@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 2,720 lines 77.9 KB
Raw
1 /*
2 * QEMU USB EHCI Emulation
3 *
4 * Copyright(c) 2008 Emutex Ltd. (address@hidden)
5 * Copyright(c) 2011-2012 Red Hat, Inc.
6 *
7 * Red Hat Authors:
8 * Gerd Hoffmann <kraxel@redhat.com>
9 * Hans de Goede <hdegoede@redhat.com>
10 *
11 * EHCI project was started by Mark Burkley, with contributions by
12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14 *
15 * This library is free software; you can redistribute it and/or
16 * modify it under the terms of the GNU Lesser General Public
17 * License as published by the Free Software Foundation; either
18 * version 2.1 of the License, or (at your option) any later version.
19 *
20 * This library is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 * Lesser General Public License for more details.
24 *
25 * You should have received a copy of the GNU Lesser General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 */
28
29 #include "qemu/osdep.h"
30 #include "qapi/error.h"
31 #include "hw/core/irq.h"
32 #include "hw/usb/ehci-regs.h"
33 #include "hw/usb/hcd-ehci.h"
34 #include "migration/vmstate.h"
35 #include "trace.h"
36 #include "qemu/error-report.h"
37 #include "qemu/main-loop.h"
38 #include "system/runstate.h"
39 #include "qemu/log.h"
40
41 #define FRAME_TIMER_FREQ 1000
42 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
43 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8)
44
45 #define NB_MAXINTRATE 8 /* Max rate at which controller issues ints */
46 #define BUFF_SIZE (5 * 4096) /* Max bytes to transfer per transaction */
47 #define MAX_QH 100 /* Max allowable queue heads in a chain */
48 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */
49 #define PERIODIC_ACTIVE 512 /* Micro-frames */
50
51 /*
52 * Internal periodic / asynchronous schedule state machine states
53 */
54 typedef enum {
55 EST_INACTIVE = 1000,
56 EST_ACTIVE,
57 EST_EXECUTING,
58 EST_SLEEPING,
59 /*
60 * The following states are internal to the state machine function
61 */
62 EST_WAITLISTHEAD,
63 EST_FETCHENTRY,
64 EST_FETCHQH,
65 EST_FETCHITD,
66 EST_FETCHSITD,
67 EST_ADVANCEQUEUE,
68 EST_FETCHQTD,
69 EST_EXECUTE,
70 EST_WRITEBACK,
71 EST_HORIZONTALQH
72 } EHCI_STATES;
73
74 /* macros for accessing fields within next link pointer entry */
75 #define NLPTR_GET(x) ((x) & ~0x1fULL)
76 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
77 #define NLPTR_TBIT(x) ((x) & 1) /* 1=invalid, 0=valid */
78
79 /* link pointer types */
80 #define NLPTR_TYPE_ITD 0 /* isoc xfer descriptor */
81 #define NLPTR_TYPE_QH 1 /* queue head */
82 #define NLPTR_TYPE_STITD 2 /* split xaction, isoc xfer descriptor */
83 #define NLPTR_TYPE_FSTN 3 /* frame span traversal node */
84
85 #define SET_LAST_RUN_CLOCK(s) \
86 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
87
88 /* nifty macros from Arnon's EHCI version */
89 #define get_field(data, field) \
90 (((data) & field##_MASK) >> field##_SH)
91
92 #define set_field(data, newval, field) do { \
93 uint32_t val = *data; \
94 val &= ~field##_MASK; \
95 val |= ((newval) << field##_SH) & field##_MASK; \
96 *data = val; \
97 } while (0)
98
99 /*
100 * EHCIqh / EHCIqtd / EHCIitd are sized to always include the extended
101 * high buffer pointer fields from EHCI 1.0 Appendix B. When 64-bit
102 * addressing capability is not advertised to the guest, the descriptors
103 * in guest memory only have the classic 32-bit layout, so DMA transfers
104 * must not read or write past that boundary.
105 */
106 #define EHCI_QH_DWORDS_32 (offsetof(EHCIqh, bufptr_hi) / sizeof(uint32_t))
107 #define EHCI_QTD_DWORDS_32 (offsetof(EHCIqtd, bufptr_hi) / sizeof(uint32_t))
108 #define EHCI_ITD_DWORDS_32 (offsetof(EHCIitd, bufptr_hi) / sizeof(uint32_t))
109
110 static const char *ehci_state_names[] = {
111 [EST_INACTIVE] = "INACTIVE",
112 [EST_ACTIVE] = "ACTIVE",
113 [EST_EXECUTING] = "EXECUTING",
114 [EST_SLEEPING] = "SLEEPING",
115 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
116 [EST_FETCHENTRY] = "FETCH ENTRY",
117 [EST_FETCHQH] = "FETCH QH",
118 [EST_FETCHITD] = "FETCH ITD",
119 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
120 [EST_FETCHQTD] = "FETCH QTD",
121 [EST_EXECUTE] = "EXECUTE",
122 [EST_WRITEBACK] = "WRITEBACK",
123 [EST_HORIZONTALQH] = "HORIZONTALQH",
124 };
125
126 static const char *ehci_mmio_names[] = {
127 [USBCMD] = "USBCMD",
128 [USBSTS] = "USBSTS",
129 [USBINTR] = "USBINTR",
130 [FRINDEX] = "FRINDEX",
131 [PERIODICLISTBASE] = "P-LIST BASE",
132 [ASYNCLISTADDR] = "A-LIST ADDR",
133 [CONFIGFLAG] = "CONFIGFLAG",
134 };
135
136 static int ehci_state_executing(EHCIQueue *q);
137 static int ehci_state_writeback(EHCIQueue *q);
138 static int ehci_state_advqueue(EHCIQueue *q);
139 static int ehci_fill_queue(EHCIPacket *p);
140 static void ehci_free_packet(EHCIPacket *p);
141
142 static const char *nr2str(const char **n, size_t len, uint32_t nr)
143 {
144 if (nr < len && n[nr] != NULL) {
145 return n[nr];
146 } else {
147 return "unknown";
148 }
149 }
150
151 static const char *state2str(uint32_t state)
152 {
153 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
154 }
155
156 static const char *addr2str(hwaddr addr)
157 {
158 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
159 }
160
161 static uint64_t ehci_get_buf_addr(const EHCIState *s, uint32_t hi,
162 uint32_t lo, uint32_t lo_mask)
163 {
164 uint64_t addr = lo & lo_mask;
165
166 if (s->caps_64bit_addr) {
167 addr = deposit64(addr, 32, 32, hi);
168 }
169
170 return addr;
171 }
172
173 static uint64_t ehci_get_desc_addr(const EHCIState *s, uint32_t lo)
174 {
175 return ehci_get_buf_addr(s, s->ctrldssegment, lo, UINT32_MAX);
176 }
177
178 static uint32_t ehci_qh_dwords(const EHCIState *s)
179 {
180 return s->caps_64bit_addr ? (sizeof(EHCIqh) >> 2) : EHCI_QH_DWORDS_32;
181 }
182
183 static uint32_t ehci_qtd_dwords(const EHCIState *s)
184 {
185 return s->caps_64bit_addr ? (sizeof(EHCIqtd) >> 2) : EHCI_QTD_DWORDS_32;
186 }
187
188 static uint32_t ehci_itd_dwords(const EHCIState *s)
189 {
190 return s->caps_64bit_addr ? (sizeof(EHCIitd) >> 2) : EHCI_ITD_DWORDS_32;
191 }
192
193 static void ehci_trace_usbsts(uint32_t mask, int state)
194 {
195 /* interrupts */
196 if (mask & USBSTS_INT) {
197 trace_usb_ehci_usbsts("INT", state);
198 }
199 if (mask & USBSTS_ERRINT) {
200 trace_usb_ehci_usbsts("ERRINT", state);
201 }
202 if (mask & USBSTS_PCD) {
203 trace_usb_ehci_usbsts("PCD", state);
204 }
205 if (mask & USBSTS_FLR) {
206 trace_usb_ehci_usbsts("FLR", state);
207 }
208 if (mask & USBSTS_HSE) {
209 trace_usb_ehci_usbsts("HSE", state);
210 }
211 if (mask & USBSTS_IAA) {
212 trace_usb_ehci_usbsts("IAA", state);
213 }
214
215 /* status */
216 if (mask & USBSTS_HALT) {
217 trace_usb_ehci_usbsts("HALT", state);
218 }
219 if (mask & USBSTS_REC) {
220 trace_usb_ehci_usbsts("REC", state);
221 }
222 if (mask & USBSTS_PSS) {
223 trace_usb_ehci_usbsts("PSS", state);
224 }
225 if (mask & USBSTS_ASS) {
226 trace_usb_ehci_usbsts("ASS", state);
227 }
228 }
229
230 static inline void ehci_set_usbsts(EHCIState *s, int mask)
231 {
232 if ((s->usbsts & mask) == mask) {
233 return;
234 }
235 ehci_trace_usbsts(mask, 1);
236 s->usbsts |= mask;
237 }
238
239 static inline void ehci_clear_usbsts(EHCIState *s, int mask)
240 {
241 if ((s->usbsts & mask) == 0) {
242 return;
243 }
244 ehci_trace_usbsts(mask, 0);
245 s->usbsts &= ~mask;
246 }
247
248 /* update irq line */
249 static inline void ehci_update_irq(EHCIState *s)
250 {
251 int level = 0;
252
253 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
254 level = 1;
255 }
256
257 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
258 qemu_set_irq(s->irq, level);
259 }
260
261 /* flag interrupt condition */
262 static inline void ehci_raise_irq(EHCIState *s, int intr)
263 {
264 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
265 s->usbsts |= intr;
266 ehci_update_irq(s);
267 } else {
268 s->usbsts_pending |= intr;
269 }
270 }
271
272 /*
273 * Commit pending interrupts (added via ehci_raise_irq),
274 * at the rate allowed by "Interrupt Threshold Control".
275 */
276 static inline void ehci_commit_irq(EHCIState *s)
277 {
278 uint32_t itc;
279
280 if (!s->usbsts_pending) {
281 return;
282 }
283 if (s->usbsts_frindex > s->frindex) {
284 return;
285 }
286
287 itc = (s->usbcmd >> 16) & 0xff;
288 s->usbsts |= s->usbsts_pending;
289 s->usbsts_pending = 0;
290 s->usbsts_frindex = s->frindex + itc;
291 ehci_update_irq(s);
292 }
293
294 static void ehci_update_halt(EHCIState *s)
295 {
296 if (s->usbcmd & USBCMD_RUNSTOP) {
297 ehci_clear_usbsts(s, USBSTS_HALT);
298 } else {
299 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
300 ehci_set_usbsts(s, USBSTS_HALT);
301 }
302 }
303 }
304
305 static void ehci_set_state(EHCIState *s, int async, int state)
306 {
307 if (async) {
308 trace_usb_ehci_state("async", state2str(state));
309 s->astate = state;
310 if (s->astate == EST_INACTIVE) {
311 ehci_clear_usbsts(s, USBSTS_ASS);
312 ehci_update_halt(s);
313 } else {
314 ehci_set_usbsts(s, USBSTS_ASS);
315 }
316 } else {
317 trace_usb_ehci_state("periodic", state2str(state));
318 s->pstate = state;
319 if (s->pstate == EST_INACTIVE) {
320 ehci_clear_usbsts(s, USBSTS_PSS);
321 ehci_update_halt(s);
322 } else {
323 ehci_set_usbsts(s, USBSTS_PSS);
324 }
325 }
326 }
327
328 static int ehci_get_state(EHCIState *s, int async)
329 {
330 return async ? s->astate : s->pstate;
331 }
332
333 static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
334 {
335 if (async) {
336 s->a_fetch_addr = addr;
337 } else {
338 s->p_fetch_addr = addr;
339 }
340 }
341
342 static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
343 {
344 return async ? s->a_fetch_addr : s->p_fetch_addr;
345 }
346
347 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
348 {
349 /* need three here due to argument count limits */
350 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
351 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
352 trace_usb_ehci_qh_fields(addr,
353 get_field(qh->epchar, QH_EPCHAR_RL),
354 get_field(qh->epchar, QH_EPCHAR_MPLEN),
355 get_field(qh->epchar, QH_EPCHAR_EPS),
356 get_field(qh->epchar, QH_EPCHAR_EP),
357 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
358 trace_usb_ehci_qh_bits(addr,
359 (bool)(qh->epchar & QH_EPCHAR_C),
360 (bool)(qh->epchar & QH_EPCHAR_H),
361 (bool)(qh->epchar & QH_EPCHAR_DTC),
362 (bool)(qh->epchar & QH_EPCHAR_I));
363 }
364
365 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
366 {
367 /* need three here due to argument count limits */
368 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
369 trace_usb_ehci_qtd_fields(addr,
370 get_field(qtd->token, QTD_TOKEN_TBYTES),
371 get_field(qtd->token, QTD_TOKEN_CPAGE),
372 get_field(qtd->token, QTD_TOKEN_CERR),
373 get_field(qtd->token, QTD_TOKEN_PID));
374 trace_usb_ehci_qtd_bits(addr,
375 (bool)(qtd->token & QTD_TOKEN_IOC),
376 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
377 (bool)(qtd->token & QTD_TOKEN_HALT),
378 (bool)(qtd->token & QTD_TOKEN_BABBLE),
379 (bool)(qtd->token & QTD_TOKEN_XACTERR));
380 }
381
382 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
383 {
384 trace_usb_ehci_itd(addr, itd->next,
385 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
386 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
387 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
388 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
389 }
390
391 static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
392 EHCIsitd *sitd)
393 {
394 trace_usb_ehci_sitd(addr, sitd->next,
395 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
396 }
397
398 static void ehci_trace_guest_bug(EHCIState *s, const char *message)
399 {
400 trace_usb_ehci_guest_bug(message);
401 }
402
403 static inline bool ehci_enabled(EHCIState *s)
404 {
405 return s->usbcmd & USBCMD_RUNSTOP;
406 }
407
408 static inline bool ehci_async_enabled(EHCIState *s)
409 {
410 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
411 }
412
413 static inline bool ehci_periodic_enabled(EHCIState *s)
414 {
415 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
416 }
417
418 /* Get an array of dwords from main memory */
419 static inline int get_dwords(EHCIState *ehci, uint64_t addr,
420 uint32_t *buf, int num)
421 {
422 int i;
423
424 if (!ehci->as) {
425 ehci_raise_irq(ehci, USBSTS_HSE);
426 ehci->usbcmd &= ~USBCMD_RUNSTOP;
427 trace_usb_ehci_dma_error();
428 return -1;
429 }
430
431 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
432 dma_memory_read(ehci->as, addr, buf, sizeof(*buf),
433 MEMTXATTRS_UNSPECIFIED);
434 *buf = le32_to_cpu(*buf);
435 }
436
437 return num;
438 }
439
440 /* Put an array of dwords in to main memory */
441 static inline int put_dwords(EHCIState *ehci, uint64_t addr,
442 uint32_t *buf, int num)
443 {
444 int i;
445
446 if (!ehci->as) {
447 ehci_raise_irq(ehci, USBSTS_HSE);
448 ehci->usbcmd &= ~USBCMD_RUNSTOP;
449 trace_usb_ehci_dma_error();
450 return -1;
451 }
452
453 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
454 uint32_t tmp = cpu_to_le32(*buf);
455 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp),
456 MEMTXATTRS_UNSPECIFIED);
457 }
458
459 return num;
460 }
461
462 static int ehci_get_pid(EHCIqtd *qtd)
463 {
464 switch (get_field(qtd->token, QTD_TOKEN_PID)) {
465 case 0:
466 return USB_TOKEN_OUT;
467 case 1:
468 return USB_TOKEN_IN;
469 case 2:
470 return USB_TOKEN_SETUP;
471 default:
472 qemu_log_mask(LOG_GUEST_ERROR, "bad token\n");
473 return 0;
474 }
475 }
476
477 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
478 {
479 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR);
480 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP);
481 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
482 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
483 (qh->current_qtd != q->qh.current_qtd) ||
484 (q->async && qh->next_qtd != q->qh.next_qtd) ||
485 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
486 EHCI_QH_OVERLAY_COUNT * sizeof(uint32_t)) != 0) ||
487 (q->dev != NULL && q->dev->addr != devaddr)) {
488 return false;
489 } else {
490 return true;
491 }
492 }
493
494 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
495 {
496 if (p->qtdaddr != p->queue->qtdaddr ||
497 (p->queue->async && !NLPTR_TBIT(p->qtd.next) &&
498 (p->qtd.next != qtd->next)) ||
499 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
500 p->qtd.token != qtd->token ||
501 p->qtd.bufptr[0] != qtd->bufptr[0] ||
502 p->qtd.bufptr_hi[0] != qtd->bufptr_hi[0]) {
503 return false;
504 } else {
505 return true;
506 }
507 }
508
509 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
510 {
511 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP);
512 int pid = ehci_get_pid(qtd);
513
514 /* Note the pid changing is normal for ep 0 (the control ep) */
515 if (q->last_pid && ep != 0 && pid != q->last_pid) {
516 return false;
517 } else {
518 return true;
519 }
520 }
521
522 /*
523 * Finish executing and writeback a packet outside of the regular
524 * fetchqh -> fetchqtd -> execute -> writeback cycle
525 */
526 static void ehci_writeback_async_complete_packet(EHCIPacket *p)
527 {
528 EHCIQueue *q = p->queue;
529 EHCIqtd qtd;
530 EHCIqh qh;
531 int state;
532
533 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
534 memset(&qh, 0, sizeof(qh));
535 memset(&qtd, 0, sizeof(qtd));
536 get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
537 (uint32_t *) &qh, ehci_qh_dwords(q->ehci));
538 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
539 (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci));
540 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
541 p->async = EHCI_ASYNC_INITIALIZED;
542 ehci_free_packet(p);
543 return;
544 }
545
546 state = ehci_get_state(q->ehci, q->async);
547 ehci_state_executing(q);
548 ehci_state_writeback(q); /* Frees the packet! */
549 if (!(q->qh.token & QTD_TOKEN_HALT)) {
550 ehci_state_advqueue(q);
551 }
552 ehci_set_state(q->ehci, q->async, state);
553 }
554
555 /* packet management */
556
557 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
558 {
559 EHCIPacket *p;
560
561 p = g_new0(EHCIPacket, 1);
562 p->queue = q;
563 usb_packet_init(&p->packet);
564 QTAILQ_INSERT_TAIL(&q->packets, p, next);
565 trace_usb_ehci_packet_action(p->queue, p, "alloc");
566 return p;
567 }
568
569 static void ehci_free_packet(EHCIPacket *p)
570 {
571 if (p->async == EHCI_ASYNC_FINISHED &&
572 !(p->queue->qh.token & QTD_TOKEN_HALT)) {
573 ehci_writeback_async_complete_packet(p);
574 return;
575 }
576 trace_usb_ehci_packet_action(p->queue, p, "free");
577 if (p->async == EHCI_ASYNC_INFLIGHT) {
578 usb_cancel_packet(&p->packet);
579 }
580 if (p->async == EHCI_ASYNC_FINISHED &&
581 p->packet.status == USB_RET_SUCCESS) {
582 qemu_log_mask(LOG_GUEST_ERROR,
583 "EHCI: Dropping completed packet from halted %s ep %02X\n",
584 (p->pid == USB_TOKEN_IN) ? "in" : "out",
585 get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
586 }
587 if (p->async != EHCI_ASYNC_NONE) {
588 usb_packet_unmap(&p->packet, &p->sgl);
589 qemu_sglist_destroy(&p->sgl);
590 }
591 QTAILQ_REMOVE(&p->queue->packets, p, next);
592 usb_packet_cleanup(&p->packet);
593 g_free(p);
594 }
595
596 /* queue management */
597
598 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
599 {
600 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
601 EHCIQueue *q;
602
603 q = g_malloc0(sizeof(*q));
604 q->ehci = ehci;
605 q->qhaddr = addr;
606 q->async = async;
607 QTAILQ_INIT(&q->packets);
608 QTAILQ_INSERT_HEAD(head, q, next);
609 trace_usb_ehci_queue_action(q, "alloc");
610 return q;
611 }
612
613 static void ehci_queue_stopped(EHCIQueue *q)
614 {
615 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP);
616
617 if (!q->last_pid || !q->dev) {
618 return;
619 }
620
621 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp));
622 }
623
624 static int ehci_cancel_queue(EHCIQueue *q)
625 {
626 EHCIPacket *p;
627 int packets = 0;
628
629 p = QTAILQ_FIRST(&q->packets);
630 if (p == NULL) {
631 goto leave;
632 }
633
634 trace_usb_ehci_queue_action(q, "cancel");
635 do {
636 ehci_free_packet(p);
637 packets++;
638 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
639
640 leave:
641 ehci_queue_stopped(q);
642 return packets;
643 }
644
645 static int ehci_reset_queue(EHCIQueue *q)
646 {
647 int packets;
648
649 trace_usb_ehci_queue_action(q, "reset");
650 packets = ehci_cancel_queue(q);
651 q->dev = NULL;
652 q->qtdaddr = 0;
653 q->last_pid = 0;
654 return packets;
655 }
656
657 static void ehci_free_queue(EHCIQueue *q, const char *warn)
658 {
659 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
660 int cancelled;
661
662 trace_usb_ehci_queue_action(q, "free");
663 cancelled = ehci_cancel_queue(q);
664 if (warn && cancelled > 0) {
665 ehci_trace_guest_bug(q->ehci, warn);
666 }
667 QTAILQ_REMOVE(head, q, next);
668 g_free(q);
669 }
670
671 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
672 int async)
673 {
674 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
675 EHCIQueue *q;
676
677 QTAILQ_FOREACH(q, head, next) {
678 if (addr == q->qhaddr) {
679 return q;
680 }
681 }
682 return NULL;
683 }
684
685 static void ehci_queues_rip_unused(EHCIState *ehci, int async)
686 {
687 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
688 const char *warn = async ? "guest unlinked busy QH" : NULL;
689 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
690 EHCIQueue *q, *tmp;
691
692 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
693 if (q->seen) {
694 q->seen = 0;
695 q->ts = ehci->last_run_ns;
696 continue;
697 }
698 if (ehci->last_run_ns < q->ts + maxage) {
699 continue;
700 }
701 ehci_free_queue(q, warn);
702 }
703 }
704
705 static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
706 {
707 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
708 EHCIQueue *q, *tmp;
709
710 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
711 if (!q->seen) {
712 ehci_free_queue(q, NULL);
713 }
714 }
715 }
716
717 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
718 {
719 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
720 EHCIQueue *q, *tmp;
721
722 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
723 if (q->dev != dev) {
724 continue;
725 }
726 ehci_free_queue(q, NULL);
727 }
728 }
729
730 static void ehci_queues_rip_all(EHCIState *ehci, int async)
731 {
732 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
733 const char *warn = async ? "guest stopped busy async schedule" : NULL;
734 EHCIQueue *q, *tmp;
735
736 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
737 ehci_free_queue(q, warn);
738 }
739 }
740
741 /* Attach or detach a device on root hub */
742
743 static void ehci_attach(USBPort *port)
744 {
745 EHCIState *s = port->opaque;
746 uint32_t *portsc = &s->portsc[port->index];
747 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
748
749 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
750
751 if (*portsc & PORTSC_POWNER) {
752 USBPort *companion = s->companion_ports[port->index];
753 companion->dev = port->dev;
754 companion->ops->attach(companion);
755 return;
756 }
757
758 *portsc |= PORTSC_CONNECT;
759 *portsc |= PORTSC_CSC;
760
761 ehci_raise_irq(s, USBSTS_PCD);
762 }
763
764 static void ehci_detach(USBPort *port)
765 {
766 EHCIState *s = port->opaque;
767 uint32_t *portsc = &s->portsc[port->index];
768 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
769
770 trace_usb_ehci_port_detach(port->index, owner);
771
772 if (*portsc & PORTSC_POWNER) {
773 USBPort *companion = s->companion_ports[port->index];
774 companion->ops->detach(companion);
775 companion->dev = NULL;
776 /*
777 * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
778 * the port ownership is returned immediately to the EHCI controller."
779 */
780 *portsc &= ~PORTSC_POWNER;
781 return;
782 }
783
784 ehci_queues_rip_device(s, port->dev, 0);
785 ehci_queues_rip_device(s, port->dev, 1);
786
787 *portsc &= ~(PORTSC_CONNECT | PORTSC_PED | PORTSC_SUSPEND);
788 *portsc |= PORTSC_CSC;
789
790 ehci_raise_irq(s, USBSTS_PCD);
791 }
792
793 static void ehci_child_detach(USBPort *port, USBDevice *child)
794 {
795 EHCIState *s = port->opaque;
796 uint32_t portsc = s->portsc[port->index];
797
798 if (portsc & PORTSC_POWNER) {
799 USBPort *companion = s->companion_ports[port->index];
800 companion->ops->child_detach(companion, child);
801 return;
802 }
803
804 ehci_queues_rip_device(s, child, 0);
805 ehci_queues_rip_device(s, child, 1);
806 }
807
808 static void ehci_wakeup(USBPort *port)
809 {
810 EHCIState *s = port->opaque;
811 uint32_t *portsc = &s->portsc[port->index];
812
813 if (*portsc & PORTSC_POWNER) {
814 USBPort *companion = s->companion_ports[port->index];
815 if (companion->ops->wakeup) {
816 companion->ops->wakeup(companion);
817 }
818 return;
819 }
820
821 if (*portsc & PORTSC_SUSPEND) {
822 trace_usb_ehci_port_wakeup(port->index);
823 *portsc |= PORTSC_FPRES;
824 ehci_raise_irq(s, USBSTS_PCD);
825 }
826
827 qemu_bh_schedule(s->async_bh);
828 }
829
830 static void ehci_register_companion(USBBus *bus, USBPort *ports[],
831 uint32_t portcount, uint32_t firstport,
832 Error **errp)
833 {
834 EHCIState *s = container_of(bus, EHCIState, bus);
835 uint32_t i;
836
837 if (firstport + portcount > EHCI_PORTS) {
838 error_setg(errp, "firstport must be between 0 and %u",
839 EHCI_PORTS - portcount);
840 return;
841 }
842
843 for (i = 0; i < portcount; i++) {
844 if (s->companion_ports[firstport + i]) {
845 error_setg(errp, "firstport %u asks for ports %u-%u,"
846 " but port %u has a companion assigned already",
847 firstport, firstport, firstport + portcount - 1,
848 firstport + i);
849 return;
850 }
851 }
852
853 for (i = 0; i < portcount; i++) {
854 s->companion_ports[firstport + i] = ports[i];
855 s->ports[firstport + i].speedmask |=
856 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
857 /* Ensure devs attached before the initial reset go to the companion */
858 s->portsc[firstport + i] = PORTSC_POWNER;
859 }
860
861 s->companion_count++;
862 s->caps[0x05] = (s->companion_count << 4) | portcount;
863 }
864
865 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
866 unsigned int stream)
867 {
868 EHCIState *s = container_of(bus, EHCIState, bus);
869 uint32_t portsc = s->portsc[ep->dev->port->index];
870
871 if (portsc & PORTSC_POWNER) {
872 return;
873 }
874
875 s->periodic_sched_active = PERIODIC_ACTIVE;
876 qemu_bh_schedule(s->async_bh);
877 }
878
879 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
880 {
881 USBDevice *dev;
882 USBPort *port;
883 int i;
884
885 for (i = 0; i < EHCI_PORTS; i++) {
886 port = &ehci->ports[i];
887 if (!(ehci->portsc[i] & PORTSC_PED)) {
888 trace_usb_ehci_port_disable(i);
889 continue;
890 }
891 dev = usb_find_device(port, addr);
892 if (dev != NULL) {
893 return dev;
894 }
895 }
896 return NULL;
897 }
898
899 /* 4.1 host controller initialization */
900 void ehci_reset(void *opaque)
901 {
902 EHCIState *s = opaque;
903 int i;
904 USBDevice *devs[EHCI_PORTS];
905
906 trace_usb_ehci_reset();
907
908 /*
909 * Do the detach before touching portsc, so that it correctly gets send to
910 * us or to our companion based on PORTSC_POWNER before the reset.
911 */
912 for (i = 0; i < EHCI_PORTS; i++) {
913 devs[i] = s->ports[i].dev;
914 if (devs[i] && devs[i]->attached) {
915 usb_detach(&s->ports[i]);
916 }
917 }
918
919 memset(&s->opreg, 0x00, sizeof(s->opreg));
920 memset(&s->portsc, 0x00, sizeof(s->portsc));
921
922 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
923 s->usbsts = USBSTS_HALT;
924 s->usbsts_pending = 0;
925 s->usbsts_frindex = 0;
926 ehci_update_irq(s);
927
928 s->astate = EST_INACTIVE;
929 s->pstate = EST_INACTIVE;
930
931 for (i = 0; i < EHCI_PORTS; i++) {
932 if (s->companion_ports[i]) {
933 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
934 } else {
935 s->portsc[i] = PORTSC_PPOWER;
936 }
937 if (devs[i] && devs[i]->attached) {
938 usb_attach(&s->ports[i]);
939 usb_device_reset(devs[i]);
940 }
941 }
942 ehci_queues_rip_all(s, 0);
943 ehci_queues_rip_all(s, 1);
944 timer_del(s->frame_timer);
945 qemu_bh_cancel(s->async_bh);
946 }
947
948 static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
949 unsigned size)
950 {
951 EHCIState *s = ptr;
952 return s->caps[addr];
953 }
954
955 static void ehci_caps_write(void *ptr, hwaddr addr,
956 uint64_t val, unsigned size)
957 {
958 }
959
960 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
961 unsigned size)
962 {
963 EHCIState *s = ptr;
964 uint32_t val;
965
966 switch (addr) {
967 case FRINDEX:
968 /* Round down to mult of 8, else it can go backwards on migration */
969 val = s->frindex & ~7;
970 break;
971 default:
972 val = s->opreg[addr >> 2];
973 }
974
975 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
976 return val;
977 }
978
979 static uint64_t ehci_port_read(void *ptr, hwaddr addr,
980 unsigned size)
981 {
982 EHCIState *s = ptr;
983 uint32_t val;
984
985 val = s->portsc[addr >> 2];
986 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
987 return val;
988 }
989
990 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
991 {
992 USBDevice *dev = s->ports[port].dev;
993 uint32_t *portsc = &s->portsc[port];
994 uint32_t orig;
995
996 if (s->companion_ports[port] == NULL) {
997 return;
998 }
999
1000 owner = owner & PORTSC_POWNER;
1001 orig = *portsc & PORTSC_POWNER;
1002
1003 if (!(owner ^ orig)) {
1004 return;
1005 }
1006
1007 if (dev && dev->attached) {
1008 usb_detach(&s->ports[port]);
1009 }
1010
1011 *portsc &= ~PORTSC_POWNER;
1012 *portsc |= owner;
1013
1014 if (dev && dev->attached) {
1015 usb_attach(&s->ports[port]);
1016 }
1017 }
1018
1019 static void ehci_port_write(void *ptr, hwaddr addr,
1020 uint64_t val, unsigned size)
1021 {
1022 EHCIState *s = ptr;
1023 int port = addr >> 2;
1024 uint32_t *portsc = &s->portsc[port];
1025 uint32_t old = *portsc;
1026 USBDevice *dev = s->ports[port].dev;
1027
1028 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
1029
1030 /* Clear rwc bits */
1031 *portsc &= ~(val & PORTSC_RWC_MASK);
1032 /* The guest may clear, but not set the PED bit */
1033 *portsc &= val | ~PORTSC_PED;
1034 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
1035 handle_port_owner_write(s, port, val);
1036 /* And finally apply RO_MASK */
1037 val &= PORTSC_RO_MASK;
1038
1039 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
1040 trace_usb_ehci_port_reset(port, 1);
1041 }
1042
1043 if (!(val & PORTSC_PRESET) && (*portsc & PORTSC_PRESET)) {
1044 trace_usb_ehci_port_reset(port, 0);
1045 if (dev && dev->attached) {
1046 usb_port_reset(&s->ports[port]);
1047 *portsc &= ~PORTSC_CSC;
1048 }
1049
1050 /*
1051 * Table 2.16 Set the enable bit(and enable bit change) to indicate
1052 * to SW that this port has a high speed device attached
1053 */
1054 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
1055 val |= PORTSC_PED;
1056 }
1057 }
1058
1059 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) {
1060 trace_usb_ehci_port_suspend(port);
1061 }
1062 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) {
1063 trace_usb_ehci_port_resume(port);
1064 val &= ~PORTSC_SUSPEND;
1065 }
1066
1067 *portsc &= ~PORTSC_RO_MASK;
1068 *portsc |= val;
1069 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
1070 }
1071
1072 static void ehci_opreg_write(void *ptr, hwaddr addr,
1073 uint64_t val, unsigned size)
1074 {
1075 EHCIState *s = ptr;
1076 uint32_t *mmio = s->opreg + (addr >> 2);
1077 uint32_t old = *mmio;
1078 int i;
1079
1080 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
1081
1082 switch (addr) {
1083 case USBCMD:
1084 if (val & USBCMD_HCRESET) {
1085 ehci_reset(s);
1086 val = s->usbcmd;
1087 break;
1088 }
1089
1090 /* not supporting dynamic frame list size at the moment */
1091 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
1092 qemu_log_mask(LOG_GUEST_ERROR,
1093 "attempt to set frame list size -- value %" PRId64
1094 "\n", val & USBCMD_FLS);
1095 val &= ~USBCMD_FLS;
1096 }
1097
1098 if (val & USBCMD_IAAD) {
1099 /*
1100 * Process IAAD immediately, otherwise the Linux IAAD watchdog may
1101 * trigger and re-use a qh without us seeing the unlink.
1102 */
1103 s->async_stepdown = 0;
1104 qemu_bh_schedule(s->async_bh);
1105 trace_usb_ehci_doorbell_ring();
1106 }
1107
1108 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
1109 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
1110 if (s->pstate == EST_INACTIVE) {
1111 SET_LAST_RUN_CLOCK(s);
1112 }
1113 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
1114 ehci_update_halt(s);
1115 s->async_stepdown = 0;
1116 qemu_bh_schedule(s->async_bh);
1117 }
1118 break;
1119
1120 case USBSTS:
1121 /* bits 6 through 31 are RO */
1122 val &= USBSTS_RO_MASK;
1123 /* bits 0 through 5 are R/WC */
1124 ehci_clear_usbsts(s, val);
1125 val = s->usbsts;
1126 ehci_update_irq(s);
1127 break;
1128
1129 case USBINTR:
1130 val &= USBINTR_MASK;
1131 if (ehci_enabled(s) && (USBSTS_FLR & val)) {
1132 qemu_bh_schedule(s->async_bh);
1133 }
1134 break;
1135
1136 case FRINDEX:
1137 val &= 0x00003fff; /* frindex is 14bits */
1138 s->usbsts_frindex = val;
1139 break;
1140
1141 case CONFIGFLAG:
1142 val &= 0x1;
1143 if (val) {
1144 for (i = 0; i < EHCI_PORTS; i++) {
1145 handle_port_owner_write(s, i, 0);
1146 }
1147 }
1148 break;
1149
1150 case PERIODICLISTBASE:
1151 if (ehci_periodic_enabled(s)) {
1152 qemu_log_mask(LOG_GUEST_ERROR,
1153 "ehci: PERIODIC list base register set while periodic schedule\n"
1154 " is enabled and HC is enabled\n");
1155 }
1156 break;
1157
1158 case CTRLDSSEGMENT:
1159 if (!s->caps_64bit_addr) {
1160 qemu_log_mask(LOG_GUEST_ERROR,
1161 "ehci: write to CTRLDSSEGMENT while "
1162 "64-bit addressing capability is disabled\n");
1163 return;
1164 }
1165 val |= s->ctrldssegment_default;
1166 break;
1167
1168 case ASYNCLISTADDR:
1169 if (ehci_async_enabled(s)) {
1170 qemu_log_mask(LOG_GUEST_ERROR,
1171 "ehci: ASYNC list address register set while async schedule\n"
1172 " is enabled and HC is enabled\n");
1173 }
1174 break;
1175 }
1176
1177 *mmio = val;
1178 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1179 *mmio, old);
1180 }
1181
1182 /*
1183 * Write the qh back to guest physical memory. This step isn't
1184 * in the EHCI spec but we need to do it since we don't share
1185 * physical memory with our guest VM.
1186 *
1187 * The first three dwords are read-only for the EHCI, so skip them
1188 * when writing back the qh.
1189 */
1190 static void ehci_flush_qh(EHCIQueue *q)
1191 {
1192 uint32_t *qh = (uint32_t *) &q->qh;
1193 uint32_t dwords = ehci_qh_dwords(q->ehci);
1194 uint64_t addr = NLPTR_GET(q->qhaddr);
1195
1196 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1197 }
1198
1199 /* 4.10.2 */
1200 static int ehci_qh_do_overlay(EHCIQueue *q)
1201 {
1202 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1203 int i;
1204 int dtoggle;
1205 int ping;
1206 int eps;
1207 int reload;
1208
1209 assert(p != NULL);
1210 assert(p->qtdaddr == q->qtdaddr);
1211
1212 /* remember values in fields to preserve in qh after overlay */
1213 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1214 ping = q->qh.token & QTD_TOKEN_PING;
1215
1216 q->qh.current_qtd = p->qtdaddr;
1217 q->qh.next_qtd = p->qtd.next;
1218 q->qh.altnext_qtd = p->qtd.altnext;
1219 q->qh.token = p->qtd.token;
1220
1221
1222 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1223 if (eps == EHCI_QH_EPS_HIGH) {
1224 q->qh.token &= ~QTD_TOKEN_PING;
1225 q->qh.token |= ping;
1226 }
1227
1228 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1229 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1230
1231 for (i = 0; i < 5; i++) {
1232 q->qh.bufptr[i] = p->qtd.bufptr[i];
1233 q->qh.bufptr_hi[i] = p->qtd.bufptr_hi[i];
1234 }
1235
1236 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1237 /* preserve QH DT bit */
1238 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1239 q->qh.token |= dtoggle;
1240 }
1241
1242 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1243 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1244
1245 ehci_flush_qh(q);
1246
1247 return 0;
1248 }
1249
1250 static int ehci_init_transfer(EHCIPacket *p)
1251 {
1252 uint32_t cpage, offset, bytes, plen;
1253 dma_addr_t page;
1254
1255 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1256 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1257 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1258 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
1259
1260 while (bytes > 0) {
1261 if (cpage > 4) {
1262 qemu_log_mask(LOG_GUEST_ERROR, "cpage out of range (%u)\n", cpage);
1263 qemu_sglist_destroy(&p->sgl);
1264 return -1;
1265 }
1266
1267 page = ehci_get_buf_addr(p->queue->ehci, p->qtd.bufptr_hi[cpage],
1268 p->qtd.bufptr[cpage], QTD_BUFPTR_MASK);
1269 page += offset;
1270 plen = bytes;
1271 if (plen > 4096 - offset) {
1272 plen = 4096 - offset;
1273 offset = 0;
1274 cpage++;
1275 }
1276
1277 qemu_sglist_add(&p->sgl, page, plen);
1278 bytes -= plen;
1279 }
1280 return 0;
1281 }
1282
1283 static void ehci_finish_transfer(EHCIQueue *q, int len)
1284 {
1285 uint32_t cpage, offset;
1286
1287 if (len > 0) {
1288 /* update cpage & offset */
1289 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1290 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1291
1292 offset += len;
1293 cpage += offset >> QTD_BUFPTR_SH;
1294 offset &= ~QTD_BUFPTR_MASK;
1295
1296 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1297 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1298 q->qh.bufptr[0] |= offset;
1299 }
1300 }
1301
1302 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1303 {
1304 EHCIPacket *p;
1305 EHCIState *s = port->opaque;
1306 uint32_t portsc = s->portsc[port->index];
1307
1308 if (portsc & PORTSC_POWNER) {
1309 USBPort *companion = s->companion_ports[port->index];
1310 companion->ops->complete(companion, packet);
1311 return;
1312 }
1313
1314 p = container_of(packet, EHCIPacket, packet);
1315 assert(p->async == EHCI_ASYNC_INFLIGHT);
1316
1317 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1318 trace_usb_ehci_packet_action(p->queue, p, "remove");
1319 ehci_free_packet(p);
1320 return;
1321 }
1322
1323 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1324 p->async = EHCI_ASYNC_FINISHED;
1325
1326 if (!p->queue->async) {
1327 s->periodic_sched_active = PERIODIC_ACTIVE;
1328 }
1329 qemu_bh_schedule(s->async_bh);
1330 }
1331
1332 static void ehci_execute_complete(EHCIQueue *q)
1333 {
1334 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1335 uint32_t tbytes;
1336
1337 assert(p != NULL);
1338 assert(p->qtdaddr == q->qtdaddr);
1339 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1340 p->async == EHCI_ASYNC_FINISHED);
1341
1342 trace_usb_ehci_execute_complete(q->qhaddr, q->qh.next, q->qtdaddr,
1343 p->packet.status, p->packet.actual_length);
1344
1345 switch (p->packet.status) {
1346 case USB_RET_SUCCESS:
1347 break;
1348 case USB_RET_IOERROR:
1349 case USB_RET_NODEV:
1350 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1351 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1352 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1353 break;
1354 case USB_RET_STALL:
1355 q->qh.token |= QTD_TOKEN_HALT;
1356 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1357 break;
1358 case USB_RET_NAK:
1359 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1360 return; /* We're not done yet with this transaction */
1361 case USB_RET_BABBLE:
1362 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1363 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1364 break;
1365 default:
1366 /* should not be triggerable */
1367 qemu_log_mask(LOG_GUEST_ERROR, "USB invalid response %d\n",
1368 p->packet.status);
1369 g_assert_not_reached();
1370 }
1371
1372 /* TODO check 4.12 for splits */
1373 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1374 if (tbytes && p->pid == USB_TOKEN_IN) {
1375 tbytes -= p->packet.actual_length;
1376 if (tbytes) {
1377 /* 4.15.1.2 must raise int on a short input packet */
1378 ehci_raise_irq(q->ehci, USBSTS_INT);
1379 if (q->async) {
1380 q->ehci->int_req_by_async = true;
1381 }
1382 }
1383 } else {
1384 tbytes = 0;
1385 }
1386 trace_usb_ehci_qh_tbytes(tbytes);
1387 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1388
1389 ehci_finish_transfer(q, p->packet.actual_length);
1390 usb_packet_unmap(&p->packet, &p->sgl);
1391 qemu_sglist_destroy(&p->sgl);
1392 p->async = EHCI_ASYNC_NONE;
1393
1394 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1395 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1396
1397 if (q->qh.token & QTD_TOKEN_IOC) {
1398 ehci_raise_irq(q->ehci, USBSTS_INT);
1399 if (q->async) {
1400 q->ehci->int_req_by_async = true;
1401 }
1402 }
1403 }
1404
1405 /* 4.10.3 returns "again" */
1406 static int ehci_execute(EHCIPacket *p, const char *action)
1407 {
1408 USBEndpoint *ep;
1409 int endp;
1410 bool spd;
1411
1412 assert(p->async == EHCI_ASYNC_NONE ||
1413 p->async == EHCI_ASYNC_INITIALIZED);
1414
1415 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1416 qemu_log_mask(LOG_GUEST_ERROR, "Attempting to execute inactive qtd\n");
1417 return -1;
1418 }
1419
1420 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1421 ehci_trace_guest_bug(p->queue->ehci,
1422 "guest requested more bytes than allowed");
1423 return -1;
1424 }
1425
1426 if (!ehci_verify_pid(p->queue, &p->qtd)) {
1427 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */
1428 }
1429 p->pid = ehci_get_pid(&p->qtd);
1430 p->queue->last_pid = p->pid;
1431 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1432 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1433
1434 if (p->async == EHCI_ASYNC_NONE) {
1435 if (ehci_init_transfer(p) != 0) {
1436 return -1;
1437 }
1438
1439 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1440 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
1441 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1442 if (usb_packet_map(&p->packet, &p->sgl)) {
1443 qemu_sglist_destroy(&p->sgl);
1444 return -1;
1445 }
1446 p->async = EHCI_ASYNC_INITIALIZED;
1447 }
1448
1449 trace_usb_ehci_packet_action(p->queue, p, action);
1450 usb_handle_packet(p->queue->dev, &p->packet);
1451 trace_usb_ehci_packet_submit(p->queue->qhaddr, p->qtd.next, p->qtdaddr,
1452 p->pid, p->packet.iov.size, endp,
1453 p->packet.status, p->packet.actual_length);
1454
1455 if (p->packet.actual_length > BUFF_SIZE) {
1456 qemu_log_mask(LOG_GUEST_ERROR,
1457 "ret from usb_handle_packet > BUFF_SIZE\n");
1458 return -1;
1459 }
1460
1461 return 1;
1462 }
1463
1464 /* 4.7.2 */
1465 static int ehci_process_itd(EHCIState *ehci,
1466 EHCIitd *itd,
1467 uint64_t addr)
1468 {
1469 USBDevice *dev;
1470 USBEndpoint *ep;
1471 uint32_t i, len, pid, dir, devaddr, endp;
1472 uint32_t pg, off, max, mult;
1473 uint64_t ptr1, ptr2;
1474
1475 ehci->periodic_sched_active = PERIODIC_ACTIVE;
1476
1477 dir = (itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1478 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1479 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1480 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1481 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1482
1483 for (i = 0; i < 8; i++) {
1484 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1485 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1486 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1487 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1488
1489 if (len > max * mult) {
1490 len = max * mult;
1491 }
1492 if (len > BUFF_SIZE || pg > 6) {
1493 return -1;
1494 }
1495
1496 ptr1 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg],
1497 itd->bufptr[pg], ITD_BUFPTR_MASK);
1498 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
1499 if (off + len > 4096) {
1500 /* transfer crosses page border */
1501 if (pg == 6) {
1502 qemu_sglist_destroy(&ehci->isgl);
1503 return -1; /* avoid page pg + 1 */
1504 }
1505 ptr2 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg + 1],
1506 itd->bufptr[pg + 1],
1507 ITD_BUFPTR_MASK);
1508 uint32_t len2 = off + len - 4096;
1509 uint32_t len1 = len - len2;
1510 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1511 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1512 } else {
1513 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1514 }
1515
1516 dev = ehci_find_device(ehci, devaddr);
1517 if (dev == NULL) {
1518 ehci_trace_guest_bug(ehci, "no device found");
1519 ehci->ipacket.status = USB_RET_NODEV;
1520 ehci->ipacket.actual_length = 0;
1521 } else {
1522 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1523 ep = usb_ep_get(dev, pid, endp);
1524 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1525 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
1526 (itd->transact[i] & ITD_XACT_IOC) != 0);
1527 if (usb_packet_map(&ehci->ipacket, &ehci->isgl)) {
1528 qemu_sglist_destroy(&ehci->isgl);
1529 return -1;
1530 }
1531 usb_handle_packet(dev, &ehci->ipacket);
1532 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1533 } else {
1534 trace_usb_ehci_log("ISOCH: "
1535 "attempt to address non-iso endpoint");
1536 ehci->ipacket.status = USB_RET_NAK;
1537 ehci->ipacket.actual_length = 0;
1538 }
1539 }
1540 qemu_sglist_destroy(&ehci->isgl);
1541
1542 switch (ehci->ipacket.status) {
1543 case USB_RET_SUCCESS:
1544 break;
1545 default:
1546 qemu_log_mask(LOG_GUEST_ERROR,
1547 "Unexpected iso usb result: %d\n",
1548 ehci->ipacket.status);
1549 /* Fall through */
1550 case USB_RET_IOERROR:
1551 case USB_RET_NODEV:
1552 /* 3.3.2: XACTERR is only allowed on IN transactions */
1553 if (dir) {
1554 itd->transact[i] |= ITD_XACT_XACTERR;
1555 ehci_raise_irq(ehci, USBSTS_ERRINT);
1556 }
1557 break;
1558 case USB_RET_BABBLE:
1559 itd->transact[i] |= ITD_XACT_BABBLE;
1560 ehci_raise_irq(ehci, USBSTS_ERRINT);
1561 break;
1562 case USB_RET_NAK:
1563 /* no data for us, so do a zero-length transfer */
1564 ehci->ipacket.actual_length = 0;
1565 break;
1566 }
1567 if (!dir) {
1568 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1569 ITD_XACT_LENGTH); /* OUT */
1570 } else {
1571 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1572 ITD_XACT_LENGTH); /* IN */
1573 }
1574 if (itd->transact[i] & ITD_XACT_IOC) {
1575 ehci_raise_irq(ehci, USBSTS_INT);
1576 }
1577 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1578 }
1579 }
1580 return 0;
1581 }
1582
1583
1584 /*
1585 * This state is the entry point for asynchronous schedule
1586 * processing. Entry here constitutes a EHCI start event state (4.8.5)
1587 */
1588 static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1589 {
1590 EHCIqh qh;
1591 int i = 0;
1592 int again = 0;
1593 uint64_t entry = 0;
1594
1595 entry = ehci_get_desc_addr(ehci, ehci->asynclistaddr);
1596
1597 /* set reclamation flag at start event (4.8.6) */
1598 if (async) {
1599 ehci_set_usbsts(ehci, USBSTS_REC);
1600 }
1601
1602 ehci_queues_rip_unused(ehci, async);
1603
1604 /* Find the head of the list (4.9.1.1) */
1605 memset(&qh, 0, sizeof(qh));
1606 for (i = 0; i < MAX_QH; i++) {
1607 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1608 ehci_qh_dwords(ehci)) < 0) {
1609 return 0;
1610 }
1611 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1612
1613 if (qh.epchar & QH_EPCHAR_H) {
1614 if (async) {
1615 entry |= (NLPTR_TYPE_QH << 1);
1616 }
1617
1618 ehci_set_fetch_addr(ehci, async, entry);
1619 ehci_set_state(ehci, async, EST_FETCHENTRY);
1620 again = 1;
1621 goto out;
1622 }
1623
1624 entry = ehci_get_desc_addr(ehci, qh.next);
1625 if (entry == ehci_get_desc_addr(ehci, ehci->asynclistaddr)) {
1626 break;
1627 }
1628 }
1629
1630 /* no head found for list. */
1631
1632 ehci_set_state(ehci, async, EST_ACTIVE);
1633
1634 out:
1635 return again;
1636 }
1637
1638
1639 /*
1640 * This state is the entry point for periodic schedule processing as
1641 * well as being a continuation state for async processing.
1642 */
1643 static int ehci_state_fetchentry(EHCIState *ehci, int async)
1644 {
1645 int again = 0;
1646 uint64_t entry = ehci_get_fetch_addr(ehci, async);
1647
1648 if (NLPTR_TBIT(entry)) {
1649 ehci_set_state(ehci, async, EST_ACTIVE);
1650 goto out;
1651 }
1652
1653 /* section 4.8, only QH in async schedule */
1654 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1655 qemu_log_mask(LOG_GUEST_ERROR,
1656 "non queue head request in async schedule\n");
1657 return -1;
1658 }
1659
1660 switch (NLPTR_TYPE_GET(entry)) {
1661 case NLPTR_TYPE_QH:
1662 ehci_set_state(ehci, async, EST_FETCHQH);
1663 again = 1;
1664 break;
1665
1666 case NLPTR_TYPE_ITD:
1667 ehci_set_state(ehci, async, EST_FETCHITD);
1668 again = 1;
1669 break;
1670
1671 case NLPTR_TYPE_STITD:
1672 ehci_set_state(ehci, async, EST_FETCHSITD);
1673 again = 1;
1674 break;
1675
1676 default:
1677 /* TODO: handle FSTN type */
1678 qemu_log_mask(LOG_GUEST_ERROR,
1679 "FETCHENTRY: entry at %" PRIx64 " is of type %" PRIu64
1680 " which is not supported yet\n",
1681 entry, NLPTR_TYPE_GET(entry));
1682 return -1;
1683 }
1684
1685 out:
1686 return again;
1687 }
1688
1689 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1690 {
1691 uint64_t entry;
1692 EHCIQueue *q;
1693 EHCIqh qh;
1694
1695 entry = ehci_get_fetch_addr(ehci, async);
1696 q = ehci_find_queue_by_qh(ehci, entry, async);
1697 if (q == NULL) {
1698 q = ehci_alloc_queue(ehci, entry, async);
1699 }
1700
1701 q->seen++;
1702 if (q->seen > 1) {
1703 /* we are going in circles -- stop processing */
1704 ehci_set_state(ehci, async, EST_ACTIVE);
1705 q = NULL;
1706 goto out;
1707 }
1708
1709 memset(&qh, 0, sizeof(qh));
1710 if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1711 (uint32_t *) &qh, ehci_qh_dwords(ehci)) < 0) {
1712 q = NULL;
1713 goto out;
1714 }
1715 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1716
1717 /*
1718 * The overlay area of the qh should never be changed by the guest,
1719 * except when idle, in which case the reset is a nop.
1720 */
1721 if (!ehci_verify_qh(q, &qh)) {
1722 if (ehci_reset_queue(q) > 0) {
1723 ehci_trace_guest_bug(ehci, "guest updated active QH");
1724 }
1725 }
1726 q->qh = qh;
1727
1728 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1729 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1730 q->transact_ctr = 4;
1731 }
1732
1733 if (q->dev == NULL) {
1734 q->dev = ehci_find_device(q->ehci,
1735 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR));
1736 }
1737
1738 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1739
1740 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1741 if (ehci->usbsts & USBSTS_REC) {
1742 ehci_clear_usbsts(ehci, USBSTS_REC);
1743 } else {
1744 trace_usb_ehci_fetchqh_reclaim_done(q->qhaddr);
1745 ehci_set_state(ehci, async, EST_ACTIVE);
1746 q = NULL;
1747 goto out;
1748 }
1749 }
1750
1751 if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
1752 if (q->qhaddr != ehci_get_desc_addr(ehci, q->qh.next)) {
1753 trace_usb_ehci_fetchqh_dbg(q->qhaddr,
1754 q->qh.epchar & QH_EPCHAR_H,
1755 q->qh.token & QTD_TOKEN_HALT,
1756 q->qh.token & QTD_TOKEN_ACTIVE,
1757 q->qh.next);
1758 }
1759 }
1760
1761 if (q->qh.token & QTD_TOKEN_HALT) {
1762 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1763
1764 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1765 (NLPTR_TBIT(q->qh.current_qtd) == 0) &&
1766 (q->qh.current_qtd != 0)) {
1767 q->qtdaddr = ehci_get_desc_addr(ehci, q->qh.current_qtd);
1768 ehci_set_state(ehci, async, EST_FETCHQTD);
1769
1770 } else {
1771 /* EHCI spec version 1.0 Section 4.10.2 */
1772 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1773 }
1774
1775 out:
1776 return q;
1777 }
1778
1779 static int ehci_state_fetchitd(EHCIState *ehci, int async)
1780 {
1781 uint64_t entry;
1782 EHCIitd itd;
1783
1784 assert(!async);
1785 entry = ehci_get_fetch_addr(ehci, async);
1786
1787 memset(&itd, 0, sizeof(itd));
1788 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1789 ehci_itd_dwords(ehci)) < 0) {
1790 return -1;
1791 }
1792 ehci_trace_itd(ehci, entry, &itd);
1793
1794 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1795 return -1;
1796 }
1797
1798 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1799 ehci_itd_dwords(ehci));
1800 ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, itd.next));
1801 ehci_set_state(ehci, async, EST_FETCHENTRY);
1802
1803 return 1;
1804 }
1805
1806 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1807 {
1808 uint64_t entry;
1809 EHCIsitd sitd;
1810
1811 assert(!async);
1812 entry = ehci_get_fetch_addr(ehci, async);
1813
1814 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1815 sizeof(EHCIsitd) >> 2) < 0) {
1816 return 0;
1817 }
1818 ehci_trace_sitd(ehci, entry, &sitd);
1819
1820 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1821 /* siTD is not active, nothing to do */;
1822 } else {
1823 /* TODO: split transfers are not implemented */
1824 warn_report("Skipping active siTD");
1825 }
1826
1827 ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, sitd.next));
1828 ehci_set_state(ehci, async, EST_FETCHENTRY);
1829 return 1;
1830 }
1831
1832 /* Section 4.10.2 - paragraph 3 */
1833 static int ehci_state_advqueue(EHCIQueue *q)
1834 {
1835 /*
1836 * TO-DO: 4.10.2 - paragraph 2
1837 * if I-bit is set to 1 and QH is not active
1838 * go to horizontal QH
1839 */
1840
1841 /*
1842 * want data and alt-next qTD is valid
1843 */
1844 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1845 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1846 q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.altnext_qtd);
1847 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1848
1849 /*
1850 * next qTD is valid
1851 */
1852 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1853 q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.next_qtd);
1854 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1855
1856 /*
1857 * no valid qTD, try next QH
1858 */
1859 } else {
1860 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1861 }
1862
1863 return 1;
1864 }
1865
1866 /* Section 4.10.2 - paragraph 4 */
1867 static int ehci_state_fetchqtd(EHCIQueue *q)
1868 {
1869 EHCIqtd qtd;
1870 EHCIPacket *p;
1871 int again = 1;
1872 uint64_t addr;
1873
1874 addr = NLPTR_GET(q->qtdaddr);
1875 if (get_dwords(q->ehci, addr + 8, &qtd.token, 1) < 0) {
1876 return 0;
1877 }
1878 barrier();
1879 memset(qtd.bufptr_hi, 0, sizeof(qtd.bufptr_hi));
1880 if (get_dwords(q->ehci, addr + 0, &qtd.next, 1) < 0 ||
1881 get_dwords(q->ehci, addr + 4, &qtd.altnext, 1) < 0 ||
1882 get_dwords(q->ehci, addr + 12, qtd.bufptr,
1883 ARRAY_SIZE(qtd.bufptr)) < 0 ||
1884 (q->ehci->caps_64bit_addr &&
1885 get_dwords(q->ehci, addr + offsetof(EHCIqtd, bufptr_hi),
1886 qtd.bufptr_hi, ARRAY_SIZE(qtd.bufptr_hi)) < 0)) {
1887 return 0;
1888 }
1889 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1890
1891 p = QTAILQ_FIRST(&q->packets);
1892 if (p != NULL) {
1893 if (!ehci_verify_qtd(p, &qtd)) {
1894 ehci_cancel_queue(q);
1895 if (qtd.token & QTD_TOKEN_ACTIVE) {
1896 ehci_trace_guest_bug(q->ehci, "guest updated active qTD");
1897 }
1898 p = NULL;
1899 } else {
1900 p->qtd = qtd;
1901 ehci_qh_do_overlay(q);
1902 }
1903 }
1904
1905 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1906 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1907 } else if (p != NULL) {
1908 switch (p->async) {
1909 case EHCI_ASYNC_NONE:
1910 case EHCI_ASYNC_INITIALIZED:
1911 /* Not yet executed (MULT), or previously nacked (int) packet */
1912 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1913 break;
1914 case EHCI_ASYNC_INFLIGHT:
1915 /* Check if the guest has added new tds to the queue */
1916 again = ehci_fill_queue(QTAILQ_LAST(&q->packets));
1917 /* Unfinished async handled packet, go horizontal */
1918 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1919 break;
1920 case EHCI_ASYNC_FINISHED:
1921 /* Complete executing of the packet */
1922 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1923 break;
1924 }
1925 } else if (q->dev == NULL) {
1926 ehci_trace_guest_bug(q->ehci, "no device attached to queue");
1927 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1928 } else {
1929 p = ehci_alloc_packet(q);
1930 p->qtdaddr = q->qtdaddr;
1931 p->qtd = qtd;
1932 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1933 }
1934
1935 return again;
1936 }
1937
1938 static int ehci_state_horizqh(EHCIQueue *q)
1939 {
1940 uint64_t addr;
1941 int again = 0;
1942
1943 addr = ehci_get_desc_addr(q->ehci, q->qh.next);
1944 if (ehci_get_fetch_addr(q->ehci, q->async) != addr) {
1945 ehci_set_fetch_addr(q->ehci, q->async, addr);
1946 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1947 again = 1;
1948 } else {
1949 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1950 }
1951
1952 return again;
1953 }
1954
1955 /* Returns "again" */
1956 static int ehci_fill_queue(EHCIPacket *p)
1957 {
1958 USBEndpoint *ep = p->packet.ep;
1959 EHCIQueue *q = p->queue;
1960 EHCIqtd qtd = p->qtd;
1961 uint64_t qtdaddr;
1962
1963 for (;;) {
1964 if (NLPTR_TBIT(qtd.next) != 0) {
1965 break;
1966 }
1967 qtdaddr = ehci_get_desc_addr(q->ehci, qtd.next);
1968 /*
1969 * Detect circular td lists, Windows creates these, counting on the
1970 * active bit going low after execution to make the queue stop.
1971 */
1972 QTAILQ_FOREACH(p, &q->packets, next) {
1973 if (p->qtdaddr == qtdaddr) {
1974 goto leave;
1975 }
1976 }
1977 memset(qtd.bufptr_hi, 0, sizeof(qtd.bufptr_hi));
1978 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1979 (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci)) < 0) {
1980 return -1;
1981 }
1982 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1983 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1984 break;
1985 }
1986 if (!ehci_verify_pid(q, &qtd)) {
1987 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
1988 break;
1989 }
1990 p = ehci_alloc_packet(q);
1991 p->qtdaddr = qtdaddr;
1992 p->qtd = qtd;
1993 if (ehci_execute(p, "queue") == -1) {
1994 return -1;
1995 }
1996 assert(p->packet.status == USB_RET_ASYNC);
1997 p->async = EHCI_ASYNC_INFLIGHT;
1998 }
1999 leave:
2000 usb_device_flush_ep_queue(ep->dev, ep);
2001 return 1;
2002 }
2003
2004 static int ehci_state_execute(EHCIQueue *q)
2005 {
2006 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
2007 int again = 0;
2008
2009 assert(p != NULL);
2010 assert(p->qtdaddr == q->qtdaddr);
2011
2012 if (ehci_qh_do_overlay(q) != 0) {
2013 return -1;
2014 }
2015
2016 /*
2017 * TODO verify enough time remains in the uframe as in 4.4.1.1
2018 * TODO write back ptr to async list when done or out of time
2019 */
2020
2021 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
2022 if (!q->async && q->transact_ctr == 0) {
2023 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2024 again = 1;
2025 goto out;
2026 }
2027
2028 if (q->async) {
2029 ehci_set_usbsts(q->ehci, USBSTS_REC);
2030 }
2031
2032 again = ehci_execute(p, "process");
2033 if (again == -1) {
2034 goto out;
2035 }
2036 if (p->packet.status == USB_RET_ASYNC) {
2037 ehci_flush_qh(q);
2038 trace_usb_ehci_packet_action(p->queue, p, "async");
2039 p->async = EHCI_ASYNC_INFLIGHT;
2040 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2041 if (q->async) {
2042 again = ehci_fill_queue(p);
2043 } else {
2044 again = 1;
2045 }
2046 goto out;
2047 }
2048
2049 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
2050 again = 1;
2051
2052 out:
2053 return again;
2054 }
2055
2056 static int ehci_state_executing(EHCIQueue *q)
2057 {
2058 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
2059
2060 assert(p != NULL);
2061 assert(p->qtdaddr == q->qtdaddr);
2062
2063 ehci_execute_complete(q);
2064
2065 /* 4.10.3 */
2066 if (!q->async && q->transact_ctr > 0) {
2067 q->transact_ctr--;
2068 }
2069
2070 /* 4.10.5 */
2071 if (p->packet.status == USB_RET_NAK) {
2072 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2073 } else {
2074 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
2075 }
2076
2077 ehci_flush_qh(q);
2078 return 1;
2079 }
2080
2081
2082 static int ehci_state_writeback(EHCIQueue *q)
2083 {
2084 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
2085 uint32_t *qtd;
2086 uint64_t addr;
2087 int again = 0;
2088
2089 /* Write back the QTD from the QH area */
2090 assert(p != NULL);
2091 assert(p->qtdaddr == q->qtdaddr);
2092
2093 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
2094 qtd = (uint32_t *) &q->qh.next_qtd;
2095 addr = NLPTR_GET(p->qtdaddr);
2096 /* First write back the offset */
2097 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qtd + 3, 1);
2098 /* Then write back the token, clearing the 'active' bit */
2099 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 1);
2100 ehci_free_packet(p);
2101
2102 /*
2103 * EHCI specs say go horizontal here.
2104 *
2105 * We can also advance the queue here for performance reasons. We
2106 * need to take care to only take that shortcut in case we've
2107 * processed the qtd just written back without errors, i.e. halt
2108 * bit is clear.
2109 */
2110 if (q->qh.token & QTD_TOKEN_HALT) {
2111 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2112 again = 1;
2113 } else {
2114 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
2115 again = 1;
2116 }
2117 return again;
2118 }
2119
2120 /*
2121 * This is the state machine that is common to both async and periodic
2122 */
2123
2124 static void ehci_advance_state(EHCIState *ehci, int async)
2125 {
2126 EHCIQueue *q = NULL;
2127 int itd_count = 0;
2128 int again;
2129
2130 do {
2131 switch (ehci_get_state(ehci, async)) {
2132 case EST_WAITLISTHEAD:
2133 again = ehci_state_waitlisthead(ehci, async);
2134 break;
2135
2136 case EST_FETCHENTRY:
2137 again = ehci_state_fetchentry(ehci, async);
2138 break;
2139
2140 case EST_FETCHQH:
2141 q = ehci_state_fetchqh(ehci, async);
2142 if (q != NULL) {
2143 assert(q->async == async);
2144 again = 1;
2145 } else {
2146 again = 0;
2147 }
2148 break;
2149
2150 case EST_FETCHITD:
2151 again = ehci_state_fetchitd(ehci, async);
2152 itd_count++;
2153 break;
2154
2155 case EST_FETCHSITD:
2156 again = ehci_state_fetchsitd(ehci, async);
2157 itd_count++;
2158 break;
2159
2160 case EST_ADVANCEQUEUE:
2161 assert(q != NULL);
2162 again = ehci_state_advqueue(q);
2163 break;
2164
2165 case EST_FETCHQTD:
2166 assert(q != NULL);
2167 again = ehci_state_fetchqtd(q);
2168 break;
2169
2170 case EST_HORIZONTALQH:
2171 assert(q != NULL);
2172 again = ehci_state_horizqh(q);
2173 break;
2174
2175 case EST_EXECUTE:
2176 assert(q != NULL);
2177 again = ehci_state_execute(q);
2178 if (async) {
2179 ehci->async_stepdown = 0;
2180 }
2181 break;
2182
2183 case EST_EXECUTING:
2184 assert(q != NULL);
2185 if (async) {
2186 ehci->async_stepdown = 0;
2187 }
2188 again = ehci_state_executing(q);
2189 break;
2190
2191 case EST_WRITEBACK:
2192 assert(q != NULL);
2193 again = ehci_state_writeback(q);
2194 if (!async) {
2195 ehci->periodic_sched_active = PERIODIC_ACTIVE;
2196 }
2197 break;
2198
2199 default:
2200 g_assert_not_reached();
2201 }
2202
2203 if (again < 0 || itd_count > 16) {
2204 /* TODO: notify guest (raise HSE irq?) */
2205 qemu_log_mask(LOG_GUEST_ERROR,
2206 "processing error - resetting ehci HC\n");
2207 ehci_reset(ehci);
2208 again = 0;
2209 }
2210 } while (again);
2211 }
2212
2213 static void ehci_advance_async_state(EHCIState *ehci)
2214 {
2215 const int async = 1;
2216
2217 switch (ehci_get_state(ehci, async)) {
2218 case EST_INACTIVE:
2219 if (!ehci_async_enabled(ehci)) {
2220 break;
2221 }
2222 ehci_set_state(ehci, async, EST_ACTIVE);
2223 /* No break, fall through to ACTIVE */
2224
2225 case EST_ACTIVE:
2226 if (!ehci_async_enabled(ehci)) {
2227 ehci_queues_rip_all(ehci, async);
2228 ehci_set_state(ehci, async, EST_INACTIVE);
2229 break;
2230 }
2231
2232 /* make sure guest has acknowledged the doorbell interrupt */
2233 /* TO-DO: is this really needed? */
2234 if (ehci->usbsts & USBSTS_IAA) {
2235 trace_usb_ehci_log("IAA status bit still set.");
2236 break;
2237 }
2238
2239 /* check that address register has been set */
2240 if (ehci->asynclistaddr == 0) {
2241 break;
2242 }
2243
2244 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2245 ehci_advance_state(ehci, async);
2246
2247 /*
2248 * If the doorbell is set, the guest wants to make a change to the
2249 * schedule. The host controller needs to release cached data.
2250 * (section 4.8.2)
2251 */
2252 if (ehci->usbcmd & USBCMD_IAAD) {
2253 /* Remove all unseen qhs from the async qhs queue */
2254 ehci_queues_rip_unseen(ehci, async);
2255 trace_usb_ehci_doorbell_ack();
2256 ehci->usbcmd &= ~USBCMD_IAAD;
2257 ehci_raise_irq(ehci, USBSTS_IAA);
2258 }
2259 break;
2260
2261 default:
2262 /* this should only be due to a developer mistake */
2263 g_assert_not_reached();
2264 }
2265 }
2266
2267 static void ehci_advance_periodic_state(EHCIState *ehci)
2268 {
2269 uint32_t entry;
2270 uint32_t list;
2271 const int async = 0;
2272 uint64_t entry64;
2273 uint64_t list64;
2274
2275 /* 4.6 */
2276
2277 switch (ehci_get_state(ehci, async)) {
2278 case EST_INACTIVE:
2279 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2280 ehci_set_state(ehci, async, EST_ACTIVE);
2281 /* No break, fall through to ACTIVE */
2282 } else
2283 break;
2284
2285 case EST_ACTIVE:
2286 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2287 ehci_queues_rip_all(ehci, async);
2288 ehci_set_state(ehci, async, EST_INACTIVE);
2289 break;
2290 }
2291
2292 list = ehci->periodiclistbase & 0xfffff000;
2293 /* check that register has been set */
2294 if (list == 0) {
2295 break;
2296 }
2297 list |= ((ehci->frindex & 0x1ff8) >> 1);
2298 list64 = ehci_get_desc_addr(ehci, list);
2299 if (get_dwords(ehci, list64, &entry, 1) < 0) {
2300 break;
2301 }
2302 entry64 = ehci_get_desc_addr(ehci, entry);
2303 trace_usb_ehci_periodic_state_advance(ehci->frindex / 8,
2304 list64, entry64);
2305 ehci_set_fetch_addr(ehci, async, entry64);
2306 ehci_set_state(ehci, async, EST_FETCHENTRY);
2307 ehci_advance_state(ehci, async);
2308 ehci_queues_rip_unused(ehci, async);
2309 break;
2310
2311 default:
2312 /* this should only be due to a developer mistake */
2313 g_assert_not_reached();
2314 }
2315 }
2316
2317 static void ehci_update_frindex(EHCIState *ehci, int uframes)
2318 {
2319 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) {
2320 return;
2321 }
2322
2323 /* Generate FLR interrupt if frame index rolls over 0x2000 */
2324 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) {
2325 ehci_raise_irq(ehci, USBSTS_FLR);
2326 }
2327
2328 /*
2329 * How many times will frindex roll over 0x4000 with this frame count?
2330 * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
2331 */
2332 int rollovers = (ehci->frindex + uframes) / 0x4000;
2333 if (rollovers > 0) {
2334 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) {
2335 ehci->usbsts_frindex -= 0x4000 * rollovers;
2336 } else {
2337 ehci->usbsts_frindex = 0;
2338 }
2339 }
2340
2341 ehci->frindex = (ehci->frindex + uframes) % 0x4000;
2342 }
2343
2344 static void ehci_work_bh(void *opaque)
2345 {
2346 EHCIState *ehci = opaque;
2347 int need_timer = 0;
2348 int64_t expire_time, t_now;
2349 uint64_t ns_elapsed;
2350 uint64_t uframes, skipped_uframes;
2351 int i;
2352
2353 if (ehci->working) {
2354 return;
2355 }
2356 ehci->working = true;
2357
2358 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2359 ns_elapsed = t_now - ehci->last_run_ns;
2360 uframes = ns_elapsed / UFRAME_TIMER_NS;
2361
2362 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2363 need_timer++;
2364
2365 if (uframes > (ehci->maxframes * 8)) {
2366 skipped_uframes = uframes - (ehci->maxframes * 8);
2367 ehci_update_frindex(ehci, skipped_uframes);
2368 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
2369 uframes -= skipped_uframes;
2370 trace_usb_ehci_skipped_uframes(skipped_uframes);
2371 }
2372
2373 for (i = 0; i < uframes; i++) {
2374 /*
2375 * If we're running behind schedule, we should not catch up
2376 * too fast, as that will make some guests unhappy:
2377 * 1) We must process a minimum of MIN_UFR_PER_TICK frames,
2378 * otherwise we will never catch up
2379 * 2) Process frames until the guest has requested an irq (IOC)
2380 */
2381 if (i >= MIN_UFR_PER_TICK) {
2382 ehci_commit_irq(ehci);
2383 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2384 break;
2385 }
2386 }
2387 if (ehci->periodic_sched_active) {
2388 ehci->periodic_sched_active--;
2389 }
2390 ehci_update_frindex(ehci, 1);
2391 if ((ehci->frindex & 7) == 0) {
2392 ehci_advance_periodic_state(ehci);
2393 }
2394 ehci->last_run_ns += UFRAME_TIMER_NS;
2395 }
2396 } else {
2397 ehci->periodic_sched_active = 0;
2398 ehci_update_frindex(ehci, uframes);
2399 ehci->last_run_ns += UFRAME_TIMER_NS * uframes;
2400 }
2401
2402 if (ehci->periodic_sched_active) {
2403 ehci->async_stepdown = 0;
2404 } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2405 ehci->async_stepdown++;
2406 }
2407
2408 /*
2409 * Async is not inside loop since it executes everything it can once
2410 * called
2411 */
2412 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2413 need_timer++;
2414 ehci_advance_async_state(ehci);
2415 }
2416
2417 ehci_commit_irq(ehci);
2418 if (ehci->usbsts_pending) {
2419 need_timer++;
2420 ehci->async_stepdown = 0;
2421 }
2422
2423 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2424 need_timer++;
2425 }
2426
2427 if (need_timer) {
2428 /*
2429 * If we've raised int, we speed up the timer, so that we quickly
2430 * notice any new packets queued up in response
2431 */
2432 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2433 expire_time = t_now +
2434 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
2435 ehci->int_req_by_async = false;
2436 } else {
2437 expire_time = t_now
2438 + (NANOSECONDS_PER_SECOND * (ehci->async_stepdown + 1) /
2439 FRAME_TIMER_FREQ);
2440 }
2441 timer_mod(ehci->frame_timer, expire_time);
2442 }
2443
2444 ehci->working = false;
2445 }
2446
2447 static void ehci_work_timer(void *opaque)
2448 {
2449 EHCIState *ehci = opaque;
2450
2451 qemu_bh_schedule(ehci->async_bh);
2452 }
2453
2454 static const MemoryRegionOps ehci_mmio_caps_ops = {
2455 .read = ehci_caps_read,
2456 .write = ehci_caps_write,
2457 .valid.min_access_size = 1,
2458 .valid.max_access_size = 4,
2459 .impl.min_access_size = 1,
2460 .impl.max_access_size = 1,
2461 .endianness = DEVICE_LITTLE_ENDIAN,
2462 };
2463
2464 static const MemoryRegionOps ehci_mmio_opreg_ops = {
2465 .read = ehci_opreg_read,
2466 .write = ehci_opreg_write,
2467 .valid.min_access_size = 4,
2468 .valid.max_access_size = 4,
2469 .endianness = DEVICE_LITTLE_ENDIAN,
2470 };
2471
2472 static const MemoryRegionOps ehci_mmio_port_ops = {
2473 .read = ehci_port_read,
2474 .write = ehci_port_write,
2475 .valid.min_access_size = 4,
2476 .valid.max_access_size = 4,
2477 .endianness = DEVICE_LITTLE_ENDIAN,
2478 };
2479
2480 static USBPortOps ehci_port_ops = {
2481 .attach = ehci_attach,
2482 .detach = ehci_detach,
2483 .child_detach = ehci_child_detach,
2484 .wakeup = ehci_wakeup,
2485 .complete = ehci_async_complete_packet,
2486 };
2487
2488 static USBBusOps ehci_bus_ops_companion = {
2489 .register_companion = ehci_register_companion,
2490 .wakeup_endpoint = ehci_wakeup_endpoint,
2491 };
2492 static USBBusOps ehci_bus_ops_standalone = {
2493 .wakeup_endpoint = ehci_wakeup_endpoint,
2494 };
2495
2496 static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
2497 {
2498 EHCIState *s = opaque;
2499
2500 return s->migrate_fetch_addr_64bit;
2501 }
2502
2503 static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
2504 {
2505 return !ehci_fetch_addr_64_needed(opaque, version_id);
2506 }
2507
2508 static int usb_ehci_pre_save(void *opaque)
2509 {
2510 EHCIState *ehci = opaque;
2511 uint32_t new_frindex;
2512
2513 /* Round down frindex to a multiple of 8 for migration compatibility */
2514 new_frindex = ehci->frindex & ~7;
2515 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
2516 ehci->frindex = new_frindex;
2517
2518 if (!ehci->migrate_fetch_addr_64bit) {
2519 ehci->migrate_a_fetch_addr = ehci->a_fetch_addr;
2520 ehci->migrate_p_fetch_addr = ehci->p_fetch_addr;
2521 }
2522
2523 return 0;
2524 }
2525
2526 static int usb_ehci_post_load(void *opaque, int version_id)
2527 {
2528 EHCIState *s = opaque;
2529 int i;
2530
2531 for (i = 0; i < EHCI_PORTS; i++) {
2532 USBPort *companion = s->companion_ports[i];
2533 if (companion == NULL) {
2534 continue;
2535 }
2536 if (s->portsc[i] & PORTSC_POWNER) {
2537 companion->dev = s->ports[i].dev;
2538 } else {
2539 companion->dev = NULL;
2540 }
2541 }
2542
2543 if (!s->migrate_fetch_addr_64bit) {
2544 s->a_fetch_addr = s->migrate_a_fetch_addr;
2545 s->p_fetch_addr = s->migrate_p_fetch_addr;
2546 }
2547
2548 return 0;
2549 }
2550
2551 static void usb_ehci_vm_state_change(void *opaque, bool running, RunState state)
2552 {
2553 EHCIState *ehci = opaque;
2554
2555 /*
2556 * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2557 * schedule in guest memory. We must do the rebuilt ASAP, so that
2558 * USB-devices which have async handled packages have a packet in the
2559 * ep queue to match the completion with.
2560 */
2561 if (running) {
2562 ehci_advance_async_state(ehci);
2563 }
2564
2565 /*
2566 * The schedule rebuilt from guest memory could cause the migration dest
2567 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2568 * will never have existed on the destination. Therefore we must flush the
2569 * async schedule on savevm to catch any not yet noticed unlinks.
2570 */
2571 if (state == RUN_STATE_SAVE_VM) {
2572 ehci_advance_async_state(ehci);
2573 ehci_queues_rip_unseen(ehci, 1);
2574 }
2575 }
2576
2577 const VMStateDescription vmstate_ehci = {
2578 .name = "ehci-core",
2579 .version_id = 2,
2580 .minimum_version_id = 1,
2581 .pre_save = usb_ehci_pre_save,
2582 .post_load = usb_ehci_post_load,
2583 .fields = (const VMStateField[]) {
2584 /* mmio registers */
2585 VMSTATE_UINT32(usbcmd, EHCIState),
2586 VMSTATE_UINT32(usbsts, EHCIState),
2587 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2588 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2589 VMSTATE_UINT32(usbintr, EHCIState),
2590 VMSTATE_UINT32(frindex, EHCIState),
2591 VMSTATE_UINT32(ctrldssegment, EHCIState),
2592 VMSTATE_UINT32(periodiclistbase, EHCIState),
2593 VMSTATE_UINT32(asynclistaddr, EHCIState),
2594 VMSTATE_UINT32(configflag, EHCIState),
2595 VMSTATE_UINT32(portsc[0], EHCIState),
2596 VMSTATE_UINT32(portsc[1], EHCIState),
2597 VMSTATE_UINT32(portsc[2], EHCIState),
2598 VMSTATE_UINT32(portsc[3], EHCIState),
2599 VMSTATE_UINT32(portsc[4], EHCIState),
2600 VMSTATE_UINT32(portsc[5], EHCIState),
2601 /* frame timer */
2602 VMSTATE_TIMER_PTR(frame_timer, EHCIState),
2603 VMSTATE_UINT64(last_run_ns, EHCIState),
2604 VMSTATE_UINT32(async_stepdown, EHCIState),
2605 /* schedule state */
2606 VMSTATE_UINT32(astate, EHCIState),
2607 VMSTATE_UINT32(pstate, EHCIState),
2608 VMSTATE_UINT32_TEST(migrate_a_fetch_addr, EHCIState,
2609 ehci_fetch_addr_32_needed),
2610 VMSTATE_UINT32_TEST(migrate_p_fetch_addr, EHCIState,
2611 ehci_fetch_addr_32_needed),
2612 VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
2613 ehci_fetch_addr_64_needed),
2614 VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
2615 ehci_fetch_addr_64_needed),
2616 VMSTATE_END_OF_LIST()
2617 }
2618 };
2619
2620 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
2621 {
2622 int i;
2623
2624 if (s->portnr > EHCI_PORTS) {
2625 error_setg(errp, "Too many ports! Max. port number is %d.",
2626 EHCI_PORTS);
2627 return;
2628 }
2629 if (s->maxframes < 8 || s->maxframes > 512) {
2630 error_setg(errp, "maxframes %d out if range (8 .. 512)",
2631 s->maxframes);
2632 return;
2633 }
2634 if (s->caps_64bit_addr) {
2635 s->caps[0x08] |= BIT(0);
2636 }
2637
2638 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2639 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2640 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
2641 &s->mem_ports);
2642
2643 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
2644 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);
2645 for (i = 0; i < s->portnr; i++) {
2646 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2647 USB_SPEED_MASK_HIGH);
2648 s->ports[i].dev = 0;
2649 }
2650
2651 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s);
2652 s->async_bh = qemu_bh_new_guarded(ehci_work_bh, s,
2653 &dev->mem_reentrancy_guard);
2654 s->device = dev;
2655
2656 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2657 }
2658
2659 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev)
2660 {
2661 trace_usb_ehci_unrealize();
2662
2663 if (s->frame_timer) {
2664 timer_free(s->frame_timer);
2665 s->frame_timer = NULL;
2666 }
2667 if (s->async_bh) {
2668 qemu_bh_delete(s->async_bh);
2669 }
2670
2671 ehci_queues_rip_all(s, 0);
2672 ehci_queues_rip_all(s, 1);
2673
2674 memory_region_del_subregion(&s->mem, &s->mem_caps);
2675 memory_region_del_subregion(&s->mem, &s->mem_opreg);
2676 memory_region_del_subregion(&s->mem, &s->mem_ports);
2677
2678 usb_bus_release(&s->bus);
2679
2680 if (s->vmstate) {
2681 qemu_del_vm_change_state_handler(s->vmstate);
2682 }
2683 }
2684
2685 void usb_ehci_init(EHCIState *s, DeviceState *dev)
2686 {
2687 /* 2.2 host controller interface version */
2688 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2689 s->caps[0x01] = 0x00;
2690 s->caps[0x02] = 0x00;
2691 s->caps[0x03] = 0x01; /* HC version */
2692 s->caps[0x04] = s->portnr; /* Number of downstream ports */
2693 s->caps[0x05] = 0x00; /* No companion ports at present */
2694 s->caps[0x06] = 0x00;
2695 s->caps[0x07] = 0x00;
2696 s->caps[0x08] = 0x80; /* We can cache whole frame */
2697 s->caps[0x0a] = 0x00;
2698 s->caps[0x0b] = 0x00;
2699
2700 QTAILQ_INIT(&s->aqueues);
2701 QTAILQ_INIT(&s->pqueues);
2702 usb_packet_init(&s->ipacket);
2703
2704 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
2705 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
2706 "capabilities", CAPA_SIZE);
2707 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
2708 "operational", s->portscbase);
2709 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
2710 "ports", 4 * s->portnr);
2711 }
2712
2713 void usb_ehci_finalize(EHCIState *s)
2714 {
2715 usb_packet_cleanup(&s->ipacket);
2716 }
2717
2718 /*
2719 * vim: expandtab ts=4
2720 */