1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30#include "qemu/osdep.h"
31#include "qapi/error.h"
32#include "hw/usb/ehci-regs.h"
33#include "hw/usb/hcd-ehci.h"
34#include "trace.h"
35
36#define FRAME_TIMER_FREQ 1000
37#define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
38#define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8)
39
40#define NB_MAXINTRATE 8
41#define BUFF_SIZE 5*4096
42#define MAX_QH 100
43#define MIN_UFR_PER_TICK 24
44#define PERIODIC_ACTIVE 512
45
46
47
48typedef enum {
49 EST_INACTIVE = 1000,
50 EST_ACTIVE,
51 EST_EXECUTING,
52 EST_SLEEPING,
53
54
55 EST_WAITLISTHEAD,
56 EST_FETCHENTRY,
57 EST_FETCHQH,
58 EST_FETCHITD,
59 EST_FETCHSITD,
60 EST_ADVANCEQUEUE,
61 EST_FETCHQTD,
62 EST_EXECUTE,
63 EST_WRITEBACK,
64 EST_HORIZONTALQH
65} EHCI_STATES;
66
67
68#define NLPTR_GET(x) ((x) & 0xffffffe0)
69#define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
70#define NLPTR_TBIT(x) ((x) & 1)
71
72
73#define NLPTR_TYPE_ITD 0
74#define NLPTR_TYPE_QH 1
75#define NLPTR_TYPE_STITD 2
76#define NLPTR_TYPE_FSTN 3
77
78#define SET_LAST_RUN_CLOCK(s) \
79 (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
80
81
82#define get_field(data, field) \
83 (((data) & field##_MASK) >> field##_SH)
84
85#define set_field(data, newval, field) do { \
86 uint32_t val = *data; \
87 val &= ~ field##_MASK; \
88 val |= ((newval) << field##_SH) & field##_MASK; \
89 *data = val; \
90 } while(0)
91
92static const char *ehci_state_names[] = {
93 [EST_INACTIVE] = "INACTIVE",
94 [EST_ACTIVE] = "ACTIVE",
95 [EST_EXECUTING] = "EXECUTING",
96 [EST_SLEEPING] = "SLEEPING",
97 [EST_WAITLISTHEAD] = "WAITLISTHEAD",
98 [EST_FETCHENTRY] = "FETCH ENTRY",
99 [EST_FETCHQH] = "FETCH QH",
100 [EST_FETCHITD] = "FETCH ITD",
101 [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
102 [EST_FETCHQTD] = "FETCH QTD",
103 [EST_EXECUTE] = "EXECUTE",
104 [EST_WRITEBACK] = "WRITEBACK",
105 [EST_HORIZONTALQH] = "HORIZONTALQH",
106};
107
108static const char *ehci_mmio_names[] = {
109 [USBCMD] = "USBCMD",
110 [USBSTS] = "USBSTS",
111 [USBINTR] = "USBINTR",
112 [FRINDEX] = "FRINDEX",
113 [PERIODICLISTBASE] = "P-LIST BASE",
114 [ASYNCLISTADDR] = "A-LIST ADDR",
115 [CONFIGFLAG] = "CONFIGFLAG",
116};
117
118static int ehci_state_executing(EHCIQueue *q);
119static int ehci_state_writeback(EHCIQueue *q);
120static int ehci_state_advqueue(EHCIQueue *q);
121static int ehci_fill_queue(EHCIPacket *p);
122static void ehci_free_packet(EHCIPacket *p);
123
124static const char *nr2str(const char **n, size_t len, uint32_t nr)
125{
126 if (nr < len && n[nr] != NULL) {
127 return n[nr];
128 } else {
129 return "unknown";
130 }
131}
132
133static const char *state2str(uint32_t state)
134{
135 return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
136}
137
138static const char *addr2str(hwaddr addr)
139{
140 return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
141}
142
143static void ehci_trace_usbsts(uint32_t mask, int state)
144{
145
146 if (mask & USBSTS_INT) {
147 trace_usb_ehci_usbsts("INT", state);
148 }
149 if (mask & USBSTS_ERRINT) {
150 trace_usb_ehci_usbsts("ERRINT", state);
151 }
152 if (mask & USBSTS_PCD) {
153 trace_usb_ehci_usbsts("PCD", state);
154 }
155 if (mask & USBSTS_FLR) {
156 trace_usb_ehci_usbsts("FLR", state);
157 }
158 if (mask & USBSTS_HSE) {
159 trace_usb_ehci_usbsts("HSE", state);
160 }
161 if (mask & USBSTS_IAA) {
162 trace_usb_ehci_usbsts("IAA", state);
163 }
164
165
166 if (mask & USBSTS_HALT) {
167 trace_usb_ehci_usbsts("HALT", state);
168 }
169 if (mask & USBSTS_REC) {
170 trace_usb_ehci_usbsts("REC", state);
171 }
172 if (mask & USBSTS_PSS) {
173 trace_usb_ehci_usbsts("PSS", state);
174 }
175 if (mask & USBSTS_ASS) {
176 trace_usb_ehci_usbsts("ASS", state);
177 }
178}
179
180static inline void ehci_set_usbsts(EHCIState *s, int mask)
181{
182 if ((s->usbsts & mask) == mask) {
183 return;
184 }
185 ehci_trace_usbsts(mask, 1);
186 s->usbsts |= mask;
187}
188
189static inline void ehci_clear_usbsts(EHCIState *s, int mask)
190{
191 if ((s->usbsts & mask) == 0) {
192 return;
193 }
194 ehci_trace_usbsts(mask, 0);
195 s->usbsts &= ~mask;
196}
197
198
199static inline void ehci_update_irq(EHCIState *s)
200{
201 int level = 0;
202
203 if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
204 level = 1;
205 }
206
207 trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
208 qemu_set_irq(s->irq, level);
209}
210
211
212static inline void ehci_raise_irq(EHCIState *s, int intr)
213{
214 if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
215 s->usbsts |= intr;
216 ehci_update_irq(s);
217 } else {
218 s->usbsts_pending |= intr;
219 }
220}
221
222
223
224
225
226static inline void ehci_commit_irq(EHCIState *s)
227{
228 uint32_t itc;
229
230 if (!s->usbsts_pending) {
231 return;
232 }
233 if (s->usbsts_frindex > s->frindex) {
234 return;
235 }
236
237 itc = (s->usbcmd >> 16) & 0xff;
238 s->usbsts |= s->usbsts_pending;
239 s->usbsts_pending = 0;
240 s->usbsts_frindex = s->frindex + itc;
241 ehci_update_irq(s);
242}
243
244static void ehci_update_halt(EHCIState *s)
245{
246 if (s->usbcmd & USBCMD_RUNSTOP) {
247 ehci_clear_usbsts(s, USBSTS_HALT);
248 } else {
249 if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
250 ehci_set_usbsts(s, USBSTS_HALT);
251 }
252 }
253}
254
255static void ehci_set_state(EHCIState *s, int async, int state)
256{
257 if (async) {
258 trace_usb_ehci_state("async", state2str(state));
259 s->astate = state;
260 if (s->astate == EST_INACTIVE) {
261 ehci_clear_usbsts(s, USBSTS_ASS);
262 ehci_update_halt(s);
263 } else {
264 ehci_set_usbsts(s, USBSTS_ASS);
265 }
266 } else {
267 trace_usb_ehci_state("periodic", state2str(state));
268 s->pstate = state;
269 if (s->pstate == EST_INACTIVE) {
270 ehci_clear_usbsts(s, USBSTS_PSS);
271 ehci_update_halt(s);
272 } else {
273 ehci_set_usbsts(s, USBSTS_PSS);
274 }
275 }
276}
277
278static int ehci_get_state(EHCIState *s, int async)
279{
280 return async ? s->astate : s->pstate;
281}
282
283static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
284{
285 if (async) {
286 s->a_fetch_addr = addr;
287 } else {
288 s->p_fetch_addr = addr;
289 }
290}
291
292static int ehci_get_fetch_addr(EHCIState *s, int async)
293{
294 return async ? s->a_fetch_addr : s->p_fetch_addr;
295}
296
297static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
298{
299
300 trace_usb_ehci_qh_ptrs(q, addr, qh->next,
301 qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
302 trace_usb_ehci_qh_fields(addr,
303 get_field(qh->epchar, QH_EPCHAR_RL),
304 get_field(qh->epchar, QH_EPCHAR_MPLEN),
305 get_field(qh->epchar, QH_EPCHAR_EPS),
306 get_field(qh->epchar, QH_EPCHAR_EP),
307 get_field(qh->epchar, QH_EPCHAR_DEVADDR));
308 trace_usb_ehci_qh_bits(addr,
309 (bool)(qh->epchar & QH_EPCHAR_C),
310 (bool)(qh->epchar & QH_EPCHAR_H),
311 (bool)(qh->epchar & QH_EPCHAR_DTC),
312 (bool)(qh->epchar & QH_EPCHAR_I));
313}
314
315static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
316{
317
318 trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
319 trace_usb_ehci_qtd_fields(addr,
320 get_field(qtd->token, QTD_TOKEN_TBYTES),
321 get_field(qtd->token, QTD_TOKEN_CPAGE),
322 get_field(qtd->token, QTD_TOKEN_CERR),
323 get_field(qtd->token, QTD_TOKEN_PID));
324 trace_usb_ehci_qtd_bits(addr,
325 (bool)(qtd->token & QTD_TOKEN_IOC),
326 (bool)(qtd->token & QTD_TOKEN_ACTIVE),
327 (bool)(qtd->token & QTD_TOKEN_HALT),
328 (bool)(qtd->token & QTD_TOKEN_BABBLE),
329 (bool)(qtd->token & QTD_TOKEN_XACTERR));
330}
331
332static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
333{
334 trace_usb_ehci_itd(addr, itd->next,
335 get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
336 get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
337 get_field(itd->bufptr[0], ITD_BUFPTR_EP),
338 get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
339}
340
341static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
342 EHCIsitd *sitd)
343{
344 trace_usb_ehci_sitd(addr, sitd->next,
345 (bool)(sitd->results & SITD_RESULTS_ACTIVE));
346}
347
348static void ehci_trace_guest_bug(EHCIState *s, const char *message)
349{
350 trace_usb_ehci_guest_bug(message);
351 fprintf(stderr, "ehci warning: %s\n", message);
352}
353
354static inline bool ehci_enabled(EHCIState *s)
355{
356 return s->usbcmd & USBCMD_RUNSTOP;
357}
358
359static inline bool ehci_async_enabled(EHCIState *s)
360{
361 return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
362}
363
364static inline bool ehci_periodic_enabled(EHCIState *s)
365{
366 return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
367}
368
369
370static inline int get_dwords(EHCIState *ehci, uint32_t addr,
371 uint32_t *buf, int num)
372{
373 int i;
374
375 if (!ehci->as) {
376 ehci_raise_irq(ehci, USBSTS_HSE);
377 ehci->usbcmd &= ~USBCMD_RUNSTOP;
378 trace_usb_ehci_dma_error();
379 return -1;
380 }
381
382 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
383 dma_memory_read(ehci->as, addr, buf, sizeof(*buf));
384 *buf = le32_to_cpu(*buf);
385 }
386
387 return num;
388}
389
390
391static inline int put_dwords(EHCIState *ehci, uint32_t addr,
392 uint32_t *buf, int num)
393{
394 int i;
395
396 if (!ehci->as) {
397 ehci_raise_irq(ehci, USBSTS_HSE);
398 ehci->usbcmd &= ~USBCMD_RUNSTOP;
399 trace_usb_ehci_dma_error();
400 return -1;
401 }
402
403 for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
404 uint32_t tmp = cpu_to_le32(*buf);
405 dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp));
406 }
407
408 return num;
409}
410
411static int ehci_get_pid(EHCIqtd *qtd)
412{
413 switch (get_field(qtd->token, QTD_TOKEN_PID)) {
414 case 0:
415 return USB_TOKEN_OUT;
416 case 1:
417 return USB_TOKEN_IN;
418 case 2:
419 return USB_TOKEN_SETUP;
420 default:
421 fprintf(stderr, "bad token\n");
422 return 0;
423 }
424}
425
426static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
427{
428 uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR);
429 uint32_t endp = get_field(qh->epchar, QH_EPCHAR_EP);
430 if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
431 (endp != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
432 (qh->current_qtd != q->qh.current_qtd) ||
433 (q->async && qh->next_qtd != q->qh.next_qtd) ||
434 (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
435 7 * sizeof(uint32_t)) != 0) ||
436 (q->dev != NULL && q->dev->addr != devaddr)) {
437 return false;
438 } else {
439 return true;
440 }
441}
442
443static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
444{
445 if (p->qtdaddr != p->queue->qtdaddr ||
446 (p->queue->async && !NLPTR_TBIT(p->qtd.next) &&
447 (p->qtd.next != qtd->next)) ||
448 (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
449 p->qtd.token != qtd->token ||
450 p->qtd.bufptr[0] != qtd->bufptr[0]) {
451 return false;
452 } else {
453 return true;
454 }
455}
456
457static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
458{
459 int ep = get_field(q->qh.epchar, QH_EPCHAR_EP);
460 int pid = ehci_get_pid(qtd);
461
462
463 if (q->last_pid && ep != 0 && pid != q->last_pid) {
464 return false;
465 } else {
466 return true;
467 }
468}
469
470
471
472static void ehci_writeback_async_complete_packet(EHCIPacket *p)
473{
474 EHCIQueue *q = p->queue;
475 EHCIqtd qtd;
476 EHCIqh qh;
477 int state;
478
479
480 get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
481 (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
482 get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
483 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
484 if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
485 p->async = EHCI_ASYNC_INITIALIZED;
486 ehci_free_packet(p);
487 return;
488 }
489
490 state = ehci_get_state(q->ehci, q->async);
491 ehci_state_executing(q);
492 ehci_state_writeback(q);
493 if (!(q->qh.token & QTD_TOKEN_HALT)) {
494 ehci_state_advqueue(q);
495 }
496 ehci_set_state(q->ehci, q->async, state);
497}
498
499
500
501static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
502{
503 EHCIPacket *p;
504
505 p = g_new0(EHCIPacket, 1);
506 p->queue = q;
507 usb_packet_init(&p->packet);
508 QTAILQ_INSERT_TAIL(&q->packets, p, next);
509 trace_usb_ehci_packet_action(p->queue, p, "alloc");
510 return p;
511}
512
513static void ehci_free_packet(EHCIPacket *p)
514{
515 if (p->async == EHCI_ASYNC_FINISHED &&
516 !(p->queue->qh.token & QTD_TOKEN_HALT)) {
517 ehci_writeback_async_complete_packet(p);
518 return;
519 }
520 trace_usb_ehci_packet_action(p->queue, p, "free");
521 if (p->async == EHCI_ASYNC_INFLIGHT) {
522 usb_cancel_packet(&p->packet);
523 }
524 if (p->async == EHCI_ASYNC_FINISHED &&
525 p->packet.status == USB_RET_SUCCESS) {
526 fprintf(stderr,
527 "EHCI: Dropping completed packet from halted %s ep %02X\n",
528 (p->pid == USB_TOKEN_IN) ? "in" : "out",
529 get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
530 }
531 if (p->async != EHCI_ASYNC_NONE) {
532 usb_packet_unmap(&p->packet, &p->sgl);
533 qemu_sglist_destroy(&p->sgl);
534 }
535 QTAILQ_REMOVE(&p->queue->packets, p, next);
536 usb_packet_cleanup(&p->packet);
537 g_free(p);
538}
539
540
541
542static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
543{
544 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
545 EHCIQueue *q;
546
547 q = g_malloc0(sizeof(*q));
548 q->ehci = ehci;
549 q->qhaddr = addr;
550 q->async = async;
551 QTAILQ_INIT(&q->packets);
552 QTAILQ_INSERT_HEAD(head, q, next);
553 trace_usb_ehci_queue_action(q, "alloc");
554 return q;
555}
556
557static void ehci_queue_stopped(EHCIQueue *q)
558{
559 int endp = get_field(q->qh.epchar, QH_EPCHAR_EP);
560
561 if (!q->last_pid || !q->dev) {
562 return;
563 }
564
565 usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp));
566}
567
568static int ehci_cancel_queue(EHCIQueue *q)
569{
570 EHCIPacket *p;
571 int packets = 0;
572
573 p = QTAILQ_FIRST(&q->packets);
574 if (p == NULL) {
575 goto leave;
576 }
577
578 trace_usb_ehci_queue_action(q, "cancel");
579 do {
580 ehci_free_packet(p);
581 packets++;
582 } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
583
584leave:
585 ehci_queue_stopped(q);
586 return packets;
587}
588
589static int ehci_reset_queue(EHCIQueue *q)
590{
591 int packets;
592
593 trace_usb_ehci_queue_action(q, "reset");
594 packets = ehci_cancel_queue(q);
595 q->dev = NULL;
596 q->qtdaddr = 0;
597 q->last_pid = 0;
598 return packets;
599}
600
601static void ehci_free_queue(EHCIQueue *q, const char *warn)
602{
603 EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
604 int cancelled;
605
606 trace_usb_ehci_queue_action(q, "free");
607 cancelled = ehci_cancel_queue(q);
608 if (warn && cancelled > 0) {
609 ehci_trace_guest_bug(q->ehci, warn);
610 }
611 QTAILQ_REMOVE(head, q, next);
612 g_free(q);
613}
614
615static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
616 int async)
617{
618 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
619 EHCIQueue *q;
620
621 QTAILQ_FOREACH(q, head, next) {
622 if (addr == q->qhaddr) {
623 return q;
624 }
625 }
626 return NULL;
627}
628
629static void ehci_queues_rip_unused(EHCIState *ehci, int async)
630{
631 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
632 const char *warn = async ? "guest unlinked busy QH" : NULL;
633 uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
634 EHCIQueue *q, *tmp;
635
636 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
637 if (q->seen) {
638 q->seen = 0;
639 q->ts = ehci->last_run_ns;
640 continue;
641 }
642 if (ehci->last_run_ns < q->ts + maxage) {
643 continue;
644 }
645 ehci_free_queue(q, warn);
646 }
647}
648
649static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
650{
651 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
652 EHCIQueue *q, *tmp;
653
654 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
655 if (!q->seen) {
656 ehci_free_queue(q, NULL);
657 }
658 }
659}
660
661static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
662{
663 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
664 EHCIQueue *q, *tmp;
665
666 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
667 if (q->dev != dev) {
668 continue;
669 }
670 ehci_free_queue(q, NULL);
671 }
672}
673
674static void ehci_queues_rip_all(EHCIState *ehci, int async)
675{
676 EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
677 const char *warn = async ? "guest stopped busy async schedule" : NULL;
678 EHCIQueue *q, *tmp;
679
680 QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
681 ehci_free_queue(q, warn);
682 }
683}
684
685
686
687static void ehci_attach(USBPort *port)
688{
689 EHCIState *s = port->opaque;
690 uint32_t *portsc = &s->portsc[port->index];
691 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
692
693 trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
694
695 if (*portsc & PORTSC_POWNER) {
696 USBPort *companion = s->companion_ports[port->index];
697 companion->dev = port->dev;
698 companion->ops->attach(companion);
699 return;
700 }
701
702 *portsc |= PORTSC_CONNECT;
703 *portsc |= PORTSC_CSC;
704
705 ehci_raise_irq(s, USBSTS_PCD);
706}
707
708static void ehci_detach(USBPort *port)
709{
710 EHCIState *s = port->opaque;
711 uint32_t *portsc = &s->portsc[port->index];
712 const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
713
714 trace_usb_ehci_port_detach(port->index, owner);
715
716 if (*portsc & PORTSC_POWNER) {
717 USBPort *companion = s->companion_ports[port->index];
718 companion->ops->detach(companion);
719 companion->dev = NULL;
720
721
722
723
724 *portsc &= ~PORTSC_POWNER;
725 return;
726 }
727
728 ehci_queues_rip_device(s, port->dev, 0);
729 ehci_queues_rip_device(s, port->dev, 1);
730
731 *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
732 *portsc |= PORTSC_CSC;
733
734 ehci_raise_irq(s, USBSTS_PCD);
735}
736
737static void ehci_child_detach(USBPort *port, USBDevice *child)
738{
739 EHCIState *s = port->opaque;
740 uint32_t portsc = s->portsc[port->index];
741
742 if (portsc & PORTSC_POWNER) {
743 USBPort *companion = s->companion_ports[port->index];
744 companion->ops->child_detach(companion, child);
745 return;
746 }
747
748 ehci_queues_rip_device(s, child, 0);
749 ehci_queues_rip_device(s, child, 1);
750}
751
752static void ehci_wakeup(USBPort *port)
753{
754 EHCIState *s = port->opaque;
755 uint32_t *portsc = &s->portsc[port->index];
756
757 if (*portsc & PORTSC_POWNER) {
758 USBPort *companion = s->companion_ports[port->index];
759 if (companion->ops->wakeup) {
760 companion->ops->wakeup(companion);
761 }
762 return;
763 }
764
765 if (*portsc & PORTSC_SUSPEND) {
766 trace_usb_ehci_port_wakeup(port->index);
767 *portsc |= PORTSC_FPRES;
768 ehci_raise_irq(s, USBSTS_PCD);
769 }
770
771 qemu_bh_schedule(s->async_bh);
772}
773
774static void ehci_register_companion(USBBus *bus, USBPort *ports[],
775 uint32_t portcount, uint32_t firstport,
776 Error **errp)
777{
778 EHCIState *s = container_of(bus, EHCIState, bus);
779 uint32_t i;
780
781 if (firstport + portcount > NB_PORTS) {
782 error_setg(errp, "firstport must be between 0 and %u",
783 NB_PORTS - portcount);
784 return;
785 }
786
787 for (i = 0; i < portcount; i++) {
788 if (s->companion_ports[firstport + i]) {
789 error_setg(errp, "firstport %u asks for ports %u-%u,"
790 " but port %u has a companion assigned already",
791 firstport, firstport, firstport + portcount - 1,
792 firstport + i);
793 return;
794 }
795 }
796
797 for (i = 0; i < portcount; i++) {
798 s->companion_ports[firstport + i] = ports[i];
799 s->ports[firstport + i].speedmask |=
800 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
801
802 s->portsc[firstport + i] = PORTSC_POWNER;
803 }
804
805 s->companion_count++;
806 s->caps[0x05] = (s->companion_count << 4) | portcount;
807}
808
809static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
810 unsigned int stream)
811{
812 EHCIState *s = container_of(bus, EHCIState, bus);
813 uint32_t portsc = s->portsc[ep->dev->port->index];
814
815 if (portsc & PORTSC_POWNER) {
816 return;
817 }
818
819 s->periodic_sched_active = PERIODIC_ACTIVE;
820 qemu_bh_schedule(s->async_bh);
821}
822
823static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
824{
825 USBDevice *dev;
826 USBPort *port;
827 int i;
828
829 for (i = 0; i < NB_PORTS; i++) {
830 port = &ehci->ports[i];
831 if (!(ehci->portsc[i] & PORTSC_PED)) {
832 DPRINTF("Port %d not enabled\n", i);
833 continue;
834 }
835 dev = usb_find_device(port, addr);
836 if (dev != NULL) {
837 return dev;
838 }
839 }
840 return NULL;
841}
842
843
844void ehci_reset(void *opaque)
845{
846 EHCIState *s = opaque;
847 int i;
848 USBDevice *devs[NB_PORTS];
849
850 trace_usb_ehci_reset();
851
852
853
854
855
856 for(i = 0; i < NB_PORTS; i++) {
857 devs[i] = s->ports[i].dev;
858 if (devs[i] && devs[i]->attached) {
859 usb_detach(&s->ports[i]);
860 }
861 }
862
863 memset(&s->opreg, 0x00, sizeof(s->opreg));
864 memset(&s->portsc, 0x00, sizeof(s->portsc));
865
866 s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
867 s->usbsts = USBSTS_HALT;
868 s->usbsts_pending = 0;
869 s->usbsts_frindex = 0;
870 ehci_update_irq(s);
871
872 s->astate = EST_INACTIVE;
873 s->pstate = EST_INACTIVE;
874
875 for(i = 0; i < NB_PORTS; i++) {
876 if (s->companion_ports[i]) {
877 s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
878 } else {
879 s->portsc[i] = PORTSC_PPOWER;
880 }
881 if (devs[i] && devs[i]->attached) {
882 usb_attach(&s->ports[i]);
883 usb_device_reset(devs[i]);
884 }
885 }
886 ehci_queues_rip_all(s, 0);
887 ehci_queues_rip_all(s, 1);
888 timer_del(s->frame_timer);
889 qemu_bh_cancel(s->async_bh);
890}
891
892static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
893 unsigned size)
894{
895 EHCIState *s = ptr;
896 return s->caps[addr];
897}
898
899static void ehci_caps_write(void *ptr, hwaddr addr,
900 uint64_t val, unsigned size)
901{
902}
903
904static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
905 unsigned size)
906{
907 EHCIState *s = ptr;
908 uint32_t val;
909
910 switch (addr) {
911 case FRINDEX:
912
913 val = s->frindex & ~7;
914 break;
915 default:
916 val = s->opreg[addr >> 2];
917 }
918
919 trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
920 return val;
921}
922
923static uint64_t ehci_port_read(void *ptr, hwaddr addr,
924 unsigned size)
925{
926 EHCIState *s = ptr;
927 uint32_t val;
928
929 val = s->portsc[addr >> 2];
930 trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
931 return val;
932}
933
934static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
935{
936 USBDevice *dev = s->ports[port].dev;
937 uint32_t *portsc = &s->portsc[port];
938 uint32_t orig;
939
940 if (s->companion_ports[port] == NULL)
941 return;
942
943 owner = owner & PORTSC_POWNER;
944 orig = *portsc & PORTSC_POWNER;
945
946 if (!(owner ^ orig)) {
947 return;
948 }
949
950 if (dev && dev->attached) {
951 usb_detach(&s->ports[port]);
952 }
953
954 *portsc &= ~PORTSC_POWNER;
955 *portsc |= owner;
956
957 if (dev && dev->attached) {
958 usb_attach(&s->ports[port]);
959 }
960}
961
962static void ehci_port_write(void *ptr, hwaddr addr,
963 uint64_t val, unsigned size)
964{
965 EHCIState *s = ptr;
966 int port = addr >> 2;
967 uint32_t *portsc = &s->portsc[port];
968 uint32_t old = *portsc;
969 USBDevice *dev = s->ports[port].dev;
970
971 trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
972
973
974 *portsc &= ~(val & PORTSC_RWC_MASK);
975
976 *portsc &= val | ~PORTSC_PED;
977
978 handle_port_owner_write(s, port, val);
979
980 val &= PORTSC_RO_MASK;
981
982 if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
983 trace_usb_ehci_port_reset(port, 1);
984 }
985
986 if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
987 trace_usb_ehci_port_reset(port, 0);
988 if (dev && dev->attached) {
989 usb_port_reset(&s->ports[port]);
990 *portsc &= ~PORTSC_CSC;
991 }
992
993
994
995
996
997 if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
998 val |= PORTSC_PED;
999 }
1000 }
1001
1002 if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) {
1003 trace_usb_ehci_port_suspend(port);
1004 }
1005 if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) {
1006 trace_usb_ehci_port_resume(port);
1007 val &= ~PORTSC_SUSPEND;
1008 }
1009
1010 *portsc &= ~PORTSC_RO_MASK;
1011 *portsc |= val;
1012 trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
1013}
1014
1015static void ehci_opreg_write(void *ptr, hwaddr addr,
1016 uint64_t val, unsigned size)
1017{
1018 EHCIState *s = ptr;
1019 uint32_t *mmio = s->opreg + (addr >> 2);
1020 uint32_t old = *mmio;
1021 int i;
1022
1023 trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
1024
1025 switch (addr) {
1026 case USBCMD:
1027 if (val & USBCMD_HCRESET) {
1028 ehci_reset(s);
1029 val = s->usbcmd;
1030 break;
1031 }
1032
1033
1034 if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
1035 fprintf(stderr, "attempt to set frame list size -- value %d\n",
1036 (int)val & USBCMD_FLS);
1037 val &= ~USBCMD_FLS;
1038 }
1039
1040 if (val & USBCMD_IAAD) {
1041
1042
1043
1044
1045 s->async_stepdown = 0;
1046 qemu_bh_schedule(s->async_bh);
1047 trace_usb_ehci_doorbell_ring();
1048 }
1049
1050 if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
1051 ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
1052 if (s->pstate == EST_INACTIVE) {
1053 SET_LAST_RUN_CLOCK(s);
1054 }
1055 s->usbcmd = val;
1056 ehci_update_halt(s);
1057 s->async_stepdown = 0;
1058 qemu_bh_schedule(s->async_bh);
1059 }
1060 break;
1061
1062 case USBSTS:
1063 val &= USBSTS_RO_MASK;
1064 ehci_clear_usbsts(s, val);
1065 val = s->usbsts;
1066 ehci_update_irq(s);
1067 break;
1068
1069 case USBINTR:
1070 val &= USBINTR_MASK;
1071 if (ehci_enabled(s) && (USBSTS_FLR & val)) {
1072 qemu_bh_schedule(s->async_bh);
1073 }
1074 break;
1075
1076 case FRINDEX:
1077 val &= 0x00003fff;
1078 s->usbsts_frindex = val;
1079 break;
1080
1081 case CONFIGFLAG:
1082 val &= 0x1;
1083 if (val) {
1084 for(i = 0; i < NB_PORTS; i++)
1085 handle_port_owner_write(s, i, 0);
1086 }
1087 break;
1088
1089 case PERIODICLISTBASE:
1090 if (ehci_periodic_enabled(s)) {
1091 fprintf(stderr,
1092 "ehci: PERIODIC list base register set while periodic schedule\n"
1093 " is enabled and HC is enabled\n");
1094 }
1095 break;
1096
1097 case ASYNCLISTADDR:
1098 if (ehci_async_enabled(s)) {
1099 fprintf(stderr,
1100 "ehci: ASYNC list address register set while async schedule\n"
1101 " is enabled and HC is enabled\n");
1102 }
1103 break;
1104 }
1105
1106 *mmio = val;
1107 trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1108 *mmio, old);
1109}
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119static void ehci_flush_qh(EHCIQueue *q)
1120{
1121 uint32_t *qh = (uint32_t *) &q->qh;
1122 uint32_t dwords = sizeof(EHCIqh) >> 2;
1123 uint32_t addr = NLPTR_GET(q->qhaddr);
1124
1125 put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1126}
1127
1128
1129
1130static int ehci_qh_do_overlay(EHCIQueue *q)
1131{
1132 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1133 int i;
1134 int dtoggle;
1135 int ping;
1136 int eps;
1137 int reload;
1138
1139 assert(p != NULL);
1140 assert(p->qtdaddr == q->qtdaddr);
1141
1142
1143
1144 dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1145 ping = q->qh.token & QTD_TOKEN_PING;
1146
1147 q->qh.current_qtd = p->qtdaddr;
1148 q->qh.next_qtd = p->qtd.next;
1149 q->qh.altnext_qtd = p->qtd.altnext;
1150 q->qh.token = p->qtd.token;
1151
1152
1153 eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1154 if (eps == EHCI_QH_EPS_HIGH) {
1155 q->qh.token &= ~QTD_TOKEN_PING;
1156 q->qh.token |= ping;
1157 }
1158
1159 reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1160 set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1161
1162 for (i = 0; i < 5; i++) {
1163 q->qh.bufptr[i] = p->qtd.bufptr[i];
1164 }
1165
1166 if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1167
1168 q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1169 q->qh.token |= dtoggle;
1170 }
1171
1172 q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1173 q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1174
1175 ehci_flush_qh(q);
1176
1177 return 0;
1178}
1179
1180static int ehci_init_transfer(EHCIPacket *p)
1181{
1182 uint32_t cpage, offset, bytes, plen;
1183 dma_addr_t page;
1184
1185 cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1186 bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1187 offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1188 qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
1189
1190 while (bytes > 0) {
1191 if (cpage > 4) {
1192 fprintf(stderr, "cpage out of range (%d)\n", cpage);
1193 qemu_sglist_destroy(&p->sgl);
1194 return -1;
1195 }
1196
1197 page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1198 page += offset;
1199 plen = bytes;
1200 if (plen > 4096 - offset) {
1201 plen = 4096 - offset;
1202 offset = 0;
1203 cpage++;
1204 }
1205
1206 qemu_sglist_add(&p->sgl, page, plen);
1207 bytes -= plen;
1208 }
1209 return 0;
1210}
1211
1212static void ehci_finish_transfer(EHCIQueue *q, int len)
1213{
1214 uint32_t cpage, offset;
1215
1216 if (len > 0) {
1217
1218 cpage = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1219 offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1220
1221 offset += len;
1222 cpage += offset >> QTD_BUFPTR_SH;
1223 offset &= ~QTD_BUFPTR_MASK;
1224
1225 set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1226 q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1227 q->qh.bufptr[0] |= offset;
1228 }
1229}
1230
1231static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1232{
1233 EHCIPacket *p;
1234 EHCIState *s = port->opaque;
1235 uint32_t portsc = s->portsc[port->index];
1236
1237 if (portsc & PORTSC_POWNER) {
1238 USBPort *companion = s->companion_ports[port->index];
1239 companion->ops->complete(companion, packet);
1240 return;
1241 }
1242
1243 p = container_of(packet, EHCIPacket, packet);
1244 assert(p->async == EHCI_ASYNC_INFLIGHT);
1245
1246 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1247 trace_usb_ehci_packet_action(p->queue, p, "remove");
1248 ehci_free_packet(p);
1249 return;
1250 }
1251
1252 trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1253 p->async = EHCI_ASYNC_FINISHED;
1254
1255 if (!p->queue->async) {
1256 s->periodic_sched_active = PERIODIC_ACTIVE;
1257 }
1258 qemu_bh_schedule(s->async_bh);
1259}
1260
1261static void ehci_execute_complete(EHCIQueue *q)
1262{
1263 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1264 uint32_t tbytes;
1265
1266 assert(p != NULL);
1267 assert(p->qtdaddr == q->qtdaddr);
1268 assert(p->async == EHCI_ASYNC_INITIALIZED ||
1269 p->async == EHCI_ASYNC_FINISHED);
1270
1271 DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1272 "status %d, actual_length %d\n",
1273 q->qhaddr, q->qh.next, q->qtdaddr,
1274 p->packet.status, p->packet.actual_length);
1275
1276 switch (p->packet.status) {
1277 case USB_RET_SUCCESS:
1278 break;
1279 case USB_RET_IOERROR:
1280 case USB_RET_NODEV:
1281 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1282 set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1283 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1284 break;
1285 case USB_RET_STALL:
1286 q->qh.token |= QTD_TOKEN_HALT;
1287 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1288 break;
1289 case USB_RET_NAK:
1290 set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1291 return;
1292 case USB_RET_BABBLE:
1293 q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1294 ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1295 break;
1296 default:
1297
1298 fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1299 g_assert_not_reached();
1300 break;
1301 }
1302
1303
1304 tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1305 if (tbytes && p->pid == USB_TOKEN_IN) {
1306 tbytes -= p->packet.actual_length;
1307 if (tbytes) {
1308
1309 ehci_raise_irq(q->ehci, USBSTS_INT);
1310 if (q->async) {
1311 q->ehci->int_req_by_async = true;
1312 }
1313 }
1314 } else {
1315 tbytes = 0;
1316 }
1317 DPRINTF("updating tbytes to %d\n", tbytes);
1318 set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1319
1320 ehci_finish_transfer(q, p->packet.actual_length);
1321 usb_packet_unmap(&p->packet, &p->sgl);
1322 qemu_sglist_destroy(&p->sgl);
1323 p->async = EHCI_ASYNC_NONE;
1324
1325 q->qh.token ^= QTD_TOKEN_DTOGGLE;
1326 q->qh.token &= ~QTD_TOKEN_ACTIVE;
1327
1328 if (q->qh.token & QTD_TOKEN_IOC) {
1329 ehci_raise_irq(q->ehci, USBSTS_INT);
1330 if (q->async) {
1331 q->ehci->int_req_by_async = true;
1332 }
1333 }
1334}
1335
1336
1337static int ehci_execute(EHCIPacket *p, const char *action)
1338{
1339 USBEndpoint *ep;
1340 int endp;
1341 bool spd;
1342
1343 assert(p->async == EHCI_ASYNC_NONE ||
1344 p->async == EHCI_ASYNC_INITIALIZED);
1345
1346 if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1347 fprintf(stderr, "Attempting to execute inactive qtd\n");
1348 return -1;
1349 }
1350
1351 if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1352 ehci_trace_guest_bug(p->queue->ehci,
1353 "guest requested more bytes than allowed");
1354 return -1;
1355 }
1356
1357 if (!ehci_verify_pid(p->queue, &p->qtd)) {
1358 ehci_queue_stopped(p->queue);
1359 }
1360 p->pid = ehci_get_pid(&p->qtd);
1361 p->queue->last_pid = p->pid;
1362 endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1363 ep = usb_ep_get(p->queue->dev, p->pid, endp);
1364
1365 if (p->async == EHCI_ASYNC_NONE) {
1366 if (ehci_init_transfer(p) != 0) {
1367 return -1;
1368 }
1369
1370 spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1371 usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
1372 (p->qtd.token & QTD_TOKEN_IOC) != 0);
1373 usb_packet_map(&p->packet, &p->sgl);
1374 p->async = EHCI_ASYNC_INITIALIZED;
1375 }
1376
1377 trace_usb_ehci_packet_action(p->queue, p, action);
1378 usb_handle_packet(p->queue->dev, &p->packet);
1379 DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1380 "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1381 p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1382 p->packet.actual_length);
1383
1384 if (p->packet.actual_length > BUFF_SIZE) {
1385 fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1386 return -1;
1387 }
1388
1389 return 1;
1390}
1391
1392
1393
1394
1395static int ehci_process_itd(EHCIState *ehci,
1396 EHCIitd *itd,
1397 uint32_t addr)
1398{
1399 USBDevice *dev;
1400 USBEndpoint *ep;
1401 uint32_t i, len, pid, dir, devaddr, endp;
1402 uint32_t pg, off, ptr1, ptr2, max, mult;
1403
1404 ehci->periodic_sched_active = PERIODIC_ACTIVE;
1405
1406 dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1407 devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1408 endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1409 max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1410 mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1411
1412 for(i = 0; i < 8; i++) {
1413 if (itd->transact[i] & ITD_XACT_ACTIVE) {
1414 pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
1415 off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1416 len = get_field(itd->transact[i], ITD_XACT_LENGTH);
1417
1418 if (len > max * mult) {
1419 len = max * mult;
1420 }
1421 if (len > BUFF_SIZE || pg > 6) {
1422 return -1;
1423 }
1424
1425 ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1426 qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
1427 if (off + len > 4096) {
1428
1429 if (pg == 6) {
1430 qemu_sglist_destroy(&ehci->isgl);
1431 return -1;
1432 }
1433 ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
1434 uint32_t len2 = off + len - 4096;
1435 uint32_t len1 = len - len2;
1436 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1437 qemu_sglist_add(&ehci->isgl, ptr2, len2);
1438 } else {
1439 qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1440 }
1441
1442 pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1443
1444 dev = ehci_find_device(ehci, devaddr);
1445 ep = usb_ep_get(dev, pid, endp);
1446 if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1447 usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
1448 (itd->transact[i] & ITD_XACT_IOC) != 0);
1449 usb_packet_map(&ehci->ipacket, &ehci->isgl);
1450 usb_handle_packet(dev, &ehci->ipacket);
1451 usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1452 } else {
1453 DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
1454 ehci->ipacket.status = USB_RET_NAK;
1455 ehci->ipacket.actual_length = 0;
1456 }
1457 qemu_sglist_destroy(&ehci->isgl);
1458
1459 switch (ehci->ipacket.status) {
1460 case USB_RET_SUCCESS:
1461 break;
1462 default:
1463 fprintf(stderr, "Unexpected iso usb result: %d\n",
1464 ehci->ipacket.status);
1465
1466 case USB_RET_IOERROR:
1467 case USB_RET_NODEV:
1468
1469 if (dir) {
1470 itd->transact[i] |= ITD_XACT_XACTERR;
1471 ehci_raise_irq(ehci, USBSTS_ERRINT);
1472 }
1473 break;
1474 case USB_RET_BABBLE:
1475 itd->transact[i] |= ITD_XACT_BABBLE;
1476 ehci_raise_irq(ehci, USBSTS_ERRINT);
1477 break;
1478 case USB_RET_NAK:
1479
1480 ehci->ipacket.actual_length = 0;
1481 break;
1482 }
1483 if (!dir) {
1484 set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1485 ITD_XACT_LENGTH);
1486 } else {
1487 set_field(&itd->transact[i], ehci->ipacket.actual_length,
1488 ITD_XACT_LENGTH);
1489 }
1490 if (itd->transact[i] & ITD_XACT_IOC) {
1491 ehci_raise_irq(ehci, USBSTS_INT);
1492 }
1493 itd->transact[i] &= ~ITD_XACT_ACTIVE;
1494 }
1495 }
1496 return 0;
1497}
1498
1499
1500
1501
1502
1503static int ehci_state_waitlisthead(EHCIState *ehci, int async)
1504{
1505 EHCIqh qh;
1506 int i = 0;
1507 int again = 0;
1508 uint32_t entry = ehci->asynclistaddr;
1509
1510
1511 if (async) {
1512 ehci_set_usbsts(ehci, USBSTS_REC);
1513 }
1514
1515 ehci_queues_rip_unused(ehci, async);
1516
1517
1518 for(i = 0; i < MAX_QH; i++) {
1519 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1520 sizeof(EHCIqh) >> 2) < 0) {
1521 return 0;
1522 }
1523 ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1524
1525 if (qh.epchar & QH_EPCHAR_H) {
1526 if (async) {
1527 entry |= (NLPTR_TYPE_QH << 1);
1528 }
1529
1530 ehci_set_fetch_addr(ehci, async, entry);
1531 ehci_set_state(ehci, async, EST_FETCHENTRY);
1532 again = 1;
1533 goto out;
1534 }
1535
1536 entry = qh.next;
1537 if (entry == ehci->asynclistaddr) {
1538 break;
1539 }
1540 }
1541
1542
1543
1544 ehci_set_state(ehci, async, EST_ACTIVE);
1545
1546out:
1547 return again;
1548}
1549
1550
1551
1552
1553
1554static int ehci_state_fetchentry(EHCIState *ehci, int async)
1555{
1556 int again = 0;
1557 uint32_t entry = ehci_get_fetch_addr(ehci, async);
1558
1559 if (NLPTR_TBIT(entry)) {
1560 ehci_set_state(ehci, async, EST_ACTIVE);
1561 goto out;
1562 }
1563
1564
1565 if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1566 fprintf(stderr, "non queue head request in async schedule\n");
1567 return -1;
1568 }
1569
1570 switch (NLPTR_TYPE_GET(entry)) {
1571 case NLPTR_TYPE_QH:
1572 ehci_set_state(ehci, async, EST_FETCHQH);
1573 again = 1;
1574 break;
1575
1576 case NLPTR_TYPE_ITD:
1577 ehci_set_state(ehci, async, EST_FETCHITD);
1578 again = 1;
1579 break;
1580
1581 case NLPTR_TYPE_STITD:
1582 ehci_set_state(ehci, async, EST_FETCHSITD);
1583 again = 1;
1584 break;
1585
1586 default:
1587
1588 fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
1589 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1590 return -1;
1591 }
1592
1593out:
1594 return again;
1595}
1596
1597static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1598{
1599 uint32_t entry;
1600 EHCIQueue *q;
1601 EHCIqh qh;
1602
1603 entry = ehci_get_fetch_addr(ehci, async);
1604 q = ehci_find_queue_by_qh(ehci, entry, async);
1605 if (q == NULL) {
1606 q = ehci_alloc_queue(ehci, entry, async);
1607 }
1608
1609 q->seen++;
1610 if (q->seen > 1) {
1611
1612 ehci_set_state(ehci, async, EST_ACTIVE);
1613 q = NULL;
1614 goto out;
1615 }
1616
1617 if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1618 (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1619 q = NULL;
1620 goto out;
1621 }
1622 ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1623
1624
1625
1626
1627
1628 if (!ehci_verify_qh(q, &qh)) {
1629 if (ehci_reset_queue(q) > 0) {
1630 ehci_trace_guest_bug(ehci, "guest updated active QH");
1631 }
1632 }
1633 q->qh = qh;
1634
1635 q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1636 if (q->transact_ctr == 0) {
1637 q->transact_ctr = 4;
1638 }
1639
1640 if (q->dev == NULL) {
1641 q->dev = ehci_find_device(q->ehci,
1642 get_field(q->qh.epchar, QH_EPCHAR_DEVADDR));
1643 }
1644
1645 if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1646
1647
1648 if (ehci->usbsts & USBSTS_REC) {
1649 ehci_clear_usbsts(ehci, USBSTS_REC);
1650 } else {
1651 DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset"
1652 " - done processing\n", q->qhaddr);
1653 ehci_set_state(ehci, async, EST_ACTIVE);
1654 q = NULL;
1655 goto out;
1656 }
1657 }
1658
1659#if EHCI_DEBUG
1660 if (q->qhaddr != q->qh.next) {
1661 DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1662 q->qhaddr,
1663 q->qh.epchar & QH_EPCHAR_H,
1664 q->qh.token & QTD_TOKEN_HALT,
1665 q->qh.token & QTD_TOKEN_ACTIVE,
1666 q->qh.next);
1667 }
1668#endif
1669
1670 if (q->qh.token & QTD_TOKEN_HALT) {
1671 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1672
1673 } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1674 (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
1675 q->qtdaddr = q->qh.current_qtd;
1676 ehci_set_state(ehci, async, EST_FETCHQTD);
1677
1678 } else {
1679
1680 ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1681 }
1682
1683out:
1684 return q;
1685}
1686
1687static int ehci_state_fetchitd(EHCIState *ehci, int async)
1688{
1689 uint32_t entry;
1690 EHCIitd itd;
1691
1692 assert(!async);
1693 entry = ehci_get_fetch_addr(ehci, async);
1694
1695 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1696 sizeof(EHCIitd) >> 2) < 0) {
1697 return -1;
1698 }
1699 ehci_trace_itd(ehci, entry, &itd);
1700
1701 if (ehci_process_itd(ehci, &itd, entry) != 0) {
1702 return -1;
1703 }
1704
1705 put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1706 sizeof(EHCIitd) >> 2);
1707 ehci_set_fetch_addr(ehci, async, itd.next);
1708 ehci_set_state(ehci, async, EST_FETCHENTRY);
1709
1710 return 1;
1711}
1712
1713static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1714{
1715 uint32_t entry;
1716 EHCIsitd sitd;
1717
1718 assert(!async);
1719 entry = ehci_get_fetch_addr(ehci, async);
1720
1721 if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1722 sizeof(EHCIsitd) >> 2) < 0) {
1723 return 0;
1724 }
1725 ehci_trace_sitd(ehci, entry, &sitd);
1726
1727 if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1728 ;
1729 } else {
1730
1731 fprintf(stderr, "WARNING: Skipping active siTD\n");
1732 }
1733
1734 ehci_set_fetch_addr(ehci, async, sitd.next);
1735 ehci_set_state(ehci, async, EST_FETCHENTRY);
1736 return 1;
1737}
1738
1739
1740static int ehci_state_advqueue(EHCIQueue *q)
1741{
1742#if 0
1743
1744
1745
1746
1747 if (I-bit set) {
1748 ehci_set_state(ehci, async, EST_HORIZONTALQH);
1749 goto out;
1750 }
1751#endif
1752
1753
1754
1755
1756 if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1757 (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1758 q->qtdaddr = q->qh.altnext_qtd;
1759 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1760
1761
1762
1763
1764 } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1765 q->qtdaddr = q->qh.next_qtd;
1766 ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1767
1768
1769
1770
1771 } else {
1772 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1773 }
1774
1775 return 1;
1776}
1777
1778
1779static int ehci_state_fetchqtd(EHCIQueue *q)
1780{
1781 EHCIqtd qtd;
1782 EHCIPacket *p;
1783 int again = 1;
1784
1785 if (get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1786 sizeof(EHCIqtd) >> 2) < 0) {
1787 return 0;
1788 }
1789 ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1790
1791 p = QTAILQ_FIRST(&q->packets);
1792 if (p != NULL) {
1793 if (!ehci_verify_qtd(p, &qtd)) {
1794 ehci_cancel_queue(q);
1795 if (qtd.token & QTD_TOKEN_ACTIVE) {
1796 ehci_trace_guest_bug(q->ehci, "guest updated active qTD");
1797 }
1798 p = NULL;
1799 } else {
1800 p->qtd = qtd;
1801 ehci_qh_do_overlay(q);
1802 }
1803 }
1804
1805 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1806 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1807 } else if (p != NULL) {
1808 switch (p->async) {
1809 case EHCI_ASYNC_NONE:
1810 case EHCI_ASYNC_INITIALIZED:
1811
1812 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1813 break;
1814 case EHCI_ASYNC_INFLIGHT:
1815
1816 again = ehci_fill_queue(QTAILQ_LAST(&q->packets, pkts_head));
1817
1818 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1819 break;
1820 case EHCI_ASYNC_FINISHED:
1821
1822 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1823 break;
1824 }
1825 } else {
1826 p = ehci_alloc_packet(q);
1827 p->qtdaddr = q->qtdaddr;
1828 p->qtd = qtd;
1829 ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1830 }
1831
1832 return again;
1833}
1834
1835static int ehci_state_horizqh(EHCIQueue *q)
1836{
1837 int again = 0;
1838
1839 if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1840 ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1841 ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1842 again = 1;
1843 } else {
1844 ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1845 }
1846
1847 return again;
1848}
1849
1850
1851static int ehci_fill_queue(EHCIPacket *p)
1852{
1853 USBEndpoint *ep = p->packet.ep;
1854 EHCIQueue *q = p->queue;
1855 EHCIqtd qtd = p->qtd;
1856 uint32_t qtdaddr;
1857
1858 for (;;) {
1859 if (NLPTR_TBIT(qtd.next) != 0) {
1860 break;
1861 }
1862 qtdaddr = qtd.next;
1863
1864
1865
1866
1867 QTAILQ_FOREACH(p, &q->packets, next) {
1868 if (p->qtdaddr == qtdaddr) {
1869 goto leave;
1870 }
1871 }
1872 if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1873 (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1874 return -1;
1875 }
1876 ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1877 if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1878 break;
1879 }
1880 if (!ehci_verify_pid(q, &qtd)) {
1881 ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
1882 break;
1883 }
1884 p = ehci_alloc_packet(q);
1885 p->qtdaddr = qtdaddr;
1886 p->qtd = qtd;
1887 if (ehci_execute(p, "queue") == -1) {
1888 return -1;
1889 }
1890 assert(p->packet.status == USB_RET_ASYNC);
1891 p->async = EHCI_ASYNC_INFLIGHT;
1892 }
1893leave:
1894 usb_device_flush_ep_queue(ep->dev, ep);
1895 return 1;
1896}
1897
1898static int ehci_state_execute(EHCIQueue *q)
1899{
1900 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1901 int again = 0;
1902
1903 assert(p != NULL);
1904 assert(p->qtdaddr == q->qtdaddr);
1905
1906 if (ehci_qh_do_overlay(q) != 0) {
1907 return -1;
1908 }
1909
1910
1911
1912
1913
1914 if (!q->async && q->transact_ctr == 0) {
1915 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1916 again = 1;
1917 goto out;
1918 }
1919
1920 if (q->async) {
1921 ehci_set_usbsts(q->ehci, USBSTS_REC);
1922 }
1923
1924 again = ehci_execute(p, "process");
1925 if (again == -1) {
1926 goto out;
1927 }
1928 if (p->packet.status == USB_RET_ASYNC) {
1929 ehci_flush_qh(q);
1930 trace_usb_ehci_packet_action(p->queue, p, "async");
1931 p->async = EHCI_ASYNC_INFLIGHT;
1932 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1933 if (q->async) {
1934 again = ehci_fill_queue(p);
1935 } else {
1936 again = 1;
1937 }
1938 goto out;
1939 }
1940
1941 ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1942 again = 1;
1943
1944out:
1945 return again;
1946}
1947
1948static int ehci_state_executing(EHCIQueue *q)
1949{
1950 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1951
1952 assert(p != NULL);
1953 assert(p->qtdaddr == q->qtdaddr);
1954
1955 ehci_execute_complete(q);
1956
1957
1958 if (!q->async && q->transact_ctr > 0) {
1959 q->transact_ctr--;
1960 }
1961
1962
1963 if (p->packet.status == USB_RET_NAK) {
1964 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1965 } else {
1966 ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1967 }
1968
1969 ehci_flush_qh(q);
1970 return 1;
1971}
1972
1973
1974static int ehci_state_writeback(EHCIQueue *q)
1975{
1976 EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1977 uint32_t *qtd, addr;
1978 int again = 0;
1979
1980
1981 assert(p != NULL);
1982 assert(p->qtdaddr == q->qtdaddr);
1983
1984 ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
1985 qtd = (uint32_t *) &q->qh.next_qtd;
1986 addr = NLPTR_GET(p->qtdaddr);
1987 put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
1988 ehci_free_packet(p);
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998 if (q->qh.token & QTD_TOKEN_HALT) {
1999 ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2000 again = 1;
2001 } else {
2002 ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
2003 again = 1;
2004 }
2005 return again;
2006}
2007
2008
2009
2010
2011
2012static void ehci_advance_state(EHCIState *ehci, int async)
2013{
2014 EHCIQueue *q = NULL;
2015 int itd_count = 0;
2016 int again;
2017
2018 do {
2019 switch(ehci_get_state(ehci, async)) {
2020 case EST_WAITLISTHEAD:
2021 again = ehci_state_waitlisthead(ehci, async);
2022 break;
2023
2024 case EST_FETCHENTRY:
2025 again = ehci_state_fetchentry(ehci, async);
2026 break;
2027
2028 case EST_FETCHQH:
2029 q = ehci_state_fetchqh(ehci, async);
2030 if (q != NULL) {
2031 assert(q->async == async);
2032 again = 1;
2033 } else {
2034 again = 0;
2035 }
2036 break;
2037
2038 case EST_FETCHITD:
2039 again = ehci_state_fetchitd(ehci, async);
2040 itd_count++;
2041 break;
2042
2043 case EST_FETCHSITD:
2044 again = ehci_state_fetchsitd(ehci, async);
2045 itd_count++;
2046 break;
2047
2048 case EST_ADVANCEQUEUE:
2049 assert(q != NULL);
2050 again = ehci_state_advqueue(q);
2051 break;
2052
2053 case EST_FETCHQTD:
2054 assert(q != NULL);
2055 again = ehci_state_fetchqtd(q);
2056 break;
2057
2058 case EST_HORIZONTALQH:
2059 assert(q != NULL);
2060 again = ehci_state_horizqh(q);
2061 break;
2062
2063 case EST_EXECUTE:
2064 assert(q != NULL);
2065 again = ehci_state_execute(q);
2066 if (async) {
2067 ehci->async_stepdown = 0;
2068 }
2069 break;
2070
2071 case EST_EXECUTING:
2072 assert(q != NULL);
2073 if (async) {
2074 ehci->async_stepdown = 0;
2075 }
2076 again = ehci_state_executing(q);
2077 break;
2078
2079 case EST_WRITEBACK:
2080 assert(q != NULL);
2081 again = ehci_state_writeback(q);
2082 if (!async) {
2083 ehci->periodic_sched_active = PERIODIC_ACTIVE;
2084 }
2085 break;
2086
2087 default:
2088 fprintf(stderr, "Bad state!\n");
2089 again = -1;
2090 g_assert_not_reached();
2091 break;
2092 }
2093
2094 if (again < 0 || itd_count > 16) {
2095
2096 fprintf(stderr, "processing error - resetting ehci HC\n");
2097 ehci_reset(ehci);
2098 again = 0;
2099 }
2100 }
2101 while (again);
2102}
2103
2104static void ehci_advance_async_state(EHCIState *ehci)
2105{
2106 const int async = 1;
2107
2108 switch(ehci_get_state(ehci, async)) {
2109 case EST_INACTIVE:
2110 if (!ehci_async_enabled(ehci)) {
2111 break;
2112 }
2113 ehci_set_state(ehci, async, EST_ACTIVE);
2114
2115
2116 case EST_ACTIVE:
2117 if (!ehci_async_enabled(ehci)) {
2118 ehci_queues_rip_all(ehci, async);
2119 ehci_set_state(ehci, async, EST_INACTIVE);
2120 break;
2121 }
2122
2123
2124
2125 if (ehci->usbsts & USBSTS_IAA) {
2126 DPRINTF("IAA status bit still set.\n");
2127 break;
2128 }
2129
2130
2131 if (ehci->asynclistaddr == 0) {
2132 break;
2133 }
2134
2135 ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2136 ehci_advance_state(ehci, async);
2137
2138
2139
2140
2141
2142 if (ehci->usbcmd & USBCMD_IAAD) {
2143
2144 ehci_queues_rip_unseen(ehci, async);
2145 trace_usb_ehci_doorbell_ack();
2146 ehci->usbcmd &= ~USBCMD_IAAD;
2147 ehci_raise_irq(ehci, USBSTS_IAA);
2148 }
2149 break;
2150
2151 default:
2152
2153 fprintf(stderr, "ehci: Bad asynchronous state %d. "
2154 "Resetting to active\n", ehci->astate);
2155 g_assert_not_reached();
2156 }
2157}
2158
2159static void ehci_advance_periodic_state(EHCIState *ehci)
2160{
2161 uint32_t entry;
2162 uint32_t list;
2163 const int async = 0;
2164
2165
2166
2167 switch(ehci_get_state(ehci, async)) {
2168 case EST_INACTIVE:
2169 if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2170 ehci_set_state(ehci, async, EST_ACTIVE);
2171
2172 } else
2173 break;
2174
2175 case EST_ACTIVE:
2176 if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2177 ehci_queues_rip_all(ehci, async);
2178 ehci_set_state(ehci, async, EST_INACTIVE);
2179 break;
2180 }
2181
2182 list = ehci->periodiclistbase & 0xfffff000;
2183
2184 if (list == 0) {
2185 break;
2186 }
2187 list |= ((ehci->frindex & 0x1ff8) >> 1);
2188
2189 if (get_dwords(ehci, list, &entry, 1) < 0) {
2190 break;
2191 }
2192
2193 DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n",
2194 ehci->frindex / 8, list, entry);
2195 ehci_set_fetch_addr(ehci, async,entry);
2196 ehci_set_state(ehci, async, EST_FETCHENTRY);
2197 ehci_advance_state(ehci, async);
2198 ehci_queues_rip_unused(ehci, async);
2199 break;
2200
2201 default:
2202
2203 fprintf(stderr, "ehci: Bad periodic state %d. "
2204 "Resetting to active\n", ehci->pstate);
2205 g_assert_not_reached();
2206 }
2207}
2208
2209static void ehci_update_frindex(EHCIState *ehci, int uframes)
2210{
2211 if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) {
2212 return;
2213 }
2214
2215
2216 if ((ehci->frindex % 0x2000) + uframes >= 0x2000) {
2217 ehci_raise_irq(ehci, USBSTS_FLR);
2218 }
2219
2220
2221
2222
2223 int rollovers = (ehci->frindex + uframes) / 0x4000;
2224 if (rollovers > 0) {
2225 if (ehci->usbsts_frindex >= (rollovers * 0x4000)) {
2226 ehci->usbsts_frindex -= 0x4000 * rollovers;
2227 } else {
2228 ehci->usbsts_frindex = 0;
2229 }
2230 }
2231
2232 ehci->frindex = (ehci->frindex + uframes) % 0x4000;
2233}
2234
2235static void ehci_frame_timer(void *opaque)
2236{
2237 EHCIState *ehci = opaque;
2238 int need_timer = 0;
2239 int64_t expire_time, t_now;
2240 uint64_t ns_elapsed;
2241 int uframes, skipped_uframes;
2242 int i;
2243
2244 t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2245 ns_elapsed = t_now - ehci->last_run_ns;
2246 uframes = ns_elapsed / UFRAME_TIMER_NS;
2247
2248 if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2249 need_timer++;
2250
2251 if (uframes > (ehci->maxframes * 8)) {
2252 skipped_uframes = uframes - (ehci->maxframes * 8);
2253 ehci_update_frindex(ehci, skipped_uframes);
2254 ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
2255 uframes -= skipped_uframes;
2256 DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes);
2257 }
2258
2259 for (i = 0; i < uframes; i++) {
2260
2261
2262
2263
2264
2265
2266
2267 if (i >= MIN_UFR_PER_TICK) {
2268 ehci_commit_irq(ehci);
2269 if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2270 break;
2271 }
2272 }
2273 if (ehci->periodic_sched_active) {
2274 ehci->periodic_sched_active--;
2275 }
2276 ehci_update_frindex(ehci, 1);
2277 if ((ehci->frindex & 7) == 0) {
2278 ehci_advance_periodic_state(ehci);
2279 }
2280 ehci->last_run_ns += UFRAME_TIMER_NS;
2281 }
2282 } else {
2283 ehci->periodic_sched_active = 0;
2284 ehci_update_frindex(ehci, uframes);
2285 ehci->last_run_ns += UFRAME_TIMER_NS * uframes;
2286 }
2287
2288 if (ehci->periodic_sched_active) {
2289 ehci->async_stepdown = 0;
2290 } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2291 ehci->async_stepdown++;
2292 }
2293
2294
2295
2296
2297 if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2298 need_timer++;
2299 ehci_advance_async_state(ehci);
2300 }
2301
2302 ehci_commit_irq(ehci);
2303 if (ehci->usbsts_pending) {
2304 need_timer++;
2305 ehci->async_stepdown = 0;
2306 }
2307
2308 if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2309 need_timer++;
2310 }
2311
2312 if (need_timer) {
2313
2314
2315 if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2316 expire_time = t_now +
2317 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
2318 ehci->int_req_by_async = false;
2319 } else {
2320 expire_time = t_now + (NANOSECONDS_PER_SECOND
2321 * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2322 }
2323 timer_mod(ehci->frame_timer, expire_time);
2324 }
2325}
2326
2327static const MemoryRegionOps ehci_mmio_caps_ops = {
2328 .read = ehci_caps_read,
2329 .write = ehci_caps_write,
2330 .valid.min_access_size = 1,
2331 .valid.max_access_size = 4,
2332 .impl.min_access_size = 1,
2333 .impl.max_access_size = 1,
2334 .endianness = DEVICE_LITTLE_ENDIAN,
2335};
2336
2337static const MemoryRegionOps ehci_mmio_opreg_ops = {
2338 .read = ehci_opreg_read,
2339 .write = ehci_opreg_write,
2340 .valid.min_access_size = 4,
2341 .valid.max_access_size = 4,
2342 .endianness = DEVICE_LITTLE_ENDIAN,
2343};
2344
2345static const MemoryRegionOps ehci_mmio_port_ops = {
2346 .read = ehci_port_read,
2347 .write = ehci_port_write,
2348 .valid.min_access_size = 4,
2349 .valid.max_access_size = 4,
2350 .endianness = DEVICE_LITTLE_ENDIAN,
2351};
2352
2353static USBPortOps ehci_port_ops = {
2354 .attach = ehci_attach,
2355 .detach = ehci_detach,
2356 .child_detach = ehci_child_detach,
2357 .wakeup = ehci_wakeup,
2358 .complete = ehci_async_complete_packet,
2359};
2360
2361static USBBusOps ehci_bus_ops_companion = {
2362 .register_companion = ehci_register_companion,
2363 .wakeup_endpoint = ehci_wakeup_endpoint,
2364};
2365static USBBusOps ehci_bus_ops_standalone = {
2366 .wakeup_endpoint = ehci_wakeup_endpoint,
2367};
2368
2369static void usb_ehci_pre_save(void *opaque)
2370{
2371 EHCIState *ehci = opaque;
2372 uint32_t new_frindex;
2373
2374
2375 new_frindex = ehci->frindex & ~7;
2376 ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
2377 ehci->frindex = new_frindex;
2378}
2379
2380static int usb_ehci_post_load(void *opaque, int version_id)
2381{
2382 EHCIState *s = opaque;
2383 int i;
2384
2385 for (i = 0; i < NB_PORTS; i++) {
2386 USBPort *companion = s->companion_ports[i];
2387 if (companion == NULL) {
2388 continue;
2389 }
2390 if (s->portsc[i] & PORTSC_POWNER) {
2391 companion->dev = s->ports[i].dev;
2392 } else {
2393 companion->dev = NULL;
2394 }
2395 }
2396
2397 return 0;
2398}
2399
2400static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
2401{
2402 EHCIState *ehci = opaque;
2403
2404
2405
2406
2407
2408
2409
2410 if (state == RUN_STATE_RUNNING) {
2411 ehci_advance_async_state(ehci);
2412 }
2413
2414
2415
2416
2417
2418
2419
2420 if (state == RUN_STATE_SAVE_VM) {
2421 ehci_advance_async_state(ehci);
2422 ehci_queues_rip_unseen(ehci, 1);
2423 }
2424}
2425
2426const VMStateDescription vmstate_ehci = {
2427 .name = "ehci-core",
2428 .version_id = 2,
2429 .minimum_version_id = 1,
2430 .pre_save = usb_ehci_pre_save,
2431 .post_load = usb_ehci_post_load,
2432 .fields = (VMStateField[]) {
2433
2434 VMSTATE_UINT32(usbcmd, EHCIState),
2435 VMSTATE_UINT32(usbsts, EHCIState),
2436 VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2437 VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2438 VMSTATE_UINT32(usbintr, EHCIState),
2439 VMSTATE_UINT32(frindex, EHCIState),
2440 VMSTATE_UINT32(ctrldssegment, EHCIState),
2441 VMSTATE_UINT32(periodiclistbase, EHCIState),
2442 VMSTATE_UINT32(asynclistaddr, EHCIState),
2443 VMSTATE_UINT32(configflag, EHCIState),
2444 VMSTATE_UINT32(portsc[0], EHCIState),
2445 VMSTATE_UINT32(portsc[1], EHCIState),
2446 VMSTATE_UINT32(portsc[2], EHCIState),
2447 VMSTATE_UINT32(portsc[3], EHCIState),
2448 VMSTATE_UINT32(portsc[4], EHCIState),
2449 VMSTATE_UINT32(portsc[5], EHCIState),
2450
2451 VMSTATE_TIMER_PTR(frame_timer, EHCIState),
2452 VMSTATE_UINT64(last_run_ns, EHCIState),
2453 VMSTATE_UINT32(async_stepdown, EHCIState),
2454
2455 VMSTATE_UINT32(astate, EHCIState),
2456 VMSTATE_UINT32(pstate, EHCIState),
2457 VMSTATE_UINT32(a_fetch_addr, EHCIState),
2458 VMSTATE_UINT32(p_fetch_addr, EHCIState),
2459 VMSTATE_END_OF_LIST()
2460 }
2461};
2462
2463void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
2464{
2465 int i;
2466
2467 if (s->portnr > NB_PORTS) {
2468 error_setg(errp, "Too many ports! Max. port number is %d.",
2469 NB_PORTS);
2470 return;
2471 }
2472
2473 usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
2474 &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);
2475 for (i = 0; i < s->portnr; i++) {
2476 usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2477 USB_SPEED_MASK_HIGH);
2478 s->ports[i].dev = 0;
2479 }
2480
2481 s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_frame_timer, s);
2482 s->async_bh = qemu_bh_new(ehci_frame_timer, s);
2483 s->device = dev;
2484
2485 s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2486}
2487
2488void usb_ehci_unrealize(EHCIState *s, DeviceState *dev, Error **errp)
2489{
2490 trace_usb_ehci_unrealize();
2491
2492 if (s->frame_timer) {
2493 timer_del(s->frame_timer);
2494 timer_free(s->frame_timer);
2495 s->frame_timer = NULL;
2496 }
2497 if (s->async_bh) {
2498 qemu_bh_delete(s->async_bh);
2499 }
2500
2501 ehci_queues_rip_all(s, 0);
2502 ehci_queues_rip_all(s, 1);
2503
2504 memory_region_del_subregion(&s->mem, &s->mem_caps);
2505 memory_region_del_subregion(&s->mem, &s->mem_opreg);
2506 memory_region_del_subregion(&s->mem, &s->mem_ports);
2507
2508 usb_bus_release(&s->bus);
2509
2510 if (s->vmstate) {
2511 qemu_del_vm_change_state_handler(s->vmstate);
2512 }
2513}
2514
2515void usb_ehci_init(EHCIState *s, DeviceState *dev)
2516{
2517
2518 s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2519 s->caps[0x01] = 0x00;
2520 s->caps[0x02] = 0x00;
2521 s->caps[0x03] = 0x01;
2522 s->caps[0x04] = s->portnr;
2523 s->caps[0x05] = 0x00;
2524 s->caps[0x06] = 0x00;
2525 s->caps[0x07] = 0x00;
2526 s->caps[0x08] = 0x80;
2527 s->caps[0x0a] = 0x00;
2528 s->caps[0x0b] = 0x00;
2529
2530 QTAILQ_INIT(&s->aqueues);
2531 QTAILQ_INIT(&s->pqueues);
2532 usb_packet_init(&s->ipacket);
2533
2534 memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
2535 memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
2536 "capabilities", CAPA_SIZE);
2537 memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
2538 "operational", s->portscbase);
2539 memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
2540 "ports", 4 * s->portnr);
2541
2542 memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2543 memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2544 memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
2545 &s->mem_ports);
2546}
2547
2548
2549
2550
2551