1 /* 2 * USB xHCI controller emulation 3 * 4 * Copyright (c) 2011 Securiforest 5 * Date: 2011-05-11 ; Author: Hector Martin <hector@marcansoft.com> 6 * Based on usb-ohci.c, emulates Renesas NEC USB 3.0 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 20 */ 21 #include "hw/hw.h" 22 #include "qemu-timer.h" 23 #include "hw/usb.h" 24 #include "hw/pci.h" 25 #include "hw/msi.h" 26 #include "hw/msix.h" 27 #include "trace.h" 28 29 //#define DEBUG_XHCI 30 //#define DEBUG_DATA 31 32 #ifdef DEBUG_XHCI 33 #define DPRINTF(...) fprintf(stderr, __VA_ARGS__) 34 #else 35 #define DPRINTF(...) do {} while (0) 36 #endif 37 #define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \ 38 __func__, __LINE__); abort(); } while (0) 39 40 #define MAXPORTS_2 8 41 #define MAXPORTS_3 8 42 43 #define MAXPORTS (MAXPORTS_2+MAXPORTS_3) 44 #define MAXSLOTS MAXPORTS 45 #define MAXINTRS 1 /* MAXPORTS */ 46 47 #define TD_QUEUE 24 48 49 /* Very pessimistic, let's hope it's enough for all cases */ 50 #define EV_QUEUE (((3*TD_QUEUE)+16)*MAXSLOTS) 51 /* Do not deliver ER Full events. NEC's driver does some things not bound 52 * to the specs when it gets them */ 53 #define ER_FULL_HACK 54 55 #define LEN_CAP 0x40 56 #define LEN_OPER (0x400 + 0x10 * MAXPORTS) 57 #define LEN_RUNTIME ((MAXINTRS + 1) * 0x20) 58 #define LEN_DOORBELL ((MAXSLOTS + 1) * 0x20) 59 60 #define OFF_OPER LEN_CAP 61 #define OFF_RUNTIME 0x1000 62 #define OFF_DOORBELL 0x2000 63 #define OFF_MSIX_TABLE 0x3000 64 #define OFF_MSIX_PBA 0x3800 65 /* must be power of 2 */ 66 #define LEN_REGS 0x4000 67 68 #if (OFF_OPER + LEN_OPER) > OFF_RUNTIME 69 #error Increase OFF_RUNTIME 70 #endif 71 #if (OFF_RUNTIME + LEN_RUNTIME) > OFF_DOORBELL 72 #error Increase OFF_DOORBELL 73 #endif 74 #if (OFF_DOORBELL + LEN_DOORBELL) > LEN_REGS 75 # error Increase LEN_REGS 76 #endif 77 78 #if MAXINTRS > 1 79 # error TODO: only one interrupter supported 80 #endif 81 82 /* bit definitions */ 83 #define USBCMD_RS (1<<0) 84 #define USBCMD_HCRST (1<<1) 85 #define USBCMD_INTE (1<<2) 86 #define USBCMD_HSEE (1<<3) 87 #define USBCMD_LHCRST (1<<7) 88 #define USBCMD_CSS (1<<8) 89 #define USBCMD_CRS (1<<9) 90 #define USBCMD_EWE (1<<10) 91 #define USBCMD_EU3S (1<<11) 92 93 #define USBSTS_HCH (1<<0) 94 #define USBSTS_HSE (1<<2) 95 #define USBSTS_EINT (1<<3) 96 #define USBSTS_PCD (1<<4) 97 #define USBSTS_SSS (1<<8) 98 #define USBSTS_RSS (1<<9) 99 #define USBSTS_SRE (1<<10) 100 #define USBSTS_CNR (1<<11) 101 #define USBSTS_HCE (1<<12) 102 103 104 #define PORTSC_CCS (1<<0) 105 #define PORTSC_PED (1<<1) 106 #define PORTSC_OCA (1<<3) 107 #define PORTSC_PR (1<<4) 108 #define PORTSC_PLS_SHIFT 5 109 #define PORTSC_PLS_MASK 0xf 110 #define PORTSC_PP (1<<9) 111 #define PORTSC_SPEED_SHIFT 10 112 #define PORTSC_SPEED_MASK 0xf 113 #define PORTSC_SPEED_FULL (1<<10) 114 #define PORTSC_SPEED_LOW (2<<10) 115 #define PORTSC_SPEED_HIGH (3<<10) 116 #define PORTSC_SPEED_SUPER (4<<10) 117 #define PORTSC_PIC_SHIFT 14 118 #define PORTSC_PIC_MASK 0x3 119 #define PORTSC_LWS (1<<16) 120 #define PORTSC_CSC (1<<17) 121 #define PORTSC_PEC (1<<18) 122 #define PORTSC_WRC (1<<19) 123 #define PORTSC_OCC (1<<20) 124 #define PORTSC_PRC (1<<21) 125 #define PORTSC_PLC (1<<22) 126 #define PORTSC_CEC (1<<23) 127 #define PORTSC_CAS (1<<24) 128 #define PORTSC_WCE (1<<25) 129 #define PORTSC_WDE (1<<26) 130 #define PORTSC_WOE (1<<27) 131 #define PORTSC_DR (1<<30) 132 #define PORTSC_WPR (1<<31) 133 134 #define CRCR_RCS (1<<0) 135 #define CRCR_CS (1<<1) 136 #define CRCR_CA (1<<2) 137 #define CRCR_CRR (1<<3) 138 139 #define IMAN_IP (1<<0) 140 #define IMAN_IE (1<<1) 141 142 #define ERDP_EHB (1<<3) 143 144 #define TRB_SIZE 16 145 typedef struct XHCITRB { 146 uint64_t parameter; 147 uint32_t status; 148 uint32_t control; 149 dma_addr_t addr; 150 bool ccs; 151 } XHCITRB; 152 153 154 typedef enum TRBType { 155 TRB_RESERVED = 0, 156 TR_NORMAL, 157 TR_SETUP, 158 TR_DATA, 159 TR_STATUS, 160 TR_ISOCH, 161 TR_LINK, 162 TR_EVDATA, 163 TR_NOOP, 164 CR_ENABLE_SLOT, 165 CR_DISABLE_SLOT, 166 CR_ADDRESS_DEVICE, 167 CR_CONFIGURE_ENDPOINT, 168 CR_EVALUATE_CONTEXT, 169 CR_RESET_ENDPOINT, 170 CR_STOP_ENDPOINT, 171 CR_SET_TR_DEQUEUE, 172 CR_RESET_DEVICE, 173 CR_FORCE_EVENT, 174 CR_NEGOTIATE_BW, 175 CR_SET_LATENCY_TOLERANCE, 176 CR_GET_PORT_BANDWIDTH, 177 CR_FORCE_HEADER, 178 CR_NOOP, 179 ER_TRANSFER = 32, 180 ER_COMMAND_COMPLETE, 181 ER_PORT_STATUS_CHANGE, 182 ER_BANDWIDTH_REQUEST, 183 ER_DOORBELL, 184 ER_HOST_CONTROLLER, 185 ER_DEVICE_NOTIFICATION, 186 ER_MFINDEX_WRAP, 187 /* vendor specific bits */ 188 CR_VENDOR_VIA_CHALLENGE_RESPONSE = 48, 189 CR_VENDOR_NEC_FIRMWARE_REVISION = 49, 190 CR_VENDOR_NEC_CHALLENGE_RESPONSE = 50, 191 } TRBType; 192 193 #define CR_LINK TR_LINK 194 195 typedef enum TRBCCode { 196 CC_INVALID = 0, 197 CC_SUCCESS, 198 CC_DATA_BUFFER_ERROR, 199 CC_BABBLE_DETECTED, 200 CC_USB_TRANSACTION_ERROR, 201 CC_TRB_ERROR, 202 CC_STALL_ERROR, 203 CC_RESOURCE_ERROR, 204 CC_BANDWIDTH_ERROR, 205 CC_NO_SLOTS_ERROR, 206 CC_INVALID_STREAM_TYPE_ERROR, 207 CC_SLOT_NOT_ENABLED_ERROR, 208 CC_EP_NOT_ENABLED_ERROR, 209 CC_SHORT_PACKET, 210 CC_RING_UNDERRUN, 211 CC_RING_OVERRUN, 212 CC_VF_ER_FULL, 213 CC_PARAMETER_ERROR, 214 CC_BANDWIDTH_OVERRUN, 215 CC_CONTEXT_STATE_ERROR, 216 CC_NO_PING_RESPONSE_ERROR, 217 CC_EVENT_RING_FULL_ERROR, 218 CC_INCOMPATIBLE_DEVICE_ERROR, 219 CC_MISSED_SERVICE_ERROR, 220 CC_COMMAND_RING_STOPPED, 221 CC_COMMAND_ABORTED, 222 CC_STOPPED, 223 CC_STOPPED_LENGTH_INVALID, 224 CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR = 29, 225 CC_ISOCH_BUFFER_OVERRUN = 31, 226 CC_EVENT_LOST_ERROR, 227 CC_UNDEFINED_ERROR, 228 CC_INVALID_STREAM_ID_ERROR, 229 CC_SECONDARY_BANDWIDTH_ERROR, 230 CC_SPLIT_TRANSACTION_ERROR 231 } TRBCCode; 232 233 #define TRB_C (1<<0) 234 #define TRB_TYPE_SHIFT 10 235 #define TRB_TYPE_MASK 0x3f 236 #define TRB_TYPE(t) (((t).control >> TRB_TYPE_SHIFT) & TRB_TYPE_MASK) 237 238 #define TRB_EV_ED (1<<2) 239 240 #define TRB_TR_ENT (1<<1) 241 #define TRB_TR_ISP (1<<2) 242 #define TRB_TR_NS (1<<3) 243 #define TRB_TR_CH (1<<4) 244 #define TRB_TR_IOC (1<<5) 245 #define TRB_TR_IDT (1<<6) 246 #define TRB_TR_TBC_SHIFT 7 247 #define TRB_TR_TBC_MASK 0x3 248 #define TRB_TR_BEI (1<<9) 249 #define TRB_TR_TLBPC_SHIFT 16 250 #define TRB_TR_TLBPC_MASK 0xf 251 #define TRB_TR_FRAMEID_SHIFT 20 252 #define TRB_TR_FRAMEID_MASK 0x7ff 253 #define TRB_TR_SIA (1<<31) 254 255 #define TRB_TR_DIR (1<<16) 256 257 #define TRB_CR_SLOTID_SHIFT 24 258 #define TRB_CR_SLOTID_MASK 0xff 259 #define TRB_CR_EPID_SHIFT 16 260 #define TRB_CR_EPID_MASK 0x1f 261 262 #define TRB_CR_BSR (1<<9) 263 #define TRB_CR_DC (1<<9) 264 265 #define TRB_LK_TC (1<<1) 266 267 #define EP_TYPE_MASK 0x7 268 #define EP_TYPE_SHIFT 3 269 270 #define EP_STATE_MASK 0x7 271 #define EP_DISABLED (0<<0) 272 #define EP_RUNNING (1<<0) 273 #define EP_HALTED (2<<0) 274 #define EP_STOPPED (3<<0) 275 #define EP_ERROR (4<<0) 276 277 #define SLOT_STATE_MASK 0x1f 278 #define SLOT_STATE_SHIFT 27 279 #define SLOT_STATE(s) (((s)>>SLOT_STATE_SHIFT)&SLOT_STATE_MASK) 280 #define SLOT_ENABLED 0 281 #define SLOT_DEFAULT 1 282 #define SLOT_ADDRESSED 2 283 #define SLOT_CONFIGURED 3 284 285 #define SLOT_CONTEXT_ENTRIES_MASK 0x1f 286 #define SLOT_CONTEXT_ENTRIES_SHIFT 27 287 288 typedef enum EPType { 289 ET_INVALID = 0, 290 ET_ISO_OUT, 291 ET_BULK_OUT, 292 ET_INTR_OUT, 293 ET_CONTROL, 294 ET_ISO_IN, 295 ET_BULK_IN, 296 ET_INTR_IN, 297 } EPType; 298 299 typedef struct XHCIRing { 300 dma_addr_t base; 301 dma_addr_t dequeue; 302 bool ccs; 303 } XHCIRing; 304 305 typedef struct XHCIPort { 306 uint32_t portsc; 307 uint32_t portnr; 308 USBPort *uport; 309 uint32_t speedmask; 310 } XHCIPort; 311 312 struct XHCIState; 313 typedef struct XHCIState XHCIState; 314 315 typedef struct XHCITransfer { 316 XHCIState *xhci; 317 USBPacket packet; 318 QEMUSGList sgl; 319 bool running_async; 320 bool running_retry; 321 bool cancelled; 322 bool complete; 323 unsigned int iso_pkts; 324 unsigned int slotid; 325 unsigned int epid; 326 bool in_xfer; 327 bool iso_xfer; 328 329 unsigned int trb_count; 330 unsigned int trb_alloced; 331 XHCITRB *trbs; 332 333 TRBCCode status; 334 335 unsigned int pkts; 336 unsigned int pktsize; 337 unsigned int cur_pkt; 338 339 uint64_t mfindex_kick; 340 } XHCITransfer; 341 342 typedef struct XHCIEPContext { 343 XHCIState *xhci; 344 unsigned int slotid; 345 unsigned int epid; 346 347 XHCIRing ring; 348 unsigned int next_xfer; 349 unsigned int comp_xfer; 350 XHCITransfer transfers[TD_QUEUE]; 351 XHCITransfer *retry; 352 EPType type; 353 dma_addr_t pctx; 354 unsigned int max_psize; 355 uint32_t state; 356 357 /* iso xfer scheduling */ 358 unsigned int interval; 359 int64_t mfindex_last; 360 QEMUTimer *kick_timer; 361 } XHCIEPContext; 362 363 typedef struct XHCISlot { 364 bool enabled; 365 dma_addr_t ctx; 366 unsigned int port; 367 unsigned int devaddr; 368 XHCIEPContext * eps[31]; 369 } XHCISlot; 370 371 typedef struct XHCIEvent { 372 TRBType type; 373 TRBCCode ccode; 374 uint64_t ptr; 375 uint32_t length; 376 uint32_t flags; 377 uint8_t slotid; 378 uint8_t epid; 379 } XHCIEvent; 380 381 struct XHCIState { 382 PCIDevice pci_dev; 383 USBBus bus; 384 qemu_irq irq; 385 MemoryRegion mem; 386 const char *name; 387 unsigned int devaddr; 388 389 /* properties */ 390 uint32_t numports_2; 391 uint32_t numports_3; 392 uint32_t flags; 393 394 /* Operational Registers */ 395 uint32_t usbcmd; 396 uint32_t usbsts; 397 uint32_t dnctrl; 398 uint32_t crcr_low; 399 uint32_t crcr_high; 400 uint32_t dcbaap_low; 401 uint32_t dcbaap_high; 402 uint32_t config; 403 404 USBPort uports[MAX(MAXPORTS_2, MAXPORTS_3)]; 405 XHCIPort ports[MAXPORTS]; 406 XHCISlot slots[MAXSLOTS]; 407 uint32_t numports; 408 409 /* Runtime Registers */ 410 uint32_t iman; 411 uint32_t imod; 412 uint32_t erstsz; 413 uint32_t erstba_low; 414 uint32_t erstba_high; 415 uint32_t erdp_low; 416 uint32_t erdp_high; 417 bool msix_used; 418 419 int64_t mfindex_start; 420 QEMUTimer *mfwrap_timer; 421 422 dma_addr_t er_start; 423 uint32_t er_size; 424 bool er_pcs; 425 unsigned int er_ep_idx; 426 bool er_full; 427 428 XHCIEvent ev_buffer[EV_QUEUE]; 429 unsigned int ev_buffer_put; 430 unsigned int ev_buffer_get; 431 432 XHCIRing cmd_ring; 433 }; 434 435 typedef struct XHCIEvRingSeg { 436 uint32_t addr_low; 437 uint32_t addr_high; 438 uint32_t size; 439 uint32_t rsvd; 440 } XHCIEvRingSeg; 441 442 enum xhci_flags { 443 XHCI_FLAG_USE_MSI = 1, 444 XHCI_FLAG_USE_MSI_X, 445 }; 446 447 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, 448 unsigned int epid); 449 static void xhci_event(XHCIState *xhci, XHCIEvent *event); 450 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event); 451 452 static const char *TRBType_names[] = { 453 [TRB_RESERVED] = "TRB_RESERVED", 454 [TR_NORMAL] = "TR_NORMAL", 455 [TR_SETUP] = "TR_SETUP", 456 [TR_DATA] = "TR_DATA", 457 [TR_STATUS] = "TR_STATUS", 458 [TR_ISOCH] = "TR_ISOCH", 459 [TR_LINK] = "TR_LINK", 460 [TR_EVDATA] = "TR_EVDATA", 461 [TR_NOOP] = "TR_NOOP", 462 [CR_ENABLE_SLOT] = "CR_ENABLE_SLOT", 463 [CR_DISABLE_SLOT] = "CR_DISABLE_SLOT", 464 [CR_ADDRESS_DEVICE] = "CR_ADDRESS_DEVICE", 465 [CR_CONFIGURE_ENDPOINT] = "CR_CONFIGURE_ENDPOINT", 466 [CR_EVALUATE_CONTEXT] = "CR_EVALUATE_CONTEXT", 467 [CR_RESET_ENDPOINT] = "CR_RESET_ENDPOINT", 468 [CR_STOP_ENDPOINT] = "CR_STOP_ENDPOINT", 469 [CR_SET_TR_DEQUEUE] = "CR_SET_TR_DEQUEUE", 470 [CR_RESET_DEVICE] = "CR_RESET_DEVICE", 471 [CR_FORCE_EVENT] = "CR_FORCE_EVENT", 472 [CR_NEGOTIATE_BW] = "CR_NEGOTIATE_BW", 473 [CR_SET_LATENCY_TOLERANCE] = "CR_SET_LATENCY_TOLERANCE", 474 [CR_GET_PORT_BANDWIDTH] = "CR_GET_PORT_BANDWIDTH", 475 [CR_FORCE_HEADER] = "CR_FORCE_HEADER", 476 [CR_NOOP] = "CR_NOOP", 477 [ER_TRANSFER] = "ER_TRANSFER", 478 [ER_COMMAND_COMPLETE] = "ER_COMMAND_COMPLETE", 479 [ER_PORT_STATUS_CHANGE] = "ER_PORT_STATUS_CHANGE", 480 [ER_BANDWIDTH_REQUEST] = "ER_BANDWIDTH_REQUEST", 481 [ER_DOORBELL] = "ER_DOORBELL", 482 [ER_HOST_CONTROLLER] = "ER_HOST_CONTROLLER", 483 [ER_DEVICE_NOTIFICATION] = "ER_DEVICE_NOTIFICATION", 484 [ER_MFINDEX_WRAP] = "ER_MFINDEX_WRAP", 485 [CR_VENDOR_VIA_CHALLENGE_RESPONSE] = "CR_VENDOR_VIA_CHALLENGE_RESPONSE", 486 [CR_VENDOR_NEC_FIRMWARE_REVISION] = "CR_VENDOR_NEC_FIRMWARE_REVISION", 487 [CR_VENDOR_NEC_CHALLENGE_RESPONSE] = "CR_VENDOR_NEC_CHALLENGE_RESPONSE", 488 }; 489 490 static const char *TRBCCode_names[] = { 491 [CC_INVALID] = "CC_INVALID", 492 [CC_SUCCESS] = "CC_SUCCESS", 493 [CC_DATA_BUFFER_ERROR] = "CC_DATA_BUFFER_ERROR", 494 [CC_BABBLE_DETECTED] = "CC_BABBLE_DETECTED", 495 [CC_USB_TRANSACTION_ERROR] = "CC_USB_TRANSACTION_ERROR", 496 [CC_TRB_ERROR] = "CC_TRB_ERROR", 497 [CC_STALL_ERROR] = "CC_STALL_ERROR", 498 [CC_RESOURCE_ERROR] = "CC_RESOURCE_ERROR", 499 [CC_BANDWIDTH_ERROR] = "CC_BANDWIDTH_ERROR", 500 [CC_NO_SLOTS_ERROR] = "CC_NO_SLOTS_ERROR", 501 [CC_INVALID_STREAM_TYPE_ERROR] = "CC_INVALID_STREAM_TYPE_ERROR", 502 [CC_SLOT_NOT_ENABLED_ERROR] = "CC_SLOT_NOT_ENABLED_ERROR", 503 [CC_EP_NOT_ENABLED_ERROR] = "CC_EP_NOT_ENABLED_ERROR", 504 [CC_SHORT_PACKET] = "CC_SHORT_PACKET", 505 [CC_RING_UNDERRUN] = "CC_RING_UNDERRUN", 506 [CC_RING_OVERRUN] = "CC_RING_OVERRUN", 507 [CC_VF_ER_FULL] = "CC_VF_ER_FULL", 508 [CC_PARAMETER_ERROR] = "CC_PARAMETER_ERROR", 509 [CC_BANDWIDTH_OVERRUN] = "CC_BANDWIDTH_OVERRUN", 510 [CC_CONTEXT_STATE_ERROR] = "CC_CONTEXT_STATE_ERROR", 511 [CC_NO_PING_RESPONSE_ERROR] = "CC_NO_PING_RESPONSE_ERROR", 512 [CC_EVENT_RING_FULL_ERROR] = "CC_EVENT_RING_FULL_ERROR", 513 [CC_INCOMPATIBLE_DEVICE_ERROR] = "CC_INCOMPATIBLE_DEVICE_ERROR", 514 [CC_MISSED_SERVICE_ERROR] = "CC_MISSED_SERVICE_ERROR", 515 [CC_COMMAND_RING_STOPPED] = "CC_COMMAND_RING_STOPPED", 516 [CC_COMMAND_ABORTED] = "CC_COMMAND_ABORTED", 517 [CC_STOPPED] = "CC_STOPPED", 518 [CC_STOPPED_LENGTH_INVALID] = "CC_STOPPED_LENGTH_INVALID", 519 [CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR] 520 = "CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR", 521 [CC_ISOCH_BUFFER_OVERRUN] = "CC_ISOCH_BUFFER_OVERRUN", 522 [CC_EVENT_LOST_ERROR] = "CC_EVENT_LOST_ERROR", 523 [CC_UNDEFINED_ERROR] = "CC_UNDEFINED_ERROR", 524 [CC_INVALID_STREAM_ID_ERROR] = "CC_INVALID_STREAM_ID_ERROR", 525 [CC_SECONDARY_BANDWIDTH_ERROR] = "CC_SECONDARY_BANDWIDTH_ERROR", 526 [CC_SPLIT_TRANSACTION_ERROR] = "CC_SPLIT_TRANSACTION_ERROR", 527 }; 528 529 static const char *lookup_name(uint32_t index, const char **list, uint32_t llen) 530 { 531 if (index >= llen || list[index] == NULL) { 532 return "???"; 533 } 534 return list[index]; 535 } 536 537 static const char *trb_name(XHCITRB *trb) 538 { 539 return lookup_name(TRB_TYPE(*trb), TRBType_names, 540 ARRAY_SIZE(TRBType_names)); 541 } 542 543 static const char *event_name(XHCIEvent *event) 544 { 545 return lookup_name(event->ccode, TRBCCode_names, 546 ARRAY_SIZE(TRBCCode_names)); 547 } 548 549 static uint64_t xhci_mfindex_get(XHCIState *xhci) 550 { 551 int64_t now = qemu_get_clock_ns(vm_clock); 552 return (now - xhci->mfindex_start) / 125000; 553 } 554 555 static void xhci_mfwrap_update(XHCIState *xhci) 556 { 557 const uint32_t bits = USBCMD_RS | USBCMD_EWE; 558 uint32_t mfindex, left; 559 int64_t now; 560 561 if ((xhci->usbcmd & bits) == bits) { 562 now = qemu_get_clock_ns(vm_clock); 563 mfindex = ((now - xhci->mfindex_start) / 125000) & 0x3fff; 564 left = 0x4000 - mfindex; 565 qemu_mod_timer(xhci->mfwrap_timer, now + left * 125000); 566 } else { 567 qemu_del_timer(xhci->mfwrap_timer); 568 } 569 } 570 571 static void xhci_mfwrap_timer(void *opaque) 572 { 573 XHCIState *xhci = opaque; 574 XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS }; 575 576 xhci_event(xhci, &wrap); 577 xhci_mfwrap_update(xhci); 578 } 579 580 static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high) 581 { 582 if (sizeof(dma_addr_t) == 4) { 583 return low; 584 } else { 585 return low | (((dma_addr_t)high << 16) << 16); 586 } 587 } 588 589 static inline dma_addr_t xhci_mask64(uint64_t addr) 590 { 591 if (sizeof(dma_addr_t) == 4) { 592 return addr & 0xffffffff; 593 } else { 594 return addr; 595 } 596 } 597 598 static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport) 599 { 600 int index; 601 602 if (!uport->dev) { 603 return NULL; 604 } 605 switch (uport->dev->speed) { 606 case USB_SPEED_LOW: 607 case USB_SPEED_FULL: 608 case USB_SPEED_HIGH: 609 index = uport->index; 610 break; 611 case USB_SPEED_SUPER: 612 index = uport->index + xhci->numports_2; 613 break; 614 default: 615 return NULL; 616 } 617 return &xhci->ports[index]; 618 } 619 620 static void xhci_intx_update(XHCIState *xhci) 621 { 622 int level = 0; 623 624 if (msix_enabled(&xhci->pci_dev) || 625 msi_enabled(&xhci->pci_dev)) { 626 return; 627 } 628 629 if (xhci->iman & IMAN_IP && 630 xhci->iman & IMAN_IE && 631 xhci->usbcmd & USBCMD_INTE) { 632 level = 1; 633 } 634 635 trace_usb_xhci_irq_intx(level); 636 qemu_set_irq(xhci->irq, level); 637 } 638 639 static void xhci_msix_update(XHCIState *xhci) 640 { 641 bool enabled; 642 643 if (!msix_enabled(&xhci->pci_dev)) { 644 return; 645 } 646 647 enabled = xhci->iman & IMAN_IE; 648 if (enabled == xhci->msix_used) { 649 return; 650 } 651 652 if (enabled) { 653 trace_usb_xhci_irq_msix_use(0); 654 msix_vector_use(&xhci->pci_dev, 0); 655 xhci->msix_used = true; 656 } else { 657 trace_usb_xhci_irq_msix_unuse(0); 658 msix_vector_unuse(&xhci->pci_dev, 0); 659 xhci->msix_used = false; 660 } 661 } 662 663 static void xhci_intr_raise(XHCIState *xhci) 664 { 665 if (!(xhci->iman & IMAN_IP) || 666 !(xhci->iman & IMAN_IE)) { 667 return; 668 } 669 670 if (!(xhci->usbcmd & USBCMD_INTE)) { 671 return; 672 } 673 674 if (msix_enabled(&xhci->pci_dev)) { 675 trace_usb_xhci_irq_msix(0); 676 msix_notify(&xhci->pci_dev, 0); 677 return; 678 } 679 680 if (msi_enabled(&xhci->pci_dev)) { 681 trace_usb_xhci_irq_msi(0); 682 msi_notify(&xhci->pci_dev, 0); 683 return; 684 } 685 686 trace_usb_xhci_irq_intx(1); 687 qemu_set_irq(xhci->irq, 1); 688 } 689 690 static inline int xhci_running(XHCIState *xhci) 691 { 692 return !(xhci->usbsts & USBSTS_HCH) && !xhci->er_full; 693 } 694 695 static void xhci_die(XHCIState *xhci) 696 { 697 xhci->usbsts |= USBSTS_HCE; 698 fprintf(stderr, "xhci: asserted controller error\n"); 699 } 700 701 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event) 702 { 703 XHCITRB ev_trb; 704 dma_addr_t addr; 705 706 ev_trb.parameter = cpu_to_le64(event->ptr); 707 ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24)); 708 ev_trb.control = (event->slotid << 24) | (event->epid << 16) | 709 event->flags | (event->type << TRB_TYPE_SHIFT); 710 if (xhci->er_pcs) { 711 ev_trb.control |= TRB_C; 712 } 713 ev_trb.control = cpu_to_le32(ev_trb.control); 714 715 trace_usb_xhci_queue_event(xhci->er_ep_idx, trb_name(&ev_trb), 716 event_name(event), ev_trb.parameter, 717 ev_trb.status, ev_trb.control); 718 719 addr = xhci->er_start + TRB_SIZE*xhci->er_ep_idx; 720 pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE); 721 722 xhci->er_ep_idx++; 723 if (xhci->er_ep_idx >= xhci->er_size) { 724 xhci->er_ep_idx = 0; 725 xhci->er_pcs = !xhci->er_pcs; 726 } 727 } 728 729 static void xhci_events_update(XHCIState *xhci) 730 { 731 dma_addr_t erdp; 732 unsigned int dp_idx; 733 bool do_irq = 0; 734 735 if (xhci->usbsts & USBSTS_HCH) { 736 return; 737 } 738 739 erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high); 740 if (erdp < xhci->er_start || 741 erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) { 742 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp); 743 fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n", 744 xhci->er_start, xhci->er_size); 745 xhci_die(xhci); 746 return; 747 } 748 dp_idx = (erdp - xhci->er_start) / TRB_SIZE; 749 assert(dp_idx < xhci->er_size); 750 751 /* NEC didn't read section 4.9.4 of the spec (v1.0 p139 top Note) and thus 752 * deadlocks when the ER is full. Hack it by holding off events until 753 * the driver decides to free at least half of the ring */ 754 if (xhci->er_full) { 755 int er_free = dp_idx - xhci->er_ep_idx; 756 if (er_free <= 0) { 757 er_free += xhci->er_size; 758 } 759 if (er_free < (xhci->er_size/2)) { 760 DPRINTF("xhci_events_update(): event ring still " 761 "more than half full (hack)\n"); 762 return; 763 } 764 } 765 766 while (xhci->ev_buffer_put != xhci->ev_buffer_get) { 767 assert(xhci->er_full); 768 if (((xhci->er_ep_idx+1) % xhci->er_size) == dp_idx) { 769 DPRINTF("xhci_events_update(): event ring full again\n"); 770 #ifndef ER_FULL_HACK 771 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR}; 772 xhci_write_event(xhci, &full); 773 #endif 774 do_irq = 1; 775 break; 776 } 777 XHCIEvent *event = &xhci->ev_buffer[xhci->ev_buffer_get]; 778 xhci_write_event(xhci, event); 779 xhci->ev_buffer_get++; 780 do_irq = 1; 781 if (xhci->ev_buffer_get == EV_QUEUE) { 782 xhci->ev_buffer_get = 0; 783 } 784 } 785 786 if (do_irq) { 787 xhci->erdp_low |= ERDP_EHB; 788 xhci->iman |= IMAN_IP; 789 xhci->usbsts |= USBSTS_EINT; 790 xhci_intr_raise(xhci); 791 } 792 793 if (xhci->er_full && xhci->ev_buffer_put == xhci->ev_buffer_get) { 794 DPRINTF("xhci_events_update(): event ring no longer full\n"); 795 xhci->er_full = 0; 796 } 797 return; 798 } 799 800 static void xhci_event(XHCIState *xhci, XHCIEvent *event) 801 { 802 dma_addr_t erdp; 803 unsigned int dp_idx; 804 805 if (xhci->er_full) { 806 DPRINTF("xhci_event(): ER full, queueing\n"); 807 if (((xhci->ev_buffer_put+1) % EV_QUEUE) == xhci->ev_buffer_get) { 808 fprintf(stderr, "xhci: event queue full, dropping event!\n"); 809 return; 810 } 811 xhci->ev_buffer[xhci->ev_buffer_put++] = *event; 812 if (xhci->ev_buffer_put == EV_QUEUE) { 813 xhci->ev_buffer_put = 0; 814 } 815 return; 816 } 817 818 erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high); 819 if (erdp < xhci->er_start || 820 erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) { 821 fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp); 822 fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n", 823 xhci->er_start, xhci->er_size); 824 xhci_die(xhci); 825 return; 826 } 827 828 dp_idx = (erdp - xhci->er_start) / TRB_SIZE; 829 assert(dp_idx < xhci->er_size); 830 831 if ((xhci->er_ep_idx+1) % xhci->er_size == dp_idx) { 832 DPRINTF("xhci_event(): ER full, queueing\n"); 833 #ifndef ER_FULL_HACK 834 XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR}; 835 xhci_write_event(xhci, &full); 836 #endif 837 xhci->er_full = 1; 838 if (((xhci->ev_buffer_put+1) % EV_QUEUE) == xhci->ev_buffer_get) { 839 fprintf(stderr, "xhci: event queue full, dropping event!\n"); 840 return; 841 } 842 xhci->ev_buffer[xhci->ev_buffer_put++] = *event; 843 if (xhci->ev_buffer_put == EV_QUEUE) { 844 xhci->ev_buffer_put = 0; 845 } 846 } else { 847 xhci_write_event(xhci, event); 848 } 849 850 xhci->erdp_low |= ERDP_EHB; 851 xhci->iman |= IMAN_IP; 852 xhci->usbsts |= USBSTS_EINT; 853 854 xhci_intr_raise(xhci); 855 } 856 857 static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring, 858 dma_addr_t base) 859 { 860 ring->base = base; 861 ring->dequeue = base; 862 ring->ccs = 1; 863 } 864 865 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb, 866 dma_addr_t *addr) 867 { 868 while (1) { 869 TRBType type; 870 pci_dma_read(&xhci->pci_dev, ring->dequeue, trb, TRB_SIZE); 871 trb->addr = ring->dequeue; 872 trb->ccs = ring->ccs; 873 le64_to_cpus(&trb->parameter); 874 le32_to_cpus(&trb->status); 875 le32_to_cpus(&trb->control); 876 877 trace_usb_xhci_fetch_trb(ring->dequeue, trb_name(trb), 878 trb->parameter, trb->status, trb->control); 879 880 if ((trb->control & TRB_C) != ring->ccs) { 881 return 0; 882 } 883 884 type = TRB_TYPE(*trb); 885 886 if (type != TR_LINK) { 887 if (addr) { 888 *addr = ring->dequeue; 889 } 890 ring->dequeue += TRB_SIZE; 891 return type; 892 } else { 893 ring->dequeue = xhci_mask64(trb->parameter); 894 if (trb->control & TRB_LK_TC) { 895 ring->ccs = !ring->ccs; 896 } 897 } 898 } 899 } 900 901 static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring) 902 { 903 XHCITRB trb; 904 int length = 0; 905 dma_addr_t dequeue = ring->dequeue; 906 bool ccs = ring->ccs; 907 /* hack to bundle together the two/three TDs that make a setup transfer */ 908 bool control_td_set = 0; 909 910 while (1) { 911 TRBType type; 912 pci_dma_read(&xhci->pci_dev, dequeue, &trb, TRB_SIZE); 913 le64_to_cpus(&trb.parameter); 914 le32_to_cpus(&trb.status); 915 le32_to_cpus(&trb.control); 916 917 if ((trb.control & TRB_C) != ccs) { 918 return -length; 919 } 920 921 type = TRB_TYPE(trb); 922 923 if (type == TR_LINK) { 924 dequeue = xhci_mask64(trb.parameter); 925 if (trb.control & TRB_LK_TC) { 926 ccs = !ccs; 927 } 928 continue; 929 } 930 931 length += 1; 932 dequeue += TRB_SIZE; 933 934 if (type == TR_SETUP) { 935 control_td_set = 1; 936 } else if (type == TR_STATUS) { 937 control_td_set = 0; 938 } 939 940 if (!control_td_set && !(trb.control & TRB_TR_CH)) { 941 return length; 942 } 943 } 944 } 945 946 static void xhci_er_reset(XHCIState *xhci) 947 { 948 XHCIEvRingSeg seg; 949 950 /* cache the (sole) event ring segment location */ 951 if (xhci->erstsz != 1) { 952 fprintf(stderr, "xhci: invalid value for ERSTSZ: %d\n", xhci->erstsz); 953 xhci_die(xhci); 954 return; 955 } 956 dma_addr_t erstba = xhci_addr64(xhci->erstba_low, xhci->erstba_high); 957 pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg)); 958 le32_to_cpus(&seg.addr_low); 959 le32_to_cpus(&seg.addr_high); 960 le32_to_cpus(&seg.size); 961 if (seg.size < 16 || seg.size > 4096) { 962 fprintf(stderr, "xhci: invalid value for segment size: %d\n", seg.size); 963 xhci_die(xhci); 964 return; 965 } 966 xhci->er_start = xhci_addr64(seg.addr_low, seg.addr_high); 967 xhci->er_size = seg.size; 968 969 xhci->er_ep_idx = 0; 970 xhci->er_pcs = 1; 971 xhci->er_full = 0; 972 973 DPRINTF("xhci: event ring:" DMA_ADDR_FMT " [%d]\n", 974 xhci->er_start, xhci->er_size); 975 } 976 977 static void xhci_run(XHCIState *xhci) 978 { 979 trace_usb_xhci_run(); 980 xhci->usbsts &= ~USBSTS_HCH; 981 xhci->mfindex_start = qemu_get_clock_ns(vm_clock); 982 } 983 984 static void xhci_stop(XHCIState *xhci) 985 { 986 trace_usb_xhci_stop(); 987 xhci->usbsts |= USBSTS_HCH; 988 xhci->crcr_low &= ~CRCR_CRR; 989 } 990 991 static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx, 992 uint32_t state) 993 { 994 uint32_t ctx[5]; 995 if (epctx->state == state) { 996 return; 997 } 998 999 pci_dma_read(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx)); 1000 ctx[0] &= ~EP_STATE_MASK; 1001 ctx[0] |= state; 1002 ctx[2] = epctx->ring.dequeue | epctx->ring.ccs; 1003 ctx[3] = (epctx->ring.dequeue >> 16) >> 16; 1004 DPRINTF("xhci: set epctx: " DMA_ADDR_FMT " state=%d dequeue=%08x%08x\n", 1005 epctx->pctx, state, ctx[3], ctx[2]); 1006 pci_dma_write(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx)); 1007 epctx->state = state; 1008 } 1009 1010 static void xhci_ep_kick_timer(void *opaque) 1011 { 1012 XHCIEPContext *epctx = opaque; 1013 xhci_kick_ep(epctx->xhci, epctx->slotid, epctx->epid); 1014 } 1015 1016 static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid, 1017 unsigned int epid, dma_addr_t pctx, 1018 uint32_t *ctx) 1019 { 1020 XHCISlot *slot; 1021 XHCIEPContext *epctx; 1022 dma_addr_t dequeue; 1023 int i; 1024 1025 trace_usb_xhci_ep_enable(slotid, epid); 1026 assert(slotid >= 1 && slotid <= MAXSLOTS); 1027 assert(epid >= 1 && epid <= 31); 1028 1029 slot = &xhci->slots[slotid-1]; 1030 if (slot->eps[epid-1]) { 1031 fprintf(stderr, "xhci: slot %d ep %d already enabled!\n", slotid, epid); 1032 return CC_TRB_ERROR; 1033 } 1034 1035 epctx = g_malloc(sizeof(XHCIEPContext)); 1036 memset(epctx, 0, sizeof(XHCIEPContext)); 1037 epctx->xhci = xhci; 1038 epctx->slotid = slotid; 1039 epctx->epid = epid; 1040 1041 slot->eps[epid-1] = epctx; 1042 1043 dequeue = xhci_addr64(ctx[2] & ~0xf, ctx[3]); 1044 xhci_ring_init(xhci, &epctx->ring, dequeue); 1045 epctx->ring.ccs = ctx[2] & 1; 1046 1047 epctx->type = (ctx[1] >> EP_TYPE_SHIFT) & EP_TYPE_MASK; 1048 DPRINTF("xhci: endpoint %d.%d type is %d\n", epid/2, epid%2, epctx->type); 1049 epctx->pctx = pctx; 1050 epctx->max_psize = ctx[1]>>16; 1051 epctx->max_psize *= 1+((ctx[1]>>8)&0xff); 1052 DPRINTF("xhci: endpoint %d.%d max transaction (burst) size is %d\n", 1053 epid/2, epid%2, epctx->max_psize); 1054 for (i = 0; i < ARRAY_SIZE(epctx->transfers); i++) { 1055 usb_packet_init(&epctx->transfers[i].packet); 1056 } 1057 1058 epctx->interval = 1 << (ctx[0] >> 16) & 0xff; 1059 epctx->mfindex_last = 0; 1060 epctx->kick_timer = qemu_new_timer_ns(vm_clock, xhci_ep_kick_timer, epctx); 1061 1062 epctx->state = EP_RUNNING; 1063 ctx[0] &= ~EP_STATE_MASK; 1064 ctx[0] |= EP_RUNNING; 1065 1066 return CC_SUCCESS; 1067 } 1068 1069 static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid, 1070 unsigned int epid) 1071 { 1072 XHCISlot *slot; 1073 XHCIEPContext *epctx; 1074 int i, xferi, killed = 0; 1075 assert(slotid >= 1 && slotid <= MAXSLOTS); 1076 assert(epid >= 1 && epid <= 31); 1077 1078 DPRINTF("xhci_ep_nuke_xfers(%d, %d)\n", slotid, epid); 1079 1080 slot = &xhci->slots[slotid-1]; 1081 1082 if (!slot->eps[epid-1]) { 1083 return 0; 1084 } 1085 1086 epctx = slot->eps[epid-1]; 1087 1088 xferi = epctx->next_xfer; 1089 for (i = 0; i < TD_QUEUE; i++) { 1090 XHCITransfer *t = &epctx->transfers[xferi]; 1091 if (t->running_async) { 1092 usb_cancel_packet(&t->packet); 1093 t->running_async = 0; 1094 t->cancelled = 1; 1095 DPRINTF("xhci: cancelling transfer %d, waiting for it to complete...\n", i); 1096 killed++; 1097 } 1098 if (t->running_retry) { 1099 t->running_retry = 0; 1100 epctx->retry = NULL; 1101 qemu_del_timer(epctx->kick_timer); 1102 } 1103 if (t->trbs) { 1104 g_free(t->trbs); 1105 } 1106 1107 t->trbs = NULL; 1108 t->trb_count = t->trb_alloced = 0; 1109 xferi = (xferi + 1) % TD_QUEUE; 1110 } 1111 return killed; 1112 } 1113 1114 static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid, 1115 unsigned int epid) 1116 { 1117 XHCISlot *slot; 1118 XHCIEPContext *epctx; 1119 1120 trace_usb_xhci_ep_disable(slotid, epid); 1121 assert(slotid >= 1 && slotid <= MAXSLOTS); 1122 assert(epid >= 1 && epid <= 31); 1123 1124 slot = &xhci->slots[slotid-1]; 1125 1126 if (!slot->eps[epid-1]) { 1127 DPRINTF("xhci: slot %d ep %d already disabled\n", slotid, epid); 1128 return CC_SUCCESS; 1129 } 1130 1131 xhci_ep_nuke_xfers(xhci, slotid, epid); 1132 1133 epctx = slot->eps[epid-1]; 1134 1135 xhci_set_ep_state(xhci, epctx, EP_DISABLED); 1136 1137 qemu_free_timer(epctx->kick_timer); 1138 g_free(epctx); 1139 slot->eps[epid-1] = NULL; 1140 1141 return CC_SUCCESS; 1142 } 1143 1144 static TRBCCode xhci_stop_ep(XHCIState *xhci, unsigned int slotid, 1145 unsigned int epid) 1146 { 1147 XHCISlot *slot; 1148 XHCIEPContext *epctx; 1149 1150 trace_usb_xhci_ep_stop(slotid, epid); 1151 assert(slotid >= 1 && slotid <= MAXSLOTS); 1152 1153 if (epid < 1 || epid > 31) { 1154 fprintf(stderr, "xhci: bad ep %d\n", epid); 1155 return CC_TRB_ERROR; 1156 } 1157 1158 slot = &xhci->slots[slotid-1]; 1159 1160 if (!slot->eps[epid-1]) { 1161 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid); 1162 return CC_EP_NOT_ENABLED_ERROR; 1163 } 1164 1165 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) { 1166 fprintf(stderr, "xhci: FIXME: endpoint stopped w/ xfers running, " 1167 "data might be lost\n"); 1168 } 1169 1170 epctx = slot->eps[epid-1]; 1171 1172 xhci_set_ep_state(xhci, epctx, EP_STOPPED); 1173 1174 return CC_SUCCESS; 1175 } 1176 1177 static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid, 1178 unsigned int epid) 1179 { 1180 XHCISlot *slot; 1181 XHCIEPContext *epctx; 1182 USBDevice *dev; 1183 1184 trace_usb_xhci_ep_reset(slotid, epid); 1185 assert(slotid >= 1 && slotid <= MAXSLOTS); 1186 1187 if (epid < 1 || epid > 31) { 1188 fprintf(stderr, "xhci: bad ep %d\n", epid); 1189 return CC_TRB_ERROR; 1190 } 1191 1192 slot = &xhci->slots[slotid-1]; 1193 1194 if (!slot->eps[epid-1]) { 1195 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid); 1196 return CC_EP_NOT_ENABLED_ERROR; 1197 } 1198 1199 epctx = slot->eps[epid-1]; 1200 1201 if (epctx->state != EP_HALTED) { 1202 fprintf(stderr, "xhci: reset EP while EP %d not halted (%d)\n", 1203 epid, epctx->state); 1204 return CC_CONTEXT_STATE_ERROR; 1205 } 1206 1207 if (xhci_ep_nuke_xfers(xhci, slotid, epid) > 0) { 1208 fprintf(stderr, "xhci: FIXME: endpoint reset w/ xfers running, " 1209 "data might be lost\n"); 1210 } 1211 1212 uint8_t ep = epid>>1; 1213 1214 if (epid & 1) { 1215 ep |= 0x80; 1216 } 1217 1218 dev = xhci->ports[xhci->slots[slotid-1].port-1].uport->dev; 1219 if (!dev) { 1220 return CC_USB_TRANSACTION_ERROR; 1221 } 1222 1223 xhci_set_ep_state(xhci, epctx, EP_STOPPED); 1224 1225 return CC_SUCCESS; 1226 } 1227 1228 static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid, 1229 unsigned int epid, uint64_t pdequeue) 1230 { 1231 XHCISlot *slot; 1232 XHCIEPContext *epctx; 1233 dma_addr_t dequeue; 1234 1235 assert(slotid >= 1 && slotid <= MAXSLOTS); 1236 1237 if (epid < 1 || epid > 31) { 1238 fprintf(stderr, "xhci: bad ep %d\n", epid); 1239 return CC_TRB_ERROR; 1240 } 1241 1242 trace_usb_xhci_ep_set_dequeue(slotid, epid, pdequeue); 1243 dequeue = xhci_mask64(pdequeue); 1244 1245 slot = &xhci->slots[slotid-1]; 1246 1247 if (!slot->eps[epid-1]) { 1248 DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid); 1249 return CC_EP_NOT_ENABLED_ERROR; 1250 } 1251 1252 epctx = slot->eps[epid-1]; 1253 1254 1255 if (epctx->state != EP_STOPPED) { 1256 fprintf(stderr, "xhci: set EP dequeue pointer while EP %d not stopped\n", epid); 1257 return CC_CONTEXT_STATE_ERROR; 1258 } 1259 1260 xhci_ring_init(xhci, &epctx->ring, dequeue & ~0xF); 1261 epctx->ring.ccs = dequeue & 1; 1262 1263 xhci_set_ep_state(xhci, epctx, EP_STOPPED); 1264 1265 return CC_SUCCESS; 1266 } 1267 1268 static int xhci_xfer_map(XHCITransfer *xfer) 1269 { 1270 int in_xfer = (xfer->packet.pid == USB_TOKEN_IN); 1271 XHCIState *xhci = xfer->xhci; 1272 int i; 1273 1274 pci_dma_sglist_init(&xfer->sgl, &xhci->pci_dev, xfer->trb_count); 1275 for (i = 0; i < xfer->trb_count; i++) { 1276 XHCITRB *trb = &xfer->trbs[i]; 1277 dma_addr_t addr; 1278 unsigned int chunk = 0; 1279 1280 switch (TRB_TYPE(*trb)) { 1281 case TR_DATA: 1282 if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) { 1283 fprintf(stderr, "xhci: data direction mismatch for TR_DATA\n"); 1284 goto err; 1285 } 1286 /* fallthrough */ 1287 case TR_NORMAL: 1288 case TR_ISOCH: 1289 addr = xhci_mask64(trb->parameter); 1290 chunk = trb->status & 0x1ffff; 1291 if (trb->control & TRB_TR_IDT) { 1292 if (chunk > 8 || in_xfer) { 1293 fprintf(stderr, "xhci: invalid immediate data TRB\n"); 1294 goto err; 1295 } 1296 qemu_sglist_add(&xfer->sgl, trb->addr, chunk); 1297 } else { 1298 qemu_sglist_add(&xfer->sgl, addr, chunk); 1299 } 1300 break; 1301 } 1302 } 1303 1304 usb_packet_map(&xfer->packet, &xfer->sgl); 1305 return 0; 1306 1307 err: 1308 qemu_sglist_destroy(&xfer->sgl); 1309 xhci_die(xhci); 1310 return -1; 1311 } 1312 1313 static void xhci_xfer_unmap(XHCITransfer *xfer) 1314 { 1315 usb_packet_unmap(&xfer->packet, &xfer->sgl); 1316 qemu_sglist_destroy(&xfer->sgl); 1317 } 1318 1319 static void xhci_xfer_report(XHCITransfer *xfer) 1320 { 1321 uint32_t edtla = 0; 1322 unsigned int left; 1323 bool reported = 0; 1324 bool shortpkt = 0; 1325 XHCIEvent event = {ER_TRANSFER, CC_SUCCESS}; 1326 XHCIState *xhci = xfer->xhci; 1327 int i; 1328 1329 left = xfer->packet.result < 0 ? 0 : xfer->packet.result; 1330 1331 for (i = 0; i < xfer->trb_count; i++) { 1332 XHCITRB *trb = &xfer->trbs[i]; 1333 unsigned int chunk = 0; 1334 1335 switch (TRB_TYPE(*trb)) { 1336 case TR_DATA: 1337 case TR_NORMAL: 1338 case TR_ISOCH: 1339 chunk = trb->status & 0x1ffff; 1340 if (chunk > left) { 1341 chunk = left; 1342 if (xfer->status == CC_SUCCESS) { 1343 shortpkt = 1; 1344 } 1345 } 1346 left -= chunk; 1347 edtla += chunk; 1348 break; 1349 case TR_STATUS: 1350 reported = 0; 1351 shortpkt = 0; 1352 break; 1353 } 1354 1355 if (!reported && ((trb->control & TRB_TR_IOC) || 1356 (shortpkt && (trb->control & TRB_TR_ISP)) || 1357 (xfer->status != CC_SUCCESS))) { 1358 event.slotid = xfer->slotid; 1359 event.epid = xfer->epid; 1360 event.length = (trb->status & 0x1ffff) - chunk; 1361 event.flags = 0; 1362 event.ptr = trb->addr; 1363 if (xfer->status == CC_SUCCESS) { 1364 event.ccode = shortpkt ? CC_SHORT_PACKET : CC_SUCCESS; 1365 } else { 1366 event.ccode = xfer->status; 1367 } 1368 if (TRB_TYPE(*trb) == TR_EVDATA) { 1369 event.ptr = trb->parameter; 1370 event.flags |= TRB_EV_ED; 1371 event.length = edtla & 0xffffff; 1372 DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length); 1373 edtla = 0; 1374 } 1375 xhci_event(xhci, &event); 1376 reported = 1; 1377 if (xfer->status != CC_SUCCESS) { 1378 return; 1379 } 1380 } 1381 } 1382 } 1383 1384 static void xhci_stall_ep(XHCITransfer *xfer) 1385 { 1386 XHCIState *xhci = xfer->xhci; 1387 XHCISlot *slot = &xhci->slots[xfer->slotid-1]; 1388 XHCIEPContext *epctx = slot->eps[xfer->epid-1]; 1389 1390 epctx->ring.dequeue = xfer->trbs[0].addr; 1391 epctx->ring.ccs = xfer->trbs[0].ccs; 1392 xhci_set_ep_state(xhci, epctx, EP_HALTED); 1393 DPRINTF("xhci: stalled slot %d ep %d\n", xfer->slotid, xfer->epid); 1394 DPRINTF("xhci: will continue at "DMA_ADDR_FMT"\n", epctx->ring.dequeue); 1395 } 1396 1397 static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, 1398 XHCIEPContext *epctx); 1399 1400 static USBDevice *xhci_find_device(XHCIPort *port, uint8_t addr) 1401 { 1402 if (!(port->portsc & PORTSC_PED)) { 1403 return NULL; 1404 } 1405 return usb_find_device(port->uport, addr); 1406 } 1407 1408 static int xhci_setup_packet(XHCITransfer *xfer) 1409 { 1410 XHCIState *xhci = xfer->xhci; 1411 XHCIPort *port; 1412 USBDevice *dev; 1413 USBEndpoint *ep; 1414 int dir; 1415 1416 dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT; 1417 1418 if (xfer->packet.ep) { 1419 ep = xfer->packet.ep; 1420 dev = ep->dev; 1421 } else { 1422 port = &xhci->ports[xhci->slots[xfer->slotid-1].port-1]; 1423 dev = xhci_find_device(port, xhci->slots[xfer->slotid-1].devaddr); 1424 if (!dev) { 1425 fprintf(stderr, "xhci: slot %d port %d has no device\n", 1426 xfer->slotid, xhci->slots[xfer->slotid-1].port); 1427 return -1; 1428 } 1429 ep = usb_ep_get(dev, dir, xfer->epid >> 1); 1430 } 1431 1432 usb_packet_setup(&xfer->packet, dir, ep, xfer->trbs[0].addr); 1433 xhci_xfer_map(xfer); 1434 DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n", 1435 xfer->packet.pid, dev->addr, ep->nr); 1436 return 0; 1437 } 1438 1439 static int xhci_complete_packet(XHCITransfer *xfer, int ret) 1440 { 1441 if (ret == USB_RET_ASYNC) { 1442 trace_usb_xhci_xfer_async(xfer); 1443 xfer->running_async = 1; 1444 xfer->running_retry = 0; 1445 xfer->complete = 0; 1446 xfer->cancelled = 0; 1447 return 0; 1448 } else if (ret == USB_RET_NAK) { 1449 trace_usb_xhci_xfer_nak(xfer); 1450 xfer->running_async = 0; 1451 xfer->running_retry = 1; 1452 xfer->complete = 0; 1453 xfer->cancelled = 0; 1454 return 0; 1455 } else { 1456 xfer->running_async = 0; 1457 xfer->running_retry = 0; 1458 xfer->complete = 1; 1459 xhci_xfer_unmap(xfer); 1460 } 1461 1462 if (ret >= 0) { 1463 trace_usb_xhci_xfer_success(xfer, ret); 1464 xfer->status = CC_SUCCESS; 1465 xhci_xfer_report(xfer); 1466 return 0; 1467 } 1468 1469 /* error */ 1470 trace_usb_xhci_xfer_error(xfer, ret); 1471 switch (ret) { 1472 case USB_RET_NODEV: 1473 xfer->status = CC_USB_TRANSACTION_ERROR; 1474 xhci_xfer_report(xfer); 1475 xhci_stall_ep(xfer); 1476 break; 1477 case USB_RET_STALL: 1478 xfer->status = CC_STALL_ERROR; 1479 xhci_xfer_report(xfer); 1480 xhci_stall_ep(xfer); 1481 break; 1482 default: 1483 fprintf(stderr, "%s: FIXME: ret = %d\n", __FUNCTION__, ret); 1484 FIXME(); 1485 } 1486 return 0; 1487 } 1488 1489 static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer) 1490 { 1491 XHCITRB *trb_setup, *trb_status; 1492 uint8_t bmRequestType; 1493 int ret; 1494 1495 trb_setup = &xfer->trbs[0]; 1496 trb_status = &xfer->trbs[xfer->trb_count-1]; 1497 1498 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid); 1499 1500 /* at most one Event Data TRB allowed after STATUS */ 1501 if (TRB_TYPE(*trb_status) == TR_EVDATA && xfer->trb_count > 2) { 1502 trb_status--; 1503 } 1504 1505 /* do some sanity checks */ 1506 if (TRB_TYPE(*trb_setup) != TR_SETUP) { 1507 fprintf(stderr, "xhci: ep0 first TD not SETUP: %d\n", 1508 TRB_TYPE(*trb_setup)); 1509 return -1; 1510 } 1511 if (TRB_TYPE(*trb_status) != TR_STATUS) { 1512 fprintf(stderr, "xhci: ep0 last TD not STATUS: %d\n", 1513 TRB_TYPE(*trb_status)); 1514 return -1; 1515 } 1516 if (!(trb_setup->control & TRB_TR_IDT)) { 1517 fprintf(stderr, "xhci: Setup TRB doesn't have IDT set\n"); 1518 return -1; 1519 } 1520 if ((trb_setup->status & 0x1ffff) != 8) { 1521 fprintf(stderr, "xhci: Setup TRB has bad length (%d)\n", 1522 (trb_setup->status & 0x1ffff)); 1523 return -1; 1524 } 1525 1526 bmRequestType = trb_setup->parameter; 1527 1528 xfer->in_xfer = bmRequestType & USB_DIR_IN; 1529 xfer->iso_xfer = false; 1530 1531 if (xhci_setup_packet(xfer) < 0) { 1532 return -1; 1533 } 1534 xfer->packet.parameter = trb_setup->parameter; 1535 1536 ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet); 1537 1538 xhci_complete_packet(xfer, ret); 1539 if (!xfer->running_async && !xfer->running_retry) { 1540 xhci_kick_ep(xhci, xfer->slotid, xfer->epid); 1541 } 1542 return 0; 1543 } 1544 1545 static void xhci_calc_iso_kick(XHCIState *xhci, XHCITransfer *xfer, 1546 XHCIEPContext *epctx, uint64_t mfindex) 1547 { 1548 if (xfer->trbs[0].control & TRB_TR_SIA) { 1549 uint64_t asap = ((mfindex + epctx->interval - 1) & 1550 ~(epctx->interval-1)); 1551 if (asap >= epctx->mfindex_last && 1552 asap <= epctx->mfindex_last + epctx->interval * 4) { 1553 xfer->mfindex_kick = epctx->mfindex_last + epctx->interval; 1554 } else { 1555 xfer->mfindex_kick = asap; 1556 } 1557 } else { 1558 xfer->mfindex_kick = (xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT) 1559 & TRB_TR_FRAMEID_MASK; 1560 xfer->mfindex_kick |= mfindex & ~0x3fff; 1561 if (xfer->mfindex_kick < mfindex) { 1562 xfer->mfindex_kick += 0x4000; 1563 } 1564 } 1565 } 1566 1567 static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer, 1568 XHCIEPContext *epctx, uint64_t mfindex) 1569 { 1570 if (xfer->mfindex_kick > mfindex) { 1571 qemu_mod_timer(epctx->kick_timer, qemu_get_clock_ns(vm_clock) + 1572 (xfer->mfindex_kick - mfindex) * 125000); 1573 xfer->running_retry = 1; 1574 } else { 1575 epctx->mfindex_last = xfer->mfindex_kick; 1576 qemu_del_timer(epctx->kick_timer); 1577 xfer->running_retry = 0; 1578 } 1579 } 1580 1581 1582 static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx) 1583 { 1584 uint64_t mfindex; 1585 int ret; 1586 1587 DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", xfer->slotid, xfer->epid); 1588 1589 xfer->in_xfer = epctx->type>>2; 1590 1591 switch(epctx->type) { 1592 case ET_INTR_OUT: 1593 case ET_INTR_IN: 1594 case ET_BULK_OUT: 1595 case ET_BULK_IN: 1596 xfer->pkts = 0; 1597 xfer->iso_xfer = false; 1598 break; 1599 case ET_ISO_OUT: 1600 case ET_ISO_IN: 1601 xfer->pkts = 1; 1602 xfer->iso_xfer = true; 1603 mfindex = xhci_mfindex_get(xhci); 1604 xhci_calc_iso_kick(xhci, xfer, epctx, mfindex); 1605 xhci_check_iso_kick(xhci, xfer, epctx, mfindex); 1606 if (xfer->running_retry) { 1607 return -1; 1608 } 1609 break; 1610 default: 1611 fprintf(stderr, "xhci: unknown or unhandled EP " 1612 "(type %d, in %d, ep %02x)\n", 1613 epctx->type, xfer->in_xfer, xfer->epid); 1614 return -1; 1615 } 1616 1617 if (xhci_setup_packet(xfer) < 0) { 1618 return -1; 1619 } 1620 ret = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet); 1621 1622 xhci_complete_packet(xfer, ret); 1623 if (!xfer->running_async && !xfer->running_retry) { 1624 xhci_kick_ep(xhci, xfer->slotid, xfer->epid); 1625 } 1626 return 0; 1627 } 1628 1629 static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx) 1630 { 1631 trace_usb_xhci_xfer_start(xfer, xfer->slotid, xfer->epid); 1632 return xhci_submit(xhci, xfer, epctx); 1633 } 1634 1635 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid, unsigned int epid) 1636 { 1637 XHCIEPContext *epctx; 1638 uint64_t mfindex; 1639 int length; 1640 int i; 1641 1642 trace_usb_xhci_ep_kick(slotid, epid); 1643 assert(slotid >= 1 && slotid <= MAXSLOTS); 1644 assert(epid >= 1 && epid <= 31); 1645 1646 if (!xhci->slots[slotid-1].enabled) { 1647 fprintf(stderr, "xhci: xhci_kick_ep for disabled slot %d\n", slotid); 1648 return; 1649 } 1650 epctx = xhci->slots[slotid-1].eps[epid-1]; 1651 if (!epctx) { 1652 fprintf(stderr, "xhci: xhci_kick_ep for disabled endpoint %d,%d\n", 1653 epid, slotid); 1654 return; 1655 } 1656 1657 if (epctx->retry) { 1658 XHCITransfer *xfer = epctx->retry; 1659 int result; 1660 1661 trace_usb_xhci_xfer_retry(xfer); 1662 assert(xfer->running_retry); 1663 if (xfer->iso_xfer) { 1664 /* retry delayed iso transfer */ 1665 mfindex = xhci_mfindex_get(xhci); 1666 xhci_check_iso_kick(xhci, xfer, epctx, mfindex); 1667 if (xfer->running_retry) { 1668 return; 1669 } 1670 if (xhci_setup_packet(xfer) < 0) { 1671 return; 1672 } 1673 result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet); 1674 assert(result != USB_RET_NAK); 1675 xhci_complete_packet(xfer, result); 1676 } else { 1677 /* retry nak'ed transfer */ 1678 if (xhci_setup_packet(xfer) < 0) { 1679 return; 1680 } 1681 result = usb_handle_packet(xfer->packet.ep->dev, &xfer->packet); 1682 if (result == USB_RET_NAK) { 1683 return; 1684 } 1685 xhci_complete_packet(xfer, result); 1686 } 1687 assert(!xfer->running_retry); 1688 epctx->retry = NULL; 1689 } 1690 1691 if (epctx->state == EP_HALTED) { 1692 DPRINTF("xhci: ep halted, not running schedule\n"); 1693 return; 1694 } 1695 1696 xhci_set_ep_state(xhci, epctx, EP_RUNNING); 1697 1698 while (1) { 1699 XHCITransfer *xfer = &epctx->transfers[epctx->next_xfer]; 1700 if (xfer->running_async || xfer->running_retry) { 1701 break; 1702 } 1703 length = xhci_ring_chain_length(xhci, &epctx->ring); 1704 if (length < 0) { 1705 break; 1706 } else if (length == 0) { 1707 break; 1708 } 1709 if (xfer->trbs && xfer->trb_alloced < length) { 1710 xfer->trb_count = 0; 1711 xfer->trb_alloced = 0; 1712 g_free(xfer->trbs); 1713 xfer->trbs = NULL; 1714 } 1715 if (!xfer->trbs) { 1716 xfer->trbs = g_malloc(sizeof(XHCITRB) * length); 1717 xfer->trb_alloced = length; 1718 } 1719 xfer->trb_count = length; 1720 1721 for (i = 0; i < length; i++) { 1722 assert(xhci_ring_fetch(xhci, &epctx->ring, &xfer->trbs[i], NULL)); 1723 } 1724 xfer->xhci = xhci; 1725 xfer->epid = epid; 1726 xfer->slotid = slotid; 1727 1728 if (epid == 1) { 1729 if (xhci_fire_ctl_transfer(xhci, xfer) >= 0) { 1730 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE; 1731 } else { 1732 fprintf(stderr, "xhci: error firing CTL transfer\n"); 1733 } 1734 } else { 1735 if (xhci_fire_transfer(xhci, xfer, epctx) >= 0) { 1736 epctx->next_xfer = (epctx->next_xfer + 1) % TD_QUEUE; 1737 } else { 1738 if (!xfer->iso_xfer) { 1739 fprintf(stderr, "xhci: error firing data transfer\n"); 1740 } 1741 } 1742 } 1743 1744 if (epctx->state == EP_HALTED) { 1745 break; 1746 } 1747 if (xfer->running_retry) { 1748 DPRINTF("xhci: xfer nacked, stopping schedule\n"); 1749 epctx->retry = xfer; 1750 break; 1751 } 1752 } 1753 } 1754 1755 static TRBCCode xhci_enable_slot(XHCIState *xhci, unsigned int slotid) 1756 { 1757 trace_usb_xhci_slot_enable(slotid); 1758 assert(slotid >= 1 && slotid <= MAXSLOTS); 1759 xhci->slots[slotid-1].enabled = 1; 1760 xhci->slots[slotid-1].port = 0; 1761 memset(xhci->slots[slotid-1].eps, 0, sizeof(XHCIEPContext*)*31); 1762 1763 return CC_SUCCESS; 1764 } 1765 1766 static TRBCCode xhci_disable_slot(XHCIState *xhci, unsigned int slotid) 1767 { 1768 int i; 1769 1770 trace_usb_xhci_slot_disable(slotid); 1771 assert(slotid >= 1 && slotid <= MAXSLOTS); 1772 1773 for (i = 1; i <= 31; i++) { 1774 if (xhci->slots[slotid-1].eps[i-1]) { 1775 xhci_disable_ep(xhci, slotid, i); 1776 } 1777 } 1778 1779 xhci->slots[slotid-1].enabled = 0; 1780 return CC_SUCCESS; 1781 } 1782 1783 static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid, 1784 uint64_t pictx, bool bsr) 1785 { 1786 XHCISlot *slot; 1787 USBDevice *dev; 1788 dma_addr_t ictx, octx, dcbaap; 1789 uint64_t poctx; 1790 uint32_t ictl_ctx[2]; 1791 uint32_t slot_ctx[4]; 1792 uint32_t ep0_ctx[5]; 1793 unsigned int port; 1794 int i; 1795 TRBCCode res; 1796 1797 trace_usb_xhci_slot_address(slotid); 1798 assert(slotid >= 1 && slotid <= MAXSLOTS); 1799 1800 dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high); 1801 pci_dma_read(&xhci->pci_dev, dcbaap + 8*slotid, &poctx, sizeof(poctx)); 1802 ictx = xhci_mask64(pictx); 1803 octx = xhci_mask64(le64_to_cpu(poctx)); 1804 1805 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx); 1806 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx); 1807 1808 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx)); 1809 1810 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) { 1811 fprintf(stderr, "xhci: invalid input context control %08x %08x\n", 1812 ictl_ctx[0], ictl_ctx[1]); 1813 return CC_TRB_ERROR; 1814 } 1815 1816 pci_dma_read(&xhci->pci_dev, ictx+32, slot_ctx, sizeof(slot_ctx)); 1817 pci_dma_read(&xhci->pci_dev, ictx+64, ep0_ctx, sizeof(ep0_ctx)); 1818 1819 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n", 1820 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 1821 1822 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n", 1823 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]); 1824 1825 port = (slot_ctx[1]>>16) & 0xFF; 1826 dev = xhci->ports[port-1].uport->dev; 1827 1828 if (port < 1 || port > xhci->numports) { 1829 fprintf(stderr, "xhci: bad port %d\n", port); 1830 return CC_TRB_ERROR; 1831 } else if (!dev) { 1832 fprintf(stderr, "xhci: port %d not connected\n", port); 1833 return CC_USB_TRANSACTION_ERROR; 1834 } 1835 1836 for (i = 0; i < MAXSLOTS; i++) { 1837 if (xhci->slots[i].port == port) { 1838 fprintf(stderr, "xhci: port %d already assigned to slot %d\n", 1839 port, i+1); 1840 return CC_TRB_ERROR; 1841 } 1842 } 1843 1844 slot = &xhci->slots[slotid-1]; 1845 slot->port = port; 1846 slot->ctx = octx; 1847 1848 if (bsr) { 1849 slot_ctx[3] = SLOT_DEFAULT << SLOT_STATE_SHIFT; 1850 } else { 1851 slot->devaddr = xhci->devaddr++; 1852 slot_ctx[3] = (SLOT_ADDRESSED << SLOT_STATE_SHIFT) | slot->devaddr; 1853 DPRINTF("xhci: device address is %d\n", slot->devaddr); 1854 usb_device_handle_control(dev, NULL, 1855 DeviceOutRequest | USB_REQ_SET_ADDRESS, 1856 slot->devaddr, 0, 0, NULL); 1857 } 1858 1859 res = xhci_enable_ep(xhci, slotid, 1, octx+32, ep0_ctx); 1860 1861 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n", 1862 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 1863 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n", 1864 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]); 1865 1866 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1867 pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx)); 1868 1869 return res; 1870 } 1871 1872 1873 static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid, 1874 uint64_t pictx, bool dc) 1875 { 1876 dma_addr_t ictx, octx; 1877 uint32_t ictl_ctx[2]; 1878 uint32_t slot_ctx[4]; 1879 uint32_t islot_ctx[4]; 1880 uint32_t ep_ctx[5]; 1881 int i; 1882 TRBCCode res; 1883 1884 trace_usb_xhci_slot_configure(slotid); 1885 assert(slotid >= 1 && slotid <= MAXSLOTS); 1886 1887 ictx = xhci_mask64(pictx); 1888 octx = xhci->slots[slotid-1].ctx; 1889 1890 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx); 1891 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx); 1892 1893 if (dc) { 1894 for (i = 2; i <= 31; i++) { 1895 if (xhci->slots[slotid-1].eps[i-1]) { 1896 xhci_disable_ep(xhci, slotid, i); 1897 } 1898 } 1899 1900 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1901 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT); 1902 slot_ctx[3] |= SLOT_ADDRESSED << SLOT_STATE_SHIFT; 1903 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n", 1904 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 1905 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1906 1907 return CC_SUCCESS; 1908 } 1909 1910 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx)); 1911 1912 if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) { 1913 fprintf(stderr, "xhci: invalid input context control %08x %08x\n", 1914 ictl_ctx[0], ictl_ctx[1]); 1915 return CC_TRB_ERROR; 1916 } 1917 1918 pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx)); 1919 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1920 1921 if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) { 1922 fprintf(stderr, "xhci: invalid slot state %08x\n", slot_ctx[3]); 1923 return CC_CONTEXT_STATE_ERROR; 1924 } 1925 1926 for (i = 2; i <= 31; i++) { 1927 if (ictl_ctx[0] & (1<<i)) { 1928 xhci_disable_ep(xhci, slotid, i); 1929 } 1930 if (ictl_ctx[1] & (1<<i)) { 1931 pci_dma_read(&xhci->pci_dev, ictx+32+(32*i), ep_ctx, 1932 sizeof(ep_ctx)); 1933 DPRINTF("xhci: input ep%d.%d context: %08x %08x %08x %08x %08x\n", 1934 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2], 1935 ep_ctx[3], ep_ctx[4]); 1936 xhci_disable_ep(xhci, slotid, i); 1937 res = xhci_enable_ep(xhci, slotid, i, octx+(32*i), ep_ctx); 1938 if (res != CC_SUCCESS) { 1939 return res; 1940 } 1941 DPRINTF("xhci: output ep%d.%d context: %08x %08x %08x %08x %08x\n", 1942 i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2], 1943 ep_ctx[3], ep_ctx[4]); 1944 pci_dma_write(&xhci->pci_dev, octx+(32*i), ep_ctx, sizeof(ep_ctx)); 1945 } 1946 } 1947 1948 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT); 1949 slot_ctx[3] |= SLOT_CONFIGURED << SLOT_STATE_SHIFT; 1950 slot_ctx[0] &= ~(SLOT_CONTEXT_ENTRIES_MASK << SLOT_CONTEXT_ENTRIES_SHIFT); 1951 slot_ctx[0] |= islot_ctx[0] & (SLOT_CONTEXT_ENTRIES_MASK << 1952 SLOT_CONTEXT_ENTRIES_SHIFT); 1953 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n", 1954 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 1955 1956 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1957 1958 return CC_SUCCESS; 1959 } 1960 1961 1962 static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid, 1963 uint64_t pictx) 1964 { 1965 dma_addr_t ictx, octx; 1966 uint32_t ictl_ctx[2]; 1967 uint32_t iep0_ctx[5]; 1968 uint32_t ep0_ctx[5]; 1969 uint32_t islot_ctx[4]; 1970 uint32_t slot_ctx[4]; 1971 1972 trace_usb_xhci_slot_evaluate(slotid); 1973 assert(slotid >= 1 && slotid <= MAXSLOTS); 1974 1975 ictx = xhci_mask64(pictx); 1976 octx = xhci->slots[slotid-1].ctx; 1977 1978 DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx); 1979 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx); 1980 1981 pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx)); 1982 1983 if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) { 1984 fprintf(stderr, "xhci: invalid input context control %08x %08x\n", 1985 ictl_ctx[0], ictl_ctx[1]); 1986 return CC_TRB_ERROR; 1987 } 1988 1989 if (ictl_ctx[1] & 0x1) { 1990 pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx)); 1991 1992 DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n", 1993 islot_ctx[0], islot_ctx[1], islot_ctx[2], islot_ctx[3]); 1994 1995 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 1996 1997 slot_ctx[1] &= ~0xFFFF; /* max exit latency */ 1998 slot_ctx[1] |= islot_ctx[1] & 0xFFFF; 1999 slot_ctx[2] &= ~0xFF00000; /* interrupter target */ 2000 slot_ctx[2] |= islot_ctx[2] & 0xFF000000; 2001 2002 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n", 2003 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 2004 2005 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 2006 } 2007 2008 if (ictl_ctx[1] & 0x2) { 2009 pci_dma_read(&xhci->pci_dev, ictx+64, iep0_ctx, sizeof(iep0_ctx)); 2010 2011 DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n", 2012 iep0_ctx[0], iep0_ctx[1], iep0_ctx[2], 2013 iep0_ctx[3], iep0_ctx[4]); 2014 2015 pci_dma_read(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx)); 2016 2017 ep0_ctx[1] &= ~0xFFFF0000; /* max packet size*/ 2018 ep0_ctx[1] |= iep0_ctx[1] & 0xFFFF0000; 2019 2020 DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n", 2021 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]); 2022 2023 pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx)); 2024 } 2025 2026 return CC_SUCCESS; 2027 } 2028 2029 static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid) 2030 { 2031 uint32_t slot_ctx[4]; 2032 dma_addr_t octx; 2033 int i; 2034 2035 trace_usb_xhci_slot_reset(slotid); 2036 assert(slotid >= 1 && slotid <= MAXSLOTS); 2037 2038 octx = xhci->slots[slotid-1].ctx; 2039 2040 DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx); 2041 2042 for (i = 2; i <= 31; i++) { 2043 if (xhci->slots[slotid-1].eps[i-1]) { 2044 xhci_disable_ep(xhci, slotid, i); 2045 } 2046 } 2047 2048 pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 2049 slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT); 2050 slot_ctx[3] |= SLOT_DEFAULT << SLOT_STATE_SHIFT; 2051 DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n", 2052 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]); 2053 pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx)); 2054 2055 return CC_SUCCESS; 2056 } 2057 2058 static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *trb) 2059 { 2060 unsigned int slotid; 2061 slotid = (trb->control >> TRB_CR_SLOTID_SHIFT) & TRB_CR_SLOTID_MASK; 2062 if (slotid < 1 || slotid > MAXSLOTS) { 2063 fprintf(stderr, "xhci: bad slot id %d\n", slotid); 2064 event->ccode = CC_TRB_ERROR; 2065 return 0; 2066 } else if (!xhci->slots[slotid-1].enabled) { 2067 fprintf(stderr, "xhci: slot id %d not enabled\n", slotid); 2068 event->ccode = CC_SLOT_NOT_ENABLED_ERROR; 2069 return 0; 2070 } 2071 return slotid; 2072 } 2073 2074 static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx) 2075 { 2076 dma_addr_t ctx; 2077 uint8_t bw_ctx[xhci->numports+1]; 2078 2079 DPRINTF("xhci_get_port_bandwidth()\n"); 2080 2081 ctx = xhci_mask64(pctx); 2082 2083 DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx); 2084 2085 /* TODO: actually implement real values here */ 2086 bw_ctx[0] = 0; 2087 memset(&bw_ctx[1], 80, xhci->numports); /* 80% */ 2088 pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx)); 2089 2090 return CC_SUCCESS; 2091 } 2092 2093 static uint32_t rotl(uint32_t v, unsigned count) 2094 { 2095 count &= 31; 2096 return (v << count) | (v >> (32 - count)); 2097 } 2098 2099 2100 static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo) 2101 { 2102 uint32_t val; 2103 val = rotl(lo - 0x49434878, 32 - ((hi>>8) & 0x1F)); 2104 val += rotl(lo + 0x49434878, hi & 0x1F); 2105 val -= rotl(hi ^ 0x49434878, (lo >> 16) & 0x1F); 2106 return ~val; 2107 } 2108 2109 static void xhci_via_challenge(XHCIState *xhci, uint64_t addr) 2110 { 2111 uint32_t buf[8]; 2112 uint32_t obuf[8]; 2113 dma_addr_t paddr = xhci_mask64(addr); 2114 2115 pci_dma_read(&xhci->pci_dev, paddr, &buf, 32); 2116 2117 memcpy(obuf, buf, sizeof(obuf)); 2118 2119 if ((buf[0] & 0xff) == 2) { 2120 obuf[0] = 0x49932000 + 0x54dc200 * buf[2] + 0x7429b578 * buf[3]; 2121 obuf[0] |= (buf[2] * buf[3]) & 0xff; 2122 obuf[1] = 0x0132bb37 + 0xe89 * buf[2] + 0xf09 * buf[3]; 2123 obuf[2] = 0x0066c2e9 + 0x2091 * buf[2] + 0x19bd * buf[3]; 2124 obuf[3] = 0xd5281342 + 0x2cc9691 * buf[2] + 0x2367662 * buf[3]; 2125 obuf[4] = 0x0123c75c + 0x1595 * buf[2] + 0x19ec * buf[3]; 2126 obuf[5] = 0x00f695de + 0x26fd * buf[2] + 0x3e9 * buf[3]; 2127 obuf[6] = obuf[2] ^ obuf[3] ^ 0x29472956; 2128 obuf[7] = obuf[2] ^ obuf[3] ^ 0x65866593; 2129 } 2130 2131 pci_dma_write(&xhci->pci_dev, paddr, &obuf, 32); 2132 } 2133 2134 static void xhci_process_commands(XHCIState *xhci) 2135 { 2136 XHCITRB trb; 2137 TRBType type; 2138 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS}; 2139 dma_addr_t addr; 2140 unsigned int i, slotid = 0; 2141 2142 DPRINTF("xhci_process_commands()\n"); 2143 if (!xhci_running(xhci)) { 2144 DPRINTF("xhci_process_commands() called while xHC stopped or paused\n"); 2145 return; 2146 } 2147 2148 xhci->crcr_low |= CRCR_CRR; 2149 2150 while ((type = xhci_ring_fetch(xhci, &xhci->cmd_ring, &trb, &addr))) { 2151 event.ptr = addr; 2152 switch (type) { 2153 case CR_ENABLE_SLOT: 2154 for (i = 0; i < MAXSLOTS; i++) { 2155 if (!xhci->slots[i].enabled) { 2156 break; 2157 } 2158 } 2159 if (i >= MAXSLOTS) { 2160 fprintf(stderr, "xhci: no device slots available\n"); 2161 event.ccode = CC_NO_SLOTS_ERROR; 2162 } else { 2163 slotid = i+1; 2164 event.ccode = xhci_enable_slot(xhci, slotid); 2165 } 2166 break; 2167 case CR_DISABLE_SLOT: 2168 slotid = xhci_get_slot(xhci, &event, &trb); 2169 if (slotid) { 2170 event.ccode = xhci_disable_slot(xhci, slotid); 2171 } 2172 break; 2173 case CR_ADDRESS_DEVICE: 2174 slotid = xhci_get_slot(xhci, &event, &trb); 2175 if (slotid) { 2176 event.ccode = xhci_address_slot(xhci, slotid, trb.parameter, 2177 trb.control & TRB_CR_BSR); 2178 } 2179 break; 2180 case CR_CONFIGURE_ENDPOINT: 2181 slotid = xhci_get_slot(xhci, &event, &trb); 2182 if (slotid) { 2183 event.ccode = xhci_configure_slot(xhci, slotid, trb.parameter, 2184 trb.control & TRB_CR_DC); 2185 } 2186 break; 2187 case CR_EVALUATE_CONTEXT: 2188 slotid = xhci_get_slot(xhci, &event, &trb); 2189 if (slotid) { 2190 event.ccode = xhci_evaluate_slot(xhci, slotid, trb.parameter); 2191 } 2192 break; 2193 case CR_STOP_ENDPOINT: 2194 slotid = xhci_get_slot(xhci, &event, &trb); 2195 if (slotid) { 2196 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT) 2197 & TRB_CR_EPID_MASK; 2198 event.ccode = xhci_stop_ep(xhci, slotid, epid); 2199 } 2200 break; 2201 case CR_RESET_ENDPOINT: 2202 slotid = xhci_get_slot(xhci, &event, &trb); 2203 if (slotid) { 2204 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT) 2205 & TRB_CR_EPID_MASK; 2206 event.ccode = xhci_reset_ep(xhci, slotid, epid); 2207 } 2208 break; 2209 case CR_SET_TR_DEQUEUE: 2210 slotid = xhci_get_slot(xhci, &event, &trb); 2211 if (slotid) { 2212 unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT) 2213 & TRB_CR_EPID_MASK; 2214 event.ccode = xhci_set_ep_dequeue(xhci, slotid, epid, 2215 trb.parameter); 2216 } 2217 break; 2218 case CR_RESET_DEVICE: 2219 slotid = xhci_get_slot(xhci, &event, &trb); 2220 if (slotid) { 2221 event.ccode = xhci_reset_slot(xhci, slotid); 2222 } 2223 break; 2224 case CR_GET_PORT_BANDWIDTH: 2225 event.ccode = xhci_get_port_bandwidth(xhci, trb.parameter); 2226 break; 2227 case CR_VENDOR_VIA_CHALLENGE_RESPONSE: 2228 xhci_via_challenge(xhci, trb.parameter); 2229 break; 2230 case CR_VENDOR_NEC_FIRMWARE_REVISION: 2231 event.type = 48; /* NEC reply */ 2232 event.length = 0x3025; 2233 break; 2234 case CR_VENDOR_NEC_CHALLENGE_RESPONSE: 2235 { 2236 uint32_t chi = trb.parameter >> 32; 2237 uint32_t clo = trb.parameter; 2238 uint32_t val = xhci_nec_challenge(chi, clo); 2239 event.length = val & 0xFFFF; 2240 event.epid = val >> 16; 2241 slotid = val >> 24; 2242 event.type = 48; /* NEC reply */ 2243 } 2244 break; 2245 default: 2246 fprintf(stderr, "xhci: unimplemented command %d\n", type); 2247 event.ccode = CC_TRB_ERROR; 2248 break; 2249 } 2250 event.slotid = slotid; 2251 xhci_event(xhci, &event); 2252 } 2253 } 2254 2255 static void xhci_update_port(XHCIState *xhci, XHCIPort *port, int is_detach) 2256 { 2257 port->portsc = PORTSC_PP; 2258 if (port->uport->dev && port->uport->dev->attached && !is_detach && 2259 (1 << port->uport->dev->speed) & port->speedmask) { 2260 port->portsc |= PORTSC_CCS; 2261 switch (port->uport->dev->speed) { 2262 case USB_SPEED_LOW: 2263 port->portsc |= PORTSC_SPEED_LOW; 2264 break; 2265 case USB_SPEED_FULL: 2266 port->portsc |= PORTSC_SPEED_FULL; 2267 break; 2268 case USB_SPEED_HIGH: 2269 port->portsc |= PORTSC_SPEED_HIGH; 2270 break; 2271 case USB_SPEED_SUPER: 2272 port->portsc |= PORTSC_SPEED_SUPER; 2273 break; 2274 } 2275 } 2276 2277 if (xhci_running(xhci)) { 2278 port->portsc |= PORTSC_CSC; 2279 XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS, 2280 port->portnr << 24}; 2281 xhci_event(xhci, &ev); 2282 DPRINTF("xhci: port change event for port %d\n", port->portnr); 2283 } 2284 } 2285 2286 static void xhci_reset(DeviceState *dev) 2287 { 2288 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev.qdev, dev); 2289 int i; 2290 2291 trace_usb_xhci_reset(); 2292 if (!(xhci->usbsts & USBSTS_HCH)) { 2293 fprintf(stderr, "xhci: reset while running!\n"); 2294 } 2295 2296 xhci->usbcmd = 0; 2297 xhci->usbsts = USBSTS_HCH; 2298 xhci->dnctrl = 0; 2299 xhci->crcr_low = 0; 2300 xhci->crcr_high = 0; 2301 xhci->dcbaap_low = 0; 2302 xhci->dcbaap_high = 0; 2303 xhci->config = 0; 2304 xhci->devaddr = 2; 2305 2306 for (i = 0; i < MAXSLOTS; i++) { 2307 xhci_disable_slot(xhci, i+1); 2308 } 2309 2310 for (i = 0; i < xhci->numports; i++) { 2311 xhci_update_port(xhci, xhci->ports + i, 0); 2312 } 2313 2314 xhci->iman = 0; 2315 xhci->imod = 0; 2316 xhci->erstsz = 0; 2317 xhci->erstba_low = 0; 2318 xhci->erstba_high = 0; 2319 xhci->erdp_low = 0; 2320 xhci->erdp_high = 0; 2321 xhci->msix_used = 0; 2322 2323 xhci->er_ep_idx = 0; 2324 xhci->er_pcs = 1; 2325 xhci->er_full = 0; 2326 xhci->ev_buffer_put = 0; 2327 xhci->ev_buffer_get = 0; 2328 2329 xhci->mfindex_start = qemu_get_clock_ns(vm_clock); 2330 xhci_mfwrap_update(xhci); 2331 } 2332 2333 static uint32_t xhci_cap_read(XHCIState *xhci, uint32_t reg) 2334 { 2335 uint32_t ret; 2336 2337 switch (reg) { 2338 case 0x00: /* HCIVERSION, CAPLENGTH */ 2339 ret = 0x01000000 | LEN_CAP; 2340 break; 2341 case 0x04: /* HCSPARAMS 1 */ 2342 ret = ((xhci->numports_2+xhci->numports_3)<<24) 2343 | (MAXINTRS<<8) | MAXSLOTS; 2344 break; 2345 case 0x08: /* HCSPARAMS 2 */ 2346 ret = 0x0000000f; 2347 break; 2348 case 0x0c: /* HCSPARAMS 3 */ 2349 ret = 0x00000000; 2350 break; 2351 case 0x10: /* HCCPARAMS */ 2352 if (sizeof(dma_addr_t) == 4) { 2353 ret = 0x00081000; 2354 } else { 2355 ret = 0x00081001; 2356 } 2357 break; 2358 case 0x14: /* DBOFF */ 2359 ret = OFF_DOORBELL; 2360 break; 2361 case 0x18: /* RTSOFF */ 2362 ret = OFF_RUNTIME; 2363 break; 2364 2365 /* extended capabilities */ 2366 case 0x20: /* Supported Protocol:00 */ 2367 ret = 0x02000402; /* USB 2.0 */ 2368 break; 2369 case 0x24: /* Supported Protocol:04 */ 2370 ret = 0x20425455; /* "USB " */ 2371 break; 2372 case 0x28: /* Supported Protocol:08 */ 2373 ret = 0x00000001 | (xhci->numports_2<<8); 2374 break; 2375 case 0x2c: /* Supported Protocol:0c */ 2376 ret = 0x00000000; /* reserved */ 2377 break; 2378 case 0x30: /* Supported Protocol:00 */ 2379 ret = 0x03000002; /* USB 3.0 */ 2380 break; 2381 case 0x34: /* Supported Protocol:04 */ 2382 ret = 0x20425455; /* "USB " */ 2383 break; 2384 case 0x38: /* Supported Protocol:08 */ 2385 ret = 0x00000000 | (xhci->numports_2+1) | (xhci->numports_3<<8); 2386 break; 2387 case 0x3c: /* Supported Protocol:0c */ 2388 ret = 0x00000000; /* reserved */ 2389 break; 2390 default: 2391 fprintf(stderr, "xhci_cap_read: reg %d unimplemented\n", reg); 2392 ret = 0; 2393 } 2394 2395 trace_usb_xhci_cap_read(reg, ret); 2396 return ret; 2397 } 2398 2399 static uint32_t xhci_port_read(XHCIState *xhci, uint32_t reg) 2400 { 2401 uint32_t port = reg >> 4; 2402 uint32_t ret; 2403 2404 if (port >= xhci->numports) { 2405 fprintf(stderr, "xhci_port_read: port %d out of bounds\n", port); 2406 ret = 0; 2407 goto out; 2408 } 2409 2410 switch (reg & 0xf) { 2411 case 0x00: /* PORTSC */ 2412 ret = xhci->ports[port].portsc; 2413 break; 2414 case 0x04: /* PORTPMSC */ 2415 case 0x08: /* PORTLI */ 2416 ret = 0; 2417 break; 2418 case 0x0c: /* reserved */ 2419 default: 2420 fprintf(stderr, "xhci_port_read (port %d): reg 0x%x unimplemented\n", 2421 port, reg); 2422 ret = 0; 2423 } 2424 2425 out: 2426 trace_usb_xhci_port_read(port, reg & 0x0f, ret); 2427 return ret; 2428 } 2429 2430 static void xhci_port_write(XHCIState *xhci, uint32_t reg, uint32_t val) 2431 { 2432 uint32_t port = reg >> 4; 2433 uint32_t portsc; 2434 2435 trace_usb_xhci_port_write(port, reg & 0x0f, val); 2436 2437 if (port >= xhci->numports) { 2438 fprintf(stderr, "xhci_port_read: port %d out of bounds\n", port); 2439 return; 2440 } 2441 2442 switch (reg & 0xf) { 2443 case 0x00: /* PORTSC */ 2444 portsc = xhci->ports[port].portsc; 2445 /* write-1-to-clear bits*/ 2446 portsc &= ~(val & (PORTSC_CSC|PORTSC_PEC|PORTSC_WRC|PORTSC_OCC| 2447 PORTSC_PRC|PORTSC_PLC|PORTSC_CEC)); 2448 if (val & PORTSC_LWS) { 2449 /* overwrite PLS only when LWS=1 */ 2450 portsc &= ~(PORTSC_PLS_MASK << PORTSC_PLS_SHIFT); 2451 portsc |= val & (PORTSC_PLS_MASK << PORTSC_PLS_SHIFT); 2452 } 2453 /* read/write bits */ 2454 portsc &= ~(PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE); 2455 portsc |= (val & (PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE)); 2456 /* write-1-to-start bits */ 2457 if (val & PORTSC_PR) { 2458 DPRINTF("xhci: port %d reset\n", port); 2459 usb_device_reset(xhci->ports[port].uport->dev); 2460 portsc |= PORTSC_PRC | PORTSC_PED; 2461 } 2462 xhci->ports[port].portsc = portsc; 2463 break; 2464 case 0x04: /* PORTPMSC */ 2465 case 0x08: /* PORTLI */ 2466 default: 2467 fprintf(stderr, "xhci_port_write (port %d): reg 0x%x unimplemented\n", 2468 port, reg); 2469 } 2470 } 2471 2472 static uint32_t xhci_oper_read(XHCIState *xhci, uint32_t reg) 2473 { 2474 uint32_t ret; 2475 2476 if (reg >= 0x400) { 2477 return xhci_port_read(xhci, reg - 0x400); 2478 } 2479 2480 switch (reg) { 2481 case 0x00: /* USBCMD */ 2482 ret = xhci->usbcmd; 2483 break; 2484 case 0x04: /* USBSTS */ 2485 ret = xhci->usbsts; 2486 break; 2487 case 0x08: /* PAGESIZE */ 2488 ret = 1; /* 4KiB */ 2489 break; 2490 case 0x14: /* DNCTRL */ 2491 ret = xhci->dnctrl; 2492 break; 2493 case 0x18: /* CRCR low */ 2494 ret = xhci->crcr_low & ~0xe; 2495 break; 2496 case 0x1c: /* CRCR high */ 2497 ret = xhci->crcr_high; 2498 break; 2499 case 0x30: /* DCBAAP low */ 2500 ret = xhci->dcbaap_low; 2501 break; 2502 case 0x34: /* DCBAAP high */ 2503 ret = xhci->dcbaap_high; 2504 break; 2505 case 0x38: /* CONFIG */ 2506 ret = xhci->config; 2507 break; 2508 default: 2509 fprintf(stderr, "xhci_oper_read: reg 0x%x unimplemented\n", reg); 2510 ret = 0; 2511 } 2512 2513 trace_usb_xhci_oper_read(reg, ret); 2514 return ret; 2515 } 2516 2517 static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val) 2518 { 2519 if (reg >= 0x400) { 2520 xhci_port_write(xhci, reg - 0x400, val); 2521 return; 2522 } 2523 2524 trace_usb_xhci_oper_write(reg, val); 2525 2526 switch (reg) { 2527 case 0x00: /* USBCMD */ 2528 if ((val & USBCMD_RS) && !(xhci->usbcmd & USBCMD_RS)) { 2529 xhci_run(xhci); 2530 } else if (!(val & USBCMD_RS) && (xhci->usbcmd & USBCMD_RS)) { 2531 xhci_stop(xhci); 2532 } 2533 xhci->usbcmd = val & 0xc0f; 2534 xhci_mfwrap_update(xhci); 2535 if (val & USBCMD_HCRST) { 2536 xhci_reset(&xhci->pci_dev.qdev); 2537 } 2538 xhci_intx_update(xhci); 2539 break; 2540 2541 case 0x04: /* USBSTS */ 2542 /* these bits are write-1-to-clear */ 2543 xhci->usbsts &= ~(val & (USBSTS_HSE|USBSTS_EINT|USBSTS_PCD|USBSTS_SRE)); 2544 xhci_intx_update(xhci); 2545 break; 2546 2547 case 0x14: /* DNCTRL */ 2548 xhci->dnctrl = val & 0xffff; 2549 break; 2550 case 0x18: /* CRCR low */ 2551 xhci->crcr_low = (val & 0xffffffcf) | (xhci->crcr_low & CRCR_CRR); 2552 break; 2553 case 0x1c: /* CRCR high */ 2554 xhci->crcr_high = val; 2555 if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) { 2556 XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED}; 2557 xhci->crcr_low &= ~CRCR_CRR; 2558 xhci_event(xhci, &event); 2559 DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low); 2560 } else { 2561 dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val); 2562 xhci_ring_init(xhci, &xhci->cmd_ring, base); 2563 } 2564 xhci->crcr_low &= ~(CRCR_CA | CRCR_CS); 2565 break; 2566 case 0x30: /* DCBAAP low */ 2567 xhci->dcbaap_low = val & 0xffffffc0; 2568 break; 2569 case 0x34: /* DCBAAP high */ 2570 xhci->dcbaap_high = val; 2571 break; 2572 case 0x38: /* CONFIG */ 2573 xhci->config = val & 0xff; 2574 break; 2575 default: 2576 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg); 2577 } 2578 } 2579 2580 static uint32_t xhci_runtime_read(XHCIState *xhci, uint32_t reg) 2581 { 2582 uint32_t ret; 2583 2584 switch (reg) { 2585 case 0x00: /* MFINDEX */ 2586 ret = xhci_mfindex_get(xhci) & 0x3fff; 2587 break; 2588 case 0x20: /* IMAN */ 2589 ret = xhci->iman; 2590 break; 2591 case 0x24: /* IMOD */ 2592 ret = xhci->imod; 2593 break; 2594 case 0x28: /* ERSTSZ */ 2595 ret = xhci->erstsz; 2596 break; 2597 case 0x30: /* ERSTBA low */ 2598 ret = xhci->erstba_low; 2599 break; 2600 case 0x34: /* ERSTBA high */ 2601 ret = xhci->erstba_high; 2602 break; 2603 case 0x38: /* ERDP low */ 2604 ret = xhci->erdp_low; 2605 break; 2606 case 0x3c: /* ERDP high */ 2607 ret = xhci->erdp_high; 2608 break; 2609 default: 2610 fprintf(stderr, "xhci_runtime_read: reg 0x%x unimplemented\n", reg); 2611 ret = 0; 2612 } 2613 2614 trace_usb_xhci_runtime_read(reg, ret); 2615 return ret; 2616 } 2617 2618 static void xhci_runtime_write(XHCIState *xhci, uint32_t reg, uint32_t val) 2619 { 2620 trace_usb_xhci_runtime_write(reg, val); 2621 2622 switch (reg) { 2623 case 0x20: /* IMAN */ 2624 if (val & IMAN_IP) { 2625 xhci->iman &= ~IMAN_IP; 2626 } 2627 xhci->iman &= ~IMAN_IE; 2628 xhci->iman |= val & IMAN_IE; 2629 xhci_intx_update(xhci); 2630 xhci_msix_update(xhci); 2631 break; 2632 case 0x24: /* IMOD */ 2633 xhci->imod = val; 2634 break; 2635 case 0x28: /* ERSTSZ */ 2636 xhci->erstsz = val & 0xffff; 2637 break; 2638 case 0x30: /* ERSTBA low */ 2639 /* XXX NEC driver bug: it doesn't align this to 64 bytes 2640 xhci->erstba_low = val & 0xffffffc0; */ 2641 xhci->erstba_low = val & 0xfffffff0; 2642 break; 2643 case 0x34: /* ERSTBA high */ 2644 xhci->erstba_high = val; 2645 xhci_er_reset(xhci); 2646 break; 2647 case 0x38: /* ERDP low */ 2648 if (val & ERDP_EHB) { 2649 xhci->erdp_low &= ~ERDP_EHB; 2650 } 2651 xhci->erdp_low = (val & ~ERDP_EHB) | (xhci->erdp_low & ERDP_EHB); 2652 break; 2653 case 0x3c: /* ERDP high */ 2654 xhci->erdp_high = val; 2655 xhci_events_update(xhci); 2656 break; 2657 default: 2658 fprintf(stderr, "xhci_oper_write: reg 0x%x unimplemented\n", reg); 2659 } 2660 } 2661 2662 static uint32_t xhci_doorbell_read(XHCIState *xhci, uint32_t reg) 2663 { 2664 /* doorbells always read as 0 */ 2665 trace_usb_xhci_doorbell_read(reg, 0); 2666 return 0; 2667 } 2668 2669 static void xhci_doorbell_write(XHCIState *xhci, uint32_t reg, uint32_t val) 2670 { 2671 trace_usb_xhci_doorbell_write(reg, val); 2672 2673 if (!xhci_running(xhci)) { 2674 fprintf(stderr, "xhci: wrote doorbell while xHC stopped or paused\n"); 2675 return; 2676 } 2677 2678 reg >>= 2; 2679 2680 if (reg == 0) { 2681 if (val == 0) { 2682 xhci_process_commands(xhci); 2683 } else { 2684 fprintf(stderr, "xhci: bad doorbell 0 write: 0x%x\n", val); 2685 } 2686 } else { 2687 if (reg > MAXSLOTS) { 2688 fprintf(stderr, "xhci: bad doorbell %d\n", reg); 2689 } else if (val > 31) { 2690 fprintf(stderr, "xhci: bad doorbell %d write: 0x%x\n", reg, val); 2691 } else { 2692 xhci_kick_ep(xhci, reg, val); 2693 } 2694 } 2695 } 2696 2697 static uint64_t xhci_mem_read(void *ptr, target_phys_addr_t addr, 2698 unsigned size) 2699 { 2700 XHCIState *xhci = ptr; 2701 2702 /* Only aligned reads are allowed on xHCI */ 2703 if (addr & 3) { 2704 fprintf(stderr, "xhci_mem_read: Mis-aligned read\n"); 2705 return 0; 2706 } 2707 2708 if (addr < LEN_CAP) { 2709 return xhci_cap_read(xhci, addr); 2710 } else if (addr >= OFF_OPER && addr < (OFF_OPER + LEN_OPER)) { 2711 return xhci_oper_read(xhci, addr - OFF_OPER); 2712 } else if (addr >= OFF_RUNTIME && addr < (OFF_RUNTIME + LEN_RUNTIME)) { 2713 return xhci_runtime_read(xhci, addr - OFF_RUNTIME); 2714 } else if (addr >= OFF_DOORBELL && addr < (OFF_DOORBELL + LEN_DOORBELL)) { 2715 return xhci_doorbell_read(xhci, addr - OFF_DOORBELL); 2716 } else { 2717 fprintf(stderr, "xhci_mem_read: Bad offset %x\n", (int)addr); 2718 return 0; 2719 } 2720 } 2721 2722 static void xhci_mem_write(void *ptr, target_phys_addr_t addr, 2723 uint64_t val, unsigned size) 2724 { 2725 XHCIState *xhci = ptr; 2726 2727 /* Only aligned writes are allowed on xHCI */ 2728 if (addr & 3) { 2729 fprintf(stderr, "xhci_mem_write: Mis-aligned write\n"); 2730 return; 2731 } 2732 2733 if (addr >= OFF_OPER && addr < (OFF_OPER + LEN_OPER)) { 2734 xhci_oper_write(xhci, addr - OFF_OPER, val); 2735 } else if (addr >= OFF_RUNTIME && addr < (OFF_RUNTIME + LEN_RUNTIME)) { 2736 xhci_runtime_write(xhci, addr - OFF_RUNTIME, val); 2737 } else if (addr >= OFF_DOORBELL && addr < (OFF_DOORBELL + LEN_DOORBELL)) { 2738 xhci_doorbell_write(xhci, addr - OFF_DOORBELL, val); 2739 } else { 2740 fprintf(stderr, "xhci_mem_write: Bad offset %x\n", (int)addr); 2741 } 2742 } 2743 2744 static const MemoryRegionOps xhci_mem_ops = { 2745 .read = xhci_mem_read, 2746 .write = xhci_mem_write, 2747 .valid.min_access_size = 4, 2748 .valid.max_access_size = 4, 2749 .endianness = DEVICE_LITTLE_ENDIAN, 2750 }; 2751 2752 static void xhci_attach(USBPort *usbport) 2753 { 2754 XHCIState *xhci = usbport->opaque; 2755 XHCIPort *port = xhci_lookup_port(xhci, usbport); 2756 2757 xhci_update_port(xhci, port, 0); 2758 } 2759 2760 static void xhci_detach(USBPort *usbport) 2761 { 2762 XHCIState *xhci = usbport->opaque; 2763 XHCIPort *port = xhci_lookup_port(xhci, usbport); 2764 2765 xhci_update_port(xhci, port, 1); 2766 } 2767 2768 static void xhci_wakeup(USBPort *usbport) 2769 { 2770 XHCIState *xhci = usbport->opaque; 2771 XHCIPort *port = xhci_lookup_port(xhci, usbport); 2772 XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS, 2773 port->portnr << 24}; 2774 uint32_t pls; 2775 2776 pls = (port->portsc >> PORTSC_PLS_SHIFT) & PORTSC_PLS_MASK; 2777 if (pls != 3) { 2778 return; 2779 } 2780 port->portsc |= 0xf << PORTSC_PLS_SHIFT; 2781 if (port->portsc & PORTSC_PLC) { 2782 return; 2783 } 2784 port->portsc |= PORTSC_PLC; 2785 xhci_event(xhci, &ev); 2786 } 2787 2788 static void xhci_complete(USBPort *port, USBPacket *packet) 2789 { 2790 XHCITransfer *xfer = container_of(packet, XHCITransfer, packet); 2791 2792 xhci_complete_packet(xfer, packet->result); 2793 xhci_kick_ep(xfer->xhci, xfer->slotid, xfer->epid); 2794 } 2795 2796 static void xhci_child_detach(USBPort *port, USBDevice *child) 2797 { 2798 FIXME(); 2799 } 2800 2801 static USBPortOps xhci_port_ops = { 2802 .attach = xhci_attach, 2803 .detach = xhci_detach, 2804 .wakeup = xhci_wakeup, 2805 .complete = xhci_complete, 2806 .child_detach = xhci_child_detach, 2807 }; 2808 2809 static int xhci_find_slotid(XHCIState *xhci, USBDevice *dev) 2810 { 2811 XHCISlot *slot; 2812 int slotid; 2813 2814 for (slotid = 1; slotid <= MAXSLOTS; slotid++) { 2815 slot = &xhci->slots[slotid-1]; 2816 if (slot->devaddr == dev->addr) { 2817 return slotid; 2818 } 2819 } 2820 return 0; 2821 } 2822 2823 static int xhci_find_epid(USBEndpoint *ep) 2824 { 2825 if (ep->nr == 0) { 2826 return 1; 2827 } 2828 if (ep->pid == USB_TOKEN_IN) { 2829 return ep->nr * 2 + 1; 2830 } else { 2831 return ep->nr * 2; 2832 } 2833 } 2834 2835 static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep) 2836 { 2837 XHCIState *xhci = container_of(bus, XHCIState, bus); 2838 int slotid; 2839 2840 DPRINTF("%s\n", __func__); 2841 slotid = xhci_find_slotid(xhci, ep->dev); 2842 if (slotid == 0 || !xhci->slots[slotid-1].enabled) { 2843 DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr); 2844 return; 2845 } 2846 xhci_kick_ep(xhci, slotid, xhci_find_epid(ep)); 2847 } 2848 2849 static USBBusOps xhci_bus_ops = { 2850 .wakeup_endpoint = xhci_wakeup_endpoint, 2851 }; 2852 2853 static void usb_xhci_init(XHCIState *xhci, DeviceState *dev) 2854 { 2855 XHCIPort *port; 2856 int i, usbports, speedmask; 2857 2858 xhci->usbsts = USBSTS_HCH; 2859 2860 if (xhci->numports_2 > MAXPORTS_2) { 2861 xhci->numports_2 = MAXPORTS_2; 2862 } 2863 if (xhci->numports_3 > MAXPORTS_3) { 2864 xhci->numports_3 = MAXPORTS_3; 2865 } 2866 usbports = MAX(xhci->numports_2, xhci->numports_3); 2867 xhci->numports = xhci->numports_2 + xhci->numports_3; 2868 2869 usb_bus_new(&xhci->bus, &xhci_bus_ops, &xhci->pci_dev.qdev); 2870 2871 for (i = 0; i < usbports; i++) { 2872 speedmask = 0; 2873 if (i < xhci->numports_2) { 2874 port = &xhci->ports[i]; 2875 port->portnr = i + 1; 2876 port->uport = &xhci->uports[i]; 2877 port->speedmask = 2878 USB_SPEED_MASK_LOW | 2879 USB_SPEED_MASK_FULL | 2880 USB_SPEED_MASK_HIGH; 2881 speedmask |= port->speedmask; 2882 } 2883 if (i < xhci->numports_3) { 2884 port = &xhci->ports[i + xhci->numports_2]; 2885 port->portnr = i + 1 + xhci->numports_2; 2886 port->uport = &xhci->uports[i]; 2887 port->speedmask = USB_SPEED_MASK_SUPER; 2888 speedmask |= port->speedmask; 2889 } 2890 usb_register_port(&xhci->bus, &xhci->uports[i], xhci, i, 2891 &xhci_port_ops, speedmask); 2892 } 2893 } 2894 2895 static int usb_xhci_initfn(struct PCIDevice *dev) 2896 { 2897 int ret; 2898 2899 XHCIState *xhci = DO_UPCAST(XHCIState, pci_dev, dev); 2900 2901 xhci->pci_dev.config[PCI_CLASS_PROG] = 0x30; /* xHCI */ 2902 xhci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */ 2903 xhci->pci_dev.config[PCI_CACHE_LINE_SIZE] = 0x10; 2904 xhci->pci_dev.config[0x60] = 0x30; /* release number */ 2905 2906 usb_xhci_init(xhci, &dev->qdev); 2907 2908 xhci->mfwrap_timer = qemu_new_timer_ns(vm_clock, xhci_mfwrap_timer, xhci); 2909 2910 xhci->irq = xhci->pci_dev.irq[0]; 2911 2912 memory_region_init_io(&xhci->mem, &xhci_mem_ops, xhci, 2913 "xhci", LEN_REGS); 2914 pci_register_bar(&xhci->pci_dev, 0, 2915 PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64, 2916 &xhci->mem); 2917 2918 ret = pcie_cap_init(&xhci->pci_dev, 0xa0, PCI_EXP_TYPE_ENDPOINT, 0); 2919 assert(ret >= 0); 2920 2921 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI)) { 2922 msi_init(&xhci->pci_dev, 0x70, MAXINTRS, true, false); 2923 } 2924 if (xhci->flags & (1 << XHCI_FLAG_USE_MSI_X)) { 2925 msix_init(&xhci->pci_dev, MAXINTRS, 2926 &xhci->mem, 0, OFF_MSIX_TABLE, 2927 &xhci->mem, 0, OFF_MSIX_PBA, 2928 0x90); 2929 } 2930 2931 return 0; 2932 } 2933 2934 static const VMStateDescription vmstate_xhci = { 2935 .name = "xhci", 2936 .unmigratable = 1, 2937 }; 2938 2939 static Property xhci_properties[] = { 2940 DEFINE_PROP_BIT("msi", XHCIState, flags, XHCI_FLAG_USE_MSI, true), 2941 DEFINE_PROP_BIT("msix", XHCIState, flags, XHCI_FLAG_USE_MSI_X, true), 2942 DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4), 2943 DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4), 2944 DEFINE_PROP_END_OF_LIST(), 2945 }; 2946 2947 static void xhci_class_init(ObjectClass *klass, void *data) 2948 { 2949 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 2950 DeviceClass *dc = DEVICE_CLASS(klass); 2951 2952 dc->vmsd = &vmstate_xhci; 2953 dc->props = xhci_properties; 2954 dc->reset = xhci_reset; 2955 k->init = usb_xhci_initfn; 2956 k->vendor_id = PCI_VENDOR_ID_NEC; 2957 k->device_id = PCI_DEVICE_ID_NEC_UPD720200; 2958 k->class_id = PCI_CLASS_SERIAL_USB; 2959 k->revision = 0x03; 2960 k->is_express = 1; 2961 } 2962 2963 static TypeInfo xhci_info = { 2964 .name = "nec-usb-xhci", 2965 .parent = TYPE_PCI_DEVICE, 2966 .instance_size = sizeof(XHCIState), 2967 .class_init = xhci_class_init, 2968 }; 2969 2970 static void xhci_register_types(void) 2971 { 2972 type_register_static(&xhci_info); 2973 } 2974 2975 type_init(xhci_register_types) 2976