1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "qemu/osdep.h" 31 #include "qapi/error.h" 32 #include "hw/usb/ehci-regs.h" 33 #include "hw/usb/hcd-ehci.h" 34 #include "trace.h" 35 36 #define FRAME_TIMER_FREQ 1000 37 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) 38 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) 39 40 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 41 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 42 #define MAX_QH 100 // Max allowable queue heads in a chain 43 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ 44 #define PERIODIC_ACTIVE 512 /* Micro-frames */ 45 46 /* Internal periodic / asynchronous schedule state machine states 47 */ 48 typedef enum { 49 EST_INACTIVE = 1000, 50 EST_ACTIVE, 51 EST_EXECUTING, 52 EST_SLEEPING, 53 /* The following states are internal to the state machine function 54 */ 55 EST_WAITLISTHEAD, 56 EST_FETCHENTRY, 57 EST_FETCHQH, 58 EST_FETCHITD, 59 EST_FETCHSITD, 60 EST_ADVANCEQUEUE, 61 EST_FETCHQTD, 62 EST_EXECUTE, 63 EST_WRITEBACK, 64 EST_HORIZONTALQH 65 } EHCI_STATES; 66 67 /* macros for accessing fields within next link pointer entry */ 68 #define NLPTR_GET(x) ((x) & 0xffffffe0) 69 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 70 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 71 72 /* link pointer types */ 73 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 74 #define NLPTR_TYPE_QH 1 // queue head 75 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 76 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 77 78 #define SET_LAST_RUN_CLOCK(s) \ 79 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 80 81 /* nifty macros from Arnon's EHCI version */ 82 #define get_field(data, field) \ 83 (((data) & field##_MASK) >> field##_SH) 84 85 #define set_field(data, newval, field) do { \ 86 uint32_t val = *data; \ 87 val &= ~ field##_MASK; \ 88 val |= ((newval) << field##_SH) & field##_MASK; \ 89 *data = val; \ 90 } while(0) 91 92 static const char *ehci_state_names[] = { 93 [EST_INACTIVE] = "INACTIVE", 94 [EST_ACTIVE] = "ACTIVE", 95 [EST_EXECUTING] = "EXECUTING", 96 [EST_SLEEPING] = "SLEEPING", 97 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 98 [EST_FETCHENTRY] = "FETCH ENTRY", 99 [EST_FETCHQH] = "FETCH QH", 100 [EST_FETCHITD] = "FETCH ITD", 101 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 102 [EST_FETCHQTD] = "FETCH QTD", 103 [EST_EXECUTE] = "EXECUTE", 104 [EST_WRITEBACK] = "WRITEBACK", 105 [EST_HORIZONTALQH] = "HORIZONTALQH", 106 }; 107 108 static const char *ehci_mmio_names[] = { 109 [USBCMD] = "USBCMD", 110 [USBSTS] = "USBSTS", 111 [USBINTR] = "USBINTR", 112 [FRINDEX] = "FRINDEX", 113 [PERIODICLISTBASE] = "P-LIST BASE", 114 [ASYNCLISTADDR] = "A-LIST ADDR", 115 [CONFIGFLAG] = "CONFIGFLAG", 116 }; 117 118 static int ehci_state_executing(EHCIQueue *q); 119 static int ehci_state_writeback(EHCIQueue *q); 120 static int ehci_state_advqueue(EHCIQueue *q); 121 static int ehci_fill_queue(EHCIPacket *p); 122 static void ehci_free_packet(EHCIPacket *p); 123 124 static const char *nr2str(const char **n, size_t len, uint32_t nr) 125 { 126 if (nr < len && n[nr] != NULL) { 127 return n[nr]; 128 } else { 129 return "unknown"; 130 } 131 } 132 133 static const char *state2str(uint32_t state) 134 { 135 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 136 } 137 138 static const char *addr2str(hwaddr addr) 139 { 140 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 141 } 142 143 static void ehci_trace_usbsts(uint32_t mask, int state) 144 { 145 /* interrupts */ 146 if (mask & USBSTS_INT) { 147 trace_usb_ehci_usbsts("INT", state); 148 } 149 if (mask & USBSTS_ERRINT) { 150 trace_usb_ehci_usbsts("ERRINT", state); 151 } 152 if (mask & USBSTS_PCD) { 153 trace_usb_ehci_usbsts("PCD", state); 154 } 155 if (mask & USBSTS_FLR) { 156 trace_usb_ehci_usbsts("FLR", state); 157 } 158 if (mask & USBSTS_HSE) { 159 trace_usb_ehci_usbsts("HSE", state); 160 } 161 if (mask & USBSTS_IAA) { 162 trace_usb_ehci_usbsts("IAA", state); 163 } 164 165 /* status */ 166 if (mask & USBSTS_HALT) { 167 trace_usb_ehci_usbsts("HALT", state); 168 } 169 if (mask & USBSTS_REC) { 170 trace_usb_ehci_usbsts("REC", state); 171 } 172 if (mask & USBSTS_PSS) { 173 trace_usb_ehci_usbsts("PSS", state); 174 } 175 if (mask & USBSTS_ASS) { 176 trace_usb_ehci_usbsts("ASS", state); 177 } 178 } 179 180 static inline void ehci_set_usbsts(EHCIState *s, int mask) 181 { 182 if ((s->usbsts & mask) == mask) { 183 return; 184 } 185 ehci_trace_usbsts(mask, 1); 186 s->usbsts |= mask; 187 } 188 189 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 190 { 191 if ((s->usbsts & mask) == 0) { 192 return; 193 } 194 ehci_trace_usbsts(mask, 0); 195 s->usbsts &= ~mask; 196 } 197 198 /* update irq line */ 199 static inline void ehci_update_irq(EHCIState *s) 200 { 201 int level = 0; 202 203 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 204 level = 1; 205 } 206 207 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 208 qemu_set_irq(s->irq, level); 209 } 210 211 /* flag interrupt condition */ 212 static inline void ehci_raise_irq(EHCIState *s, int intr) 213 { 214 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 215 s->usbsts |= intr; 216 ehci_update_irq(s); 217 } else { 218 s->usbsts_pending |= intr; 219 } 220 } 221 222 /* 223 * Commit pending interrupts (added via ehci_raise_irq), 224 * at the rate allowed by "Interrupt Threshold Control". 225 */ 226 static inline void ehci_commit_irq(EHCIState *s) 227 { 228 uint32_t itc; 229 230 if (!s->usbsts_pending) { 231 return; 232 } 233 if (s->usbsts_frindex > s->frindex) { 234 return; 235 } 236 237 itc = (s->usbcmd >> 16) & 0xff; 238 s->usbsts |= s->usbsts_pending; 239 s->usbsts_pending = 0; 240 s->usbsts_frindex = s->frindex + itc; 241 ehci_update_irq(s); 242 } 243 244 static void ehci_update_halt(EHCIState *s) 245 { 246 if (s->usbcmd & USBCMD_RUNSTOP) { 247 ehci_clear_usbsts(s, USBSTS_HALT); 248 } else { 249 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 250 ehci_set_usbsts(s, USBSTS_HALT); 251 } 252 } 253 } 254 255 static void ehci_set_state(EHCIState *s, int async, int state) 256 { 257 if (async) { 258 trace_usb_ehci_state("async", state2str(state)); 259 s->astate = state; 260 if (s->astate == EST_INACTIVE) { 261 ehci_clear_usbsts(s, USBSTS_ASS); 262 ehci_update_halt(s); 263 } else { 264 ehci_set_usbsts(s, USBSTS_ASS); 265 } 266 } else { 267 trace_usb_ehci_state("periodic", state2str(state)); 268 s->pstate = state; 269 if (s->pstate == EST_INACTIVE) { 270 ehci_clear_usbsts(s, USBSTS_PSS); 271 ehci_update_halt(s); 272 } else { 273 ehci_set_usbsts(s, USBSTS_PSS); 274 } 275 } 276 } 277 278 static int ehci_get_state(EHCIState *s, int async) 279 { 280 return async ? s->astate : s->pstate; 281 } 282 283 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 284 { 285 if (async) { 286 s->a_fetch_addr = addr; 287 } else { 288 s->p_fetch_addr = addr; 289 } 290 } 291 292 static int ehci_get_fetch_addr(EHCIState *s, int async) 293 { 294 return async ? s->a_fetch_addr : s->p_fetch_addr; 295 } 296 297 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 298 { 299 /* need three here due to argument count limits */ 300 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 301 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 302 trace_usb_ehci_qh_fields(addr, 303 get_field(qh->epchar, QH_EPCHAR_RL), 304 get_field(qh->epchar, QH_EPCHAR_MPLEN), 305 get_field(qh->epchar, QH_EPCHAR_EPS), 306 get_field(qh->epchar, QH_EPCHAR_EP), 307 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 308 trace_usb_ehci_qh_bits(addr, 309 (bool)(qh->epchar & QH_EPCHAR_C), 310 (bool)(qh->epchar & QH_EPCHAR_H), 311 (bool)(qh->epchar & QH_EPCHAR_DTC), 312 (bool)(qh->epchar & QH_EPCHAR_I)); 313 } 314 315 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 316 { 317 /* need three here due to argument count limits */ 318 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 319 trace_usb_ehci_qtd_fields(addr, 320 get_field(qtd->token, QTD_TOKEN_TBYTES), 321 get_field(qtd->token, QTD_TOKEN_CPAGE), 322 get_field(qtd->token, QTD_TOKEN_CERR), 323 get_field(qtd->token, QTD_TOKEN_PID)); 324 trace_usb_ehci_qtd_bits(addr, 325 (bool)(qtd->token & QTD_TOKEN_IOC), 326 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 327 (bool)(qtd->token & QTD_TOKEN_HALT), 328 (bool)(qtd->token & QTD_TOKEN_BABBLE), 329 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 330 } 331 332 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 333 { 334 trace_usb_ehci_itd(addr, itd->next, 335 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 336 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 337 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 338 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 339 } 340 341 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 342 EHCIsitd *sitd) 343 { 344 trace_usb_ehci_sitd(addr, sitd->next, 345 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 346 } 347 348 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 349 { 350 trace_usb_ehci_guest_bug(message); 351 fprintf(stderr, "ehci warning: %s\n", message); 352 } 353 354 static inline bool ehci_enabled(EHCIState *s) 355 { 356 return s->usbcmd & USBCMD_RUNSTOP; 357 } 358 359 static inline bool ehci_async_enabled(EHCIState *s) 360 { 361 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 362 } 363 364 static inline bool ehci_periodic_enabled(EHCIState *s) 365 { 366 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 367 } 368 369 /* Get an array of dwords from main memory */ 370 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 371 uint32_t *buf, int num) 372 { 373 int i; 374 375 if (!ehci->as) { 376 ehci_raise_irq(ehci, USBSTS_HSE); 377 ehci->usbcmd &= ~USBCMD_RUNSTOP; 378 trace_usb_ehci_dma_error(); 379 return -1; 380 } 381 382 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 383 dma_memory_read(ehci->as, addr, buf, sizeof(*buf)); 384 *buf = le32_to_cpu(*buf); 385 } 386 387 return num; 388 } 389 390 /* Put an array of dwords in to main memory */ 391 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 392 uint32_t *buf, int num) 393 { 394 int i; 395 396 if (!ehci->as) { 397 ehci_raise_irq(ehci, USBSTS_HSE); 398 ehci->usbcmd &= ~USBCMD_RUNSTOP; 399 trace_usb_ehci_dma_error(); 400 return -1; 401 } 402 403 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 404 uint32_t tmp = cpu_to_le32(*buf); 405 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp)); 406 } 407 408 return num; 409 } 410 411 static int ehci_get_pid(EHCIqtd *qtd) 412 { 413 switch (get_field(qtd->token, QTD_TOKEN_PID)) { 414 case 0: 415 return USB_TOKEN_OUT; 416 case 1: 417 return USB_TOKEN_IN; 418 case 2: 419 return USB_TOKEN_SETUP; 420 default: 421 fprintf(stderr, "bad token\n"); 422 return 0; 423 } 424 } 425 426 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh) 427 { 428 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR); 429 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP); 430 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 431 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 432 (qh->current_qtd != q->qh.current_qtd) || 433 (q->async && qh->next_qtd != q->qh.next_qtd) || 434 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd, 435 7 * sizeof(uint32_t)) != 0) || 436 (q->dev != NULL && q->dev->addr != devaddr)) { 437 return false; 438 } else { 439 return true; 440 } 441 } 442 443 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) 444 { 445 if (p->qtdaddr != p->queue->qtdaddr || 446 (p->queue->async && !NLPTR_TBIT(p->qtd.next) && 447 (p->qtd.next != qtd->next)) || 448 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || 449 p->qtd.token != qtd->token || 450 p->qtd.bufptr[0] != qtd->bufptr[0]) { 451 return false; 452 } else { 453 return true; 454 } 455 } 456 457 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) 458 { 459 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP); 460 int pid = ehci_get_pid(qtd); 461 462 /* Note the pid changing is normal for ep 0 (the control ep) */ 463 if (q->last_pid && ep != 0 && pid != q->last_pid) { 464 return false; 465 } else { 466 return true; 467 } 468 } 469 470 /* Finish executing and writeback a packet outside of the regular 471 fetchqh -> fetchqtd -> execute -> writeback cycle */ 472 static void ehci_writeback_async_complete_packet(EHCIPacket *p) 473 { 474 EHCIQueue *q = p->queue; 475 EHCIqtd qtd; 476 EHCIqh qh; 477 int state; 478 479 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ 480 get_dwords(q->ehci, NLPTR_GET(q->qhaddr), 481 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 482 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), 483 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 484 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { 485 p->async = EHCI_ASYNC_INITIALIZED; 486 ehci_free_packet(p); 487 return; 488 } 489 490 state = ehci_get_state(q->ehci, q->async); 491 ehci_state_executing(q); 492 ehci_state_writeback(q); /* Frees the packet! */ 493 if (!(q->qh.token & QTD_TOKEN_HALT)) { 494 ehci_state_advqueue(q); 495 } 496 ehci_set_state(q->ehci, q->async, state); 497 } 498 499 /* packet management */ 500 501 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 502 { 503 EHCIPacket *p; 504 505 p = g_new0(EHCIPacket, 1); 506 p->queue = q; 507 usb_packet_init(&p->packet); 508 QTAILQ_INSERT_TAIL(&q->packets, p, next); 509 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 510 return p; 511 } 512 513 static void ehci_free_packet(EHCIPacket *p) 514 { 515 if (p->async == EHCI_ASYNC_FINISHED && 516 !(p->queue->qh.token & QTD_TOKEN_HALT)) { 517 ehci_writeback_async_complete_packet(p); 518 return; 519 } 520 trace_usb_ehci_packet_action(p->queue, p, "free"); 521 if (p->async == EHCI_ASYNC_INFLIGHT) { 522 usb_cancel_packet(&p->packet); 523 } 524 if (p->async == EHCI_ASYNC_FINISHED && 525 p->packet.status == USB_RET_SUCCESS) { 526 fprintf(stderr, 527 "EHCI: Dropping completed packet from halted %s ep %02X\n", 528 (p->pid == USB_TOKEN_IN) ? "in" : "out", 529 get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); 530 } 531 if (p->async != EHCI_ASYNC_NONE) { 532 usb_packet_unmap(&p->packet, &p->sgl); 533 qemu_sglist_destroy(&p->sgl); 534 } 535 QTAILQ_REMOVE(&p->queue->packets, p, next); 536 usb_packet_cleanup(&p->packet); 537 g_free(p); 538 } 539 540 /* queue management */ 541 542 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 543 { 544 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 545 EHCIQueue *q; 546 547 q = g_malloc0(sizeof(*q)); 548 q->ehci = ehci; 549 q->qhaddr = addr; 550 q->async = async; 551 QTAILQ_INIT(&q->packets); 552 QTAILQ_INSERT_HEAD(head, q, next); 553 trace_usb_ehci_queue_action(q, "alloc"); 554 return q; 555 } 556 557 static void ehci_queue_stopped(EHCIQueue *q) 558 { 559 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP); 560 561 if (!q->last_pid || !q->dev) { 562 return; 563 } 564 565 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp)); 566 } 567 568 static int ehci_cancel_queue(EHCIQueue *q) 569 { 570 EHCIPacket *p; 571 int packets = 0; 572 573 p = QTAILQ_FIRST(&q->packets); 574 if (p == NULL) { 575 goto leave; 576 } 577 578 trace_usb_ehci_queue_action(q, "cancel"); 579 do { 580 ehci_free_packet(p); 581 packets++; 582 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 583 584 leave: 585 ehci_queue_stopped(q); 586 return packets; 587 } 588 589 static int ehci_reset_queue(EHCIQueue *q) 590 { 591 int packets; 592 593 trace_usb_ehci_queue_action(q, "reset"); 594 packets = ehci_cancel_queue(q); 595 q->dev = NULL; 596 q->qtdaddr = 0; 597 q->last_pid = 0; 598 return packets; 599 } 600 601 static void ehci_free_queue(EHCIQueue *q, const char *warn) 602 { 603 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 604 int cancelled; 605 606 trace_usb_ehci_queue_action(q, "free"); 607 cancelled = ehci_cancel_queue(q); 608 if (warn && cancelled > 0) { 609 ehci_trace_guest_bug(q->ehci, warn); 610 } 611 QTAILQ_REMOVE(head, q, next); 612 g_free(q); 613 } 614 615 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 616 int async) 617 { 618 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 619 EHCIQueue *q; 620 621 QTAILQ_FOREACH(q, head, next) { 622 if (addr == q->qhaddr) { 623 return q; 624 } 625 } 626 return NULL; 627 } 628 629 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 630 { 631 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 632 const char *warn = async ? "guest unlinked busy QH" : NULL; 633 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 634 EHCIQueue *q, *tmp; 635 636 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 637 if (q->seen) { 638 q->seen = 0; 639 q->ts = ehci->last_run_ns; 640 continue; 641 } 642 if (ehci->last_run_ns < q->ts + maxage) { 643 continue; 644 } 645 ehci_free_queue(q, warn); 646 } 647 } 648 649 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 650 { 651 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 652 EHCIQueue *q, *tmp; 653 654 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 655 if (!q->seen) { 656 ehci_free_queue(q, NULL); 657 } 658 } 659 } 660 661 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 662 { 663 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 664 EHCIQueue *q, *tmp; 665 666 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 667 if (q->dev != dev) { 668 continue; 669 } 670 ehci_free_queue(q, NULL); 671 } 672 } 673 674 static void ehci_queues_rip_all(EHCIState *ehci, int async) 675 { 676 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 677 const char *warn = async ? "guest stopped busy async schedule" : NULL; 678 EHCIQueue *q, *tmp; 679 680 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 681 ehci_free_queue(q, warn); 682 } 683 } 684 685 /* Attach or detach a device on root hub */ 686 687 static void ehci_attach(USBPort *port) 688 { 689 EHCIState *s = port->opaque; 690 uint32_t *portsc = &s->portsc[port->index]; 691 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 692 693 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 694 695 if (*portsc & PORTSC_POWNER) { 696 USBPort *companion = s->companion_ports[port->index]; 697 companion->dev = port->dev; 698 companion->ops->attach(companion); 699 return; 700 } 701 702 *portsc |= PORTSC_CONNECT; 703 *portsc |= PORTSC_CSC; 704 705 ehci_raise_irq(s, USBSTS_PCD); 706 } 707 708 static void ehci_detach(USBPort *port) 709 { 710 EHCIState *s = port->opaque; 711 uint32_t *portsc = &s->portsc[port->index]; 712 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 713 714 trace_usb_ehci_port_detach(port->index, owner); 715 716 if (*portsc & PORTSC_POWNER) { 717 USBPort *companion = s->companion_ports[port->index]; 718 companion->ops->detach(companion); 719 companion->dev = NULL; 720 /* 721 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 722 * the port ownership is returned immediately to the EHCI controller." 723 */ 724 *portsc &= ~PORTSC_POWNER; 725 return; 726 } 727 728 ehci_queues_rip_device(s, port->dev, 0); 729 ehci_queues_rip_device(s, port->dev, 1); 730 731 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); 732 *portsc |= PORTSC_CSC; 733 734 ehci_raise_irq(s, USBSTS_PCD); 735 } 736 737 static void ehci_child_detach(USBPort *port, USBDevice *child) 738 { 739 EHCIState *s = port->opaque; 740 uint32_t portsc = s->portsc[port->index]; 741 742 if (portsc & PORTSC_POWNER) { 743 USBPort *companion = s->companion_ports[port->index]; 744 companion->ops->child_detach(companion, child); 745 return; 746 } 747 748 ehci_queues_rip_device(s, child, 0); 749 ehci_queues_rip_device(s, child, 1); 750 } 751 752 static void ehci_wakeup(USBPort *port) 753 { 754 EHCIState *s = port->opaque; 755 uint32_t *portsc = &s->portsc[port->index]; 756 757 if (*portsc & PORTSC_POWNER) { 758 USBPort *companion = s->companion_ports[port->index]; 759 if (companion->ops->wakeup) { 760 companion->ops->wakeup(companion); 761 } 762 return; 763 } 764 765 if (*portsc & PORTSC_SUSPEND) { 766 trace_usb_ehci_port_wakeup(port->index); 767 *portsc |= PORTSC_FPRES; 768 ehci_raise_irq(s, USBSTS_PCD); 769 } 770 771 qemu_bh_schedule(s->async_bh); 772 } 773 774 static void ehci_register_companion(USBBus *bus, USBPort *ports[], 775 uint32_t portcount, uint32_t firstport, 776 Error **errp) 777 { 778 EHCIState *s = container_of(bus, EHCIState, bus); 779 uint32_t i; 780 781 if (firstport + portcount > NB_PORTS) { 782 error_setg(errp, "firstport must be between 0 and %u", 783 NB_PORTS - portcount); 784 return; 785 } 786 787 for (i = 0; i < portcount; i++) { 788 if (s->companion_ports[firstport + i]) { 789 error_setg(errp, "firstport %u asks for ports %u-%u," 790 " but port %u has a companion assigned already", 791 firstport, firstport, firstport + portcount - 1, 792 firstport + i); 793 return; 794 } 795 } 796 797 for (i = 0; i < portcount; i++) { 798 s->companion_ports[firstport + i] = ports[i]; 799 s->ports[firstport + i].speedmask |= 800 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 801 /* Ensure devs attached before the initial reset go to the companion */ 802 s->portsc[firstport + i] = PORTSC_POWNER; 803 } 804 805 s->companion_count++; 806 s->caps[0x05] = (s->companion_count << 4) | portcount; 807 } 808 809 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, 810 unsigned int stream) 811 { 812 EHCIState *s = container_of(bus, EHCIState, bus); 813 uint32_t portsc = s->portsc[ep->dev->port->index]; 814 815 if (portsc & PORTSC_POWNER) { 816 return; 817 } 818 819 s->periodic_sched_active = PERIODIC_ACTIVE; 820 qemu_bh_schedule(s->async_bh); 821 } 822 823 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 824 { 825 USBDevice *dev; 826 USBPort *port; 827 int i; 828 829 for (i = 0; i < NB_PORTS; i++) { 830 port = &ehci->ports[i]; 831 if (!(ehci->portsc[i] & PORTSC_PED)) { 832 DPRINTF("Port %d not enabled\n", i); 833 continue; 834 } 835 dev = usb_find_device(port, addr); 836 if (dev != NULL) { 837 return dev; 838 } 839 } 840 return NULL; 841 } 842 843 /* 4.1 host controller initialization */ 844 void ehci_reset(void *opaque) 845 { 846 EHCIState *s = opaque; 847 int i; 848 USBDevice *devs[NB_PORTS]; 849 850 trace_usb_ehci_reset(); 851 852 /* 853 * Do the detach before touching portsc, so that it correctly gets send to 854 * us or to our companion based on PORTSC_POWNER before the reset. 855 */ 856 for(i = 0; i < NB_PORTS; i++) { 857 devs[i] = s->ports[i].dev; 858 if (devs[i] && devs[i]->attached) { 859 usb_detach(&s->ports[i]); 860 } 861 } 862 863 memset(&s->opreg, 0x00, sizeof(s->opreg)); 864 memset(&s->portsc, 0x00, sizeof(s->portsc)); 865 866 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 867 s->usbsts = USBSTS_HALT; 868 s->usbsts_pending = 0; 869 s->usbsts_frindex = 0; 870 ehci_update_irq(s); 871 872 s->astate = EST_INACTIVE; 873 s->pstate = EST_INACTIVE; 874 875 for(i = 0; i < NB_PORTS; i++) { 876 if (s->companion_ports[i]) { 877 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 878 } else { 879 s->portsc[i] = PORTSC_PPOWER; 880 } 881 if (devs[i] && devs[i]->attached) { 882 usb_attach(&s->ports[i]); 883 usb_device_reset(devs[i]); 884 } 885 } 886 ehci_queues_rip_all(s, 0); 887 ehci_queues_rip_all(s, 1); 888 timer_del(s->frame_timer); 889 qemu_bh_cancel(s->async_bh); 890 } 891 892 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 893 unsigned size) 894 { 895 EHCIState *s = ptr; 896 return s->caps[addr]; 897 } 898 899 static void ehci_caps_write(void *ptr, hwaddr addr, 900 uint64_t val, unsigned size) 901 { 902 } 903 904 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 905 unsigned size) 906 { 907 EHCIState *s = ptr; 908 uint32_t val; 909 910 switch (addr) { 911 case FRINDEX: 912 /* Round down to mult of 8, else it can go backwards on migration */ 913 val = s->frindex & ~7; 914 break; 915 default: 916 val = s->opreg[addr >> 2]; 917 } 918 919 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 920 return val; 921 } 922 923 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 924 unsigned size) 925 { 926 EHCIState *s = ptr; 927 uint32_t val; 928 929 val = s->portsc[addr >> 2]; 930 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val); 931 return val; 932 } 933 934 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 935 { 936 USBDevice *dev = s->ports[port].dev; 937 uint32_t *portsc = &s->portsc[port]; 938 uint32_t orig; 939 940 if (s->companion_ports[port] == NULL) 941 return; 942 943 owner = owner & PORTSC_POWNER; 944 orig = *portsc & PORTSC_POWNER; 945 946 if (!(owner ^ orig)) { 947 return; 948 } 949 950 if (dev && dev->attached) { 951 usb_detach(&s->ports[port]); 952 } 953 954 *portsc &= ~PORTSC_POWNER; 955 *portsc |= owner; 956 957 if (dev && dev->attached) { 958 usb_attach(&s->ports[port]); 959 } 960 } 961 962 static void ehci_port_write(void *ptr, hwaddr addr, 963 uint64_t val, unsigned size) 964 { 965 EHCIState *s = ptr; 966 int port = addr >> 2; 967 uint32_t *portsc = &s->portsc[port]; 968 uint32_t old = *portsc; 969 USBDevice *dev = s->ports[port].dev; 970 971 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val); 972 973 /* Clear rwc bits */ 974 *portsc &= ~(val & PORTSC_RWC_MASK); 975 /* The guest may clear, but not set the PED bit */ 976 *portsc &= val | ~PORTSC_PED; 977 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 978 handle_port_owner_write(s, port, val); 979 /* And finally apply RO_MASK */ 980 val &= PORTSC_RO_MASK; 981 982 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 983 trace_usb_ehci_port_reset(port, 1); 984 } 985 986 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 987 trace_usb_ehci_port_reset(port, 0); 988 if (dev && dev->attached) { 989 usb_port_reset(&s->ports[port]); 990 *portsc &= ~PORTSC_CSC; 991 } 992 993 /* 994 * Table 2.16 Set the enable bit(and enable bit change) to indicate 995 * to SW that this port has a high speed device attached 996 */ 997 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 998 val |= PORTSC_PED; 999 } 1000 } 1001 1002 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) { 1003 trace_usb_ehci_port_suspend(port); 1004 } 1005 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) { 1006 trace_usb_ehci_port_resume(port); 1007 val &= ~PORTSC_SUSPEND; 1008 } 1009 1010 *portsc &= ~PORTSC_RO_MASK; 1011 *portsc |= val; 1012 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old); 1013 } 1014 1015 static void ehci_opreg_write(void *ptr, hwaddr addr, 1016 uint64_t val, unsigned size) 1017 { 1018 EHCIState *s = ptr; 1019 uint32_t *mmio = s->opreg + (addr >> 2); 1020 uint32_t old = *mmio; 1021 int i; 1022 1023 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 1024 1025 switch (addr) { 1026 case USBCMD: 1027 if (val & USBCMD_HCRESET) { 1028 ehci_reset(s); 1029 val = s->usbcmd; 1030 break; 1031 } 1032 1033 /* not supporting dynamic frame list size at the moment */ 1034 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 1035 fprintf(stderr, "attempt to set frame list size -- value %d\n", 1036 (int)val & USBCMD_FLS); 1037 val &= ~USBCMD_FLS; 1038 } 1039 1040 if (val & USBCMD_IAAD) { 1041 /* 1042 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 1043 * trigger and re-use a qh without us seeing the unlink. 1044 */ 1045 s->async_stepdown = 0; 1046 qemu_bh_schedule(s->async_bh); 1047 trace_usb_ehci_doorbell_ring(); 1048 } 1049 1050 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 1051 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 1052 if (s->pstate == EST_INACTIVE) { 1053 SET_LAST_RUN_CLOCK(s); 1054 } 1055 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 1056 ehci_update_halt(s); 1057 s->async_stepdown = 0; 1058 qemu_bh_schedule(s->async_bh); 1059 } 1060 break; 1061 1062 case USBSTS: 1063 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 1064 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 1065 val = s->usbsts; 1066 ehci_update_irq(s); 1067 break; 1068 1069 case USBINTR: 1070 val &= USBINTR_MASK; 1071 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 1072 qemu_bh_schedule(s->async_bh); 1073 } 1074 break; 1075 1076 case FRINDEX: 1077 val &= 0x00003fff; /* frindex is 14bits */ 1078 s->usbsts_frindex = val; 1079 break; 1080 1081 case CONFIGFLAG: 1082 val &= 0x1; 1083 if (val) { 1084 for(i = 0; i < NB_PORTS; i++) 1085 handle_port_owner_write(s, i, 0); 1086 } 1087 break; 1088 1089 case PERIODICLISTBASE: 1090 if (ehci_periodic_enabled(s)) { 1091 fprintf(stderr, 1092 "ehci: PERIODIC list base register set while periodic schedule\n" 1093 " is enabled and HC is enabled\n"); 1094 } 1095 break; 1096 1097 case ASYNCLISTADDR: 1098 if (ehci_async_enabled(s)) { 1099 fprintf(stderr, 1100 "ehci: ASYNC list address register set while async schedule\n" 1101 " is enabled and HC is enabled\n"); 1102 } 1103 break; 1104 } 1105 1106 *mmio = val; 1107 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1108 *mmio, old); 1109 } 1110 1111 /* 1112 * Write the qh back to guest physical memory. This step isn't 1113 * in the EHCI spec but we need to do it since we don't share 1114 * physical memory with our guest VM. 1115 * 1116 * The first three dwords are read-only for the EHCI, so skip them 1117 * when writing back the qh. 1118 */ 1119 static void ehci_flush_qh(EHCIQueue *q) 1120 { 1121 uint32_t *qh = (uint32_t *) &q->qh; 1122 uint32_t dwords = sizeof(EHCIqh) >> 2; 1123 uint32_t addr = NLPTR_GET(q->qhaddr); 1124 1125 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1126 } 1127 1128 // 4.10.2 1129 1130 static int ehci_qh_do_overlay(EHCIQueue *q) 1131 { 1132 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1133 int i; 1134 int dtoggle; 1135 int ping; 1136 int eps; 1137 int reload; 1138 1139 assert(p != NULL); 1140 assert(p->qtdaddr == q->qtdaddr); 1141 1142 // remember values in fields to preserve in qh after overlay 1143 1144 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1145 ping = q->qh.token & QTD_TOKEN_PING; 1146 1147 q->qh.current_qtd = p->qtdaddr; 1148 q->qh.next_qtd = p->qtd.next; 1149 q->qh.altnext_qtd = p->qtd.altnext; 1150 q->qh.token = p->qtd.token; 1151 1152 1153 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1154 if (eps == EHCI_QH_EPS_HIGH) { 1155 q->qh.token &= ~QTD_TOKEN_PING; 1156 q->qh.token |= ping; 1157 } 1158 1159 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1160 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1161 1162 for (i = 0; i < 5; i++) { 1163 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1164 } 1165 1166 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1167 // preserve QH DT bit 1168 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1169 q->qh.token |= dtoggle; 1170 } 1171 1172 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1173 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1174 1175 ehci_flush_qh(q); 1176 1177 return 0; 1178 } 1179 1180 static int ehci_init_transfer(EHCIPacket *p) 1181 { 1182 uint32_t cpage, offset, bytes, plen; 1183 dma_addr_t page; 1184 1185 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1186 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1187 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1188 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as); 1189 1190 while (bytes > 0) { 1191 if (cpage > 4) { 1192 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1193 qemu_sglist_destroy(&p->sgl); 1194 return -1; 1195 } 1196 1197 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1198 page += offset; 1199 plen = bytes; 1200 if (plen > 4096 - offset) { 1201 plen = 4096 - offset; 1202 offset = 0; 1203 cpage++; 1204 } 1205 1206 qemu_sglist_add(&p->sgl, page, plen); 1207 bytes -= plen; 1208 } 1209 return 0; 1210 } 1211 1212 static void ehci_finish_transfer(EHCIQueue *q, int len) 1213 { 1214 uint32_t cpage, offset; 1215 1216 if (len > 0) { 1217 /* update cpage & offset */ 1218 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1219 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1220 1221 offset += len; 1222 cpage += offset >> QTD_BUFPTR_SH; 1223 offset &= ~QTD_BUFPTR_MASK; 1224 1225 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1226 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1227 q->qh.bufptr[0] |= offset; 1228 } 1229 } 1230 1231 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1232 { 1233 EHCIPacket *p; 1234 EHCIState *s = port->opaque; 1235 uint32_t portsc = s->portsc[port->index]; 1236 1237 if (portsc & PORTSC_POWNER) { 1238 USBPort *companion = s->companion_ports[port->index]; 1239 companion->ops->complete(companion, packet); 1240 return; 1241 } 1242 1243 p = container_of(packet, EHCIPacket, packet); 1244 assert(p->async == EHCI_ASYNC_INFLIGHT); 1245 1246 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1247 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1248 ehci_free_packet(p); 1249 return; 1250 } 1251 1252 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1253 p->async = EHCI_ASYNC_FINISHED; 1254 1255 if (!p->queue->async) { 1256 s->periodic_sched_active = PERIODIC_ACTIVE; 1257 } 1258 qemu_bh_schedule(s->async_bh); 1259 } 1260 1261 static void ehci_execute_complete(EHCIQueue *q) 1262 { 1263 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1264 uint32_t tbytes; 1265 1266 assert(p != NULL); 1267 assert(p->qtdaddr == q->qtdaddr); 1268 assert(p->async == EHCI_ASYNC_INITIALIZED || 1269 p->async == EHCI_ASYNC_FINISHED); 1270 1271 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1272 "status %d, actual_length %d\n", 1273 q->qhaddr, q->qh.next, q->qtdaddr, 1274 p->packet.status, p->packet.actual_length); 1275 1276 switch (p->packet.status) { 1277 case USB_RET_SUCCESS: 1278 break; 1279 case USB_RET_IOERROR: 1280 case USB_RET_NODEV: 1281 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1282 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1283 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1284 break; 1285 case USB_RET_STALL: 1286 q->qh.token |= QTD_TOKEN_HALT; 1287 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1288 break; 1289 case USB_RET_NAK: 1290 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1291 return; /* We're not done yet with this transaction */ 1292 case USB_RET_BABBLE: 1293 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1294 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1295 break; 1296 default: 1297 /* should not be triggerable */ 1298 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1299 g_assert_not_reached(); 1300 break; 1301 } 1302 1303 /* TODO check 4.12 for splits */ 1304 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1305 if (tbytes && p->pid == USB_TOKEN_IN) { 1306 tbytes -= p->packet.actual_length; 1307 if (tbytes) { 1308 /* 4.15.1.2 must raise int on a short input packet */ 1309 ehci_raise_irq(q->ehci, USBSTS_INT); 1310 if (q->async) { 1311 q->ehci->int_req_by_async = true; 1312 } 1313 } 1314 } else { 1315 tbytes = 0; 1316 } 1317 DPRINTF("updating tbytes to %d\n", tbytes); 1318 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1319 1320 ehci_finish_transfer(q, p->packet.actual_length); 1321 usb_packet_unmap(&p->packet, &p->sgl); 1322 qemu_sglist_destroy(&p->sgl); 1323 p->async = EHCI_ASYNC_NONE; 1324 1325 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1326 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1327 1328 if (q->qh.token & QTD_TOKEN_IOC) { 1329 ehci_raise_irq(q->ehci, USBSTS_INT); 1330 if (q->async) { 1331 q->ehci->int_req_by_async = true; 1332 } 1333 } 1334 } 1335 1336 /* 4.10.3 returns "again" */ 1337 static int ehci_execute(EHCIPacket *p, const char *action) 1338 { 1339 USBEndpoint *ep; 1340 int endp; 1341 bool spd; 1342 1343 assert(p->async == EHCI_ASYNC_NONE || 1344 p->async == EHCI_ASYNC_INITIALIZED); 1345 1346 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1347 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1348 return -1; 1349 } 1350 1351 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1352 ehci_trace_guest_bug(p->queue->ehci, 1353 "guest requested more bytes than allowed"); 1354 return -1; 1355 } 1356 1357 if (!ehci_verify_pid(p->queue, &p->qtd)) { 1358 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */ 1359 } 1360 p->pid = ehci_get_pid(&p->qtd); 1361 p->queue->last_pid = p->pid; 1362 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1363 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1364 1365 if (p->async == EHCI_ASYNC_NONE) { 1366 if (ehci_init_transfer(p) != 0) { 1367 return -1; 1368 } 1369 1370 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1371 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, 1372 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1373 usb_packet_map(&p->packet, &p->sgl); 1374 p->async = EHCI_ASYNC_INITIALIZED; 1375 } 1376 1377 trace_usb_ehci_packet_action(p->queue, p, action); 1378 usb_handle_packet(p->queue->dev, &p->packet); 1379 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1380 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1381 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1382 p->packet.actual_length); 1383 1384 if (p->packet.actual_length > BUFF_SIZE) { 1385 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1386 return -1; 1387 } 1388 1389 return 1; 1390 } 1391 1392 /* 4.7.2 1393 */ 1394 1395 static int ehci_process_itd(EHCIState *ehci, 1396 EHCIitd *itd, 1397 uint32_t addr) 1398 { 1399 USBDevice *dev; 1400 USBEndpoint *ep; 1401 uint32_t i, len, pid, dir, devaddr, endp; 1402 uint32_t pg, off, ptr1, ptr2, max, mult; 1403 1404 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1405 1406 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1407 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1408 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1409 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1410 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1411 1412 for(i = 0; i < 8; i++) { 1413 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1414 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1415 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1416 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1417 1418 if (len > max * mult) { 1419 len = max * mult; 1420 } 1421 if (len > BUFF_SIZE || pg > 6) { 1422 return -1; 1423 } 1424 1425 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1426 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); 1427 if (off + len > 4096) { 1428 /* transfer crosses page border */ 1429 if (pg == 6) { 1430 qemu_sglist_destroy(&ehci->isgl); 1431 return -1; /* avoid page pg + 1 */ 1432 } 1433 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); 1434 uint32_t len2 = off + len - 4096; 1435 uint32_t len1 = len - len2; 1436 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1437 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1438 } else { 1439 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1440 } 1441 1442 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1443 1444 dev = ehci_find_device(ehci, devaddr); 1445 ep = usb_ep_get(dev, pid, endp); 1446 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1447 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, 1448 (itd->transact[i] & ITD_XACT_IOC) != 0); 1449 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1450 usb_handle_packet(dev, &ehci->ipacket); 1451 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1452 } else { 1453 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1454 ehci->ipacket.status = USB_RET_NAK; 1455 ehci->ipacket.actual_length = 0; 1456 } 1457 qemu_sglist_destroy(&ehci->isgl); 1458 1459 switch (ehci->ipacket.status) { 1460 case USB_RET_SUCCESS: 1461 break; 1462 default: 1463 fprintf(stderr, "Unexpected iso usb result: %d\n", 1464 ehci->ipacket.status); 1465 /* Fall through */ 1466 case USB_RET_IOERROR: 1467 case USB_RET_NODEV: 1468 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1469 if (dir) { 1470 itd->transact[i] |= ITD_XACT_XACTERR; 1471 ehci_raise_irq(ehci, USBSTS_ERRINT); 1472 } 1473 break; 1474 case USB_RET_BABBLE: 1475 itd->transact[i] |= ITD_XACT_BABBLE; 1476 ehci_raise_irq(ehci, USBSTS_ERRINT); 1477 break; 1478 case USB_RET_NAK: 1479 /* no data for us, so do a zero-length transfer */ 1480 ehci->ipacket.actual_length = 0; 1481 break; 1482 } 1483 if (!dir) { 1484 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1485 ITD_XACT_LENGTH); /* OUT */ 1486 } else { 1487 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1488 ITD_XACT_LENGTH); /* IN */ 1489 } 1490 if (itd->transact[i] & ITD_XACT_IOC) { 1491 ehci_raise_irq(ehci, USBSTS_INT); 1492 } 1493 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1494 } 1495 } 1496 return 0; 1497 } 1498 1499 1500 /* This state is the entry point for asynchronous schedule 1501 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1502 */ 1503 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1504 { 1505 EHCIqh qh; 1506 int i = 0; 1507 int again = 0; 1508 uint32_t entry = ehci->asynclistaddr; 1509 1510 /* set reclamation flag at start event (4.8.6) */ 1511 if (async) { 1512 ehci_set_usbsts(ehci, USBSTS_REC); 1513 } 1514 1515 ehci_queues_rip_unused(ehci, async); 1516 1517 /* Find the head of the list (4.9.1.1) */ 1518 for(i = 0; i < MAX_QH; i++) { 1519 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1520 sizeof(EHCIqh) >> 2) < 0) { 1521 return 0; 1522 } 1523 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1524 1525 if (qh.epchar & QH_EPCHAR_H) { 1526 if (async) { 1527 entry |= (NLPTR_TYPE_QH << 1); 1528 } 1529 1530 ehci_set_fetch_addr(ehci, async, entry); 1531 ehci_set_state(ehci, async, EST_FETCHENTRY); 1532 again = 1; 1533 goto out; 1534 } 1535 1536 entry = qh.next; 1537 if (entry == ehci->asynclistaddr) { 1538 break; 1539 } 1540 } 1541 1542 /* no head found for list. */ 1543 1544 ehci_set_state(ehci, async, EST_ACTIVE); 1545 1546 out: 1547 return again; 1548 } 1549 1550 1551 /* This state is the entry point for periodic schedule processing as 1552 * well as being a continuation state for async processing. 1553 */ 1554 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1555 { 1556 int again = 0; 1557 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1558 1559 if (NLPTR_TBIT(entry)) { 1560 ehci_set_state(ehci, async, EST_ACTIVE); 1561 goto out; 1562 } 1563 1564 /* section 4.8, only QH in async schedule */ 1565 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1566 fprintf(stderr, "non queue head request in async schedule\n"); 1567 return -1; 1568 } 1569 1570 switch (NLPTR_TYPE_GET(entry)) { 1571 case NLPTR_TYPE_QH: 1572 ehci_set_state(ehci, async, EST_FETCHQH); 1573 again = 1; 1574 break; 1575 1576 case NLPTR_TYPE_ITD: 1577 ehci_set_state(ehci, async, EST_FETCHITD); 1578 again = 1; 1579 break; 1580 1581 case NLPTR_TYPE_STITD: 1582 ehci_set_state(ehci, async, EST_FETCHSITD); 1583 again = 1; 1584 break; 1585 1586 default: 1587 /* TODO: handle FSTN type */ 1588 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1589 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1590 return -1; 1591 } 1592 1593 out: 1594 return again; 1595 } 1596 1597 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1598 { 1599 uint32_t entry; 1600 EHCIQueue *q; 1601 EHCIqh qh; 1602 1603 entry = ehci_get_fetch_addr(ehci, async); 1604 q = ehci_find_queue_by_qh(ehci, entry, async); 1605 if (q == NULL) { 1606 q = ehci_alloc_queue(ehci, entry, async); 1607 } 1608 1609 q->seen++; 1610 if (q->seen > 1) { 1611 /* we are going in circles -- stop processing */ 1612 ehci_set_state(ehci, async, EST_ACTIVE); 1613 q = NULL; 1614 goto out; 1615 } 1616 1617 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1618 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1619 q = NULL; 1620 goto out; 1621 } 1622 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1623 1624 /* 1625 * The overlay area of the qh should never be changed by the guest, 1626 * except when idle, in which case the reset is a nop. 1627 */ 1628 if (!ehci_verify_qh(q, &qh)) { 1629 if (ehci_reset_queue(q) > 0) { 1630 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1631 } 1632 } 1633 q->qh = qh; 1634 1635 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1636 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1637 q->transact_ctr = 4; 1638 } 1639 1640 if (q->dev == NULL) { 1641 q->dev = ehci_find_device(q->ehci, 1642 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)); 1643 } 1644 1645 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1646 1647 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1648 if (ehci->usbsts & USBSTS_REC) { 1649 ehci_clear_usbsts(ehci, USBSTS_REC); 1650 } else { 1651 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1652 " - done processing\n", q->qhaddr); 1653 ehci_set_state(ehci, async, EST_ACTIVE); 1654 q = NULL; 1655 goto out; 1656 } 1657 } 1658 1659 #if EHCI_DEBUG 1660 if (q->qhaddr != q->qh.next) { 1661 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1662 q->qhaddr, 1663 q->qh.epchar & QH_EPCHAR_H, 1664 q->qh.token & QTD_TOKEN_HALT, 1665 q->qh.token & QTD_TOKEN_ACTIVE, 1666 q->qh.next); 1667 } 1668 #endif 1669 1670 if (q->qh.token & QTD_TOKEN_HALT) { 1671 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1672 1673 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1674 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1675 q->qtdaddr = q->qh.current_qtd; 1676 ehci_set_state(ehci, async, EST_FETCHQTD); 1677 1678 } else { 1679 /* EHCI spec version 1.0 Section 4.10.2 */ 1680 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1681 } 1682 1683 out: 1684 return q; 1685 } 1686 1687 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1688 { 1689 uint32_t entry; 1690 EHCIitd itd; 1691 1692 assert(!async); 1693 entry = ehci_get_fetch_addr(ehci, async); 1694 1695 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1696 sizeof(EHCIitd) >> 2) < 0) { 1697 return -1; 1698 } 1699 ehci_trace_itd(ehci, entry, &itd); 1700 1701 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1702 return -1; 1703 } 1704 1705 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1706 sizeof(EHCIitd) >> 2); 1707 ehci_set_fetch_addr(ehci, async, itd.next); 1708 ehci_set_state(ehci, async, EST_FETCHENTRY); 1709 1710 return 1; 1711 } 1712 1713 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1714 { 1715 uint32_t entry; 1716 EHCIsitd sitd; 1717 1718 assert(!async); 1719 entry = ehci_get_fetch_addr(ehci, async); 1720 1721 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1722 sizeof(EHCIsitd) >> 2) < 0) { 1723 return 0; 1724 } 1725 ehci_trace_sitd(ehci, entry, &sitd); 1726 1727 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1728 /* siTD is not active, nothing to do */; 1729 } else { 1730 /* TODO: split transfers are not implemented */ 1731 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1732 } 1733 1734 ehci_set_fetch_addr(ehci, async, sitd.next); 1735 ehci_set_state(ehci, async, EST_FETCHENTRY); 1736 return 1; 1737 } 1738 1739 /* Section 4.10.2 - paragraph 3 */ 1740 static int ehci_state_advqueue(EHCIQueue *q) 1741 { 1742 #if 0 1743 /* TO-DO: 4.10.2 - paragraph 2 1744 * if I-bit is set to 1 and QH is not active 1745 * go to horizontal QH 1746 */ 1747 if (I-bit set) { 1748 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1749 goto out; 1750 } 1751 #endif 1752 1753 /* 1754 * want data and alt-next qTD is valid 1755 */ 1756 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1757 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1758 q->qtdaddr = q->qh.altnext_qtd; 1759 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1760 1761 /* 1762 * next qTD is valid 1763 */ 1764 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1765 q->qtdaddr = q->qh.next_qtd; 1766 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1767 1768 /* 1769 * no valid qTD, try next QH 1770 */ 1771 } else { 1772 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1773 } 1774 1775 return 1; 1776 } 1777 1778 /* Section 4.10.2 - paragraph 4 */ 1779 static int ehci_state_fetchqtd(EHCIQueue *q) 1780 { 1781 EHCIqtd qtd; 1782 EHCIPacket *p; 1783 int again = 1; 1784 1785 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1786 sizeof(EHCIqtd) >> 2) < 0) { 1787 return 0; 1788 } 1789 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1790 1791 p = QTAILQ_FIRST(&q->packets); 1792 if (p != NULL) { 1793 if (!ehci_verify_qtd(p, &qtd)) { 1794 ehci_cancel_queue(q); 1795 if (qtd.token & QTD_TOKEN_ACTIVE) { 1796 ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); 1797 } 1798 p = NULL; 1799 } else { 1800 p->qtd = qtd; 1801 ehci_qh_do_overlay(q); 1802 } 1803 } 1804 1805 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1806 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1807 } else if (p != NULL) { 1808 switch (p->async) { 1809 case EHCI_ASYNC_NONE: 1810 case EHCI_ASYNC_INITIALIZED: 1811 /* Not yet executed (MULT), or previously nacked (int) packet */ 1812 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1813 break; 1814 case EHCI_ASYNC_INFLIGHT: 1815 /* Check if the guest has added new tds to the queue */ 1816 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1817 /* Unfinished async handled packet, go horizontal */ 1818 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1819 break; 1820 case EHCI_ASYNC_FINISHED: 1821 /* Complete executing of the packet */ 1822 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1823 break; 1824 } 1825 } else { 1826 p = ehci_alloc_packet(q); 1827 p->qtdaddr = q->qtdaddr; 1828 p->qtd = qtd; 1829 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1830 } 1831 1832 return again; 1833 } 1834 1835 static int ehci_state_horizqh(EHCIQueue *q) 1836 { 1837 int again = 0; 1838 1839 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1840 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1841 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1842 again = 1; 1843 } else { 1844 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1845 } 1846 1847 return again; 1848 } 1849 1850 /* Returns "again" */ 1851 static int ehci_fill_queue(EHCIPacket *p) 1852 { 1853 USBEndpoint *ep = p->packet.ep; 1854 EHCIQueue *q = p->queue; 1855 EHCIqtd qtd = p->qtd; 1856 uint32_t qtdaddr; 1857 1858 for (;;) { 1859 if (NLPTR_TBIT(qtd.next) != 0) { 1860 break; 1861 } 1862 qtdaddr = qtd.next; 1863 /* 1864 * Detect circular td lists, Windows creates these, counting on the 1865 * active bit going low after execution to make the queue stop. 1866 */ 1867 QTAILQ_FOREACH(p, &q->packets, next) { 1868 if (p->qtdaddr == qtdaddr) { 1869 goto leave; 1870 } 1871 } 1872 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1873 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1874 return -1; 1875 } 1876 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1877 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1878 break; 1879 } 1880 if (!ehci_verify_pid(q, &qtd)) { 1881 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid"); 1882 break; 1883 } 1884 p = ehci_alloc_packet(q); 1885 p->qtdaddr = qtdaddr; 1886 p->qtd = qtd; 1887 if (ehci_execute(p, "queue") == -1) { 1888 return -1; 1889 } 1890 assert(p->packet.status == USB_RET_ASYNC); 1891 p->async = EHCI_ASYNC_INFLIGHT; 1892 } 1893 leave: 1894 usb_device_flush_ep_queue(ep->dev, ep); 1895 return 1; 1896 } 1897 1898 static int ehci_state_execute(EHCIQueue *q) 1899 { 1900 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1901 int again = 0; 1902 1903 assert(p != NULL); 1904 assert(p->qtdaddr == q->qtdaddr); 1905 1906 if (ehci_qh_do_overlay(q) != 0) { 1907 return -1; 1908 } 1909 1910 // TODO verify enough time remains in the uframe as in 4.4.1.1 1911 // TODO write back ptr to async list when done or out of time 1912 1913 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1914 if (!q->async && q->transact_ctr == 0) { 1915 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1916 again = 1; 1917 goto out; 1918 } 1919 1920 if (q->async) { 1921 ehci_set_usbsts(q->ehci, USBSTS_REC); 1922 } 1923 1924 again = ehci_execute(p, "process"); 1925 if (again == -1) { 1926 goto out; 1927 } 1928 if (p->packet.status == USB_RET_ASYNC) { 1929 ehci_flush_qh(q); 1930 trace_usb_ehci_packet_action(p->queue, p, "async"); 1931 p->async = EHCI_ASYNC_INFLIGHT; 1932 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1933 if (q->async) { 1934 again = ehci_fill_queue(p); 1935 } else { 1936 again = 1; 1937 } 1938 goto out; 1939 } 1940 1941 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1942 again = 1; 1943 1944 out: 1945 return again; 1946 } 1947 1948 static int ehci_state_executing(EHCIQueue *q) 1949 { 1950 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1951 1952 assert(p != NULL); 1953 assert(p->qtdaddr == q->qtdaddr); 1954 1955 ehci_execute_complete(q); 1956 1957 /* 4.10.3 */ 1958 if (!q->async && q->transact_ctr > 0) { 1959 q->transact_ctr--; 1960 } 1961 1962 /* 4.10.5 */ 1963 if (p->packet.status == USB_RET_NAK) { 1964 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1965 } else { 1966 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1967 } 1968 1969 ehci_flush_qh(q); 1970 return 1; 1971 } 1972 1973 1974 static int ehci_state_writeback(EHCIQueue *q) 1975 { 1976 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1977 uint32_t *qtd, addr; 1978 int again = 0; 1979 1980 /* Write back the QTD from the QH area */ 1981 assert(p != NULL); 1982 assert(p->qtdaddr == q->qtdaddr); 1983 1984 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1985 qtd = (uint32_t *) &q->qh.next_qtd; 1986 addr = NLPTR_GET(p->qtdaddr); 1987 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1988 ehci_free_packet(p); 1989 1990 /* 1991 * EHCI specs say go horizontal here. 1992 * 1993 * We can also advance the queue here for performance reasons. We 1994 * need to take care to only take that shortcut in case we've 1995 * processed the qtd just written back without errors, i.e. halt 1996 * bit is clear. 1997 */ 1998 if (q->qh.token & QTD_TOKEN_HALT) { 1999 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 2000 again = 1; 2001 } else { 2002 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 2003 again = 1; 2004 } 2005 return again; 2006 } 2007 2008 /* 2009 * This is the state machine that is common to both async and periodic 2010 */ 2011 2012 static void ehci_advance_state(EHCIState *ehci, int async) 2013 { 2014 EHCIQueue *q = NULL; 2015 int itd_count = 0; 2016 int again; 2017 2018 do { 2019 switch(ehci_get_state(ehci, async)) { 2020 case EST_WAITLISTHEAD: 2021 again = ehci_state_waitlisthead(ehci, async); 2022 break; 2023 2024 case EST_FETCHENTRY: 2025 again = ehci_state_fetchentry(ehci, async); 2026 break; 2027 2028 case EST_FETCHQH: 2029 q = ehci_state_fetchqh(ehci, async); 2030 if (q != NULL) { 2031 assert(q->async == async); 2032 again = 1; 2033 } else { 2034 again = 0; 2035 } 2036 break; 2037 2038 case EST_FETCHITD: 2039 again = ehci_state_fetchitd(ehci, async); 2040 itd_count++; 2041 break; 2042 2043 case EST_FETCHSITD: 2044 again = ehci_state_fetchsitd(ehci, async); 2045 itd_count++; 2046 break; 2047 2048 case EST_ADVANCEQUEUE: 2049 assert(q != NULL); 2050 again = ehci_state_advqueue(q); 2051 break; 2052 2053 case EST_FETCHQTD: 2054 assert(q != NULL); 2055 again = ehci_state_fetchqtd(q); 2056 break; 2057 2058 case EST_HORIZONTALQH: 2059 assert(q != NULL); 2060 again = ehci_state_horizqh(q); 2061 break; 2062 2063 case EST_EXECUTE: 2064 assert(q != NULL); 2065 again = ehci_state_execute(q); 2066 if (async) { 2067 ehci->async_stepdown = 0; 2068 } 2069 break; 2070 2071 case EST_EXECUTING: 2072 assert(q != NULL); 2073 if (async) { 2074 ehci->async_stepdown = 0; 2075 } 2076 again = ehci_state_executing(q); 2077 break; 2078 2079 case EST_WRITEBACK: 2080 assert(q != NULL); 2081 again = ehci_state_writeback(q); 2082 if (!async) { 2083 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2084 } 2085 break; 2086 2087 default: 2088 fprintf(stderr, "Bad state!\n"); 2089 again = -1; 2090 g_assert_not_reached(); 2091 break; 2092 } 2093 2094 if (again < 0 || itd_count > 16) { 2095 /* TODO: notify guest (raise HSE irq?) */ 2096 fprintf(stderr, "processing error - resetting ehci HC\n"); 2097 ehci_reset(ehci); 2098 again = 0; 2099 } 2100 } 2101 while (again); 2102 } 2103 2104 static void ehci_advance_async_state(EHCIState *ehci) 2105 { 2106 const int async = 1; 2107 2108 switch(ehci_get_state(ehci, async)) { 2109 case EST_INACTIVE: 2110 if (!ehci_async_enabled(ehci)) { 2111 break; 2112 } 2113 ehci_set_state(ehci, async, EST_ACTIVE); 2114 // No break, fall through to ACTIVE 2115 2116 case EST_ACTIVE: 2117 if (!ehci_async_enabled(ehci)) { 2118 ehci_queues_rip_all(ehci, async); 2119 ehci_set_state(ehci, async, EST_INACTIVE); 2120 break; 2121 } 2122 2123 /* make sure guest has acknowledged the doorbell interrupt */ 2124 /* TO-DO: is this really needed? */ 2125 if (ehci->usbsts & USBSTS_IAA) { 2126 DPRINTF("IAA status bit still set.\n"); 2127 break; 2128 } 2129 2130 /* check that address register has been set */ 2131 if (ehci->asynclistaddr == 0) { 2132 break; 2133 } 2134 2135 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2136 ehci_advance_state(ehci, async); 2137 2138 /* If the doorbell is set, the guest wants to make a change to the 2139 * schedule. The host controller needs to release cached data. 2140 * (section 4.8.2) 2141 */ 2142 if (ehci->usbcmd & USBCMD_IAAD) { 2143 /* Remove all unseen qhs from the async qhs queue */ 2144 ehci_queues_rip_unseen(ehci, async); 2145 trace_usb_ehci_doorbell_ack(); 2146 ehci->usbcmd &= ~USBCMD_IAAD; 2147 ehci_raise_irq(ehci, USBSTS_IAA); 2148 } 2149 break; 2150 2151 default: 2152 /* this should only be due to a developer mistake */ 2153 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2154 "Resetting to active\n", ehci->astate); 2155 g_assert_not_reached(); 2156 } 2157 } 2158 2159 static void ehci_advance_periodic_state(EHCIState *ehci) 2160 { 2161 uint32_t entry; 2162 uint32_t list; 2163 const int async = 0; 2164 2165 // 4.6 2166 2167 switch(ehci_get_state(ehci, async)) { 2168 case EST_INACTIVE: 2169 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2170 ehci_set_state(ehci, async, EST_ACTIVE); 2171 // No break, fall through to ACTIVE 2172 } else 2173 break; 2174 2175 case EST_ACTIVE: 2176 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2177 ehci_queues_rip_all(ehci, async); 2178 ehci_set_state(ehci, async, EST_INACTIVE); 2179 break; 2180 } 2181 2182 list = ehci->periodiclistbase & 0xfffff000; 2183 /* check that register has been set */ 2184 if (list == 0) { 2185 break; 2186 } 2187 list |= ((ehci->frindex & 0x1ff8) >> 1); 2188 2189 if (get_dwords(ehci, list, &entry, 1) < 0) { 2190 break; 2191 } 2192 2193 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2194 ehci->frindex / 8, list, entry); 2195 ehci_set_fetch_addr(ehci, async,entry); 2196 ehci_set_state(ehci, async, EST_FETCHENTRY); 2197 ehci_advance_state(ehci, async); 2198 ehci_queues_rip_unused(ehci, async); 2199 break; 2200 2201 default: 2202 /* this should only be due to a developer mistake */ 2203 fprintf(stderr, "ehci: Bad periodic state %d. " 2204 "Resetting to active\n", ehci->pstate); 2205 g_assert_not_reached(); 2206 } 2207 } 2208 2209 static void ehci_update_frindex(EHCIState *ehci, int uframes) 2210 { 2211 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) { 2212 return; 2213 } 2214 2215 /* Generate FLR interrupt if frame index rolls over 0x2000 */ 2216 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) { 2217 ehci_raise_irq(ehci, USBSTS_FLR); 2218 } 2219 2220 /* How many times will frindex roll over 0x4000 with this frame count? 2221 * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0 2222 */ 2223 int rollovers = (ehci->frindex + uframes) / 0x4000; 2224 if (rollovers > 0) { 2225 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) { 2226 ehci->usbsts_frindex -= 0x4000 * rollovers; 2227 } else { 2228 ehci->usbsts_frindex = 0; 2229 } 2230 } 2231 2232 ehci->frindex = (ehci->frindex + uframes) % 0x4000; 2233 } 2234 2235 static void ehci_work_bh(void *opaque) 2236 { 2237 EHCIState *ehci = opaque; 2238 int need_timer = 0; 2239 int64_t expire_time, t_now; 2240 uint64_t ns_elapsed; 2241 uint64_t uframes, skipped_uframes; 2242 int i; 2243 2244 if (ehci->working) { 2245 return; 2246 } 2247 ehci->working = true; 2248 2249 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 2250 ns_elapsed = t_now - ehci->last_run_ns; 2251 uframes = ns_elapsed / UFRAME_TIMER_NS; 2252 2253 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2254 need_timer++; 2255 2256 if (uframes > (ehci->maxframes * 8)) { 2257 skipped_uframes = uframes - (ehci->maxframes * 8); 2258 ehci_update_frindex(ehci, skipped_uframes); 2259 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; 2260 uframes -= skipped_uframes; 2261 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes); 2262 } 2263 2264 for (i = 0; i < uframes; i++) { 2265 /* 2266 * If we're running behind schedule, we should not catch up 2267 * too fast, as that will make some guests unhappy: 2268 * 1) We must process a minimum of MIN_UFR_PER_TICK frames, 2269 * otherwise we will never catch up 2270 * 2) Process frames until the guest has requested an irq (IOC) 2271 */ 2272 if (i >= MIN_UFR_PER_TICK) { 2273 ehci_commit_irq(ehci); 2274 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2275 break; 2276 } 2277 } 2278 if (ehci->periodic_sched_active) { 2279 ehci->periodic_sched_active--; 2280 } 2281 ehci_update_frindex(ehci, 1); 2282 if ((ehci->frindex & 7) == 0) { 2283 ehci_advance_periodic_state(ehci); 2284 } 2285 ehci->last_run_ns += UFRAME_TIMER_NS; 2286 } 2287 } else { 2288 ehci->periodic_sched_active = 0; 2289 ehci_update_frindex(ehci, uframes); 2290 ehci->last_run_ns += UFRAME_TIMER_NS * uframes; 2291 } 2292 2293 if (ehci->periodic_sched_active) { 2294 ehci->async_stepdown = 0; 2295 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2296 ehci->async_stepdown++; 2297 } 2298 2299 /* Async is not inside loop since it executes everything it can once 2300 * called 2301 */ 2302 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2303 need_timer++; 2304 ehci_advance_async_state(ehci); 2305 } 2306 2307 ehci_commit_irq(ehci); 2308 if (ehci->usbsts_pending) { 2309 need_timer++; 2310 ehci->async_stepdown = 0; 2311 } 2312 2313 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2314 need_timer++; 2315 } 2316 2317 if (need_timer) { 2318 /* If we've raised int, we speed up the timer, so that we quickly 2319 * notice any new packets queued up in response */ 2320 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2321 expire_time = t_now + 2322 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4); 2323 ehci->int_req_by_async = false; 2324 } else { 2325 expire_time = t_now + (NANOSECONDS_PER_SECOND 2326 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2327 } 2328 timer_mod(ehci->frame_timer, expire_time); 2329 } 2330 2331 ehci->working = false; 2332 } 2333 2334 static void ehci_work_timer(void *opaque) 2335 { 2336 EHCIState *ehci = opaque; 2337 2338 qemu_bh_schedule(ehci->async_bh); 2339 } 2340 2341 static const MemoryRegionOps ehci_mmio_caps_ops = { 2342 .read = ehci_caps_read, 2343 .write = ehci_caps_write, 2344 .valid.min_access_size = 1, 2345 .valid.max_access_size = 4, 2346 .impl.min_access_size = 1, 2347 .impl.max_access_size = 1, 2348 .endianness = DEVICE_LITTLE_ENDIAN, 2349 }; 2350 2351 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2352 .read = ehci_opreg_read, 2353 .write = ehci_opreg_write, 2354 .valid.min_access_size = 4, 2355 .valid.max_access_size = 4, 2356 .endianness = DEVICE_LITTLE_ENDIAN, 2357 }; 2358 2359 static const MemoryRegionOps ehci_mmio_port_ops = { 2360 .read = ehci_port_read, 2361 .write = ehci_port_write, 2362 .valid.min_access_size = 4, 2363 .valid.max_access_size = 4, 2364 .endianness = DEVICE_LITTLE_ENDIAN, 2365 }; 2366 2367 static USBPortOps ehci_port_ops = { 2368 .attach = ehci_attach, 2369 .detach = ehci_detach, 2370 .child_detach = ehci_child_detach, 2371 .wakeup = ehci_wakeup, 2372 .complete = ehci_async_complete_packet, 2373 }; 2374 2375 static USBBusOps ehci_bus_ops_companion = { 2376 .register_companion = ehci_register_companion, 2377 .wakeup_endpoint = ehci_wakeup_endpoint, 2378 }; 2379 static USBBusOps ehci_bus_ops_standalone = { 2380 .wakeup_endpoint = ehci_wakeup_endpoint, 2381 }; 2382 2383 static void usb_ehci_pre_save(void *opaque) 2384 { 2385 EHCIState *ehci = opaque; 2386 uint32_t new_frindex; 2387 2388 /* Round down frindex to a multiple of 8 for migration compatibility */ 2389 new_frindex = ehci->frindex & ~7; 2390 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS; 2391 ehci->frindex = new_frindex; 2392 } 2393 2394 static int usb_ehci_post_load(void *opaque, int version_id) 2395 { 2396 EHCIState *s = opaque; 2397 int i; 2398 2399 for (i = 0; i < NB_PORTS; i++) { 2400 USBPort *companion = s->companion_ports[i]; 2401 if (companion == NULL) { 2402 continue; 2403 } 2404 if (s->portsc[i] & PORTSC_POWNER) { 2405 companion->dev = s->ports[i].dev; 2406 } else { 2407 companion->dev = NULL; 2408 } 2409 } 2410 2411 return 0; 2412 } 2413 2414 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2415 { 2416 EHCIState *ehci = opaque; 2417 2418 /* 2419 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2420 * schedule in guest memory. We must do the rebuilt ASAP, so that 2421 * USB-devices which have async handled packages have a packet in the 2422 * ep queue to match the completion with. 2423 */ 2424 if (state == RUN_STATE_RUNNING) { 2425 ehci_advance_async_state(ehci); 2426 } 2427 2428 /* 2429 * The schedule rebuilt from guest memory could cause the migration dest 2430 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2431 * will never have existed on the destination. Therefor we must flush the 2432 * async schedule on savevm to catch any not yet noticed unlinks. 2433 */ 2434 if (state == RUN_STATE_SAVE_VM) { 2435 ehci_advance_async_state(ehci); 2436 ehci_queues_rip_unseen(ehci, 1); 2437 } 2438 } 2439 2440 const VMStateDescription vmstate_ehci = { 2441 .name = "ehci-core", 2442 .version_id = 2, 2443 .minimum_version_id = 1, 2444 .pre_save = usb_ehci_pre_save, 2445 .post_load = usb_ehci_post_load, 2446 .fields = (VMStateField[]) { 2447 /* mmio registers */ 2448 VMSTATE_UINT32(usbcmd, EHCIState), 2449 VMSTATE_UINT32(usbsts, EHCIState), 2450 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2451 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2452 VMSTATE_UINT32(usbintr, EHCIState), 2453 VMSTATE_UINT32(frindex, EHCIState), 2454 VMSTATE_UINT32(ctrldssegment, EHCIState), 2455 VMSTATE_UINT32(periodiclistbase, EHCIState), 2456 VMSTATE_UINT32(asynclistaddr, EHCIState), 2457 VMSTATE_UINT32(configflag, EHCIState), 2458 VMSTATE_UINT32(portsc[0], EHCIState), 2459 VMSTATE_UINT32(portsc[1], EHCIState), 2460 VMSTATE_UINT32(portsc[2], EHCIState), 2461 VMSTATE_UINT32(portsc[3], EHCIState), 2462 VMSTATE_UINT32(portsc[4], EHCIState), 2463 VMSTATE_UINT32(portsc[5], EHCIState), 2464 /* frame timer */ 2465 VMSTATE_TIMER_PTR(frame_timer, EHCIState), 2466 VMSTATE_UINT64(last_run_ns, EHCIState), 2467 VMSTATE_UINT32(async_stepdown, EHCIState), 2468 /* schedule state */ 2469 VMSTATE_UINT32(astate, EHCIState), 2470 VMSTATE_UINT32(pstate, EHCIState), 2471 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2472 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2473 VMSTATE_END_OF_LIST() 2474 } 2475 }; 2476 2477 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) 2478 { 2479 int i; 2480 2481 if (s->portnr > NB_PORTS) { 2482 error_setg(errp, "Too many ports! Max. port number is %d.", 2483 NB_PORTS); 2484 return; 2485 } 2486 if (s->maxframes < 8 || s->maxframes > 512) { 2487 error_setg(errp, "maxframes %d out if range (8 .. 512)", 2488 s->maxframes); 2489 return; 2490 } 2491 2492 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ? 2493 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev); 2494 for (i = 0; i < s->portnr; i++) { 2495 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2496 USB_SPEED_MASK_HIGH); 2497 s->ports[i].dev = 0; 2498 } 2499 2500 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s); 2501 s->async_bh = qemu_bh_new(ehci_work_bh, s); 2502 s->device = dev; 2503 2504 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2505 } 2506 2507 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp) 2508 { 2509 trace_usb_ehci_unrealize(); 2510 2511 if (s->frame_timer) { 2512 timer_del(s->frame_timer); 2513 timer_free(s->frame_timer); 2514 s->frame_timer = NULL; 2515 } 2516 if (s->async_bh) { 2517 qemu_bh_delete(s->async_bh); 2518 } 2519 2520 ehci_queues_rip_all(s, 0); 2521 ehci_queues_rip_all(s, 1); 2522 2523 memory_region_del_subregion(&s->mem, &s->mem_caps); 2524 memory_region_del_subregion(&s->mem, &s->mem_opreg); 2525 memory_region_del_subregion(&s->mem, &s->mem_ports); 2526 2527 usb_bus_release(&s->bus); 2528 2529 if (s->vmstate) { 2530 qemu_del_vm_change_state_handler(s->vmstate); 2531 } 2532 } 2533 2534 void usb_ehci_init(EHCIState *s, DeviceState *dev) 2535 { 2536 /* 2.2 host controller interface version */ 2537 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2538 s->caps[0x01] = 0x00; 2539 s->caps[0x02] = 0x00; 2540 s->caps[0x03] = 0x01; /* HC version */ 2541 s->caps[0x04] = s->portnr; /* Number of downstream ports */ 2542 s->caps[0x05] = 0x00; /* No companion ports at present */ 2543 s->caps[0x06] = 0x00; 2544 s->caps[0x07] = 0x00; 2545 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2546 s->caps[0x0a] = 0x00; 2547 s->caps[0x0b] = 0x00; 2548 2549 QTAILQ_INIT(&s->aqueues); 2550 QTAILQ_INIT(&s->pqueues); 2551 usb_packet_init(&s->ipacket); 2552 2553 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE); 2554 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s, 2555 "capabilities", CAPA_SIZE); 2556 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s, 2557 "operational", s->portscbase); 2558 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s, 2559 "ports", 4 * s->portnr); 2560 2561 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2562 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2563 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase, 2564 &s->mem_ports); 2565 } 2566 2567 void usb_ehci_finalize(EHCIState *s) 2568 { 2569 usb_packet_cleanup(&s->ipacket); 2570 } 2571 2572 /* 2573 * vim: expandtab ts=4 2574 */ 2575