]> git.proxmox.com Git - qemu.git/blame - hw/usb/hcd-xhci.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
uhci: Use only one queue for ctrl endpoints
[qemu.git] / hw / usb / hcd-xhci.c
CommitLineData
62c6ae04
HM		 1/*
2 * USB xHCI controller emulation
3 *
4 * Copyright (c) 2011 Securiforest
5 * Date: 2011-05-11 ; Author: Hector Martin <hector@marcansoft.com>
6 * Based on usb-ohci.c, emulates Renesas NEC USB 3.0
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 */
f1ae32a1 21#include "hw/hw.h"
62c6ae04 22#include "qemu-timer.h"
f1ae32a1
GH		 23#include "hw/usb.h"
24#include "hw/pci.h"
f1ae32a1 25#include "hw/msi.h"
4c47f800 26#include "hw/msix.h"
2d754a10 27#include "trace.h"
62c6ae04
HM		 28
29//#define DEBUG_XHCI
30//#define DEBUG_DATA
31
32#ifdef DEBUG_XHCI
33#define DPRINTF(...) fprintf(stderr, __VA_ARGS__)
34#else
35#define DPRINTF(...) do {} while (0)
36#endif
37#define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \
38 __func__, __LINE__); abort(); } while (0)
39
d95e74ea
GH		 40#define MAXPORTS_2 15
41#define MAXPORTS_3 15
62c6ae04 42
0846e635 43#define MAXPORTS (MAXPORTS_2+MAXPORTS_3)
d95e74ea
GH		 44#define MAXSLOTS 64
45#define MAXINTRS 16
62c6ae04
HM		 46
47#define TD_QUEUE 24
62c6ae04
HM		 48
49/* Very pessimistic, let's hope it's enough for all cases */
50#define EV_QUEUE (((3*TD_QUEUE)+16)*MAXSLOTS)
51/* Do not deliver ER Full events. NEC's driver does some things not bound
52 * to the specs when it gets them */
53#define ER_FULL_HACK
54
55#define LEN_CAP 0x40
62c6ae04 56#define LEN_OPER (0x400 + 0x10 * MAXPORTS)
106b214c 57#define LEN_RUNTIME ((MAXINTRS + 1) * 0x20)
62c6ae04
HM		 58#define LEN_DOORBELL ((MAXSLOTS + 1) * 0x20)
59
106b214c
GH		 60#define OFF_OPER LEN_CAP
61#define OFF_RUNTIME 0x1000
62#define OFF_DOORBELL 0x2000
4c47f800
GH		 63#define OFF_MSIX_TABLE 0x3000
64#define OFF_MSIX_PBA 0x3800
62c6ae04 65/* must be power of 2 */
106b214c 66#define LEN_REGS 0x4000
62c6ae04 67
106b214c
GH		 68#if (OFF_OPER + LEN_OPER) > OFF_RUNTIME
69#error Increase OFF_RUNTIME
70#endif
71#if (OFF_RUNTIME + LEN_RUNTIME) > OFF_DOORBELL
72#error Increase OFF_DOORBELL
73#endif
62c6ae04
HM		 74#if (OFF_DOORBELL + LEN_DOORBELL) > LEN_REGS
75# error Increase LEN_REGS
76#endif
77
62c6ae04
HM		 78/* bit definitions */
79#define USBCMD_RS (1<<0)
80#define USBCMD_HCRST (1<<1)
81#define USBCMD_INTE (1<<2)
82#define USBCMD_HSEE (1<<3)
83#define USBCMD_LHCRST (1<<7)
84#define USBCMD_CSS (1<<8)
85#define USBCMD_CRS (1<<9)
86#define USBCMD_EWE (1<<10)
87#define USBCMD_EU3S (1<<11)
88
89#define USBSTS_HCH (1<<0)
90#define USBSTS_HSE (1<<2)
91#define USBSTS_EINT (1<<3)
92#define USBSTS_PCD (1<<4)
93#define USBSTS_SSS (1<<8)
94#define USBSTS_RSS (1<<9)
95#define USBSTS_SRE (1<<10)
96#define USBSTS_CNR (1<<11)
97#define USBSTS_HCE (1<<12)
98
99
100#define PORTSC_CCS (1<<0)
101#define PORTSC_PED (1<<1)
102#define PORTSC_OCA (1<<3)
103#define PORTSC_PR (1<<4)
104#define PORTSC_PLS_SHIFT 5
105#define PORTSC_PLS_MASK 0xf
106#define PORTSC_PP (1<<9)
107#define PORTSC_SPEED_SHIFT 10
108#define PORTSC_SPEED_MASK 0xf
109#define PORTSC_SPEED_FULL (1<<10)
110#define PORTSC_SPEED_LOW (2<<10)
111#define PORTSC_SPEED_HIGH (3<<10)
112#define PORTSC_SPEED_SUPER (4<<10)
113#define PORTSC_PIC_SHIFT 14
114#define PORTSC_PIC_MASK 0x3
115#define PORTSC_LWS (1<<16)
116#define PORTSC_CSC (1<<17)
117#define PORTSC_PEC (1<<18)
118#define PORTSC_WRC (1<<19)
119#define PORTSC_OCC (1<<20)
120#define PORTSC_PRC (1<<21)
121#define PORTSC_PLC (1<<22)
122#define PORTSC_CEC (1<<23)
123#define PORTSC_CAS (1<<24)
124#define PORTSC_WCE (1<<25)
125#define PORTSC_WDE (1<<26)
126#define PORTSC_WOE (1<<27)
127#define PORTSC_DR (1<<30)
128#define PORTSC_WPR (1<<31)
129
130#define CRCR_RCS (1<<0)
131#define CRCR_CS (1<<1)
132#define CRCR_CA (1<<2)
133#define CRCR_CRR (1<<3)
134
135#define IMAN_IP (1<<0)
136#define IMAN_IE (1<<1)
137
138#define ERDP_EHB (1<<3)
139
140#define TRB_SIZE 16
141typedef struct XHCITRB {
142 uint64_t parameter;
143 uint32_t status;
144 uint32_t control;
59a70ccd 145 dma_addr_t addr;
62c6ae04
HM		 146 bool ccs;
147} XHCITRB;
148
149
150typedef enum TRBType {
151 TRB_RESERVED = 0,
152 TR_NORMAL,
153 TR_SETUP,
154 TR_DATA,
155 TR_STATUS,
156 TR_ISOCH,
157 TR_LINK,
158 TR_EVDATA,
159 TR_NOOP,
160 CR_ENABLE_SLOT,
161 CR_DISABLE_SLOT,
162 CR_ADDRESS_DEVICE,
163 CR_CONFIGURE_ENDPOINT,
164 CR_EVALUATE_CONTEXT,
165 CR_RESET_ENDPOINT,
166 CR_STOP_ENDPOINT,
167 CR_SET_TR_DEQUEUE,
168 CR_RESET_DEVICE,
169 CR_FORCE_EVENT,
170 CR_NEGOTIATE_BW,
171 CR_SET_LATENCY_TOLERANCE,
172 CR_GET_PORT_BANDWIDTH,
173 CR_FORCE_HEADER,
174 CR_NOOP,
175 ER_TRANSFER = 32,
176 ER_COMMAND_COMPLETE,
177 ER_PORT_STATUS_CHANGE,
178 ER_BANDWIDTH_REQUEST,
179 ER_DOORBELL,
180 ER_HOST_CONTROLLER,
181 ER_DEVICE_NOTIFICATION,
182 ER_MFINDEX_WRAP,
183 /* vendor specific bits */
184 CR_VENDOR_VIA_CHALLENGE_RESPONSE = 48,
185 CR_VENDOR_NEC_FIRMWARE_REVISION = 49,
186 CR_VENDOR_NEC_CHALLENGE_RESPONSE = 50,
187} TRBType;
188
189#define CR_LINK TR_LINK
190
191typedef enum TRBCCode {
192 CC_INVALID = 0,
193 CC_SUCCESS,
194 CC_DATA_BUFFER_ERROR,
195 CC_BABBLE_DETECTED,
196 CC_USB_TRANSACTION_ERROR,
197 CC_TRB_ERROR,
198 CC_STALL_ERROR,
199 CC_RESOURCE_ERROR,
200 CC_BANDWIDTH_ERROR,
201 CC_NO_SLOTS_ERROR,
202 CC_INVALID_STREAM_TYPE_ERROR,
203 CC_SLOT_NOT_ENABLED_ERROR,
204 CC_EP_NOT_ENABLED_ERROR,
205 CC_SHORT_PACKET,
206 CC_RING_UNDERRUN,
207 CC_RING_OVERRUN,
208 CC_VF_ER_FULL,
209 CC_PARAMETER_ERROR,
210 CC_BANDWIDTH_OVERRUN,
211 CC_CONTEXT_STATE_ERROR,
212 CC_NO_PING_RESPONSE_ERROR,
213 CC_EVENT_RING_FULL_ERROR,
214 CC_INCOMPATIBLE_DEVICE_ERROR,
215 CC_MISSED_SERVICE_ERROR,
216 CC_COMMAND_RING_STOPPED,
217 CC_COMMAND_ABORTED,
218 CC_STOPPED,
219 CC_STOPPED_LENGTH_INVALID,
220 CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR = 29,
221 CC_ISOCH_BUFFER_OVERRUN = 31,
222 CC_EVENT_LOST_ERROR,
223 CC_UNDEFINED_ERROR,
224 CC_INVALID_STREAM_ID_ERROR,
225 CC_SECONDARY_BANDWIDTH_ERROR,
226 CC_SPLIT_TRANSACTION_ERROR
227} TRBCCode;
228
229#define TRB_C (1<<0)
230#define TRB_TYPE_SHIFT 10
231#define TRB_TYPE_MASK 0x3f
232#define TRB_TYPE(t) (((t).control >> TRB_TYPE_SHIFT) & TRB_TYPE_MASK)
233
234#define TRB_EV_ED (1<<2)
235
236#define TRB_TR_ENT (1<<1)
237#define TRB_TR_ISP (1<<2)
238#define TRB_TR_NS (1<<3)
239#define TRB_TR_CH (1<<4)
240#define TRB_TR_IOC (1<<5)
241#define TRB_TR_IDT (1<<6)
242#define TRB_TR_TBC_SHIFT 7
243#define TRB_TR_TBC_MASK 0x3
244#define TRB_TR_BEI (1<<9)
245#define TRB_TR_TLBPC_SHIFT 16
246#define TRB_TR_TLBPC_MASK 0xf
247#define TRB_TR_FRAMEID_SHIFT 20
248#define TRB_TR_FRAMEID_MASK 0x7ff
249#define TRB_TR_SIA (1<<31)
250
251#define TRB_TR_DIR (1<<16)
252
253#define TRB_CR_SLOTID_SHIFT 24
254#define TRB_CR_SLOTID_MASK 0xff
255#define TRB_CR_EPID_SHIFT 16
256#define TRB_CR_EPID_MASK 0x1f
257
258#define TRB_CR_BSR (1<<9)
259#define TRB_CR_DC (1<<9)
260
261#define TRB_LK_TC (1<<1)
262
2d1de850
GH		 263#define TRB_INTR_SHIFT 22
264#define TRB_INTR_MASK 0x3ff
265#define TRB_INTR(t) (((t).status >> TRB_INTR_SHIFT) & TRB_INTR_MASK)
266
62c6ae04
HM		 267#define EP_TYPE_MASK 0x7
268#define EP_TYPE_SHIFT 3
269
270#define EP_STATE_MASK 0x7
271#define EP_DISABLED (0<<0)
272#define EP_RUNNING (1<<0)
273#define EP_HALTED (2<<0)
274#define EP_STOPPED (3<<0)
275#define EP_ERROR (4<<0)
276
277#define SLOT_STATE_MASK 0x1f
278#define SLOT_STATE_SHIFT 27
279#define SLOT_STATE(s) (((s)>>SLOT_STATE_SHIFT)&SLOT_STATE_MASK)
280#define SLOT_ENABLED 0
281#define SLOT_DEFAULT 1
282#define SLOT_ADDRESSED 2
283#define SLOT_CONFIGURED 3
284
285#define SLOT_CONTEXT_ENTRIES_MASK 0x1f
286#define SLOT_CONTEXT_ENTRIES_SHIFT 27
287
1d8a4e69
GH		 288typedef struct XHCIState XHCIState;
289
62c6ae04
HM		 290typedef enum EPType {
291 ET_INVALID = 0,
292 ET_ISO_OUT,
293 ET_BULK_OUT,
294 ET_INTR_OUT,
295 ET_CONTROL,
296 ET_ISO_IN,
297 ET_BULK_IN,
298 ET_INTR_IN,
299} EPType;
300
301typedef struct XHCIRing {
59a70ccd
DG		 302 dma_addr_t base;
303 dma_addr_t dequeue;
62c6ae04
HM		 304 bool ccs;
305} XHCIRing;
306
307typedef struct XHCIPort {
1d8a4e69 308 XHCIState *xhci;
62c6ae04 309 uint32_t portsc;
0846e635
GH		 310 uint32_t portnr;
311 USBPort *uport;
312 uint32_t speedmask;
1d8a4e69
GH		 313 char name[16];
314 MemoryRegion mem;
62c6ae04
HM		 315} XHCIPort;
316
62c6ae04
HM		 317typedef struct XHCITransfer {
318 XHCIState *xhci;
319 USBPacket packet;
d5a15814 320 QEMUSGList sgl;
7c605a23
GH		 321 bool running_async;
322 bool running_retry;
62c6ae04
HM		 323 bool cancelled;
324 bool complete;
a6fb2ddb 325 bool int_req;
62c6ae04
HM		 326 unsigned int iso_pkts;
327 unsigned int slotid;
328 unsigned int epid;
329 bool in_xfer;
330 bool iso_xfer;
62c6ae04
HM		 331
332 unsigned int trb_count;
333 unsigned int trb_alloced;
334 XHCITRB *trbs;
335
62c6ae04
HM		 336 TRBCCode status;
337
338 unsigned int pkts;
339 unsigned int pktsize;
340 unsigned int cur_pkt;
3d139684
GH		 341
342 uint64_t mfindex_kick;
62c6ae04
HM		 343} XHCITransfer;
344
345typedef struct XHCIEPContext {
3d139684
GH		 346 XHCIState *xhci;
347 unsigned int slotid;
348 unsigned int epid;
349
62c6ae04
HM		 350 XHCIRing ring;
351 unsigned int next_xfer;
352 unsigned int comp_xfer;
353 XHCITransfer transfers[TD_QUEUE];
7c605a23 354 XHCITransfer *retry;
62c6ae04 355 EPType type;
59a70ccd 356 dma_addr_t pctx;
62c6ae04 357 unsigned int max_psize;
62c6ae04 358 uint32_t state;
3d139684
GH		 359
360 /* iso xfer scheduling */
361 unsigned int interval;
362 int64_t mfindex_last;
363 QEMUTimer *kick_timer;
62c6ae04
HM		 364} XHCIEPContext;
365
366typedef struct XHCISlot {
367 bool enabled;
59a70ccd 368 dma_addr_t ctx;
ccaf87a0 369 USBPort *uport;
62c6ae04
HM		 370 unsigned int devaddr;
371 XHCIEPContext * eps[31];
372} XHCISlot;
373
374typedef struct XHCIEvent {
375 TRBType type;
376 TRBCCode ccode;
377 uint64_t ptr;
378 uint32_t length;
379 uint32_t flags;
380 uint8_t slotid;
381 uint8_t epid;
382} XHCIEvent;
383
962d11e1
GH		 384typedef struct XHCIInterrupter {
385 uint32_t iman;
386 uint32_t imod;
387 uint32_t erstsz;
388 uint32_t erstba_low;
389 uint32_t erstba_high;
390 uint32_t erdp_low;
391 uint32_t erdp_high;
392
393 bool msix_used, er_pcs, er_full;
394
395 dma_addr_t er_start;
396 uint32_t er_size;
397 unsigned int er_ep_idx;
398
399 XHCIEvent ev_buffer[EV_QUEUE];
400 unsigned int ev_buffer_put;
401 unsigned int ev_buffer_get;
402
403} XHCIInterrupter;
404
62c6ae04
HM		 405struct XHCIState {
406 PCIDevice pci_dev;
407 USBBus bus;
408 qemu_irq irq;
409 MemoryRegion mem;
1b067564
GH		 410 MemoryRegion mem_cap;
411 MemoryRegion mem_oper;
412 MemoryRegion mem_runtime;
413 MemoryRegion mem_doorbell;
62c6ae04 414 const char *name;
62c6ae04
HM		 415 unsigned int devaddr;
416
0846e635
GH		 417 /* properties */
418 uint32_t numports_2;
419 uint32_t numports_3;
c5e9b02d 420 uint32_t flags;
0846e635 421
62c6ae04
HM		 422 /* Operational Registers */
423 uint32_t usbcmd;
424 uint32_t usbsts;
425 uint32_t dnctrl;
426 uint32_t crcr_low;
427 uint32_t crcr_high;
428 uint32_t dcbaap_low;
429 uint32_t dcbaap_high;
430 uint32_t config;
431
0846e635 432 USBPort uports[MAX(MAXPORTS_2, MAXPORTS_3)];
62c6ae04
HM		 433 XHCIPort ports[MAXPORTS];
434 XHCISlot slots[MAXSLOTS];
0846e635 435 uint32_t numports;
62c6ae04
HM		 436
437 /* Runtime Registers */
01546fa6
GH		 438 int64_t mfindex_start;
439 QEMUTimer *mfwrap_timer;
962d11e1 440 XHCIInterrupter intr[MAXINTRS];
62c6ae04
HM		 441
442 XHCIRing cmd_ring;
443};
444
445typedef struct XHCIEvRingSeg {
446 uint32_t addr_low;
447 uint32_t addr_high;
448 uint32_t size;
449 uint32_t rsvd;
450} XHCIEvRingSeg;
451
c5e9b02d
GH		 452enum xhci_flags {
453 XHCI_FLAG_USE_MSI = 1,
4c47f800 454 XHCI_FLAG_USE_MSI_X,
c5e9b02d
GH		 455};
456
01546fa6
GH		 457static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
458 unsigned int epid);
962d11e1
GH		 459static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v);
460static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v);
01546fa6 461
f10de44e
GH		 462static const char *TRBType_names[] = {
463 [TRB_RESERVED] = "TRB_RESERVED",
464 [TR_NORMAL] = "TR_NORMAL",
465 [TR_SETUP] = "TR_SETUP",
466 [TR_DATA] = "TR_DATA",
467 [TR_STATUS] = "TR_STATUS",
468 [TR_ISOCH] = "TR_ISOCH",
469 [TR_LINK] = "TR_LINK",
470 [TR_EVDATA] = "TR_EVDATA",
471 [TR_NOOP] = "TR_NOOP",
472 [CR_ENABLE_SLOT] = "CR_ENABLE_SLOT",
473 [CR_DISABLE_SLOT] = "CR_DISABLE_SLOT",
474 [CR_ADDRESS_DEVICE] = "CR_ADDRESS_DEVICE",
475 [CR_CONFIGURE_ENDPOINT] = "CR_CONFIGURE_ENDPOINT",
476 [CR_EVALUATE_CONTEXT] = "CR_EVALUATE_CONTEXT",
477 [CR_RESET_ENDPOINT] = "CR_RESET_ENDPOINT",
478 [CR_STOP_ENDPOINT] = "CR_STOP_ENDPOINT",
479 [CR_SET_TR_DEQUEUE] = "CR_SET_TR_DEQUEUE",
480 [CR_RESET_DEVICE] = "CR_RESET_DEVICE",
481 [CR_FORCE_EVENT] = "CR_FORCE_EVENT",
482 [CR_NEGOTIATE_BW] = "CR_NEGOTIATE_BW",
483 [CR_SET_LATENCY_TOLERANCE] = "CR_SET_LATENCY_TOLERANCE",
484 [CR_GET_PORT_BANDWIDTH] = "CR_GET_PORT_BANDWIDTH",
485 [CR_FORCE_HEADER] = "CR_FORCE_HEADER",
486 [CR_NOOP] = "CR_NOOP",
487 [ER_TRANSFER] = "ER_TRANSFER",
488 [ER_COMMAND_COMPLETE] = "ER_COMMAND_COMPLETE",
489 [ER_PORT_STATUS_CHANGE] = "ER_PORT_STATUS_CHANGE",
490 [ER_BANDWIDTH_REQUEST] = "ER_BANDWIDTH_REQUEST",
491 [ER_DOORBELL] = "ER_DOORBELL",
492 [ER_HOST_CONTROLLER] = "ER_HOST_CONTROLLER",
493 [ER_DEVICE_NOTIFICATION] = "ER_DEVICE_NOTIFICATION",
494 [ER_MFINDEX_WRAP] = "ER_MFINDEX_WRAP",
495 [CR_VENDOR_VIA_CHALLENGE_RESPONSE] = "CR_VENDOR_VIA_CHALLENGE_RESPONSE",
496 [CR_VENDOR_NEC_FIRMWARE_REVISION] = "CR_VENDOR_NEC_FIRMWARE_REVISION",
497 [CR_VENDOR_NEC_CHALLENGE_RESPONSE] = "CR_VENDOR_NEC_CHALLENGE_RESPONSE",
498};
499
873123fe
GH		 500static const char *TRBCCode_names[] = {
501 [CC_INVALID] = "CC_INVALID",
502 [CC_SUCCESS] = "CC_SUCCESS",
503 [CC_DATA_BUFFER_ERROR] = "CC_DATA_BUFFER_ERROR",
504 [CC_BABBLE_DETECTED] = "CC_BABBLE_DETECTED",
505 [CC_USB_TRANSACTION_ERROR] = "CC_USB_TRANSACTION_ERROR",
506 [CC_TRB_ERROR] = "CC_TRB_ERROR",
507 [CC_STALL_ERROR] = "CC_STALL_ERROR",
508 [CC_RESOURCE_ERROR] = "CC_RESOURCE_ERROR",
509 [CC_BANDWIDTH_ERROR] = "CC_BANDWIDTH_ERROR",
510 [CC_NO_SLOTS_ERROR] = "CC_NO_SLOTS_ERROR",
511 [CC_INVALID_STREAM_TYPE_ERROR] = "CC_INVALID_STREAM_TYPE_ERROR",
512 [CC_SLOT_NOT_ENABLED_ERROR] = "CC_SLOT_NOT_ENABLED_ERROR",
513 [CC_EP_NOT_ENABLED_ERROR] = "CC_EP_NOT_ENABLED_ERROR",
514 [CC_SHORT_PACKET] = "CC_SHORT_PACKET",
515 [CC_RING_UNDERRUN] = "CC_RING_UNDERRUN",
516 [CC_RING_OVERRUN] = "CC_RING_OVERRUN",
517 [CC_VF_ER_FULL] = "CC_VF_ER_FULL",
518 [CC_PARAMETER_ERROR] = "CC_PARAMETER_ERROR",
519 [CC_BANDWIDTH_OVERRUN] = "CC_BANDWIDTH_OVERRUN",
520 [CC_CONTEXT_STATE_ERROR] = "CC_CONTEXT_STATE_ERROR",
521 [CC_NO_PING_RESPONSE_ERROR] = "CC_NO_PING_RESPONSE_ERROR",
522 [CC_EVENT_RING_FULL_ERROR] = "CC_EVENT_RING_FULL_ERROR",
523 [CC_INCOMPATIBLE_DEVICE_ERROR] = "CC_INCOMPATIBLE_DEVICE_ERROR",
524 [CC_MISSED_SERVICE_ERROR] = "CC_MISSED_SERVICE_ERROR",
525 [CC_COMMAND_RING_STOPPED] = "CC_COMMAND_RING_STOPPED",
526 [CC_COMMAND_ABORTED] = "CC_COMMAND_ABORTED",
527 [CC_STOPPED] = "CC_STOPPED",
528 [CC_STOPPED_LENGTH_INVALID] = "CC_STOPPED_LENGTH_INVALID",
529 [CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR]
530 = "CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR",
531 [CC_ISOCH_BUFFER_OVERRUN] = "CC_ISOCH_BUFFER_OVERRUN",
532 [CC_EVENT_LOST_ERROR] = "CC_EVENT_LOST_ERROR",
533 [CC_UNDEFINED_ERROR] = "CC_UNDEFINED_ERROR",
534 [CC_INVALID_STREAM_ID_ERROR] = "CC_INVALID_STREAM_ID_ERROR",
535 [CC_SECONDARY_BANDWIDTH_ERROR] = "CC_SECONDARY_BANDWIDTH_ERROR",
536 [CC_SPLIT_TRANSACTION_ERROR] = "CC_SPLIT_TRANSACTION_ERROR",
537};
538
f10de44e
GH		 539static const char *lookup_name(uint32_t index, const char **list, uint32_t llen)
540{
541 if (index >= llen || list[index] == NULL) {
542 return "???";
543 }
544 return list[index];
545}
546
547static const char *trb_name(XHCITRB *trb)
548{
549 return lookup_name(TRB_TYPE(*trb), TRBType_names,
550 ARRAY_SIZE(TRBType_names));
551}
f10de44e 552
873123fe
GH		 553static const char *event_name(XHCIEvent *event)
554{
555 return lookup_name(event->ccode, TRBCCode_names,
556 ARRAY_SIZE(TRBCCode_names));
557}
558
01546fa6
GH		 559static uint64_t xhci_mfindex_get(XHCIState *xhci)
560{
561 int64_t now = qemu_get_clock_ns(vm_clock);
562 return (now - xhci->mfindex_start) / 125000;
563}
564
565static void xhci_mfwrap_update(XHCIState *xhci)
566{
567 const uint32_t bits = USBCMD_RS | USBCMD_EWE;
568 uint32_t mfindex, left;
569 int64_t now;
570
571 if ((xhci->usbcmd & bits) == bits) {
572 now = qemu_get_clock_ns(vm_clock);
573 mfindex = ((now - xhci->mfindex_start) / 125000) & 0x3fff;
574 left = 0x4000 - mfindex;
575 qemu_mod_timer(xhci->mfwrap_timer, now + left * 125000);
576 } else {
577 qemu_del_timer(xhci->mfwrap_timer);
578 }
579}
580
581static void xhci_mfwrap_timer(void *opaque)
582{
583 XHCIState *xhci = opaque;
584 XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS };
585
962d11e1 586 xhci_event(xhci, &wrap, 0);
01546fa6
GH		 587 xhci_mfwrap_update(xhci);
588}
62c6ae04 589
59a70ccd 590static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
62c6ae04 591{
59a70ccd
DG		 592 if (sizeof(dma_addr_t) == 4) {
593 return low;
594 } else {
595 return low | (((dma_addr_t)high << 16) << 16);
596 }
62c6ae04
HM		 597}
598
59a70ccd 599static inline dma_addr_t xhci_mask64(uint64_t addr)
62c6ae04 600{
59a70ccd
DG		 601 if (sizeof(dma_addr_t) == 4) {
602 return addr & 0xffffffff;
603 } else {
604 return addr;
605 }
62c6ae04
HM		 606}
607
0846e635
GH		 608static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
609{
610 int index;
611
612 if (!uport->dev) {
613 return NULL;
614 }
615 switch (uport->dev->speed) {
616 case USB_SPEED_LOW:
617 case USB_SPEED_FULL:
618 case USB_SPEED_HIGH:
619 index = uport->index;
620 break;
621 case USB_SPEED_SUPER:
622 index = uport->index + xhci->numports_2;
623 break;
624 default:
625 return NULL;
626 }
627 return &xhci->ports[index];
628}
629
4c4abe7c 630static void xhci_intx_update(XHCIState *xhci)
62c6ae04
HM		 631{
632 int level = 0;
633
4c47f800
GH		 634 if (msix_enabled(&xhci->pci_dev) ||
635 msi_enabled(&xhci->pci_dev)) {
4c4abe7c
GH		 636 return;
637 }
638
962d11e1
GH		 639 if (xhci->intr[0].iman & IMAN_IP &&
640 xhci->intr[0].iman & IMAN_IE &&
215bff17 641 xhci->usbcmd & USBCMD_INTE) {
62c6ae04
HM		 642 level = 1;
643 }
644
4c4abe7c
GH		 645 trace_usb_xhci_irq_intx(level);
646 qemu_set_irq(xhci->irq, level);
647}
648
962d11e1 649static void xhci_msix_update(XHCIState *xhci, int v)
4c47f800
GH		 650{
651 bool enabled;
652
653 if (!msix_enabled(&xhci->pci_dev)) {
654 return;
655 }
656
962d11e1
GH		 657 enabled = xhci->intr[v].iman & IMAN_IE;
658 if (enabled == xhci->intr[v].msix_used) {
4c47f800
GH		 659 return;
660 }
661
662 if (enabled) {
962d11e1
GH		 663 trace_usb_xhci_irq_msix_use(v);
664 msix_vector_use(&xhci->pci_dev, v);
665 xhci->intr[v].msix_used = true;
4c47f800 666 } else {
962d11e1
GH		 667 trace_usb_xhci_irq_msix_unuse(v);
668 msix_vector_unuse(&xhci->pci_dev, v);
669 xhci->intr[v].msix_used = false;
4c47f800
GH		 670 }
671}
672
962d11e1 673static void xhci_intr_raise(XHCIState *xhci, int v)
4c4abe7c 674{
962d11e1
GH		 675 xhci->intr[v].erdp_low |= ERDP_EHB;
676 xhci->intr[v].iman |= IMAN_IP;
2cae4119
GH		 677 xhci->usbsts |= USBSTS_EINT;
678
962d11e1 679 if (!(xhci->intr[v].iman & IMAN_IE)) {
4c4abe7c
GH		 680 return;
681 }
682
683 if (!(xhci->usbcmd & USBCMD_INTE)) {
684 return;
685 }
686
4c47f800 687 if (msix_enabled(&xhci->pci_dev)) {
962d11e1
GH		 688 trace_usb_xhci_irq_msix(v);
689 msix_notify(&xhci->pci_dev, v);
4c47f800
GH		 690 return;
691 }
692
c5e9b02d 693 if (msi_enabled(&xhci->pci_dev)) {
962d11e1
GH		 694 trace_usb_xhci_irq_msi(v);
695 msi_notify(&xhci->pci_dev, v);
4c4abe7c 696 return;
62c6ae04 697 }
4c4abe7c 698
962d11e1
GH		 699 if (v == 0) {
700 trace_usb_xhci_irq_intx(1);
701 qemu_set_irq(xhci->irq, 1);
702 }
62c6ae04
HM		 703}
704
705static inline int xhci_running(XHCIState *xhci)
706{
962d11e1 707 return !(xhci->usbsts & USBSTS_HCH) && !xhci->intr[0].er_full;
62c6ae04
HM		 708}
709
710static void xhci_die(XHCIState *xhci)
711{
712 xhci->usbsts |= USBSTS_HCE;
713 fprintf(stderr, "xhci: asserted controller error\n");
714}
715
962d11e1 716static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
62c6ae04 717{
962d11e1 718 XHCIInterrupter *intr = &xhci->intr[v];
62c6ae04 719 XHCITRB ev_trb;
59a70ccd 720 dma_addr_t addr;
62c6ae04
HM		 721
722 ev_trb.parameter = cpu_to_le64(event->ptr);
723 ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
724 ev_trb.control = (event->slotid << 24) | (event->epid << 16) |
725 event->flags | (event->type << TRB_TYPE_SHIFT);
962d11e1 726 if (intr->er_pcs) {
62c6ae04
HM		 727 ev_trb.control |= TRB_C;
728 }
729 ev_trb.control = cpu_to_le32(ev_trb.control);
730
962d11e1 731 trace_usb_xhci_queue_event(v, intr->er_ep_idx, trb_name(&ev_trb),
873123fe
GH		 732 event_name(event), ev_trb.parameter,
733 ev_trb.status, ev_trb.control);
62c6ae04 734
962d11e1 735 addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
59a70ccd 736 pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
62c6ae04 737
962d11e1
GH		 738 intr->er_ep_idx++;
739 if (intr->er_ep_idx >= intr->er_size) {
740 intr->er_ep_idx = 0;
741 intr->er_pcs = !intr->er_pcs;
62c6ae04
HM		 742 }
743}
744
962d11e1 745static void xhci_events_update(XHCIState *xhci, int v)
62c6ae04 746{
962d11e1 747 XHCIInterrupter *intr = &xhci->intr[v];
59a70ccd 748 dma_addr_t erdp;
62c6ae04
HM		 749 unsigned int dp_idx;
750 bool do_irq = 0;
751
752 if (xhci->usbsts & USBSTS_HCH) {
753 return;
754 }
755
962d11e1
GH		 756 erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
757 if (erdp < intr->er_start ||
758 erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
59a70ccd 759 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
962d11e1
GH		 760 fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
761 v, intr->er_start, intr->er_size);
62c6ae04
HM		 762 xhci_die(xhci);
763 return;
764 }
962d11e1
GH		 765 dp_idx = (erdp - intr->er_start) / TRB_SIZE;
766 assert(dp_idx < intr->er_size);
62c6ae04
HM		 767
768 /* NEC didn't read section 4.9.4 of the spec (v1.0 p139 top Note) and thus
769 * deadlocks when the ER is full. Hack it by holding off events until
770 * the driver decides to free at least half of the ring */
962d11e1
GH		 771 if (intr->er_full) {
772 int er_free = dp_idx - intr->er_ep_idx;
62c6ae04 773 if (er_free <= 0) {
962d11e1 774 er_free += intr->er_size;
62c6ae04 775 }
962d11e1 776 if (er_free < (intr->er_size/2)) {
62c6ae04
HM		 777 DPRINTF("xhci_events_update(): event ring still "
778 "more than half full (hack)\n");
779 return;
780 }
781 }
782
962d11e1
GH		 783 while (intr->ev_buffer_put != intr->ev_buffer_get) {
784 assert(intr->er_full);
785 if (((intr->er_ep_idx+1) % intr->er_size) == dp_idx) {
62c6ae04
HM		 786 DPRINTF("xhci_events_update(): event ring full again\n");
787#ifndef ER_FULL_HACK
788 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
962d11e1 789 xhci_write_event(xhci, &full, v);
62c6ae04
HM		 790#endif
791 do_irq = 1;
792 break;
793 }
962d11e1
GH		 794 XHCIEvent *event = &intr->ev_buffer[intr->ev_buffer_get];
795 xhci_write_event(xhci, event, v);
796 intr->ev_buffer_get++;
62c6ae04 797 do_irq = 1;
962d11e1
GH		 798 if (intr->ev_buffer_get == EV_QUEUE) {
799 intr->ev_buffer_get = 0;
62c6ae04
HM		 800 }
801 }
802
803 if (do_irq) {
962d11e1 804 xhci_intr_raise(xhci, v);
62c6ae04
HM		 805 }
806
962d11e1 807 if (intr->er_full && intr->ev_buffer_put == intr->ev_buffer_get) {
62c6ae04 808 DPRINTF("xhci_events_update(): event ring no longer full\n");
962d11e1 809 intr->er_full = 0;
62c6ae04 810 }
62c6ae04
HM		 811}
812
962d11e1 813static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v)
62c6ae04 814{
2d1de850 815 XHCIInterrupter *intr;
59a70ccd 816 dma_addr_t erdp;
62c6ae04
HM		 817 unsigned int dp_idx;
818
2d1de850
GH		 819 if (v >= MAXINTRS) {
820 DPRINTF("intr nr out of range (%d >= %d)\n", v, MAXINTRS);
821 return;
822 }
823 intr = &xhci->intr[v];
824
962d11e1 825 if (intr->er_full) {
62c6ae04 826 DPRINTF("xhci_event(): ER full, queueing\n");
962d11e1 827 if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
62c6ae04
HM		 828 fprintf(stderr, "xhci: event queue full, dropping event!\n");
829 return;
830 }
962d11e1
GH		 831 intr->ev_buffer[intr->ev_buffer_put++] = *event;
832 if (intr->ev_buffer_put == EV_QUEUE) {
833 intr->ev_buffer_put = 0;
62c6ae04
HM		 834 }
835 return;
836 }
837
962d11e1
GH		 838 erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
839 if (erdp < intr->er_start ||
840 erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
59a70ccd 841 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
962d11e1
GH		 842 fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
843 v, intr->er_start, intr->er_size);
62c6ae04
HM		 844 xhci_die(xhci);
845 return;
846 }
847
962d11e1
GH		 848 dp_idx = (erdp - intr->er_start) / TRB_SIZE;
849 assert(dp_idx < intr->er_size);
62c6ae04 850
962d11e1 851 if ((intr->er_ep_idx+1) % intr->er_size == dp_idx) {
62c6ae04
HM		 852 DPRINTF("xhci_event(): ER full, queueing\n");
853#ifndef ER_FULL_HACK
854 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
855 xhci_write_event(xhci, &full);
856#endif
962d11e1
GH		 857 intr->er_full = 1;
858 if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
62c6ae04
HM		 859 fprintf(stderr, "xhci: event queue full, dropping event!\n");
860 return;
861 }
962d11e1
GH		 862 intr->ev_buffer[intr->ev_buffer_put++] = *event;
863 if (intr->ev_buffer_put == EV_QUEUE) {
864 intr->ev_buffer_put = 0;
62c6ae04
HM		 865 }
866 } else {
962d11e1 867 xhci_write_event(xhci, event, v);
62c6ae04
HM		 868 }
869
962d11e1 870 xhci_intr_raise(xhci, v);
62c6ae04
HM		 871}
872
873static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
59a70ccd 874 dma_addr_t base)
62c6ae04
HM		 875{
876 ring->base = base;
877 ring->dequeue = base;
878 ring->ccs = 1;
879}
880
881static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
59a70ccd 882 dma_addr_t *addr)
62c6ae04
HM		 883{
884 while (1) {
885 TRBType type;
59a70ccd 886 pci_dma_read(&xhci->pci_dev, ring->dequeue, trb, TRB_SIZE);
62c6ae04
HM		 887 trb->addr = ring->dequeue;
888 trb->ccs = ring->ccs;
889 le64_to_cpus(&trb->parameter);
890 le32_to_cpus(&trb->status);
891 le32_to_cpus(&trb->control);
892
0703a4a7
GH		 893 trace_usb_xhci_fetch_trb(ring->dequeue, trb_name(trb),
894 trb->parameter, trb->status, trb->control);
62c6ae04
HM		 895
896 if ((trb->control & TRB_C) != ring->ccs) {
897 return 0;
898 }
899
900 type = TRB_TYPE(*trb);
901
902 if (type != TR_LINK) {
903 if (addr) {
904 *addr = ring->dequeue;
905 }
906 ring->dequeue += TRB_SIZE;
907 return type;
908 } else {
909 ring->dequeue = xhci_mask64(trb->parameter);
910 if (trb->control & TRB_LK_TC) {
911 ring->ccs = !ring->ccs;
912 }
913 }
914 }
915}
916
917static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
918{
919 XHCITRB trb;
920 int length = 0;
59a70ccd 921 dma_addr_t dequeue = ring->dequeue;
62c6ae04
HM		 922 bool ccs = ring->ccs;
923 /* hack to bundle together the two/three TDs that make a setup transfer */
924 bool control_td_set = 0;
925
926 while (1) {
927 TRBType type;
59a70ccd 928 pci_dma_read(&xhci->pci_dev, dequeue, &trb, TRB_SIZE);
62c6ae04
HM		 929 le64_to_cpus(&trb.parameter);
930 le32_to_cpus(&trb.status);
931 le32_to_cpus(&trb.control);
932
62c6ae04
HM		 933 if ((trb.control & TRB_C) != ccs) {
934 return -length;
935 }
936
937 type = TRB_TYPE(trb);
938
939 if (type == TR_LINK) {
940 dequeue = xhci_mask64(trb.parameter);
941 if (trb.control & TRB_LK_TC) {
942 ccs = !ccs;
943 }
944 continue;
945 }
946
947 length += 1;
948 dequeue += TRB_SIZE;
949
950 if (type == TR_SETUP) {
951 control_td_set = 1;
952 } else if (type == TR_STATUS) {
953 control_td_set = 0;
954 }
955
956 if (!control_td_set && !(trb.control & TRB_TR_CH)) {
957 return length;
958 }
959 }
960}
961
962d11e1 962static void xhci_er_reset(XHCIState *xhci, int v)
62c6ae04 963{
962d11e1 964 XHCIInterrupter *intr = &xhci->intr[v];
62c6ae04
HM		 965 XHCIEvRingSeg seg;
966
967 /* cache the (sole) event ring segment location */
962d11e1
GH		 968 if (intr->erstsz != 1) {
969 fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
62c6ae04
HM		 970 xhci_die(xhci);
971 return;
972 }
962d11e1 973 dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);
59a70ccd 974 pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg));
62c6ae04
HM		 975 le32_to_cpus(&seg.addr_low);
976 le32_to_cpus(&seg.addr_high);
977 le32_to_cpus(&seg.size);
978 if (seg.size < 16 || seg.size > 4096) {
979 fprintf(stderr, "xhci: invalid value for segment size: %d\n", seg.size);
980 xhci_die(xhci);
981 return;
982 }
962d11e1
GH		 983 intr->er_start = xhci_addr64(seg.addr_low, seg.addr_high);
984 intr->er_size = seg.size;
62c6ae04 985
962d11e1
GH		 986 intr->er_ep_idx = 0;
987 intr->er_pcs = 1;
988 intr->er_full = 0;
62c6ae04 989
962d11e1
GH		 990 DPRINTF("xhci: event ring[%d]:" DMA_ADDR_FMT " [%d]\n",
991 v, intr->er_start, intr->er_size);
62c6ae04
HM		 992}
993
994static void xhci_run(XHCIState *xhci)
995{
fc0ddaca 996 trace_usb_xhci_run();
62c6ae04 997 xhci->usbsts &= ~USBSTS_HCH;
01546fa6 998 xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
62c6ae04
HM		 999}
1000
1001static void xhci_stop(XHCIState *xhci)
1002{
fc0ddaca 1003 trace_usb_xhci_stop();
62c6ae04
HM		 1004 xhci->usbsts |= USBSTS_HCH;
1005 xhci->crcr_low &= ~CRCR_CRR;
1006}
1007
1008static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
1009 uint32_t state)
1010{
1011 uint32_t ctx[5];
1012 if (epctx->state == state) {
1013 return;
1014 }
1015
59a70ccd 1016 pci_dma_read(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx));
62c6ae04
HM		 1017 ctx[0] &= ~EP_STATE_MASK;
1018 ctx[0] |= state;
1019 ctx[2] = epctx->ring.dequeue | epctx->ring.ccs;
1020 ctx[3] = (epctx->ring.dequeue >> 16) >> 16;
59a70ccd 1021 DPRINTF("xhci: set epctx: " DMA_ADDR_FMT " state=%d dequeue=%08x%08x\n",
62c6ae04 1022 epctx->pctx, state, ctx[3], ctx[2]);
59a70ccd 1023 pci_dma_write(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx));
62c6ae04
HM		 1024 epctx->state = state;
1025}
1026
3d139684
GH		 1027static void xhci_ep_kick_timer(void *opaque)
1028{
1029 XHCIEPContext *epctx = opaque;
1030 xhci_kick_ep(epctx->xhci, epctx->slotid, epctx->epid);
1031}
1032
62c6ae04 1033static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
59a70ccd 1034 unsigned int epid, dma_addr_t pctx,
62c6ae04
HM		 1035 uint32_t *ctx)
1036{
1037 XHCISlot *slot;
1038 XHCIEPContext *epctx;
59a70ccd 1039 dma_addr_t dequeue;
62c6ae04
HM		 1040 int i;
1041
c1f6b493 1042 trace_usb_xhci_ep_enable(slotid, epid);
62c6ae04
HM		 1043 assert(slotid >= 1 && slotid <= MAXSLOTS);
1044 assert(epid >= 1 && epid <= 31);
1045
62c6ae04
HM		 1046 slot = &xhci->slots[slotid-1];
1047 if (slot->eps[epid-1]) {
1048 fprintf(stderr, "xhci: slot %d ep %d already enabled!\n", slotid, epid);
1049 return CC_TRB_ERROR;
1050 }
1051
1052 epctx = g_malloc(sizeof(XHCIEPContext));
1053 memset(epctx, 0, sizeof(XHCIEPContext));
3d139684
GH		 1054 epctx->xhci = xhci;
1055 epctx->slotid = slotid;
1056 epctx->epid = epid;
62c6ae04
HM		 1057
1058 slot->eps[epid-1] = epctx;
1059
1060 dequeue = xhci_addr64(ctx[2] & ~0xf, ctx[3]);
1061 xhci_ring_init(xhci, &epctx->ring, dequeue);
1062 epctx->ring.ccs = ctx[2] & 1;
1063
1064 epctx->type = (ctx[1] >> EP_TYPE_SHIFT) & EP_TYPE_MASK;
1065 DPRINTF("xhci: endpoint %d.%d type is %d\n", epid/2, epid%2, epctx->type);
1066 epctx->pctx = pctx;
1067 epctx->max_psize = ctx[1]>>16;
1068 epctx->max_psize *= 1+((ctx[1]>>8)&0xff);
62c6ae04
HM		 1069 DPRINTF("xhci: endpoint %d.%d max transaction (burst) size is %d\n",
1070 epid/2, epid%2, epctx->max_psize);
1071 for (i = 0; i < ARRAY_SIZE(epctx->transfers); i++) {
1072 usb_packet_init(&epctx->transfers[i].packet);
1073 }
1074
3d139684
GH		 1075 epctx->interval = 1 << (ctx[0] >> 16) & 0xff;
1076 epctx->mfindex_last = 0;
1077 epctx->kick_timer = qemu_new_timer_ns(vm_clock, xhci_ep_kick_timer, epctx);
1078
62c6ae04
HM		 1079 epctx->state = EP_RUNNING;
1080 ctx[0] &= ~EP_STATE_MASK;
1081 ctx[0] |= EP_RUNNING;
1082
1083 return CC_SUCCESS;
1084}
1085
3151f209
HG		 1086static int xhci_ep_nuke_one_xfer(XHCITransfer *t)
1087{
1088 int killed = 0;
1089
1090 if (t->running_async) {
1091 usb_cancel_packet(&t->packet);
1092 t->running_async = 0;
1093 t->cancelled = 1;
1094 DPRINTF("xhci: cancelling transfer, waiting for it to complete\n");
1095 killed = 1;
1096 }
1097 if (t->running_retry) {
1098 XHCIEPContext *epctx = t->xhci->slots[t->slotid-1].eps[t->epid-1];
1099 if (epctx) {
1100 epctx->retry = NULL;
1101 qemu_del_timer(epctx->kick_timer);
1102 }
1103 t->running_retry = 0;
1104 }
1105 if (t->trbs) {
1106 g_free(t->trbs);
1107 }
1108
1109 t->trbs = NULL;
1110 t->trb_count = t->trb_alloced = 0;
1111
1112 return killed;
1113}
1114
62c6ae04
HM		 1115static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
1116 unsigned int epid)
1117{
1118 XHCISlot *slot;
1119 XHCIEPContext *epctx;
1120 int i, xferi, killed = 0;
1121 assert(slotid >= 1 && slotid <= MAXSLOTS);
1122 assert(epid >= 1 && epid <= 31);
1123
1124 DPRINTF("xhci_ep_nuke_xfers(%d, %d)\n", slotid, epid);
1125
1126 slot = &xhci->slots[slotid-1];
1127
1128 if (!slot->eps[epid-1]) {
1129 return 0;
1130 }
1131
1132 epctx = slot->eps[epid-1];
1133
1134 xferi = epctx->next_xfer;
1135 for (i = 0; i < TD_QUEUE; i++) {
3151f209 1136 killed += xhci_ep_nuke_one_xfer(&epctx->transfers[xferi]);
62c6ae04
HM		 1137 xferi = (xferi + 1) % TD_QUEUE;
1138 }
62c6ae04
HM		 1139 return killed;
1140}
1141
1142static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
1143 unsigned int epid)
1144{
1145 XHCISlot *slot;
1146 XHCIEPContext *epctx;
1147
c1f6b493 1148 trace_usb_xhci_ep_disable(slotid, epid);
62c6ae04
HM		 1149 assert(slotid >= 1 && slotid <= MAXSLOTS);
1150 assert(epid >= 1 && epid <= 31);
1151
62c6ae04
HM		 1152 slot = &xhci->slots[slotid-1];
1153
1154 if (!slot->eps[epid-1]) {
1155 DPRINTF("xhci: slot %d ep %d already disabled\n", slotid, epid);
1156 return CC_SUCCESS;
1157 }
1158
1159 xhci_ep_nuke_xfers(xhci, slotid, epid);
1160
1161 epctx = slot->eps[epid-1];
1162
1163 xhci_set_ep_state(xhci, epctx, EP_DISABLED);
1164
3d139684 1165 qemu_free_timer(epctx->kick_timer);
62c6ae04
HM		 1166 g_free(epctx);
1167 slot->eps[epid-1] = NULL;
1168
1169 return CC_SUCCESS;
1170}
1171
1172static TRBCCode xhci_stop_ep(XHCIState *xhci, unsigned int slotid,
1173 unsigned int epid)
1174{
1175 XHCISlot *slot;
1176 XHCIEPContext *epctx;
1177
c1f6b493 1178 trace_usb_xhci_ep_stop(slotid, epid);
62c6ae04
HM		 1179 assert(slotid >= 1 && slotid <= MAXSLOTS);
1180
1181 if (epid < 1 || epid > 31) {
1182 fprintf(stderr, "xhci: bad ep %d\n", epid);
1183 return CC_TRB_ERROR;
1184 }
1185
1186 slot = &xhci->slots[slotid-1];
1187
1188 if (!slot->eps[epid-1]) {
1189 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1190 return CC_EP_NOT_ENABLED_ERROR;
1191 }
1192
1193 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) {
1194 fprintf(stderr, "xhci: FIXME: endpoint stopped w/ xfers running, "
1195 "data might be lost\n");
1196 }
1197
1198 epctx = slot->eps[epid-1];
1199
1200 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1201
1202 return CC_SUCCESS;
1203}
1204
1205static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
1206 unsigned int epid)
1207{
1208 XHCISlot *slot;
1209 XHCIEPContext *epctx;
1210 USBDevice *dev;
1211
c1f6b493 1212 trace_usb_xhci_ep_reset(slotid, epid);
62c6ae04
HM		 1213 assert(slotid >= 1 && slotid <= MAXSLOTS);
1214
62c6ae04
HM		 1215 if (epid < 1 || epid > 31) {
1216 fprintf(stderr, "xhci: bad ep %d\n", epid);
1217 return CC_TRB_ERROR;
1218 }
1219
1220 slot = &xhci->slots[slotid-1];
1221
1222 if (!slot->eps[epid-1]) {
1223 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1224 return CC_EP_NOT_ENABLED_ERROR;
1225 }
1226
1227 epctx = slot->eps[epid-1];
1228
1229 if (epctx->state != EP_HALTED) {
1230 fprintf(stderr, "xhci: reset EP while EP %d not halted (%d)\n",
1231 epid, epctx->state);
1232 return CC_CONTEXT_STATE_ERROR;
1233 }
1234
1235 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) {
1236 fprintf(stderr, "xhci: FIXME: endpoint reset w/ xfers running, "
1237 "data might be lost\n");
1238 }
1239
1240 uint8_t ep = epid>>1;
1241
1242 if (epid & 1) {
1243 ep |= 0x80;
1244 }
1245
ccaf87a0 1246 dev = xhci->slots[slotid-1].uport->dev;
62c6ae04
HM		 1247 if (!dev) {
1248 return CC_USB_TRANSACTION_ERROR;
1249 }
1250
1251 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1252
1253 return CC_SUCCESS;
1254}
1255
1256static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
1257 unsigned int epid, uint64_t pdequeue)
1258{
1259 XHCISlot *slot;
1260 XHCIEPContext *epctx;
59a70ccd 1261 dma_addr_t dequeue;
62c6ae04
HM		 1262
1263 assert(slotid >= 1 && slotid <= MAXSLOTS);
1264
1265 if (epid < 1 || epid > 31) {
1266 fprintf(stderr, "xhci: bad ep %d\n", epid);
1267 return CC_TRB_ERROR;
1268 }
1269
d829fde9 1270 trace_usb_xhci_ep_set_dequeue(slotid, epid, pdequeue);
62c6ae04
HM		 1271 dequeue = xhci_mask64(pdequeue);
1272
1273 slot = &xhci->slots[slotid-1];
1274
1275 if (!slot->eps[epid-1]) {
1276 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1277 return CC_EP_NOT_ENABLED_ERROR;
1278 }
1279
1280 epctx = slot->eps[epid-1];
1281
1282
1283 if (epctx->state != EP_STOPPED) {
1284 fprintf(stderr, "xhci: set EP dequeue pointer while EP %d not stopped\n", epid);
1285 return CC_CONTEXT_STATE_ERROR;
1286 }
1287
1288 xhci_ring_init(xhci, &epctx->ring, dequeue & ~0xF);
1289 epctx->ring.ccs = dequeue & 1;
1290
1291 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1292
1293 return CC_SUCCESS;
1294}
1295
a6fb2ddb 1296static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
62c6ae04 1297{
62c6ae04 1298 XHCIState *xhci = xfer->xhci;
d5a15814 1299 int i;
62c6ae04 1300
a6fb2ddb 1301 xfer->int_req = false;
d5a15814 1302 pci_dma_sglist_init(&xfer->sgl, &xhci->pci_dev, xfer->trb_count);
62c6ae04
HM		 1303 for (i = 0; i < xfer->trb_count; i++) {
1304 XHCITRB *trb = &xfer->trbs[i];
59a70ccd 1305 dma_addr_t addr;
62c6ae04
HM		 1306 unsigned int chunk = 0;
1307
a6fb2ddb
HG		 1308 if (trb->control & TRB_TR_IOC) {
1309 xfer->int_req = true;
1310 }
1311
62c6ae04
HM		 1312 switch (TRB_TYPE(*trb)) {
1313 case TR_DATA:
1314 if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
1315 fprintf(stderr, "xhci: data direction mismatch for TR_DATA\n");
d5a15814 1316 goto err;
62c6ae04
HM		 1317 }
1318 /* fallthrough */
1319 case TR_NORMAL:
1320 case TR_ISOCH:
1321 addr = xhci_mask64(trb->parameter);
d5a15814
GH		 1322 chunk = trb->status & 0x1ffff;
1323 if (trb->control & TRB_TR_IDT) {
1324 if (chunk > 8 || in_xfer) {
1325 fprintf(stderr, "xhci: invalid immediate data TRB\n");
1326 goto err;
1327 }
1328 qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
1329 } else {
1330 qemu_sglist_add(&xfer->sgl, addr, chunk);
1331 }
1332 break;
1333 }
1334 }
1335
d5a15814
GH		 1336 return 0;
1337
1338err:
1339 qemu_sglist_destroy(&xfer->sgl);
1340 xhci_die(xhci);
1341 return -1;
1342}
1343
1344static void xhci_xfer_unmap(XHCITransfer *xfer)
1345{
1346 usb_packet_unmap(&xfer->packet, &xfer->sgl);
1347 qemu_sglist_destroy(&xfer->sgl);
1348}
1349
1350static void xhci_xfer_report(XHCITransfer *xfer)
1351{
1352 uint32_t edtla = 0;
1353 unsigned int left;
1354 bool reported = 0;
1355 bool shortpkt = 0;
1356 XHCIEvent event = {ER_TRANSFER, CC_SUCCESS};
1357 XHCIState *xhci = xfer->xhci;
1358 int i;
1359
1360 left = xfer->packet.result < 0 ? 0 : xfer->packet.result;
1361
1362 for (i = 0; i < xfer->trb_count; i++) {
1363 XHCITRB *trb = &xfer->trbs[i];
1364 unsigned int chunk = 0;
1365
1366 switch (TRB_TYPE(*trb)) {
1367 case TR_DATA:
1368 case TR_NORMAL:
1369 case TR_ISOCH:
62c6ae04
HM		 1370 chunk = trb->status & 0x1ffff;
1371 if (chunk > left) {
1372 chunk = left;
d5a15814
GH		 1373 if (xfer->status == CC_SUCCESS) {
1374 shortpkt = 1;
62c6ae04
HM		 1375 }
1376 }
1377 left -= chunk;
62c6ae04 1378 edtla += chunk;
62c6ae04
HM		 1379 break;
1380 case TR_STATUS:
1381 reported = 0;
1382 shortpkt = 0;
1383 break;
1384 }
1385
d5a15814
GH		 1386 if (!reported && ((trb->control & TRB_TR_IOC) ||
1387 (shortpkt && (trb->control & TRB_TR_ISP)) ||
1388 (xfer->status != CC_SUCCESS))) {
62c6ae04
HM		 1389 event.slotid = xfer->slotid;
1390 event.epid = xfer->epid;
1391 event.length = (trb->status & 0x1ffff) - chunk;
1392 event.flags = 0;
1393 event.ptr = trb->addr;
1394 if (xfer->status == CC_SUCCESS) {
1395 event.ccode = shortpkt ? CC_SHORT_PACKET : CC_SUCCESS;
1396 } else {
1397 event.ccode = xfer->status;
1398 }
1399 if (TRB_TYPE(*trb) == TR_EVDATA) {
1400 event.ptr = trb->parameter;
1401 event.flags |= TRB_EV_ED;
1402 event.length = edtla & 0xffffff;
1403 DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length);
1404 edtla = 0;
1405 }
2d1de850 1406 xhci_event(xhci, &event, TRB_INTR(*trb));
62c6ae04 1407 reported = 1;
d5a15814
GH		 1408 if (xfer->status != CC_SUCCESS) {
1409 return;
1410 }
62c6ae04
HM		 1411 }
1412 }
62c6ae04
HM		 1413}
1414
1415static void xhci_stall_ep(XHCITransfer *xfer)
1416{
1417 XHCIState *xhci = xfer->xhci;
1418 XHCISlot *slot = &xhci->slots[xfer->slotid-1];
1419 XHCIEPContext *epctx = slot->eps[xfer->epid-1];
1420
1421 epctx->ring.dequeue = xfer->trbs[0].addr;
1422 epctx->ring.ccs = xfer->trbs[0].ccs;
1423 xhci_set_ep_state(xhci, epctx, EP_HALTED);
1424 DPRINTF("xhci: stalled slot %d ep %d\n", xfer->slotid, xfer->epid);
59a70ccd 1425 DPRINTF("xhci: will continue at "DMA_ADDR_FMT"\n", epctx->ring.dequeue);
62c6ae04
HM		 1426}
1427
1428static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer,
1429 XHCIEPContext *epctx);
1430
5c08106f
GH		 1431static int xhci_setup_packet(XHCITransfer *xfer)
1432{
1433 XHCIState *xhci = xfer->xhci;
5c08106f 1434 USBDevice *dev;
079d0b7f
GH		 1435 USBEndpoint *ep;
1436 int dir;
1437
1438 dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT;
5c08106f
GH		 1439
1440 if (xfer->packet.ep) {
1441 ep = xfer->packet.ep;
1442 dev = ep->dev;
1443 } else {
ccaf87a0
GH		 1444 if (!xhci->slots[xfer->slotid-1].uport) {
1445 fprintf(stderr, "xhci: slot %d has no device\n",
1446 xfer->slotid);
5c08106f
GH		 1447 return -1;
1448 }
ccaf87a0 1449 dev = xhci->slots[xfer->slotid-1].uport->dev;
5c08106f
GH		 1450 ep = usb_ep_get(dev, dir, xfer->epid >> 1);
1451 }
1452
a6fb2ddb
HG		 1453 xhci_xfer_create_sgl(xfer, dir == USB_TOKEN_IN); /* Also sets int_req */
1454 usb_packet_setup(&xfer->packet, dir, ep, xfer->trbs[0].addr, false,
1455 xfer->int_req);
1456 usb_packet_map(&xfer->packet, &xfer->sgl);
62c6ae04 1457 DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n",
079d0b7f 1458 xfer->packet.pid, dev->addr, ep->nr);
62c6ae04
HM		 1459 return 0;
1460}
1461
1462static int xhci_complete_packet(XHCITransfer *xfer, int ret)
1463{
1464 if (ret == USB_RET_ASYNC) {
97df650b 1465 trace_usb_xhci_xfer_async(xfer);
7c605a23
GH		 1466 xfer->running_async = 1;
1467 xfer->running_retry = 0;
1468 xfer->complete = 0;
1469 xfer->cancelled = 0;
1470 return 0;
1471 } else if (ret == USB_RET_NAK) {
97df650b 1472 trace_usb_xhci_xfer_nak(xfer);
7c605a23
GH		 1473 xfer->running_async = 0;
1474 xfer->running_retry = 1;
62c6ae04
HM		 1475 xfer->complete = 0;
1476 xfer->cancelled = 0;
1477 return 0;
1478 } else {
7c605a23
GH		 1479 xfer->running_async = 0;
1480 xfer->running_retry = 0;
62c6ae04 1481 xfer->complete = 1;
d5a15814 1482 xhci_xfer_unmap(xfer);
62c6ae04
HM		 1483 }
1484
1485 if (ret >= 0) {
97df650b 1486 trace_usb_xhci_xfer_success(xfer, ret);
d5a15814
GH		 1487 xfer->status = CC_SUCCESS;
1488 xhci_xfer_report(xfer);
62c6ae04
HM		 1489 return 0;
1490 }
1491
1492 /* error */
97df650b 1493 trace_usb_xhci_xfer_error(xfer, ret);
62c6ae04
HM		 1494 switch (ret) {
1495 case USB_RET_NODEV:
1496 xfer->status = CC_USB_TRANSACTION_ERROR;
d5a15814 1497 xhci_xfer_report(xfer);
62c6ae04
HM		 1498 xhci_stall_ep(xfer);
1499 break;
1500 case USB_RET_STALL:
1501 xfer->status = CC_STALL_ERROR;
d5a15814 1502 xhci_xfer_report(xfer);
62c6ae04
HM		 1503 xhci_stall_ep(xfer);
1504 break;
1505 default:
1506 fprintf(stderr, "%s: FIXME: ret = %d\n", __FUNCTION__, ret);
1507 FIXME();
1508 }
1509 return 0;
1510}
1511
1512static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
1513{
1514 XHCITRB *trb_setup, *trb_status;
2850ca9e 1515 uint8_t bmRequestType;
62c6ae04
HM		 1516 int ret;
1517
62c6ae04
HM		 1518 trb_setup = &xfer->trbs[0];
1519 trb_status = &xfer->trbs[xfer->trb_count-1];
1520
d5a15814 1521 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
97df650b 1522
62c6ae04
HM		 1523 /* at most one Event Data TRB allowed after STATUS */
1524 if (TRB_TYPE(*trb_status) == TR_EVDATA && xfer->trb_count > 2) {
1525 trb_status--;
1526 }
1527
1528 /* do some sanity checks */
1529 if (TRB_TYPE(*trb_setup) != TR_SETUP) {
1530 fprintf(stderr, "xhci: ep0 first TD not SETUP: %d\n",
1531 TRB_TYPE(*trb_setup));
1532 return -1;
1533 }
1534 if (TRB_TYPE(*trb_status) != TR_STATUS) {
1535 fprintf(stderr, "xhci: ep0 last TD not STATUS: %d\n",
1536 TRB_TYPE(*trb_status));
1537 return -1;
1538 }
1539 if (!(trb_setup->control & TRB_TR_IDT)) {
1540 fprintf(stderr, "xhci: Setup TRB doesn't have IDT set\n");
1541 return -1;
1542 }
1543 if ((trb_setup->status & 0x1ffff) != 8) {
1544 fprintf(stderr, "xhci: Setup TRB has bad length (%d)\n",
1545 (trb_setup->status & 0x1ffff));
1546 return -1;
1547 }
1548
1549 bmRequestType = trb_setup->parameter;
62c6ae04 1550
62c6ae04
HM		 1551 xfer->in_xfer = bmRequestType & USB_DIR_IN;
1552 xfer->iso_xfer = false;
1553
5c08106f
GH		 1554 if (xhci_setup_packet(xfer) < 0) {
1555 return -1;
1556 }
2850ca9e 1557 xfer->packet.parameter = trb_setup->parameter;
2850ca9e 1558
5c08106f 1559 ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
62c6ae04
HM		 1560
1561 xhci_complete_packet(xfer, ret);
7c605a23 1562 if (!xfer->running_async && !xfer->running_retry) {
62c6ae04
HM		 1563 xhci_kick_ep(xhci, xfer->slotid, xfer->epid);
1564 }
1565 return 0;
1566}
1567
3d139684
GH		 1568static void xhci_calc_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
1569 XHCIEPContext *epctx, uint64_t mfindex)
1570{
1571 if (xfer->trbs[0].control & TRB_TR_SIA) {
1572 uint64_t asap = ((mfindex + epctx->interval - 1) &
1573 ~(epctx->interval-1));
1574 if (asap >= epctx->mfindex_last &&
1575 asap <= epctx->mfindex_last + epctx->interval * 4) {
1576 xfer->mfindex_kick = epctx->mfindex_last + epctx->interval;
1577 } else {
1578 xfer->mfindex_kick = asap;
1579 }
1580 } else {
1581 xfer->mfindex_kick = (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
1582 & TRB_TR_FRAMEID_MASK;
1583 xfer->mfindex_kick |= mfindex & ~0x3fff;
1584 if (xfer->mfindex_kick < mfindex) {
1585 xfer->mfindex_kick += 0x4000;
1586 }
1587 }
1588}
1589
1590static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
1591 XHCIEPContext *epctx, uint64_t mfindex)
1592{
1593 if (xfer->mfindex_kick > mfindex) {
1594 qemu_mod_timer(epctx->kick_timer, qemu_get_clock_ns(vm_clock) +
1595 (xfer->mfindex_kick - mfindex) * 125000);
1596 xfer->running_retry = 1;
1597 } else {
1598 epctx->mfindex_last = xfer->mfindex_kick;
1599 qemu_del_timer(epctx->kick_timer);
1600 xfer->running_retry = 0;
1601 }
1602}
1603
1604
62c6ae04
HM		 1605static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
1606{
3d139684 1607 uint64_t mfindex;
62c6ae04
HM		 1608 int ret;
1609
1610 DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", xfer->slotid, xfer->epid);
62c6ae04
HM		 1611
1612 xfer->in_xfer = epctx->type>>2;
62c6ae04 1613
62c6ae04
HM		 1614 switch(epctx->type) {
1615 case ET_INTR_OUT:
1616 case ET_INTR_IN:
1617 case ET_BULK_OUT:
1618 case ET_BULK_IN:
3d139684
GH		 1619 xfer->pkts = 0;
1620 xfer->iso_xfer = false;
62c6ae04
HM		 1621 break;
1622 case ET_ISO_OUT:
1623 case ET_ISO_IN:
3d139684
GH		 1624 xfer->pkts = 1;
1625 xfer->iso_xfer = true;
1626 mfindex = xhci_mfindex_get(xhci);
1627 xhci_calc_iso_kick(xhci, xfer, epctx, mfindex);
1628 xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
1629 if (xfer->running_retry) {
1630 return -1;
1631 }
62c6ae04
HM		 1632 break;
1633 default:
079d0b7f
GH		 1634 fprintf(stderr, "xhci: unknown or unhandled EP "
1635 "(type %d, in %d, ep %02x)\n",
1636 epctx->type, xfer->in_xfer, xfer->epid);
62c6ae04
HM		 1637 return -1;
1638 }
1639
5c08106f
GH		 1640 if (xhci_setup_packet(xfer) < 0) {
1641 return -1;
1642 }
1643 ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
62c6ae04
HM		 1644
1645 xhci_complete_packet(xfer, ret);
7c605a23 1646 if (!xfer->running_async && !xfer->running_retry) {
62c6ae04
HM		 1647 xhci_kick_ep(xhci, xfer->slotid, xfer->epid);
1648 }
1649 return 0;
1650}
1651
1652static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
1653{
d5a15814 1654 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
331e9406 1655 return xhci_submit(xhci, xfer, epctx);
62c6ae04
HM		 1656}
1657
1658static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid)
1659{
1660 XHCIEPContext *epctx;
36dfe324 1661 USBEndpoint *ep = NULL;
3d139684 1662 uint64_t mfindex;
62c6ae04
HM		 1663 int length;
1664 int i;
1665
c1f6b493 1666 trace_usb_xhci_ep_kick(slotid, epid);
62c6ae04
HM		 1667 assert(slotid >= 1 && slotid <= MAXSLOTS);
1668 assert(epid >= 1 && epid <= 31);
62c6ae04
HM		 1669
1670 if (!xhci->slots[slotid-1].enabled) {
1671 fprintf(stderr, "xhci: xhci_kick_ep for disabled slot %d\n", slotid);
1672 return;
1673 }
1674 epctx = xhci->slots[slotid-1].eps[epid-1];
1675 if (!epctx) {
1676 fprintf(stderr, "xhci: xhci_kick_ep for disabled endpoint %d,%d\n",
1677 epid, slotid);
1678 return;
1679 }
1680
7c605a23 1681 if (epctx->retry) {
7c605a23
GH		 1682 XHCITransfer *xfer = epctx->retry;
1683 int result;
1684
97df650b 1685 trace_usb_xhci_xfer_retry(xfer);
7c605a23 1686 assert(xfer->running_retry);
3d139684
GH		 1687 if (xfer->iso_xfer) {
1688 /* retry delayed iso transfer */
1689 mfindex = xhci_mfindex_get(xhci);
1690 xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
1691 if (xfer->running_retry) {
1692 return;
1693 }
1694 if (xhci_setup_packet(xfer) < 0) {
1695 return;
1696 }
1697 result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1698 assert(result != USB_RET_NAK);
1699 xhci_complete_packet(xfer, result);
1700 } else {
1701 /* retry nak'ed transfer */
1702 if (xhci_setup_packet(xfer) < 0) {
1703 return;
1704 }
1705 result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1706 if (result == USB_RET_NAK) {
1707 return;
1708 }
1709 xhci_complete_packet(xfer, result);
7c605a23 1710 }
7c605a23
GH		 1711 assert(!xfer->running_retry);
1712 epctx->retry = NULL;
1713 }
1714
62c6ae04
HM		 1715 if (epctx->state == EP_HALTED) {
1716 DPRINTF("xhci: ep halted, not running schedule\n");
1717 return;
1718 }
1719
1720 xhci_set_ep_state(xhci, epctx, EP_RUNNING);
1721
1722 while (1) {
1723 XHCITransfer *xfer = &epctx->transfers[epctx->next_xfer];
331e9406 1724 if (xfer->running_async || xfer->running_retry) {
62c6ae04
HM		 1725 break;
1726 }
1727 length = xhci_ring_chain_length(xhci, &epctx->ring);
1728 if (length < 0) {
62c6ae04
HM		 1729 break;
1730 } else if (length == 0) {
1731 break;
1732 }
62c6ae04
HM		 1733 if (xfer->trbs && xfer->trb_alloced < length) {
1734 xfer->trb_count = 0;
1735 xfer->trb_alloced = 0;
1736 g_free(xfer->trbs);
1737 xfer->trbs = NULL;
1738 }
1739 if (!xfer->trbs) {
1740 xfer->trbs = g_malloc(sizeof(XHCITRB) * length);
1741 xfer->trb_alloced = length;
1742 }
1743 xfer->trb_count = length;
1744
1745 for (i = 0; i < length; i++) {
1746 assert(xhci_ring_fetch(xhci, &epctx->ring, &xfer->trbs[i], NULL));
1747 }
1748 xfer->xhci = xhci;
1749 xfer->epid = epid;
1750 xfer->slotid = slotid;
1751
1752 if (epid == 1) {
1753 if (xhci_fire_ctl_transfer(xhci, xfer) >= 0) {
1754 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
36dfe324 1755 ep = xfer->packet.ep;
62c6ae04
HM		 1756 } else {
1757 fprintf(stderr, "xhci: error firing CTL transfer\n");
1758 }
1759 } else {
1760 if (xhci_fire_transfer(xhci, xfer, epctx) >= 0) {
1761 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
36dfe324 1762 ep = xfer->packet.ep;
62c6ae04 1763 } else {
3d139684
GH		 1764 if (!xfer->iso_xfer) {
1765 fprintf(stderr, "xhci: error firing data transfer\n");
1766 }
62c6ae04
HM		 1767 }
1768 }
1769
3c4866e0 1770 if (epctx->state == EP_HALTED) {
3c4866e0
GH		 1771 break;
1772 }
7c605a23
GH		 1773 if (xfer->running_retry) {
1774 DPRINTF("xhci: xfer nacked, stopping schedule\n");
1775 epctx->retry = xfer;
1776 break;
1777 }
62c6ae04 1778 }
36dfe324
HG		 1779 if (ep) {
1780 usb_device_flush_ep_queue(ep->dev, ep);
1781 }
62c6ae04
HM		 1782}
1783
1784static TRBCCode xhci_enable_slot(XHCIState *xhci, unsigned int slotid)
1785{
348f1037 1786 trace_usb_xhci_slot_enable(slotid);
62c6ae04 1787 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04 1788 xhci->slots[slotid-1].enabled = 1;
ccaf87a0 1789 xhci->slots[slotid-1].uport = NULL;
62c6ae04
HM		 1790 memset(xhci->slots[slotid-1].eps, 0, sizeof(XHCIEPContext*)*31);
1791
1792 return CC_SUCCESS;
1793}
1794
1795static TRBCCode xhci_disable_slot(XHCIState *xhci, unsigned int slotid)
1796{
1797 int i;
1798
348f1037 1799 trace_usb_xhci_slot_disable(slotid);
62c6ae04 1800 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04
HM		 1801
1802 for (i = 1; i <= 31; i++) {
1803 if (xhci->slots[slotid-1].eps[i-1]) {
1804 xhci_disable_ep(xhci, slotid, i);
1805 }
1806 }
1807
1808 xhci->slots[slotid-1].enabled = 0;
1809 return CC_SUCCESS;
1810}
1811
ccaf87a0
GH		 1812static USBPort *xhci_lookup_uport(XHCIState *xhci, uint32_t *slot_ctx)
1813{
1814 USBPort *uport;
1815 char path[32];
1816 int i, pos, port;
1817
1818 port = (slot_ctx[1]>>16) & 0xFF;
1819 port = xhci->ports[port-1].uport->index+1;
1820 pos = snprintf(path, sizeof(path), "%d", port);
1821 for (i = 0; i < 5; i++) {
1822 port = (slot_ctx[0] >> 4*i) & 0x0f;
1823 if (!port) {
1824 break;
1825 }
1826 pos += snprintf(path + pos, sizeof(path) - pos, ".%d", port);
1827 }
1828
1829 QTAILQ_FOREACH(uport, &xhci->bus.used, next) {
1830 if (strcmp(uport->path, path) == 0) {
1831 return uport;
1832 }
1833 }
1834 return NULL;
1835}
1836
62c6ae04
HM		 1837static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
1838 uint64_t pictx, bool bsr)
1839{
1840 XHCISlot *slot;
ccaf87a0 1841 USBPort *uport;
62c6ae04 1842 USBDevice *dev;
59a70ccd 1843 dma_addr_t ictx, octx, dcbaap;
62c6ae04
HM		 1844 uint64_t poctx;
1845 uint32_t ictl_ctx[2];
1846 uint32_t slot_ctx[4];
1847 uint32_t ep0_ctx[5];
62c6ae04
HM		 1848 int i;
1849 TRBCCode res;
1850
348f1037 1851 trace_usb_xhci_slot_address(slotid);
62c6ae04 1852 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04
HM		 1853
1854 dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
59a70ccd 1855 pci_dma_read(&xhci->pci_dev, dcbaap + 8*slotid, &poctx, sizeof(poctx));
62c6ae04
HM		 1856 ictx = xhci_mask64(pictx);
1857 octx = xhci_mask64(le64_to_cpu(poctx));
1858
59a70ccd
DG		 1859 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
1860 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
62c6ae04 1861
59a70ccd 1862 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
62c6ae04
HM		 1863
1864 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) {
1865 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
1866 ictl_ctx[0], ictl_ctx[1]);
1867 return CC_TRB_ERROR;
1868 }
1869
59a70ccd
DG		 1870 pci_dma_read(&xhci->pci_dev, ictx+32, slot_ctx, sizeof(slot_ctx));
1871 pci_dma_read(&xhci->pci_dev, ictx+64, ep0_ctx, sizeof(ep0_ctx));
62c6ae04
HM		 1872
1873 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
1874 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
1875
1876 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
1877 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
1878
ccaf87a0
GH		 1879 uport = xhci_lookup_uport(xhci, slot_ctx);
1880 if (uport == NULL) {
1881 fprintf(stderr, "xhci: port not found\n");
62c6ae04 1882 return CC_TRB_ERROR;
ccaf87a0
GH		 1883 }
1884
1885 dev = uport->dev;
1886 if (!dev) {
1887 fprintf(stderr, "xhci: port %s not connected\n", uport->path);
62c6ae04
HM		 1888 return CC_USB_TRANSACTION_ERROR;
1889 }
1890
1891 for (i = 0; i < MAXSLOTS; i++) {
ccaf87a0
GH		 1892 if (xhci->slots[i].uport == uport) {
1893 fprintf(stderr, "xhci: port %s already assigned to slot %d\n",
1894 uport->path, i+1);
62c6ae04
HM		 1895 return CC_TRB_ERROR;
1896 }
1897 }
1898
1899 slot = &xhci->slots[slotid-1];
ccaf87a0 1900 slot->uport = uport;
62c6ae04
HM		 1901 slot->ctx = octx;
1902
1903 if (bsr) {
1904 slot_ctx[3] = SLOT_DEFAULT << SLOT_STATE_SHIFT;
1905 } else {
1906 slot->devaddr = xhci->devaddr++;
1907 slot_ctx[3] = (SLOT_ADDRESSED << SLOT_STATE_SHIFT) | slot->devaddr;
1908 DPRINTF("xhci: device address is %d\n", slot->devaddr);
62aed765 1909 usb_device_handle_control(dev, NULL,
62c6ae04
HM		 1910 DeviceOutRequest | USB_REQ_SET_ADDRESS,
1911 slot->devaddr, 0, 0, NULL);
1912 }
1913
1914 res = xhci_enable_ep(xhci, slotid, 1, octx+32, ep0_ctx);
1915
1916 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
1917 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
1918 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
1919 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
1920
59a70ccd
DG		 1921 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
1922 pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
62c6ae04
HM		 1923
1924 return res;
1925}
1926
1927
1928static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
1929 uint64_t pictx, bool dc)
1930{
59a70ccd 1931 dma_addr_t ictx, octx;
62c6ae04
HM		 1932 uint32_t ictl_ctx[2];
1933 uint32_t slot_ctx[4];
1934 uint32_t islot_ctx[4];
1935 uint32_t ep_ctx[5];
1936 int i;
1937 TRBCCode res;
1938
348f1037 1939 trace_usb_xhci_slot_configure(slotid);
62c6ae04 1940 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04
HM		 1941
1942 ictx = xhci_mask64(pictx);
1943 octx = xhci->slots[slotid-1].ctx;
1944
59a70ccd
DG		 1945 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
1946 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
62c6ae04
HM		 1947
1948 if (dc) {
1949 for (i = 2; i <= 31; i++) {
1950 if (xhci->slots[slotid-1].eps[i-1]) {
1951 xhci_disable_ep(xhci, slotid, i);
1952 }
1953 }
1954
59a70ccd 1955 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 1956 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
1957 slot_ctx[3] |= SLOT_ADDRESSED << SLOT_STATE_SHIFT;
1958 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
1959 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
59a70ccd 1960 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 1961
1962 return CC_SUCCESS;
1963 }
1964
59a70ccd 1965 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
62c6ae04
HM		 1966
1967 if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) {
1968 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
1969 ictl_ctx[0], ictl_ctx[1]);
1970 return CC_TRB_ERROR;
1971 }
1972
59a70ccd
DG		 1973 pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx));
1974 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 1975
1976 if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) {
1977 fprintf(stderr, "xhci: invalid slot state %08x\n", slot_ctx[3]);
1978 return CC_CONTEXT_STATE_ERROR;
1979 }
1980
1981 for (i = 2; i <= 31; i++) {
1982 if (ictl_ctx[0] & (1<<i)) {
1983 xhci_disable_ep(xhci, slotid, i);
1984 }
1985 if (ictl_ctx[1] & (1<<i)) {
59a70ccd
DG		 1986 pci_dma_read(&xhci->pci_dev, ictx+32+(32*i), ep_ctx,
1987 sizeof(ep_ctx));
62c6ae04
HM		 1988 DPRINTF("xhci: input ep%d.%d context: %08x %08x %08x %08x %08x\n",
1989 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
1990 ep_ctx[3], ep_ctx[4]);
1991 xhci_disable_ep(xhci, slotid, i);
1992 res = xhci_enable_ep(xhci, slotid, i, octx+(32*i), ep_ctx);
1993 if (res != CC_SUCCESS) {
1994 return res;
1995 }
1996 DPRINTF("xhci: output ep%d.%d context: %08x %08x %08x %08x %08x\n",
1997 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
1998 ep_ctx[3], ep_ctx[4]);
59a70ccd 1999 pci_dma_write(&xhci->pci_dev, octx+(32*i), ep_ctx, sizeof(ep_ctx));
62c6ae04
HM		 2000 }
2001 }
2002
2003 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
2004 slot_ctx[3] |= SLOT_CONFIGURED << SLOT_STATE_SHIFT;
2005 slot_ctx[0] &= ~(SLOT_CONTEXT_ENTRIES_MASK << SLOT_CONTEXT_ENTRIES_SHIFT);
2006 slot_ctx[0] |= islot_ctx[0] & (SLOT_CONTEXT_ENTRIES_MASK <<
2007 SLOT_CONTEXT_ENTRIES_SHIFT);
2008 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2009 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2010
59a70ccd 2011 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 2012
2013 return CC_SUCCESS;
2014}
2015
2016
2017static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
2018 uint64_t pictx)
2019{
59a70ccd 2020 dma_addr_t ictx, octx;
62c6ae04
HM		 2021 uint32_t ictl_ctx[2];
2022 uint32_t iep0_ctx[5];
2023 uint32_t ep0_ctx[5];
2024 uint32_t islot_ctx[4];
2025 uint32_t slot_ctx[4];
2026
348f1037 2027 trace_usb_xhci_slot_evaluate(slotid);
62c6ae04 2028 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04
HM		 2029
2030 ictx = xhci_mask64(pictx);
2031 octx = xhci->slots[slotid-1].ctx;
2032
59a70ccd
DG		 2033 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
2034 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
62c6ae04 2035
59a70ccd 2036 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
62c6ae04
HM		 2037
2038 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) {
2039 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
2040 ictl_ctx[0], ictl_ctx[1]);
2041 return CC_TRB_ERROR;
2042 }
2043
2044 if (ictl_ctx[1] & 0x1) {
59a70ccd 2045 pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx));
62c6ae04
HM		 2046
2047 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
2048 islot_ctx[0], islot_ctx[1], islot_ctx[2], islot_ctx[3]);
2049
59a70ccd 2050 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 2051
2052 slot_ctx[1] &= ~0xFFFF; /* max exit latency */
2053 slot_ctx[1] |= islot_ctx[1] & 0xFFFF;
2054 slot_ctx[2] &= ~0xFF00000; /* interrupter target */
2055 slot_ctx[2] |= islot_ctx[2] & 0xFF000000;
2056
2057 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2058 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2059
59a70ccd 2060 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 2061 }
2062
2063 if (ictl_ctx[1] & 0x2) {
59a70ccd 2064 pci_dma_read(&xhci->pci_dev, ictx+64, iep0_ctx, sizeof(iep0_ctx));
62c6ae04
HM		 2065
2066 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
2067 iep0_ctx[0], iep0_ctx[1], iep0_ctx[2],
2068 iep0_ctx[3], iep0_ctx[4]);
2069
59a70ccd 2070 pci_dma_read(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
62c6ae04
HM		 2071
2072 ep0_ctx[1] &= ~0xFFFF0000; /* max packet size*/
2073 ep0_ctx[1] |= iep0_ctx[1] & 0xFFFF0000;
2074
2075 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
2076 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
2077
59a70ccd 2078 pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
62c6ae04
HM		 2079 }
2080
2081 return CC_SUCCESS;
2082}
2083
2084static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
2085{
2086 uint32_t slot_ctx[4];
59a70ccd 2087 dma_addr_t octx;
62c6ae04
HM		 2088 int i;
2089
348f1037 2090 trace_usb_xhci_slot_reset(slotid);
62c6ae04 2091 assert(slotid >= 1 && slotid <= MAXSLOTS);
62c6ae04
HM		 2092
2093 octx = xhci->slots[slotid-1].ctx;
2094
59a70ccd 2095 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
62c6ae04
HM		 2096
2097 for (i = 2; i <= 31; i++) {
2098 if (xhci->slots[slotid-1].eps[i-1]) {
2099 xhci_disable_ep(xhci, slotid, i);
2100 }
2101 }
2102
59a70ccd 2103 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 2104 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
2105 slot_ctx[3] |= SLOT_DEFAULT << SLOT_STATE_SHIFT;
2106 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2107 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
59a70ccd 2108 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
62c6ae04
HM		 2109
2110 return CC_SUCCESS;
2111}
2112
2113static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *trb)
2114{
2115 unsigned int slotid;
2116 slotid = (trb->control >> TRB_CR_SLOTID_SHIFT) & TRB_CR_SLOTID_MASK;
2117 if (slotid < 1 || slotid > MAXSLOTS) {
2118 fprintf(stderr, "xhci: bad slot id %d\n", slotid);
2119 event->ccode = CC_TRB_ERROR;
2120 return 0;
2121 } else if (!xhci->slots[slotid-1].enabled) {
2122 fprintf(stderr, "xhci: slot id %d not enabled\n", slotid);
2123 event->ccode = CC_SLOT_NOT_ENABLED_ERROR;
2124 return 0;
2125 }
2126 return slotid;
2127}
2128
2129static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
2130{
59a70ccd 2131 dma_addr_t ctx;
0846e635 2132 uint8_t bw_ctx[xhci->numports+1];
62c6ae04
HM		 2133
2134 DPRINTF("xhci_get_port_bandwidth()\n");
2135
2136 ctx = xhci_mask64(pctx);
2137
59a70ccd 2138 DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx);
62c6ae04
HM		 2139
2140 /* TODO: actually implement real values here */
2141 bw_ctx[0] = 0;
0846e635 2142 memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
59a70ccd 2143 pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx));
62c6ae04
HM		 2144
2145 return CC_SUCCESS;
2146}
2147
2148static uint32_t rotl(uint32_t v, unsigned count)
2149{
2150 count &= 31;
2151 return (v << count) | (v >> (32 - count));
2152}
2153
2154
2155static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo)
2156{
2157 uint32_t val;
2158 val = rotl(lo - 0x49434878, 32 - ((hi>>8) & 0x1F));
2159 val += rotl(lo + 0x49434878, hi & 0x1F);
2160 val -= rotl(hi ^ 0x49434878, (lo >> 16) & 0x1F);
2161 return ~val;
2162}
2163
59a70ccd 2164static void xhci_via_challenge(XHCIState *xhci, uint64_t addr)
62c6ae04
HM		 2165{
2166 uint32_t buf[8];
2167 uint32_t obuf[8];
59a70ccd 2168 dma_addr_t paddr = xhci_mask64(addr);
62c6ae04 2169
59a70ccd 2170 pci_dma_read(&xhci->pci_dev, paddr, &buf, 32);
62c6ae04
HM		 2171
2172 memcpy(obuf, buf, sizeof(obuf));
2173
2174 if ((buf[0] & 0xff) == 2) {
2175 obuf[0] = 0x49932000 + 0x54dc200 * buf[2] + 0x7429b578 * buf[3];
2176 obuf[0] |= (buf[2] * buf[3]) & 0xff;
2177 obuf[1] = 0x0132bb37 + 0xe89 * buf[2] + 0xf09 * buf[3];
2178 obuf[2] = 0x0066c2e9 + 0x2091 * buf[2] + 0x19bd * buf[3];
2179 obuf[3] = 0xd5281342 + 0x2cc9691 * buf[2] + 0x2367662 * buf[3];
2180 obuf[4] = 0x0123c75c + 0x1595 * buf[2] + 0x19ec * buf[3];
2181 obuf[5] = 0x00f695de + 0x26fd * buf[2] + 0x3e9 * buf[3];
2182 obuf[6] = obuf[2] ^ obuf[3] ^ 0x29472956;
2183 obuf[7] = obuf[2] ^ obuf[3] ^ 0x65866593;
2184 }
2185
59a70ccd 2186 pci_dma_write(&xhci->pci_dev, paddr, &obuf, 32);
62c6ae04
HM		 2187}
2188
2189static void xhci_process_commands(XHCIState *xhci)
2190{
2191 XHCITRB trb;
2192 TRBType type;
2193 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS};
59a70ccd 2194 dma_addr_t addr;
62c6ae04
HM		 2195 unsigned int i, slotid = 0;
2196
2197 DPRINTF("xhci_process_commands()\n");
2198 if (!xhci_running(xhci)) {
2199 DPRINTF("xhci_process_commands() called while xHC stopped or paused\n");
2200 return;
2201 }
2202
2203 xhci->crcr_low |= CRCR_CRR;
2204
2205 while ((type = xhci_ring_fetch(xhci, &xhci->cmd_ring, &trb, &addr))) {
2206 event.ptr = addr;
2207 switch (type) {
2208 case CR_ENABLE_SLOT:
2209 for (i = 0; i < MAXSLOTS; i++) {
2210 if (!xhci->slots[i].enabled) {
2211 break;
2212 }
2213 }
2214 if (i >= MAXSLOTS) {
2215 fprintf(stderr, "xhci: no device slots available\n");
2216 event.ccode = CC_NO_SLOTS_ERROR;
2217 } else {
2218 slotid = i+1;
2219 event.ccode = xhci_enable_slot(xhci, slotid);
2220 }
2221 break;
2222 case CR_DISABLE_SLOT:
2223 slotid = xhci_get_slot(xhci, &event, &trb);
2224 if (slotid) {
2225 event.ccode = xhci_disable_slot(xhci, slotid);
2226 }
2227 break;
2228 case CR_ADDRESS_DEVICE:
2229 slotid = xhci_get_slot(xhci, &event, &trb);
2230 if (slotid) {
2231 event.ccode = xhci_address_slot(xhci, slotid, trb.parameter,
2232 trb.control & TRB_CR_BSR);
2233 }
2234 break;
2235 case CR_CONFIGURE_ENDPOINT:
2236 slotid = xhci_get_slot(xhci, &event, &trb);
2237 if (slotid) {
2238 event.ccode = xhci_configure_slot(xhci, slotid, trb.parameter,
2239 trb.control & TRB_CR_DC);
2240 }
2241 break;
2242 case CR_EVALUATE_CONTEXT:
2243 slotid = xhci_get_slot(xhci, &event, &trb);
2244 if (slotid) {
2245 event.ccode = xhci_evaluate_slot(xhci, slotid, trb.parameter);
2246 }
2247 break;
2248 case CR_STOP_ENDPOINT:
2249 slotid = xhci_get_slot(xhci, &event, &trb);
2250 if (slotid) {
2251 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2252 & TRB_CR_EPID_MASK;
2253 event.ccode = xhci_stop_ep(xhci, slotid, epid);
2254 }
2255 break;
2256 case CR_RESET_ENDPOINT:
2257 slotid = xhci_get_slot(xhci, &event, &trb);
2258 if (slotid) {
2259 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2260 & TRB_CR_EPID_MASK;
2261 event.ccode = xhci_reset_ep(xhci, slotid, epid);
2262 }
2263 break;
2264 case CR_SET_TR_DEQUEUE:
2265 slotid = xhci_get_slot(xhci, &event, &trb);
2266 if (slotid) {
2267 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2268 & TRB_CR_EPID_MASK;
2269 event.ccode = xhci_set_ep_dequeue(xhci, slotid, epid,
2270 trb.parameter);
2271 }
2272 break;
2273 case CR_RESET_DEVICE:
2274 slotid = xhci_get_slot(xhci, &event, &trb);
2275 if (slotid) {
2276 event.ccode = xhci_reset_slot(xhci, slotid);
2277 }
2278 break;
2279 case CR_GET_PORT_BANDWIDTH:
2280 event.ccode = xhci_get_port_bandwidth(xhci, trb.parameter);
2281 break;
2282 case CR_VENDOR_VIA_CHALLENGE_RESPONSE:
59a70ccd 2283 xhci_via_challenge(xhci, trb.parameter);
62c6ae04
HM		 2284 break;
2285 case CR_VENDOR_NEC_FIRMWARE_REVISION:
2286 event.type = 48; /* NEC reply */
2287 event.length = 0x3025;
2288 break;
2289 case CR_VENDOR_NEC_CHALLENGE_RESPONSE:
2290 {
2291 uint32_t chi = trb.parameter >> 32;
2292 uint32_t clo = trb.parameter;
2293 uint32_t val = xhci_nec_challenge(chi, clo);
2294 event.length = val & 0xFFFF;
2295 event.epid = val >> 16;
2296 slotid = val >> 24;
2297 event.type = 48; /* NEC reply */
2298 }
2299 break;
2300 default:
2301 fprintf(stderr, "xhci: unimplemented command %d\n", type);
2302 event.ccode = CC_TRB_ERROR;
2303 break;
2304 }
2305 event.slotid = slotid;
2d1de850 2306 xhci_event(xhci, &event, 0);
62c6ae04
HM		 2307 }
2308}
2309
2310static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach)
2311{
62c6ae04 2312 port->portsc = PORTSC_PP;
0846e635
GH		 2313 if (port->uport->dev && port->uport->dev->attached && !is_detach &&
2314 (1 << port->uport->dev->speed) & port->speedmask) {
62c6ae04 2315 port->portsc |= PORTSC_CCS;
0846e635 2316 switch (port->uport->dev->speed) {
62c6ae04
HM		 2317 case USB_SPEED_LOW:
2318 port->portsc |= PORTSC_SPEED_LOW;
2319 break;
2320 case USB_SPEED_FULL:
2321 port->portsc |= PORTSC_SPEED_FULL;
2322 break;
2323 case USB_SPEED_HIGH:
2324 port->portsc |= PORTSC_SPEED_HIGH;
2325 break;
0846e635
GH		 2326 case USB_SPEED_SUPER:
2327 port->portsc |= PORTSC_SPEED_SUPER;
2328 break;
62c6ae04
HM		 2329 }
2330 }
2331
2332 if (xhci_running(xhci)) {
2333 port->portsc |= PORTSC_CSC;
0846e635
GH		 2334 XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
2335 port->portnr << 24};
2d1de850 2336 xhci_event(xhci, &ev, 0);
0846e635 2337 DPRINTF("xhci: port change event for port %d\n", port->portnr);
62c6ae04
HM		 2338 }
2339}
2340
64619739 2341static void xhci_reset(DeviceState *dev)
62c6ae04 2342{
64619739 2343 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev.qdev, dev);
62c6ae04
HM		 2344 int i;
2345
2d754a10 2346 trace_usb_xhci_reset();
62c6ae04
HM		 2347 if (!(xhci->usbsts & USBSTS_HCH)) {
2348 fprintf(stderr, "xhci: reset while running!\n");
2349 }
2350
2351 xhci->usbcmd = 0;
2352 xhci->usbsts = USBSTS_HCH;
2353 xhci->dnctrl = 0;
2354 xhci->crcr_low = 0;
2355 xhci->crcr_high = 0;
2356 xhci->dcbaap_low = 0;
2357 xhci->dcbaap_high = 0;
2358 xhci->config = 0;
2359 xhci->devaddr = 2;
2360
2361 for (i = 0; i < MAXSLOTS; i++) {
2362 xhci_disable_slot(xhci, i+1);
2363 }
2364
0846e635 2365 for (i = 0; i < xhci->numports; i++) {
62c6ae04
HM		 2366 xhci_update_port(xhci, xhci->ports + i, 0);
2367 }
2368
962d11e1
GH		 2369 for (i = 0; i < MAXINTRS; i++) {
2370 xhci->intr[i].iman = 0;
2371 xhci->intr[i].imod = 0;
2372 xhci->intr[i].erstsz = 0;
2373 xhci->intr[i].erstba_low = 0;
2374 xhci->intr[i].erstba_high = 0;
2375 xhci->intr[i].erdp_low = 0;
2376 xhci->intr[i].erdp_high = 0;
2377 xhci->intr[i].msix_used = 0;
62c6ae04 2378
962d11e1
GH		 2379 xhci->intr[i].er_ep_idx = 0;
2380 xhci->intr[i].er_pcs = 1;
2381 xhci->intr[i].er_full = 0;
2382 xhci->intr[i].ev_buffer_put = 0;
2383 xhci->intr[i].ev_buffer_get = 0;
2384 }
01546fa6
GH		 2385
2386 xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
2387 xhci_mfwrap_update(xhci);
62c6ae04
HM		 2388}
2389
a8170e5e 2390static uint64_t xhci_cap_read(void *ptr, hwaddr reg, unsigned size)
62c6ae04 2391{
1b067564 2392 XHCIState *xhci = ptr;
2d754a10 2393 uint32_t ret;
62c6ae04
HM		 2394
2395 switch (reg) {
2396 case 0x00: /* HCIVERSION, CAPLENGTH */
2d754a10
GH		 2397 ret = 0x01000000 | LEN_CAP;
2398 break;
62c6ae04 2399 case 0x04: /* HCSPARAMS 1 */
0846e635
GH		 2400 ret = ((xhci->numports_2+xhci->numports_3)<<24)
2401 | (MAXINTRS<<8) | MAXSLOTS;
2d754a10 2402 break;
62c6ae04 2403 case 0x08: /* HCSPARAMS 2 */
2d754a10
GH		 2404 ret = 0x0000000f;
2405 break;
62c6ae04 2406 case 0x0c: /* HCSPARAMS 3 */
2d754a10
GH		 2407 ret = 0x00000000;
2408 break;
62c6ae04 2409 case 0x10: /* HCCPARAMS */
2d754a10
GH		 2410 if (sizeof(dma_addr_t) == 4) {
2411 ret = 0x00081000;
2412 } else {
2413 ret = 0x00081001;
2414 }
2415 break;
62c6ae04 2416 case 0x14: /* DBOFF */
2d754a10
GH		 2417 ret = OFF_DOORBELL;
2418 break;
62c6ae04 2419 case 0x18: /* RTSOFF */
2d754a10
GH		 2420 ret = OFF_RUNTIME;
2421 break;
62c6ae04
HM		 2422
2423 /* extended capabilities */
2424 case 0x20: /* Supported Protocol:00 */
2d754a10
GH		 2425 ret = 0x02000402; /* USB 2.0 */
2426 break;
62c6ae04 2427 case 0x24: /* Supported Protocol:04 */
2d754a10
GH		 2428 ret = 0x20425455; /* "USB " */
2429 break;
62c6ae04 2430 case 0x28: /* Supported Protocol:08 */
0846e635 2431 ret = 0x00000001 | (xhci->numports_2<<8);
2d754a10 2432 break;
62c6ae04 2433 case 0x2c: /* Supported Protocol:0c */
2d754a10
GH		 2434 ret = 0x00000000; /* reserved */
2435 break;
62c6ae04 2436 case 0x30: /* Supported Protocol:00 */
2d754a10
GH		 2437 ret = 0x03000002; /* USB 3.0 */
2438 break;
62c6ae04 2439 case 0x34: /* Supported Protocol:04 */
2d754a10
GH		 2440 ret = 0x20425455; /* "USB " */
2441 break;
62c6ae04 2442 case 0x38: /* Supported Protocol:08 */
0846e635 2443 ret = 0x00000000 | (xhci->numports_2+1) | (xhci->numports_3<<8);
2d754a10 2444 break;
62c6ae04 2445 case 0x3c: /* Supported Protocol:0c */
2d754a10
GH		 2446 ret = 0x00000000; /* reserved */
2447 break;
62c6ae04 2448 default:
1b067564 2449 fprintf(stderr, "xhci_cap_read: reg %d unimplemented\n", (int)reg);
2d754a10 2450 ret = 0;
62c6ae04 2451 }
2d754a10
GH		 2452
2453 trace_usb_xhci_cap_read(reg, ret);
2454 return ret;
62c6ae04
HM		 2455}
2456
a8170e5e 2457static uint64_t xhci_port_read(void *ptr, hwaddr reg, unsigned size)
62c6ae04 2458{
1d8a4e69 2459 XHCIPort *port = ptr;
2d754a10
GH		 2460 uint32_t ret;
2461
1d8a4e69 2462 switch (reg) {
62c6ae04 2463 case 0x00: /* PORTSC */
1d8a4e69 2464 ret = port->portsc;
2d754a10 2465 break;
62c6ae04
HM		 2466 case 0x04: /* PORTPMSC */
2467 case 0x08: /* PORTLI */
2d754a10
GH		 2468 ret = 0;
2469 break;
62c6ae04
HM		 2470 case 0x0c: /* reserved */
2471 default:
2472 fprintf(stderr, "xhci_port_read (port %d): reg 0x%x unimplemented\n",
1d8a4e69 2473 port->portnr, (uint32_t)reg);
2d754a10 2474 ret = 0;
62c6ae04 2475 }
2d754a10 2476
1d8a4e69 2477 trace_usb_xhci_port_read(port->portnr, reg, ret);
2d754a10 2478 return ret;
62c6ae04
HM		 2479}
2480
a8170e5e 2481static void xhci_port_write(void *ptr, hwaddr reg,
1d8a4e69 2482 uint64_t val, unsigned size)
62c6ae04 2483{
1d8a4e69 2484 XHCIPort *port = ptr;
62c6ae04
HM		 2485 uint32_t portsc;
2486
1d8a4e69 2487 trace_usb_xhci_port_write(port->portnr, reg, val);
2d754a10 2488
1d8a4e69 2489 switch (reg) {
62c6ae04 2490 case 0x00: /* PORTSC */
1d8a4e69 2491 portsc = port->portsc;
62c6ae04
HM		 2492 /* write-1-to-clear bits*/
2493 portsc &= ~(val & (PORTSC_CSC|PORTSC_PEC|PORTSC_WRC|PORTSC_OCC|
2494 PORTSC_PRC|PORTSC_PLC|PORTSC_CEC));
2495 if (val & PORTSC_LWS) {
2496 /* overwrite PLS only when LWS=1 */
2497 portsc &= ~(PORTSC_PLS_MASK << PORTSC_PLS_SHIFT);
2498 portsc |= val & (PORTSC_PLS_MASK << PORTSC_PLS_SHIFT);
2499 }
2500 /* read/write bits */
2501 portsc &= ~(PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE);
2502 portsc |= (val & (PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE));
2503 /* write-1-to-start bits */
2504 if (val & PORTSC_PR) {
2505 DPRINTF("xhci: port %d reset\n", port);
1d8a4e69 2506 usb_device_reset(port->uport->dev);
62c6ae04
HM		 2507 portsc |= PORTSC_PRC | PORTSC_PED;
2508 }
1d8a4e69 2509 port->portsc = portsc;
62c6ae04
HM		 2510 break;
2511 case 0x04: /* PORTPMSC */
2512 case 0x08: /* PORTLI */
2513 default:
2514 fprintf(stderr, "xhci_port_write (port %d): reg 0x%x unimplemented\n",
1d8a4e69 2515 port->portnr, (uint32_t)reg);
62c6ae04
HM		 2516 }
2517}
2518
a8170e5e 2519static uint64_t xhci_oper_read(void *ptr, hwaddr reg, unsigned size)
62c6ae04 2520{
1b067564 2521 XHCIState *xhci = ptr;
2d754a10 2522 uint32_t ret;
62c6ae04 2523
62c6ae04
HM		 2524 switch (reg) {
2525 case 0x00: /* USBCMD */
2d754a10
GH		 2526 ret = xhci->usbcmd;
2527 break;
62c6ae04 2528 case 0x04: /* USBSTS */
2d754a10
GH		 2529 ret = xhci->usbsts;
2530 break;
62c6ae04 2531 case 0x08: /* PAGESIZE */
2d754a10
GH		 2532 ret = 1; /* 4KiB */
2533 break;
62c6ae04 2534 case 0x14: /* DNCTRL */
2d754a10
GH		 2535 ret = xhci->dnctrl;
2536 break;
62c6ae04 2537 case 0x18: /* CRCR low */
2d754a10
GH		 2538 ret = xhci->crcr_low & ~0xe;
2539 break;
62c6ae04 2540 case 0x1c: /* CRCR high */
2d754a10
GH		 2541 ret = xhci->crcr_high;
2542 break;
62c6ae04 2543 case 0x30: /* DCBAAP low */
2d754a10
GH		 2544 ret = xhci->dcbaap_low;
2545 break;
62c6ae04 2546 case 0x34: /* DCBAAP high */
2d754a10
GH		 2547 ret = xhci->dcbaap_high;
2548 break;
62c6ae04 2549 case 0x38: /* CONFIG */
2d754a10
GH		 2550 ret = xhci->config;
2551 break;
62c6ae04 2552 default:
1b067564 2553 fprintf(stderr, "xhci_oper_read: reg 0x%x unimplemented\n", (int)reg);
2d754a10 2554 ret = 0;
62c6ae04 2555 }
2d754a10
GH		 2556
2557 trace_usb_xhci_oper_read(reg, ret);
2558 return ret;
62c6ae04
HM		 2559}
2560
a8170e5e 2561static void xhci_oper_write(void *ptr, hwaddr reg,
1b067564 2562 uint64_t val, unsigned size)
62c6ae04 2563{
1b067564
GH		 2564 XHCIState *xhci = ptr;
2565
2d754a10
GH		 2566 trace_usb_xhci_oper_write(reg, val);
2567
62c6ae04
HM		 2568 switch (reg) {
2569 case 0x00: /* USBCMD */
2570 if ((val & USBCMD_RS) && !(xhci->usbcmd & USBCMD_RS)) {
2571 xhci_run(xhci);
2572 } else if (!(val & USBCMD_RS) && (xhci->usbcmd & USBCMD_RS)) {
2573 xhci_stop(xhci);
2574 }
2575 xhci->usbcmd = val & 0xc0f;
01546fa6 2576 xhci_mfwrap_update(xhci);
62c6ae04 2577 if (val & USBCMD_HCRST) {
64619739 2578 xhci_reset(&xhci->pci_dev.qdev);
62c6ae04 2579 }
4c4abe7c 2580 xhci_intx_update(xhci);
62c6ae04
HM		 2581 break;
2582
2583 case 0x04: /* USBSTS */
2584 /* these bits are write-1-to-clear */
2585 xhci->usbsts &= ~(val & (USBSTS_HSE|USBSTS_EINT|USBSTS_PCD|USBSTS_SRE));
4c4abe7c 2586 xhci_intx_update(xhci);
62c6ae04
HM		 2587 break;
2588
2589 case 0x14: /* DNCTRL */
2590 xhci->dnctrl = val & 0xffff;
2591 break;
2592 case 0x18: /* CRCR low */
2593 xhci->crcr_low = (val & 0xffffffcf) | (xhci->crcr_low & CRCR_CRR);
2594 break;
2595 case 0x1c: /* CRCR high */
2596 xhci->crcr_high = val;
2597 if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) {
2598 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED};
2599 xhci->crcr_low &= ~CRCR_CRR;
2d1de850 2600 xhci_event(xhci, &event, 0);
62c6ae04
HM		 2601 DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
2602 } else {
59a70ccd 2603 dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
62c6ae04
HM		 2604 xhci_ring_init(xhci, &xhci->cmd_ring, base);
2605 }
2606 xhci->crcr_low &= ~(CRCR_CA | CRCR_CS);
2607 break;
2608 case 0x30: /* DCBAAP low */
2609 xhci->dcbaap_low = val & 0xffffffc0;
2610 break;
2611 case 0x34: /* DCBAAP high */
2612 xhci->dcbaap_high = val;
2613 break;
2614 case 0x38: /* CONFIG */
2615 xhci->config = val & 0xff;
2616 break;
2617 default:
1b067564 2618 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", (int)reg);
62c6ae04
HM		 2619 }
2620}
2621
a8170e5e 2622static uint64_t xhci_runtime_read(void *ptr, hwaddr reg,
1b067564 2623 unsigned size)
62c6ae04 2624{
1b067564 2625 XHCIState *xhci = ptr;
43d9d604 2626 uint32_t ret = 0;
62c6ae04 2627
43d9d604
GH		 2628 if (reg < 0x20) {
2629 switch (reg) {
2630 case 0x00: /* MFINDEX */
2631 ret = xhci_mfindex_get(xhci) & 0x3fff;
2632 break;
2633 default:
1b067564
GH		 2634 fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n",
2635 (int)reg);
43d9d604
GH		 2636 break;
2637 }
2638 } else {
2639 int v = (reg - 0x20) / 0x20;
2640 XHCIInterrupter *intr = &xhci->intr[v];
2641 switch (reg & 0x1f) {
2642 case 0x00: /* IMAN */
2643 ret = intr->iman;
2644 break;
2645 case 0x04: /* IMOD */
2646 ret = intr->imod;
2647 break;
2648 case 0x08: /* ERSTSZ */
2649 ret = intr->erstsz;
2650 break;
2651 case 0x10: /* ERSTBA low */
2652 ret = intr->erstba_low;
2653 break;
2654 case 0x14: /* ERSTBA high */
2655 ret = intr->erstba_high;
2656 break;
2657 case 0x18: /* ERDP low */
2658 ret = intr->erdp_low;
2659 break;
2660 case 0x1c: /* ERDP high */
2661 ret = intr->erdp_high;
2662 break;
2663 }
62c6ae04 2664 }
2d754a10
GH		 2665
2666 trace_usb_xhci_runtime_read(reg, ret);
2667 return ret;
62c6ae04
HM		 2668}
2669
a8170e5e 2670static void xhci_runtime_write(void *ptr, hwaddr reg,
1b067564 2671 uint64_t val, unsigned size)
62c6ae04 2672{
1b067564 2673 XHCIState *xhci = ptr;
43d9d604
GH		 2674 int v = (reg - 0x20) / 0x20;
2675 XHCIInterrupter *intr = &xhci->intr[v];
8e9f18b6 2676 trace_usb_xhci_runtime_write(reg, val);
62c6ae04 2677
43d9d604 2678 if (reg < 0x20) {
1b067564 2679 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", (int)reg);
43d9d604
GH		 2680 return;
2681 }
2682
2683 switch (reg & 0x1f) {
2684 case 0x00: /* IMAN */
62c6ae04 2685 if (val & IMAN_IP) {
962d11e1 2686 intr->iman &= ~IMAN_IP;
62c6ae04 2687 }
962d11e1
GH		 2688 intr->iman &= ~IMAN_IE;
2689 intr->iman |= val & IMAN_IE;
43d9d604
GH		 2690 if (v == 0) {
2691 xhci_intx_update(xhci);
2692 }
2693 xhci_msix_update(xhci, v);
62c6ae04 2694 break;
43d9d604 2695 case 0x04: /* IMOD */
962d11e1 2696 intr->imod = val;
62c6ae04 2697 break;
43d9d604 2698 case 0x08: /* ERSTSZ */
962d11e1 2699 intr->erstsz = val & 0xffff;
62c6ae04 2700 break;
43d9d604 2701 case 0x10: /* ERSTBA low */
62c6ae04 2702 /* XXX NEC driver bug: it doesn't align this to 64 bytes
962d11e1
GH		 2703 intr->erstba_low = val & 0xffffffc0; */
2704 intr->erstba_low = val & 0xfffffff0;
62c6ae04 2705 break;
43d9d604 2706 case 0x14: /* ERSTBA high */
962d11e1 2707 intr->erstba_high = val;
43d9d604 2708 xhci_er_reset(xhci, v);
62c6ae04 2709 break;
43d9d604 2710 case 0x18: /* ERDP low */
62c6ae04 2711 if (val & ERDP_EHB) {
962d11e1 2712 intr->erdp_low &= ~ERDP_EHB;
62c6ae04 2713 }
962d11e1 2714 intr->erdp_low = (val & ~ERDP_EHB) | (intr->erdp_low & ERDP_EHB);
62c6ae04 2715 break;
43d9d604 2716 case 0x1c: /* ERDP high */
962d11e1 2717 intr->erdp_high = val;
43d9d604 2718 xhci_events_update(xhci, v);
62c6ae04
HM		 2719 break;
2720 default:
1b067564
GH		 2721 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n",
2722 (int)reg);
62c6ae04
HM		 2723 }
2724}
2725
a8170e5e 2726static uint64_t xhci_doorbell_read(void *ptr, hwaddr reg,
1b067564 2727 unsigned size)
62c6ae04 2728{
62c6ae04 2729 /* doorbells always read as 0 */
2d754a10 2730 trace_usb_xhci_doorbell_read(reg, 0);
62c6ae04
HM		 2731 return 0;
2732}
2733
a8170e5e 2734static void xhci_doorbell_write(void *ptr, hwaddr reg,
1b067564 2735 uint64_t val, unsigned size)
62c6ae04 2736{
1b067564
GH		 2737 XHCIState *xhci = ptr;
2738
2d754a10 2739 trace_usb_xhci_doorbell_write(reg, val);
62c6ae04
HM		 2740
2741 if (!xhci_running(xhci)) {
2742 fprintf(stderr, "xhci: wrote doorbell while xHC stopped or paused\n");
2743 return;
2744 }
2745
2746 reg >>= 2;
2747
2748 if (reg == 0) {
2749 if (val == 0) {
2750 xhci_process_commands(xhci);
2751 } else {
1b067564
GH		 2752 fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n",
2753 (uint32_t)val);
62c6ae04
HM		 2754 }
2755 } else {
2756 if (reg > MAXSLOTS) {
1b067564 2757 fprintf(stderr, "xhci: bad doorbell %d\n", (int)reg);
62c6ae04 2758 } else if (val > 31) {
1b067564
GH		 2759 fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n",
2760 (int)reg, (uint32_t)val);
62c6ae04
HM		 2761 } else {
2762 xhci_kick_ep(xhci, reg, val);
2763 }
2764 }
2765}
2766
1b067564
GH		 2767static const MemoryRegionOps xhci_cap_ops = {
2768 .read = xhci_cap_read,
6ee021d4 2769 .valid.min_access_size = 1,
1b067564 2770 .valid.max_access_size = 4,
6ee021d4
GH		 2771 .impl.min_access_size = 4,
2772 .impl.max_access_size = 4,
1b067564
GH		 2773 .endianness = DEVICE_LITTLE_ENDIAN,
2774};
62c6ae04 2775
1b067564
GH		 2776static const MemoryRegionOps xhci_oper_ops = {
2777 .read = xhci_oper_read,
2778 .write = xhci_oper_write,
2779 .valid.min_access_size = 4,
2780 .valid.max_access_size = 4,
2781 .endianness = DEVICE_LITTLE_ENDIAN,
2782};
62c6ae04 2783
1d8a4e69
GH		 2784static const MemoryRegionOps xhci_port_ops = {
2785 .read = xhci_port_read,
2786 .write = xhci_port_write,
2787 .valid.min_access_size = 4,
2788 .valid.max_access_size = 4,
2789 .endianness = DEVICE_LITTLE_ENDIAN,
2790};
2791
1b067564
GH		 2792static const MemoryRegionOps xhci_runtime_ops = {
2793 .read = xhci_runtime_read,
2794 .write = xhci_runtime_write,
2795 .valid.min_access_size = 4,
2796 .valid.max_access_size = 4,
2797 .endianness = DEVICE_LITTLE_ENDIAN,
2798};
62c6ae04 2799
1b067564
GH		 2800static const MemoryRegionOps xhci_doorbell_ops = {
2801 .read = xhci_doorbell_read,
2802 .write = xhci_doorbell_write,
62c6ae04
HM		 2803 .valid.min_access_size = 4,
2804 .valid.max_access_size = 4,
2805 .endianness = DEVICE_LITTLE_ENDIAN,
2806};
2807
2808static void xhci_attach(USBPort *usbport)
2809{
2810 XHCIState *xhci = usbport->opaque;
0846e635 2811 XHCIPort *port = xhci_lookup_port(xhci, usbport);
62c6ae04
HM		 2812
2813 xhci_update_port(xhci, port, 0);
2814}
2815
2816static void xhci_detach(USBPort *usbport)
2817{
2818 XHCIState *xhci = usbport->opaque;
0846e635 2819 XHCIPort *port = xhci_lookup_port(xhci, usbport);
62c6ae04
HM		 2820
2821 xhci_update_port(xhci, port, 1);
2822}
2823
8c735e43
GH		 2824static void xhci_wakeup(USBPort *usbport)
2825{
2826 XHCIState *xhci = usbport->opaque;
0846e635
GH		 2827 XHCIPort *port = xhci_lookup_port(xhci, usbport);
2828 XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
2829 port->portnr << 24};
8c735e43
GH		 2830 uint32_t pls;
2831
2832 pls = (port->portsc >> PORTSC_PLS_SHIFT) & PORTSC_PLS_MASK;
2833 if (pls != 3) {
2834 return;
2835 }
2836 port->portsc |= 0xf << PORTSC_PLS_SHIFT;
2837 if (port->portsc & PORTSC_PLC) {
2838 return;
2839 }
2840 port->portsc |= PORTSC_PLC;
2d1de850 2841 xhci_event(xhci, &ev, 0);
8c735e43
GH		 2842}
2843
62c6ae04
HM		 2844static void xhci_complete(USBPort *port, USBPacket *packet)
2845{
2846 XHCITransfer *xfer = container_of(packet, XHCITransfer, packet);
2847
0cae7b1a
HG		 2848 if (packet->result == USB_RET_REMOVE_FROM_QUEUE) {
2849 xhci_ep_nuke_one_xfer(xfer);
2850 return;
2851 }
62c6ae04
HM		 2852 xhci_complete_packet(xfer, packet->result);
2853 xhci_kick_ep(xfer->xhci, xfer->slotid, xfer->epid);
2854}
2855
ccaf87a0 2856static void xhci_child_detach(USBPort *uport, USBDevice *child)
62c6ae04 2857{
ccaf87a0
GH		 2858 USBBus *bus = usb_bus_from_device(child);
2859 XHCIState *xhci = container_of(bus, XHCIState, bus);
2860 int i;
2861
2862 for (i = 0; i < MAXSLOTS; i++) {
2863 if (xhci->slots[i].uport == uport) {
2864 xhci->slots[i].uport = NULL;
2865 }
2866 }
62c6ae04
HM		 2867}
2868
1d8a4e69 2869static USBPortOps xhci_uport_ops = {
62c6ae04
HM		 2870 .attach = xhci_attach,
2871 .detach = xhci_detach,
8c735e43 2872 .wakeup = xhci_wakeup,
62c6ae04
HM		 2873 .complete = xhci_complete,
2874 .child_detach = xhci_child_detach,
2875};
2876
7c605a23
GH		 2877static int xhci_find_slotid(XHCIState *xhci, USBDevice *dev)
2878{
2879 XHCISlot *slot;
2880 int slotid;
2881
2882 for (slotid = 1; slotid <= MAXSLOTS; slotid++) {
2883 slot = &xhci->slots[slotid-1];
2884 if (slot->devaddr == dev->addr) {
2885 return slotid;
2886 }
2887 }
2888 return 0;
2889}
2890
2891static int xhci_find_epid(USBEndpoint *ep)
2892{
2893 if (ep->nr == 0) {
2894 return 1;
2895 }
2896 if (ep->pid == USB_TOKEN_IN) {
2897 return ep->nr * 2 + 1;
2898 } else {
2899 return ep->nr * 2;
2900 }
2901}
2902
2903static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep)
2904{
2905 XHCIState *xhci = container_of(bus, XHCIState, bus);
2906 int slotid;
2907
2908 DPRINTF("%s\n", __func__);
2909 slotid = xhci_find_slotid(xhci, ep->dev);
2910 if (slotid == 0 || !xhci->slots[slotid-1].enabled) {
2911 DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr);
2912 return;
2913 }
2914 xhci_kick_ep(xhci, slotid, xhci_find_epid(ep));
2915}
2916
62c6ae04 2917static USBBusOps xhci_bus_ops = {
7c605a23 2918 .wakeup_endpoint = xhci_wakeup_endpoint,
62c6ae04
HM		 2919};
2920
2921static void usb_xhci_init(XHCIState *xhci, DeviceState *dev)
2922{
0846e635
GH		 2923 XHCIPort *port;
2924 int i, usbports, speedmask;
62c6ae04
HM		 2925
2926 xhci->usbsts = USBSTS_HCH;
2927
0846e635
GH		 2928 if (xhci->numports_2 > MAXPORTS_2) {
2929 xhci->numports_2 = MAXPORTS_2;
2930 }
2931 if (xhci->numports_3 > MAXPORTS_3) {
2932 xhci->numports_3 = MAXPORTS_3;
2933 }
2934 usbports = MAX(xhci->numports_2, xhci->numports_3);
2935 xhci->numports = xhci->numports_2 + xhci->numports_3;
2936
62c6ae04
HM		 2937 usb_bus_new(&xhci->bus, &xhci_bus_ops, &xhci->pci_dev.qdev);
2938
0846e635
GH		 2939 for (i = 0; i < usbports; i++) {
2940 speedmask = 0;
2941 if (i < xhci->numports_2) {
2942 port = &xhci->ports[i];
2943 port->portnr = i + 1;
2944 port->uport = &xhci->uports[i];
2945 port->speedmask =
2946 USB_SPEED_MASK_LOW |
2947 USB_SPEED_MASK_FULL |
2948 USB_SPEED_MASK_HIGH;
1d8a4e69 2949 snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1);
0846e635
GH		 2950 speedmask |= port->speedmask;
2951 }
2952 if (i < xhci->numports_3) {
2953 port = &xhci->ports[i + xhci->numports_2];
2954 port->portnr = i + 1 + xhci->numports_2;
2955 port->uport = &xhci->uports[i];
2956 port->speedmask = USB_SPEED_MASK_SUPER;
1d8a4e69 2957 snprintf(port->name, sizeof(port->name), "usb3 port #%d", i+1);
0846e635
GH		 2958 speedmask |= port->speedmask;
2959 }
2960 usb_register_port(&xhci->bus, &xhci->uports[i], xhci, i,
1d8a4e69 2961 &xhci_uport_ops, speedmask);
62c6ae04 2962 }
62c6ae04
HM		 2963}
2964
2965static int usb_xhci_initfn(struct PCIDevice *dev)
2966{
1d8a4e69 2967 int i, ret;
62c6ae04
HM		 2968
2969 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev, dev);
2970
2971 xhci->pci_dev.config[PCI_CLASS_PROG] = 0x30; /* xHCI */
2972 xhci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */
2973 xhci->pci_dev.config[PCI_CACHE_LINE_SIZE] = 0x10;
2974 xhci->pci_dev.config[0x60] = 0x30; /* release number */
2975
2976 usb_xhci_init(xhci, &dev->qdev);
2977
01546fa6
GH		 2978 xhci->mfwrap_timer = qemu_new_timer_ns(vm_clock, xhci_mfwrap_timer, xhci);
2979
62c6ae04
HM		 2980 xhci->irq = xhci->pci_dev.irq[0];
2981
1b067564
GH		 2982 memory_region_init(&xhci->mem, "xhci", LEN_REGS);
2983 memory_region_init_io(&xhci->mem_cap, &xhci_cap_ops, xhci,
2984 "capabilities", LEN_CAP);
2985 memory_region_init_io(&xhci->mem_oper, &xhci_oper_ops, xhci,
1d8a4e69 2986 "operational", 0x400);
1b067564
GH		 2987 memory_region_init_io(&xhci->mem_runtime, &xhci_runtime_ops, xhci,
2988 "runtime", LEN_RUNTIME);
2989 memory_region_init_io(&xhci->mem_doorbell, &xhci_doorbell_ops, xhci,
2990 "doorbell", LEN_DOORBELL);
2991
2992 memory_region_add_subregion(&xhci->mem, 0, &xhci->mem_cap);
2993 memory_region_add_subregion(&xhci->mem, OFF_OPER, &xhci->mem_oper);
2994 memory_region_add_subregion(&xhci->mem, OFF_RUNTIME, &xhci->mem_runtime);
2995 memory_region_add_subregion(&xhci->mem, OFF_DOORBELL, &xhci->mem_doorbell);
2996
1d8a4e69
GH		 2997 for (i = 0; i < xhci->numports; i++) {
2998 XHCIPort *port = &xhci->ports[i];
2999 uint32_t offset = OFF_OPER + 0x400 + 0x10 * i;
3000 port->xhci = xhci;
3001 memory_region_init_io(&port->mem, &xhci_port_ops, port,
3002 port->name, 0x10);
3003 memory_region_add_subregion(&xhci->mem, offset, &port->mem);
3004 }
3005
62c6ae04
HM		 3006 pci_register_bar(&xhci->pci_dev, 0,
3007 PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
3008 &xhci->mem);
3009
3010 ret = pcie_cap_init(&xhci->pci_dev, 0xa0, PCI_EXP_TYPE_ENDPOINT, 0);
3011 assert(ret >= 0);
3012
c5e9b02d
GH		 3013 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) {
3014 msi_init(&xhci->pci_dev, 0x70, MAXINTRS, true, false);
62c6ae04 3015 }
4c47f800
GH		 3016 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI_X)) {
3017 msix_init(&xhci->pci_dev, MAXINTRS,
3018 &xhci->mem, 0, OFF_MSIX_TABLE,
3019 &xhci->mem, 0, OFF_MSIX_PBA,
3020 0x90);
3021 }
62c6ae04
HM		 3022
3023 return 0;
3024}
3025
62c6ae04
HM		 3026static const VMStateDescription vmstate_xhci = {
3027 .name = "xhci",
3028 .unmigratable = 1,
3029};
3030
39bffca2 3031static Property xhci_properties[] = {
c5e9b02d 3032 DEFINE_PROP_BIT("msi", XHCIState, flags, XHCI_FLAG_USE_MSI, true),
4c47f800 3033 DEFINE_PROP_BIT("msix", XHCIState, flags, XHCI_FLAG_USE_MSI_X, true),
0846e635
GH		 3034 DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
3035 DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
39bffca2
AL		 3036 DEFINE_PROP_END_OF_LIST(),
3037};
3038
40021f08
AL		 3039static void xhci_class_init(ObjectClass *klass, void *data)
3040{
3041 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
39bffca2 3042 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08 3043
39bffca2
AL		 3044 dc->vmsd = &vmstate_xhci;
3045 dc->props = xhci_properties;
64619739 3046 dc->reset = xhci_reset;
40021f08
AL		 3047 k->init = usb_xhci_initfn;
3048 k->vendor_id = PCI_VENDOR_ID_NEC;
3049 k->device_id = PCI_DEVICE_ID_NEC_UPD720200;
3050 k->class_id = PCI_CLASS_SERIAL_USB;
3051 k->revision = 0x03;
3052 k->is_express = 1;
40021f08
AL		 3053}
3054
39bffca2
AL		 3055static TypeInfo xhci_info = {
3056 .name = "nec-usb-xhci",
3057 .parent = TYPE_PCI_DEVICE,
3058 .instance_size = sizeof(XHCIState),
3059 .class_init = xhci_class_init,
62c6ae04
HM		 3060};
3061
83f7d43a 3062static void xhci_register_types(void)
62c6ae04 3063{
39bffca2 3064 type_register_static(&xhci_info);
62c6ae04 3065}
83f7d43a
AF		 3066
3067type_init(xhci_register_types)
Qemu copy for testing