qemu/hw/usb/hcd-ehci.c
<<
>>
Prefs
   1/*
   2 * QEMU USB EHCI Emulation
   3 *
   4 * Copyright(c) 2008  Emutex Ltd. (address@hidden)
   5 * Copyright(c) 2011-2012 Red Hat, Inc.
   6 *
   7 * Red Hat Authors:
   8 * Gerd Hoffmann <kraxel@redhat.com>
   9 * Hans de Goede <hdegoede@redhat.com>
  10 *
  11 * EHCI project was started by Mark Burkley, with contributions by
  12 * Niels de Vos.  David S. Ahern continued working on it.  Kevin Wolf,
  13 * Jan Kiszka and Vincent Palatin contributed bugfixes.
  14 *
  15 *
  16 * This library is free software; you can redistribute it and/or
  17 * modify it under the terms of the GNU Lesser General Public
  18 * License as published by the Free Software Foundation; either
  19 * version 2 of the License, or(at your option) any later version.
  20 *
  21 * This library is distributed in the hope that it will be useful,
  22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  24 * Lesser General Public License for more details.
  25 *
  26 * You should have received a copy of the GNU General Public License
  27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
  28 */
  29
  30#include "qemu/osdep.h"
  31#include "qapi/error.h"
  32#include "hw/usb/ehci-regs.h"
  33#include "hw/usb/hcd-ehci.h"
  34#include "trace.h"
  35
  36#define FRAME_TIMER_FREQ 1000
  37#define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
  38#define UFRAME_TIMER_NS  (FRAME_TIMER_NS / 8)
  39
  40#define NB_MAXINTRATE    8        // Max rate at which controller issues ints
  41#define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
  42#define MAX_QH           100      // Max allowable queue heads in a chain
  43#define MIN_UFR_PER_TICK 24       /* Min frames to process when catching up */
  44#define PERIODIC_ACTIVE  512      /* Micro-frames */
  45
  46/*  Internal periodic / asynchronous schedule state machine states
  47 */
  48typedef enum {
  49    EST_INACTIVE = 1000,
  50    EST_ACTIVE,
  51    EST_EXECUTING,
  52    EST_SLEEPING,
  53    /*  The following states are internal to the state machine function
  54    */
  55    EST_WAITLISTHEAD,
  56    EST_FETCHENTRY,
  57    EST_FETCHQH,
  58    EST_FETCHITD,
  59    EST_FETCHSITD,
  60    EST_ADVANCEQUEUE,
  61    EST_FETCHQTD,
  62    EST_EXECUTE,
  63    EST_WRITEBACK,
  64    EST_HORIZONTALQH
  65} EHCI_STATES;
  66
  67/* macros for accessing fields within next link pointer entry */
  68#define NLPTR_GET(x)             ((x) & 0xffffffe0)
  69#define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
  70#define NLPTR_TBIT(x)            ((x) & 1)  // 1=invalid, 0=valid
  71
  72/* link pointer types */
  73#define NLPTR_TYPE_ITD           0     // isoc xfer descriptor
  74#define NLPTR_TYPE_QH            1     // queue head
  75#define NLPTR_TYPE_STITD         2     // split xaction, isoc xfer descriptor
  76#define NLPTR_TYPE_FSTN          3     // frame span traversal node
  77
  78#define SET_LAST_RUN_CLOCK(s) \
  79    (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
  80
  81/* nifty macros from Arnon's EHCI version  */
  82#define get_field(data, field) \
  83    (((data) & field##_MASK) >> field##_SH)
  84
  85#define set_field(data, newval, field) do { \
  86    uint32_t val = *data; \
  87    val &= ~ field##_MASK; \
  88    val |= ((newval) << field##_SH) & field##_MASK; \
  89    *data = val; \
  90    } while(0)
  91
  92static const char *ehci_state_names[] = {
  93    [EST_INACTIVE]     = "INACTIVE",
  94    [EST_ACTIVE]       = "ACTIVE",
  95    [EST_EXECUTING]    = "EXECUTING",
  96    [EST_SLEEPING]     = "SLEEPING",
  97    [EST_WAITLISTHEAD] = "WAITLISTHEAD",
  98    [EST_FETCHENTRY]   = "FETCH ENTRY",
  99    [EST_FETCHQH]      = "FETCH QH",
 100    [EST_FETCHITD]     = "FETCH ITD",
 101    [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
 102    [EST_FETCHQTD]     = "FETCH QTD",
 103    [EST_EXECUTE]      = "EXECUTE",
 104    [EST_WRITEBACK]    = "WRITEBACK",
 105    [EST_HORIZONTALQH] = "HORIZONTALQH",
 106};
 107
 108static const char *ehci_mmio_names[] = {
 109    [USBCMD]            = "USBCMD",
 110    [USBSTS]            = "USBSTS",
 111    [USBINTR]           = "USBINTR",
 112    [FRINDEX]           = "FRINDEX",
 113    [PERIODICLISTBASE]  = "P-LIST BASE",
 114    [ASYNCLISTADDR]     = "A-LIST ADDR",
 115    [CONFIGFLAG]        = "CONFIGFLAG",
 116};
 117
 118static int ehci_state_executing(EHCIQueue *q);
 119static int ehci_state_writeback(EHCIQueue *q);
 120static int ehci_state_advqueue(EHCIQueue *q);
 121static int ehci_fill_queue(EHCIPacket *p);
 122static void ehci_free_packet(EHCIPacket *p);
 123
 124static const char *nr2str(const char **n, size_t len, uint32_t nr)
 125{
 126    if (nr < len && n[nr] != NULL) {
 127        return n[nr];
 128    } else {
 129        return "unknown";
 130    }
 131}
 132
 133static const char *state2str(uint32_t state)
 134{
 135    return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
 136}
 137
 138static const char *addr2str(hwaddr addr)
 139{
 140    return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
 141}
 142
 143static void ehci_trace_usbsts(uint32_t mask, int state)
 144{
 145    /* interrupts */
 146    if (mask & USBSTS_INT) {
 147        trace_usb_ehci_usbsts("INT", state);
 148    }
 149    if (mask & USBSTS_ERRINT) {
 150        trace_usb_ehci_usbsts("ERRINT", state);
 151    }
 152    if (mask & USBSTS_PCD) {
 153        trace_usb_ehci_usbsts("PCD", state);
 154    }
 155    if (mask & USBSTS_FLR) {
 156        trace_usb_ehci_usbsts("FLR", state);
 157    }
 158    if (mask & USBSTS_HSE) {
 159        trace_usb_ehci_usbsts("HSE", state);
 160    }
 161    if (mask & USBSTS_IAA) {
 162        trace_usb_ehci_usbsts("IAA", state);
 163    }
 164
 165    /* status */
 166    if (mask & USBSTS_HALT) {
 167        trace_usb_ehci_usbsts("HALT", state);
 168    }
 169    if (mask & USBSTS_REC) {
 170        trace_usb_ehci_usbsts("REC", state);
 171    }
 172    if (mask & USBSTS_PSS) {
 173        trace_usb_ehci_usbsts("PSS", state);
 174    }
 175    if (mask & USBSTS_ASS) {
 176        trace_usb_ehci_usbsts("ASS", state);
 177    }
 178}
 179
 180static inline void ehci_set_usbsts(EHCIState *s, int mask)
 181{
 182    if ((s->usbsts & mask) == mask) {
 183        return;
 184    }
 185    ehci_trace_usbsts(mask, 1);
 186    s->usbsts |= mask;
 187}
 188
 189static inline void ehci_clear_usbsts(EHCIState *s, int mask)
 190{
 191    if ((s->usbsts & mask) == 0) {
 192        return;
 193    }
 194    ehci_trace_usbsts(mask, 0);
 195    s->usbsts &= ~mask;
 196}
 197
 198/* update irq line */
 199static inline void ehci_update_irq(EHCIState *s)
 200{
 201    int level = 0;
 202
 203    if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
 204        level = 1;
 205    }
 206
 207    trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
 208    qemu_set_irq(s->irq, level);
 209}
 210
 211/* flag interrupt condition */
 212static inline void ehci_raise_irq(EHCIState *s, int intr)
 213{
 214    if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
 215        s->usbsts |= intr;
 216        ehci_update_irq(s);
 217    } else {
 218        s->usbsts_pending |= intr;
 219    }
 220}
 221
 222/*
 223 * Commit pending interrupts (added via ehci_raise_irq),
 224 * at the rate allowed by "Interrupt Threshold Control".
 225 */
 226static inline void ehci_commit_irq(EHCIState *s)
 227{
 228    uint32_t itc;
 229
 230    if (!s->usbsts_pending) {
 231        return;
 232    }
 233    if (s->usbsts_frindex > s->frindex) {
 234        return;
 235    }
 236
 237    itc = (s->usbcmd >> 16) & 0xff;
 238    s->usbsts |= s->usbsts_pending;
 239    s->usbsts_pending = 0;
 240    s->usbsts_frindex = s->frindex + itc;
 241    ehci_update_irq(s);
 242}
 243
 244static void ehci_update_halt(EHCIState *s)
 245{
 246    if (s->usbcmd & USBCMD_RUNSTOP) {
 247        ehci_clear_usbsts(s, USBSTS_HALT);
 248    } else {
 249        if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
 250            ehci_set_usbsts(s, USBSTS_HALT);
 251        }
 252    }
 253}
 254
 255static void ehci_set_state(EHCIState *s, int async, int state)
 256{
 257    if (async) {
 258        trace_usb_ehci_state("async", state2str(state));
 259        s->astate = state;
 260        if (s->astate == EST_INACTIVE) {
 261            ehci_clear_usbsts(s, USBSTS_ASS);
 262            ehci_update_halt(s);
 263        } else {
 264            ehci_set_usbsts(s, USBSTS_ASS);
 265        }
 266    } else {
 267        trace_usb_ehci_state("periodic", state2str(state));
 268        s->pstate = state;
 269        if (s->pstate == EST_INACTIVE) {
 270            ehci_clear_usbsts(s, USBSTS_PSS);
 271            ehci_update_halt(s);
 272        } else {
 273            ehci_set_usbsts(s, USBSTS_PSS);
 274        }
 275    }
 276}
 277
 278static int ehci_get_state(EHCIState *s, int async)
 279{
 280    return async ? s->astate : s->pstate;
 281}
 282
 283static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
 284{
 285    if (async) {
 286        s->a_fetch_addr = addr;
 287    } else {
 288        s->p_fetch_addr = addr;
 289    }
 290}
 291
 292static int ehci_get_fetch_addr(EHCIState *s, int async)
 293{
 294    return async ? s->a_fetch_addr : s->p_fetch_addr;
 295}
 296
 297static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
 298{
 299    /* need three here due to argument count limits */
 300    trace_usb_ehci_qh_ptrs(q, addr, qh->next,
 301                           qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
 302    trace_usb_ehci_qh_fields(addr,
 303                             get_field(qh->epchar, QH_EPCHAR_RL),
 304                             get_field(qh->epchar, QH_EPCHAR_MPLEN),
 305                             get_field(qh->epchar, QH_EPCHAR_EPS),
 306                             get_field(qh->epchar, QH_EPCHAR_EP),
 307                             get_field(qh->epchar, QH_EPCHAR_DEVADDR));
 308    trace_usb_ehci_qh_bits(addr,
 309                           (bool)(qh->epchar & QH_EPCHAR_C),
 310                           (bool)(qh->epchar & QH_EPCHAR_H),
 311                           (bool)(qh->epchar & QH_EPCHAR_DTC),
 312                           (bool)(qh->epchar & QH_EPCHAR_I));
 313}
 314
 315static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
 316{
 317    /* need three here due to argument count limits */
 318    trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
 319    trace_usb_ehci_qtd_fields(addr,
 320                              get_field(qtd->token, QTD_TOKEN_TBYTES),
 321                              get_field(qtd->token, QTD_TOKEN_CPAGE),
 322                              get_field(qtd->token, QTD_TOKEN_CERR),
 323                              get_field(qtd->token, QTD_TOKEN_PID));
 324    trace_usb_ehci_qtd_bits(addr,
 325                            (bool)(qtd->token & QTD_TOKEN_IOC),
 326                            (bool)(qtd->token & QTD_TOKEN_ACTIVE),
 327                            (bool)(qtd->token & QTD_TOKEN_HALT),
 328                            (bool)(qtd->token & QTD_TOKEN_BABBLE),
 329                            (bool)(qtd->token & QTD_TOKEN_XACTERR));
 330}
 331
 332static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
 333{
 334    trace_usb_ehci_itd(addr, itd->next,
 335                       get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
 336                       get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
 337                       get_field(itd->bufptr[0], ITD_BUFPTR_EP),
 338                       get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
 339}
 340
 341static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
 342                            EHCIsitd *sitd)
 343{
 344    trace_usb_ehci_sitd(addr, sitd->next,
 345                        (bool)(sitd->results & SITD_RESULTS_ACTIVE));
 346}
 347
 348static void ehci_trace_guest_bug(EHCIState *s, const char *message)
 349{
 350    trace_usb_ehci_guest_bug(message);
 351    fprintf(stderr, "ehci warning: %s\n", message);
 352}
 353
 354static inline bool ehci_enabled(EHCIState *s)
 355{
 356    return s->usbcmd & USBCMD_RUNSTOP;
 357}
 358
 359static inline bool ehci_async_enabled(EHCIState *s)
 360{
 361    return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
 362}
 363
 364static inline bool ehci_periodic_enabled(EHCIState *s)
 365{
 366    return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
 367}
 368
 369/* Get an array of dwords from main memory */
 370static inline int get_dwords(EHCIState *ehci, uint32_t addr,
 371                             uint32_t *buf, int num)
 372{
 373    int i;
 374
 375    if (!ehci->as) {
 376        ehci_raise_irq(ehci, USBSTS_HSE);
 377        ehci->usbcmd &= ~USBCMD_RUNSTOP;
 378        trace_usb_ehci_dma_error();
 379        return -1;
 380    }
 381
 382    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 383        dma_memory_read(ehci->as, addr, buf, sizeof(*buf));
 384        *buf = le32_to_cpu(*buf);
 385    }
 386
 387    return num;
 388}
 389
 390/* Put an array of dwords in to main memory */
 391static inline int put_dwords(EHCIState *ehci, uint32_t addr,
 392                             uint32_t *buf, int num)
 393{
 394    int i;
 395
 396    if (!ehci->as) {
 397        ehci_raise_irq(ehci, USBSTS_HSE);
 398        ehci->usbcmd &= ~USBCMD_RUNSTOP;
 399        trace_usb_ehci_dma_error();
 400        return -1;
 401    }
 402
 403    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 404        uint32_t tmp = cpu_to_le32(*buf);
 405        dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp));
 406    }
 407
 408    return num;
 409}
 410
 411static int ehci_get_pid(EHCIqtd *qtd)
 412{
 413    switch (get_field(qtd->token, QTD_TOKEN_PID)) {
 414    case 0:
 415        return USB_TOKEN_OUT;
 416    case 1:
 417        return USB_TOKEN_IN;
 418    case 2:
 419        return USB_TOKEN_SETUP;
 420    default:
 421        fprintf(stderr, "bad token\n");
 422        return 0;
 423    }
 424}
 425
 426static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
 427{
 428    uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR);
 429    uint32_t endp    = get_field(qh->epchar, QH_EPCHAR_EP);
 430    if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
 431        (endp    != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
 432        (qh->current_qtd != q->qh.current_qtd) ||
 433        (q->async && qh->next_qtd != q->qh.next_qtd) ||
 434        (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
 435                                 7 * sizeof(uint32_t)) != 0) ||
 436        (q->dev != NULL && q->dev->addr != devaddr)) {
 437        return false;
 438    } else {
 439        return true;
 440    }
 441}
 442
 443static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
 444{
 445    if (p->qtdaddr != p->queue->qtdaddr ||
 446        (p->queue->async && !NLPTR_TBIT(p->qtd.next) &&
 447            (p->qtd.next != qtd->next)) ||
 448        (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
 449        p->qtd.token != qtd->token ||
 450        p->qtd.bufptr[0] != qtd->bufptr[0]) {
 451        return false;
 452    } else {
 453        return true;
 454    }
 455}
 456
 457static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
 458{
 459    int ep  = get_field(q->qh.epchar, QH_EPCHAR_EP);
 460    int pid = ehci_get_pid(qtd);
 461
 462    /* Note the pid changing is normal for ep 0 (the control ep) */
 463    if (q->last_pid && ep != 0 && pid != q->last_pid) {
 464        return false;
 465    } else {
 466        return true;
 467    }
 468}
 469
 470/* Finish executing and writeback a packet outside of the regular
 471   fetchqh -> fetchqtd -> execute -> writeback cycle */
 472static void ehci_writeback_async_complete_packet(EHCIPacket *p)
 473{
 474    EHCIQueue *q = p->queue;
 475    EHCIqtd qtd;
 476    EHCIqh qh;
 477    int state;
 478
 479    /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
 480    get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
 481               (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
 482    get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
 483               (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
 484    if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
 485        p->async = EHCI_ASYNC_INITIALIZED;
 486        ehci_free_packet(p);
 487        return;
 488    }
 489
 490    state = ehci_get_state(q->ehci, q->async);
 491    ehci_state_executing(q);
 492    ehci_state_writeback(q); /* Frees the packet! */
 493    if (!(q->qh.token & QTD_TOKEN_HALT)) {
 494        ehci_state_advqueue(q);
 495    }
 496    ehci_set_state(q->ehci, q->async, state);
 497}
 498
 499/* packet management */
 500
 501static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
 502{
 503    EHCIPacket *p;
 504
 505    p = g_new0(EHCIPacket, 1);
 506    p->queue = q;
 507    usb_packet_init(&p->packet);
 508    QTAILQ_INSERT_TAIL(&q->packets, p, next);
 509    trace_usb_ehci_packet_action(p->queue, p, "alloc");
 510    return p;
 511}
 512
 513static void ehci_free_packet(EHCIPacket *p)
 514{
 515    if (p->async == EHCI_ASYNC_FINISHED &&
 516            !(p->queue->qh.token & QTD_TOKEN_HALT)) {
 517        ehci_writeback_async_complete_packet(p);
 518        return;
 519    }
 520    trace_usb_ehci_packet_action(p->queue, p, "free");
 521    if (p->async == EHCI_ASYNC_INFLIGHT) {
 522        usb_cancel_packet(&p->packet);
 523    }
 524    if (p->async == EHCI_ASYNC_FINISHED &&
 525            p->packet.status == USB_RET_SUCCESS) {
 526        fprintf(stderr,
 527                "EHCI: Dropping completed packet from halted %s ep %02X\n",
 528                (p->pid == USB_TOKEN_IN) ? "in" : "out",
 529                get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
 530    }
 531    if (p->async != EHCI_ASYNC_NONE) {
 532        usb_packet_unmap(&p->packet, &p->sgl);
 533        qemu_sglist_destroy(&p->sgl);
 534    }
 535    QTAILQ_REMOVE(&p->queue->packets, p, next);
 536    usb_packet_cleanup(&p->packet);
 537    g_free(p);
 538}
 539
 540/* queue management */
 541
 542static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
 543{
 544    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 545    EHCIQueue *q;
 546
 547    q = g_malloc0(sizeof(*q));
 548    q->ehci = ehci;
 549    q->qhaddr = addr;
 550    q->async = async;
 551    QTAILQ_INIT(&q->packets);
 552    QTAILQ_INSERT_HEAD(head, q, next);
 553    trace_usb_ehci_queue_action(q, "alloc");
 554    return q;
 555}
 556
 557static void ehci_queue_stopped(EHCIQueue *q)
 558{
 559    int endp  = get_field(q->qh.epchar, QH_EPCHAR_EP);
 560
 561    if (!q->last_pid || !q->dev) {
 562        return;
 563    }
 564
 565    usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp));
 566}
 567
 568static int ehci_cancel_queue(EHCIQueue *q)
 569{
 570    EHCIPacket *p;
 571    int packets = 0;
 572
 573    p = QTAILQ_FIRST(&q->packets);
 574    if (p == NULL) {
 575        goto leave;
 576    }
 577
 578    trace_usb_ehci_queue_action(q, "cancel");
 579    do {
 580        ehci_free_packet(p);
 581        packets++;
 582    } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
 583
 584leave:
 585    ehci_queue_stopped(q);
 586    return packets;
 587}
 588
 589static int ehci_reset_queue(EHCIQueue *q)
 590{
 591    int packets;
 592
 593    trace_usb_ehci_queue_action(q, "reset");
 594    packets = ehci_cancel_queue(q);
 595    q->dev = NULL;
 596    q->qtdaddr = 0;
 597    q->last_pid = 0;
 598    return packets;
 599}
 600
 601static void ehci_free_queue(EHCIQueue *q, const char *warn)
 602{
 603    EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
 604    int cancelled;
 605
 606    trace_usb_ehci_queue_action(q, "free");
 607    cancelled = ehci_cancel_queue(q);
 608    if (warn && cancelled > 0) {
 609        ehci_trace_guest_bug(q->ehci, warn);
 610    }
 611    QTAILQ_REMOVE(head, q, next);
 612    g_free(q);
 613}
 614
 615static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
 616                                        int async)
 617{
 618    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 619    EHCIQueue *q;
 620
 621    QTAILQ_FOREACH(q, head, next) {
 622        if (addr == q->qhaddr) {
 623            return q;
 624        }
 625    }
 626    return NULL;
 627}
 628
 629static void ehci_queues_rip_unused(EHCIState *ehci, int async)
 630{
 631    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 632    const char *warn = async ? "guest unlinked busy QH" : NULL;
 633    uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
 634    EHCIQueue *q, *tmp;
 635
 636    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
 637        if (q->seen) {
 638            q->seen = 0;
 639            q->ts = ehci->last_run_ns;
 640            continue;
 641        }
 642        if (ehci->last_run_ns < q->ts + maxage) {
 643            continue;
 644        }
 645        ehci_free_queue(q, warn);
 646    }
 647}
 648
 649static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
 650{
 651    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 652    EHCIQueue *q, *tmp;
 653
 654    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
 655        if (!q->seen) {
 656            ehci_free_queue(q, NULL);
 657        }
 658    }
 659}
 660
 661static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
 662{
 663    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 664    EHCIQueue *q, *tmp;
 665
 666    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
 667        if (q->dev != dev) {
 668            continue;
 669        }
 670        ehci_free_queue(q, NULL);
 671    }
 672}
 673
 674static void ehci_queues_rip_all(EHCIState *ehci, int async)
 675{
 676    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
 677    const char *warn = async ? "guest stopped busy async schedule" : NULL;
 678    EHCIQueue *q, *tmp;
 679
 680    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
 681        ehci_free_queue(q, warn);
 682    }
 683}
 684
 685/* Attach or detach a device on root hub */
 686
 687static void ehci_attach(USBPort *port)
 688{
 689    EHCIState *s = port->opaque;
 690    uint32_t *portsc = &s->portsc[port->index];
 691    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
 692
 693    trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
 694
 695    if (*portsc & PORTSC_POWNER) {
 696        USBPort *companion = s->companion_ports[port->index];
 697        companion->dev = port->dev;
 698        companion->ops->attach(companion);
 699        return;
 700    }
 701
 702    *portsc |= PORTSC_CONNECT;
 703    *portsc |= PORTSC_CSC;
 704
 705    ehci_raise_irq(s, USBSTS_PCD);
 706}
 707
 708static void ehci_detach(USBPort *port)
 709{
 710    EHCIState *s = port->opaque;
 711    uint32_t *portsc = &s->portsc[port->index];
 712    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
 713
 714    trace_usb_ehci_port_detach(port->index, owner);
 715
 716    if (*portsc & PORTSC_POWNER) {
 717        USBPort *companion = s->companion_ports[port->index];
 718        companion->ops->detach(companion);
 719        companion->dev = NULL;
 720        /*
 721         * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
 722         * the port ownership is returned immediately to the EHCI controller."
 723         */
 724        *portsc &= ~PORTSC_POWNER;
 725        return;
 726    }
 727
 728    ehci_queues_rip_device(s, port->dev, 0);
 729    ehci_queues_rip_device(s, port->dev, 1);
 730
 731    *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
 732    *portsc |= PORTSC_CSC;
 733
 734    ehci_raise_irq(s, USBSTS_PCD);
 735}
 736
 737static void ehci_child_detach(USBPort *port, USBDevice *child)
 738{
 739    EHCIState *s = port->opaque;
 740    uint32_t portsc = s->portsc[port->index];
 741
 742    if (portsc & PORTSC_POWNER) {
 743        USBPort *companion = s->companion_ports[port->index];
 744        companion->ops->child_detach(companion, child);
 745        return;
 746    }
 747
 748    ehci_queues_rip_device(s, child, 0);
 749    ehci_queues_rip_device(s, child, 1);
 750}
 751
 752static void ehci_wakeup(USBPort *port)
 753{
 754    EHCIState *s = port->opaque;
 755    uint32_t *portsc = &s->portsc[port->index];
 756
 757    if (*portsc & PORTSC_POWNER) {
 758        USBPort *companion = s->companion_ports[port->index];
 759        if (companion->ops->wakeup) {
 760            companion->ops->wakeup(companion);
 761        }
 762        return;
 763    }
 764
 765    if (*portsc & PORTSC_SUSPEND) {
 766        trace_usb_ehci_port_wakeup(port->index);
 767        *portsc |= PORTSC_FPRES;
 768        ehci_raise_irq(s, USBSTS_PCD);
 769    }
 770
 771    qemu_bh_schedule(s->async_bh);
 772}
 773
 774static void ehci_register_companion(USBBus *bus, USBPort *ports[],
 775                                    uint32_t portcount, uint32_t firstport,
 776                                    Error **errp)
 777{
 778    EHCIState *s = container_of(bus, EHCIState, bus);
 779    uint32_t i;
 780
 781    if (firstport + portcount > NB_PORTS) {
 782        error_setg(errp, "firstport must be between 0 and %u",
 783                   NB_PORTS - portcount);
 784        return;
 785    }
 786
 787    for (i = 0; i < portcount; i++) {
 788        if (s->companion_ports[firstport + i]) {
 789            error_setg(errp, "firstport %u asks for ports %u-%u,"
 790                       " but port %u has a companion assigned already",
 791                       firstport, firstport, firstport + portcount - 1,
 792                       firstport + i);
 793            return;
 794        }
 795    }
 796
 797    for (i = 0; i < portcount; i++) {
 798        s->companion_ports[firstport + i] = ports[i];
 799        s->ports[firstport + i].speedmask |=
 800            USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
 801        /* Ensure devs attached before the initial reset go to the companion */
 802        s->portsc[firstport + i] = PORTSC_POWNER;
 803    }
 804
 805    s->companion_count++;
 806    s->caps[0x05] = (s->companion_count << 4) | portcount;
 807}
 808
 809static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
 810                                 unsigned int stream)
 811{
 812    EHCIState *s = container_of(bus, EHCIState, bus);
 813    uint32_t portsc = s->portsc[ep->dev->port->index];
 814
 815    if (portsc & PORTSC_POWNER) {
 816        return;
 817    }
 818
 819    s->periodic_sched_active = PERIODIC_ACTIVE;
 820    qemu_bh_schedule(s->async_bh);
 821}
 822
 823static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
 824{
 825    USBDevice *dev;
 826    USBPort *port;
 827    int i;
 828
 829    for (i = 0; i < NB_PORTS; i++) {
 830        port = &ehci->ports[i];
 831        if (!(ehci->portsc[i] & PORTSC_PED)) {
 832            DPRINTF("Port %d not enabled\n", i);
 833            continue;
 834        }
 835        dev = usb_find_device(port, addr);
 836        if (dev != NULL) {
 837            return dev;
 838        }
 839    }
 840    return NULL;
 841}
 842
 843/* 4.1 host controller initialization */
 844void ehci_reset(void *opaque)
 845{
 846    EHCIState *s = opaque;
 847    int i;
 848    USBDevice *devs[NB_PORTS];
 849
 850    trace_usb_ehci_reset();
 851
 852    /*
 853     * Do the detach before touching portsc, so that it correctly gets send to
 854     * us or to our companion based on PORTSC_POWNER before the reset.
 855     */
 856    for(i = 0; i < NB_PORTS; i++) {
 857        devs[i] = s->ports[i].dev;
 858        if (devs[i] && devs[i]->attached) {
 859            usb_detach(&s->ports[i]);
 860        }
 861    }
 862
 863    memset(&s->opreg, 0x00, sizeof(s->opreg));
 864    memset(&s->portsc, 0x00, sizeof(s->portsc));
 865
 866    s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
 867    s->usbsts = USBSTS_HALT;
 868    s->usbsts_pending = 0;
 869    s->usbsts_frindex = 0;
 870    ehci_update_irq(s);
 871
 872    s->astate = EST_INACTIVE;
 873    s->pstate = EST_INACTIVE;
 874
 875    for(i = 0; i < NB_PORTS; i++) {
 876        if (s->companion_ports[i]) {
 877            s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
 878        } else {
 879            s->portsc[i] = PORTSC_PPOWER;
 880        }
 881        if (devs[i] && devs[i]->attached) {
 882            usb_attach(&s->ports[i]);
 883            usb_device_reset(devs[i]);
 884        }
 885    }
 886    ehci_queues_rip_all(s, 0);
 887    ehci_queues_rip_all(s, 1);
 888    timer_del(s->frame_timer);
 889    qemu_bh_cancel(s->async_bh);
 890}
 891
 892static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
 893                               unsigned size)
 894{
 895    EHCIState *s = ptr;
 896    return s->caps[addr];
 897}
 898
 899static void ehci_caps_write(void *ptr, hwaddr addr,
 900                             uint64_t val, unsigned size)
 901{
 902}
 903
 904static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
 905                                unsigned size)
 906{
 907    EHCIState *s = ptr;
 908    uint32_t val;
 909
 910    switch (addr) {
 911    case FRINDEX:
 912        /* Round down to mult of 8, else it can go backwards on migration */
 913        val = s->frindex & ~7;
 914        break;
 915    default:
 916        val = s->opreg[addr >> 2];
 917    }
 918
 919    trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
 920    return val;
 921}
 922
 923static uint64_t ehci_port_read(void *ptr, hwaddr addr,
 924                               unsigned size)
 925{
 926    EHCIState *s = ptr;
 927    uint32_t val;
 928
 929    val = s->portsc[addr >> 2];
 930    trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
 931    return val;
 932}
 933
 934static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
 935{
 936    USBDevice *dev = s->ports[port].dev;
 937    uint32_t *portsc = &s->portsc[port];
 938    uint32_t orig;
 939
 940    if (s->companion_ports[port] == NULL)
 941        return;
 942
 943    owner = owner & PORTSC_POWNER;
 944    orig  = *portsc & PORTSC_POWNER;
 945
 946    if (!(owner ^ orig)) {
 947        return;
 948    }
 949
 950    if (dev && dev->attached) {
 951        usb_detach(&s->ports[port]);
 952    }
 953
 954    *portsc &= ~PORTSC_POWNER;
 955    *portsc |= owner;
 956
 957    if (dev && dev->attached) {
 958        usb_attach(&s->ports[port]);
 959    }
 960}
 961
 962static void ehci_port_write(void *ptr, hwaddr addr,
 963                            uint64_t val, unsigned size)
 964{
 965    EHCIState *s = ptr;
 966    int port = addr >> 2;
 967    uint32_t *portsc = &s->portsc[port];
 968    uint32_t old = *portsc;
 969    USBDevice *dev = s->ports[port].dev;
 970
 971    trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
 972
 973    /* Clear rwc bits */
 974    *portsc &= ~(val & PORTSC_RWC_MASK);
 975    /* The guest may clear, but not set the PED bit */
 976    *portsc &= val | ~PORTSC_PED;
 977    /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
 978    handle_port_owner_write(s, port, val);
 979    /* And finally apply RO_MASK */
 980    val &= PORTSC_RO_MASK;
 981
 982    if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
 983        trace_usb_ehci_port_reset(port, 1);
 984    }
 985
 986    if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
 987        trace_usb_ehci_port_reset(port, 0);
 988        if (dev && dev->attached) {
 989            usb_port_reset(&s->ports[port]);
 990            *portsc &= ~PORTSC_CSC;
 991        }
 992
 993        /*
 994         *  Table 2.16 Set the enable bit(and enable bit change) to indicate
 995         *  to SW that this port has a high speed device attached
 996         */
 997        if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
 998            val |= PORTSC_PED;
 999        }
1000    }
1001
1002    if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) {
1003        trace_usb_ehci_port_suspend(port);
1004    }
1005    if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) {
1006        trace_usb_ehci_port_resume(port);
1007        val &= ~PORTSC_SUSPEND;
1008    }
1009
1010    *portsc &= ~PORTSC_RO_MASK;
1011    *portsc |= val;
1012    trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
1013}
1014
1015static void ehci_opreg_write(void *ptr, hwaddr addr,
1016                             uint64_t val, unsigned size)
1017{
1018    EHCIState *s = ptr;
1019    uint32_t *mmio = s->opreg + (addr >> 2);
1020    uint32_t old = *mmio;
1021    int i;
1022
1023    trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
1024
1025    switch (addr) {
1026    case USBCMD:
1027        if (val & USBCMD_HCRESET) {
1028            ehci_reset(s);
1029            val = s->usbcmd;
1030            break;
1031        }
1032
1033        /* not supporting dynamic frame list size at the moment */
1034        if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
1035            fprintf(stderr, "attempt to set frame list size -- value %d\n",
1036                    (int)val & USBCMD_FLS);
1037            val &= ~USBCMD_FLS;
1038        }
1039
1040        if (val & USBCMD_IAAD) {
1041            /*
1042             * Process IAAD immediately, otherwise the Linux IAAD watchdog may
1043             * trigger and re-use a qh without us seeing the unlink.
1044             */
1045            s->async_stepdown = 0;
1046            qemu_bh_schedule(s->async_bh);
1047            trace_usb_ehci_doorbell_ring();
1048        }
1049
1050        if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
1051            ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
1052            if (s->pstate == EST_INACTIVE) {
1053                SET_LAST_RUN_CLOCK(s);
1054            }
1055            s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
1056            ehci_update_halt(s);
1057            s->async_stepdown = 0;
1058            qemu_bh_schedule(s->async_bh);
1059        }
1060        break;
1061
1062    case USBSTS:
1063        val &= USBSTS_RO_MASK;              // bits 6 through 31 are RO
1064        ehci_clear_usbsts(s, val);          // bits 0 through 5 are R/WC
1065        val = s->usbsts;
1066        ehci_update_irq(s);
1067        break;
1068
1069    case USBINTR:
1070        val &= USBINTR_MASK;
1071        if (ehci_enabled(s) && (USBSTS_FLR & val)) {
1072            qemu_bh_schedule(s->async_bh);
1073        }
1074        break;
1075
1076    case FRINDEX:
1077        val &= 0x00003fff; /* frindex is 14bits */
1078        s->usbsts_frindex = val;
1079        break;
1080
1081    case CONFIGFLAG:
1082        val &= 0x1;
1083        if (val) {
1084            for(i = 0; i < NB_PORTS; i++)
1085                handle_port_owner_write(s, i, 0);
1086        }
1087        break;
1088
1089    case PERIODICLISTBASE:
1090        if (ehci_periodic_enabled(s)) {
1091            fprintf(stderr,
1092              "ehci: PERIODIC list base register set while periodic schedule\n"
1093              "      is enabled and HC is enabled\n");
1094        }
1095        break;
1096
1097    case ASYNCLISTADDR:
1098        if (ehci_async_enabled(s)) {
1099            fprintf(stderr,
1100              "ehci: ASYNC list address register set while async schedule\n"
1101              "      is enabled and HC is enabled\n");
1102        }
1103        break;
1104    }
1105
1106    *mmio = val;
1107    trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1108                                *mmio, old);
1109}
1110
1111/*
1112 *  Write the qh back to guest physical memory.  This step isn't
1113 *  in the EHCI spec but we need to do it since we don't share
1114 *  physical memory with our guest VM.
1115 *
1116 *  The first three dwords are read-only for the EHCI, so skip them
1117 *  when writing back the qh.
1118 */
1119static void ehci_flush_qh(EHCIQueue *q)
1120{
1121    uint32_t *qh = (uint32_t *) &q->qh;
1122    uint32_t dwords = sizeof(EHCIqh) >> 2;
1123    uint32_t addr = NLPTR_GET(q->qhaddr);
1124
1125    put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1126}
1127
1128// 4.10.2
1129
1130static int ehci_qh_do_overlay(EHCIQueue *q)
1131{
1132    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1133    int i;
1134    int dtoggle;
1135    int ping;
1136    int eps;
1137    int reload;
1138
1139    assert(p != NULL);
1140    assert(p->qtdaddr == q->qtdaddr);
1141
1142    // remember values in fields to preserve in qh after overlay
1143
1144    dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1145    ping    = q->qh.token & QTD_TOKEN_PING;
1146
1147    q->qh.current_qtd = p->qtdaddr;
1148    q->qh.next_qtd    = p->qtd.next;
1149    q->qh.altnext_qtd = p->qtd.altnext;
1150    q->qh.token       = p->qtd.token;
1151
1152
1153    eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1154    if (eps == EHCI_QH_EPS_HIGH) {
1155        q->qh.token &= ~QTD_TOKEN_PING;
1156        q->qh.token |= ping;
1157    }
1158
1159    reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1160    set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1161
1162    for (i = 0; i < 5; i++) {
1163        q->qh.bufptr[i] = p->qtd.bufptr[i];
1164    }
1165
1166    if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1167        // preserve QH DT bit
1168        q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1169        q->qh.token |= dtoggle;
1170    }
1171
1172    q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1173    q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1174
1175    ehci_flush_qh(q);
1176
1177    return 0;
1178}
1179
1180static int ehci_init_transfer(EHCIPacket *p)
1181{
1182    uint32_t cpage, offset, bytes, plen;
1183    dma_addr_t page;
1184
1185    cpage  = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1186    bytes  = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1187    offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1188    qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
1189
1190    while (bytes > 0) {
1191        if (cpage > 4) {
1192            fprintf(stderr, "cpage out of range (%d)\n", cpage);
1193            return -1;
1194        }
1195
1196        page  = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1197        page += offset;
1198        plen  = bytes;
1199        if (plen > 4096 - offset) {
1200            plen = 4096 - offset;
1201            offset = 0;
1202            cpage++;
1203        }
1204
1205        qemu_sglist_add(&p->sgl, page, plen);
1206        bytes -= plen;
1207    }
1208    return 0;
1209}
1210
1211static void ehci_finish_transfer(EHCIQueue *q, int len)
1212{
1213    uint32_t cpage, offset;
1214
1215    if (len > 0) {
1216        /* update cpage & offset */
1217        cpage  = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1218        offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1219
1220        offset += len;
1221        cpage  += offset >> QTD_BUFPTR_SH;
1222        offset &= ~QTD_BUFPTR_MASK;
1223
1224        set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1225        q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1226        q->qh.bufptr[0] |= offset;
1227    }
1228}
1229
1230static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1231{
1232    EHCIPacket *p;
1233    EHCIState *s = port->opaque;
1234    uint32_t portsc = s->portsc[port->index];
1235
1236    if (portsc & PORTSC_POWNER) {
1237        USBPort *companion = s->companion_ports[port->index];
1238        companion->ops->complete(companion, packet);
1239        return;
1240    }
1241
1242    p = container_of(packet, EHCIPacket, packet);
1243    assert(p->async == EHCI_ASYNC_INFLIGHT);
1244
1245    if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1246        trace_usb_ehci_packet_action(p->queue, p, "remove");
1247        ehci_free_packet(p);
1248        return;
1249    }
1250
1251    trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1252    p->async = EHCI_ASYNC_FINISHED;
1253
1254    if (!p->queue->async) {
1255        s->periodic_sched_active = PERIODIC_ACTIVE;
1256    }
1257    qemu_bh_schedule(s->async_bh);
1258}
1259
1260static void ehci_execute_complete(EHCIQueue *q)
1261{
1262    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1263    uint32_t tbytes;
1264
1265    assert(p != NULL);
1266    assert(p->qtdaddr == q->qtdaddr);
1267    assert(p->async == EHCI_ASYNC_INITIALIZED ||
1268           p->async == EHCI_ASYNC_FINISHED);
1269
1270    DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1271            "status %d, actual_length %d\n",
1272            q->qhaddr, q->qh.next, q->qtdaddr,
1273            p->packet.status, p->packet.actual_length);
1274
1275    switch (p->packet.status) {
1276    case USB_RET_SUCCESS:
1277        break;
1278    case USB_RET_IOERROR:
1279    case USB_RET_NODEV:
1280        q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1281        set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1282        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1283        break;
1284    case USB_RET_STALL:
1285        q->qh.token |= QTD_TOKEN_HALT;
1286        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1287        break;
1288    case USB_RET_NAK:
1289        set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1290        return; /* We're not done yet with this transaction */
1291    case USB_RET_BABBLE:
1292        q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1293        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1294        break;
1295    default:
1296        /* should not be triggerable */
1297        fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1298        g_assert_not_reached();
1299        break;
1300    }
1301
1302    /* TODO check 4.12 for splits */
1303    tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1304    if (tbytes && p->pid == USB_TOKEN_IN) {
1305        tbytes -= p->packet.actual_length;
1306        if (tbytes) {
1307            /* 4.15.1.2 must raise int on a short input packet */
1308            ehci_raise_irq(q->ehci, USBSTS_INT);
1309            if (q->async) {
1310                q->ehci->int_req_by_async = true;
1311            }
1312        }
1313    } else {
1314        tbytes = 0;
1315    }
1316    DPRINTF("updating tbytes to %d\n", tbytes);
1317    set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1318
1319    ehci_finish_transfer(q, p->packet.actual_length);
1320    usb_packet_unmap(&p->packet, &p->sgl);
1321    qemu_sglist_destroy(&p->sgl);
1322    p->async = EHCI_ASYNC_NONE;
1323
1324    q->qh.token ^= QTD_TOKEN_DTOGGLE;
1325    q->qh.token &= ~QTD_TOKEN_ACTIVE;
1326
1327    if (q->qh.token & QTD_TOKEN_IOC) {
1328        ehci_raise_irq(q->ehci, USBSTS_INT);
1329        if (q->async) {
1330            q->ehci->int_req_by_async = true;
1331        }
1332    }
1333}
1334
1335/* 4.10.3 returns "again" */
1336static int ehci_execute(EHCIPacket *p, const char *action)
1337{
1338    USBEndpoint *ep;
1339    int endp;
1340    bool spd;
1341
1342    assert(p->async == EHCI_ASYNC_NONE ||
1343           p->async == EHCI_ASYNC_INITIALIZED);
1344
1345    if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1346        fprintf(stderr, "Attempting to execute inactive qtd\n");
1347        return -1;
1348    }
1349
1350    if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1351        ehci_trace_guest_bug(p->queue->ehci,
1352                             "guest requested more bytes than allowed");
1353        return -1;
1354    }
1355
1356    if (!ehci_verify_pid(p->queue, &p->qtd)) {
1357        ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */
1358    }
1359    p->pid = ehci_get_pid(&p->qtd);
1360    p->queue->last_pid = p->pid;
1361    endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1362    ep = usb_ep_get(p->queue->dev, p->pid, endp);
1363
1364    if (p->async == EHCI_ASYNC_NONE) {
1365        if (ehci_init_transfer(p) != 0) {
1366            return -1;
1367        }
1368
1369        spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1370        usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
1371                         (p->qtd.token & QTD_TOKEN_IOC) != 0);
1372        usb_packet_map(&p->packet, &p->sgl);
1373        p->async = EHCI_ASYNC_INITIALIZED;
1374    }
1375
1376    trace_usb_ehci_packet_action(p->queue, p, action);
1377    usb_handle_packet(p->queue->dev, &p->packet);
1378    DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1379            "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1380            p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1381            p->packet.actual_length);
1382
1383    if (p->packet.actual_length > BUFF_SIZE) {
1384        fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1385        return -1;
1386    }
1387
1388    return 1;
1389}
1390
1391/*  4.7.2
1392 */
1393
1394static int ehci_process_itd(EHCIState *ehci,
1395                            EHCIitd *itd,
1396                            uint32_t addr)
1397{
1398    USBDevice *dev;
1399    USBEndpoint *ep;
1400    uint32_t i, len, pid, dir, devaddr, endp;
1401    uint32_t pg, off, ptr1, ptr2, max, mult;
1402
1403    ehci->periodic_sched_active = PERIODIC_ACTIVE;
1404
1405    dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1406    devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1407    endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1408    max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1409    mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1410
1411    for(i = 0; i < 8; i++) {
1412        if (itd->transact[i] & ITD_XACT_ACTIVE) {
1413            pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
1414            off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1415            len  = get_field(itd->transact[i], ITD_XACT_LENGTH);
1416
1417            if (len > max * mult) {
1418                len = max * mult;
1419            }
1420            if (len > BUFF_SIZE || pg > 6) {
1421                return -1;
1422            }
1423
1424            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1425            qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
1426            if (off + len > 4096) {
1427                /* transfer crosses page border */
1428                if (pg == 6) {
1429                    return -1;  /* avoid page pg + 1 */
1430                }
1431                ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
1432                uint32_t len2 = off + len - 4096;
1433                uint32_t len1 = len - len2;
1434                qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1435                qemu_sglist_add(&ehci->isgl, ptr2, len2);
1436            } else {
1437                qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1438            }
1439
1440            pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1441
1442            dev = ehci_find_device(ehci, devaddr);
1443            ep = usb_ep_get(dev, pid, endp);
1444            if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1445                usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
1446                                 (itd->transact[i] & ITD_XACT_IOC) != 0);
1447                usb_packet_map(&ehci->ipacket, &ehci->isgl);
1448                usb_handle_packet(dev, &ehci->ipacket);
1449                usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1450            } else {
1451                DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1452                ehci->ipacket.status = USB_RET_NAK;
1453                ehci->ipacket.actual_length = 0;
1454            }
1455            qemu_sglist_destroy(&ehci->isgl);
1456
1457            switch (ehci->ipacket.status) {
1458            case USB_RET_SUCCESS:
1459                break;
1460            default:
1461                fprintf(stderr, "Unexpected iso usb result: %d\n",
1462                        ehci->ipacket.status);
1463                /* Fall through */
1464            case USB_RET_IOERROR:
1465            case USB_RET_NODEV:
1466                /* 3.3.2: XACTERR is only allowed on IN transactions */
1467                if (dir) {
1468                    itd->transact[i] |= ITD_XACT_XACTERR;
1469                    ehci_raise_irq(ehci, USBSTS_ERRINT);
1470                }
1471                break;
1472            case USB_RET_BABBLE:
1473                itd->transact[i] |= ITD_XACT_BABBLE;
1474                ehci_raise_irq(ehci, USBSTS_ERRINT);
1475                break;
1476            case USB_RET_NAK:
1477                /* no data for us, so do a zero-length transfer */
1478                ehci->ipacket.actual_length = 0;
1479                break;
1480            }
1481            if (!dir) {
1482                set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1483                          ITD_XACT_LENGTH); /* OUT */
1484            } else {
1485                set_field(&itd->transact[i], ehci->ipacket.actual_length,
1486                          ITD_XACT_LENGTH); /* IN */
1487            }
1488            if (itd->transact[i] & ITD_XACT_IOC) {
1489                ehci_raise_irq(ehci, USBSTS_INT);
1490            }
1491            itd->transact[i] &= ~ITD_XACT_ACTIVE;
1492        }
1493    }
1494    return 0;
1495}
1496
1497
1498/*  This state is the entry point for asynchronous schedule
1499 *  processing.  Entry here consitutes a EHCI start event state (4.8.5)
1500 */
1501static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
1502{
1503    EHCIqh qh;
1504    int i = 0;
1505    int again = 0;
1506    uint32_t entry = ehci->asynclistaddr;
1507
1508    /* set reclamation flag at start event (4.8.6) */
1509    if (async) {
1510        ehci_set_usbsts(ehci, USBSTS_REC);
1511    }
1512
1513    ehci_queues_rip_unused(ehci, async);
1514
1515    /*  Find the head of the list (4.9.1.1) */
1516    for(i = 0; i < MAX_QH; i++) {
1517        if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1518                       sizeof(EHCIqh) >> 2) < 0) {
1519            return 0;
1520        }
1521        ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1522
1523        if (qh.epchar & QH_EPCHAR_H) {
1524            if (async) {
1525                entry |= (NLPTR_TYPE_QH << 1);
1526            }
1527
1528            ehci_set_fetch_addr(ehci, async, entry);
1529            ehci_set_state(ehci, async, EST_FETCHENTRY);
1530            again = 1;
1531            goto out;
1532        }
1533
1534        entry = qh.next;
1535        if (entry == ehci->asynclistaddr) {
1536            break;
1537        }
1538    }
1539
1540    /* no head found for list. */
1541
1542    ehci_set_state(ehci, async, EST_ACTIVE);
1543
1544out:
1545    return again;
1546}
1547
1548
1549/*  This state is the entry point for periodic schedule processing as
1550 *  well as being a continuation state for async processing.
1551 */
1552static int ehci_state_fetchentry(EHCIState *ehci, int async)
1553{
1554    int again = 0;
1555    uint32_t entry = ehci_get_fetch_addr(ehci, async);
1556
1557    if (NLPTR_TBIT(entry)) {
1558        ehci_set_state(ehci, async, EST_ACTIVE);
1559        goto out;
1560    }
1561
1562    /* section 4.8, only QH in async schedule */
1563    if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1564        fprintf(stderr, "non queue head request in async schedule\n");
1565        return -1;
1566    }
1567
1568    switch (NLPTR_TYPE_GET(entry)) {
1569    case NLPTR_TYPE_QH:
1570        ehci_set_state(ehci, async, EST_FETCHQH);
1571        again = 1;
1572        break;
1573
1574    case NLPTR_TYPE_ITD:
1575        ehci_set_state(ehci, async, EST_FETCHITD);
1576        again = 1;
1577        break;
1578
1579    case NLPTR_TYPE_STITD:
1580        ehci_set_state(ehci, async, EST_FETCHSITD);
1581        again = 1;
1582        break;
1583
1584    default:
1585        /* TODO: handle FSTN type */
1586        fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1587                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1588        return -1;
1589    }
1590
1591out:
1592    return again;
1593}
1594
1595static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1596{
1597    uint32_t entry;
1598    EHCIQueue *q;
1599    EHCIqh qh;
1600
1601    entry = ehci_get_fetch_addr(ehci, async);
1602    q = ehci_find_queue_by_qh(ehci, entry, async);
1603    if (q == NULL) {
1604        q = ehci_alloc_queue(ehci, entry, async);
1605    }
1606
1607    q->seen++;
1608    if (q->seen > 1) {
1609        /* we are going in circles -- stop processing */
1610        ehci_set_state(ehci, async, EST_ACTIVE);
1611        q = NULL;
1612        goto out;
1613    }
1614
1615    if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1616                   (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1617        q = NULL;
1618        goto out;
1619    }
1620    ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1621
1622    /*
1623     * The overlay area of the qh should never be changed by the guest,
1624     * except when idle, in which case the reset is a nop.
1625     */
1626    if (!ehci_verify_qh(q, &qh)) {
1627        if (ehci_reset_queue(q) > 0) {
1628            ehci_trace_guest_bug(ehci, "guest updated active QH");
1629        }
1630    }
1631    q->qh = qh;
1632
1633    q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1634    if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1635        q->transact_ctr = 4;
1636    }
1637
1638    if (q->dev == NULL) {
1639        q->dev = ehci_find_device(q->ehci,
1640                                  get_field(q->qh.epchar, QH_EPCHAR_DEVADDR));
1641    }
1642
1643    if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1644
1645        /*  EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1646        if (ehci->usbsts & USBSTS_REC) {
1647            ehci_clear_usbsts(ehci, USBSTS_REC);
1648        } else {
1649            DPRINTF("FETCHQH:  QH 0x%08x. H-bit set, reclamation status reset"
1650                       " - done processing\n", q->qhaddr);
1651            ehci_set_state(ehci, async, EST_ACTIVE);
1652            q = NULL;
1653            goto out;
1654        }
1655    }
1656
1657#if EHCI_DEBUG
1658    if (q->qhaddr != q->qh.next) {
1659    DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1660               q->qhaddr,
1661               q->qh.epchar & QH_EPCHAR_H,
1662               q->qh.token & QTD_TOKEN_HALT,
1663               q->qh.token & QTD_TOKEN_ACTIVE,
1664               q->qh.next);
1665    }
1666#endif
1667
1668    if (q->qh.token & QTD_TOKEN_HALT) {
1669        ehci_set_state(ehci, async, EST_HORIZONTALQH);
1670
1671    } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1672               (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
1673        q->qtdaddr = q->qh.current_qtd;
1674        ehci_set_state(ehci, async, EST_FETCHQTD);
1675
1676    } else {
1677        /*  EHCI spec version 1.0 Section 4.10.2 */
1678        ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1679    }
1680
1681out:
1682    return q;
1683}
1684
1685static int ehci_state_fetchitd(EHCIState *ehci, int async)
1686{
1687    uint32_t entry;
1688    EHCIitd itd;
1689
1690    assert(!async);
1691    entry = ehci_get_fetch_addr(ehci, async);
1692
1693    if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1694                   sizeof(EHCIitd) >> 2) < 0) {
1695        return -1;
1696    }
1697    ehci_trace_itd(ehci, entry, &itd);
1698
1699    if (ehci_process_itd(ehci, &itd, entry) != 0) {
1700        return -1;
1701    }
1702
1703    put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1704               sizeof(EHCIitd) >> 2);
1705    ehci_set_fetch_addr(ehci, async, itd.next);
1706    ehci_set_state(ehci, async, EST_FETCHENTRY);
1707
1708    return 1;
1709}
1710
1711static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1712{
1713    uint32_t entry;
1714    EHCIsitd sitd;
1715
1716    assert(!async);
1717    entry = ehci_get_fetch_addr(ehci, async);
1718
1719    if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1720                   sizeof(EHCIsitd) >> 2) < 0) {
1721        return 0;
1722    }
1723    ehci_trace_sitd(ehci, entry, &sitd);
1724
1725    if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1726        /* siTD is not active, nothing to do */;
1727    } else {
1728        /* TODO: split transfers are not implemented */
1729        fprintf(stderr, "WARNING: Skipping active siTD\n");
1730    }
1731
1732    ehci_set_fetch_addr(ehci, async, sitd.next);
1733    ehci_set_state(ehci, async, EST_FETCHENTRY);
1734    return 1;
1735}
1736
1737/* Section 4.10.2 - paragraph 3 */
1738static int ehci_state_advqueue(EHCIQueue *q)
1739{
1740#if 0
1741    /* TO-DO: 4.10.2 - paragraph 2
1742     * if I-bit is set to 1 and QH is not active
1743     * go to horizontal QH
1744     */
1745    if (I-bit set) {
1746        ehci_set_state(ehci, async, EST_HORIZONTALQH);
1747        goto out;
1748    }
1749#endif
1750
1751    /*
1752     * want data and alt-next qTD is valid
1753     */
1754    if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1755        (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1756        q->qtdaddr = q->qh.altnext_qtd;
1757        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1758
1759    /*
1760     *  next qTD is valid
1761     */
1762    } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1763        q->qtdaddr = q->qh.next_qtd;
1764        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1765
1766    /*
1767     *  no valid qTD, try next QH
1768     */
1769    } else {
1770        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1771    }
1772
1773    return 1;
1774}
1775
1776/* Section 4.10.2 - paragraph 4 */
1777static int ehci_state_fetchqtd(EHCIQueue *q)
1778{
1779    EHCIqtd qtd;
1780    EHCIPacket *p;
1781    int again = 1;
1782
1783    if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1784                   sizeof(EHCIqtd) >> 2) < 0) {
1785        return 0;
1786    }
1787    ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1788
1789    p = QTAILQ_FIRST(&q->packets);
1790    if (p != NULL) {
1791        if (!ehci_verify_qtd(p, &qtd)) {
1792            ehci_cancel_queue(q);
1793            if (qtd.token & QTD_TOKEN_ACTIVE) {
1794                ehci_trace_guest_bug(q->ehci, "guest updated active qTD");
1795            }
1796            p = NULL;
1797        } else {
1798            p->qtd = qtd;
1799            ehci_qh_do_overlay(q);
1800        }
1801    }
1802
1803    if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1804        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1805    } else if (p != NULL) {
1806        switch (p->async) {
1807        case EHCI_ASYNC_NONE:
1808        case EHCI_ASYNC_INITIALIZED:
1809            /* Not yet executed (MULT), or previously nacked (int) packet */
1810            ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1811            break;
1812        case EHCI_ASYNC_INFLIGHT:
1813            /* Check if the guest has added new tds to the queue */
1814            again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head));
1815            /* Unfinished async handled packet, go horizontal */
1816            ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1817            break;
1818        case EHCI_ASYNC_FINISHED:
1819            /* Complete executing of the packet */
1820            ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1821            break;
1822        }
1823    } else {
1824        p = ehci_alloc_packet(q);
1825        p->qtdaddr = q->qtdaddr;
1826        p->qtd = qtd;
1827        ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1828    }
1829
1830    return again;
1831}
1832
1833static int ehci_state_horizqh(EHCIQueue *q)
1834{
1835    int again = 0;
1836
1837    if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1838        ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1839        ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1840        again = 1;
1841    } else {
1842        ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1843    }
1844
1845    return again;
1846}
1847
1848/* Returns "again" */
1849static int ehci_fill_queue(EHCIPacket *p)
1850{
1851    USBEndpoint *ep = p->packet.ep;
1852    EHCIQueue *q = p->queue;
1853    EHCIqtd qtd = p->qtd;
1854    uint32_t qtdaddr;
1855
1856    for (;;) {
1857        if (NLPTR_TBIT(qtd.next) != 0) {
1858            break;
1859        }
1860        qtdaddr = qtd.next;
1861        /*
1862         * Detect circular td lists, Windows creates these, counting on the
1863         * active bit going low after execution to make the queue stop.
1864         */
1865        QTAILQ_FOREACH(p, &q->packets, next) {
1866            if (p->qtdaddr == qtdaddr) {
1867                goto leave;
1868            }
1869        }
1870        if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1871                       (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1872            return -1;
1873        }
1874        ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1875        if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1876            break;
1877        }
1878        if (!ehci_verify_pid(q, &qtd)) {
1879            ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
1880            break;
1881        }
1882        p = ehci_alloc_packet(q);
1883        p->qtdaddr = qtdaddr;
1884        p->qtd = qtd;
1885        if (ehci_execute(p, "queue") == -1) {
1886            return -1;
1887        }
1888        assert(p->packet.status == USB_RET_ASYNC);
1889        p->async = EHCI_ASYNC_INFLIGHT;
1890    }
1891leave:
1892    usb_device_flush_ep_queue(ep->dev, ep);
1893    return 1;
1894}
1895
1896static int ehci_state_execute(EHCIQueue *q)
1897{
1898    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1899    int again = 0;
1900
1901    assert(p != NULL);
1902    assert(p->qtdaddr == q->qtdaddr);
1903
1904    if (ehci_qh_do_overlay(q) != 0) {
1905        return -1;
1906    }
1907
1908    // TODO verify enough time remains in the uframe as in 4.4.1.1
1909    // TODO write back ptr to async list when done or out of time
1910
1911    /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1912    if (!q->async && q->transact_ctr == 0) {
1913        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1914        again = 1;
1915        goto out;
1916    }
1917
1918    if (q->async) {
1919        ehci_set_usbsts(q->ehci, USBSTS_REC);
1920    }
1921
1922    again = ehci_execute(p, "process");
1923    if (again == -1) {
1924        goto out;
1925    }
1926    if (p->packet.status == USB_RET_ASYNC) {
1927        ehci_flush_qh(q);
1928        trace_usb_ehci_packet_action(p->queue, p, "async");
1929        p->async = EHCI_ASYNC_INFLIGHT;
1930        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1931        if (q->async) {
1932            again = ehci_fill_queue(p);
1933        } else {
1934            again = 1;
1935        }
1936        goto out;
1937    }
1938
1939    ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1940    again = 1;
1941
1942out:
1943    return again;
1944}
1945
1946static int ehci_state_executing(EHCIQueue *q)
1947{
1948    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1949
1950    assert(p != NULL);
1951    assert(p->qtdaddr == q->qtdaddr);
1952
1953    ehci_execute_complete(q);
1954
1955    /* 4.10.3 */
1956    if (!q->async && q->transact_ctr > 0) {
1957        q->transact_ctr--;
1958    }
1959
1960    /* 4.10.5 */
1961    if (p->packet.status == USB_RET_NAK) {
1962        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1963    } else {
1964        ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1965    }
1966
1967    ehci_flush_qh(q);
1968    return 1;
1969}
1970
1971
1972static int ehci_state_writeback(EHCIQueue *q)
1973{
1974    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1975    uint32_t *qtd, addr;
1976    int again = 0;
1977
1978    /*  Write back the QTD from the QH area */
1979    assert(p != NULL);
1980    assert(p->qtdaddr == q->qtdaddr);
1981
1982    ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1983    qtd = (uint32_t *) &q->qh.next_qtd;
1984    addr = NLPTR_GET(p->qtdaddr);
1985    put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
1986    ehci_free_packet(p);
1987
1988    /*
1989     * EHCI specs say go horizontal here.
1990     *
1991     * We can also advance the queue here for performance reasons.  We
1992     * need to take care to only take that shortcut in case we've
1993     * processed the qtd just written back without errors, i.e. halt
1994     * bit is clear.
1995     */
1996    if (q->qh.token & QTD_TOKEN_HALT) {
1997        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1998        again = 1;
1999    } else {
2000        ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
2001        again = 1;
2002    }
2003    return again;
2004}
2005
2006/*
2007 * This is the state machine that is common to both async and periodic
2008 */
2009
2010static void ehci_advance_state(EHCIState *ehci, int async)
2011{
2012    EHCIQueue *q = NULL;
2013    int itd_count = 0;
2014    int again;
2015
2016    do {
2017        switch(ehci_get_state(ehci, async)) {
2018        case EST_WAITLISTHEAD:
2019            again = ehci_state_waitlisthead(ehci, async);
2020            break;
2021
2022        case EST_FETCHENTRY:
2023            again = ehci_state_fetchentry(ehci, async);
2024            break;
2025
2026        case EST_FETCHQH:
2027            q = ehci_state_fetchqh(ehci, async);
2028            if (q != NULL) {
2029                assert(q->async == async);
2030                again = 1;
2031            } else {
2032                again = 0;
2033            }
2034            break;
2035
2036        case EST_FETCHITD:
2037            again = ehci_state_fetchitd(ehci, async);
2038            itd_count++;
2039            break;
2040
2041        case EST_FETCHSITD:
2042            again = ehci_state_fetchsitd(ehci, async);
2043            itd_count++;
2044            break;
2045
2046        case EST_ADVANCEQUEUE:
2047            assert(q != NULL);
2048            again = ehci_state_advqueue(q);
2049            break;
2050
2051        case EST_FETCHQTD:
2052            assert(q != NULL);
2053            again = ehci_state_fetchqtd(q);
2054            break;
2055
2056        case EST_HORIZONTALQH:
2057            assert(q != NULL);
2058            again = ehci_state_horizqh(q);
2059            break;
2060
2061        case EST_EXECUTE:
2062            assert(q != NULL);
2063            again = ehci_state_execute(q);
2064            if (async) {
2065                ehci->async_stepdown = 0;
2066            }
2067            break;
2068
2069        case EST_EXECUTING:
2070            assert(q != NULL);
2071            if (async) {
2072                ehci->async_stepdown = 0;
2073            }
2074            again = ehci_state_executing(q);
2075            break;
2076
2077        case EST_WRITEBACK:
2078            assert(q != NULL);
2079            again = ehci_state_writeback(q);
2080            if (!async) {
2081                ehci->periodic_sched_active = PERIODIC_ACTIVE;
2082            }
2083            break;
2084
2085        default:
2086            fprintf(stderr, "Bad state!\n");
2087            again = -1;
2088            g_assert_not_reached();
2089            break;
2090        }
2091
2092        if (again < 0 || itd_count > 16) {
2093            /* TODO: notify guest (raise HSE irq?) */
2094            fprintf(stderr, "processing error - resetting ehci HC\n");
2095            ehci_reset(ehci);
2096            again = 0;
2097        }
2098    }
2099    while (again);
2100}
2101
2102static void ehci_advance_async_state(EHCIState *ehci)
2103{
2104    const int async = 1;
2105
2106    switch(ehci_get_state(ehci, async)) {
2107    case EST_INACTIVE:
2108        if (!ehci_async_enabled(ehci)) {
2109            break;
2110        }
2111        ehci_set_state(ehci, async, EST_ACTIVE);
2112        // No break, fall through to ACTIVE
2113
2114    case EST_ACTIVE:
2115        if (!ehci_async_enabled(ehci)) {
2116            ehci_queues_rip_all(ehci, async);
2117            ehci_set_state(ehci, async, EST_INACTIVE);
2118            break;
2119        }
2120
2121        /* make sure guest has acknowledged the doorbell interrupt */
2122        /* TO-DO: is this really needed? */
2123        if (ehci->usbsts & USBSTS_IAA) {
2124            DPRINTF("IAA status bit still set.\n");
2125            break;
2126        }
2127
2128        /* check that address register has been set */
2129        if (ehci->asynclistaddr == 0) {
2130            break;
2131        }
2132
2133        ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2134        ehci_advance_state(ehci, async);
2135
2136        /* If the doorbell is set, the guest wants to make a change to the
2137         * schedule. The host controller needs to release cached data.
2138         * (section 4.8.2)
2139         */
2140        if (ehci->usbcmd & USBCMD_IAAD) {
2141            /* Remove all unseen qhs from the async qhs queue */
2142            ehci_queues_rip_unseen(ehci, async);
2143            trace_usb_ehci_doorbell_ack();
2144            ehci->usbcmd &= ~USBCMD_IAAD;
2145            ehci_raise_irq(ehci, USBSTS_IAA);
2146        }
2147        break;
2148
2149    default:
2150        /* this should only be due to a developer mistake */
2151        fprintf(stderr, "ehci: Bad asynchronous state %d. "
2152                "Resetting to active\n", ehci->astate);
2153        g_assert_not_reached();
2154    }
2155}
2156
2157static void ehci_advance_periodic_state(EHCIState *ehci)
2158{
2159    uint32_t entry;
2160    uint32_t list;
2161    const int async = 0;
2162
2163    // 4.6
2164
2165    switch(ehci_get_state(ehci, async)) {
2166    case EST_INACTIVE:
2167        if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2168            ehci_set_state(ehci, async, EST_ACTIVE);
2169            // No break, fall through to ACTIVE
2170        } else
2171            break;
2172
2173    case EST_ACTIVE:
2174        if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2175            ehci_queues_rip_all(ehci, async);
2176            ehci_set_state(ehci, async, EST_INACTIVE);
2177            break;
2178        }
2179
2180        list = ehci->periodiclistbase & 0xfffff000;
2181        /* check that register has been set */
2182        if (list == 0) {
2183            break;
2184        }
2185        list |= ((ehci->frindex & 0x1ff8) >> 1);
2186
2187        if (get_dwords(ehci, list, &entry, 1) < 0) {
2188            break;
2189        }
2190
2191        DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
2192                ehci->frindex / 8, list, entry);
2193        ehci_set_fetch_addr(ehci, async,entry);
2194        ehci_set_state(ehci, async, EST_FETCHENTRY);
2195        ehci_advance_state(ehci, async);
2196        ehci_queues_rip_unused(ehci, async);
2197        break;
2198
2199    default:
2200        /* this should only be due to a developer mistake */
2201        fprintf(stderr, "ehci: Bad periodic state %d. "
2202                "Resetting to active\n", ehci->pstate);
2203        g_assert_not_reached();
2204    }
2205}
2206
2207static void ehci_update_frindex(EHCIState *ehci, int uframes)
2208{
2209    if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) {
2210        return;
2211    }
2212
2213    /* Generate FLR interrupt if frame index rolls over 0x2000 */
2214    if ((ehci->frindex % 0x2000) + uframes >= 0x2000) {
2215        ehci_raise_irq(ehci, USBSTS_FLR);
2216    }
2217
2218    /* How many times will frindex roll over 0x4000 with this frame count?
2219     * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
2220     */
2221    int rollovers = (ehci->frindex + uframes) / 0x4000;
2222    if (rollovers > 0) {
2223        if (ehci->usbsts_frindex >= (rollovers * 0x4000)) {
2224            ehci->usbsts_frindex -= 0x4000 * rollovers;
2225        } else {
2226            ehci->usbsts_frindex = 0;
2227        }
2228    }
2229
2230    ehci->frindex = (ehci->frindex + uframes) % 0x4000;
2231}
2232
2233static void ehci_frame_timer(void *opaque)
2234{
2235    EHCIState *ehci = opaque;
2236    int need_timer = 0;
2237    int64_t expire_time, t_now;
2238    uint64_t ns_elapsed;
2239    int uframes, skipped_uframes;
2240    int i;
2241
2242    t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2243    ns_elapsed = t_now - ehci->last_run_ns;
2244    uframes = ns_elapsed / UFRAME_TIMER_NS;
2245
2246    if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2247        need_timer++;
2248
2249        if (uframes > (ehci->maxframes * 8)) {
2250            skipped_uframes = uframes - (ehci->maxframes * 8);
2251            ehci_update_frindex(ehci, skipped_uframes);
2252            ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
2253            uframes -= skipped_uframes;
2254            DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes);
2255        }
2256
2257        for (i = 0; i < uframes; i++) {
2258            /*
2259             * If we're running behind schedule, we should not catch up
2260             * too fast, as that will make some guests unhappy:
2261             * 1) We must process a minimum of MIN_UFR_PER_TICK frames,
2262             *    otherwise we will never catch up
2263             * 2) Process frames until the guest has requested an irq (IOC)
2264             */
2265            if (i >= MIN_UFR_PER_TICK) {
2266                ehci_commit_irq(ehci);
2267                if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2268                    break;
2269                }
2270            }
2271            if (ehci->periodic_sched_active) {
2272                ehci->periodic_sched_active--;
2273            }
2274            ehci_update_frindex(ehci, 1);
2275            if ((ehci->frindex & 7) == 0) {
2276                ehci_advance_periodic_state(ehci);
2277            }
2278            ehci->last_run_ns += UFRAME_TIMER_NS;
2279        }
2280    } else {
2281        ehci->periodic_sched_active = 0;
2282        ehci_update_frindex(ehci, uframes);
2283        ehci->last_run_ns += UFRAME_TIMER_NS * uframes;
2284    }
2285
2286    if (ehci->periodic_sched_active) {
2287        ehci->async_stepdown = 0;
2288    } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2289        ehci->async_stepdown++;
2290    }
2291
2292    /*  Async is not inside loop since it executes everything it can once
2293     *  called
2294     */
2295    if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2296        need_timer++;
2297        ehci_advance_async_state(ehci);
2298    }
2299
2300    ehci_commit_irq(ehci);
2301    if (ehci->usbsts_pending) {
2302        need_timer++;
2303        ehci->async_stepdown = 0;
2304    }
2305
2306    if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2307        need_timer++;
2308    }
2309
2310    if (need_timer) {
2311        /* If we've raised int, we speed up the timer, so that we quickly
2312         * notice any new packets queued up in response */
2313        if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2314            expire_time = t_now +
2315                NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
2316            ehci->int_req_by_async = false;
2317        } else {
2318            expire_time = t_now + (NANOSECONDS_PER_SECOND
2319                               * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2320        }
2321        timer_mod(ehci->frame_timer, expire_time);
2322    }
2323}
2324
2325static const MemoryRegionOps ehci_mmio_caps_ops = {
2326    .read = ehci_caps_read,
2327    .write = ehci_caps_write,
2328    .valid.min_access_size = 1,
2329    .valid.max_access_size = 4,
2330    .impl.min_access_size = 1,
2331    .impl.max_access_size = 1,
2332    .endianness = DEVICE_LITTLE_ENDIAN,
2333};
2334
2335static const MemoryRegionOps ehci_mmio_opreg_ops = {
2336    .read = ehci_opreg_read,
2337    .write = ehci_opreg_write,
2338    .valid.min_access_size = 4,
2339    .valid.max_access_size = 4,
2340    .endianness = DEVICE_LITTLE_ENDIAN,
2341};
2342
2343static const MemoryRegionOps ehci_mmio_port_ops = {
2344    .read = ehci_port_read,
2345    .write = ehci_port_write,
2346    .valid.min_access_size = 4,
2347    .valid.max_access_size = 4,
2348    .endianness = DEVICE_LITTLE_ENDIAN,
2349};
2350
2351static USBPortOps ehci_port_ops = {
2352    .attach = ehci_attach,
2353    .detach = ehci_detach,
2354    .child_detach = ehci_child_detach,
2355    .wakeup = ehci_wakeup,
2356    .complete = ehci_async_complete_packet,
2357};
2358
2359static USBBusOps ehci_bus_ops_companion = {
2360    .register_companion = ehci_register_companion,
2361    .wakeup_endpoint = ehci_wakeup_endpoint,
2362};
2363static USBBusOps ehci_bus_ops_standalone = {
2364    .wakeup_endpoint = ehci_wakeup_endpoint,
2365};
2366
2367static void usb_ehci_pre_save(void *opaque)
2368{
2369    EHCIState *ehci = opaque;
2370    uint32_t new_frindex;
2371
2372    /* Round down frindex to a multiple of 8 for migration compatibility */
2373    new_frindex = ehci->frindex & ~7;
2374    ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
2375    ehci->frindex = new_frindex;
2376}
2377
2378static int usb_ehci_post_load(void *opaque, int version_id)
2379{
2380    EHCIState *s = opaque;
2381    int i;
2382
2383    for (i = 0; i < NB_PORTS; i++) {
2384        USBPort *companion = s->companion_ports[i];
2385        if (companion == NULL) {
2386            continue;
2387        }
2388        if (s->portsc[i] & PORTSC_POWNER) {
2389            companion->dev = s->ports[i].dev;
2390        } else {
2391            companion->dev = NULL;
2392        }
2393    }
2394
2395    return 0;
2396}
2397
2398static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2399{
2400    EHCIState *ehci = opaque;
2401
2402    /*
2403     * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2404     * schedule in guest memory. We must do the rebuilt ASAP, so that
2405     * USB-devices which have async handled packages have a packet in the
2406     * ep queue to match the completion with.
2407     */
2408    if (state == RUN_STATE_RUNNING) {
2409        ehci_advance_async_state(ehci);
2410    }
2411
2412    /*
2413     * The schedule rebuilt from guest memory could cause the migration dest
2414     * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2415     * will never have existed on the destination. Therefor we must flush the
2416     * async schedule on savevm to catch any not yet noticed unlinks.
2417     */
2418    if (state == RUN_STATE_SAVE_VM) {
2419        ehci_advance_async_state(ehci);
2420        ehci_queues_rip_unseen(ehci, 1);
2421    }
2422}
2423
2424const VMStateDescription vmstate_ehci = {
2425    .name        = "ehci-core",
2426    .version_id  = 2,
2427    .minimum_version_id  = 1,
2428    .pre_save    = usb_ehci_pre_save,
2429    .post_load   = usb_ehci_post_load,
2430    .fields = (VMStateField[]) {
2431        /* mmio registers */
2432        VMSTATE_UINT32(usbcmd, EHCIState),
2433        VMSTATE_UINT32(usbsts, EHCIState),
2434        VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2435        VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2436        VMSTATE_UINT32(usbintr, EHCIState),
2437        VMSTATE_UINT32(frindex, EHCIState),
2438        VMSTATE_UINT32(ctrldssegment, EHCIState),
2439        VMSTATE_UINT32(periodiclistbase, EHCIState),
2440        VMSTATE_UINT32(asynclistaddr, EHCIState),
2441        VMSTATE_UINT32(configflag, EHCIState),
2442        VMSTATE_UINT32(portsc[0], EHCIState),
2443        VMSTATE_UINT32(portsc[1], EHCIState),
2444        VMSTATE_UINT32(portsc[2], EHCIState),
2445        VMSTATE_UINT32(portsc[3], EHCIState),
2446        VMSTATE_UINT32(portsc[4], EHCIState),
2447        VMSTATE_UINT32(portsc[5], EHCIState),
2448        /* frame timer */
2449        VMSTATE_TIMER_PTR(frame_timer, EHCIState),
2450        VMSTATE_UINT64(last_run_ns, EHCIState),
2451        VMSTATE_UINT32(async_stepdown, EHCIState),
2452        /* schedule state */
2453        VMSTATE_UINT32(astate, EHCIState),
2454        VMSTATE_UINT32(pstate, EHCIState),
2455        VMSTATE_UINT32(a_fetch_addr, EHCIState),
2456        VMSTATE_UINT32(p_fetch_addr, EHCIState),
2457        VMSTATE_END_OF_LIST()
2458    }
2459};
2460
2461void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
2462{
2463    int i;
2464
2465    if (s->portnr > NB_PORTS) {
2466        error_setg(errp, "Too many ports! Max. port number is %d.",
2467                   NB_PORTS);
2468        return;
2469    }
2470
2471    usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
2472                &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);
2473    for (i = 0; i < s->portnr; i++) {
2474        usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2475                          USB_SPEED_MASK_HIGH);
2476        s->ports[i].dev = 0;
2477    }
2478
2479    s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_frame_timer, s);
2480    s->async_bh = qemu_bh_new(ehci_frame_timer, s);
2481    s->device = dev;
2482
2483    s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2484}
2485
2486void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp)
2487{
2488    trace_usb_ehci_unrealize();
2489
2490    if (s->frame_timer) {
2491        timer_del(s->frame_timer);
2492        timer_free(s->frame_timer);
2493        s->frame_timer = NULL;
2494    }
2495    if (s->async_bh) {
2496        qemu_bh_delete(s->async_bh);
2497    }
2498
2499    ehci_queues_rip_all(s, 0);
2500    ehci_queues_rip_all(s, 1);
2501
2502    memory_region_del_subregion(&s->mem, &s->mem_caps);
2503    memory_region_del_subregion(&s->mem, &s->mem_opreg);
2504    memory_region_del_subregion(&s->mem, &s->mem_ports);
2505
2506    usb_bus_release(&s->bus);
2507
2508    if (s->vmstate) {
2509        qemu_del_vm_change_state_handler(s->vmstate);
2510    }
2511}
2512
2513void usb_ehci_init(EHCIState *s, DeviceState *dev)
2514{
2515    /* 2.2 host controller interface version */
2516    s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2517    s->caps[0x01] = 0x00;
2518    s->caps[0x02] = 0x00;
2519    s->caps[0x03] = 0x01;        /* HC version */
2520    s->caps[0x04] = s->portnr;   /* Number of downstream ports */
2521    s->caps[0x05] = 0x00;        /* No companion ports at present */
2522    s->caps[0x06] = 0x00;
2523    s->caps[0x07] = 0x00;
2524    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
2525    s->caps[0x0a] = 0x00;
2526    s->caps[0x0b] = 0x00;
2527
2528    QTAILQ_INIT(&s->aqueues);
2529    QTAILQ_INIT(&s->pqueues);
2530    usb_packet_init(&s->ipacket);
2531
2532    memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
2533    memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
2534                          "capabilities", CAPA_SIZE);
2535    memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
2536                          "operational", s->portscbase);
2537    memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
2538                          "ports", 4 * s->portnr);
2539
2540    memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2541    memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2542    memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
2543                                &s->mem_ports);
2544}
2545
2546/*
2547 * vim: expandtab ts=4
2548 */
2549