1 /* 2 * QEMU USB EHCI Emulation 3 * 4 * Copyright(c) 2008 Emutex Ltd. (address@hidden) 5 * Copyright(c) 2011-2012 Red Hat, Inc. 6 * 7 * Red Hat Authors: 8 * Gerd Hoffmann <kraxel@redhat.com> 9 * Hans de Goede <hdegoede@redhat.com> 10 * 11 * EHCI project was started by Mark Burkley, with contributions by 12 * Niels de Vos. David S. Ahern continued working on it. Kevin Wolf, 13 * Jan Kiszka and Vincent Palatin contributed bugfixes. 14 * 15 * 16 * This library is free software; you can redistribute it and/or 17 * modify it under the terms of the GNU Lesser General Public 18 * License as published by the Free Software Foundation; either 19 * version 2 of the License, or(at your option) any later version. 20 * 21 * This library is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 24 * Lesser General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 */ 29 30 #include "qemu/osdep.h" 31 #include "qapi/error.h" 32 #include "hw/usb/ehci-regs.h" 33 #include "hw/usb/hcd-ehci.h" 34 #include "trace.h" 35 36 #define FRAME_TIMER_FREQ 1000 37 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) 38 #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) 39 40 #define NB_MAXINTRATE 8 // Max rate at which controller issues ints 41 #define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction 42 #define MAX_QH 100 // Max allowable queue heads in a chain 43 #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ 44 #define PERIODIC_ACTIVE 512 /* Micro-frames */ 45 46 /* Internal periodic / asynchronous schedule state machine states 47 */ 48 typedef enum { 49 EST_INACTIVE = 1000, 50 EST_ACTIVE, 51 EST_EXECUTING, 52 EST_SLEEPING, 53 /* The following states are internal to the state machine function 54 */ 55 EST_WAITLISTHEAD, 56 EST_FETCHENTRY, 57 EST_FETCHQH, 58 EST_FETCHITD, 59 EST_FETCHSITD, 60 EST_ADVANCEQUEUE, 61 EST_FETCHQTD, 62 EST_EXECUTE, 63 EST_WRITEBACK, 64 EST_HORIZONTALQH 65 } EHCI_STATES; 66 67 /* macros for accessing fields within next link pointer entry */ 68 #define NLPTR_GET(x) ((x) & 0xffffffe0) 69 #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) 70 #define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid 71 72 /* link pointer types */ 73 #define NLPTR_TYPE_ITD 0 // isoc xfer descriptor 74 #define NLPTR_TYPE_QH 1 // queue head 75 #define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor 76 #define NLPTR_TYPE_FSTN 3 // frame span traversal node 77 78 #define SET_LAST_RUN_CLOCK(s) \ 79 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 80 81 /* nifty macros from Arnon's EHCI version */ 82 #define get_field(data, field) \ 83 (((data) & field##_MASK) >> field##_SH) 84 85 #define set_field(data, newval, field) do { \ 86 uint32_t val = *data; \ 87 val &= ~ field##_MASK; \ 88 val |= ((newval) << field##_SH) & field##_MASK; \ 89 *data = val; \ 90 } while(0) 91 92 static const char *ehci_state_names[] = { 93 [EST_INACTIVE] = "INACTIVE", 94 [EST_ACTIVE] = "ACTIVE", 95 [EST_EXECUTING] = "EXECUTING", 96 [EST_SLEEPING] = "SLEEPING", 97 [EST_WAITLISTHEAD] = "WAITLISTHEAD", 98 [EST_FETCHENTRY] = "FETCH ENTRY", 99 [EST_FETCHQH] = "FETCH QH", 100 [EST_FETCHITD] = "FETCH ITD", 101 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE", 102 [EST_FETCHQTD] = "FETCH QTD", 103 [EST_EXECUTE] = "EXECUTE", 104 [EST_WRITEBACK] = "WRITEBACK", 105 [EST_HORIZONTALQH] = "HORIZONTALQH", 106 }; 107 108 static const char *ehci_mmio_names[] = { 109 [USBCMD] = "USBCMD", 110 [USBSTS] = "USBSTS", 111 [USBINTR] = "USBINTR", 112 [FRINDEX] = "FRINDEX", 113 [PERIODICLISTBASE] = "P-LIST BASE", 114 [ASYNCLISTADDR] = "A-LIST ADDR", 115 [CONFIGFLAG] = "CONFIGFLAG", 116 }; 117 118 static int ehci_state_executing(EHCIQueue *q); 119 static int ehci_state_writeback(EHCIQueue *q); 120 static int ehci_state_advqueue(EHCIQueue *q); 121 static int ehci_fill_queue(EHCIPacket *p); 122 static void ehci_free_packet(EHCIPacket *p); 123 124 static const char *nr2str(const char **n, size_t len, uint32_t nr) 125 { 126 if (nr < len && n[nr] != NULL) { 127 return n[nr]; 128 } else { 129 return "unknown"; 130 } 131 } 132 133 static const char *state2str(uint32_t state) 134 { 135 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state); 136 } 137 138 static const char *addr2str(hwaddr addr) 139 { 140 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr); 141 } 142 143 static void ehci_trace_usbsts(uint32_t mask, int state) 144 { 145 /* interrupts */ 146 if (mask & USBSTS_INT) { 147 trace_usb_ehci_usbsts("INT", state); 148 } 149 if (mask & USBSTS_ERRINT) { 150 trace_usb_ehci_usbsts("ERRINT", state); 151 } 152 if (mask & USBSTS_PCD) { 153 trace_usb_ehci_usbsts("PCD", state); 154 } 155 if (mask & USBSTS_FLR) { 156 trace_usb_ehci_usbsts("FLR", state); 157 } 158 if (mask & USBSTS_HSE) { 159 trace_usb_ehci_usbsts("HSE", state); 160 } 161 if (mask & USBSTS_IAA) { 162 trace_usb_ehci_usbsts("IAA", state); 163 } 164 165 /* status */ 166 if (mask & USBSTS_HALT) { 167 trace_usb_ehci_usbsts("HALT", state); 168 } 169 if (mask & USBSTS_REC) { 170 trace_usb_ehci_usbsts("REC", state); 171 } 172 if (mask & USBSTS_PSS) { 173 trace_usb_ehci_usbsts("PSS", state); 174 } 175 if (mask & USBSTS_ASS) { 176 trace_usb_ehci_usbsts("ASS", state); 177 } 178 } 179 180 static inline void ehci_set_usbsts(EHCIState *s, int mask) 181 { 182 if ((s->usbsts & mask) == mask) { 183 return; 184 } 185 ehci_trace_usbsts(mask, 1); 186 s->usbsts |= mask; 187 } 188 189 static inline void ehci_clear_usbsts(EHCIState *s, int mask) 190 { 191 if ((s->usbsts & mask) == 0) { 192 return; 193 } 194 ehci_trace_usbsts(mask, 0); 195 s->usbsts &= ~mask; 196 } 197 198 /* update irq line */ 199 static inline void ehci_update_irq(EHCIState *s) 200 { 201 int level = 0; 202 203 if ((s->usbsts & USBINTR_MASK) & s->usbintr) { 204 level = 1; 205 } 206 207 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr); 208 qemu_set_irq(s->irq, level); 209 } 210 211 /* flag interrupt condition */ 212 static inline void ehci_raise_irq(EHCIState *s, int intr) 213 { 214 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) { 215 s->usbsts |= intr; 216 ehci_update_irq(s); 217 } else { 218 s->usbsts_pending |= intr; 219 } 220 } 221 222 /* 223 * Commit pending interrupts (added via ehci_raise_irq), 224 * at the rate allowed by "Interrupt Threshold Control". 225 */ 226 static inline void ehci_commit_irq(EHCIState *s) 227 { 228 uint32_t itc; 229 230 if (!s->usbsts_pending) { 231 return; 232 } 233 if (s->usbsts_frindex > s->frindex) { 234 return; 235 } 236 237 itc = (s->usbcmd >> 16) & 0xff; 238 s->usbsts |= s->usbsts_pending; 239 s->usbsts_pending = 0; 240 s->usbsts_frindex = s->frindex + itc; 241 ehci_update_irq(s); 242 } 243 244 static void ehci_update_halt(EHCIState *s) 245 { 246 if (s->usbcmd & USBCMD_RUNSTOP) { 247 ehci_clear_usbsts(s, USBSTS_HALT); 248 } else { 249 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) { 250 ehci_set_usbsts(s, USBSTS_HALT); 251 } 252 } 253 } 254 255 static void ehci_set_state(EHCIState *s, int async, int state) 256 { 257 if (async) { 258 trace_usb_ehci_state("async", state2str(state)); 259 s->astate = state; 260 if (s->astate == EST_INACTIVE) { 261 ehci_clear_usbsts(s, USBSTS_ASS); 262 ehci_update_halt(s); 263 } else { 264 ehci_set_usbsts(s, USBSTS_ASS); 265 } 266 } else { 267 trace_usb_ehci_state("periodic", state2str(state)); 268 s->pstate = state; 269 if (s->pstate == EST_INACTIVE) { 270 ehci_clear_usbsts(s, USBSTS_PSS); 271 ehci_update_halt(s); 272 } else { 273 ehci_set_usbsts(s, USBSTS_PSS); 274 } 275 } 276 } 277 278 static int ehci_get_state(EHCIState *s, int async) 279 { 280 return async ? s->astate : s->pstate; 281 } 282 283 static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr) 284 { 285 if (async) { 286 s->a_fetch_addr = addr; 287 } else { 288 s->p_fetch_addr = addr; 289 } 290 } 291 292 static int ehci_get_fetch_addr(EHCIState *s, int async) 293 { 294 return async ? s->a_fetch_addr : s->p_fetch_addr; 295 } 296 297 static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh) 298 { 299 /* need three here due to argument count limits */ 300 trace_usb_ehci_qh_ptrs(q, addr, qh->next, 301 qh->current_qtd, qh->next_qtd, qh->altnext_qtd); 302 trace_usb_ehci_qh_fields(addr, 303 get_field(qh->epchar, QH_EPCHAR_RL), 304 get_field(qh->epchar, QH_EPCHAR_MPLEN), 305 get_field(qh->epchar, QH_EPCHAR_EPS), 306 get_field(qh->epchar, QH_EPCHAR_EP), 307 get_field(qh->epchar, QH_EPCHAR_DEVADDR)); 308 trace_usb_ehci_qh_bits(addr, 309 (bool)(qh->epchar & QH_EPCHAR_C), 310 (bool)(qh->epchar & QH_EPCHAR_H), 311 (bool)(qh->epchar & QH_EPCHAR_DTC), 312 (bool)(qh->epchar & QH_EPCHAR_I)); 313 } 314 315 static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd) 316 { 317 /* need three here due to argument count limits */ 318 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext); 319 trace_usb_ehci_qtd_fields(addr, 320 get_field(qtd->token, QTD_TOKEN_TBYTES), 321 get_field(qtd->token, QTD_TOKEN_CPAGE), 322 get_field(qtd->token, QTD_TOKEN_CERR), 323 get_field(qtd->token, QTD_TOKEN_PID)); 324 trace_usb_ehci_qtd_bits(addr, 325 (bool)(qtd->token & QTD_TOKEN_IOC), 326 (bool)(qtd->token & QTD_TOKEN_ACTIVE), 327 (bool)(qtd->token & QTD_TOKEN_HALT), 328 (bool)(qtd->token & QTD_TOKEN_BABBLE), 329 (bool)(qtd->token & QTD_TOKEN_XACTERR)); 330 } 331 332 static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd) 333 { 334 trace_usb_ehci_itd(addr, itd->next, 335 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT), 336 get_field(itd->bufptr[2], ITD_BUFPTR_MULT), 337 get_field(itd->bufptr[0], ITD_BUFPTR_EP), 338 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR)); 339 } 340 341 static void ehci_trace_sitd(EHCIState *s, hwaddr addr, 342 EHCIsitd *sitd) 343 { 344 trace_usb_ehci_sitd(addr, sitd->next, 345 (bool)(sitd->results & SITD_RESULTS_ACTIVE)); 346 } 347 348 static void ehci_trace_guest_bug(EHCIState *s, const char *message) 349 { 350 trace_usb_ehci_guest_bug(message); 351 fprintf(stderr, "ehci warning: %s\n", message); 352 } 353 354 static inline bool ehci_enabled(EHCIState *s) 355 { 356 return s->usbcmd & USBCMD_RUNSTOP; 357 } 358 359 static inline bool ehci_async_enabled(EHCIState *s) 360 { 361 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE); 362 } 363 364 static inline bool ehci_periodic_enabled(EHCIState *s) 365 { 366 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE); 367 } 368 369 /* Get an array of dwords from main memory */ 370 static inline int get_dwords(EHCIState *ehci, uint32_t addr, 371 uint32_t *buf, int num) 372 { 373 int i; 374 375 if (!ehci->as) { 376 ehci_raise_irq(ehci, USBSTS_HSE); 377 ehci->usbcmd &= ~USBCMD_RUNSTOP; 378 trace_usb_ehci_dma_error(); 379 return -1; 380 } 381 382 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 383 dma_memory_read(ehci->as, addr, buf, sizeof(*buf)); 384 *buf = le32_to_cpu(*buf); 385 } 386 387 return num; 388 } 389 390 /* Put an array of dwords in to main memory */ 391 static inline int put_dwords(EHCIState *ehci, uint32_t addr, 392 uint32_t *buf, int num) 393 { 394 int i; 395 396 if (!ehci->as) { 397 ehci_raise_irq(ehci, USBSTS_HSE); 398 ehci->usbcmd &= ~USBCMD_RUNSTOP; 399 trace_usb_ehci_dma_error(); 400 return -1; 401 } 402 403 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) { 404 uint32_t tmp = cpu_to_le32(*buf); 405 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp)); 406 } 407 408 return num; 409 } 410 411 static int ehci_get_pid(EHCIqtd *qtd) 412 { 413 switch (get_field(qtd->token, QTD_TOKEN_PID)) { 414 case 0: 415 return USB_TOKEN_OUT; 416 case 1: 417 return USB_TOKEN_IN; 418 case 2: 419 return USB_TOKEN_SETUP; 420 default: 421 fprintf(stderr, "bad token\n"); 422 return 0; 423 } 424 } 425 426 static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh) 427 { 428 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR); 429 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP); 430 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) || 431 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) || 432 (qh->current_qtd != q->qh.current_qtd) || 433 (q->async && qh->next_qtd != q->qh.next_qtd) || 434 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd, 435 7 * sizeof(uint32_t)) != 0) || 436 (q->dev != NULL && q->dev->addr != devaddr)) { 437 return false; 438 } else { 439 return true; 440 } 441 } 442 443 static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd) 444 { 445 if (p->qtdaddr != p->queue->qtdaddr || 446 (p->queue->async && !NLPTR_TBIT(p->qtd.next) && 447 (p->qtd.next != qtd->next)) || 448 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) || 449 p->qtd.token != qtd->token || 450 p->qtd.bufptr[0] != qtd->bufptr[0]) { 451 return false; 452 } else { 453 return true; 454 } 455 } 456 457 static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) 458 { 459 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP); 460 int pid = ehci_get_pid(qtd); 461 462 /* Note the pid changing is normal for ep 0 (the control ep) */ 463 if (q->last_pid && ep != 0 && pid != q->last_pid) { 464 return false; 465 } else { 466 return true; 467 } 468 } 469 470 /* Finish executing and writeback a packet outside of the regular 471 fetchqh -> fetchqtd -> execute -> writeback cycle */ 472 static void ehci_writeback_async_complete_packet(EHCIPacket *p) 473 { 474 EHCIQueue *q = p->queue; 475 EHCIqtd qtd; 476 EHCIqh qh; 477 int state; 478 479 /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */ 480 get_dwords(q->ehci, NLPTR_GET(q->qhaddr), 481 (uint32_t *) &qh, sizeof(EHCIqh) >> 2); 482 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), 483 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2); 484 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) { 485 p->async = EHCI_ASYNC_INITIALIZED; 486 ehci_free_packet(p); 487 return; 488 } 489 490 state = ehci_get_state(q->ehci, q->async); 491 ehci_state_executing(q); 492 ehci_state_writeback(q); /* Frees the packet! */ 493 if (!(q->qh.token & QTD_TOKEN_HALT)) { 494 ehci_state_advqueue(q); 495 } 496 ehci_set_state(q->ehci, q->async, state); 497 } 498 499 /* packet management */ 500 501 static EHCIPacket *ehci_alloc_packet(EHCIQueue *q) 502 { 503 EHCIPacket *p; 504 505 p = g_new0(EHCIPacket, 1); 506 p->queue = q; 507 usb_packet_init(&p->packet); 508 QTAILQ_INSERT_TAIL(&q->packets, p, next); 509 trace_usb_ehci_packet_action(p->queue, p, "alloc"); 510 return p; 511 } 512 513 static void ehci_free_packet(EHCIPacket *p) 514 { 515 if (p->async == EHCI_ASYNC_FINISHED && 516 !(p->queue->qh.token & QTD_TOKEN_HALT)) { 517 ehci_writeback_async_complete_packet(p); 518 return; 519 } 520 trace_usb_ehci_packet_action(p->queue, p, "free"); 521 if (p->async == EHCI_ASYNC_INFLIGHT) { 522 usb_cancel_packet(&p->packet); 523 } 524 if (p->async == EHCI_ASYNC_FINISHED && 525 p->packet.status == USB_RET_SUCCESS) { 526 fprintf(stderr, 527 "EHCI: Dropping completed packet from halted %s ep %02X\n", 528 (p->pid == USB_TOKEN_IN) ? "in" : "out", 529 get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); 530 } 531 if (p->async != EHCI_ASYNC_NONE) { 532 usb_packet_unmap(&p->packet, &p->sgl); 533 qemu_sglist_destroy(&p->sgl); 534 } 535 QTAILQ_REMOVE(&p->queue->packets, p, next); 536 usb_packet_cleanup(&p->packet); 537 g_free(p); 538 } 539 540 /* queue management */ 541 542 static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async) 543 { 544 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 545 EHCIQueue *q; 546 547 q = g_malloc0(sizeof(*q)); 548 q->ehci = ehci; 549 q->qhaddr = addr; 550 q->async = async; 551 QTAILQ_INIT(&q->packets); 552 QTAILQ_INSERT_HEAD(head, q, next); 553 trace_usb_ehci_queue_action(q, "alloc"); 554 return q; 555 } 556 557 static void ehci_queue_stopped(EHCIQueue *q) 558 { 559 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP); 560 561 if (!q->last_pid || !q->dev) { 562 return; 563 } 564 565 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp)); 566 } 567 568 static int ehci_cancel_queue(EHCIQueue *q) 569 { 570 EHCIPacket *p; 571 int packets = 0; 572 573 p = QTAILQ_FIRST(&q->packets); 574 if (p == NULL) { 575 goto leave; 576 } 577 578 trace_usb_ehci_queue_action(q, "cancel"); 579 do { 580 ehci_free_packet(p); 581 packets++; 582 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL); 583 584 leave: 585 ehci_queue_stopped(q); 586 return packets; 587 } 588 589 static int ehci_reset_queue(EHCIQueue *q) 590 { 591 int packets; 592 593 trace_usb_ehci_queue_action(q, "reset"); 594 packets = ehci_cancel_queue(q); 595 q->dev = NULL; 596 q->qtdaddr = 0; 597 q->last_pid = 0; 598 return packets; 599 } 600 601 static void ehci_free_queue(EHCIQueue *q, const char *warn) 602 { 603 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues; 604 int cancelled; 605 606 trace_usb_ehci_queue_action(q, "free"); 607 cancelled = ehci_cancel_queue(q); 608 if (warn && cancelled > 0) { 609 ehci_trace_guest_bug(q->ehci, warn); 610 } 611 QTAILQ_REMOVE(head, q, next); 612 g_free(q); 613 } 614 615 static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr, 616 int async) 617 { 618 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 619 EHCIQueue *q; 620 621 QTAILQ_FOREACH(q, head, next) { 622 if (addr == q->qhaddr) { 623 return q; 624 } 625 } 626 return NULL; 627 } 628 629 static void ehci_queues_rip_unused(EHCIState *ehci, int async) 630 { 631 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 632 const char *warn = async ? "guest unlinked busy QH" : NULL; 633 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4; 634 EHCIQueue *q, *tmp; 635 636 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 637 if (q->seen) { 638 q->seen = 0; 639 q->ts = ehci->last_run_ns; 640 continue; 641 } 642 if (ehci->last_run_ns < q->ts + maxage) { 643 continue; 644 } 645 ehci_free_queue(q, warn); 646 } 647 } 648 649 static void ehci_queues_rip_unseen(EHCIState *ehci, int async) 650 { 651 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 652 EHCIQueue *q, *tmp; 653 654 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 655 if (!q->seen) { 656 ehci_free_queue(q, NULL); 657 } 658 } 659 } 660 661 static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async) 662 { 663 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 664 EHCIQueue *q, *tmp; 665 666 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 667 if (q->dev != dev) { 668 continue; 669 } 670 ehci_free_queue(q, NULL); 671 } 672 } 673 674 static void ehci_queues_rip_all(EHCIState *ehci, int async) 675 { 676 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues; 677 const char *warn = async ? "guest stopped busy async schedule" : NULL; 678 EHCIQueue *q, *tmp; 679 680 QTAILQ_FOREACH_SAFE(q, head, next, tmp) { 681 ehci_free_queue(q, warn); 682 } 683 } 684 685 /* Attach or detach a device on root hub */ 686 687 static void ehci_attach(USBPort *port) 688 { 689 EHCIState *s = port->opaque; 690 uint32_t *portsc = &s->portsc[port->index]; 691 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 692 693 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc); 694 695 if (*portsc & PORTSC_POWNER) { 696 USBPort *companion = s->companion_ports[port->index]; 697 companion->dev = port->dev; 698 companion->ops->attach(companion); 699 return; 700 } 701 702 *portsc |= PORTSC_CONNECT; 703 *portsc |= PORTSC_CSC; 704 705 ehci_raise_irq(s, USBSTS_PCD); 706 } 707 708 static void ehci_detach(USBPort *port) 709 { 710 EHCIState *s = port->opaque; 711 uint32_t *portsc = &s->portsc[port->index]; 712 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci"; 713 714 trace_usb_ehci_port_detach(port->index, owner); 715 716 if (*portsc & PORTSC_POWNER) { 717 USBPort *companion = s->companion_ports[port->index]; 718 companion->ops->detach(companion); 719 companion->dev = NULL; 720 /* 721 * EHCI spec 4.2.2: "When a disconnect occurs... On the event, 722 * the port ownership is returned immediately to the EHCI controller." 723 */ 724 *portsc &= ~PORTSC_POWNER; 725 return; 726 } 727 728 ehci_queues_rip_device(s, port->dev, 0); 729 ehci_queues_rip_device(s, port->dev, 1); 730 731 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); 732 *portsc |= PORTSC_CSC; 733 734 ehci_raise_irq(s, USBSTS_PCD); 735 } 736 737 static void ehci_child_detach(USBPort *port, USBDevice *child) 738 { 739 EHCIState *s = port->opaque; 740 uint32_t portsc = s->portsc[port->index]; 741 742 if (portsc & PORTSC_POWNER) { 743 USBPort *companion = s->companion_ports[port->index]; 744 companion->ops->child_detach(companion, child); 745 return; 746 } 747 748 ehci_queues_rip_device(s, child, 0); 749 ehci_queues_rip_device(s, child, 1); 750 } 751 752 static void ehci_wakeup(USBPort *port) 753 { 754 EHCIState *s = port->opaque; 755 uint32_t *portsc = &s->portsc[port->index]; 756 757 if (*portsc & PORTSC_POWNER) { 758 USBPort *companion = s->companion_ports[port->index]; 759 if (companion->ops->wakeup) { 760 companion->ops->wakeup(companion); 761 } 762 return; 763 } 764 765 if (*portsc & PORTSC_SUSPEND) { 766 trace_usb_ehci_port_wakeup(port->index); 767 *portsc |= PORTSC_FPRES; 768 ehci_raise_irq(s, USBSTS_PCD); 769 } 770 771 qemu_bh_schedule(s->async_bh); 772 } 773 774 static void ehci_register_companion(USBBus *bus, USBPort *ports[], 775 uint32_t portcount, uint32_t firstport, 776 Error **errp) 777 { 778 EHCIState *s = container_of(bus, EHCIState, bus); 779 uint32_t i; 780 781 if (firstport + portcount > NB_PORTS) { 782 error_setg(errp, "firstport must be between 0 and %u", 783 NB_PORTS - portcount); 784 return; 785 } 786 787 for (i = 0; i < portcount; i++) { 788 if (s->companion_ports[firstport + i]) { 789 error_setg(errp, "firstport %u asks for ports %u-%u," 790 " but port %u has a companion assigned already", 791 firstport, firstport, firstport + portcount - 1, 792 firstport + i); 793 return; 794 } 795 } 796 797 for (i = 0; i < portcount; i++) { 798 s->companion_ports[firstport + i] = ports[i]; 799 s->ports[firstport + i].speedmask |= 800 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL; 801 /* Ensure devs attached before the initial reset go to the companion */ 802 s->portsc[firstport + i] = PORTSC_POWNER; 803 } 804 805 s->companion_count++; 806 s->caps[0x05] = (s->companion_count << 4) | portcount; 807 } 808 809 static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep, 810 unsigned int stream) 811 { 812 EHCIState *s = container_of(bus, EHCIState, bus); 813 uint32_t portsc = s->portsc[ep->dev->port->index]; 814 815 if (portsc & PORTSC_POWNER) { 816 return; 817 } 818 819 s->periodic_sched_active = PERIODIC_ACTIVE; 820 qemu_bh_schedule(s->async_bh); 821 } 822 823 static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) 824 { 825 USBDevice *dev; 826 USBPort *port; 827 int i; 828 829 for (i = 0; i < NB_PORTS; i++) { 830 port = &ehci->ports[i]; 831 if (!(ehci->portsc[i] & PORTSC_PED)) { 832 DPRINTF("Port %d not enabled\n", i); 833 continue; 834 } 835 dev = usb_find_device(port, addr); 836 if (dev != NULL) { 837 return dev; 838 } 839 } 840 return NULL; 841 } 842 843 /* 4.1 host controller initialization */ 844 void ehci_reset(void *opaque) 845 { 846 EHCIState *s = opaque; 847 int i; 848 USBDevice *devs[NB_PORTS]; 849 850 trace_usb_ehci_reset(); 851 852 /* 853 * Do the detach before touching portsc, so that it correctly gets send to 854 * us or to our companion based on PORTSC_POWNER before the reset. 855 */ 856 for(i = 0; i < NB_PORTS; i++) { 857 devs[i] = s->ports[i].dev; 858 if (devs[i] && devs[i]->attached) { 859 usb_detach(&s->ports[i]); 860 } 861 } 862 863 memset(&s->opreg, 0x00, sizeof(s->opreg)); 864 memset(&s->portsc, 0x00, sizeof(s->portsc)); 865 866 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH; 867 s->usbsts = USBSTS_HALT; 868 s->usbsts_pending = 0; 869 s->usbsts_frindex = 0; 870 ehci_update_irq(s); 871 872 s->astate = EST_INACTIVE; 873 s->pstate = EST_INACTIVE; 874 875 for(i = 0; i < NB_PORTS; i++) { 876 if (s->companion_ports[i]) { 877 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; 878 } else { 879 s->portsc[i] = PORTSC_PPOWER; 880 } 881 if (devs[i] && devs[i]->attached) { 882 usb_attach(&s->ports[i]); 883 usb_device_reset(devs[i]); 884 } 885 } 886 ehci_queues_rip_all(s, 0); 887 ehci_queues_rip_all(s, 1); 888 timer_del(s->frame_timer); 889 qemu_bh_cancel(s->async_bh); 890 } 891 892 static uint64_t ehci_caps_read(void *ptr, hwaddr addr, 893 unsigned size) 894 { 895 EHCIState *s = ptr; 896 return s->caps[addr]; 897 } 898 899 static uint64_t ehci_opreg_read(void *ptr, hwaddr addr, 900 unsigned size) 901 { 902 EHCIState *s = ptr; 903 uint32_t val; 904 905 switch (addr) { 906 case FRINDEX: 907 /* Round down to mult of 8, else it can go backwards on migration */ 908 val = s->frindex & ~7; 909 break; 910 default: 911 val = s->opreg[addr >> 2]; 912 } 913 914 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val); 915 return val; 916 } 917 918 static uint64_t ehci_port_read(void *ptr, hwaddr addr, 919 unsigned size) 920 { 921 EHCIState *s = ptr; 922 uint32_t val; 923 924 val = s->portsc[addr >> 2]; 925 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val); 926 return val; 927 } 928 929 static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) 930 { 931 USBDevice *dev = s->ports[port].dev; 932 uint32_t *portsc = &s->portsc[port]; 933 uint32_t orig; 934 935 if (s->companion_ports[port] == NULL) 936 return; 937 938 owner = owner & PORTSC_POWNER; 939 orig = *portsc & PORTSC_POWNER; 940 941 if (!(owner ^ orig)) { 942 return; 943 } 944 945 if (dev && dev->attached) { 946 usb_detach(&s->ports[port]); 947 } 948 949 *portsc &= ~PORTSC_POWNER; 950 *portsc |= owner; 951 952 if (dev && dev->attached) { 953 usb_attach(&s->ports[port]); 954 } 955 } 956 957 static void ehci_port_write(void *ptr, hwaddr addr, 958 uint64_t val, unsigned size) 959 { 960 EHCIState *s = ptr; 961 int port = addr >> 2; 962 uint32_t *portsc = &s->portsc[port]; 963 uint32_t old = *portsc; 964 USBDevice *dev = s->ports[port].dev; 965 966 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val); 967 968 /* Clear rwc bits */ 969 *portsc &= ~(val & PORTSC_RWC_MASK); 970 /* The guest may clear, but not set the PED bit */ 971 *portsc &= val | ~PORTSC_PED; 972 /* POWNER is masked out by RO_MASK as it is RO when we've no companion */ 973 handle_port_owner_write(s, port, val); 974 /* And finally apply RO_MASK */ 975 val &= PORTSC_RO_MASK; 976 977 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) { 978 trace_usb_ehci_port_reset(port, 1); 979 } 980 981 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { 982 trace_usb_ehci_port_reset(port, 0); 983 if (dev && dev->attached) { 984 usb_port_reset(&s->ports[port]); 985 *portsc &= ~PORTSC_CSC; 986 } 987 988 /* 989 * Table 2.16 Set the enable bit(and enable bit change) to indicate 990 * to SW that this port has a high speed device attached 991 */ 992 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) { 993 val |= PORTSC_PED; 994 } 995 } 996 997 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) { 998 trace_usb_ehci_port_suspend(port); 999 } 1000 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) { 1001 trace_usb_ehci_port_resume(port); 1002 val &= ~PORTSC_SUSPEND; 1003 } 1004 1005 *portsc &= ~PORTSC_RO_MASK; 1006 *portsc |= val; 1007 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old); 1008 } 1009 1010 static void ehci_opreg_write(void *ptr, hwaddr addr, 1011 uint64_t val, unsigned size) 1012 { 1013 EHCIState *s = ptr; 1014 uint32_t *mmio = s->opreg + (addr >> 2); 1015 uint32_t old = *mmio; 1016 int i; 1017 1018 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val); 1019 1020 switch (addr) { 1021 case USBCMD: 1022 if (val & USBCMD_HCRESET) { 1023 ehci_reset(s); 1024 val = s->usbcmd; 1025 break; 1026 } 1027 1028 /* not supporting dynamic frame list size at the moment */ 1029 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { 1030 fprintf(stderr, "attempt to set frame list size -- value %d\n", 1031 (int)val & USBCMD_FLS); 1032 val &= ~USBCMD_FLS; 1033 } 1034 1035 if (val & USBCMD_IAAD) { 1036 /* 1037 * Process IAAD immediately, otherwise the Linux IAAD watchdog may 1038 * trigger and re-use a qh without us seeing the unlink. 1039 */ 1040 s->async_stepdown = 0; 1041 qemu_bh_schedule(s->async_bh); 1042 trace_usb_ehci_doorbell_ring(); 1043 } 1044 1045 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) != 1046 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) { 1047 if (s->pstate == EST_INACTIVE) { 1048 SET_LAST_RUN_CLOCK(s); 1049 } 1050 s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */ 1051 ehci_update_halt(s); 1052 s->async_stepdown = 0; 1053 qemu_bh_schedule(s->async_bh); 1054 } 1055 break; 1056 1057 case USBSTS: 1058 val &= USBSTS_RO_MASK; // bits 6 through 31 are RO 1059 ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC 1060 val = s->usbsts; 1061 ehci_update_irq(s); 1062 break; 1063 1064 case USBINTR: 1065 val &= USBINTR_MASK; 1066 if (ehci_enabled(s) && (USBSTS_FLR & val)) { 1067 qemu_bh_schedule(s->async_bh); 1068 } 1069 break; 1070 1071 case FRINDEX: 1072 val &= 0x00003fff; /* frindex is 14bits */ 1073 s->usbsts_frindex = val; 1074 break; 1075 1076 case CONFIGFLAG: 1077 val &= 0x1; 1078 if (val) { 1079 for(i = 0; i < NB_PORTS; i++) 1080 handle_port_owner_write(s, i, 0); 1081 } 1082 break; 1083 1084 case PERIODICLISTBASE: 1085 if (ehci_periodic_enabled(s)) { 1086 fprintf(stderr, 1087 "ehci: PERIODIC list base register set while periodic schedule\n" 1088 " is enabled and HC is enabled\n"); 1089 } 1090 break; 1091 1092 case ASYNCLISTADDR: 1093 if (ehci_async_enabled(s)) { 1094 fprintf(stderr, 1095 "ehci: ASYNC list address register set while async schedule\n" 1096 " is enabled and HC is enabled\n"); 1097 } 1098 break; 1099 } 1100 1101 *mmio = val; 1102 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr), 1103 *mmio, old); 1104 } 1105 1106 /* 1107 * Write the qh back to guest physical memory. This step isn't 1108 * in the EHCI spec but we need to do it since we don't share 1109 * physical memory with our guest VM. 1110 * 1111 * The first three dwords are read-only for the EHCI, so skip them 1112 * when writing back the qh. 1113 */ 1114 static void ehci_flush_qh(EHCIQueue *q) 1115 { 1116 uint32_t *qh = (uint32_t *) &q->qh; 1117 uint32_t dwords = sizeof(EHCIqh) >> 2; 1118 uint32_t addr = NLPTR_GET(q->qhaddr); 1119 1120 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); 1121 } 1122 1123 // 4.10.2 1124 1125 static int ehci_qh_do_overlay(EHCIQueue *q) 1126 { 1127 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1128 int i; 1129 int dtoggle; 1130 int ping; 1131 int eps; 1132 int reload; 1133 1134 assert(p != NULL); 1135 assert(p->qtdaddr == q->qtdaddr); 1136 1137 // remember values in fields to preserve in qh after overlay 1138 1139 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; 1140 ping = q->qh.token & QTD_TOKEN_PING; 1141 1142 q->qh.current_qtd = p->qtdaddr; 1143 q->qh.next_qtd = p->qtd.next; 1144 q->qh.altnext_qtd = p->qtd.altnext; 1145 q->qh.token = p->qtd.token; 1146 1147 1148 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); 1149 if (eps == EHCI_QH_EPS_HIGH) { 1150 q->qh.token &= ~QTD_TOKEN_PING; 1151 q->qh.token |= ping; 1152 } 1153 1154 reload = get_field(q->qh.epchar, QH_EPCHAR_RL); 1155 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); 1156 1157 for (i = 0; i < 5; i++) { 1158 q->qh.bufptr[i] = p->qtd.bufptr[i]; 1159 } 1160 1161 if (!(q->qh.epchar & QH_EPCHAR_DTC)) { 1162 // preserve QH DT bit 1163 q->qh.token &= ~QTD_TOKEN_DTOGGLE; 1164 q->qh.token |= dtoggle; 1165 } 1166 1167 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; 1168 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; 1169 1170 ehci_flush_qh(q); 1171 1172 return 0; 1173 } 1174 1175 static int ehci_init_transfer(EHCIPacket *p) 1176 { 1177 uint32_t cpage, offset, bytes, plen; 1178 dma_addr_t page; 1179 1180 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); 1181 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); 1182 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; 1183 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as); 1184 1185 while (bytes > 0) { 1186 if (cpage > 4) { 1187 fprintf(stderr, "cpage out of range (%d)\n", cpage); 1188 return -1; 1189 } 1190 1191 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; 1192 page += offset; 1193 plen = bytes; 1194 if (plen > 4096 - offset) { 1195 plen = 4096 - offset; 1196 offset = 0; 1197 cpage++; 1198 } 1199 1200 qemu_sglist_add(&p->sgl, page, plen); 1201 bytes -= plen; 1202 } 1203 return 0; 1204 } 1205 1206 static void ehci_finish_transfer(EHCIQueue *q, int len) 1207 { 1208 uint32_t cpage, offset; 1209 1210 if (len > 0) { 1211 /* update cpage & offset */ 1212 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE); 1213 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK; 1214 1215 offset += len; 1216 cpage += offset >> QTD_BUFPTR_SH; 1217 offset &= ~QTD_BUFPTR_MASK; 1218 1219 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE); 1220 q->qh.bufptr[0] &= QTD_BUFPTR_MASK; 1221 q->qh.bufptr[0] |= offset; 1222 } 1223 } 1224 1225 static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) 1226 { 1227 EHCIPacket *p; 1228 EHCIState *s = port->opaque; 1229 uint32_t portsc = s->portsc[port->index]; 1230 1231 if (portsc & PORTSC_POWNER) { 1232 USBPort *companion = s->companion_ports[port->index]; 1233 companion->ops->complete(companion, packet); 1234 return; 1235 } 1236 1237 p = container_of(packet, EHCIPacket, packet); 1238 assert(p->async == EHCI_ASYNC_INFLIGHT); 1239 1240 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) { 1241 trace_usb_ehci_packet_action(p->queue, p, "remove"); 1242 ehci_free_packet(p); 1243 return; 1244 } 1245 1246 trace_usb_ehci_packet_action(p->queue, p, "wakeup"); 1247 p->async = EHCI_ASYNC_FINISHED; 1248 1249 if (!p->queue->async) { 1250 s->periodic_sched_active = PERIODIC_ACTIVE; 1251 } 1252 qemu_bh_schedule(s->async_bh); 1253 } 1254 1255 static void ehci_execute_complete(EHCIQueue *q) 1256 { 1257 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1258 uint32_t tbytes; 1259 1260 assert(p != NULL); 1261 assert(p->qtdaddr == q->qtdaddr); 1262 assert(p->async == EHCI_ASYNC_INITIALIZED || 1263 p->async == EHCI_ASYNC_FINISHED); 1264 1265 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " 1266 "status %d, actual_length %d\n", 1267 q->qhaddr, q->qh.next, q->qtdaddr, 1268 p->packet.status, p->packet.actual_length); 1269 1270 switch (p->packet.status) { 1271 case USB_RET_SUCCESS: 1272 break; 1273 case USB_RET_IOERROR: 1274 case USB_RET_NODEV: 1275 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR); 1276 set_field(&q->qh.token, 0, QTD_TOKEN_CERR); 1277 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1278 break; 1279 case USB_RET_STALL: 1280 q->qh.token |= QTD_TOKEN_HALT; 1281 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1282 break; 1283 case USB_RET_NAK: 1284 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT); 1285 return; /* We're not done yet with this transaction */ 1286 case USB_RET_BABBLE: 1287 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE); 1288 ehci_raise_irq(q->ehci, USBSTS_ERRINT); 1289 break; 1290 default: 1291 /* should not be triggerable */ 1292 fprintf(stderr, "USB invalid response %d\n", p->packet.status); 1293 g_assert_not_reached(); 1294 break; 1295 } 1296 1297 /* TODO check 4.12 for splits */ 1298 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES); 1299 if (tbytes && p->pid == USB_TOKEN_IN) { 1300 tbytes -= p->packet.actual_length; 1301 if (tbytes) { 1302 /* 4.15.1.2 must raise int on a short input packet */ 1303 ehci_raise_irq(q->ehci, USBSTS_INT); 1304 if (q->async) { 1305 q->ehci->int_req_by_async = true; 1306 } 1307 } 1308 } else { 1309 tbytes = 0; 1310 } 1311 DPRINTF("updating tbytes to %d\n", tbytes); 1312 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); 1313 1314 ehci_finish_transfer(q, p->packet.actual_length); 1315 usb_packet_unmap(&p->packet, &p->sgl); 1316 qemu_sglist_destroy(&p->sgl); 1317 p->async = EHCI_ASYNC_NONE; 1318 1319 q->qh.token ^= QTD_TOKEN_DTOGGLE; 1320 q->qh.token &= ~QTD_TOKEN_ACTIVE; 1321 1322 if (q->qh.token & QTD_TOKEN_IOC) { 1323 ehci_raise_irq(q->ehci, USBSTS_INT); 1324 if (q->async) { 1325 q->ehci->int_req_by_async = true; 1326 } 1327 } 1328 } 1329 1330 /* 4.10.3 returns "again" */ 1331 static int ehci_execute(EHCIPacket *p, const char *action) 1332 { 1333 USBEndpoint *ep; 1334 int endp; 1335 bool spd; 1336 1337 assert(p->async == EHCI_ASYNC_NONE || 1338 p->async == EHCI_ASYNC_INITIALIZED); 1339 1340 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { 1341 fprintf(stderr, "Attempting to execute inactive qtd\n"); 1342 return -1; 1343 } 1344 1345 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) { 1346 ehci_trace_guest_bug(p->queue->ehci, 1347 "guest requested more bytes than allowed"); 1348 return -1; 1349 } 1350 1351 if (!ehci_verify_pid(p->queue, &p->qtd)) { 1352 ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */ 1353 } 1354 p->pid = ehci_get_pid(&p->qtd); 1355 p->queue->last_pid = p->pid; 1356 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP); 1357 ep = usb_ep_get(p->queue->dev, p->pid, endp); 1358 1359 if (p->async == EHCI_ASYNC_NONE) { 1360 if (ehci_init_transfer(p) != 0) { 1361 return -1; 1362 } 1363 1364 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0); 1365 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd, 1366 (p->qtd.token & QTD_TOKEN_IOC) != 0); 1367 usb_packet_map(&p->packet, &p->sgl); 1368 p->async = EHCI_ASYNC_INITIALIZED; 1369 } 1370 1371 trace_usb_ehci_packet_action(p->queue, p, action); 1372 usb_handle_packet(p->queue->dev, &p->packet); 1373 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " 1374 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, 1375 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, 1376 p->packet.actual_length); 1377 1378 if (p->packet.actual_length > BUFF_SIZE) { 1379 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); 1380 return -1; 1381 } 1382 1383 return 1; 1384 } 1385 1386 /* 4.7.2 1387 */ 1388 1389 static int ehci_process_itd(EHCIState *ehci, 1390 EHCIitd *itd, 1391 uint32_t addr) 1392 { 1393 USBDevice *dev; 1394 USBEndpoint *ep; 1395 uint32_t i, len, pid, dir, devaddr, endp, xfers = 0; 1396 uint32_t pg, off, ptr1, ptr2, max, mult; 1397 1398 ehci->periodic_sched_active = PERIODIC_ACTIVE; 1399 1400 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); 1401 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); 1402 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); 1403 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); 1404 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); 1405 1406 for(i = 0; i < 8; i++) { 1407 if (itd->transact[i] & ITD_XACT_ACTIVE) { 1408 pg = get_field(itd->transact[i], ITD_XACT_PGSEL); 1409 off = itd->transact[i] & ITD_XACT_OFFSET_MASK; 1410 len = get_field(itd->transact[i], ITD_XACT_LENGTH); 1411 1412 if (len > max * mult) { 1413 len = max * mult; 1414 } 1415 if (len > BUFF_SIZE || pg > 6) { 1416 return -1; 1417 } 1418 1419 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); 1420 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); 1421 if (off + len > 4096) { 1422 /* transfer crosses page border */ 1423 if (pg == 6) { 1424 return -1; /* avoid page pg + 1 */ 1425 } 1426 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); 1427 uint32_t len2 = off + len - 4096; 1428 uint32_t len1 = len - len2; 1429 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); 1430 qemu_sglist_add(&ehci->isgl, ptr2, len2); 1431 } else { 1432 qemu_sglist_add(&ehci->isgl, ptr1 + off, len); 1433 } 1434 1435 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT; 1436 1437 dev = ehci_find_device(ehci, devaddr); 1438 ep = usb_ep_get(dev, pid, endp); 1439 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) { 1440 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false, 1441 (itd->transact[i] & ITD_XACT_IOC) != 0); 1442 usb_packet_map(&ehci->ipacket, &ehci->isgl); 1443 usb_handle_packet(dev, &ehci->ipacket); 1444 usb_packet_unmap(&ehci->ipacket, &ehci->isgl); 1445 } else { 1446 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n"); 1447 ehci->ipacket.status = USB_RET_NAK; 1448 ehci->ipacket.actual_length = 0; 1449 } 1450 qemu_sglist_destroy(&ehci->isgl); 1451 1452 switch (ehci->ipacket.status) { 1453 case USB_RET_SUCCESS: 1454 break; 1455 default: 1456 fprintf(stderr, "Unexpected iso usb result: %d\n", 1457 ehci->ipacket.status); 1458 /* Fall through */ 1459 case USB_RET_IOERROR: 1460 case USB_RET_NODEV: 1461 /* 3.3.2: XACTERR is only allowed on IN transactions */ 1462 if (dir) { 1463 itd->transact[i] |= ITD_XACT_XACTERR; 1464 ehci_raise_irq(ehci, USBSTS_ERRINT); 1465 } 1466 break; 1467 case USB_RET_BABBLE: 1468 itd->transact[i] |= ITD_XACT_BABBLE; 1469 ehci_raise_irq(ehci, USBSTS_ERRINT); 1470 break; 1471 case USB_RET_NAK: 1472 /* no data for us, so do a zero-length transfer */ 1473 ehci->ipacket.actual_length = 0; 1474 break; 1475 } 1476 if (!dir) { 1477 set_field(&itd->transact[i], len - ehci->ipacket.actual_length, 1478 ITD_XACT_LENGTH); /* OUT */ 1479 } else { 1480 set_field(&itd->transact[i], ehci->ipacket.actual_length, 1481 ITD_XACT_LENGTH); /* IN */ 1482 } 1483 if (itd->transact[i] & ITD_XACT_IOC) { 1484 ehci_raise_irq(ehci, USBSTS_INT); 1485 } 1486 itd->transact[i] &= ~ITD_XACT_ACTIVE; 1487 xfers++; 1488 } 1489 } 1490 return xfers ? 0 : -1; 1491 } 1492 1493 1494 /* This state is the entry point for asynchronous schedule 1495 * processing. Entry here consitutes a EHCI start event state (4.8.5) 1496 */ 1497 static int ehci_state_waitlisthead(EHCIState *ehci, int async) 1498 { 1499 EHCIqh qh; 1500 int i = 0; 1501 int again = 0; 1502 uint32_t entry = ehci->asynclistaddr; 1503 1504 /* set reclamation flag at start event (4.8.6) */ 1505 if (async) { 1506 ehci_set_usbsts(ehci, USBSTS_REC); 1507 } 1508 1509 ehci_queues_rip_unused(ehci, async); 1510 1511 /* Find the head of the list (4.9.1.1) */ 1512 for(i = 0; i < MAX_QH; i++) { 1513 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, 1514 sizeof(EHCIqh) >> 2) < 0) { 1515 return 0; 1516 } 1517 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh); 1518 1519 if (qh.epchar & QH_EPCHAR_H) { 1520 if (async) { 1521 entry |= (NLPTR_TYPE_QH << 1); 1522 } 1523 1524 ehci_set_fetch_addr(ehci, async, entry); 1525 ehci_set_state(ehci, async, EST_FETCHENTRY); 1526 again = 1; 1527 goto out; 1528 } 1529 1530 entry = qh.next; 1531 if (entry == ehci->asynclistaddr) { 1532 break; 1533 } 1534 } 1535 1536 /* no head found for list. */ 1537 1538 ehci_set_state(ehci, async, EST_ACTIVE); 1539 1540 out: 1541 return again; 1542 } 1543 1544 1545 /* This state is the entry point for periodic schedule processing as 1546 * well as being a continuation state for async processing. 1547 */ 1548 static int ehci_state_fetchentry(EHCIState *ehci, int async) 1549 { 1550 int again = 0; 1551 uint32_t entry = ehci_get_fetch_addr(ehci, async); 1552 1553 if (NLPTR_TBIT(entry)) { 1554 ehci_set_state(ehci, async, EST_ACTIVE); 1555 goto out; 1556 } 1557 1558 /* section 4.8, only QH in async schedule */ 1559 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { 1560 fprintf(stderr, "non queue head request in async schedule\n"); 1561 return -1; 1562 } 1563 1564 switch (NLPTR_TYPE_GET(entry)) { 1565 case NLPTR_TYPE_QH: 1566 ehci_set_state(ehci, async, EST_FETCHQH); 1567 again = 1; 1568 break; 1569 1570 case NLPTR_TYPE_ITD: 1571 ehci_set_state(ehci, async, EST_FETCHITD); 1572 again = 1; 1573 break; 1574 1575 case NLPTR_TYPE_STITD: 1576 ehci_set_state(ehci, async, EST_FETCHSITD); 1577 again = 1; 1578 break; 1579 1580 default: 1581 /* TODO: handle FSTN type */ 1582 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d " 1583 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); 1584 return -1; 1585 } 1586 1587 out: 1588 return again; 1589 } 1590 1591 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) 1592 { 1593 uint32_t entry; 1594 EHCIQueue *q; 1595 EHCIqh qh; 1596 1597 entry = ehci_get_fetch_addr(ehci, async); 1598 q = ehci_find_queue_by_qh(ehci, entry, async); 1599 if (q == NULL) { 1600 q = ehci_alloc_queue(ehci, entry, async); 1601 } 1602 1603 q->seen++; 1604 if (q->seen > 1) { 1605 /* we are going in circles -- stop processing */ 1606 ehci_set_state(ehci, async, EST_ACTIVE); 1607 q = NULL; 1608 goto out; 1609 } 1610 1611 if (get_dwords(ehci, NLPTR_GET(q->qhaddr), 1612 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { 1613 q = NULL; 1614 goto out; 1615 } 1616 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh); 1617 1618 /* 1619 * The overlay area of the qh should never be changed by the guest, 1620 * except when idle, in which case the reset is a nop. 1621 */ 1622 if (!ehci_verify_qh(q, &qh)) { 1623 if (ehci_reset_queue(q) > 0) { 1624 ehci_trace_guest_bug(ehci, "guest updated active QH"); 1625 } 1626 } 1627 q->qh = qh; 1628 1629 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT); 1630 if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */ 1631 q->transact_ctr = 4; 1632 } 1633 1634 if (q->dev == NULL) { 1635 q->dev = ehci_find_device(q->ehci, 1636 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)); 1637 } 1638 1639 if (async && (q->qh.epchar & QH_EPCHAR_H)) { 1640 1641 /* EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */ 1642 if (ehci->usbsts & USBSTS_REC) { 1643 ehci_clear_usbsts(ehci, USBSTS_REC); 1644 } else { 1645 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" 1646 " - done processing\n", q->qhaddr); 1647 ehci_set_state(ehci, async, EST_ACTIVE); 1648 q = NULL; 1649 goto out; 1650 } 1651 } 1652 1653 #if EHCI_DEBUG 1654 if (q->qhaddr != q->qh.next) { 1655 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", 1656 q->qhaddr, 1657 q->qh.epchar & QH_EPCHAR_H, 1658 q->qh.token & QTD_TOKEN_HALT, 1659 q->qh.token & QTD_TOKEN_ACTIVE, 1660 q->qh.next); 1661 } 1662 #endif 1663 1664 if (q->qh.token & QTD_TOKEN_HALT) { 1665 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1666 1667 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) && 1668 (NLPTR_TBIT(q->qh.current_qtd) == 0)) { 1669 q->qtdaddr = q->qh.current_qtd; 1670 ehci_set_state(ehci, async, EST_FETCHQTD); 1671 1672 } else { 1673 /* EHCI spec version 1.0 Section 4.10.2 */ 1674 ehci_set_state(ehci, async, EST_ADVANCEQUEUE); 1675 } 1676 1677 out: 1678 return q; 1679 } 1680 1681 static int ehci_state_fetchitd(EHCIState *ehci, int async) 1682 { 1683 uint32_t entry; 1684 EHCIitd itd; 1685 1686 assert(!async); 1687 entry = ehci_get_fetch_addr(ehci, async); 1688 1689 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1690 sizeof(EHCIitd) >> 2) < 0) { 1691 return -1; 1692 } 1693 ehci_trace_itd(ehci, entry, &itd); 1694 1695 if (ehci_process_itd(ehci, &itd, entry) != 0) { 1696 return -1; 1697 } 1698 1699 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd, 1700 sizeof(EHCIitd) >> 2); 1701 ehci_set_fetch_addr(ehci, async, itd.next); 1702 ehci_set_state(ehci, async, EST_FETCHENTRY); 1703 1704 return 1; 1705 } 1706 1707 static int ehci_state_fetchsitd(EHCIState *ehci, int async) 1708 { 1709 uint32_t entry; 1710 EHCIsitd sitd; 1711 1712 assert(!async); 1713 entry = ehci_get_fetch_addr(ehci, async); 1714 1715 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd, 1716 sizeof(EHCIsitd) >> 2) < 0) { 1717 return 0; 1718 } 1719 ehci_trace_sitd(ehci, entry, &sitd); 1720 1721 if (!(sitd.results & SITD_RESULTS_ACTIVE)) { 1722 /* siTD is not active, nothing to do */; 1723 } else { 1724 /* TODO: split transfers are not implemented */ 1725 fprintf(stderr, "WARNING: Skipping active siTD\n"); 1726 } 1727 1728 ehci_set_fetch_addr(ehci, async, sitd.next); 1729 ehci_set_state(ehci, async, EST_FETCHENTRY); 1730 return 1; 1731 } 1732 1733 /* Section 4.10.2 - paragraph 3 */ 1734 static int ehci_state_advqueue(EHCIQueue *q) 1735 { 1736 #if 0 1737 /* TO-DO: 4.10.2 - paragraph 2 1738 * if I-bit is set to 1 and QH is not active 1739 * go to horizontal QH 1740 */ 1741 if (I-bit set) { 1742 ehci_set_state(ehci, async, EST_HORIZONTALQH); 1743 goto out; 1744 } 1745 #endif 1746 1747 /* 1748 * want data and alt-next qTD is valid 1749 */ 1750 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) && 1751 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) { 1752 q->qtdaddr = q->qh.altnext_qtd; 1753 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1754 1755 /* 1756 * next qTD is valid 1757 */ 1758 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) { 1759 q->qtdaddr = q->qh.next_qtd; 1760 ehci_set_state(q->ehci, q->async, EST_FETCHQTD); 1761 1762 /* 1763 * no valid qTD, try next QH 1764 */ 1765 } else { 1766 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1767 } 1768 1769 return 1; 1770 } 1771 1772 /* Section 4.10.2 - paragraph 4 */ 1773 static int ehci_state_fetchqtd(EHCIQueue *q) 1774 { 1775 EHCIqtd qtd; 1776 EHCIPacket *p; 1777 int again = 1; 1778 1779 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd, 1780 sizeof(EHCIqtd) >> 2) < 0) { 1781 return 0; 1782 } 1783 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd); 1784 1785 p = QTAILQ_FIRST(&q->packets); 1786 if (p != NULL) { 1787 if (!ehci_verify_qtd(p, &qtd)) { 1788 ehci_cancel_queue(q); 1789 if (qtd.token & QTD_TOKEN_ACTIVE) { 1790 ehci_trace_guest_bug(q->ehci, "guest updated active qTD"); 1791 } 1792 p = NULL; 1793 } else { 1794 p->qtd = qtd; 1795 ehci_qh_do_overlay(q); 1796 } 1797 } 1798 1799 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1800 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1801 } else if (p != NULL) { 1802 switch (p->async) { 1803 case EHCI_ASYNC_NONE: 1804 case EHCI_ASYNC_INITIALIZED: 1805 /* Not yet executed (MULT), or previously nacked (int) packet */ 1806 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1807 break; 1808 case EHCI_ASYNC_INFLIGHT: 1809 /* Check if the guest has added new tds to the queue */ 1810 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head)); 1811 /* Unfinished async handled packet, go horizontal */ 1812 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1813 break; 1814 case EHCI_ASYNC_FINISHED: 1815 /* Complete executing of the packet */ 1816 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1817 break; 1818 } 1819 } else { 1820 p = ehci_alloc_packet(q); 1821 p->qtdaddr = q->qtdaddr; 1822 p->qtd = qtd; 1823 ehci_set_state(q->ehci, q->async, EST_EXECUTE); 1824 } 1825 1826 return again; 1827 } 1828 1829 static int ehci_state_horizqh(EHCIQueue *q) 1830 { 1831 int again = 0; 1832 1833 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) { 1834 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next); 1835 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY); 1836 again = 1; 1837 } else { 1838 ehci_set_state(q->ehci, q->async, EST_ACTIVE); 1839 } 1840 1841 return again; 1842 } 1843 1844 /* Returns "again" */ 1845 static int ehci_fill_queue(EHCIPacket *p) 1846 { 1847 USBEndpoint *ep = p->packet.ep; 1848 EHCIQueue *q = p->queue; 1849 EHCIqtd qtd = p->qtd; 1850 uint32_t qtdaddr; 1851 1852 for (;;) { 1853 if (NLPTR_TBIT(qtd.next) != 0) { 1854 break; 1855 } 1856 qtdaddr = qtd.next; 1857 /* 1858 * Detect circular td lists, Windows creates these, counting on the 1859 * active bit going low after execution to make the queue stop. 1860 */ 1861 QTAILQ_FOREACH(p, &q->packets, next) { 1862 if (p->qtdaddr == qtdaddr) { 1863 goto leave; 1864 } 1865 } 1866 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr), 1867 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) { 1868 return -1; 1869 } 1870 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd); 1871 if (!(qtd.token & QTD_TOKEN_ACTIVE)) { 1872 break; 1873 } 1874 if (!ehci_verify_pid(q, &qtd)) { 1875 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid"); 1876 break; 1877 } 1878 p = ehci_alloc_packet(q); 1879 p->qtdaddr = qtdaddr; 1880 p->qtd = qtd; 1881 if (ehci_execute(p, "queue") == -1) { 1882 return -1; 1883 } 1884 assert(p->packet.status == USB_RET_ASYNC); 1885 p->async = EHCI_ASYNC_INFLIGHT; 1886 } 1887 leave: 1888 usb_device_flush_ep_queue(ep->dev, ep); 1889 return 1; 1890 } 1891 1892 static int ehci_state_execute(EHCIQueue *q) 1893 { 1894 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1895 int again = 0; 1896 1897 assert(p != NULL); 1898 assert(p->qtdaddr == q->qtdaddr); 1899 1900 if (ehci_qh_do_overlay(q) != 0) { 1901 return -1; 1902 } 1903 1904 // TODO verify enough time remains in the uframe as in 4.4.1.1 1905 // TODO write back ptr to async list when done or out of time 1906 1907 /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ 1908 if (!q->async && q->transact_ctr == 0) { 1909 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1910 again = 1; 1911 goto out; 1912 } 1913 1914 if (q->async) { 1915 ehci_set_usbsts(q->ehci, USBSTS_REC); 1916 } 1917 1918 again = ehci_execute(p, "process"); 1919 if (again == -1) { 1920 goto out; 1921 } 1922 if (p->packet.status == USB_RET_ASYNC) { 1923 ehci_flush_qh(q); 1924 trace_usb_ehci_packet_action(p->queue, p, "async"); 1925 p->async = EHCI_ASYNC_INFLIGHT; 1926 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1927 if (q->async) { 1928 again = ehci_fill_queue(p); 1929 } else { 1930 again = 1; 1931 } 1932 goto out; 1933 } 1934 1935 ehci_set_state(q->ehci, q->async, EST_EXECUTING); 1936 again = 1; 1937 1938 out: 1939 return again; 1940 } 1941 1942 static int ehci_state_executing(EHCIQueue *q) 1943 { 1944 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1945 1946 assert(p != NULL); 1947 assert(p->qtdaddr == q->qtdaddr); 1948 1949 ehci_execute_complete(q); 1950 1951 /* 4.10.3 */ 1952 if (!q->async && q->transact_ctr > 0) { 1953 q->transact_ctr--; 1954 } 1955 1956 /* 4.10.5 */ 1957 if (p->packet.status == USB_RET_NAK) { 1958 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1959 } else { 1960 ehci_set_state(q->ehci, q->async, EST_WRITEBACK); 1961 } 1962 1963 ehci_flush_qh(q); 1964 return 1; 1965 } 1966 1967 1968 static int ehci_state_writeback(EHCIQueue *q) 1969 { 1970 EHCIPacket *p = QTAILQ_FIRST(&q->packets); 1971 uint32_t *qtd, addr; 1972 int again = 0; 1973 1974 /* Write back the QTD from the QH area */ 1975 assert(p != NULL); 1976 assert(p->qtdaddr == q->qtdaddr); 1977 1978 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd); 1979 qtd = (uint32_t *) &q->qh.next_qtd; 1980 addr = NLPTR_GET(p->qtdaddr); 1981 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2); 1982 ehci_free_packet(p); 1983 1984 /* 1985 * EHCI specs say go horizontal here. 1986 * 1987 * We can also advance the queue here for performance reasons. We 1988 * need to take care to only take that shortcut in case we've 1989 * processed the qtd just written back without errors, i.e. halt 1990 * bit is clear. 1991 */ 1992 if (q->qh.token & QTD_TOKEN_HALT) { 1993 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); 1994 again = 1; 1995 } else { 1996 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE); 1997 again = 1; 1998 } 1999 return again; 2000 } 2001 2002 /* 2003 * This is the state machine that is common to both async and periodic 2004 */ 2005 2006 static void ehci_advance_state(EHCIState *ehci, int async) 2007 { 2008 EHCIQueue *q = NULL; 2009 int again; 2010 2011 do { 2012 switch(ehci_get_state(ehci, async)) { 2013 case EST_WAITLISTHEAD: 2014 again = ehci_state_waitlisthead(ehci, async); 2015 break; 2016 2017 case EST_FETCHENTRY: 2018 again = ehci_state_fetchentry(ehci, async); 2019 break; 2020 2021 case EST_FETCHQH: 2022 q = ehci_state_fetchqh(ehci, async); 2023 if (q != NULL) { 2024 assert(q->async == async); 2025 again = 1; 2026 } else { 2027 again = 0; 2028 } 2029 break; 2030 2031 case EST_FETCHITD: 2032 again = ehci_state_fetchitd(ehci, async); 2033 break; 2034 2035 case EST_FETCHSITD: 2036 again = ehci_state_fetchsitd(ehci, async); 2037 break; 2038 2039 case EST_ADVANCEQUEUE: 2040 assert(q != NULL); 2041 again = ehci_state_advqueue(q); 2042 break; 2043 2044 case EST_FETCHQTD: 2045 assert(q != NULL); 2046 again = ehci_state_fetchqtd(q); 2047 break; 2048 2049 case EST_HORIZONTALQH: 2050 assert(q != NULL); 2051 again = ehci_state_horizqh(q); 2052 break; 2053 2054 case EST_EXECUTE: 2055 assert(q != NULL); 2056 again = ehci_state_execute(q); 2057 if (async) { 2058 ehci->async_stepdown = 0; 2059 } 2060 break; 2061 2062 case EST_EXECUTING: 2063 assert(q != NULL); 2064 if (async) { 2065 ehci->async_stepdown = 0; 2066 } 2067 again = ehci_state_executing(q); 2068 break; 2069 2070 case EST_WRITEBACK: 2071 assert(q != NULL); 2072 again = ehci_state_writeback(q); 2073 if (!async) { 2074 ehci->periodic_sched_active = PERIODIC_ACTIVE; 2075 } 2076 break; 2077 2078 default: 2079 fprintf(stderr, "Bad state!\n"); 2080 again = -1; 2081 g_assert_not_reached(); 2082 break; 2083 } 2084 2085 if (again < 0) { 2086 fprintf(stderr, "processing error - resetting ehci HC\n"); 2087 ehci_reset(ehci); 2088 again = 0; 2089 } 2090 } 2091 while (again); 2092 } 2093 2094 static void ehci_advance_async_state(EHCIState *ehci) 2095 { 2096 const int async = 1; 2097 2098 switch(ehci_get_state(ehci, async)) { 2099 case EST_INACTIVE: 2100 if (!ehci_async_enabled(ehci)) { 2101 break; 2102 } 2103 ehci_set_state(ehci, async, EST_ACTIVE); 2104 // No break, fall through to ACTIVE 2105 2106 case EST_ACTIVE: 2107 if (!ehci_async_enabled(ehci)) { 2108 ehci_queues_rip_all(ehci, async); 2109 ehci_set_state(ehci, async, EST_INACTIVE); 2110 break; 2111 } 2112 2113 /* make sure guest has acknowledged the doorbell interrupt */ 2114 /* TO-DO: is this really needed? */ 2115 if (ehci->usbsts & USBSTS_IAA) { 2116 DPRINTF("IAA status bit still set.\n"); 2117 break; 2118 } 2119 2120 /* check that address register has been set */ 2121 if (ehci->asynclistaddr == 0) { 2122 break; 2123 } 2124 2125 ehci_set_state(ehci, async, EST_WAITLISTHEAD); 2126 ehci_advance_state(ehci, async); 2127 2128 /* If the doorbell is set, the guest wants to make a change to the 2129 * schedule. The host controller needs to release cached data. 2130 * (section 4.8.2) 2131 */ 2132 if (ehci->usbcmd & USBCMD_IAAD) { 2133 /* Remove all unseen qhs from the async qhs queue */ 2134 ehci_queues_rip_unseen(ehci, async); 2135 trace_usb_ehci_doorbell_ack(); 2136 ehci->usbcmd &= ~USBCMD_IAAD; 2137 ehci_raise_irq(ehci, USBSTS_IAA); 2138 } 2139 break; 2140 2141 default: 2142 /* this should only be due to a developer mistake */ 2143 fprintf(stderr, "ehci: Bad asynchronous state %d. " 2144 "Resetting to active\n", ehci->astate); 2145 g_assert_not_reached(); 2146 } 2147 } 2148 2149 static void ehci_advance_periodic_state(EHCIState *ehci) 2150 { 2151 uint32_t entry; 2152 uint32_t list; 2153 const int async = 0; 2154 2155 // 4.6 2156 2157 switch(ehci_get_state(ehci, async)) { 2158 case EST_INACTIVE: 2159 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { 2160 ehci_set_state(ehci, async, EST_ACTIVE); 2161 // No break, fall through to ACTIVE 2162 } else 2163 break; 2164 2165 case EST_ACTIVE: 2166 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) { 2167 ehci_queues_rip_all(ehci, async); 2168 ehci_set_state(ehci, async, EST_INACTIVE); 2169 break; 2170 } 2171 2172 list = ehci->periodiclistbase & 0xfffff000; 2173 /* check that register has been set */ 2174 if (list == 0) { 2175 break; 2176 } 2177 list |= ((ehci->frindex & 0x1ff8) >> 1); 2178 2179 if (get_dwords(ehci, list, &entry, 1) < 0) { 2180 break; 2181 } 2182 2183 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", 2184 ehci->frindex / 8, list, entry); 2185 ehci_set_fetch_addr(ehci, async,entry); 2186 ehci_set_state(ehci, async, EST_FETCHENTRY); 2187 ehci_advance_state(ehci, async); 2188 ehci_queues_rip_unused(ehci, async); 2189 break; 2190 2191 default: 2192 /* this should only be due to a developer mistake */ 2193 fprintf(stderr, "ehci: Bad periodic state %d. " 2194 "Resetting to active\n", ehci->pstate); 2195 g_assert_not_reached(); 2196 } 2197 } 2198 2199 static void ehci_update_frindex(EHCIState *ehci, int uframes) 2200 { 2201 int i; 2202 2203 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) { 2204 return; 2205 } 2206 2207 for (i = 0; i < uframes; i++) { 2208 ehci->frindex++; 2209 2210 if (ehci->frindex == 0x00002000) { 2211 ehci_raise_irq(ehci, USBSTS_FLR); 2212 } 2213 2214 if (ehci->frindex == 0x00004000) { 2215 ehci_raise_irq(ehci, USBSTS_FLR); 2216 ehci->frindex = 0; 2217 if (ehci->usbsts_frindex >= 0x00004000) { 2218 ehci->usbsts_frindex -= 0x00004000; 2219 } else { 2220 ehci->usbsts_frindex = 0; 2221 } 2222 } 2223 } 2224 } 2225 2226 static void ehci_frame_timer(void *opaque) 2227 { 2228 EHCIState *ehci = opaque; 2229 int need_timer = 0; 2230 int64_t expire_time, t_now; 2231 uint64_t ns_elapsed; 2232 int uframes, skipped_uframes; 2233 int i; 2234 2235 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 2236 ns_elapsed = t_now - ehci->last_run_ns; 2237 uframes = ns_elapsed / UFRAME_TIMER_NS; 2238 2239 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) { 2240 need_timer++; 2241 2242 if (uframes > (ehci->maxframes * 8)) { 2243 skipped_uframes = uframes - (ehci->maxframes * 8); 2244 ehci_update_frindex(ehci, skipped_uframes); 2245 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; 2246 uframes -= skipped_uframes; 2247 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes); 2248 } 2249 2250 for (i = 0; i < uframes; i++) { 2251 /* 2252 * If we're running behind schedule, we should not catch up 2253 * too fast, as that will make some guests unhappy: 2254 * 1) We must process a minimum of MIN_UFR_PER_TICK frames, 2255 * otherwise we will never catch up 2256 * 2) Process frames until the guest has requested an irq (IOC) 2257 */ 2258 if (i >= MIN_UFR_PER_TICK) { 2259 ehci_commit_irq(ehci); 2260 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) { 2261 break; 2262 } 2263 } 2264 if (ehci->periodic_sched_active) { 2265 ehci->periodic_sched_active--; 2266 } 2267 ehci_update_frindex(ehci, 1); 2268 if ((ehci->frindex & 7) == 0) { 2269 ehci_advance_periodic_state(ehci); 2270 } 2271 ehci->last_run_ns += UFRAME_TIMER_NS; 2272 } 2273 } else { 2274 ehci->periodic_sched_active = 0; 2275 ehci_update_frindex(ehci, uframes); 2276 ehci->last_run_ns += UFRAME_TIMER_NS * uframes; 2277 } 2278 2279 if (ehci->periodic_sched_active) { 2280 ehci->async_stepdown = 0; 2281 } else if (ehci->async_stepdown < ehci->maxframes / 2) { 2282 ehci->async_stepdown++; 2283 } 2284 2285 /* Async is not inside loop since it executes everything it can once 2286 * called 2287 */ 2288 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { 2289 need_timer++; 2290 ehci_advance_async_state(ehci); 2291 } 2292 2293 ehci_commit_irq(ehci); 2294 if (ehci->usbsts_pending) { 2295 need_timer++; 2296 ehci->async_stepdown = 0; 2297 } 2298 2299 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) { 2300 need_timer++; 2301 } 2302 2303 if (need_timer) { 2304 /* If we've raised int, we speed up the timer, so that we quickly 2305 * notice any new packets queued up in response */ 2306 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { 2307 expire_time = t_now + get_ticks_per_sec() / (FRAME_TIMER_FREQ * 4); 2308 ehci->int_req_by_async = false; 2309 } else { 2310 expire_time = t_now + (get_ticks_per_sec() 2311 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); 2312 } 2313 timer_mod(ehci->frame_timer, expire_time); 2314 } 2315 } 2316 2317 static const MemoryRegionOps ehci_mmio_caps_ops = { 2318 .read = ehci_caps_read, 2319 .valid.min_access_size = 1, 2320 .valid.max_access_size = 4, 2321 .impl.min_access_size = 1, 2322 .impl.max_access_size = 1, 2323 .endianness = DEVICE_LITTLE_ENDIAN, 2324 }; 2325 2326 static const MemoryRegionOps ehci_mmio_opreg_ops = { 2327 .read = ehci_opreg_read, 2328 .write = ehci_opreg_write, 2329 .valid.min_access_size = 4, 2330 .valid.max_access_size = 4, 2331 .endianness = DEVICE_LITTLE_ENDIAN, 2332 }; 2333 2334 static const MemoryRegionOps ehci_mmio_port_ops = { 2335 .read = ehci_port_read, 2336 .write = ehci_port_write, 2337 .valid.min_access_size = 4, 2338 .valid.max_access_size = 4, 2339 .endianness = DEVICE_LITTLE_ENDIAN, 2340 }; 2341 2342 static USBPortOps ehci_port_ops = { 2343 .attach = ehci_attach, 2344 .detach = ehci_detach, 2345 .child_detach = ehci_child_detach, 2346 .wakeup = ehci_wakeup, 2347 .complete = ehci_async_complete_packet, 2348 }; 2349 2350 static USBBusOps ehci_bus_ops_companion = { 2351 .register_companion = ehci_register_companion, 2352 .wakeup_endpoint = ehci_wakeup_endpoint, 2353 }; 2354 static USBBusOps ehci_bus_ops_standalone = { 2355 .wakeup_endpoint = ehci_wakeup_endpoint, 2356 }; 2357 2358 static void usb_ehci_pre_save(void *opaque) 2359 { 2360 EHCIState *ehci = opaque; 2361 uint32_t new_frindex; 2362 2363 /* Round down frindex to a multiple of 8 for migration compatibility */ 2364 new_frindex = ehci->frindex & ~7; 2365 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS; 2366 ehci->frindex = new_frindex; 2367 } 2368 2369 static int usb_ehci_post_load(void *opaque, int version_id) 2370 { 2371 EHCIState *s = opaque; 2372 int i; 2373 2374 for (i = 0; i < NB_PORTS; i++) { 2375 USBPort *companion = s->companion_ports[i]; 2376 if (companion == NULL) { 2377 continue; 2378 } 2379 if (s->portsc[i] & PORTSC_POWNER) { 2380 companion->dev = s->ports[i].dev; 2381 } else { 2382 companion->dev = NULL; 2383 } 2384 } 2385 2386 return 0; 2387 } 2388 2389 static void usb_ehci_vm_state_change(void *opaque, int running, RunState state) 2390 { 2391 EHCIState *ehci = opaque; 2392 2393 /* 2394 * We don't migrate the EHCIQueue-s, instead we rebuild them for the 2395 * schedule in guest memory. We must do the rebuilt ASAP, so that 2396 * USB-devices which have async handled packages have a packet in the 2397 * ep queue to match the completion with. 2398 */ 2399 if (state == RUN_STATE_RUNNING) { 2400 ehci_advance_async_state(ehci); 2401 } 2402 2403 /* 2404 * The schedule rebuilt from guest memory could cause the migration dest 2405 * to miss a QH unlink, and fail to cancel packets, since the unlinked QH 2406 * will never have existed on the destination. Therefor we must flush the 2407 * async schedule on savevm to catch any not yet noticed unlinks. 2408 */ 2409 if (state == RUN_STATE_SAVE_VM) { 2410 ehci_advance_async_state(ehci); 2411 ehci_queues_rip_unseen(ehci, 1); 2412 } 2413 } 2414 2415 const VMStateDescription vmstate_ehci = { 2416 .name = "ehci-core", 2417 .version_id = 2, 2418 .minimum_version_id = 1, 2419 .pre_save = usb_ehci_pre_save, 2420 .post_load = usb_ehci_post_load, 2421 .fields = (VMStateField[]) { 2422 /* mmio registers */ 2423 VMSTATE_UINT32(usbcmd, EHCIState), 2424 VMSTATE_UINT32(usbsts, EHCIState), 2425 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2), 2426 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2), 2427 VMSTATE_UINT32(usbintr, EHCIState), 2428 VMSTATE_UINT32(frindex, EHCIState), 2429 VMSTATE_UINT32(ctrldssegment, EHCIState), 2430 VMSTATE_UINT32(periodiclistbase, EHCIState), 2431 VMSTATE_UINT32(asynclistaddr, EHCIState), 2432 VMSTATE_UINT32(configflag, EHCIState), 2433 VMSTATE_UINT32(portsc[0], EHCIState), 2434 VMSTATE_UINT32(portsc[1], EHCIState), 2435 VMSTATE_UINT32(portsc[2], EHCIState), 2436 VMSTATE_UINT32(portsc[3], EHCIState), 2437 VMSTATE_UINT32(portsc[4], EHCIState), 2438 VMSTATE_UINT32(portsc[5], EHCIState), 2439 /* frame timer */ 2440 VMSTATE_TIMER_PTR(frame_timer, EHCIState), 2441 VMSTATE_UINT64(last_run_ns, EHCIState), 2442 VMSTATE_UINT32(async_stepdown, EHCIState), 2443 /* schedule state */ 2444 VMSTATE_UINT32(astate, EHCIState), 2445 VMSTATE_UINT32(pstate, EHCIState), 2446 VMSTATE_UINT32(a_fetch_addr, EHCIState), 2447 VMSTATE_UINT32(p_fetch_addr, EHCIState), 2448 VMSTATE_END_OF_LIST() 2449 } 2450 }; 2451 2452 void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp) 2453 { 2454 int i; 2455 2456 if (s->portnr > NB_PORTS) { 2457 error_setg(errp, "Too many ports! Max. port number is %d.", 2458 NB_PORTS); 2459 return; 2460 } 2461 2462 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ? 2463 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev); 2464 for (i = 0; i < s->portnr; i++) { 2465 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops, 2466 USB_SPEED_MASK_HIGH); 2467 s->ports[i].dev = 0; 2468 } 2469 2470 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_frame_timer, s); 2471 s->async_bh = qemu_bh_new(ehci_frame_timer, s); 2472 s->device = dev; 2473 2474 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s); 2475 } 2476 2477 void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp) 2478 { 2479 trace_usb_ehci_unrealize(); 2480 2481 if (s->frame_timer) { 2482 timer_del(s->frame_timer); 2483 timer_free(s->frame_timer); 2484 s->frame_timer = NULL; 2485 } 2486 if (s->async_bh) { 2487 qemu_bh_delete(s->async_bh); 2488 } 2489 2490 ehci_queues_rip_all(s, 0); 2491 ehci_queues_rip_all(s, 1); 2492 2493 memory_region_del_subregion(&s->mem, &s->mem_caps); 2494 memory_region_del_subregion(&s->mem, &s->mem_opreg); 2495 memory_region_del_subregion(&s->mem, &s->mem_ports); 2496 2497 usb_bus_release(&s->bus); 2498 2499 if (s->vmstate) { 2500 qemu_del_vm_change_state_handler(s->vmstate); 2501 } 2502 } 2503 2504 void usb_ehci_init(EHCIState *s, DeviceState *dev) 2505 { 2506 /* 2.2 host controller interface version */ 2507 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase); 2508 s->caps[0x01] = 0x00; 2509 s->caps[0x02] = 0x00; 2510 s->caps[0x03] = 0x01; /* HC version */ 2511 s->caps[0x04] = s->portnr; /* Number of downstream ports */ 2512 s->caps[0x05] = 0x00; /* No companion ports at present */ 2513 s->caps[0x06] = 0x00; 2514 s->caps[0x07] = 0x00; 2515 s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */ 2516 s->caps[0x0a] = 0x00; 2517 s->caps[0x0b] = 0x00; 2518 2519 QTAILQ_INIT(&s->aqueues); 2520 QTAILQ_INIT(&s->pqueues); 2521 usb_packet_init(&s->ipacket); 2522 2523 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE); 2524 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s, 2525 "capabilities", CAPA_SIZE); 2526 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s, 2527 "operational", s->portscbase); 2528 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s, 2529 "ports", 4 * s->portnr); 2530 2531 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps); 2532 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg); 2533 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase, 2534 &s->mem_ports); 2535 } 2536 2537 /* 2538 * vim: expandtab ts=4 2539 */ 2540