?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Include hw/irq.h a lot less
[qemu/kevin.git] / hw / usb / hcd-ehci.c
blobd2189fc84433bbf2a2ae0a82be8a226ff2850e81
1 /*
2 * QEMU USB EHCI Emulation
3 *
4 * Copyright(c) 2008 Emutex Ltd. (address@hidden)
5 * Copyright(c) 2011-2012 Red Hat, Inc.
6 *
7 * Red Hat Authors:
8 * Gerd Hoffmann <kraxel@redhat.com>
9 * Hans de Goede <hdegoede@redhat.com>
10 *
11 * EHCI project was started by Mark Burkley, with contributions by
12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14 *
15 * This library is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU Lesser General Public
17 * License as published by the Free Software Foundation; either
18 * version 2.1 of the License, or (at your option) any later version.
19 *
20 * This library is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 * Lesser General Public License for more details.
24 *
25 * You should have received a copy of the GNU Lesser General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 */
28
29 #include "qemu/osdep.h"
30 #include "qapi/error.h"
31 #include "hw/irq.h"
32 #include "hw/usb/ehci-regs.h"
33 #include "hw/usb/hcd-ehci.h"
34 #include "trace.h"
35 #include "qemu/error-report.h"
36
37 #define FRAME_TIMER_FREQ 1000
38 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
39 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8)
40
41 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints
42 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction
43 #define MAX_QH 100 // Max allowable queue heads in a chain
44 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */
45 #define PERIODIC_ACTIVE 512 /* Micro-frames */
46
47 /* Internal periodic / asynchronous schedule state machine states
48 */
49 typedef enum {
50 EST_INACTIVE = 1000,
51 EST_ACTIVE,
52 EST_EXECUTING,
53 EST_SLEEPING,
54 /* The following states are internal to the state machine function
55 */
56 EST_WAITLISTHEAD,
57 EST_FETCHENTRY,
58 EST_FETCHQH,
59 EST_FETCHITD,
60 EST_FETCHSITD,
61 EST_ADVANCEQUEUE,
62 EST_FETCHQTD,
63 EST_EXECUTE,
64 EST_WRITEBACK,
65 EST_HORIZONTALQH
66 } EHCI_STATES;
67
68 /* macros for accessing fields within next link pointer entry */
69 #define NLPTR_GET(x) ((x) & 0xffffffe0)
70 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
71 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid
72
73 /* link pointer types */
74 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor
75 #define NLPTR_TYPE_QH 1 // queue head
76 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor
77 #define NLPTR_TYPE_FSTN 3 // frame span traversal node
78
79 #define SET_LAST_RUN_CLOCK(s) \
80 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
81
82 /* nifty macros from Arnon's EHCI version */
83 #define get_field(data, field) \
84 (((data) & field##_MASK) >> field##_SH)
85
86 #define set_field(data, newval, field) do { \
87 uint32_t val = *data; \
88 val &= ~ field##_MASK; \
89 val |= ((newval) << field##_SH) & field##_MASK; \
90 *data = val; \
91 } while(0)
92
93 static const char *ehci_state_names[] = {
94 [EST_INACTIVE] = "INACTIVE",
95 [EST_ACTIVE] = "ACTIVE",
96 [EST_EXECUTING] = "EXECUTING",
97 [EST_SLEEPING] = "SLEEPING",
98 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
99 [EST_FETCHENTRY] = "FETCH ENTRY",
100 [EST_FETCHQH] = "FETCH QH",
101 [EST_FETCHITD] = "FETCH ITD",
102 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
103 [EST_FETCHQTD] = "FETCH QTD",
104 [EST_EXECUTE] = "EXECUTE",
105 [EST_WRITEBACK] = "WRITEBACK",
106 [EST_HORIZONTALQH] = "HORIZONTALQH",
107 };
108
109 static const char *ehci_mmio_names[] = {
110 [USBCMD] = "USBCMD",
111 [USBSTS] = "USBSTS",
112 [USBINTR] = "USBINTR",
113 [FRINDEX] = "FRINDEX",
114 [PERIODICLISTBASE] = "P-LIST BASE",
115 [ASYNCLISTADDR] = "A-LIST ADDR",
116 [CONFIGFLAG] = "CONFIGFLAG",
117 };
118
119 static int ehci_state_executing(EHCIQueue *q);
120 static int ehci_state_writeback(EHCIQueue *q);
121 static int ehci_state_advqueue(EHCIQueue *q);
122 static int ehci_fill_queue(EHCIPacket *p);
123 static void ehci_free_packet(EHCIPacket *p);
124
125 static const char *nr2str(const char **n, size_t len, uint32_t nr)
126 {
127 if (nr < len && n[nr] != NULL) {
128 return n[nr];
129 } else {
130 return "unknown";
131 }
132 }
133
134 static const char *state2str(uint32_t state)
135 {
136 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
137 }
138
139 static const char *addr2str(hwaddr addr)
140 {
141 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
142 }
143
144 static void ehci_trace_usbsts(uint32_t mask, int state)
145 {
146 /* interrupts */
147 if (mask & USBSTS_INT) {
148 trace_usb_ehci_usbsts("INT", state);
149 }
150 if (mask & USBSTS_ERRINT) {
151 trace_usb_ehci_usbsts("ERRINT", state);
152 }
153 if (mask & USBSTS_PCD) {
154 trace_usb_ehci_usbsts("PCD", state);
155 }
156 if (mask & USBSTS_FLR) {
157 trace_usb_ehci_usbsts("FLR", state);
158 }
159 if (mask & USBSTS_HSE) {
160 trace_usb_ehci_usbsts("HSE", state);
161 }
162 if (mask & USBSTS_IAA) {
163 trace_usb_ehci_usbsts("IAA", state);
164 }
165
166 /* status */
167 if (mask & USBSTS_HALT) {
168 trace_usb_ehci_usbsts("HALT", state);
169 }
170 if (mask & USBSTS_REC) {
171 trace_usb_ehci_usbsts("REC", state);
172 }
173 if (mask & USBSTS_PSS) {
174 trace_usb_ehci_usbsts("PSS", state);
175 }
176 if (mask & USBSTS_ASS) {
177 trace_usb_ehci_usbsts("ASS", state);
178 }
179 }
180
181 static inline void ehci_set_usbsts(EHCIState *s, int mask)
182 {
183 if ((s->usbsts & mask) == mask) {
184 return;
185 }
186 ehci_trace_usbsts(mask, 1);
187 s->usbsts |= mask;
188 }
189
190 static inline void ehci_clear_usbsts(EHCIState *s, int mask)
191 {
192 if ((s->usbsts & mask) == 0) {
193 return;
194 }
195 ehci_trace_usbsts(mask, 0);
196 s->usbsts &= ~mask;
197 }
198
199 /* update irq line */
200 static inline void ehci_update_irq(EHCIState *s)
201 {
202 int level = 0;
203
204 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
205 level = 1;
206 }
207
208 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
209 qemu_set_irq(s->irq, level);
210 }
211
212 /* flag interrupt condition */
213 static inline void ehci_raise_irq(EHCIState *s, int intr)
214 {
215 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
216 s->usbsts |= intr;
217 ehci_update_irq(s);
218 } else {
219 s->usbsts_pending |= intr;
220 }
221 }
222
223 /*
224 * Commit pending interrupts (added via ehci_raise_irq),
225 * at the rate allowed by "Interrupt Threshold Control".
226 */
227 static inline void ehci_commit_irq(EHCIState *s)
228 {
229 uint32_t itc;
230
231 if (!s->usbsts_pending) {
232 return;
233 }
234 if (s->usbsts_frindex > s->frindex) {
235 return;
236 }
237
238 itc = (s->usbcmd >> 16) & 0xff;
239 s->usbsts |= s->usbsts_pending;
240 s->usbsts_pending = 0;
241 s->usbsts_frindex = s->frindex + itc;
242 ehci_update_irq(s);
243 }
244
245 static void ehci_update_halt(EHCIState *s)
246 {
247 if (s->usbcmd & USBCMD_RUNSTOP) {
248 ehci_clear_usbsts(s, USBSTS_HALT);
249 } else {
250 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
251 ehci_set_usbsts(s, USBSTS_HALT);
252 }
253 }
254 }
255
256 static void ehci_set_state(EHCIState *s, int async, int state)
257 {
258 if (async) {
259 trace_usb_ehci_state("async", state2str(state));
260 s->astate = state;
261 if (s->astate == EST_INACTIVE) {
262 ehci_clear_usbsts(s, USBSTS_ASS);
263 ehci_update_halt(s);
264 } else {
265 ehci_set_usbsts(s, USBSTS_ASS);
266 }
267 } else {
268 trace_usb_ehci_state("periodic", state2str(state));
269 s->pstate = state;
270 if (s->pstate == EST_INACTIVE) {
271 ehci_clear_usbsts(s, USBSTS_PSS);
272 ehci_update_halt(s);
273 } else {
274 ehci_set_usbsts(s, USBSTS_PSS);
275 }
276 }
277 }
278
279 static int ehci_get_state(EHCIState *s, int async)
280 {
281 return async ? s->astate : s->pstate;
282 }
283
284 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
285 {
286 if (async) {
287 s->a_fetch_addr = addr;
288 } else {
289 s->p_fetch_addr = addr;
290 }
291 }
292
293 static int ehci_get_fetch_addr(EHCIState *s, int async)
294 {
295 return async ? s->a_fetch_addr : s->p_fetch_addr;
296 }
297
298 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
299 {
300 /* need three here due to argument count limits */
301 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
302 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
303 trace_usb_ehci_qh_fields(addr,
304 get_field(qh->epchar, QH_EPCHAR_RL),
305 get_field(qh->epchar, QH_EPCHAR_MPLEN),
306 get_field(qh->epchar, QH_EPCHAR_EPS),
307 get_field(qh->epchar, QH_EPCHAR_EP),
308 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
309 trace_usb_ehci_qh_bits(addr,
310 (bool)(qh->epchar & QH_EPCHAR_C),
311 (bool)(qh->epchar & QH_EPCHAR_H),
312 (bool)(qh->epchar & QH_EPCHAR_DTC),
313 (bool)(qh->epchar & QH_EPCHAR_I));
314 }
315
316 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
317 {
318 /* need three here due to argument count limits */
319 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
320 trace_usb_ehci_qtd_fields(addr,
321 get_field(qtd->token, QTD_TOKEN_TBYTES),
322 get_field(qtd->token, QTD_TOKEN_CPAGE),
323 get_field(qtd->token, QTD_TOKEN_CERR),
324 get_field(qtd->token, QTD_TOKEN_PID));
325 trace_usb_ehci_qtd_bits(addr,
326 (bool)(qtd->token & QTD_TOKEN_IOC),
327 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
328 (bool)(qtd->token & QTD_TOKEN_HALT),
329 (bool)(qtd->token & QTD_TOKEN_BABBLE),
330 (bool)(qtd->token & QTD_TOKEN_XACTERR));
331 }
332
333 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
334 {
335 trace_usb_ehci_itd(addr, itd->next,
336 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
337 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
338 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
339 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
340 }
341
342 static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
343 EHCIsitd *sitd)
344 {
345 trace_usb_ehci_sitd(addr, sitd->next,
346 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
347 }
348
349 static void ehci_trace_guest_bug(EHCIState *s, const char *message)
350 {
351 trace_usb_ehci_guest_bug(message);
352 warn_report("%s", message);
353 }
354
355 static inline bool ehci_enabled(EHCIState *s)
356 {
357 return s->usbcmd & USBCMD_RUNSTOP;
358 }
359
360 static inline bool ehci_async_enabled(EHCIState *s)
361 {
362 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
363 }
364
365 static inline bool ehci_periodic_enabled(EHCIState *s)
366 {
367 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
368 }
369
370 /* Get an array of dwords from main memory */
371 static inline int get_dwords(EHCIState *ehci, uint32_t addr,
372 uint32_t *buf, int num)
373 {
374 int i;
375
376 if (!ehci->as) {
377 ehci_raise_irq(ehci, USBSTS_HSE);
378 ehci->usbcmd &= ~USBCMD_RUNSTOP;
379 trace_usb_ehci_dma_error();
380 return -1;
381 }
382
383 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
384 dma_memory_read(ehci->as, addr, buf, sizeof(*buf));
385 *buf = le32_to_cpu(*buf);
386 }
387
388 return num;
389 }
390
391 /* Put an array of dwords in to main memory */
392 static inline int put_dwords(EHCIState *ehci, uint32_t addr,
393 uint32_t *buf, int num)
394 {
395 int i;
396
397 if (!ehci->as) {
398 ehci_raise_irq(ehci, USBSTS_HSE);
399 ehci->usbcmd &= ~USBCMD_RUNSTOP;
400 trace_usb_ehci_dma_error();
401 return -1;
402 }
403
404 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
405 uint32_t tmp = cpu_to_le32(*buf);
406 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp));
407 }
408
409 return num;
410 }
411
412 static int ehci_get_pid(EHCIqtd *qtd)
413 {
414 switch (get_field(qtd->token, QTD_TOKEN_PID)) {
415 case 0:
416 return USB_TOKEN_OUT;
417 case 1:
418 return USB_TOKEN_IN;
419 case 2:
420 return USB_TOKEN_SETUP;
421 default:
422 fprintf(stderr, "bad token\n");
423 return 0;
424 }
425 }
426
427 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
428 {
429 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR);
430 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP);
431 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
432 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
433 (qh->current_qtd != q->qh.current_qtd) ||
434 (q->async && qh->next_qtd != q->qh.next_qtd) ||
435 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
436 7 * sizeof(uint32_t)) != 0) ||
437 (q->dev != NULL && q->dev->addr != devaddr)) {
438 return false;
439 } else {
440 return true;
441 }
442 }
443
444 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
445 {
446 if (p->qtdaddr != p->queue->qtdaddr ||
447 (p->queue->async && !NLPTR_TBIT(p->qtd.next) &&
448 (p->qtd.next != qtd->next)) ||
449 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
450 p->qtd.token != qtd->token ||
451 p->qtd.bufptr[0] != qtd->bufptr[0]) {
452 return false;
453 } else {
454 return true;
455 }
456 }
457
458 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
459 {
460 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP);
461 int pid = ehci_get_pid(qtd);
462
463 /* Note the pid changing is normal for ep 0 (the control ep) */
464 if (q->last_pid && ep != 0 && pid != q->last_pid) {
465 return false;
466 } else {
467 return true;
468 }
469 }
470
471 /* Finish executing and writeback a packet outside of the regular
472 fetchqh -> fetchqtd -> execute -> writeback cycle */
473 static void ehci_writeback_async_complete_packet(EHCIPacket *p)
474 {
475 EHCIQueue *q = p->queue;
476 EHCIqtd qtd;
477 EHCIqh qh;
478 int state;
479
480 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
481 get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
482 (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
483 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
484 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
485 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
486 p->async = EHCI_ASYNC_INITIALIZED;
487 ehci_free_packet(p);
488 return;
489 }
490
491 state = ehci_get_state(q->ehci, q->async);
492 ehci_state_executing(q);
493 ehci_state_writeback(q); /* Frees the packet! */
494 if (!(q->qh.token & QTD_TOKEN_HALT)) {
495 ehci_state_advqueue(q);
496 }
497 ehci_set_state(q->ehci, q->async, state);
498 }
499
500 /* packet management */
501
502 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
503 {
504 EHCIPacket *p;
505
506 p = g_new0(EHCIPacket, 1);
507 p->queue = q;
508 usb_packet_init(&p->packet);
509 QTAILQ_INSERT_TAIL(&q->packets, p, next);
510 trace_usb_ehci_packet_action(p->queue, p, "alloc");
511 return p;
512 }
513
514 static void ehci_free_packet(EHCIPacket *p)
515 {
516 if (p->async == EHCI_ASYNC_FINISHED &&
517 !(p->queue->qh.token & QTD_TOKEN_HALT)) {
518 ehci_writeback_async_complete_packet(p);
519 return;
520 }
521 trace_usb_ehci_packet_action(p->queue, p, "free");
522 if (p->async == EHCI_ASYNC_INFLIGHT) {
523 usb_cancel_packet(&p->packet);
524 }
525 if (p->async == EHCI_ASYNC_FINISHED &&
526 p->packet.status == USB_RET_SUCCESS) {
527 fprintf(stderr,
528 "EHCI: Dropping completed packet from halted %s ep %02X\n",
529 (p->pid == USB_TOKEN_IN) ? "in" : "out",
530 get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
531 }
532 if (p->async != EHCI_ASYNC_NONE) {
533 usb_packet_unmap(&p->packet, &p->sgl);
534 qemu_sglist_destroy(&p->sgl);
535 }
536 QTAILQ_REMOVE(&p->queue->packets, p, next);
537 usb_packet_cleanup(&p->packet);
538 g_free(p);
539 }
540
541 /* queue management */
542
543 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
544 {
545 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
546 EHCIQueue *q;
547
548 q = g_malloc0(sizeof(*q));
549 q->ehci = ehci;
550 q->qhaddr = addr;
551 q->async = async;
552 QTAILQ_INIT(&q->packets);
553 QTAILQ_INSERT_HEAD(head, q, next);
554 trace_usb_ehci_queue_action(q, "alloc");
555 return q;
556 }
557
558 static void ehci_queue_stopped(EHCIQueue *q)
559 {
560 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP);
561
562 if (!q->last_pid || !q->dev) {
563 return;
564 }
565
566 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp));
567 }
568
569 static int ehci_cancel_queue(EHCIQueue *q)
570 {
571 EHCIPacket *p;
572 int packets = 0;
573
574 p = QTAILQ_FIRST(&q->packets);
575 if (p == NULL) {
576 goto leave;
577 }
578
579 trace_usb_ehci_queue_action(q, "cancel");
580 do {
581 ehci_free_packet(p);
582 packets++;
583 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
584
585 leave:
586 ehci_queue_stopped(q);
587 return packets;
588 }
589
590 static int ehci_reset_queue(EHCIQueue *q)
591 {
592 int packets;
593
594 trace_usb_ehci_queue_action(q, "reset");
595 packets = ehci_cancel_queue(q);
596 q->dev = NULL;
597 q->qtdaddr = 0;
598 q->last_pid = 0;
599 return packets;
600 }
601
602 static void ehci_free_queue(EHCIQueue *q, const char *warn)
603 {
604 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
605 int cancelled;
606
607 trace_usb_ehci_queue_action(q, "free");
608 cancelled = ehci_cancel_queue(q);
609 if (warn && cancelled > 0) {
610 ehci_trace_guest_bug(q->ehci, warn);
611 }
612 QTAILQ_REMOVE(head, q, next);
613 g_free(q);
614 }
615
616 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
617 int async)
618 {
619 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
620 EHCIQueue *q;
621
622 QTAILQ_FOREACH(q, head, next) {
623 if (addr == q->qhaddr) {
624 return q;
625 }
626 }
627 return NULL;
628 }
629
630 static void ehci_queues_rip_unused(EHCIState *ehci, int async)
631 {
632 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
633 const char *warn = async ? "guest unlinked busy QH" : NULL;
634 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
635 EHCIQueue *q, *tmp;
636
637 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
638 if (q->seen) {
639 q->seen = 0;
640 q->ts = ehci->last_run_ns;
641 continue;
642 }
643 if (ehci->last_run_ns < q->ts + maxage) {
644 continue;
645 }
646 ehci_free_queue(q, warn);
647 }
648 }
649
650 static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
651 {
652 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
653 EHCIQueue *q, *tmp;
654
655 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
656 if (!q->seen) {
657 ehci_free_queue(q, NULL);
658 }
659 }
660 }
661
662 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
663 {
664 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
665 EHCIQueue *q, *tmp;
666
667 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
668 if (q->dev != dev) {
669 continue;
670 }
671 ehci_free_queue(q, NULL);
672 }
673 }
674
675 static void ehci_queues_rip_all(EHCIState *ehci, int async)
676 {
677 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
678 const char *warn = async ? "guest stopped busy async schedule" : NULL;
679 EHCIQueue *q, *tmp;
680
681 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
682 ehci_free_queue(q, warn);
683 }
684 }
685
686 /* Attach or detach a device on root hub */
687
688 static void ehci_attach(USBPort *port)
689 {
690 EHCIState *s = port->opaque;
691 uint32_t *portsc = &s->portsc[port->index];
692 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
693
694 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
695
696 if (*portsc & PORTSC_POWNER) {
697 USBPort *companion = s->companion_ports[port->index];
698 companion->dev = port->dev;
699 companion->ops->attach(companion);
700 return;
701 }
702
703 *portsc |= PORTSC_CONNECT;
704 *portsc |= PORTSC_CSC;
705
706 ehci_raise_irq(s, USBSTS_PCD);
707 }
708
709 static void ehci_detach(USBPort *port)
710 {
711 EHCIState *s = port->opaque;
712 uint32_t *portsc = &s->portsc[port->index];
713 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
714
715 trace_usb_ehci_port_detach(port->index, owner);
716
717 if (*portsc & PORTSC_POWNER) {
718 USBPort *companion = s->companion_ports[port->index];
719 companion->ops->detach(companion);
720 companion->dev = NULL;
721 /*
722 * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
723 * the port ownership is returned immediately to the EHCI controller."
724 */
725 *portsc &= ~PORTSC_POWNER;
726 return;
727 }
728
729 ehci_queues_rip_device(s, port->dev, 0);
730 ehci_queues_rip_device(s, port->dev, 1);
731
732 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
733 *portsc |= PORTSC_CSC;
734
735 ehci_raise_irq(s, USBSTS_PCD);
736 }
737
738 static void ehci_child_detach(USBPort *port, USBDevice *child)
739 {
740 EHCIState *s = port->opaque;
741 uint32_t portsc = s->portsc[port->index];
742
743 if (portsc & PORTSC_POWNER) {
744 USBPort *companion = s->companion_ports[port->index];
745 companion->ops->child_detach(companion, child);
746 return;
747 }
748
749 ehci_queues_rip_device(s, child, 0);
750 ehci_queues_rip_device(s, child, 1);
751 }
752
753 static void ehci_wakeup(USBPort *port)
754 {
755 EHCIState *s = port->opaque;
756 uint32_t *portsc = &s->portsc[port->index];
757
758 if (*portsc & PORTSC_POWNER) {
759 USBPort *companion = s->companion_ports[port->index];
760 if (companion->ops->wakeup) {
761 companion->ops->wakeup(companion);
762 }
763 return;
764 }
765
766 if (*portsc & PORTSC_SUSPEND) {
767 trace_usb_ehci_port_wakeup(port->index);
768 *portsc |= PORTSC_FPRES;
769 ehci_raise_irq(s, USBSTS_PCD);
770 }
771
772 qemu_bh_schedule(s->async_bh);
773 }
774
775 static void ehci_register_companion(USBBus *bus, USBPort *ports[],
776 uint32_t portcount, uint32_t firstport,
777 Error **errp)
778 {
779 EHCIState *s = container_of(bus, EHCIState, bus);
780 uint32_t i;
781
782 if (firstport + portcount > NB_PORTS) {
783 error_setg(errp, "firstport must be between 0 and %u",
784 NB_PORTS - portcount);
785 return;
786 }
787
788 for (i = 0; i < portcount; i++) {
789 if (s->companion_ports[firstport + i]) {
790 error_setg(errp, "firstport %u asks for ports %u-%u,"
791 " but port %u has a companion assigned already",
792 firstport, firstport, firstport + portcount - 1,
793 firstport + i);
794 return;
795 }
796 }
797
798 for (i = 0; i < portcount; i++) {
799 s->companion_ports[firstport + i] = ports[i];
800 s->ports[firstport + i].speedmask |=
801 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
802 /* Ensure devs attached before the initial reset go to the companion */
803 s->portsc[firstport + i] = PORTSC_POWNER;
804 }
805
806 s->companion_count++;
807 s->caps[0x05] = (s->companion_count << 4) | portcount;
808 }
809
810 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
811 unsigned int stream)
812 {
813 EHCIState *s = container_of(bus, EHCIState, bus);
814 uint32_t portsc = s->portsc[ep->dev->port->index];
815
816 if (portsc & PORTSC_POWNER) {
817 return;
818 }
819
820 s->periodic_sched_active = PERIODIC_ACTIVE;
821 qemu_bh_schedule(s->async_bh);
822 }
823
824 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
825 {
826 USBDevice *dev;
827 USBPort *port;
828 int i;
829
830 for (i = 0; i < NB_PORTS; i++) {
831 port = &ehci->ports[i];
832 if (!(ehci->portsc[i] & PORTSC_PED)) {
833 DPRINTF("Port %d not enabled\n", i);
834 continue;
835 }
836 dev = usb_find_device(port, addr);
837 if (dev != NULL) {
838 return dev;
839 }
840 }
841 return NULL;
842 }
843
844 /* 4.1 host controller initialization */
845 void ehci_reset(void *opaque)
846 {
847 EHCIState *s = opaque;
848 int i;
849 USBDevice *devs[NB_PORTS];
850
851 trace_usb_ehci_reset();
852
853 /*
854 * Do the detach before touching portsc, so that it correctly gets send to
855 * us or to our companion based on PORTSC_POWNER before the reset.
856 */
857 for(i = 0; i < NB_PORTS; i++) {
858 devs[i] = s->ports[i].dev;
859 if (devs[i] && devs[i]->attached) {
860 usb_detach(&s->ports[i]);
861 }
862 }
863
864 memset(&s->opreg, 0x00, sizeof(s->opreg));
865 memset(&s->portsc, 0x00, sizeof(s->portsc));
866
867 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
868 s->usbsts = USBSTS_HALT;
869 s->usbsts_pending = 0;
870 s->usbsts_frindex = 0;
871 ehci_update_irq(s);
872
873 s->astate = EST_INACTIVE;
874 s->pstate = EST_INACTIVE;
875
876 for(i = 0; i < NB_PORTS; i++) {
877 if (s->companion_ports[i]) {
878 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
879 } else {
880 s->portsc[i] = PORTSC_PPOWER;
881 }
882 if (devs[i] && devs[i]->attached) {
883 usb_attach(&s->ports[i]);
884 usb_device_reset(devs[i]);
885 }
886 }
887 ehci_queues_rip_all(s, 0);
888 ehci_queues_rip_all(s, 1);
889 timer_del(s->frame_timer);
890 qemu_bh_cancel(s->async_bh);
891 }
892
893 static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
894 unsigned size)
895 {
896 EHCIState *s = ptr;
897 return s->caps[addr];
898 }
899
900 static void ehci_caps_write(void *ptr, hwaddr addr,
901 uint64_t val, unsigned size)
902 {
903 }
904
905 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
906 unsigned size)
907 {
908 EHCIState *s = ptr;
909 uint32_t val;
910
911 switch (addr) {
912 case FRINDEX:
913 /* Round down to mult of 8, else it can go backwards on migration */
914 val = s->frindex & ~7;
915 break;
916 default:
917 val = s->opreg[addr >> 2];
918 }
919
920 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
921 return val;
922 }
923
924 static uint64_t ehci_port_read(void *ptr, hwaddr addr,
925 unsigned size)
926 {
927 EHCIState *s = ptr;
928 uint32_t val;
929
930 val = s->portsc[addr >> 2];
931 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
932 return val;
933 }
934
935 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
936 {
937 USBDevice *dev = s->ports[port].dev;
938 uint32_t *portsc = &s->portsc[port];
939 uint32_t orig;
940
941 if (s->companion_ports[port] == NULL)
942 return;
943
944 owner = owner & PORTSC_POWNER;
945 orig = *portsc & PORTSC_POWNER;
946
947 if (!(owner ^ orig)) {
948 return;
949 }
950
951 if (dev && dev->attached) {
952 usb_detach(&s->ports[port]);
953 }
954
955 *portsc &= ~PORTSC_POWNER;
956 *portsc |= owner;
957
958 if (dev && dev->attached) {
959 usb_attach(&s->ports[port]);
960 }
961 }
962
963 static void ehci_port_write(void *ptr, hwaddr addr,
964 uint64_t val, unsigned size)
965 {
966 EHCIState *s = ptr;
967 int port = addr >> 2;
968 uint32_t *portsc = &s->portsc[port];
969 uint32_t old = *portsc;
970 USBDevice *dev = s->ports[port].dev;
971
972 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
973
974 /* Clear rwc bits */
975 *portsc &= ~(val & PORTSC_RWC_MASK);
976 /* The guest may clear, but not set the PED bit */
977 *portsc &= val | ~PORTSC_PED;
978 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
979 handle_port_owner_write(s, port, val);
980 /* And finally apply RO_MASK */
981 val &= PORTSC_RO_MASK;
982
983 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
984 trace_usb_ehci_port_reset(port, 1);
985 }
986
987 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
988 trace_usb_ehci_port_reset(port, 0);
989 if (dev && dev->attached) {
990 usb_port_reset(&s->ports[port]);
991 *portsc &= ~PORTSC_CSC;
992 }
993
994 /*
995 * Table 2.16 Set the enable bit(and enable bit change) to indicate
996 * to SW that this port has a high speed device attached
997 */
998 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
999 val |= PORTSC_PED;
1000 }
1001 }
1002
1003 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) {
1004 trace_usb_ehci_port_suspend(port);
1005 }
1006 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) {
1007 trace_usb_ehci_port_resume(port);
1008 val &= ~PORTSC_SUSPEND;
1009 }
1010
1011 *portsc &= ~PORTSC_RO_MASK;
1012 *portsc |= val;
1013 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
1014 }
1015
1016 static void ehci_opreg_write(void *ptr, hwaddr addr,
1017 uint64_t val, unsigned size)
1018 {
1019 EHCIState *s = ptr;
1020 uint32_t *mmio = s->opreg + (addr >> 2);
1021 uint32_t old = *mmio;
1022 int i;
1023
1024 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
1025
1026 switch (addr) {
1027 case USBCMD:
1028 if (val & USBCMD_HCRESET) {
1029 ehci_reset(s);
1030 val = s->usbcmd;
1031 break;
1032 }
1033
1034 /* not supporting dynamic frame list size at the moment */
1035 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
1036 fprintf(stderr, "attempt to set frame list size -- value %d\n",
1037 (int)val & USBCMD_FLS);
1038 val &= ~USBCMD_FLS;
1039 }
1040
1041 if (val & USBCMD_IAAD) {
1042 /*
1043 * Process IAAD immediately, otherwise the Linux IAAD watchdog may
1044 * trigger and re-use a qh without us seeing the unlink.
1045 */
1046 s->async_stepdown = 0;
1047 qemu_bh_schedule(s->async_bh);
1048 trace_usb_ehci_doorbell_ring();
1049 }
1050
1051 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
1052 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
1053 if (s->pstate == EST_INACTIVE) {
1054 SET_LAST_RUN_CLOCK(s);
1055 }
1056 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
1057 ehci_update_halt(s);
1058 s->async_stepdown = 0;
1059 qemu_bh_schedule(s->async_bh);
1060 }
1061 break;
1062
1063 case USBSTS:
1064 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO
1065 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC
1066 val = s->usbsts;
1067 ehci_update_irq(s);
1068 break;
1069
1070 case USBINTR:
1071 val &= USBINTR_MASK;
1072 if (ehci_enabled(s) && (USBSTS_FLR & val)) {
1073 qemu_bh_schedule(s->async_bh);
1074 }
1075 break;
1076
1077 case FRINDEX:
1078 val &= 0x00003fff; /* frindex is 14bits */
1079 s->usbsts_frindex = val;
1080 break;
1081
1082 case CONFIGFLAG:
1083 val &= 0x1;
1084 if (val) {
1085 for(i = 0; i < NB_PORTS; i++)
1086 handle_port_owner_write(s, i, 0);
1087 }
1088 break;
1089
1090 case PERIODICLISTBASE:
1091 if (ehci_periodic_enabled(s)) {
1092 fprintf(stderr,
1093 "ehci: PERIODIC list base register set while periodic schedule\n"
1094 " is enabled and HC is enabled\n");
1095 }
1096 break;
1097
1098 case ASYNCLISTADDR:
1099 if (ehci_async_enabled(s)) {
1100 fprintf(stderr,
1101 "ehci: ASYNC list address register set while async schedule\n"
1102 " is enabled and HC is enabled\n");
1103 }
1104 break;
1105 }
1106
1107 *mmio = val;
1108 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1109 *mmio, old);
1110 }
1111
1112 /*
1113 * Write the qh back to guest physical memory. This step isn't
1114 * in the EHCI spec but we need to do it since we don't share
1115 * physical memory with our guest VM.
1116 *
1117 * The first three dwords are read-only for the EHCI, so skip them
1118 * when writing back the qh.
1119 */
1120 static void ehci_flush_qh(EHCIQueue *q)
1121 {
1122 uint32_t *qh = (uint32_t *) &q->qh;
1123 uint32_t dwords = sizeof(EHCIqh) >> 2;
1124 uint32_t addr = NLPTR_GET(q->qhaddr);
1125
1126 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1127 }
1128
1129 // 4.10.2
1130
1131 static int ehci_qh_do_overlay(EHCIQueue *q)
1132 {
1133 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1134 int i;
1135 int dtoggle;
1136 int ping;
1137 int eps;
1138 int reload;
1139
1140 assert(p != NULL);
1141 assert(p->qtdaddr == q->qtdaddr);
1142
1143 // remember values in fields to preserve in qh after overlay
1144
1145 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1146 ping = q->qh.token & QTD_TOKEN_PING;
1147
1148 q->qh.current_qtd = p->qtdaddr;
1149 q->qh.next_qtd = p->qtd.next;
1150 q->qh.altnext_qtd = p->qtd.altnext;
1151 q->qh.token = p->qtd.token;
1152
1153
1154 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1155 if (eps == EHCI_QH_EPS_HIGH) {
1156 q->qh.token &= ~QTD_TOKEN_PING;
1157 q->qh.token |= ping;
1158 }
1159
1160 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1161 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1162
1163 for (i = 0; i < 5; i++) {
1164 q->qh.bufptr[i] = p->qtd.bufptr[i];
1165 }
1166
1167 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1168 // preserve QH DT bit
1169 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1170 q->qh.token |= dtoggle;
1171 }
1172
1173 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1174 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1175
1176 ehci_flush_qh(q);
1177
1178 return 0;
1179 }
1180
1181 static int ehci_init_transfer(EHCIPacket *p)
1182 {
1183 uint32_t cpage, offset, bytes, plen;
1184 dma_addr_t page;
1185
1186 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1187 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1188 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1189 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
1190
1191 while (bytes > 0) {
1192 if (cpage > 4) {
1193 fprintf(stderr, "cpage out of range (%d)\n", cpage);
1194 qemu_sglist_destroy(&p->sgl);
1195 return -1;
1196 }
1197
1198 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1199 page += offset;
1200 plen = bytes;
1201 if (plen > 4096 - offset) {
1202 plen = 4096 - offset;
1203 offset = 0;
1204 cpage++;
1205 }
1206
1207 qemu_sglist_add(&p->sgl, page, plen);
1208 bytes -= plen;
1209 }
1210 return 0;
1211 }
1212
1213 static void ehci_finish_transfer(EHCIQueue *q, int len)
1214 {
1215 uint32_t cpage, offset;
1216
1217 if (len > 0) {
1218 /* update cpage & offset */
1219 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1220 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1221
1222 offset += len;
1223 cpage += offset >> QTD_BUFPTR_SH;
1224 offset &= ~QTD_BUFPTR_MASK;
1225
1226 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1227 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1228 q->qh.bufptr[0] |= offset;
1229 }
1230 }
1231
1232 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1233 {
1234 EHCIPacket *p;
1235 EHCIState *s = port->opaque;
1236 uint32_t portsc = s->portsc[port->index];
1237
1238 if (portsc & PORTSC_POWNER) {
1239 USBPort *companion = s->companion_ports[port->index];
1240 companion->ops->complete(companion, packet);
1241 return;
1242 }
1243
1244 p = container_of(packet, EHCIPacket, packet);
1245 assert(p->async == EHCI_ASYNC_INFLIGHT);
1246
1247 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1248 trace_usb_ehci_packet_action(p->queue, p, "remove");
1249 ehci_free_packet(p);
1250 return;
1251 }
1252
1253 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1254 p->async = EHCI_ASYNC_FINISHED;
1255
1256 if (!p->queue->async) {
1257 s->periodic_sched_active = PERIODIC_ACTIVE;
1258 }
1259 qemu_bh_schedule(s->async_bh);
1260 }
1261
1262 static void ehci_execute_complete(EHCIQueue *q)
1263 {
1264 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1265 uint32_t tbytes;
1266
1267 assert(p != NULL);
1268 assert(p->qtdaddr == q->qtdaddr);
1269 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1270 p->async == EHCI_ASYNC_FINISHED);
1271
1272 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1273 "status %d, actual_length %d\n",
1274 q->qhaddr, q->qh.next, q->qtdaddr,
1275 p->packet.status, p->packet.actual_length);
1276
1277 switch (p->packet.status) {
1278 case USB_RET_SUCCESS:
1279 break;
1280 case USB_RET_IOERROR:
1281 case USB_RET_NODEV:
1282 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1283 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1284 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1285 break;
1286 case USB_RET_STALL:
1287 q->qh.token |= QTD_TOKEN_HALT;
1288 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1289 break;
1290 case USB_RET_NAK:
1291 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1292 return; /* We're not done yet with this transaction */
1293 case USB_RET_BABBLE:
1294 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1295 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1296 break;
1297 default:
1298 /* should not be triggerable */
1299 fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1300 g_assert_not_reached();
1301 break;
1302 }
1303
1304 /* TODO check 4.12 for splits */
1305 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1306 if (tbytes && p->pid == USB_TOKEN_IN) {
1307 tbytes -= p->packet.actual_length;
1308 if (tbytes) {
1309 /* 4.15.1.2 must raise int on a short input packet */
1310 ehci_raise_irq(q->ehci, USBSTS_INT);
1311 if (q->async) {
1312 q->ehci->int_req_by_async = true;
1313 }
1314 }
1315 } else {
1316 tbytes = 0;
1317 }
1318 DPRINTF("updating tbytes to %d\n", tbytes);
1319 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1320
1321 ehci_finish_transfer(q, p->packet.actual_length);
1322 usb_packet_unmap(&p->packet, &p->sgl);
1323 qemu_sglist_destroy(&p->sgl);
1324 p->async = EHCI_ASYNC_NONE;
1325
1326 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1327 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1328
1329 if (q->qh.token & QTD_TOKEN_IOC) {
1330 ehci_raise_irq(q->ehci, USBSTS_INT);
1331 if (q->async) {
1332 q->ehci->int_req_by_async = true;
1333 }
1334 }
1335 }
1336
1337 /* 4.10.3 returns "again" */
1338 static int ehci_execute(EHCIPacket *p, const char *action)
1339 {
1340 USBEndpoint *ep;
1341 int endp;
1342 bool spd;
1343
1344 assert(p->async == EHCI_ASYNC_NONE ||
1345 p->async == EHCI_ASYNC_INITIALIZED);
1346
1347 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1348 fprintf(stderr, "Attempting to execute inactive qtd\n");
1349 return -1;
1350 }
1351
1352 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1353 ehci_trace_guest_bug(p->queue->ehci,
1354 "guest requested more bytes than allowed");
1355 return -1;
1356 }
1357
1358 if (!ehci_verify_pid(p->queue, &p->qtd)) {
1359 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */
1360 }
1361 p->pid = ehci_get_pid(&p->qtd);
1362 p->queue->last_pid = p->pid;
1363 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1364 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1365
1366 if (p->async == EHCI_ASYNC_NONE) {
1367 if (ehci_init_transfer(p) != 0) {
1368 return -1;
1369 }
1370
1371 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1372 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
1373 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1374 usb_packet_map(&p->packet, &p->sgl);
1375 p->async = EHCI_ASYNC_INITIALIZED;
1376 }
1377
1378 trace_usb_ehci_packet_action(p->queue, p, action);
1379 usb_handle_packet(p->queue->dev, &p->packet);
1380 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1381 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1382 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1383 p->packet.actual_length);
1384
1385 if (p->packet.actual_length > BUFF_SIZE) {
1386 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1387 return -1;
1388 }
1389
1390 return 1;
1391 }
1392
1393 /* 4.7.2
1394 */
1395
1396 static int ehci_process_itd(EHCIState *ehci,
1397 EHCIitd *itd,
1398 uint32_t addr)
1399 {
1400 USBDevice *dev;
1401 USBEndpoint *ep;
1402 uint32_t i, len, pid, dir, devaddr, endp;
1403 uint32_t pg, off, ptr1, ptr2, max, mult;
1404
1405 ehci->periodic_sched_active = PERIODIC_ACTIVE;
1406
1407 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1408 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1409 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1410 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1411 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1412
1413 for(i = 0; i < 8; i++) {
1414 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1415 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1416 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1417 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1418
1419 if (len > max * mult) {
1420 len = max * mult;
1421 }
1422 if (len > BUFF_SIZE || pg > 6) {
1423 return -1;
1424 }
1425
1426 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1427 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
1428 if (off + len > 4096) {
1429 /* transfer crosses page border */
1430 if (pg == 6) {
1431 qemu_sglist_destroy(&ehci->isgl);
1432 return -1; /* avoid page pg + 1 */
1433 }
1434 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
1435 uint32_t len2 = off + len - 4096;
1436 uint32_t len1 = len - len2;
1437 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1438 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1439 } else {
1440 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1441 }
1442
1443 dev = ehci_find_device(ehci, devaddr);
1444 if (dev == NULL) {
1445 ehci_trace_guest_bug(ehci, "no device found");
1446 return -1;
1447 }
1448 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1449 ep = usb_ep_get(dev, pid, endp);
1450 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1451 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
1452 (itd->transact[i] & ITD_XACT_IOC) != 0);
1453 usb_packet_map(&ehci->ipacket, &ehci->isgl);
1454 usb_handle_packet(dev, &ehci->ipacket);
1455 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1456 } else {
1457 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1458 ehci->ipacket.status = USB_RET_NAK;
1459 ehci->ipacket.actual_length = 0;
1460 }
1461 qemu_sglist_destroy(&ehci->isgl);
1462
1463 switch (ehci->ipacket.status) {
1464 case USB_RET_SUCCESS:
1465 break;
1466 default:
1467 fprintf(stderr, "Unexpected iso usb result: %d\n",
1468 ehci->ipacket.status);
1469 /* Fall through */
1470 case USB_RET_IOERROR:
1471 case USB_RET_NODEV:
1472 /* 3.3.2: XACTERR is only allowed on IN transactions */
1473 if (dir) {
1474 itd->transact[i] |= ITD_XACT_XACTERR;
1475 ehci_raise_irq(ehci, USBSTS_ERRINT);
1476 }
1477 break;
1478 case USB_RET_BABBLE:
1479 itd->transact[i] |= ITD_XACT_BABBLE;
1480 ehci_raise_irq(ehci, USBSTS_ERRINT);
1481 break;
1482 case USB_RET_NAK:
1483 /* no data for us, so do a zero-length transfer */
1484 ehci->ipacket.actual_length = 0;
1485 break;
1486 }
1487 if (!dir) {
1488 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1489 ITD_XACT_LENGTH); /* OUT */
1490 } else {
1491 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1492 ITD_XACT_LENGTH); /* IN */
1493 }
1494 if (itd->transact[i] & ITD_XACT_IOC) {
1495 ehci_raise_irq(ehci, USBSTS_INT);
1496 }
1497 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1498 }
1499 }
1500 return 0;
1501 }
1502
1503
1504 /* This state is the entry point for asynchronous schedule
1505 * processing. Entry here consitutes a EHCI start event state (4.8.5)
1506 */
1507 static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1508 {
1509 EHCIqh qh;
1510 int i = 0;
1511 int again = 0;
1512 uint32_t entry = ehci->asynclistaddr;
1513
1514 /* set reclamation flag at start event (4.8.6) */
1515 if (async) {
1516 ehci_set_usbsts(ehci, USBSTS_REC);
1517 }
1518
1519 ehci_queues_rip_unused(ehci, async);
1520
1521 /* Find the head of the list (4.9.1.1) */
1522 for(i = 0; i < MAX_QH; i++) {
1523 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1524 sizeof(EHCIqh) >> 2) < 0) {
1525 return 0;
1526 }
1527 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1528
1529 if (qh.epchar & QH_EPCHAR_H) {
1530 if (async) {
1531 entry |= (NLPTR_TYPE_QH << 1);
1532 }
1533
1534 ehci_set_fetch_addr(ehci, async, entry);
1535 ehci_set_state(ehci, async, EST_FETCHENTRY);
1536 again = 1;
1537 goto out;
1538 }
1539
1540 entry = qh.next;
1541 if (entry == ehci->asynclistaddr) {
1542 break;
1543 }
1544 }
1545
1546 /* no head found for list. */
1547
1548 ehci_set_state(ehci, async, EST_ACTIVE);
1549
1550 out:
1551 return again;
1552 }
1553
1554
1555 /* This state is the entry point for periodic schedule processing as
1556 * well as being a continuation state for async processing.
1557 */
1558 static int ehci_state_fetchentry(EHCIState *ehci, int async)
1559 {
1560 int again = 0;
1561 uint32_t entry = ehci_get_fetch_addr(ehci, async);
1562
1563 if (NLPTR_TBIT(entry)) {
1564 ehci_set_state(ehci, async, EST_ACTIVE);
1565 goto out;
1566 }
1567
1568 /* section 4.8, only QH in async schedule */
1569 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1570 fprintf(stderr, "non queue head request in async schedule\n");
1571 return -1;
1572 }
1573
1574 switch (NLPTR_TYPE_GET(entry)) {
1575 case NLPTR_TYPE_QH:
1576 ehci_set_state(ehci, async, EST_FETCHQH);
1577 again = 1;
1578 break;
1579
1580 case NLPTR_TYPE_ITD:
1581 ehci_set_state(ehci, async, EST_FETCHITD);
1582 again = 1;
1583 break;
1584
1585 case NLPTR_TYPE_STITD:
1586 ehci_set_state(ehci, async, EST_FETCHSITD);
1587 again = 1;
1588 break;
1589
1590 default:
1591 /* TODO: handle FSTN type */
1592 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1593 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1594 return -1;
1595 }
1596
1597 out:
1598 return again;
1599 }
1600
1601 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1602 {
1603 uint32_t entry;
1604 EHCIQueue *q;
1605 EHCIqh qh;
1606
1607 entry = ehci_get_fetch_addr(ehci, async);
1608 q = ehci_find_queue_by_qh(ehci, entry, async);
1609 if (q == NULL) {
1610 q = ehci_alloc_queue(ehci, entry, async);
1611 }
1612
1613 q->seen++;
1614 if (q->seen > 1) {
1615 /* we are going in circles -- stop processing */
1616 ehci_set_state(ehci, async, EST_ACTIVE);
1617 q = NULL;
1618 goto out;
1619 }
1620
1621 if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1622 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1623 q = NULL;
1624 goto out;
1625 }
1626 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1627
1628 /*
1629 * The overlay area of the qh should never be changed by the guest,
1630 * except when idle, in which case the reset is a nop.
1631 */
1632 if (!ehci_verify_qh(q, &qh)) {
1633 if (ehci_reset_queue(q) > 0) {
1634 ehci_trace_guest_bug(ehci, "guest updated active QH");
1635 }
1636 }
1637 q->qh = qh;
1638
1639 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1640 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1641 q->transact_ctr = 4;
1642 }
1643
1644 if (q->dev == NULL) {
1645 q->dev = ehci_find_device(q->ehci,
1646 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR));
1647 }
1648
1649 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1650
1651 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1652 if (ehci->usbsts & USBSTS_REC) {
1653 ehci_clear_usbsts(ehci, USBSTS_REC);
1654 } else {
1655 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset"
1656 " - done processing\n", q->qhaddr);
1657 ehci_set_state(ehci, async, EST_ACTIVE);
1658 q = NULL;
1659 goto out;
1660 }
1661 }
1662
1663 #if EHCI_DEBUG
1664 if (q->qhaddr != q->qh.next) {
1665 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1666 q->qhaddr,
1667 q->qh.epchar & QH_EPCHAR_H,
1668 q->qh.token & QTD_TOKEN_HALT,
1669 q->qh.token & QTD_TOKEN_ACTIVE,
1670 q->qh.next);
1671 }
1672 #endif
1673
1674 if (q->qh.token & QTD_TOKEN_HALT) {
1675 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1676
1677 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1678 (NLPTR_TBIT(q->qh.current_qtd) == 0) &&
1679 (q->qh.current_qtd != 0)) {
1680 q->qtdaddr = q->qh.current_qtd;
1681 ehci_set_state(ehci, async, EST_FETCHQTD);
1682
1683 } else {
1684 /* EHCI spec version 1.0 Section 4.10.2 */
1685 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1686 }
1687
1688 out:
1689 return q;
1690 }
1691
1692 static int ehci_state_fetchitd(EHCIState *ehci, int async)
1693 {
1694 uint32_t entry;
1695 EHCIitd itd;
1696
1697 assert(!async);
1698 entry = ehci_get_fetch_addr(ehci, async);
1699
1700 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1701 sizeof(EHCIitd) >> 2) < 0) {
1702 return -1;
1703 }
1704 ehci_trace_itd(ehci, entry, &itd);
1705
1706 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1707 return -1;
1708 }
1709
1710 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1711 sizeof(EHCIitd) >> 2);
1712 ehci_set_fetch_addr(ehci, async, itd.next);
1713 ehci_set_state(ehci, async, EST_FETCHENTRY);
1714
1715 return 1;
1716 }
1717
1718 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1719 {
1720 uint32_t entry;
1721 EHCIsitd sitd;
1722
1723 assert(!async);
1724 entry = ehci_get_fetch_addr(ehci, async);
1725
1726 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1727 sizeof(EHCIsitd) >> 2) < 0) {
1728 return 0;
1729 }
1730 ehci_trace_sitd(ehci, entry, &sitd);
1731
1732 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1733 /* siTD is not active, nothing to do */;
1734 } else {
1735 /* TODO: split transfers are not implemented */
1736 warn_report("Skipping active siTD");
1737 }
1738
1739 ehci_set_fetch_addr(ehci, async, sitd.next);
1740 ehci_set_state(ehci, async, EST_FETCHENTRY);
1741 return 1;
1742 }
1743
1744 /* Section 4.10.2 - paragraph 3 */
1745 static int ehci_state_advqueue(EHCIQueue *q)
1746 {
1747 #if 0
1748 /* TO-DO: 4.10.2 - paragraph 2
1749 * if I-bit is set to 1 and QH is not active
1750 * go to horizontal QH
1751 */
1752 if (I-bit set) {
1753 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1754 goto out;
1755 }
1756 #endif
1757
1758 /*
1759 * want data and alt-next qTD is valid
1760 */
1761 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1762 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1763 q->qtdaddr = q->qh.altnext_qtd;
1764 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1765
1766 /*
1767 * next qTD is valid
1768 */
1769 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1770 q->qtdaddr = q->qh.next_qtd;
1771 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1772
1773 /*
1774 * no valid qTD, try next QH
1775 */
1776 } else {
1777 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1778 }
1779
1780 return 1;
1781 }
1782
1783 /* Section 4.10.2 - paragraph 4 */
1784 static int ehci_state_fetchqtd(EHCIQueue *q)
1785 {
1786 EHCIqtd qtd;
1787 EHCIPacket *p;
1788 int again = 1;
1789 uint32_t addr;
1790
1791 addr = NLPTR_GET(q->qtdaddr);
1792 if (get_dwords(q->ehci, addr + 8, &qtd.token, 1) < 0) {
1793 return 0;
1794 }
1795 barrier();
1796 if (get_dwords(q->ehci, addr + 0, &qtd.next, 1) < 0 ||
1797 get_dwords(q->ehci, addr + 4, &qtd.altnext, 1) < 0 ||
1798 get_dwords(q->ehci, addr + 12, qtd.bufptr,
1799 ARRAY_SIZE(qtd.bufptr)) < 0) {
1800 return 0;
1801 }
1802 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1803
1804 p = QTAILQ_FIRST(&q->packets);
1805 if (p != NULL) {
1806 if (!ehci_verify_qtd(p, &qtd)) {
1807 ehci_cancel_queue(q);
1808 if (qtd.token & QTD_TOKEN_ACTIVE) {
1809 ehci_trace_guest_bug(q->ehci, "guest updated active qTD");
1810 }
1811 p = NULL;
1812 } else {
1813 p->qtd = qtd;
1814 ehci_qh_do_overlay(q);
1815 }
1816 }
1817
1818 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1819 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1820 } else if (p != NULL) {
1821 switch (p->async) {
1822 case EHCI_ASYNC_NONE:
1823 case EHCI_ASYNC_INITIALIZED:
1824 /* Not yet executed (MULT), or previously nacked (int) packet */
1825 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1826 break;
1827 case EHCI_ASYNC_INFLIGHT:
1828 /* Check if the guest has added new tds to the queue */
1829 again = ehci_fill_queue(QTAILQ_LAST(&q->packets));
1830 /* Unfinished async handled packet, go horizontal */
1831 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1832 break;
1833 case EHCI_ASYNC_FINISHED:
1834 /* Complete executing of the packet */
1835 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1836 break;
1837 }
1838 } else {
1839 p = ehci_alloc_packet(q);
1840 p->qtdaddr = q->qtdaddr;
1841 p->qtd = qtd;
1842 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1843 }
1844
1845 return again;
1846 }
1847
1848 static int ehci_state_horizqh(EHCIQueue *q)
1849 {
1850 int again = 0;
1851
1852 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1853 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1854 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1855 again = 1;
1856 } else {
1857 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1858 }
1859
1860 return again;
1861 }
1862
1863 /* Returns "again" */
1864 static int ehci_fill_queue(EHCIPacket *p)
1865 {
1866 USBEndpoint *ep = p->packet.ep;
1867 EHCIQueue *q = p->queue;
1868 EHCIqtd qtd = p->qtd;
1869 uint32_t qtdaddr;
1870
1871 for (;;) {
1872 if (NLPTR_TBIT(qtd.next) != 0) {
1873 break;
1874 }
1875 qtdaddr = qtd.next;
1876 /*
1877 * Detect circular td lists, Windows creates these, counting on the
1878 * active bit going low after execution to make the queue stop.
1879 */
1880 QTAILQ_FOREACH(p, &q->packets, next) {
1881 if (p->qtdaddr == qtdaddr) {
1882 goto leave;
1883 }
1884 }
1885 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1886 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1887 return -1;
1888 }
1889 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1890 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1891 break;
1892 }
1893 if (!ehci_verify_pid(q, &qtd)) {
1894 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
1895 break;
1896 }
1897 p = ehci_alloc_packet(q);
1898 p->qtdaddr = qtdaddr;
1899 p->qtd = qtd;
1900 if (ehci_execute(p, "queue") == -1) {
1901 return -1;
1902 }
1903 assert(p->packet.status == USB_RET_ASYNC);
1904 p->async = EHCI_ASYNC_INFLIGHT;
1905 }
1906 leave:
1907 usb_device_flush_ep_queue(ep->dev, ep);
1908 return 1;
1909 }
1910
1911 static int ehci_state_execute(EHCIQueue *q)
1912 {
1913 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1914 int again = 0;
1915
1916 assert(p != NULL);
1917 assert(p->qtdaddr == q->qtdaddr);
1918
1919 if (ehci_qh_do_overlay(q) != 0) {
1920 return -1;
1921 }
1922
1923 // TODO verify enough time remains in the uframe as in 4.4.1.1
1924 // TODO write back ptr to async list when done or out of time
1925
1926 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1927 if (!q->async && q->transact_ctr == 0) {
1928 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1929 again = 1;
1930 goto out;
1931 }
1932
1933 if (q->async) {
1934 ehci_set_usbsts(q->ehci, USBSTS_REC);
1935 }
1936
1937 again = ehci_execute(p, "process");
1938 if (again == -1) {
1939 goto out;
1940 }
1941 if (p->packet.status == USB_RET_ASYNC) {
1942 ehci_flush_qh(q);
1943 trace_usb_ehci_packet_action(p->queue, p, "async");
1944 p->async = EHCI_ASYNC_INFLIGHT;
1945 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1946 if (q->async) {
1947 again = ehci_fill_queue(p);
1948 } else {
1949 again = 1;
1950 }
1951 goto out;
1952 }
1953
1954 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1955 again = 1;
1956
1957 out:
1958 return again;
1959 }
1960
1961 static int ehci_state_executing(EHCIQueue *q)
1962 {
1963 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1964
1965 assert(p != NULL);
1966 assert(p->qtdaddr == q->qtdaddr);
1967
1968 ehci_execute_complete(q);
1969
1970 /* 4.10.3 */
1971 if (!q->async && q->transact_ctr > 0) {
1972 q->transact_ctr--;
1973 }
1974
1975 /* 4.10.5 */
1976 if (p->packet.status == USB_RET_NAK) {
1977 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1978 } else {
1979 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1980 }
1981
1982 ehci_flush_qh(q);
1983 return 1;
1984 }
1985
1986
1987 static int ehci_state_writeback(EHCIQueue *q)
1988 {
1989 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1990 uint32_t *qtd, addr;
1991 int again = 0;
1992
1993 /* Write back the QTD from the QH area */
1994 assert(p != NULL);
1995 assert(p->qtdaddr == q->qtdaddr);
1996
1997 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1998 qtd = (uint32_t *) &q->qh.next_qtd;
1999 addr = NLPTR_GET(p->qtdaddr);
2000 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
2001 ehci_free_packet(p);
2002
2003 /*
2004 * EHCI specs say go horizontal here.
2005 *
2006 * We can also advance the queue here for performance reasons. We
2007 * need to take care to only take that shortcut in case we've
2008 * processed the qtd just written back without errors, i.e. halt
2009 * bit is clear.
2010 */
2011 if (q->qh.token & QTD_TOKEN_HALT) {
2012 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2013 again = 1;
2014 } else {
2015 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
2016 again = 1;
2017 }
2018 return again;
2019 }
2020
2021 /*
2022 * This is the state machine that is common to both async and periodic
2023 */
2024
2025 static void ehci_advance_state(EHCIState *ehci, int async)
2026 {
2027 EHCIQueue *q = NULL;
2028 int itd_count = 0;
2029 int again;
2030
2031 do {
2032 switch(ehci_get_state(ehci, async)) {
2033 case EST_WAITLISTHEAD:
2034 again = ehci_state_waitlisthead(ehci, async);
2035 break;
2036
2037 case EST_FETCHENTRY:
2038 again = ehci_state_fetchentry(ehci, async);
2039 break;
2040
2041 case EST_FETCHQH:
2042 q = ehci_state_fetchqh(ehci, async);
2043 if (q != NULL) {
2044 assert(q->async == async);
2045 again = 1;
2046 } else {
2047 again = 0;
2048 }
2049 break;
2050
2051 case EST_FETCHITD:
2052 again = ehci_state_fetchitd(ehci, async);
2053 itd_count++;
2054 break;
2055
2056 case EST_FETCHSITD:
2057 again = ehci_state_fetchsitd(ehci, async);
2058 itd_count++;
2059 break;
2060
2061 case EST_ADVANCEQUEUE:
2062 assert(q != NULL);
2063 again = ehci_state_advqueue(q);
2064 break;
2065
2066 case EST_FETCHQTD:
2067 assert(q != NULL);
2068 again = ehci_state_fetchqtd(q);
2069 break;
2070
2071 case EST_HORIZONTALQH:
2072 assert(q != NULL);
2073 again = ehci_state_horizqh(q);
2074 break;
2075
2076 case EST_EXECUTE:
2077 assert(q != NULL);
2078 again = ehci_state_execute(q);
2079 if (async) {
2080 ehci->async_stepdown = 0;
2081 }
2082 break;
2083
2084 case EST_EXECUTING:
2085 assert(q != NULL);
2086 if (async) {
2087 ehci->async_stepdown = 0;
2088 }
2089 again = ehci_state_executing(q);
2090 break;
2091
2092 case EST_WRITEBACK:
2093 assert(q != NULL);
2094 again = ehci_state_writeback(q);
2095 if (!async) {
2096 ehci->periodic_sched_active = PERIODIC_ACTIVE;
2097 }
2098 break;
2099
2100 default:
2101 fprintf(stderr, "Bad state!\n");
2102 again = -1;
2103 g_assert_not_reached();
2104 break;
2105 }
2106
2107 if (again < 0 || itd_count > 16) {
2108 /* TODO: notify guest (raise HSE irq?) */
2109 fprintf(stderr, "processing error - resetting ehci HC\n");
2110 ehci_reset(ehci);
2111 again = 0;
2112 }
2113 }
2114 while (again);
2115 }
2116
2117 static void ehci_advance_async_state(EHCIState *ehci)
2118 {
2119 const int async = 1;
2120
2121 switch(ehci_get_state(ehci, async)) {
2122 case EST_INACTIVE:
2123 if (!ehci_async_enabled(ehci)) {
2124 break;
2125 }
2126 ehci_set_state(ehci, async, EST_ACTIVE);
2127 // No break, fall through to ACTIVE
2128
2129 case EST_ACTIVE:
2130 if (!ehci_async_enabled(ehci)) {
2131 ehci_queues_rip_all(ehci, async);
2132 ehci_set_state(ehci, async, EST_INACTIVE);
2133 break;
2134 }
2135
2136 /* make sure guest has acknowledged the doorbell interrupt */
2137 /* TO-DO: is this really needed? */
2138 if (ehci->usbsts & USBSTS_IAA) {
2139 DPRINTF("IAA status bit still set.\n");
2140 break;
2141 }
2142
2143 /* check that address register has been set */
2144 if (ehci->asynclistaddr == 0) {
2145 break;
2146 }
2147
2148 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2149 ehci_advance_state(ehci, async);
2150
2151 /* If the doorbell is set, the guest wants to make a change to the
2152 * schedule. The host controller needs to release cached data.
2153 * (section 4.8.2)
2154 */
2155 if (ehci->usbcmd & USBCMD_IAAD) {
2156 /* Remove all unseen qhs from the async qhs queue */
2157 ehci_queues_rip_unseen(ehci, async);
2158 trace_usb_ehci_doorbell_ack();
2159 ehci->usbcmd &= ~USBCMD_IAAD;
2160 ehci_raise_irq(ehci, USBSTS_IAA);
2161 }
2162 break;
2163
2164 default:
2165 /* this should only be due to a developer mistake */
2166 fprintf(stderr, "ehci: Bad asynchronous state %d. "
2167 "Resetting to active\n", ehci->astate);
2168 g_assert_not_reached();
2169 }
2170 }
2171
2172 static void ehci_advance_periodic_state(EHCIState *ehci)
2173 {
2174 uint32_t entry;
2175 uint32_t list;
2176 const int async = 0;
2177
2178 // 4.6
2179
2180 switch(ehci_get_state(ehci, async)) {
2181 case EST_INACTIVE:
2182 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2183 ehci_set_state(ehci, async, EST_ACTIVE);
2184 // No break, fall through to ACTIVE
2185 } else
2186 break;
2187
2188 case EST_ACTIVE:
2189 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2190 ehci_queues_rip_all(ehci, async);
2191 ehci_set_state(ehci, async, EST_INACTIVE);
2192 break;
2193 }
2194
2195 list = ehci->periodiclistbase & 0xfffff000;
2196 /* check that register has been set */
2197 if (list == 0) {
2198 break;
2199 }
2200 list |= ((ehci->frindex & 0x1ff8) >> 1);
2201
2202 if (get_dwords(ehci, list, &entry, 1) < 0) {
2203 break;
2204 }
2205
2206 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n",
2207 ehci->frindex / 8, list, entry);
2208 ehci_set_fetch_addr(ehci, async,entry);
2209 ehci_set_state(ehci, async, EST_FETCHENTRY);
2210 ehci_advance_state(ehci, async);
2211 ehci_queues_rip_unused(ehci, async);
2212 break;
2213
2214 default:
2215 /* this should only be due to a developer mistake */
2216 fprintf(stderr, "ehci: Bad periodic state %d. "
2217 "Resetting to active\n", ehci->pstate);
2218 g_assert_not_reached();
2219 }
2220 }
2221
2222 static void ehci_update_frindex(EHCIState *ehci, int uframes)
2223 {
2224 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) {
2225 return;
2226 }
2227
2228 /* Generate FLR interrupt if frame index rolls over 0x2000 */
2229 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) {
2230 ehci_raise_irq(ehci, USBSTS_FLR);
2231 }
2232
2233 /* How many times will frindex roll over 0x4000 with this frame count?
2234 * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
2235 */
2236 int rollovers = (ehci->frindex + uframes) / 0x4000;
2237 if (rollovers > 0) {
2238 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) {
2239 ehci->usbsts_frindex -= 0x4000 * rollovers;
2240 } else {
2241 ehci->usbsts_frindex = 0;
2242 }
2243 }
2244
2245 ehci->frindex = (ehci->frindex + uframes) % 0x4000;
2246 }
2247
2248 static void ehci_work_bh(void *opaque)
2249 {
2250 EHCIState *ehci = opaque;
2251 int need_timer = 0;
2252 int64_t expire_time, t_now;
2253 uint64_t ns_elapsed;
2254 uint64_t uframes, skipped_uframes;
2255 int i;
2256
2257 if (ehci->working) {
2258 return;
2259 }
2260 ehci->working = true;
2261
2262 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2263 ns_elapsed = t_now - ehci->last_run_ns;
2264 uframes = ns_elapsed / UFRAME_TIMER_NS;
2265
2266 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2267 need_timer++;
2268
2269 if (uframes > (ehci->maxframes * 8)) {
2270 skipped_uframes = uframes - (ehci->maxframes * 8);
2271 ehci_update_frindex(ehci, skipped_uframes);
2272 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
2273 uframes -= skipped_uframes;
2274 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes);
2275 }
2276
2277 for (i = 0; i < uframes; i++) {
2278 /*
2279 * If we're running behind schedule, we should not catch up
2280 * too fast, as that will make some guests unhappy:
2281 * 1) We must process a minimum of MIN_UFR_PER_TICK frames,
2282 * otherwise we will never catch up
2283 * 2) Process frames until the guest has requested an irq (IOC)
2284 */
2285 if (i >= MIN_UFR_PER_TICK) {
2286 ehci_commit_irq(ehci);
2287 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2288 break;
2289 }
2290 }
2291 if (ehci->periodic_sched_active) {
2292 ehci->periodic_sched_active--;
2293 }
2294 ehci_update_frindex(ehci, 1);
2295 if ((ehci->frindex & 7) == 0) {
2296 ehci_advance_periodic_state(ehci);
2297 }
2298 ehci->last_run_ns += UFRAME_TIMER_NS;
2299 }
2300 } else {
2301 ehci->periodic_sched_active = 0;
2302 ehci_update_frindex(ehci, uframes);
2303 ehci->last_run_ns += UFRAME_TIMER_NS * uframes;
2304 }
2305
2306 if (ehci->periodic_sched_active) {
2307 ehci->async_stepdown = 0;
2308 } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2309 ehci->async_stepdown++;
2310 }
2311
2312 /* Async is not inside loop since it executes everything it can once
2313 * called
2314 */
2315 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2316 need_timer++;
2317 ehci_advance_async_state(ehci);
2318 }
2319
2320 ehci_commit_irq(ehci);
2321 if (ehci->usbsts_pending) {
2322 need_timer++;
2323 ehci->async_stepdown = 0;
2324 }
2325
2326 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2327 need_timer++;
2328 }
2329
2330 if (need_timer) {
2331 /* If we've raised int, we speed up the timer, so that we quickly
2332 * notice any new packets queued up in response */
2333 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2334 expire_time = t_now +
2335 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
2336 ehci->int_req_by_async = false;
2337 } else {
2338 expire_time = t_now + (NANOSECONDS_PER_SECOND
2339 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2340 }
2341 timer_mod(ehci->frame_timer, expire_time);
2342 }
2343
2344 ehci->working = false;
2345 }
2346
2347 static void ehci_work_timer(void *opaque)
2348 {
2349 EHCIState *ehci = opaque;
2350
2351 qemu_bh_schedule(ehci->async_bh);
2352 }
2353
2354 static const MemoryRegionOps ehci_mmio_caps_ops = {
2355 .read = ehci_caps_read,
2356 .write = ehci_caps_write,
2357 .valid.min_access_size = 1,
2358 .valid.max_access_size = 4,
2359 .impl.min_access_size = 1,
2360 .impl.max_access_size = 1,
2361 .endianness = DEVICE_LITTLE_ENDIAN,
2362 };
2363
2364 static const MemoryRegionOps ehci_mmio_opreg_ops = {
2365 .read = ehci_opreg_read,
2366 .write = ehci_opreg_write,
2367 .valid.min_access_size = 4,
2368 .valid.max_access_size = 4,
2369 .endianness = DEVICE_LITTLE_ENDIAN,
2370 };
2371
2372 static const MemoryRegionOps ehci_mmio_port_ops = {
2373 .read = ehci_port_read,
2374 .write = ehci_port_write,
2375 .valid.min_access_size = 4,
2376 .valid.max_access_size = 4,
2377 .endianness = DEVICE_LITTLE_ENDIAN,
2378 };
2379
2380 static USBPortOps ehci_port_ops = {
2381 .attach = ehci_attach,
2382 .detach = ehci_detach,
2383 .child_detach = ehci_child_detach,
2384 .wakeup = ehci_wakeup,
2385 .complete = ehci_async_complete_packet,
2386 };
2387
2388 static USBBusOps ehci_bus_ops_companion = {
2389 .register_companion = ehci_register_companion,
2390 .wakeup_endpoint = ehci_wakeup_endpoint,
2391 };
2392 static USBBusOps ehci_bus_ops_standalone = {
2393 .wakeup_endpoint = ehci_wakeup_endpoint,
2394 };
2395
2396 static int usb_ehci_pre_save(void *opaque)
2397 {
2398 EHCIState *ehci = opaque;
2399 uint32_t new_frindex;
2400
2401 /* Round down frindex to a multiple of 8 for migration compatibility */
2402 new_frindex = ehci->frindex & ~7;
2403 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
2404 ehci->frindex = new_frindex;
2405
2406 return 0;
2407 }
2408
2409 static int usb_ehci_post_load(void *opaque, int version_id)
2410 {
2411 EHCIState *s = opaque;
2412 int i;
2413
2414 for (i = 0; i < NB_PORTS; i++) {
2415 USBPort *companion = s->companion_ports[i];
2416 if (companion == NULL) {
2417 continue;
2418 }
2419 if (s->portsc[i] & PORTSC_POWNER) {
2420 companion->dev = s->ports[i].dev;
2421 } else {
2422 companion->dev = NULL;
2423 }
2424 }
2425
2426 return 0;
2427 }
2428
2429 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2430 {
2431 EHCIState *ehci = opaque;
2432
2433 /*
2434 * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2435 * schedule in guest memory. We must do the rebuilt ASAP, so that
2436 * USB-devices which have async handled packages have a packet in the
2437 * ep queue to match the completion with.
2438 */
2439 if (state == RUN_STATE_RUNNING) {
2440 ehci_advance_async_state(ehci);
2441 }
2442
2443 /*
2444 * The schedule rebuilt from guest memory could cause the migration dest
2445 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2446 * will never have existed on the destination. Therefor we must flush the
2447 * async schedule on savevm to catch any not yet noticed unlinks.
2448 */
2449 if (state == RUN_STATE_SAVE_VM) {
2450 ehci_advance_async_state(ehci);
2451 ehci_queues_rip_unseen(ehci, 1);
2452 }
2453 }
2454
2455 const VMStateDescription vmstate_ehci = {
2456 .name = "ehci-core",
2457 .version_id = 2,
2458 .minimum_version_id = 1,
2459 .pre_save = usb_ehci_pre_save,
2460 .post_load = usb_ehci_post_load,
2461 .fields = (VMStateField[]) {
2462 /* mmio registers */
2463 VMSTATE_UINT32(usbcmd, EHCIState),
2464 VMSTATE_UINT32(usbsts, EHCIState),
2465 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2466 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2467 VMSTATE_UINT32(usbintr, EHCIState),
2468 VMSTATE_UINT32(frindex, EHCIState),
2469 VMSTATE_UINT32(ctrldssegment, EHCIState),
2470 VMSTATE_UINT32(periodiclistbase, EHCIState),
2471 VMSTATE_UINT32(asynclistaddr, EHCIState),
2472 VMSTATE_UINT32(configflag, EHCIState),
2473 VMSTATE_UINT32(portsc[0], EHCIState),
2474 VMSTATE_UINT32(portsc[1], EHCIState),
2475 VMSTATE_UINT32(portsc[2], EHCIState),
2476 VMSTATE_UINT32(portsc[3], EHCIState),
2477 VMSTATE_UINT32(portsc[4], EHCIState),
2478 VMSTATE_UINT32(portsc[5], EHCIState),
2479 /* frame timer */
2480 VMSTATE_TIMER_PTR(frame_timer, EHCIState),
2481 VMSTATE_UINT64(last_run_ns, EHCIState),
2482 VMSTATE_UINT32(async_stepdown, EHCIState),
2483 /* schedule state */
2484 VMSTATE_UINT32(astate, EHCIState),
2485 VMSTATE_UINT32(pstate, EHCIState),
2486 VMSTATE_UINT32(a_fetch_addr, EHCIState),
2487 VMSTATE_UINT32(p_fetch_addr, EHCIState),
2488 VMSTATE_END_OF_LIST()
2489 }
2490 };
2491
2492 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
2493 {
2494 int i;
2495
2496 if (s->portnr > NB_PORTS) {
2497 error_setg(errp, "Too many ports! Max. port number is %d.",
2498 NB_PORTS);
2499 return;
2500 }
2501 if (s->maxframes < 8 || s->maxframes > 512) {
2502 error_setg(errp, "maxframes %d out if range (8 .. 512)",
2503 s->maxframes);
2504 return;
2505 }
2506
2507 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
2508 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);
2509 for (i = 0; i < s->portnr; i++) {
2510 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2511 USB_SPEED_MASK_HIGH);
2512 s->ports[i].dev = 0;
2513 }
2514
2515 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s);
2516 s->async_bh = qemu_bh_new(ehci_work_bh, s);
2517 s->device = dev;
2518
2519 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2520 }
2521
2522 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp)
2523 {
2524 trace_usb_ehci_unrealize();
2525
2526 if (s->frame_timer) {
2527 timer_del(s->frame_timer);
2528 timer_free(s->frame_timer);
2529 s->frame_timer = NULL;
2530 }
2531 if (s->async_bh) {
2532 qemu_bh_delete(s->async_bh);
2533 }
2534
2535 ehci_queues_rip_all(s, 0);
2536 ehci_queues_rip_all(s, 1);
2537
2538 memory_region_del_subregion(&s->mem, &s->mem_caps);
2539 memory_region_del_subregion(&s->mem, &s->mem_opreg);
2540 memory_region_del_subregion(&s->mem, &s->mem_ports);
2541
2542 usb_bus_release(&s->bus);
2543
2544 if (s->vmstate) {
2545 qemu_del_vm_change_state_handler(s->vmstate);
2546 }
2547 }
2548
2549 void usb_ehci_init(EHCIState *s, DeviceState *dev)
2550 {
2551 /* 2.2 host controller interface version */
2552 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2553 s->caps[0x01] = 0x00;
2554 s->caps[0x02] = 0x00;
2555 s->caps[0x03] = 0x01; /* HC version */
2556 s->caps[0x04] = s->portnr; /* Number of downstream ports */
2557 s->caps[0x05] = 0x00; /* No companion ports at present */
2558 s->caps[0x06] = 0x00;
2559 s->caps[0x07] = 0x00;
2560 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
2561 s->caps[0x0a] = 0x00;
2562 s->caps[0x0b] = 0x00;
2563
2564 QTAILQ_INIT(&s->aqueues);
2565 QTAILQ_INIT(&s->pqueues);
2566 usb_packet_init(&s->ipacket);
2567
2568 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
2569 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
2570 "capabilities", CAPA_SIZE);
2571 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
2572 "operational", s->portscbase);
2573 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
2574 "ports", 4 * s->portnr);
2575
2576 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2577 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2578 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
2579 &s->mem_ports);
2580 }
2581
2582 void usb_ehci_finalize(EHCIState *s)
2583 {
2584 usb_packet_cleanup(&s->ipacket);
2585 }
2586
2587 /*
2588 * vim: expandtab ts=4
2589 */
Random patches