1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "qemu/osdep.h" 31 #include "qapi/error.h" 32 #include "hw/usb/ehci-regs.h" 33 #include "hw/usb/hcd-ehci.h" 34 #include "trace.h" 35 36 #define FRAME_TIMER_FREQ 1000 37 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) 38 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) 39 40 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 41 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 42 #define MAX_QH 100 // Max allowable queue heads in a chain 43 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ 44 #define PERIODIC_ACTIVE 512 /* Micro-frames */ 45 46 /* Internal periodic / asynchronous schedule state machine states 47 */ 48 typedef enum { 49 EST_INACTIVE = 1000, 50 EST_ACTIVE, 51 EST_EXECUTING, 52 EST_SLEEPING, 53 /* The following states are internal to the state machine function 54 */ 55 EST_WAITLISTHEAD, 56 EST_FETCHENTRY, 57 EST_FETCHQH, 58 EST_FETCHITD, 59 EST_FETCHSITD, 60 EST_ADVANCEQUEUE, 61 EST_FETCHQTD, 62 EST_EXECUTE, 63 EST_WRITEBACK, 64 EST_HORIZONTALQH 65 } EHCI_STATES; 66 67 /* macros for accessing fields within next link pointer entry */ 68 #define NLPTR_GET(x) ((x) & 0xffffffe0) 69 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 70 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 71 72 /* link pointer types */ 73 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 74 #define NLPTR_TYPE_QH 1 // queue head 75 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 76 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 77 78 #define SET_LAST_RUN_CLOCK(s) \ 79 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 80 81 /* nifty macros from Arnon's EHCI version */ 82 #define get_field(data, field) \ 83 (((data) & field##_MASK) >> field##_SH) 84 85 #define set_field(data, newval, field) do { \ 86 uint32_t val = *data; \ 87 val &= ~ field##_MASK; \ 88 val |= ((newval) << field##_SH) & field##_MASK; \ 89 *data = val; \ 90 } while(0) 91 92 static const char *ehci_state_names[] = { 93 [EST_INACTIVE] = "INACTIVE", 94 [EST_ACTIVE] = "ACTIVE", 95 [EST_EXECUTING] = "EXECUTING", 96 [EST_SLEEPING] = "SLEEPING", 97 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 98 [EST_FETCHENTRY] = "FETCH ENTRY", 99 [EST_FETCHQH] = "FETCH QH", 100 [EST_FETCHITD] = "FETCH ITD", 101 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 102 [EST_FETCHQTD] = "FETCH QTD", 103 [EST_EXECUTE] = "EXECUTE", 104 [EST_WRITEBACK] = "WRITEBACK", 105 [EST_HORIZONTALQH] = "HORIZONTALQH", 106 }; 107 108 static const char *ehci_mmio_names[] = { 109 [USBCMD] = "USBCMD", 110 [USBSTS] = "USBSTS", 111 [USBINTR] = "USBINTR", 112 [FRINDEX] = "FRINDEX", 113 [PERIODICLISTBASE] = "P-LIST BASE", 114 [ASYNCLISTADDR] = "A-LIST ADDR", 115 [CONFIGFLAG] = "CONFIGFLAG", 116 }; 117 118 static int ehci_state_executing(EHCIQueue *q); 119 static int ehci_state_writeback(EHCIQueue *q); 120 static int ehci_state_advqueue(EHCIQueue *q); 121 static int ehci_fill_queue(EHCIPacket *p); 122 static void ehci_free_packet(EHCIPacket *p); 123 124 static const char *nr2str(const char **n, size_t len, uint32_t nr) 125 { 126 if (nr < len && n[nr] != NULL) { 127 return n[nr]; 128 } else { 129 return "unknown"; 130 } 131 } 132 133 static const char *state2str(uint32_t state) 134 { 135 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 136 } 137 138 static const char *addr2str(hwaddr addr) 139 { 140 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 141 } 142 143 static void ehci_trace_usbsts(uint32_t mask, int state) 144 { 145 /* interrupts */ 146 if (mask & USBSTS_INT) { 147 trace_usb_ehci_usbsts("INT", state); 148 } 149 if (mask & USBSTS_ERRINT) { 150 trace_usb_ehci_usbsts("ERRINT", state); 151 } 152 if (mask & USBSTS_PCD) { 153 trace_usb_ehci_usbsts("PCD", state); 154 } 155 if (mask & USBSTS_FLR) { 156 trace_usb_ehci_usbsts("FLR", state); 157 } 158 if (mask & USBSTS_HSE) { 159 trace_usb_ehci_usbsts("HSE", state); 160 } 161 if (mask & USBSTS_IAA) { 162 trace_usb_ehci_usbsts("IAA", state); 163 } 164 165 /* status */ 166 if (mask & USBSTS_HALT) { 167 trace_usb_ehci_usbsts("HALT", state); 168 } 169 if (mask & USBSTS_REC) { 170 trace_usb_ehci_usbsts("REC", state); 171 } 172 if (mask & USBSTS_PSS) { 173 trace_usb_ehci_usbsts("PSS", state); 174 } 175 if (mask & USBSTS_ASS) { 176 trace_usb_ehci_usbsts("ASS", state); 177 } 178 } 179 180 static inline void ehci_set_usbsts(EHCIState *s, int mask) 181 { 182 if ((s->usbsts & mask) == mask) { 183 return; 184 } 185 ehci_trace_usbsts(mask, 1); 186 s->usbsts |= mask; 187 } 188 189 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 190 { 191 if ((s->usbsts & mask) == 0) { 192 return; 193 } 194 ehci_trace_usbsts(mask, 0); 195 s->usbsts &= ~mask; 196 } 197 198 /* update irq line */ 199 static inline void ehci_update_irq(EHCIState *s) 200 { 201 int level = 0; 202 203 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 204 level = 1; 205 } 206 207 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 208 qemu_set_irq(s->irq, level); 209 } 210 211 /* flag interrupt condition */ 212 static inline void ehci_raise_irq(EHCIState *s, int intr) 213 { 214 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 215 s->usbsts |= intr; 216 ehci_update_irq(s); 217 } else { 218 s->usbsts_pending |= intr; 219 } 220 } 221 222 /* 223 * Commit pending interrupts (added via ehci_raise_irq), 224 * at the rate allowed by "Interrupt Threshold Control". 225 */ 226 static inline void ehci_commit_irq(EHCIState *s) 227 { 228 uint32_t itc; 229 230 if (!s->usbsts_pending) { 231 return; 232 } 233 if (s->usbsts_frindex > s->frindex) { 234 return; 235 } 236 237 itc = (s->usbcmd >> 16) & 0xff; 238 s->usbsts |= s->usbsts_pending; 239 s->usbsts_pending = 0; 240 s->usbsts_frindex = s->frindex + itc; 241 ehci_update_irq(s); 242 } 243 244 static void ehci_update_halt(EHCIState *s) 245 { 246 if (s->usbcmd & USBCMD_RUNSTOP) { 247 ehci_clear_usbsts(s, USBSTS_HALT); 248 } else { 249 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 250 ehci_set_usbsts(s, USBSTS_HALT); 251 } 252 } 253 } 254 255 static void ehci_set_state(EHCIState *s, int async, int state) 256 { 257 if (async) { 258 trace_usb_ehci_state("async", state2str(state)); 259 s->astate = state; 260 if (s->astate == EST_INACTIVE) { 261 ehci_clear_usbsts(s, USBSTS_ASS); 262 ehci_update_halt(s); 263 } else { 264 ehci_set_usbsts(s, USBSTS_ASS); 265 } 266 } else { 267 trace_usb_ehci_state("periodic", state2str(state)); 268 s->pstate = state; 269 if (s->pstate == EST_INACTIVE) { 270 ehci_clear_usbsts(s, USBSTS_PSS); 271 ehci_update_halt(s); 272 } else { 273 ehci_set_usbsts(s, USBSTS_PSS); 274 } 275 } 276 } 277 278 static int ehci_get_state(EHCIState *s, int async) 279 { 280 return async ? s->astate : s->pstate; 281 } 282 283 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 284 { 285 if (async) { 286 s->a_fetch_addr = addr; 287 } else { 288 s->p_fetch_addr = addr; 289 } 290 } 291 292 static int ehci_get_fetch_addr(EHCIState *s, int async) 293 { 294 return async ? s->a_fetch_addr : s->p_fetch_addr; 295 } 296 297 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 298 { 299 /* need three here due to argument count limits */ 300 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 301 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 302 trace_usb_ehci_qh_fields(addr, 303 get_field(qh->epchar, QH_EPCHAR_RL), 304 get_field(qh->epchar, QH_EPCHAR_MPLEN), 305 get_field(qh->epchar, QH_EPCHAR_EPS), 306 get_field(qh->epchar, QH_EPCHAR_EP), 307 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 308 trace_usb_ehci_qh_bits(addr, 309 (bool)(qh->epchar & QH_EPCHAR_C), 310 (bool)(qh->epchar & QH_EPCHAR_H), 311 (bool)(qh->epchar & QH_EPCHAR_DTC), 312 (bool)(qh->epchar & QH_EPCHAR_I)); 313 } 314 315 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 316 { 317 /* need three here due to argument count limits */ 318 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 319 trace_usb_ehci_qtd_fields(addr, 320 get_field(qtd->token, QTD_TOKEN_TBYTES), 321 get_field(qtd->token, QTD_TOKEN_CPAGE), 322 get_field(qtd->token, QTD_TOKEN_CERR), 323 get_field(qtd->token, QTD_TOKEN_PID)); 324 trace_usb_ehci_qtd_bits(addr, 325 (bool)(qtd->token & QTD_TOKEN_IOC), 326 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 327 (bool)(qtd->token & QTD_TOKEN_HALT), 328 (bool)(qtd->token & QTD_TOKEN_BABBLE), 329 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 330 } 331 332 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 333 { 334 trace_usb_ehci_itd(addr, itd->next, 335 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 336 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 337 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 338 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 339 } 340 341 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 342 EHCIsitd *sitd) 343 { 344 trace_usb_ehci_sitd(addr, sitd->next, 345 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 346 } 347 348 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 349 { 350 trace_usb_ehci_guest_bug(message); 351 fprintf(stderr, "ehci warning: %s\n", message); 352 } 353 354 static inline bool ehci_enabled(EHCIState *s) 355 { 356 return s->usbcmd & USBCMD_RUNSTOP; 357 } 358 359 static inline bool ehci_async_enabled(EHCIState *s) 360 { 361 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 362 } 363 364 static inline bool ehci_periodic_enabled(EHCIState *s) 365 { 366 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 367 } 368 369 /* Get an array of dwords from main memory */ 370 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 371 uint32_t *buf, int num) 372 { 373 int i; 374 375 if (!ehci->as) { 376 ehci_raise_irq(ehci, USBSTS_HSE); 377 ehci->usbcmd &= ~USBCMD_RUNSTOP; 378 trace_usb_ehci_dma_error(); 379 return -1; 380 } 381 382 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 383 dma_memory_read(ehci->as, addr, buf, sizeof(*buf)); 384 *buf = le32_to_cpu(*buf); 385 } 386 387 return num; 388 } 389 390 /* Put an array of dwords in to main memory */ 391 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 392 uint32_t *buf, int num) 393 { 394 int i; 395 396 if (!ehci->as) { 397 ehci_raise_irq(ehci, USBSTS_HSE); 398 ehci->usbcmd &= ~USBCMD_RUNSTOP; 399 trace_usb_ehci_dma_error(); 400 return -1; 401 } 402 403 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 404 uint32_t tmp = cpu_to_le32(*buf); 405 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp)); 406 } 407 408 return num; 409 } 410 411 static int ehci_get_pid(EHCIqtd *qtd) 412 { 413 switch (get_field(qtd->token, QTD_TOKEN_PID)) { 414 case 0: 415 return USB_TOKEN_OUT; 416 case 1: 417 return USB_TOKEN_IN; 418 case 2: 419 return USB_TOKEN_SETUP; 420 default: 421 fprintf(stderr, "bad token\n"); 422 return 0; 423 } 424 } 425 426 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh) 427 { 428 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR); 429 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP); 430 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 431 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 432 (qh->current_qtd != q->qh.current_qtd) || 433 (q->async && qh->next_qtd != q->qh.next_qtd) || 434 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd, 435 7 * sizeof(uint32_t)) != 0) || 436 (q->dev != NULL && q->dev->addr != devaddr)) { 437 return false; 438 } else { 439 return true; 440 } 441 } 442 443 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) 444 { 445 if (p->qtdaddr != p->queue->qtdaddr || 446 (p->queue->async && !NLPTR_TBIT(p->qtd.next) && 447 (p->qtd.next != qtd->next)) || 448 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || 449 p->qtd.token != qtd->token || 450 p->qtd.bufptr[0] != qtd->bufptr[0]) { 451 return false; 452 } else { 453 return true; 454 } 455 } 456 457 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) 458 { 459 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP); 460 int pid = ehci_get_pid(qtd); 461 462 /* Note the pid changing is normal for ep 0 (the control ep) */ 463 if (q->last_pid && ep != 0 && pid != q->last_pid) { 464 return false; 465 } else { 466 return true; 467 } 468 } 469 470 /* Finish executing and writeback a packet outside of the regular 471 fetchqh -> fetchqtd -> execute -> writeback cycle */ 472 static void ehci_writeback_async_complete_packet(EHCIPacket *p) 473 { 474 EHCIQueue *q = p->queue; 475 EHCIqtd qtd; 476 EHCIqh qh; 477 int state; 478 479 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ 480 get_dwords(q->ehci, NLPTR_GET(q->qhaddr), 481 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 482 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), 483 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 484 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { 485 p->async = EHCI_ASYNC_INITIALIZED; 486 ehci_free_packet(p); 487 return; 488 } 489 490 state = ehci_get_state(q->ehci, q->async); 491 ehci_state_executing(q); 492 ehci_state_writeback(q); /* Frees the packet! */ 493 if (!(q->qh.token & QTD_TOKEN_HALT)) { 494 ehci_state_advqueue(q); 495 } 496 ehci_set_state(q->ehci, q->async, state); 497 } 498 499 /* packet management */ 500 501 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 502 { 503 EHCIPacket *p; 504 505 p = g_new0(EHCIPacket, 1); 506 p->queue = q; 507 usb_packet_init(&p->packet); 508 QTAILQ_INSERT_TAIL(&q->packets, p, next); 509 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 510 return p; 511 } 512 513 static void ehci_free_packet(EHCIPacket *p) 514 { 515 if (p->async == EHCI_ASYNC_FINISHED && 516 !(p->queue->qh.token & QTD_TOKEN_HALT)) { 517 ehci_writeback_async_complete_packet(p); 518 return; 519 } 520 trace_usb_ehci_packet_action(p->queue, p, "free"); 521 if (p->async == EHCI_ASYNC_INFLIGHT) { 522 usb_cancel_packet(&p->packet); 523 } 524 if (p->async == EHCI_ASYNC_FINISHED && 525 p->packet.status == USB_RET_SUCCESS) { 526 fprintf(stderr, 527 "EHCI: Dropping completed packet from halted %s ep %02X\n", 528 (p->pid == USB_TOKEN_IN) ? "in" : "out", 529 get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); 530 } 531 if (p->async != EHCI_ASYNC_NONE) { 532 usb_packet_unmap(&p->packet, &p->sgl); 533 qemu_sglist_destroy(&p->sgl); 534 } 535 QTAILQ_REMOVE(&p->queue->packets, p, next); 536 usb_packet_cleanup(&p->packet); 537 g_free(p); 538 } 539 540 /* queue management */ 541 542 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 543 { 544 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 545 EHCIQueue *q; 546 547 q = g_malloc0(sizeof(*q)); 548 q->ehci = ehci; 549 q->qhaddr = addr; 550 q->async = async; 551 QTAILQ_INIT(&q->packets); 552 QTAILQ_INSERT_HEAD(head, q, next); 553 trace_usb_ehci_queue_action(q, "alloc"); 554 return q; 555 } 556 557 static void ehci_queue_stopped(EHCIQueue *q) 558 { 559 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP); 560 561 if (!q->last_pid || !q->dev) { 562 return; 563 } 564 565 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp)); 566 } 567 568 static int ehci_cancel_queue(EHCIQueue *q) 569 { 570 EHCIPacket *p; 571 int packets = 0; 572 573 p = QTAILQ_FIRST(&q->packets); 574 if (p == NULL) { 575 goto leave; 576 } 577 578 trace_usb_ehci_queue_action(q, "cancel"); 579 do { 580 ehci_free_packet(p); 581 packets++; 582 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 583 584 leave: 585 ehci_queue_stopped(q); 586 return packets; 587 } 588 589 static int ehci_reset_queue(EHCIQueue *q) 590 { 591 int packets; 592 593 trace_usb_ehci_queue_action(q, "reset"); 594 packets = ehci_cancel_queue(q); 595 q->dev = NULL; 596 q->qtdaddr = 0; 597 q->last_pid = 0; 598 return packets; 599 } 600 601 static void ehci_free_queue(EHCIQueue *q, const char *warn) 602 { 603 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 604 int cancelled; 605 606 trace_usb_ehci_queue_action(q, "free"); 607 cancelled = ehci_cancel_queue(q); 608 if (warn && cancelled > 0) { 609 ehci_trace_guest_bug(q->ehci, warn); 610 } 611 QTAILQ_REMOVE(head, q, next); 612 g_free(q); 613 } 614 615 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 616 int async) 617 { 618 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 619 EHCIQueue *q; 620 621 QTAILQ_FOREACH(q, head, next) { 622 if (addr == q->qhaddr) { 623 return q; 624 } 625 } 626 return NULL; 627 } 628 629 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 630 { 631 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 632 const char *warn = async ? "guest unlinked busy QH" : NULL; 633 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 634 EHCIQueue *q, *tmp; 635 636 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 637 if (q->seen) { 638 q->seen = 0; 639 q->ts = ehci->last_run_ns; 640 continue; 641 } 642 if (ehci->last_run_ns < q->ts + maxage) { 643 continue; 644 } 645 ehci_free_queue(q, warn); 646 } 647 } 648 649 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 650 { 651 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 652 EHCIQueue *q, *tmp; 653 654 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 655 if (!q->seen) { 656 ehci_free_queue(q, NULL); 657 } 658 } 659 } 660 661 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 662 { 663 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 664 EHCIQueue *q, *tmp; 665 666 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 667 if (q->dev != dev) { 668 continue; 669 } 670 ehci_free_queue(q, NULL); 671 } 672 } 673 674 static void ehci_queues_rip_all(EHCIState *ehci, int async) 675 { 676 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 677 const char *warn = async ? "guest stopped busy async schedule" : NULL; 678 EHCIQueue *q, *tmp; 679 680 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 681 ehci_free_queue(q, warn); 682 } 683 } 684 685 /* Attach or detach a device on root hub */ 686 687 static void ehci_attach(USBPort *port) 688 { 689 EHCIState *s = port->opaque; 690 uint32_t *portsc = &s->portsc[port->index]; 691 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 692 693 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 694 695 if (*portsc & PORTSC_POWNER) { 696 USBPort *companion = s->companion_ports[port->index]; 697 companion->dev = port->dev; 698 companion->ops->attach(companion); 699 return; 700 } 701 702 *portsc |= PORTSC_CONNECT; 703 *portsc |= PORTSC_CSC; 704 705 ehci_raise_irq(s, USBSTS_PCD); 706 } 707 708 static void ehci_detach(USBPort *port) 709 { 710 EHCIState *s = port->opaque; 711 uint32_t *portsc = &s->portsc[port->index]; 712 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 713 714 trace_usb_ehci_port_detach(port->index, owner); 715 716 if (*portsc & PORTSC_POWNER) { 717 USBPort *companion = s->companion_ports[port->index]; 718 companion->ops->detach(companion); 719 companion->dev = NULL; 720 /* 721 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 722 * the port ownership is returned immediately to the EHCI controller." 723 */ 724 *portsc &= ~PORTSC_POWNER; 725 return; 726 } 727 728 ehci_queues_rip_device(s, port->dev, 0); 729 ehci_queues_rip_device(s, port->dev, 1); 730 731 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); 732 *portsc |= PORTSC_CSC; 733 734 ehci_raise_irq(s, USBSTS_PCD); 735 } 736 737 static void ehci_child_detach(USBPort *port, USBDevice *child) 738 { 739 EHCIState *s = port->opaque; 740 uint32_t portsc = s->portsc[port->index]; 741 742 if (portsc & PORTSC_POWNER) { 743 USBPort *companion = s->companion_ports[port->index]; 744 companion->ops->child_detach(companion, child); 745 return; 746 } 747 748 ehci_queues_rip_device(s, child, 0); 749 ehci_queues_rip_device(s, child, 1); 750 } 751 752 static void ehci_wakeup(USBPort *port) 753 { 754 EHCIState *s = port->opaque; 755 uint32_t *portsc = &s->portsc[port->index]; 756 757 if (*portsc & PORTSC_POWNER) { 758 USBPort *companion = s->companion_ports[port->index]; 759 if (companion->ops->wakeup) { 760 companion->ops->wakeup(companion); 761 } 762 return; 763 } 764 765 if (*portsc & PORTSC_SUSPEND) { 766 trace_usb_ehci_port_wakeup(port->index); 767 *portsc |= PORTSC_FPRES; 768 ehci_raise_irq(s, USBSTS_PCD); 769 } 770 771 qemu_bh_schedule(s->async_bh); 772 } 773 774 static void ehci_register_companion(USBBus *bus, USBPort *ports[], 775 uint32_t portcount, uint32_t firstport, 776 Error **errp) 777 { 778 EHCIState *s = container_of(bus, EHCIState, bus); 779 uint32_t i; 780 781 if (firstport + portcount > NB_PORTS) { 782 error_setg(errp, "firstport must be between 0 and %u", 783 NB_PORTS - portcount); 784 return; 785 } 786 787 for (i = 0; i < portcount; i++) { 788 if (s->companion_ports[firstport + i]) { 789 error_setg(errp, "firstport %u asks for ports %u-%u," 790 " but port %u has a companion assigned already", 791 firstport, firstport, firstport + portcount - 1, 792 firstport + i); 793 return; 794 } 795 } 796 797 for (i = 0; i < portcount; i++) { 798 s->companion_ports[firstport + i] = ports[i]; 799 s->ports[firstport + i].speedmask |= 800 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 801 /* Ensure devs attached before the initial reset go to the companion */ 802 s->portsc[firstport + i] = PORTSC_POWNER; 803 } 804 805 s->companion_count++; 806 s->caps[0x05] = (s->companion_count << 4) | portcount; 807 } 808 809 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, 810 unsigned int stream) 811 { 812 EHCIState *s = container_of(bus, EHCIState, bus); 813 uint32_t portsc = s->portsc[ep->dev->port->index]; 814 815 if (portsc & PORTSC_POWNER) { 816 return; 817 } 818 819 s->periodic_sched_active = PERIODIC_ACTIVE; 820 qemu_bh_schedule(s->async_bh); 821 } 822 823 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 824 { 825 USBDevice *dev; 826 USBPort *port; 827 int i; 828 829 for (i = 0; i < NB_PORTS; i++) { 830 port = &ehci->ports[i]; 831 if (!(ehci->portsc[i] & PORTSC_PED)) { 832 DPRINTF("Port %d not enabled\n", i); 833 continue; 834 } 835 dev = usb_find_device(port, addr); 836 if (dev != NULL) { 837 return dev; 838 } 839 } 840 return NULL; 841 } 842 843 /* 4.1 host controller initialization */ 844 void ehci_reset(void *opaque) 845 { 846 EHCIState *s = opaque; 847 int i; 848 USBDevice *devs[NB_PORTS]; 849 850 trace_usb_ehci_reset(); 851 852 /* 853 * Do the detach before touching portsc, so that it correctly gets send to 854 * us or to our companion based on PORTSC_POWNER before the reset. 855 */ 856 for(i = 0; i < NB_PORTS; i++) { 857 devs[i] = s->ports[i].dev; 858 if (devs[i] && devs[i]->attached) { 859 usb_detach(&s->ports[i]); 860 } 861 } 862 863 memset(&s->opreg, 0x00, sizeof(s->opreg)); 864 memset(&s->portsc, 0x00, sizeof(s->portsc)); 865 866 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 867 s->usbsts = USBSTS_HALT; 868 s->usbsts_pending = 0; 869 s->usbsts_frindex = 0; 870 ehci_update_irq(s); 871 872 s->astate = EST_INACTIVE; 873 s->pstate = EST_INACTIVE; 874 875 for(i = 0; i < NB_PORTS; i++) { 876 if (s->companion_ports[i]) { 877 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 878 } else { 879 s->portsc[i] = PORTSC_PPOWER; 880 } 881 if (devs[i] && devs[i]->attached) { 882 usb_attach(&s->ports[i]); 883 usb_device_reset(devs[i]); 884 } 885 } 886 ehci_queues_rip_all(s, 0); 887 ehci_queues_rip_all(s, 1); 888 timer_del(s->frame_timer); 889 qemu_bh_cancel(s->async_bh); 890 } 891 892 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 893 unsigned size) 894 { 895 EHCIState *s = ptr; 896 return s->caps[addr]; 897 } 898 899 static void ehci_caps_write(void *ptr, hwaddr addr, 900 uint64_t val, unsigned size) 901 { 902 } 903 904 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 905 unsigned size) 906 { 907 EHCIState *s = ptr; 908 uint32_t val; 909 910 switch (addr) { 911 case FRINDEX: 912 /* Round down to mult of 8, else it can go backwards on migration */ 913 val = s->frindex & ~7; 914 break; 915 default: 916 val = s->opreg[addr >> 2]; 917 } 918 919 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 920 return val; 921 } 922 923 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 924 unsigned size) 925 { 926 EHCIState *s = ptr; 927 uint32_t val; 928 929 val = s->portsc[addr >> 2]; 930 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val); 931 return val; 932 } 933 934 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 935 { 936 USBDevice *dev = s->ports[port].dev; 937 uint32_t *portsc = &s->portsc[port]; 938 uint32_t orig; 939 940 if (s->companion_ports[port] == NULL) 941 return; 942 943 owner = owner & PORTSC_POWNER; 944 orig = *portsc & PORTSC_POWNER; 945 946 if (!(owner ^ orig)) { 947 return; 948 } 949 950 if (dev && dev->attached) { 951 usb_detach(&s->ports[port]); 952 } 953 954 *portsc &= ~PORTSC_POWNER; 955 *portsc |= owner; 956 957 if (dev && dev->attached) { 958 usb_attach(&s->ports[port]); 959 } 960 } 961 962 static void ehci_port_write(void *ptr, hwaddr addr, 963 uint64_t val, unsigned size) 964 { 965 EHCIState *s = ptr; 966 int port = addr >> 2; 967 uint32_t *portsc = &s->portsc[port]; 968 uint32_t old = *portsc; 969 USBDevice *dev = s->ports[port].dev; 970 971 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val); 972 973 /* Clear rwc bits */ 974 *portsc &= ~(val & PORTSC_RWC_MASK); 975 /* The guest may clear, but not set the PED bit */ 976 *portsc &= val | ~PORTSC_PED; 977 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 978 handle_port_owner_write(s, port, val); 979 /* And finally apply RO_MASK */ 980 val &= PORTSC_RO_MASK; 981 982 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 983 trace_usb_ehci_port_reset(port, 1); 984 } 985 986 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 987 trace_usb_ehci_port_reset(port, 0); 988 if (dev && dev->attached) { 989 usb_port_reset(&s->ports[port]); 990 *portsc &= ~PORTSC_CSC; 991 } 992 993 /* 994 * Table 2.16 Set the enable bit(and enable bit change) to indicate 995 * to SW that this port has a high speed device attached 996 */ 997 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 998 val |= PORTSC_PED; 999 } 1000 } 1001 1002 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) { 1003 trace_usb_ehci_port_suspend(port); 1004 } 1005 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) { 1006 trace_usb_ehci_port_resume(port); 1007 val &= ~PORTSC_SUSPEND; 1008 } 1009 1010 *portsc &= ~PORTSC_RO_MASK; 1011 *portsc |= val; 1012 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old); 1013 } 1014 1015 static void ehci_opreg_write(void *ptr, hwaddr addr, 1016 uint64_t val, unsigned size) 1017 { 1018 EHCIState *s = ptr; 1019 uint32_t *mmio = s->opreg + (addr >> 2); 1020 uint32_t old = *mmio; 1021 int i; 1022 1023 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 1024 1025 switch (addr) { 1026 case USBCMD: 1027 if (val & USBCMD_HCRESET) { 1028 ehci_reset(s); 1029 val = s->usbcmd; 1030 break; 1031 } 1032 1033 /* not supporting dynamic frame list size at the moment */ 1034 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 1035 fprintf(stderr, "attempt to set frame list size -- value %d\n", 1036 (int)val & USBCMD_FLS); 1037 val &= ~USBCMD_FLS; 1038 } 1039 1040 if (val & USBCMD_IAAD) { 1041 /* 1042 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 1043 * trigger and re-use a qh without us seeing the unlink. 1044 */ 1045 s->async_stepdown = 0; 1046 qemu_bh_schedule(s->async_bh); 1047 trace_usb_ehci_doorbell_ring(); 1048 } 1049 1050 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 1051 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 1052 if (s->pstate == EST_INACTIVE) { 1053 SET_LAST_RUN_CLOCK(s); 1054 } 1055 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 1056 ehci_update_halt(s); 1057 s->async_stepdown = 0; 1058 qemu_bh_schedule(s->async_bh); 1059 } 1060 break; 1061 1062 case USBSTS: 1063 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 1064 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 1065 val = s->usbsts; 1066 ehci_update_irq(s); 1067 break; 1068 1069 case USBINTR: 1070 val &= USBINTR_MASK; 1071 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 1072 qemu_bh_schedule(s->async_bh); 1073 } 1074 break; 1075 1076 case FRINDEX: 1077 val &= 0x00003fff; /* frindex is 14bits */ 1078 s->usbsts_frindex = val; 1079 break; 1080 1081 case CONFIGFLAG: 1082 val &= 0x1; 1083 if (val) { 1084 for(i = 0; i < NB_PORTS; i++) 1085 handle_port_owner_write(s, i, 0); 1086 } 1087 break; 1088 1089 case PERIODICLISTBASE: 1090 if (ehci_periodic_enabled(s)) { 1091 fprintf(stderr, 1092 "ehci: PERIODIC list base register set while periodic schedule\n" 1093 " is enabled and HC is enabled\n"); 1094 } 1095 break; 1096 1097 case ASYNCLISTADDR: 1098 if (ehci_async_enabled(s)) { 1099 fprintf(stderr, 1100 "ehci: ASYNC list address register set while async schedule\n" 1101 " is enabled and HC is enabled\n"); 1102 } 1103 break; 1104 } 1105 1106 *mmio = val; 1107 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1108 *mmio, old); 1109 } 1110 1111 /* 1112 * Write the qh back to guest physical memory. This step isn't 1113 * in the EHCI spec but we need to do it since we don't share 1114 * physical memory with our guest VM. 1115 * 1116 * The first three dwords are read-only for the EHCI, so skip them 1117 * when writing back the qh. 1118 */ 1119 static void ehci_flush_qh(EHCIQueue *q) 1120 { 1121 uint32_t *qh = (uint32_t *) &q->qh; 1122 uint32_t dwords = sizeof(EHCIqh) >> 2; 1123 uint32_t addr = NLPTR_GET(q->qhaddr); 1124 1125 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1126 } 1127 1128 // 4.10.2 1129 1130 static int ehci_qh_do_overlay(EHCIQueue *q) 1131 { 1132 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1133 int i; 1134 int dtoggle; 1135 int ping; 1136 int eps; 1137 int reload; 1138 1139 assert(p != NULL); 1140 assert(p->qtdaddr == q->qtdaddr); 1141 1142 // remember values in fields to preserve in qh after overlay 1143 1144 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1145 ping = q->qh.token & QTD_TOKEN_PING; 1146 1147 q->qh.current_qtd = p->qtdaddr; 1148 q->qh.next_qtd = p->qtd.next; 1149 q->qh.altnext_qtd = p->qtd.altnext; 1150 q->qh.token = p->qtd.token; 1151 1152 1153 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1154 if (eps == EHCI_QH_EPS_HIGH) { 1155 q->qh.token &= ~QTD_TOKEN_PING; 1156 q->qh.token |= ping; 1157 } 1158 1159 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1160 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1161 1162 for (i = 0; i < 5; i++) { 1163 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1164 } 1165 1166 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1167 // preserve QH DT bit 1168 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1169 q->qh.token |= dtoggle; 1170 } 1171 1172 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1173 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1174 1175 ehci_flush_qh(q); 1176 1177 return 0; 1178 } 1179 1180 static int ehci_init_transfer(EHCIPacket *p) 1181 { 1182 uint32_t cpage, offset, bytes, plen; 1183 dma_addr_t page; 1184 1185 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1186 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1187 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1188 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as); 1189 1190 while (bytes > 0) { 1191 if (cpage > 4) { 1192 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1193 return -1; 1194 } 1195 1196 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1197 page += offset; 1198 plen = bytes; 1199 if (plen > 4096 - offset) { 1200 plen = 4096 - offset; 1201 offset = 0; 1202 cpage++; 1203 } 1204 1205 qemu_sglist_add(&p->sgl, page, plen); 1206 bytes -= plen; 1207 } 1208 return 0; 1209 } 1210 1211 static void ehci_finish_transfer(EHCIQueue *q, int len) 1212 { 1213 uint32_t cpage, offset; 1214 1215 if (len > 0) { 1216 /* update cpage & offset */ 1217 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1218 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1219 1220 offset += len; 1221 cpage += offset >> QTD_BUFPTR_SH; 1222 offset &= ~QTD_BUFPTR_MASK; 1223 1224 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1225 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1226 q->qh.bufptr[0] |= offset; 1227 } 1228 } 1229 1230 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1231 { 1232 EHCIPacket *p; 1233 EHCIState *s = port->opaque; 1234 uint32_t portsc = s->portsc[port->index]; 1235 1236 if (portsc & PORTSC_POWNER) { 1237 USBPort *companion = s->companion_ports[port->index]; 1238 companion->ops->complete(companion, packet); 1239 return; 1240 } 1241 1242 p = container_of(packet, EHCIPacket, packet); 1243 assert(p->async == EHCI_ASYNC_INFLIGHT); 1244 1245 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1246 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1247 ehci_free_packet(p); 1248 return; 1249 } 1250 1251 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1252 p->async = EHCI_ASYNC_FINISHED; 1253 1254 if (!p->queue->async) { 1255 s->periodic_sched_active = PERIODIC_ACTIVE; 1256 } 1257 qemu_bh_schedule(s->async_bh); 1258 } 1259 1260 static void ehci_execute_complete(EHCIQueue *q) 1261 { 1262 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1263 uint32_t tbytes; 1264 1265 assert(p != NULL); 1266 assert(p->qtdaddr == q->qtdaddr); 1267 assert(p->async == EHCI_ASYNC_INITIALIZED || 1268 p->async == EHCI_ASYNC_FINISHED); 1269 1270 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1271 "status %d, actual_length %d\n", 1272 q->qhaddr, q->qh.next, q->qtdaddr, 1273 p->packet.status, p->packet.actual_length); 1274 1275 switch (p->packet.status) { 1276 case USB_RET_SUCCESS: 1277 break; 1278 case USB_RET_IOERROR: 1279 case USB_RET_NODEV: 1280 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1281 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1282 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1283 break; 1284 case USB_RET_STALL: 1285 q->qh.token |= QTD_TOKEN_HALT; 1286 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1287 break; 1288 case USB_RET_NAK: 1289 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1290 return; /* We're not done yet with this transaction */ 1291 case USB_RET_BABBLE: 1292 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1293 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1294 break; 1295 default: 1296 /* should not be triggerable */ 1297 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1298 g_assert_not_reached(); 1299 break; 1300 } 1301 1302 /* TODO check 4.12 for splits */ 1303 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1304 if (tbytes && p->pid == USB_TOKEN_IN) { 1305 tbytes -= p->packet.actual_length; 1306 if (tbytes) { 1307 /* 4.15.1.2 must raise int on a short input packet */ 1308 ehci_raise_irq(q->ehci, USBSTS_INT); 1309 if (q->async) { 1310 q->ehci->int_req_by_async = true; 1311 } 1312 } 1313 } else { 1314 tbytes = 0; 1315 } 1316 DPRINTF("updating tbytes to %d\n", tbytes); 1317 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1318 1319 ehci_finish_transfer(q, p->packet.actual_length); 1320 usb_packet_unmap(&p->packet, &p->sgl); 1321 qemu_sglist_destroy(&p->sgl); 1322 p->async = EHCI_ASYNC_NONE; 1323 1324 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1325 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1326 1327 if (q->qh.token & QTD_TOKEN_IOC) { 1328 ehci_raise_irq(q->ehci, USBSTS_INT); 1329 if (q->async) { 1330 q->ehci->int_req_by_async = true; 1331 } 1332 } 1333 } 1334 1335 /* 4.10.3 returns "again" */ 1336 static int ehci_execute(EHCIPacket *p, const char *action) 1337 { 1338 USBEndpoint *ep; 1339 int endp; 1340 bool spd; 1341 1342 assert(p->async == EHCI_ASYNC_NONE || 1343 p->async == EHCI_ASYNC_INITIALIZED); 1344 1345 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1346 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1347 return -1; 1348 } 1349 1350 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1351 ehci_trace_guest_bug(p->queue->ehci, 1352 "guest requested more bytes than allowed"); 1353 return -1; 1354 } 1355 1356 if (!ehci_verify_pid(p->queue, &p->qtd)) { 1357 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */ 1358 } 1359 p->pid = ehci_get_pid(&p->qtd); 1360 p->queue->last_pid = p->pid; 1361 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1362 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1363 1364 if (p->async == EHCI_ASYNC_NONE) { 1365 if (ehci_init_transfer(p) != 0) { 1366 return -1; 1367 } 1368 1369 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1370 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, 1371 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1372 usb_packet_map(&p->packet, &p->sgl); 1373 p->async = EHCI_ASYNC_INITIALIZED; 1374 } 1375 1376 trace_usb_ehci_packet_action(p->queue, p, action); 1377 usb_handle_packet(p->queue->dev, &p->packet); 1378 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1379 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1380 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1381 p->packet.actual_length); 1382 1383 if (p->packet.actual_length > BUFF_SIZE) { 1384 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1385 return -1; 1386 } 1387 1388 return 1; 1389 } 1390 1391 /* 4.7.2 1392 */ 1393 1394 static int ehci_process_itd(EHCIState *ehci, 1395 EHCIitd *itd, 1396 uint32_t addr) 1397 { 1398 USBDevice *dev; 1399 USBEndpoint *ep; 1400 uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; 1401 uint32_t pg, off, ptr1, ptr2, max, mult; 1402 1403 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1404 1405 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1406 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1407 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1408 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1409 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1410 1411 for(i = 0; i < 8; i++) { 1412 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1413 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1414 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1415 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1416 1417 if (len > max * mult) { 1418 len = max * mult; 1419 } 1420 if (len > BUFF_SIZE || pg > 6) { 1421 return -1; 1422 } 1423 1424 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1425 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); 1426 if (off + len > 4096) { 1427 /* transfer crosses page border */ 1428 if (pg == 6) { 1429 return -1; /* avoid page pg + 1 */ 1430 } 1431 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); 1432 uint32_t len2 = off + len - 4096; 1433 uint32_t len1 = len - len2; 1434 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1435 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1436 } else { 1437 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1438 } 1439 1440 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1441 1442 dev = ehci_find_device(ehci, devaddr); 1443 ep = usb_ep_get(dev, pid, endp); 1444 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1445 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, 1446 (itd->transact[i] & ITD_XACT_IOC) != 0); 1447 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1448 usb_handle_packet(dev, &ehci->ipacket); 1449 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1450 } else { 1451 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1452 ehci->ipacket.status = USB_RET_NAK; 1453 ehci->ipacket.actual_length = 0; 1454 } 1455 qemu_sglist_destroy(&ehci->isgl); 1456 1457 switch (ehci->ipacket.status) { 1458 case USB_RET_SUCCESS: 1459 break; 1460 default: 1461 fprintf(stderr, "Unexpected iso usb result: %d\n", 1462 ehci->ipacket.status); 1463 /* Fall through */ 1464 case USB_RET_IOERROR: 1465 case USB_RET_NODEV: 1466 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1467 if (dir) { 1468 itd->transact[i] |= ITD_XACT_XACTERR; 1469 ehci_raise_irq(ehci, USBSTS_ERRINT); 1470 } 1471 break; 1472 case USB_RET_BABBLE: 1473 itd->transact[i] |= ITD_XACT_BABBLE; 1474 ehci_raise_irq(ehci, USBSTS_ERRINT); 1475 break; 1476 case USB_RET_NAK: 1477 /* no data for us, so do a zero-length transfer */ 1478 ehci->ipacket.actual_length = 0; 1479 break; 1480 } 1481 if (!dir) { 1482 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1483 ITD_XACT_LENGTH); /* OUT */ 1484 } else { 1485 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1486 ITD_XACT_LENGTH); /* IN */ 1487 } 1488 if (itd->transact[i] & ITD_XACT_IOC) { 1489 ehci_raise_irq(ehci, USBSTS_INT); 1490 } 1491 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1492 xfers++; 1493 } 1494 } 1495 return xfers ? 0 : -1; 1496 } 1497 1498 1499 /* This state is the entry point for asynchronous schedule 1500 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1501 */ 1502 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1503 { 1504 EHCIqh qh; 1505 int i = 0; 1506 int again = 0; 1507 uint32_t entry = ehci->asynclistaddr; 1508 1509 /* set reclamation flag at start event (4.8.6) */ 1510 if (async) { 1511 ehci_set_usbsts(ehci, USBSTS_REC); 1512 } 1513 1514 ehci_queues_rip_unused(ehci, async); 1515 1516 /* Find the head of the list (4.9.1.1) */ 1517 for(i = 0; i < MAX_QH; i++) { 1518 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1519 sizeof(EHCIqh) >> 2) < 0) { 1520 return 0; 1521 } 1522 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1523 1524 if (qh.epchar & QH_EPCHAR_H) { 1525 if (async) { 1526 entry |= (NLPTR_TYPE_QH << 1); 1527 } 1528 1529 ehci_set_fetch_addr(ehci, async, entry); 1530 ehci_set_state(ehci, async, EST_FETCHENTRY); 1531 again = 1; 1532 goto out; 1533 } 1534 1535 entry = qh.next; 1536 if (entry == ehci->asynclistaddr) { 1537 break; 1538 } 1539 } 1540 1541 /* no head found for list. */ 1542 1543 ehci_set_state(ehci, async, EST_ACTIVE); 1544 1545 out: 1546 return again; 1547 } 1548 1549 1550 /* This state is the entry point for periodic schedule processing as 1551 * well as being a continuation state for async processing. 1552 */ 1553 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1554 { 1555 int again = 0; 1556 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1557 1558 if (NLPTR_TBIT(entry)) { 1559 ehci_set_state(ehci, async, EST_ACTIVE); 1560 goto out; 1561 } 1562 1563 /* section 4.8, only QH in async schedule */ 1564 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1565 fprintf(stderr, "non queue head request in async schedule\n"); 1566 return -1; 1567 } 1568 1569 switch (NLPTR_TYPE_GET(entry)) { 1570 case NLPTR_TYPE_QH: 1571 ehci_set_state(ehci, async, EST_FETCHQH); 1572 again = 1; 1573 break; 1574 1575 case NLPTR_TYPE_ITD: 1576 ehci_set_state(ehci, async, EST_FETCHITD); 1577 again = 1; 1578 break; 1579 1580 case NLPTR_TYPE_STITD: 1581 ehci_set_state(ehci, async, EST_FETCHSITD); 1582 again = 1; 1583 break; 1584 1585 default: 1586 /* TODO: handle FSTN type */ 1587 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1588 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1589 return -1; 1590 } 1591 1592 out: 1593 return again; 1594 } 1595 1596 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1597 { 1598 uint32_t entry; 1599 EHCIQueue *q; 1600 EHCIqh qh; 1601 1602 entry = ehci_get_fetch_addr(ehci, async); 1603 q = ehci_find_queue_by_qh(ehci, entry, async); 1604 if (q == NULL) { 1605 q = ehci_alloc_queue(ehci, entry, async); 1606 } 1607 1608 q->seen++; 1609 if (q->seen > 1) { 1610 /* we are going in circles -- stop processing */ 1611 ehci_set_state(ehci, async, EST_ACTIVE); 1612 q = NULL; 1613 goto out; 1614 } 1615 1616 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1617 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1618 q = NULL; 1619 goto out; 1620 } 1621 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1622 1623 /* 1624 * The overlay area of the qh should never be changed by the guest, 1625 * except when idle, in which case the reset is a nop. 1626 */ 1627 if (!ehci_verify_qh(q, &qh)) { 1628 if (ehci_reset_queue(q) > 0) { 1629 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1630 } 1631 } 1632 q->qh = qh; 1633 1634 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1635 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1636 q->transact_ctr = 4; 1637 } 1638 1639 if (q->dev == NULL) { 1640 q->dev = ehci_find_device(q->ehci, 1641 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)); 1642 } 1643 1644 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1645 1646 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1647 if (ehci->usbsts & USBSTS_REC) { 1648 ehci_clear_usbsts(ehci, USBSTS_REC); 1649 } else { 1650 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1651 " - done processing\n", q->qhaddr); 1652 ehci_set_state(ehci, async, EST_ACTIVE); 1653 q = NULL; 1654 goto out; 1655 } 1656 } 1657 1658 #if EHCI_DEBUG 1659 if (q->qhaddr != q->qh.next) { 1660 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1661 q->qhaddr, 1662 q->qh.epchar & QH_EPCHAR_H, 1663 q->qh.token & QTD_TOKEN_HALT, 1664 q->qh.token & QTD_TOKEN_ACTIVE, 1665 q->qh.next); 1666 } 1667 #endif 1668 1669 if (q->qh.token & QTD_TOKEN_HALT) { 1670 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1671 1672 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1673 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1674 q->qtdaddr = q->qh.current_qtd; 1675 ehci_set_state(ehci, async, EST_FETCHQTD); 1676 1677 } else { 1678 /* EHCI spec version 1.0 Section 4.10.2 */ 1679 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1680 } 1681 1682 out: 1683 return q; 1684 } 1685 1686 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1687 { 1688 uint32_t entry; 1689 EHCIitd itd; 1690 1691 assert(!async); 1692 entry = ehci_get_fetch_addr(ehci, async); 1693 1694 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1695 sizeof(EHCIitd) >> 2) < 0) { 1696 return -1; 1697 } 1698 ehci_trace_itd(ehci, entry, &itd); 1699 1700 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1701 return -1; 1702 } 1703 1704 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1705 sizeof(EHCIitd) >> 2); 1706 ehci_set_fetch_addr(ehci, async, itd.next); 1707 ehci_set_state(ehci, async, EST_FETCHENTRY); 1708 1709 return 1; 1710 } 1711 1712 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1713 { 1714 uint32_t entry; 1715 EHCIsitd sitd; 1716 1717 assert(!async); 1718 entry = ehci_get_fetch_addr(ehci, async); 1719 1720 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1721 sizeof(EHCIsitd) >> 2) < 0) { 1722 return 0; 1723 } 1724 ehci_trace_sitd(ehci, entry, &sitd); 1725 1726 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1727 /* siTD is not active, nothing to do */; 1728 } else { 1729 /* TODO: split transfers are not implemented */ 1730 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1731 } 1732 1733 ehci_set_fetch_addr(ehci, async, sitd.next); 1734 ehci_set_state(ehci, async, EST_FETCHENTRY); 1735 return 1; 1736 } 1737 1738 /* Section 4.10.2 - paragraph 3 */ 1739 static int ehci_state_advqueue(EHCIQueue *q) 1740 { 1741 #if 0 1742 /* TO-DO: 4.10.2 - paragraph 2 1743 * if I-bit is set to 1 and QH is not active 1744 * go to horizontal QH 1745 */ 1746 if (I-bit set) { 1747 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1748 goto out; 1749 } 1750 #endif 1751 1752 /* 1753 * want data and alt-next qTD is valid 1754 */ 1755 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1756 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1757 q->qtdaddr = q->qh.altnext_qtd; 1758 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1759 1760 /* 1761 * next qTD is valid 1762 */ 1763 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1764 q->qtdaddr = q->qh.next_qtd; 1765 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1766 1767 /* 1768 * no valid qTD, try next QH 1769 */ 1770 } else { 1771 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1772 } 1773 1774 return 1; 1775 } 1776 1777 /* Section 4.10.2 - paragraph 4 */ 1778 static int ehci_state_fetchqtd(EHCIQueue *q) 1779 { 1780 EHCIqtd qtd; 1781 EHCIPacket *p; 1782 int again = 1; 1783 1784 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1785 sizeof(EHCIqtd) >> 2) < 0) { 1786 return 0; 1787 } 1788 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1789 1790 p = QTAILQ_FIRST(&q->packets); 1791 if (p != NULL) { 1792 if (!ehci_verify_qtd(p, &qtd)) { 1793 ehci_cancel_queue(q); 1794 if (qtd.token & QTD_TOKEN_ACTIVE) { 1795 ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); 1796 } 1797 p = NULL; 1798 } else { 1799 p->qtd = qtd; 1800 ehci_qh_do_overlay(q); 1801 } 1802 } 1803 1804 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1805 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1806 } else if (p != NULL) { 1807 switch (p->async) { 1808 case EHCI_ASYNC_NONE: 1809 case EHCI_ASYNC_INITIALIZED: 1810 /* Not yet executed (MULT), or previously nacked (int) packet */ 1811 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1812 break; 1813 case EHCI_ASYNC_INFLIGHT: 1814 /* Check if the guest has added new tds to the queue */ 1815 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1816 /* Unfinished async handled packet, go horizontal */ 1817 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1818 break; 1819 case EHCI_ASYNC_FINISHED: 1820 /* Complete executing of the packet */ 1821 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1822 break; 1823 } 1824 } else { 1825 p = ehci_alloc_packet(q); 1826 p->qtdaddr = q->qtdaddr; 1827 p->qtd = qtd; 1828 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1829 } 1830 1831 return again; 1832 } 1833 1834 static int ehci_state_horizqh(EHCIQueue *q) 1835 { 1836 int again = 0; 1837 1838 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1839 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1840 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1841 again = 1; 1842 } else { 1843 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1844 } 1845 1846 return again; 1847 } 1848 1849 /* Returns "again" */ 1850 static int ehci_fill_queue(EHCIPacket *p) 1851 { 1852 USBEndpoint *ep = p->packet.ep; 1853 EHCIQueue *q = p->queue; 1854 EHCIqtd qtd = p->qtd; 1855 uint32_t qtdaddr; 1856 1857 for (;;) { 1858 if (NLPTR_TBIT(qtd.next) != 0) { 1859 break; 1860 } 1861 qtdaddr = qtd.next; 1862 /* 1863 * Detect circular td lists, Windows creates these, counting on the 1864 * active bit going low after execution to make the queue stop. 1865 */ 1866 QTAILQ_FOREACH(p, &q->packets, next) { 1867 if (p->qtdaddr == qtdaddr) { 1868 goto leave; 1869 } 1870 } 1871 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1872 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1873 return -1; 1874 } 1875 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1876 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1877 break; 1878 } 1879 if (!ehci_verify_pid(q, &qtd)) { 1880 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid"); 1881 break; 1882 } 1883 p = ehci_alloc_packet(q); 1884 p->qtdaddr = qtdaddr; 1885 p->qtd = qtd; 1886 if (ehci_execute(p, "queue") == -1) { 1887 return -1; 1888 } 1889 assert(p->packet.status == USB_RET_ASYNC); 1890 p->async = EHCI_ASYNC_INFLIGHT; 1891 } 1892 leave: 1893 usb_device_flush_ep_queue(ep->dev, ep); 1894 return 1; 1895 } 1896 1897 static int ehci_state_execute(EHCIQueue *q) 1898 { 1899 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1900 int again = 0; 1901 1902 assert(p != NULL); 1903 assert(p->qtdaddr == q->qtdaddr); 1904 1905 if (ehci_qh_do_overlay(q) != 0) { 1906 return -1; 1907 } 1908 1909 // TODO verify enough time remains in the uframe as in 4.4.1.1 1910 // TODO write back ptr to async list when done or out of time 1911 1912 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1913 if (!q->async && q->transact_ctr == 0) { 1914 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1915 again = 1; 1916 goto out; 1917 } 1918 1919 if (q->async) { 1920 ehci_set_usbsts(q->ehci, USBSTS_REC); 1921 } 1922 1923 again = ehci_execute(p, "process"); 1924 if (again == -1) { 1925 goto out; 1926 } 1927 if (p->packet.status == USB_RET_ASYNC) { 1928 ehci_flush_qh(q); 1929 trace_usb_ehci_packet_action(p->queue, p, "async"); 1930 p->async = EHCI_ASYNC_INFLIGHT; 1931 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1932 if (q->async) { 1933 again = ehci_fill_queue(p); 1934 } else { 1935 again = 1; 1936 } 1937 goto out; 1938 } 1939 1940 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1941 again = 1; 1942 1943 out: 1944 return again; 1945 } 1946 1947 static int ehci_state_executing(EHCIQueue *q) 1948 { 1949 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1950 1951 assert(p != NULL); 1952 assert(p->qtdaddr == q->qtdaddr); 1953 1954 ehci_execute_complete(q); 1955 1956 /* 4.10.3 */ 1957 if (!q->async && q->transact_ctr > 0) { 1958 q->transact_ctr--; 1959 } 1960 1961 /* 4.10.5 */ 1962 if (p->packet.status == USB_RET_NAK) { 1963 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1964 } else { 1965 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1966 } 1967 1968 ehci_flush_qh(q); 1969 return 1; 1970 } 1971 1972 1973 static int ehci_state_writeback(EHCIQueue *q) 1974 { 1975 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1976 uint32_t *qtd, addr; 1977 int again = 0; 1978 1979 /* Write back the QTD from the QH area */ 1980 assert(p != NULL); 1981 assert(p->qtdaddr == q->qtdaddr); 1982 1983 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1984 qtd = (uint32_t *) &q->qh.next_qtd; 1985 addr = NLPTR_GET(p->qtdaddr); 1986 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1987 ehci_free_packet(p); 1988 1989 /* 1990 * EHCI specs say go horizontal here. 1991 * 1992 * We can also advance the queue here for performance reasons. We 1993 * need to take care to only take that shortcut in case we've 1994 * processed the qtd just written back without errors, i.e. halt 1995 * bit is clear. 1996 */ 1997 if (q->qh.token & QTD_TOKEN_HALT) { 1998 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1999 again = 1; 2000 } else { 2001 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 2002 again = 1; 2003 } 2004 return again; 2005 } 2006 2007 /* 2008 * This is the state machine that is common to both async and periodic 2009 */ 2010 2011 static void ehci_advance_state(EHCIState *ehci, int async) 2012 { 2013 EHCIQueue *q = NULL; 2014 int again; 2015 2016 do { 2017 switch(ehci_get_state(ehci, async)) { 2018 case EST_WAITLISTHEAD: 2019 again = ehci_state_waitlisthead(ehci, async); 2020 break; 2021 2022 case EST_FETCHENTRY: 2023 again = ehci_state_fetchentry(ehci, async); 2024 break; 2025 2026 case EST_FETCHQH: 2027 q = ehci_state_fetchqh(ehci, async); 2028 if (q != NULL) { 2029 assert(q->async == async); 2030 again = 1; 2031 } else { 2032 again = 0; 2033 } 2034 break; 2035 2036 case EST_FETCHITD: 2037 again = ehci_state_fetchitd(ehci, async); 2038 break; 2039 2040 case EST_FETCHSITD: 2041 again = ehci_state_fetchsitd(ehci, async); 2042 break; 2043 2044 case EST_ADVANCEQUEUE: 2045 assert(q != NULL); 2046 again = ehci_state_advqueue(q); 2047 break; 2048 2049 case EST_FETCHQTD: 2050 assert(q != NULL); 2051 again = ehci_state_fetchqtd(q); 2052 break; 2053 2054 case EST_HORIZONTALQH: 2055 assert(q != NULL); 2056 again = ehci_state_horizqh(q); 2057 break; 2058 2059 case EST_EXECUTE: 2060 assert(q != NULL); 2061 again = ehci_state_execute(q); 2062 if (async) { 2063 ehci->async_stepdown = 0; 2064 } 2065 break; 2066 2067 case EST_EXECUTING: 2068 assert(q != NULL); 2069 if (async) { 2070 ehci->async_stepdown = 0; 2071 } 2072 again = ehci_state_executing(q); 2073 break; 2074 2075 case EST_WRITEBACK: 2076 assert(q != NULL); 2077 again = ehci_state_writeback(q); 2078 if (!async) { 2079 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2080 } 2081 break; 2082 2083 default: 2084 fprintf(stderr, "Bad state!\n"); 2085 again = -1; 2086 g_assert_not_reached(); 2087 break; 2088 } 2089 2090 if (again < 0) { 2091 fprintf(stderr, "processing error - resetting ehci HC\n"); 2092 ehci_reset(ehci); 2093 again = 0; 2094 } 2095 } 2096 while (again); 2097 } 2098 2099 static void ehci_advance_async_state(EHCIState *ehci) 2100 { 2101 const int async = 1; 2102 2103 switch(ehci_get_state(ehci, async)) { 2104 case EST_INACTIVE: 2105 if (!ehci_async_enabled(ehci)) { 2106 break; 2107 } 2108 ehci_set_state(ehci, async, EST_ACTIVE); 2109 // No break, fall through to ACTIVE 2110 2111 case EST_ACTIVE: 2112 if (!ehci_async_enabled(ehci)) { 2113 ehci_queues_rip_all(ehci, async); 2114 ehci_set_state(ehci, async, EST_INACTIVE); 2115 break; 2116 } 2117 2118 /* make sure guest has acknowledged the doorbell interrupt */ 2119 /* TO-DO: is this really needed? */ 2120 if (ehci->usbsts & USBSTS_IAA) { 2121 DPRINTF("IAA status bit still set.\n"); 2122 break; 2123 } 2124 2125 /* check that address register has been set */ 2126 if (ehci->asynclistaddr == 0) { 2127 break; 2128 } 2129 2130 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2131 ehci_advance_state(ehci, async); 2132 2133 /* If the doorbell is set, the guest wants to make a change to the 2134 * schedule. The host controller needs to release cached data. 2135 * (section 4.8.2) 2136 */ 2137 if (ehci->usbcmd & USBCMD_IAAD) { 2138 /* Remove all unseen qhs from the async qhs queue */ 2139 ehci_queues_rip_unseen(ehci, async); 2140 trace_usb_ehci_doorbell_ack(); 2141 ehci->usbcmd &= ~USBCMD_IAAD; 2142 ehci_raise_irq(ehci, USBSTS_IAA); 2143 } 2144 break; 2145 2146 default: 2147 /* this should only be due to a developer mistake */ 2148 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2149 "Resetting to active\n", ehci->astate); 2150 g_assert_not_reached(); 2151 } 2152 } 2153 2154 static void ehci_advance_periodic_state(EHCIState *ehci) 2155 { 2156 uint32_t entry; 2157 uint32_t list; 2158 const int async = 0; 2159 2160 // 4.6 2161 2162 switch(ehci_get_state(ehci, async)) { 2163 case EST_INACTIVE: 2164 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2165 ehci_set_state(ehci, async, EST_ACTIVE); 2166 // No break, fall through to ACTIVE 2167 } else 2168 break; 2169 2170 case EST_ACTIVE: 2171 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2172 ehci_queues_rip_all(ehci, async); 2173 ehci_set_state(ehci, async, EST_INACTIVE); 2174 break; 2175 } 2176 2177 list = ehci->periodiclistbase & 0xfffff000; 2178 /* check that register has been set */ 2179 if (list == 0) { 2180 break; 2181 } 2182 list |= ((ehci->frindex & 0x1ff8) >> 1); 2183 2184 if (get_dwords(ehci, list, &entry, 1) < 0) { 2185 break; 2186 } 2187 2188 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2189 ehci->frindex / 8, list, entry); 2190 ehci_set_fetch_addr(ehci, async,entry); 2191 ehci_set_state(ehci, async, EST_FETCHENTRY); 2192 ehci_advance_state(ehci, async); 2193 ehci_queues_rip_unused(ehci, async); 2194 break; 2195 2196 default: 2197 /* this should only be due to a developer mistake */ 2198 fprintf(stderr, "ehci: Bad periodic state %d. " 2199 "Resetting to active\n", ehci->pstate); 2200 g_assert_not_reached(); 2201 } 2202 } 2203 2204 static void ehci_update_frindex(EHCIState *ehci, int uframes) 2205 { 2206 int i; 2207 2208 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) { 2209 return; 2210 } 2211 2212 for (i = 0; i < uframes; i++) { 2213 ehci->frindex++; 2214 2215 if (ehci->frindex == 0x00002000) { 2216 ehci_raise_irq(ehci, USBSTS_FLR); 2217 } 2218 2219 if (ehci->frindex == 0x00004000) { 2220 ehci_raise_irq(ehci, USBSTS_FLR); 2221 ehci->frindex = 0; 2222 if (ehci->usbsts_frindex >= 0x00004000) { 2223 ehci->usbsts_frindex -= 0x00004000; 2224 } else { 2225 ehci->usbsts_frindex = 0; 2226 } 2227 } 2228 } 2229 } 2230 2231 static void ehci_frame_timer(void *opaque) 2232 { 2233 EHCIState *ehci = opaque; 2234 int need_timer = 0; 2235 int64_t expire_time, t_now; 2236 uint64_t ns_elapsed; 2237 int uframes, skipped_uframes; 2238 int i; 2239 2240 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 2241 ns_elapsed = t_now - ehci->last_run_ns; 2242 uframes = ns_elapsed / UFRAME_TIMER_NS; 2243 2244 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2245 need_timer++; 2246 2247 if (uframes > (ehci->maxframes * 8)) { 2248 skipped_uframes = uframes - (ehci->maxframes * 8); 2249 ehci_update_frindex(ehci, skipped_uframes); 2250 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; 2251 uframes -= skipped_uframes; 2252 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes); 2253 } 2254 2255 for (i = 0; i < uframes; i++) { 2256 /* 2257 * If we're running behind schedule, we should not catch up 2258 * too fast, as that will make some guests unhappy: 2259 * 1) We must process a minimum of MIN_UFR_PER_TICK frames, 2260 * otherwise we will never catch up 2261 * 2) Process frames until the guest has requested an irq (IOC) 2262 */ 2263 if (i >= MIN_UFR_PER_TICK) { 2264 ehci_commit_irq(ehci); 2265 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2266 break; 2267 } 2268 } 2269 if (ehci->periodic_sched_active) { 2270 ehci->periodic_sched_active--; 2271 } 2272 ehci_update_frindex(ehci, 1); 2273 if ((ehci->frindex & 7) == 0) { 2274 ehci_advance_periodic_state(ehci); 2275 } 2276 ehci->last_run_ns += UFRAME_TIMER_NS; 2277 } 2278 } else { 2279 ehci->periodic_sched_active = 0; 2280 ehci_update_frindex(ehci, uframes); 2281 ehci->last_run_ns += UFRAME_TIMER_NS * uframes; 2282 } 2283 2284 if (ehci->periodic_sched_active) { 2285 ehci->async_stepdown = 0; 2286 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2287 ehci->async_stepdown++; 2288 } 2289 2290 /* Async is not inside loop since it executes everything it can once 2291 * called 2292 */ 2293 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2294 need_timer++; 2295 ehci_advance_async_state(ehci); 2296 } 2297 2298 ehci_commit_irq(ehci); 2299 if (ehci->usbsts_pending) { 2300 need_timer++; 2301 ehci->async_stepdown = 0; 2302 } 2303 2304 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2305 need_timer++; 2306 } 2307 2308 if (need_timer) { 2309 /* If we've raised int, we speed up the timer, so that we quickly 2310 * notice any new packets queued up in response */ 2311 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2312 expire_time = t_now + 2313 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4); 2314 ehci->int_req_by_async = false; 2315 } else { 2316 expire_time = t_now + (NANOSECONDS_PER_SECOND 2317 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2318 } 2319 timer_mod(ehci->frame_timer, expire_time); 2320 } 2321 } 2322 2323 static const MemoryRegionOps ehci_mmio_caps_ops = { 2324 .read = ehci_caps_read, 2325 .write = ehci_caps_write, 2326 .valid.min_access_size = 1, 2327 .valid.max_access_size = 4, 2328 .impl.min_access_size = 1, 2329 .impl.max_access_size = 1, 2330 .endianness = DEVICE_LITTLE_ENDIAN, 2331 }; 2332 2333 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2334 .read = ehci_opreg_read, 2335 .write = ehci_opreg_write, 2336 .valid.min_access_size = 4, 2337 .valid.max_access_size = 4, 2338 .endianness = DEVICE_LITTLE_ENDIAN, 2339 }; 2340 2341 static const MemoryRegionOps ehci_mmio_port_ops = { 2342 .read = ehci_port_read, 2343 .write = ehci_port_write, 2344 .valid.min_access_size = 4, 2345 .valid.max_access_size = 4, 2346 .endianness = DEVICE_LITTLE_ENDIAN, 2347 }; 2348 2349 static USBPortOps ehci_port_ops = { 2350 .attach = ehci_attach, 2351 .detach = ehci_detach, 2352 .child_detach = ehci_child_detach, 2353 .wakeup = ehci_wakeup, 2354 .complete = ehci_async_complete_packet, 2355 }; 2356 2357 static USBBusOps ehci_bus_ops_companion = { 2358 .register_companion = ehci_register_companion, 2359 .wakeup_endpoint = ehci_wakeup_endpoint, 2360 }; 2361 static USBBusOps ehci_bus_ops_standalone = { 2362 .wakeup_endpoint = ehci_wakeup_endpoint, 2363 }; 2364 2365 static void usb_ehci_pre_save(void *opaque) 2366 { 2367 EHCIState *ehci = opaque; 2368 uint32_t new_frindex; 2369 2370 /* Round down frindex to a multiple of 8 for migration compatibility */ 2371 new_frindex = ehci->frindex & ~7; 2372 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS; 2373 ehci->frindex = new_frindex; 2374 } 2375 2376 static int usb_ehci_post_load(void *opaque, int version_id) 2377 { 2378 EHCIState *s = opaque; 2379 int i; 2380 2381 for (i = 0; i < NB_PORTS; i++) { 2382 USBPort *companion = s->companion_ports[i]; 2383 if (companion == NULL) { 2384 continue; 2385 } 2386 if (s->portsc[i] & PORTSC_POWNER) { 2387 companion->dev = s->ports[i].dev; 2388 } else { 2389 companion->dev = NULL; 2390 } 2391 } 2392 2393 return 0; 2394 } 2395 2396 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2397 { 2398 EHCIState *ehci = opaque; 2399 2400 /* 2401 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2402 * schedule in guest memory. We must do the rebuilt ASAP, so that 2403 * USB-devices which have async handled packages have a packet in the 2404 * ep queue to match the completion with. 2405 */ 2406 if (state == RUN_STATE_RUNNING) { 2407 ehci_advance_async_state(ehci); 2408 } 2409 2410 /* 2411 * The schedule rebuilt from guest memory could cause the migration dest 2412 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2413 * will never have existed on the destination. Therefor we must flush the 2414 * async schedule on savevm to catch any not yet noticed unlinks. 2415 */ 2416 if (state == RUN_STATE_SAVE_VM) { 2417 ehci_advance_async_state(ehci); 2418 ehci_queues_rip_unseen(ehci, 1); 2419 } 2420 } 2421 2422 const VMStateDescription vmstate_ehci = { 2423 .name = "ehci-core", 2424 .version_id = 2, 2425 .minimum_version_id = 1, 2426 .pre_save = usb_ehci_pre_save, 2427 .post_load = usb_ehci_post_load, 2428 .fields = (VMStateField[]) { 2429 /* mmio registers */ 2430 VMSTATE_UINT32(usbcmd, EHCIState), 2431 VMSTATE_UINT32(usbsts, EHCIState), 2432 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2433 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2434 VMSTATE_UINT32(usbintr, EHCIState), 2435 VMSTATE_UINT32(frindex, EHCIState), 2436 VMSTATE_UINT32(ctrldssegment, EHCIState), 2437 VMSTATE_UINT32(periodiclistbase, EHCIState), 2438 VMSTATE_UINT32(asynclistaddr, EHCIState), 2439 VMSTATE_UINT32(configflag, EHCIState), 2440 VMSTATE_UINT32(portsc[0], EHCIState), 2441 VMSTATE_UINT32(portsc[1], EHCIState), 2442 VMSTATE_UINT32(portsc[2], EHCIState), 2443 VMSTATE_UINT32(portsc[3], EHCIState), 2444 VMSTATE_UINT32(portsc[4], EHCIState), 2445 VMSTATE_UINT32(portsc[5], EHCIState), 2446 /* frame timer */ 2447 VMSTATE_TIMER_PTR(frame_timer, EHCIState), 2448 VMSTATE_UINT64(last_run_ns, EHCIState), 2449 VMSTATE_UINT32(async_stepdown, EHCIState), 2450 /* schedule state */ 2451 VMSTATE_UINT32(astate, EHCIState), 2452 VMSTATE_UINT32(pstate, EHCIState), 2453 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2454 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2455 VMSTATE_END_OF_LIST() 2456 } 2457 }; 2458 2459 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) 2460 { 2461 int i; 2462 2463 if (s->portnr > NB_PORTS) { 2464 error_setg(errp, "Too many ports! Max. port number is %d.", 2465 NB_PORTS); 2466 return; 2467 } 2468 2469 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ? 2470 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev); 2471 for (i = 0; i < s->portnr; i++) { 2472 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2473 USB_SPEED_MASK_HIGH); 2474 s->ports[i].dev = 0; 2475 } 2476 2477 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_frame_timer, s); 2478 s->async_bh = qemu_bh_new(ehci_frame_timer, s); 2479 s->device = dev; 2480 2481 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2482 } 2483 2484 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp) 2485 { 2486 trace_usb_ehci_unrealize(); 2487 2488 if (s->frame_timer) { 2489 timer_del(s->frame_timer); 2490 timer_free(s->frame_timer); 2491 s->frame_timer = NULL; 2492 } 2493 if (s->async_bh) { 2494 qemu_bh_delete(s->async_bh); 2495 } 2496 2497 ehci_queues_rip_all(s, 0); 2498 ehci_queues_rip_all(s, 1); 2499 2500 memory_region_del_subregion(&s->mem, &s->mem_caps); 2501 memory_region_del_subregion(&s->mem, &s->mem_opreg); 2502 memory_region_del_subregion(&s->mem, &s->mem_ports); 2503 2504 usb_bus_release(&s->bus); 2505 2506 if (s->vmstate) { 2507 qemu_del_vm_change_state_handler(s->vmstate); 2508 } 2509 } 2510 2511 void usb_ehci_init(EHCIState *s, DeviceState *dev) 2512 { 2513 /* 2.2 host controller interface version */ 2514 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2515 s->caps[0x01] = 0x00; 2516 s->caps[0x02] = 0x00; 2517 s->caps[0x03] = 0x01; /* HC version */ 2518 s->caps[0x04] = s->portnr; /* Number of downstream ports */ 2519 s->caps[0x05] = 0x00; /* No companion ports at present */ 2520 s->caps[0x06] = 0x00; 2521 s->caps[0x07] = 0x00; 2522 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2523 s->caps[0x0a] = 0x00; 2524 s->caps[0x0b] = 0x00; 2525 2526 QTAILQ_INIT(&s->aqueues); 2527 QTAILQ_INIT(&s->pqueues); 2528 usb_packet_init(&s->ipacket); 2529 2530 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE); 2531 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s, 2532 "capabilities", CAPA_SIZE); 2533 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s, 2534 "operational", s->portscbase); 2535 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s, 2536 "ports", 4 * s->portnr); 2537 2538 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2539 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2540 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase, 2541 &s->mem_ports); 2542 } 2543 2544 /* 2545 * vim: expandtab ts=4 2546 */ 2547