch_addr(EHCIState *s, int async)
363 {
364 return async ? s->a_fetch_addr : s->p_fetch_addr;
365 }
366
367 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
368 {
369 /* need three here due to argument count limits */
370 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
371 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
372 trace_usb_ehci_qh_fields(addr,
373 get_field(qh->epchar, QH_EPCHAR_RL),
374 get_field(qh->epchar, QH_EPCHAR_MPLEN),
375 get_field(qh->epchar, QH_EPCHAR_EPS),
376 get_field(qh->epchar, QH_EPCHAR_EP),
377 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
378 trace_usb_ehci_qh_bits(addr,
379 (bool)(qh->epchar & QH_EPCHAR_C),
380 (bool)(qh->epchar & QH_EPCHAR_H),
381 (bool)(qh->epchar & QH_EPCHAR_DTC),
382 (bool)(qh->epchar & QH_EPCHAR_I));
383 }
384
385 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
386 {
387 /* need three here due to argument count limits */
388 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
389 trace_usb_ehci_qtd_fields(addr,
390 get_field(qtd->token, QTD_TOKEN_TBYTES),
391 get_field(qtd->token, QTD_TOKEN_CPAGE),
392 get_field(qtd->token, QTD_TOKEN_CERR),
393 get_field(qtd->token, QTD_TOKEN_PID));
394 trace_usb_ehci_qtd_bits(addr,
395 (bool)(qtd->token & QTD_TOKEN_IOC),
396 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
397 (bool)(qtd->token & QTD_TOKEN_HALT),
398 (bool)(qtd->token & QTD_TOKEN_BABBLE),
399 (bool)(qtd->token & QTD_TOKEN_XACTERR));
400 }
401
402 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
403 {
404 trace_usb_ehci_itd(addr, itd->next,
405 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
406 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
407 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
408 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
409 }
410
411 static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
412 EHCIsitd *sitd)
413 {
414 trace_usb_ehci_sitd(addr, sitd->next,
415 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
416 }
417
418 static void ehci_trace_guest_bug(EHCIState *s, const char *message)
419 {
420 trace_usb_ehci_guest_bug(message);
421 fprintf(stderr, "ehci warning: %s\n", message);
422 }
423
424 static inline bool ehci_enabled(EHCIState *s)
425 {
426 return s->usbcmd & USBCMD_RUNSTOP;
427 }
428
429 static inline bool ehci_async_enabled(EHCIState *s)
430 {
431 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
432 }
433
434 static inline bool ehci_periodic_enabled(EHCIState *s)
435 {
436 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
437 }
438
439 /* packet management */
440
441 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
442 {
443 EHCIPacket *p;
444
445 p = g_new0(EHCIPacket, 1);
446 p->queue = q;
447 usb_packet_init(&p->packet);
448 QTAILQ_INSERT_TAIL(&q->packets, p, next);
449 trace_usb_ehci_packet_action(p->queue, p, "alloc");
450 return p;
451 }
452
453 static void ehci_free_packet(EHCIPacket *p)
454 {
455 if (p->async == EHCI_ASYNC_FINISHED) {
456 int state = ehci_get_state(p->queue->ehci, p->queue->async);
457 /* This is a normal, but rare condition (cancel racing completion) */
458 fprintf(stderr, "EHCI: Warning packet completed but not processed\n");
459 ehci_state_executing(p->queue);
460 ehci_state_writeback(p->queue);
461 ehci_set_state(p->queue->ehci, p->queue->async, state);
462 /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
463 return;
464 }
465 trace_usb_ehci_packet_action(p->queue, p, "free");
466 if (p->async == EHCI_ASYNC_INITIALIZED) {
467 usb_packet_unmap(&p->packet, &p->sgl);
468 qemu_sglist_destroy(&p->sgl);
469 }
470 if (p->async == EHCI_ASYNC_INFLIGHT) {
471 usb_cancel_packet(&p->packet);
472 usb_packet_unmap(&p->packet, &p->sgl);
473 qemu_sglist_destroy(&p->sgl);
474 }
475 QTAILQ_REMOVE(&p->queue->packets, p, next);
476 usb_packet_cleanup(&p->packet);
477 g_free(p);
478 }
479
480 /* queue management */
481
482 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
483 {
484 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
485 EHCIQueue *q;
486
487 q = g_malloc0(sizeof(*q));
488 q->ehci = ehci;
489 q->qhaddr = addr;
490 q->async = async;
491 QTAILQ_INIT(&q->packets);
492 QTAILQ_INSERT_HEAD(head, q, next);
493 trace_usb_ehci_queue_action(q, "alloc");
494 return q;
495 }
496
497 static int ehci_cancel_queue(EHCIQueue *q)
498 {
499 EHCIPacket *p;
500 int packets = 0;
501
502 p = QTAILQ_FIRST(&q->packets);
503 if (p == NULL) {
504 return 0;
505 }
506
507 trace_usb_ehci_queue_action(q, "cancel");
508 do {
509 ehci_free_packet(p);
510 packets++;
511 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
512 return packets;
513 }
514
515 static int ehci_reset_queue(EHCIQueue *q)
516 {
517 int packets;
518
519 trace_usb_ehci_queue_action(q, "reset");
520 packets = ehci_cancel_queue(q);
521 q->dev = NULL;
522 q->qtdaddr = 0;
523 return packets;
524 }
525
526 static void ehci_free_queue(EHCIQueue *q, const char *warn)
527 {
528 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
529 int cancelled;
530
531 trace_usb_ehci_queue_action(q, "free");
532 cancelled = ehci_cancel_queue(q);
533 if (warn && cancelled > 0) {
534 ehci_trace_guest_bug(q->ehci, warn);
535 }
536 QTAILQ_REMOVE(head, q, next);
537 g_free(q);
538 }
539
540 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
541 int async)
542 {
543 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
544 EHCIQueue *q;
545
546 QTAILQ_FOREACH(q, head, next) {
547 if (addr == q->qhaddr) {
548 return q;
549 }
550 }
551 return NULL;
552 }
553
554 static void ehci_queues_rip_unused(EHCIState *ehci, int async)
555 {
556 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
557 const char *warn = async ? "guest unlinked busy QH" : NULL;
558 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
559 EHCIQueue *q, *tmp;
560
561 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
562 if (q->seen) {
563 q->seen = 0;
564 q->ts = ehci->last_run_ns;
565 continue;
566 }
567 if (ehci->last_run_ns < q->ts + maxage) {
568 continue;
569 }
570 ehci_free_queue(q, warn);
571 }
572 }
573
574 static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
575 {
576 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
577 EHCIQueue *q, *tmp;
578
579 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
580 if (!q->seen) {
581 ehci_free_queue(q, NULL);
582 }
583 }
584 }
585
586 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
587 {
588 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
589 EHCIQueue *q, *tmp;
590
591 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
592 if (q->dev != dev) {
593 continue;
594 }
595 ehci_free_queue(q, NULL);
596 }
597 }
598
599 static void ehci_queues_rip_all(EHCIState *ehci, int async)
600 {
601 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
602 const char *warn = async ? "guest stopped busy async schedule" : NULL;
603 EHCIQueue *q, *tmp;
604
605 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
606 ehci_free_queue(q, warn);
607 }
608 }
609
610 /* Attach or detach a device on root hub */
611
612 static void ehci_attach(USBPort *port)
613 {
614 EHCIState *s = port->opaque;
615 uint32_t *portsc = &s->portsc[port->index];
616 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
617
618 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
619
620 if (*portsc & PORTSC_POWNER) {
621 USBPort *companion = s->companion_ports[port->index];
622 companion->dev = port->dev;
623 companion->ops->attach(companion);
624 return;
625 }
626
627 *portsc |= PORTSC_CONNECT;
628 *portsc |= PORTSC_CSC;
629
630 ehci_raise_irq(s, USBSTS_PCD);
631 ehci_commit_irq(s);
632 }
633
634 static void ehci_detach(USBPort *port)
635 {
636 EHCIState *s = port->opaque;
637 uint32_t *portsc = &s->portsc[port->index];
638 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
639
640 trace_usb_ehci_port_detach(port->index, owner);
641
642 if (*portsc & PORTSC_POWNER) {
643 USBPort *companion = s->companion_ports[port->index];
644 companion->ops->detach(companion);
645 companion->dev = NULL;
646 /*
647 * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
648 * the port ownership is returned immediately to the EHCI controller."
649 */
650 *portsc &= ~PORTSC_POWNER;
651 return;
652 }
653
654 ehci_queues_rip_device(s, port->dev, 0);
655 ehci_queues_rip_device(s, port->dev, 1);
656
657 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED);
658 *portsc |= PORTSC_CSC;
659
660 ehci_raise_irq(s, USBSTS_PCD);
661 ehci_commit_irq(s);
662 }
663
664 static void ehci_child_detach(USBPort *port, USBDevice *child)
665 {
666 EHCIState *s = port->opaque;
667 uint32_t portsc = s->portsc[port->index];
668
669 if (portsc & PORTSC_POWNER) {
670 USBPort *companion = s->companion_ports[port->index];
671 companion->ops->child_detach(companion, child);
672 return;
673 }
674
675 ehci_queues_rip_device(s, child, 0);
676 ehci_queues_rip_device(s, child, 1);
677 }
678
679 static void ehci_wakeup(USBPort *port)
680 {
681 EHCIState *s = port->opaque;
682 uint32_t portsc = s->portsc[port->index];
683
684 if (portsc & PORTSC_POWNER) {
685 USBPort *companion = s->companion_ports[port->index];
686 if (companion->ops->wakeup) {
687 companion->ops->wakeup(companion);
688 }
689 return;
690 }
691
692 qemu_bh_schedule(s->async_bh);
693 }
694
695 static int ehci_register_companion(USBBus *bus, USBPort *ports[],
696 uint32_t portcount, uint32_t firstport)
697 {
698 EHCIState *s = container_of(bus, EHCIState, bus);
699 uint32_t i;
700
701 if (firstport + portcount > NB_PORTS) {
702 qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport",
703 "firstport on masterbus");
704 error_printf_unless_qmp(
705 "firstport value of %u makes companion take ports %u - %u, which "
706 "is outside of the valid range of 0 - %u\n", firstport, firstport,
707 firstport + portcount - 1, NB_PORTS - 1);
708 return -1;
709 }
710
711 for (i = 0; i < portcount; i++) {
712 if (s->companion_ports[firstport + i]) {
713 qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus",
714 "an USB masterbus");
715 error_printf_unless_qmp(
716 "port %u on masterbus %s already has a companion assigned\n",
717 firstport + i, bus->qbus.name);
718 return -1;
719 }
720 }
721
722 for (i = 0; i < portcount; i++) {
723 s->companion_ports[firstport + i] = ports[i];
724 s->ports[firstport + i].speedmask |=
725 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
726 /* Ensure devs attached before the initial reset go to the companion */
727 s->portsc[firstport + i] = PORTSC_POWNER;
728 }
729
730 s->companion_count++;
731 s->caps[0x05] = (s->companion_count << 4) | portcount;
732
733 return 0;
734 }
735
736 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
737 {
738 USBDevice *dev;
739 USBPort *port;
740 int i;
741
742 for (i = 0; i < NB_PORTS; i++) {
743 port = &ehci->ports[i];
744 if (!(ehci->portsc[i] & PORTSC_PED)) {
745 DPRINTF("Port %d not enabled\n", i);
746 continue;
747 }
748 dev = usb_find_device(port, addr);
749 if (dev != NULL) {
750 return dev;
751 }
752 }
753 return NULL;
754 }
755
756 /* 4.1 host controller initialization */
757 static void ehci_reset(void *opaque)
758 {
759 EHCIState *s = opaque;
760 int i;
761 USBDevice *devs[NB_PORTS];
762
763 trace_usb_ehci_reset();
764
765 /*
766 * Do the detach before touching portsc, so that it correctly gets send to
767 * us or to our companion based on PORTSC_POWNER before the reset.
768 */
769 for(i = 0; i < NB_PORTS; i++) {
770 devs[i] = s->ports[i].dev;
771 if (devs[i] && devs[i]->attached) {
772 usb_detach(&s->ports[i]);
773 }
774 }
775
776 memset(&s->opreg, 0x00, sizeof(s->opreg));
777 memset(&s->portsc, 0x00, sizeof(s->portsc));
778
779 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
780 s->usbsts = USBSTS_HALT;
781 s->usbsts_pending = 0;
782 s->usbsts_frindex = 0;
783
784 s->astate = EST_INACTIVE;
785 s->pstate = EST_INACTIVE;
786
787 for(i = 0; i < NB_PORTS; i++) {
788 if (s->companion_ports[i]) {
789 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
790 } else {
791 s->portsc[i] = PORTSC_PPOWER;
792 }
793 if (devs[i] && devs[i]->attached) {
794 usb_attach(&s->ports[i]);
795 usb_device_reset(devs[i]);
796 }
797 }
798 ehci_queues_rip_all(s, 0);
799 ehci_queues_rip_all(s, 1);
800 qemu_del_timer(s->frame_timer);
801 qemu_bh_cancel(s->async_bh);
802 }
803
804 static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
805 unsigned size)
806 {
807 EHCIState *s = ptr;
808 return s->caps[addr];
809 }
810
811 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
812 unsigned size)
813 {
814 EHCIState *s = ptr;
815 uint32_t val;
816
817 val = s->opreg[addr >> 2];
818 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
819 return val;
820 }
821
822 static uint64_t ehci_port_read(void *ptr, hwaddr addr,
823 unsigned size)
824 {
825 EHCIState *s = ptr;
826 uint32_t val;
827
828 val = s->portsc[addr >> 2];
829 trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
830 return val;
831 }
832
833 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
834 {
835 USBDevice *dev = s->ports[port].dev;
836 uint32_t *portsc = &s->portsc[port];
837 uint32_t orig;
838
839 if (s->companion_ports[port] == NULL)
840 return;
841
842 owner = owner & PORTSC_POWNER;
843 orig = *portsc & PORTSC_POWNER;
844
845 if (!(owner ^ orig)) {
846 return;
847 }
848
849 if (dev && dev->attached) {
850 usb_detach(&s->ports[port]);
851 }
852
853 *portsc &= ~PORTSC_POWNER;
854 *portsc |= owner;
855
856 if (dev && dev->attached) {
857 usb_attach(&s->ports[port]);
858 }
859 }
860
861 static void ehci_port_write(void *ptr, hwaddr addr,
862 uint64_t val, unsigned size)
863 {
864 EHCIState *s = ptr;
865 int port = addr >> 2;
866 uint32_t *portsc = &s->portsc[port];
867 uint32_t old = *portsc;
868 USBDevice *dev = s->ports[port].dev;
869
870 trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
871
872 /* Clear rwc bits */
873 *portsc &= ~(val & PORTSC_RWC_MASK);
874 /* The guest may clear, but not set the PED bit */
875 *portsc &= val | ~PORTSC_PED;
876 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
877 handle_port_owner_write(s, port, val);
878 /* And finally apply RO_MASK */
879 val &= PORTSC_RO_MASK;
880
881 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
882 trace_usb_ehci_port_reset(port, 1);
883 }
884
885 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
886 trace_usb_ehci_port_reset(port, 0);
887 if (dev && dev->attached) {
888 usb_port_reset(&s->ports[port]);
889 *portsc &= ~PORTSC_CSC;
890 }
891
892 /*
893 * Table 2.16 Set the enable bit(and enable bit change) to indicate
894 * to SW that this port has a high speed device attached
895 */
896 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
897 val |= PORTSC_PED;
898 }
899 }
900
901 *portsc &= ~PORTSC_RO_MASK;
902 *portsc |= val;
903 trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
904 }
905
906 static void ehci_opreg_write(void *ptr, hwaddr addr,
907 uint64_t val, unsigned size)
908 {
909 EHCIState *s = ptr;
910 uint32_t *mmio = s->opreg + (addr >> 2);
911 uint32_t old = *mmio;
912 int i;
913
914 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
915
916 switch (addr) {
917 case USBCMD:
918 if (val & USBCMD_HCRESET) {
919 ehci_reset(s);
920 val = s->usbcmd;
921 break;
922 }
923
924 /* not supporting dynamic frame list size at the moment */
925 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
926 fprintf(stderr, "attempt to set frame list size -- value %d\n",
927 (int)val & USBCMD_FLS);
928 val &= ~USBCMD_FLS;
929 }
930
931 if (val & USBCMD_IAAD) {
932 /*
933 * Process IAAD immediately, otherwise the Linux IAAD watchdog may
934 * trigger and re-use a qh without us seeing the unlink.
935 */
936 s->async_stepdown = 0;
937 qemu_bh_schedule(s->async_bh);
938 trace_usb_ehci_doorbell_ring();
939 }
940
941 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
942 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
943 if (s->pstate == EST_INACTIVE) {
944 SET_LAST_RUN_CLOCK(s);
945 }
946 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
947 ehci_update_halt(s);
948 s->async_stepdown = 0;
949 qemu_bh_schedule(s->async_bh);
950 }
951 break;
952
953 case USBSTS:
954 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO
955 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC
956 val = s->usbsts;
957 ehci_update_irq(s);
958 break;
959
960 case USBINTR:
961 val &= USBINTR_MASK;
962 break;
963
964 case FRINDEX:
965 val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */
966 break;
967
968 case CONFIGFLAG:
969 val &= 0x1;
970 if (val) {
971 for(i = 0; i < NB_PORTS; i++)
972 handle_port_owner_write(s, i, 0);
973 }
974 break;
975
976 case PERIODICLISTBASE:
977 if (ehci_periodic_enabled(s)) {
978 fprintf(stderr,
979 "ehci: PERIODIC list base register set while periodic schedule\n"
980 " is enabled and HC is enabled\n");
981 }
982 break;
983
984 case ASYNCLISTADDR:
985 if (ehci_async_enabled(s)) {
986 fprintf(stderr,
987 "ehci: ASYNC list address register set while async schedule\n"
988 " is enabled and HC is enabled\n");
989 }
990 break;
991 }
992
993 *mmio = val;
994 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
995 *mmio, old);
996 }
997
998
999 // TODO : Put in common header file, duplication from usb-ohci.c
1000
1001 /* Get an array of dwords from main memory */
1002 static inline int get_dwords(EHCIState *ehci, uint32_t addr,
1003 uint32_t *buf, int num)
1004 {
1005 int i;
1006
1007 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1008 dma_memory_read(ehci->dma, addr, buf, sizeof(*buf));
1009 *buf = le32_to_cpu(*buf);
1010 }
1011
1012 return 1;
1013 }
1014
1015 /* Put an array of dwords in to main memory */
1016 static inline int put_dwords(EHCIState *ehci, uint32_t addr,
1017 uint32_t *buf, int num)
1018 {
1019 int i;
1020
1021 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1022 uint32_t tmp = cpu_to_le32(*buf);
1023 dma_memory_write(ehci->dma, addr, &tmp, sizeof(tmp));
1024 }
1025
1026 return 1;
1027 }
1028
1029 /*
1030 * Write the qh back to guest physical memory. This step isn't
1031 * in the EHCI spec but we need to do it since we don't share
1032 * physical memory with our guest VM.
1033 *
1034 * The first three dwords are read-only for the EHCI, so skip them
1035 * when writing back the qh.
1036 */
1037 static void ehci_flush_qh(EHCIQueue *q)
1038 {
1039 uint32_t *qh = (uint32_t *) &q->qh;
1040 uint32_t dwords = sizeof(EHCIqh) >> 2;
1041 uint32_t addr = NLPTR_GET(q->qhaddr);
1042
1043 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1044 }
1045
1046 // 4.10.2
1047
1048 static int ehci_qh_do_overlay(EHCIQueue *q)
1049 {
1050 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1051 int i;
1052 int dtoggle;
1053 int ping;
1054 int eps;
1055 int reload;
1056
1057 assert(p != NULL);
1058 assert(p->qtdaddr == q->qtdaddr);
1059
1060 // remember values in fields to preserve in qh after overlay
1061
1062 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1063 ping = q->qh.token & QTD_TOKEN_PING;
1064
1065 q->qh.current_qtd = p->qtdaddr;
1066 q->qh.next_qtd = p->qtd.next;
1067 q->qh.altnext_qtd = p->qtd.altnext;
1068 q->qh.token = p->qtd.token;
1069
1070
1071 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1072 if (eps == EHCI_QH_EPS_HIGH) {
1073 q->qh.token &= ~QTD_TOKEN_PING;
1074 q->qh.token |= ping;
1075 }
1076
1077 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1078 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1079
1080 for (i = 0; i < 5; i++) {
1081 q->qh.bufptr[i] = p->qtd.bufptr[i];
1082 }
1083
1084 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1085 // preserve QH DT bit
1086 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1087 q->qh.token |= dtoggle;
1088 }
1089
1090 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1091 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1092
1093 ehci_flush_qh(q);
1094
1095 return 0;
1096 }
1097
1098 static int ehci_init_transfer(EHCIPacket *p)
1099 {
1100 uint32_t cpage, offset, bytes, plen;
1101 dma_addr_t page;
1102
1103 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1104 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1105 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1106 qemu_sglist_init(&p->sgl, 5, p->queue->ehci->dma);
1107
1108 while (bytes > 0) {
1109 if (cpage > 4) {
1110 fprintf(stderr, "cpage out of range (%d)\n", cpage);
1111 return -1;
1112 }
1113
1114 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1115 page += offset;
1116 plen = bytes;
1117 if (plen > 4096 - offset) {
1118 plen = 4096 - offset;
1119 offset = 0;
1120 cpage++;
1121 }
1122
1123 qemu_sglist_add(&p->sgl, page, plen);
1124 bytes -= plen;
1125 }
1126 return 0;
1127 }
1128
1129 static void ehci_finish_transfer(EHCIQueue *q, int len)
1130 {
1131 uint32_t cpage, offset;
1132
1133 if (len > 0) {
1134 /* update cpage & offset */
1135 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1136 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1137
1138 offset += len;
1139 cpage += offset >> QTD_BUFPTR_SH;
1140 offset &= ~QTD_BUFPTR_MASK;
1141
1142 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1143 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1144 q->qh.bufptr[0] |= offset;
1145 }
1146 }
1147
1148 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1149 {
1150 EHCIPacket *p;
1151 EHCIState *s = port->opaque;
1152 uint32_t portsc = s->portsc[port->index];
1153
1154 if (portsc & PORTSC_POWNER) {
1155 USBPort *companion = s->companion_ports[port->index];
1156 companion->ops->complete(companion, packet);
1157 return;
1158 }
1159
1160 p = container_of(packet, EHCIPacket, packet);
1161 assert(p->async == EHCI_ASYNC_INFLIGHT);
1162
1163 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1164 trace_usb_ehci_packet_action(p->queue, p, "remove");
1165 ehci_free_packet(p);
1166 return;
1167 }
1168
1169 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1170 p->async = EHCI_ASYNC_FINISHED;
1171
1172 if (p->queue->async) {
1173 qemu_bh_schedule(p->queue->ehci->async_bh);
1174 }
1175 }
1176
1177 static void ehci_execute_complete(EHCIQueue *q)
1178 {
1179 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1180 uint32_t tbytes;
1181
1182 assert(p != NULL);
1183 assert(p->qtdaddr == q->qtdaddr);
1184 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1185 p->async == EHCI_ASYNC_FINISHED);
1186
1187 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1188 "status %d, actual_length %d\n",
1189 q->qhaddr, q->qh.next, q->qtdaddr,
1190 p->packet.status, p->packet.actual_length);
1191
1192 switch (p->packet.status) {
1193 case USB_RET_SUCCESS:
1194 break;
1195 case USB_RET_IOERROR:
1196 case USB_RET_NODEV:
1197 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1198 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1199 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1200 break;
1201 case USB_RET_STALL:
1202 q->qh.token |= QTD_TOKEN_HALT;
1203 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1204 break;
1205 case USB_RET_NAK:
1206 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1207 return; /* We're not done yet with this transaction */
1208 case USB_RET_BABBLE:
1209 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1210 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1211 break;
1212 default:
1213 /* should not be triggerable */
1214 fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1215 assert(0);
1216 break;
1217 }
1218
1219 /* TODO check 4.12 for splits */
1220 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1221 if (tbytes && p->pid == USB_TOKEN_IN) {
1222 tbytes -= p->packet.actual_length;
1223 if (tbytes) {
1224 /* 4.15.1.2 must raise int on a short input packet */
1225 ehci_raise_irq(q->ehci, USBSTS_INT);
1226 }
1227 } else {
1228 tbytes = 0;
1229 }
1230 DPRINTF("updating tbytes to %d\n", tbytes);
1231 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1232
1233 ehci_finish_transfer(q, p->packet.actual_length);
1234 usb_packet_unmap(&p->packet, &p->sgl);
1235 qemu_sglist_destroy(&p->sgl);
1236 p->async = EHCI_ASYNC_NONE;
1237
1238 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1239 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1240
1241 if (q->qh.token & QTD_TOKEN_IOC) {
1242 ehci_raise_irq(q->ehci, USBSTS_INT);
1243 if (q->async) {
1244 q->ehci->int_req_by_async = true;
1245 }
1246 }
1247 }
1248
1249 /* 4.10.3 returns "again" */
1250 static int ehci_execute(EHCIPacket *p, const char *action)
1251 {
1252 USBEndpoint *ep;
1253 int endp;
1254 bool spd;
1255
1256 assert(p->async == EHCI_ASYNC_NONE ||
1257 p->async == EHCI_ASYNC_INITIALIZED);
1258
1259 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1260 fprintf(stderr, "Attempting to execute inactive qtd\n");
1261 return -1;
1262 }
1263
1264 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1265 ehci_trace_guest_bug(p->queue->ehci,
1266 "guest requested more bytes than allowed");
1267 return -1;
1268 }
1269
1270 p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH;
1271 switch (p->pid) {
1272 case 0:
1273 p->pid = USB_TOKEN_OUT;
1274 break;
1275 case 1:
1276 p->pid = USB_TOKEN_IN;
1277 break;
1278 case 2:
1279 p->pid = USB_TOKEN_SETUP;
1280 break;
1281 default:
1282 fprintf(stderr, "bad token\n");
1283 break;
1284 }
1285
1286 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1287 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1288
1289 if (p->async == EHCI_ASYNC_NONE) {
1290 if (ehci_init_transfer(p) != 0) {
1291 return -1;
1292 }
1293
1294 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1295 usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr, spd,
1296 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1297 usb_packet_map(&p->packet, &p->sgl);
1298 p->async = EHCI_ASYNC_INITIALIZED;
1299 }
1300
1301 trace_usb_ehci_packet_action(p->queue, p, action);
1302 usb_handle_packet(p->queue->dev, &p->packet);
1303 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1304 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1305 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1306 p->packet.actual_length);
1307
1308 if (p->packet.actual_length > BUFF_SIZE) {
1309 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1310 return -1;
1311 }
1312
1313 return 1;
1314 }
1315
1316 /* 4.7.2
1317 */
1318
1319 static int ehci_process_itd(EHCIState *ehci,
1320 EHCIitd *itd,
1321 uint32_t addr)
1322 {
1323 USBDevice *dev;
1324 USBEndpoint *ep;
1325 uint32_t i, len, pid, dir, devaddr, endp;
1326 uint32_t pg, off, ptr1, ptr2, max, mult;
1327
1328 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1329 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1330 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1331 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1332 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1333
1334 for(i = 0; i < 8; i++) {
1335 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1336 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1337 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1338 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1339 ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
1340 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1341
1342 if (len > max * mult) {
1343 len = max * mult;
1344 }
1345
1346 if (len > BUFF_SIZE) {
1347 return -1;
1348 }
1349
1350 qemu_sglist_init(&ehci->isgl, 2, ehci->dma);
1351 if (off + len > 4096) {
1352 /* transfer crosses page border */
1353 uint32_t len2 = off + len - 4096;
1354 uint32_t len1 = len - len2;
1355 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1356 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1357 } else {
1358 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1359 }
1360
1361 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1362
1363 dev = ehci_find_device(ehci, devaddr);
1364 ep = usb_ep_get(dev, pid, endp);
1365 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1366 usb_packet_setup(&ehci->ipacket, pid, ep, addr, false,
1367 (itd->transact[i] & ITD_XACT_IOC) != 0);
1368 usb_packet_map(&ehci->ipacket, &ehci->isgl);
1369 usb_handle_packet(dev, &ehci->ipacket);
1370 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1371 } else {
1372 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1373 ehci->ipacket.status = USB_RET_NAK;
1374 ehci->ipacket.actual_length = 0;
1375 }
1376 qemu_sglist_destroy(&ehci->isgl);
1377
1378 switch (ehci->ipacket.status) {
1379 case USB_RET_SUCCESS:
1380 break;
1381 default:
1382 fprintf(stderr, "Unexpected iso usb result: %d\n",
1383 ehci->ipacket.status);
1384 /* Fall through */
1385 case USB_RET_IOERROR:
1386 case USB_RET_NODEV:
1387 /* 3.3.2: XACTERR is only allowed on IN transactions */
1388 if (dir) {
1389 itd->transact[i] |= ITD_XACT_XACTERR;
1390 ehci_raise_irq(ehci, USBSTS_ERRINT);
1391 }
1392 break;
1393 case USB_RET_BABBLE:
1394 itd->transact[i] |= ITD_XACT_BABBLE;
1395 ehci_raise_irq(ehci, USBSTS_ERRINT);
1396 break;
1397 case USB_RET_NAK:
1398 /* no data for us, so do a zero-length transfer */
1399 ehci->ipacket.actual_length = 0;
1400 break;
1401 }
1402 if (!dir) {
1403 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1404 ITD_XACT_LENGTH); /* OUT */
1405 } else {
1406 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1407 ITD_XACT_LENGTH); /* IN */
1408 }
1409 if (itd->transact[i] & ITD_XACT_IOC) {
1410 ehci_raise_irq(ehci, USBSTS_INT);
1411 }
1412 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1413 }
1414 }
1415 return 0;
1416 }
1417
1418
1419 /* This state is the entry point for asynchronous schedule
1420 * processing. Entry here consitutes a EHCI start event state (4.8.5)
1421 */
1422 static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1423 {
1424 EHCIqh qh;
1425 int i = 0;
1426 int again = 0;
1427 uint32_t entry = ehci->asynclistaddr;
1428
1429 /* set reclamation flag at start event (4.8.6) */
1430 if (async) {
1431 ehci_set_usbsts(ehci, USBSTS_REC);
1432 }
1433
1434 ehci_queues_rip_unused(ehci, async);
1435
1436 /* Find the head of the list (4.9.1.1) */
1437 for(i = 0; i < MAX_QH; i++) {
1438 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1439 sizeof(EHCIqh) >> 2);
1440 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1441
1442 if (qh.epchar & QH_EPCHAR_H) {
1443 if (async) {
1444 entry |= (NLPTR_TYPE_QH << 1);
1445 }
1446
1447 ehci_set_fetch_addr(ehci, async, entry);
1448 ehci_set_state(ehci, async, EST_FETCHENTRY);
1449 again = 1;
1450 goto out;
1451 }
1452
1453 entry = qh.next;
1454 if (entry == ehci->asynclistaddr) {
1455 break;
1456 }
1457 }
1458
1459 /* no head found for list. */
1460
1461 ehci_set_state(ehci, async, EST_ACTIVE);
1462
1463 out:
1464 return again;
1465 }
1466
1467
1468 /* This state is the entry point for periodic schedule processing as
1469 * well as being a continuation state for async processing.
1470 */
1471 static int ehci_state_fetchentry(EHCIState *ehci, int async)
1472 {
1473 int again = 0;
1474 uint32_t entry = ehci_get_fetch_addr(ehci, async);
1475
1476 if (NLPTR_TBIT(entry)) {
1477 ehci_set_state(ehci, async, EST_ACTIVE);
1478 goto out;
1479 }
1480
1481 /* section 4.8, only QH in async schedule */
1482 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1483 fprintf(stderr, "non queue head request in async schedule\n");
1484 return -1;
1485 }
1486
1487 switch (NLPTR_TYPE_GET(entry)) {
1488 case NLPTR_TYPE_QH:
1489 ehci_set_state(ehci, async, EST_FETCHQH);
1490 again = 1;
1491 break;
1492
1493 case NLPTR_TYPE_ITD:
1494 ehci_set_state(ehci, async, EST_FETCHITD);
1495 again = 1;
1496 break;
1497
1498 case NLPTR_TYPE_STITD:
1499 ehci_set_state(ehci, async, EST_FETCHSITD);
1500 again = 1;
1501 break;
1502
1503 default:
1504 /* TODO: handle FSTN type */
1505 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1506 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1507 return -1;
1508 }
1509
1510 out:
1511 return again;
1512 }
1513
1514 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1515 {
1516 EHCIPacket *p;
1517 uint32_t entry, devaddr, endp;
1518 EHCIQueue *q;
1519 EHCIqh qh;
1520
1521 entry = ehci_get_fetch_addr(ehci, async);
1522 q = ehci_find_queue_by_qh(ehci, entry, async);
1523 if (NULL == q) {
1524 q = ehci_alloc_queue(ehci, entry, async);
1525 }
1526 p = QTAILQ_FIRST(&q->packets);
1527
1528 q->seen++;
1529 if (q->seen > 1) {
1530 /* we are going in circles -- stop processing */
1531 ehci_set_state(ehci, async, EST_ACTIVE);
1532 q = NULL;
1533 goto out;
1534 }
1535
1536 get_dwords(ehci, NLPTR_GET(q->qhaddr),
1537 (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
1538 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1539
1540 /*
1541 * The overlay area of the qh should never be changed by the guest,
1542 * except when idle, in which case the reset is a nop.
1543 */
1544 devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR);
1545 endp = get_field(qh.epchar, QH_EPCHAR_EP);
1546 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
1547 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
1548 (memcmp(&qh.current_qtd, &q->qh.current_qtd,
1549 9 * sizeof(uint32_t)) != 0) ||
1550 (q->dev != NULL && q->dev->addr != devaddr)) {
1551 if (ehci_reset_queue(q) > 0) {
1552 ehci_trace_guest_bug(ehci, "guest updated active QH");
1553 }
1554 p = NULL;
1555 }
1556 q->qh = qh;
1557
1558 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1559 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1560 q->transact_ctr = 4;
1561 }
1562
1563 if (q->dev == NULL) {
1564 q->dev = ehci_find_device(q->ehci, devaddr);
1565 }
1566
1567 if (p && p->async == EHCI_ASYNC_FINISHED) {
1568 /* I/O finished -- continue processing queue */
1569 trace_usb_ehci_packet_action(p->queue, p, "complete");
1570 ehci_set_state(ehci, async, EST_EXECUTING);
1571 goto out;
1572 }
1573
1574 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1575
1576 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1577 if (ehci->usbsts & USBSTS_REC) {
1578 ehci_clear_usbsts(ehci, USBSTS_REC);
1579 } else {
1580 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset"
1581 " - done processing\n", q->qhaddr);
1582 ehci_set_state(ehci, async, EST_ACTIVE);
1583 q = NULL;
1584 goto out;
1585 }
1586 }
1587
1588 #if EHCI_DEBUG
1589 if (q->qhaddr != q->qh.next) {
1590 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1591 q->qhaddr,
1592 q->qh.epchar & QH_EPCHAR_H,
1593 q->qh.token & QTD_TOKEN_HALT,
1594 q->qh.token & QTD_TOKEN_ACTIVE,
1595 q->qh.next);
1596 }
1597 #endif
1598
1599 if (q->qh.token & QTD_TOKEN_HALT) {
1600 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1601
1602 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1603 (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
1604 q->qtdaddr = q->qh.current_qtd;
1605 ehci_set_state(ehci, async, EST_FETCHQTD);
1606
1607 } else {
1608 /* EHCI spec version 1.0 Section 4.10.2 */
1609 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1610 }
1611
1612 out:
1613 return q;
1614 }
1615
1616 static int ehci_state_fetchitd(EHCIState *ehci, int async)
1617 {
1618 uint32_t entry;
1619 EHCIitd itd;
1620
1621 assert(!async);
1622 entry = ehci_get_fetch_addr(ehci, async);
1623
1624 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1625 sizeof(EHCIitd) >> 2);
1626 ehci_trace_itd(ehci, entry, &itd);
1627
1628 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1629 return -1;
1630 }
1631
1632 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1633 sizeof(EHCIitd) >> 2);
1634 ehci_set_fetch_addr(ehci, async, itd.next);
1635 ehci_set_state(ehci, async, EST_FETCHENTRY);
1636
1637 return 1;
1638 }
1639
1640 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1641 {
1642 uint32_t entry;
1643 EHCIsitd sitd;
1644
1645 assert(!async);
1646 entry = ehci_get_fetch_addr(ehci, async);
1647
1648 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1649 sizeof(EHCIsitd) >> 2);
1650 ehci_trace_sitd(ehci, entry, &sitd);
1651
1652 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1653 /* siTD is not active, nothing to do */;
1654 } else {
1655 /* TODO: split transfers are not implemented */
1656 fprintf(stderr, "WARNING: Skipping active siTD\n");
1657 }
1658
1659 ehci_set_fetch_addr(ehci, async, sitd.next);
1660 ehci_set_state(ehci, async, EST_FETCHENTRY);
1661 return 1;
1662 }
1663
1664 /* Section 4.10.2 - paragraph 3 */
1665 static int ehci_state_advqueue(EHCIQueue *q)
1666 {
1667 #if 0
1668 /* TO-DO: 4.10.2 - paragraph 2
1669 * if I-bit is set to 1 and QH is not active
1670 * go to horizontal QH
1671 */
1672 if (I-bit set) {
1673 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1674 goto out;
1675 }
1676 #endif
1677
1678 /*
1679 * want data and alt-next qTD is valid
1680 */
1681 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1682 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1683 q->qtdaddr = q->qh.altnext_qtd;
1684 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1685
1686 /*
1687 * next qTD is valid
1688 */
1689 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1690 q->qtdaddr = q->qh.next_qtd;
1691 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1692
1693 /*
1694 * no valid qTD, try next QH
1695 */
1696 } else {
1697 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1698 }
1699
1700 return 1;
1701 }
1702
1703 /* Section 4.10.2 - paragraph 4 */
1704 static int ehci_state_fetchqtd(EHCIQueue *q)
1705 {
1706 EHCIqtd qtd;
1707 EHCIPacket *p;
1708 int again = 1;
1709
1710 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1711 sizeof(EHCIqtd) >> 2);
1712 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1713
1714 p = QTAILQ_FIRST(&q->packets);
1715 if (p != NULL) {
1716 if (p->qtdaddr != q->qtdaddr ||
1717 (!NLPTR_TBIT(p->qtd.next) && (p->qtd.next != qtd.next)) ||
1718 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) ||
1719 p->qtd.bufptr[0] != qtd.bufptr[0]) {
1720 ehci_cancel_queue(q);
1721 ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD");
1722 p = NULL;
1723 } else {
1724 p->qtd = qtd;
1725 ehci_qh_do_overlay(q);
1726 }
1727 }
1728
1729 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1730 if (p != NULL) {
1731 /* transfer canceled by guest (clear active) */
1732 ehci_cancel_queue(q);
1733 p = NULL;
1734 }
1735 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1736 } else if (p != NULL) {
1737 switch (p->async) {
1738 case EHCI_ASYNC_NONE:
1739 case EHCI_ASYNC_INITIALIZED:
1740 /* Not yet executed (MULT), or previously nacked (int) packet */
1741 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1742 break;
1743 case EHCI_ASYNC_INFLIGHT:
1744 /* Check if the guest has added new tds to the queue */
1745 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head));
1746 /* Unfinished async handled packet, go horizontal */
1747 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1748 break;
1749 case EHCI_ASYNC_FINISHED:
1750 /*
1751 * We get here when advqueue moves to a packet which is already
1752 * finished, which can happen with packets queued up by fill_queue
1753 */
1754 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1755 break;
1756 }
1757 } else {
1758 p = ehci_alloc_packet(q);
1759 p->qtdaddr = q->qtdaddr;
1760 p->qtd = qtd;
1761 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1762 }
1763
1764 return again;
1765 }
1766
1767 static int ehci_state_horizqh(EHCIQueue *q)
1768 {
1769 int again = 0;
1770
1771 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1772 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1773 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1774 again = 1;
1775 } else {
1776 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1777 }
1778
1779 return again;
1780 }
1781
1782 /* Returns "again" */
1783 static int ehci_fill_queue(EHCIPacket *p)
1784 {
1785 USBEndpoint *ep = p->packet.ep;
1786 EHCIQueue *q = p->queue;
1787 EHCIqtd qtd = p->qtd;
1788 uint32_t qtdaddr, start_addr = p->qtdaddr;
1789
1790 for (;;) {
1791 if (NLPTR_TBIT(qtd.next) != 0) {
1792 break;
1793 }
1794 qtdaddr = qtd.next;
1795 /*
1796 * Detect circular td lists, Windows creates these, counting on the
1797 * active bit going low after execution to make the queue stop.
1798 */
1799 if (qtdaddr == start_addr) {
1800 break;
1801 }
1802 get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1803 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
1804 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1805 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1806 break;
1807 }
1808 p = ehci_alloc_packet(q);
1809 p->qtdaddr = qtdaddr;
1810 p->qtd = qtd;
1811 if (ehci_execute(p, "queue") == -1) {
1812 return -1;
1813 }
1814 assert(p->packet.status == USB_RET_ASYNC);
1815 p->async = EHCI_ASYNC_INFLIGHT;
1816 }
1817 usb_device_flush_ep_queue(ep->dev, ep);
1818 return 1;
1819 }
1820
1821 static int ehci_state_execute(EHCIQueue *q)
1822 {
1823 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1824 int again = 0;
1825
1826 assert(p != NULL);
1827 assert(p->qtdaddr == q->qtdaddr);
1828
1829 if (ehci_qh_do_overlay(q) != 0) {
1830 return -1;
1831 }
1832
1833 // TODO verify enough time remains in the uframe as in 4.4.1.1
1834 // TODO write back ptr to async list when done or out of time
1835
1836 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1837 if (!q->async && q->transact_ctr == 0) {
1838 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1839 again = 1;
1840 goto out;
1841 }
1842
1843 if (q->async) {
1844 ehci_set_usbsts(q->ehci, USBSTS_REC);
1845 }
1846
1847 again = ehci_execute(p, "process");
1848 if (again == -1) {
1849 goto out;
1850 }
1851 if (p->packet.status == USB_RET_ASYNC) {
1852 ehci_flush_qh(q);
1853 trace_usb_ehci_packet_action(p->queue, p, "async");
1854 p->async = EHCI_ASYNC_INFLIGHT;
1855 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1856 if (q->async) {
1857 again = ehci_fill_queue(p);
1858 } else {
1859 again = 1;
1860 }
1861 goto out;
1862 }
1863
1864 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1865 again = 1;
1866
1867 out:
1868 return again;
1869 }
1870
1871 static int ehci_state_executing(EHCIQueue *q)
1872 {
1873 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1874
1875 assert(p != NULL);
1876 assert(p->qtdaddr == q->qtdaddr);
1877
1878 ehci_execute_complete(q);
1879
1880 /* 4.10.3 */
1881 if (!q->async && q->transact_ctr > 0) {
1882 q->transact_ctr--;
1883 }
1884
1885 /* 4.10.5 */
1886 if (p->packet.status == USB_RET_NAK) {
1887 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1888 } else {
1889 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1890 }
1891
1892 ehci_flush_qh(q);
1893 return 1;
1894 }
1895
1896
1897 static int ehci_state_writeback(EHCIQueue *q)
1898 {
1899 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1900 uint32_t *qtd, addr;
1901 int again = 0;
1902
1903 /* Write back the QTD from the QH area */
1904 assert(p != NULL);
1905 assert(p->qtdaddr == q->qtdaddr);
1906
1907 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1908 qtd = (uint32_t *) &q->qh.next_qtd;
1909 addr = NLPTR_GET(p->qtdaddr);
1910 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
1911 ehci_free_packet(p);
1912
1913 /*
1914 * EHCI specs say go horizontal here.
1915 *
1916 * We can also advance the queue here for performance reasons. We
1917 * need to take care to only take that shortcut in case we've
1918 * processed the qtd just written back without errors, i.e. halt
1919 * bit is clear.
1920 */
1921 if (q->qh.token & QTD_TOKEN_HALT) {
1922 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1923 again = 1;
1924 } else {
1925 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
1926 again = 1;
1927 }
1928 return again;
1929 }
1930
1931 /*
1932 * This is the state machine that is common to both async and periodic
1933 */
1934
1935 static void ehci_advance_state(EHCIState *ehci, int async)
1936 {
1937 EHCIQueue *q = NULL;
1938 int again;
1939
1940 do {
1941 switch(ehci_get_state(ehci, async)) {
1942 case EST_WAITLISTHEAD:
1943 again = ehci_state_waitlisthead(ehci, async);
1944 break;
1945
1946 case EST_FETCHENTRY:
1947 again = ehci_state_fetchentry(ehci, async);
1948 break;
1949
1950 case EST_FETCHQH:
1951 q = ehci_state_fetchqh(ehci, async);
1952 if (q != NULL) {
1953 assert(q->async == async);
1954 again = 1;
1955 } else {
1956 again = 0;
1957 }
1958 break;
1959
1960 case EST_FETCHITD:
1961 again = ehci_state_fetchitd(ehci, async);
1962 break;
1963
1964 case EST_FETCHSITD:
1965 again = ehci_state_fetchsitd(ehci, async);
1966 break;
1967
1968 case EST_ADVANCEQUEUE:
1969 again = ehci_state_advqueue(q);
1970 break;
1971
1972 case EST_FETCHQTD:
1973 again = ehci_state_fetchqtd(q);
1974 break;
1975
1976 case EST_HORIZONTALQH:
1977 again = ehci_state_horizqh(q);
1978 break;
1979
1980 case EST_EXECUTE:
1981 again = ehci_state_execute(q);
1982 if (async) {
1983 ehci->async_stepdown = 0;
1984 }
1985 break;
1986
1987 case EST_EXECUTING:
1988 assert(q != NULL);
1989 if (async) {
1990 ehci->async_stepdown = 0;
1991 }
1992 again = ehci_state_executing(q);
1993 break;
1994
1995 case EST_WRITEBACK:
1996 assert(q != NULL);
1997 again = ehci_state_writeback(q);
1998 break;
1999
2000 default:
2001 fprintf(stderr, "Bad state!\n");
2002 again = -1;
2003 assert(0);
2004 break;
2005 }
2006
2007 if (again < 0) {
2008 fprintf(stderr, "processing error - resetting ehci HC\n");
2009 ehci_reset(ehci);
2010 again = 0;
2011 }
2012 }
2013 while (again);
2014 }
2015
2016 static void ehci_advance_async_state(EHCIState *ehci)
2017 {
2018 const int async = 1;
2019
2020 switch(ehci_get_state(ehci, async)) {
2021 case EST_INACTIVE:
2022 if (!ehci_async_enabled(ehci)) {
2023 break;
2024 }
2025 ehci_set_state(ehci, async, EST_ACTIVE);
2026 // No break, fall through to ACTIVE
2027
2028 case EST_ACTIVE:
2029 if (!ehci_async_enabled(ehci)) {
2030 ehci_queues_rip_all(ehci, async);
2031 ehci_set_state(ehci, async, EST_INACTIVE);
2032 break;
2033 }
2034
2035 /* make sure guest has acknowledged the doorbell interrupt */
2036 /* TO-DO: is this really needed? */
2037 if (ehci->usbsts & USBSTS_IAA) {
2038 DPRINTF("IAA status bit still set.\n");
2039 break;
2040 }
2041
2042 /* check that address register has been set */
2043 if (ehci->asynclistaddr == 0) {
2044 break;
2045 }
2046
2047 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2048 ehci_advance_state(ehci, async);
2049
2050 /* If the doorbell is set, the guest wants to make a change to the
2051 * schedule. The host controller needs to release cached data.
2052 * (section 4.8.2)
2053 */
2054 if (ehci->usbcmd & USBCMD_IAAD) {
2055 /* Remove all unseen qhs from the async qhs queue */
2056 ehci_queues_rip_unseen(ehci, async);
2057 trace_usb_ehci_doorbell_ack();
2058 ehci->usbcmd &= ~USBCMD_IAAD;
2059 ehci_raise_irq(ehci, USBSTS_IAA);
2060 }
2061 break;
2062
2063 default:
2064 /* this should only be due to a developer mistake */
2065 fprintf(stderr, "ehci: Bad asynchronous state %d. "
2066 "Resetting to active\n", ehci->astate);
2067 assert(0);
2068 }
2069 }
2070
2071 static void ehci_advance_periodic_state(EHCIState *ehci)
2072 {
2073 uint32_t entry;
2074 uint32_t list;
2075 const int async = 0;
2076
2077 // 4.6
2078
2079 switch(ehci_get_state(ehci, async)) {
2080 case EST_INACTIVE:
2081 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2082 ehci_set_state(ehci, async, EST_ACTIVE);
2083 // No break, fall through to ACTIVE
2084 } else
2085 break;
2086
2087 case EST_ACTIVE:
2088 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2089 ehci_queues_rip_all(ehci, async);
2090 ehci_set_state(ehci, async, EST_INACTIVE);
2091 break;
2092 }
2093
2094 list = ehci->periodiclistbase & 0xfffff000;
2095 /* check that register has been set */
2096 if (list == 0) {
2097 break;
2098 }
2099 list |= ((ehci->frindex & 0x1ff8) >> 1);
2100
2101 dma_memory_read(ehci->dma, list, &entry, sizeof entry);
2102 entry = le32_to_cpu(entry);
2103
2104 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n",
2105 ehci->frindex / 8, list, entry);
2106 ehci_set_fetch_addr(ehci, async,entry);
2107 ehci_set_state(ehci, async, EST_FETCHENTRY);
2108 ehci_advance_state(ehci, async);
2109 ehci_queues_rip_unused(ehci, async);
2110 break;
2111
2112 default:
2113 /* this should only be due to a developer mistake */
2114 fprintf(stderr, "ehci: Bad periodic state %d. "
2115 "Resetting to active\n", ehci->pstate);
2116 assert(0);
2117 }
2118 }
2119
2120 static void ehci_update_frindex(EHCIState *ehci, int frames)
2121 {
2122 int i;
2123
2124 if (!ehci_enabled(ehci)) {
2125 return;
2126 }
2127
2128 for (i = 0; i < frames; i++) {
2129 ehci->frindex += 8;
2130
2131 if (ehci->frindex == 0x00002000) {
2132 ehci_raise_irq(ehci, USBSTS_FLR);
2133 }
2134
2135 if (ehci->frindex == 0x00004000) {
2136 ehci_raise_irq(ehci, USBSTS_FLR);
2137 ehci->frindex = 0;
2138 if (ehci->usbsts_frindex >= 0x00004000) {
2139 ehci->usbsts_frindex -= 0x00004000;
2140 } else {
2141 ehci->usbsts_frindex = 0;
2142 }
2143 }
2144 }
2145 }
2146
2147 static void ehci_frame_timer(void *opaque)
2148 {
2149 EHCIState *ehci = opaque;
2150 int need_timer = 0;
2151 int64_t expire_time, t_now;
2152 uint64_t ns_elapsed;
2153 int frames, skipped_frames;
2154 int i;
2155
2156 t_now = qemu_get_clock_ns(vm_clock);
2157 ns_elapsed = t_now - ehci->last_run_ns;
2158 frames = ns_elapsed / FRAME_TIMER_NS;
2159
2160 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2161 need_timer++;
2162 ehci->async_stepdown = 0;
2163
2164 if (frames > ehci->maxframes) {
2165 skipped_frames = frames - ehci->maxframes;
2166 ehci_update_frindex(ehci, skipped_frames);
2167 ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames;
2168 frames -= skipped_frames;
2169 DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames);
2170 }
2171
2172 for (i = 0; i < frames; i++) {
2173 /*
2174 * If we're running behind schedule, we should not catch up
2175 * too fast, as that will make some guests unhappy:
2176 * 1) We must process a minimum of MIN_FR_PER_TICK frames,
2177 * otherwise we will never catch up
2178 * 2) Process frames until the guest has requested an irq (IOC)
2179 */
2180 if (i >= MIN_FR_PER_TICK) {
2181 ehci_commit_irq(ehci);
2182 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2183 break;
2184 }
2185 }
2186 ehci_update_frindex(ehci, 1);
2187 ehci_advance_periodic_state(ehci);
2188 ehci->last_run_ns += FRAME_TIMER_NS;
2189 }
2190 } else {
2191 if (ehci->async_stepdown < ehci->maxframes / 2) {
2192 ehci->async_stepdown++;
2193 }
2194 ehci_update_frindex(ehci, frames);
2195 ehci->last_run_ns += FRAME_TIMER_NS * frames;
2196 }
2197
2198 /* Async is not inside loop since it executes everything it can once
2199 * called
2200 */
2201 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2202 need_timer++;
2203 ehci_advance_async_state(ehci);
2204 }
2205
2206 ehci_commit_irq(ehci);
2207 if (ehci->usbsts_pending) {
2208 need_timer++;
2209 ehci->async_stepdown = 0;
2210 }
2211
2212 if (need_timer) {
2213 /* If we've raised int, we speed up the timer, so that we quickly
2214 * notice any new packets queued up in response */
2215 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2216 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 2);
2217 ehci->int_req_by_async = false;
2218 } else {
2219 expire_time = t_now + (get_ticks_per_sec()
2220 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2221 }
2222 qemu_mod_timer(ehci->frame_timer, expire_time);
2223 }
2224 }
2225
2226 static const MemoryRegionOps ehci_mmio_caps_ops = {
2227 .read = ehci_caps_read,
2228 .valid.min_access_size = 1,
2229 .valid.max_access_size = 4,
2230 .impl.min_access_size = 1,
2231 .impl.max_access_size = 1,
2232 .endianness = DEVICE_LITTLE_ENDIAN,
2233 };
2234
2235 static const MemoryRegionOps ehci_mmio_opreg_ops = {
2236 .read = ehci_opreg_read,
2237 .write = ehci_opreg_write,
2238 .valid.min_access_size = 4,
2239 .valid.max_access_size = 4,
2240 .endianness = DEVICE_LITTLE_ENDIAN,
2241 };
2242
2243 static const MemoryRegionOps ehci_mmio_port_ops = {
2244 .read = ehci_port_read,
2245 .write = ehci_port_write,
2246 .valid.min_access_size = 4,
2247 .valid.max_access_size = 4,
2248 .endianness = DEVICE_LITTLE_ENDIAN,
2249 };
2250
2251 static USBPortOps ehci_port_ops = {
2252 .attach = ehci_attach,
2253 .detach = ehci_detach,
2254 .child_detach = ehci_child_detach,
2255 .wakeup = ehci_wakeup,
2256 .complete = ehci_async_complete_packet,
2257 };
2258
2259 static USBBusOps ehci_bus_ops = {
2260 .register_companion = ehci_register_companion,
2261 };
2262
2263 static int usb_ehci_post_load(void *opaque, int version_id)
2264 {
2265 EHCIState *s = opaque;
2266 int i;
2267
2268 for (i = 0; i < NB_PORTS; i++) {
2269 USBPort *companion = s->companion_ports[i];
2270 if (companion == NULL) {
2271 continue;
2272 }
2273 if (s->portsc[i] & PORTSC_POWNER) {
2274 companion->dev = s->ports[i].dev;
2275 } else {
2276 companion->dev = NULL;
2277 }
2278 }
2279
2280 return 0;
2281 }
2282
2283 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2284 {
2285 EHCIState *ehci = opaque;
2286
2287 /*
2288 * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2289 * schedule in guest memory. We must do the rebuilt ASAP, so that
2290 * USB-devices which have async handled packages have a packet in the
2291 * ep queue to match the completion with.
2292 */
2293 if (state == RUN_STATE_RUNNING) {
2294 ehci_advance_async_state(ehci);
2295 }
2296
2297 /*
2298 * The schedule rebuilt from guest memory could cause the migration dest
2299 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2300 * will never have existed on the destination. Therefor we must flush the
2301 * async schedule on savevm to catch any not yet noticed unlinks.
2302 */
2303 if (state == RUN_STATE_SAVE_VM) {
2304 ehci_advance_async_state(ehci);
2305 ehci_queues_rip_unseen(ehci, 1);
2306 }
2307 }
2308
2309 const VMStateDescription vmstate_ehci = {
2310 .name = "ehci-core",
2311 .version_id = 2,
2312 .minimum_version_id = 1,
2313 .post_load = usb_ehci_post_load,
2314 .fields = (VMStateField[]) {
2315 /* mmio registers */
2316 VMSTATE_UINT32(usbcmd, EHCIState),
2317 VMSTATE_UINT32(usbsts, EHCIState),
2318 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2319 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2320 VMSTATE_UINT32(usbintr, EHCIState),
2321 VMSTATE_UINT32(frindex, EHCIState),
2322 VMSTATE_UINT32(ctrldssegment, EHCIState),
2323 VMSTATE_UINT32(periodiclistbase, EHCIState),
2324 VMSTATE_UINT32(asynclistaddr, EHCIState),
2325 VMSTATE_UINT32(configflag, EHCIState),
2326 VMSTATE_UINT32(portsc[0], EHCIState),
2327 VMSTATE_UINT32(portsc[1], EHCIState),
2328 VMSTATE_UINT32(portsc[2], EHCIState),
2329 VMSTATE_UINT32(portsc[3], EHCIState),
2330 VMSTATE_UINT32(portsc[4], EHCIState),
2331 VMSTATE_UINT32(portsc[5], EHCIState),
2332 /* frame timer */
2333 VMSTATE_TIMER(frame_timer, EHCIState),
2334 VMSTATE_UINT64(last_run_ns, EHCIState),
2335 VMSTATE_UINT32(async_stepdown, EHCIState),
2336 /* schedule state */
2337 VMSTATE_UINT32(astate, EHCIState),
2338 VMSTATE_UINT32(pstate, EHCIState),
2339 VMSTATE_UINT32(a_fetch_addr, EHCIState),
2340 VMSTATE_UINT32(p_fetch_addr, EHCIState),
2341 VMSTATE_END_OF_LIST()
2342 }
2343 };
2344
2345 void usb_ehci_initfn(EHCIState *s, DeviceState *dev)
2346 {
2347 int i;
2348
2349 /* 2.2 host controller interface version */
2350 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2351 s->caps[0x01] = 0x00;
2352 s->caps[0x02] = 0x00;
2353 s->caps[0x03] = 0x01; /* HC version */
2354 s->caps[0x04] = NB_PORTS; /* Number of downstream ports */
2355 s->caps[0x05] = 0x00; /* No companion ports at present */
2356 s->caps[0x06] = 0x00;
2357 s->caps[0x07] = 0x00;
2358 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
2359 s->caps[0x0a] = 0x00;
2360 s->caps[0x0b] = 0x00;
2361
2362 usb_bus_new(&s->bus, &ehci_bus_ops, dev);
2363 for(i = 0; i < NB_PORTS; i++) {
2364 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2365 USB_SPEED_MASK_HIGH);
2366 s->ports[i].dev = 0;
2367 }
2368
2369 s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
2370 s->async_bh = qemu_bh_new(ehci_frame_timer, s);
2371 QTAILQ_INIT(&s->aqueues);
2372 QTAILQ_INIT(&s->pqueues);
2373 usb_packet_init(&s->ipacket);
2374
2375 qemu_register_reset(ehci_reset, s);
2376 qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2377
2378 memory_region_init(&s->mem, "ehci", MMIO_SIZE);
2379 memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
2380 "capabilities", CAPA_SIZE);
2381 memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
2382 "operational", PORTSC_BEGIN);
2383 memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
2384 "ports", PORTSC_END - PORTSC_BEGIN);
2385
2386 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2387 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2388 memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN,
2389 &s->mem_ports);
2390 }
2391
2392 /*
2393 * vim: expandtab ts=4
2394 */
QEmu