1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "qemu/osdep.h" 31 #include "qapi/error.h" 32 #include "hw/usb/ehci-regs.h" 33 #include "hw/usb/hcd-ehci.h" 34 #include "trace.h" 35 36 #define FRAME_TIMER_FREQ 1000 37 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) 38 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) 39 40 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 41 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 42 #define MAX_QH 100 // Max allowable queue heads in a chain 43 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ 44 #define PERIODIC_ACTIVE 512 /* Micro-frames */ 45 46 /* Internal periodic / asynchronous schedule state machine states 47 */ 48 typedef enum { 49 EST_INACTIVE = 1000, 50 EST_ACTIVE, 51 EST_EXECUTING, 52 EST_SLEEPING, 53 /* The following states are internal to the state machine function 54 */ 55 EST_WAITLISTHEAD, 56 EST_FETCHENTRY, 57 EST_FETCHQH, 58 EST_FETCHITD, 59 EST_FETCHSITD, 60 EST_ADVANCEQUEUE, 61 EST_FETCHQTD, 62 EST_EXECUTE, 63 EST_WRITEBACK, 64 EST_HORIZONTALQH 65 } EHCI_STATES; 66 67 /* macros for accessing fields within next link pointer entry */ 68 #define NLPTR_GET(x) ((x) & 0xffffffe0) 69 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 70 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 71 72 /* link pointer types */ 73 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 74 #define NLPTR_TYPE_QH 1 // queue head 75 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 76 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 77 78 #define SET_LAST_RUN_CLOCK(s) \ 79 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 80 81 /* nifty macros from Arnon's EHCI version */ 82 #define get_field(data, field) \ 83 (((data) & field##_MASK) >> field##_SH) 84 85 #define set_field(data, newval, field) do { \ 86 uint32_t val = *data; \ 87 val &= ~ field##_MASK; \ 88 val |= ((newval) << field##_SH) & field##_MASK; \ 89 *data = val; \ 90 } while(0) 91 92 static const char *ehci_state_names[] = { 93 [EST_INACTIVE] = "INACTIVE", 94 [EST_ACTIVE] = "ACTIVE", 95 [EST_EXECUTING] = "EXECUTING", 96 [EST_SLEEPING] = "SLEEPING", 97 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 98 [EST_FETCHENTRY] = "FETCH ENTRY", 99 [EST_FETCHQH] = "FETCH QH", 100 [EST_FETCHITD] = "FETCH ITD", 101 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 102 [EST_FETCHQTD] = "FETCH QTD", 103 [EST_EXECUTE] = "EXECUTE", 104 [EST_WRITEBACK] = "WRITEBACK", 105 [EST_HORIZONTALQH] = "HORIZONTALQH", 106 }; 107 108 static const char *ehci_mmio_names[] = { 109 [USBCMD] = "USBCMD", 110 [USBSTS] = "USBSTS", 111 [USBINTR] = "USBINTR", 112 [FRINDEX] = "FRINDEX", 113 [PERIODICLISTBASE] = "P-LIST BASE", 114 [ASYNCLISTADDR] = "A-LIST ADDR", 115 [CONFIGFLAG] = "CONFIGFLAG", 116 }; 117 118 static int ehci_state_executing(EHCIQueue *q); 119 static int ehci_state_writeback(EHCIQueue *q); 120 static int ehci_state_advqueue(EHCIQueue *q); 121 static int ehci_fill_queue(EHCIPacket *p); 122 static void ehci_free_packet(EHCIPacket *p); 123 124 static const char *nr2str(const char **n, size_t len, uint32_t nr) 125 { 126 if (nr < len && n[nr] != NULL) { 127 return n[nr]; 128 } else { 129 return "unknown"; 130 } 131 } 132 133 static const char *state2str(uint32_t state) 134 { 135 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 136 } 137 138 static const char *addr2str(hwaddr addr) 139 { 140 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 141 } 142 143 static void ehci_trace_usbsts(uint32_t mask, int state) 144 { 145 /* interrupts */ 146 if (mask & USBSTS_INT) { 147 trace_usb_ehci_usbsts("INT", state); 148 } 149 if (mask & USBSTS_ERRINT) { 150 trace_usb_ehci_usbsts("ERRINT", state); 151 } 152 if (mask & USBSTS_PCD) { 153 trace_usb_ehci_usbsts("PCD", state); 154 } 155 if (mask & USBSTS_FLR) { 156 trace_usb_ehci_usbsts("FLR", state); 157 } 158 if (mask & USBSTS_HSE) { 159 trace_usb_ehci_usbsts("HSE", state); 160 } 161 if (mask & USBSTS_IAA) { 162 trace_usb_ehci_usbsts("IAA", state); 163 } 164 165 /* status */ 166 if (mask & USBSTS_HALT) { 167 trace_usb_ehci_usbsts("HALT", state); 168 } 169 if (mask & USBSTS_REC) { 170 trace_usb_ehci_usbsts("REC", state); 171 } 172 if (mask & USBSTS_PSS) { 173 trace_usb_ehci_usbsts("PSS", state); 174 } 175 if (mask & USBSTS_ASS) { 176 trace_usb_ehci_usbsts("ASS", state); 177 } 178 } 179 180 static inline void ehci_set_usbsts(EHCIState *s, int mask) 181 { 182 if ((s->usbsts & mask) == mask) { 183 return; 184 } 185 ehci_trace_usbsts(mask, 1); 186 s->usbsts |= mask; 187 } 188 189 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 190 { 191 if ((s->usbsts & mask) == 0) { 192 return; 193 } 194 ehci_trace_usbsts(mask, 0); 195 s->usbsts &= ~mask; 196 } 197 198 /* update irq line */ 199 static inline void ehci_update_irq(EHCIState *s) 200 { 201 int level = 0; 202 203 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 204 level = 1; 205 } 206 207 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 208 qemu_set_irq(s->irq, level); 209 } 210 211 /* flag interrupt condition */ 212 static inline void ehci_raise_irq(EHCIState *s, int intr) 213 { 214 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 215 s->usbsts |= intr; 216 ehci_update_irq(s); 217 } else { 218 s->usbsts_pending |= intr; 219 } 220 } 221 222 /* 223 * Commit pending interrupts (added via ehci_raise_irq), 224 * at the rate allowed by "Interrupt Threshold Control". 225 */ 226 static inline void ehci_commit_irq(EHCIState *s) 227 { 228 uint32_t itc; 229 230 if (!s->usbsts_pending) { 231 return; 232 } 233 if (s->usbsts_frindex > s->frindex) { 234 return; 235 } 236 237 itc = (s->usbcmd >> 16) & 0xff; 238 s->usbsts |= s->usbsts_pending; 239 s->usbsts_pending = 0; 240 s->usbsts_frindex = s->frindex + itc; 241 ehci_update_irq(s); 242 } 243 244 static void ehci_update_halt(EHCIState *s) 245 { 246 if (s->usbcmd & USBCMD_RUNSTOP) { 247 ehci_clear_usbsts(s, USBSTS_HALT); 248 } else { 249 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 250 ehci_set_usbsts(s, USBSTS_HALT); 251 } 252 } 253 } 254 255 static void ehci_set_state(EHCIState *s, int async, int state) 256 { 257 if (async) { 258 trace_usb_ehci_state("async", state2str(state)); 259 s->astate = state; 260 if (s->astate == EST_INACTIVE) { 261 ehci_clear_usbsts(s, USBSTS_ASS); 262 ehci_update_halt(s); 263 } else { 264 ehci_set_usbsts(s, USBSTS_ASS); 265 } 266 } else { 267 trace_usb_ehci_state("periodic", state2str(state)); 268 s->pstate = state; 269 if (s->pstate == EST_INACTIVE) { 270 ehci_clear_usbsts(s, USBSTS_PSS); 271 ehci_update_halt(s); 272 } else { 273 ehci_set_usbsts(s, USBSTS_PSS); 274 } 275 } 276 } 277 278 static int ehci_get_state(EHCIState *s, int async) 279 { 280 return async ? s->astate : s->pstate; 281 } 282 283 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 284 { 285 if (async) { 286 s->a_fetch_addr = addr; 287 } else { 288 s->p_fetch_addr = addr; 289 } 290 } 291 292 static int ehci_get_fetch_addr(EHCIState *s, int async) 293 { 294 return async ? s->a_fetch_addr : s->p_fetch_addr; 295 } 296 297 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 298 { 299 /* need three here due to argument count limits */ 300 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 301 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 302 trace_usb_ehci_qh_fields(addr, 303 get_field(qh->epchar, QH_EPCHAR_RL), 304 get_field(qh->epchar, QH_EPCHAR_MPLEN), 305 get_field(qh->epchar, QH_EPCHAR_EPS), 306 get_field(qh->epchar, QH_EPCHAR_EP), 307 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 308 trace_usb_ehci_qh_bits(addr, 309 (bool)(qh->epchar & QH_EPCHAR_C), 310 (bool)(qh->epchar & QH_EPCHAR_H), 311 (bool)(qh->epchar & QH_EPCHAR_DTC), 312 (bool)(qh->epchar & QH_EPCHAR_I)); 313 } 314 315 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 316 { 317 /* need three here due to argument count limits */ 318 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 319 trace_usb_ehci_qtd_fields(addr, 320 get_field(qtd->token, QTD_TOKEN_TBYTES), 321 get_field(qtd->token, QTD_TOKEN_CPAGE), 322 get_field(qtd->token, QTD_TOKEN_CERR), 323 get_field(qtd->token, QTD_TOKEN_PID)); 324 trace_usb_ehci_qtd_bits(addr, 325 (bool)(qtd->token & QTD_TOKEN_IOC), 326 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 327 (bool)(qtd->token & QTD_TOKEN_HALT), 328 (bool)(qtd->token & QTD_TOKEN_BABBLE), 329 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 330 } 331 332 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 333 { 334 trace_usb_ehci_itd(addr, itd->next, 335 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 336 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 337 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 338 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 339 } 340 341 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 342 EHCIsitd *sitd) 343 { 344 trace_usb_ehci_sitd(addr, sitd->next, 345 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 346 } 347 348 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 349 { 350 trace_usb_ehci_guest_bug(message); 351 fprintf(stderr, "ehci warning: %s\n", message); 352 } 353 354 static inline bool ehci_enabled(EHCIState *s) 355 { 356 return s->usbcmd & USBCMD_RUNSTOP; 357 } 358 359 static inline bool ehci_async_enabled(EHCIState *s) 360 { 361 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 362 } 363 364 static inline bool ehci_periodic_enabled(EHCIState *s) 365 { 366 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 367 } 368 369 /* Get an array of dwords from main memory */ 370 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 371 uint32_t *buf, int num) 372 { 373 int i; 374 375 if (!ehci->as) { 376 ehci_raise_irq(ehci, USBSTS_HSE); 377 ehci->usbcmd &= ~USBCMD_RUNSTOP; 378 trace_usb_ehci_dma_error(); 379 return -1; 380 } 381 382 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 383 dma_memory_read(ehci->as, addr, buf, sizeof(*buf)); 384 *buf = le32_to_cpu(*buf); 385 } 386 387 return num; 388 } 389 390 /* Put an array of dwords in to main memory */ 391 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 392 uint32_t *buf, int num) 393 { 394 int i; 395 396 if (!ehci->as) { 397 ehci_raise_irq(ehci, USBSTS_HSE); 398 ehci->usbcmd &= ~USBCMD_RUNSTOP; 399 trace_usb_ehci_dma_error(); 400 return -1; 401 } 402 403 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 404 uint32_t tmp = cpu_to_le32(*buf); 405 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp)); 406 } 407 408 return num; 409 } 410 411 static int ehci_get_pid(EHCIqtd *qtd) 412 { 413 switch (get_field(qtd->token, QTD_TOKEN_PID)) { 414 case 0: 415 return USB_TOKEN_OUT; 416 case 1: 417 return USB_TOKEN_IN; 418 case 2: 419 return USB_TOKEN_SETUP; 420 default: 421 fprintf(stderr, "bad token\n"); 422 return 0; 423 } 424 } 425 426 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh) 427 { 428 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR); 429 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP); 430 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 431 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 432 (qh->current_qtd != q->qh.current_qtd) || 433 (q->async && qh->next_qtd != q->qh.next_qtd) || 434 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd, 435 7 * sizeof(uint32_t)) != 0) || 436 (q->dev != NULL && q->dev->addr != devaddr)) { 437 return false; 438 } else { 439 return true; 440 } 441 } 442 443 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) 444 { 445 if (p->qtdaddr != p->queue->qtdaddr || 446 (p->queue->async && !NLPTR_TBIT(p->qtd.next) && 447 (p->qtd.next != qtd->next)) || 448 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || 449 p->qtd.token != qtd->token || 450 p->qtd.bufptr[0] != qtd->bufptr[0]) { 451 return false; 452 } else { 453 return true; 454 } 455 } 456 457 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) 458 { 459 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP); 460 int pid = ehci_get_pid(qtd); 461 462 /* Note the pid changing is normal for ep 0 (the control ep) */ 463 if (q->last_pid && ep != 0 && pid != q->last_pid) { 464 return false; 465 } else { 466 return true; 467 } 468 } 469 470 /* Finish executing and writeback a packet outside of the regular 471 fetchqh -> fetchqtd -> execute -> writeback cycle */ 472 static void ehci_writeback_async_complete_packet(EHCIPacket *p) 473 { 474 EHCIQueue *q = p->queue; 475 EHCIqtd qtd; 476 EHCIqh qh; 477 int state; 478 479 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ 480 get_dwords(q->ehci, NLPTR_GET(q->qhaddr), 481 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 482 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), 483 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 484 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { 485 p->async = EHCI_ASYNC_INITIALIZED; 486 ehci_free_packet(p); 487 return; 488 } 489 490 state = ehci_get_state(q->ehci, q->async); 491 ehci_state_executing(q); 492 ehci_state_writeback(q); /* Frees the packet! */ 493 if (!(q->qh.token & QTD_TOKEN_HALT)) { 494 ehci_state_advqueue(q); 495 } 496 ehci_set_state(q->ehci, q->async, state); 497 } 498 499 /* packet management */ 500 501 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 502 { 503 EHCIPacket *p; 504 505 p = g_new0(EHCIPacket, 1); 506 p->queue = q; 507 usb_packet_init(&p->packet); 508 QTAILQ_INSERT_TAIL(&q->packets, p, next); 509 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 510 return p; 511 } 512 513 static void ehci_free_packet(EHCIPacket *p) 514 { 515 if (p->async == EHCI_ASYNC_FINISHED && 516 !(p->queue->qh.token & QTD_TOKEN_HALT)) { 517 ehci_writeback_async_complete_packet(p); 518 return; 519 } 520 trace_usb_ehci_packet_action(p->queue, p, "free"); 521 if (p->async == EHCI_ASYNC_INFLIGHT) { 522 usb_cancel_packet(&p->packet); 523 } 524 if (p->async == EHCI_ASYNC_FINISHED && 525 p->packet.status == USB_RET_SUCCESS) { 526 fprintf(stderr, 527 "EHCI: Dropping completed packet from halted %s ep %02X\n", 528 (p->pid == USB_TOKEN_IN) ? "in" : "out", 529 get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); 530 } 531 if (p->async != EHCI_ASYNC_NONE) { 532 usb_packet_unmap(&p->packet, &p->sgl); 533 qemu_sglist_destroy(&p->sgl); 534 } 535 QTAILQ_REMOVE(&p->queue->packets, p, next); 536 usb_packet_cleanup(&p->packet); 537 g_free(p); 538 } 539 540 /* queue management */ 541 542 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 543 { 544 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 545 EHCIQueue *q; 546 547 q = g_malloc0(sizeof(*q)); 548 q->ehci = ehci; 549 q->qhaddr = addr; 550 q->async = async; 551 QTAILQ_INIT(&q->packets); 552 QTAILQ_INSERT_HEAD(head, q, next); 553 trace_usb_ehci_queue_action(q, "alloc"); 554 return q; 555 } 556 557 static void ehci_queue_stopped(EHCIQueue *q) 558 { 559 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP); 560 561 if (!q->last_pid || !q->dev) { 562 return; 563 } 564 565 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp)); 566 } 567 568 static int ehci_cancel_queue(EHCIQueue *q) 569 { 570 EHCIPacket *p; 571 int packets = 0; 572 573 p = QTAILQ_FIRST(&q->packets); 574 if (p == NULL) { 575 goto leave; 576 } 577 578 trace_usb_ehci_queue_action(q, "cancel"); 579 do { 580 ehci_free_packet(p); 581 packets++; 582 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 583 584 leave: 585 ehci_queue_stopped(q); 586 return packets; 587 } 588 589 static int ehci_reset_queue(EHCIQueue *q) 590 { 591 int packets; 592 593 trace_usb_ehci_queue_action(q, "reset"); 594 packets = ehci_cancel_queue(q); 595 q->dev = NULL; 596 q->qtdaddr = 0; 597 q->last_pid = 0; 598 return packets; 599 } 600 601 static void ehci_free_queue(EHCIQueue *q, const char *warn) 602 { 603 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 604 int cancelled; 605 606 trace_usb_ehci_queue_action(q, "free"); 607 cancelled = ehci_cancel_queue(q); 608 if (warn && cancelled > 0) { 609 ehci_trace_guest_bug(q->ehci, warn); 610 } 611 QTAILQ_REMOVE(head, q, next); 612 g_free(q); 613 } 614 615 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 616 int async) 617 { 618 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 619 EHCIQueue *q; 620 621 QTAILQ_FOREACH(q, head, next) { 622 if (addr == q->qhaddr) { 623 return q; 624 } 625 } 626 return NULL; 627 } 628 629 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 630 { 631 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 632 const char *warn = async ? "guest unlinked busy QH" : NULL; 633 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 634 EHCIQueue *q, *tmp; 635 636 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 637 if (q->seen) { 638 q->seen = 0; 639 q->ts = ehci->last_run_ns; 640 continue; 641 } 642 if (ehci->last_run_ns < q->ts + maxage) { 643 continue; 644 } 645 ehci_free_queue(q, warn); 646 } 647 } 648 649 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 650 { 651 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 652 EHCIQueue *q, *tmp; 653 654 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 655 if (!q->seen) { 656 ehci_free_queue(q, NULL); 657 } 658 } 659 } 660 661 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 662 { 663 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 664 EHCIQueue *q, *tmp; 665 666 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 667 if (q->dev != dev) { 668 continue; 669 } 670 ehci_free_queue(q, NULL); 671 } 672 } 673 674 static void ehci_queues_rip_all(EHCIState *ehci, int async) 675 { 676 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 677 const char *warn = async ? "guest stopped busy async schedule" : NULL; 678 EHCIQueue *q, *tmp; 679 680 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 681 ehci_free_queue(q, warn); 682 } 683 } 684 685 /* Attach or detach a device on root hub */ 686 687 static void ehci_attach(USBPort *port) 688 { 689 EHCIState *s = port->opaque; 690 uint32_t *portsc = &s->portsc[port->index]; 691 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 692 693 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 694 695 if (*portsc & PORTSC_POWNER) { 696 USBPort *companion = s->companion_ports[port->index]; 697 companion->dev = port->dev; 698 companion->ops->attach(companion); 699 return; 700 } 701 702 *portsc |= PORTSC_CONNECT; 703 *portsc |= PORTSC_CSC; 704 705 ehci_raise_irq(s, USBSTS_PCD); 706 } 707 708 static void ehci_detach(USBPort *port) 709 { 710 EHCIState *s = port->opaque; 711 uint32_t *portsc = &s->portsc[port->index]; 712 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 713 714 trace_usb_ehci_port_detach(port->index, owner); 715 716 if (*portsc & PORTSC_POWNER) { 717 USBPort *companion = s->companion_ports[port->index]; 718 companion->ops->detach(companion); 719 companion->dev = NULL; 720 /* 721 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 722 * the port ownership is returned immediately to the EHCI controller." 723 */ 724 *portsc &= ~PORTSC_POWNER; 725 return; 726 } 727 728 ehci_queues_rip_device(s, port->dev, 0); 729 ehci_queues_rip_device(s, port->dev, 1); 730 731 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); 732 *portsc |= PORTSC_CSC; 733 734 ehci_raise_irq(s, USBSTS_PCD); 735 } 736 737 static void ehci_child_detach(USBPort *port, USBDevice *child) 738 { 739 EHCIState *s = port->opaque; 740 uint32_t portsc = s->portsc[port->index]; 741 742 if (portsc & PORTSC_POWNER) { 743 USBPort *companion = s->companion_ports[port->index]; 744 companion->ops->child_detach(companion, child); 745 return; 746 } 747 748 ehci_queues_rip_device(s, child, 0); 749 ehci_queues_rip_device(s, child, 1); 750 } 751 752 static void ehci_wakeup(USBPort *port) 753 { 754 EHCIState *s = port->opaque; 755 uint32_t *portsc = &s->portsc[port->index]; 756 757 if (*portsc & PORTSC_POWNER) { 758 USBPort *companion = s->companion_ports[port->index]; 759 if (companion->ops->wakeup) { 760 companion->ops->wakeup(companion); 761 } 762 return; 763 } 764 765 if (*portsc & PORTSC_SUSPEND) { 766 trace_usb_ehci_port_wakeup(port->index); 767 *portsc |= PORTSC_FPRES; 768 ehci_raise_irq(s, USBSTS_PCD); 769 } 770 771 qemu_bh_schedule(s->async_bh); 772 } 773 774 static void ehci_register_companion(USBBus *bus, USBPort *ports[], 775 uint32_t portcount, uint32_t firstport, 776 Error **errp) 777 { 778 EHCIState *s = container_of(bus, EHCIState, bus); 779 uint32_t i; 780 781 if (firstport + portcount > NB_PORTS) { 782 error_setg(errp, "firstport must be between 0 and %u", 783 NB_PORTS - portcount); 784 return; 785 } 786 787 for (i = 0; i < portcount; i++) { 788 if (s->companion_ports[firstport + i]) { 789 error_setg(errp, "firstport %u asks for ports %u-%u," 790 " but port %u has a companion assigned already", 791 firstport, firstport, firstport + portcount - 1, 792 firstport + i); 793 return; 794 } 795 } 796 797 for (i = 0; i < portcount; i++) { 798 s->companion_ports[firstport + i] = ports[i]; 799 s->ports[firstport + i].speedmask |= 800 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 801 /* Ensure devs attached before the initial reset go to the companion */ 802 s->portsc[firstport + i] = PORTSC_POWNER; 803 } 804 805 s->companion_count++; 806 s->caps[0x05] = (s->companion_count << 4) | portcount; 807 } 808 809 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, 810 unsigned int stream) 811 { 812 EHCIState *s = container_of(bus, EHCIState, bus); 813 uint32_t portsc = s->portsc[ep->dev->port->index]; 814 815 if (portsc & PORTSC_POWNER) { 816 return; 817 } 818 819 s->periodic_sched_active = PERIODIC_ACTIVE; 820 qemu_bh_schedule(s->async_bh); 821 } 822 823 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 824 { 825 USBDevice *dev; 826 USBPort *port; 827 int i; 828 829 for (i = 0; i < NB_PORTS; i++) { 830 port = &ehci->ports[i]; 831 if (!(ehci->portsc[i] & PORTSC_PED)) { 832 DPRINTF("Port %d not enabled\n", i); 833 continue; 834 } 835 dev = usb_find_device(port, addr); 836 if (dev != NULL) { 837 return dev; 838 } 839 } 840 return NULL; 841 } 842 843 /* 4.1 host controller initialization */ 844 void ehci_reset(void *opaque) 845 { 846 EHCIState *s = opaque; 847 int i; 848 USBDevice *devs[NB_PORTS]; 849 850 trace_usb_ehci_reset(); 851 852 /* 853 * Do the detach before touching portsc, so that it correctly gets send to 854 * us or to our companion based on PORTSC_POWNER before the reset. 855 */ 856 for(i = 0; i < NB_PORTS; i++) { 857 devs[i] = s->ports[i].dev; 858 if (devs[i] && devs[i]->attached) { 859 usb_detach(&s->ports[i]); 860 } 861 } 862 863 memset(&s->opreg, 0x00, sizeof(s->opreg)); 864 memset(&s->portsc, 0x00, sizeof(s->portsc)); 865 866 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 867 s->usbsts = USBSTS_HALT; 868 s->usbsts_pending = 0; 869 s->usbsts_frindex = 0; 870 ehci_update_irq(s); 871 872 s->astate = EST_INACTIVE; 873 s->pstate = EST_INACTIVE; 874 875 for(i = 0; i < NB_PORTS; i++) { 876 if (s->companion_ports[i]) { 877 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 878 } else { 879 s->portsc[i] = PORTSC_PPOWER; 880 } 881 if (devs[i] && devs[i]->attached) { 882 usb_attach(&s->ports[i]); 883 usb_device_reset(devs[i]); 884 } 885 } 886 ehci_queues_rip_all(s, 0); 887 ehci_queues_rip_all(s, 1); 888 timer_del(s->frame_timer); 889 qemu_bh_cancel(s->async_bh); 890 } 891 892 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 893 unsigned size) 894 { 895 EHCIState *s = ptr; 896 return s->caps[addr]; 897 } 898 899 static void ehci_caps_write(void *ptr, hwaddr addr, 900 uint64_t val, unsigned size) 901 { 902 } 903 904 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 905 unsigned size) 906 { 907 EHCIState *s = ptr; 908 uint32_t val; 909 910 switch (addr) { 911 case FRINDEX: 912 /* Round down to mult of 8, else it can go backwards on migration */ 913 val = s->frindex & ~7; 914 break; 915 default: 916 val = s->opreg[addr >> 2]; 917 } 918 919 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 920 return val; 921 } 922 923 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 924 unsigned size) 925 { 926 EHCIState *s = ptr; 927 uint32_t val; 928 929 val = s->portsc[addr >> 2]; 930 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val); 931 return val; 932 } 933 934 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 935 { 936 USBDevice *dev = s->ports[port].dev; 937 uint32_t *portsc = &s->portsc[port]; 938 uint32_t orig; 939 940 if (s->companion_ports[port] == NULL) 941 return; 942 943 owner = owner & PORTSC_POWNER; 944 orig = *portsc & PORTSC_POWNER; 945 946 if (!(owner ^ orig)) { 947 return; 948 } 949 950 if (dev && dev->attached) { 951 usb_detach(&s->ports[port]); 952 } 953 954 *portsc &= ~PORTSC_POWNER; 955 *portsc |= owner; 956 957 if (dev && dev->attached) { 958 usb_attach(&s->ports[port]); 959 } 960 } 961 962 static void ehci_port_write(void *ptr, hwaddr addr, 963 uint64_t val, unsigned size) 964 { 965 EHCIState *s = ptr; 966 int port = addr >> 2; 967 uint32_t *portsc = &s->portsc[port]; 968 uint32_t old = *portsc; 969 USBDevice *dev = s->ports[port].dev; 970 971 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val); 972 973 /* Clear rwc bits */ 974 *portsc &= ~(val & PORTSC_RWC_MASK); 975 /* The guest may clear, but not set the PED bit */ 976 *portsc &= val | ~PORTSC_PED; 977 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 978 handle_port_owner_write(s, port, val); 979 /* And finally apply RO_MASK */ 980 val &= PORTSC_RO_MASK; 981 982 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 983 trace_usb_ehci_port_reset(port, 1); 984 } 985 986 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 987 trace_usb_ehci_port_reset(port, 0); 988 if (dev && dev->attached) { 989 usb_port_reset(&s->ports[port]); 990 *portsc &= ~PORTSC_CSC; 991 } 992 993 /* 994 * Table 2.16 Set the enable bit(and enable bit change) to indicate 995 * to SW that this port has a high speed device attached 996 */ 997 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 998 val |= PORTSC_PED; 999 } 1000 } 1001 1002 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) { 1003 trace_usb_ehci_port_suspend(port); 1004 } 1005 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) { 1006 trace_usb_ehci_port_resume(port); 1007 val &= ~PORTSC_SUSPEND; 1008 } 1009 1010 *portsc &= ~PORTSC_RO_MASK; 1011 *portsc |= val; 1012 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old); 1013 } 1014 1015 static void ehci_opreg_write(void *ptr, hwaddr addr, 1016 uint64_t val, unsigned size) 1017 { 1018 EHCIState *s = ptr; 1019 uint32_t *mmio = s->opreg + (addr >> 2); 1020 uint32_t old = *mmio; 1021 int i; 1022 1023 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 1024 1025 switch (addr) { 1026 case USBCMD: 1027 if (val & USBCMD_HCRESET) { 1028 ehci_reset(s); 1029 val = s->usbcmd; 1030 break; 1031 } 1032 1033 /* not supporting dynamic frame list size at the moment */ 1034 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 1035 fprintf(stderr, "attempt to set frame list size -- value %d\n", 1036 (int)val & USBCMD_FLS); 1037 val &= ~USBCMD_FLS; 1038 } 1039 1040 if (val & USBCMD_IAAD) { 1041 /* 1042 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 1043 * trigger and re-use a qh without us seeing the unlink. 1044 */ 1045 s->async_stepdown = 0; 1046 qemu_bh_schedule(s->async_bh); 1047 trace_usb_ehci_doorbell_ring(); 1048 } 1049 1050 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 1051 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 1052 if (s->pstate == EST_INACTIVE) { 1053 SET_LAST_RUN_CLOCK(s); 1054 } 1055 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 1056 ehci_update_halt(s); 1057 s->async_stepdown = 0; 1058 qemu_bh_schedule(s->async_bh); 1059 } 1060 break; 1061 1062 case USBSTS: 1063 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 1064 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 1065 val = s->usbsts; 1066 ehci_update_irq(s); 1067 break; 1068 1069 case USBINTR: 1070 val &= USBINTR_MASK; 1071 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 1072 qemu_bh_schedule(s->async_bh); 1073 } 1074 break; 1075 1076 case FRINDEX: 1077 val &= 0x00003fff; /* frindex is 14bits */ 1078 s->usbsts_frindex = val; 1079 break; 1080 1081 case CONFIGFLAG: 1082 val &= 0x1; 1083 if (val) { 1084 for(i = 0; i < NB_PORTS; i++) 1085 handle_port_owner_write(s, i, 0); 1086 } 1087 break; 1088 1089 case PERIODICLISTBASE: 1090 if (ehci_periodic_enabled(s)) { 1091 fprintf(stderr, 1092 "ehci: PERIODIC list base register set while periodic schedule\n" 1093 " is enabled and HC is enabled\n"); 1094 } 1095 break; 1096 1097 case ASYNCLISTADDR: 1098 if (ehci_async_enabled(s)) { 1099 fprintf(stderr, 1100 "ehci: ASYNC list address register set while async schedule\n" 1101 " is enabled and HC is enabled\n"); 1102 } 1103 break; 1104 } 1105 1106 *mmio = val; 1107 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1108 *mmio, old); 1109 } 1110 1111 /* 1112 * Write the qh back to guest physical memory. This step isn't 1113 * in the EHCI spec but we need to do it since we don't share 1114 * physical memory with our guest VM. 1115 * 1116 * The first three dwords are read-only for the EHCI, so skip them 1117 * when writing back the qh. 1118 */ 1119 static void ehci_flush_qh(EHCIQueue *q) 1120 { 1121 uint32_t *qh = (uint32_t *) &q->qh; 1122 uint32_t dwords = sizeof(EHCIqh) >> 2; 1123 uint32_t addr = NLPTR_GET(q->qhaddr); 1124 1125 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1126 } 1127 1128 // 4.10.2 1129 1130 static int ehci_qh_do_overlay(EHCIQueue *q) 1131 { 1132 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1133 int i; 1134 int dtoggle; 1135 int ping; 1136 int eps; 1137 int reload; 1138 1139 assert(p != NULL); 1140 assert(p->qtdaddr == q->qtdaddr); 1141 1142 // remember values in fields to preserve in qh after overlay 1143 1144 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1145 ping = q->qh.token & QTD_TOKEN_PING; 1146 1147 q->qh.current_qtd = p->qtdaddr; 1148 q->qh.next_qtd = p->qtd.next; 1149 q->qh.altnext_qtd = p->qtd.altnext; 1150 q->qh.token = p->qtd.token; 1151 1152 1153 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1154 if (eps == EHCI_QH_EPS_HIGH) { 1155 q->qh.token &= ~QTD_TOKEN_PING; 1156 q->qh.token |= ping; 1157 } 1158 1159 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1160 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1161 1162 for (i = 0; i < 5; i++) { 1163 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1164 } 1165 1166 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1167 // preserve QH DT bit 1168 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1169 q->qh.token |= dtoggle; 1170 } 1171 1172 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1173 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1174 1175 ehci_flush_qh(q); 1176 1177 return 0; 1178 } 1179 1180 static int ehci_init_transfer(EHCIPacket *p) 1181 { 1182 uint32_t cpage, offset, bytes, plen; 1183 dma_addr_t page; 1184 1185 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1186 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1187 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1188 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as); 1189 1190 while (bytes > 0) { 1191 if (cpage > 4) { 1192 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1193 return -1; 1194 } 1195 1196 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1197 page += offset; 1198 plen = bytes; 1199 if (plen > 4096 - offset) { 1200 plen = 4096 - offset; 1201 offset = 0; 1202 cpage++; 1203 } 1204 1205 qemu_sglist_add(&p->sgl, page, plen); 1206 bytes -= plen; 1207 } 1208 return 0; 1209 } 1210 1211 static void ehci_finish_transfer(EHCIQueue *q, int len) 1212 { 1213 uint32_t cpage, offset; 1214 1215 if (len > 0) { 1216 /* update cpage & offset */ 1217 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1218 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1219 1220 offset += len; 1221 cpage += offset >> QTD_BUFPTR_SH; 1222 offset &= ~QTD_BUFPTR_MASK; 1223 1224 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1225 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1226 q->qh.bufptr[0] |= offset; 1227 } 1228 } 1229 1230 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1231 { 1232 EHCIPacket *p; 1233 EHCIState *s = port->opaque; 1234 uint32_t portsc = s->portsc[port->index]; 1235 1236 if (portsc & PORTSC_POWNER) { 1237 USBPort *companion = s->companion_ports[port->index]; 1238 companion->ops->complete(companion, packet); 1239 return; 1240 } 1241 1242 p = container_of(packet, EHCIPacket, packet); 1243 assert(p->async == EHCI_ASYNC_INFLIGHT); 1244 1245 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1246 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1247 ehci_free_packet(p); 1248 return; 1249 } 1250 1251 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1252 p->async = EHCI_ASYNC_FINISHED; 1253 1254 if (!p->queue->async) { 1255 s->periodic_sched_active = PERIODIC_ACTIVE; 1256 } 1257 qemu_bh_schedule(s->async_bh); 1258 } 1259 1260 static void ehci_execute_complete(EHCIQueue *q) 1261 { 1262 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1263 uint32_t tbytes; 1264 1265 assert(p != NULL); 1266 assert(p->qtdaddr == q->qtdaddr); 1267 assert(p->async == EHCI_ASYNC_INITIALIZED || 1268 p->async == EHCI_ASYNC_FINISHED); 1269 1270 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1271 "status %d, actual_length %d\n", 1272 q->qhaddr, q->qh.next, q->qtdaddr, 1273 p->packet.status, p->packet.actual_length); 1274 1275 switch (p->packet.status) { 1276 case USB_RET_SUCCESS: 1277 break; 1278 case USB_RET_IOERROR: 1279 case USB_RET_NODEV: 1280 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1281 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1282 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1283 break; 1284 case USB_RET_STALL: 1285 q->qh.token |= QTD_TOKEN_HALT; 1286 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1287 break; 1288 case USB_RET_NAK: 1289 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1290 return; /* We're not done yet with this transaction */ 1291 case USB_RET_BABBLE: 1292 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1293 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1294 break; 1295 default: 1296 /* should not be triggerable */ 1297 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1298 g_assert_not_reached(); 1299 break; 1300 } 1301 1302 /* TODO check 4.12 for splits */ 1303 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1304 if (tbytes && p->pid == USB_TOKEN_IN) { 1305 tbytes -= p->packet.actual_length; 1306 if (tbytes) { 1307 /* 4.15.1.2 must raise int on a short input packet */ 1308 ehci_raise_irq(q->ehci, USBSTS_INT); 1309 if (q->async) { 1310 q->ehci->int_req_by_async = true; 1311 } 1312 } 1313 } else { 1314 tbytes = 0; 1315 } 1316 DPRINTF("updating tbytes to %d\n", tbytes); 1317 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1318 1319 ehci_finish_transfer(q, p->packet.actual_length); 1320 usb_packet_unmap(&p->packet, &p->sgl); 1321 qemu_sglist_destroy(&p->sgl); 1322 p->async = EHCI_ASYNC_NONE; 1323 1324 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1325 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1326 1327 if (q->qh.token & QTD_TOKEN_IOC) { 1328 ehci_raise_irq(q->ehci, USBSTS_INT); 1329 if (q->async) { 1330 q->ehci->int_req_by_async = true; 1331 } 1332 } 1333 } 1334 1335 /* 4.10.3 returns "again" */ 1336 static int ehci_execute(EHCIPacket *p, const char *action) 1337 { 1338 USBEndpoint *ep; 1339 int endp; 1340 bool spd; 1341 1342 assert(p->async == EHCI_ASYNC_NONE || 1343 p->async == EHCI_ASYNC_INITIALIZED); 1344 1345 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1346 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1347 return -1; 1348 } 1349 1350 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1351 ehci_trace_guest_bug(p->queue->ehci, 1352 "guest requested more bytes than allowed"); 1353 return -1; 1354 } 1355 1356 if (!ehci_verify_pid(p->queue, &p->qtd)) { 1357 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */ 1358 } 1359 p->pid = ehci_get_pid(&p->qtd); 1360 p->queue->last_pid = p->pid; 1361 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1362 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1363 1364 if (p->async == EHCI_ASYNC_NONE) { 1365 if (ehci_init_transfer(p) != 0) { 1366 return -1; 1367 } 1368 1369 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1370 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, 1371 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1372 usb_packet_map(&p->packet, &p->sgl); 1373 p->async = EHCI_ASYNC_INITIALIZED; 1374 } 1375 1376 trace_usb_ehci_packet_action(p->queue, p, action); 1377 usb_handle_packet(p->queue->dev, &p->packet); 1378 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1379 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1380 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1381 p->packet.actual_length); 1382 1383 if (p->packet.actual_length > BUFF_SIZE) { 1384 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1385 return -1; 1386 } 1387 1388 return 1; 1389 } 1390 1391 /* 4.7.2 1392 */ 1393 1394 static int ehci_process_itd(EHCIState *ehci, 1395 EHCIitd *itd, 1396 uint32_t addr) 1397 { 1398 USBDevice *dev; 1399 USBEndpoint *ep; 1400 uint32_t i, len, pid, dir, devaddr, endp; 1401 uint32_t pg, off, ptr1, ptr2, max, mult; 1402 1403 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1404 1405 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1406 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1407 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1408 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1409 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1410 1411 for(i = 0; i < 8; i++) { 1412 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1413 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1414 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1415 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1416 1417 if (len > max * mult) { 1418 len = max * mult; 1419 } 1420 if (len > BUFF_SIZE || pg > 6) { 1421 return -1; 1422 } 1423 1424 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1425 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); 1426 if (off + len > 4096) { 1427 /* transfer crosses page border */ 1428 if (pg == 6) { 1429 return -1; /* avoid page pg + 1 */ 1430 } 1431 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); 1432 uint32_t len2 = off + len - 4096; 1433 uint32_t len1 = len - len2; 1434 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1435 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1436 } else { 1437 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1438 } 1439 1440 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1441 1442 dev = ehci_find_device(ehci, devaddr); 1443 ep = usb_ep_get(dev, pid, endp); 1444 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1445 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, 1446 (itd->transact[i] & ITD_XACT_IOC) != 0); 1447 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1448 usb_handle_packet(dev, &ehci->ipacket); 1449 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1450 } else { 1451 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1452 ehci->ipacket.status = USB_RET_NAK; 1453 ehci->ipacket.actual_length = 0; 1454 } 1455 qemu_sglist_destroy(&ehci->isgl); 1456 1457 switch (ehci->ipacket.status) { 1458 case USB_RET_SUCCESS: 1459 break; 1460 default: 1461 fprintf(stderr, "Unexpected iso usb result: %d\n", 1462 ehci->ipacket.status); 1463 /* Fall through */ 1464 case USB_RET_IOERROR: 1465 case USB_RET_NODEV: 1466 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1467 if (dir) { 1468 itd->transact[i] |= ITD_XACT_XACTERR; 1469 ehci_raise_irq(ehci, USBSTS_ERRINT); 1470 } 1471 break; 1472 case USB_RET_BABBLE: 1473 itd->transact[i] |= ITD_XACT_BABBLE; 1474 ehci_raise_irq(ehci, USBSTS_ERRINT); 1475 break; 1476 case USB_RET_NAK: 1477 /* no data for us, so do a zero-length transfer */ 1478 ehci->ipacket.actual_length = 0; 1479 break; 1480 } 1481 if (!dir) { 1482 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1483 ITD_XACT_LENGTH); /* OUT */ 1484 } else { 1485 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1486 ITD_XACT_LENGTH); /* IN */ 1487 } 1488 if (itd->transact[i] & ITD_XACT_IOC) { 1489 ehci_raise_irq(ehci, USBSTS_INT); 1490 } 1491 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1492 } 1493 } 1494 return 0; 1495 } 1496 1497 1498 /* This state is the entry point for asynchronous schedule 1499 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1500 */ 1501 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1502 { 1503 EHCIqh qh; 1504 int i = 0; 1505 int again = 0; 1506 uint32_t entry = ehci->asynclistaddr; 1507 1508 /* set reclamation flag at start event (4.8.6) */ 1509 if (async) { 1510 ehci_set_usbsts(ehci, USBSTS_REC); 1511 } 1512 1513 ehci_queues_rip_unused(ehci, async); 1514 1515 /* Find the head of the list (4.9.1.1) */ 1516 for(i = 0; i < MAX_QH; i++) { 1517 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1518 sizeof(EHCIqh) >> 2) < 0) { 1519 return 0; 1520 } 1521 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1522 1523 if (qh.epchar & QH_EPCHAR_H) { 1524 if (async) { 1525 entry |= (NLPTR_TYPE_QH << 1); 1526 } 1527 1528 ehci_set_fetch_addr(ehci, async, entry); 1529 ehci_set_state(ehci, async, EST_FETCHENTRY); 1530 again = 1; 1531 goto out; 1532 } 1533 1534 entry = qh.next; 1535 if (entry == ehci->asynclistaddr) { 1536 break; 1537 } 1538 } 1539 1540 /* no head found for list. */ 1541 1542 ehci_set_state(ehci, async, EST_ACTIVE); 1543 1544 out: 1545 return again; 1546 } 1547 1548 1549 /* This state is the entry point for periodic schedule processing as 1550 * well as being a continuation state for async processing. 1551 */ 1552 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1553 { 1554 int again = 0; 1555 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1556 1557 if (NLPTR_TBIT(entry)) { 1558 ehci_set_state(ehci, async, EST_ACTIVE); 1559 goto out; 1560 } 1561 1562 /* section 4.8, only QH in async schedule */ 1563 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1564 fprintf(stderr, "non queue head request in async schedule\n"); 1565 return -1; 1566 } 1567 1568 switch (NLPTR_TYPE_GET(entry)) { 1569 case NLPTR_TYPE_QH: 1570 ehci_set_state(ehci, async, EST_FETCHQH); 1571 again = 1; 1572 break; 1573 1574 case NLPTR_TYPE_ITD: 1575 ehci_set_state(ehci, async, EST_FETCHITD); 1576 again = 1; 1577 break; 1578 1579 case NLPTR_TYPE_STITD: 1580 ehci_set_state(ehci, async, EST_FETCHSITD); 1581 again = 1; 1582 break; 1583 1584 default: 1585 /* TODO: handle FSTN type */ 1586 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1587 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1588 return -1; 1589 } 1590 1591 out: 1592 return again; 1593 } 1594 1595 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1596 { 1597 uint32_t entry; 1598 EHCIQueue *q; 1599 EHCIqh qh; 1600 1601 entry = ehci_get_fetch_addr(ehci, async); 1602 q = ehci_find_queue_by_qh(ehci, entry, async); 1603 if (q == NULL) { 1604 q = ehci_alloc_queue(ehci, entry, async); 1605 } 1606 1607 q->seen++; 1608 if (q->seen > 1) { 1609 /* we are going in circles -- stop processing */ 1610 ehci_set_state(ehci, async, EST_ACTIVE); 1611 q = NULL; 1612 goto out; 1613 } 1614 1615 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1616 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1617 q = NULL; 1618 goto out; 1619 } 1620 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1621 1622 /* 1623 * The overlay area of the qh should never be changed by the guest, 1624 * except when idle, in which case the reset is a nop. 1625 */ 1626 if (!ehci_verify_qh(q, &qh)) { 1627 if (ehci_reset_queue(q) > 0) { 1628 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1629 } 1630 } 1631 q->qh = qh; 1632 1633 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1634 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1635 q->transact_ctr = 4; 1636 } 1637 1638 if (q->dev == NULL) { 1639 q->dev = ehci_find_device(q->ehci, 1640 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)); 1641 } 1642 1643 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1644 1645 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1646 if (ehci->usbsts & USBSTS_REC) { 1647 ehci_clear_usbsts(ehci, USBSTS_REC); 1648 } else { 1649 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1650 " - done processing\n", q->qhaddr); 1651 ehci_set_state(ehci, async, EST_ACTIVE); 1652 q = NULL; 1653 goto out; 1654 } 1655 } 1656 1657 #if EHCI_DEBUG 1658 if (q->qhaddr != q->qh.next) { 1659 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1660 q->qhaddr, 1661 q->qh.epchar & QH_EPCHAR_H, 1662 q->qh.token & QTD_TOKEN_HALT, 1663 q->qh.token & QTD_TOKEN_ACTIVE, 1664 q->qh.next); 1665 } 1666 #endif 1667 1668 if (q->qh.token & QTD_TOKEN_HALT) { 1669 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1670 1671 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1672 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1673 q->qtdaddr = q->qh.current_qtd; 1674 ehci_set_state(ehci, async, EST_FETCHQTD); 1675 1676 } else { 1677 /* EHCI spec version 1.0 Section 4.10.2 */ 1678 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1679 } 1680 1681 out: 1682 return q; 1683 } 1684 1685 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1686 { 1687 uint32_t entry; 1688 EHCIitd itd; 1689 1690 assert(!async); 1691 entry = ehci_get_fetch_addr(ehci, async); 1692 1693 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1694 sizeof(EHCIitd) >> 2) < 0) { 1695 return -1; 1696 } 1697 ehci_trace_itd(ehci, entry, &itd); 1698 1699 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1700 return -1; 1701 } 1702 1703 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1704 sizeof(EHCIitd) >> 2); 1705 ehci_set_fetch_addr(ehci, async, itd.next); 1706 ehci_set_state(ehci, async, EST_FETCHENTRY); 1707 1708 return 1; 1709 } 1710 1711 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1712 { 1713 uint32_t entry; 1714 EHCIsitd sitd; 1715 1716 assert(!async); 1717 entry = ehci_get_fetch_addr(ehci, async); 1718 1719 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1720 sizeof(EHCIsitd) >> 2) < 0) { 1721 return 0; 1722 } 1723 ehci_trace_sitd(ehci, entry, &sitd); 1724 1725 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1726 /* siTD is not active, nothing to do */; 1727 } else { 1728 /* TODO: split transfers are not implemented */ 1729 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1730 } 1731 1732 ehci_set_fetch_addr(ehci, async, sitd.next); 1733 ehci_set_state(ehci, async, EST_FETCHENTRY); 1734 return 1; 1735 } 1736 1737 /* Section 4.10.2 - paragraph 3 */ 1738 static int ehci_state_advqueue(EHCIQueue *q) 1739 { 1740 #if 0 1741 /* TO-DO: 4.10.2 - paragraph 2 1742 * if I-bit is set to 1 and QH is not active 1743 * go to horizontal QH 1744 */ 1745 if (I-bit set) { 1746 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1747 goto out; 1748 } 1749 #endif 1750 1751 /* 1752 * want data and alt-next qTD is valid 1753 */ 1754 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1755 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1756 q->qtdaddr = q->qh.altnext_qtd; 1757 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1758 1759 /* 1760 * next qTD is valid 1761 */ 1762 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1763 q->qtdaddr = q->qh.next_qtd; 1764 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1765 1766 /* 1767 * no valid qTD, try next QH 1768 */ 1769 } else { 1770 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1771 } 1772 1773 return 1; 1774 } 1775 1776 /* Section 4.10.2 - paragraph 4 */ 1777 static int ehci_state_fetchqtd(EHCIQueue *q) 1778 { 1779 EHCIqtd qtd; 1780 EHCIPacket *p; 1781 int again = 1; 1782 1783 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1784 sizeof(EHCIqtd) >> 2) < 0) { 1785 return 0; 1786 } 1787 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1788 1789 p = QTAILQ_FIRST(&q->packets); 1790 if (p != NULL) { 1791 if (!ehci_verify_qtd(p, &qtd)) { 1792 ehci_cancel_queue(q); 1793 if (qtd.token & QTD_TOKEN_ACTIVE) { 1794 ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); 1795 } 1796 p = NULL; 1797 } else { 1798 p->qtd = qtd; 1799 ehci_qh_do_overlay(q); 1800 } 1801 } 1802 1803 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1804 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1805 } else if (p != NULL) { 1806 switch (p->async) { 1807 case EHCI_ASYNC_NONE: 1808 case EHCI_ASYNC_INITIALIZED: 1809 /* Not yet executed (MULT), or previously nacked (int) packet */ 1810 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1811 break; 1812 case EHCI_ASYNC_INFLIGHT: 1813 /* Check if the guest has added new tds to the queue */ 1814 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1815 /* Unfinished async handled packet, go horizontal */ 1816 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1817 break; 1818 case EHCI_ASYNC_FINISHED: 1819 /* Complete executing of the packet */ 1820 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1821 break; 1822 } 1823 } else { 1824 p = ehci_alloc_packet(q); 1825 p->qtdaddr = q->qtdaddr; 1826 p->qtd = qtd; 1827 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1828 } 1829 1830 return again; 1831 } 1832 1833 static int ehci_state_horizqh(EHCIQueue *q) 1834 { 1835 int again = 0; 1836 1837 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1838 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1839 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1840 again = 1; 1841 } else { 1842 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1843 } 1844 1845 return again; 1846 } 1847 1848 /* Returns "again" */ 1849 static int ehci_fill_queue(EHCIPacket *p) 1850 { 1851 USBEndpoint *ep = p->packet.ep; 1852 EHCIQueue *q = p->queue; 1853 EHCIqtd qtd = p->qtd; 1854 uint32_t qtdaddr; 1855 1856 for (;;) { 1857 if (NLPTR_TBIT(qtd.next) != 0) { 1858 break; 1859 } 1860 qtdaddr = qtd.next; 1861 /* 1862 * Detect circular td lists, Windows creates these, counting on the 1863 * active bit going low after execution to make the queue stop. 1864 */ 1865 QTAILQ_FOREACH(p, &q->packets, next) { 1866 if (p->qtdaddr == qtdaddr) { 1867 goto leave; 1868 } 1869 } 1870 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1871 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1872 return -1; 1873 } 1874 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1875 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1876 break; 1877 } 1878 if (!ehci_verify_pid(q, &qtd)) { 1879 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid"); 1880 break; 1881 } 1882 p = ehci_alloc_packet(q); 1883 p->qtdaddr = qtdaddr; 1884 p->qtd = qtd; 1885 if (ehci_execute(p, "queue") == -1) { 1886 return -1; 1887 } 1888 assert(p->packet.status == USB_RET_ASYNC); 1889 p->async = EHCI_ASYNC_INFLIGHT; 1890 } 1891 leave: 1892 usb_device_flush_ep_queue(ep->dev, ep); 1893 return 1; 1894 } 1895 1896 static int ehci_state_execute(EHCIQueue *q) 1897 { 1898 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1899 int again = 0; 1900 1901 assert(p != NULL); 1902 assert(p->qtdaddr == q->qtdaddr); 1903 1904 if (ehci_qh_do_overlay(q) != 0) { 1905 return -1; 1906 } 1907 1908 // TODO verify enough time remains in the uframe as in 4.4.1.1 1909 // TODO write back ptr to async list when done or out of time 1910 1911 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1912 if (!q->async && q->transact_ctr == 0) { 1913 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1914 again = 1; 1915 goto out; 1916 } 1917 1918 if (q->async) { 1919 ehci_set_usbsts(q->ehci, USBSTS_REC); 1920 } 1921 1922 again = ehci_execute(p, "process"); 1923 if (again == -1) { 1924 goto out; 1925 } 1926 if (p->packet.status == USB_RET_ASYNC) { 1927 ehci_flush_qh(q); 1928 trace_usb_ehci_packet_action(p->queue, p, "async"); 1929 p->async = EHCI_ASYNC_INFLIGHT; 1930 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1931 if (q->async) { 1932 again = ehci_fill_queue(p); 1933 } else { 1934 again = 1; 1935 } 1936 goto out; 1937 } 1938 1939 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1940 again = 1; 1941 1942 out: 1943 return again; 1944 } 1945 1946 static int ehci_state_executing(EHCIQueue *q) 1947 { 1948 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1949 1950 assert(p != NULL); 1951 assert(p->qtdaddr == q->qtdaddr); 1952 1953 ehci_execute_complete(q); 1954 1955 /* 4.10.3 */ 1956 if (!q->async && q->transact_ctr > 0) { 1957 q->transact_ctr--; 1958 } 1959 1960 /* 4.10.5 */ 1961 if (p->packet.status == USB_RET_NAK) { 1962 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1963 } else { 1964 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1965 } 1966 1967 ehci_flush_qh(q); 1968 return 1; 1969 } 1970 1971 1972 static int ehci_state_writeback(EHCIQueue *q) 1973 { 1974 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1975 uint32_t *qtd, addr; 1976 int again = 0; 1977 1978 /* Write back the QTD from the QH area */ 1979 assert(p != NULL); 1980 assert(p->qtdaddr == q->qtdaddr); 1981 1982 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1983 qtd = (uint32_t *) &q->qh.next_qtd; 1984 addr = NLPTR_GET(p->qtdaddr); 1985 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1986 ehci_free_packet(p); 1987 1988 /* 1989 * EHCI specs say go horizontal here. 1990 * 1991 * We can also advance the queue here for performance reasons. We 1992 * need to take care to only take that shortcut in case we've 1993 * processed the qtd just written back without errors, i.e. halt 1994 * bit is clear. 1995 */ 1996 if (q->qh.token & QTD_TOKEN_HALT) { 1997 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1998 again = 1; 1999 } else { 2000 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 2001 again = 1; 2002 } 2003 return again; 2004 } 2005 2006 /* 2007 * This is the state machine that is common to both async and periodic 2008 */ 2009 2010 static void ehci_advance_state(EHCIState *ehci, int async) 2011 { 2012 EHCIQueue *q = NULL; 2013 int itd_count = 0; 2014 int again; 2015 2016 do { 2017 switch(ehci_get_state(ehci, async)) { 2018 case EST_WAITLISTHEAD: 2019 again = ehci_state_waitlisthead(ehci, async); 2020 break; 2021 2022 case EST_FETCHENTRY: 2023 again = ehci_state_fetchentry(ehci, async); 2024 break; 2025 2026 case EST_FETCHQH: 2027 q = ehci_state_fetchqh(ehci, async); 2028 if (q != NULL) { 2029 assert(q->async == async); 2030 again = 1; 2031 } else { 2032 again = 0; 2033 } 2034 break; 2035 2036 case EST_FETCHITD: 2037 again = ehci_state_fetchitd(ehci, async); 2038 itd_count++; 2039 break; 2040 2041 case EST_FETCHSITD: 2042 again = ehci_state_fetchsitd(ehci, async); 2043 itd_count++; 2044 break; 2045 2046 case EST_ADVANCEQUEUE: 2047 assert(q != NULL); 2048 again = ehci_state_advqueue(q); 2049 break; 2050 2051 case EST_FETCHQTD: 2052 assert(q != NULL); 2053 again = ehci_state_fetchqtd(q); 2054 break; 2055 2056 case EST_HORIZONTALQH: 2057 assert(q != NULL); 2058 again = ehci_state_horizqh(q); 2059 break; 2060 2061 case EST_EXECUTE: 2062 assert(q != NULL); 2063 again = ehci_state_execute(q); 2064 if (async) { 2065 ehci->async_stepdown = 0; 2066 } 2067 break; 2068 2069 case EST_EXECUTING: 2070 assert(q != NULL); 2071 if (async) { 2072 ehci->async_stepdown = 0; 2073 } 2074 again = ehci_state_executing(q); 2075 break; 2076 2077 case EST_WRITEBACK: 2078 assert(q != NULL); 2079 again = ehci_state_writeback(q); 2080 if (!async) { 2081 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2082 } 2083 break; 2084 2085 default: 2086 fprintf(stderr, "Bad state!\n"); 2087 again = -1; 2088 g_assert_not_reached(); 2089 break; 2090 } 2091 2092 if (again < 0 || itd_count > 16) { 2093 /* TODO: notify guest (raise HSE irq?) */ 2094 fprintf(stderr, "processing error - resetting ehci HC\n"); 2095 ehci_reset(ehci); 2096 again = 0; 2097 } 2098 } 2099 while (again); 2100 } 2101 2102 static void ehci_advance_async_state(EHCIState *ehci) 2103 { 2104 const int async = 1; 2105 2106 switch(ehci_get_state(ehci, async)) { 2107 case EST_INACTIVE: 2108 if (!ehci_async_enabled(ehci)) { 2109 break; 2110 } 2111 ehci_set_state(ehci, async, EST_ACTIVE); 2112 // No break, fall through to ACTIVE 2113 2114 case EST_ACTIVE: 2115 if (!ehci_async_enabled(ehci)) { 2116 ehci_queues_rip_all(ehci, async); 2117 ehci_set_state(ehci, async, EST_INACTIVE); 2118 break; 2119 } 2120 2121 /* make sure guest has acknowledged the doorbell interrupt */ 2122 /* TO-DO: is this really needed? */ 2123 if (ehci->usbsts & USBSTS_IAA) { 2124 DPRINTF("IAA status bit still set.\n"); 2125 break; 2126 } 2127 2128 /* check that address register has been set */ 2129 if (ehci->asynclistaddr == 0) { 2130 break; 2131 } 2132 2133 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2134 ehci_advance_state(ehci, async); 2135 2136 /* If the doorbell is set, the guest wants to make a change to the 2137 * schedule. The host controller needs to release cached data. 2138 * (section 4.8.2) 2139 */ 2140 if (ehci->usbcmd & USBCMD_IAAD) { 2141 /* Remove all unseen qhs from the async qhs queue */ 2142 ehci_queues_rip_unseen(ehci, async); 2143 trace_usb_ehci_doorbell_ack(); 2144 ehci->usbcmd &= ~USBCMD_IAAD; 2145 ehci_raise_irq(ehci, USBSTS_IAA); 2146 } 2147 break; 2148 2149 default: 2150 /* this should only be due to a developer mistake */ 2151 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2152 "Resetting to active\n", ehci->astate); 2153 g_assert_not_reached(); 2154 } 2155 } 2156 2157 static void ehci_advance_periodic_state(EHCIState *ehci) 2158 { 2159 uint32_t entry; 2160 uint32_t list; 2161 const int async = 0; 2162 2163 // 4.6 2164 2165 switch(ehci_get_state(ehci, async)) { 2166 case EST_INACTIVE: 2167 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2168 ehci_set_state(ehci, async, EST_ACTIVE); 2169 // No break, fall through to ACTIVE 2170 } else 2171 break; 2172 2173 case EST_ACTIVE: 2174 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2175 ehci_queues_rip_all(ehci, async); 2176 ehci_set_state(ehci, async, EST_INACTIVE); 2177 break; 2178 } 2179 2180 list = ehci->periodiclistbase & 0xfffff000; 2181 /* check that register has been set */ 2182 if (list == 0) { 2183 break; 2184 } 2185 list |= ((ehci->frindex & 0x1ff8) >> 1); 2186 2187 if (get_dwords(ehci, list, &entry, 1) < 0) { 2188 break; 2189 } 2190 2191 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2192 ehci->frindex / 8, list, entry); 2193 ehci_set_fetch_addr(ehci, async,entry); 2194 ehci_set_state(ehci, async, EST_FETCHENTRY); 2195 ehci_advance_state(ehci, async); 2196 ehci_queues_rip_unused(ehci, async); 2197 break; 2198 2199 default: 2200 /* this should only be due to a developer mistake */ 2201 fprintf(stderr, "ehci: Bad periodic state %d. " 2202 "Resetting to active\n", ehci->pstate); 2203 g_assert_not_reached(); 2204 } 2205 } 2206 2207 static void ehci_update_frindex(EHCIState *ehci, int uframes) 2208 { 2209 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) { 2210 return; 2211 } 2212 2213 /* Generate FLR interrupt if frame index rolls over 0x2000 */ 2214 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) { 2215 ehci_raise_irq(ehci, USBSTS_FLR); 2216 } 2217 2218 /* How many times will frindex roll over 0x4000 with this frame count? 2219 * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0 2220 */ 2221 int rollovers = (ehci->frindex + uframes) / 0x4000; 2222 if (rollovers > 0) { 2223 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) { 2224 ehci->usbsts_frindex -= 0x4000 * rollovers; 2225 } else { 2226 ehci->usbsts_frindex = 0; 2227 } 2228 } 2229 2230 ehci->frindex = (ehci->frindex + uframes) % 0x4000; 2231 } 2232 2233 static void ehci_frame_timer(void *opaque) 2234 { 2235 EHCIState *ehci = opaque; 2236 int need_timer = 0; 2237 int64_t expire_time, t_now; 2238 uint64_t ns_elapsed; 2239 int uframes, skipped_uframes; 2240 int i; 2241 2242 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 2243 ns_elapsed = t_now - ehci->last_run_ns; 2244 uframes = ns_elapsed / UFRAME_TIMER_NS; 2245 2246 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2247 need_timer++; 2248 2249 if (uframes > (ehci->maxframes * 8)) { 2250 skipped_uframes = uframes - (ehci->maxframes * 8); 2251 ehci_update_frindex(ehci, skipped_uframes); 2252 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; 2253 uframes -= skipped_uframes; 2254 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes); 2255 } 2256 2257 for (i = 0; i < uframes; i++) { 2258 /* 2259 * If we're running behind schedule, we should not catch up 2260 * too fast, as that will make some guests unhappy: 2261 * 1) We must process a minimum of MIN_UFR_PER_TICK frames, 2262 * otherwise we will never catch up 2263 * 2) Process frames until the guest has requested an irq (IOC) 2264 */ 2265 if (i >= MIN_UFR_PER_TICK) { 2266 ehci_commit_irq(ehci); 2267 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2268 break; 2269 } 2270 } 2271 if (ehci->periodic_sched_active) { 2272 ehci->periodic_sched_active--; 2273 } 2274 ehci_update_frindex(ehci, 1); 2275 if ((ehci->frindex & 7) == 0) { 2276 ehci_advance_periodic_state(ehci); 2277 } 2278 ehci->last_run_ns += UFRAME_TIMER_NS; 2279 } 2280 } else { 2281 ehci->periodic_sched_active = 0; 2282 ehci_update_frindex(ehci, uframes); 2283 ehci->last_run_ns += UFRAME_TIMER_NS * uframes; 2284 } 2285 2286 if (ehci->periodic_sched_active) { 2287 ehci->async_stepdown = 0; 2288 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2289 ehci->async_stepdown++; 2290 } 2291 2292 /* Async is not inside loop since it executes everything it can once 2293 * called 2294 */ 2295 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2296 need_timer++; 2297 ehci_advance_async_state(ehci); 2298 } 2299 2300 ehci_commit_irq(ehci); 2301 if (ehci->usbsts_pending) { 2302 need_timer++; 2303 ehci->async_stepdown = 0; 2304 } 2305 2306 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2307 need_timer++; 2308 } 2309 2310 if (need_timer) { 2311 /* If we've raised int, we speed up the timer, so that we quickly 2312 * notice any new packets queued up in response */ 2313 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2314 expire_time = t_now + 2315 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4); 2316 ehci->int_req_by_async = false; 2317 } else { 2318 expire_time = t_now + (NANOSECONDS_PER_SECOND 2319 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2320 } 2321 timer_mod(ehci->frame_timer, expire_time); 2322 } 2323 } 2324 2325 static const MemoryRegionOps ehci_mmio_caps_ops = { 2326 .read = ehci_caps_read, 2327 .write = ehci_caps_write, 2328 .valid.min_access_size = 1, 2329 .valid.max_access_size = 4, 2330 .impl.min_access_size = 1, 2331 .impl.max_access_size = 1, 2332 .endianness = DEVICE_LITTLE_ENDIAN, 2333 }; 2334 2335 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2336 .read = ehci_opreg_read, 2337 .write = ehci_opreg_write, 2338 .valid.min_access_size = 4, 2339 .valid.max_access_size = 4, 2340 .endianness = DEVICE_LITTLE_ENDIAN, 2341 }; 2342 2343 static const MemoryRegionOps ehci_mmio_port_ops = { 2344 .read = ehci_port_read, 2345 .write = ehci_port_write, 2346 .valid.min_access_size = 4, 2347 .valid.max_access_size = 4, 2348 .endianness = DEVICE_LITTLE_ENDIAN, 2349 }; 2350 2351 static USBPortOps ehci_port_ops = { 2352 .attach = ehci_attach, 2353 .detach = ehci_detach, 2354 .child_detach = ehci_child_detach, 2355 .wakeup = ehci_wakeup, 2356 .complete = ehci_async_complete_packet, 2357 }; 2358 2359 static USBBusOps ehci_bus_ops_companion = { 2360 .register_companion = ehci_register_companion, 2361 .wakeup_endpoint = ehci_wakeup_endpoint, 2362 }; 2363 static USBBusOps ehci_bus_ops_standalone = { 2364 .wakeup_endpoint = ehci_wakeup_endpoint, 2365 }; 2366 2367 static void usb_ehci_pre_save(void *opaque) 2368 { 2369 EHCIState *ehci = opaque; 2370 uint32_t new_frindex; 2371 2372 /* Round down frindex to a multiple of 8 for migration compatibility */ 2373 new_frindex = ehci->frindex & ~7; 2374 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS; 2375 ehci->frindex = new_frindex; 2376 } 2377 2378 static int usb_ehci_post_load(void *opaque, int version_id) 2379 { 2380 EHCIState *s = opaque; 2381 int i; 2382 2383 for (i = 0; i < NB_PORTS; i++) { 2384 USBPort *companion = s->companion_ports[i]; 2385 if (companion == NULL) { 2386 continue; 2387 } 2388 if (s->portsc[i] & PORTSC_POWNER) { 2389 companion->dev = s->ports[i].dev; 2390 } else { 2391 companion->dev = NULL; 2392 } 2393 } 2394 2395 return 0; 2396 } 2397 2398 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2399 { 2400 EHCIState *ehci = opaque; 2401 2402 /* 2403 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2404 * schedule in guest memory. We must do the rebuilt ASAP, so that 2405 * USB-devices which have async handled packages have a packet in the 2406 * ep queue to match the completion with. 2407 */ 2408 if (state == RUN_STATE_RUNNING) { 2409 ehci_advance_async_state(ehci); 2410 } 2411 2412 /* 2413 * The schedule rebuilt from guest memory could cause the migration dest 2414 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2415 * will never have existed on the destination. Therefor we must flush the 2416 * async schedule on savevm to catch any not yet noticed unlinks. 2417 */ 2418 if (state == RUN_STATE_SAVE_VM) { 2419 ehci_advance_async_state(ehci); 2420 ehci_queues_rip_unseen(ehci, 1); 2421 } 2422 } 2423 2424 const VMStateDescription vmstate_ehci = { 2425 .name = "ehci-core", 2426 .version_id = 2, 2427 .minimum_version_id = 1, 2428 .pre_save = usb_ehci_pre_save, 2429 .post_load = usb_ehci_post_load, 2430 .fields = (VMStateField[]) { 2431 /* mmio registers */ 2432 VMSTATE_UINT32(usbcmd, EHCIState), 2433 VMSTATE_UINT32(usbsts, EHCIState), 2434 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2435 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2436 VMSTATE_UINT32(usbintr, EHCIState), 2437 VMSTATE_UINT32(frindex, EHCIState), 2438 VMSTATE_UINT32(ctrldssegment, EHCIState), 2439 VMSTATE_UINT32(periodiclistbase, EHCIState), 2440 VMSTATE_UINT32(asynclistaddr, EHCIState), 2441 VMSTATE_UINT32(configflag, EHCIState), 2442 VMSTATE_UINT32(portsc[0], EHCIState), 2443 VMSTATE_UINT32(portsc[1], EHCIState), 2444 VMSTATE_UINT32(portsc[2], EHCIState), 2445 VMSTATE_UINT32(portsc[3], EHCIState), 2446 VMSTATE_UINT32(portsc[4], EHCIState), 2447 VMSTATE_UINT32(portsc[5], EHCIState), 2448 /* frame timer */ 2449 VMSTATE_TIMER_PTR(frame_timer, EHCIState), 2450 VMSTATE_UINT64(last_run_ns, EHCIState), 2451 VMSTATE_UINT32(async_stepdown, EHCIState), 2452 /* schedule state */ 2453 VMSTATE_UINT32(astate, EHCIState), 2454 VMSTATE_UINT32(pstate, EHCIState), 2455 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2456 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2457 VMSTATE_END_OF_LIST() 2458 } 2459 }; 2460 2461 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) 2462 { 2463 int i; 2464 2465 if (s->portnr > NB_PORTS) { 2466 error_setg(errp, "Too many ports! Max. port number is %d.", 2467 NB_PORTS); 2468 return; 2469 } 2470 2471 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ? 2472 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev); 2473 for (i = 0; i < s->portnr; i++) { 2474 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2475 USB_SPEED_MASK_HIGH); 2476 s->ports[i].dev = 0; 2477 } 2478 2479 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_frame_timer, s); 2480 s->async_bh = qemu_bh_new(ehci_frame_timer, s); 2481 s->device = dev; 2482 2483 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2484 } 2485 2486 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp) 2487 { 2488 trace_usb_ehci_unrealize(); 2489 2490 if (s->frame_timer) { 2491 timer_del(s->frame_timer); 2492 timer_free(s->frame_timer); 2493 s->frame_timer = NULL; 2494 } 2495 if (s->async_bh) { 2496 qemu_bh_delete(s->async_bh); 2497 } 2498 2499 ehci_queues_rip_all(s, 0); 2500 ehci_queues_rip_all(s, 1); 2501 2502 memory_region_del_subregion(&s->mem, &s->mem_caps); 2503 memory_region_del_subregion(&s->mem, &s->mem_opreg); 2504 memory_region_del_subregion(&s->mem, &s->mem_ports); 2505 2506 usb_bus_release(&s->bus); 2507 2508 if (s->vmstate) { 2509 qemu_del_vm_change_state_handler(s->vmstate); 2510 } 2511 } 2512 2513 void usb_ehci_init(EHCIState *s, DeviceState *dev) 2514 { 2515 /* 2.2 host controller interface version */ 2516 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2517 s->caps[0x01] = 0x00; 2518 s->caps[0x02] = 0x00; 2519 s->caps[0x03] = 0x01; /* HC version */ 2520 s->caps[0x04] = s->portnr; /* Number of downstream ports */ 2521 s->caps[0x05] = 0x00; /* No companion ports at present */ 2522 s->caps[0x06] = 0x00; 2523 s->caps[0x07] = 0x00; 2524 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2525 s->caps[0x0a] = 0x00; 2526 s->caps[0x0b] = 0x00; 2527 2528 QTAILQ_INIT(&s->aqueues); 2529 QTAILQ_INIT(&s->pqueues); 2530 usb_packet_init(&s->ipacket); 2531 2532 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE); 2533 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s, 2534 "capabilities", CAPA_SIZE); 2535 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s, 2536 "operational", s->portscbase); 2537 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s, 2538 "ports", 4 * s->portnr); 2539 2540 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2541 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2542 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase, 2543 &s->mem_ports); 2544 } 2545 2546 /* 2547 * vim: expandtab ts=4 2548 */ 2549