1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "hw/usb/hcd-ehci.h" 31 32 /* Capability Registers Base Address - section 2.2 */ 33 #define CAPLENGTH 0x0000 /* 1-byte, 0x0001 reserved */ 34 #define HCIVERSION 0x0002 /* 2-bytes, i/f version # */ 35 #define HCSPARAMS 0x0004 /* 4-bytes, structural params */ 36 #define HCCPARAMS 0x0008 /* 4-bytes, capability params */ 37 #define EECP HCCPARAMS + 1 38 #define HCSPPORTROUTE1 0x000c 39 #define HCSPPORTROUTE2 0x0010 40 41 #define USBCMD 0x0000 42 #define USBCMD_RUNSTOP (1 << 0) // run / Stop 43 #define USBCMD_HCRESET (1 << 1) // HC Reset 44 #define USBCMD_FLS (3 << 2) // Frame List Size 45 #define USBCMD_FLS_SH 2 // Frame List Size Shift 46 #define USBCMD_PSE (1 << 4) // Periodic Schedule Enable 47 #define USBCMD_ASE (1 << 5) // Asynch Schedule Enable 48 #define USBCMD_IAAD (1 << 6) // Int Asynch Advance Doorbell 49 #define USBCMD_LHCR (1 << 7) // Light Host Controller Reset 50 #define USBCMD_ASPMC (3 << 8) // Async Sched Park Mode Count 51 #define USBCMD_ASPME (1 << 11) // Async Sched Park Mode Enable 52 #define USBCMD_ITC (0x7f << 16) // Int Threshold Control 53 #define USBCMD_ITC_SH 16 // Int Threshold Control Shift 54 55 #define USBSTS 0x0004 56 #define USBSTS_RO_MASK 0x0000003f 57 #define USBSTS_INT (1 << 0) // USB Interrupt 58 #define USBSTS_ERRINT (1 << 1) // Error Interrupt 59 #define USBSTS_PCD (1 << 2) // Port Change Detect 60 #define USBSTS_FLR (1 << 3) // Frame List Rollover 61 #define USBSTS_HSE (1 << 4) // Host System Error 62 #define USBSTS_IAA (1 << 5) // Interrupt on Async Advance 63 #define USBSTS_HALT (1 << 12) // HC Halted 64 #define USBSTS_REC (1 << 13) // Reclamation 65 #define USBSTS_PSS (1 << 14) // Periodic Schedule Status 66 #define USBSTS_ASS (1 << 15) // Asynchronous Schedule Status 67 68 /* 69 * Interrupt enable bits correspond to the interrupt active bits in USBSTS 70 * so no need to redefine here. 71 */ 72 #define USBINTR 0x0008 73 #define USBINTR_MASK 0x0000003f 74 75 #define FRINDEX 0x000c 76 #define CTRLDSSEGMENT 0x0010 77 #define PERIODICLISTBASE 0x0014 78 #define ASYNCLISTADDR 0x0018 79 #define ASYNCLISTADDR_MASK 0xffffffe0 80 81 #define CONFIGFLAG 0x0040 82 83 /* 84 * Bits that are reserved or are read-only are masked out of values 85 * written to us by software 86 */ 87 #define PORTSC_RO_MASK 0x007001c0 88 #define PORTSC_RWC_MASK 0x0000002a 89 #define PORTSC_WKOC_E (1 << 22) // Wake on Over Current Enable 90 #define PORTSC_WKDS_E (1 << 21) // Wake on Disconnect Enable 91 #define PORTSC_WKCN_E (1 << 20) // Wake on Connect Enable 92 #define PORTSC_PTC (15 << 16) // Port Test Control 93 #define PORTSC_PTC_SH 16 // Port Test Control shift 94 #define PORTSC_PIC (3 << 14) // Port Indicator Control 95 #define PORTSC_PIC_SH 14 // Port Indicator Control Shift 96 #define PORTSC_POWNER (1 << 13) // Port Owner 97 #define PORTSC_PPOWER (1 << 12) // Port Power 98 #define PORTSC_LINESTAT (3 << 10) // Port Line Status 99 #define PORTSC_LINESTAT_SH 10 // Port Line Status Shift 100 #define PORTSC_PRESET (1 << 8) // Port Reset 101 #define PORTSC_SUSPEND (1 << 7) // Port Suspend 102 #define PORTSC_FPRES (1 << 6) // Force Port Resume 103 #define PORTSC_OCC (1 << 5) // Over Current Change 104 #define PORTSC_OCA (1 << 4) // Over Current Active 105 #define PORTSC_PEDC (1 << 3) // Port Enable/Disable Change 106 #define PORTSC_PED (1 << 2) // Port Enable/Disable 107 #define PORTSC_CSC (1 << 1) // Connect Status Change 108 #define PORTSC_CONNECT (1 << 0) // Current Connect Status 109 110 #define FRAME_TIMER_FREQ 1000 111 #define FRAME_TIMER_NS (1000000000 / FRAME_TIMER_FREQ) 112 113 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 114 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 115 #define MAX_QH 100 // Max allowable queue heads in a chain 116 #define MIN_FR_PER_TICK 3 // Min frames to process when catching up 117 #define PERIODIC_ACTIVE 64 118 119 /* Internal periodic / asynchronous schedule state machine states 120 */ 121 typedef enum { 122 EST_INACTIVE = 1000, 123 EST_ACTIVE, 124 EST_EXECUTING, 125 EST_SLEEPING, 126 /* The following states are internal to the state machine function 127 */ 128 EST_WAITLISTHEAD, 129 EST_FETCHENTRY, 130 EST_FETCHQH, 131 EST_FETCHITD, 132 EST_FETCHSITD, 133 EST_ADVANCEQUEUE, 134 EST_FETCHQTD, 135 EST_EXECUTE, 136 EST_WRITEBACK, 137 EST_HORIZONTALQH 138 } EHCI_STATES; 139 140 /* macros for accessing fields within next link pointer entry */ 141 #define NLPTR_GET(x) ((x) & 0xffffffe0) 142 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 143 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 144 145 /* link pointer types */ 146 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 147 #define NLPTR_TYPE_QH 1 // queue head 148 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 149 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 150 151 #define SET_LAST_RUN_CLOCK(s) \ 152 (s)->last_run_ns = qemu_get_clock_ns(vm_clock); 153 154 /* nifty macros from Arnon's EHCI version */ 155 #define get_field(data, field) \ 156 (((data) & field##_MASK) >> field##_SH) 157 158 #define set_field(data, newval, field) do { \ 159 uint32_t val = *data; \ 160 val &= ~ field##_MASK; \ 161 val |= ((newval) << field##_SH) & field##_MASK; \ 162 *data = val; \ 163 } while(0) 164 165 static const char *ehci_state_names[] = { 166 [EST_INACTIVE] = "INACTIVE", 167 [EST_ACTIVE] = "ACTIVE", 168 [EST_EXECUTING] = "EXECUTING", 169 [EST_SLEEPING] = "SLEEPING", 170 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 171 [EST_FETCHENTRY] = "FETCH ENTRY", 172 [EST_FETCHQH] = "FETCH QH", 173 [EST_FETCHITD] = "FETCH ITD", 174 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 175 [EST_FETCHQTD] = "FETCH QTD", 176 [EST_EXECUTE] = "EXECUTE", 177 [EST_WRITEBACK] = "WRITEBACK", 178 [EST_HORIZONTALQH] = "HORIZONTALQH", 179 }; 180 181 static const char *ehci_mmio_names[] = { 182 [USBCMD] = "USBCMD", 183 [USBSTS] = "USBSTS", 184 [USBINTR] = "USBINTR", 185 [FRINDEX] = "FRINDEX", 186 [PERIODICLISTBASE] = "P-LIST BASE", 187 [ASYNCLISTADDR] = "A-LIST ADDR", 188 [CONFIGFLAG] = "CONFIGFLAG", 189 }; 190 191 static int ehci_state_executing(EHCIQueue *q); 192 static int ehci_state_writeback(EHCIQueue *q); 193 static int ehci_state_advqueue(EHCIQueue *q); 194 static int ehci_fill_queue(EHCIPacket *p); 195 196 static const char *nr2str(const char **n, size_t len, uint32_t nr) 197 { 198 if (nr < len && n[nr] != NULL) { 199 return n[nr]; 200 } else { 201 return "unknown"; 202 } 203 } 204 205 static const char *state2str(uint32_t state) 206 { 207 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 208 } 209 210 static const char *addr2str(hwaddr addr) 211 { 212 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 213 } 214 215 static void ehci_trace_usbsts(uint32_t mask, int state) 216 { 217 /* interrupts */ 218 if (mask & USBSTS_INT) { 219 trace_usb_ehci_usbsts("INT", state); 220 } 221 if (mask & USBSTS_ERRINT) { 222 trace_usb_ehci_usbsts("ERRINT", state); 223 } 224 if (mask & USBSTS_PCD) { 225 trace_usb_ehci_usbsts("PCD", state); 226 } 227 if (mask & USBSTS_FLR) { 228 trace_usb_ehci_usbsts("FLR", state); 229 } 230 if (mask & USBSTS_HSE) { 231 trace_usb_ehci_usbsts("HSE", state); 232 } 233 if (mask & USBSTS_IAA) { 234 trace_usb_ehci_usbsts("IAA", state); 235 } 236 237 /* status */ 238 if (mask & USBSTS_HALT) { 239 trace_usb_ehci_usbsts("HALT", state); 240 } 241 if (mask & USBSTS_REC) { 242 trace_usb_ehci_usbsts("REC", state); 243 } 244 if (mask & USBSTS_PSS) { 245 trace_usb_ehci_usbsts("PSS", state); 246 } 247 if (mask & USBSTS_ASS) { 248 trace_usb_ehci_usbsts("ASS", state); 249 } 250 } 251 252 static inline void ehci_set_usbsts(EHCIState *s, int mask) 253 { 254 if ((s->usbsts & mask) == mask) { 255 return; 256 } 257 ehci_trace_usbsts(mask, 1); 258 s->usbsts |= mask; 259 } 260 261 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 262 { 263 if ((s->usbsts & mask) == 0) { 264 return; 265 } 266 ehci_trace_usbsts(mask, 0); 267 s->usbsts &= ~mask; 268 } 269 270 /* update irq line */ 271 static inline void ehci_update_irq(EHCIState *s) 272 { 273 int level = 0; 274 275 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 276 level = 1; 277 } 278 279 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 280 qemu_set_irq(s->irq, level); 281 } 282 283 /* flag interrupt condition */ 284 static inline void ehci_raise_irq(EHCIState *s, int intr) 285 { 286 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 287 s->usbsts |= intr; 288 ehci_update_irq(s); 289 } else { 290 s->usbsts_pending |= intr; 291 } 292 } 293 294 /* 295 * Commit pending interrupts (added via ehci_raise_irq), 296 * at the rate allowed by "Interrupt Threshold Control". 297 */ 298 static inline void ehci_commit_irq(EHCIState *s) 299 { 300 uint32_t itc; 301 302 if (!s->usbsts_pending) { 303 return; 304 } 305 if (s->usbsts_frindex > s->frindex) { 306 return; 307 } 308 309 itc = (s->usbcmd >> 16) & 0xff; 310 s->usbsts |= s->usbsts_pending; 311 s->usbsts_pending = 0; 312 s->usbsts_frindex = s->frindex + itc; 313 ehci_update_irq(s); 314 } 315 316 static void ehci_update_halt(EHCIState *s) 317 { 318 if (s->usbcmd & USBCMD_RUNSTOP) { 319 ehci_clear_usbsts(s, USBSTS_HALT); 320 } else { 321 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 322 ehci_set_usbsts(s, USBSTS_HALT); 323 } 324 } 325 } 326 327 static void ehci_set_state(EHCIState *s, int async, int state) 328 { 329 if (async) { 330 trace_usb_ehci_state("async", state2str(state)); 331 s->astate = state; 332 if (s->astate == EST_INACTIVE) { 333 ehci_clear_usbsts(s, USBSTS_ASS); 334 ehci_update_halt(s); 335 } else { 336 ehci_set_usbsts(s, USBSTS_ASS); 337 } 338 } else { 339 trace_usb_ehci_state("periodic", state2str(state)); 340 s->pstate = state; 341 if (s->pstate == EST_INACTIVE) { 342 ehci_clear_usbsts(s, USBSTS_PSS); 343 ehci_update_halt(s); 344 } else { 345 ehci_set_usbsts(s, USBSTS_PSS); 346 } 347 } 348 } 349 350 static int ehci_get_state(EHCIState *s, int async) 351 { 352 return async ? s->astate : s->pstate; 353 } 354 355 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 356 { 357 if (async) { 358 s->a_fetch_addr = addr; 359 } else { 360 s->p_fetch_addr = addr; 361 } 362 } 363 364 static int ehci_get_fetch_addr(EHCIState *s, int async) 365 { 366 return async ? s->a_fetch_addr : s->p_fetch_addr; 367 } 368 369 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 370 { 371 /* need three here due to argument count limits */ 372 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 373 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 374 trace_usb_ehci_qh_fields(addr, 375 get_field(qh->epchar, QH_EPCHAR_RL), 376 get_field(qh->epchar, QH_EPCHAR_MPLEN), 377 get_field(qh->epchar, QH_EPCHAR_EPS), 378 get_field(qh->epchar, QH_EPCHAR_EP), 379 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 380 trace_usb_ehci_qh_bits(addr, 381 (bool)(qh->epchar & QH_EPCHAR_C), 382 (bool)(qh->epchar & QH_EPCHAR_H), 383 (bool)(qh->epchar & QH_EPCHAR_DTC), 384 (bool)(qh->epchar & QH_EPCHAR_I)); 385 } 386 387 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 388 { 389 /* need three here due to argument count limits */ 390 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 391 trace_usb_ehci_qtd_fields(addr, 392 get_field(qtd->token, QTD_TOKEN_TBYTES), 393 get_field(qtd->token, QTD_TOKEN_CPAGE), 394 get_field(qtd->token, QTD_TOKEN_CERR), 395 get_field(qtd->token, QTD_TOKEN_PID)); 396 trace_usb_ehci_qtd_bits(addr, 397 (bool)(qtd->token & QTD_TOKEN_IOC), 398 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 399 (bool)(qtd->token & QTD_TOKEN_HALT), 400 (bool)(qtd->token & QTD_TOKEN_BABBLE), 401 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 402 } 403 404 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 405 { 406 trace_usb_ehci_itd(addr, itd->next, 407 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 408 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 409 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 410 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 411 } 412 413 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 414 EHCIsitd *sitd) 415 { 416 trace_usb_ehci_sitd(addr, sitd->next, 417 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 418 } 419 420 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 421 { 422 trace_usb_ehci_guest_bug(message); 423 fprintf(stderr, "ehci warning: %s\n", message); 424 } 425 426 static inline bool ehci_enabled(EHCIState *s) 427 { 428 return s->usbcmd & USBCMD_RUNSTOP; 429 } 430 431 static inline bool ehci_async_enabled(EHCIState *s) 432 { 433 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 434 } 435 436 static inline bool ehci_periodic_enabled(EHCIState *s) 437 { 438 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 439 } 440 441 /* packet management */ 442 443 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 444 { 445 EHCIPacket *p; 446 447 p = g_new0(EHCIPacket, 1); 448 p->queue = q; 449 usb_packet_init(&p->packet); 450 QTAILQ_INSERT_TAIL(&q->packets, p, next); 451 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 452 return p; 453 } 454 455 static void ehci_free_packet(EHCIPacket *p) 456 { 457 if (p->async == EHCI_ASYNC_FINISHED) { 458 EHCIQueue *q = p->queue; 459 int state = ehci_get_state(q->ehci, q->async); 460 /* This is a normal, but rare condition (cancel racing completion) */ 461 fprintf(stderr, "EHCI: Warning packet completed but not processed\n"); 462 ehci_state_executing(q); 463 ehci_state_writeback(q); 464 if (!(q->qh.token & QTD_TOKEN_HALT)) { 465 ehci_state_advqueue(q); 466 } 467 ehci_set_state(q->ehci, q->async, state); 468 /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */ 469 return; 470 } 471 trace_usb_ehci_packet_action(p->queue, p, "free"); 472 if (p->async == EHCI_ASYNC_INITIALIZED) { 473 usb_packet_unmap(&p->packet, &p->sgl); 474 qemu_sglist_destroy(&p->sgl); 475 } 476 if (p->async == EHCI_ASYNC_INFLIGHT) { 477 usb_cancel_packet(&p->packet); 478 usb_packet_unmap(&p->packet, &p->sgl); 479 qemu_sglist_destroy(&p->sgl); 480 } 481 QTAILQ_REMOVE(&p->queue->packets, p, next); 482 usb_packet_cleanup(&p->packet); 483 g_free(p); 484 } 485 486 /* queue management */ 487 488 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 489 { 490 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 491 EHCIQueue *q; 492 493 q = g_malloc0(sizeof(*q)); 494 q->ehci = ehci; 495 q->qhaddr = addr; 496 q->async = async; 497 QTAILQ_INIT(&q->packets); 498 QTAILQ_INSERT_HEAD(head, q, next); 499 trace_usb_ehci_queue_action(q, "alloc"); 500 return q; 501 } 502 503 static int ehci_cancel_queue(EHCIQueue *q) 504 { 505 EHCIPacket *p; 506 int packets = 0; 507 508 p = QTAILQ_FIRST(&q->packets); 509 if (p == NULL) { 510 return 0; 511 } 512 513 trace_usb_ehci_queue_action(q, "cancel"); 514 do { 515 ehci_free_packet(p); 516 packets++; 517 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 518 return packets; 519 } 520 521 static int ehci_reset_queue(EHCIQueue *q) 522 { 523 int packets; 524 525 trace_usb_ehci_queue_action(q, "reset"); 526 packets = ehci_cancel_queue(q); 527 q->dev = NULL; 528 q->qtdaddr = 0; 529 return packets; 530 } 531 532 static void ehci_free_queue(EHCIQueue *q, const char *warn) 533 { 534 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 535 int cancelled; 536 537 trace_usb_ehci_queue_action(q, "free"); 538 cancelled = ehci_cancel_queue(q); 539 if (warn && cancelled > 0) { 540 ehci_trace_guest_bug(q->ehci, warn); 541 } 542 QTAILQ_REMOVE(head, q, next); 543 g_free(q); 544 } 545 546 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 547 int async) 548 { 549 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 550 EHCIQueue *q; 551 552 QTAILQ_FOREACH(q, head, next) { 553 if (addr == q->qhaddr) { 554 return q; 555 } 556 } 557 return NULL; 558 } 559 560 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 561 { 562 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 563 const char *warn = async ? "guest unlinked busy QH" : NULL; 564 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 565 EHCIQueue *q, *tmp; 566 567 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 568 if (q->seen) { 569 q->seen = 0; 570 q->ts = ehci->last_run_ns; 571 continue; 572 } 573 if (ehci->last_run_ns < q->ts + maxage) { 574 continue; 575 } 576 ehci_free_queue(q, warn); 577 } 578 } 579 580 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 581 { 582 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 583 EHCIQueue *q, *tmp; 584 585 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 586 if (!q->seen) { 587 ehci_free_queue(q, NULL); 588 } 589 } 590 } 591 592 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 593 { 594 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 595 EHCIQueue *q, *tmp; 596 597 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 598 if (q->dev != dev) { 599 continue; 600 } 601 ehci_free_queue(q, NULL); 602 } 603 } 604 605 static void ehci_queues_rip_all(EHCIState *ehci, int async) 606 { 607 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 608 const char *warn = async ? "guest stopped busy async schedule" : NULL; 609 EHCIQueue *q, *tmp; 610 611 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 612 ehci_free_queue(q, warn); 613 } 614 } 615 616 /* Attach or detach a device on root hub */ 617 618 static void ehci_attach(USBPort *port) 619 { 620 EHCIState *s = port->opaque; 621 uint32_t *portsc = &s->portsc[port->index]; 622 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 623 624 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 625 626 if (*portsc & PORTSC_POWNER) { 627 USBPort *companion = s->companion_ports[port->index]; 628 companion->dev = port->dev; 629 companion->ops->attach(companion); 630 return; 631 } 632 633 *portsc |= PORTSC_CONNECT; 634 *portsc |= PORTSC_CSC; 635 636 ehci_raise_irq(s, USBSTS_PCD); 637 ehci_commit_irq(s); 638 } 639 640 static void ehci_detach(USBPort *port) 641 { 642 EHCIState *s = port->opaque; 643 uint32_t *portsc = &s->portsc[port->index]; 644 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 645 646 trace_usb_ehci_port_detach(port->index, owner); 647 648 if (*portsc & PORTSC_POWNER) { 649 USBPort *companion = s->companion_ports[port->index]; 650 companion->ops->detach(companion); 651 companion->dev = NULL; 652 /* 653 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 654 * the port ownership is returned immediately to the EHCI controller." 655 */ 656 *portsc &= ~PORTSC_POWNER; 657 return; 658 } 659 660 ehci_queues_rip_device(s, port->dev, 0); 661 ehci_queues_rip_device(s, port->dev, 1); 662 663 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED); 664 *portsc |= PORTSC_CSC; 665 666 ehci_raise_irq(s, USBSTS_PCD); 667 ehci_commit_irq(s); 668 } 669 670 static void ehci_child_detach(USBPort *port, USBDevice *child) 671 { 672 EHCIState *s = port->opaque; 673 uint32_t portsc = s->portsc[port->index]; 674 675 if (portsc & PORTSC_POWNER) { 676 USBPort *companion = s->companion_ports[port->index]; 677 companion->ops->child_detach(companion, child); 678 return; 679 } 680 681 ehci_queues_rip_device(s, child, 0); 682 ehci_queues_rip_device(s, child, 1); 683 } 684 685 static void ehci_wakeup(USBPort *port) 686 { 687 EHCIState *s = port->opaque; 688 uint32_t portsc = s->portsc[port->index]; 689 690 if (portsc & PORTSC_POWNER) { 691 USBPort *companion = s->companion_ports[port->index]; 692 if (companion->ops->wakeup) { 693 companion->ops->wakeup(companion); 694 } 695 return; 696 } 697 698 qemu_bh_schedule(s->async_bh); 699 } 700 701 static int ehci_register_companion(USBBus *bus, USBPort *ports[], 702 uint32_t portcount, uint32_t firstport) 703 { 704 EHCIState *s = container_of(bus, EHCIState, bus); 705 uint32_t i; 706 707 if (firstport + portcount > NB_PORTS) { 708 qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport", 709 "firstport on masterbus"); 710 error_printf_unless_qmp( 711 "firstport value of %u makes companion take ports %u - %u, which " 712 "is outside of the valid range of 0 - %u\n", firstport, firstport, 713 firstport + portcount - 1, NB_PORTS - 1); 714 return -1; 715 } 716 717 for (i = 0; i < portcount; i++) { 718 if (s->companion_ports[firstport + i]) { 719 qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus", 720 "an USB masterbus"); 721 error_printf_unless_qmp( 722 "port %u on masterbus %s already has a companion assigned\n", 723 firstport + i, bus->qbus.name); 724 return -1; 725 } 726 } 727 728 for (i = 0; i < portcount; i++) { 729 s->companion_ports[firstport + i] = ports[i]; 730 s->ports[firstport + i].speedmask |= 731 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 732 /* Ensure devs attached before the initial reset go to the companion */ 733 s->portsc[firstport + i] = PORTSC_POWNER; 734 } 735 736 s->companion_count++; 737 s->caps[0x05] = (s->companion_count << 4) | portcount; 738 739 return 0; 740 } 741 742 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep) 743 { 744 EHCIState *s = container_of(bus, EHCIState, bus); 745 uint32_t portsc = s->portsc[ep->dev->port->index]; 746 747 if (portsc & PORTSC_POWNER) { 748 return; 749 } 750 751 s->periodic_sched_active = PERIODIC_ACTIVE; 752 qemu_bh_schedule(s->async_bh); 753 } 754 755 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 756 { 757 USBDevice *dev; 758 USBPort *port; 759 int i; 760 761 for (i = 0; i < NB_PORTS; i++) { 762 port = &ehci->ports[i]; 763 if (!(ehci->portsc[i] & PORTSC_PED)) { 764 DPRINTF("Port %d not enabled\n", i); 765 continue; 766 } 767 dev = usb_find_device(port, addr); 768 if (dev != NULL) { 769 return dev; 770 } 771 } 772 return NULL; 773 } 774 775 /* 4.1 host controller initialization */ 776 static void ehci_reset(void *opaque) 777 { 778 EHCIState *s = opaque; 779 int i; 780 USBDevice *devs[NB_PORTS]; 781 782 trace_usb_ehci_reset(); 783 784 /* 785 * Do the detach before touching portsc, so that it correctly gets send to 786 * us or to our companion based on PORTSC_POWNER before the reset. 787 */ 788 for(i = 0; i < NB_PORTS; i++) { 789 devs[i] = s->ports[i].dev; 790 if (devs[i] && devs[i]->attached) { 791 usb_detach(&s->ports[i]); 792 } 793 } 794 795 memset(&s->opreg, 0x00, sizeof(s->opreg)); 796 memset(&s->portsc, 0x00, sizeof(s->portsc)); 797 798 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 799 s->usbsts = USBSTS_HALT; 800 s->usbsts_pending = 0; 801 s->usbsts_frindex = 0; 802 803 s->astate = EST_INACTIVE; 804 s->pstate = EST_INACTIVE; 805 806 for(i = 0; i < NB_PORTS; i++) { 807 if (s->companion_ports[i]) { 808 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 809 } else { 810 s->portsc[i] = PORTSC_PPOWER; 811 } 812 if (devs[i] && devs[i]->attached) { 813 usb_attach(&s->ports[i]); 814 usb_device_reset(devs[i]); 815 } 816 } 817 ehci_queues_rip_all(s, 0); 818 ehci_queues_rip_all(s, 1); 819 qemu_del_timer(s->frame_timer); 820 qemu_bh_cancel(s->async_bh); 821 } 822 823 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 824 unsigned size) 825 { 826 EHCIState *s = ptr; 827 return s->caps[addr]; 828 } 829 830 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 831 unsigned size) 832 { 833 EHCIState *s = ptr; 834 uint32_t val; 835 836 val = s->opreg[addr >> 2]; 837 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 838 return val; 839 } 840 841 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 842 unsigned size) 843 { 844 EHCIState *s = ptr; 845 uint32_t val; 846 847 val = s->portsc[addr >> 2]; 848 trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val); 849 return val; 850 } 851 852 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 853 { 854 USBDevice *dev = s->ports[port].dev; 855 uint32_t *portsc = &s->portsc[port]; 856 uint32_t orig; 857 858 if (s->companion_ports[port] == NULL) 859 return; 860 861 owner = owner & PORTSC_POWNER; 862 orig = *portsc & PORTSC_POWNER; 863 864 if (!(owner ^ orig)) { 865 return; 866 } 867 868 if (dev && dev->attached) { 869 usb_detach(&s->ports[port]); 870 } 871 872 *portsc &= ~PORTSC_POWNER; 873 *portsc |= owner; 874 875 if (dev && dev->attached) { 876 usb_attach(&s->ports[port]); 877 } 878 } 879 880 static void ehci_port_write(void *ptr, hwaddr addr, 881 uint64_t val, unsigned size) 882 { 883 EHCIState *s = ptr; 884 int port = addr >> 2; 885 uint32_t *portsc = &s->portsc[port]; 886 uint32_t old = *portsc; 887 USBDevice *dev = s->ports[port].dev; 888 889 trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val); 890 891 /* Clear rwc bits */ 892 *portsc &= ~(val & PORTSC_RWC_MASK); 893 /* The guest may clear, but not set the PED bit */ 894 *portsc &= val | ~PORTSC_PED; 895 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 896 handle_port_owner_write(s, port, val); 897 /* And finally apply RO_MASK */ 898 val &= PORTSC_RO_MASK; 899 900 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 901 trace_usb_ehci_port_reset(port, 1); 902 } 903 904 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 905 trace_usb_ehci_port_reset(port, 0); 906 if (dev && dev->attached) { 907 usb_port_reset(&s->ports[port]); 908 *portsc &= ~PORTSC_CSC; 909 } 910 911 /* 912 * Table 2.16 Set the enable bit(and enable bit change) to indicate 913 * to SW that this port has a high speed device attached 914 */ 915 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 916 val |= PORTSC_PED; 917 } 918 } 919 920 *portsc &= ~PORTSC_RO_MASK; 921 *portsc |= val; 922 trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old); 923 } 924 925 static void ehci_opreg_write(void *ptr, hwaddr addr, 926 uint64_t val, unsigned size) 927 { 928 EHCIState *s = ptr; 929 uint32_t *mmio = s->opreg + (addr >> 2); 930 uint32_t old = *mmio; 931 int i; 932 933 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 934 935 switch (addr) { 936 case USBCMD: 937 if (val & USBCMD_HCRESET) { 938 ehci_reset(s); 939 val = s->usbcmd; 940 break; 941 } 942 943 /* not supporting dynamic frame list size at the moment */ 944 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 945 fprintf(stderr, "attempt to set frame list size -- value %d\n", 946 (int)val & USBCMD_FLS); 947 val &= ~USBCMD_FLS; 948 } 949 950 if (val & USBCMD_IAAD) { 951 /* 952 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 953 * trigger and re-use a qh without us seeing the unlink. 954 */ 955 s->async_stepdown = 0; 956 qemu_bh_schedule(s->async_bh); 957 trace_usb_ehci_doorbell_ring(); 958 } 959 960 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 961 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 962 if (s->pstate == EST_INACTIVE) { 963 SET_LAST_RUN_CLOCK(s); 964 } 965 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 966 ehci_update_halt(s); 967 s->async_stepdown = 0; 968 qemu_bh_schedule(s->async_bh); 969 } 970 break; 971 972 case USBSTS: 973 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 974 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 975 val = s->usbsts; 976 ehci_update_irq(s); 977 break; 978 979 case USBINTR: 980 val &= USBINTR_MASK; 981 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 982 qemu_bh_schedule(s->async_bh); 983 } 984 break; 985 986 case FRINDEX: 987 val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */ 988 break; 989 990 case CONFIGFLAG: 991 val &= 0x1; 992 if (val) { 993 for(i = 0; i < NB_PORTS; i++) 994 handle_port_owner_write(s, i, 0); 995 } 996 break; 997 998 case PERIODICLISTBASE: 999 if (ehci_periodic_enabled(s)) { 1000 fprintf(stderr, 1001 "ehci: PERIODIC list base register set while periodic schedule\n" 1002 " is enabled and HC is enabled\n"); 1003 } 1004 break; 1005 1006 case ASYNCLISTADDR: 1007 if (ehci_async_enabled(s)) { 1008 fprintf(stderr, 1009 "ehci: ASYNC list address register set while async schedule\n" 1010 " is enabled and HC is enabled\n"); 1011 } 1012 break; 1013 } 1014 1015 *mmio = val; 1016 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1017 *mmio, old); 1018 } 1019 1020 /* Get an array of dwords from main memory */ 1021 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 1022 uint32_t *buf, int num) 1023 { 1024 int i; 1025 1026 if (!ehci->dma) { 1027 ehci_raise_irq(ehci, USBSTS_HSE); 1028 ehci->usbcmd &= ~USBCMD_RUNSTOP; 1029 trace_usb_ehci_dma_error(); 1030 return -1; 1031 } 1032 1033 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 1034 dma_memory_read(ehci->dma, addr, buf, sizeof(*buf)); 1035 *buf = le32_to_cpu(*buf); 1036 } 1037 1038 return num; 1039 } 1040 1041 /* Put an array of dwords in to main memory */ 1042 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 1043 uint32_t *buf, int num) 1044 { 1045 int i; 1046 1047 if (!ehci->dma) { 1048 ehci_raise_irq(ehci, USBSTS_HSE); 1049 ehci->usbcmd &= ~USBCMD_RUNSTOP; 1050 trace_usb_ehci_dma_error(); 1051 return -1; 1052 } 1053 1054 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 1055 uint32_t tmp = cpu_to_le32(*buf); 1056 dma_memory_write(ehci->dma, addr, &tmp, sizeof(tmp)); 1057 } 1058 1059 return num; 1060 } 1061 1062 /* 1063 * Write the qh back to guest physical memory. This step isn't 1064 * in the EHCI spec but we need to do it since we don't share 1065 * physical memory with our guest VM. 1066 * 1067 * The first three dwords are read-only for the EHCI, so skip them 1068 * when writing back the qh. 1069 */ 1070 static void ehci_flush_qh(EHCIQueue *q) 1071 { 1072 uint32_t *qh = (uint32_t *) &q->qh; 1073 uint32_t dwords = sizeof(EHCIqh) >> 2; 1074 uint32_t addr = NLPTR_GET(q->qhaddr); 1075 1076 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1077 } 1078 1079 // 4.10.2 1080 1081 static int ehci_qh_do_overlay(EHCIQueue *q) 1082 { 1083 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1084 int i; 1085 int dtoggle; 1086 int ping; 1087 int eps; 1088 int reload; 1089 1090 assert(p != NULL); 1091 assert(p->qtdaddr == q->qtdaddr); 1092 1093 // remember values in fields to preserve in qh after overlay 1094 1095 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1096 ping = q->qh.token & QTD_TOKEN_PING; 1097 1098 q->qh.current_qtd = p->qtdaddr; 1099 q->qh.next_qtd = p->qtd.next; 1100 q->qh.altnext_qtd = p->qtd.altnext; 1101 q->qh.token = p->qtd.token; 1102 1103 1104 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1105 if (eps == EHCI_QH_EPS_HIGH) { 1106 q->qh.token &= ~QTD_TOKEN_PING; 1107 q->qh.token |= ping; 1108 } 1109 1110 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1111 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1112 1113 for (i = 0; i < 5; i++) { 1114 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1115 } 1116 1117 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1118 // preserve QH DT bit 1119 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1120 q->qh.token |= dtoggle; 1121 } 1122 1123 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1124 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1125 1126 ehci_flush_qh(q); 1127 1128 return 0; 1129 } 1130 1131 static int ehci_init_transfer(EHCIPacket *p) 1132 { 1133 uint32_t cpage, offset, bytes, plen; 1134 dma_addr_t page; 1135 1136 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1137 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1138 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1139 qemu_sglist_init(&p->sgl, 5, p->queue->ehci->dma); 1140 1141 while (bytes > 0) { 1142 if (cpage > 4) { 1143 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1144 return -1; 1145 } 1146 1147 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1148 page += offset; 1149 plen = bytes; 1150 if (plen > 4096 - offset) { 1151 plen = 4096 - offset; 1152 offset = 0; 1153 cpage++; 1154 } 1155 1156 qemu_sglist_add(&p->sgl, page, plen); 1157 bytes -= plen; 1158 } 1159 return 0; 1160 } 1161 1162 static void ehci_finish_transfer(EHCIQueue *q, int len) 1163 { 1164 uint32_t cpage, offset; 1165 1166 if (len > 0) { 1167 /* update cpage & offset */ 1168 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1169 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1170 1171 offset += len; 1172 cpage += offset >> QTD_BUFPTR_SH; 1173 offset &= ~QTD_BUFPTR_MASK; 1174 1175 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1176 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1177 q->qh.bufptr[0] |= offset; 1178 } 1179 } 1180 1181 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1182 { 1183 EHCIPacket *p; 1184 EHCIState *s = port->opaque; 1185 uint32_t portsc = s->portsc[port->index]; 1186 1187 if (portsc & PORTSC_POWNER) { 1188 USBPort *companion = s->companion_ports[port->index]; 1189 companion->ops->complete(companion, packet); 1190 return; 1191 } 1192 1193 p = container_of(packet, EHCIPacket, packet); 1194 assert(p->async == EHCI_ASYNC_INFLIGHT); 1195 1196 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1197 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1198 ehci_free_packet(p); 1199 return; 1200 } 1201 1202 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1203 p->async = EHCI_ASYNC_FINISHED; 1204 1205 if (!p->queue->async) { 1206 s->periodic_sched_active = PERIODIC_ACTIVE; 1207 } 1208 qemu_bh_schedule(s->async_bh); 1209 } 1210 1211 static void ehci_execute_complete(EHCIQueue *q) 1212 { 1213 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1214 uint32_t tbytes; 1215 1216 assert(p != NULL); 1217 assert(p->qtdaddr == q->qtdaddr); 1218 assert(p->async == EHCI_ASYNC_INITIALIZED || 1219 p->async == EHCI_ASYNC_FINISHED); 1220 1221 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1222 "status %d, actual_length %d\n", 1223 q->qhaddr, q->qh.next, q->qtdaddr, 1224 p->packet.status, p->packet.actual_length); 1225 1226 switch (p->packet.status) { 1227 case USB_RET_SUCCESS: 1228 break; 1229 case USB_RET_IOERROR: 1230 case USB_RET_NODEV: 1231 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1232 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1233 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1234 break; 1235 case USB_RET_STALL: 1236 q->qh.token |= QTD_TOKEN_HALT; 1237 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1238 break; 1239 case USB_RET_NAK: 1240 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1241 return; /* We're not done yet with this transaction */ 1242 case USB_RET_BABBLE: 1243 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1244 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1245 break; 1246 default: 1247 /* should not be triggerable */ 1248 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1249 assert(0); 1250 break; 1251 } 1252 1253 /* TODO check 4.12 for splits */ 1254 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1255 if (tbytes && p->pid == USB_TOKEN_IN) { 1256 tbytes -= p->packet.actual_length; 1257 if (tbytes) { 1258 /* 4.15.1.2 must raise int on a short input packet */ 1259 ehci_raise_irq(q->ehci, USBSTS_INT); 1260 } 1261 } else { 1262 tbytes = 0; 1263 } 1264 DPRINTF("updating tbytes to %d\n", tbytes); 1265 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1266 1267 ehci_finish_transfer(q, p->packet.actual_length); 1268 usb_packet_unmap(&p->packet, &p->sgl); 1269 qemu_sglist_destroy(&p->sgl); 1270 p->async = EHCI_ASYNC_NONE; 1271 1272 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1273 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1274 1275 if (q->qh.token & QTD_TOKEN_IOC) { 1276 ehci_raise_irq(q->ehci, USBSTS_INT); 1277 if (q->async) { 1278 q->ehci->int_req_by_async = true; 1279 } 1280 } 1281 } 1282 1283 /* 4.10.3 returns "again" */ 1284 static int ehci_execute(EHCIPacket *p, const char *action) 1285 { 1286 USBEndpoint *ep; 1287 int endp; 1288 bool spd; 1289 1290 assert(p->async == EHCI_ASYNC_NONE || 1291 p->async == EHCI_ASYNC_INITIALIZED); 1292 1293 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1294 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1295 return -1; 1296 } 1297 1298 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1299 ehci_trace_guest_bug(p->queue->ehci, 1300 "guest requested more bytes than allowed"); 1301 return -1; 1302 } 1303 1304 p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH; 1305 switch (p->pid) { 1306 case 0: 1307 p->pid = USB_TOKEN_OUT; 1308 break; 1309 case 1: 1310 p->pid = USB_TOKEN_IN; 1311 break; 1312 case 2: 1313 p->pid = USB_TOKEN_SETUP; 1314 break; 1315 default: 1316 fprintf(stderr, "bad token\n"); 1317 break; 1318 } 1319 1320 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1321 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1322 1323 if (p->async == EHCI_ASYNC_NONE) { 1324 if (ehci_init_transfer(p) != 0) { 1325 return -1; 1326 } 1327 1328 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1329 usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr, spd, 1330 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1331 usb_packet_map(&p->packet, &p->sgl); 1332 p->async = EHCI_ASYNC_INITIALIZED; 1333 } 1334 1335 trace_usb_ehci_packet_action(p->queue, p, action); 1336 usb_handle_packet(p->queue->dev, &p->packet); 1337 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1338 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1339 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1340 p->packet.actual_length); 1341 1342 if (p->packet.actual_length > BUFF_SIZE) { 1343 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1344 return -1; 1345 } 1346 1347 return 1; 1348 } 1349 1350 /* 4.7.2 1351 */ 1352 1353 static int ehci_process_itd(EHCIState *ehci, 1354 EHCIitd *itd, 1355 uint32_t addr) 1356 { 1357 USBDevice *dev; 1358 USBEndpoint *ep; 1359 uint32_t i, len, pid, dir, devaddr, endp; 1360 uint32_t pg, off, ptr1, ptr2, max, mult; 1361 1362 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1363 1364 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1365 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1366 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1367 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1368 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1369 1370 for(i = 0; i < 8; i++) { 1371 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1372 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1373 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1374 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1375 ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK); 1376 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1377 1378 if (len > max * mult) { 1379 len = max * mult; 1380 } 1381 1382 if (len > BUFF_SIZE) { 1383 return -1; 1384 } 1385 1386 qemu_sglist_init(&ehci->isgl, 2, ehci->dma); 1387 if (off + len > 4096) { 1388 /* transfer crosses page border */ 1389 uint32_t len2 = off + len - 4096; 1390 uint32_t len1 = len - len2; 1391 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1392 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1393 } else { 1394 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1395 } 1396 1397 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1398 1399 dev = ehci_find_device(ehci, devaddr); 1400 ep = usb_ep_get(dev, pid, endp); 1401 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1402 usb_packet_setup(&ehci->ipacket, pid, ep, addr, false, 1403 (itd->transact[i] & ITD_XACT_IOC) != 0); 1404 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1405 usb_handle_packet(dev, &ehci->ipacket); 1406 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1407 } else { 1408 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1409 ehci->ipacket.status = USB_RET_NAK; 1410 ehci->ipacket.actual_length = 0; 1411 } 1412 qemu_sglist_destroy(&ehci->isgl); 1413 1414 switch (ehci->ipacket.status) { 1415 case USB_RET_SUCCESS: 1416 break; 1417 default: 1418 fprintf(stderr, "Unexpected iso usb result: %d\n", 1419 ehci->ipacket.status); 1420 /* Fall through */ 1421 case USB_RET_IOERROR: 1422 case USB_RET_NODEV: 1423 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1424 if (dir) { 1425 itd->transact[i] |= ITD_XACT_XACTERR; 1426 ehci_raise_irq(ehci, USBSTS_ERRINT); 1427 } 1428 break; 1429 case USB_RET_BABBLE: 1430 itd->transact[i] |= ITD_XACT_BABBLE; 1431 ehci_raise_irq(ehci, USBSTS_ERRINT); 1432 break; 1433 case USB_RET_NAK: 1434 /* no data for us, so do a zero-length transfer */ 1435 ehci->ipacket.actual_length = 0; 1436 break; 1437 } 1438 if (!dir) { 1439 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1440 ITD_XACT_LENGTH); /* OUT */ 1441 } else { 1442 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1443 ITD_XACT_LENGTH); /* IN */ 1444 } 1445 if (itd->transact[i] & ITD_XACT_IOC) { 1446 ehci_raise_irq(ehci, USBSTS_INT); 1447 } 1448 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1449 } 1450 } 1451 return 0; 1452 } 1453 1454 1455 /* This state is the entry point for asynchronous schedule 1456 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1457 */ 1458 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1459 { 1460 EHCIqh qh; 1461 int i = 0; 1462 int again = 0; 1463 uint32_t entry = ehci->asynclistaddr; 1464 1465 /* set reclamation flag at start event (4.8.6) */ 1466 if (async) { 1467 ehci_set_usbsts(ehci, USBSTS_REC); 1468 } 1469 1470 ehci_queues_rip_unused(ehci, async); 1471 1472 /* Find the head of the list (4.9.1.1) */ 1473 for(i = 0; i < MAX_QH; i++) { 1474 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1475 sizeof(EHCIqh) >> 2) < 0) { 1476 return 0; 1477 } 1478 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1479 1480 if (qh.epchar & QH_EPCHAR_H) { 1481 if (async) { 1482 entry |= (NLPTR_TYPE_QH << 1); 1483 } 1484 1485 ehci_set_fetch_addr(ehci, async, entry); 1486 ehci_set_state(ehci, async, EST_FETCHENTRY); 1487 again = 1; 1488 goto out; 1489 } 1490 1491 entry = qh.next; 1492 if (entry == ehci->asynclistaddr) { 1493 break; 1494 } 1495 } 1496 1497 /* no head found for list. */ 1498 1499 ehci_set_state(ehci, async, EST_ACTIVE); 1500 1501 out: 1502 return again; 1503 } 1504 1505 1506 /* This state is the entry point for periodic schedule processing as 1507 * well as being a continuation state for async processing. 1508 */ 1509 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1510 { 1511 int again = 0; 1512 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1513 1514 if (NLPTR_TBIT(entry)) { 1515 ehci_set_state(ehci, async, EST_ACTIVE); 1516 goto out; 1517 } 1518 1519 /* section 4.8, only QH in async schedule */ 1520 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1521 fprintf(stderr, "non queue head request in async schedule\n"); 1522 return -1; 1523 } 1524 1525 switch (NLPTR_TYPE_GET(entry)) { 1526 case NLPTR_TYPE_QH: 1527 ehci_set_state(ehci, async, EST_FETCHQH); 1528 again = 1; 1529 break; 1530 1531 case NLPTR_TYPE_ITD: 1532 ehci_set_state(ehci, async, EST_FETCHITD); 1533 again = 1; 1534 break; 1535 1536 case NLPTR_TYPE_STITD: 1537 ehci_set_state(ehci, async, EST_FETCHSITD); 1538 again = 1; 1539 break; 1540 1541 default: 1542 /* TODO: handle FSTN type */ 1543 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1544 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1545 return -1; 1546 } 1547 1548 out: 1549 return again; 1550 } 1551 1552 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1553 { 1554 EHCIPacket *p; 1555 uint32_t entry, devaddr, endp; 1556 EHCIQueue *q; 1557 EHCIqh qh; 1558 1559 entry = ehci_get_fetch_addr(ehci, async); 1560 q = ehci_find_queue_by_qh(ehci, entry, async); 1561 if (NULL == q) { 1562 q = ehci_alloc_queue(ehci, entry, async); 1563 } 1564 p = QTAILQ_FIRST(&q->packets); 1565 1566 q->seen++; 1567 if (q->seen > 1) { 1568 /* we are going in circles -- stop processing */ 1569 ehci_set_state(ehci, async, EST_ACTIVE); 1570 q = NULL; 1571 goto out; 1572 } 1573 1574 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1575 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1576 q = NULL; 1577 goto out; 1578 } 1579 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1580 1581 /* 1582 * The overlay area of the qh should never be changed by the guest, 1583 * except when idle, in which case the reset is a nop. 1584 */ 1585 devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR); 1586 endp = get_field(qh.epchar, QH_EPCHAR_EP); 1587 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 1588 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 1589 (qh.current_qtd != q->qh.current_qtd) || 1590 (q->async && qh.next_qtd != q->qh.next_qtd) || 1591 (memcmp(&qh.altnext_qtd, &q->qh.altnext_qtd, 1592 7 * sizeof(uint32_t)) != 0) || 1593 (q->dev != NULL && q->dev->addr != devaddr)) { 1594 if (ehci_reset_queue(q) > 0) { 1595 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1596 } 1597 p = NULL; 1598 } 1599 q->qh = qh; 1600 1601 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1602 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1603 q->transact_ctr = 4; 1604 } 1605 1606 if (q->dev == NULL) { 1607 q->dev = ehci_find_device(q->ehci, devaddr); 1608 } 1609 1610 if (p && p->async == EHCI_ASYNC_FINISHED) { 1611 /* I/O finished -- continue processing queue */ 1612 trace_usb_ehci_packet_action(p->queue, p, "complete"); 1613 ehci_set_state(ehci, async, EST_EXECUTING); 1614 goto out; 1615 } 1616 1617 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1618 1619 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1620 if (ehci->usbsts & USBSTS_REC) { 1621 ehci_clear_usbsts(ehci, USBSTS_REC); 1622 } else { 1623 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1624 " - done processing\n", q->qhaddr); 1625 ehci_set_state(ehci, async, EST_ACTIVE); 1626 q = NULL; 1627 goto out; 1628 } 1629 } 1630 1631 #if EHCI_DEBUG 1632 if (q->qhaddr != q->qh.next) { 1633 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1634 q->qhaddr, 1635 q->qh.epchar & QH_EPCHAR_H, 1636 q->qh.token & QTD_TOKEN_HALT, 1637 q->qh.token & QTD_TOKEN_ACTIVE, 1638 q->qh.next); 1639 } 1640 #endif 1641 1642 if (q->qh.token & QTD_TOKEN_HALT) { 1643 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1644 1645 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1646 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1647 q->qtdaddr = q->qh.current_qtd; 1648 ehci_set_state(ehci, async, EST_FETCHQTD); 1649 1650 } else { 1651 /* EHCI spec version 1.0 Section 4.10.2 */ 1652 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1653 } 1654 1655 out: 1656 return q; 1657 } 1658 1659 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1660 { 1661 uint32_t entry; 1662 EHCIitd itd; 1663 1664 assert(!async); 1665 entry = ehci_get_fetch_addr(ehci, async); 1666 1667 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1668 sizeof(EHCIitd) >> 2) < 0) { 1669 return -1; 1670 } 1671 ehci_trace_itd(ehci, entry, &itd); 1672 1673 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1674 return -1; 1675 } 1676 1677 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1678 sizeof(EHCIitd) >> 2); 1679 ehci_set_fetch_addr(ehci, async, itd.next); 1680 ehci_set_state(ehci, async, EST_FETCHENTRY); 1681 1682 return 1; 1683 } 1684 1685 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1686 { 1687 uint32_t entry; 1688 EHCIsitd sitd; 1689 1690 assert(!async); 1691 entry = ehci_get_fetch_addr(ehci, async); 1692 1693 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1694 sizeof(EHCIsitd) >> 2) < 0) { 1695 return 0; 1696 } 1697 ehci_trace_sitd(ehci, entry, &sitd); 1698 1699 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1700 /* siTD is not active, nothing to do */; 1701 } else { 1702 /* TODO: split transfers are not implemented */ 1703 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1704 } 1705 1706 ehci_set_fetch_addr(ehci, async, sitd.next); 1707 ehci_set_state(ehci, async, EST_FETCHENTRY); 1708 return 1; 1709 } 1710 1711 /* Section 4.10.2 - paragraph 3 */ 1712 static int ehci_state_advqueue(EHCIQueue *q) 1713 { 1714 #if 0 1715 /* TO-DO: 4.10.2 - paragraph 2 1716 * if I-bit is set to 1 and QH is not active 1717 * go to horizontal QH 1718 */ 1719 if (I-bit set) { 1720 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1721 goto out; 1722 } 1723 #endif 1724 1725 /* 1726 * want data and alt-next qTD is valid 1727 */ 1728 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1729 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1730 q->qtdaddr = q->qh.altnext_qtd; 1731 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1732 1733 /* 1734 * next qTD is valid 1735 */ 1736 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1737 q->qtdaddr = q->qh.next_qtd; 1738 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1739 1740 /* 1741 * no valid qTD, try next QH 1742 */ 1743 } else { 1744 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1745 } 1746 1747 return 1; 1748 } 1749 1750 /* Section 4.10.2 - paragraph 4 */ 1751 static int ehci_state_fetchqtd(EHCIQueue *q) 1752 { 1753 EHCIqtd qtd; 1754 EHCIPacket *p; 1755 int again = 1; 1756 1757 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1758 sizeof(EHCIqtd) >> 2) < 0) { 1759 return 0; 1760 } 1761 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1762 1763 p = QTAILQ_FIRST(&q->packets); 1764 if (p != NULL) { 1765 if (p->qtdaddr != q->qtdaddr || 1766 (q->async && !NLPTR_TBIT(p->qtd.next) && 1767 (p->qtd.next != qtd.next)) || 1768 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) || 1769 p->qtd.bufptr[0] != qtd.bufptr[0]) { 1770 ehci_cancel_queue(q); 1771 ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD"); 1772 p = NULL; 1773 } else { 1774 p->qtd = qtd; 1775 ehci_qh_do_overlay(q); 1776 } 1777 } 1778 1779 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1780 if (p != NULL) { 1781 /* transfer canceled by guest (clear active) */ 1782 ehci_cancel_queue(q); 1783 p = NULL; 1784 } 1785 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1786 } else if (p != NULL) { 1787 switch (p->async) { 1788 case EHCI_ASYNC_NONE: 1789 case EHCI_ASYNC_INITIALIZED: 1790 /* Not yet executed (MULT), or previously nacked (int) packet */ 1791 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1792 break; 1793 case EHCI_ASYNC_INFLIGHT: 1794 /* Check if the guest has added new tds to the queue */ 1795 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1796 /* Unfinished async handled packet, go horizontal */ 1797 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1798 break; 1799 case EHCI_ASYNC_FINISHED: 1800 /* 1801 * We get here when advqueue moves to a packet which is already 1802 * finished, which can happen with packets queued up by fill_queue 1803 */ 1804 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1805 break; 1806 } 1807 } else { 1808 p = ehci_alloc_packet(q); 1809 p->qtdaddr = q->qtdaddr; 1810 p->qtd = qtd; 1811 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1812 } 1813 1814 return again; 1815 } 1816 1817 static int ehci_state_horizqh(EHCIQueue *q) 1818 { 1819 int again = 0; 1820 1821 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1822 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1823 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1824 again = 1; 1825 } else { 1826 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1827 } 1828 1829 return again; 1830 } 1831 1832 /* Returns "again" */ 1833 static int ehci_fill_queue(EHCIPacket *p) 1834 { 1835 USBEndpoint *ep = p->packet.ep; 1836 EHCIQueue *q = p->queue; 1837 EHCIqtd qtd = p->qtd; 1838 uint32_t qtdaddr; 1839 1840 for (;;) { 1841 if (NLPTR_TBIT(qtd.next) != 0) { 1842 break; 1843 } 1844 qtdaddr = qtd.next; 1845 /* 1846 * Detect circular td lists, Windows creates these, counting on the 1847 * active bit going low after execution to make the queue stop. 1848 */ 1849 QTAILQ_FOREACH(p, &q->packets, next) { 1850 if (p->qtdaddr == qtdaddr) { 1851 goto leave; 1852 } 1853 } 1854 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1855 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1856 return -1; 1857 } 1858 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1859 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1860 break; 1861 } 1862 p = ehci_alloc_packet(q); 1863 p->qtdaddr = qtdaddr; 1864 p->qtd = qtd; 1865 if (ehci_execute(p, "queue") == -1) { 1866 return -1; 1867 } 1868 assert(p->packet.status == USB_RET_ASYNC); 1869 p->async = EHCI_ASYNC_INFLIGHT; 1870 } 1871 leave: 1872 usb_device_flush_ep_queue(ep->dev, ep); 1873 return 1; 1874 } 1875 1876 static int ehci_state_execute(EHCIQueue *q) 1877 { 1878 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1879 int again = 0; 1880 1881 assert(p != NULL); 1882 assert(p->qtdaddr == q->qtdaddr); 1883 1884 if (ehci_qh_do_overlay(q) != 0) { 1885 return -1; 1886 } 1887 1888 // TODO verify enough time remains in the uframe as in 4.4.1.1 1889 // TODO write back ptr to async list when done or out of time 1890 1891 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1892 if (!q->async && q->transact_ctr == 0) { 1893 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1894 again = 1; 1895 goto out; 1896 } 1897 1898 if (q->async) { 1899 ehci_set_usbsts(q->ehci, USBSTS_REC); 1900 } 1901 1902 again = ehci_execute(p, "process"); 1903 if (again == -1) { 1904 goto out; 1905 } 1906 if (p->packet.status == USB_RET_ASYNC) { 1907 ehci_flush_qh(q); 1908 trace_usb_ehci_packet_action(p->queue, p, "async"); 1909 p->async = EHCI_ASYNC_INFLIGHT; 1910 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1911 if (q->async) { 1912 again = ehci_fill_queue(p); 1913 } else { 1914 again = 1; 1915 } 1916 goto out; 1917 } 1918 1919 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1920 again = 1; 1921 1922 out: 1923 return again; 1924 } 1925 1926 static int ehci_state_executing(EHCIQueue *q) 1927 { 1928 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1929 1930 assert(p != NULL); 1931 assert(p->qtdaddr == q->qtdaddr); 1932 1933 ehci_execute_complete(q); 1934 1935 /* 4.10.3 */ 1936 if (!q->async && q->transact_ctr > 0) { 1937 q->transact_ctr--; 1938 } 1939 1940 /* 4.10.5 */ 1941 if (p->packet.status == USB_RET_NAK) { 1942 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1943 } else { 1944 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1945 } 1946 1947 ehci_flush_qh(q); 1948 return 1; 1949 } 1950 1951 1952 static int ehci_state_writeback(EHCIQueue *q) 1953 { 1954 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1955 uint32_t *qtd, addr; 1956 int again = 0; 1957 1958 /* Write back the QTD from the QH area */ 1959 assert(p != NULL); 1960 assert(p->qtdaddr == q->qtdaddr); 1961 1962 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1963 qtd = (uint32_t *) &q->qh.next_qtd; 1964 addr = NLPTR_GET(p->qtdaddr); 1965 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1966 ehci_free_packet(p); 1967 1968 /* 1969 * EHCI specs say go horizontal here. 1970 * 1971 * We can also advance the queue here for performance reasons. We 1972 * need to take care to only take that shortcut in case we've 1973 * processed the qtd just written back without errors, i.e. halt 1974 * bit is clear. 1975 */ 1976 if (q->qh.token & QTD_TOKEN_HALT) { 1977 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1978 again = 1; 1979 } else { 1980 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 1981 again = 1; 1982 } 1983 return again; 1984 } 1985 1986 /* 1987 * This is the state machine that is common to both async and periodic 1988 */ 1989 1990 static void ehci_advance_state(EHCIState *ehci, int async) 1991 { 1992 EHCIQueue *q = NULL; 1993 int again; 1994 1995 do { 1996 switch(ehci_get_state(ehci, async)) { 1997 case EST_WAITLISTHEAD: 1998 again = ehci_state_waitlisthead(ehci, async); 1999 break; 2000 2001 case EST_FETCHENTRY: 2002 again = ehci_state_fetchentry(ehci, async); 2003 break; 2004 2005 case EST_FETCHQH: 2006 q = ehci_state_fetchqh(ehci, async); 2007 if (q != NULL) { 2008 assert(q->async == async); 2009 again = 1; 2010 } else { 2011 again = 0; 2012 } 2013 break; 2014 2015 case EST_FETCHITD: 2016 again = ehci_state_fetchitd(ehci, async); 2017 break; 2018 2019 case EST_FETCHSITD: 2020 again = ehci_state_fetchsitd(ehci, async); 2021 break; 2022 2023 case EST_ADVANCEQUEUE: 2024 again = ehci_state_advqueue(q); 2025 break; 2026 2027 case EST_FETCHQTD: 2028 again = ehci_state_fetchqtd(q); 2029 break; 2030 2031 case EST_HORIZONTALQH: 2032 again = ehci_state_horizqh(q); 2033 break; 2034 2035 case EST_EXECUTE: 2036 again = ehci_state_execute(q); 2037 if (async) { 2038 ehci->async_stepdown = 0; 2039 } 2040 break; 2041 2042 case EST_EXECUTING: 2043 assert(q != NULL); 2044 if (async) { 2045 ehci->async_stepdown = 0; 2046 } 2047 again = ehci_state_executing(q); 2048 break; 2049 2050 case EST_WRITEBACK: 2051 assert(q != NULL); 2052 again = ehci_state_writeback(q); 2053 if (!async) { 2054 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2055 } 2056 break; 2057 2058 default: 2059 fprintf(stderr, "Bad state!\n"); 2060 again = -1; 2061 assert(0); 2062 break; 2063 } 2064 2065 if (again < 0) { 2066 fprintf(stderr, "processing error - resetting ehci HC\n"); 2067 ehci_reset(ehci); 2068 again = 0; 2069 } 2070 } 2071 while (again); 2072 } 2073 2074 static void ehci_advance_async_state(EHCIState *ehci) 2075 { 2076 const int async = 1; 2077 2078 switch(ehci_get_state(ehci, async)) { 2079 case EST_INACTIVE: 2080 if (!ehci_async_enabled(ehci)) { 2081 break; 2082 } 2083 ehci_set_state(ehci, async, EST_ACTIVE); 2084 // No break, fall through to ACTIVE 2085 2086 case EST_ACTIVE: 2087 if (!ehci_async_enabled(ehci)) { 2088 ehci_queues_rip_all(ehci, async); 2089 ehci_set_state(ehci, async, EST_INACTIVE); 2090 break; 2091 } 2092 2093 /* make sure guest has acknowledged the doorbell interrupt */ 2094 /* TO-DO: is this really needed? */ 2095 if (ehci->usbsts & USBSTS_IAA) { 2096 DPRINTF("IAA status bit still set.\n"); 2097 break; 2098 } 2099 2100 /* check that address register has been set */ 2101 if (ehci->asynclistaddr == 0) { 2102 break; 2103 } 2104 2105 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2106 ehci_advance_state(ehci, async); 2107 2108 /* If the doorbell is set, the guest wants to make a change to the 2109 * schedule. The host controller needs to release cached data. 2110 * (section 4.8.2) 2111 */ 2112 if (ehci->usbcmd & USBCMD_IAAD) { 2113 /* Remove all unseen qhs from the async qhs queue */ 2114 ehci_queues_rip_unseen(ehci, async); 2115 trace_usb_ehci_doorbell_ack(); 2116 ehci->usbcmd &= ~USBCMD_IAAD; 2117 ehci_raise_irq(ehci, USBSTS_IAA); 2118 } 2119 break; 2120 2121 default: 2122 /* this should only be due to a developer mistake */ 2123 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2124 "Resetting to active\n", ehci->astate); 2125 assert(0); 2126 } 2127 } 2128 2129 static void ehci_advance_periodic_state(EHCIState *ehci) 2130 { 2131 uint32_t entry; 2132 uint32_t list; 2133 const int async = 0; 2134 2135 // 4.6 2136 2137 switch(ehci_get_state(ehci, async)) { 2138 case EST_INACTIVE: 2139 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2140 ehci_set_state(ehci, async, EST_ACTIVE); 2141 // No break, fall through to ACTIVE 2142 } else 2143 break; 2144 2145 case EST_ACTIVE: 2146 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2147 ehci_queues_rip_all(ehci, async); 2148 ehci_set_state(ehci, async, EST_INACTIVE); 2149 break; 2150 } 2151 2152 list = ehci->periodiclistbase & 0xfffff000; 2153 /* check that register has been set */ 2154 if (list == 0) { 2155 break; 2156 } 2157 list |= ((ehci->frindex & 0x1ff8) >> 1); 2158 2159 if (get_dwords(ehci, list, &entry, 1) < 0) { 2160 break; 2161 } 2162 2163 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2164 ehci->frindex / 8, list, entry); 2165 ehci_set_fetch_addr(ehci, async,entry); 2166 ehci_set_state(ehci, async, EST_FETCHENTRY); 2167 ehci_advance_state(ehci, async); 2168 ehci_queues_rip_unused(ehci, async); 2169 break; 2170 2171 default: 2172 /* this should only be due to a developer mistake */ 2173 fprintf(stderr, "ehci: Bad periodic state %d. " 2174 "Resetting to active\n", ehci->pstate); 2175 assert(0); 2176 } 2177 } 2178 2179 static void ehci_update_frindex(EHCIState *ehci, int frames) 2180 { 2181 int i; 2182 2183 if (!ehci_enabled(ehci)) { 2184 return; 2185 } 2186 2187 for (i = 0; i < frames; i++) { 2188 ehci->frindex += 8; 2189 2190 if (ehci->frindex == 0x00002000) { 2191 ehci_raise_irq(ehci, USBSTS_FLR); 2192 } 2193 2194 if (ehci->frindex == 0x00004000) { 2195 ehci_raise_irq(ehci, USBSTS_FLR); 2196 ehci->frindex = 0; 2197 if (ehci->usbsts_frindex >= 0x00004000) { 2198 ehci->usbsts_frindex -= 0x00004000; 2199 } else { 2200 ehci->usbsts_frindex = 0; 2201 } 2202 } 2203 } 2204 } 2205 2206 static void ehci_frame_timer(void *opaque) 2207 { 2208 EHCIState *ehci = opaque; 2209 int need_timer = 0; 2210 int64_t expire_time, t_now; 2211 uint64_t ns_elapsed; 2212 int frames, skipped_frames; 2213 int i; 2214 2215 t_now = qemu_get_clock_ns(vm_clock); 2216 ns_elapsed = t_now - ehci->last_run_ns; 2217 frames = ns_elapsed / FRAME_TIMER_NS; 2218 2219 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2220 need_timer++; 2221 2222 if (frames > ehci->maxframes) { 2223 skipped_frames = frames - ehci->maxframes; 2224 ehci_update_frindex(ehci, skipped_frames); 2225 ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames; 2226 frames -= skipped_frames; 2227 DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames); 2228 } 2229 2230 for (i = 0; i < frames; i++) { 2231 /* 2232 * If we're running behind schedule, we should not catch up 2233 * too fast, as that will make some guests unhappy: 2234 * 1) We must process a minimum of MIN_FR_PER_TICK frames, 2235 * otherwise we will never catch up 2236 * 2) Process frames until the guest has requested an irq (IOC) 2237 */ 2238 if (i >= MIN_FR_PER_TICK) { 2239 ehci_commit_irq(ehci); 2240 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2241 break; 2242 } 2243 } 2244 if (ehci->periodic_sched_active) { 2245 ehci->periodic_sched_active--; 2246 } 2247 ehci_update_frindex(ehci, 1); 2248 ehci_advance_periodic_state(ehci); 2249 ehci->last_run_ns += FRAME_TIMER_NS; 2250 } 2251 } else { 2252 ehci->periodic_sched_active = 0; 2253 ehci_update_frindex(ehci, frames); 2254 ehci->last_run_ns += FRAME_TIMER_NS * frames; 2255 } 2256 2257 if (ehci->periodic_sched_active) { 2258 ehci->async_stepdown = 0; 2259 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2260 ehci->async_stepdown++; 2261 } 2262 2263 /* Async is not inside loop since it executes everything it can once 2264 * called 2265 */ 2266 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2267 need_timer++; 2268 ehci_advance_async_state(ehci); 2269 } 2270 2271 ehci_commit_irq(ehci); 2272 if (ehci->usbsts_pending) { 2273 need_timer++; 2274 ehci->async_stepdown = 0; 2275 } 2276 2277 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2278 need_timer++; 2279 } 2280 2281 if (need_timer) { 2282 /* If we've raised int, we speed up the timer, so that we quickly 2283 * notice any new packets queued up in response */ 2284 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2285 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 2); 2286 ehci->int_req_by_async = false; 2287 } else { 2288 expire_time = t_now + (get_ticks_per_sec() 2289 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2290 } 2291 qemu_mod_timer(ehci->frame_timer, expire_time); 2292 } 2293 } 2294 2295 static const MemoryRegionOps ehci_mmio_caps_ops = { 2296 .read = ehci_caps_read, 2297 .valid.min_access_size = 1, 2298 .valid.max_access_size = 4, 2299 .impl.min_access_size = 1, 2300 .impl.max_access_size = 1, 2301 .endianness = DEVICE_LITTLE_ENDIAN, 2302 }; 2303 2304 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2305 .read = ehci_opreg_read, 2306 .write = ehci_opreg_write, 2307 .valid.min_access_size = 4, 2308 .valid.max_access_size = 4, 2309 .endianness = DEVICE_LITTLE_ENDIAN, 2310 }; 2311 2312 static const MemoryRegionOps ehci_mmio_port_ops = { 2313 .read = ehci_port_read, 2314 .write = ehci_port_write, 2315 .valid.min_access_size = 4, 2316 .valid.max_access_size = 4, 2317 .endianness = DEVICE_LITTLE_ENDIAN, 2318 }; 2319 2320 static USBPortOps ehci_port_ops = { 2321 .attach = ehci_attach, 2322 .detach = ehci_detach, 2323 .child_detach = ehci_child_detach, 2324 .wakeup = ehci_wakeup, 2325 .complete = ehci_async_complete_packet, 2326 }; 2327 2328 static USBBusOps ehci_bus_ops = { 2329 .register_companion = ehci_register_companion, 2330 .wakeup_endpoint = ehci_wakeup_endpoint, 2331 }; 2332 2333 static int usb_ehci_post_load(void *opaque, int version_id) 2334 { 2335 EHCIState *s = opaque; 2336 int i; 2337 2338 for (i = 0; i < NB_PORTS; i++) { 2339 USBPort *companion = s->companion_ports[i]; 2340 if (companion == NULL) { 2341 continue; 2342 } 2343 if (s->portsc[i] & PORTSC_POWNER) { 2344 companion->dev = s->ports[i].dev; 2345 } else { 2346 companion->dev = NULL; 2347 } 2348 } 2349 2350 return 0; 2351 } 2352 2353 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2354 { 2355 EHCIState *ehci = opaque; 2356 2357 /* 2358 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2359 * schedule in guest memory. We must do the rebuilt ASAP, so that 2360 * USB-devices which have async handled packages have a packet in the 2361 * ep queue to match the completion with. 2362 */ 2363 if (state == RUN_STATE_RUNNING) { 2364 ehci_advance_async_state(ehci); 2365 } 2366 2367 /* 2368 * The schedule rebuilt from guest memory could cause the migration dest 2369 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2370 * will never have existed on the destination. Therefor we must flush the 2371 * async schedule on savevm to catch any not yet noticed unlinks. 2372 */ 2373 if (state == RUN_STATE_SAVE_VM) { 2374 ehci_advance_async_state(ehci); 2375 ehci_queues_rip_unseen(ehci, 1); 2376 } 2377 } 2378 2379 const VMStateDescription vmstate_ehci = { 2380 .name = "ehci-core", 2381 .version_id = 2, 2382 .minimum_version_id = 1, 2383 .post_load = usb_ehci_post_load, 2384 .fields = (VMStateField[]) { 2385 /* mmio registers */ 2386 VMSTATE_UINT32(usbcmd, EHCIState), 2387 VMSTATE_UINT32(usbsts, EHCIState), 2388 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2389 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2390 VMSTATE_UINT32(usbintr, EHCIState), 2391 VMSTATE_UINT32(frindex, EHCIState), 2392 VMSTATE_UINT32(ctrldssegment, EHCIState), 2393 VMSTATE_UINT32(periodiclistbase, EHCIState), 2394 VMSTATE_UINT32(asynclistaddr, EHCIState), 2395 VMSTATE_UINT32(configflag, EHCIState), 2396 VMSTATE_UINT32(portsc[0], EHCIState), 2397 VMSTATE_UINT32(portsc[1], EHCIState), 2398 VMSTATE_UINT32(portsc[2], EHCIState), 2399 VMSTATE_UINT32(portsc[3], EHCIState), 2400 VMSTATE_UINT32(portsc[4], EHCIState), 2401 VMSTATE_UINT32(portsc[5], EHCIState), 2402 /* frame timer */ 2403 VMSTATE_TIMER(frame_timer, EHCIState), 2404 VMSTATE_UINT64(last_run_ns, EHCIState), 2405 VMSTATE_UINT32(async_stepdown, EHCIState), 2406 /* schedule state */ 2407 VMSTATE_UINT32(astate, EHCIState), 2408 VMSTATE_UINT32(pstate, EHCIState), 2409 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2410 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2411 VMSTATE_END_OF_LIST() 2412 } 2413 }; 2414 2415 void usb_ehci_initfn(EHCIState *s, DeviceState *dev) 2416 { 2417 int i; 2418 2419 /* 2.2 host controller interface version */ 2420 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2421 s->caps[0x01] = 0x00; 2422 s->caps[0x02] = 0x00; 2423 s->caps[0x03] = 0x01; /* HC version */ 2424 s->caps[0x04] = NB_PORTS; /* Number of downstream ports */ 2425 s->caps[0x05] = 0x00; /* No companion ports at present */ 2426 s->caps[0x06] = 0x00; 2427 s->caps[0x07] = 0x00; 2428 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2429 s->caps[0x0a] = 0x00; 2430 s->caps[0x0b] = 0x00; 2431 2432 usb_bus_new(&s->bus, &ehci_bus_ops, dev); 2433 for(i = 0; i < NB_PORTS; i++) { 2434 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2435 USB_SPEED_MASK_HIGH); 2436 s->ports[i].dev = 0; 2437 } 2438 2439 s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s); 2440 s->async_bh = qemu_bh_new(ehci_frame_timer, s); 2441 QTAILQ_INIT(&s->aqueues); 2442 QTAILQ_INIT(&s->pqueues); 2443 usb_packet_init(&s->ipacket); 2444 2445 qemu_register_reset(ehci_reset, s); 2446 qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2447 2448 memory_region_init(&s->mem, "ehci", MMIO_SIZE); 2449 memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s, 2450 "capabilities", CAPA_SIZE); 2451 memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s, 2452 "operational", PORTSC_BEGIN); 2453 memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s, 2454 "ports", PORTSC_END - PORTSC_BEGIN); 2455 2456 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2457 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2458 memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN, 2459 &s->mem_ports); 2460 } 2461 2462 /* 2463 * vim: expandtab ts=4 2464 */ 2465