]> git.proxmox.com Git - qemu.git/blob - hw/usb/hcd-xhci.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm
[qemu.git] / hw / usb / hcd-xhci.c
1 /*
2 * USB xHCI controller emulation
3 *
4 * Copyright (c) 2011 Securiforest
5 * Date: 2011-05-11 ; Author: Hector Martin <hector@marcansoft.com>
6 * Based on usb-ohci.c, emulates Renesas NEC USB 3.0
7 *
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2 of the License, or (at your option) any later version.
12 *
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
17 *
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 */
21 #include "hw/hw.h"
22 #include "qemu/timer.h"
23 #include "hw/usb.h"
24 #include "hw/pci/pci.h"
25 #include "hw/pci/msi.h"
26 #include "hw/pci/msix.h"
27 #include "trace.h"
28
29 //#define DEBUG_XHCI
30 //#define DEBUG_DATA
31
32 #ifdef DEBUG_XHCI
33 #define DPRINTF(...) fprintf(stderr, __VA_ARGS__)
34 #else
35 #define DPRINTF(...) do {} while (0)
36 #endif
37 #define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \
38 __func__, __LINE__); abort(); } while (0)
39
40 #define MAXPORTS_2 15
41 #define MAXPORTS_3 15
42
43 #define MAXPORTS (MAXPORTS_2+MAXPORTS_3)
44 #define MAXSLOTS 64
45 #define MAXINTRS 16
46
47 #define TD_QUEUE 24
48
49 /* Very pessimistic, let's hope it's enough for all cases */
50 #define EV_QUEUE (((3*TD_QUEUE)+16)*MAXSLOTS)
51 /* Do not deliver ER Full events. NEC's driver does some things not bound
52 * to the specs when it gets them */
53 #define ER_FULL_HACK
54
55 #define LEN_CAP 0x40
56 #define LEN_OPER (0x400 + 0x10 * MAXPORTS)
57 #define LEN_RUNTIME ((MAXINTRS + 1) * 0x20)
58 #define LEN_DOORBELL ((MAXSLOTS + 1) * 0x20)
59
60 #define OFF_OPER LEN_CAP
61 #define OFF_RUNTIME 0x1000
62 #define OFF_DOORBELL 0x2000
63 #define OFF_MSIX_TABLE 0x3000
64 #define OFF_MSIX_PBA 0x3800
65 /* must be power of 2 */
66 #define LEN_REGS 0x4000
67
68 #if (OFF_OPER + LEN_OPER) > OFF_RUNTIME
69 #error Increase OFF_RUNTIME
70 #endif
71 #if (OFF_RUNTIME + LEN_RUNTIME) > OFF_DOORBELL
72 #error Increase OFF_DOORBELL
73 #endif
74 #if (OFF_DOORBELL + LEN_DOORBELL) > LEN_REGS
75 # error Increase LEN_REGS
76 #endif
77
78 /* bit definitions */
79 #define USBCMD_RS (1<<0)
80 #define USBCMD_HCRST (1<<1)
81 #define USBCMD_INTE (1<<2)
82 #define USBCMD_HSEE (1<<3)
83 #define USBCMD_LHCRST (1<<7)
84 #define USBCMD_CSS (1<<8)
85 #define USBCMD_CRS (1<<9)
86 #define USBCMD_EWE (1<<10)
87 #define USBCMD_EU3S (1<<11)
88
89 #define USBSTS_HCH (1<<0)
90 #define USBSTS_HSE (1<<2)
91 #define USBSTS_EINT (1<<3)
92 #define USBSTS_PCD (1<<4)
93 #define USBSTS_SSS (1<<8)
94 #define USBSTS_RSS (1<<9)
95 #define USBSTS_SRE (1<<10)
96 #define USBSTS_CNR (1<<11)
97 #define USBSTS_HCE (1<<12)
98
99
100 #define PORTSC_CCS (1<<0)
101 #define PORTSC_PED (1<<1)
102 #define PORTSC_OCA (1<<3)
103 #define PORTSC_PR (1<<4)
104 #define PORTSC_PLS_SHIFT 5
105 #define PORTSC_PLS_MASK 0xf
106 #define PORTSC_PP (1<<9)
107 #define PORTSC_SPEED_SHIFT 10
108 #define PORTSC_SPEED_MASK 0xf
109 #define PORTSC_SPEED_FULL (1<<10)
110 #define PORTSC_SPEED_LOW (2<<10)
111 #define PORTSC_SPEED_HIGH (3<<10)
112 #define PORTSC_SPEED_SUPER (4<<10)
113 #define PORTSC_PIC_SHIFT 14
114 #define PORTSC_PIC_MASK 0x3
115 #define PORTSC_LWS (1<<16)
116 #define PORTSC_CSC (1<<17)
117 #define PORTSC_PEC (1<<18)
118 #define PORTSC_WRC (1<<19)
119 #define PORTSC_OCC (1<<20)
120 #define PORTSC_PRC (1<<21)
121 #define PORTSC_PLC (1<<22)
122 #define PORTSC_CEC (1<<23)
123 #define PORTSC_CAS (1<<24)
124 #define PORTSC_WCE (1<<25)
125 #define PORTSC_WDE (1<<26)
126 #define PORTSC_WOE (1<<27)
127 #define PORTSC_DR (1<<30)
128 #define PORTSC_WPR (1<<31)
129
130 #define CRCR_RCS (1<<0)
131 #define CRCR_CS (1<<1)
132 #define CRCR_CA (1<<2)
133 #define CRCR_CRR (1<<3)
134
135 #define IMAN_IP (1<<0)
136 #define IMAN_IE (1<<1)
137
138 #define ERDP_EHB (1<<3)
139
140 #define TRB_SIZE 16
141 typedef struct XHCITRB {
142 uint64_t parameter;
143 uint32_t status;
144 uint32_t control;
145 dma_addr_t addr;
146 bool ccs;
147 } XHCITRB;
148
149 enum {
150 PLS_U0 = 0,
151 PLS_U1 = 1,
152 PLS_U2 = 2,
153 PLS_U3 = 3,
154 PLS_DISABLED = 4,
155 PLS_RX_DETECT = 5,
156 PLS_INACTIVE = 6,
157 PLS_POLLING = 7,
158 PLS_RECOVERY = 8,
159 PLS_HOT_RESET = 9,
160 PLS_COMPILANCE_MODE = 10,
161 PLS_TEST_MODE = 11,
162 PLS_RESUME = 15,
163 };
164
165 typedef enum TRBType {
166 TRB_RESERVED = 0,
167 TR_NORMAL,
168 TR_SETUP,
169 TR_DATA,
170 TR_STATUS,
171 TR_ISOCH,
172 TR_LINK,
173 TR_EVDATA,
174 TR_NOOP,
175 CR_ENABLE_SLOT,
176 CR_DISABLE_SLOT,
177 CR_ADDRESS_DEVICE,
178 CR_CONFIGURE_ENDPOINT,
179 CR_EVALUATE_CONTEXT,
180 CR_RESET_ENDPOINT,
181 CR_STOP_ENDPOINT,
182 CR_SET_TR_DEQUEUE,
183 CR_RESET_DEVICE,
184 CR_FORCE_EVENT,
185 CR_NEGOTIATE_BW,
186 CR_SET_LATENCY_TOLERANCE,
187 CR_GET_PORT_BANDWIDTH,
188 CR_FORCE_HEADER,
189 CR_NOOP,
190 ER_TRANSFER = 32,
191 ER_COMMAND_COMPLETE,
192 ER_PORT_STATUS_CHANGE,
193 ER_BANDWIDTH_REQUEST,
194 ER_DOORBELL,
195 ER_HOST_CONTROLLER,
196 ER_DEVICE_NOTIFICATION,
197 ER_MFINDEX_WRAP,
198 /* vendor specific bits */
199 CR_VENDOR_VIA_CHALLENGE_RESPONSE = 48,
200 CR_VENDOR_NEC_FIRMWARE_REVISION = 49,
201 CR_VENDOR_NEC_CHALLENGE_RESPONSE = 50,
202 } TRBType;
203
204 #define CR_LINK TR_LINK
205
206 typedef enum TRBCCode {
207 CC_INVALID = 0,
208 CC_SUCCESS,
209 CC_DATA_BUFFER_ERROR,
210 CC_BABBLE_DETECTED,
211 CC_USB_TRANSACTION_ERROR,
212 CC_TRB_ERROR,
213 CC_STALL_ERROR,
214 CC_RESOURCE_ERROR,
215 CC_BANDWIDTH_ERROR,
216 CC_NO_SLOTS_ERROR,
217 CC_INVALID_STREAM_TYPE_ERROR,
218 CC_SLOT_NOT_ENABLED_ERROR,
219 CC_EP_NOT_ENABLED_ERROR,
220 CC_SHORT_PACKET,
221 CC_RING_UNDERRUN,
222 CC_RING_OVERRUN,
223 CC_VF_ER_FULL,
224 CC_PARAMETER_ERROR,
225 CC_BANDWIDTH_OVERRUN,
226 CC_CONTEXT_STATE_ERROR,
227 CC_NO_PING_RESPONSE_ERROR,
228 CC_EVENT_RING_FULL_ERROR,
229 CC_INCOMPATIBLE_DEVICE_ERROR,
230 CC_MISSED_SERVICE_ERROR,
231 CC_COMMAND_RING_STOPPED,
232 CC_COMMAND_ABORTED,
233 CC_STOPPED,
234 CC_STOPPED_LENGTH_INVALID,
235 CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR = 29,
236 CC_ISOCH_BUFFER_OVERRUN = 31,
237 CC_EVENT_LOST_ERROR,
238 CC_UNDEFINED_ERROR,
239 CC_INVALID_STREAM_ID_ERROR,
240 CC_SECONDARY_BANDWIDTH_ERROR,
241 CC_SPLIT_TRANSACTION_ERROR
242 } TRBCCode;
243
244 #define TRB_C (1<<0)
245 #define TRB_TYPE_SHIFT 10
246 #define TRB_TYPE_MASK 0x3f
247 #define TRB_TYPE(t) (((t).control >> TRB_TYPE_SHIFT) & TRB_TYPE_MASK)
248
249 #define TRB_EV_ED (1<<2)
250
251 #define TRB_TR_ENT (1<<1)
252 #define TRB_TR_ISP (1<<2)
253 #define TRB_TR_NS (1<<3)
254 #define TRB_TR_CH (1<<4)
255 #define TRB_TR_IOC (1<<5)
256 #define TRB_TR_IDT (1<<6)
257 #define TRB_TR_TBC_SHIFT 7
258 #define TRB_TR_TBC_MASK 0x3
259 #define TRB_TR_BEI (1<<9)
260 #define TRB_TR_TLBPC_SHIFT 16
261 #define TRB_TR_TLBPC_MASK 0xf
262 #define TRB_TR_FRAMEID_SHIFT 20
263 #define TRB_TR_FRAMEID_MASK 0x7ff
264 #define TRB_TR_SIA (1<<31)
265
266 #define TRB_TR_DIR (1<<16)
267
268 #define TRB_CR_SLOTID_SHIFT 24
269 #define TRB_CR_SLOTID_MASK 0xff
270 #define TRB_CR_EPID_SHIFT 16
271 #define TRB_CR_EPID_MASK 0x1f
272
273 #define TRB_CR_BSR (1<<9)
274 #define TRB_CR_DC (1<<9)
275
276 #define TRB_LK_TC (1<<1)
277
278 #define TRB_INTR_SHIFT 22
279 #define TRB_INTR_MASK 0x3ff
280 #define TRB_INTR(t) (((t).status >> TRB_INTR_SHIFT) & TRB_INTR_MASK)
281
282 #define EP_TYPE_MASK 0x7
283 #define EP_TYPE_SHIFT 3
284
285 #define EP_STATE_MASK 0x7
286 #define EP_DISABLED (0<<0)
287 #define EP_RUNNING (1<<0)
288 #define EP_HALTED (2<<0)
289 #define EP_STOPPED (3<<0)
290 #define EP_ERROR (4<<0)
291
292 #define SLOT_STATE_MASK 0x1f
293 #define SLOT_STATE_SHIFT 27
294 #define SLOT_STATE(s) (((s)>>SLOT_STATE_SHIFT)&SLOT_STATE_MASK)
295 #define SLOT_ENABLED 0
296 #define SLOT_DEFAULT 1
297 #define SLOT_ADDRESSED 2
298 #define SLOT_CONFIGURED 3
299
300 #define SLOT_CONTEXT_ENTRIES_MASK 0x1f
301 #define SLOT_CONTEXT_ENTRIES_SHIFT 27
302
303 typedef struct XHCIState XHCIState;
304
305 #define get_field(data, field) \
306 (((data) >> field##_SHIFT) & field##_MASK)
307
308 #define set_field(data, newval, field) do { \
309 uint32_t val = *data; \
310 val &= ~(field##_MASK << field##_SHIFT); \
311 val |= ((newval) & field##_MASK) << field##_SHIFT; \
312 *data = val; \
313 } while (0)
314
315 typedef enum EPType {
316 ET_INVALID = 0,
317 ET_ISO_OUT,
318 ET_BULK_OUT,
319 ET_INTR_OUT,
320 ET_CONTROL,
321 ET_ISO_IN,
322 ET_BULK_IN,
323 ET_INTR_IN,
324 } EPType;
325
326 typedef struct XHCIRing {
327 dma_addr_t base;
328 dma_addr_t dequeue;
329 bool ccs;
330 } XHCIRing;
331
332 typedef struct XHCIPort {
333 XHCIState *xhci;
334 uint32_t portsc;
335 uint32_t portnr;
336 USBPort *uport;
337 uint32_t speedmask;
338 char name[16];
339 MemoryRegion mem;
340 } XHCIPort;
341
342 typedef struct XHCITransfer {
343 XHCIState *xhci;
344 USBPacket packet;
345 QEMUSGList sgl;
346 bool running_async;
347 bool running_retry;
348 bool cancelled;
349 bool complete;
350 bool int_req;
351 unsigned int iso_pkts;
352 unsigned int slotid;
353 unsigned int epid;
354 bool in_xfer;
355 bool iso_xfer;
356
357 unsigned int trb_count;
358 unsigned int trb_alloced;
359 XHCITRB *trbs;
360
361 TRBCCode status;
362
363 unsigned int pkts;
364 unsigned int pktsize;
365 unsigned int cur_pkt;
366
367 uint64_t mfindex_kick;
368 } XHCITransfer;
369
370 typedef struct XHCIEPContext {
371 XHCIState *xhci;
372 unsigned int slotid;
373 unsigned int epid;
374
375 XHCIRing ring;
376 unsigned int next_xfer;
377 unsigned int comp_xfer;
378 XHCITransfer transfers[TD_QUEUE];
379 XHCITransfer *retry;
380 EPType type;
381 dma_addr_t pctx;
382 unsigned int max_psize;
383 uint32_t state;
384
385 /* iso xfer scheduling */
386 unsigned int interval;
387 int64_t mfindex_last;
388 QEMUTimer *kick_timer;
389 } XHCIEPContext;
390
391 typedef struct XHCISlot {
392 bool enabled;
393 dma_addr_t ctx;
394 USBPort *uport;
395 unsigned int devaddr;
396 XHCIEPContext * eps[31];
397 } XHCISlot;
398
399 typedef struct XHCIEvent {
400 TRBType type;
401 TRBCCode ccode;
402 uint64_t ptr;
403 uint32_t length;
404 uint32_t flags;
405 uint8_t slotid;
406 uint8_t epid;
407 } XHCIEvent;
408
409 typedef struct XHCIInterrupter {
410 uint32_t iman;
411 uint32_t imod;
412 uint32_t erstsz;
413 uint32_t erstba_low;
414 uint32_t erstba_high;
415 uint32_t erdp_low;
416 uint32_t erdp_high;
417
418 bool msix_used, er_pcs, er_full;
419
420 dma_addr_t er_start;
421 uint32_t er_size;
422 unsigned int er_ep_idx;
423
424 XHCIEvent ev_buffer[EV_QUEUE];
425 unsigned int ev_buffer_put;
426 unsigned int ev_buffer_get;
427
428 } XHCIInterrupter;
429
430 struct XHCIState {
431 PCIDevice pci_dev;
432 USBBus bus;
433 qemu_irq irq;
434 MemoryRegion mem;
435 MemoryRegion mem_cap;
436 MemoryRegion mem_oper;
437 MemoryRegion mem_runtime;
438 MemoryRegion mem_doorbell;
439 const char *name;
440 unsigned int devaddr;
441
442 /* properties */
443 uint32_t numports_2;
444 uint32_t numports_3;
445 uint32_t numintrs;
446 uint32_t numslots;
447 uint32_t flags;
448
449 /* Operational Registers */
450 uint32_t usbcmd;
451 uint32_t usbsts;
452 uint32_t dnctrl;
453 uint32_t crcr_low;
454 uint32_t crcr_high;
455 uint32_t dcbaap_low;
456 uint32_t dcbaap_high;
457 uint32_t config;
458
459 USBPort uports[MAX(MAXPORTS_2, MAXPORTS_3)];
460 XHCIPort ports[MAXPORTS];
461 XHCISlot slots[MAXSLOTS];
462 uint32_t numports;
463
464 /* Runtime Registers */
465 int64_t mfindex_start;
466 QEMUTimer *mfwrap_timer;
467 XHCIInterrupter intr[MAXINTRS];
468
469 XHCIRing cmd_ring;
470 };
471
472 typedef struct XHCIEvRingSeg {
473 uint32_t addr_low;
474 uint32_t addr_high;
475 uint32_t size;
476 uint32_t rsvd;
477 } XHCIEvRingSeg;
478
479 enum xhci_flags {
480 XHCI_FLAG_USE_MSI = 1,
481 XHCI_FLAG_USE_MSI_X,
482 };
483
484 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
485 unsigned int epid);
486 static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
487 unsigned int epid);
488 static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v);
489 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v);
490
491 static const char *TRBType_names[] = {
492 [TRB_RESERVED] = "TRB_RESERVED",
493 [TR_NORMAL] = "TR_NORMAL",
494 [TR_SETUP] = "TR_SETUP",
495 [TR_DATA] = "TR_DATA",
496 [TR_STATUS] = "TR_STATUS",
497 [TR_ISOCH] = "TR_ISOCH",
498 [TR_LINK] = "TR_LINK",
499 [TR_EVDATA] = "TR_EVDATA",
500 [TR_NOOP] = "TR_NOOP",
501 [CR_ENABLE_SLOT] = "CR_ENABLE_SLOT",
502 [CR_DISABLE_SLOT] = "CR_DISABLE_SLOT",
503 [CR_ADDRESS_DEVICE] = "CR_ADDRESS_DEVICE",
504 [CR_CONFIGURE_ENDPOINT] = "CR_CONFIGURE_ENDPOINT",
505 [CR_EVALUATE_CONTEXT] = "CR_EVALUATE_CONTEXT",
506 [CR_RESET_ENDPOINT] = "CR_RESET_ENDPOINT",
507 [CR_STOP_ENDPOINT] = "CR_STOP_ENDPOINT",
508 [CR_SET_TR_DEQUEUE] = "CR_SET_TR_DEQUEUE",
509 [CR_RESET_DEVICE] = "CR_RESET_DEVICE",
510 [CR_FORCE_EVENT] = "CR_FORCE_EVENT",
511 [CR_NEGOTIATE_BW] = "CR_NEGOTIATE_BW",
512 [CR_SET_LATENCY_TOLERANCE] = "CR_SET_LATENCY_TOLERANCE",
513 [CR_GET_PORT_BANDWIDTH] = "CR_GET_PORT_BANDWIDTH",
514 [CR_FORCE_HEADER] = "CR_FORCE_HEADER",
515 [CR_NOOP] = "CR_NOOP",
516 [ER_TRANSFER] = "ER_TRANSFER",
517 [ER_COMMAND_COMPLETE] = "ER_COMMAND_COMPLETE",
518 [ER_PORT_STATUS_CHANGE] = "ER_PORT_STATUS_CHANGE",
519 [ER_BANDWIDTH_REQUEST] = "ER_BANDWIDTH_REQUEST",
520 [ER_DOORBELL] = "ER_DOORBELL",
521 [ER_HOST_CONTROLLER] = "ER_HOST_CONTROLLER",
522 [ER_DEVICE_NOTIFICATION] = "ER_DEVICE_NOTIFICATION",
523 [ER_MFINDEX_WRAP] = "ER_MFINDEX_WRAP",
524 [CR_VENDOR_VIA_CHALLENGE_RESPONSE] = "CR_VENDOR_VIA_CHALLENGE_RESPONSE",
525 [CR_VENDOR_NEC_FIRMWARE_REVISION] = "CR_VENDOR_NEC_FIRMWARE_REVISION",
526 [CR_VENDOR_NEC_CHALLENGE_RESPONSE] = "CR_VENDOR_NEC_CHALLENGE_RESPONSE",
527 };
528
529 static const char *TRBCCode_names[] = {
530 [CC_INVALID] = "CC_INVALID",
531 [CC_SUCCESS] = "CC_SUCCESS",
532 [CC_DATA_BUFFER_ERROR] = "CC_DATA_BUFFER_ERROR",
533 [CC_BABBLE_DETECTED] = "CC_BABBLE_DETECTED",
534 [CC_USB_TRANSACTION_ERROR] = "CC_USB_TRANSACTION_ERROR",
535 [CC_TRB_ERROR] = "CC_TRB_ERROR",
536 [CC_STALL_ERROR] = "CC_STALL_ERROR",
537 [CC_RESOURCE_ERROR] = "CC_RESOURCE_ERROR",
538 [CC_BANDWIDTH_ERROR] = "CC_BANDWIDTH_ERROR",
539 [CC_NO_SLOTS_ERROR] = "CC_NO_SLOTS_ERROR",
540 [CC_INVALID_STREAM_TYPE_ERROR] = "CC_INVALID_STREAM_TYPE_ERROR",
541 [CC_SLOT_NOT_ENABLED_ERROR] = "CC_SLOT_NOT_ENABLED_ERROR",
542 [CC_EP_NOT_ENABLED_ERROR] = "CC_EP_NOT_ENABLED_ERROR",
543 [CC_SHORT_PACKET] = "CC_SHORT_PACKET",
544 [CC_RING_UNDERRUN] = "CC_RING_UNDERRUN",
545 [CC_RING_OVERRUN] = "CC_RING_OVERRUN",
546 [CC_VF_ER_FULL] = "CC_VF_ER_FULL",
547 [CC_PARAMETER_ERROR] = "CC_PARAMETER_ERROR",
548 [CC_BANDWIDTH_OVERRUN] = "CC_BANDWIDTH_OVERRUN",
549 [CC_CONTEXT_STATE_ERROR] = "CC_CONTEXT_STATE_ERROR",
550 [CC_NO_PING_RESPONSE_ERROR] = "CC_NO_PING_RESPONSE_ERROR",
551 [CC_EVENT_RING_FULL_ERROR] = "CC_EVENT_RING_FULL_ERROR",
552 [CC_INCOMPATIBLE_DEVICE_ERROR] = "CC_INCOMPATIBLE_DEVICE_ERROR",
553 [CC_MISSED_SERVICE_ERROR] = "CC_MISSED_SERVICE_ERROR",
554 [CC_COMMAND_RING_STOPPED] = "CC_COMMAND_RING_STOPPED",
555 [CC_COMMAND_ABORTED] = "CC_COMMAND_ABORTED",
556 [CC_STOPPED] = "CC_STOPPED",
557 [CC_STOPPED_LENGTH_INVALID] = "CC_STOPPED_LENGTH_INVALID",
558 [CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR]
559 = "CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR",
560 [CC_ISOCH_BUFFER_OVERRUN] = "CC_ISOCH_BUFFER_OVERRUN",
561 [CC_EVENT_LOST_ERROR] = "CC_EVENT_LOST_ERROR",
562 [CC_UNDEFINED_ERROR] = "CC_UNDEFINED_ERROR",
563 [CC_INVALID_STREAM_ID_ERROR] = "CC_INVALID_STREAM_ID_ERROR",
564 [CC_SECONDARY_BANDWIDTH_ERROR] = "CC_SECONDARY_BANDWIDTH_ERROR",
565 [CC_SPLIT_TRANSACTION_ERROR] = "CC_SPLIT_TRANSACTION_ERROR",
566 };
567
568 static const char *lookup_name(uint32_t index, const char **list, uint32_t llen)
569 {
570 if (index >= llen || list[index] == NULL) {
571 return "???";
572 }
573 return list[index];
574 }
575
576 static const char *trb_name(XHCITRB *trb)
577 {
578 return lookup_name(TRB_TYPE(*trb), TRBType_names,
579 ARRAY_SIZE(TRBType_names));
580 }
581
582 static const char *event_name(XHCIEvent *event)
583 {
584 return lookup_name(event->ccode, TRBCCode_names,
585 ARRAY_SIZE(TRBCCode_names));
586 }
587
588 static uint64_t xhci_mfindex_get(XHCIState *xhci)
589 {
590 int64_t now = qemu_get_clock_ns(vm_clock);
591 return (now - xhci->mfindex_start) / 125000;
592 }
593
594 static void xhci_mfwrap_update(XHCIState *xhci)
595 {
596 const uint32_t bits = USBCMD_RS | USBCMD_EWE;
597 uint32_t mfindex, left;
598 int64_t now;
599
600 if ((xhci->usbcmd & bits) == bits) {
601 now = qemu_get_clock_ns(vm_clock);
602 mfindex = ((now - xhci->mfindex_start) / 125000) & 0x3fff;
603 left = 0x4000 - mfindex;
604 qemu_mod_timer(xhci->mfwrap_timer, now + left * 125000);
605 } else {
606 qemu_del_timer(xhci->mfwrap_timer);
607 }
608 }
609
610 static void xhci_mfwrap_timer(void *opaque)
611 {
612 XHCIState *xhci = opaque;
613 XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS };
614
615 xhci_event(xhci, &wrap, 0);
616 xhci_mfwrap_update(xhci);
617 }
618
619 static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
620 {
621 if (sizeof(dma_addr_t) == 4) {
622 return low;
623 } else {
624 return low | (((dma_addr_t)high << 16) << 16);
625 }
626 }
627
628 static inline dma_addr_t xhci_mask64(uint64_t addr)
629 {
630 if (sizeof(dma_addr_t) == 4) {
631 return addr & 0xffffffff;
632 } else {
633 return addr;
634 }
635 }
636
637 static inline void xhci_dma_read_u32s(XHCIState *xhci, dma_addr_t addr,
638 uint32_t *buf, size_t len)
639 {
640 int i;
641
642 assert((len % sizeof(uint32_t)) == 0);
643
644 pci_dma_read(&xhci->pci_dev, addr, buf, len);
645
646 for (i = 0; i < (len / sizeof(uint32_t)); i++) {
647 buf[i] = le32_to_cpu(buf[i]);
648 }
649 }
650
651 static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
652 uint32_t *buf, size_t len)
653 {
654 int i;
655 uint32_t tmp[len / sizeof(uint32_t)];
656
657 assert((len % sizeof(uint32_t)) == 0);
658
659 for (i = 0; i < (len / sizeof(uint32_t)); i++) {
660 tmp[i] = cpu_to_le32(buf[i]);
661 }
662 pci_dma_write(&xhci->pci_dev, addr, tmp, len);
663 }
664
665 static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
666 {
667 int index;
668
669 if (!uport->dev) {
670 return NULL;
671 }
672 switch (uport->dev->speed) {
673 case USB_SPEED_LOW:
674 case USB_SPEED_FULL:
675 case USB_SPEED_HIGH:
676 index = uport->index;
677 break;
678 case USB_SPEED_SUPER:
679 index = uport->index + xhci->numports_2;
680 break;
681 default:
682 return NULL;
683 }
684 return &xhci->ports[index];
685 }
686
687 static void xhci_intx_update(XHCIState *xhci)
688 {
689 int level = 0;
690
691 if (msix_enabled(&xhci->pci_dev) ||
692 msi_enabled(&xhci->pci_dev)) {
693 return;
694 }
695
696 if (xhci->intr[0].iman & IMAN_IP &&
697 xhci->intr[0].iman & IMAN_IE &&
698 xhci->usbcmd & USBCMD_INTE) {
699 level = 1;
700 }
701
702 trace_usb_xhci_irq_intx(level);
703 qemu_set_irq(xhci->irq, level);
704 }
705
706 static void xhci_msix_update(XHCIState *xhci, int v)
707 {
708 bool enabled;
709
710 if (!msix_enabled(&xhci->pci_dev)) {
711 return;
712 }
713
714 enabled = xhci->intr[v].iman & IMAN_IE;
715 if (enabled == xhci->intr[v].msix_used) {
716 return;
717 }
718
719 if (enabled) {
720 trace_usb_xhci_irq_msix_use(v);
721 msix_vector_use(&xhci->pci_dev, v);
722 xhci->intr[v].msix_used = true;
723 } else {
724 trace_usb_xhci_irq_msix_unuse(v);
725 msix_vector_unuse(&xhci->pci_dev, v);
726 xhci->intr[v].msix_used = false;
727 }
728 }
729
730 static void xhci_intr_raise(XHCIState *xhci, int v)
731 {
732 xhci->intr[v].erdp_low |= ERDP_EHB;
733 xhci->intr[v].iman |= IMAN_IP;
734 xhci->usbsts |= USBSTS_EINT;
735
736 if (!(xhci->intr[v].iman & IMAN_IE)) {
737 return;
738 }
739
740 if (!(xhci->usbcmd & USBCMD_INTE)) {
741 return;
742 }
743
744 if (msix_enabled(&xhci->pci_dev)) {
745 trace_usb_xhci_irq_msix(v);
746 msix_notify(&xhci->pci_dev, v);
747 return;
748 }
749
750 if (msi_enabled(&xhci->pci_dev)) {
751 trace_usb_xhci_irq_msi(v);
752 msi_notify(&xhci->pci_dev, v);
753 return;
754 }
755
756 if (v == 0) {
757 trace_usb_xhci_irq_intx(1);
758 qemu_set_irq(xhci->irq, 1);
759 }
760 }
761
762 static inline int xhci_running(XHCIState *xhci)
763 {
764 return !(xhci->usbsts & USBSTS_HCH) && !xhci->intr[0].er_full;
765 }
766
767 static void xhci_die(XHCIState *xhci)
768 {
769 xhci->usbsts |= USBSTS_HCE;
770 fprintf(stderr, "xhci: asserted controller error\n");
771 }
772
773 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
774 {
775 XHCIInterrupter *intr = &xhci->intr[v];
776 XHCITRB ev_trb;
777 dma_addr_t addr;
778
779 ev_trb.parameter = cpu_to_le64(event->ptr);
780 ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
781 ev_trb.control = (event->slotid << 24) | (event->epid << 16) |
782 event->flags | (event->type << TRB_TYPE_SHIFT);
783 if (intr->er_pcs) {
784 ev_trb.control |= TRB_C;
785 }
786 ev_trb.control = cpu_to_le32(ev_trb.control);
787
788 trace_usb_xhci_queue_event(v, intr->er_ep_idx, trb_name(&ev_trb),
789 event_name(event), ev_trb.parameter,
790 ev_trb.status, ev_trb.control);
791
792 addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
793 pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
794
795 intr->er_ep_idx++;
796 if (intr->er_ep_idx >= intr->er_size) {
797 intr->er_ep_idx = 0;
798 intr->er_pcs = !intr->er_pcs;
799 }
800 }
801
802 static void xhci_events_update(XHCIState *xhci, int v)
803 {
804 XHCIInterrupter *intr = &xhci->intr[v];
805 dma_addr_t erdp;
806 unsigned int dp_idx;
807 bool do_irq = 0;
808
809 if (xhci->usbsts & USBSTS_HCH) {
810 return;
811 }
812
813 erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
814 if (erdp < intr->er_start ||
815 erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
816 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
817 fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
818 v, intr->er_start, intr->er_size);
819 xhci_die(xhci);
820 return;
821 }
822 dp_idx = (erdp - intr->er_start) / TRB_SIZE;
823 assert(dp_idx < intr->er_size);
824
825 /* NEC didn't read section 4.9.4 of the spec (v1.0 p139 top Note) and thus
826 * deadlocks when the ER is full. Hack it by holding off events until
827 * the driver decides to free at least half of the ring */
828 if (intr->er_full) {
829 int er_free = dp_idx - intr->er_ep_idx;
830 if (er_free <= 0) {
831 er_free += intr->er_size;
832 }
833 if (er_free < (intr->er_size/2)) {
834 DPRINTF("xhci_events_update(): event ring still "
835 "more than half full (hack)\n");
836 return;
837 }
838 }
839
840 while (intr->ev_buffer_put != intr->ev_buffer_get) {
841 assert(intr->er_full);
842 if (((intr->er_ep_idx+1) % intr->er_size) == dp_idx) {
843 DPRINTF("xhci_events_update(): event ring full again\n");
844 #ifndef ER_FULL_HACK
845 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
846 xhci_write_event(xhci, &full, v);
847 #endif
848 do_irq = 1;
849 break;
850 }
851 XHCIEvent *event = &intr->ev_buffer[intr->ev_buffer_get];
852 xhci_write_event(xhci, event, v);
853 intr->ev_buffer_get++;
854 do_irq = 1;
855 if (intr->ev_buffer_get == EV_QUEUE) {
856 intr->ev_buffer_get = 0;
857 }
858 }
859
860 if (do_irq) {
861 xhci_intr_raise(xhci, v);
862 }
863
864 if (intr->er_full && intr->ev_buffer_put == intr->ev_buffer_get) {
865 DPRINTF("xhci_events_update(): event ring no longer full\n");
866 intr->er_full = 0;
867 }
868 }
869
870 static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v)
871 {
872 XHCIInterrupter *intr;
873 dma_addr_t erdp;
874 unsigned int dp_idx;
875
876 if (v >= xhci->numintrs) {
877 DPRINTF("intr nr out of range (%d >= %d)\n", v, xhci->numintrs);
878 return;
879 }
880 intr = &xhci->intr[v];
881
882 if (intr->er_full) {
883 DPRINTF("xhci_event(): ER full, queueing\n");
884 if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
885 fprintf(stderr, "xhci: event queue full, dropping event!\n");
886 return;
887 }
888 intr->ev_buffer[intr->ev_buffer_put++] = *event;
889 if (intr->ev_buffer_put == EV_QUEUE) {
890 intr->ev_buffer_put = 0;
891 }
892 return;
893 }
894
895 erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
896 if (erdp < intr->er_start ||
897 erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
898 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
899 fprintf(stderr, "xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
900 v, intr->er_start, intr->er_size);
901 xhci_die(xhci);
902 return;
903 }
904
905 dp_idx = (erdp - intr->er_start) / TRB_SIZE;
906 assert(dp_idx < intr->er_size);
907
908 if ((intr->er_ep_idx+1) % intr->er_size == dp_idx) {
909 DPRINTF("xhci_event(): ER full, queueing\n");
910 #ifndef ER_FULL_HACK
911 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
912 xhci_write_event(xhci, &full);
913 #endif
914 intr->er_full = 1;
915 if (((intr->ev_buffer_put+1) % EV_QUEUE) == intr->ev_buffer_get) {
916 fprintf(stderr, "xhci: event queue full, dropping event!\n");
917 return;
918 }
919 intr->ev_buffer[intr->ev_buffer_put++] = *event;
920 if (intr->ev_buffer_put == EV_QUEUE) {
921 intr->ev_buffer_put = 0;
922 }
923 } else {
924 xhci_write_event(xhci, event, v);
925 }
926
927 xhci_intr_raise(xhci, v);
928 }
929
930 static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
931 dma_addr_t base)
932 {
933 ring->base = base;
934 ring->dequeue = base;
935 ring->ccs = 1;
936 }
937
938 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
939 dma_addr_t *addr)
940 {
941 while (1) {
942 TRBType type;
943 pci_dma_read(&xhci->pci_dev, ring->dequeue, trb, TRB_SIZE);
944 trb->addr = ring->dequeue;
945 trb->ccs = ring->ccs;
946 le64_to_cpus(&trb->parameter);
947 le32_to_cpus(&trb->status);
948 le32_to_cpus(&trb->control);
949
950 trace_usb_xhci_fetch_trb(ring->dequeue, trb_name(trb),
951 trb->parameter, trb->status, trb->control);
952
953 if ((trb->control & TRB_C) != ring->ccs) {
954 return 0;
955 }
956
957 type = TRB_TYPE(*trb);
958
959 if (type != TR_LINK) {
960 if (addr) {
961 *addr = ring->dequeue;
962 }
963 ring->dequeue += TRB_SIZE;
964 return type;
965 } else {
966 ring->dequeue = xhci_mask64(trb->parameter);
967 if (trb->control & TRB_LK_TC) {
968 ring->ccs = !ring->ccs;
969 }
970 }
971 }
972 }
973
974 static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
975 {
976 XHCITRB trb;
977 int length = 0;
978 dma_addr_t dequeue = ring->dequeue;
979 bool ccs = ring->ccs;
980 /* hack to bundle together the two/three TDs that make a setup transfer */
981 bool control_td_set = 0;
982
983 while (1) {
984 TRBType type;
985 pci_dma_read(&xhci->pci_dev, dequeue, &trb, TRB_SIZE);
986 le64_to_cpus(&trb.parameter);
987 le32_to_cpus(&trb.status);
988 le32_to_cpus(&trb.control);
989
990 if ((trb.control & TRB_C) != ccs) {
991 return -length;
992 }
993
994 type = TRB_TYPE(trb);
995
996 if (type == TR_LINK) {
997 dequeue = xhci_mask64(trb.parameter);
998 if (trb.control & TRB_LK_TC) {
999 ccs = !ccs;
1000 }
1001 continue;
1002 }
1003
1004 length += 1;
1005 dequeue += TRB_SIZE;
1006
1007 if (type == TR_SETUP) {
1008 control_td_set = 1;
1009 } else if (type == TR_STATUS) {
1010 control_td_set = 0;
1011 }
1012
1013 if (!control_td_set && !(trb.control & TRB_TR_CH)) {
1014 return length;
1015 }
1016 }
1017 }
1018
1019 static void xhci_er_reset(XHCIState *xhci, int v)
1020 {
1021 XHCIInterrupter *intr = &xhci->intr[v];
1022 XHCIEvRingSeg seg;
1023
1024 if (intr->erstsz == 0) {
1025 /* disabled */
1026 intr->er_start = 0;
1027 intr->er_size = 0;
1028 return;
1029 }
1030 /* cache the (sole) event ring segment location */
1031 if (intr->erstsz != 1) {
1032 fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
1033 xhci_die(xhci);
1034 return;
1035 }
1036 dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);
1037 pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg));
1038 le32_to_cpus(&seg.addr_low);
1039 le32_to_cpus(&seg.addr_high);
1040 le32_to_cpus(&seg.size);
1041 if (seg.size < 16 || seg.size > 4096) {
1042 fprintf(stderr, "xhci: invalid value for segment size: %d\n", seg.size);
1043 xhci_die(xhci);
1044 return;
1045 }
1046 intr->er_start = xhci_addr64(seg.addr_low, seg.addr_high);
1047 intr->er_size = seg.size;
1048
1049 intr->er_ep_idx = 0;
1050 intr->er_pcs = 1;
1051 intr->er_full = 0;
1052
1053 DPRINTF("xhci: event ring[%d]:" DMA_ADDR_FMT " [%d]\n",
1054 v, intr->er_start, intr->er_size);
1055 }
1056
1057 static void xhci_run(XHCIState *xhci)
1058 {
1059 trace_usb_xhci_run();
1060 xhci->usbsts &= ~USBSTS_HCH;
1061 xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
1062 }
1063
1064 static void xhci_stop(XHCIState *xhci)
1065 {
1066 trace_usb_xhci_stop();
1067 xhci->usbsts |= USBSTS_HCH;
1068 xhci->crcr_low &= ~CRCR_CRR;
1069 }
1070
1071 static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
1072 uint32_t state)
1073 {
1074 uint32_t ctx[5];
1075
1076 xhci_dma_read_u32s(xhci, epctx->pctx, ctx, sizeof(ctx));
1077 ctx[0] &= ~EP_STATE_MASK;
1078 ctx[0] |= state;
1079 ctx[2] = epctx->ring.dequeue | epctx->ring.ccs;
1080 ctx[3] = (epctx->ring.dequeue >> 16) >> 16;
1081 DPRINTF("xhci: set epctx: " DMA_ADDR_FMT " state=%d dequeue=%08x%08x\n",
1082 epctx->pctx, state, ctx[3], ctx[2]);
1083 xhci_dma_write_u32s(xhci, epctx->pctx, ctx, sizeof(ctx));
1084 epctx->state = state;
1085 }
1086
1087 static void xhci_ep_kick_timer(void *opaque)
1088 {
1089 XHCIEPContext *epctx = opaque;
1090 xhci_kick_ep(epctx->xhci, epctx->slotid, epctx->epid);
1091 }
1092
1093 static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
1094 unsigned int epid, dma_addr_t pctx,
1095 uint32_t *ctx)
1096 {
1097 XHCISlot *slot;
1098 XHCIEPContext *epctx;
1099 dma_addr_t dequeue;
1100 int i;
1101
1102 trace_usb_xhci_ep_enable(slotid, epid);
1103 assert(slotid >= 1 && slotid <= xhci->numslots);
1104 assert(epid >= 1 && epid <= 31);
1105
1106 slot = &xhci->slots[slotid-1];
1107 if (slot->eps[epid-1]) {
1108 xhci_disable_ep(xhci, slotid, epid);
1109 }
1110
1111 epctx = g_malloc(sizeof(XHCIEPContext));
1112 memset(epctx, 0, sizeof(XHCIEPContext));
1113 epctx->xhci = xhci;
1114 epctx->slotid = slotid;
1115 epctx->epid = epid;
1116
1117 slot->eps[epid-1] = epctx;
1118
1119 dequeue = xhci_addr64(ctx[2] & ~0xf, ctx[3]);
1120 xhci_ring_init(xhci, &epctx->ring, dequeue);
1121 epctx->ring.ccs = ctx[2] & 1;
1122
1123 epctx->type = (ctx[1] >> EP_TYPE_SHIFT) & EP_TYPE_MASK;
1124 DPRINTF("xhci: endpoint %d.%d type is %d\n", epid/2, epid%2, epctx->type);
1125 epctx->pctx = pctx;
1126 epctx->max_psize = ctx[1]>>16;
1127 epctx->max_psize *= 1+((ctx[1]>>8)&0xff);
1128 DPRINTF("xhci: endpoint %d.%d max transaction (burst) size is %d\n",
1129 epid/2, epid%2, epctx->max_psize);
1130 for (i = 0; i < ARRAY_SIZE(epctx->transfers); i++) {
1131 usb_packet_init(&epctx->transfers[i].packet);
1132 }
1133
1134 epctx->interval = 1 << (ctx[0] >> 16) & 0xff;
1135 epctx->mfindex_last = 0;
1136 epctx->kick_timer = qemu_new_timer_ns(vm_clock, xhci_ep_kick_timer, epctx);
1137
1138 epctx->state = EP_RUNNING;
1139 ctx[0] &= ~EP_STATE_MASK;
1140 ctx[0] |= EP_RUNNING;
1141
1142 return CC_SUCCESS;
1143 }
1144
1145 static int xhci_ep_nuke_one_xfer(XHCITransfer *t)
1146 {
1147 int killed = 0;
1148
1149 if (t->running_async) {
1150 usb_cancel_packet(&t->packet);
1151 t->running_async = 0;
1152 t->cancelled = 1;
1153 DPRINTF("xhci: cancelling transfer, waiting for it to complete\n");
1154 killed = 1;
1155 }
1156 if (t->running_retry) {
1157 XHCIEPContext *epctx = t->xhci->slots[t->slotid-1].eps[t->epid-1];
1158 if (epctx) {
1159 epctx->retry = NULL;
1160 qemu_del_timer(epctx->kick_timer);
1161 }
1162 t->running_retry = 0;
1163 }
1164 if (t->trbs) {
1165 g_free(t->trbs);
1166 }
1167
1168 t->trbs = NULL;
1169 t->trb_count = t->trb_alloced = 0;
1170
1171 return killed;
1172 }
1173
1174 static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
1175 unsigned int epid)
1176 {
1177 XHCISlot *slot;
1178 XHCIEPContext *epctx;
1179 int i, xferi, killed = 0;
1180 USBEndpoint *ep = NULL;
1181 assert(slotid >= 1 && slotid <= xhci->numslots);
1182 assert(epid >= 1 && epid <= 31);
1183
1184 DPRINTF("xhci_ep_nuke_xfers(%d, %d)\n", slotid, epid);
1185
1186 slot = &xhci->slots[slotid-1];
1187
1188 if (!slot->eps[epid-1]) {
1189 return 0;
1190 }
1191
1192 epctx = slot->eps[epid-1];
1193
1194 xferi = epctx->next_xfer;
1195 for (i = 0; i < TD_QUEUE; i++) {
1196 if (epctx->transfers[xferi].packet.ep) {
1197 ep = epctx->transfers[xferi].packet.ep;
1198 }
1199 killed += xhci_ep_nuke_one_xfer(&epctx->transfers[xferi]);
1200 xferi = (xferi + 1) % TD_QUEUE;
1201 }
1202 if (ep) {
1203 usb_device_ep_stopped(ep->dev, ep);
1204 }
1205 return killed;
1206 }
1207
1208 static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
1209 unsigned int epid)
1210 {
1211 XHCISlot *slot;
1212 XHCIEPContext *epctx;
1213
1214 trace_usb_xhci_ep_disable(slotid, epid);
1215 assert(slotid >= 1 && slotid <= xhci->numslots);
1216 assert(epid >= 1 && epid <= 31);
1217
1218 slot = &xhci->slots[slotid-1];
1219
1220 if (!slot->eps[epid-1]) {
1221 DPRINTF("xhci: slot %d ep %d already disabled\n", slotid, epid);
1222 return CC_SUCCESS;
1223 }
1224
1225 xhci_ep_nuke_xfers(xhci, slotid, epid);
1226
1227 epctx = slot->eps[epid-1];
1228
1229 xhci_set_ep_state(xhci, epctx, EP_DISABLED);
1230
1231 qemu_free_timer(epctx->kick_timer);
1232 g_free(epctx);
1233 slot->eps[epid-1] = NULL;
1234
1235 return CC_SUCCESS;
1236 }
1237
1238 static TRBCCode xhci_stop_ep(XHCIState *xhci, unsigned int slotid,
1239 unsigned int epid)
1240 {
1241 XHCISlot *slot;
1242 XHCIEPContext *epctx;
1243
1244 trace_usb_xhci_ep_stop(slotid, epid);
1245 assert(slotid >= 1 && slotid <= xhci->numslots);
1246
1247 if (epid < 1 || epid > 31) {
1248 fprintf(stderr, "xhci: bad ep %d\n", epid);
1249 return CC_TRB_ERROR;
1250 }
1251
1252 slot = &xhci->slots[slotid-1];
1253
1254 if (!slot->eps[epid-1]) {
1255 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1256 return CC_EP_NOT_ENABLED_ERROR;
1257 }
1258
1259 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) {
1260 fprintf(stderr, "xhci: FIXME: endpoint stopped w/ xfers running, "
1261 "data might be lost\n");
1262 }
1263
1264 epctx = slot->eps[epid-1];
1265
1266 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1267
1268 return CC_SUCCESS;
1269 }
1270
1271 static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
1272 unsigned int epid)
1273 {
1274 XHCISlot *slot;
1275 XHCIEPContext *epctx;
1276 USBDevice *dev;
1277
1278 trace_usb_xhci_ep_reset(slotid, epid);
1279 assert(slotid >= 1 && slotid <= xhci->numslots);
1280
1281 if (epid < 1 || epid > 31) {
1282 fprintf(stderr, "xhci: bad ep %d\n", epid);
1283 return CC_TRB_ERROR;
1284 }
1285
1286 slot = &xhci->slots[slotid-1];
1287
1288 if (!slot->eps[epid-1]) {
1289 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1290 return CC_EP_NOT_ENABLED_ERROR;
1291 }
1292
1293 epctx = slot->eps[epid-1];
1294
1295 if (epctx->state != EP_HALTED) {
1296 fprintf(stderr, "xhci: reset EP while EP %d not halted (%d)\n",
1297 epid, epctx->state);
1298 return CC_CONTEXT_STATE_ERROR;
1299 }
1300
1301 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) {
1302 fprintf(stderr, "xhci: FIXME: endpoint reset w/ xfers running, "
1303 "data might be lost\n");
1304 }
1305
1306 uint8_t ep = epid>>1;
1307
1308 if (epid & 1) {
1309 ep |= 0x80;
1310 }
1311
1312 dev = xhci->slots[slotid-1].uport->dev;
1313 if (!dev) {
1314 return CC_USB_TRANSACTION_ERROR;
1315 }
1316
1317 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1318
1319 return CC_SUCCESS;
1320 }
1321
1322 static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
1323 unsigned int epid, uint64_t pdequeue)
1324 {
1325 XHCISlot *slot;
1326 XHCIEPContext *epctx;
1327 dma_addr_t dequeue;
1328
1329 assert(slotid >= 1 && slotid <= xhci->numslots);
1330
1331 if (epid < 1 || epid > 31) {
1332 fprintf(stderr, "xhci: bad ep %d\n", epid);
1333 return CC_TRB_ERROR;
1334 }
1335
1336 trace_usb_xhci_ep_set_dequeue(slotid, epid, pdequeue);
1337 dequeue = xhci_mask64(pdequeue);
1338
1339 slot = &xhci->slots[slotid-1];
1340
1341 if (!slot->eps[epid-1]) {
1342 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
1343 return CC_EP_NOT_ENABLED_ERROR;
1344 }
1345
1346 epctx = slot->eps[epid-1];
1347
1348
1349 if (epctx->state != EP_STOPPED) {
1350 fprintf(stderr, "xhci: set EP dequeue pointer while EP %d not stopped\n", epid);
1351 return CC_CONTEXT_STATE_ERROR;
1352 }
1353
1354 xhci_ring_init(xhci, &epctx->ring, dequeue & ~0xF);
1355 epctx->ring.ccs = dequeue & 1;
1356
1357 xhci_set_ep_state(xhci, epctx, EP_STOPPED);
1358
1359 return CC_SUCCESS;
1360 }
1361
1362 static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
1363 {
1364 XHCIState *xhci = xfer->xhci;
1365 int i;
1366
1367 xfer->int_req = false;
1368 pci_dma_sglist_init(&xfer->sgl, &xhci->pci_dev, xfer->trb_count);
1369 for (i = 0; i < xfer->trb_count; i++) {
1370 XHCITRB *trb = &xfer->trbs[i];
1371 dma_addr_t addr;
1372 unsigned int chunk = 0;
1373
1374 if (trb->control & TRB_TR_IOC) {
1375 xfer->int_req = true;
1376 }
1377
1378 switch (TRB_TYPE(*trb)) {
1379 case TR_DATA:
1380 if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
1381 fprintf(stderr, "xhci: data direction mismatch for TR_DATA\n");
1382 goto err;
1383 }
1384 /* fallthrough */
1385 case TR_NORMAL:
1386 case TR_ISOCH:
1387 addr = xhci_mask64(trb->parameter);
1388 chunk = trb->status & 0x1ffff;
1389 if (trb->control & TRB_TR_IDT) {
1390 if (chunk > 8 || in_xfer) {
1391 fprintf(stderr, "xhci: invalid immediate data TRB\n");
1392 goto err;
1393 }
1394 qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
1395 } else {
1396 qemu_sglist_add(&xfer->sgl, addr, chunk);
1397 }
1398 break;
1399 }
1400 }
1401
1402 return 0;
1403
1404 err:
1405 qemu_sglist_destroy(&xfer->sgl);
1406 xhci_die(xhci);
1407 return -1;
1408 }
1409
1410 static void xhci_xfer_unmap(XHCITransfer *xfer)
1411 {
1412 usb_packet_unmap(&xfer->packet, &xfer->sgl);
1413 qemu_sglist_destroy(&xfer->sgl);
1414 }
1415
1416 static void xhci_xfer_report(XHCITransfer *xfer)
1417 {
1418 uint32_t edtla = 0;
1419 unsigned int left;
1420 bool reported = 0;
1421 bool shortpkt = 0;
1422 XHCIEvent event = {ER_TRANSFER, CC_SUCCESS};
1423 XHCIState *xhci = xfer->xhci;
1424 int i;
1425
1426 left = xfer->packet.actual_length;
1427
1428 for (i = 0; i < xfer->trb_count; i++) {
1429 XHCITRB *trb = &xfer->trbs[i];
1430 unsigned int chunk = 0;
1431
1432 switch (TRB_TYPE(*trb)) {
1433 case TR_DATA:
1434 case TR_NORMAL:
1435 case TR_ISOCH:
1436 chunk = trb->status & 0x1ffff;
1437 if (chunk > left) {
1438 chunk = left;
1439 if (xfer->status == CC_SUCCESS) {
1440 shortpkt = 1;
1441 }
1442 }
1443 left -= chunk;
1444 edtla += chunk;
1445 break;
1446 case TR_STATUS:
1447 reported = 0;
1448 shortpkt = 0;
1449 break;
1450 }
1451
1452 if (!reported && ((trb->control & TRB_TR_IOC) ||
1453 (shortpkt && (trb->control & TRB_TR_ISP)) ||
1454 (xfer->status != CC_SUCCESS && left == 0))) {
1455 event.slotid = xfer->slotid;
1456 event.epid = xfer->epid;
1457 event.length = (trb->status & 0x1ffff) - chunk;
1458 event.flags = 0;
1459 event.ptr = trb->addr;
1460 if (xfer->status == CC_SUCCESS) {
1461 event.ccode = shortpkt ? CC_SHORT_PACKET : CC_SUCCESS;
1462 } else {
1463 event.ccode = xfer->status;
1464 }
1465 if (TRB_TYPE(*trb) == TR_EVDATA) {
1466 event.ptr = trb->parameter;
1467 event.flags |= TRB_EV_ED;
1468 event.length = edtla & 0xffffff;
1469 DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length);
1470 edtla = 0;
1471 }
1472 xhci_event(xhci, &event, TRB_INTR(*trb));
1473 reported = 1;
1474 if (xfer->status != CC_SUCCESS) {
1475 return;
1476 }
1477 }
1478 }
1479 }
1480
1481 static void xhci_stall_ep(XHCITransfer *xfer)
1482 {
1483 XHCIState *xhci = xfer->xhci;
1484 XHCISlot *slot = &xhci->slots[xfer->slotid-1];
1485 XHCIEPContext *epctx = slot->eps[xfer->epid-1];
1486
1487 epctx->ring.dequeue = xfer->trbs[0].addr;
1488 epctx->ring.ccs = xfer->trbs[0].ccs;
1489 xhci_set_ep_state(xhci, epctx, EP_HALTED);
1490 DPRINTF("xhci: stalled slot %d ep %d\n", xfer->slotid, xfer->epid);
1491 DPRINTF("xhci: will continue at "DMA_ADDR_FMT"\n", epctx->ring.dequeue);
1492 }
1493
1494 static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer,
1495 XHCIEPContext *epctx);
1496
1497 static int xhci_setup_packet(XHCITransfer *xfer)
1498 {
1499 XHCIState *xhci = xfer->xhci;
1500 USBDevice *dev;
1501 USBEndpoint *ep;
1502 int dir;
1503
1504 dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT;
1505
1506 if (xfer->packet.ep) {
1507 ep = xfer->packet.ep;
1508 dev = ep->dev;
1509 } else {
1510 if (!xhci->slots[xfer->slotid-1].uport) {
1511 fprintf(stderr, "xhci: slot %d has no device\n",
1512 xfer->slotid);
1513 return -1;
1514 }
1515 dev = xhci->slots[xfer->slotid-1].uport->dev;
1516 ep = usb_ep_get(dev, dir, xfer->epid >> 1);
1517 }
1518
1519 xhci_xfer_create_sgl(xfer, dir == USB_TOKEN_IN); /* Also sets int_req */
1520 usb_packet_setup(&xfer->packet, dir, ep, xfer->trbs[0].addr, false,
1521 xfer->int_req);
1522 usb_packet_map(&xfer->packet, &xfer->sgl);
1523 DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n",
1524 xfer->packet.pid, dev->addr, ep->nr);
1525 return 0;
1526 }
1527
1528 static int xhci_complete_packet(XHCITransfer *xfer)
1529 {
1530 if (xfer->packet.status == USB_RET_ASYNC) {
1531 trace_usb_xhci_xfer_async(xfer);
1532 xfer->running_async = 1;
1533 xfer->running_retry = 0;
1534 xfer->complete = 0;
1535 xfer->cancelled = 0;
1536 return 0;
1537 } else if (xfer->packet.status == USB_RET_NAK) {
1538 trace_usb_xhci_xfer_nak(xfer);
1539 xfer->running_async = 0;
1540 xfer->running_retry = 1;
1541 xfer->complete = 0;
1542 xfer->cancelled = 0;
1543 return 0;
1544 } else {
1545 xfer->running_async = 0;
1546 xfer->running_retry = 0;
1547 xfer->complete = 1;
1548 xhci_xfer_unmap(xfer);
1549 }
1550
1551 if (xfer->packet.status == USB_RET_SUCCESS) {
1552 trace_usb_xhci_xfer_success(xfer, xfer->packet.actual_length);
1553 xfer->status = CC_SUCCESS;
1554 xhci_xfer_report(xfer);
1555 return 0;
1556 }
1557
1558 /* error */
1559 trace_usb_xhci_xfer_error(xfer, xfer->packet.status);
1560 switch (xfer->packet.status) {
1561 case USB_RET_NODEV:
1562 xfer->status = CC_USB_TRANSACTION_ERROR;
1563 xhci_xfer_report(xfer);
1564 xhci_stall_ep(xfer);
1565 break;
1566 case USB_RET_STALL:
1567 xfer->status = CC_STALL_ERROR;
1568 xhci_xfer_report(xfer);
1569 xhci_stall_ep(xfer);
1570 break;
1571 default:
1572 fprintf(stderr, "%s: FIXME: status = %d\n", __func__,
1573 xfer->packet.status);
1574 FIXME();
1575 }
1576 return 0;
1577 }
1578
1579 static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
1580 {
1581 XHCITRB *trb_setup, *trb_status;
1582 uint8_t bmRequestType;
1583
1584 trb_setup = &xfer->trbs[0];
1585 trb_status = &xfer->trbs[xfer->trb_count-1];
1586
1587 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
1588
1589 /* at most one Event Data TRB allowed after STATUS */
1590 if (TRB_TYPE(*trb_status) == TR_EVDATA && xfer->trb_count > 2) {
1591 trb_status--;
1592 }
1593
1594 /* do some sanity checks */
1595 if (TRB_TYPE(*trb_setup) != TR_SETUP) {
1596 fprintf(stderr, "xhci: ep0 first TD not SETUP: %d\n",
1597 TRB_TYPE(*trb_setup));
1598 return -1;
1599 }
1600 if (TRB_TYPE(*trb_status) != TR_STATUS) {
1601 fprintf(stderr, "xhci: ep0 last TD not STATUS: %d\n",
1602 TRB_TYPE(*trb_status));
1603 return -1;
1604 }
1605 if (!(trb_setup->control & TRB_TR_IDT)) {
1606 fprintf(stderr, "xhci: Setup TRB doesn't have IDT set\n");
1607 return -1;
1608 }
1609 if ((trb_setup->status & 0x1ffff) != 8) {
1610 fprintf(stderr, "xhci: Setup TRB has bad length (%d)\n",
1611 (trb_setup->status & 0x1ffff));
1612 return -1;
1613 }
1614
1615 bmRequestType = trb_setup->parameter;
1616
1617 xfer->in_xfer = bmRequestType & USB_DIR_IN;
1618 xfer->iso_xfer = false;
1619
1620 if (xhci_setup_packet(xfer) < 0) {
1621 return -1;
1622 }
1623 xfer->packet.parameter = trb_setup->parameter;
1624
1625 usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1626
1627 xhci_complete_packet(xfer);
1628 if (!xfer->running_async && !xfer->running_retry) {
1629 xhci_kick_ep(xhci, xfer->slotid, xfer->epid);
1630 }
1631 return 0;
1632 }
1633
1634 static void xhci_calc_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
1635 XHCIEPContext *epctx, uint64_t mfindex)
1636 {
1637 if (xfer->trbs[0].control & TRB_TR_SIA) {
1638 uint64_t asap = ((mfindex + epctx->interval - 1) &
1639 ~(epctx->interval-1));
1640 if (asap >= epctx->mfindex_last &&
1641 asap <= epctx->mfindex_last + epctx->interval * 4) {
1642 xfer->mfindex_kick = epctx->mfindex_last + epctx->interval;
1643 } else {
1644 xfer->mfindex_kick = asap;
1645 }
1646 } else {
1647 xfer->mfindex_kick = (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
1648 & TRB_TR_FRAMEID_MASK;
1649 xfer->mfindex_kick |= mfindex & ~0x3fff;
1650 if (xfer->mfindex_kick < mfindex) {
1651 xfer->mfindex_kick += 0x4000;
1652 }
1653 }
1654 }
1655
1656 static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
1657 XHCIEPContext *epctx, uint64_t mfindex)
1658 {
1659 if (xfer->mfindex_kick > mfindex) {
1660 qemu_mod_timer(epctx->kick_timer, qemu_get_clock_ns(vm_clock) +
1661 (xfer->mfindex_kick - mfindex) * 125000);
1662 xfer->running_retry = 1;
1663 } else {
1664 epctx->mfindex_last = xfer->mfindex_kick;
1665 qemu_del_timer(epctx->kick_timer);
1666 xfer->running_retry = 0;
1667 }
1668 }
1669
1670
1671 static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
1672 {
1673 uint64_t mfindex;
1674
1675 DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", xfer->slotid, xfer->epid);
1676
1677 xfer->in_xfer = epctx->type>>2;
1678
1679 switch(epctx->type) {
1680 case ET_INTR_OUT:
1681 case ET_INTR_IN:
1682 case ET_BULK_OUT:
1683 case ET_BULK_IN:
1684 xfer->pkts = 0;
1685 xfer->iso_xfer = false;
1686 break;
1687 case ET_ISO_OUT:
1688 case ET_ISO_IN:
1689 xfer->pkts = 1;
1690 xfer->iso_xfer = true;
1691 mfindex = xhci_mfindex_get(xhci);
1692 xhci_calc_iso_kick(xhci, xfer, epctx, mfindex);
1693 xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
1694 if (xfer->running_retry) {
1695 return -1;
1696 }
1697 break;
1698 default:
1699 fprintf(stderr, "xhci: unknown or unhandled EP "
1700 "(type %d, in %d, ep %02x)\n",
1701 epctx->type, xfer->in_xfer, xfer->epid);
1702 return -1;
1703 }
1704
1705 if (xhci_setup_packet(xfer) < 0) {
1706 return -1;
1707 }
1708 usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1709
1710 xhci_complete_packet(xfer);
1711 if (!xfer->running_async && !xfer->running_retry) {
1712 xhci_kick_ep(xhci, xfer->slotid, xfer->epid);
1713 }
1714 return 0;
1715 }
1716
1717 static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
1718 {
1719 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid);
1720 return xhci_submit(xhci, xfer, epctx);
1721 }
1722
1723 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid)
1724 {
1725 XHCIEPContext *epctx;
1726 USBEndpoint *ep = NULL;
1727 uint64_t mfindex;
1728 int length;
1729 int i;
1730
1731 trace_usb_xhci_ep_kick(slotid, epid);
1732 assert(slotid >= 1 && slotid <= xhci->numslots);
1733 assert(epid >= 1 && epid <= 31);
1734
1735 if (!xhci->slots[slotid-1].enabled) {
1736 fprintf(stderr, "xhci: xhci_kick_ep for disabled slot %d\n", slotid);
1737 return;
1738 }
1739 epctx = xhci->slots[slotid-1].eps[epid-1];
1740 if (!epctx) {
1741 fprintf(stderr, "xhci: xhci_kick_ep for disabled endpoint %d,%d\n",
1742 epid, slotid);
1743 return;
1744 }
1745
1746 if (epctx->retry) {
1747 XHCITransfer *xfer = epctx->retry;
1748
1749 trace_usb_xhci_xfer_retry(xfer);
1750 assert(xfer->running_retry);
1751 if (xfer->iso_xfer) {
1752 /* retry delayed iso transfer */
1753 mfindex = xhci_mfindex_get(xhci);
1754 xhci_check_iso_kick(xhci, xfer, epctx, mfindex);
1755 if (xfer->running_retry) {
1756 return;
1757 }
1758 if (xhci_setup_packet(xfer) < 0) {
1759 return;
1760 }
1761 usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1762 assert(xfer->packet.status != USB_RET_NAK);
1763 xhci_complete_packet(xfer);
1764 } else {
1765 /* retry nak'ed transfer */
1766 if (xhci_setup_packet(xfer) < 0) {
1767 return;
1768 }
1769 usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
1770 if (xfer->packet.status == USB_RET_NAK) {
1771 return;
1772 }
1773 xhci_complete_packet(xfer);
1774 }
1775 assert(!xfer->running_retry);
1776 epctx->retry = NULL;
1777 }
1778
1779 if (epctx->state == EP_HALTED) {
1780 DPRINTF("xhci: ep halted, not running schedule\n");
1781 return;
1782 }
1783
1784 xhci_set_ep_state(xhci, epctx, EP_RUNNING);
1785
1786 while (1) {
1787 XHCITransfer *xfer = &epctx->transfers[epctx->next_xfer];
1788 if (xfer->running_async || xfer->running_retry) {
1789 break;
1790 }
1791 length = xhci_ring_chain_length(xhci, &epctx->ring);
1792 if (length < 0) {
1793 break;
1794 } else if (length == 0) {
1795 break;
1796 }
1797 if (xfer->trbs && xfer->trb_alloced < length) {
1798 xfer->trb_count = 0;
1799 xfer->trb_alloced = 0;
1800 g_free(xfer->trbs);
1801 xfer->trbs = NULL;
1802 }
1803 if (!xfer->trbs) {
1804 xfer->trbs = g_malloc(sizeof(XHCITRB) * length);
1805 xfer->trb_alloced = length;
1806 }
1807 xfer->trb_count = length;
1808
1809 for (i = 0; i < length; i++) {
1810 assert(xhci_ring_fetch(xhci, &epctx->ring, &xfer->trbs[i], NULL));
1811 }
1812 xfer->xhci = xhci;
1813 xfer->epid = epid;
1814 xfer->slotid = slotid;
1815
1816 if (epid == 1) {
1817 if (xhci_fire_ctl_transfer(xhci, xfer) >= 0) {
1818 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
1819 ep = xfer->packet.ep;
1820 } else {
1821 fprintf(stderr, "xhci: error firing CTL transfer\n");
1822 }
1823 } else {
1824 if (xhci_fire_transfer(xhci, xfer, epctx) >= 0) {
1825 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE;
1826 ep = xfer->packet.ep;
1827 } else {
1828 if (!xfer->iso_xfer) {
1829 fprintf(stderr, "xhci: error firing data transfer\n");
1830 }
1831 }
1832 }
1833
1834 if (epctx->state == EP_HALTED) {
1835 break;
1836 }
1837 if (xfer->running_retry) {
1838 DPRINTF("xhci: xfer nacked, stopping schedule\n");
1839 epctx->retry = xfer;
1840 break;
1841 }
1842 }
1843 if (ep) {
1844 usb_device_flush_ep_queue(ep->dev, ep);
1845 }
1846 }
1847
1848 static TRBCCode xhci_enable_slot(XHCIState *xhci, unsigned int slotid)
1849 {
1850 trace_usb_xhci_slot_enable(slotid);
1851 assert(slotid >= 1 && slotid <= xhci->numslots);
1852 xhci->slots[slotid-1].enabled = 1;
1853 xhci->slots[slotid-1].uport = NULL;
1854 memset(xhci->slots[slotid-1].eps, 0, sizeof(XHCIEPContext*)*31);
1855
1856 return CC_SUCCESS;
1857 }
1858
1859 static TRBCCode xhci_disable_slot(XHCIState *xhci, unsigned int slotid)
1860 {
1861 int i;
1862
1863 trace_usb_xhci_slot_disable(slotid);
1864 assert(slotid >= 1 && slotid <= xhci->numslots);
1865
1866 for (i = 1; i <= 31; i++) {
1867 if (xhci->slots[slotid-1].eps[i-1]) {
1868 xhci_disable_ep(xhci, slotid, i);
1869 }
1870 }
1871
1872 xhci->slots[slotid-1].enabled = 0;
1873 return CC_SUCCESS;
1874 }
1875
1876 static USBPort *xhci_lookup_uport(XHCIState *xhci, uint32_t *slot_ctx)
1877 {
1878 USBPort *uport;
1879 char path[32];
1880 int i, pos, port;
1881
1882 port = (slot_ctx[1]>>16) & 0xFF;
1883 port = xhci->ports[port-1].uport->index+1;
1884 pos = snprintf(path, sizeof(path), "%d", port);
1885 for (i = 0; i < 5; i++) {
1886 port = (slot_ctx[0] >> 4*i) & 0x0f;
1887 if (!port) {
1888 break;
1889 }
1890 pos += snprintf(path + pos, sizeof(path) - pos, ".%d", port);
1891 }
1892
1893 QTAILQ_FOREACH(uport, &xhci->bus.used, next) {
1894 if (strcmp(uport->path, path) == 0) {
1895 return uport;
1896 }
1897 }
1898 return NULL;
1899 }
1900
1901 static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
1902 uint64_t pictx, bool bsr)
1903 {
1904 XHCISlot *slot;
1905 USBPort *uport;
1906 USBDevice *dev;
1907 dma_addr_t ictx, octx, dcbaap;
1908 uint64_t poctx;
1909 uint32_t ictl_ctx[2];
1910 uint32_t slot_ctx[4];
1911 uint32_t ep0_ctx[5];
1912 int i;
1913 TRBCCode res;
1914
1915 trace_usb_xhci_slot_address(slotid);
1916 assert(slotid >= 1 && slotid <= xhci->numslots);
1917
1918 dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
1919 poctx = ldq_le_pci_dma(&xhci->pci_dev, dcbaap + 8*slotid);
1920 ictx = xhci_mask64(pictx);
1921 octx = xhci_mask64(poctx);
1922
1923 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
1924 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
1925
1926 xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
1927
1928 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) {
1929 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
1930 ictl_ctx[0], ictl_ctx[1]);
1931 return CC_TRB_ERROR;
1932 }
1933
1934 xhci_dma_read_u32s(xhci, ictx+32, slot_ctx, sizeof(slot_ctx));
1935 xhci_dma_read_u32s(xhci, ictx+64, ep0_ctx, sizeof(ep0_ctx));
1936
1937 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
1938 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
1939
1940 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
1941 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
1942
1943 uport = xhci_lookup_uport(xhci, slot_ctx);
1944 if (uport == NULL) {
1945 fprintf(stderr, "xhci: port not found\n");
1946 return CC_TRB_ERROR;
1947 }
1948
1949 dev = uport->dev;
1950 if (!dev) {
1951 fprintf(stderr, "xhci: port %s not connected\n", uport->path);
1952 return CC_USB_TRANSACTION_ERROR;
1953 }
1954
1955 for (i = 0; i < xhci->numslots; i++) {
1956 if (i == slotid-1) {
1957 continue;
1958 }
1959 if (xhci->slots[i].uport == uport) {
1960 fprintf(stderr, "xhci: port %s already assigned to slot %d\n",
1961 uport->path, i+1);
1962 return CC_TRB_ERROR;
1963 }
1964 }
1965
1966 slot = &xhci->slots[slotid-1];
1967 slot->uport = uport;
1968 slot->ctx = octx;
1969
1970 if (bsr) {
1971 slot_ctx[3] = SLOT_DEFAULT << SLOT_STATE_SHIFT;
1972 } else {
1973 USBPacket p;
1974 slot->devaddr = xhci->devaddr++;
1975 slot_ctx[3] = (SLOT_ADDRESSED << SLOT_STATE_SHIFT) | slot->devaddr;
1976 DPRINTF("xhci: device address is %d\n", slot->devaddr);
1977 usb_device_reset(dev);
1978 usb_packet_setup(&p, USB_TOKEN_OUT,
1979 usb_ep_get(dev, USB_TOKEN_OUT, 0),
1980 0, false, false);
1981 usb_device_handle_control(dev, &p,
1982 DeviceOutRequest | USB_REQ_SET_ADDRESS,
1983 slot->devaddr, 0, 0, NULL);
1984 assert(p.status != USB_RET_ASYNC);
1985 }
1986
1987 res = xhci_enable_ep(xhci, slotid, 1, octx+32, ep0_ctx);
1988
1989 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
1990 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
1991 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
1992 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
1993
1994 xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
1995 xhci_dma_write_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
1996
1997 return res;
1998 }
1999
2000
2001 static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
2002 uint64_t pictx, bool dc)
2003 {
2004 dma_addr_t ictx, octx;
2005 uint32_t ictl_ctx[2];
2006 uint32_t slot_ctx[4];
2007 uint32_t islot_ctx[4];
2008 uint32_t ep_ctx[5];
2009 int i;
2010 TRBCCode res;
2011
2012 trace_usb_xhci_slot_configure(slotid);
2013 assert(slotid >= 1 && slotid <= xhci->numslots);
2014
2015 ictx = xhci_mask64(pictx);
2016 octx = xhci->slots[slotid-1].ctx;
2017
2018 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
2019 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
2020
2021 if (dc) {
2022 for (i = 2; i <= 31; i++) {
2023 if (xhci->slots[slotid-1].eps[i-1]) {
2024 xhci_disable_ep(xhci, slotid, i);
2025 }
2026 }
2027
2028 xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2029 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
2030 slot_ctx[3] |= SLOT_ADDRESSED << SLOT_STATE_SHIFT;
2031 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2032 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2033 xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2034
2035 return CC_SUCCESS;
2036 }
2037
2038 xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
2039
2040 if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) {
2041 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
2042 ictl_ctx[0], ictl_ctx[1]);
2043 return CC_TRB_ERROR;
2044 }
2045
2046 xhci_dma_read_u32s(xhci, ictx+32, islot_ctx, sizeof(islot_ctx));
2047 xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2048
2049 if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) {
2050 fprintf(stderr, "xhci: invalid slot state %08x\n", slot_ctx[3]);
2051 return CC_CONTEXT_STATE_ERROR;
2052 }
2053
2054 for (i = 2; i <= 31; i++) {
2055 if (ictl_ctx[0] & (1<<i)) {
2056 xhci_disable_ep(xhci, slotid, i);
2057 }
2058 if (ictl_ctx[1] & (1<<i)) {
2059 xhci_dma_read_u32s(xhci, ictx+32+(32*i), ep_ctx, sizeof(ep_ctx));
2060 DPRINTF("xhci: input ep%d.%d context: %08x %08x %08x %08x %08x\n",
2061 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
2062 ep_ctx[3], ep_ctx[4]);
2063 xhci_disable_ep(xhci, slotid, i);
2064 res = xhci_enable_ep(xhci, slotid, i, octx+(32*i), ep_ctx);
2065 if (res != CC_SUCCESS) {
2066 return res;
2067 }
2068 DPRINTF("xhci: output ep%d.%d context: %08x %08x %08x %08x %08x\n",
2069 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
2070 ep_ctx[3], ep_ctx[4]);
2071 xhci_dma_write_u32s(xhci, octx+(32*i), ep_ctx, sizeof(ep_ctx));
2072 }
2073 }
2074
2075 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
2076 slot_ctx[3] |= SLOT_CONFIGURED << SLOT_STATE_SHIFT;
2077 slot_ctx[0] &= ~(SLOT_CONTEXT_ENTRIES_MASK << SLOT_CONTEXT_ENTRIES_SHIFT);
2078 slot_ctx[0] |= islot_ctx[0] & (SLOT_CONTEXT_ENTRIES_MASK <<
2079 SLOT_CONTEXT_ENTRIES_SHIFT);
2080 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2081 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2082
2083 xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2084
2085 return CC_SUCCESS;
2086 }
2087
2088
2089 static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
2090 uint64_t pictx)
2091 {
2092 dma_addr_t ictx, octx;
2093 uint32_t ictl_ctx[2];
2094 uint32_t iep0_ctx[5];
2095 uint32_t ep0_ctx[5];
2096 uint32_t islot_ctx[4];
2097 uint32_t slot_ctx[4];
2098
2099 trace_usb_xhci_slot_evaluate(slotid);
2100 assert(slotid >= 1 && slotid <= xhci->numslots);
2101
2102 ictx = xhci_mask64(pictx);
2103 octx = xhci->slots[slotid-1].ctx;
2104
2105 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
2106 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
2107
2108 xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
2109
2110 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) {
2111 fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
2112 ictl_ctx[0], ictl_ctx[1]);
2113 return CC_TRB_ERROR;
2114 }
2115
2116 if (ictl_ctx[1] & 0x1) {
2117 xhci_dma_read_u32s(xhci, ictx+32, islot_ctx, sizeof(islot_ctx));
2118
2119 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
2120 islot_ctx[0], islot_ctx[1], islot_ctx[2], islot_ctx[3]);
2121
2122 xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2123
2124 slot_ctx[1] &= ~0xFFFF; /* max exit latency */
2125 slot_ctx[1] |= islot_ctx[1] & 0xFFFF;
2126 slot_ctx[2] &= ~0xFF00000; /* interrupter target */
2127 slot_ctx[2] |= islot_ctx[2] & 0xFF000000;
2128
2129 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2130 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2131
2132 xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2133 }
2134
2135 if (ictl_ctx[1] & 0x2) {
2136 xhci_dma_read_u32s(xhci, ictx+64, iep0_ctx, sizeof(iep0_ctx));
2137
2138 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
2139 iep0_ctx[0], iep0_ctx[1], iep0_ctx[2],
2140 iep0_ctx[3], iep0_ctx[4]);
2141
2142 xhci_dma_read_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
2143
2144 ep0_ctx[1] &= ~0xFFFF0000; /* max packet size*/
2145 ep0_ctx[1] |= iep0_ctx[1] & 0xFFFF0000;
2146
2147 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
2148 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
2149
2150 xhci_dma_write_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
2151 }
2152
2153 return CC_SUCCESS;
2154 }
2155
2156 static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
2157 {
2158 uint32_t slot_ctx[4];
2159 dma_addr_t octx;
2160 int i;
2161
2162 trace_usb_xhci_slot_reset(slotid);
2163 assert(slotid >= 1 && slotid <= xhci->numslots);
2164
2165 octx = xhci->slots[slotid-1].ctx;
2166
2167 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
2168
2169 for (i = 2; i <= 31; i++) {
2170 if (xhci->slots[slotid-1].eps[i-1]) {
2171 xhci_disable_ep(xhci, slotid, i);
2172 }
2173 }
2174
2175 xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2176 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
2177 slot_ctx[3] |= SLOT_DEFAULT << SLOT_STATE_SHIFT;
2178 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
2179 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
2180 xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
2181
2182 return CC_SUCCESS;
2183 }
2184
2185 static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *trb)
2186 {
2187 unsigned int slotid;
2188 slotid = (trb->control >> TRB_CR_SLOTID_SHIFT) & TRB_CR_SLOTID_MASK;
2189 if (slotid < 1 || slotid > xhci->numslots) {
2190 fprintf(stderr, "xhci: bad slot id %d\n", slotid);
2191 event->ccode = CC_TRB_ERROR;
2192 return 0;
2193 } else if (!xhci->slots[slotid-1].enabled) {
2194 fprintf(stderr, "xhci: slot id %d not enabled\n", slotid);
2195 event->ccode = CC_SLOT_NOT_ENABLED_ERROR;
2196 return 0;
2197 }
2198 return slotid;
2199 }
2200
2201 static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
2202 {
2203 dma_addr_t ctx;
2204 uint8_t bw_ctx[xhci->numports+1];
2205
2206 DPRINTF("xhci_get_port_bandwidth()\n");
2207
2208 ctx = xhci_mask64(pctx);
2209
2210 DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx);
2211
2212 /* TODO: actually implement real values here */
2213 bw_ctx[0] = 0;
2214 memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
2215 pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx));
2216
2217 return CC_SUCCESS;
2218 }
2219
2220 static uint32_t rotl(uint32_t v, unsigned count)
2221 {
2222 count &= 31;
2223 return (v << count) | (v >> (32 - count));
2224 }
2225
2226
2227 static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo)
2228 {
2229 uint32_t val;
2230 val = rotl(lo - 0x49434878, 32 - ((hi>>8) & 0x1F));
2231 val += rotl(lo + 0x49434878, hi & 0x1F);
2232 val -= rotl(hi ^ 0x49434878, (lo >> 16) & 0x1F);
2233 return ~val;
2234 }
2235
2236 static void xhci_via_challenge(XHCIState *xhci, uint64_t addr)
2237 {
2238 uint32_t buf[8];
2239 uint32_t obuf[8];
2240 dma_addr_t paddr = xhci_mask64(addr);
2241
2242 pci_dma_read(&xhci->pci_dev, paddr, &buf, 32);
2243
2244 memcpy(obuf, buf, sizeof(obuf));
2245
2246 if ((buf[0] & 0xff) == 2) {
2247 obuf[0] = 0x49932000 + 0x54dc200 * buf[2] + 0x7429b578 * buf[3];
2248 obuf[0] |= (buf[2] * buf[3]) & 0xff;
2249 obuf[1] = 0x0132bb37 + 0xe89 * buf[2] + 0xf09 * buf[3];
2250 obuf[2] = 0x0066c2e9 + 0x2091 * buf[2] + 0x19bd * buf[3];
2251 obuf[3] = 0xd5281342 + 0x2cc9691 * buf[2] + 0x2367662 * buf[3];
2252 obuf[4] = 0x0123c75c + 0x1595 * buf[2] + 0x19ec * buf[3];
2253 obuf[5] = 0x00f695de + 0x26fd * buf[2] + 0x3e9 * buf[3];
2254 obuf[6] = obuf[2] ^ obuf[3] ^ 0x29472956;
2255 obuf[7] = obuf[2] ^ obuf[3] ^ 0x65866593;
2256 }
2257
2258 pci_dma_write(&xhci->pci_dev, paddr, &obuf, 32);
2259 }
2260
2261 static void xhci_process_commands(XHCIState *xhci)
2262 {
2263 XHCITRB trb;
2264 TRBType type;
2265 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS};
2266 dma_addr_t addr;
2267 unsigned int i, slotid = 0;
2268
2269 DPRINTF("xhci_process_commands()\n");
2270 if (!xhci_running(xhci)) {
2271 DPRINTF("xhci_process_commands() called while xHC stopped or paused\n");
2272 return;
2273 }
2274
2275 xhci->crcr_low |= CRCR_CRR;
2276
2277 while ((type = xhci_ring_fetch(xhci, &xhci->cmd_ring, &trb, &addr))) {
2278 event.ptr = addr;
2279 switch (type) {
2280 case CR_ENABLE_SLOT:
2281 for (i = 0; i < xhci->numslots; i++) {
2282 if (!xhci->slots[i].enabled) {
2283 break;
2284 }
2285 }
2286 if (i >= xhci->numslots) {
2287 fprintf(stderr, "xhci: no device slots available\n");
2288 event.ccode = CC_NO_SLOTS_ERROR;
2289 } else {
2290 slotid = i+1;
2291 event.ccode = xhci_enable_slot(xhci, slotid);
2292 }
2293 break;
2294 case CR_DISABLE_SLOT:
2295 slotid = xhci_get_slot(xhci, &event, &trb);
2296 if (slotid) {
2297 event.ccode = xhci_disable_slot(xhci, slotid);
2298 }
2299 break;
2300 case CR_ADDRESS_DEVICE:
2301 slotid = xhci_get_slot(xhci, &event, &trb);
2302 if (slotid) {
2303 event.ccode = xhci_address_slot(xhci, slotid, trb.parameter,
2304 trb.control & TRB_CR_BSR);
2305 }
2306 break;
2307 case CR_CONFIGURE_ENDPOINT:
2308 slotid = xhci_get_slot(xhci, &event, &trb);
2309 if (slotid) {
2310 event.ccode = xhci_configure_slot(xhci, slotid, trb.parameter,
2311 trb.control & TRB_CR_DC);
2312 }
2313 break;
2314 case CR_EVALUATE_CONTEXT:
2315 slotid = xhci_get_slot(xhci, &event, &trb);
2316 if (slotid) {
2317 event.ccode = xhci_evaluate_slot(xhci, slotid, trb.parameter);
2318 }
2319 break;
2320 case CR_STOP_ENDPOINT:
2321 slotid = xhci_get_slot(xhci, &event, &trb);
2322 if (slotid) {
2323 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2324 & TRB_CR_EPID_MASK;
2325 event.ccode = xhci_stop_ep(xhci, slotid, epid);
2326 }
2327 break;
2328 case CR_RESET_ENDPOINT:
2329 slotid = xhci_get_slot(xhci, &event, &trb);
2330 if (slotid) {
2331 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2332 & TRB_CR_EPID_MASK;
2333 event.ccode = xhci_reset_ep(xhci, slotid, epid);
2334 }
2335 break;
2336 case CR_SET_TR_DEQUEUE:
2337 slotid = xhci_get_slot(xhci, &event, &trb);
2338 if (slotid) {
2339 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
2340 & TRB_CR_EPID_MASK;
2341 event.ccode = xhci_set_ep_dequeue(xhci, slotid, epid,
2342 trb.parameter);
2343 }
2344 break;
2345 case CR_RESET_DEVICE:
2346 slotid = xhci_get_slot(xhci, &event, &trb);
2347 if (slotid) {
2348 event.ccode = xhci_reset_slot(xhci, slotid);
2349 }
2350 break;
2351 case CR_GET_PORT_BANDWIDTH:
2352 event.ccode = xhci_get_port_bandwidth(xhci, trb.parameter);
2353 break;
2354 case CR_VENDOR_VIA_CHALLENGE_RESPONSE:
2355 xhci_via_challenge(xhci, trb.parameter);
2356 break;
2357 case CR_VENDOR_NEC_FIRMWARE_REVISION:
2358 event.type = 48; /* NEC reply */
2359 event.length = 0x3025;
2360 break;
2361 case CR_VENDOR_NEC_CHALLENGE_RESPONSE:
2362 {
2363 uint32_t chi = trb.parameter >> 32;
2364 uint32_t clo = trb.parameter;
2365 uint32_t val = xhci_nec_challenge(chi, clo);
2366 event.length = val & 0xFFFF;
2367 event.epid = val >> 16;
2368 slotid = val >> 24;
2369 event.type = 48; /* NEC reply */
2370 }
2371 break;
2372 default:
2373 fprintf(stderr, "xhci: unimplemented command %d\n", type);
2374 event.ccode = CC_TRB_ERROR;
2375 break;
2376 }
2377 event.slotid = slotid;
2378 xhci_event(xhci, &event, 0);
2379 }
2380 }
2381
2382 static bool xhci_port_have_device(XHCIPort *port)
2383 {
2384 if (!port->uport->dev || !port->uport->dev->attached) {
2385 return false; /* no device present */
2386 }
2387 if (!((1 << port->uport->dev->speed) & port->speedmask)) {
2388 return false; /* speed mismatch */
2389 }
2390 return true;
2391 }
2392
2393 static void xhci_port_notify(XHCIPort *port, uint32_t bits)
2394 {
2395 XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
2396 port->portnr << 24 };
2397
2398 if ((port->portsc & bits) == bits) {
2399 return;
2400 }
2401 port->portsc |= bits;
2402 if (!xhci_running(port->xhci)) {
2403 return;
2404 }
2405 xhci_event(port->xhci, &ev, 0);
2406 }
2407
2408 static void xhci_port_update(XHCIPort *port, int is_detach)
2409 {
2410 uint32_t pls = PLS_RX_DETECT;
2411
2412 port->portsc = PORTSC_PP;
2413 if (!is_detach && xhci_port_have_device(port)) {
2414 port->portsc |= PORTSC_CCS;
2415 switch (port->uport->dev->speed) {
2416 case USB_SPEED_LOW:
2417 port->portsc |= PORTSC_SPEED_LOW;
2418 pls = PLS_POLLING;
2419 break;
2420 case USB_SPEED_FULL:
2421 port->portsc |= PORTSC_SPEED_FULL;
2422 pls = PLS_POLLING;
2423 break;
2424 case USB_SPEED_HIGH:
2425 port->portsc |= PORTSC_SPEED_HIGH;
2426 pls = PLS_POLLING;
2427 break;
2428 case USB_SPEED_SUPER:
2429 port->portsc |= PORTSC_SPEED_SUPER;
2430 port->portsc |= PORTSC_PED;
2431 pls = PLS_U0;
2432 break;
2433 }
2434 }
2435 set_field(&port->portsc, pls, PORTSC_PLS);
2436 trace_usb_xhci_port_link(port->portnr, pls);
2437 xhci_port_notify(port, PORTSC_CSC);
2438 }
2439
2440 static void xhci_port_reset(XHCIPort *port)
2441 {
2442 trace_usb_xhci_port_reset(port->portnr);
2443
2444 if (!xhci_port_have_device(port)) {
2445 return;
2446 }
2447
2448 usb_device_reset(port->uport->dev);
2449
2450 switch (port->uport->dev->speed) {
2451 case USB_SPEED_LOW:
2452 case USB_SPEED_FULL:
2453 case USB_SPEED_HIGH:
2454 set_field(&port->portsc, PLS_U0, PORTSC_PLS);
2455 trace_usb_xhci_port_link(port->portnr, PLS_U0);
2456 port->portsc |= PORTSC_PED;
2457 break;
2458 }
2459
2460 port->portsc &= ~PORTSC_PR;
2461 xhci_port_notify(port, PORTSC_PRC);
2462 }
2463
2464 static void xhci_reset(DeviceState *dev)
2465 {
2466 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev.qdev, dev);
2467 int i;
2468
2469 trace_usb_xhci_reset();
2470 if (!(xhci->usbsts & USBSTS_HCH)) {
2471 fprintf(stderr, "xhci: reset while running!\n");
2472 }
2473
2474 xhci->usbcmd = 0;
2475 xhci->usbsts = USBSTS_HCH;
2476 xhci->dnctrl = 0;
2477 xhci->crcr_low = 0;
2478 xhci->crcr_high = 0;
2479 xhci->dcbaap_low = 0;
2480 xhci->dcbaap_high = 0;
2481 xhci->config = 0;
2482 xhci->devaddr = 2;
2483
2484 for (i = 0; i < xhci->numslots; i++) {
2485 xhci_disable_slot(xhci, i+1);
2486 }
2487
2488 for (i = 0; i < xhci->numports; i++) {
2489 xhci_port_update(xhci->ports + i, 0);
2490 }
2491
2492 for (i = 0; i < xhci->numintrs; i++) {
2493 xhci->intr[i].iman = 0;
2494 xhci->intr[i].imod = 0;
2495 xhci->intr[i].erstsz = 0;
2496 xhci->intr[i].erstba_low = 0;
2497 xhci->intr[i].erstba_high = 0;
2498 xhci->intr[i].erdp_low = 0;
2499 xhci->intr[i].erdp_high = 0;
2500 xhci->intr[i].msix_used = 0;
2501
2502 xhci->intr[i].er_ep_idx = 0;
2503 xhci->intr[i].er_pcs = 1;
2504 xhci->intr[i].er_full = 0;
2505 xhci->intr[i].ev_buffer_put = 0;
2506 xhci->intr[i].ev_buffer_get = 0;
2507 }
2508
2509 xhci->mfindex_start = qemu_get_clock_ns(vm_clock);
2510 xhci_mfwrap_update(xhci);
2511 }
2512
2513 static uint64_t xhci_cap_read(void *ptr, hwaddr reg, unsigned size)
2514 {
2515 XHCIState *xhci = ptr;
2516 uint32_t ret;
2517
2518 switch (reg) {
2519 case 0x00: /* HCIVERSION, CAPLENGTH */
2520 ret = 0x01000000 | LEN_CAP;
2521 break;
2522 case 0x04: /* HCSPARAMS 1 */
2523 ret = ((xhci->numports_2+xhci->numports_3)<<24)
2524 | (xhci->numintrs<<8) | xhci->numslots;
2525 break;
2526 case 0x08: /* HCSPARAMS 2 */
2527 ret = 0x0000000f;
2528 break;
2529 case 0x0c: /* HCSPARAMS 3 */
2530 ret = 0x00000000;
2531 break;
2532 case 0x10: /* HCCPARAMS */
2533 if (sizeof(dma_addr_t) == 4) {
2534 ret = 0x00081000;
2535 } else {
2536 ret = 0x00081001;
2537 }
2538 break;
2539 case 0x14: /* DBOFF */
2540 ret = OFF_DOORBELL;
2541 break;
2542 case 0x18: /* RTSOFF */
2543 ret = OFF_RUNTIME;
2544 break;
2545
2546 /* extended capabilities */
2547 case 0x20: /* Supported Protocol:00 */
2548 ret = 0x02000402; /* USB 2.0 */
2549 break;
2550 case 0x24: /* Supported Protocol:04 */
2551 ret = 0x20425355; /* "USB " */
2552 break;
2553 case 0x28: /* Supported Protocol:08 */
2554 ret = 0x00000001 | (xhci->numports_2<<8);
2555 break;
2556 case 0x2c: /* Supported Protocol:0c */
2557 ret = 0x00000000; /* reserved */
2558 break;
2559 case 0x30: /* Supported Protocol:00 */
2560 ret = 0x03000002; /* USB 3.0 */
2561 break;
2562 case 0x34: /* Supported Protocol:04 */
2563 ret = 0x20425355; /* "USB " */
2564 break;
2565 case 0x38: /* Supported Protocol:08 */
2566 ret = 0x00000000 | (xhci->numports_2+1) | (xhci->numports_3<<8);
2567 break;
2568 case 0x3c: /* Supported Protocol:0c */
2569 ret = 0x00000000; /* reserved */
2570 break;
2571 default:
2572 fprintf(stderr, "xhci_cap_read: reg %d unimplemented\n", (int)reg);
2573 ret = 0;
2574 }
2575
2576 trace_usb_xhci_cap_read(reg, ret);
2577 return ret;
2578 }
2579
2580 static uint64_t xhci_port_read(void *ptr, hwaddr reg, unsigned size)
2581 {
2582 XHCIPort *port = ptr;
2583 uint32_t ret;
2584
2585 switch (reg) {
2586 case 0x00: /* PORTSC */
2587 ret = port->portsc;
2588 break;
2589 case 0x04: /* PORTPMSC */
2590 case 0x08: /* PORTLI */
2591 ret = 0;
2592 break;
2593 case 0x0c: /* reserved */
2594 default:
2595 fprintf(stderr, "xhci_port_read (port %d): reg 0x%x unimplemented\n",
2596 port->portnr, (uint32_t)reg);
2597 ret = 0;
2598 }
2599
2600 trace_usb_xhci_port_read(port->portnr, reg, ret);
2601 return ret;
2602 }
2603
2604 static void xhci_port_write(void *ptr, hwaddr reg,
2605 uint64_t val, unsigned size)
2606 {
2607 XHCIPort *port = ptr;
2608 uint32_t portsc;
2609
2610 trace_usb_xhci_port_write(port->portnr, reg, val);
2611
2612 switch (reg) {
2613 case 0x00: /* PORTSC */
2614 portsc = port->portsc;
2615 /* write-1-to-clear bits*/
2616 portsc &= ~(val & (PORTSC_CSC|PORTSC_PEC|PORTSC_WRC|PORTSC_OCC|
2617 PORTSC_PRC|PORTSC_PLC|PORTSC_CEC));
2618 if (val & PORTSC_LWS) {
2619 /* overwrite PLS only when LWS=1 */
2620 uint32_t pls = get_field(val, PORTSC_PLS);
2621 set_field(&portsc, pls, PORTSC_PLS);
2622 trace_usb_xhci_port_link(port->portnr, pls);
2623 }
2624 /* read/write bits */
2625 portsc &= ~(PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE);
2626 portsc |= (val & (PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE));
2627 port->portsc = portsc;
2628 /* write-1-to-start bits */
2629 if (val & PORTSC_PR) {
2630 xhci_port_reset(port);
2631 }
2632 break;
2633 case 0x04: /* PORTPMSC */
2634 case 0x08: /* PORTLI */
2635 default:
2636 fprintf(stderr, "xhci_port_write (port %d): reg 0x%x unimplemented\n",
2637 port->portnr, (uint32_t)reg);
2638 }
2639 }
2640
2641 static uint64_t xhci_oper_read(void *ptr, hwaddr reg, unsigned size)
2642 {
2643 XHCIState *xhci = ptr;
2644 uint32_t ret;
2645
2646 switch (reg) {
2647 case 0x00: /* USBCMD */
2648 ret = xhci->usbcmd;
2649 break;
2650 case 0x04: /* USBSTS */
2651 ret = xhci->usbsts;
2652 break;
2653 case 0x08: /* PAGESIZE */
2654 ret = 1; /* 4KiB */
2655 break;
2656 case 0x14: /* DNCTRL */
2657 ret = xhci->dnctrl;
2658 break;
2659 case 0x18: /* CRCR low */
2660 ret = xhci->crcr_low & ~0xe;
2661 break;
2662 case 0x1c: /* CRCR high */
2663 ret = xhci->crcr_high;
2664 break;
2665 case 0x30: /* DCBAAP low */
2666 ret = xhci->dcbaap_low;
2667 break;
2668 case 0x34: /* DCBAAP high */
2669 ret = xhci->dcbaap_high;
2670 break;
2671 case 0x38: /* CONFIG */
2672 ret = xhci->config;
2673 break;
2674 default:
2675 fprintf(stderr, "xhci_oper_read: reg 0x%x unimplemented\n", (int)reg);
2676 ret = 0;
2677 }
2678
2679 trace_usb_xhci_oper_read(reg, ret);
2680 return ret;
2681 }
2682
2683 static void xhci_oper_write(void *ptr, hwaddr reg,
2684 uint64_t val, unsigned size)
2685 {
2686 XHCIState *xhci = ptr;
2687
2688 trace_usb_xhci_oper_write(reg, val);
2689
2690 switch (reg) {
2691 case 0x00: /* USBCMD */
2692 if ((val & USBCMD_RS) && !(xhci->usbcmd & USBCMD_RS)) {
2693 xhci_run(xhci);
2694 } else if (!(val & USBCMD_RS) && (xhci->usbcmd & USBCMD_RS)) {
2695 xhci_stop(xhci);
2696 }
2697 xhci->usbcmd = val & 0xc0f;
2698 xhci_mfwrap_update(xhci);
2699 if (val & USBCMD_HCRST) {
2700 xhci_reset(&xhci->pci_dev.qdev);
2701 }
2702 xhci_intx_update(xhci);
2703 break;
2704
2705 case 0x04: /* USBSTS */
2706 /* these bits are write-1-to-clear */
2707 xhci->usbsts &= ~(val & (USBSTS_HSE|USBSTS_EINT|USBSTS_PCD|USBSTS_SRE));
2708 xhci_intx_update(xhci);
2709 break;
2710
2711 case 0x14: /* DNCTRL */
2712 xhci->dnctrl = val & 0xffff;
2713 break;
2714 case 0x18: /* CRCR low */
2715 xhci->crcr_low = (val & 0xffffffcf) | (xhci->crcr_low & CRCR_CRR);
2716 break;
2717 case 0x1c: /* CRCR high */
2718 xhci->crcr_high = val;
2719 if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) {
2720 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED};
2721 xhci->crcr_low &= ~CRCR_CRR;
2722 xhci_event(xhci, &event, 0);
2723 DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
2724 } else {
2725 dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
2726 xhci_ring_init(xhci, &xhci->cmd_ring, base);
2727 }
2728 xhci->crcr_low &= ~(CRCR_CA | CRCR_CS);
2729 break;
2730 case 0x30: /* DCBAAP low */
2731 xhci->dcbaap_low = val & 0xffffffc0;
2732 break;
2733 case 0x34: /* DCBAAP high */
2734 xhci->dcbaap_high = val;
2735 break;
2736 case 0x38: /* CONFIG */
2737 xhci->config = val & 0xff;
2738 break;
2739 default:
2740 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", (int)reg);
2741 }
2742 }
2743
2744 static uint64_t xhci_runtime_read(void *ptr, hwaddr reg,
2745 unsigned size)
2746 {
2747 XHCIState *xhci = ptr;
2748 uint32_t ret = 0;
2749
2750 if (reg < 0x20) {
2751 switch (reg) {
2752 case 0x00: /* MFINDEX */
2753 ret = xhci_mfindex_get(xhci) & 0x3fff;
2754 break;
2755 default:
2756 fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n",
2757 (int)reg);
2758 break;
2759 }
2760 } else {
2761 int v = (reg - 0x20) / 0x20;
2762 XHCIInterrupter *intr = &xhci->intr[v];
2763 switch (reg & 0x1f) {
2764 case 0x00: /* IMAN */
2765 ret = intr->iman;
2766 break;
2767 case 0x04: /* IMOD */
2768 ret = intr->imod;
2769 break;
2770 case 0x08: /* ERSTSZ */
2771 ret = intr->erstsz;
2772 break;
2773 case 0x10: /* ERSTBA low */
2774 ret = intr->erstba_low;
2775 break;
2776 case 0x14: /* ERSTBA high */
2777 ret = intr->erstba_high;
2778 break;
2779 case 0x18: /* ERDP low */
2780 ret = intr->erdp_low;
2781 break;
2782 case 0x1c: /* ERDP high */
2783 ret = intr->erdp_high;
2784 break;
2785 }
2786 }
2787
2788 trace_usb_xhci_runtime_read(reg, ret);
2789 return ret;
2790 }
2791
2792 static void xhci_runtime_write(void *ptr, hwaddr reg,
2793 uint64_t val, unsigned size)
2794 {
2795 XHCIState *xhci = ptr;
2796 int v = (reg - 0x20) / 0x20;
2797 XHCIInterrupter *intr = &xhci->intr[v];
2798 trace_usb_xhci_runtime_write(reg, val);
2799
2800 if (reg < 0x20) {
2801 fprintf(stderr, "%s: reg 0x%x unimplemented\n", __func__, (int)reg);
2802 return;
2803 }
2804
2805 switch (reg & 0x1f) {
2806 case 0x00: /* IMAN */
2807 if (val & IMAN_IP) {
2808 intr->iman &= ~IMAN_IP;
2809 }
2810 intr->iman &= ~IMAN_IE;
2811 intr->iman |= val & IMAN_IE;
2812 if (v == 0) {
2813 xhci_intx_update(xhci);
2814 }
2815 xhci_msix_update(xhci, v);
2816 break;
2817 case 0x04: /* IMOD */
2818 intr->imod = val;
2819 break;
2820 case 0x08: /* ERSTSZ */
2821 intr->erstsz = val & 0xffff;
2822 break;
2823 case 0x10: /* ERSTBA low */
2824 /* XXX NEC driver bug: it doesn't align this to 64 bytes
2825 intr->erstba_low = val & 0xffffffc0; */
2826 intr->erstba_low = val & 0xfffffff0;
2827 break;
2828 case 0x14: /* ERSTBA high */
2829 intr->erstba_high = val;
2830 xhci_er_reset(xhci, v);
2831 break;
2832 case 0x18: /* ERDP low */
2833 if (val & ERDP_EHB) {
2834 intr->erdp_low &= ~ERDP_EHB;
2835 }
2836 intr->erdp_low = (val & ~ERDP_EHB) | (intr->erdp_low & ERDP_EHB);
2837 break;
2838 case 0x1c: /* ERDP high */
2839 intr->erdp_high = val;
2840 xhci_events_update(xhci, v);
2841 break;
2842 default:
2843 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n",
2844 (int)reg);
2845 }
2846 }
2847
2848 static uint64_t xhci_doorbell_read(void *ptr, hwaddr reg,
2849 unsigned size)
2850 {
2851 /* doorbells always read as 0 */
2852 trace_usb_xhci_doorbell_read(reg, 0);
2853 return 0;
2854 }
2855
2856 static void xhci_doorbell_write(void *ptr, hwaddr reg,
2857 uint64_t val, unsigned size)
2858 {
2859 XHCIState *xhci = ptr;
2860
2861 trace_usb_xhci_doorbell_write(reg, val);
2862
2863 if (!xhci_running(xhci)) {
2864 fprintf(stderr, "xhci: wrote doorbell while xHC stopped or paused\n");
2865 return;
2866 }
2867
2868 reg >>= 2;
2869
2870 if (reg == 0) {
2871 if (val == 0) {
2872 xhci_process_commands(xhci);
2873 } else {
2874 fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n",
2875 (uint32_t)val);
2876 }
2877 } else {
2878 if (reg > xhci->numslots) {
2879 fprintf(stderr, "xhci: bad doorbell %d\n", (int)reg);
2880 } else if (val > 31) {
2881 fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n",
2882 (int)reg, (uint32_t)val);
2883 } else {
2884 xhci_kick_ep(xhci, reg, val);
2885 }
2886 }
2887 }
2888
2889 static const MemoryRegionOps xhci_cap_ops = {
2890 .read = xhci_cap_read,
2891 .valid.min_access_size = 1,
2892 .valid.max_access_size = 4,
2893 .impl.min_access_size = 4,
2894 .impl.max_access_size = 4,
2895 .endianness = DEVICE_LITTLE_ENDIAN,
2896 };
2897
2898 static const MemoryRegionOps xhci_oper_ops = {
2899 .read = xhci_oper_read,
2900 .write = xhci_oper_write,
2901 .valid.min_access_size = 4,
2902 .valid.max_access_size = 4,
2903 .endianness = DEVICE_LITTLE_ENDIAN,
2904 };
2905
2906 static const MemoryRegionOps xhci_port_ops = {
2907 .read = xhci_port_read,
2908 .write = xhci_port_write,
2909 .valid.min_access_size = 4,
2910 .valid.max_access_size = 4,
2911 .endianness = DEVICE_LITTLE_ENDIAN,
2912 };
2913
2914 static const MemoryRegionOps xhci_runtime_ops = {
2915 .read = xhci_runtime_read,
2916 .write = xhci_runtime_write,
2917 .valid.min_access_size = 4,
2918 .valid.max_access_size = 4,
2919 .endianness = DEVICE_LITTLE_ENDIAN,
2920 };
2921
2922 static const MemoryRegionOps xhci_doorbell_ops = {
2923 .read = xhci_doorbell_read,
2924 .write = xhci_doorbell_write,
2925 .valid.min_access_size = 4,
2926 .valid.max_access_size = 4,
2927 .endianness = DEVICE_LITTLE_ENDIAN,
2928 };
2929
2930 static void xhci_attach(USBPort *usbport)
2931 {
2932 XHCIState *xhci = usbport->opaque;
2933 XHCIPort *port = xhci_lookup_port(xhci, usbport);
2934
2935 xhci_port_update(port, 0);
2936 }
2937
2938 static void xhci_detach(USBPort *usbport)
2939 {
2940 XHCIState *xhci = usbport->opaque;
2941 XHCIPort *port = xhci_lookup_port(xhci, usbport);
2942
2943 xhci_port_update(port, 1);
2944 }
2945
2946 static void xhci_wakeup(USBPort *usbport)
2947 {
2948 XHCIState *xhci = usbport->opaque;
2949 XHCIPort *port = xhci_lookup_port(xhci, usbport);
2950
2951 if (get_field(port->portsc, PORTSC_PLS) != PLS_U3) {
2952 return;
2953 }
2954 set_field(&port->portsc, PLS_RESUME, PORTSC_PLS);
2955 xhci_port_notify(port, PORTSC_PLC);
2956 }
2957
2958 static void xhci_complete(USBPort *port, USBPacket *packet)
2959 {
2960 XHCITransfer *xfer = container_of(packet, XHCITransfer, packet);
2961
2962 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
2963 xhci_ep_nuke_one_xfer(xfer);
2964 return;
2965 }
2966 xhci_complete_packet(xfer);
2967 xhci_kick_ep(xfer->xhci, xfer->slotid, xfer->epid);
2968 }
2969
2970 static void xhci_child_detach(USBPort *uport, USBDevice *child)
2971 {
2972 USBBus *bus = usb_bus_from_device(child);
2973 XHCIState *xhci = container_of(bus, XHCIState, bus);
2974 int i;
2975
2976 for (i = 0; i < xhci->numslots; i++) {
2977 if (xhci->slots[i].uport == uport) {
2978 xhci->slots[i].uport = NULL;
2979 }
2980 }
2981 }
2982
2983 static USBPortOps xhci_uport_ops = {
2984 .attach = xhci_attach,
2985 .detach = xhci_detach,
2986 .wakeup = xhci_wakeup,
2987 .complete = xhci_complete,
2988 .child_detach = xhci_child_detach,
2989 };
2990
2991 static int xhci_find_slotid(XHCIState *xhci, USBDevice *dev)
2992 {
2993 XHCISlot *slot;
2994 int slotid;
2995
2996 for (slotid = 1; slotid <= xhci->numslots; slotid++) {
2997 slot = &xhci->slots[slotid-1];
2998 if (slot->devaddr == dev->addr) {
2999 return slotid;
3000 }
3001 }
3002 return 0;
3003 }
3004
3005 static int xhci_find_epid(USBEndpoint *ep)
3006 {
3007 if (ep->nr == 0) {
3008 return 1;
3009 }
3010 if (ep->pid == USB_TOKEN_IN) {
3011 return ep->nr * 2 + 1;
3012 } else {
3013 return ep->nr * 2;
3014 }
3015 }
3016
3017 static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep)
3018 {
3019 XHCIState *xhci = container_of(bus, XHCIState, bus);
3020 int slotid;
3021
3022 DPRINTF("%s\n", __func__);
3023 slotid = xhci_find_slotid(xhci, ep->dev);
3024 if (slotid == 0 || !xhci->slots[slotid-1].enabled) {
3025 DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr);
3026 return;
3027 }
3028 xhci_kick_ep(xhci, slotid, xhci_find_epid(ep));
3029 }
3030
3031 static USBBusOps xhci_bus_ops = {
3032 .wakeup_endpoint = xhci_wakeup_endpoint,
3033 };
3034
3035 static void usb_xhci_init(XHCIState *xhci, DeviceState *dev)
3036 {
3037 XHCIPort *port;
3038 int i, usbports, speedmask;
3039
3040 xhci->usbsts = USBSTS_HCH;
3041
3042 if (xhci->numports_2 > MAXPORTS_2) {
3043 xhci->numports_2 = MAXPORTS_2;
3044 }
3045 if (xhci->numports_3 > MAXPORTS_3) {
3046 xhci->numports_3 = MAXPORTS_3;
3047 }
3048 usbports = MAX(xhci->numports_2, xhci->numports_3);
3049 xhci->numports = xhci->numports_2 + xhci->numports_3;
3050
3051 usb_bus_new(&xhci->bus, &xhci_bus_ops, &xhci->pci_dev.qdev);
3052
3053 for (i = 0; i < usbports; i++) {
3054 speedmask = 0;
3055 if (i < xhci->numports_2) {
3056 port = &xhci->ports[i];
3057 port->portnr = i + 1;
3058 port->uport = &xhci->uports[i];
3059 port->speedmask =
3060 USB_SPEED_MASK_LOW |
3061 USB_SPEED_MASK_FULL |
3062 USB_SPEED_MASK_HIGH;
3063 snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1);
3064 speedmask |= port->speedmask;
3065 }
3066 if (i < xhci->numports_3) {
3067 port = &xhci->ports[i + xhci->numports_2];
3068 port->portnr = i + 1 + xhci->numports_2;
3069 port->uport = &xhci->uports[i];
3070 port->speedmask = USB_SPEED_MASK_SUPER;
3071 snprintf(port->name, sizeof(port->name), "usb3 port #%d", i+1);
3072 speedmask |= port->speedmask;
3073 }
3074 usb_register_port(&xhci->bus, &xhci->uports[i], xhci, i,
3075 &xhci_uport_ops, speedmask);
3076 }
3077 }
3078
3079 static int usb_xhci_initfn(struct PCIDevice *dev)
3080 {
3081 int i, ret;
3082
3083 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev, dev);
3084
3085 xhci->pci_dev.config[PCI_CLASS_PROG] = 0x30; /* xHCI */
3086 xhci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */
3087 xhci->pci_dev.config[PCI_CACHE_LINE_SIZE] = 0x10;
3088 xhci->pci_dev.config[0x60] = 0x30; /* release number */
3089
3090 usb_xhci_init(xhci, &dev->qdev);
3091
3092 if (xhci->numintrs > MAXINTRS) {
3093 xhci->numintrs = MAXINTRS;
3094 }
3095 if (xhci->numintrs < 1) {
3096 xhci->numintrs = 1;
3097 }
3098 if (xhci->numslots > MAXSLOTS) {
3099 xhci->numslots = MAXSLOTS;
3100 }
3101 if (xhci->numslots < 1) {
3102 xhci->numslots = 1;
3103 }
3104
3105 xhci->mfwrap_timer = qemu_new_timer_ns(vm_clock, xhci_mfwrap_timer, xhci);
3106
3107 xhci->irq = xhci->pci_dev.irq[0];
3108
3109 memory_region_init(&xhci->mem, "xhci", LEN_REGS);
3110 memory_region_init_io(&xhci->mem_cap, &xhci_cap_ops, xhci,
3111 "capabilities", LEN_CAP);
3112 memory_region_init_io(&xhci->mem_oper, &xhci_oper_ops, xhci,
3113 "operational", 0x400);
3114 memory_region_init_io(&xhci->mem_runtime, &xhci_runtime_ops, xhci,
3115 "runtime", LEN_RUNTIME);
3116 memory_region_init_io(&xhci->mem_doorbell, &xhci_doorbell_ops, xhci,
3117 "doorbell", LEN_DOORBELL);
3118
3119 memory_region_add_subregion(&xhci->mem, 0, &xhci->mem_cap);
3120 memory_region_add_subregion(&xhci->mem, OFF_OPER, &xhci->mem_oper);
3121 memory_region_add_subregion(&xhci->mem, OFF_RUNTIME, &xhci->mem_runtime);
3122 memory_region_add_subregion(&xhci->mem, OFF_DOORBELL, &xhci->mem_doorbell);
3123
3124 for (i = 0; i < xhci->numports; i++) {
3125 XHCIPort *port = &xhci->ports[i];
3126 uint32_t offset = OFF_OPER + 0x400 + 0x10 * i;
3127 port->xhci = xhci;
3128 memory_region_init_io(&port->mem, &xhci_port_ops, port,
3129 port->name, 0x10);
3130 memory_region_add_subregion(&xhci->mem, offset, &port->mem);
3131 }
3132
3133 pci_register_bar(&xhci->pci_dev, 0,
3134 PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
3135 &xhci->mem);
3136
3137 ret = pcie_cap_init(&xhci->pci_dev, 0xa0, PCI_EXP_TYPE_ENDPOINT, 0);
3138 assert(ret >= 0);
3139
3140 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) {
3141 msi_init(&xhci->pci_dev, 0x70, xhci->numintrs, true, false);
3142 }
3143 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI_X)) {
3144 msix_init(&xhci->pci_dev, xhci->numintrs,
3145 &xhci->mem, 0, OFF_MSIX_TABLE,
3146 &xhci->mem, 0, OFF_MSIX_PBA,
3147 0x90);
3148 }
3149
3150 return 0;
3151 }
3152
3153 static const VMStateDescription vmstate_xhci = {
3154 .name = "xhci",
3155 .unmigratable = 1,
3156 };
3157
3158 static Property xhci_properties[] = {
3159 DEFINE_PROP_BIT("msi", XHCIState, flags, XHCI_FLAG_USE_MSI, true),
3160 DEFINE_PROP_BIT("msix", XHCIState, flags, XHCI_FLAG_USE_MSI_X, true),
3161 DEFINE_PROP_UINT32("intrs", XHCIState, numintrs, MAXINTRS),
3162 DEFINE_PROP_UINT32("slots", XHCIState, numslots, MAXSLOTS),
3163 DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
3164 DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
3165 DEFINE_PROP_END_OF_LIST(),
3166 };
3167
3168 static void xhci_class_init(ObjectClass *klass, void *data)
3169 {
3170 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3171 DeviceClass *dc = DEVICE_CLASS(klass);
3172
3173 dc->vmsd = &vmstate_xhci;
3174 dc->props = xhci_properties;
3175 dc->reset = xhci_reset;
3176 k->init = usb_xhci_initfn;
3177 k->vendor_id = PCI_VENDOR_ID_NEC;
3178 k->device_id = PCI_DEVICE_ID_NEC_UPD720200;
3179 k->class_id = PCI_CLASS_SERIAL_USB;
3180 k->revision = 0x03;
3181 k->is_express = 1;
3182 k->no_hotplug = 1;
3183 }
3184
3185 static const TypeInfo xhci_info = {
3186 .name = "nec-usb-xhci",
3187 .parent = TYPE_PCI_DEVICE,
3188 .instance_size = sizeof(XHCIState),
3189 .class_init = xhci_class_init,
3190 };
3191
3192 static void xhci_register_types(void)
3193 {
3194 type_register_static(&xhci_info);
3195 }
3196
3197 type_init(xhci_register_types)
Qemu copy for testing