?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ehci: Lower timer freq when the periodic schedule is idle
[qemu/ar7.git] / hw / usb / hcd-ehci.c
blob7536837fb2091721b4500763a0ce6dddfbc737d9
1 /*
2 * QEMU USB EHCI Emulation
3 *
4 * Copyright(c) 2008 Emutex Ltd. (address@hidden)
5 * Copyright(c) 2011-2012 Red Hat, Inc.
6 *
7 * Red Hat Authors:
8 * Gerd Hoffmann <kraxel@redhat.com>
9 * Hans de Goede <hdegoede@redhat.com>
10 *
11 * EHCI project was started by Mark Burkley, with contributions by
12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14 *
15 *
16 * This library is free software; you can redistribute it and/or
17 * modify it under the terms of the GNU Lesser General Public
18 * License as published by the Free Software Foundation; either
19 * version 2 of the License, or(at your option) any later version.
20 *
21 * This library is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
24 * Lesser General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 #include "hw/usb/hcd-ehci.h"
31
32 /* Capability Registers Base Address - section 2.2 */
33 #define CAPLENGTH 0x0000 /* 1-byte, 0x0001 reserved */
34 #define HCIVERSION 0x0002 /* 2-bytes, i/f version # */
35 #define HCSPARAMS 0x0004 /* 4-bytes, structural params */
36 #define HCCPARAMS 0x0008 /* 4-bytes, capability params */
37 #define EECP HCCPARAMS + 1
38 #define HCSPPORTROUTE1 0x000c
39 #define HCSPPORTROUTE2 0x0010
40
41 #define USBCMD 0x0000
42 #define USBCMD_RUNSTOP (1 << 0) // run / Stop
43 #define USBCMD_HCRESET (1 << 1) // HC Reset
44 #define USBCMD_FLS (3 << 2) // Frame List Size
45 #define USBCMD_FLS_SH 2 // Frame List Size Shift
46 #define USBCMD_PSE (1 << 4) // Periodic Schedule Enable
47 #define USBCMD_ASE (1 << 5) // Asynch Schedule Enable
48 #define USBCMD_IAAD (1 << 6) // Int Asynch Advance Doorbell
49 #define USBCMD_LHCR (1 << 7) // Light Host Controller Reset
50 #define USBCMD_ASPMC (3 << 8) // Async Sched Park Mode Count
51 #define USBCMD_ASPME (1 << 11) // Async Sched Park Mode Enable
52 #define USBCMD_ITC (0x7f << 16) // Int Threshold Control
53 #define USBCMD_ITC_SH 16 // Int Threshold Control Shift
54
55 #define USBSTS 0x0004
56 #define USBSTS_RO_MASK 0x0000003f
57 #define USBSTS_INT (1 << 0) // USB Interrupt
58 #define USBSTS_ERRINT (1 << 1) // Error Interrupt
59 #define USBSTS_PCD (1 << 2) // Port Change Detect
60 #define USBSTS_FLR (1 << 3) // Frame List Rollover
61 #define USBSTS_HSE (1 << 4) // Host System Error
62 #define USBSTS_IAA (1 << 5) // Interrupt on Async Advance
63 #define USBSTS_HALT (1 << 12) // HC Halted
64 #define USBSTS_REC (1 << 13) // Reclamation
65 #define USBSTS_PSS (1 << 14) // Periodic Schedule Status
66 #define USBSTS_ASS (1 << 15) // Asynchronous Schedule Status
67
68 /*
69 * Interrupt enable bits correspond to the interrupt active bits in USBSTS
70 * so no need to redefine here.
71 */
72 #define USBINTR 0x0008
73 #define USBINTR_MASK 0x0000003f
74
75 #define FRINDEX 0x000c
76 #define CTRLDSSEGMENT 0x0010
77 #define PERIODICLISTBASE 0x0014
78 #define ASYNCLISTADDR 0x0018
79 #define ASYNCLISTADDR_MASK 0xffffffe0
80
81 #define CONFIGFLAG 0x0040
82
83 /*
84 * Bits that are reserved or are read-only are masked out of values
85 * written to us by software
86 */
87 #define PORTSC_RO_MASK 0x007001c0
88 #define PORTSC_RWC_MASK 0x0000002a
89 #define PORTSC_WKOC_E (1 << 22) // Wake on Over Current Enable
90 #define PORTSC_WKDS_E (1 << 21) // Wake on Disconnect Enable
91 #define PORTSC_WKCN_E (1 << 20) // Wake on Connect Enable
92 #define PORTSC_PTC (15 << 16) // Port Test Control
93 #define PORTSC_PTC_SH 16 // Port Test Control shift
94 #define PORTSC_PIC (3 << 14) // Port Indicator Control
95 #define PORTSC_PIC_SH 14 // Port Indicator Control Shift
96 #define PORTSC_POWNER (1 << 13) // Port Owner
97 #define PORTSC_PPOWER (1 << 12) // Port Power
98 #define PORTSC_LINESTAT (3 << 10) // Port Line Status
99 #define PORTSC_LINESTAT_SH 10 // Port Line Status Shift
100 #define PORTSC_PRESET (1 << 8) // Port Reset
101 #define PORTSC_SUSPEND (1 << 7) // Port Suspend
102 #define PORTSC_FPRES (1 << 6) // Force Port Resume
103 #define PORTSC_OCC (1 << 5) // Over Current Change
104 #define PORTSC_OCA (1 << 4) // Over Current Active
105 #define PORTSC_PEDC (1 << 3) // Port Enable/Disable Change
106 #define PORTSC_PED (1 << 2) // Port Enable/Disable
107 #define PORTSC_CSC (1 << 1) // Connect Status Change
108 #define PORTSC_CONNECT (1 << 0) // Current Connect Status
109
110 #define FRAME_TIMER_FREQ 1000
111 #define FRAME_TIMER_NS (1000000000 / FRAME_TIMER_FREQ)
112
113 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints
114 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction
115 #define MAX_QH 100 // Max allowable queue heads in a chain
116 #define MIN_FR_PER_TICK 3 // Min frames to process when catching up
117 #define PERIODIC_ACTIVE 64
118
119 /* Internal periodic / asynchronous schedule state machine states
120 */
121 typedef enum {
122 EST_INACTIVE = 1000,
123 EST_ACTIVE,
124 EST_EXECUTING,
125 EST_SLEEPING,
126 /* The following states are internal to the state machine function
127 */
128 EST_WAITLISTHEAD,
129 EST_FETCHENTRY,
130 EST_FETCHQH,
131 EST_FETCHITD,
132 EST_FETCHSITD,
133 EST_ADVANCEQUEUE,
134 EST_FETCHQTD,
135 EST_EXECUTE,
136 EST_WRITEBACK,
137 EST_HORIZONTALQH
138 } EHCI_STATES;
139
140 /* macros for accessing fields within next link pointer entry */
141 #define NLPTR_GET(x) ((x) & 0xffffffe0)
142 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
143 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid
144
145 /* link pointer types */
146 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor
147 #define NLPTR_TYPE_QH 1 // queue head
148 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor
149 #define NLPTR_TYPE_FSTN 3 // frame span traversal node
150
151 #define SET_LAST_RUN_CLOCK(s) \
152 (s)->last_run_ns = qemu_get_clock_ns(vm_clock);
153
154 /* nifty macros from Arnon's EHCI version */
155 #define get_field(data, field) \
156 (((data) & field##_MASK) >> field##_SH)
157
158 #define set_field(data, newval, field) do { \
159 uint32_t val = *data; \
160 val &= ~ field##_MASK; \
161 val |= ((newval) << field##_SH) & field##_MASK; \
162 *data = val; \
163 } while(0)
164
165 static const char *ehci_state_names[] = {
166 [EST_INACTIVE] = "INACTIVE",
167 [EST_ACTIVE] = "ACTIVE",
168 [EST_EXECUTING] = "EXECUTING",
169 [EST_SLEEPING] = "SLEEPING",
170 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
171 [EST_FETCHENTRY] = "FETCH ENTRY",
172 [EST_FETCHQH] = "FETCH QH",
173 [EST_FETCHITD] = "FETCH ITD",
174 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
175 [EST_FETCHQTD] = "FETCH QTD",
176 [EST_EXECUTE] = "EXECUTE",
177 [EST_WRITEBACK] = "WRITEBACK",
178 [EST_HORIZONTALQH] = "HORIZONTALQH",
179 };
180
181 static const char *ehci_mmio_names[] = {
182 [USBCMD] = "USBCMD",
183 [USBSTS] = "USBSTS",
184 [USBINTR] = "USBINTR",
185 [FRINDEX] = "FRINDEX",
186 [PERIODICLISTBASE] = "P-LIST BASE",
187 [ASYNCLISTADDR] = "A-LIST ADDR",
188 [CONFIGFLAG] = "CONFIGFLAG",
189 };
190
191 static int ehci_state_executing(EHCIQueue *q);
192 static int ehci_state_writeback(EHCIQueue *q);
193 static int ehci_state_advqueue(EHCIQueue *q);
194 static int ehci_fill_queue(EHCIPacket *p);
195
196 static const char *nr2str(const char **n, size_t len, uint32_t nr)
197 {
198 if (nr < len && n[nr] != NULL) {
199 return n[nr];
200 } else {
201 return "unknown";
202 }
203 }
204
205 static const char *state2str(uint32_t state)
206 {
207 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
208 }
209
210 static const char *addr2str(hwaddr addr)
211 {
212 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
213 }
214
215 static void ehci_trace_usbsts(uint32_t mask, int state)
216 {
217 /* interrupts */
218 if (mask & USBSTS_INT) {
219 trace_usb_ehci_usbsts("INT", state);
220 }
221 if (mask & USBSTS_ERRINT) {
222 trace_usb_ehci_usbsts("ERRINT", state);
223 }
224 if (mask & USBSTS_PCD) {
225 trace_usb_ehci_usbsts("PCD", state);
226 }
227 if (mask & USBSTS_FLR) {
228 trace_usb_ehci_usbsts("FLR", state);
229 }
230 if (mask & USBSTS_HSE) {
231 trace_usb_ehci_usbsts("HSE", state);
232 }
233 if (mask & USBSTS_IAA) {
234 trace_usb_ehci_usbsts("IAA", state);
235 }
236
237 /* status */
238 if (mask & USBSTS_HALT) {
239 trace_usb_ehci_usbsts("HALT", state);
240 }
241 if (mask & USBSTS_REC) {
242 trace_usb_ehci_usbsts("REC", state);
243 }
244 if (mask & USBSTS_PSS) {
245 trace_usb_ehci_usbsts("PSS", state);
246 }
247 if (mask & USBSTS_ASS) {
248 trace_usb_ehci_usbsts("ASS", state);
249 }
250 }
251
252 static inline void ehci_set_usbsts(EHCIState *s, int mask)
253 {
254 if ((s->usbsts & mask) == mask) {
255 return;
256 }
257 ehci_trace_usbsts(mask, 1);
258 s->usbsts |= mask;
259 }
260
261 static inline void ehci_clear_usbsts(EHCIState *s, int mask)
262 {
263 if ((s->usbsts & mask) == 0) {
264 return;
265 }
266 ehci_trace_usbsts(mask, 0);
267 s->usbsts &= ~mask;
268 }
269
270 /* update irq line */
271 static inline void ehci_update_irq(EHCIState *s)
272 {
273 int level = 0;
274
275 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
276 level = 1;
277 }
278
279 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
280 qemu_set_irq(s->irq, level);
281 }
282
283 /* flag interrupt condition */
284 static inline void ehci_raise_irq(EHCIState *s, int intr)
285 {
286 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
287 s->usbsts |= intr;
288 ehci_update_irq(s);
289 } else {
290 s->usbsts_pending |= intr;
291 }
292 }
293
294 /*
295 * Commit pending interrupts (added via ehci_raise_irq),
296 * at the rate allowed by "Interrupt Threshold Control".
297 */
298 static inline void ehci_commit_irq(EHCIState *s)
299 {
300 uint32_t itc;
301
302 if (!s->usbsts_pending) {
303 return;
304 }
305 if (s->usbsts_frindex > s->frindex) {
306 return;
307 }
308
309 itc = (s->usbcmd >> 16) & 0xff;
310 s->usbsts |= s->usbsts_pending;
311 s->usbsts_pending = 0;
312 s->usbsts_frindex = s->frindex + itc;
313 ehci_update_irq(s);
314 }
315
316 static void ehci_update_halt(EHCIState *s)
317 {
318 if (s->usbcmd & USBCMD_RUNSTOP) {
319 ehci_clear_usbsts(s, USBSTS_HALT);
320 } else {
321 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
322 ehci_set_usbsts(s, USBSTS_HALT);
323 }
324 }
325 }
326
327 static void ehci_set_state(EHCIState *s, int async, int state)
328 {
329 if (async) {
330 trace_usb_ehci_state("async", state2str(state));
331 s->astate = state;
332 if (s->astate == EST_INACTIVE) {
333 ehci_clear_usbsts(s, USBSTS_ASS);
334 ehci_update_halt(s);
335 } else {
336 ehci_set_usbsts(s, USBSTS_ASS);
337 }
338 } else {
339 trace_usb_ehci_state("periodic", state2str(state));
340 s->pstate = state;
341 if (s->pstate == EST_INACTIVE) {
342 ehci_clear_usbsts(s, USBSTS_PSS);
343 ehci_update_halt(s);
344 } else {
345 ehci_set_usbsts(s, USBSTS_PSS);
346 }
347 }
348 }
349
350 static int ehci_get_state(EHCIState *s, int async)
351 {
352 return async ? s->astate : s->pstate;
353 }
354
355 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
356 {
357 if (async) {
358 s->a_fetch_addr = addr;
359 } else {
360 s->p_fetch_addr = addr;
361 }
362 }
363
364 static int ehci_get_fetch_addr(EHCIState *s, int async)
365 {
366 return async ? s->a_fetch_addr : s->p_fetch_addr;
367 }
368
369 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
370 {
371 /* need three here due to argument count limits */
372 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
373 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
374 trace_usb_ehci_qh_fields(addr,
375 get_field(qh->epchar, QH_EPCHAR_RL),
376 get_field(qh->epchar, QH_EPCHAR_MPLEN),
377 get_field(qh->epchar, QH_EPCHAR_EPS),
378 get_field(qh->epchar, QH_EPCHAR_EP),
379 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
380 trace_usb_ehci_qh_bits(addr,
381 (bool)(qh->epchar & QH_EPCHAR_C),
382 (bool)(qh->epchar & QH_EPCHAR_H),
383 (bool)(qh->epchar & QH_EPCHAR_DTC),
384 (bool)(qh->epchar & QH_EPCHAR_I));
385 }
386
387 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
388 {
389 /* need three here due to argument count limits */
390 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
391 trace_usb_ehci_qtd_fields(addr,
392 get_field(qtd->token, QTD_TOKEN_TBYTES),
393 get_field(qtd->token, QTD_TOKEN_CPAGE),
394 get_field(qtd->token, QTD_TOKEN_CERR),
395 get_field(qtd->token, QTD_TOKEN_PID));
396 trace_usb_ehci_qtd_bits(addr,
397 (bool)(qtd->token & QTD_TOKEN_IOC),
398 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
399 (bool)(qtd->token & QTD_TOKEN_HALT),
400 (bool)(qtd->token & QTD_TOKEN_BABBLE),
401 (bool)(qtd->token & QTD_TOKEN_XACTERR));
402 }
403
404 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
405 {
406 trace_usb_ehci_itd(addr, itd->next,
407 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
408 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
409 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
410 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
411 }
412
413 static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
414 EHCIsitd *sitd)
415 {
416 trace_usb_ehci_sitd(addr, sitd->next,
417 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
418 }
419
420 static void ehci_trace_guest_bug(EHCIState *s, const char *message)
421 {
422 trace_usb_ehci_guest_bug(message);
423 fprintf(stderr, "ehci warning: %s\n", message);
424 }
425
426 static inline bool ehci_enabled(EHCIState *s)
427 {
428 return s->usbcmd & USBCMD_RUNSTOP;
429 }
430
431 static inline bool ehci_async_enabled(EHCIState *s)
432 {
433 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
434 }
435
436 static inline bool ehci_periodic_enabled(EHCIState *s)
437 {
438 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
439 }
440
441 /* packet management */
442
443 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
444 {
445 EHCIPacket *p;
446
447 p = g_new0(EHCIPacket, 1);
448 p->queue = q;
449 usb_packet_init(&p->packet);
450 QTAILQ_INSERT_TAIL(&q->packets, p, next);
451 trace_usb_ehci_packet_action(p->queue, p, "alloc");
452 return p;
453 }
454
455 static void ehci_free_packet(EHCIPacket *p)
456 {
457 if (p->async == EHCI_ASYNC_FINISHED) {
458 EHCIQueue *q = p->queue;
459 int state = ehci_get_state(q->ehci, q->async);
460 /* This is a normal, but rare condition (cancel racing completion) */
461 fprintf(stderr, "EHCI: Warning packet completed but not processed\n");
462 ehci_state_executing(q);
463 ehci_state_writeback(q);
464 if (!(q->qh.token & QTD_TOKEN_HALT)) {
465 ehci_state_advqueue(q);
466 }
467 ehci_set_state(q->ehci, q->async, state);
468 /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
469 return;
470 }
471 trace_usb_ehci_packet_action(p->queue, p, "free");
472 if (p->async == EHCI_ASYNC_INITIALIZED) {
473 usb_packet_unmap(&p->packet, &p->sgl);
474 qemu_sglist_destroy(&p->sgl);
475 }
476 if (p->async == EHCI_ASYNC_INFLIGHT) {
477 usb_cancel_packet(&p->packet);
478 usb_packet_unmap(&p->packet, &p->sgl);
479 qemu_sglist_destroy(&p->sgl);
480 }
481 QTAILQ_REMOVE(&p->queue->packets, p, next);
482 usb_packet_cleanup(&p->packet);
483 g_free(p);
484 }
485
486 /* queue management */
487
488 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
489 {
490 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
491 EHCIQueue *q;
492
493 q = g_malloc0(sizeof(*q));
494 q->ehci = ehci;
495 q->qhaddr = addr;
496 q->async = async;
497 QTAILQ_INIT(&q->packets);
498 QTAILQ_INSERT_HEAD(head, q, next);
499 trace_usb_ehci_queue_action(q, "alloc");
500 return q;
501 }
502
503 static int ehci_cancel_queue(EHCIQueue *q)
504 {
505 EHCIPacket *p;
506 int packets = 0;
507
508 p = QTAILQ_FIRST(&q->packets);
509 if (p == NULL) {
510 return 0;
511 }
512
513 trace_usb_ehci_queue_action(q, "cancel");
514 do {
515 ehci_free_packet(p);
516 packets++;
517 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
518 return packets;
519 }
520
521 static int ehci_reset_queue(EHCIQueue *q)
522 {
523 int packets;
524
525 trace_usb_ehci_queue_action(q, "reset");
526 packets = ehci_cancel_queue(q);
527 q->dev = NULL;
528 q->qtdaddr = 0;
529 return packets;
530 }
531
532 static void ehci_free_queue(EHCIQueue *q, const char *warn)
533 {
534 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
535 int cancelled;
536
537 trace_usb_ehci_queue_action(q, "free");
538 cancelled = ehci_cancel_queue(q);
539 if (warn && cancelled > 0) {
540 ehci_trace_guest_bug(q->ehci, warn);
541 }
542 QTAILQ_REMOVE(head, q, next);
543 g_free(q);
544 }
545
546 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
547 int async)
548 {
549 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
550 EHCIQueue *q;
551
552 QTAILQ_FOREACH(q, head, next) {
553 if (addr == q->qhaddr) {
554 return q;
555 }
556 }
557 return NULL;
558 }
559
560 static void ehci_queues_rip_unused(EHCIState *ehci, int async)
561 {
562 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
563 const char *warn = async ? "guest unlinked busy QH" : NULL;
564 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
565 EHCIQueue *q, *tmp;
566
567 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
568 if (q->seen) {
569 q->seen = 0;
570 q->ts = ehci->last_run_ns;
571 continue;
572 }
573 if (ehci->last_run_ns < q->ts + maxage) {
574 continue;
575 }
576 ehci_free_queue(q, warn);
577 }
578 }
579
580 static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
581 {
582 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
583 EHCIQueue *q, *tmp;
584
585 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
586 if (!q->seen) {
587 ehci_free_queue(q, NULL);
588 }
589 }
590 }
591
592 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
593 {
594 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
595 EHCIQueue *q, *tmp;
596
597 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
598 if (q->dev != dev) {
599 continue;
600 }
601 ehci_free_queue(q, NULL);
602 }
603 }
604
605 static void ehci_queues_rip_all(EHCIState *ehci, int async)
606 {
607 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
608 const char *warn = async ? "guest stopped busy async schedule" : NULL;
609 EHCIQueue *q, *tmp;
610
611 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
612 ehci_free_queue(q, warn);
613 }
614 }
615
616 /* Attach or detach a device on root hub */
617
618 static void ehci_attach(USBPort *port)
619 {
620 EHCIState *s = port->opaque;
621 uint32_t *portsc = &s->portsc[port->index];
622 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
623
624 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
625
626 if (*portsc & PORTSC_POWNER) {
627 USBPort *companion = s->companion_ports[port->index];
628 companion->dev = port->dev;
629 companion->ops->attach(companion);
630 return;
631 }
632
633 *portsc |= PORTSC_CONNECT;
634 *portsc |= PORTSC_CSC;
635
636 ehci_raise_irq(s, USBSTS_PCD);
637 ehci_commit_irq(s);
638 }
639
640 static void ehci_detach(USBPort *port)
641 {
642 EHCIState *s = port->opaque;
643 uint32_t *portsc = &s->portsc[port->index];
644 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
645
646 trace_usb_ehci_port_detach(port->index, owner);
647
648 if (*portsc & PORTSC_POWNER) {
649 USBPort *companion = s->companion_ports[port->index];
650 companion->ops->detach(companion);
651 companion->dev = NULL;
652 /*
653 * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
654 * the port ownership is returned immediately to the EHCI controller."
655 */
656 *portsc &= ~PORTSC_POWNER;
657 return;
658 }
659
660 ehci_queues_rip_device(s, port->dev, 0);
661 ehci_queues_rip_device(s, port->dev, 1);
662
663 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED);
664 *portsc |= PORTSC_CSC;
665
666 ehci_raise_irq(s, USBSTS_PCD);
667 ehci_commit_irq(s);
668 }
669
670 static void ehci_child_detach(USBPort *port, USBDevice *child)
671 {
672 EHCIState *s = port->opaque;
673 uint32_t portsc = s->portsc[port->index];
674
675 if (portsc & PORTSC_POWNER) {
676 USBPort *companion = s->companion_ports[port->index];
677 companion->ops->child_detach(companion, child);
678 return;
679 }
680
681 ehci_queues_rip_device(s, child, 0);
682 ehci_queues_rip_device(s, child, 1);
683 }
684
685 static void ehci_wakeup(USBPort *port)
686 {
687 EHCIState *s = port->opaque;
688 uint32_t portsc = s->portsc[port->index];
689
690 if (portsc & PORTSC_POWNER) {
691 USBPort *companion = s->companion_ports[port->index];
692 if (companion->ops->wakeup) {
693 companion->ops->wakeup(companion);
694 }
695 return;
696 }
697
698 qemu_bh_schedule(s->async_bh);
699 }
700
701 static int ehci_register_companion(USBBus *bus, USBPort *ports[],
702 uint32_t portcount, uint32_t firstport)
703 {
704 EHCIState *s = container_of(bus, EHCIState, bus);
705 uint32_t i;
706
707 if (firstport + portcount > NB_PORTS) {
708 qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport",
709 "firstport on masterbus");
710 error_printf_unless_qmp(
711 "firstport value of %u makes companion take ports %u - %u, which "
712 "is outside of the valid range of 0 - %u\n", firstport, firstport,
713 firstport + portcount - 1, NB_PORTS - 1);
714 return -1;
715 }
716
717 for (i = 0; i < portcount; i++) {
718 if (s->companion_ports[firstport + i]) {
719 qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus",
720 "an USB masterbus");
721 error_printf_unless_qmp(
722 "port %u on masterbus %s already has a companion assigned\n",
723 firstport + i, bus->qbus.name);
724 return -1;
725 }
726 }
727
728 for (i = 0; i < portcount; i++) {
729 s->companion_ports[firstport + i] = ports[i];
730 s->ports[firstport + i].speedmask |=
731 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
732 /* Ensure devs attached before the initial reset go to the companion */
733 s->portsc[firstport + i] = PORTSC_POWNER;
734 }
735
736 s->companion_count++;
737 s->caps[0x05] = (s->companion_count << 4) | portcount;
738
739 return 0;
740 }
741
742 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep)
743 {
744 EHCIState *s = container_of(bus, EHCIState, bus);
745 uint32_t portsc = s->portsc[ep->dev->port->index];
746
747 if (portsc & PORTSC_POWNER) {
748 return;
749 }
750
751 s->periodic_sched_active = PERIODIC_ACTIVE;
752 qemu_bh_schedule(s->async_bh);
753 }
754
755 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
756 {
757 USBDevice *dev;
758 USBPort *port;
759 int i;
760
761 for (i = 0; i < NB_PORTS; i++) {
762 port = &ehci->ports[i];
763 if (!(ehci->portsc[i] & PORTSC_PED)) {
764 DPRINTF("Port %d not enabled\n", i);
765 continue;
766 }
767 dev = usb_find_device(port, addr);
768 if (dev != NULL) {
769 return dev;
770 }
771 }
772 return NULL;
773 }
774
775 /* 4.1 host controller initialization */
776 static void ehci_reset(void *opaque)
777 {
778 EHCIState *s = opaque;
779 int i;
780 USBDevice *devs[NB_PORTS];
781
782 trace_usb_ehci_reset();
783
784 /*
785 * Do the detach before touching portsc, so that it correctly gets send to
786 * us or to our companion based on PORTSC_POWNER before the reset.
787 */
788 for(i = 0; i < NB_PORTS; i++) {
789 devs[i] = s->ports[i].dev;
790 if (devs[i] && devs[i]->attached) {
791 usb_detach(&s->ports[i]);
792 }
793 }
794
795 memset(&s->opreg, 0x00, sizeof(s->opreg));
796 memset(&s->portsc, 0x00, sizeof(s->portsc));
797
798 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
799 s->usbsts = USBSTS_HALT;
800 s->usbsts_pending = 0;
801 s->usbsts_frindex = 0;
802
803 s->astate = EST_INACTIVE;
804 s->pstate = EST_INACTIVE;
805
806 for(i = 0; i < NB_PORTS; i++) {
807 if (s->companion_ports[i]) {
808 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
809 } else {
810 s->portsc[i] = PORTSC_PPOWER;
811 }
812 if (devs[i] && devs[i]->attached) {
813 usb_attach(&s->ports[i]);
814 usb_device_reset(devs[i]);
815 }
816 }
817 ehci_queues_rip_all(s, 0);
818 ehci_queues_rip_all(s, 1);
819 qemu_del_timer(s->frame_timer);
820 qemu_bh_cancel(s->async_bh);
821 }
822
823 static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
824 unsigned size)
825 {
826 EHCIState *s = ptr;
827 return s->caps[addr];
828 }
829
830 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
831 unsigned size)
832 {
833 EHCIState *s = ptr;
834 uint32_t val;
835
836 val = s->opreg[addr >> 2];
837 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
838 return val;
839 }
840
841 static uint64_t ehci_port_read(void *ptr, hwaddr addr,
842 unsigned size)
843 {
844 EHCIState *s = ptr;
845 uint32_t val;
846
847 val = s->portsc[addr >> 2];
848 trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
849 return val;
850 }
851
852 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
853 {
854 USBDevice *dev = s->ports[port].dev;
855 uint32_t *portsc = &s->portsc[port];
856 uint32_t orig;
857
858 if (s->companion_ports[port] == NULL)
859 return;
860
861 owner = owner & PORTSC_POWNER;
862 orig = *portsc & PORTSC_POWNER;
863
864 if (!(owner ^ orig)) {
865 return;
866 }
867
868 if (dev && dev->attached) {
869 usb_detach(&s->ports[port]);
870 }
871
872 *portsc &= ~PORTSC_POWNER;
873 *portsc |= owner;
874
875 if (dev && dev->attached) {
876 usb_attach(&s->ports[port]);
877 }
878 }
879
880 static void ehci_port_write(void *ptr, hwaddr addr,
881 uint64_t val, unsigned size)
882 {
883 EHCIState *s = ptr;
884 int port = addr >> 2;
885 uint32_t *portsc = &s->portsc[port];
886 uint32_t old = *portsc;
887 USBDevice *dev = s->ports[port].dev;
888
889 trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
890
891 /* Clear rwc bits */
892 *portsc &= ~(val & PORTSC_RWC_MASK);
893 /* The guest may clear, but not set the PED bit */
894 *portsc &= val | ~PORTSC_PED;
895 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
896 handle_port_owner_write(s, port, val);
897 /* And finally apply RO_MASK */
898 val &= PORTSC_RO_MASK;
899
900 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
901 trace_usb_ehci_port_reset(port, 1);
902 }
903
904 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
905 trace_usb_ehci_port_reset(port, 0);
906 if (dev && dev->attached) {
907 usb_port_reset(&s->ports[port]);
908 *portsc &= ~PORTSC_CSC;
909 }
910
911 /*
912 * Table 2.16 Set the enable bit(and enable bit change) to indicate
913 * to SW that this port has a high speed device attached
914 */
915 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
916 val |= PORTSC_PED;
917 }
918 }
919
920 *portsc &= ~PORTSC_RO_MASK;
921 *portsc |= val;
922 trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
923 }
924
925 static void ehci_opreg_write(void *ptr, hwaddr addr,
926 uint64_t val, unsigned size)
927 {
928 EHCIState *s = ptr;
929 uint32_t *mmio = s->opreg + (addr >> 2);
930 uint32_t old = *mmio;
931 int i;
932
933 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
934
935 switch (addr) {
936 case USBCMD:
937 if (val & USBCMD_HCRESET) {
938 ehci_reset(s);
939 val = s->usbcmd;
940 break;
941 }
942
943 /* not supporting dynamic frame list size at the moment */
944 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
945 fprintf(stderr, "attempt to set frame list size -- value %d\n",
946 (int)val & USBCMD_FLS);
947 val &= ~USBCMD_FLS;
948 }
949
950 if (val & USBCMD_IAAD) {
951 /*
952 * Process IAAD immediately, otherwise the Linux IAAD watchdog may
953 * trigger and re-use a qh without us seeing the unlink.
954 */
955 s->async_stepdown = 0;
956 qemu_bh_schedule(s->async_bh);
957 trace_usb_ehci_doorbell_ring();
958 }
959
960 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
961 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
962 if (s->pstate == EST_INACTIVE) {
963 SET_LAST_RUN_CLOCK(s);
964 }
965 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
966 ehci_update_halt(s);
967 s->async_stepdown = 0;
968 qemu_bh_schedule(s->async_bh);
969 }
970 break;
971
972 case USBSTS:
973 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO
974 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC
975 val = s->usbsts;
976 ehci_update_irq(s);
977 break;
978
979 case USBINTR:
980 val &= USBINTR_MASK;
981 if (ehci_enabled(s) && (USBSTS_FLR & val)) {
982 qemu_bh_schedule(s->async_bh);
983 }
984 break;
985
986 case FRINDEX:
987 val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */
988 break;
989
990 case CONFIGFLAG:
991 val &= 0x1;
992 if (val) {
993 for(i = 0; i < NB_PORTS; i++)
994 handle_port_owner_write(s, i, 0);
995 }
996 break;
997
998 case PERIODICLISTBASE:
999 if (ehci_periodic_enabled(s)) {
1000 fprintf(stderr,
1001 "ehci: PERIODIC list base register set while periodic schedule\n"
1002 " is enabled and HC is enabled\n");
1003 }
1004 break;
1005
1006 case ASYNCLISTADDR:
1007 if (ehci_async_enabled(s)) {
1008 fprintf(stderr,
1009 "ehci: ASYNC list address register set while async schedule\n"
1010 " is enabled and HC is enabled\n");
1011 }
1012 break;
1013 }
1014
1015 *mmio = val;
1016 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1017 *mmio, old);
1018 }
1019
1020 /* Get an array of dwords from main memory */
1021 static inline int get_dwords(EHCIState *ehci, uint32_t addr,
1022 uint32_t *buf, int num)
1023 {
1024 int i;
1025
1026 if (!ehci->dma) {
1027 ehci_raise_irq(ehci, USBSTS_HSE);
1028 ehci->usbcmd &= ~USBCMD_RUNSTOP;
1029 trace_usb_ehci_dma_error();
1030 return -1;
1031 }
1032
1033 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1034 dma_memory_read(ehci->dma, addr, buf, sizeof(*buf));
1035 *buf = le32_to_cpu(*buf);
1036 }
1037
1038 return num;
1039 }
1040
1041 /* Put an array of dwords in to main memory */
1042 static inline int put_dwords(EHCIState *ehci, uint32_t addr,
1043 uint32_t *buf, int num)
1044 {
1045 int i;
1046
1047 if (!ehci->dma) {
1048 ehci_raise_irq(ehci, USBSTS_HSE);
1049 ehci->usbcmd &= ~USBCMD_RUNSTOP;
1050 trace_usb_ehci_dma_error();
1051 return -1;
1052 }
1053
1054 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1055 uint32_t tmp = cpu_to_le32(*buf);
1056 dma_memory_write(ehci->dma, addr, &tmp, sizeof(tmp));
1057 }
1058
1059 return num;
1060 }
1061
1062 /*
1063 * Write the qh back to guest physical memory. This step isn't
1064 * in the EHCI spec but we need to do it since we don't share
1065 * physical memory with our guest VM.
1066 *
1067 * The first three dwords are read-only for the EHCI, so skip them
1068 * when writing back the qh.
1069 */
1070 static void ehci_flush_qh(EHCIQueue *q)
1071 {
1072 uint32_t *qh = (uint32_t *) &q->qh;
1073 uint32_t dwords = sizeof(EHCIqh) >> 2;
1074 uint32_t addr = NLPTR_GET(q->qhaddr);
1075
1076 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1077 }
1078
1079 // 4.10.2
1080
1081 static int ehci_qh_do_overlay(EHCIQueue *q)
1082 {
1083 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1084 int i;
1085 int dtoggle;
1086 int ping;
1087 int eps;
1088 int reload;
1089
1090 assert(p != NULL);
1091 assert(p->qtdaddr == q->qtdaddr);
1092
1093 // remember values in fields to preserve in qh after overlay
1094
1095 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1096 ping = q->qh.token & QTD_TOKEN_PING;
1097
1098 q->qh.current_qtd = p->qtdaddr;
1099 q->qh.next_qtd = p->qtd.next;
1100 q->qh.altnext_qtd = p->qtd.altnext;
1101 q->qh.token = p->qtd.token;
1102
1103
1104 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1105 if (eps == EHCI_QH_EPS_HIGH) {
1106 q->qh.token &= ~QTD_TOKEN_PING;
1107 q->qh.token |= ping;
1108 }
1109
1110 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1111 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1112
1113 for (i = 0; i < 5; i++) {
1114 q->qh.bufptr[i] = p->qtd.bufptr[i];
1115 }
1116
1117 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1118 // preserve QH DT bit
1119 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1120 q->qh.token |= dtoggle;
1121 }
1122
1123 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1124 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1125
1126 ehci_flush_qh(q);
1127
1128 return 0;
1129 }
1130
1131 static int ehci_init_transfer(EHCIPacket *p)
1132 {
1133 uint32_t cpage, offset, bytes, plen;
1134 dma_addr_t page;
1135
1136 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1137 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1138 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1139 qemu_sglist_init(&p->sgl, 5, p->queue->ehci->dma);
1140
1141 while (bytes > 0) {
1142 if (cpage > 4) {
1143 fprintf(stderr, "cpage out of range (%d)\n", cpage);
1144 return -1;
1145 }
1146
1147 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1148 page += offset;
1149 plen = bytes;
1150 if (plen > 4096 - offset) {
1151 plen = 4096 - offset;
1152 offset = 0;
1153 cpage++;
1154 }
1155
1156 qemu_sglist_add(&p->sgl, page, plen);
1157 bytes -= plen;
1158 }
1159 return 0;
1160 }
1161
1162 static void ehci_finish_transfer(EHCIQueue *q, int len)
1163 {
1164 uint32_t cpage, offset;
1165
1166 if (len > 0) {
1167 /* update cpage & offset */
1168 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1169 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1170
1171 offset += len;
1172 cpage += offset >> QTD_BUFPTR_SH;
1173 offset &= ~QTD_BUFPTR_MASK;
1174
1175 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1176 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1177 q->qh.bufptr[0] |= offset;
1178 }
1179 }
1180
1181 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1182 {
1183 EHCIPacket *p;
1184 EHCIState *s = port->opaque;
1185 uint32_t portsc = s->portsc[port->index];
1186
1187 if (portsc & PORTSC_POWNER) {
1188 USBPort *companion = s->companion_ports[port->index];
1189 companion->ops->complete(companion, packet);
1190 return;
1191 }
1192
1193 p = container_of(packet, EHCIPacket, packet);
1194 assert(p->async == EHCI_ASYNC_INFLIGHT);
1195
1196 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1197 trace_usb_ehci_packet_action(p->queue, p, "remove");
1198 ehci_free_packet(p);
1199 return;
1200 }
1201
1202 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1203 p->async = EHCI_ASYNC_FINISHED;
1204
1205 if (!p->queue->async) {
1206 s->periodic_sched_active = PERIODIC_ACTIVE;
1207 }
1208 qemu_bh_schedule(s->async_bh);
1209 }
1210
1211 static void ehci_execute_complete(EHCIQueue *q)
1212 {
1213 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1214 uint32_t tbytes;
1215
1216 assert(p != NULL);
1217 assert(p->qtdaddr == q->qtdaddr);
1218 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1219 p->async == EHCI_ASYNC_FINISHED);
1220
1221 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1222 "status %d, actual_length %d\n",
1223 q->qhaddr, q->qh.next, q->qtdaddr,
1224 p->packet.status, p->packet.actual_length);
1225
1226 switch (p->packet.status) {
1227 case USB_RET_SUCCESS:
1228 break;
1229 case USB_RET_IOERROR:
1230 case USB_RET_NODEV:
1231 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1232 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1233 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1234 break;
1235 case USB_RET_STALL:
1236 q->qh.token |= QTD_TOKEN_HALT;
1237 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1238 break;
1239 case USB_RET_NAK:
1240 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1241 return; /* We're not done yet with this transaction */
1242 case USB_RET_BABBLE:
1243 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1244 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1245 break;
1246 default:
1247 /* should not be triggerable */
1248 fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1249 assert(0);
1250 break;
1251 }
1252
1253 /* TODO check 4.12 for splits */
1254 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1255 if (tbytes && p->pid == USB_TOKEN_IN) {
1256 tbytes -= p->packet.actual_length;
1257 if (tbytes) {
1258 /* 4.15.1.2 must raise int on a short input packet */
1259 ehci_raise_irq(q->ehci, USBSTS_INT);
1260 }
1261 } else {
1262 tbytes = 0;
1263 }
1264 DPRINTF("updating tbytes to %d\n", tbytes);
1265 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1266
1267 ehci_finish_transfer(q, p->packet.actual_length);
1268 usb_packet_unmap(&p->packet, &p->sgl);
1269 qemu_sglist_destroy(&p->sgl);
1270 p->async = EHCI_ASYNC_NONE;
1271
1272 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1273 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1274
1275 if (q->qh.token & QTD_TOKEN_IOC) {
1276 ehci_raise_irq(q->ehci, USBSTS_INT);
1277 if (q->async) {
1278 q->ehci->int_req_by_async = true;
1279 }
1280 }
1281 }
1282
1283 /* 4.10.3 returns "again" */
1284 static int ehci_execute(EHCIPacket *p, const char *action)
1285 {
1286 USBEndpoint *ep;
1287 int endp;
1288 bool spd;
1289
1290 assert(p->async == EHCI_ASYNC_NONE ||
1291 p->async == EHCI_ASYNC_INITIALIZED);
1292
1293 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1294 fprintf(stderr, "Attempting to execute inactive qtd\n");
1295 return -1;
1296 }
1297
1298 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1299 ehci_trace_guest_bug(p->queue->ehci,
1300 "guest requested more bytes than allowed");
1301 return -1;
1302 }
1303
1304 p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH;
1305 switch (p->pid) {
1306 case 0:
1307 p->pid = USB_TOKEN_OUT;
1308 break;
1309 case 1:
1310 p->pid = USB_TOKEN_IN;
1311 break;
1312 case 2:
1313 p->pid = USB_TOKEN_SETUP;
1314 break;
1315 default:
1316 fprintf(stderr, "bad token\n");
1317 break;
1318 }
1319
1320 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1321 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1322
1323 if (p->async == EHCI_ASYNC_NONE) {
1324 if (ehci_init_transfer(p) != 0) {
1325 return -1;
1326 }
1327
1328 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1329 usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr, spd,
1330 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1331 usb_packet_map(&p->packet, &p->sgl);
1332 p->async = EHCI_ASYNC_INITIALIZED;
1333 }
1334
1335 trace_usb_ehci_packet_action(p->queue, p, action);
1336 usb_handle_packet(p->queue->dev, &p->packet);
1337 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1338 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1339 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1340 p->packet.actual_length);
1341
1342 if (p->packet.actual_length > BUFF_SIZE) {
1343 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1344 return -1;
1345 }
1346
1347 return 1;
1348 }
1349
1350 /* 4.7.2
1351 */
1352
1353 static int ehci_process_itd(EHCIState *ehci,
1354 EHCIitd *itd,
1355 uint32_t addr)
1356 {
1357 USBDevice *dev;
1358 USBEndpoint *ep;
1359 uint32_t i, len, pid, dir, devaddr, endp;
1360 uint32_t pg, off, ptr1, ptr2, max, mult;
1361
1362 ehci->periodic_sched_active = PERIODIC_ACTIVE;
1363
1364 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1365 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1366 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1367 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1368 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1369
1370 for(i = 0; i < 8; i++) {
1371 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1372 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1373 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1374 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1375 ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
1376 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1377
1378 if (len > max * mult) {
1379 len = max * mult;
1380 }
1381
1382 if (len > BUFF_SIZE) {
1383 return -1;
1384 }
1385
1386 qemu_sglist_init(&ehci->isgl, 2, ehci->dma);
1387 if (off + len > 4096) {
1388 /* transfer crosses page border */
1389 uint32_t len2 = off + len - 4096;
1390 uint32_t len1 = len - len2;
1391 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1392 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1393 } else {
1394 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1395 }
1396
1397 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1398
1399 dev = ehci_find_device(ehci, devaddr);
1400 ep = usb_ep_get(dev, pid, endp);
1401 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1402 usb_packet_setup(&ehci->ipacket, pid, ep, addr, false,
1403 (itd->transact[i] & ITD_XACT_IOC) != 0);
1404 usb_packet_map(&ehci->ipacket, &ehci->isgl);
1405 usb_handle_packet(dev, &ehci->ipacket);
1406 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1407 } else {
1408 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1409 ehci->ipacket.status = USB_RET_NAK;
1410 ehci->ipacket.actual_length = 0;
1411 }
1412 qemu_sglist_destroy(&ehci->isgl);
1413
1414 switch (ehci->ipacket.status) {
1415 case USB_RET_SUCCESS:
1416 break;
1417 default:
1418 fprintf(stderr, "Unexpected iso usb result: %d\n",
1419 ehci->ipacket.status);
1420 /* Fall through */
1421 case USB_RET_IOERROR:
1422 case USB_RET_NODEV:
1423 /* 3.3.2: XACTERR is only allowed on IN transactions */
1424 if (dir) {
1425 itd->transact[i] |= ITD_XACT_XACTERR;
1426 ehci_raise_irq(ehci, USBSTS_ERRINT);
1427 }
1428 break;
1429 case USB_RET_BABBLE:
1430 itd->transact[i] |= ITD_XACT_BABBLE;
1431 ehci_raise_irq(ehci, USBSTS_ERRINT);
1432 break;
1433 case USB_RET_NAK:
1434 /* no data for us, so do a zero-length transfer */
1435 ehci->ipacket.actual_length = 0;
1436 break;
1437 }
1438 if (!dir) {
1439 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1440 ITD_XACT_LENGTH); /* OUT */
1441 } else {
1442 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1443 ITD_XACT_LENGTH); /* IN */
1444 }
1445 if (itd->transact[i] & ITD_XACT_IOC) {
1446 ehci_raise_irq(ehci, USBSTS_INT);
1447 }
1448 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1449 }
1450 }
1451 return 0;
1452 }
1453
1454
1455 /* This state is the entry point for asynchronous schedule
1456 * processing. Entry here consitutes a EHCI start event state (4.8.5)
1457 */
1458 static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1459 {
1460 EHCIqh qh;
1461 int i = 0;
1462 int again = 0;
1463 uint32_t entry = ehci->asynclistaddr;
1464
1465 /* set reclamation flag at start event (4.8.6) */
1466 if (async) {
1467 ehci_set_usbsts(ehci, USBSTS_REC);
1468 }
1469
1470 ehci_queues_rip_unused(ehci, async);
1471
1472 /* Find the head of the list (4.9.1.1) */
1473 for(i = 0; i < MAX_QH; i++) {
1474 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1475 sizeof(EHCIqh) >> 2) < 0) {
1476 return 0;
1477 }
1478 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1479
1480 if (qh.epchar & QH_EPCHAR_H) {
1481 if (async) {
1482 entry |= (NLPTR_TYPE_QH << 1);
1483 }
1484
1485 ehci_set_fetch_addr(ehci, async, entry);
1486 ehci_set_state(ehci, async, EST_FETCHENTRY);
1487 again = 1;
1488 goto out;
1489 }
1490
1491 entry = qh.next;
1492 if (entry == ehci->asynclistaddr) {
1493 break;
1494 }
1495 }
1496
1497 /* no head found for list. */
1498
1499 ehci_set_state(ehci, async, EST_ACTIVE);
1500
1501 out:
1502 return again;
1503 }
1504
1505
1506 /* This state is the entry point for periodic schedule processing as
1507 * well as being a continuation state for async processing.
1508 */
1509 static int ehci_state_fetchentry(EHCIState *ehci, int async)
1510 {
1511 int again = 0;
1512 uint32_t entry = ehci_get_fetch_addr(ehci, async);
1513
1514 if (NLPTR_TBIT(entry)) {
1515 ehci_set_state(ehci, async, EST_ACTIVE);
1516 goto out;
1517 }
1518
1519 /* section 4.8, only QH in async schedule */
1520 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1521 fprintf(stderr, "non queue head request in async schedule\n");
1522 return -1;
1523 }
1524
1525 switch (NLPTR_TYPE_GET(entry)) {
1526 case NLPTR_TYPE_QH:
1527 ehci_set_state(ehci, async, EST_FETCHQH);
1528 again = 1;
1529 break;
1530
1531 case NLPTR_TYPE_ITD:
1532 ehci_set_state(ehci, async, EST_FETCHITD);
1533 again = 1;
1534 break;
1535
1536 case NLPTR_TYPE_STITD:
1537 ehci_set_state(ehci, async, EST_FETCHSITD);
1538 again = 1;
1539 break;
1540
1541 default:
1542 /* TODO: handle FSTN type */
1543 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1544 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1545 return -1;
1546 }
1547
1548 out:
1549 return again;
1550 }
1551
1552 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1553 {
1554 EHCIPacket *p;
1555 uint32_t entry, devaddr, endp;
1556 EHCIQueue *q;
1557 EHCIqh qh;
1558
1559 entry = ehci_get_fetch_addr(ehci, async);
1560 q = ehci_find_queue_by_qh(ehci, entry, async);
1561 if (NULL == q) {
1562 q = ehci_alloc_queue(ehci, entry, async);
1563 }
1564 p = QTAILQ_FIRST(&q->packets);
1565
1566 q->seen++;
1567 if (q->seen > 1) {
1568 /* we are going in circles -- stop processing */
1569 ehci_set_state(ehci, async, EST_ACTIVE);
1570 q = NULL;
1571 goto out;
1572 }
1573
1574 if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1575 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1576 q = NULL;
1577 goto out;
1578 }
1579 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1580
1581 /*
1582 * The overlay area of the qh should never be changed by the guest,
1583 * except when idle, in which case the reset is a nop.
1584 */
1585 devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR);
1586 endp = get_field(qh.epchar, QH_EPCHAR_EP);
1587 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
1588 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
1589 (qh.current_qtd != q->qh.current_qtd) ||
1590 (q->async && qh.next_qtd != q->qh.next_qtd) ||
1591 (memcmp(&qh.altnext_qtd, &q->qh.altnext_qtd,
1592 7 * sizeof(uint32_t)) != 0) ||
1593 (q->dev != NULL && q->dev->addr != devaddr)) {
1594 if (ehci_reset_queue(q) > 0) {
1595 ehci_trace_guest_bug(ehci, "guest updated active QH");
1596 }
1597 p = NULL;
1598 }
1599 q->qh = qh;
1600
1601 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1602 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1603 q->transact_ctr = 4;
1604 }
1605
1606 if (q->dev == NULL) {
1607 q->dev = ehci_find_device(q->ehci, devaddr);
1608 }
1609
1610 if (p && p->async == EHCI_ASYNC_FINISHED) {
1611 /* I/O finished -- continue processing queue */
1612 trace_usb_ehci_packet_action(p->queue, p, "complete");
1613 ehci_set_state(ehci, async, EST_EXECUTING);
1614 goto out;
1615 }
1616
1617 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1618
1619 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1620 if (ehci->usbsts & USBSTS_REC) {
1621 ehci_clear_usbsts(ehci, USBSTS_REC);
1622 } else {
1623 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset"
1624 " - done processing\n", q->qhaddr);
1625 ehci_set_state(ehci, async, EST_ACTIVE);
1626 q = NULL;
1627 goto out;
1628 }
1629 }
1630
1631 #if EHCI_DEBUG
1632 if (q->qhaddr != q->qh.next) {
1633 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1634 q->qhaddr,
1635 q->qh.epchar & QH_EPCHAR_H,
1636 q->qh.token & QTD_TOKEN_HALT,
1637 q->qh.token & QTD_TOKEN_ACTIVE,
1638 q->qh.next);
1639 }
1640 #endif
1641
1642 if (q->qh.token & QTD_TOKEN_HALT) {
1643 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1644
1645 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1646 (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
1647 q->qtdaddr = q->qh.current_qtd;
1648 ehci_set_state(ehci, async, EST_FETCHQTD);
1649
1650 } else {
1651 /* EHCI spec version 1.0 Section 4.10.2 */
1652 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1653 }
1654
1655 out:
1656 return q;
1657 }
1658
1659 static int ehci_state_fetchitd(EHCIState *ehci, int async)
1660 {
1661 uint32_t entry;
1662 EHCIitd itd;
1663
1664 assert(!async);
1665 entry = ehci_get_fetch_addr(ehci, async);
1666
1667 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1668 sizeof(EHCIitd) >> 2) < 0) {
1669 return -1;
1670 }
1671 ehci_trace_itd(ehci, entry, &itd);
1672
1673 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1674 return -1;
1675 }
1676
1677 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1678 sizeof(EHCIitd) >> 2);
1679 ehci_set_fetch_addr(ehci, async, itd.next);
1680 ehci_set_state(ehci, async, EST_FETCHENTRY);
1681
1682 return 1;
1683 }
1684
1685 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1686 {
1687 uint32_t entry;
1688 EHCIsitd sitd;
1689
1690 assert(!async);
1691 entry = ehci_get_fetch_addr(ehci, async);
1692
1693 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1694 sizeof(EHCIsitd) >> 2) < 0) {
1695 return 0;
1696 }
1697 ehci_trace_sitd(ehci, entry, &sitd);
1698
1699 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1700 /* siTD is not active, nothing to do */;
1701 } else {
1702 /* TODO: split transfers are not implemented */
1703 fprintf(stderr, "WARNING: Skipping active siTD\n");
1704 }
1705
1706 ehci_set_fetch_addr(ehci, async, sitd.next);
1707 ehci_set_state(ehci, async, EST_FETCHENTRY);
1708 return 1;
1709 }
1710
1711 /* Section 4.10.2 - paragraph 3 */
1712 static int ehci_state_advqueue(EHCIQueue *q)
1713 {
1714 #if 0
1715 /* TO-DO: 4.10.2 - paragraph 2
1716 * if I-bit is set to 1 and QH is not active
1717 * go to horizontal QH
1718 */
1719 if (I-bit set) {
1720 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1721 goto out;
1722 }
1723 #endif
1724
1725 /*
1726 * want data and alt-next qTD is valid
1727 */
1728 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1729 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1730 q->qtdaddr = q->qh.altnext_qtd;
1731 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1732
1733 /*
1734 * next qTD is valid
1735 */
1736 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1737 q->qtdaddr = q->qh.next_qtd;
1738 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1739
1740 /*
1741 * no valid qTD, try next QH
1742 */
1743 } else {
1744 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1745 }
1746
1747 return 1;
1748 }
1749
1750 /* Section 4.10.2 - paragraph 4 */
1751 static int ehci_state_fetchqtd(EHCIQueue *q)
1752 {
1753 EHCIqtd qtd;
1754 EHCIPacket *p;
1755 int again = 1;
1756
1757 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1758 sizeof(EHCIqtd) >> 2) < 0) {
1759 return 0;
1760 }
1761 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1762
1763 p = QTAILQ_FIRST(&q->packets);
1764 if (p != NULL) {
1765 if (p->qtdaddr != q->qtdaddr ||
1766 (q->async && !NLPTR_TBIT(p->qtd.next) &&
1767 (p->qtd.next != qtd.next)) ||
1768 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) ||
1769 p->qtd.bufptr[0] != qtd.bufptr[0]) {
1770 ehci_cancel_queue(q);
1771 ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD");
1772 p = NULL;
1773 } else {
1774 p->qtd = qtd;
1775 ehci_qh_do_overlay(q);
1776 }
1777 }
1778
1779 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1780 if (p != NULL) {
1781 /* transfer canceled by guest (clear active) */
1782 ehci_cancel_queue(q);
1783 p = NULL;
1784 }
1785 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1786 } else if (p != NULL) {
1787 switch (p->async) {
1788 case EHCI_ASYNC_NONE:
1789 case EHCI_ASYNC_INITIALIZED:
1790 /* Not yet executed (MULT), or previously nacked (int) packet */
1791 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1792 break;
1793 case EHCI_ASYNC_INFLIGHT:
1794 /* Check if the guest has added new tds to the queue */
1795 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head));
1796 /* Unfinished async handled packet, go horizontal */
1797 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1798 break;
1799 case EHCI_ASYNC_FINISHED:
1800 /*
1801 * We get here when advqueue moves to a packet which is already
1802 * finished, which can happen with packets queued up by fill_queue
1803 */
1804 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1805 break;
1806 }
1807 } else {
1808 p = ehci_alloc_packet(q);
1809 p->qtdaddr = q->qtdaddr;
1810 p->qtd = qtd;
1811 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1812 }
1813
1814 return again;
1815 }
1816
1817 static int ehci_state_horizqh(EHCIQueue *q)
1818 {
1819 int again = 0;
1820
1821 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1822 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1823 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1824 again = 1;
1825 } else {
1826 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1827 }
1828
1829 return again;
1830 }
1831
1832 /* Returns "again" */
1833 static int ehci_fill_queue(EHCIPacket *p)
1834 {
1835 USBEndpoint *ep = p->packet.ep;
1836 EHCIQueue *q = p->queue;
1837 EHCIqtd qtd = p->qtd;
1838 uint32_t qtdaddr;
1839
1840 for (;;) {
1841 if (NLPTR_TBIT(qtd.next) != 0) {
1842 break;
1843 }
1844 qtdaddr = qtd.next;
1845 /*
1846 * Detect circular td lists, Windows creates these, counting on the
1847 * active bit going low after execution to make the queue stop.
1848 */
1849 QTAILQ_FOREACH(p, &q->packets, next) {
1850 if (p->qtdaddr == qtdaddr) {
1851 goto leave;
1852 }
1853 }
1854 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1855 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1856 return -1;
1857 }
1858 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1859 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1860 break;
1861 }
1862 p = ehci_alloc_packet(q);
1863 p->qtdaddr = qtdaddr;
1864 p->qtd = qtd;
1865 if (ehci_execute(p, "queue") == -1) {
1866 return -1;
1867 }
1868 assert(p->packet.status == USB_RET_ASYNC);
1869 p->async = EHCI_ASYNC_INFLIGHT;
1870 }
1871 leave:
1872 usb_device_flush_ep_queue(ep->dev, ep);
1873 return 1;
1874 }
1875
1876 static int ehci_state_execute(EHCIQueue *q)
1877 {
1878 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1879 int again = 0;
1880
1881 assert(p != NULL);
1882 assert(p->qtdaddr == q->qtdaddr);
1883
1884 if (ehci_qh_do_overlay(q) != 0) {
1885 return -1;
1886 }
1887
1888 // TODO verify enough time remains in the uframe as in 4.4.1.1
1889 // TODO write back ptr to async list when done or out of time
1890
1891 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1892 if (!q->async && q->transact_ctr == 0) {
1893 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1894 again = 1;
1895 goto out;
1896 }
1897
1898 if (q->async) {
1899 ehci_set_usbsts(q->ehci, USBSTS_REC);
1900 }
1901
1902 again = ehci_execute(p, "process");
1903 if (again == -1) {
1904 goto out;
1905 }
1906 if (p->packet.status == USB_RET_ASYNC) {
1907 ehci_flush_qh(q);
1908 trace_usb_ehci_packet_action(p->queue, p, "async");
1909 p->async = EHCI_ASYNC_INFLIGHT;
1910 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1911 if (q->async) {
1912 again = ehci_fill_queue(p);
1913 } else {
1914 again = 1;
1915 }
1916 goto out;
1917 }
1918
1919 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1920 again = 1;
1921
1922 out:
1923 return again;
1924 }
1925
1926 static int ehci_state_executing(EHCIQueue *q)
1927 {
1928 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1929
1930 assert(p != NULL);
1931 assert(p->qtdaddr == q->qtdaddr);
1932
1933 ehci_execute_complete(q);
1934
1935 /* 4.10.3 */
1936 if (!q->async && q->transact_ctr > 0) {
1937 q->transact_ctr--;
1938 }
1939
1940 /* 4.10.5 */
1941 if (p->packet.status == USB_RET_NAK) {
1942 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1943 } else {
1944 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1945 }
1946
1947 ehci_flush_qh(q);
1948 return 1;
1949 }
1950
1951
1952 static int ehci_state_writeback(EHCIQueue *q)
1953 {
1954 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1955 uint32_t *qtd, addr;
1956 int again = 0;
1957
1958 /* Write back the QTD from the QH area */
1959 assert(p != NULL);
1960 assert(p->qtdaddr == q->qtdaddr);
1961
1962 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1963 qtd = (uint32_t *) &q->qh.next_qtd;
1964 addr = NLPTR_GET(p->qtdaddr);
1965 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
1966 ehci_free_packet(p);
1967
1968 /*
1969 * EHCI specs say go horizontal here.
1970 *
1971 * We can also advance the queue here for performance reasons. We
1972 * need to take care to only take that shortcut in case we've
1973 * processed the qtd just written back without errors, i.e. halt
1974 * bit is clear.
1975 */
1976 if (q->qh.token & QTD_TOKEN_HALT) {
1977 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1978 again = 1;
1979 } else {
1980 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
1981 again = 1;
1982 }
1983 return again;
1984 }
1985
1986 /*
1987 * This is the state machine that is common to both async and periodic
1988 */
1989
1990 static void ehci_advance_state(EHCIState *ehci, int async)
1991 {
1992 EHCIQueue *q = NULL;
1993 int again;
1994
1995 do {
1996 switch(ehci_get_state(ehci, async)) {
1997 case EST_WAITLISTHEAD:
1998 again = ehci_state_waitlisthead(ehci, async);
1999 break;
2000
2001 case EST_FETCHENTRY:
2002 again = ehci_state_fetchentry(ehci, async);
2003 break;
2004
2005 case EST_FETCHQH:
2006 q = ehci_state_fetchqh(ehci, async);
2007 if (q != NULL) {
2008 assert(q->async == async);
2009 again = 1;
2010 } else {
2011 again = 0;
2012 }
2013 break;
2014
2015 case EST_FETCHITD:
2016 again = ehci_state_fetchitd(ehci, async);
2017 break;
2018
2019 case EST_FETCHSITD:
2020 again = ehci_state_fetchsitd(ehci, async);
2021 break;
2022
2023 case EST_ADVANCEQUEUE:
2024 again = ehci_state_advqueue(q);
2025 break;
2026
2027 case EST_FETCHQTD:
2028 again = ehci_state_fetchqtd(q);
2029 break;
2030
2031 case EST_HORIZONTALQH:
2032 again = ehci_state_horizqh(q);
2033 break;
2034
2035 case EST_EXECUTE:
2036 again = ehci_state_execute(q);
2037 if (async) {
2038 ehci->async_stepdown = 0;
2039 }
2040 break;
2041
2042 case EST_EXECUTING:
2043 assert(q != NULL);
2044 if (async) {
2045 ehci->async_stepdown = 0;
2046 }
2047 again = ehci_state_executing(q);
2048 break;
2049
2050 case EST_WRITEBACK:
2051 assert(q != NULL);
2052 again = ehci_state_writeback(q);
2053 if (!async) {
2054 ehci->periodic_sched_active = PERIODIC_ACTIVE;
2055 }
2056 break;
2057
2058 default:
2059 fprintf(stderr, "Bad state!\n");
2060 again = -1;
2061 assert(0);
2062 break;
2063 }
2064
2065 if (again < 0) {
2066 fprintf(stderr, "processing error - resetting ehci HC\n");
2067 ehci_reset(ehci);
2068 again = 0;
2069 }
2070 }
2071 while (again);
2072 }
2073
2074 static void ehci_advance_async_state(EHCIState *ehci)
2075 {
2076 const int async = 1;
2077
2078 switch(ehci_get_state(ehci, async)) {
2079 case EST_INACTIVE:
2080 if (!ehci_async_enabled(ehci)) {
2081 break;
2082 }
2083 ehci_set_state(ehci, async, EST_ACTIVE);
2084 // No break, fall through to ACTIVE
2085
2086 case EST_ACTIVE:
2087 if (!ehci_async_enabled(ehci)) {
2088 ehci_queues_rip_all(ehci, async);
2089 ehci_set_state(ehci, async, EST_INACTIVE);
2090 break;
2091 }
2092
2093 /* make sure guest has acknowledged the doorbell interrupt */
2094 /* TO-DO: is this really needed? */
2095 if (ehci->usbsts & USBSTS_IAA) {
2096 DPRINTF("IAA status bit still set.\n");
2097 break;
2098 }
2099
2100 /* check that address register has been set */
2101 if (ehci->asynclistaddr == 0) {
2102 break;
2103 }
2104
2105 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2106 ehci_advance_state(ehci, async);
2107
2108 /* If the doorbell is set, the guest wants to make a change to the
2109 * schedule. The host controller needs to release cached data.
2110 * (section 4.8.2)
2111 */
2112 if (ehci->usbcmd & USBCMD_IAAD) {
2113 /* Remove all unseen qhs from the async qhs queue */
2114 ehci_queues_rip_unseen(ehci, async);
2115 trace_usb_ehci_doorbell_ack();
2116 ehci->usbcmd &= ~USBCMD_IAAD;
2117 ehci_raise_irq(ehci, USBSTS_IAA);
2118 }
2119 break;
2120
2121 default:
2122 /* this should only be due to a developer mistake */
2123 fprintf(stderr, "ehci: Bad asynchronous state %d. "
2124 "Resetting to active\n", ehci->astate);
2125 assert(0);
2126 }
2127 }
2128
2129 static void ehci_advance_periodic_state(EHCIState *ehci)
2130 {
2131 uint32_t entry;
2132 uint32_t list;
2133 const int async = 0;
2134
2135 // 4.6
2136
2137 switch(ehci_get_state(ehci, async)) {
2138 case EST_INACTIVE:
2139 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2140 ehci_set_state(ehci, async, EST_ACTIVE);
2141 // No break, fall through to ACTIVE
2142 } else
2143 break;
2144
2145 case EST_ACTIVE:
2146 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2147 ehci_queues_rip_all(ehci, async);
2148 ehci_set_state(ehci, async, EST_INACTIVE);
2149 break;
2150 }
2151
2152 list = ehci->periodiclistbase & 0xfffff000;
2153 /* check that register has been set */
2154 if (list == 0) {
2155 break;
2156 }
2157 list |= ((ehci->frindex & 0x1ff8) >> 1);
2158
2159 if (get_dwords(ehci, list, &entry, 1) < 0) {
2160 break;
2161 }
2162
2163 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n",
2164 ehci->frindex / 8, list, entry);
2165 ehci_set_fetch_addr(ehci, async,entry);
2166 ehci_set_state(ehci, async, EST_FETCHENTRY);
2167 ehci_advance_state(ehci, async);
2168 ehci_queues_rip_unused(ehci, async);
2169 break;
2170
2171 default:
2172 /* this should only be due to a developer mistake */
2173 fprintf(stderr, "ehci: Bad periodic state %d. "
2174 "Resetting to active\n", ehci->pstate);
2175 assert(0);
2176 }
2177 }
2178
2179 static void ehci_update_frindex(EHCIState *ehci, int frames)
2180 {
2181 int i;
2182
2183 if (!ehci_enabled(ehci)) {
2184 return;
2185 }
2186
2187 for (i = 0; i < frames; i++) {
2188 ehci->frindex += 8;
2189
2190 if (ehci->frindex == 0x00002000) {
2191 ehci_raise_irq(ehci, USBSTS_FLR);
2192 }
2193
2194 if (ehci->frindex == 0x00004000) {
2195 ehci_raise_irq(ehci, USBSTS_FLR);
2196 ehci->frindex = 0;
2197 if (ehci->usbsts_frindex >= 0x00004000) {
2198 ehci->usbsts_frindex -= 0x00004000;
2199 } else {
2200 ehci->usbsts_frindex = 0;
2201 }
2202 }
2203 }
2204 }
2205
2206 static void ehci_frame_timer(void *opaque)
2207 {
2208 EHCIState *ehci = opaque;
2209 int need_timer = 0;
2210 int64_t expire_time, t_now;
2211 uint64_t ns_elapsed;
2212 int frames, skipped_frames;
2213 int i;
2214
2215 t_now = qemu_get_clock_ns(vm_clock);
2216 ns_elapsed = t_now - ehci->last_run_ns;
2217 frames = ns_elapsed / FRAME_TIMER_NS;
2218
2219 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2220 need_timer++;
2221
2222 if (frames > ehci->maxframes) {
2223 skipped_frames = frames - ehci->maxframes;
2224 ehci_update_frindex(ehci, skipped_frames);
2225 ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames;
2226 frames -= skipped_frames;
2227 DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames);
2228 }
2229
2230 for (i = 0; i < frames; i++) {
2231 /*
2232 * If we're running behind schedule, we should not catch up
2233 * too fast, as that will make some guests unhappy:
2234 * 1) We must process a minimum of MIN_FR_PER_TICK frames,
2235 * otherwise we will never catch up
2236 * 2) Process frames until the guest has requested an irq (IOC)
2237 */
2238 if (i >= MIN_FR_PER_TICK) {
2239 ehci_commit_irq(ehci);
2240 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2241 break;
2242 }
2243 }
2244 if (ehci->periodic_sched_active) {
2245 ehci->periodic_sched_active--;
2246 }
2247 ehci_update_frindex(ehci, 1);
2248 ehci_advance_periodic_state(ehci);
2249 ehci->last_run_ns += FRAME_TIMER_NS;
2250 }
2251 } else {
2252 ehci->periodic_sched_active = 0;
2253 ehci_update_frindex(ehci, frames);
2254 ehci->last_run_ns += FRAME_TIMER_NS * frames;
2255 }
2256
2257 if (ehci->periodic_sched_active) {
2258 ehci->async_stepdown = 0;
2259 } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2260 ehci->async_stepdown++;
2261 }
2262
2263 /* Async is not inside loop since it executes everything it can once
2264 * called
2265 */
2266 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2267 need_timer++;
2268 ehci_advance_async_state(ehci);
2269 }
2270
2271 ehci_commit_irq(ehci);
2272 if (ehci->usbsts_pending) {
2273 need_timer++;
2274 ehci->async_stepdown = 0;
2275 }
2276
2277 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2278 need_timer++;
2279 }
2280
2281 if (need_timer) {
2282 /* If we've raised int, we speed up the timer, so that we quickly
2283 * notice any new packets queued up in response */
2284 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2285 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 2);
2286 ehci->int_req_by_async = false;
2287 } else {
2288 expire_time = t_now + (get_ticks_per_sec()
2289 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2290 }
2291 qemu_mod_timer(ehci->frame_timer, expire_time);
2292 }
2293 }
2294
2295 static const MemoryRegionOps ehci_mmio_caps_ops = {
2296 .read = ehci_caps_read,
2297 .valid.min_access_size = 1,
2298 .valid.max_access_size = 4,
2299 .impl.min_access_size = 1,
2300 .impl.max_access_size = 1,
2301 .endianness = DEVICE_LITTLE_ENDIAN,
2302 };
2303
2304 static const MemoryRegionOps ehci_mmio_opreg_ops = {
2305 .read = ehci_opreg_read,
2306 .write = ehci_opreg_write,
2307 .valid.min_access_size = 4,
2308 .valid.max_access_size = 4,
2309 .endianness = DEVICE_LITTLE_ENDIAN,
2310 };
2311
2312 static const MemoryRegionOps ehci_mmio_port_ops = {
2313 .read = ehci_port_read,
2314 .write = ehci_port_write,
2315 .valid.min_access_size = 4,
2316 .valid.max_access_size = 4,
2317 .endianness = DEVICE_LITTLE_ENDIAN,
2318 };
2319
2320 static USBPortOps ehci_port_ops = {
2321 .attach = ehci_attach,
2322 .detach = ehci_detach,
2323 .child_detach = ehci_child_detach,
2324 .wakeup = ehci_wakeup,
2325 .complete = ehci_async_complete_packet,
2326 };
2327
2328 static USBBusOps ehci_bus_ops = {
2329 .register_companion = ehci_register_companion,
2330 .wakeup_endpoint = ehci_wakeup_endpoint,
2331 };
2332
2333 static int usb_ehci_post_load(void *opaque, int version_id)
2334 {
2335 EHCIState *s = opaque;
2336 int i;
2337
2338 for (i = 0; i < NB_PORTS; i++) {
2339 USBPort *companion = s->companion_ports[i];
2340 if (companion == NULL) {
2341 continue;
2342 }
2343 if (s->portsc[i] & PORTSC_POWNER) {
2344 companion->dev = s->ports[i].dev;
2345 } else {
2346 companion->dev = NULL;
2347 }
2348 }
2349
2350 return 0;
2351 }
2352
2353 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2354 {
2355 EHCIState *ehci = opaque;
2356
2357 /*
2358 * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2359 * schedule in guest memory. We must do the rebuilt ASAP, so that
2360 * USB-devices which have async handled packages have a packet in the
2361 * ep queue to match the completion with.
2362 */
2363 if (state == RUN_STATE_RUNNING) {
2364 ehci_advance_async_state(ehci);
2365 }
2366
2367 /*
2368 * The schedule rebuilt from guest memory could cause the migration dest
2369 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2370 * will never have existed on the destination. Therefor we must flush the
2371 * async schedule on savevm to catch any not yet noticed unlinks.
2372 */
2373 if (state == RUN_STATE_SAVE_VM) {
2374 ehci_advance_async_state(ehci);
2375 ehci_queues_rip_unseen(ehci, 1);
2376 }
2377 }
2378
2379 const VMStateDescription vmstate_ehci = {
2380 .name = "ehci-core",
2381 .version_id = 2,
2382 .minimum_version_id = 1,
2383 .post_load = usb_ehci_post_load,
2384 .fields = (VMStateField[]) {
2385 /* mmio registers */
2386 VMSTATE_UINT32(usbcmd, EHCIState),
2387 VMSTATE_UINT32(usbsts, EHCIState),
2388 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2389 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2390 VMSTATE_UINT32(usbintr, EHCIState),
2391 VMSTATE_UINT32(frindex, EHCIState),
2392 VMSTATE_UINT32(ctrldssegment, EHCIState),
2393 VMSTATE_UINT32(periodiclistbase, EHCIState),
2394 VMSTATE_UINT32(asynclistaddr, EHCIState),
2395 VMSTATE_UINT32(configflag, EHCIState),
2396 VMSTATE_UINT32(portsc[0], EHCIState),
2397 VMSTATE_UINT32(portsc[1], EHCIState),
2398 VMSTATE_UINT32(portsc[2], EHCIState),
2399 VMSTATE_UINT32(portsc[3], EHCIState),
2400 VMSTATE_UINT32(portsc[4], EHCIState),
2401 VMSTATE_UINT32(portsc[5], EHCIState),
2402 /* frame timer */
2403 VMSTATE_TIMER(frame_timer, EHCIState),
2404 VMSTATE_UINT64(last_run_ns, EHCIState),
2405 VMSTATE_UINT32(async_stepdown, EHCIState),
2406 /* schedule state */
2407 VMSTATE_UINT32(astate, EHCIState),
2408 VMSTATE_UINT32(pstate, EHCIState),
2409 VMSTATE_UINT32(a_fetch_addr, EHCIState),
2410 VMSTATE_UINT32(p_fetch_addr, EHCIState),
2411 VMSTATE_END_OF_LIST()
2412 }
2413 };
2414
2415 void usb_ehci_initfn(EHCIState *s, DeviceState *dev)
2416 {
2417 int i;
2418
2419 /* 2.2 host controller interface version */
2420 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2421 s->caps[0x01] = 0x00;
2422 s->caps[0x02] = 0x00;
2423 s->caps[0x03] = 0x01; /* HC version */
2424 s->caps[0x04] = NB_PORTS; /* Number of downstream ports */
2425 s->caps[0x05] = 0x00; /* No companion ports at present */
2426 s->caps[0x06] = 0x00;
2427 s->caps[0x07] = 0x00;
2428 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
2429 s->caps[0x0a] = 0x00;
2430 s->caps[0x0b] = 0x00;
2431
2432 usb_bus_new(&s->bus, &ehci_bus_ops, dev);
2433 for(i = 0; i < NB_PORTS; i++) {
2434 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2435 USB_SPEED_MASK_HIGH);
2436 s->ports[i].dev = 0;
2437 }
2438
2439 s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
2440 s->async_bh = qemu_bh_new(ehci_frame_timer, s);
2441 QTAILQ_INIT(&s->aqueues);
2442 QTAILQ_INIT(&s->pqueues);
2443 usb_packet_init(&s->ipacket);
2444
2445 qemu_register_reset(ehci_reset, s);
2446 qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2447
2448 memory_region_init(&s->mem, "ehci", MMIO_SIZE);
2449 memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
2450 "capabilities", CAPA_SIZE);
2451 memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
2452 "operational", PORTSC_BEGIN);
2453 memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
2454 "ports", PORTSC_END - PORTSC_BEGIN);
2455
2456 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2457 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2458 memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN,
2459 &s->mem_ports);
2460 }
2461
2462 /*
2463 * vim: expandtab ts=4
2464 */
AR7 emulation for QEMU