1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * This library is free software; you can redistribute it and/or 16 * modify it under the terms of the GNU Lesser General Public 17 * License as published by the Free Software Foundation; either 18 * version 2.1 of the License, or (at your option) any later version. 19 * 20 * This library is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 23 * Lesser General Public License for more details. 24 * 25 * You should have received a copy of the GNU Lesser General Public License 26 * along with this program; if not, see <http://www.gnu.org/licenses/>. 27 */ 28 29 #include "qemu/osdep.h" 30 #include "qapi/error.h" 31 #include "hw/irq.h" 32 #include "hw/usb/ehci-regs.h" 33 #include "hw/usb/hcd-ehci.h" 34 #include "trace.h" 35 #include "qemu/error-report.h" 36 37 #define FRAME_TIMER_FREQ 1000 38 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) 39 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) 40 41 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 42 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 43 #define MAX_QH 100 // Max allowable queue heads in a chain 44 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ 45 #define PERIODIC_ACTIVE 512 /* Micro-frames */ 46 47 /* Internal periodic / asynchronous schedule state machine states 48 */ 49 typedef enum { 50 EST_INACTIVE = 1000, 51 EST_ACTIVE, 52 EST_EXECUTING, 53 EST_SLEEPING, 54 /* The following states are internal to the state machine function 55 */ 56 EST_WAITLISTHEAD, 57 EST_FETCHENTRY, 58 EST_FETCHQH, 59 EST_FETCHITD, 60 EST_FETCHSITD, 61 EST_ADVANCEQUEUE, 62 EST_FETCHQTD, 63 EST_EXECUTE, 64 EST_WRITEBACK, 65 EST_HORIZONTALQH 66 } EHCI_STATES; 67 68 /* macros for accessing fields within next link pointer entry */ 69 #define NLPTR_GET(x) ((x) & 0xffffffe0) 70 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 71 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 72 73 /* link pointer types */ 74 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 75 #define NLPTR_TYPE_QH 1 // queue head 76 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 77 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 78 79 #define SET_LAST_RUN_CLOCK(s) \ 80 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 81 82 /* nifty macros from Arnon's EHCI version */ 83 #define get_field(data, field) \ 84 (((data) & field##_MASK) >> field##_SH) 85 86 #define set_field(data, newval, field) do { \ 87 uint32_t val = *data; \ 88 val &= ~ field##_MASK; \ 89 val |= ((newval) << field##_SH) & field##_MASK; \ 90 *data = val; \ 91 } while(0) 92 93 static const char *ehci_state_names[] = { 94 [EST_INACTIVE] = "INACTIVE", 95 [EST_ACTIVE] = "ACTIVE", 96 [EST_EXECUTING] = "EXECUTING", 97 [EST_SLEEPING] = "SLEEPING", 98 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 99 [EST_FETCHENTRY] = "FETCH ENTRY", 100 [EST_FETCHQH] = "FETCH QH", 101 [EST_FETCHITD] = "FETCH ITD", 102 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 103 [EST_FETCHQTD] = "FETCH QTD", 104 [EST_EXECUTE] = "EXECUTE", 105 [EST_WRITEBACK] = "WRITEBACK", 106 [EST_HORIZONTALQH] = "HORIZONTALQH", 107 }; 108 109 static const char *ehci_mmio_names[] = { 110 [USBCMD] = "USBCMD", 111 [USBSTS] = "USBSTS", 112 [USBINTR] = "USBINTR", 113 [FRINDEX] = "FRINDEX", 114 [PERIODICLISTBASE] = "P-LIST BASE", 115 [ASYNCLISTADDR] = "A-LIST ADDR", 116 [CONFIGFLAG] = "CONFIGFLAG", 117 }; 118 119 static int ehci_state_executing(EHCIQueue *q); 120 static int ehci_state_writeback(EHCIQueue *q); 121 static int ehci_state_advqueue(EHCIQueue *q); 122 static int ehci_fill_queue(EHCIPacket *p); 123 static void ehci_free_packet(EHCIPacket *p); 124 125 static const char *nr2str(const char **n, size_t len, uint32_t nr) 126 { 127 if (nr < len && n[nr] != NULL) { 128 return n[nr]; 129 } else { 130 return "unknown"; 131 } 132 } 133 134 static const char *state2str(uint32_t state) 135 { 136 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 137 } 138 139 static const char *addr2str(hwaddr addr) 140 { 141 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 142 } 143 144 static void ehci_trace_usbsts(uint32_t mask, int state) 145 { 146 /* interrupts */ 147 if (mask & USBSTS_INT) { 148 trace_usb_ehci_usbsts("INT", state); 149 } 150 if (mask & USBSTS_ERRINT) { 151 trace_usb_ehci_usbsts("ERRINT", state); 152 } 153 if (mask & USBSTS_PCD) { 154 trace_usb_ehci_usbsts("PCD", state); 155 } 156 if (mask & USBSTS_FLR) { 157 trace_usb_ehci_usbsts("FLR", state); 158 } 159 if (mask & USBSTS_HSE) { 160 trace_usb_ehci_usbsts("HSE", state); 161 } 162 if (mask & USBSTS_IAA) { 163 trace_usb_ehci_usbsts("IAA", state); 164 } 165 166 /* status */ 167 if (mask & USBSTS_HALT) { 168 trace_usb_ehci_usbsts("HALT", state); 169 } 170 if (mask & USBSTS_REC) { 171 trace_usb_ehci_usbsts("REC", state); 172 } 173 if (mask & USBSTS_PSS) { 174 trace_usb_ehci_usbsts("PSS", state); 175 } 176 if (mask & USBSTS_ASS) { 177 trace_usb_ehci_usbsts("ASS", state); 178 } 179 } 180 181 static inline void ehci_set_usbsts(EHCIState *s, int mask) 182 { 183 if ((s->usbsts & mask) == mask) { 184 return; 185 } 186 ehci_trace_usbsts(mask, 1); 187 s->usbsts |= mask; 188 } 189 190 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 191 { 192 if ((s->usbsts & mask) == 0) { 193 return; 194 } 195 ehci_trace_usbsts(mask, 0); 196 s->usbsts &= ~mask; 197 } 198 199 /* update irq line */ 200 static inline void ehci_update_irq(EHCIState *s) 201 { 202 int level = 0; 203 204 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 205 level = 1; 206 } 207 208 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 209 qemu_set_irq(s->irq, level); 210 } 211 212 /* flag interrupt condition */ 213 static inline void ehci_raise_irq(EHCIState *s, int intr) 214 { 215 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 216 s->usbsts |= intr; 217 ehci_update_irq(s); 218 } else { 219 s->usbsts_pending |= intr; 220 } 221 } 222 223 /* 224 * Commit pending interrupts (added via ehci_raise_irq), 225 * at the rate allowed by "Interrupt Threshold Control". 226 */ 227 static inline void ehci_commit_irq(EHCIState *s) 228 { 229 uint32_t itc; 230 231 if (!s->usbsts_pending) { 232 return; 233 } 234 if (s->usbsts_frindex > s->frindex) { 235 return; 236 } 237 238 itc = (s->usbcmd >> 16) & 0xff; 239 s->usbsts |= s->usbsts_pending; 240 s->usbsts_pending = 0; 241 s->usbsts_frindex = s->frindex + itc; 242 ehci_update_irq(s); 243 } 244 245 static void ehci_update_halt(EHCIState *s) 246 { 247 if (s->usbcmd & USBCMD_RUNSTOP) { 248 ehci_clear_usbsts(s, USBSTS_HALT); 249 } else { 250 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 251 ehci_set_usbsts(s, USBSTS_HALT); 252 } 253 } 254 } 255 256 static void ehci_set_state(EHCIState *s, int async, int state) 257 { 258 if (async) { 259 trace_usb_ehci_state("async", state2str(state)); 260 s->astate = state; 261 if (s->astate == EST_INACTIVE) { 262 ehci_clear_usbsts(s, USBSTS_ASS); 263 ehci_update_halt(s); 264 } else { 265 ehci_set_usbsts(s, USBSTS_ASS); 266 } 267 } else { 268 trace_usb_ehci_state("periodic", state2str(state)); 269 s->pstate = state; 270 if (s->pstate == EST_INACTIVE) { 271 ehci_clear_usbsts(s, USBSTS_PSS); 272 ehci_update_halt(s); 273 } else { 274 ehci_set_usbsts(s, USBSTS_PSS); 275 } 276 } 277 } 278 279 static int ehci_get_state(EHCIState *s, int async) 280 { 281 return async ? s->astate : s->pstate; 282 } 283 284 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 285 { 286 if (async) { 287 s->a_fetch_addr = addr; 288 } else { 289 s->p_fetch_addr = addr; 290 } 291 } 292 293 static int ehci_get_fetch_addr(EHCIState *s, int async) 294 { 295 return async ? s->a_fetch_addr : s->p_fetch_addr; 296 } 297 298 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 299 { 300 /* need three here due to argument count limits */ 301 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 302 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 303 trace_usb_ehci_qh_fields(addr, 304 get_field(qh->epchar, QH_EPCHAR_RL), 305 get_field(qh->epchar, QH_EPCHAR_MPLEN), 306 get_field(qh->epchar, QH_EPCHAR_EPS), 307 get_field(qh->epchar, QH_EPCHAR_EP), 308 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 309 trace_usb_ehci_qh_bits(addr, 310 (bool)(qh->epchar & QH_EPCHAR_C), 311 (bool)(qh->epchar & QH_EPCHAR_H), 312 (bool)(qh->epchar & QH_EPCHAR_DTC), 313 (bool)(qh->epchar & QH_EPCHAR_I)); 314 } 315 316 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 317 { 318 /* need three here due to argument count limits */ 319 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 320 trace_usb_ehci_qtd_fields(addr, 321 get_field(qtd->token, QTD_TOKEN_TBYTES), 322 get_field(qtd->token, QTD_TOKEN_CPAGE), 323 get_field(qtd->token, QTD_TOKEN_CERR), 324 get_field(qtd->token, QTD_TOKEN_PID)); 325 trace_usb_ehci_qtd_bits(addr, 326 (bool)(qtd->token & QTD_TOKEN_IOC), 327 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 328 (bool)(qtd->token & QTD_TOKEN_HALT), 329 (bool)(qtd->token & QTD_TOKEN_BABBLE), 330 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 331 } 332 333 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 334 { 335 trace_usb_ehci_itd(addr, itd->next, 336 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 337 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 338 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 339 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 340 } 341 342 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 343 EHCIsitd *sitd) 344 { 345 trace_usb_ehci_sitd(addr, sitd->next, 346 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 347 } 348 349 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 350 { 351 trace_usb_ehci_guest_bug(message); 352 warn_report("%s", message); 353 } 354 355 static inline bool ehci_enabled(EHCIState *s) 356 { 357 return s->usbcmd & USBCMD_RUNSTOP; 358 } 359 360 static inline bool ehci_async_enabled(EHCIState *s) 361 { 362 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 363 } 364 365 static inline bool ehci_periodic_enabled(EHCIState *s) 366 { 367 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 368 } 369 370 /* Get an array of dwords from main memory */ 371 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 372 uint32_t *buf, int num) 373 { 374 int i; 375 376 if (!ehci->as) { 377 ehci_raise_irq(ehci, USBSTS_HSE); 378 ehci->usbcmd &= ~USBCMD_RUNSTOP; 379 trace_usb_ehci_dma_error(); 380 return -1; 381 } 382 383 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 384 dma_memory_read(ehci->as, addr, buf, sizeof(*buf)); 385 *buf = le32_to_cpu(*buf); 386 } 387 388 return num; 389 } 390 391 /* Put an array of dwords in to main memory */ 392 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 393 uint32_t *buf, int num) 394 { 395 int i; 396 397 if (!ehci->as) { 398 ehci_raise_irq(ehci, USBSTS_HSE); 399 ehci->usbcmd &= ~USBCMD_RUNSTOP; 400 trace_usb_ehci_dma_error(); 401 return -1; 402 } 403 404 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 405 uint32_t tmp = cpu_to_le32(*buf); 406 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp)); 407 } 408 409 return num; 410 } 411 412 static int ehci_get_pid(EHCIqtd *qtd) 413 { 414 switch (get_field(qtd->token, QTD_TOKEN_PID)) { 415 case 0: 416 return USB_TOKEN_OUT; 417 case 1: 418 return USB_TOKEN_IN; 419 case 2: 420 return USB_TOKEN_SETUP; 421 default: 422 fprintf(stderr, "bad token\n"); 423 return 0; 424 } 425 } 426 427 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh) 428 { 429 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR); 430 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP); 431 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 432 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 433 (qh->current_qtd != q->qh.current_qtd) || 434 (q->async && qh->next_qtd != q->qh.next_qtd) || 435 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd, 436 7 * sizeof(uint32_t)) != 0) || 437 (q->dev != NULL && q->dev->addr != devaddr)) { 438 return false; 439 } else { 440 return true; 441 } 442 } 443 444 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) 445 { 446 if (p->qtdaddr != p->queue->qtdaddr || 447 (p->queue->async && !NLPTR_TBIT(p->qtd.next) && 448 (p->qtd.next != qtd->next)) || 449 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || 450 p->qtd.token != qtd->token || 451 p->qtd.bufptr[0] != qtd->bufptr[0]) { 452 return false; 453 } else { 454 return true; 455 } 456 } 457 458 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) 459 { 460 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP); 461 int pid = ehci_get_pid(qtd); 462 463 /* Note the pid changing is normal for ep 0 (the control ep) */ 464 if (q->last_pid && ep != 0 && pid != q->last_pid) { 465 return false; 466 } else { 467 return true; 468 } 469 } 470 471 /* Finish executing and writeback a packet outside of the regular 472 fetchqh -> fetchqtd -> execute -> writeback cycle */ 473 static void ehci_writeback_async_complete_packet(EHCIPacket *p) 474 { 475 EHCIQueue *q = p->queue; 476 EHCIqtd qtd; 477 EHCIqh qh; 478 int state; 479 480 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ 481 get_dwords(q->ehci, NLPTR_GET(q->qhaddr), 482 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 483 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), 484 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 485 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { 486 p->async = EHCI_ASYNC_INITIALIZED; 487 ehci_free_packet(p); 488 return; 489 } 490 491 state = ehci_get_state(q->ehci, q->async); 492 ehci_state_executing(q); 493 ehci_state_writeback(q); /* Frees the packet! */ 494 if (!(q->qh.token & QTD_TOKEN_HALT)) { 495 ehci_state_advqueue(q); 496 } 497 ehci_set_state(q->ehci, q->async, state); 498 } 499 500 /* packet management */ 501 502 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 503 { 504 EHCIPacket *p; 505 506 p = g_new0(EHCIPacket, 1); 507 p->queue = q; 508 usb_packet_init(&p->packet); 509 QTAILQ_INSERT_TAIL(&q->packets, p, next); 510 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 511 return p; 512 } 513 514 static void ehci_free_packet(EHCIPacket *p) 515 { 516 if (p->async == EHCI_ASYNC_FINISHED && 517 !(p->queue->qh.token & QTD_TOKEN_HALT)) { 518 ehci_writeback_async_complete_packet(p); 519 return; 520 } 521 trace_usb_ehci_packet_action(p->queue, p, "free"); 522 if (p->async == EHCI_ASYNC_INFLIGHT) { 523 usb_cancel_packet(&p->packet); 524 } 525 if (p->async == EHCI_ASYNC_FINISHED && 526 p->packet.status == USB_RET_SUCCESS) { 527 fprintf(stderr, 528 "EHCI: Dropping completed packet from halted %s ep %02X\n", 529 (p->pid == USB_TOKEN_IN) ? "in" : "out", 530 get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); 531 } 532 if (p->async != EHCI_ASYNC_NONE) { 533 usb_packet_unmap(&p->packet, &p->sgl); 534 qemu_sglist_destroy(&p->sgl); 535 } 536 QTAILQ_REMOVE(&p->queue->packets, p, next); 537 usb_packet_cleanup(&p->packet); 538 g_free(p); 539 } 540 541 /* queue management */ 542 543 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 544 { 545 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 546 EHCIQueue *q; 547 548 q = g_malloc0(sizeof(*q)); 549 q->ehci = ehci; 550 q->qhaddr = addr; 551 q->async = async; 552 QTAILQ_INIT(&q->packets); 553 QTAILQ_INSERT_HEAD(head, q, next); 554 trace_usb_ehci_queue_action(q, "alloc"); 555 return q; 556 } 557 558 static void ehci_queue_stopped(EHCIQueue *q) 559 { 560 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP); 561 562 if (!q->last_pid || !q->dev) { 563 return; 564 } 565 566 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp)); 567 } 568 569 static int ehci_cancel_queue(EHCIQueue *q) 570 { 571 EHCIPacket *p; 572 int packets = 0; 573 574 p = QTAILQ_FIRST(&q->packets); 575 if (p == NULL) { 576 goto leave; 577 } 578 579 trace_usb_ehci_queue_action(q, "cancel"); 580 do { 581 ehci_free_packet(p); 582 packets++; 583 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 584 585 leave: 586 ehci_queue_stopped(q); 587 return packets; 588 } 589 590 static int ehci_reset_queue(EHCIQueue *q) 591 { 592 int packets; 593 594 trace_usb_ehci_queue_action(q, "reset"); 595 packets = ehci_cancel_queue(q); 596 q->dev = NULL; 597 q->qtdaddr = 0; 598 q->last_pid = 0; 599 return packets; 600 } 601 602 static void ehci_free_queue(EHCIQueue *q, const char *warn) 603 { 604 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 605 int cancelled; 606 607 trace_usb_ehci_queue_action(q, "free"); 608 cancelled = ehci_cancel_queue(q); 609 if (warn && cancelled > 0) { 610 ehci_trace_guest_bug(q->ehci, warn); 611 } 612 QTAILQ_REMOVE(head, q, next); 613 g_free(q); 614 } 615 616 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 617 int async) 618 { 619 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 620 EHCIQueue *q; 621 622 QTAILQ_FOREACH(q, head, next) { 623 if (addr == q->qhaddr) { 624 return q; 625 } 626 } 627 return NULL; 628 } 629 630 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 631 { 632 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 633 const char *warn = async ? "guest unlinked busy QH" : NULL; 634 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 635 EHCIQueue *q, *tmp; 636 637 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 638 if (q->seen) { 639 q->seen = 0; 640 q->ts = ehci->last_run_ns; 641 continue; 642 } 643 if (ehci->last_run_ns < q->ts + maxage) { 644 continue; 645 } 646 ehci_free_queue(q, warn); 647 } 648 } 649 650 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 651 { 652 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 653 EHCIQueue *q, *tmp; 654 655 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 656 if (!q->seen) { 657 ehci_free_queue(q, NULL); 658 } 659 } 660 } 661 662 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 663 { 664 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 665 EHCIQueue *q, *tmp; 666 667 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 668 if (q->dev != dev) { 669 continue; 670 } 671 ehci_free_queue(q, NULL); 672 } 673 } 674 675 static void ehci_queues_rip_all(EHCIState *ehci, int async) 676 { 677 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 678 const char *warn = async ? "guest stopped busy async schedule" : NULL; 679 EHCIQueue *q, *tmp; 680 681 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 682 ehci_free_queue(q, warn); 683 } 684 } 685 686 /* Attach or detach a device on root hub */ 687 688 static void ehci_attach(USBPort *port) 689 { 690 EHCIState *s = port->opaque; 691 uint32_t *portsc = &s->portsc[port->index]; 692 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 693 694 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 695 696 if (*portsc & PORTSC_POWNER) { 697 USBPort *companion = s->companion_ports[port->index]; 698 companion->dev = port->dev; 699 companion->ops->attach(companion); 700 return; 701 } 702 703 *portsc |= PORTSC_CONNECT; 704 *portsc |= PORTSC_CSC; 705 706 ehci_raise_irq(s, USBSTS_PCD); 707 } 708 709 static void ehci_detach(USBPort *port) 710 { 711 EHCIState *s = port->opaque; 712 uint32_t *portsc = &s->portsc[port->index]; 713 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 714 715 trace_usb_ehci_port_detach(port->index, owner); 716 717 if (*portsc & PORTSC_POWNER) { 718 USBPort *companion = s->companion_ports[port->index]; 719 companion->ops->detach(companion); 720 companion->dev = NULL; 721 /* 722 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 723 * the port ownership is returned immediately to the EHCI controller." 724 */ 725 *portsc &= ~PORTSC_POWNER; 726 return; 727 } 728 729 ehci_queues_rip_device(s, port->dev, 0); 730 ehci_queues_rip_device(s, port->dev, 1); 731 732 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); 733 *portsc |= PORTSC_CSC; 734 735 ehci_raise_irq(s, USBSTS_PCD); 736 } 737 738 static void ehci_child_detach(USBPort *port, USBDevice *child) 739 { 740 EHCIState *s = port->opaque; 741 uint32_t portsc = s->portsc[port->index]; 742 743 if (portsc & PORTSC_POWNER) { 744 USBPort *companion = s->companion_ports[port->index]; 745 companion->ops->child_detach(companion, child); 746 return; 747 } 748 749 ehci_queues_rip_device(s, child, 0); 750 ehci_queues_rip_device(s, child, 1); 751 } 752 753 static void ehci_wakeup(USBPort *port) 754 { 755 EHCIState *s = port->opaque; 756 uint32_t *portsc = &s->portsc[port->index]; 757 758 if (*portsc & PORTSC_POWNER) { 759 USBPort *companion = s->companion_ports[port->index]; 760 if (companion->ops->wakeup) { 761 companion->ops->wakeup(companion); 762 } 763 return; 764 } 765 766 if (*portsc & PORTSC_SUSPEND) { 767 trace_usb_ehci_port_wakeup(port->index); 768 *portsc |= PORTSC_FPRES; 769 ehci_raise_irq(s, USBSTS_PCD); 770 } 771 772 qemu_bh_schedule(s->async_bh); 773 } 774 775 static void ehci_register_companion(USBBus *bus, USBPort *ports[], 776 uint32_t portcount, uint32_t firstport, 777 Error **errp) 778 { 779 EHCIState *s = container_of(bus, EHCIState, bus); 780 uint32_t i; 781 782 if (firstport + portcount > NB_PORTS) { 783 error_setg(errp, "firstport must be between 0 and %u", 784 NB_PORTS - portcount); 785 return; 786 } 787 788 for (i = 0; i < portcount; i++) { 789 if (s->companion_ports[firstport + i]) { 790 error_setg(errp, "firstport %u asks for ports %u-%u," 791 " but port %u has a companion assigned already", 792 firstport, firstport, firstport + portcount - 1, 793 firstport + i); 794 return; 795 } 796 } 797 798 for (i = 0; i < portcount; i++) { 799 s->companion_ports[firstport + i] = ports[i]; 800 s->ports[firstport + i].speedmask |= 801 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 802 /* Ensure devs attached before the initial reset go to the companion */ 803 s->portsc[firstport + i] = PORTSC_POWNER; 804 } 805 806 s->companion_count++; 807 s->caps[0x05] = (s->companion_count << 4) | portcount; 808 } 809 810 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, 811 unsigned int stream) 812 { 813 EHCIState *s = container_of(bus, EHCIState, bus); 814 uint32_t portsc = s->portsc[ep->dev->port->index]; 815 816 if (portsc & PORTSC_POWNER) { 817 return; 818 } 819 820 s->periodic_sched_active = PERIODIC_ACTIVE; 821 qemu_bh_schedule(s->async_bh); 822 } 823 824 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 825 { 826 USBDevice *dev; 827 USBPort *port; 828 int i; 829 830 for (i = 0; i < NB_PORTS; i++) { 831 port = &ehci->ports[i]; 832 if (!(ehci->portsc[i] & PORTSC_PED)) { 833 DPRINTF("Port %d not enabled\n", i); 834 continue; 835 } 836 dev = usb_find_device(port, addr); 837 if (dev != NULL) { 838 return dev; 839 } 840 } 841 return NULL; 842 } 843 844 /* 4.1 host controller initialization */ 845 void ehci_reset(void *opaque) 846 { 847 EHCIState *s = opaque; 848 int i; 849 USBDevice *devs[NB_PORTS]; 850 851 trace_usb_ehci_reset(); 852 853 /* 854 * Do the detach before touching portsc, so that it correctly gets send to 855 * us or to our companion based on PORTSC_POWNER before the reset. 856 */ 857 for(i = 0; i < NB_PORTS; i++) { 858 devs[i] = s->ports[i].dev; 859 if (devs[i] && devs[i]->attached) { 860 usb_detach(&s->ports[i]); 861 } 862 } 863 864 memset(&s->opreg, 0x00, sizeof(s->opreg)); 865 memset(&s->portsc, 0x00, sizeof(s->portsc)); 866 867 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 868 s->usbsts = USBSTS_HALT; 869 s->usbsts_pending = 0; 870 s->usbsts_frindex = 0; 871 ehci_update_irq(s); 872 873 s->astate = EST_INACTIVE; 874 s->pstate = EST_INACTIVE; 875 876 for(i = 0; i < NB_PORTS; i++) { 877 if (s->companion_ports[i]) { 878 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 879 } else { 880 s->portsc[i] = PORTSC_PPOWER; 881 } 882 if (devs[i] && devs[i]->attached) { 883 usb_attach(&s->ports[i]); 884 usb_device_reset(devs[i]); 885 } 886 } 887 ehci_queues_rip_all(s, 0); 888 ehci_queues_rip_all(s, 1); 889 timer_del(s->frame_timer); 890 qemu_bh_cancel(s->async_bh); 891 } 892 893 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 894 unsigned size) 895 { 896 EHCIState *s = ptr; 897 return s->caps[addr]; 898 } 899 900 static void ehci_caps_write(void *ptr, hwaddr addr, 901 uint64_t val, unsigned size) 902 { 903 } 904 905 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 906 unsigned size) 907 { 908 EHCIState *s = ptr; 909 uint32_t val; 910 911 switch (addr) { 912 case FRINDEX: 913 /* Round down to mult of 8, else it can go backwards on migration */ 914 val = s->frindex & ~7; 915 break; 916 default: 917 val = s->opreg[addr >> 2]; 918 } 919 920 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 921 return val; 922 } 923 924 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 925 unsigned size) 926 { 927 EHCIState *s = ptr; 928 uint32_t val; 929 930 val = s->portsc[addr >> 2]; 931 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val); 932 return val; 933 } 934 935 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 936 { 937 USBDevice *dev = s->ports[port].dev; 938 uint32_t *portsc = &s->portsc[port]; 939 uint32_t orig; 940 941 if (s->companion_ports[port] == NULL) 942 return; 943 944 owner = owner & PORTSC_POWNER; 945 orig = *portsc & PORTSC_POWNER; 946 947 if (!(owner ^ orig)) { 948 return; 949 } 950 951 if (dev && dev->attached) { 952 usb_detach(&s->ports[port]); 953 } 954 955 *portsc &= ~PORTSC_POWNER; 956 *portsc |= owner; 957 958 if (dev && dev->attached) { 959 usb_attach(&s->ports[port]); 960 } 961 } 962 963 static void ehci_port_write(void *ptr, hwaddr addr, 964 uint64_t val, unsigned size) 965 { 966 EHCIState *s = ptr; 967 int port = addr >> 2; 968 uint32_t *portsc = &s->portsc[port]; 969 uint32_t old = *portsc; 970 USBDevice *dev = s->ports[port].dev; 971 972 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val); 973 974 /* Clear rwc bits */ 975 *portsc &= ~(val & PORTSC_RWC_MASK); 976 /* The guest may clear, but not set the PED bit */ 977 *portsc &= val | ~PORTSC_PED; 978 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 979 handle_port_owner_write(s, port, val); 980 /* And finally apply RO_MASK */ 981 val &= PORTSC_RO_MASK; 982 983 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 984 trace_usb_ehci_port_reset(port, 1); 985 } 986 987 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 988 trace_usb_ehci_port_reset(port, 0); 989 if (dev && dev->attached) { 990 usb_port_reset(&s->ports[port]); 991 *portsc &= ~PORTSC_CSC; 992 } 993 994 /* 995 * Table 2.16 Set the enable bit(and enable bit change) to indicate 996 * to SW that this port has a high speed device attached 997 */ 998 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 999 val |= PORTSC_PED; 1000 } 1001 } 1002 1003 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) { 1004 trace_usb_ehci_port_suspend(port); 1005 } 1006 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) { 1007 trace_usb_ehci_port_resume(port); 1008 val &= ~PORTSC_SUSPEND; 1009 } 1010 1011 *portsc &= ~PORTSC_RO_MASK; 1012 *portsc |= val; 1013 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old); 1014 } 1015 1016 static void ehci_opreg_write(void *ptr, hwaddr addr, 1017 uint64_t val, unsigned size) 1018 { 1019 EHCIState *s = ptr; 1020 uint32_t *mmio = s->opreg + (addr >> 2); 1021 uint32_t old = *mmio; 1022 int i; 1023 1024 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 1025 1026 switch (addr) { 1027 case USBCMD: 1028 if (val & USBCMD_HCRESET) { 1029 ehci_reset(s); 1030 val = s->usbcmd; 1031 break; 1032 } 1033 1034 /* not supporting dynamic frame list size at the moment */ 1035 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 1036 fprintf(stderr, "attempt to set frame list size -- value %d\n", 1037 (int)val & USBCMD_FLS); 1038 val &= ~USBCMD_FLS; 1039 } 1040 1041 if (val & USBCMD_IAAD) { 1042 /* 1043 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 1044 * trigger and re-use a qh without us seeing the unlink. 1045 */ 1046 s->async_stepdown = 0; 1047 qemu_bh_schedule(s->async_bh); 1048 trace_usb_ehci_doorbell_ring(); 1049 } 1050 1051 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 1052 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 1053 if (s->pstate == EST_INACTIVE) { 1054 SET_LAST_RUN_CLOCK(s); 1055 } 1056 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 1057 ehci_update_halt(s); 1058 s->async_stepdown = 0; 1059 qemu_bh_schedule(s->async_bh); 1060 } 1061 break; 1062 1063 case USBSTS: 1064 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 1065 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 1066 val = s->usbsts; 1067 ehci_update_irq(s); 1068 break; 1069 1070 case USBINTR: 1071 val &= USBINTR_MASK; 1072 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 1073 qemu_bh_schedule(s->async_bh); 1074 } 1075 break; 1076 1077 case FRINDEX: 1078 val &= 0x00003fff; /* frindex is 14bits */ 1079 s->usbsts_frindex = val; 1080 break; 1081 1082 case CONFIGFLAG: 1083 val &= 0x1; 1084 if (val) { 1085 for(i = 0; i < NB_PORTS; i++) 1086 handle_port_owner_write(s, i, 0); 1087 } 1088 break; 1089 1090 case PERIODICLISTBASE: 1091 if (ehci_periodic_enabled(s)) { 1092 fprintf(stderr, 1093 "ehci: PERIODIC list base register set while periodic schedule\n" 1094 " is enabled and HC is enabled\n"); 1095 } 1096 break; 1097 1098 case ASYNCLISTADDR: 1099 if (ehci_async_enabled(s)) { 1100 fprintf(stderr, 1101 "ehci: ASYNC list address register set while async schedule\n" 1102 " is enabled and HC is enabled\n"); 1103 } 1104 break; 1105 } 1106 1107 *mmio = val; 1108 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1109 *mmio, old); 1110 } 1111 1112 /* 1113 * Write the qh back to guest physical memory. This step isn't 1114 * in the EHCI spec but we need to do it since we don't share 1115 * physical memory with our guest VM. 1116 * 1117 * The first three dwords are read-only for the EHCI, so skip them 1118 * when writing back the qh. 1119 */ 1120 static void ehci_flush_qh(EHCIQueue *q) 1121 { 1122 uint32_t *qh = (uint32_t *) &q->qh; 1123 uint32_t dwords = sizeof(EHCIqh) >> 2; 1124 uint32_t addr = NLPTR_GET(q->qhaddr); 1125 1126 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1127 } 1128 1129 // 4.10.2 1130 1131 static int ehci_qh_do_overlay(EHCIQueue *q) 1132 { 1133 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1134 int i; 1135 int dtoggle; 1136 int ping; 1137 int eps; 1138 int reload; 1139 1140 assert(p != NULL); 1141 assert(p->qtdaddr == q->qtdaddr); 1142 1143 // remember values in fields to preserve in qh after overlay 1144 1145 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1146 ping = q->qh.token & QTD_TOKEN_PING; 1147 1148 q->qh.current_qtd = p->qtdaddr; 1149 q->qh.next_qtd = p->qtd.next; 1150 q->qh.altnext_qtd = p->qtd.altnext; 1151 q->qh.token = p->qtd.token; 1152 1153 1154 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1155 if (eps == EHCI_QH_EPS_HIGH) { 1156 q->qh.token &= ~QTD_TOKEN_PING; 1157 q->qh.token |= ping; 1158 } 1159 1160 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1161 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1162 1163 for (i = 0; i < 5; i++) { 1164 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1165 } 1166 1167 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1168 // preserve QH DT bit 1169 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1170 q->qh.token |= dtoggle; 1171 } 1172 1173 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1174 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1175 1176 ehci_flush_qh(q); 1177 1178 return 0; 1179 } 1180 1181 static int ehci_init_transfer(EHCIPacket *p) 1182 { 1183 uint32_t cpage, offset, bytes, plen; 1184 dma_addr_t page; 1185 1186 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1187 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1188 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1189 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as); 1190 1191 while (bytes > 0) { 1192 if (cpage > 4) { 1193 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1194 qemu_sglist_destroy(&p->sgl); 1195 return -1; 1196 } 1197 1198 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1199 page += offset; 1200 plen = bytes; 1201 if (plen > 4096 - offset) { 1202 plen = 4096 - offset; 1203 offset = 0; 1204 cpage++; 1205 } 1206 1207 qemu_sglist_add(&p->sgl, page, plen); 1208 bytes -= plen; 1209 } 1210 return 0; 1211 } 1212 1213 static void ehci_finish_transfer(EHCIQueue *q, int len) 1214 { 1215 uint32_t cpage, offset; 1216 1217 if (len > 0) { 1218 /* update cpage & offset */ 1219 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1220 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1221 1222 offset += len; 1223 cpage += offset >> QTD_BUFPTR_SH; 1224 offset &= ~QTD_BUFPTR_MASK; 1225 1226 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1227 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1228 q->qh.bufptr[0] |= offset; 1229 } 1230 } 1231 1232 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1233 { 1234 EHCIPacket *p; 1235 EHCIState *s = port->opaque; 1236 uint32_t portsc = s->portsc[port->index]; 1237 1238 if (portsc & PORTSC_POWNER) { 1239 USBPort *companion = s->companion_ports[port->index]; 1240 companion->ops->complete(companion, packet); 1241 return; 1242 } 1243 1244 p = container_of(packet, EHCIPacket, packet); 1245 assert(p->async == EHCI_ASYNC_INFLIGHT); 1246 1247 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1248 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1249 ehci_free_packet(p); 1250 return; 1251 } 1252 1253 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1254 p->async = EHCI_ASYNC_FINISHED; 1255 1256 if (!p->queue->async) { 1257 s->periodic_sched_active = PERIODIC_ACTIVE; 1258 } 1259 qemu_bh_schedule(s->async_bh); 1260 } 1261 1262 static void ehci_execute_complete(EHCIQueue *q) 1263 { 1264 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1265 uint32_t tbytes; 1266 1267 assert(p != NULL); 1268 assert(p->qtdaddr == q->qtdaddr); 1269 assert(p->async == EHCI_ASYNC_INITIALIZED || 1270 p->async == EHCI_ASYNC_FINISHED); 1271 1272 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1273 "status %d, actual_length %d\n", 1274 q->qhaddr, q->qh.next, q->qtdaddr, 1275 p->packet.status, p->packet.actual_length); 1276 1277 switch (p->packet.status) { 1278 case USB_RET_SUCCESS: 1279 break; 1280 case USB_RET_IOERROR: 1281 case USB_RET_NODEV: 1282 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1283 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1284 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1285 break; 1286 case USB_RET_STALL: 1287 q->qh.token |= QTD_TOKEN_HALT; 1288 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1289 break; 1290 case USB_RET_NAK: 1291 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1292 return; /* We're not done yet with this transaction */ 1293 case USB_RET_BABBLE: 1294 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1295 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1296 break; 1297 default: 1298 /* should not be triggerable */ 1299 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1300 g_assert_not_reached(); 1301 break; 1302 } 1303 1304 /* TODO check 4.12 for splits */ 1305 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1306 if (tbytes && p->pid == USB_TOKEN_IN) { 1307 tbytes -= p->packet.actual_length; 1308 if (tbytes) { 1309 /* 4.15.1.2 must raise int on a short input packet */ 1310 ehci_raise_irq(q->ehci, USBSTS_INT); 1311 if (q->async) { 1312 q->ehci->int_req_by_async = true; 1313 } 1314 } 1315 } else { 1316 tbytes = 0; 1317 } 1318 DPRINTF("updating tbytes to %d\n", tbytes); 1319 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1320 1321 ehci_finish_transfer(q, p->packet.actual_length); 1322 usb_packet_unmap(&p->packet, &p->sgl); 1323 qemu_sglist_destroy(&p->sgl); 1324 p->async = EHCI_ASYNC_NONE; 1325 1326 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1327 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1328 1329 if (q->qh.token & QTD_TOKEN_IOC) { 1330 ehci_raise_irq(q->ehci, USBSTS_INT); 1331 if (q->async) { 1332 q->ehci->int_req_by_async = true; 1333 } 1334 } 1335 } 1336 1337 /* 4.10.3 returns "again" */ 1338 static int ehci_execute(EHCIPacket *p, const char *action) 1339 { 1340 USBEndpoint *ep; 1341 int endp; 1342 bool spd; 1343 1344 assert(p->async == EHCI_ASYNC_NONE || 1345 p->async == EHCI_ASYNC_INITIALIZED); 1346 1347 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1348 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1349 return -1; 1350 } 1351 1352 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1353 ehci_trace_guest_bug(p->queue->ehci, 1354 "guest requested more bytes than allowed"); 1355 return -1; 1356 } 1357 1358 if (!ehci_verify_pid(p->queue, &p->qtd)) { 1359 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */ 1360 } 1361 p->pid = ehci_get_pid(&p->qtd); 1362 p->queue->last_pid = p->pid; 1363 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1364 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1365 1366 if (p->async == EHCI_ASYNC_NONE) { 1367 if (ehci_init_transfer(p) != 0) { 1368 return -1; 1369 } 1370 1371 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1372 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, 1373 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1374 usb_packet_map(&p->packet, &p->sgl); 1375 p->async = EHCI_ASYNC_INITIALIZED; 1376 } 1377 1378 trace_usb_ehci_packet_action(p->queue, p, action); 1379 usb_handle_packet(p->queue->dev, &p->packet); 1380 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1381 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1382 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1383 p->packet.actual_length); 1384 1385 if (p->packet.actual_length > BUFF_SIZE) { 1386 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1387 return -1; 1388 } 1389 1390 return 1; 1391 } 1392 1393 /* 4.7.2 1394 */ 1395 1396 static int ehci_process_itd(EHCIState *ehci, 1397 EHCIitd *itd, 1398 uint32_t addr) 1399 { 1400 USBDevice *dev; 1401 USBEndpoint *ep; 1402 uint32_t i, len, pid, dir, devaddr, endp; 1403 uint32_t pg, off, ptr1, ptr2, max, mult; 1404 1405 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1406 1407 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1408 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1409 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1410 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1411 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1412 1413 for(i = 0; i < 8; i++) { 1414 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1415 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1416 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1417 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1418 1419 if (len > max * mult) { 1420 len = max * mult; 1421 } 1422 if (len > BUFF_SIZE || pg > 6) { 1423 return -1; 1424 } 1425 1426 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1427 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); 1428 if (off + len > 4096) { 1429 /* transfer crosses page border */ 1430 if (pg == 6) { 1431 qemu_sglist_destroy(&ehci->isgl); 1432 return -1; /* avoid page pg + 1 */ 1433 } 1434 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); 1435 uint32_t len2 = off + len - 4096; 1436 uint32_t len1 = len - len2; 1437 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1438 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1439 } else { 1440 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1441 } 1442 1443 dev = ehci_find_device(ehci, devaddr); 1444 if (dev == NULL) { 1445 ehci_trace_guest_bug(ehci, "no device found"); 1446 return -1; 1447 } 1448 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1449 ep = usb_ep_get(dev, pid, endp); 1450 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1451 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, 1452 (itd->transact[i] & ITD_XACT_IOC) != 0); 1453 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1454 usb_handle_packet(dev, &ehci->ipacket); 1455 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1456 } else { 1457 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1458 ehci->ipacket.status = USB_RET_NAK; 1459 ehci->ipacket.actual_length = 0; 1460 } 1461 qemu_sglist_destroy(&ehci->isgl); 1462 1463 switch (ehci->ipacket.status) { 1464 case USB_RET_SUCCESS: 1465 break; 1466 default: 1467 fprintf(stderr, "Unexpected iso usb result: %d\n", 1468 ehci->ipacket.status); 1469 /* Fall through */ 1470 case USB_RET_IOERROR: 1471 case USB_RET_NODEV: 1472 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1473 if (dir) { 1474 itd->transact[i] |= ITD_XACT_XACTERR; 1475 ehci_raise_irq(ehci, USBSTS_ERRINT); 1476 } 1477 break; 1478 case USB_RET_BABBLE: 1479 itd->transact[i] |= ITD_XACT_BABBLE; 1480 ehci_raise_irq(ehci, USBSTS_ERRINT); 1481 break; 1482 case USB_RET_NAK: 1483 /* no data for us, so do a zero-length transfer */ 1484 ehci->ipacket.actual_length = 0; 1485 break; 1486 } 1487 if (!dir) { 1488 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1489 ITD_XACT_LENGTH); /* OUT */ 1490 } else { 1491 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1492 ITD_XACT_LENGTH); /* IN */ 1493 } 1494 if (itd->transact[i] & ITD_XACT_IOC) { 1495 ehci_raise_irq(ehci, USBSTS_INT); 1496 } 1497 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1498 } 1499 } 1500 return 0; 1501 } 1502 1503 1504 /* This state is the entry point for asynchronous schedule 1505 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1506 */ 1507 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1508 { 1509 EHCIqh qh; 1510 int i = 0; 1511 int again = 0; 1512 uint32_t entry = ehci->asynclistaddr; 1513 1514 /* set reclamation flag at start event (4.8.6) */ 1515 if (async) { 1516 ehci_set_usbsts(ehci, USBSTS_REC); 1517 } 1518 1519 ehci_queues_rip_unused(ehci, async); 1520 1521 /* Find the head of the list (4.9.1.1) */ 1522 for(i = 0; i < MAX_QH; i++) { 1523 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1524 sizeof(EHCIqh) >> 2) < 0) { 1525 return 0; 1526 } 1527 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1528 1529 if (qh.epchar & QH_EPCHAR_H) { 1530 if (async) { 1531 entry |= (NLPTR_TYPE_QH << 1); 1532 } 1533 1534 ehci_set_fetch_addr(ehci, async, entry); 1535 ehci_set_state(ehci, async, EST_FETCHENTRY); 1536 again = 1; 1537 goto out; 1538 } 1539 1540 entry = qh.next; 1541 if (entry == ehci->asynclistaddr) { 1542 break; 1543 } 1544 } 1545 1546 /* no head found for list. */ 1547 1548 ehci_set_state(ehci, async, EST_ACTIVE); 1549 1550 out: 1551 return again; 1552 } 1553 1554 1555 /* This state is the entry point for periodic schedule processing as 1556 * well as being a continuation state for async processing. 1557 */ 1558 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1559 { 1560 int again = 0; 1561 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1562 1563 if (NLPTR_TBIT(entry)) { 1564 ehci_set_state(ehci, async, EST_ACTIVE); 1565 goto out; 1566 } 1567 1568 /* section 4.8, only QH in async schedule */ 1569 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1570 fprintf(stderr, "non queue head request in async schedule\n"); 1571 return -1; 1572 } 1573 1574 switch (NLPTR_TYPE_GET(entry)) { 1575 case NLPTR_TYPE_QH: 1576 ehci_set_state(ehci, async, EST_FETCHQH); 1577 again = 1; 1578 break; 1579 1580 case NLPTR_TYPE_ITD: 1581 ehci_set_state(ehci, async, EST_FETCHITD); 1582 again = 1; 1583 break; 1584 1585 case NLPTR_TYPE_STITD: 1586 ehci_set_state(ehci, async, EST_FETCHSITD); 1587 again = 1; 1588 break; 1589 1590 default: 1591 /* TODO: handle FSTN type */ 1592 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1593 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1594 return -1; 1595 } 1596 1597 out: 1598 return again; 1599 } 1600 1601 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1602 { 1603 uint32_t entry; 1604 EHCIQueue *q; 1605 EHCIqh qh; 1606 1607 entry = ehci_get_fetch_addr(ehci, async); 1608 q = ehci_find_queue_by_qh(ehci, entry, async); 1609 if (q == NULL) { 1610 q = ehci_alloc_queue(ehci, entry, async); 1611 } 1612 1613 q->seen++; 1614 if (q->seen > 1) { 1615 /* we are going in circles -- stop processing */ 1616 ehci_set_state(ehci, async, EST_ACTIVE); 1617 q = NULL; 1618 goto out; 1619 } 1620 1621 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1622 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1623 q = NULL; 1624 goto out; 1625 } 1626 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1627 1628 /* 1629 * The overlay area of the qh should never be changed by the guest, 1630 * except when idle, in which case the reset is a nop. 1631 */ 1632 if (!ehci_verify_qh(q, &qh)) { 1633 if (ehci_reset_queue(q) > 0) { 1634 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1635 } 1636 } 1637 q->qh = qh; 1638 1639 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1640 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1641 q->transact_ctr = 4; 1642 } 1643 1644 if (q->dev == NULL) { 1645 q->dev = ehci_find_device(q->ehci, 1646 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)); 1647 } 1648 1649 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1650 1651 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1652 if (ehci->usbsts & USBSTS_REC) { 1653 ehci_clear_usbsts(ehci, USBSTS_REC); 1654 } else { 1655 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1656 " - done processing\n", q->qhaddr); 1657 ehci_set_state(ehci, async, EST_ACTIVE); 1658 q = NULL; 1659 goto out; 1660 } 1661 } 1662 1663 #if EHCI_DEBUG 1664 if (q->qhaddr != q->qh.next) { 1665 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1666 q->qhaddr, 1667 q->qh.epchar & QH_EPCHAR_H, 1668 q->qh.token & QTD_TOKEN_HALT, 1669 q->qh.token & QTD_TOKEN_ACTIVE, 1670 q->qh.next); 1671 } 1672 #endif 1673 1674 if (q->qh.token & QTD_TOKEN_HALT) { 1675 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1676 1677 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1678 (NLPTR_TBIT(q->qh.current_qtd) == 0) && 1679 (q->qh.current_qtd != 0)) { 1680 q->qtdaddr = q->qh.current_qtd; 1681 ehci_set_state(ehci, async, EST_FETCHQTD); 1682 1683 } else { 1684 /* EHCI spec version 1.0 Section 4.10.2 */ 1685 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1686 } 1687 1688 out: 1689 return q; 1690 } 1691 1692 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1693 { 1694 uint32_t entry; 1695 EHCIitd itd; 1696 1697 assert(!async); 1698 entry = ehci_get_fetch_addr(ehci, async); 1699 1700 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1701 sizeof(EHCIitd) >> 2) < 0) { 1702 return -1; 1703 } 1704 ehci_trace_itd(ehci, entry, &itd); 1705 1706 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1707 return -1; 1708 } 1709 1710 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1711 sizeof(EHCIitd) >> 2); 1712 ehci_set_fetch_addr(ehci, async, itd.next); 1713 ehci_set_state(ehci, async, EST_FETCHENTRY); 1714 1715 return 1; 1716 } 1717 1718 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1719 { 1720 uint32_t entry; 1721 EHCIsitd sitd; 1722 1723 assert(!async); 1724 entry = ehci_get_fetch_addr(ehci, async); 1725 1726 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1727 sizeof(EHCIsitd) >> 2) < 0) { 1728 return 0; 1729 } 1730 ehci_trace_sitd(ehci, entry, &sitd); 1731 1732 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1733 /* siTD is not active, nothing to do */; 1734 } else { 1735 /* TODO: split transfers are not implemented */ 1736 warn_report("Skipping active siTD"); 1737 } 1738 1739 ehci_set_fetch_addr(ehci, async, sitd.next); 1740 ehci_set_state(ehci, async, EST_FETCHENTRY); 1741 return 1; 1742 } 1743 1744 /* Section 4.10.2 - paragraph 3 */ 1745 static int ehci_state_advqueue(EHCIQueue *q) 1746 { 1747 #if 0 1748 /* TO-DO: 4.10.2 - paragraph 2 1749 * if I-bit is set to 1 and QH is not active 1750 * go to horizontal QH 1751 */ 1752 if (I-bit set) { 1753 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1754 goto out; 1755 } 1756 #endif 1757 1758 /* 1759 * want data and alt-next qTD is valid 1760 */ 1761 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1762 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1763 q->qtdaddr = q->qh.altnext_qtd; 1764 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1765 1766 /* 1767 * next qTD is valid 1768 */ 1769 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1770 q->qtdaddr = q->qh.next_qtd; 1771 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1772 1773 /* 1774 * no valid qTD, try next QH 1775 */ 1776 } else { 1777 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1778 } 1779 1780 return 1; 1781 } 1782 1783 /* Section 4.10.2 - paragraph 4 */ 1784 static int ehci_state_fetchqtd(EHCIQueue *q) 1785 { 1786 EHCIqtd qtd; 1787 EHCIPacket *p; 1788 int again = 1; 1789 uint32_t addr; 1790 1791 addr = NLPTR_GET(q->qtdaddr); 1792 if (get_dwords(q->ehci, addr + 8, &qtd.token, 1) < 0) { 1793 return 0; 1794 } 1795 barrier(); 1796 if (get_dwords(q->ehci, addr + 0, &qtd.next, 1) < 0 || 1797 get_dwords(q->ehci, addr + 4, &qtd.altnext, 1) < 0 || 1798 get_dwords(q->ehci, addr + 12, qtd.bufptr, 1799 ARRAY_SIZE(qtd.bufptr)) < 0) { 1800 return 0; 1801 } 1802 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1803 1804 p = QTAILQ_FIRST(&q->packets); 1805 if (p != NULL) { 1806 if (!ehci_verify_qtd(p, &qtd)) { 1807 ehci_cancel_queue(q); 1808 if (qtd.token & QTD_TOKEN_ACTIVE) { 1809 ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); 1810 } 1811 p = NULL; 1812 } else { 1813 p->qtd = qtd; 1814 ehci_qh_do_overlay(q); 1815 } 1816 } 1817 1818 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1819 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1820 } else if (p != NULL) { 1821 switch (p->async) { 1822 case EHCI_ASYNC_NONE: 1823 case EHCI_ASYNC_INITIALIZED: 1824 /* Not yet executed (MULT), or previously nacked (int) packet */ 1825 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1826 break; 1827 case EHCI_ASYNC_INFLIGHT: 1828 /* Check if the guest has added new tds to the queue */ 1829 again = ehci_fill_queue(QTAILQ_LAST(&q->packets)); 1830 /* Unfinished async handled packet, go horizontal */ 1831 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1832 break; 1833 case EHCI_ASYNC_FINISHED: 1834 /* Complete executing of the packet */ 1835 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1836 break; 1837 } 1838 } else { 1839 p = ehci_alloc_packet(q); 1840 p->qtdaddr = q->qtdaddr; 1841 p->qtd = qtd; 1842 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1843 } 1844 1845 return again; 1846 } 1847 1848 static int ehci_state_horizqh(EHCIQueue *q) 1849 { 1850 int again = 0; 1851 1852 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1853 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1854 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1855 again = 1; 1856 } else { 1857 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1858 } 1859 1860 return again; 1861 } 1862 1863 /* Returns "again" */ 1864 static int ehci_fill_queue(EHCIPacket *p) 1865 { 1866 USBEndpoint *ep = p->packet.ep; 1867 EHCIQueue *q = p->queue; 1868 EHCIqtd qtd = p->qtd; 1869 uint32_t qtdaddr; 1870 1871 for (;;) { 1872 if (NLPTR_TBIT(qtd.next) != 0) { 1873 break; 1874 } 1875 qtdaddr = qtd.next; 1876 /* 1877 * Detect circular td lists, Windows creates these, counting on the 1878 * active bit going low after execution to make the queue stop. 1879 */ 1880 QTAILQ_FOREACH(p, &q->packets, next) { 1881 if (p->qtdaddr == qtdaddr) { 1882 goto leave; 1883 } 1884 } 1885 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1886 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1887 return -1; 1888 } 1889 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1890 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1891 break; 1892 } 1893 if (!ehci_verify_pid(q, &qtd)) { 1894 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid"); 1895 break; 1896 } 1897 p = ehci_alloc_packet(q); 1898 p->qtdaddr = qtdaddr; 1899 p->qtd = qtd; 1900 if (ehci_execute(p, "queue") == -1) { 1901 return -1; 1902 } 1903 assert(p->packet.status == USB_RET_ASYNC); 1904 p->async = EHCI_ASYNC_INFLIGHT; 1905 } 1906 leave: 1907 usb_device_flush_ep_queue(ep->dev, ep); 1908 return 1; 1909 } 1910 1911 static int ehci_state_execute(EHCIQueue *q) 1912 { 1913 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1914 int again = 0; 1915 1916 assert(p != NULL); 1917 assert(p->qtdaddr == q->qtdaddr); 1918 1919 if (ehci_qh_do_overlay(q) != 0) { 1920 return -1; 1921 } 1922 1923 // TODO verify enough time remains in the uframe as in 4.4.1.1 1924 // TODO write back ptr to async list when done or out of time 1925 1926 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1927 if (!q->async && q->transact_ctr == 0) { 1928 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1929 again = 1; 1930 goto out; 1931 } 1932 1933 if (q->async) { 1934 ehci_set_usbsts(q->ehci, USBSTS_REC); 1935 } 1936 1937 again = ehci_execute(p, "process"); 1938 if (again == -1) { 1939 goto out; 1940 } 1941 if (p->packet.status == USB_RET_ASYNC) { 1942 ehci_flush_qh(q); 1943 trace_usb_ehci_packet_action(p->queue, p, "async"); 1944 p->async = EHCI_ASYNC_INFLIGHT; 1945 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1946 if (q->async) { 1947 again = ehci_fill_queue(p); 1948 } else { 1949 again = 1; 1950 } 1951 goto out; 1952 } 1953 1954 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1955 again = 1; 1956 1957 out: 1958 return again; 1959 } 1960 1961 static int ehci_state_executing(EHCIQueue *q) 1962 { 1963 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1964 1965 assert(p != NULL); 1966 assert(p->qtdaddr == q->qtdaddr); 1967 1968 ehci_execute_complete(q); 1969 1970 /* 4.10.3 */ 1971 if (!q->async && q->transact_ctr > 0) { 1972 q->transact_ctr--; 1973 } 1974 1975 /* 4.10.5 */ 1976 if (p->packet.status == USB_RET_NAK) { 1977 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1978 } else { 1979 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1980 } 1981 1982 ehci_flush_qh(q); 1983 return 1; 1984 } 1985 1986 1987 static int ehci_state_writeback(EHCIQueue *q) 1988 { 1989 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1990 uint32_t *qtd, addr; 1991 int again = 0; 1992 1993 /* Write back the QTD from the QH area */ 1994 assert(p != NULL); 1995 assert(p->qtdaddr == q->qtdaddr); 1996 1997 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1998 qtd = (uint32_t *) &q->qh.next_qtd; 1999 addr = NLPTR_GET(p->qtdaddr); 2000 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 2001 ehci_free_packet(p); 2002 2003 /* 2004 * EHCI specs say go horizontal here. 2005 * 2006 * We can also advance the queue here for performance reasons. We 2007 * need to take care to only take that shortcut in case we've 2008 * processed the qtd just written back without errors, i.e. halt 2009 * bit is clear. 2010 */ 2011 if (q->qh.token & QTD_TOKEN_HALT) { 2012 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 2013 again = 1; 2014 } else { 2015 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 2016 again = 1; 2017 } 2018 return again; 2019 } 2020 2021 /* 2022 * This is the state machine that is common to both async and periodic 2023 */ 2024 2025 static void ehci_advance_state(EHCIState *ehci, int async) 2026 { 2027 EHCIQueue *q = NULL; 2028 int itd_count = 0; 2029 int again; 2030 2031 do { 2032 switch(ehci_get_state(ehci, async)) { 2033 case EST_WAITLISTHEAD: 2034 again = ehci_state_waitlisthead(ehci, async); 2035 break; 2036 2037 case EST_FETCHENTRY: 2038 again = ehci_state_fetchentry(ehci, async); 2039 break; 2040 2041 case EST_FETCHQH: 2042 q = ehci_state_fetchqh(ehci, async); 2043 if (q != NULL) { 2044 assert(q->async == async); 2045 again = 1; 2046 } else { 2047 again = 0; 2048 } 2049 break; 2050 2051 case EST_FETCHITD: 2052 again = ehci_state_fetchitd(ehci, async); 2053 itd_count++; 2054 break; 2055 2056 case EST_FETCHSITD: 2057 again = ehci_state_fetchsitd(ehci, async); 2058 itd_count++; 2059 break; 2060 2061 case EST_ADVANCEQUEUE: 2062 assert(q != NULL); 2063 again = ehci_state_advqueue(q); 2064 break; 2065 2066 case EST_FETCHQTD: 2067 assert(q != NULL); 2068 again = ehci_state_fetchqtd(q); 2069 break; 2070 2071 case EST_HORIZONTALQH: 2072 assert(q != NULL); 2073 again = ehci_state_horizqh(q); 2074 break; 2075 2076 case EST_EXECUTE: 2077 assert(q != NULL); 2078 again = ehci_state_execute(q); 2079 if (async) { 2080 ehci->async_stepdown = 0; 2081 } 2082 break; 2083 2084 case EST_EXECUTING: 2085 assert(q != NULL); 2086 if (async) { 2087 ehci->async_stepdown = 0; 2088 } 2089 again = ehci_state_executing(q); 2090 break; 2091 2092 case EST_WRITEBACK: 2093 assert(q != NULL); 2094 again = ehci_state_writeback(q); 2095 if (!async) { 2096 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2097 } 2098 break; 2099 2100 default: 2101 fprintf(stderr, "Bad state!\n"); 2102 again = -1; 2103 g_assert_not_reached(); 2104 break; 2105 } 2106 2107 if (again < 0 || itd_count > 16) { 2108 /* TODO: notify guest (raise HSE irq?) */ 2109 fprintf(stderr, "processing error - resetting ehci HC\n"); 2110 ehci_reset(ehci); 2111 again = 0; 2112 } 2113 } 2114 while (again); 2115 } 2116 2117 static void ehci_advance_async_state(EHCIState *ehci) 2118 { 2119 const int async = 1; 2120 2121 switch(ehci_get_state(ehci, async)) { 2122 case EST_INACTIVE: 2123 if (!ehci_async_enabled(ehci)) { 2124 break; 2125 } 2126 ehci_set_state(ehci, async, EST_ACTIVE); 2127 // No break, fall through to ACTIVE 2128 2129 case EST_ACTIVE: 2130 if (!ehci_async_enabled(ehci)) { 2131 ehci_queues_rip_all(ehci, async); 2132 ehci_set_state(ehci, async, EST_INACTIVE); 2133 break; 2134 } 2135 2136 /* make sure guest has acknowledged the doorbell interrupt */ 2137 /* TO-DO: is this really needed? */ 2138 if (ehci->usbsts & USBSTS_IAA) { 2139 DPRINTF("IAA status bit still set.\n"); 2140 break; 2141 } 2142 2143 /* check that address register has been set */ 2144 if (ehci->asynclistaddr == 0) { 2145 break; 2146 } 2147 2148 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2149 ehci_advance_state(ehci, async); 2150 2151 /* If the doorbell is set, the guest wants to make a change to the 2152 * schedule. The host controller needs to release cached data. 2153 * (section 4.8.2) 2154 */ 2155 if (ehci->usbcmd & USBCMD_IAAD) { 2156 /* Remove all unseen qhs from the async qhs queue */ 2157 ehci_queues_rip_unseen(ehci, async); 2158 trace_usb_ehci_doorbell_ack(); 2159 ehci->usbcmd &= ~USBCMD_IAAD; 2160 ehci_raise_irq(ehci, USBSTS_IAA); 2161 } 2162 break; 2163 2164 default: 2165 /* this should only be due to a developer mistake */ 2166 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2167 "Resetting to active\n", ehci->astate); 2168 g_assert_not_reached(); 2169 } 2170 } 2171 2172 static void ehci_advance_periodic_state(EHCIState *ehci) 2173 { 2174 uint32_t entry; 2175 uint32_t list; 2176 const int async = 0; 2177 2178 // 4.6 2179 2180 switch(ehci_get_state(ehci, async)) { 2181 case EST_INACTIVE: 2182 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2183 ehci_set_state(ehci, async, EST_ACTIVE); 2184 // No break, fall through to ACTIVE 2185 } else 2186 break; 2187 2188 case EST_ACTIVE: 2189 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2190 ehci_queues_rip_all(ehci, async); 2191 ehci_set_state(ehci, async, EST_INACTIVE); 2192 break; 2193 } 2194 2195 list = ehci->periodiclistbase & 0xfffff000; 2196 /* check that register has been set */ 2197 if (list == 0) { 2198 break; 2199 } 2200 list |= ((ehci->frindex & 0x1ff8) >> 1); 2201 2202 if (get_dwords(ehci, list, &entry, 1) < 0) { 2203 break; 2204 } 2205 2206 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2207 ehci->frindex / 8, list, entry); 2208 ehci_set_fetch_addr(ehci, async,entry); 2209 ehci_set_state(ehci, async, EST_FETCHENTRY); 2210 ehci_advance_state(ehci, async); 2211 ehci_queues_rip_unused(ehci, async); 2212 break; 2213 2214 default: 2215 /* this should only be due to a developer mistake */ 2216 fprintf(stderr, "ehci: Bad periodic state %d. " 2217 "Resetting to active\n", ehci->pstate); 2218 g_assert_not_reached(); 2219 } 2220 } 2221 2222 static void ehci_update_frindex(EHCIState *ehci, int uframes) 2223 { 2224 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) { 2225 return; 2226 } 2227 2228 /* Generate FLR interrupt if frame index rolls over 0x2000 */ 2229 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) { 2230 ehci_raise_irq(ehci, USBSTS_FLR); 2231 } 2232 2233 /* How many times will frindex roll over 0x4000 with this frame count? 2234 * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0 2235 */ 2236 int rollovers = (ehci->frindex + uframes) / 0x4000; 2237 if (rollovers > 0) { 2238 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) { 2239 ehci->usbsts_frindex -= 0x4000 * rollovers; 2240 } else { 2241 ehci->usbsts_frindex = 0; 2242 } 2243 } 2244 2245 ehci->frindex = (ehci->frindex + uframes) % 0x4000; 2246 } 2247 2248 static void ehci_work_bh(void *opaque) 2249 { 2250 EHCIState *ehci = opaque; 2251 int need_timer = 0; 2252 int64_t expire_time, t_now; 2253 uint64_t ns_elapsed; 2254 uint64_t uframes, skipped_uframes; 2255 int i; 2256 2257 if (ehci->working) { 2258 return; 2259 } 2260 ehci->working = true; 2261 2262 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 2263 ns_elapsed = t_now - ehci->last_run_ns; 2264 uframes = ns_elapsed / UFRAME_TIMER_NS; 2265 2266 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2267 need_timer++; 2268 2269 if (uframes > (ehci->maxframes * 8)) { 2270 skipped_uframes = uframes - (ehci->maxframes * 8); 2271 ehci_update_frindex(ehci, skipped_uframes); 2272 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; 2273 uframes -= skipped_uframes; 2274 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes); 2275 } 2276 2277 for (i = 0; i < uframes; i++) { 2278 /* 2279 * If we're running behind schedule, we should not catch up 2280 * too fast, as that will make some guests unhappy: 2281 * 1) We must process a minimum of MIN_UFR_PER_TICK frames, 2282 * otherwise we will never catch up 2283 * 2) Process frames until the guest has requested an irq (IOC) 2284 */ 2285 if (i >= MIN_UFR_PER_TICK) { 2286 ehci_commit_irq(ehci); 2287 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2288 break; 2289 } 2290 } 2291 if (ehci->periodic_sched_active) { 2292 ehci->periodic_sched_active--; 2293 } 2294 ehci_update_frindex(ehci, 1); 2295 if ((ehci->frindex & 7) == 0) { 2296 ehci_advance_periodic_state(ehci); 2297 } 2298 ehci->last_run_ns += UFRAME_TIMER_NS; 2299 } 2300 } else { 2301 ehci->periodic_sched_active = 0; 2302 ehci_update_frindex(ehci, uframes); 2303 ehci->last_run_ns += UFRAME_TIMER_NS * uframes; 2304 } 2305 2306 if (ehci->periodic_sched_active) { 2307 ehci->async_stepdown = 0; 2308 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2309 ehci->async_stepdown++; 2310 } 2311 2312 /* Async is not inside loop since it executes everything it can once 2313 * called 2314 */ 2315 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2316 need_timer++; 2317 ehci_advance_async_state(ehci); 2318 } 2319 2320 ehci_commit_irq(ehci); 2321 if (ehci->usbsts_pending) { 2322 need_timer++; 2323 ehci->async_stepdown = 0; 2324 } 2325 2326 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2327 need_timer++; 2328 } 2329 2330 if (need_timer) { 2331 /* If we've raised int, we speed up the timer, so that we quickly 2332 * notice any new packets queued up in response */ 2333 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2334 expire_time = t_now + 2335 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4); 2336 ehci->int_req_by_async = false; 2337 } else { 2338 expire_time = t_now + (NANOSECONDS_PER_SECOND 2339 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2340 } 2341 timer_mod(ehci->frame_timer, expire_time); 2342 } 2343 2344 ehci->working = false; 2345 } 2346 2347 static void ehci_work_timer(void *opaque) 2348 { 2349 EHCIState *ehci = opaque; 2350 2351 qemu_bh_schedule(ehci->async_bh); 2352 } 2353 2354 static const MemoryRegionOps ehci_mmio_caps_ops = { 2355 .read = ehci_caps_read, 2356 .write = ehci_caps_write, 2357 .valid.min_access_size = 1, 2358 .valid.max_access_size = 4, 2359 .impl.min_access_size = 1, 2360 .impl.max_access_size = 1, 2361 .endianness = DEVICE_LITTLE_ENDIAN, 2362 }; 2363 2364 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2365 .read = ehci_opreg_read, 2366 .write = ehci_opreg_write, 2367 .valid.min_access_size = 4, 2368 .valid.max_access_size = 4, 2369 .endianness = DEVICE_LITTLE_ENDIAN, 2370 }; 2371 2372 static const MemoryRegionOps ehci_mmio_port_ops = { 2373 .read = ehci_port_read, 2374 .write = ehci_port_write, 2375 .valid.min_access_size = 4, 2376 .valid.max_access_size = 4, 2377 .endianness = DEVICE_LITTLE_ENDIAN, 2378 }; 2379 2380 static USBPortOps ehci_port_ops = { 2381 .attach = ehci_attach, 2382 .detach = ehci_detach, 2383 .child_detach = ehci_child_detach, 2384 .wakeup = ehci_wakeup, 2385 .complete = ehci_async_complete_packet, 2386 }; 2387 2388 static USBBusOps ehci_bus_ops_companion = { 2389 .register_companion = ehci_register_companion, 2390 .wakeup_endpoint = ehci_wakeup_endpoint, 2391 }; 2392 static USBBusOps ehci_bus_ops_standalone = { 2393 .wakeup_endpoint = ehci_wakeup_endpoint, 2394 }; 2395 2396 static int usb_ehci_pre_save(void *opaque) 2397 { 2398 EHCIState *ehci = opaque; 2399 uint32_t new_frindex; 2400 2401 /* Round down frindex to a multiple of 8 for migration compatibility */ 2402 new_frindex = ehci->frindex & ~7; 2403 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS; 2404 ehci->frindex = new_frindex; 2405 2406 return 0; 2407 } 2408 2409 static int usb_ehci_post_load(void *opaque, int version_id) 2410 { 2411 EHCIState *s = opaque; 2412 int i; 2413 2414 for (i = 0; i < NB_PORTS; i++) { 2415 USBPort *companion = s->companion_ports[i]; 2416 if (companion == NULL) { 2417 continue; 2418 } 2419 if (s->portsc[i] & PORTSC_POWNER) { 2420 companion->dev = s->ports[i].dev; 2421 } else { 2422 companion->dev = NULL; 2423 } 2424 } 2425 2426 return 0; 2427 } 2428 2429 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2430 { 2431 EHCIState *ehci = opaque; 2432 2433 /* 2434 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2435 * schedule in guest memory. We must do the rebuilt ASAP, so that 2436 * USB-devices which have async handled packages have a packet in the 2437 * ep queue to match the completion with. 2438 */ 2439 if (state == RUN_STATE_RUNNING) { 2440 ehci_advance_async_state(ehci); 2441 } 2442 2443 /* 2444 * The schedule rebuilt from guest memory could cause the migration dest 2445 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2446 * will never have existed on the destination. Therefor we must flush the 2447 * async schedule on savevm to catch any not yet noticed unlinks. 2448 */ 2449 if (state == RUN_STATE_SAVE_VM) { 2450 ehci_advance_async_state(ehci); 2451 ehci_queues_rip_unseen(ehci, 1); 2452 } 2453 } 2454 2455 const VMStateDescription vmstate_ehci = { 2456 .name = "ehci-core", 2457 .version_id = 2, 2458 .minimum_version_id = 1, 2459 .pre_save = usb_ehci_pre_save, 2460 .post_load = usb_ehci_post_load, 2461 .fields = (VMStateField[]) { 2462 /* mmio registers */ 2463 VMSTATE_UINT32(usbcmd, EHCIState), 2464 VMSTATE_UINT32(usbsts, EHCIState), 2465 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2466 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2467 VMSTATE_UINT32(usbintr, EHCIState), 2468 VMSTATE_UINT32(frindex, EHCIState), 2469 VMSTATE_UINT32(ctrldssegment, EHCIState), 2470 VMSTATE_UINT32(periodiclistbase, EHCIState), 2471 VMSTATE_UINT32(asynclistaddr, EHCIState), 2472 VMSTATE_UINT32(configflag, EHCIState), 2473 VMSTATE_UINT32(portsc[0], EHCIState), 2474 VMSTATE_UINT32(portsc[1], EHCIState), 2475 VMSTATE_UINT32(portsc[2], EHCIState), 2476 VMSTATE_UINT32(portsc[3], EHCIState), 2477 VMSTATE_UINT32(portsc[4], EHCIState), 2478 VMSTATE_UINT32(portsc[5], EHCIState), 2479 /* frame timer */ 2480 VMSTATE_TIMER_PTR(frame_timer, EHCIState), 2481 VMSTATE_UINT64(last_run_ns, EHCIState), 2482 VMSTATE_UINT32(async_stepdown, EHCIState), 2483 /* schedule state */ 2484 VMSTATE_UINT32(astate, EHCIState), 2485 VMSTATE_UINT32(pstate, EHCIState), 2486 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2487 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2488 VMSTATE_END_OF_LIST() 2489 } 2490 }; 2491 2492 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) 2493 { 2494 int i; 2495 2496 if (s->portnr > NB_PORTS) { 2497 error_setg(errp, "Too many ports! Max. port number is %d.", 2498 NB_PORTS); 2499 return; 2500 } 2501 if (s->maxframes < 8 || s->maxframes > 512) { 2502 error_setg(errp, "maxframes %d out if range (8 .. 512)", 2503 s->maxframes); 2504 return; 2505 } 2506 2507 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ? 2508 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev); 2509 for (i = 0; i < s->portnr; i++) { 2510 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2511 USB_SPEED_MASK_HIGH); 2512 s->ports[i].dev = 0; 2513 } 2514 2515 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s); 2516 s->async_bh = qemu_bh_new(ehci_work_bh, s); 2517 s->device = dev; 2518 2519 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2520 } 2521 2522 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp) 2523 { 2524 trace_usb_ehci_unrealize(); 2525 2526 if (s->frame_timer) { 2527 timer_del(s->frame_timer); 2528 timer_free(s->frame_timer); 2529 s->frame_timer = NULL; 2530 } 2531 if (s->async_bh) { 2532 qemu_bh_delete(s->async_bh); 2533 } 2534 2535 ehci_queues_rip_all(s, 0); 2536 ehci_queues_rip_all(s, 1); 2537 2538 memory_region_del_subregion(&s->mem, &s->mem_caps); 2539 memory_region_del_subregion(&s->mem, &s->mem_opreg); 2540 memory_region_del_subregion(&s->mem, &s->mem_ports); 2541 2542 usb_bus_release(&s->bus); 2543 2544 if (s->vmstate) { 2545 qemu_del_vm_change_state_handler(s->vmstate); 2546 } 2547 } 2548 2549 void usb_ehci_init(EHCIState *s, DeviceState *dev) 2550 { 2551 /* 2.2 host controller interface version */ 2552 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2553 s->caps[0x01] = 0x00; 2554 s->caps[0x02] = 0x00; 2555 s->caps[0x03] = 0x01; /* HC version */ 2556 s->caps[0x04] = s->portnr; /* Number of downstream ports */ 2557 s->caps[0x05] = 0x00; /* No companion ports at present */ 2558 s->caps[0x06] = 0x00; 2559 s->caps[0x07] = 0x00; 2560 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2561 s->caps[0x0a] = 0x00; 2562 s->caps[0x0b] = 0x00; 2563 2564 QTAILQ_INIT(&s->aqueues); 2565 QTAILQ_INIT(&s->pqueues); 2566 usb_packet_init(&s->ipacket); 2567 2568 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE); 2569 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s, 2570 "capabilities", CAPA_SIZE); 2571 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s, 2572 "operational", s->portscbase); 2573 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s, 2574 "ports", 4 * s->portnr); 2575 2576 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2577 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2578 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase, 2579 &s->mem_ports); 2580 } 2581 2582 void usb_ehci_finalize(EHCIState *s) 2583 { 2584 usb_packet_cleanup(&s->ipacket); 2585 } 2586 2587 /* 2588 * vim: expandtab ts=4 2589 */ 2590