hw/usb/core.c

   1 /*
   2  * QEMU USB emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * 2008 Generic packet handler rewrite by Max Krasnyansky
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  24  * THE SOFTWARE.
  25  */
  26 #include "qemu/osdep.h"
  27 #include "hw/usb.h"
  28 #include "qemu/iov.h"
  29 #include "trace.h"
  30
  31 void usb_pick_speed(USBPort *port)
  32 {
  33     static const int speeds[] = {
  34         USB_SPEED_SUPER,
  35         USB_SPEED_HIGH,
  36         USB_SPEED_FULL,
  37         USB_SPEED_LOW,
  38     };
  39     USBDevice *udev = port->dev;
  40     int i;
  41
  42     for (i = 0; i < ARRAY_SIZE(speeds); i++) {
  43         if ((udev->speedmask & (1 << speeds[i])) &&
  44             (port->speedmask & (1 << speeds[i]))) {
  45             udev->speed = speeds[i];
  46             return;
  47         }
  48     }
  49 }
  50
  51 void usb_attach(USBPort *port)
  52 {
  53     USBDevice *dev = port->dev;
  54
  55     assert(dev != NULL);
  56     assert(dev->attached);
  57     assert(dev->state == USB_STATE_NOTATTACHED);
  58     usb_pick_speed(port);
  59     port->ops->attach(port);
  60     dev->state = USB_STATE_ATTACHED;
  61     usb_device_handle_attach(dev);
  62 }
  63
  64 void usb_detach(USBPort *port)
  65 {
  66     USBDevice *dev = port->dev;
  67
  68     assert(dev != NULL);
  69     assert(dev->state != USB_STATE_NOTATTACHED);
  70     port->ops->detach(port);
  71     dev->state = USB_STATE_NOTATTACHED;
  72 }
  73
  74 void usb_port_reset(USBPort *port)
  75 {
  76     USBDevice *dev = port->dev;
  77
  78     assert(dev != NULL);
  79     usb_detach(port);
  80     usb_attach(port);
  81     usb_device_reset(dev);
  82 }
  83
  84 void usb_device_reset(USBDevice *dev)
  85 {
  86     if (dev == NULL || !dev->attached) {
  87         return;
  88     }
  89     usb_device_handle_reset(dev);
  90     dev->remote_wakeup = 0;
  91     dev->addr = 0;
  92     dev->state = USB_STATE_DEFAULT;
  93 }
  94
  95 void usb_wakeup(USBEndpoint *ep, unsigned int stream)
  96 {
  97     USBDevice *dev = ep->dev;
  98     USBBus *bus = usb_bus_from_device(dev);
  99
 100     if (!phase_check(PHASE_MACHINE_READY)) {
 101         /*
 102          * This is machine init cold plug.  No need to wakeup anyone,
 103          * all devices will be reset anyway.  And trying to wakeup can
 104          * cause problems due to hitting uninitialized devices.
 105          */
 106         return;
 107     }
 108     if (dev->remote_wakeup && dev->port && dev->port->ops->wakeup) {
 109         dev->port->ops->wakeup(dev->port);
 110     }
 111     if (bus->ops->wakeup_endpoint) {
 112         bus->ops->wakeup_endpoint(bus, ep, stream);
 113     }
 114 }
 115
 116 /**********************/
 117
 118 /* generic USB device helpers (you are not forced to use them when
 119    writing your USB device driver, but they help handling the
 120    protocol)
 121 */
 122
 123 #define SETUP_STATE_IDLE  0
 124 #define SETUP_STATE_SETUP 1
 125 #define SETUP_STATE_DATA  2
 126 #define SETUP_STATE_ACK   3
 127 #define SETUP_STATE_PARAM 4
 128
 129 static void do_token_setup(USBDevice *s, USBPacket *p)
 130 {
 131     int request, value, index;
 132     unsigned int setup_len;
 133
 134     if (p->iov.size != 8) {
 135         p->status = USB_RET_STALL;
 136         return;
 137     }
 138
 139     usb_packet_copy(p, s->setup_buf, p->iov.size);
 140     s->setup_index = 0;
 141     p->actual_length = 0;
 142     setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
 143     if (setup_len > sizeof(s->data_buf)) {
 144         fprintf(stderr,
 145                 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
 146                 setup_len, sizeof(s->data_buf));
 147         p->status = USB_RET_STALL;
 148         return;
 149     }
 150     s->setup_len = setup_len;
 151
 152     request = (s->setup_buf[0] << 8) | s->setup_buf[1];
 153     value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
 154     index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
 155
 156     if (s->setup_buf[0] & USB_DIR_IN) {
 157         usb_device_handle_control(s, p, request, value, index,
 158                                   s->setup_len, s->data_buf);
 159         if (p->status == USB_RET_ASYNC) {
 160             s->setup_state = SETUP_STATE_SETUP;
 161         }
 162         if (p->status != USB_RET_SUCCESS) {
 163             return;
 164         }
 165
 166         if (p->actual_length < s->setup_len) {
 167             s->setup_len = p->actual_length;
 168         }
 169         s->setup_state = SETUP_STATE_DATA;
 170     } else {
 171         if (s->setup_len == 0)
 172             s->setup_state = SETUP_STATE_ACK;
 173         else
 174             s->setup_state = SETUP_STATE_DATA;
 175     }
 176
 177     p->actual_length = 8;
 178 }
 179
 180 static void do_token_in(USBDevice *s, USBPacket *p)
 181 {
 182     int request, value, index;
 183
 184     assert(p->ep->nr == 0);
 185
 186     request = (s->setup_buf[0] << 8) | s->setup_buf[1];
 187     value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
 188     index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
 189
 190     switch(s->setup_state) {
 191     case SETUP_STATE_ACK:
 192         if (!(s->setup_buf[0] & USB_DIR_IN)) {
 193             usb_device_handle_control(s, p, request, value, index,
 194                                       s->setup_len, s->data_buf);
 195             if (p->status == USB_RET_ASYNC) {
 196                 return;
 197             }
 198             s->setup_state = SETUP_STATE_IDLE;
 199             p->actual_length = 0;
 200         }
 201         break;
 202
 203     case SETUP_STATE_DATA:
 204         if (s->setup_buf[0] & USB_DIR_IN) {
 205             int len = s->setup_len - s->setup_index;
 206             if (len > p->iov.size) {
 207                 len = p->iov.size;
 208             }
 209             usb_packet_copy(p, s->data_buf + s->setup_index, len);
 210             s->setup_index += len;
 211             if (s->setup_index >= s->setup_len) {
 212                 s->setup_state = SETUP_STATE_ACK;
 213             }
 214             return;
 215         }
 216         s->setup_state = SETUP_STATE_IDLE;
 217         p->status = USB_RET_STALL;
 218         break;
 219
 220     default:
 221         p->status = USB_RET_STALL;
 222     }
 223 }
 224
 225 static void do_token_out(USBDevice *s, USBPacket *p)
 226 {
 227     assert(p->ep->nr == 0);
 228
 229     switch(s->setup_state) {
 230     case SETUP_STATE_ACK:
 231         if (s->setup_buf[0] & USB_DIR_IN) {
 232             s->setup_state = SETUP_STATE_IDLE;
 233             /* transfer OK */
 234         } else {
 235             /* ignore additional output */
 236         }
 237         break;
 238
 239     case SETUP_STATE_DATA:
 240         if (!(s->setup_buf[0] & USB_DIR_IN)) {
 241             int len = s->setup_len - s->setup_index;
 242             if (len > p->iov.size) {
 243                 len = p->iov.size;
 244             }
 245             usb_packet_copy(p, s->data_buf + s->setup_index, len);
 246             s->setup_index += len;
 247             if (s->setup_index >= s->setup_len) {
 248                 s->setup_state = SETUP_STATE_ACK;
 249             }
 250             return;
 251         }
 252         s->setup_state = SETUP_STATE_IDLE;
 253         p->status = USB_RET_STALL;
 254         break;
 255
 256     default:
 257         p->status = USB_RET_STALL;
 258     }
 259 }
 260
 261 static void do_parameter(USBDevice *s, USBPacket *p)
 262 {
 263     int i, request, value, index;
 264     unsigned int setup_len;
 265
 266     for (i = 0; i < 8; i++) {
 267         s->setup_buf[i] = p->parameter >> (i*8);
 268     }
 269
 270     s->setup_state = SETUP_STATE_PARAM;
 271     s->setup_index = 0;
 272
 273     request = (s->setup_buf[0] << 8) | s->setup_buf[1];
 274     value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
 275     index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
 276
 277     setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
 278     if (setup_len > sizeof(s->data_buf)) {
 279         fprintf(stderr,
 280                 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
 281                 setup_len, sizeof(s->data_buf));
 282         p->status = USB_RET_STALL;
 283         return;
 284     }
 285     s->setup_len = setup_len;
 286
 287     if (p->pid == USB_TOKEN_OUT) {
 288         usb_packet_copy(p, s->data_buf, s->setup_len);
 289     }
 290
 291     usb_device_handle_control(s, p, request, value, index,
 292                               s->setup_len, s->data_buf);
 293     if (p->status == USB_RET_ASYNC) {
 294         return;
 295     }
 296
 297     if (p->actual_length < s->setup_len) {
 298         s->setup_len = p->actual_length;
 299     }
 300     if (p->pid == USB_TOKEN_IN) {
 301         p->actual_length = 0;
 302         usb_packet_copy(p, s->data_buf, s->setup_len);
 303     }
 304 }
 305
 306 /* ctrl complete function for devices which use usb_generic_handle_packet and
 307    may return USB_RET_ASYNC from their handle_control callback. Device code
 308    which does this *must* call this function instead of the normal
 309    usb_packet_complete to complete their async control packets. */
 310 void usb_generic_async_ctrl_complete(USBDevice *s, USBPacket *p)
 311 {
 312     if (p->status < 0) {
 313         s->setup_state = SETUP_STATE_IDLE;
 314     }
 315
 316     switch (s->setup_state) {
 317     case SETUP_STATE_SETUP:
 318         if (p->actual_length < s->setup_len) {
 319             s->setup_len = p->actual_length;
 320         }
 321         s->setup_state = SETUP_STATE_DATA;
 322         p->actual_length = 8;
 323         break;
 324
 325     case SETUP_STATE_ACK:
 326         s->setup_state = SETUP_STATE_IDLE;
 327         p->actual_length = 0;
 328         break;
 329
 330     case SETUP_STATE_PARAM:
 331         if (p->actual_length < s->setup_len) {
 332             s->setup_len = p->actual_length;
 333         }
 334         if (p->pid == USB_TOKEN_IN) {
 335             p->actual_length = 0;
 336             usb_packet_copy(p, s->data_buf, s->setup_len);
 337         }
 338         break;
 339
 340     default:
 341         break;
 342     }
 343     usb_packet_complete(s, p);
 344 }
 345
 346 USBDevice *usb_find_device(USBPort *port, uint8_t addr)
 347 {
 348     USBDevice *dev = port->dev;
 349
 350     if (dev == NULL || !dev->attached || dev->state != USB_STATE_DEFAULT) {
 351         return NULL;
 352     }
 353     if (dev->addr == addr) {
 354         return dev;
 355     }
 356     return usb_device_find_device(dev, addr);
 357 }
 358
 359 static void usb_process_one(USBPacket *p)
 360 {
 361     USBDevice *dev = p->ep->dev;
 362
 363     /*
 364      * Handlers expect status to be initialized to USB_RET_SUCCESS, but it
 365      * can be USB_RET_NAK here from a previous usb_process_one() call,
 366      * or USB_RET_ASYNC from going through usb_queue_one().
 367      */
 368     p->status = USB_RET_SUCCESS;
 369
 370     if (p->ep->nr == 0) {
 371         /* control pipe */
 372         if (p->parameter) {
 373             do_parameter(dev, p);
 374             return;
 375         }
 376         switch (p->pid) {
 377         case USB_TOKEN_SETUP:
 378             do_token_setup(dev, p);
 379             break;
 380         case USB_TOKEN_IN:
 381             do_token_in(dev, p);
 382             break;
 383         case USB_TOKEN_OUT:
 384             do_token_out(dev, p);
 385             break;
 386         default:
 387             p->status = USB_RET_STALL;
 388         }
 389     } else {
 390         /* data pipe */
 391         usb_device_handle_data(dev, p);
 392     }
 393 }
 394
 395 static void usb_queue_one(USBPacket *p)
 396 {
 397     usb_packet_set_state(p, USB_PACKET_QUEUED);
 398     QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue);
 399     p->status = USB_RET_ASYNC;
 400 }
 401
 402 /* Hand over a packet to a device for processing.  p->status ==
 403    USB_RET_ASYNC indicates the processing isn't finished yet, the
 404    driver will call usb_packet_complete() when done processing it. */
 405 void usb_handle_packet(USBDevice *dev, USBPacket *p)
 406 {
 407     if (dev == NULL) {
 408         p->status = USB_RET_NODEV;
 409         return;
 410     }
 411     assert(dev == p->ep->dev);
 412     assert(dev->state == USB_STATE_DEFAULT);
 413     usb_packet_check_state(p, USB_PACKET_SETUP);
 414     assert(p->ep != NULL);
 415
 416     /* Submitting a new packet clears halt */
 417     if (p->ep->halted) {
 418         assert(QTAILQ_EMPTY(&p->ep->queue));
 419         p->ep->halted = false;
 420     }
 421
 422     if (QTAILQ_EMPTY(&p->ep->queue) || p->ep->pipeline || p->stream) {
 423         usb_process_one(p);
 424         if (p->status == USB_RET_ASYNC) {
 425             /* hcd drivers cannot handle async for isoc */
 426             assert(p->ep->type != USB_ENDPOINT_XFER_ISOC);
 427             /* using async for interrupt packets breaks migration */
 428             assert(p->ep->type != USB_ENDPOINT_XFER_INT ||
 429                    (dev->flags & (1 << USB_DEV_FLAG_IS_HOST)));
 430             usb_packet_set_state(p, USB_PACKET_ASYNC);
 431             QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue);
 432         } else if (p->status == USB_RET_ADD_TO_QUEUE) {
 433             usb_queue_one(p);
 434         } else {
 435             /*
 436              * When pipelining is enabled usb-devices must always return async,
 437              * otherwise packets can complete out of order!
 438              */
 439             assert(p->stream || !p->ep->pipeline ||
 440                    QTAILQ_EMPTY(&p->ep->queue));
 441             if (p->status != USB_RET_NAK) {
 442                 usb_packet_set_state(p, USB_PACKET_COMPLETE);
 443             }
 444         }
 445     } else {
 446         usb_queue_one(p);
 447     }
 448 }
 449
 450 void usb_packet_complete_one(USBDevice *dev, USBPacket *p)
 451 {
 452     USBEndpoint *ep = p->ep;
 453
 454     assert(p->stream || QTAILQ_FIRST(&ep->queue) == p);
 455     assert(p->status != USB_RET_ASYNC && p->status != USB_RET_NAK);
 456
 457     if (p->status != USB_RET_SUCCESS ||
 458             (p->short_not_ok && (p->actual_length < p->iov.size))) {
 459         ep->halted = true;
 460     }
 461     usb_packet_set_state(p, USB_PACKET_COMPLETE);
 462     QTAILQ_REMOVE(&ep->queue, p, queue);
 463     dev->port->ops->complete(dev->port, p);
 464 }
 465
 466 /* Notify the controller that an async packet is complete.  This should only
 467    be called for packets previously deferred by returning USB_RET_ASYNC from
 468    handle_packet. */
 469 void usb_packet_complete(USBDevice *dev, USBPacket *p)
 470 {
 471     USBEndpoint *ep = p->ep;
 472
 473     usb_packet_check_state(p, USB_PACKET_ASYNC);
 474     usb_packet_complete_one(dev, p);
 475
 476     while (!QTAILQ_EMPTY(&ep->queue)) {
 477         p = QTAILQ_FIRST(&ep->queue);
 478         if (ep->halted) {
 479             /* Empty the queue on a halt */
 480             p->status = USB_RET_REMOVE_FROM_QUEUE;
 481             dev->port->ops->complete(dev->port, p);
 482             continue;
 483         }
 484         if (p->state == USB_PACKET_ASYNC) {
 485             break;
 486         }
 487         usb_packet_check_state(p, USB_PACKET_QUEUED);
 488         usb_process_one(p);
 489         if (p->status == USB_RET_ASYNC) {
 490             usb_packet_set_state(p, USB_PACKET_ASYNC);
 491             break;
 492         }
 493         usb_packet_complete_one(ep->dev, p);
 494     }
 495 }
 496
 497 /* Cancel an active packet.  The packed must have been deferred by
 498    returning USB_RET_ASYNC from handle_packet, and not yet
 499    completed.  */
 500 void usb_cancel_packet(USBPacket * p)
 501 {
 502     bool callback = (p->state == USB_PACKET_ASYNC);
 503     assert(usb_packet_is_inflight(p));
 504     usb_packet_set_state(p, USB_PACKET_CANCELED);
 505     QTAILQ_REMOVE(&p->ep->queue, p, queue);
 506     if (callback) {
 507         usb_device_cancel_packet(p->ep->dev, p);
 508     }
 509 }
 510
 511
 512 void usb_packet_init(USBPacket *p)
 513 {
 514     qemu_iovec_init(&p->iov, 1);
 515 }
 516
 517 static const char *usb_packet_state_name(USBPacketState state)
 518 {
 519     static const char *name[] = {
 520         [USB_PACKET_UNDEFINED] = "undef",
 521         [USB_PACKET_SETUP]     = "setup",
 522         [USB_PACKET_QUEUED]    = "queued",
 523         [USB_PACKET_ASYNC]     = "async",
 524         [USB_PACKET_COMPLETE]  = "complete",
 525         [USB_PACKET_CANCELED]  = "canceled",
 526     };
 527     if (state < ARRAY_SIZE(name)) {
 528         return name[state];
 529     }
 530     return "INVALID";
 531 }
 532
 533 void usb_packet_check_state(USBPacket *p, USBPacketState expected)
 534 {
 535     USBDevice *dev;
 536     USBBus *bus;
 537
 538     if (p->state == expected) {
 539         return;
 540     }
 541     dev = p->ep->dev;
 542     bus = usb_bus_from_device(dev);
 543     trace_usb_packet_state_fault(bus->busnr, dev->port->path, p->ep->nr, p,
 544                                  usb_packet_state_name(p->state),
 545                                  usb_packet_state_name(expected));
 546     assert(!"usb packet state check failed");
 547 }
 548
 549 void usb_packet_set_state(USBPacket *p, USBPacketState state)
 550 {
 551     if (p->ep) {
 552         USBDevice *dev = p->ep->dev;
 553         USBBus *bus = usb_bus_from_device(dev);
 554         trace_usb_packet_state_change(bus->busnr, dev->port->path, p->ep->nr, p,
 555                                       usb_packet_state_name(p->state),
 556                                       usb_packet_state_name(state));
 557     } else {
 558         trace_usb_packet_state_change(-1, "", -1, p,
 559                                       usb_packet_state_name(p->state),
 560                                       usb_packet_state_name(state));
 561     }
 562     p->state = state;
 563 }
 564
 565 void usb_packet_setup(USBPacket *p, int pid,
 566                       USBEndpoint *ep, unsigned int stream,
 567                       uint64_t id, bool short_not_ok, bool int_req)
 568 {
 569     assert(!usb_packet_is_inflight(p));
 570     assert(p->iov.iov != NULL);
 571     p->id = id;
 572     p->pid = pid;
 573     p->ep = ep;
 574     p->stream = stream;
 575     p->status = USB_RET_SUCCESS;
 576     p->actual_length = 0;
 577     p->parameter = 0;
 578     p->short_not_ok = short_not_ok;
 579     p->int_req = int_req;
 580     p->combined = NULL;
 581     qemu_iovec_reset(&p->iov);
 582     usb_packet_set_state(p, USB_PACKET_SETUP);
 583 }
 584
 585 void usb_packet_addbuf(USBPacket *p, void *ptr, size_t len)
 586 {
 587     qemu_iovec_add(&p->iov, ptr, len);
 588 }
 589
 590 void usb_packet_copy(USBPacket *p, void *ptr, size_t bytes)
 591 {
 592     QEMUIOVector *iov = p->combined ? &p->combined->iov : &p->iov;
 593
 594     assert(p->actual_length >= 0);
 595     assert(p->actual_length + bytes <= iov->size);
 596     switch (p->pid) {
 597     case USB_TOKEN_SETUP:
 598     case USB_TOKEN_OUT:
 599         iov_to_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
 600         break;
 601     case USB_TOKEN_IN:
 602         iov_from_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
 603         break;
 604     default:
 605         fprintf(stderr, "%s: invalid pid: %x\n", __func__, p->pid);
 606         abort();
 607     }
 608     p->actual_length += bytes;
 609 }
 610
 611 void usb_packet_skip(USBPacket *p, size_t bytes)
 612 {
 613     QEMUIOVector *iov = p->combined ? &p->combined->iov : &p->iov;
 614
 615     assert(p->actual_length >= 0);
 616     assert(p->actual_length + bytes <= iov->size);
 617     if (p->pid == USB_TOKEN_IN) {
 618         iov_memset(iov->iov, iov->niov, p->actual_length, 0, bytes);
 619     }
 620     p->actual_length += bytes;
 621 }
 622
 623 size_t usb_packet_size(USBPacket *p)
 624 {
 625     return p->combined ? p->combined->iov.size : p->iov.size;
 626 }
 627
 628 void usb_packet_cleanup(USBPacket *p)
 629 {
 630     assert(!usb_packet_is_inflight(p));
 631     qemu_iovec_destroy(&p->iov);
 632 }
 633
 634 void usb_ep_reset(USBDevice *dev)
 635 {
 636     int ep;
 637
 638     dev->ep_ctl.nr = 0;
 639     dev->ep_ctl.type = USB_ENDPOINT_XFER_CONTROL;
 640     dev->ep_ctl.ifnum = 0;
 641     dev->ep_ctl.max_packet_size = 64;
 642     dev->ep_ctl.max_streams = 0;
 643     dev->ep_ctl.dev = dev;
 644     dev->ep_ctl.pipeline = false;
 645     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
 646         dev->ep_in[ep].nr = ep + 1;
 647         dev->ep_out[ep].nr = ep + 1;
 648         dev->ep_in[ep].pid = USB_TOKEN_IN;
 649         dev->ep_out[ep].pid = USB_TOKEN_OUT;
 650         dev->ep_in[ep].type = USB_ENDPOINT_XFER_INVALID;
 651         dev->ep_out[ep].type = USB_ENDPOINT_XFER_INVALID;
 652         dev->ep_in[ep].ifnum = USB_INTERFACE_INVALID;
 653         dev->ep_out[ep].ifnum = USB_INTERFACE_INVALID;
 654         dev->ep_in[ep].max_packet_size = 0;
 655         dev->ep_out[ep].max_packet_size = 0;
 656         dev->ep_in[ep].max_streams = 0;
 657         dev->ep_out[ep].max_streams = 0;
 658         dev->ep_in[ep].dev = dev;
 659         dev->ep_out[ep].dev = dev;
 660         dev->ep_in[ep].pipeline = false;
 661         dev->ep_out[ep].pipeline = false;
 662     }
 663 }
 664
 665 void usb_ep_init(USBDevice *dev)
 666 {
 667     int ep;
 668
 669     usb_ep_reset(dev);
 670     QTAILQ_INIT(&dev->ep_ctl.queue);
 671     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
 672         QTAILQ_INIT(&dev->ep_in[ep].queue);
 673         QTAILQ_INIT(&dev->ep_out[ep].queue);
 674     }
 675 }
 676
 677 void usb_ep_dump(USBDevice *dev)
 678 {
 679     static const char *tname[] = {
 680         [USB_ENDPOINT_XFER_CONTROL] = "control",
 681         [USB_ENDPOINT_XFER_ISOC]    = "isoc",
 682         [USB_ENDPOINT_XFER_BULK]    = "bulk",
 683         [USB_ENDPOINT_XFER_INT]     = "int",
 684     };
 685     int ifnum, ep, first;
 686
 687     fprintf(stderr, "Device \"%s\", config %d\n",
 688             dev->product_desc, dev->configuration);
 689     for (ifnum = 0; ifnum < 16; ifnum++) {
 690         first = 1;
 691         for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
 692             if (dev->ep_in[ep].type != USB_ENDPOINT_XFER_INVALID &&
 693                 dev->ep_in[ep].ifnum == ifnum) {
 694                 if (first) {
 695                     first = 0;
 696                     fprintf(stderr, "  Interface %d, alternative %d\n",
 697                             ifnum, dev->altsetting[ifnum]);
 698                 }
 699                 fprintf(stderr, "    Endpoint %d, IN, %s, %d max\n", ep,
 700                         tname[dev->ep_in[ep].type],
 701                         dev->ep_in[ep].max_packet_size);
 702             }
 703             if (dev->ep_out[ep].type != USB_ENDPOINT_XFER_INVALID &&
 704                 dev->ep_out[ep].ifnum == ifnum) {
 705                 if (first) {
 706                     first = 0;
 707                     fprintf(stderr, "  Interface %d, alternative %d\n",
 708                             ifnum, dev->altsetting[ifnum]);
 709                 }
 710                 fprintf(stderr, "    Endpoint %d, OUT, %s, %d max\n", ep,
 711                         tname[dev->ep_out[ep].type],
 712                         dev->ep_out[ep].max_packet_size);
 713             }
 714         }
 715     }
 716     fprintf(stderr, "--\n");
 717 }
 718
 719 struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep)
 720 {
 721     struct USBEndpoint *eps;
 722
 723     assert(dev != NULL);
 724     if (ep == 0) {
 725         return &dev->ep_ctl;
 726     }
 727     assert(pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT);
 728     assert(ep > 0 && ep <= USB_MAX_ENDPOINTS);
 729     eps = (pid == USB_TOKEN_IN) ? dev->ep_in : dev->ep_out;
 730     return eps + ep - 1;
 731 }
 732
 733 uint8_t usb_ep_get_type(USBDevice *dev, int pid, int ep)
 734 {
 735     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 736     return uep->type;
 737 }
 738
 739 void usb_ep_set_type(USBDevice *dev, int pid, int ep, uint8_t type)
 740 {
 741     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 742     uep->type = type;
 743 }
 744
 745 void usb_ep_set_ifnum(USBDevice *dev, int pid, int ep, uint8_t ifnum)
 746 {
 747     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 748     uep->ifnum = ifnum;
 749 }
 750
 751 void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
 752                                 uint16_t raw)
 753 {
 754     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 755     int size, microframes;
 756
 757     size = raw & 0x7ff;
 758     switch ((raw >> 11) & 3) {
 759     case 1:
 760         microframes = 2;
 761         break;
 762     case 2:
 763         microframes = 3;
 764         break;
 765     default:
 766         microframes = 1;
 767         break;
 768     }
 769     uep->max_packet_size = size * microframes;
 770 }
 771
 772 void usb_ep_set_max_streams(USBDevice *dev, int pid, int ep, uint8_t raw)
 773 {
 774     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 775     int MaxStreams;
 776
 777     MaxStreams = raw & 0x1f;
 778     if (MaxStreams) {
 779         uep->max_streams = 1 << MaxStreams;
 780     } else {
 781         uep->max_streams = 0;
 782     }
 783 }
 784
 785 void usb_ep_set_halted(USBDevice *dev, int pid, int ep, bool halted)
 786 {
 787     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 788     uep->halted = halted;
 789 }
 790
 791 USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
 792                                     uint64_t id)
 793 {
 794     struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
 795     USBPacket *p;
 796
 797     QTAILQ_FOREACH(p, &uep->queue, queue) {
 798         if (p->id == id) {
 799             return p;
 800         }
 801     }
 802
 803     return NULL;
 804 }