hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
EHCI supports 64-bit addressing when the 64-bit Addressing Capability bit in HCCPARAMS is set. In that mode, the CTRLDSSEGMENT register provides the upper 32 bits that are concatenated with 32-bit link pointer values to form 64-bit control data structure addresses (EHCI 1.0, section 2.3.5 and Appendix B). qTD link pointers (current_qtd/next_qtd/altnext_qtd and qTD.next) are stored as 32-bit values in the data structures and must be expanded to full 64-bit descriptor addresses when 64-bit mode is enabled. Update the qTD traversal paths to use ehci_get_desc_addr() when following link pointers. Appendix B also defines high dword fields for qTD buffer pointers. Add bufptr_hi[5] to EHCIqtd and extend qTD fetch and QH overlay handling to load and propagate the high buffer pointer fields. When 64-bit capability is disabled, descriptor and buffer addresses remain 32-bit and existing behaviour is unchanged. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20260713032704.3583103-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Jamin Lin committed
Jul 13, 2026 at 03:27 UTC
dea1ed14c931504a56cc767da26eed7fb3ac155b
2 files changed
+25
-9
hw/usb/hcd-ehci.c
+24
-9
@@ -104,6 +104,7 @@ typedef enum {
104
* must not read or write past that boundary.
105
*/
106
#define EHCI_QH_DWORDS_32 (offsetof(EHCIqh, bufptr_hi) / sizeof(uint32_t))
107
+#define EHCI_QTD_DWORDS_32 (offsetof(EHCIqtd, bufptr_hi) / sizeof(uint32_t))
108
109
static const char *ehci_state_names[] = {
110
[EST_INACTIVE] = "INACTIVE",
@@ -178,6 +179,11 @@ static uint32_t ehci_qh_dwords(const EHCIState *s)
179
return s->caps_64bit_addr ? (sizeof(EHCIqh) >> 2) : EHCI_QH_DWORDS_32;
180
}
181
182
+static uint32_t ehci_qtd_dwords(const EHCIState *s)
183
+{
184
+ return s->caps_64bit_addr ? (sizeof(EHCIqtd) >> 2) : EHCI_QTD_DWORDS_32;
185
+}
186
+
187
static void ehci_trace_usbsts(uint32_t mask, int state)
188
{
189
/* interrupts */
@@ -486,7 +492,8 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
492
(p->qtd.next != qtd->next)) ||
493
(!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
494
p->qtd.token != qtd->token ||
489
- p->qtd.bufptr[0] != qtd->bufptr[0]) {
495
+ p->qtd.bufptr[0] != qtd->bufptr[0] ||
496
+ p->qtd.bufptr_hi[0] != qtd->bufptr_hi[0]) {
497
return false;
498
} else {
499
return true;
@@ -519,10 +526,11 @@ static void ehci_writeback_async_complete_packet(EHCIPacket *p)
526
527
/* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
528
memset(&qh, 0, sizeof(qh));
529
+ memset(&qtd, 0, sizeof(qtd));
530
get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
531
(uint32_t *) &qh, ehci_qh_dwords(q->ehci));
532
get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
525
- (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
533
+ (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci));
534
if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
535
p->async = EHCI_ASYNC_INITIALIZED;
536
ehci_free_packet(p);
@@ -1215,6 +1223,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
1223
1224
for (i = 0; i < 5; i++) {
1225
q->qh.bufptr[i] = p->qtd.bufptr[i];
1226
+ q->qh.bufptr_hi[i] = p->qtd.bufptr_hi[i];
1227
}
1228
1229
if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
@@ -1248,7 +1257,8 @@ static int ehci_init_transfer(EHCIPacket *p)
1257
return -1;
1258
}
1259
1251
- page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1260
+ page = ehci_get_buf_addr(p->queue->ehci, p->qtd.bufptr_hi[cpage],
1261
+ p->qtd.bufptr[cpage], QTD_BUFPTR_MASK);
1262
page += offset;
1263
plen = bytes;
1264
if (plen > 4096 - offset) {
@@ -1744,7 +1754,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1754
} else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1755
(NLPTR_TBIT(q->qh.current_qtd) == 0) &&
1756
(q->qh.current_qtd != 0)) {
1747
- q->qtdaddr = q->qh.current_qtd;
1757
+ q->qtdaddr = ehci_get_desc_addr(ehci, q->qh.current_qtd);
1758
ehci_set_state(ehci, async, EST_FETCHQTD);
1759
1760
} else {
@@ -1822,14 +1832,14 @@ static int ehci_state_advqueue(EHCIQueue *q)
1832
*/
1833
if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1834
(NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1825
- q->qtdaddr = q->qh.altnext_qtd;
1835
+ q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.altnext_qtd);
1836
ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1837
1838
/*
1839
* next qTD is valid
1840
*/
1841
} else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1832
- q->qtdaddr = q->qh.next_qtd;
1842
+ q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.next_qtd);
1843
ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1844
1845
/*
@@ -1855,10 +1865,14 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
1865
return 0;
1866
}
1867
barrier();
1868
+ memset(qtd.bufptr_hi, 0, sizeof(qtd.bufptr_hi));
1869
if (get_dwords(q->ehci, addr + 0, &qtd.next, 1) < 0 ||
1870
get_dwords(q->ehci, addr + 4, &qtd.altnext, 1) < 0 ||
1871
get_dwords(q->ehci, addr + 12, qtd.bufptr,
1861
- ARRAY_SIZE(qtd.bufptr)) < 0) {
1872
+ ARRAY_SIZE(qtd.bufptr)) < 0 ||
1873
+ (q->ehci->caps_64bit_addr &&
1874
+ get_dwords(q->ehci, addr + offsetof(EHCIqtd, bufptr_hi),
1875
+ qtd.bufptr_hi, ARRAY_SIZE(qtd.bufptr_hi)) < 0)) {
1876
return 0;
1877
}
1878
ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
@@ -1939,7 +1953,7 @@ static int ehci_fill_queue(EHCIPacket *p)
1953
if (NLPTR_TBIT(qtd.next) != 0) {
1954
break;
1955
}
1942
- qtdaddr = qtd.next;
1956
+ qtdaddr = ehci_get_desc_addr(q->ehci, qtd.next);
1957
/*
1958
* Detect circular td lists, Windows creates these, counting on the
1959
* active bit going low after execution to make the queue stop.
@@ -1949,8 +1963,9 @@ static int ehci_fill_queue(EHCIPacket *p)
1963
goto leave;
1964
}
1965
}
1966
+ memset(qtd.bufptr_hi, 0, sizeof(qtd.bufptr_hi));
1967
if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1953
- (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1968
+ (uint32_t *) &qtd, ehci_qtd_dwords(q->ehci)) < 0) {
1969
return -1;
1970
}
1971
ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
hw/usb/hcd-ehci.h
+1
@@ -139,6 +139,7 @@ typedef struct EHCIqtd {
139
uint32_t bufptr[5]; /* Standard buffer pointer */
140
#define QTD_BUFPTR_MASK 0xfffff000
141
#define QTD_BUFPTR_SH 12
142
+ uint32_t bufptr_hi[5];
143
} EHCIqtd;
144
145
/* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */