1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "hw/usb/hcd-ehci.h" 31 32 /* Capability Registers Base Address - section 2.2 */ 33 #define CAPLENGTH 0x0000 /* 1-byte, 0x0001 reserved */ 34 #define HCIVERSION 0x0002 /* 2-bytes, i/f version # */ 35 #define HCSPARAMS 0x0004 /* 4-bytes, structural params */ 36 #define HCCPARAMS 0x0008 /* 4-bytes, capability params */ 37 #define EECP HCCPARAMS + 1 38 #define HCSPPORTROUTE1 0x000c 39 #define HCSPPORTROUTE2 0x0010 40 41 #define USBCMD 0x0000 42 #define USBCMD_RUNSTOP (1 << 0) // run / Stop 43 #define USBCMD_HCRESET (1 << 1) // HC Reset 44 #define USBCMD_FLS (3 << 2) // Frame List Size 45 #define USBCMD_FLS_SH 2 // Frame List Size Shift 46 #define USBCMD_PSE (1 << 4) // Periodic Schedule Enable 47 #define USBCMD_ASE (1 << 5) // Asynch Schedule Enable 48 #define USBCMD_IAAD (1 << 6) // Int Asynch Advance Doorbell 49 #define USBCMD_LHCR (1 << 7) // Light Host Controller Reset 50 #define USBCMD_ASPMC (3 << 8) // Async Sched Park Mode Count 51 #define USBCMD_ASPME (1 << 11) // Async Sched Park Mode Enable 52 #define USBCMD_ITC (0x7f << 16) // Int Threshold Control 53 #define USBCMD_ITC_SH 16 // Int Threshold Control Shift 54 55 #define USBSTS 0x0004 56 #define USBSTS_RO_MASK 0x0000003f 57 #define USBSTS_INT (1 << 0) // USB Interrupt 58 #define USBSTS_ERRINT (1 << 1) // Error Interrupt 59 #define USBSTS_PCD (1 << 2) // Port Change Detect 60 #define USBSTS_FLR (1 << 3) // Frame List Rollover 61 #define USBSTS_HSE (1 << 4) // Host System Error 62 #define USBSTS_IAA (1 << 5) // Interrupt on Async Advance 63 #define USBSTS_HALT (1 << 12) // HC Halted 64 #define USBSTS_REC (1 << 13) // Reclamation 65 #define USBSTS_PSS (1 << 14) // Periodic Schedule Status 66 #define USBSTS_ASS (1 << 15) // Asynchronous Schedule Status 67 68 /* 69 * Interrupt enable bits correspond to the interrupt active bits in USBSTS 70 * so no need to redefine here. 71 */ 72 #define USBINTR 0x0008 73 #define USBINTR_MASK 0x0000003f 74 75 #define FRINDEX 0x000c 76 #define CTRLDSSEGMENT 0x0010 77 #define PERIODICLISTBASE 0x0014 78 #define ASYNCLISTADDR 0x0018 79 #define ASYNCLISTADDR_MASK 0xffffffe0 80 81 #define CONFIGFLAG 0x0040 82 83 /* 84 * Bits that are reserved or are read-only are masked out of values 85 * written to us by software 86 */ 87 #define PORTSC_RO_MASK 0x007001c0 88 #define PORTSC_RWC_MASK 0x0000002a 89 #define PORTSC_WKOC_E (1 << 22) // Wake on Over Current Enable 90 #define PORTSC_WKDS_E (1 << 21) // Wake on Disconnect Enable 91 #define PORTSC_WKCN_E (1 << 20) // Wake on Connect Enable 92 #define PORTSC_PTC (15 << 16) // Port Test Control 93 #define PORTSC_PTC_SH 16 // Port Test Control shift 94 #define PORTSC_PIC (3 << 14) // Port Indicator Control 95 #define PORTSC_PIC_SH 14 // Port Indicator Control Shift 96 #define PORTSC_POWNER (1 << 13) // Port Owner 97 #define PORTSC_PPOWER (1 << 12) // Port Power 98 #define PORTSC_LINESTAT (3 << 10) // Port Line Status 99 #define PORTSC_LINESTAT_SH 10 // Port Line Status Shift 100 #define PORTSC_PRESET (1 << 8) // Port Reset 101 #define PORTSC_SUSPEND (1 << 7) // Port Suspend 102 #define PORTSC_FPRES (1 << 6) // Force Port Resume 103 #define PORTSC_OCC (1 << 5) // Over Current Change 104 #define PORTSC_OCA (1 << 4) // Over Current Active 105 #define PORTSC_PEDC (1 << 3) // Port Enable/Disable Change 106 #define PORTSC_PED (1 << 2) // Port Enable/Disable 107 #define PORTSC_CSC (1 << 1) // Connect Status Change 108 #define PORTSC_CONNECT (1 << 0) // Current Connect Status 109 110 #define FRAME_TIMER_FREQ 1000 111 #define FRAME_TIMER_NS (1000000000 / FRAME_TIMER_FREQ) 112 113 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 114 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 115 #define MAX_QH 100 // Max allowable queue heads in a chain 116 #define MIN_FR_PER_TICK 3 // Min frames to process when catching up 117 118 /* Internal periodic / asynchronous schedule state machine states 119 */ 120 typedef enum { 121 EST_INACTIVE = 1000, 122 EST_ACTIVE, 123 EST_EXECUTING, 124 EST_SLEEPING, 125 /* The following states are internal to the state machine function 126 */ 127 EST_WAITLISTHEAD, 128 EST_FETCHENTRY, 129 EST_FETCHQH, 130 EST_FETCHITD, 131 EST_FETCHSITD, 132 EST_ADVANCEQUEUE, 133 EST_FETCHQTD, 134 EST_EXECUTE, 135 EST_WRITEBACK, 136 EST_HORIZONTALQH 137 } EHCI_STATES; 138 139 /* macros for accessing fields within next link pointer entry */ 140 #define NLPTR_GET(x) ((x) & 0xffffffe0) 141 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 142 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 143 144 /* link pointer types */ 145 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 146 #define NLPTR_TYPE_QH 1 // queue head 147 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 148 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 149 150 #define SET_LAST_RUN_CLOCK(s) \ 151 (s)->last_run_ns = qemu_get_clock_ns(vm_clock); 152 153 /* nifty macros from Arnon's EHCI version */ 154 #define get_field(data, field) \ 155 (((data) & field##_MASK) >> field##_SH) 156 157 #define set_field(data, newval, field) do { \ 158 uint32_t val = *data; \ 159 val &= ~ field##_MASK; \ 160 val |= ((newval) << field##_SH) & field##_MASK; \ 161 *data = val; \ 162 } while(0) 163 164 static const char *ehci_state_names[] = { 165 [EST_INACTIVE] = "INACTIVE", 166 [EST_ACTIVE] = "ACTIVE", 167 [EST_EXECUTING] = "EXECUTING", 168 [EST_SLEEPING] = "SLEEPING", 169 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 170 [EST_FETCHENTRY] = "FETCH ENTRY", 171 [EST_FETCHQH] = "FETCH QH", 172 [EST_FETCHITD] = "FETCH ITD", 173 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 174 [EST_FETCHQTD] = "FETCH QTD", 175 [EST_EXECUTE] = "EXECUTE", 176 [EST_WRITEBACK] = "WRITEBACK", 177 [EST_HORIZONTALQH] = "HORIZONTALQH", 178 }; 179 180 static const char *ehci_mmio_names[] = { 181 [USBCMD] = "USBCMD", 182 [USBSTS] = "USBSTS", 183 [USBINTR] = "USBINTR", 184 [FRINDEX] = "FRINDEX", 185 [PERIODICLISTBASE] = "P-LIST BASE", 186 [ASYNCLISTADDR] = "A-LIST ADDR", 187 [CONFIGFLAG] = "CONFIGFLAG", 188 }; 189 190 static int ehci_state_executing(EHCIQueue *q); 191 static int ehci_state_writeback(EHCIQueue *q); 192 static int ehci_fill_queue(EHCIPacket *p); 193 194 static const char *nr2str(const char **n, size_t len, uint32_t nr) 195 { 196 if (nr < len && n[nr] != NULL) { 197 return n[nr]; 198 } else { 199 return "unknown"; 200 } 201 } 202 203 static const char *state2str(uint32_t state) 204 { 205 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 206 } 207 208 static const char *addr2str(hwaddr addr) 209 { 210 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 211 } 212 213 static void ehci_trace_usbsts(uint32_t mask, int state) 214 { 215 /* interrupts */ 216 if (mask & USBSTS_INT) { 217 trace_usb_ehci_usbsts("INT", state); 218 } 219 if (mask & USBSTS_ERRINT) { 220 trace_usb_ehci_usbsts("ERRINT", state); 221 } 222 if (mask & USBSTS_PCD) { 223 trace_usb_ehci_usbsts("PCD", state); 224 } 225 if (mask & USBSTS_FLR) { 226 trace_usb_ehci_usbsts("FLR", state); 227 } 228 if (mask & USBSTS_HSE) { 229 trace_usb_ehci_usbsts("HSE", state); 230 } 231 if (mask & USBSTS_IAA) { 232 trace_usb_ehci_usbsts("IAA", state); 233 } 234 235 /* status */ 236 if (mask & USBSTS_HALT) { 237 trace_usb_ehci_usbsts("HALT", state); 238 } 239 if (mask & USBSTS_REC) { 240 trace_usb_ehci_usbsts("REC", state); 241 } 242 if (mask & USBSTS_PSS) { 243 trace_usb_ehci_usbsts("PSS", state); 244 } 245 if (mask & USBSTS_ASS) { 246 trace_usb_ehci_usbsts("ASS", state); 247 } 248 } 249 250 static inline void ehci_set_usbsts(EHCIState *s, int mask) 251 { 252 if ((s->usbsts & mask) == mask) { 253 return; 254 } 255 ehci_trace_usbsts(mask, 1); 256 s->usbsts |= mask; 257 } 258 259 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 260 { 261 if ((s->usbsts & mask) == 0) { 262 return; 263 } 264 ehci_trace_usbsts(mask, 0); 265 s->usbsts &= ~mask; 266 } 267 268 /* update irq line */ 269 static inline void ehci_update_irq(EHCIState *s) 270 { 271 int level = 0; 272 273 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 274 level = 1; 275 } 276 277 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 278 qemu_set_irq(s->irq, level); 279 } 280 281 /* flag interrupt condition */ 282 static inline void ehci_raise_irq(EHCIState *s, int intr) 283 { 284 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 285 s->usbsts |= intr; 286 ehci_update_irq(s); 287 } else { 288 s->usbsts_pending |= intr; 289 } 290 } 291 292 /* 293 * Commit pending interrupts (added via ehci_raise_irq), 294 * at the rate allowed by "Interrupt Threshold Control". 295 */ 296 static inline void ehci_commit_irq(EHCIState *s) 297 { 298 uint32_t itc; 299 300 if (!s->usbsts_pending) { 301 return; 302 } 303 if (s->usbsts_frindex > s->frindex) { 304 return; 305 } 306 307 itc = (s->usbcmd >> 16) & 0xff; 308 s->usbsts |= s->usbsts_pending; 309 s->usbsts_pending = 0; 310 s->usbsts_frindex = s->frindex + itc; 311 ehci_update_irq(s); 312 } 313 314 static void ehci_update_halt(EHCIState *s) 315 { 316 if (s->usbcmd & USBCMD_RUNSTOP) { 317 ehci_clear_usbsts(s, USBSTS_HALT); 318 } else { 319 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 320 ehci_set_usbsts(s, USBSTS_HALT); 321 } 322 } 323 } 324 325 static void ehci_set_state(EHCIState *s, int async, int state) 326 { 327 if (async) { 328 trace_usb_ehci_state("async", state2str(state)); 329 s->astate = state; 330 if (s->astate == EST_INACTIVE) { 331 ehci_clear_usbsts(s, USBSTS_ASS); 332 ehci_update_halt(s); 333 } else { 334 ehci_set_usbsts(s, USBSTS_ASS); 335 } 336 } else { 337 trace_usb_ehci_state("periodic", state2str(state)); 338 s->pstate = state; 339 if (s->pstate == EST_INACTIVE) { 340 ehci_clear_usbsts(s, USBSTS_PSS); 341 ehci_update_halt(s); 342 } else { 343 ehci_set_usbsts(s, USBSTS_PSS); 344 } 345 } 346 } 347 348 static int ehci_get_state(EHCIState *s, int async) 349 { 350 return async ? s->astate : s->pstate; 351 } 352 353 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 354 { 355 if (async) { 356 s->a_fetch_addr = addr; 357 } else { 358 s->p_fetch_addr = addr; 359 } 360 } 361 362 static int ehci_get_fetch_addr(EHCIState *s, int async) 363 { 364 return async ? s->a_fetch_addr : s->p_fetch_addr; 365 } 366 367 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 368 { 369 /* need three here due to argument count limits */ 370 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 371 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 372 trace_usb_ehci_qh_fields(addr, 373 get_field(qh->epchar, QH_EPCHAR_RL), 374 get_field(qh->epchar, QH_EPCHAR_MPLEN), 375 get_field(qh->epchar, QH_EPCHAR_EPS), 376 get_field(qh->epchar, QH_EPCHAR_EP), 377 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 378 trace_usb_ehci_qh_bits(addr, 379 (bool)(qh->epchar & QH_EPCHAR_C), 380 (bool)(qh->epchar & QH_EPCHAR_H), 381 (bool)(qh->epchar & QH_EPCHAR_DTC), 382 (bool)(qh->epchar & QH_EPCHAR_I)); 383 } 384 385 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 386 { 387 /* need three here due to argument count limits */ 388 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 389 trace_usb_ehci_qtd_fields(addr, 390 get_field(qtd->token, QTD_TOKEN_TBYTES), 391 get_field(qtd->token, QTD_TOKEN_CPAGE), 392 get_field(qtd->token, QTD_TOKEN_CERR), 393 get_field(qtd->token, QTD_TOKEN_PID)); 394 trace_usb_ehci_qtd_bits(addr, 395 (bool)(qtd->token & QTD_TOKEN_IOC), 396 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 397 (bool)(qtd->token & QTD_TOKEN_HALT), 398 (bool)(qtd->token & QTD_TOKEN_BABBLE), 399 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 400 } 401 402 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 403 { 404 trace_usb_ehci_itd(addr, itd->next, 405 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 406 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 407 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 408 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 409 } 410 411 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 412 EHCIsitd *sitd) 413 { 414 trace_usb_ehci_sitd(addr, sitd->next, 415 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 416 } 417 418 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 419 { 420 trace_usb_ehci_guest_bug(message); 421 fprintf(stderr, "ehci warning: %s\n", message); 422 } 423 424 static inline bool ehci_enabled(EHCIState *s) 425 { 426 return s->usbcmd & USBCMD_RUNSTOP; 427 } 428 429 static inline bool ehci_async_enabled(EHCIState *s) 430 { 431 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 432 } 433 434 static inline bool ehci_periodic_enabled(EHCIState *s) 435 { 436 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 437 } 438 439 /* packet management */ 440 441 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 442 { 443 EHCIPacket *p; 444 445 p = g_new0(EHCIPacket, 1); 446 p->queue = q; 447 usb_packet_init(&p->packet); 448 QTAILQ_INSERT_TAIL(&q->packets, p, next); 449 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 450 return p; 451 } 452 453 static void ehci_free_packet(EHCIPacket *p) 454 { 455 if (p->async == EHCI_ASYNC_FINISHED) { 456 int state = ehci_get_state(p->queue->ehci, p->queue->async); 457 /* This is a normal, but rare condition (cancel racing completion) */ 458 fprintf(stderr, "EHCI: Warning packet completed but not processed\n"); 459 ehci_state_executing(p->queue); 460 ehci_state_writeback(p->queue); 461 ehci_set_state(p->queue->ehci, p->queue->async, state); 462 /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */ 463 return; 464 } 465 trace_usb_ehci_packet_action(p->queue, p, "free"); 466 if (p->async == EHCI_ASYNC_INITIALIZED) { 467 usb_packet_unmap(&p->packet, &p->sgl); 468 qemu_sglist_destroy(&p->sgl); 469 } 470 if (p->async == EHCI_ASYNC_INFLIGHT) { 471 usb_cancel_packet(&p->packet); 472 usb_packet_unmap(&p->packet, &p->sgl); 473 qemu_sglist_destroy(&p->sgl); 474 } 475 QTAILQ_REMOVE(&p->queue->packets, p, next); 476 usb_packet_cleanup(&p->packet); 477 g_free(p); 478 } 479 480 /* queue management */ 481 482 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 483 { 484 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 485 EHCIQueue *q; 486 487 q = g_malloc0(sizeof(*q)); 488 q->ehci = ehci; 489 q->qhaddr = addr; 490 q->async = async; 491 QTAILQ_INIT(&q->packets); 492 QTAILQ_INSERT_HEAD(head, q, next); 493 trace_usb_ehci_queue_action(q, "alloc"); 494 return q; 495 } 496 497 static int ehci_cancel_queue(EHCIQueue *q) 498 { 499 EHCIPacket *p; 500 int packets = 0; 501 502 p = QTAILQ_FIRST(&q->packets); 503 if (p == NULL) { 504 return 0; 505 } 506 507 trace_usb_ehci_queue_action(q, "cancel"); 508 do { 509 ehci_free_packet(p); 510 packets++; 511 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 512 return packets; 513 } 514 515 static int ehci_reset_queue(EHCIQueue *q) 516 { 517 int packets; 518 519 trace_usb_ehci_queue_action(q, "reset"); 520 packets = ehci_cancel_queue(q); 521 q->dev = NULL; 522 q->qtdaddr = 0; 523 return packets; 524 } 525 526 static void ehci_free_queue(EHCIQueue *q, const char *warn) 527 { 528 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 529 int cancelled; 530 531 trace_usb_ehci_queue_action(q, "free"); 532 cancelled = ehci_cancel_queue(q); 533 if (warn && cancelled > 0) { 534 ehci_trace_guest_bug(q->ehci, warn); 535 } 536 QTAILQ_REMOVE(head, q, next); 537 g_free(q); 538 } 539 540 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 541 int async) 542 { 543 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 544 EHCIQueue *q; 545 546 QTAILQ_FOREACH(q, head, next) { 547 if (addr == q->qhaddr) { 548 return q; 549 } 550 } 551 return NULL; 552 } 553 554 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 555 { 556 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 557 const char *warn = async ? "guest unlinked busy QH" : NULL; 558 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 559 EHCIQueue *q, *tmp; 560 561 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 562 if (q->seen) { 563 q->seen = 0; 564 q->ts = ehci->last_run_ns; 565 continue; 566 } 567 if (ehci->last_run_ns < q->ts + maxage) { 568 continue; 569 } 570 ehci_free_queue(q, warn); 571 } 572 } 573 574 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 575 { 576 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 577 EHCIQueue *q, *tmp; 578 579 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 580 if (!q->seen) { 581 ehci_free_queue(q, NULL); 582 } 583 } 584 } 585 586 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 587 { 588 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 589 EHCIQueue *q, *tmp; 590 591 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 592 if (q->dev != dev) { 593 continue; 594 } 595 ehci_free_queue(q, NULL); 596 } 597 } 598 599 static void ehci_queues_rip_all(EHCIState *ehci, int async) 600 { 601 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 602 const char *warn = async ? "guest stopped busy async schedule" : NULL; 603 EHCIQueue *q, *tmp; 604 605 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 606 ehci_free_queue(q, warn); 607 } 608 } 609 610 /* Attach or detach a device on root hub */ 611 612 static void ehci_attach(USBPort *port) 613 { 614 EHCIState *s = port->opaque; 615 uint32_t *portsc = &s->portsc[port->index]; 616 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 617 618 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 619 620 if (*portsc & PORTSC_POWNER) { 621 USBPort *companion = s->companion_ports[port->index]; 622 companion->dev = port->dev; 623 companion->ops->attach(companion); 624 return; 625 } 626 627 *portsc |= PORTSC_CONNECT; 628 *portsc |= PORTSC_CSC; 629 630 ehci_raise_irq(s, USBSTS_PCD); 631 ehci_commit_irq(s); 632 } 633 634 static void ehci_detach(USBPort *port) 635 { 636 EHCIState *s = port->opaque; 637 uint32_t *portsc = &s->portsc[port->index]; 638 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 639 640 trace_usb_ehci_port_detach(port->index, owner); 641 642 if (*portsc & PORTSC_POWNER) { 643 USBPort *companion = s->companion_ports[port->index]; 644 companion->ops->detach(companion); 645 companion->dev = NULL; 646 /* 647 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 648 * the port ownership is returned immediately to the EHCI controller." 649 */ 650 *portsc &= ~PORTSC_POWNER; 651 return; 652 } 653 654 ehci_queues_rip_device(s, port->dev, 0); 655 ehci_queues_rip_device(s, port->dev, 1); 656 657 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED); 658 *portsc |= PORTSC_CSC; 659 660 ehci_raise_irq(s, USBSTS_PCD); 661 ehci_commit_irq(s); 662 } 663 664 static void ehci_child_detach(USBPort *port, USBDevice *child) 665 { 666 EHCIState *s = port->opaque; 667 uint32_t portsc = s->portsc[port->index]; 668 669 if (portsc & PORTSC_POWNER) { 670 USBPort *companion = s->companion_ports[port->index]; 671 companion->ops->child_detach(companion, child); 672 return; 673 } 674 675 ehci_queues_rip_device(s, child, 0); 676 ehci_queues_rip_device(s, child, 1); 677 } 678 679 static void ehci_wakeup(USBPort *port) 680 { 681 EHCIState *s = port->opaque; 682 uint32_t portsc = s->portsc[port->index]; 683 684 if (portsc & PORTSC_POWNER) { 685 USBPort *companion = s->companion_ports[port->index]; 686 if (companion->ops->wakeup) { 687 companion->ops->wakeup(companion); 688 } 689 return; 690 } 691 692 qemu_bh_schedule(s->async_bh); 693 } 694 695 static int ehci_register_companion(USBBus *bus, USBPort *ports[], 696 uint32_t portcount, uint32_t firstport) 697 { 698 EHCIState *s = container_of(bus, EHCIState, bus); 699 uint32_t i; 700 701 if (firstport + portcount > NB_PORTS) { 702 qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport", 703 "firstport on masterbus"); 704 error_printf_unless_qmp( 705 "firstport value of %u makes companion take ports %u - %u, which " 706 "is outside of the valid range of 0 - %u\n", firstport, firstport, 707 firstport + portcount - 1, NB_PORTS - 1); 708 return -1; 709 } 710 711 for (i = 0; i < portcount; i++) { 712 if (s->companion_ports[firstport + i]) { 713 qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus", 714 "an USB masterbus"); 715 error_printf_unless_qmp( 716 "port %u on masterbus %s already has a companion assigned\n", 717 firstport + i, bus->qbus.name); 718 return -1; 719 } 720 } 721 722 for (i = 0; i < portcount; i++) { 723 s->companion_ports[firstport + i] = ports[i]; 724 s->ports[firstport + i].speedmask |= 725 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 726 /* Ensure devs attached before the initial reset go to the companion */ 727 s->portsc[firstport + i] = PORTSC_POWNER; 728 } 729 730 s->companion_count++; 731 s->caps[0x05] = (s->companion_count << 4) | portcount; 732 733 return 0; 734 } 735 736 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 737 { 738 USBDevice *dev; 739 USBPort *port; 740 int i; 741 742 for (i = 0; i < NB_PORTS; i++) { 743 port = &ehci->ports[i]; 744 if (!(ehci->portsc[i] & PORTSC_PED)) { 745 DPRINTF("Port %d not enabled\n", i); 746 continue; 747 } 748 dev = usb_find_device(port, addr); 749 if (dev != NULL) { 750 return dev; 751 } 752 } 753 return NULL; 754 } 755 756 /* 4.1 host controller initialization */ 757 static void ehci_reset(void *opaque) 758 { 759 EHCIState *s = opaque; 760 int i; 761 USBDevice *devs[NB_PORTS]; 762 763 trace_usb_ehci_reset(); 764 765 /* 766 * Do the detach before touching portsc, so that it correctly gets send to 767 * us or to our companion based on PORTSC_POWNER before the reset. 768 */ 769 for(i = 0; i < NB_PORTS; i++) { 770 devs[i] = s->ports[i].dev; 771 if (devs[i] && devs[i]->attached) { 772 usb_detach(&s->ports[i]); 773 } 774 } 775 776 memset(&s->opreg, 0x00, sizeof(s->opreg)); 777 memset(&s->portsc, 0x00, sizeof(s->portsc)); 778 779 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 780 s->usbsts = USBSTS_HALT; 781 s->usbsts_pending = 0; 782 s->usbsts_frindex = 0; 783 784 s->astate = EST_INACTIVE; 785 s->pstate = EST_INACTIVE; 786 787 for(i = 0; i < NB_PORTS; i++) { 788 if (s->companion_ports[i]) { 789 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 790 } else { 791 s->portsc[i] = PORTSC_PPOWER; 792 } 793 if (devs[i] && devs[i]->attached) { 794 usb_attach(&s->ports[i]); 795 usb_device_reset(devs[i]); 796 } 797 } 798 ehci_queues_rip_all(s, 0); 799 ehci_queues_rip_all(s, 1); 800 qemu_del_timer(s->frame_timer); 801 qemu_bh_cancel(s->async_bh); 802 } 803 804 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 805 unsigned size) 806 { 807 EHCIState *s = ptr; 808 return s->caps[addr]; 809 } 810 811 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 812 unsigned size) 813 { 814 EHCIState *s = ptr; 815 uint32_t val; 816 817 val = s->opreg[addr >> 2]; 818 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 819 return val; 820 } 821 822 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 823 unsigned size) 824 { 825 EHCIState *s = ptr; 826 uint32_t val; 827 828 val = s->portsc[addr >> 2]; 829 trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val); 830 return val; 831 } 832 833 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 834 { 835 USBDevice *dev = s->ports[port].dev; 836 uint32_t *portsc = &s->portsc[port]; 837 uint32_t orig; 838 839 if (s->companion_ports[port] == NULL) 840 return; 841 842 owner = owner & PORTSC_POWNER; 843 orig = *portsc & PORTSC_POWNER; 844 845 if (!(owner ^ orig)) { 846 return; 847 } 848 849 if (dev && dev->attached) { 850 usb_detach(&s->ports[port]); 851 } 852 853 *portsc &= ~PORTSC_POWNER; 854 *portsc |= owner; 855 856 if (dev && dev->attached) { 857 usb_attach(&s->ports[port]); 858 } 859 } 860 861 static void ehci_port_write(void *ptr, hwaddr addr, 862 uint64_t val, unsigned size) 863 { 864 EHCIState *s = ptr; 865 int port = addr >> 2; 866 uint32_t *portsc = &s->portsc[port]; 867 uint32_t old = *portsc; 868 USBDevice *dev = s->ports[port].dev; 869 870 trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val); 871 872 /* Clear rwc bits */ 873 *portsc &= ~(val & PORTSC_RWC_MASK); 874 /* The guest may clear, but not set the PED bit */ 875 *portsc &= val | ~PORTSC_PED; 876 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 877 handle_port_owner_write(s, port, val); 878 /* And finally apply RO_MASK */ 879 val &= PORTSC_RO_MASK; 880 881 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 882 trace_usb_ehci_port_reset(port, 1); 883 } 884 885 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 886 trace_usb_ehci_port_reset(port, 0); 887 if (dev && dev->attached) { 888 usb_port_reset(&s->ports[port]); 889 *portsc &= ~PORTSC_CSC; 890 } 891 892 /* 893 * Table 2.16 Set the enable bit(and enable bit change) to indicate 894 * to SW that this port has a high speed device attached 895 */ 896 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 897 val |= PORTSC_PED; 898 } 899 } 900 901 *portsc &= ~PORTSC_RO_MASK; 902 *portsc |= val; 903 trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old); 904 } 905 906 static void ehci_opreg_write(void *ptr, hwaddr addr, 907 uint64_t val, unsigned size) 908 { 909 EHCIState *s = ptr; 910 uint32_t *mmio = s->opreg + (addr >> 2); 911 uint32_t old = *mmio; 912 int i; 913 914 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 915 916 switch (addr) { 917 case USBCMD: 918 if (val & USBCMD_HCRESET) { 919 ehci_reset(s); 920 val = s->usbcmd; 921 break; 922 } 923 924 /* not supporting dynamic frame list size at the moment */ 925 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 926 fprintf(stderr, "attempt to set frame list size -- value %d\n", 927 (int)val & USBCMD_FLS); 928 val &= ~USBCMD_FLS; 929 } 930 931 if (val & USBCMD_IAAD) { 932 /* 933 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 934 * trigger and re-use a qh without us seeing the unlink. 935 */ 936 s->async_stepdown = 0; 937 qemu_bh_schedule(s->async_bh); 938 trace_usb_ehci_doorbell_ring(); 939 } 940 941 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 942 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 943 if (s->pstate == EST_INACTIVE) { 944 SET_LAST_RUN_CLOCK(s); 945 } 946 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 947 ehci_update_halt(s); 948 s->async_stepdown = 0; 949 qemu_bh_schedule(s->async_bh); 950 } 951 break; 952 953 case USBSTS: 954 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 955 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 956 val = s->usbsts; 957 ehci_update_irq(s); 958 break; 959 960 case USBINTR: 961 val &= USBINTR_MASK; 962 break; 963 964 case FRINDEX: 965 val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */ 966 break; 967 968 case CONFIGFLAG: 969 val &= 0x1; 970 if (val) { 971 for(i = 0; i < NB_PORTS; i++) 972 handle_port_owner_write(s, i, 0); 973 } 974 break; 975 976 case PERIODICLISTBASE: 977 if (ehci_periodic_enabled(s)) { 978 fprintf(stderr, 979 "ehci: PERIODIC list base register set while periodic schedule\n" 980 " is enabled and HC is enabled\n"); 981 } 982 break; 983 984 case ASYNCLISTADDR: 985 if (ehci_async_enabled(s)) { 986 fprintf(stderr, 987 "ehci: ASYNC list address register set while async schedule\n" 988 " is enabled and HC is enabled\n"); 989 } 990 break; 991 } 992 993 *mmio = val; 994 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 995 *mmio, old); 996 } 997 998 999 // TODO : Put in common header file, duplication from usb-ohci.c 1000 1001 /* Get an array of dwords from main memory */ 1002 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 1003 uint32_t *buf, int num) 1004 { 1005 int i; 1006 1007 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 1008 dma_memory_read(ehci->dma, addr, buf, sizeof(*buf)); 1009 *buf = le32_to_cpu(*buf); 1010 } 1011 1012 return 1; 1013 } 1014 1015 /* Put an array of dwords in to main memory */ 1016 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 1017 uint32_t *buf, int num) 1018 { 1019 int i; 1020 1021 for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 1022 uint32_t tmp = cpu_to_le32(*buf); 1023 dma_memory_write(ehci->dma, addr, &tmp, sizeof(tmp)); 1024 } 1025 1026 return 1; 1027 } 1028 1029 /* 1030 * Write the qh back to guest physical memory. This step isn't 1031 * in the EHCI spec but we need to do it since we don't share 1032 * physical memory with our guest VM. 1033 * 1034 * The first three dwords are read-only for the EHCI, so skip them 1035 * when writing back the qh. 1036 */ 1037 static void ehci_flush_qh(EHCIQueue *q) 1038 { 1039 uint32_t *qh = (uint32_t *) &q->qh; 1040 uint32_t dwords = sizeof(EHCIqh) >> 2; 1041 uint32_t addr = NLPTR_GET(q->qhaddr); 1042 1043 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1044 } 1045 1046 // 4.10.2 1047 1048 static int ehci_qh_do_overlay(EHCIQueue *q) 1049 { 1050 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1051 int i; 1052 int dtoggle; 1053 int ping; 1054 int eps; 1055 int reload; 1056 1057 assert(p != NULL); 1058 assert(p->qtdaddr == q->qtdaddr); 1059 1060 // remember values in fields to preserve in qh after overlay 1061 1062 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1063 ping = q->qh.token & QTD_TOKEN_PING; 1064 1065 q->qh.current_qtd = p->qtdaddr; 1066 q->qh.next_qtd = p->qtd.next; 1067 q->qh.altnext_qtd = p->qtd.altnext; 1068 q->qh.token = p->qtd.token; 1069 1070 1071 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1072 if (eps == EHCI_QH_EPS_HIGH) { 1073 q->qh.token &= ~QTD_TOKEN_PING; 1074 q->qh.token |= ping; 1075 } 1076 1077 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1078 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1079 1080 for (i = 0; i < 5; i++) { 1081 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1082 } 1083 1084 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1085 // preserve QH DT bit 1086 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1087 q->qh.token |= dtoggle; 1088 } 1089 1090 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1091 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1092 1093 ehci_flush_qh(q); 1094 1095 return 0; 1096 } 1097 1098 static int ehci_init_transfer(EHCIPacket *p) 1099 { 1100 uint32_t cpage, offset, bytes, plen; 1101 dma_addr_t page; 1102 1103 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1104 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1105 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1106 qemu_sglist_init(&p->sgl, 5, p->queue->ehci->dma); 1107 1108 while (bytes > 0) { 1109 if (cpage > 4) { 1110 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1111 return -1; 1112 } 1113 1114 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1115 page += offset; 1116 plen = bytes; 1117 if (plen > 4096 - offset) { 1118 plen = 4096 - offset; 1119 offset = 0; 1120 cpage++; 1121 } 1122 1123 qemu_sglist_add(&p->sgl, page, plen); 1124 bytes -= plen; 1125 } 1126 return 0; 1127 } 1128 1129 static void ehci_finish_transfer(EHCIQueue *q, int len) 1130 { 1131 uint32_t cpage, offset; 1132 1133 if (len > 0) { 1134 /* update cpage & offset */ 1135 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1136 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1137 1138 offset += len; 1139 cpage += offset >> QTD_BUFPTR_SH; 1140 offset &= ~QTD_BUFPTR_MASK; 1141 1142 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1143 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1144 q->qh.bufptr[0] |= offset; 1145 } 1146 } 1147 1148 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1149 { 1150 EHCIPacket *p; 1151 EHCIState *s = port->opaque; 1152 uint32_t portsc = s->portsc[port->index]; 1153 1154 if (portsc & PORTSC_POWNER) { 1155 USBPort *companion = s->companion_ports[port->index]; 1156 companion->ops->complete(companion, packet); 1157 return; 1158 } 1159 1160 p = container_of(packet, EHCIPacket, packet); 1161 assert(p->async == EHCI_ASYNC_INFLIGHT); 1162 1163 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1164 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1165 ehci_free_packet(p); 1166 return; 1167 } 1168 1169 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1170 p->async = EHCI_ASYNC_FINISHED; 1171 1172 if (p->queue->async) { 1173 qemu_bh_schedule(p->queue->ehci->async_bh); 1174 } 1175 } 1176 1177 static void ehci_execute_complete(EHCIQueue *q) 1178 { 1179 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1180 uint32_t tbytes; 1181 1182 assert(p != NULL); 1183 assert(p->qtdaddr == q->qtdaddr); 1184 assert(p->async == EHCI_ASYNC_INITIALIZED || 1185 p->async == EHCI_ASYNC_FINISHED); 1186 1187 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1188 "status %d, actual_length %d\n", 1189 q->qhaddr, q->qh.next, q->qtdaddr, 1190 p->packet.status, p->packet.actual_length); 1191 1192 switch (p->packet.status) { 1193 case USB_RET_SUCCESS: 1194 break; 1195 case USB_RET_IOERROR: 1196 case USB_RET_NODEV: 1197 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1198 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1199 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1200 break; 1201 case USB_RET_STALL: 1202 q->qh.token |= QTD_TOKEN_HALT; 1203 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1204 break; 1205 case USB_RET_NAK: 1206 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1207 return; /* We're not done yet with this transaction */ 1208 case USB_RET_BABBLE: 1209 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1210 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1211 break; 1212 default: 1213 /* should not be triggerable */ 1214 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1215 assert(0); 1216 break; 1217 } 1218 1219 /* TODO check 4.12 for splits */ 1220 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1221 if (tbytes && p->pid == USB_TOKEN_IN) { 1222 tbytes -= p->packet.actual_length; 1223 if (tbytes) { 1224 /* 4.15.1.2 must raise int on a short input packet */ 1225 ehci_raise_irq(q->ehci, USBSTS_INT); 1226 } 1227 } else { 1228 tbytes = 0; 1229 } 1230 DPRINTF("updating tbytes to %d\n", tbytes); 1231 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1232 1233 ehci_finish_transfer(q, p->packet.actual_length); 1234 usb_packet_unmap(&p->packet, &p->sgl); 1235 qemu_sglist_destroy(&p->sgl); 1236 p->async = EHCI_ASYNC_NONE; 1237 1238 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1239 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1240 1241 if (q->qh.token & QTD_TOKEN_IOC) { 1242 ehci_raise_irq(q->ehci, USBSTS_INT); 1243 if (q->async) { 1244 q->ehci->int_req_by_async = true; 1245 } 1246 } 1247 } 1248 1249 /* 4.10.3 returns "again" */ 1250 static int ehci_execute(EHCIPacket *p, const char *action) 1251 { 1252 USBEndpoint *ep; 1253 int endp; 1254 bool spd; 1255 1256 assert(p->async == EHCI_ASYNC_NONE || 1257 p->async == EHCI_ASYNC_INITIALIZED); 1258 1259 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1260 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1261 return -1; 1262 } 1263 1264 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1265 ehci_trace_guest_bug(p->queue->ehci, 1266 "guest requested more bytes than allowed"); 1267 return -1; 1268 } 1269 1270 p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH; 1271 switch (p->pid) { 1272 case 0: 1273 p->pid = USB_TOKEN_OUT; 1274 break; 1275 case 1: 1276 p->pid = USB_TOKEN_IN; 1277 break; 1278 case 2: 1279 p->pid = USB_TOKEN_SETUP; 1280 break; 1281 default: 1282 fprintf(stderr, "bad token\n"); 1283 break; 1284 } 1285 1286 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1287 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1288 1289 if (p->async == EHCI_ASYNC_NONE) { 1290 if (ehci_init_transfer(p) != 0) { 1291 return -1; 1292 } 1293 1294 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1295 usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr, spd, 1296 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1297 usb_packet_map(&p->packet, &p->sgl); 1298 p->async = EHCI_ASYNC_INITIALIZED; 1299 } 1300 1301 trace_usb_ehci_packet_action(p->queue, p, action); 1302 usb_handle_packet(p->queue->dev, &p->packet); 1303 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1304 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1305 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1306 p->packet.actual_length); 1307 1308 if (p->packet.actual_length > BUFF_SIZE) { 1309 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1310 return -1; 1311 } 1312 1313 return 1; 1314 } 1315 1316 /* 4.7.2 1317 */ 1318 1319 static int ehci_process_itd(EHCIState *ehci, 1320 EHCIitd *itd, 1321 uint32_t addr) 1322 { 1323 USBDevice *dev; 1324 USBEndpoint *ep; 1325 uint32_t i, len, pid, dir, devaddr, endp; 1326 uint32_t pg, off, ptr1, ptr2, max, mult; 1327 1328 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1329 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1330 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1331 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1332 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1333 1334 for(i = 0; i < 8; i++) { 1335 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1336 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1337 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1338 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1339 ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK); 1340 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1341 1342 if (len > max * mult) { 1343 len = max * mult; 1344 } 1345 1346 if (len > BUFF_SIZE) { 1347 return -1; 1348 } 1349 1350 qemu_sglist_init(&ehci->isgl, 2, ehci->dma); 1351 if (off + len > 4096) { 1352 /* transfer crosses page border */ 1353 uint32_t len2 = off + len - 4096; 1354 uint32_t len1 = len - len2; 1355 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1356 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1357 } else { 1358 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1359 } 1360 1361 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1362 1363 dev = ehci_find_device(ehci, devaddr); 1364 ep = usb_ep_get(dev, pid, endp); 1365 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1366 usb_packet_setup(&ehci->ipacket, pid, ep, addr, false, 1367 (itd->transact[i] & ITD_XACT_IOC) != 0); 1368 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1369 usb_handle_packet(dev, &ehci->ipacket); 1370 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1371 } else { 1372 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1373 ehci->ipacket.status = USB_RET_NAK; 1374 ehci->ipacket.actual_length = 0; 1375 } 1376 qemu_sglist_destroy(&ehci->isgl); 1377 1378 switch (ehci->ipacket.status) { 1379 case USB_RET_SUCCESS: 1380 break; 1381 default: 1382 fprintf(stderr, "Unexpected iso usb result: %d\n", 1383 ehci->ipacket.status); 1384 /* Fall through */ 1385 case USB_RET_IOERROR: 1386 case USB_RET_NODEV: 1387 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1388 if (dir) { 1389 itd->transact[i] |= ITD_XACT_XACTERR; 1390 ehci_raise_irq(ehci, USBSTS_ERRINT); 1391 } 1392 break; 1393 case USB_RET_BABBLE: 1394 itd->transact[i] |= ITD_XACT_BABBLE; 1395 ehci_raise_irq(ehci, USBSTS_ERRINT); 1396 break; 1397 case USB_RET_NAK: 1398 /* no data for us, so do a zero-length transfer */ 1399 ehci->ipacket.actual_length = 0; 1400 break; 1401 } 1402 if (!dir) { 1403 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1404 ITD_XACT_LENGTH); /* OUT */ 1405 } else { 1406 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1407 ITD_XACT_LENGTH); /* IN */ 1408 } 1409 if (itd->transact[i] & ITD_XACT_IOC) { 1410 ehci_raise_irq(ehci, USBSTS_INT); 1411 } 1412 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1413 } 1414 } 1415 return 0; 1416 } 1417 1418 1419 /* This state is the entry point for asynchronous schedule 1420 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1421 */ 1422 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1423 { 1424 EHCIqh qh; 1425 int i = 0; 1426 int again = 0; 1427 uint32_t entry = ehci->asynclistaddr; 1428 1429 /* set reclamation flag at start event (4.8.6) */ 1430 if (async) { 1431 ehci_set_usbsts(ehci, USBSTS_REC); 1432 } 1433 1434 ehci_queues_rip_unused(ehci, async); 1435 1436 /* Find the head of the list (4.9.1.1) */ 1437 for(i = 0; i < MAX_QH; i++) { 1438 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1439 sizeof(EHCIqh) >> 2); 1440 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1441 1442 if (qh.epchar & QH_EPCHAR_H) { 1443 if (async) { 1444 entry |= (NLPTR_TYPE_QH << 1); 1445 } 1446 1447 ehci_set_fetch_addr(ehci, async, entry); 1448 ehci_set_state(ehci, async, EST_FETCHENTRY); 1449 again = 1; 1450 goto out; 1451 } 1452 1453 entry = qh.next; 1454 if (entry == ehci->asynclistaddr) { 1455 break; 1456 } 1457 } 1458 1459 /* no head found for list. */ 1460 1461 ehci_set_state(ehci, async, EST_ACTIVE); 1462 1463 out: 1464 return again; 1465 } 1466 1467 1468 /* This state is the entry point for periodic schedule processing as 1469 * well as being a continuation state for async processing. 1470 */ 1471 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1472 { 1473 int again = 0; 1474 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1475 1476 if (NLPTR_TBIT(entry)) { 1477 ehci_set_state(ehci, async, EST_ACTIVE); 1478 goto out; 1479 } 1480 1481 /* section 4.8, only QH in async schedule */ 1482 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1483 fprintf(stderr, "non queue head request in async schedule\n"); 1484 return -1; 1485 } 1486 1487 switch (NLPTR_TYPE_GET(entry)) { 1488 case NLPTR_TYPE_QH: 1489 ehci_set_state(ehci, async, EST_FETCHQH); 1490 again = 1; 1491 break; 1492 1493 case NLPTR_TYPE_ITD: 1494 ehci_set_state(ehci, async, EST_FETCHITD); 1495 again = 1; 1496 break; 1497 1498 case NLPTR_TYPE_STITD: 1499 ehci_set_state(ehci, async, EST_FETCHSITD); 1500 again = 1; 1501 break; 1502 1503 default: 1504 /* TODO: handle FSTN type */ 1505 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1506 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1507 return -1; 1508 } 1509 1510 out: 1511 return again; 1512 } 1513 1514 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1515 { 1516 EHCIPacket *p; 1517 uint32_t entry, devaddr, endp; 1518 EHCIQueue *q; 1519 EHCIqh qh; 1520 1521 entry = ehci_get_fetch_addr(ehci, async); 1522 q = ehci_find_queue_by_qh(ehci, entry, async); 1523 if (NULL == q) { 1524 q = ehci_alloc_queue(ehci, entry, async); 1525 } 1526 p = QTAILQ_FIRST(&q->packets); 1527 1528 q->seen++; 1529 if (q->seen > 1) { 1530 /* we are going in circles -- stop processing */ 1531 ehci_set_state(ehci, async, EST_ACTIVE); 1532 q = NULL; 1533 goto out; 1534 } 1535 1536 get_dwords(ehci, NLPTR_GET(q->qhaddr), 1537 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 1538 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1539 1540 /* 1541 * The overlay area of the qh should never be changed by the guest, 1542 * except when idle, in which case the reset is a nop. 1543 */ 1544 devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR); 1545 endp = get_field(qh.epchar, QH_EPCHAR_EP); 1546 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 1547 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 1548 (memcmp(&qh.current_qtd, &q->qh.current_qtd, 1549 9 * sizeof(uint32_t)) != 0) || 1550 (q->dev != NULL && q->dev->addr != devaddr)) { 1551 if (ehci_reset_queue(q) > 0) { 1552 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1553 } 1554 p = NULL; 1555 } 1556 q->qh = qh; 1557 1558 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1559 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1560 q->transact_ctr = 4; 1561 } 1562 1563 if (q->dev == NULL) { 1564 q->dev = ehci_find_device(q->ehci, devaddr); 1565 } 1566 1567 if (p && p->async == EHCI_ASYNC_FINISHED) { 1568 /* I/O finished -- continue processing queue */ 1569 trace_usb_ehci_packet_action(p->queue, p, "complete"); 1570 ehci_set_state(ehci, async, EST_EXECUTING); 1571 goto out; 1572 } 1573 1574 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1575 1576 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1577 if (ehci->usbsts & USBSTS_REC) { 1578 ehci_clear_usbsts(ehci, USBSTS_REC); 1579 } else { 1580 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1581 " - done processing\n", q->qhaddr); 1582 ehci_set_state(ehci, async, EST_ACTIVE); 1583 q = NULL; 1584 goto out; 1585 } 1586 } 1587 1588 #if EHCI_DEBUG 1589 if (q->qhaddr != q->qh.next) { 1590 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1591 q->qhaddr, 1592 q->qh.epchar & QH_EPCHAR_H, 1593 q->qh.token & QTD_TOKEN_HALT, 1594 q->qh.token & QTD_TOKEN_ACTIVE, 1595 q->qh.next); 1596 } 1597 #endif 1598 1599 if (q->qh.token & QTD_TOKEN_HALT) { 1600 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1601 1602 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1603 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1604 q->qtdaddr = q->qh.current_qtd; 1605 ehci_set_state(ehci, async, EST_FETCHQTD); 1606 1607 } else { 1608 /* EHCI spec version 1.0 Section 4.10.2 */ 1609 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1610 } 1611 1612 out: 1613 return q; 1614 } 1615 1616 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1617 { 1618 uint32_t entry; 1619 EHCIitd itd; 1620 1621 assert(!async); 1622 entry = ehci_get_fetch_addr(ehci, async); 1623 1624 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1625 sizeof(EHCIitd) >> 2); 1626 ehci_trace_itd(ehci, entry, &itd); 1627 1628 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1629 return -1; 1630 } 1631 1632 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1633 sizeof(EHCIitd) >> 2); 1634 ehci_set_fetch_addr(ehci, async, itd.next); 1635 ehci_set_state(ehci, async, EST_FETCHENTRY); 1636 1637 return 1; 1638 } 1639 1640 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1641 { 1642 uint32_t entry; 1643 EHCIsitd sitd; 1644 1645 assert(!async); 1646 entry = ehci_get_fetch_addr(ehci, async); 1647 1648 get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1649 sizeof(EHCIsitd) >> 2); 1650 ehci_trace_sitd(ehci, entry, &sitd); 1651 1652 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1653 /* siTD is not active, nothing to do */; 1654 } else { 1655 /* TODO: split transfers are not implemented */ 1656 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1657 } 1658 1659 ehci_set_fetch_addr(ehci, async, sitd.next); 1660 ehci_set_state(ehci, async, EST_FETCHENTRY); 1661 return 1; 1662 } 1663 1664 /* Section 4.10.2 - paragraph 3 */ 1665 static int ehci_state_advqueue(EHCIQueue *q) 1666 { 1667 #if 0 1668 /* TO-DO: 4.10.2 - paragraph 2 1669 * if I-bit is set to 1 and QH is not active 1670 * go to horizontal QH 1671 */ 1672 if (I-bit set) { 1673 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1674 goto out; 1675 } 1676 #endif 1677 1678 /* 1679 * want data and alt-next qTD is valid 1680 */ 1681 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1682 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1683 q->qtdaddr = q->qh.altnext_qtd; 1684 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1685 1686 /* 1687 * next qTD is valid 1688 */ 1689 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1690 q->qtdaddr = q->qh.next_qtd; 1691 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1692 1693 /* 1694 * no valid qTD, try next QH 1695 */ 1696 } else { 1697 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1698 } 1699 1700 return 1; 1701 } 1702 1703 /* Section 4.10.2 - paragraph 4 */ 1704 static int ehci_state_fetchqtd(EHCIQueue *q) 1705 { 1706 EHCIqtd qtd; 1707 EHCIPacket *p; 1708 int again = 1; 1709 1710 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1711 sizeof(EHCIqtd) >> 2); 1712 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1713 1714 p = QTAILQ_FIRST(&q->packets); 1715 if (p != NULL) { 1716 if (p->qtdaddr != q->qtdaddr || 1717 (!NLPTR_TBIT(p->qtd.next) && (p->qtd.next != qtd.next)) || 1718 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) || 1719 p->qtd.bufptr[0] != qtd.bufptr[0]) { 1720 ehci_cancel_queue(q); 1721 ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD"); 1722 p = NULL; 1723 } else { 1724 p->qtd = qtd; 1725 ehci_qh_do_overlay(q); 1726 } 1727 } 1728 1729 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1730 if (p != NULL) { 1731 /* transfer canceled by guest (clear active) */ 1732 ehci_cancel_queue(q); 1733 p = NULL; 1734 } 1735 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1736 } else if (p != NULL) { 1737 switch (p->async) { 1738 case EHCI_ASYNC_NONE: 1739 case EHCI_ASYNC_INITIALIZED: 1740 /* Not yet executed (MULT), or previously nacked (int) packet */ 1741 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1742 break; 1743 case EHCI_ASYNC_INFLIGHT: 1744 /* Check if the guest has added new tds to the queue */ 1745 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1746 /* Unfinished async handled packet, go horizontal */ 1747 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1748 break; 1749 case EHCI_ASYNC_FINISHED: 1750 /* 1751 * We get here when advqueue moves to a packet which is already 1752 * finished, which can happen with packets queued up by fill_queue 1753 */ 1754 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1755 break; 1756 } 1757 } else { 1758 p = ehci_alloc_packet(q); 1759 p->qtdaddr = q->qtdaddr; 1760 p->qtd = qtd; 1761 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1762 } 1763 1764 return again; 1765 } 1766 1767 static int ehci_state_horizqh(EHCIQueue *q) 1768 { 1769 int again = 0; 1770 1771 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1772 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1773 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1774 again = 1; 1775 } else { 1776 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1777 } 1778 1779 return again; 1780 } 1781 1782 /* Returns "again" */ 1783 static int ehci_fill_queue(EHCIPacket *p) 1784 { 1785 USBEndpoint *ep = p->packet.ep; 1786 EHCIQueue *q = p->queue; 1787 EHCIqtd qtd = p->qtd; 1788 uint32_t qtdaddr, start_addr = p->qtdaddr; 1789 1790 for (;;) { 1791 if (NLPTR_TBIT(qtd.next) != 0) { 1792 break; 1793 } 1794 qtdaddr = qtd.next; 1795 /* 1796 * Detect circular td lists, Windows creates these, counting on the 1797 * active bit going low after execution to make the queue stop. 1798 */ 1799 if (qtdaddr == start_addr) { 1800 break; 1801 } 1802 get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1803 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 1804 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1805 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1806 break; 1807 } 1808 p = ehci_alloc_packet(q); 1809 p->qtdaddr = qtdaddr; 1810 p->qtd = qtd; 1811 if (ehci_execute(p, "queue") == -1) { 1812 return -1; 1813 } 1814 assert(p->packet.status == USB_RET_ASYNC); 1815 p->async = EHCI_ASYNC_INFLIGHT; 1816 } 1817 usb_device_flush_ep_queue(ep->dev, ep); 1818 return 1; 1819 } 1820 1821 static int ehci_state_execute(EHCIQueue *q) 1822 { 1823 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1824 int again = 0; 1825 1826 assert(p != NULL); 1827 assert(p->qtdaddr == q->qtdaddr); 1828 1829 if (ehci_qh_do_overlay(q) != 0) { 1830 return -1; 1831 } 1832 1833 // TODO verify enough time remains in the uframe as in 4.4.1.1 1834 // TODO write back ptr to async list when done or out of time 1835 1836 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1837 if (!q->async && q->transact_ctr == 0) { 1838 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1839 again = 1; 1840 goto out; 1841 } 1842 1843 if (q->async) { 1844 ehci_set_usbsts(q->ehci, USBSTS_REC); 1845 } 1846 1847 again = ehci_execute(p, "process"); 1848 if (again == -1) { 1849 goto out; 1850 } 1851 if (p->packet.status == USB_RET_ASYNC) { 1852 ehci_flush_qh(q); 1853 trace_usb_ehci_packet_action(p->queue, p, "async"); 1854 p->async = EHCI_ASYNC_INFLIGHT; 1855 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1856 if (q->async) { 1857 again = ehci_fill_queue(p); 1858 } else { 1859 again = 1; 1860 } 1861 goto out; 1862 } 1863 1864 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1865 again = 1; 1866 1867 out: 1868 return again; 1869 } 1870 1871 static int ehci_state_executing(EHCIQueue *q) 1872 { 1873 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1874 1875 assert(p != NULL); 1876 assert(p->qtdaddr == q->qtdaddr); 1877 1878 ehci_execute_complete(q); 1879 1880 /* 4.10.3 */ 1881 if (!q->async && q->transact_ctr > 0) { 1882 q->transact_ctr--; 1883 } 1884 1885 /* 4.10.5 */ 1886 if (p->packet.status == USB_RET_NAK) { 1887 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1888 } else { 1889 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1890 } 1891 1892 ehci_flush_qh(q); 1893 return 1; 1894 } 1895 1896 1897 static int ehci_state_writeback(EHCIQueue *q) 1898 { 1899 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1900 uint32_t *qtd, addr; 1901 int again = 0; 1902 1903 /* Write back the QTD from the QH area */ 1904 assert(p != NULL); 1905 assert(p->qtdaddr == q->qtdaddr); 1906 1907 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1908 qtd = (uint32_t *) &q->qh.next_qtd; 1909 addr = NLPTR_GET(p->qtdaddr); 1910 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1911 ehci_free_packet(p); 1912 1913 /* 1914 * EHCI specs say go horizontal here. 1915 * 1916 * We can also advance the queue here for performance reasons. We 1917 * need to take care to only take that shortcut in case we've 1918 * processed the qtd just written back without errors, i.e. halt 1919 * bit is clear. 1920 */ 1921 if (q->qh.token & QTD_TOKEN_HALT) { 1922 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1923 again = 1; 1924 } else { 1925 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 1926 again = 1; 1927 } 1928 return again; 1929 } 1930 1931 /* 1932 * This is the state machine that is common to both async and periodic 1933 */ 1934 1935 static void ehci_advance_state(EHCIState *ehci, int async) 1936 { 1937 EHCIQueue *q = NULL; 1938 int again; 1939 1940 do { 1941 switch(ehci_get_state(ehci, async)) { 1942 case EST_WAITLISTHEAD: 1943 again = ehci_state_waitlisthead(ehci, async); 1944 break; 1945 1946 case EST_FETCHENTRY: 1947 again = ehci_state_fetchentry(ehci, async); 1948 break; 1949 1950 case EST_FETCHQH: 1951 q = ehci_state_fetchqh(ehci, async); 1952 if (q != NULL) { 1953 assert(q->async == async); 1954 again = 1; 1955 } else { 1956 again = 0; 1957 } 1958 break; 1959 1960 case EST_FETCHITD: 1961 again = ehci_state_fetchitd(ehci, async); 1962 break; 1963 1964 case EST_FETCHSITD: 1965 again = ehci_state_fetchsitd(ehci, async); 1966 break; 1967 1968 case EST_ADVANCEQUEUE: 1969 again = ehci_state_advqueue(q); 1970 break; 1971 1972 case EST_FETCHQTD: 1973 again = ehci_state_fetchqtd(q); 1974 break; 1975 1976 case EST_HORIZONTALQH: 1977 again = ehci_state_horizqh(q); 1978 break; 1979 1980 case EST_EXECUTE: 1981 again = ehci_state_execute(q); 1982 if (async) { 1983 ehci->async_stepdown = 0; 1984 } 1985 break; 1986 1987 case EST_EXECUTING: 1988 assert(q != NULL); 1989 if (async) { 1990 ehci->async_stepdown = 0; 1991 } 1992 again = ehci_state_executing(q); 1993 break; 1994 1995 case EST_WRITEBACK: 1996 assert(q != NULL); 1997 again = ehci_state_writeback(q); 1998 break; 1999 2000 default: 2001 fprintf(stderr, "Bad state!\n"); 2002 again = -1; 2003 assert(0); 2004 break; 2005 } 2006 2007 if (again < 0) { 2008 fprintf(stderr, "processing error - resetting ehci HC\n"); 2009 ehci_reset(ehci); 2010 again = 0; 2011 } 2012 } 2013 while (again); 2014 } 2015 2016 static void ehci_advance_async_state(EHCIState *ehci) 2017 { 2018 const int async = 1; 2019 2020 switch(ehci_get_state(ehci, async)) { 2021 case EST_INACTIVE: 2022 if (!ehci_async_enabled(ehci)) { 2023 break; 2024 } 2025 ehci_set_state(ehci, async, EST_ACTIVE); 2026 // No break, fall through to ACTIVE 2027 2028 case EST_ACTIVE: 2029 if (!ehci_async_enabled(ehci)) { 2030 ehci_queues_rip_all(ehci, async); 2031 ehci_set_state(ehci, async, EST_INACTIVE); 2032 break; 2033 } 2034 2035 /* make sure guest has acknowledged the doorbell interrupt */ 2036 /* TO-DO: is this really needed? */ 2037 if (ehci->usbsts & USBSTS_IAA) { 2038 DPRINTF("IAA status bit still set.\n"); 2039 break; 2040 } 2041 2042 /* check that address register has been set */ 2043 if (ehci->asynclistaddr == 0) { 2044 break; 2045 } 2046 2047 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2048 ehci_advance_state(ehci, async); 2049 2050 /* If the doorbell is set, the guest wants to make a change to the 2051 * schedule. The host controller needs to release cached data. 2052 * (section 4.8.2) 2053 */ 2054 if (ehci->usbcmd & USBCMD_IAAD) { 2055 /* Remove all unseen qhs from the async qhs queue */ 2056 ehci_queues_rip_unseen(ehci, async); 2057 trace_usb_ehci_doorbell_ack(); 2058 ehci->usbcmd &= ~USBCMD_IAAD; 2059 ehci_raise_irq(ehci, USBSTS_IAA); 2060 } 2061 break; 2062 2063 default: 2064 /* this should only be due to a developer mistake */ 2065 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2066 "Resetting to active\n", ehci->astate); 2067 assert(0); 2068 } 2069 } 2070 2071 static void ehci_advance_periodic_state(EHCIState *ehci) 2072 { 2073 uint32_t entry; 2074 uint32_t list; 2075 const int async = 0; 2076 2077 // 4.6 2078 2079 switch(ehci_get_state(ehci, async)) { 2080 case EST_INACTIVE: 2081 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2082 ehci_set_state(ehci, async, EST_ACTIVE); 2083 // No break, fall through to ACTIVE 2084 } else 2085 break; 2086 2087 case EST_ACTIVE: 2088 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2089 ehci_queues_rip_all(ehci, async); 2090 ehci_set_state(ehci, async, EST_INACTIVE); 2091 break; 2092 } 2093 2094 list = ehci->periodiclistbase & 0xfffff000; 2095 /* check that register has been set */ 2096 if (list == 0) { 2097 break; 2098 } 2099 list |= ((ehci->frindex & 0x1ff8) >> 1); 2100 2101 dma_memory_read(ehci->dma, list, &entry, sizeof entry); 2102 entry = le32_to_cpu(entry); 2103 2104 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2105 ehci->frindex / 8, list, entry); 2106 ehci_set_fetch_addr(ehci, async,entry); 2107 ehci_set_state(ehci, async, EST_FETCHENTRY); 2108 ehci_advance_state(ehci, async); 2109 ehci_queues_rip_unused(ehci, async); 2110 break; 2111 2112 default: 2113 /* this should only be due to a developer mistake */ 2114 fprintf(stderr, "ehci: Bad periodic state %d. " 2115 "Resetting to active\n", ehci->pstate); 2116 assert(0); 2117 } 2118 } 2119 2120 static void ehci_update_frindex(EHCIState *ehci, int frames) 2121 { 2122 int i; 2123 2124 if (!ehci_enabled(ehci)) { 2125 return; 2126 } 2127 2128 for (i = 0; i < frames; i++) { 2129 ehci->frindex += 8; 2130 2131 if (ehci->frindex == 0x00002000) { 2132 ehci_raise_irq(ehci, USBSTS_FLR); 2133 } 2134 2135 if (ehci->frindex == 0x00004000) { 2136 ehci_raise_irq(ehci, USBSTS_FLR); 2137 ehci->frindex = 0; 2138 if (ehci->usbsts_frindex >= 0x00004000) { 2139 ehci->usbsts_frindex -= 0x00004000; 2140 } else { 2141 ehci->usbsts_frindex = 0; 2142 } 2143 } 2144 } 2145 } 2146 2147 static void ehci_frame_timer(void *opaque) 2148 { 2149 EHCIState *ehci = opaque; 2150 int need_timer = 0; 2151 int64_t expire_time, t_now; 2152 uint64_t ns_elapsed; 2153 int frames, skipped_frames; 2154 int i; 2155 2156 t_now = qemu_get_clock_ns(vm_clock); 2157 ns_elapsed = t_now - ehci->last_run_ns; 2158 frames = ns_elapsed / FRAME_TIMER_NS; 2159 2160 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2161 need_timer++; 2162 ehci->async_stepdown = 0; 2163 2164 if (frames > ehci->maxframes) { 2165 skipped_frames = frames - ehci->maxframes; 2166 ehci_update_frindex(ehci, skipped_frames); 2167 ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames; 2168 frames -= skipped_frames; 2169 DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames); 2170 } 2171 2172 for (i = 0; i < frames; i++) { 2173 /* 2174 * If we're running behind schedule, we should not catch up 2175 * too fast, as that will make some guests unhappy: 2176 * 1) We must process a minimum of MIN_FR_PER_TICK frames, 2177 * otherwise we will never catch up 2178 * 2) Process frames until the guest has requested an irq (IOC) 2179 */ 2180 if (i >= MIN_FR_PER_TICK) { 2181 ehci_commit_irq(ehci); 2182 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2183 break; 2184 } 2185 } 2186 ehci_update_frindex(ehci, 1); 2187 ehci_advance_periodic_state(ehci); 2188 ehci->last_run_ns += FRAME_TIMER_NS; 2189 } 2190 } else { 2191 if (ehci->async_stepdown < ehci->maxframes / 2) { 2192 ehci->async_stepdown++; 2193 } 2194 ehci_update_frindex(ehci, frames); 2195 ehci->last_run_ns += FRAME_TIMER_NS * frames; 2196 } 2197 2198 /* Async is not inside loop since it executes everything it can once 2199 * called 2200 */ 2201 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2202 need_timer++; 2203 ehci_advance_async_state(ehci); 2204 } 2205 2206 ehci_commit_irq(ehci); 2207 if (ehci->usbsts_pending) { 2208 need_timer++; 2209 ehci->async_stepdown = 0; 2210 } 2211 2212 if (need_timer) { 2213 /* If we've raised int, we speed up the timer, so that we quickly 2214 * notice any new packets queued up in response */ 2215 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2216 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 2); 2217 ehci->int_req_by_async = false; 2218 } else { 2219 expire_time = t_now + (get_ticks_per_sec() 2220 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2221 } 2222 qemu_mod_timer(ehci->frame_timer, expire_time); 2223 } 2224 } 2225 2226 static const MemoryRegionOps ehci_mmio_caps_ops = { 2227 .read = ehci_caps_read, 2228 .valid.min_access_size = 1, 2229 .valid.max_access_size = 4, 2230 .impl.min_access_size = 1, 2231 .impl.max_access_size = 1, 2232 .endianness = DEVICE_LITTLE_ENDIAN, 2233 }; 2234 2235 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2236 .read = ehci_opreg_read, 2237 .write = ehci_opreg_write, 2238 .valid.min_access_size = 4, 2239 .valid.max_access_size = 4, 2240 .endianness = DEVICE_LITTLE_ENDIAN, 2241 }; 2242 2243 static const MemoryRegionOps ehci_mmio_port_ops = { 2244 .read = ehci_port_read, 2245 .write = ehci_port_write, 2246 .valid.min_access_size = 4, 2247 .valid.max_access_size = 4, 2248 .endianness = DEVICE_LITTLE_ENDIAN, 2249 }; 2250 2251 static USBPortOps ehci_port_ops = { 2252 .attach = ehci_attach, 2253 .detach = ehci_detach, 2254 .child_detach = ehci_child_detach, 2255 .wakeup = ehci_wakeup, 2256 .complete = ehci_async_complete_packet, 2257 }; 2258 2259 static USBBusOps ehci_bus_ops = { 2260 .register_companion = ehci_register_companion, 2261 }; 2262 2263 static int usb_ehci_post_load(void *opaque, int version_id) 2264 { 2265 EHCIState *s = opaque; 2266 int i; 2267 2268 for (i = 0; i < NB_PORTS; i++) { 2269 USBPort *companion = s->companion_ports[i]; 2270 if (companion == NULL) { 2271 continue; 2272 } 2273 if (s->portsc[i] & PORTSC_POWNER) { 2274 companion->dev = s->ports[i].dev; 2275 } else { 2276 companion->dev = NULL; 2277 } 2278 } 2279 2280 return 0; 2281 } 2282 2283 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2284 { 2285 EHCIState *ehci = opaque; 2286 2287 /* 2288 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2289 * schedule in guest memory. We must do the rebuilt ASAP, so that 2290 * USB-devices which have async handled packages have a packet in the 2291 * ep queue to match the completion with. 2292 */ 2293 if (state == RUN_STATE_RUNNING) { 2294 ehci_advance_async_state(ehci); 2295 } 2296 2297 /* 2298 * The schedule rebuilt from guest memory could cause the migration dest 2299 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2300 * will never have existed on the destination. Therefor we must flush the 2301 * async schedule on savevm to catch any not yet noticed unlinks. 2302 */ 2303 if (state == RUN_STATE_SAVE_VM) { 2304 ehci_advance_async_state(ehci); 2305 ehci_queues_rip_unseen(ehci, 1); 2306 } 2307 } 2308 2309 const VMStateDescription vmstate_ehci = { 2310 .name = "ehci-core", 2311 .version_id = 2, 2312 .minimum_version_id = 1, 2313 .post_load = usb_ehci_post_load, 2314 .fields = (VMStateField[]) { 2315 /* mmio registers */ 2316 VMSTATE_UINT32(usbcmd, EHCIState), 2317 VMSTATE_UINT32(usbsts, EHCIState), 2318 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2319 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2320 VMSTATE_UINT32(usbintr, EHCIState), 2321 VMSTATE_UINT32(frindex, EHCIState), 2322 VMSTATE_UINT32(ctrldssegment, EHCIState), 2323 VMSTATE_UINT32(periodiclistbase, EHCIState), 2324 VMSTATE_UINT32(asynclistaddr, EHCIState), 2325 VMSTATE_UINT32(configflag, EHCIState), 2326 VMSTATE_UINT32(portsc[0], EHCIState), 2327 VMSTATE_UINT32(portsc[1], EHCIState), 2328 VMSTATE_UINT32(portsc[2], EHCIState), 2329 VMSTATE_UINT32(portsc[3], EHCIState), 2330 VMSTATE_UINT32(portsc[4], EHCIState), 2331 VMSTATE_UINT32(portsc[5], EHCIState), 2332 /* frame timer */ 2333 VMSTATE_TIMER(frame_timer, EHCIState), 2334 VMSTATE_UINT64(last_run_ns, EHCIState), 2335 VMSTATE_UINT32(async_stepdown, EHCIState), 2336 /* schedule state */ 2337 VMSTATE_UINT32(astate, EHCIState), 2338 VMSTATE_UINT32(pstate, EHCIState), 2339 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2340 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2341 VMSTATE_END_OF_LIST() 2342 } 2343 }; 2344 2345 void usb_ehci_initfn(EHCIState *s, DeviceState *dev) 2346 { 2347 int i; 2348 2349 /* 2.2 host controller interface version */ 2350 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2351 s->caps[0x01] = 0x00; 2352 s->caps[0x02] = 0x00; 2353 s->caps[0x03] = 0x01; /* HC version */ 2354 s->caps[0x04] = NB_PORTS; /* Number of downstream ports */ 2355 s->caps[0x05] = 0x00; /* No companion ports at present */ 2356 s->caps[0x06] = 0x00; 2357 s->caps[0x07] = 0x00; 2358 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2359 s->caps[0x0a] = 0x00; 2360 s->caps[0x0b] = 0x00; 2361 2362 usb_bus_new(&s->bus, &ehci_bus_ops, dev); 2363 for(i = 0; i < NB_PORTS; i++) { 2364 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2365 USB_SPEED_MASK_HIGH); 2366 s->ports[i].dev = 0; 2367 } 2368 2369 s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s); 2370 s->async_bh = qemu_bh_new(ehci_frame_timer, s); 2371 QTAILQ_INIT(&s->aqueues); 2372 QTAILQ_INIT(&s->pqueues); 2373 usb_packet_init(&s->ipacket); 2374 2375 qemu_register_reset(ehci_reset, s); 2376 qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2377 2378 memory_region_init(&s->mem, "ehci", MMIO_SIZE); 2379 memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s, 2380 "capabilities", CAPA_SIZE); 2381 memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s, 2382 "operational", PORTSC_BEGIN); 2383 memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s, 2384 "ports", PORTSC_END - PORTSC_BEGIN); 2385 2386 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2387 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2388 memory_region_add_subregion(&s->mem, s->opregbase + PORTSC_BEGIN, 2389 &s->mem_ports); 2390 } 2391 2392 /* 2393 * vim: expandtab ts=4 2394 */ 2395