]> git.proxmox.com Git - mirror_qemu.git/blob - hw/usb/hcd-ehci.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
virtfs-proxy-helper: use setresuid and setresgid
[mirror_qemu.git] / hw / usb / hcd-ehci.c
1 /*
2 * QEMU USB EHCI Emulation
3 *
4 * Copyright(c) 2008 Emutex Ltd. (address@hidden)
5 * Copyright(c) 2011-2012 Red Hat, Inc.
6 *
7 * Red Hat Authors:
8 * Gerd Hoffmann <kraxel@redhat.com>
9 * Hans de Goede <hdegoede@redhat.com>
10 *
11 * EHCI project was started by Mark Burkley, with contributions by
12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf,
13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14 *
15 *
16 * This library is free software; you can redistribute it and/or
17 * modify it under the terms of the GNU Lesser General Public
18 * License as published by the Free Software Foundation; either
19 * version 2 of the License, or(at your option) any later version.
20 *
21 * This library is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
24 * Lesser General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 #include "hw/usb/hcd-ehci.h"
31
32 /* Capability Registers Base Address - section 2.2 */
33 #define CAPLENGTH 0x0000 /* 1-byte, 0x0001 reserved */
34 #define HCIVERSION 0x0002 /* 2-bytes, i/f version # */
35 #define HCSPARAMS 0x0004 /* 4-bytes, structural params */
36 #define HCCPARAMS 0x0008 /* 4-bytes, capability params */
37 #define EECP HCCPARAMS + 1
38 #define HCSPPORTROUTE1 0x000c
39 #define HCSPPORTROUTE2 0x0010
40
41 #define USBCMD 0x0000
42 #define USBCMD_RUNSTOP (1 << 0) // run / Stop
43 #define USBCMD_HCRESET (1 << 1) // HC Reset
44 #define USBCMD_FLS (3 << 2) // Frame List Size
45 #define USBCMD_FLS_SH 2 // Frame List Size Shift
46 #define USBCMD_PSE (1 << 4) // Periodic Schedule Enable
47 #define USBCMD_ASE (1 << 5) // Asynch Schedule Enable
48 #define USBCMD_IAAD (1 << 6) // Int Asynch Advance Doorbell
49 #define USBCMD_LHCR (1 << 7) // Light Host Controller Reset
50 #define USBCMD_ASPMC (3 << 8) // Async Sched Park Mode Count
51 #define USBCMD_ASPME (1 << 11) // Async Sched Park Mode Enable
52 #define USBCMD_ITC (0x7f << 16) // Int Threshold Control
53 #define USBCMD_ITC_SH 16 // Int Threshold Control Shift
54
55 #define USBSTS 0x0004
56 #define USBSTS_RO_MASK 0x0000003f
57 #define USBSTS_INT (1 << 0) // USB Interrupt
58 #define USBSTS_ERRINT (1 << 1) // Error Interrupt
59 #define USBSTS_PCD (1 << 2) // Port Change Detect
60 #define USBSTS_FLR (1 << 3) // Frame List Rollover
61 #define USBSTS_HSE (1 << 4) // Host System Error
62 #define USBSTS_IAA (1 << 5) // Interrupt on Async Advance
63 #define USBSTS_HALT (1 << 12) // HC Halted
64 #define USBSTS_REC (1 << 13) // Reclamation
65 #define USBSTS_PSS (1 << 14) // Periodic Schedule Status
66 #define USBSTS_ASS (1 << 15) // Asynchronous Schedule Status
67
68 /*
69 * Interrupt enable bits correspond to the interrupt active bits in USBSTS
70 * so no need to redefine here.
71 */
72 #define USBINTR 0x0008
73 #define USBINTR_MASK 0x0000003f
74
75 #define FRINDEX 0x000c
76 #define CTRLDSSEGMENT 0x0010
77 #define PERIODICLISTBASE 0x0014
78 #define ASYNCLISTADDR 0x0018
79 #define ASYNCLISTADDR_MASK 0xffffffe0
80
81 #define CONFIGFLAG 0x0040
82
83 /*
84 * Bits that are reserved or are read-only are masked out of values
85 * written to us by software
86 */
87 #define PORTSC_RO_MASK 0x007001c0
88 #define PORTSC_RWC_MASK 0x0000002a
89 #define PORTSC_WKOC_E (1 << 22) // Wake on Over Current Enable
90 #define PORTSC_WKDS_E (1 << 21) // Wake on Disconnect Enable
91 #define PORTSC_WKCN_E (1 << 20) // Wake on Connect Enable
92 #define PORTSC_PTC (15 << 16) // Port Test Control
93 #define PORTSC_PTC_SH 16 // Port Test Control shift
94 #define PORTSC_PIC (3 << 14) // Port Indicator Control
95 #define PORTSC_PIC_SH 14 // Port Indicator Control Shift
96 #define PORTSC_POWNER (1 << 13) // Port Owner
97 #define PORTSC_PPOWER (1 << 12) // Port Power
98 #define PORTSC_LINESTAT (3 << 10) // Port Line Status
99 #define PORTSC_LINESTAT_SH 10 // Port Line Status Shift
100 #define PORTSC_PRESET (1 << 8) // Port Reset
101 #define PORTSC_SUSPEND (1 << 7) // Port Suspend
102 #define PORTSC_FPRES (1 << 6) // Force Port Resume
103 #define PORTSC_OCC (1 << 5) // Over Current Change
104 #define PORTSC_OCA (1 << 4) // Over Current Active
105 #define PORTSC_PEDC (1 << 3) // Port Enable/Disable Change
106 #define PORTSC_PED (1 << 2) // Port Enable/Disable
107 #define PORTSC_CSC (1 << 1) // Connect Status Change
108 #define PORTSC_CONNECT (1 << 0) // Current Connect Status
109
110 #define FRAME_TIMER_FREQ 1000
111 #define FRAME_TIMER_NS (1000000000 / FRAME_TIMER_FREQ)
112
113 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints
114 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction
115 #define MAX_QH 100 // Max allowable queue heads in a chain
116 #define MIN_FR_PER_TICK 3 // Min frames to process when catching up
117
118 /* Internal periodic / asynchronous schedule state machine states
119 */
120 typedef enum {
121 EST_INACTIVE = 1000,
122 EST_ACTIVE,
123 EST_EXECUTING,
124 EST_SLEEPING,
125 /* The following states are internal to the state machine function
126 */
127 EST_WAITLISTHEAD,
128 EST_FETCHENTRY,
129 EST_FETCHQH,
130 EST_FETCHITD,
131 EST_FETCHSITD,
132 EST_ADVANCEQUEUE,
133 EST_FETCHQTD,
134 EST_EXECUTE,
135 EST_WRITEBACK,
136 EST_HORIZONTALQH
137 } EHCI_STATES;
138
139 /* macros for accessing fields within next link pointer entry */
140 #define NLPTR_GET(x) ((x) & 0xffffffe0)
141 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
142 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid
143
144 /* link pointer types */
145 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor
146 #define NLPTR_TYPE_QH 1 // queue head
147 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor
148 #define NLPTR_TYPE_FSTN 3 // frame span traversal node
149
150 #define SET_LAST_RUN_CLOCK(s) \
151 (s)->last_run_ns = qemu_get_clock_ns(vm_clock);
152
153 /* nifty macros from Arnon's EHCI version */
154 #define get_field(data, field) \
155 (((data) & field##_MASK) >> field##_SH)
156
157 #define set_field(data, newval, field) do { \
158 uint32_t val = *data; \
159 val &= ~ field##_MASK; \
160 val |= ((newval) << field##_SH) & field##_MASK; \
161 *data = val; \
162 } while(0)
163
164 static const char *ehci_state_names[] = {
165 [EST_INACTIVE] = "INACTIVE",
166 [EST_ACTIVE] = "ACTIVE",
167 [EST_EXECUTING] = "EXECUTING",
168 [EST_SLEEPING] = "SLEEPING",
169 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
170 [EST_FETCHENTRY] = "FETCH ENTRY",
171 [EST_FETCHQH] = "FETCH QH",
172 [EST_FETCHITD] = "FETCH ITD",
173 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
174 [EST_FETCHQTD] = "FETCH QTD",
175 [EST_EXECUTE] = "EXECUTE",
176 [EST_WRITEBACK] = "WRITEBACK",
177 [EST_HORIZONTALQH] = "HORIZONTALQH",
178 };
179
180 static const char *ehci_mmio_names[] = {
181 [USBCMD] = "USBCMD",
182 [USBSTS] = "USBSTS",
183 [USBINTR] = "USBINTR",
184 [FRINDEX] = "FRINDEX",
185 [PERIODICLISTBASE] = "P-LIST BASE",
186 [ASYNCLISTADDR] = "A-LIST ADDR",
187 [CONFIGFLAG] = "CONFIGFLAG",
188 };
189
190 static int ehci_state_executing(EHCIQueue *q);
191 static int ehci_state_writeback(EHCIQueue *q);
192 static int ehci_state_advqueue(EHCIQueue *q);
193 static int ehci_fill_queue(EHCIPacket *p);
194
195 static const char *nr2str(const char **n, size_t len, uint32_t nr)
196 {
197 if (nr < len && n[nr] != NULL) {
198 return n[nr];
199 } else {
200 return "unknown";
201 }
202 }
203
204 static const char *state2str(uint32_t state)
205 {
206 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
207 }
208
209 static const char *addr2str(hwaddr addr)
210 {
211 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
212 }
213
214 static void ehci_trace_usbsts(uint32_t mask, int state)
215 {
216 /* interrupts */
217 if (mask & USBSTS_INT) {
218 trace_usb_ehci_usbsts("INT", state);
219 }
220 if (mask & USBSTS_ERRINT) {
221 trace_usb_ehci_usbsts("ERRINT", state);
222 }
223 if (mask & USBSTS_PCD) {
224 trace_usb_ehci_usbsts("PCD", state);
225 }
226 if (mask & USBSTS_FLR) {
227 trace_usb_ehci_usbsts("FLR", state);
228 }
229 if (mask & USBSTS_HSE) {
230 trace_usb_ehci_usbsts("HSE", state);
231 }
232 if (mask & USBSTS_IAA) {
233 trace_usb_ehci_usbsts("IAA", state);
234 }
235
236 /* status */
237 if (mask & USBSTS_HALT) {
238 trace_usb_ehci_usbsts("HALT", state);
239 }
240 if (mask & USBSTS_REC) {
241 trace_usb_ehci_usbsts("REC", state);
242 }
243 if (mask & USBSTS_PSS) {
244 trace_usb_ehci_usbsts("PSS", state);
245 }
246 if (mask & USBSTS_ASS) {
247 trace_usb_ehci_usbsts("ASS", state);
248 }
249 }
250
251 static inline void ehci_set_usbsts(EHCIState *s, int mask)
252 {
253 if ((s->usbsts & mask) == mask) {
254 return;
255 }
256 ehci_trace_usbsts(mask, 1);
257 s->usbsts |= mask;
258 }
259
260 static inline void ehci_clear_usbsts(EHCIState *s, int mask)
261 {
262 if ((s->usbsts & mask) == 0) {
263 return;
264 }
265 ehci_trace_usbsts(mask, 0);
266 s->usbsts &= ~mask;
267 }
268
269 /* update irq line */
270 static inline void ehci_update_irq(EHCIState *s)
271 {
272 int level = 0;
273
274 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
275 level = 1;
276 }
277
278 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
279 qemu_set_irq(s->irq, level);
280 }
281
282 /* flag interrupt condition */
283 static inline void ehci_raise_irq(EHCIState *s, int intr)
284 {
285 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
286 s->usbsts |= intr;
287 ehci_update_irq(s);
288 } else {
289 s->usbsts_pending |= intr;
290 }
291 }
292
293 /*
294 * Commit pending interrupts (added via ehci_raise_irq),
295 * at the rate allowed by "Interrupt Threshold Control".
296 */
297 static inline void ehci_commit_irq(EHCIState *s)
298 {
299 uint32_t itc;
300
301 if (!s->usbsts_pending) {
302 return;
303 }
304 if (s->usbsts_frindex > s->frindex) {
305 return;
306 }
307
308 itc = (s->usbcmd >> 16) & 0xff;
309 s->usbsts |= s->usbsts_pending;
310 s->usbsts_pending = 0;
311 s->usbsts_frindex = s->frindex + itc;
312 ehci_update_irq(s);
313 }
314
315 static void ehci_update_halt(EHCIState *s)
316 {
317 if (s->usbcmd & USBCMD_RUNSTOP) {
318 ehci_clear_usbsts(s, USBSTS_HALT);
319 } else {
320 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
321 ehci_set_usbsts(s, USBSTS_HALT);
322 }
323 }
324 }
325
326 static void ehci_set_state(EHCIState *s, int async, int state)
327 {
328 if (async) {
329 trace_usb_ehci_state("async", state2str(state));
330 s->astate = state;
331 if (s->astate == EST_INACTIVE) {
332 ehci_clear_usbsts(s, USBSTS_ASS);
333 ehci_update_halt(s);
334 } else {
335 ehci_set_usbsts(s, USBSTS_ASS);
336 }
337 } else {
338 trace_usb_ehci_state("periodic", state2str(state));
339 s->pstate = state;
340 if (s->pstate == EST_INACTIVE) {
341 ehci_clear_usbsts(s, USBSTS_PSS);
342 ehci_update_halt(s);
343 } else {
344 ehci_set_usbsts(s, USBSTS_PSS);
345 }
346 }
347 }
348
349 static int ehci_get_state(EHCIState *s, int async)
350 {
351 return async ? s->astate : s->pstate;
352 }
353
354 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
355 {
356 if (async) {
357 s->a_fetch_addr = addr;
358 } else {
359 s->p_fetch_addr = addr;
360 }
361 }
362
363 static int ehci_get_fetch_addr(EHCIState *s, int async)
364 {
365 return async ? s->a_fetch_addr : s->p_fetch_addr;
366 }
367
368 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
369 {
370 /* need three here due to argument count limits */
371 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
372 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
373 trace_usb_ehci_qh_fields(addr,
374 get_field(qh->epchar, QH_EPCHAR_RL),
375 get_field(qh->epchar, QH_EPCHAR_MPLEN),
376 get_field(qh->epchar, QH_EPCHAR_EPS),
377 get_field(qh->epchar, QH_EPCHAR_EP),
378 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
379 trace_usb_ehci_qh_bits(addr,
380 (bool)(qh->epchar & QH_EPCHAR_C),
381 (bool)(qh->epchar & QH_EPCHAR_H),
382 (bool)(qh->epchar & QH_EPCHAR_DTC),
383 (bool)(qh->epchar & QH_EPCHAR_I));
384 }
385
386 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
387 {
388 /* need three here due to argument count limits */
389 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
390 trace_usb_ehci_qtd_fields(addr,
391 get_field(qtd->token, QTD_TOKEN_TBYTES),
392 get_field(qtd->token, QTD_TOKEN_CPAGE),
393 get_field(qtd->token, QTD_TOKEN_CERR),
394 get_field(qtd->token, QTD_TOKEN_PID));
395 trace_usb_ehci_qtd_bits(addr,
396 (bool)(qtd->token & QTD_TOKEN_IOC),
397 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
398 (bool)(qtd->token & QTD_TOKEN_HALT),
399 (bool)(qtd->token & QTD_TOKEN_BABBLE),
400 (bool)(qtd->token & QTD_TOKEN_XACTERR));
401 }
402
403 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
404 {
405 trace_usb_ehci_itd(addr, itd->next,
406 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
407 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
408 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
409 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
410 }
411
412 static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
413 EHCIsitd *sitd)
414 {
415 trace_usb_ehci_sitd(addr, sitd->next,
416 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
417 }
418
419 static void ehci_trace_guest_bug(EHCIState *s, const char *message)
420 {
421 trace_usb_ehci_guest_bug(message);
422 fprintf(stderr, "ehci warning: %s\n", message);
423 }
424
425 static inline bool ehci_enabled(EHCIState *s)
426 {
427 return s->usbcmd & USBCMD_RUNSTOP;
428 }
429
430 static inline bool ehci_async_enabled(EHCIState *s)
431 {
432 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
433 }
434
435 static inline bool ehci_periodic_enabled(EHCIState *s)
436 {
437 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
438 }
439
440 /* packet management */
441
442 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
443 {
444 EHCIPacket *p;
445
446 p = g_new0(EHCIPacket, 1);
447 p->queue = q;
448 usb_packet_init(&p->packet);
449 QTAILQ_INSERT_TAIL(&q->packets, p, next);
450 trace_usb_ehci_packet_action(p->queue, p, "alloc");
451 return p;
452 }
453
454 static void ehci_free_packet(EHCIPacket *p)
455 {
456 if (p->async == EHCI_ASYNC_FINISHED) {
457 EHCIQueue *q = p->queue;
458 int state = ehci_get_state(q->ehci, q->async);
459 /* This is a normal, but rare condition (cancel racing completion) */
460 fprintf(stderr, "EHCI: Warning packet completed but not processed\n");
461 ehci_state_executing(q);
462 ehci_state_writeback(q);
463 if (!(q->qh.token & QTD_TOKEN_HALT)) {
464 ehci_state_advqueue(q);
465 }
466 ehci_set_state(q->ehci, q->async, state);
467 /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
468 return;
469 }
470 trace_usb_ehci_packet_action(p->queue, p, "free");
471 if (p->async == EHCI_ASYNC_INITIALIZED) {
472 usb_packet_unmap(&p->packet, &p->sgl);
473 qemu_sglist_destroy(&p->sgl);
474 }
475 if (p->async == EHCI_ASYNC_INFLIGHT) {
476 usb_cancel_packet(&p->packet);
477 usb_packet_unmap(&p->packet, &p->sgl);
478 qemu_sglist_destroy(&p->sgl);
479 }
480 QTAILQ_REMOVE(&p->queue->packets, p, next);
481 usb_packet_cleanup(&p->packet);
482 g_free(p);
483 }
484
485 /* queue management */
486
487 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
488 {
489 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
490 EHCIQueue *q;
491
492 q = g_malloc0(sizeof(*q));
493 q->ehci = ehci;
494 q->qhaddr = addr;
495 q->async = async;
496 QTAILQ_INIT(&q->packets);
497 QTAILQ_INSERT_HEAD(head, q, next);
498 trace_usb_ehci_queue_action(q, "alloc");
499 return q;
500 }
501
502 static int ehci_cancel_queue(EHCIQueue *q)
503 {
504 EHCIPacket *p;
505 int packets = 0;
506
507 p = QTAILQ_FIRST(&q->packets);
508 if (p == NULL) {
509 return 0;
510 }
511
512 trace_usb_ehci_queue_action(q, "cancel");
513 do {
514 ehci_free_packet(p);
515 packets++;
516 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
517 return packets;
518 }
519
520 static int ehci_reset_queue(EHCIQueue *q)
521 {
522 int packets;
523
524 trace_usb_ehci_queue_action(q, "reset");
525 packets = ehci_cancel_queue(q);
526 q->dev = NULL;
527 q->qtdaddr = 0;
528 return packets;
529 }
530
531 static void ehci_free_queue(EHCIQueue *q, const char *warn)
532 {
533 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
534 int cancelled;
535
536 trace_usb_ehci_queue_action(q, "free");
537 cancelled = ehci_cancel_queue(q);
538 if (warn && cancelled > 0) {
539 ehci_trace_guest_bug(q->ehci, warn);
540 }
541 QTAILQ_REMOVE(head, q, next);
542 g_free(q);
543 }
544
545 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
546 int async)
547 {
548 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
549 EHCIQueue *q;
550
551 QTAILQ_FOREACH(q, head, next) {
552 if (addr == q->qhaddr) {
553 return q;
554 }
555 }
556 return NULL;
557 }
558
559 static void ehci_queues_rip_unused(EHCIState *ehci, int async)
560 {
561 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
562 const char *warn = async ? "guest unlinked busy QH" : NULL;
563 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
564 EHCIQueue *q, *tmp;
565
566 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
567 if (q->seen) {
568 q->seen = 0;
569 q->ts = ehci->last_run_ns;
570 continue;
571 }
572 if (ehci->last_run_ns < q->ts + maxage) {
573 continue;
574 }
575 ehci_free_queue(q, warn);
576 }
577 }
578
579 static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
580 {
581 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
582 EHCIQueue *q, *tmp;
583
584 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
585 if (!q->seen) {
586 ehci_free_queue(q, NULL);
587 }
588 }
589 }
590
591 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
592 {
593 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
594 EHCIQueue *q, *tmp;
595
596 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
597 if (q->dev != dev) {
598 continue;
599 }
600 ehci_free_queue(q, NULL);
601 }
602 }
603
604 static void ehci_queues_rip_all(EHCIState *ehci, int async)
605 {
606 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
607 const char *warn = async ? "guest stopped busy async schedule" : NULL;
608 EHCIQueue *q, *tmp;
609
610 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
611 ehci_free_queue(q, warn);
612 }
613 }
614
615 /* Attach or detach a device on root hub */
616
617 static void ehci_attach(USBPort *port)
618 {
619 EHCIState *s = port->opaque;
620 uint32_t *portsc = &s->portsc[port->index];
621 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
622
623 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
624
625 if (*portsc & PORTSC_POWNER) {
626 USBPort *companion = s->companion_ports[port->index];
627 companion->dev = port->dev;
628 companion->ops->attach(companion);
629 return;
630 }
631
632 *portsc |= PORTSC_CONNECT;
633 *portsc |= PORTSC_CSC;
634
635 ehci_raise_irq(s, USBSTS_PCD);
636 ehci_commit_irq(s);
637 }
638
639 static void ehci_detach(USBPort *port)
640 {
641 EHCIState *s = port->opaque;
642 uint32_t *portsc = &s->portsc[port->index];
643 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
644
645 trace_usb_ehci_port_detach(port->index, owner);
646
647 if (*portsc & PORTSC_POWNER) {
648 USBPort *companion = s->companion_ports[port->index];
649 companion->ops->detach(companion);
650 companion->dev = NULL;
651 /*
652 * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
653 * the port ownership is returned immediately to the EHCI controller."
654 */
655 *portsc &= ~PORTSC_POWNER;
656 return;
657 }
658
659 ehci_queues_rip_device(s, port->dev, 0);
660 ehci_queues_rip_device(s, port->dev, 1);
661
662 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED);
663 *portsc |= PORTSC_CSC;
664
665 ehci_raise_irq(s, USBSTS_PCD);
666 ehci_commit_irq(s);
667 }
668
669 static void ehci_child_detach(USBPort *port, USBDevice *child)
670 {
671 EHCIState *s = port->opaque;
672 uint32_t portsc = s->portsc[port->index];
673
674 if (portsc & PORTSC_POWNER) {
675 USBPort *companion = s->companion_ports[port->index];
676 companion->ops->child_detach(companion, child);
677 return;
678 }
679
680 ehci_queues_rip_device(s, child, 0);
681 ehci_queues_rip_device(s, child, 1);
682 }
683
684 static void ehci_wakeup(USBPort *port)
685 {
686 EHCIState *s = port->opaque;
687 uint32_t portsc = s->portsc[port->index];
688
689 if (portsc & PORTSC_POWNER) {
690 USBPort *companion = s->companion_ports[port->index];
691 if (companion->ops->wakeup) {
692 companion->ops->wakeup(companion);
693 }
694 return;
695 }
696
697 qemu_bh_schedule(s->async_bh);
698 }
699
700 static int ehci_register_companion(USBBus *bus, USBPort *ports[],
701 uint32_t portcount, uint32_t firstport)
702 {
703 EHCIState *s = container_of(bus, EHCIState, bus);
704 uint32_t i;
705
706 if (firstport + portcount > NB_PORTS) {
707 qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport",
708 "firstport on masterbus");
709 error_printf_unless_qmp(
710 "firstport value of %u makes companion take ports %u - %u, which "
711 "is outside of the valid range of 0 - %u\n", firstport, firstport,
712 firstport + portcount - 1, NB_PORTS - 1);
713 return -1;
714 }
715
716 for (i = 0; i < portcount; i++) {
717 if (s->companion_ports[firstport + i]) {
718 qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus",
719 "an USB masterbus");
720 error_printf_unless_qmp(
721 "port %u on masterbus %s already has a companion assigned\n",
722 firstport + i, bus->qbus.name);
723 return -1;
724 }
725 }
726
727 for (i = 0; i < portcount; i++) {
728 s->companion_ports[firstport + i] = ports[i];
729 s->ports[firstport + i].speedmask |=
730 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
731 /* Ensure devs attached before the initial reset go to the companion */
732 s->portsc[firstport + i] = PORTSC_POWNER;
733 }
734
735 s->companion_count++;
736 s->caps[0x05] = (s->companion_count << 4) | portcount;
737
738 return 0;
739 }
740
741 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
742 {
743 USBDevice *dev;
744 USBPort *port;
745 int i;
746
747 for (i = 0; i < NB_PORTS; i++) {
748 port = &ehci->ports[i];
749 if (!(ehci->portsc[i] & PORTSC_PED)) {
750 DPRINTF("Port %d not enabled\n", i);
751 continue;
752 }
753 dev = usb_find_device(port, addr);
754 if (dev != NULL) {
755 return dev;
756 }
757 }
758 return NULL;
759 }
760
761 /* 4.1 host controller initialization */
762 static void ehci_reset(void *opaque)
763 {
764 EHCIState *s = opaque;
765 int i;
766 USBDevice *devs[NB_PORTS];
767
768 trace_usb_ehci_reset();
769
770 /*
771 * Do the detach before touching portsc, so that it correctly gets send to
772 * us or to our companion based on PORTSC_POWNER before the reset.
773 */
774 for(i = 0; i < NB_PORTS; i++) {
775 devs[i] = s->ports[i].dev;
776 if (devs[i] && devs[i]->attached) {
777 usb_detach(&s->ports[i]);
778 }
779 }
780
781 memset(&s->opreg, 0x00, sizeof(s->opreg));
782 memset(&s->portsc, 0x00, sizeof(s->portsc));
783
784 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
785 s->usbsts = USBSTS_HALT;
786 s->usbsts_pending = 0;
787 s->usbsts_frindex = 0;
788
789 s->astate = EST_INACTIVE;
790 s->pstate = EST_INACTIVE;
791
792 for(i = 0; i < NB_PORTS; i++) {
793 if (s->companion_ports[i]) {
794 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
795 } else {
796 s->portsc[i] = PORTSC_PPOWER;
797 }
798 if (devs[i] && devs[i]->attached) {
799 usb_attach(&s->ports[i]);
800 usb_device_reset(devs[i]);
801 }
802 }
803 ehci_queues_rip_all(s, 0);
804 ehci_queues_rip_all(s, 1);
805 qemu_del_timer(s->frame_timer);
806 qemu_bh_cancel(s->async_bh);
807 }
808
809 static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
810 unsigned size)
811 {
812 EHCIState *s = ptr;
813 return s->caps[addr];
814 }
815
816 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
817 unsigned size)
818 {
819 EHCIState *s = ptr;
820 uint32_t val;
821
822 val = s->opreg[addr >> 2];
823 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
824 return val;
825 }
826
827 static uint64_t ehci_port_read(void *ptr, hwaddr addr,
828 unsigned size)
829 {
830 EHCIState *s = ptr;
831 uint32_t val;
832
833 val = s->portsc[addr >> 2];
834 trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
835 return val;
836 }
837
838 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
839 {
840 USBDevice *dev = s->ports[port].dev;
841 uint32_t *portsc = &s->portsc[port];
842 uint32_t orig;
843
844 if (s->companion_ports[port] == NULL)
845 return;
846
847 owner = owner & PORTSC_POWNER;
848 orig = *portsc & PORTSC_POWNER;
849
850 if (!(owner ^ orig)) {
851 return;
852 }
853
854 if (dev && dev->attached) {
855 usb_detach(&s->ports[port]);
856 }
857
858 *portsc &= ~PORTSC_POWNER;
859 *portsc |= owner;
860
861 if (dev && dev->attached) {
862 usb_attach(&s->ports[port]);
863 }
864 }
865
866 static void ehci_port_write(void *ptr, hwaddr addr,
867 uint64_t val, unsigned size)
868 {
869 EHCIState *s = ptr;
870 int port = addr >> 2;
871 uint32_t *portsc = &s->portsc[port];
872 uint32_t old = *portsc;
873 USBDevice *dev = s->ports[port].dev;
874
875 trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);
876
877 /* Clear rwc bits */
878 *portsc &= ~(val & PORTSC_RWC_MASK);
879 /* The guest may clear, but not set the PED bit */
880 *portsc &= val | ~PORTSC_PED;
881 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
882 handle_port_owner_write(s, port, val);
883 /* And finally apply RO_MASK */
884 val &= PORTSC_RO_MASK;
885
886 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
887 trace_usb_ehci_port_reset(port, 1);
888 }
889
890 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
891 trace_usb_ehci_port_reset(port, 0);
892 if (dev && dev->attached) {
893 usb_port_reset(&s->ports[port]);
894 *portsc &= ~PORTSC_CSC;
895 }
896
897 /*
898 * Table 2.16 Set the enable bit(and enable bit change) to indicate
899 * to SW that this port has a high speed device attached
900 */
901 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
902 val |= PORTSC_PED;
903 }
904 }
905
906 *portsc &= ~PORTSC_RO_MASK;
907 *portsc |= val;
908 trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
909 }
910
911 static void ehci_opreg_write(void *ptr, hwaddr addr,
912 uint64_t val, unsigned size)
913 {
914 EHCIState *s = ptr;
915 uint32_t *mmio = s->opreg + (addr >> 2);
916 uint32_t old = *mmio;
917 int i;
918
919 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
920
921 switch (addr) {
922 case USBCMD:
923 if (val & USBCMD_HCRESET) {
924 ehci_reset(s);
925 val = s->usbcmd;
926 break;
927 }
928
929 /* not supporting dynamic frame list size at the moment */
930 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
931 fprintf(stderr, "attempt to set frame list size -- value %d\n",
932 (int)val & USBCMD_FLS);
933 val &= ~USBCMD_FLS;
934 }
935
936 if (val & USBCMD_IAAD) {
937 /*
938 * Process IAAD immediately, otherwise the Linux IAAD watchdog may
939 * trigger and re-use a qh without us seeing the unlink.
940 */
941 s->async_stepdown = 0;
942 qemu_bh_schedule(s->async_bh);
943 trace_usb_ehci_doorbell_ring();
944 }
945
946 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
947 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
948 if (s->pstate == EST_INACTIVE) {
949 SET_LAST_RUN_CLOCK(s);
950 }
951 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
952 ehci_update_halt(s);
953 s->async_stepdown = 0;
954 qemu_bh_schedule(s->async_bh);
955 }
956 break;
957
958 case USBSTS:
959 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO
960 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC
961 val = s->usbsts;
962 ehci_update_irq(s);
963 break;
964
965 case USBINTR:
966 val &= USBINTR_MASK;
967 if (ehci_enabled(s) && (USBSTS_FLR & val)) {
968 qemu_bh_schedule(s->async_bh);
969 }
970 break;
971
972 case FRINDEX:
973 val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */
974 break;
975
976 case CONFIGFLAG:
977 val &= 0x1;
978 if (val) {
979 for(i = 0; i < NB_PORTS; i++)
980 handle_port_owner_write(s, i, 0);
981 }
982 break;
983
984 case PERIODICLISTBASE:
985 if (ehci_periodic_enabled(s)) {
986 fprintf(stderr,
987 "ehci: PERIODIC list base register set while periodic schedule\n"
988 " is enabled and HC is enabled\n");
989 }
990 break;
991
992 case ASYNCLISTADDR:
993 if (ehci_async_enabled(s)) {
994 fprintf(stderr,
995 "ehci: ASYNC list address register set while async schedule\n"
996 " is enabled and HC is enabled\n");
997 }
998 break;
999 }
1000
1001 *mmio = val;
1002 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1003 *mmio, old);
1004 }
1005
1006 /* Get an array of dwords from main memory */
1007 static inline int get_dwords(EHCIState *ehci, uint32_t addr,
1008 uint32_t *buf, int num)
1009 {
1010 int i;
1011
1012 if (!ehci->dma) {
1013 ehci_raise_irq(ehci, USBSTS_HSE);
1014 ehci->usbcmd &= ~USBCMD_RUNSTOP;
1015 trace_usb_ehci_dma_error();
1016 return -1;
1017 }
1018
1019 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1020 dma_memory_read(ehci->dma, addr, buf, sizeof(*buf));
1021 *buf = le32_to_cpu(*buf);
1022 }
1023
1024 return num;
1025 }
1026
1027 /* Put an array of dwords in to main memory */
1028 static inline int put_dwords(EHCIState *ehci, uint32_t addr,
1029 uint32_t *buf, int num)
1030 {
1031 int i;
1032
1033 if (!ehci->dma) {
1034 ehci_raise_irq(ehci, USBSTS_HSE);
1035 ehci->usbcmd &= ~USBCMD_RUNSTOP;
1036 trace_usb_ehci_dma_error();
1037 return -1;
1038 }
1039
1040 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1041 uint32_t tmp = cpu_to_le32(*buf);
1042 dma_memory_write(ehci->dma, addr, &tmp, sizeof(tmp));
1043 }
1044
1045 return num;
1046 }
1047
1048 /*
1049 * Write the qh back to guest physical memory. This step isn't
1050 * in the EHCI spec but we need to do it since we don't share
1051 * physical memory with our guest VM.
1052 *
1053 * The first three dwords are read-only for the EHCI, so skip them
1054 * when writing back the qh.
1055 */
1056 static void ehci_flush_qh(EHCIQueue *q)
1057 {
1058 uint32_t *qh = (uint32_t *) &q->qh;
1059 uint32_t dwords = sizeof(EHCIqh) >> 2;
1060 uint32_t addr = NLPTR_GET(q->qhaddr);
1061
1062 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1063 }
1064
1065 // 4.10.2
1066
1067 static int ehci_qh_do_overlay(EHCIQueue *q)
1068 {
1069 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1070 int i;
1071 int dtoggle;
1072 int ping;
1073 int eps;
1074 int reload;
1075
1076 assert(p != NULL);
1077 assert(p->qtdaddr == q->qtdaddr);
1078
1079 // remember values in fields to preserve in qh after overlay
1080
1081 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1082 ping = q->qh.token & QTD_TOKEN_PING;
1083
1084 q->qh.current_qtd = p->qtdaddr;
1085 q->qh.next_qtd = p->qtd.next;
1086 q->qh.altnext_qtd = p->qtd.altnext;
1087 q->qh.token = p->qtd.token;
1088
1089
1090 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1091 if (eps == EHCI_QH_EPS_HIGH) {
1092 q->qh.token &= ~QTD_TOKEN_PING;
1093 q->qh.token |= ping;
1094 }
1095
1096 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1097 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1098
1099 for (i = 0; i < 5; i++) {
1100 q->qh.bufptr[i] = p->qtd.bufptr[i];
1101 }
1102
1103 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1104 // preserve QH DT bit
1105 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1106 q->qh.token |= dtoggle;
1107 }
1108
1109 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1110 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1111
1112 ehci_flush_qh(q);
1113
1114 return 0;
1115 }
1116
1117 static int ehci_init_transfer(EHCIPacket *p)
1118 {
1119 uint32_t cpage, offset, bytes, plen;
1120 dma_addr_t page;
1121
1122 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1123 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1124 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1125 qemu_sglist_init(&p->sgl, 5, p->queue->ehci->dma);
1126
1127 while (bytes > 0) {
1128 if (cpage > 4) {
1129 fprintf(stderr, "cpage out of range (%d)\n", cpage);
1130 return -1;
1131 }
1132
1133 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1134 page += offset;
1135 plen = bytes;
1136 if (plen > 4096 - offset) {
1137 plen = 4096 - offset;
1138 offset = 0;
1139 cpage++;
1140 }
1141
1142 qemu_sglist_add(&p->sgl, page, plen);
1143 bytes -= plen;
1144 }
1145 return 0;
1146 }
1147
1148 static void ehci_finish_transfer(EHCIQueue *q, int len)
1149 {
1150 uint32_t cpage, offset;
1151
1152 if (len > 0) {
1153 /* update cpage & offset */
1154 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1155 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1156
1157 offset += len;
1158 cpage += offset >> QTD_BUFPTR_SH;
1159 offset &= ~QTD_BUFPTR_MASK;
1160
1161 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1162 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1163 q->qh.bufptr[0] |= offset;
1164 }
1165 }
1166
1167 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1168 {
1169 EHCIPacket *p;
1170 EHCIState *s = port->opaque;
1171 uint32_t portsc = s->portsc[port->index];
1172
1173 if (portsc & PORTSC_POWNER) {
1174 USBPort *companion = s->companion_ports[port->index];
1175 companion->ops->complete(companion, packet);
1176 return;
1177 }
1178
1179 p = container_of(packet, EHCIPacket, packet);
1180 assert(p->async == EHCI_ASYNC_INFLIGHT);
1181
1182 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1183 trace_usb_ehci_packet_action(p->queue, p, "remove");
1184 ehci_free_packet(p);
1185 return;
1186 }
1187
1188 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1189 p->async = EHCI_ASYNC_FINISHED;
1190
1191 if (p->queue->async) {
1192 qemu_bh_schedule(p->queue->ehci->async_bh);
1193 }
1194 }
1195
1196 static void ehci_execute_complete(EHCIQueue *q)
1197 {
1198 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1199 uint32_t tbytes;
1200
1201 assert(p != NULL);
1202 assert(p->qtdaddr == q->qtdaddr);
1203 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1204 p->async == EHCI_ASYNC_FINISHED);
1205
1206 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1207 "status %d, actual_length %d\n",
1208 q->qhaddr, q->qh.next, q->qtdaddr,
1209 p->packet.status, p->packet.actual_length);
1210
1211 switch (p->packet.status) {
1212 case USB_RET_SUCCESS:
1213 break;
1214 case USB_RET_IOERROR:
1215 case USB_RET_NODEV:
1216 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1217 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1218 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1219 break;
1220 case USB_RET_STALL:
1221 q->qh.token |= QTD_TOKEN_HALT;
1222 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1223 break;
1224 case USB_RET_NAK:
1225 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1226 return; /* We're not done yet with this transaction */
1227 case USB_RET_BABBLE:
1228 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1229 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1230 break;
1231 default:
1232 /* should not be triggerable */
1233 fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1234 assert(0);
1235 break;
1236 }
1237
1238 /* TODO check 4.12 for splits */
1239 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1240 if (tbytes && p->pid == USB_TOKEN_IN) {
1241 tbytes -= p->packet.actual_length;
1242 if (tbytes) {
1243 /* 4.15.1.2 must raise int on a short input packet */
1244 ehci_raise_irq(q->ehci, USBSTS_INT);
1245 }
1246 } else {
1247 tbytes = 0;
1248 }
1249 DPRINTF("updating tbytes to %d\n", tbytes);
1250 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1251
1252 ehci_finish_transfer(q, p->packet.actual_length);
1253 usb_packet_unmap(&p->packet, &p->sgl);
1254 qemu_sglist_destroy(&p->sgl);
1255 p->async = EHCI_ASYNC_NONE;
1256
1257 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1258 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1259
1260 if (q->qh.token & QTD_TOKEN_IOC) {
1261 ehci_raise_irq(q->ehci, USBSTS_INT);
1262 if (q->async) {
1263 q->ehci->int_req_by_async = true;
1264 }
1265 }
1266 }
1267
1268 /* 4.10.3 returns "again" */
1269 static int ehci_execute(EHCIPacket *p, const char *action)
1270 {
1271 USBEndpoint *ep;
1272 int endp;
1273 bool spd;
1274
1275 assert(p->async == EHCI_ASYNC_NONE ||
1276 p->async == EHCI_ASYNC_INITIALIZED);
1277
1278 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1279 fprintf(stderr, "Attempting to execute inactive qtd\n");
1280 return -1;
1281 }
1282
1283 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1284 ehci_trace_guest_bug(p->queue->ehci,
1285 "guest requested more bytes than allowed");
1286 return -1;
1287 }
1288
1289 p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH;
1290 switch (p->pid) {
1291 case 0:
1292 p->pid = USB_TOKEN_OUT;
1293 break;
1294 case 1:
1295 p->pid = USB_TOKEN_IN;
1296 break;
1297 case 2:
1298 p->pid = USB_TOKEN_SETUP;
1299 break;
1300 default:
1301 fprintf(stderr, "bad token\n");
1302 break;
1303 }
1304
1305 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1306 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1307
1308 if (p->async == EHCI_ASYNC_NONE) {
1309 if (ehci_init_transfer(p) != 0) {
1310 return -1;
1311 }
1312
1313 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1314 usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr, spd,
1315 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1316 usb_packet_map(&p->packet, &p->sgl);
1317 p->async = EHCI_ASYNC_INITIALIZED;
1318 }
1319
1320 trace_usb_ehci_packet_action(p->queue, p, action);
1321 usb_handle_packet(p->queue->dev, &p->packet);
1322 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1323 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1324 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1325 p->packet.actual_length);
1326
1327 if (p->packet.actual_length > BUFF_SIZE) {
1328 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1329 return -1;
1330 }
1331
1332 return 1;
1333 }
1334
1335 /* 4.7.2
1336 */
1337
1338 static int ehci_process_itd(EHCIState *ehci,
1339 EHCIitd *itd,
1340 uint32_t addr)
1341 {
1342 USBDevice *dev;
1343 USBEndpoint *ep;
1344 uint32_t i, len, pid, dir, devaddr, endp;
1345 uint32_t pg, off, ptr1, ptr2, max, mult;
1346
1347 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1348 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1349 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1350 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1351 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1352
1353 for(i = 0; i < 8; i++) {
1354 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1355 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1356 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1357 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1358 ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
1359 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1360
1361 if (len > max * mult) {
1362 len = max * mult;
1363 }
1364
1365 if (len > BUFF_SIZE) {
1366 return -1;
1367 }
1368
1369 qemu_sglist_init(&ehci->isgl, 2, ehci->dma);
1370 if (off + len > 4096) {
1371 /* transfer crosses page border */
1372 uint32_t len2 = off + len - 4096;
1373 uint32_t len1 = len - len2;
1374 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1375 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1376 } else {
1377 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1378 }
1379
1380 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1381
1382 dev = ehci_find_device(ehci, devaddr);
1383 ep = usb_ep_get(dev, pid, endp);
1384 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1385 usb_packet_setup(&ehci->ipacket, pid, ep, addr, false,
1386 (itd->transact[i] & ITD_XACT_IOC) != 0);
1387 usb_packet_map(&ehci->ipacket, &ehci->isgl);
1388 usb_handle_packet(dev, &ehci->ipacket);
1389 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1390 } else {
1391 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1392 ehci->ipacket.status = USB_RET_NAK;
1393 ehci->ipacket.actual_length = 0;
1394 }
1395 qemu_sglist_destroy(&ehci->isgl);
1396
1397 switch (ehci->ipacket.status) {
1398 case USB_RET_SUCCESS:
1399 break;
1400 default:
1401 fprintf(stderr, "Unexpected iso usb result: %d\n",
1402 ehci->ipacket.status);
1403 /* Fall through */
1404 case USB_RET_IOERROR:
1405 case USB_RET_NODEV:
1406 /* 3.3.2: XACTERR is only allowed on IN transactions */
1407 if (dir) {
1408 itd->transact[i] |= ITD_XACT_XACTERR;
1409 ehci_raise_irq(ehci, USBSTS_ERRINT);
1410 }
1411 break;
1412 case USB_RET_BABBLE:
1413 itd->transact[i] |= ITD_XACT_BABBLE;
1414 ehci_raise_irq(ehci, USBSTS_ERRINT);
1415 break;
1416 case USB_RET_NAK:
1417 /* no data for us, so do a zero-length transfer */
1418 ehci->ipacket.actual_length = 0;
1419 break;
1420 }
1421 if (!dir) {
1422 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1423 ITD_XACT_LENGTH); /* OUT */
1424 } else {
1425 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1426 ITD_XACT_LENGTH); /* IN */
1427 }
1428 if (itd->transact[i] & ITD_XACT_IOC) {
1429 ehci_raise_irq(ehci, USBSTS_INT);
1430 }
1431 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1432 }
1433 }
1434 return 0;
1435 }
1436
1437
1438 /* This state is the entry point for asynchronous schedule
1439 * processing. Entry here consitutes a EHCI start event state (4.8.5)
1440 */
1441 static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1442 {
1443 EHCIqh qh;
1444 int i = 0;
1445 int again = 0;
1446 uint32_t entry = ehci->asynclistaddr;
1447
1448 /* set reclamation flag at start event (4.8.6) */
1449 if (async) {
1450 ehci_set_usbsts(ehci, USBSTS_REC);
1451 }
1452
1453 ehci_queues_rip_unused(ehci, async);
1454
1455 /* Find the head of the list (4.9.1.1) */
1456 for(i = 0; i < MAX_QH; i++) {
1457 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1458 sizeof(EHCIqh) >> 2) < 0) {
1459 return 0;
1460 }
1461 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1462
1463 if (qh.epchar & QH_EPCHAR_H) {
1464 if (async) {
1465 entry |= (NLPTR_TYPE_QH << 1);
1466 }
1467
1468 ehci_set_fetch_addr(ehci, async, entry);
1469 ehci_set_state(ehci, async, EST_FETCHENTRY);
1470 again = 1;
1471 goto out;
1472 }
1473
1474 entry = qh.next;
1475 if (entry == ehci->asynclistaddr) {
1476 break;
1477 }
1478 }
1479
1480 /* no head found for list. */
1481
1482 ehci_set_state(ehci, async, EST_ACTIVE);
1483
1484 out:
1485 return again;
1486 }
1487
1488
1489 /* This state is the entry point for periodic schedule processing as
1490 * well as being a continuation state for async processing.
1491 */
1492 static int ehci_state_fetchentry(EHCIState *ehci, int async)
1493 {
1494 int again = 0;
1495 uint32_t entry = ehci_get_fetch_addr(ehci, async);
1496
1497 if (NLPTR_TBIT(entry)) {
1498 ehci_set_state(ehci, async, EST_ACTIVE);
1499 goto out;
1500 }
1501
1502 /* section 4.8, only QH in async schedule */
1503 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1504 fprintf(stderr, "non queue head request in async schedule\n");
1505 return -1;
1506 }
1507
1508 switch (NLPTR_TYPE_GET(entry)) {
1509 case NLPTR_TYPE_QH:
1510 ehci_set_state(ehci, async, EST_FETCHQH);
1511 again = 1;
1512 break;
1513
1514 case NLPTR_TYPE_ITD:
1515 ehci_set_state(ehci, async, EST_FETCHITD);
1516 again = 1;
1517 break;
1518
1519 case NLPTR_TYPE_STITD:
1520 ehci_set_state(ehci, async, EST_FETCHSITD);
1521 again = 1;
1522 break;
1523
1524 default:
1525 /* TODO: handle FSTN type */
1526 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1527 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1528 return -1;
1529 }
1530
1531 out:
1532 return again;
1533 }
1534
1535 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1536 {
1537 EHCIPacket *p;
1538 uint32_t entry, devaddr, endp;
1539 EHCIQueue *q;
1540 EHCIqh qh;
1541
1542 entry = ehci_get_fetch_addr(ehci, async);
1543 q = ehci_find_queue_by_qh(ehci, entry, async);
1544 if (NULL == q) {
1545 q = ehci_alloc_queue(ehci, entry, async);
1546 }
1547 p = QTAILQ_FIRST(&q->packets);
1548
1549 q->seen++;
1550 if (q->seen > 1) {
1551 /* we are going in circles -- stop processing */
1552 ehci_set_state(ehci, async, EST_ACTIVE);
1553 q = NULL;
1554 goto out;
1555 }
1556
1557 if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1558 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1559 q = NULL;
1560 goto out;
1561 }
1562 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1563
1564 /*
1565 * The overlay area of the qh should never be changed by the guest,
1566 * except when idle, in which case the reset is a nop.
1567 */
1568 devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR);
1569 endp = get_field(qh.epchar, QH_EPCHAR_EP);
1570 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
1571 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
1572 (qh.current_qtd != q->qh.current_qtd) ||
1573 (q->async && qh.next_qtd != q->qh.next_qtd) ||
1574 (memcmp(&qh.altnext_qtd, &q->qh.altnext_qtd,
1575 7 * sizeof(uint32_t)) != 0) ||
1576 (q->dev != NULL && q->dev->addr != devaddr)) {
1577 if (ehci_reset_queue(q) > 0) {
1578 ehci_trace_guest_bug(ehci, "guest updated active QH");
1579 }
1580 p = NULL;
1581 }
1582 q->qh = qh;
1583
1584 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1585 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1586 q->transact_ctr = 4;
1587 }
1588
1589 if (q->dev == NULL) {
1590 q->dev = ehci_find_device(q->ehci, devaddr);
1591 }
1592
1593 if (p && p->async == EHCI_ASYNC_FINISHED) {
1594 /* I/O finished -- continue processing queue */
1595 trace_usb_ehci_packet_action(p->queue, p, "complete");
1596 ehci_set_state(ehci, async, EST_EXECUTING);
1597 goto out;
1598 }
1599
1600 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1601
1602 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1603 if (ehci->usbsts & USBSTS_REC) {
1604 ehci_clear_usbsts(ehci, USBSTS_REC);
1605 } else {
1606 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset"
1607 " - done processing\n", q->qhaddr);
1608 ehci_set_state(ehci, async, EST_ACTIVE);
1609 q = NULL;
1610 goto out;
1611 }
1612 }
1613
1614 #if EHCI_DEBUG
1615 if (q->qhaddr != q->qh.next) {
1616 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1617 q->qhaddr,
1618 q->qh.epchar & QH_EPCHAR_H,
1619 q->qh.token & QTD_TOKEN_HALT,
1620 q->qh.token & QTD_TOKEN_ACTIVE,
1621 q->qh.next);
1622 }
1623 #endif
1624
1625 if (q->qh.token & QTD_TOKEN_HALT) {
1626 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1627
1628 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1629 (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
1630 q->qtdaddr = q->qh.current_qtd;
1631 ehci_set_state(ehci, async, EST_FETCHQTD);
1632
1633 } else {
1634 /* EHCI spec version 1.0 Section 4.10.2 */
1635 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1636 }
1637
1638 out:
1639 return q;
1640 }
1641
1642 static int ehci_state_fetchitd(EHCIState *ehci, int async)
1643 {
1644 uint32_t entry;
1645 EHCIitd itd;
1646
1647 assert(!async);
1648 entry = ehci_get_fetch_addr(ehci, async);
1649
1650 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1651 sizeof(EHCIitd) >> 2) < 0) {
1652 return -1;
1653 }
1654 ehci_trace_itd(ehci, entry, &itd);
1655
1656 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1657 return -1;
1658 }
1659
1660 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1661 sizeof(EHCIitd) >> 2);
1662 ehci_set_fetch_addr(ehci, async, itd.next);
1663 ehci_set_state(ehci, async, EST_FETCHENTRY);
1664
1665 return 1;
1666 }
1667
1668 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1669 {
1670 uint32_t entry;
1671 EHCIsitd sitd;
1672
1673 assert(!async);
1674 entry = ehci_get_fetch_addr(ehci, async);
1675
1676 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1677 sizeof(EHCIsitd) >> 2) < 0) {
1678 return 0;
1679 }
1680 ehci_trace_sitd(ehci, entry, &sitd);
1681
1682 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1683 /* siTD is not active, nothing to do */;
1684 } else {
1685 /* TODO: split transfers are not implemented */
1686 fprintf(stderr, "WARNING: Skipping active siTD\n");
1687 }
1688
1689 ehci_set_fetch_addr(ehci, async, sitd.next);
1690 ehci_set_state(ehci, async, EST_FETCHENTRY);
1691 return 1;
1692 }
1693
1694 /* Section 4.10.2 - paragraph 3 */
1695 static int ehci_state_advqueue(EHCIQueue *q)
1696 {
1697 #if 0
1698 /* TO-DO: 4.10.2 - paragraph 2
1699 * if I-bit is set to 1 and QH is not active
1700 * go to horizontal QH
1701 */
1702 if (I-bit set) {
1703 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1704 goto out;
1705 }
1706 #endif
1707
1708 /*
1709 * want data and alt-next qTD is valid
1710 */
1711 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1712 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1713 q->qtdaddr = q->qh.altnext_qtd;
1714 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1715
1716 /*
1717 * next qTD is valid
1718 */
1719 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1720 q->qtdaddr = q->qh.next_qtd;
1721 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1722
1723 /*
1724 * no valid qTD, try next QH
1725 */
1726 } else {
1727 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1728 }
1729
1730 return 1;
1731 }
1732
1733 /* Section 4.10.2 - paragraph 4 */
1734 static int ehci_state_fetchqtd(EHCIQueue *q)
1735 {
1736 EHCIqtd qtd;
1737 EHCIPacket *p;
1738 int again = 1;
1739
1740 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1741 sizeof(EHCIqtd) >> 2) < 0) {
1742 return 0;
1743 }
1744 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1745
1746 p = QTAILQ_FIRST(&q->packets);
1747 if (p != NULL) {
1748 if (p->qtdaddr != q->qtdaddr ||
1749 (q->async && !NLPTR_TBIT(p->qtd.next) &&
1750 (p->qtd.next != qtd.next)) ||
1751 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) ||
1752 p->qtd.bufptr[0] != qtd.bufptr[0]) {
1753 ehci_cancel_queue(q);
1754 ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD");
1755 p = NULL;
1756 } else {
1757 p->qtd = qtd;
1758 ehci_qh_do_overlay(q);
1759 }
1760 }
1761
1762 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1763 if (p != NULL) {
1764 /* transfer canceled by guest (clear active) */
1765 ehci_cancel_queue(q);
1766 p = NULL;
1767 }
1768 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1769 } else if (p != NULL) {
1770 switch (p->async) {
1771 case EHCI_ASYNC_NONE:
1772 case EHCI_ASYNC_INITIALIZED:
1773 /* Not yet executed (MULT), or previously nacked (int) packet */
1774 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1775 break;
1776 case EHCI_ASYNC_INFLIGHT:
1777 /* Check if the guest has added new tds to the queue */
1778 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head));
1779 /* Unfinished async handled packet, go horizontal */
1780 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1781 break;
1782 case EHCI_ASYNC_FINISHED:
1783 /*
1784 * We get here when advqueue moves to a packet which is already
1785 * finished, which can happen with packets queued up by fill_queue
1786 */
1787 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1788 break;
1789 }
1790 } else {
1791 p = ehci_alloc_packet(q);
1792 p->qtdaddr = q->qtdaddr;
1793 p->qtd = qtd;
1794 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1795 }
1796
1797 return again;
1798 }
1799
1800 static int ehci_state_horizqh(EHCIQueue *q)
1801 {
1802 int again = 0;
1803
1804 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1805 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1806 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1807 again = 1;
1808 } else {
1809 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1810 }
1811
1812 return again;
1813 }
1814
1815 /* Returns "again" */
1816 static int ehci_fill_queue(EHCIPacket *p)
1817 {
1818 USBEndpoint *ep = p->packet.ep;
1819 EHCIQueue *q = p->queue;
1820 EHCIqtd qtd = p->qtd;
1821 uint32_t qtdaddr;
1822
1823 for (;;) {
1824 if (NLPTR_TBIT(qtd.next) != 0) {
1825 break;
1826 }
1827 qtdaddr = qtd.next;
1828 /*
1829 * Detect circular td lists, Windows creates these, counting on the
1830 * active bit going low after execution to make the queue stop.
1831 */
1832 QTAILQ_FOREACH(p, &q->packets, next) {
1833 if (p->qtdaddr == qtdaddr) {
1834 goto leave;
1835 }
1836 }
1837 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1838 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1839 return -1;
1840 }
1841 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1842 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1843 break;
1844 }
1845 p = ehci_alloc_packet(q);
1846 p->qtdaddr = qtdaddr;
1847 p->qtd = qtd;
1848 if (ehci_execute(p, "queue") == -1) {
1849 return -1;
1850 }
1851 assert(p->packet.status == USB_RET_ASYNC);
1852 p->async = EHCI_ASYNC_INFLIGHT;
1853 }
1854 leave:
1855 usb_device_flush_ep_queue(ep->dev, ep);
1856 return 1;
1857 }
1858
1859 static int ehci_state_execute(EHCIQueue *q)
1860 {
1861 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1862 int again = 0;
1863
1864 assert(p != NULL);
1865 assert(p->qtdaddr == q->qtdaddr);
1866
1867 if (ehci_qh_do_overlay(q) != 0) {
1868 return -1;
1869 }
1870
1871 // TODO verify enough time remains in the uframe as in 4.4.1.1
1872 // TODO write back ptr to async list when done or out of time
1873
1874 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1875 if (!q->async && q->transact_ctr == 0) {
1876 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1877 again = 1;
1878 goto out;
1879 }
1880
1881 if (q->async) {
1882 ehci_set_usbsts(q->ehci, USBSTS_REC);
1883 }
1884
1885 again = ehci_execute(p, "process");
1886 if (again == -1) {
1887 goto out;
1888 }
1889 if (p->packet.status == USB_RET_ASYNC) {
1890 ehci_flush_qh(q);
1891 trace_usb_ehci_packet_action(p->queue, p, "async");
1892 p->async = EHCI_ASYNC_INFLIGHT;
1893 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1894 if (q->async) {
1895 again = ehci_fill_queue(p);
1896 } else {
1897 again = 1;
1898 }
1899 goto out;
1900 }
1901
1902 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1903 again = 1;
1904
1905 out:
1906 return again;
1907 }
1908
1909 static int ehci_state_executing(EHCIQueue *q)
1910 {
1911 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1912
1913 assert(p != NULL);
1914 assert(p->qtdaddr == q->qtdaddr);
1915
1916 ehci_execute_complete(q);
1917
1918 /* 4.10.3 */
1919 if (!q->async && q->transact_ctr > 0) {
1920 q->transact_ctr--;
1921 }
1922
1923 /* 4.10.5 */
1924 if (p->packet.status == USB_RET_NAK) {
1925 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1926 } else {
1927 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1928 }
1929
1930 ehci_flush_qh(q);
1931 return 1;
1932 }
1933
1934
1935 static int ehci_state_writeback(EHCIQueue *q)
1936 {
1937 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1938 uint32_t *qtd, addr;
1939 int again = 0;
1940
1941 /* Write back the QTD from the QH area */
1942 assert(p != NULL);
1943 assert(p->qtdaddr == q->qtdaddr);
1944
1945 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1946 qtd = (uint32_t *) &q->qh.next_qtd;
1947 addr = NLPTR_GET(p->qtdaddr);
1948 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
1949 ehci_free_packet(p);
1950
1951 /*
1952 * EHCI specs say go horizontal here.
1953 *
1954 * We can also advance the queue here for performance reasons. We
1955 * need to take care to only take that shortcut in case we've
1956 * processed the qtd just written back without errors, i.e. halt
1957 * bit is clear.
1958 */
1959 if (q->qh.token & QTD_TOKEN_HALT) {
1960 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1961 again = 1;
1962 } else {
1963 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
1964 again = 1;
1965 }
1966 return again;
1967 }
1968
1969 /*
1970 * This is the state machine that is common to both async and periodic
1971 */
1972
1973 static void ehci_advance_state(EHCIState *ehci, int async)
1974 {
1975 EHCIQueue *q = NULL;
1976 int again;
1977
1978 do {
1979 switch(ehci_get_state(ehci, async)) {
1980 case EST_WAITLISTHEAD:
1981 again = ehci_state_waitlisthead(ehci, async);
1982 break;
1983
1984 case EST_FETCHENTRY:
1985 again = ehci_state_fetchentry(ehci, async);
1986 break;
1987
1988 case EST_FETCHQH:
1989 q = ehci_state_fetchqh(ehci, async);
1990 if (q != NULL) {
1991 assert(q->async == async);
1992 again = 1;
1993 } else {
1994 again = 0;
1995 }
1996 break;
1997
1998 case EST_FETCHITD:
1999 again = ehci_state_fetchitd(ehci, async);
2000 break;
2001
2002 case EST_FETCHSITD:
2003 again = ehci_state_fetchsitd(ehci, async);
2004 break;
2005
2006 case EST_ADVANCEQUEUE:
2007 again = ehci_state_advqueue(q);
2008 break;
2009
2010 case EST_FETCHQTD:
2011 again = ehci_state_fetchqtd(q);
2012 break;
2013
2014 case EST_HORIZONTALQH:
2015 again = ehci_state_horizqh(q);
2016 break;
2017
2018 case EST_EXECUTE:
2019 again = ehci_state_execute(q);
2020 if (async) {
2021 ehci->async_stepdown = 0;
2022 }
2023 break;
2024
2025 case EST_EXECUTING:
2026 assert(q != NULL);
2027 if (async) {
2028 ehci->async_stepdown = 0;
2029 }
2030 again = ehci_state_executing(q);
2031 break;
2032
2033 case EST_WRITEBACK:
2034 assert(q != NULL);
2035 again = ehci_state_writeback(q);
2036 break;
2037
2038 default:
2039 fprintf(stderr, "Bad state!\n");
2040 again = -1;
2041 assert(0);
2042 break;
2043 }
2044
2045 if (again < 0) {
2046 fprintf(stderr, "processing error - resetting ehci HC\n");
2047 ehci_reset(ehci);
2048 again = 0;
2049 }
2050 }
2051 while (again);
2052 }
2053
2054 static void ehci_advance_async_state(EHCIState *ehci)
2055 {
2056 const int async = 1;
2057
2058 switch(ehci_get_state(ehci, async)) {
2059 case EST_INACTIVE:
2060 if (!ehci_async_enabled(ehci)) {
2061 break;
2062 }
2063 ehci_set_state(ehci, async, EST_ACTIVE);
2064 // No break, fall through to ACTIVE
2065
2066 case EST_ACTIVE:
2067 if (!ehci_async_enabled(ehci)) {
2068 ehci_queues_rip_all(ehci, async);
2069 ehci_set_state(ehci, async, EST_INACTIVE);
2070 break;
2071 }
2072
2073 /* make sure guest has acknowledged the doorbell interrupt */
2074 /* TO-DO: is this really needed? */
2075 if (ehci->usbsts & USBSTS_IAA) {
2076 DPRINTF("IAA status bit still set.\n");
2077 break;
2078 }
2079
2080 /* check that address register has been set */
2081 if (ehci->asynclistaddr == 0) {
2082 break;
2083 }
2084
2085 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2086 ehci_advance_state(ehci, async);
2087
2088 /* If the doorbell is set, the guest wants to make a change to the
2089 * schedule. The host controller needs to release cached data.
2090 * (section 4.8.2)
2091 */
2092 if (ehci->usbcmd & USBCMD_IAAD) {
2093 /* Remove all unseen qhs from the async qhs queue */
2094 ehci_queues_rip_unseen(ehci, async);
2095 trace_usb_ehci_doorbell_ack();
2096 ehci->usbcmd &= ~USBCMD_IAAD;
2097 ehci_raise_irq(ehci, USBSTS_IAA);
2098 }
2099 break;
2100
2101 default:
2102 /* this should only be due to a developer mistake */
2103 fprintf(stderr, "ehci: Bad asynchronous state %d. "
2104 "Resetting to active\n", ehci->astate);
2105 assert(0);
2106 }
2107 }
2108
2109 static void ehci_advance_periodic_state(EHCIState *ehci)
2110 {
2111 uint32_t entry;
2112 uint32_t list;
2113 const int async = 0;
2114
2115 // 4.6
2116
2117 switch(ehci_get_state(ehci, async)) {
2118 case EST_INACTIVE:
2119 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2120 ehci_set_state(ehci, async, EST_ACTIVE);
2121 // No break, fall through to ACTIVE
2122 } else
2123 break;
2124
2125 case EST_ACTIVE:
2126 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2127 ehci_queues_rip_all(ehci, async);
2128 ehci_set_state(ehci, async, EST_INACTIVE);
2129 break;
2130 }
2131
2132 list = ehci->periodiclistbase & 0xfffff000;
2133 /* check that register has been set */
2134 if (list == 0) {
2135 break;
2136 }
2137 list |= ((ehci->frindex & 0x1ff8) >> 1);
2138
2139 if (get_dwords(ehci, list, &entry, 1) < 0) {
2140 break;
2141 }
2142
2143 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n",
2144 ehci->frindex / 8, list, entry);
2145 ehci_set_fetch_addr(ehci, async,entry);
2146 ehci_set_state(ehci, async, EST_FETCHENTRY);
2147 ehci_advance_state(ehci, async);
2148 ehci_queues_rip_unused(ehci, async);
2149 break;
2150
2151 default:
2152 /* this should only be due to a developer mistake */
2153 fprintf(stderr, "ehci: Bad periodic state %d. "
2154 "Resetting to active\n", ehci->pstate);
2155 assert(0);
2156 }
2157 }
2158
2159 static void ehci_update_frindex(EHCIState *ehci, int frames)
2160 {
2161 int i;
2162
2163 if (!ehci_enabled(ehci)) {
2164 return;
2165 }
2166
2167 for (i = 0; i < frames; i++) {
2168 ehci->frindex += 8;
2169
2170 if (ehci->frindex == 0x00002000) {
2171 ehci_raise_irq(ehci, USBSTS_FLR);
2172 }
2173
2174 if (ehci->frindex == 0x00004000) {
2175 ehci_raise_irq(ehci, USBSTS_FLR);
2176 ehci->frindex = 0;
2177 if (ehci->usbsts_frindex >= 0x00004000) {
2178 ehci->usbsts_frindex -= 0x00004000;
2179 } else {
2180 ehci->usbsts_frindex = 0;
2181 }
2182 }
2183 }
2184 }
2185
2186 static void ehci_frame_timer(void *opaque)
2187 {
2188 EHCIState *ehci = opaque;
2189 int need_timer = 0;
2190 int64_t expire_time, t_now;
2191 uint64_t ns_elapsed;
2192 int frames, skipped_frames;
2193 int i;
2194
2195 t_now = qemu_get_clock_ns(vm_clock);
2196 ns_elapsed = t_now - ehci->last_run_ns;
2197 frames = ns_elapsed / FRAME_TIMER_NS;
2198
2199 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2200 need_timer++;
2201 ehci->async_stepdown = 0;
2202
2203 if (frames > ehci->maxframes) {
2204 skipped_frames = frames - ehci->maxframes;
2205 ehci_update_frindex(ehci, skipped_frames);
2206 ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames;
2207 frames -= skipped_frames;
2208 DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames);
2209 }
2210
2211 for (i = 0; i < frames; i++) {
2212 /*
2213 * If we're running behind schedule, we should not catch up
2214 * too fast, as that will make some guests unhappy:
2215 * 1) We must process a minimum of MIN_FR_PER_TICK frames,
2216 * otherwise we will never catch up
2217 * 2) Process frames until the guest has requested an irq (IOC)
2218 */
2219 if (i >= MIN_FR_PER_TICK) {
2220 ehci_commit_irq(ehci);
2221 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2222 break;
2223 }
2224 }
2225 ehci_update_frindex(ehci, 1);
2226 ehci_advance_periodic_state(ehci);
2227 ehci->last_run_ns += FRAME_TIMER_NS;
2228 }
2229 } else {
2230 if (ehci->async_stepdown < ehci->maxframes / 2) {
2231 ehci->async_stepdown++;
2232 }
2233 ehci_update_frindex(ehci, frames);
2234 ehci->last_run_ns += FRAME_TIMER_NS * frames;
2235 }
2236
2237 /* Async is not inside loop since it executes everything it can once
2238 * called
2239 */
2240 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2241 need_timer++;
2242 ehci_advance_async_state(ehci);
2243 }
2244
2245 ehci_commit_irq(ehci);
2246 if (ehci->usbsts_pending) {
2247 need_timer++;
2248 ehci->async_stepdown = 0;
2249 }
2250
2251 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2252 need_timer++;
2253 }
2254
2255 if (need_timer) {
2256 /* If we've raised int, we speed up the timer, so that we quickly
2257 * notice any new packets queued up in response */
2258 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2259 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 2);
2260 ehci->int_req_by_async = false;
2261 } else {
2262 expire_time = t_now + (get_ticks_per_sec()
2263 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2264 }
2265 qemu_mod_timer(ehci->frame_timer, expire_time);
2266 }
2267 }
2268
2269 static const MemoryRegionOps ehci_mmio_caps_ops = {
2270 .read = ehci_caps_read,
2271 .valid.min_access_size = 1,
2272 .valid.max_access_size = 4,
2273 .impl.min_access_size = 1,
2274 .impl.max_access_size = 1,
2275 .endianness = DEVICE_LITTLE_ENDIAN,
2276 };
2277
2278 static const MemoryRegionOps ehci_mmio_opreg_ops = {
2279 .read = ehci_opreg_read,
2280 .write = ehci_opreg_write,
2281 .valid.min_access_size = 4,
2282 .valid.max_access_size = 4,
2283 .endianness = DEVICE_LITTLE_ENDIAN,
2284 };
2285
2286 static const MemoryRegionOps ehci_mmio_port_ops = {
2287 .read = ehci_port_read,
2288 .write = ehci_port_write,
2289 .valid.min_access_size = 4,
2290 .valid.max_access_size = 4,
2291 .endianness = DEVICE_LITTLE_ENDIAN,
2292 };
2293
2294 static USBPortOps ehci_port_ops = {
2295 .attach = ehci_attach,
2296 .detach = ehci_detach,
2297 .child_detach = ehci_child_detach,
2298 .wakeup = ehci_wakeup,
2299 .complete = ehci_async_complete_packet,
2300 };
2301
2302 static USBBusOps ehci_bus_ops = {
2303 .register_companion = ehci_register_companion,
2304 };
2305
2306 static int usb_ehci_post_load(void *opaque, int version_id)
2307 {
2308 EHCIState *s = opaque;
2309 int i;
2310
2311 for (i = 0; i < NB_PORTS; i++) {
2312 USBPort *companion = s->companion_ports[i];
2313 if (companion == NULL) {
2314 continue;
2315 }
2316 if (s->portsc[i] & PORTSC_POWNER) {
2317 companion->dev = s->ports[i].dev;
2318 } else {
2319 companion->dev = NULL;
2320 }
2321 }
2322
2323 return 0;
2324 }
2325
2326 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2327 {
2328 EHCIState *ehci = opaque;
2329
2330 /*
2331 * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2332 * schedule in guest memory. We must do the rebuilt ASAP, so that
2333 * USB-devices which have async handled packages have a packet in the
2334 * ep queue to match the completion with.
2335 */
2336 if (state == RUN_STATE_RUNNING) {
2337 ehci_advance_async_state(ehci);
2338 }
2339
2340 /*
2341 * The schedule rebuilt from guest memory could cause the migration dest
2342 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2343 * will never have existed on the destination. Therefor we must flush the
2344 * async schedule on savevm to catch any not yet noticed unlinks.
2345 */
2346 if (state == RUN_STATE_SAVE_VM) {
2347 ehci_advance_async_state(ehci);
2348 ehci_queues_rip_unseen(ehci, 1);
2349 }
2350 }
2351
2352 const VMStateDescription vmstate_ehci = {
2353 .name = "ehci-core",
2354 .version_id = 2,
2355 .minimum_version_id = 1,
2356 .post_load = usb_ehci_post_load,
2357 .fields = (VMStateField[]) {
2358 /* mmio registers */
2359 VMSTATE_UINT32(usbcmd, EHCIState),
2360 VMSTATE_UINT32(usbsts, EHCIState),
2361 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2362 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2363 VMSTATE_UINT32(usbintr, EHCIState),
2364 VMSTATE_UINT32(frindex, EHCIState),
2365 VMSTATE_UINT32(ctrldssegment, EHCIState),
2366 VMSTATE_UINT32(periodiclistbase, EHCIState),
2367 VMSTATE_UINT32(asynclistaddr, EHCIState),
2368 VMSTATE_UINT32(configflag, EHCIState),
2369 VMSTATE_UINT32(portsc[0], EHCIState),
2370 VMSTATE_UINT32(portsc[1], EHCIState),
2371 VMSTATE_UINT32(portsc[2], EHCIState),
2372 VMSTATE_UINT32(portsc[3], EHCIState),
2373 VMSTATE_UINT32(portsc[4], EHCIState),
2374 VMSTATE_UINT32(portsc[5], EHCIState),
2375 /* frame timer */
2376 VMSTATE_TIMER(frame_timer, EHCIState),
2377 VMSTATE_UINT64(last_run_ns, EHCIState),
2378 VMSTATE_UINT32(async_stepdown, EHCIState),
2379 /* schedule state */
2380 VMSTATE_UINT32(astate, EHCIState),
2381 VMSTATE_UINT32(pstate, EHCIState),
2382 VMSTATE_UINT32(a_fetch_addr, EHCIState),
2383 VMSTATE_UINT32(p_fetch_addr, EHCIState),
2384 VMSTATE_END_OF_LIST()
2385 }
2386 };
2387
2388 void usb_ehci_initfn(EHCIState *s, DeviceState *dev)
2389 {
2390 int i;
2391
2392 /* 2.2 host controller interface version */
2393 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2394 s->caps[0x01] = 0x00;
2395 s->caps[0x02] = 0x00;
2396 s->caps[0x03] = 0x01; /* HC version */
2397 s->caps[0x04] = NB_PORTS; /* Number of downstream ports */
2398 s->caps[0x05] = 0x00; /* No companion ports at present */
2399 s->caps[0x06] = 0x00;
2400 s->caps[0x07] = 0x00;
2401 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
2402 s->caps[0x0a] = 0x00;
2403 s->caps[0x0b] = 0x00;
2404
2405 usb_bus_new(&s->bus, &ehci_bus_ops, dev);
2406 for(i = 0; i < NB_PORTS; i++) {
2407 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2408 USB_SPEED_MASK_HIGH);
2409 s->ports[i].dev = 0;
2410 }
2411
2412 s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
2413 s->async_bh = qemu_bh_new(ehci_frame_timer, s);
2414 QTAILQ_INIT(&s->aqueues);
2415 QTAILQ_INIT(&s->pqueues);
2416 usb_packet_init(&s->ipacket);
2417
2418 qemu_register_reset(ehci_reset, s);
2419 qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2420
2421 memory_region_init(&s->mem, "ehci", MMIO_SIZE);
2422 memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
2423 "capabilities", CAPA_SIZE);
2424 memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
2425 "operational", PORTSC_BEGIN);
2426 memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
2427 "ports", PORTSC_END - PORTSC_BEGIN);
2428
2429 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2430 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2431 memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN,
2432 &s->mem_ports);
2433 }
2434
2435 /*
2436 * vim: expandtab ts=4
2437 */
QEMU mirror