hcd-ehci.c 80.9 KB
Newer Older
G
Gerd Hoffmann 已提交
1 2 3 4
/*
 * QEMU USB EHCI Emulation
 *
 * Copyright(c) 2008  Emutex Ltd. (address@hidden)
5 6 7 8 9
 * Copyright(c) 2011-2012 Red Hat, Inc.
 *
 * Red Hat Authors:
 * Gerd Hoffmann <kraxel@redhat.com>
 * Hans de Goede <hdegoede@redhat.com>
G
Gerd Hoffmann 已提交
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
 *
 * EHCI project was started by Mark Burkley, with contributions by
 * Niels de Vos.  David S. Ahern continued working on it.  Kevin Wolf,
 * Jan Kiszka and Vincent Palatin contributed bugfixes.
 *
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or(at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

G
Gerd Hoffmann 已提交
30
#include "hw/hw.h"
G
Gerd Hoffmann 已提交
31
#include "qemu-timer.h"
G
Gerd Hoffmann 已提交
32 33
#include "hw/usb.h"
#include "hw/pci.h"
G
Gerd Hoffmann 已提交
34
#include "monitor.h"
G
Gerd Hoffmann 已提交
35
#include "trace.h"
36
#include "dma.h"
37
#include "sysemu.h"
G
Gerd Hoffmann 已提交
38 39 40

#define EHCI_DEBUG   0

41
#if EHCI_DEBUG
G
Gerd Hoffmann 已提交
42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109
#define DPRINTF printf
#else
#define DPRINTF(...)
#endif

/* internal processing - reset HC to try and recover */
#define USB_RET_PROCERR   (-99)

#define MMIO_SIZE        0x1000

/* Capability Registers Base Address - section 2.2 */
#define CAPREGBASE       0x0000
#define CAPLENGTH        CAPREGBASE + 0x0000  // 1-byte, 0x0001 reserved
#define HCIVERSION       CAPREGBASE + 0x0002  // 2-bytes, i/f version #
#define HCSPARAMS        CAPREGBASE + 0x0004  // 4-bytes, structural params
#define HCCPARAMS        CAPREGBASE + 0x0008  // 4-bytes, capability params
#define EECP             HCCPARAMS + 1
#define HCSPPORTROUTE1   CAPREGBASE + 0x000c
#define HCSPPORTROUTE2   CAPREGBASE + 0x0010

#define OPREGBASE        0x0020        // Operational Registers Base Address

#define USBCMD           OPREGBASE + 0x0000
#define USBCMD_RUNSTOP   (1 << 0)      // run / Stop
#define USBCMD_HCRESET   (1 << 1)      // HC Reset
#define USBCMD_FLS       (3 << 2)      // Frame List Size
#define USBCMD_FLS_SH    2             // Frame List Size Shift
#define USBCMD_PSE       (1 << 4)      // Periodic Schedule Enable
#define USBCMD_ASE       (1 << 5)      // Asynch Schedule Enable
#define USBCMD_IAAD      (1 << 6)      // Int Asynch Advance Doorbell
#define USBCMD_LHCR      (1 << 7)      // Light Host Controller Reset
#define USBCMD_ASPMC     (3 << 8)      // Async Sched Park Mode Count
#define USBCMD_ASPME     (1 << 11)     // Async Sched Park Mode Enable
#define USBCMD_ITC       (0x7f << 16)  // Int Threshold Control
#define USBCMD_ITC_SH    16            // Int Threshold Control Shift

#define USBSTS           OPREGBASE + 0x0004
#define USBSTS_RO_MASK   0x0000003f
#define USBSTS_INT       (1 << 0)      // USB Interrupt
#define USBSTS_ERRINT    (1 << 1)      // Error Interrupt
#define USBSTS_PCD       (1 << 2)      // Port Change Detect
#define USBSTS_FLR       (1 << 3)      // Frame List Rollover
#define USBSTS_HSE       (1 << 4)      // Host System Error
#define USBSTS_IAA       (1 << 5)      // Interrupt on Async Advance
#define USBSTS_HALT      (1 << 12)     // HC Halted
#define USBSTS_REC       (1 << 13)     // Reclamation
#define USBSTS_PSS       (1 << 14)     // Periodic Schedule Status
#define USBSTS_ASS       (1 << 15)     // Asynchronous Schedule Status

/*
 *  Interrupt enable bits correspond to the interrupt active bits in USBSTS
 *  so no need to redefine here.
 */
#define USBINTR              OPREGBASE + 0x0008
#define USBINTR_MASK         0x0000003f

#define FRINDEX              OPREGBASE + 0x000c
#define CTRLDSSEGMENT        OPREGBASE + 0x0010
#define PERIODICLISTBASE     OPREGBASE + 0x0014
#define ASYNCLISTADDR        OPREGBASE + 0x0018
#define ASYNCLISTADDR_MASK   0xffffffe0

#define CONFIGFLAG           OPREGBASE + 0x0040

#define PORTSC               (OPREGBASE + 0x0044)
#define PORTSC_BEGIN         PORTSC
#define PORTSC_END           (PORTSC + 4 * NB_PORTS)
/*
110
 * Bits that are reserved or are read-only are masked out of values
G
Gerd Hoffmann 已提交
111 112
 * written to us by software
 */
113
#define PORTSC_RO_MASK       0x007001c0
G
Gerd Hoffmann 已提交
114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136
#define PORTSC_RWC_MASK      0x0000002a
#define PORTSC_WKOC_E        (1 << 22)    // Wake on Over Current Enable
#define PORTSC_WKDS_E        (1 << 21)    // Wake on Disconnect Enable
#define PORTSC_WKCN_E        (1 << 20)    // Wake on Connect Enable
#define PORTSC_PTC           (15 << 16)   // Port Test Control
#define PORTSC_PTC_SH        16           // Port Test Control shift
#define PORTSC_PIC           (3 << 14)    // Port Indicator Control
#define PORTSC_PIC_SH        14           // Port Indicator Control Shift
#define PORTSC_POWNER        (1 << 13)    // Port Owner
#define PORTSC_PPOWER        (1 << 12)    // Port Power
#define PORTSC_LINESTAT      (3 << 10)    // Port Line Status
#define PORTSC_LINESTAT_SH   10           // Port Line Status Shift
#define PORTSC_PRESET        (1 << 8)     // Port Reset
#define PORTSC_SUSPEND       (1 << 7)     // Port Suspend
#define PORTSC_FPRES         (1 << 6)     // Force Port Resume
#define PORTSC_OCC           (1 << 5)     // Over Current Change
#define PORTSC_OCA           (1 << 4)     // Over Current Active
#define PORTSC_PEDC          (1 << 3)     // Port Enable/Disable Change
#define PORTSC_PED           (1 << 2)     // Port Enable/Disable
#define PORTSC_CSC           (1 << 1)     // Connect Status Change
#define PORTSC_CONNECT       (1 << 0)     // Current Connect Status

#define FRAME_TIMER_FREQ 1000
G
Gerd Hoffmann 已提交
137
#define FRAME_TIMER_NS   (1000000000 / FRAME_TIMER_FREQ)
G
Gerd Hoffmann 已提交
138 139

#define NB_MAXINTRATE    8        // Max rate at which controller issues ints
G
Gerd Hoffmann 已提交
140
#define NB_PORTS         6        // Number of downstream ports
G
Gerd Hoffmann 已提交
141 142
#define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
#define MAX_QH           100      // Max allowable queue heads in a chain
143
#define MIN_FR_PER_TICK  3        // Min frames to process when catching up
G
Gerd Hoffmann 已提交
144 145 146 147 148 149 150 151 152 153 154 155 156 157

/*  Internal periodic / asynchronous schedule state machine states
 */
typedef enum {
    EST_INACTIVE = 1000,
    EST_ACTIVE,
    EST_EXECUTING,
    EST_SLEEPING,
    /*  The following states are internal to the state machine function
    */
    EST_WAITLISTHEAD,
    EST_FETCHENTRY,
    EST_FETCHQH,
    EST_FETCHITD,
G
Gerd Hoffmann 已提交
158
    EST_FETCHSITD,
G
Gerd Hoffmann 已提交
159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205
    EST_ADVANCEQUEUE,
    EST_FETCHQTD,
    EST_EXECUTE,
    EST_WRITEBACK,
    EST_HORIZONTALQH
} EHCI_STATES;

/* macros for accessing fields within next link pointer entry */
#define NLPTR_GET(x)             ((x) & 0xffffffe0)
#define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
#define NLPTR_TBIT(x)            ((x) & 1)  // 1=invalid, 0=valid

/* link pointer types */
#define NLPTR_TYPE_ITD           0     // isoc xfer descriptor
#define NLPTR_TYPE_QH            1     // queue head
#define NLPTR_TYPE_STITD         2     // split xaction, isoc xfer descriptor
#define NLPTR_TYPE_FSTN          3     // frame span traversal node


/*  EHCI spec version 1.0 Section 3.3
 */
typedef struct EHCIitd {
    uint32_t next;

    uint32_t transact[8];
#define ITD_XACT_ACTIVE          (1 << 31)
#define ITD_XACT_DBERROR         (1 << 30)
#define ITD_XACT_BABBLE          (1 << 29)
#define ITD_XACT_XACTERR         (1 << 28)
#define ITD_XACT_LENGTH_MASK     0x0fff0000
#define ITD_XACT_LENGTH_SH       16
#define ITD_XACT_IOC             (1 << 15)
#define ITD_XACT_PGSEL_MASK      0x00007000
#define ITD_XACT_PGSEL_SH        12
#define ITD_XACT_OFFSET_MASK     0x00000fff

    uint32_t bufptr[7];
#define ITD_BUFPTR_MASK          0xfffff000
#define ITD_BUFPTR_SH            12
#define ITD_BUFPTR_EP_MASK       0x00000f00
#define ITD_BUFPTR_EP_SH         8
#define ITD_BUFPTR_DEVADDR_MASK  0x0000007f
#define ITD_BUFPTR_DEVADDR_SH    0
#define ITD_BUFPTR_DIRECTION     (1 << 11)
#define ITD_BUFPTR_MAXPKT_MASK   0x000007ff
#define ITD_BUFPTR_MAXPKT_SH     0
#define ITD_BUFPTR_MULT_MASK     0x00000003
G
Gerd Hoffmann 已提交
206
#define ITD_BUFPTR_MULT_SH       0
G
Gerd Hoffmann 已提交
207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279
} EHCIitd;

/*  EHCI spec version 1.0 Section 3.4
 */
typedef struct EHCIsitd {
    uint32_t next;                  // Standard next link pointer
    uint32_t epchar;
#define SITD_EPCHAR_IO              (1 << 31)
#define SITD_EPCHAR_PORTNUM_MASK    0x7f000000
#define SITD_EPCHAR_PORTNUM_SH      24
#define SITD_EPCHAR_HUBADD_MASK     0x007f0000
#define SITD_EPCHAR_HUBADDR_SH      16
#define SITD_EPCHAR_EPNUM_MASK      0x00000f00
#define SITD_EPCHAR_EPNUM_SH        8
#define SITD_EPCHAR_DEVADDR_MASK    0x0000007f

    uint32_t uframe;
#define SITD_UFRAME_CMASK_MASK      0x0000ff00
#define SITD_UFRAME_CMASK_SH        8
#define SITD_UFRAME_SMASK_MASK      0x000000ff

    uint32_t results;
#define SITD_RESULTS_IOC              (1 << 31)
#define SITD_RESULTS_PGSEL            (1 << 30)
#define SITD_RESULTS_TBYTES_MASK      0x03ff0000
#define SITD_RESULTS_TYBYTES_SH       16
#define SITD_RESULTS_CPROGMASK_MASK   0x0000ff00
#define SITD_RESULTS_CPROGMASK_SH     8
#define SITD_RESULTS_ACTIVE           (1 << 7)
#define SITD_RESULTS_ERR              (1 << 6)
#define SITD_RESULTS_DBERR            (1 << 5)
#define SITD_RESULTS_BABBLE           (1 << 4)
#define SITD_RESULTS_XACTERR          (1 << 3)
#define SITD_RESULTS_MISSEDUF         (1 << 2)
#define SITD_RESULTS_SPLITXSTATE      (1 << 1)

    uint32_t bufptr[2];
#define SITD_BUFPTR_MASK              0xfffff000
#define SITD_BUFPTR_CURROFF_MASK      0x00000fff
#define SITD_BUFPTR_TPOS_MASK         0x00000018
#define SITD_BUFPTR_TPOS_SH           3
#define SITD_BUFPTR_TCNT_MASK         0x00000007

    uint32_t backptr;                 // Standard next link pointer
} EHCIsitd;

/*  EHCI spec version 1.0 Section 3.5
 */
typedef struct EHCIqtd {
    uint32_t next;                    // Standard next link pointer
    uint32_t altnext;                 // Standard next link pointer
    uint32_t token;
#define QTD_TOKEN_DTOGGLE             (1 << 31)
#define QTD_TOKEN_TBYTES_MASK         0x7fff0000
#define QTD_TOKEN_TBYTES_SH           16
#define QTD_TOKEN_IOC                 (1 << 15)
#define QTD_TOKEN_CPAGE_MASK          0x00007000
#define QTD_TOKEN_CPAGE_SH            12
#define QTD_TOKEN_CERR_MASK           0x00000c00
#define QTD_TOKEN_CERR_SH             10
#define QTD_TOKEN_PID_MASK            0x00000300
#define QTD_TOKEN_PID_SH              8
#define QTD_TOKEN_ACTIVE              (1 << 7)
#define QTD_TOKEN_HALT                (1 << 6)
#define QTD_TOKEN_DBERR               (1 << 5)
#define QTD_TOKEN_BABBLE              (1 << 4)
#define QTD_TOKEN_XACTERR             (1 << 3)
#define QTD_TOKEN_MISSEDUF            (1 << 2)
#define QTD_TOKEN_SPLITXSTATE         (1 << 1)
#define QTD_TOKEN_PING                (1 << 0)

    uint32_t bufptr[5];               // Standard buffer pointer
#define QTD_BUFPTR_MASK               0xfffff000
280
#define QTD_BUFPTR_SH                 12
G
Gerd Hoffmann 已提交
281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343
} EHCIqtd;

/*  EHCI spec version 1.0 Section 3.6
 */
typedef struct EHCIqh {
    uint32_t next;                    // Standard next link pointer

    /* endpoint characteristics */
    uint32_t epchar;
#define QH_EPCHAR_RL_MASK             0xf0000000
#define QH_EPCHAR_RL_SH               28
#define QH_EPCHAR_C                   (1 << 27)
#define QH_EPCHAR_MPLEN_MASK          0x07FF0000
#define QH_EPCHAR_MPLEN_SH            16
#define QH_EPCHAR_H                   (1 << 15)
#define QH_EPCHAR_DTC                 (1 << 14)
#define QH_EPCHAR_EPS_MASK            0x00003000
#define QH_EPCHAR_EPS_SH              12
#define EHCI_QH_EPS_FULL              0
#define EHCI_QH_EPS_LOW               1
#define EHCI_QH_EPS_HIGH              2
#define EHCI_QH_EPS_RESERVED          3

#define QH_EPCHAR_EP_MASK             0x00000f00
#define QH_EPCHAR_EP_SH               8
#define QH_EPCHAR_I                   (1 << 7)
#define QH_EPCHAR_DEVADDR_MASK        0x0000007f
#define QH_EPCHAR_DEVADDR_SH          0

    /* endpoint capabilities */
    uint32_t epcap;
#define QH_EPCAP_MULT_MASK            0xc0000000
#define QH_EPCAP_MULT_SH              30
#define QH_EPCAP_PORTNUM_MASK         0x3f800000
#define QH_EPCAP_PORTNUM_SH           23
#define QH_EPCAP_HUBADDR_MASK         0x007f0000
#define QH_EPCAP_HUBADDR_SH           16
#define QH_EPCAP_CMASK_MASK           0x0000ff00
#define QH_EPCAP_CMASK_SH             8
#define QH_EPCAP_SMASK_MASK           0x000000ff
#define QH_EPCAP_SMASK_SH             0

    uint32_t current_qtd;             // Standard next link pointer
    uint32_t next_qtd;                // Standard next link pointer
    uint32_t altnext_qtd;
#define QH_ALTNEXT_NAKCNT_MASK        0x0000001e
#define QH_ALTNEXT_NAKCNT_SH          1

    uint32_t token;                   // Same as QTD token
    uint32_t bufptr[5];               // Standard buffer pointer
#define BUFPTR_CPROGMASK_MASK         0x000000ff
#define BUFPTR_FRAMETAG_MASK          0x0000001f
#define BUFPTR_SBYTES_MASK            0x00000fe0
#define BUFPTR_SBYTES_SH              5
} EHCIqh;

/*  EHCI spec version 1.0 Section 3.7
 */
typedef struct EHCIfstn {
    uint32_t next;                    // Standard next link pointer
    uint32_t backptr;                 // Standard next link pointer
} EHCIfstn;

G
Gerd Hoffmann 已提交
344
typedef struct EHCIPacket EHCIPacket;
G
Gerd Hoffmann 已提交
345 346 347 348 349
typedef struct EHCIQueue EHCIQueue;
typedef struct EHCIState EHCIState;

enum async_state {
    EHCI_ASYNC_NONE = 0,
350
    EHCI_ASYNC_INITIALIZED,
G
Gerd Hoffmann 已提交
351 352 353 354
    EHCI_ASYNC_INFLIGHT,
    EHCI_ASYNC_FINISHED,
};

G
Gerd Hoffmann 已提交
355 356 357 358 359 360 361 362 363 364 365 366 367 368
struct EHCIPacket {
    EHCIQueue *queue;
    QTAILQ_ENTRY(EHCIPacket) next;

    EHCIqtd qtd;           /* copy of current QTD (being worked on) */
    uint32_t qtdaddr;      /* address QTD read from                 */

    USBPacket packet;
    QEMUSGList sgl;
    int pid;
    enum async_state async;
    int usb_status;
};

G
Gerd Hoffmann 已提交
369 370
struct EHCIQueue {
    EHCIState *ehci;
G
Gerd Hoffmann 已提交
371
    QTAILQ_ENTRY(EHCIQueue) next;
G
Gerd Hoffmann 已提交
372 373
    uint32_t seen;
    uint64_t ts;
374
    int async;
375
    int transact_ctr;
G
Gerd Hoffmann 已提交
376 377 378 379

    /* cached data from guest - needs to be flushed
     * when guest removes an entry (doorbell, handshake sequence)
     */
G
Gerd Hoffmann 已提交
380 381 382
    EHCIqh qh;             /* copy of current QH (being worked on) */
    uint32_t qhaddr;       /* address QH read from                 */
    uint32_t qtdaddr;      /* address QTD read from                */
383
    USBDevice *dev;
G
Gerd Hoffmann 已提交
384
    QTAILQ_HEAD(, EHCIPacket) packets;
G
Gerd Hoffmann 已提交
385 386
};

387 388
typedef QTAILQ_HEAD(EHCIQueueHead, EHCIQueue) EHCIQueueHead;

G
Gerd Hoffmann 已提交
389
struct EHCIState {
G
Gerd Hoffmann 已提交
390
    PCIDevice dev;
G
Gerd Hoffmann 已提交
391
    USBBus bus;
G
Gerd Hoffmann 已提交
392
    qemu_irq irq;
A
Avi Kivity 已提交
393
    MemoryRegion mem;
394 395 396
    MemoryRegion mem_caps;
    MemoryRegion mem_opreg;
    MemoryRegion mem_ports;
397
    int companion_count;
398 399 400 401

    /* properties */
    uint32_t maxframes;

G
Gerd Hoffmann 已提交
402 403 404 405
    /*
     *  EHCI spec version 1.0 Section 2.3
     *  Host Controller Operational Registers
     */
406
    uint8_t caps[OPREGBASE];
G
Gerd Hoffmann 已提交
407
    union {
408
        uint32_t opreg[(PORTSC_BEGIN-OPREGBASE)/sizeof(uint32_t)];
G
Gerd Hoffmann 已提交
409 410 411 412 413 414 415 416 417 418 419 420
        struct {
            uint32_t usbcmd;
            uint32_t usbsts;
            uint32_t usbintr;
            uint32_t frindex;
            uint32_t ctrldssegment;
            uint32_t periodiclistbase;
            uint32_t asynclistaddr;
            uint32_t notused[9];
            uint32_t configflag;
        };
    };
421
    uint32_t portsc[NB_PORTS];
G
Gerd Hoffmann 已提交
422

G
Gerd Hoffmann 已提交
423 424 425 426
    /*
     *  Internal states, shadow registers, etc
     */
    QEMUTimer *frame_timer;
427
    QEMUBH *async_bh;
G
Gerd Hoffmann 已提交
428 429
    uint32_t astate;         /* Current state in asynchronous schedule */
    uint32_t pstate;         /* Current state in periodic schedule     */
G
Gerd Hoffmann 已提交
430
    USBPort ports[NB_PORTS];
431
    USBPort *companion_ports[NB_PORTS];
G
Gerd Hoffmann 已提交
432
    uint32_t usbsts_pending;
433
    uint32_t usbsts_frindex;
434 435
    EHCIQueueHead aqueues;
    EHCIQueueHead pqueues;
G
Gerd Hoffmann 已提交
436

G
Gerd Hoffmann 已提交
437 438 439
    /* which address to look at next */
    uint32_t a_fetch_addr;
    uint32_t p_fetch_addr;
G
Gerd Hoffmann 已提交
440

G
Gerd Hoffmann 已提交
441
    USBPacket ipacket;
442
    QEMUSGList isgl;
G
Gerd Hoffmann 已提交
443

G
Gerd Hoffmann 已提交
444
    uint64_t last_run_ns;
G
Gerd Hoffmann 已提交
445
    uint32_t async_stepdown;
G
Gerd Hoffmann 已提交
446
};
G
Gerd Hoffmann 已提交
447 448

#define SET_LAST_RUN_CLOCK(s) \
G
Gerd Hoffmann 已提交
449
    (s)->last_run_ns = qemu_get_clock_ns(vm_clock);
G
Gerd Hoffmann 已提交
450 451 452 453 454 455 456 457 458 459 460 461

/* nifty macros from Arnon's EHCI version  */
#define get_field(data, field) \
    (((data) & field##_MASK) >> field##_SH)

#define set_field(data, newval, field) do { \
    uint32_t val = *data; \
    val &= ~ field##_MASK; \
    val |= ((newval) << field##_SH) & field##_MASK; \
    *data = val; \
    } while(0)

462
static const char *ehci_state_names[] = {
G
Gerd Hoffmann 已提交
463 464 465 466 467 468 469 470 471 472 473 474 475
    [EST_INACTIVE]     = "INACTIVE",
    [EST_ACTIVE]       = "ACTIVE",
    [EST_EXECUTING]    = "EXECUTING",
    [EST_SLEEPING]     = "SLEEPING",
    [EST_WAITLISTHEAD] = "WAITLISTHEAD",
    [EST_FETCHENTRY]   = "FETCH ENTRY",
    [EST_FETCHQH]      = "FETCH QH",
    [EST_FETCHITD]     = "FETCH ITD",
    [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
    [EST_FETCHQTD]     = "FETCH QTD",
    [EST_EXECUTE]      = "EXECUTE",
    [EST_WRITEBACK]    = "WRITEBACK",
    [EST_HORIZONTALQH] = "HORIZONTALQH",
476 477 478
};

static const char *ehci_mmio_names[] = {
G
Gerd Hoffmann 已提交
479 480 481 482 483 484 485
    [USBCMD]            = "USBCMD",
    [USBSTS]            = "USBSTS",
    [USBINTR]           = "USBINTR",
    [FRINDEX]           = "FRINDEX",
    [PERIODICLISTBASE]  = "P-LIST BASE",
    [ASYNCLISTADDR]     = "A-LIST ADDR",
    [CONFIGFLAG]        = "CONFIGFLAG",
486
};
G
Gerd Hoffmann 已提交
487

488 489 490
static int ehci_state_executing(EHCIQueue *q);
static int ehci_state_writeback(EHCIQueue *q);

491
static const char *nr2str(const char **n, size_t len, uint32_t nr)
G
Gerd Hoffmann 已提交
492
{
493 494
    if (nr < len && n[nr] != NULL) {
        return n[nr];
G
Gerd Hoffmann 已提交
495
    } else {
496
        return "unknown";
G
Gerd Hoffmann 已提交
497 498 499
    }
}

500 501 502 503 504
static const char *state2str(uint32_t state)
{
    return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
}

A
Avi Kivity 已提交
505
static const char *addr2str(hwaddr addr)
506
{
507 508
    return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names),
                  addr + OPREGBASE);
509 510
}

G
Gerd Hoffmann 已提交
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564
static void ehci_trace_usbsts(uint32_t mask, int state)
{
    /* interrupts */
    if (mask & USBSTS_INT) {
        trace_usb_ehci_usbsts("INT", state);
    }
    if (mask & USBSTS_ERRINT) {
        trace_usb_ehci_usbsts("ERRINT", state);
    }
    if (mask & USBSTS_PCD) {
        trace_usb_ehci_usbsts("PCD", state);
    }
    if (mask & USBSTS_FLR) {
        trace_usb_ehci_usbsts("FLR", state);
    }
    if (mask & USBSTS_HSE) {
        trace_usb_ehci_usbsts("HSE", state);
    }
    if (mask & USBSTS_IAA) {
        trace_usb_ehci_usbsts("IAA", state);
    }

    /* status */
    if (mask & USBSTS_HALT) {
        trace_usb_ehci_usbsts("HALT", state);
    }
    if (mask & USBSTS_REC) {
        trace_usb_ehci_usbsts("REC", state);
    }
    if (mask & USBSTS_PSS) {
        trace_usb_ehci_usbsts("PSS", state);
    }
    if (mask & USBSTS_ASS) {
        trace_usb_ehci_usbsts("ASS", state);
    }
}

static inline void ehci_set_usbsts(EHCIState *s, int mask)
{
    if ((s->usbsts & mask) == mask) {
        return;
    }
    ehci_trace_usbsts(mask, 1);
    s->usbsts |= mask;
}

static inline void ehci_clear_usbsts(EHCIState *s, int mask)
{
    if ((s->usbsts & mask) == 0) {
        return;
    }
    ehci_trace_usbsts(mask, 0);
    s->usbsts &= ~mask;
}
G
Gerd Hoffmann 已提交
565

566 567
/* update irq line */
static inline void ehci_update_irq(EHCIState *s)
G
Gerd Hoffmann 已提交
568 569 570 571 572 573 574
{
    int level = 0;

    if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
        level = 1;
    }

575
    trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
G
Gerd Hoffmann 已提交
576 577 578
    qemu_set_irq(s->irq, level);
}

579 580
/* flag interrupt condition */
static inline void ehci_raise_irq(EHCIState *s, int intr)
G
Gerd Hoffmann 已提交
581
{
582 583 584 585 586 587
    if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
        s->usbsts |= intr;
        ehci_update_irq(s);
    } else {
        s->usbsts_pending |= intr;
    }
G
Gerd Hoffmann 已提交
588 589
}

590 591 592 593 594
/*
 * Commit pending interrupts (added via ehci_raise_irq),
 * at the rate allowed by "Interrupt Threshold Control".
 */
static inline void ehci_commit_irq(EHCIState *s)
G
Gerd Hoffmann 已提交
595
{
596 597
    uint32_t itc;

G
Gerd Hoffmann 已提交
598 599 600
    if (!s->usbsts_pending) {
        return;
    }
601 602 603 604 605 606
    if (s->usbsts_frindex > s->frindex) {
        return;
    }

    itc = (s->usbcmd >> 16) & 0xff;
    s->usbsts |= s->usbsts_pending;
G
Gerd Hoffmann 已提交
607
    s->usbsts_pending = 0;
608 609
    s->usbsts_frindex = s->frindex + itc;
    ehci_update_irq(s);
G
Gerd Hoffmann 已提交
610 611
}

G
Gerd Hoffmann 已提交
612 613 614 615 616 617 618 619 620 621 622
static void ehci_update_halt(EHCIState *s)
{
    if (s->usbcmd & USBCMD_RUNSTOP) {
        ehci_clear_usbsts(s, USBSTS_HALT);
    } else {
        if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
            ehci_set_usbsts(s, USBSTS_HALT);
        }
    }
}

623 624 625 626 627
static void ehci_set_state(EHCIState *s, int async, int state)
{
    if (async) {
        trace_usb_ehci_state("async", state2str(state));
        s->astate = state;
628 629
        if (s->astate == EST_INACTIVE) {
            ehci_clear_usbsts(s, USBSTS_ASS);
G
Gerd Hoffmann 已提交
630
            ehci_update_halt(s);
631 632 633
        } else {
            ehci_set_usbsts(s, USBSTS_ASS);
        }
634 635 636
    } else {
        trace_usb_ehci_state("periodic", state2str(state));
        s->pstate = state;
637 638
        if (s->pstate == EST_INACTIVE) {
            ehci_clear_usbsts(s, USBSTS_PSS);
G
Gerd Hoffmann 已提交
639
            ehci_update_halt(s);
640 641 642
        } else {
            ehci_set_usbsts(s, USBSTS_PSS);
        }
643 644 645 646 647 648 649 650
    }
}

static int ehci_get_state(EHCIState *s, int async)
{
    return async ? s->astate : s->pstate;
}

G
Gerd Hoffmann 已提交
651 652 653 654 655 656 657 658 659 660 661 662 663 664
static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
{
    if (async) {
        s->a_fetch_addr = addr;
    } else {
        s->p_fetch_addr = addr;
    }
}

static int ehci_get_fetch_addr(EHCIState *s, int async)
{
    return async ? s->a_fetch_addr : s->p_fetch_addr;
}

A
Avi Kivity 已提交
665
static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
666
{
667 668 669 670 671 672 673 674 675 676 677 678 679 680
    /* need three here due to argument count limits */
    trace_usb_ehci_qh_ptrs(q, addr, qh->next,
                           qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
    trace_usb_ehci_qh_fields(addr,
                             get_field(qh->epchar, QH_EPCHAR_RL),
                             get_field(qh->epchar, QH_EPCHAR_MPLEN),
                             get_field(qh->epchar, QH_EPCHAR_EPS),
                             get_field(qh->epchar, QH_EPCHAR_EP),
                             get_field(qh->epchar, QH_EPCHAR_DEVADDR));
    trace_usb_ehci_qh_bits(addr,
                           (bool)(qh->epchar & QH_EPCHAR_C),
                           (bool)(qh->epchar & QH_EPCHAR_H),
                           (bool)(qh->epchar & QH_EPCHAR_DTC),
                           (bool)(qh->epchar & QH_EPCHAR_I));
681 682
}

A
Avi Kivity 已提交
683
static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
684
{
685 686 687 688 689 690 691 692 693 694 695 696 697
    /* need three here due to argument count limits */
    trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
    trace_usb_ehci_qtd_fields(addr,
                              get_field(qtd->token, QTD_TOKEN_TBYTES),
                              get_field(qtd->token, QTD_TOKEN_CPAGE),
                              get_field(qtd->token, QTD_TOKEN_CERR),
                              get_field(qtd->token, QTD_TOKEN_PID));
    trace_usb_ehci_qtd_bits(addr,
                            (bool)(qtd->token & QTD_TOKEN_IOC),
                            (bool)(qtd->token & QTD_TOKEN_ACTIVE),
                            (bool)(qtd->token & QTD_TOKEN_HALT),
                            (bool)(qtd->token & QTD_TOKEN_BABBLE),
                            (bool)(qtd->token & QTD_TOKEN_XACTERR));
698 699
}

A
Avi Kivity 已提交
700
static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
701
{
G
Gerd Hoffmann 已提交
702 703 704 705 706
    trace_usb_ehci_itd(addr, itd->next,
                       get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
                       get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
                       get_field(itd->bufptr[0], ITD_BUFPTR_EP),
                       get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
707 708
}

A
Avi Kivity 已提交
709
static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
G
Gerd Hoffmann 已提交
710 711 712 713 714 715
                            EHCIsitd *sitd)
{
    trace_usb_ehci_sitd(addr, sitd->next,
                        (bool)(sitd->results & SITD_RESULTS_ACTIVE));
}

G
Gerd Hoffmann 已提交
716 717 718 719 720 721
static void ehci_trace_guest_bug(EHCIState *s, const char *message)
{
    trace_usb_ehci_guest_bug(message);
    fprintf(stderr, "ehci warning: %s\n", message);
}

722 723 724 725 726 727 728 729 730 731 732 733 734 735 736
static inline bool ehci_enabled(EHCIState *s)
{
    return s->usbcmd & USBCMD_RUNSTOP;
}

static inline bool ehci_async_enabled(EHCIState *s)
{
    return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
}

static inline bool ehci_periodic_enabled(EHCIState *s)
{
    return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
}

G
Gerd Hoffmann 已提交
737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752
/* packet management */

static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
{
    EHCIPacket *p;

    p = g_new0(EHCIPacket, 1);
    p->queue = q;
    usb_packet_init(&p->packet);
    QTAILQ_INSERT_TAIL(&q->packets, p, next);
    trace_usb_ehci_packet_action(p->queue, p, "alloc");
    return p;
}

static void ehci_free_packet(EHCIPacket *p)
{
753 754 755 756 757 758 759 760 761 762
    if (p->async == EHCI_ASYNC_FINISHED) {
        int state = ehci_get_state(p->queue->ehci, p->queue->async);
        /* This is a normal, but rare condition (cancel racing completion) */
        fprintf(stderr, "EHCI: Warning packet completed but not processed\n");
        ehci_state_executing(p->queue);
        ehci_state_writeback(p->queue);
        ehci_set_state(p->queue->ehci, p->queue->async, state);
        /* state_writeback recurses into us with async == EHCI_ASYNC_NONE!! */
        return;
    }
763
    trace_usb_ehci_packet_action(p->queue, p, "free");
764 765 766 767
    if (p->async == EHCI_ASYNC_INITIALIZED) {
        usb_packet_unmap(&p->packet, &p->sgl);
        qemu_sglist_destroy(&p->sgl);
    }
768 769 770 771 772
    if (p->async == EHCI_ASYNC_INFLIGHT) {
        usb_cancel_packet(&p->packet);
        usb_packet_unmap(&p->packet, &p->sgl);
        qemu_sglist_destroy(&p->sgl);
    }
G
Gerd Hoffmann 已提交
773 774 775 776 777
    QTAILQ_REMOVE(&p->queue->packets, p, next);
    usb_packet_cleanup(&p->packet);
    g_free(p);
}

G
Gerd Hoffmann 已提交
778 779
/* queue management */

G
Gerd Hoffmann 已提交
780
static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
G
Gerd Hoffmann 已提交
781
{
782
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
G
Gerd Hoffmann 已提交
783 784
    EHCIQueue *q;

785
    q = g_malloc0(sizeof(*q));
G
Gerd Hoffmann 已提交
786
    q->ehci = ehci;
G
Gerd Hoffmann 已提交
787
    q->qhaddr = addr;
788
    q->async = async;
G
Gerd Hoffmann 已提交
789
    QTAILQ_INIT(&q->packets);
790
    QTAILQ_INSERT_HEAD(head, q, next);
G
Gerd Hoffmann 已提交
791 792 793 794
    trace_usb_ehci_queue_action(q, "alloc");
    return q;
}

G
Gerd Hoffmann 已提交
795
static int ehci_cancel_queue(EHCIQueue *q)
G
Gerd Hoffmann 已提交
796 797
{
    EHCIPacket *p;
G
Gerd Hoffmann 已提交
798
    int packets = 0;
G
Gerd Hoffmann 已提交
799 800 801

    p = QTAILQ_FIRST(&q->packets);
    if (p == NULL) {
G
Gerd Hoffmann 已提交
802
        return 0;
G
Gerd Hoffmann 已提交
803 804 805 806 807
    }

    trace_usb_ehci_queue_action(q, "cancel");
    do {
        ehci_free_packet(p);
G
Gerd Hoffmann 已提交
808
        packets++;
G
Gerd Hoffmann 已提交
809
    } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
G
Gerd Hoffmann 已提交
810
    return packets;
G
Gerd Hoffmann 已提交
811 812
}

G
Gerd Hoffmann 已提交
813
static int ehci_reset_queue(EHCIQueue *q)
814
{
G
Gerd Hoffmann 已提交
815 816
    int packets;

817
    trace_usb_ehci_queue_action(q, "reset");
G
Gerd Hoffmann 已提交
818
    packets = ehci_cancel_queue(q);
819 820
    q->dev = NULL;
    q->qtdaddr = 0;
G
Gerd Hoffmann 已提交
821
    return packets;
822 823
}

824
static void ehci_free_queue(EHCIQueue *q, const char *warn)
G
Gerd Hoffmann 已提交
825
{
826
    EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
827
    int cancelled;
G
Gerd Hoffmann 已提交
828

G
Gerd Hoffmann 已提交
829
    trace_usb_ehci_queue_action(q, "free");
830 831 832 833
    cancelled = ehci_cancel_queue(q);
    if (warn && cancelled > 0) {
        ehci_trace_guest_bug(q->ehci, warn);
    }
834
    QTAILQ_REMOVE(head, q, next);
835
    g_free(q);
G
Gerd Hoffmann 已提交
836 837
}

838 839
static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
                                        int async)
G
Gerd Hoffmann 已提交
840
{
841
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
G
Gerd Hoffmann 已提交
842 843
    EHCIQueue *q;

844
    QTAILQ_FOREACH(q, head, next) {
G
Gerd Hoffmann 已提交
845 846 847 848 849 850 851
        if (addr == q->qhaddr) {
            return q;
        }
    }
    return NULL;
}

852
static void ehci_queues_rip_unused(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
853
{
854
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
855
    const char *warn = async ? "guest unlinked busy QH" : NULL;
G
Gerd Hoffmann 已提交
856
    uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
G
Gerd Hoffmann 已提交
857 858
    EHCIQueue *q, *tmp;

859
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
G
Gerd Hoffmann 已提交
860 861
        if (q->seen) {
            q->seen = 0;
G
Gerd Hoffmann 已提交
862
            q->ts = ehci->last_run_ns;
G
Gerd Hoffmann 已提交
863 864
            continue;
        }
865
        if (ehci->last_run_ns < q->ts + maxage) {
G
Gerd Hoffmann 已提交
866 867
            continue;
        }
868
        ehci_free_queue(q, warn);
G
Gerd Hoffmann 已提交
869 870 871
    }
}

872 873 874 875 876 877 878 879 880 881 882 883
static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
{
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
    EHCIQueue *q, *tmp;

    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
        if (!q->seen) {
            ehci_free_queue(q, NULL);
        }
    }
}

884
static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
885
{
886
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
887 888
    EHCIQueue *q, *tmp;

889
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
890
        if (q->dev != dev) {
891 892
            continue;
        }
893
        ehci_free_queue(q, NULL);
894 895 896
    }
}

897
static void ehci_queues_rip_all(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
898
{
899
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
900
    const char *warn = async ? "guest stopped busy async schedule" : NULL;
G
Gerd Hoffmann 已提交
901 902
    EHCIQueue *q, *tmp;

903
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
904
        ehci_free_queue(q, warn);
G
Gerd Hoffmann 已提交
905 906 907
    }
}

G
Gerd Hoffmann 已提交
908 909 910 911 912 913
/* Attach or detach a device on root hub */

static void ehci_attach(USBPort *port)
{
    EHCIState *s = port->opaque;
    uint32_t *portsc = &s->portsc[port->index];
G
Gerd Hoffmann 已提交
914
    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
G
Gerd Hoffmann 已提交
915

G
Gerd Hoffmann 已提交
916
    trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
G
Gerd Hoffmann 已提交
917

918 919 920 921 922 923 924
    if (*portsc & PORTSC_POWNER) {
        USBPort *companion = s->companion_ports[port->index];
        companion->dev = port->dev;
        companion->ops->attach(companion);
        return;
    }

G
Gerd Hoffmann 已提交
925 926 927
    *portsc |= PORTSC_CONNECT;
    *portsc |= PORTSC_CSC;

928 929
    ehci_raise_irq(s, USBSTS_PCD);
    ehci_commit_irq(s);
G
Gerd Hoffmann 已提交
930 931 932 933 934 935
}

static void ehci_detach(USBPort *port)
{
    EHCIState *s = port->opaque;
    uint32_t *portsc = &s->portsc[port->index];
G
Gerd Hoffmann 已提交
936
    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
G
Gerd Hoffmann 已提交
937

G
Gerd Hoffmann 已提交
938
    trace_usb_ehci_port_detach(port->index, owner);
G
Gerd Hoffmann 已提交
939

940 941 942 943
    if (*portsc & PORTSC_POWNER) {
        USBPort *companion = s->companion_ports[port->index];
        companion->ops->detach(companion);
        companion->dev = NULL;
944 945 946 947 948
        /*
         * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
         * the port ownership is returned immediately to the EHCI controller."
         */
        *portsc &= ~PORTSC_POWNER;
949 950 951
        return;
    }

952 953
    ehci_queues_rip_device(s, port->dev, 0);
    ehci_queues_rip_device(s, port->dev, 1);
954

955
    *portsc &= ~(PORTSC_CONNECT|PORTSC_PED);
G
Gerd Hoffmann 已提交
956 957
    *portsc |= PORTSC_CSC;

958 959
    ehci_raise_irq(s, USBSTS_PCD);
    ehci_commit_irq(s);
G
Gerd Hoffmann 已提交
960 961
}

962 963 964
static void ehci_child_detach(USBPort *port, USBDevice *child)
{
    EHCIState *s = port->opaque;
965 966 967 968 969 970 971
    uint32_t portsc = s->portsc[port->index];

    if (portsc & PORTSC_POWNER) {
        USBPort *companion = s->companion_ports[port->index];
        companion->ops->child_detach(companion, child);
        return;
    }
972

973 974
    ehci_queues_rip_device(s, child, 0);
    ehci_queues_rip_device(s, child, 1);
975 976
}

977 978 979 980 981 982 983 984 985 986
static void ehci_wakeup(USBPort *port)
{
    EHCIState *s = port->opaque;
    uint32_t portsc = s->portsc[port->index];

    if (portsc & PORTSC_POWNER) {
        USBPort *companion = s->companion_ports[port->index];
        if (companion->ops->wakeup) {
            companion->ops->wakeup(companion);
        }
987
        return;
988
    }
989 990

    qemu_bh_schedule(s->async_bh);
991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028
}

static int ehci_register_companion(USBBus *bus, USBPort *ports[],
                                   uint32_t portcount, uint32_t firstport)
{
    EHCIState *s = container_of(bus, EHCIState, bus);
    uint32_t i;

    if (firstport + portcount > NB_PORTS) {
        qerror_report(QERR_INVALID_PARAMETER_VALUE, "firstport",
                      "firstport on masterbus");
        error_printf_unless_qmp(
            "firstport value of %u makes companion take ports %u - %u, which "
            "is outside of the valid range of 0 - %u\n", firstport, firstport,
            firstport + portcount - 1, NB_PORTS - 1);
        return -1;
    }

    for (i = 0; i < portcount; i++) {
        if (s->companion_ports[firstport + i]) {
            qerror_report(QERR_INVALID_PARAMETER_VALUE, "masterbus",
                          "an USB masterbus");
            error_printf_unless_qmp(
                "port %u on masterbus %s already has a companion assigned\n",
                firstport + i, bus->qbus.name);
            return -1;
        }
    }

    for (i = 0; i < portcount; i++) {
        s->companion_ports[firstport + i] = ports[i];
        s->ports[firstport + i].speedmask |=
            USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
        /* Ensure devs attached before the initial reset go to the companion */
        s->portsc[firstport + i] = PORTSC_POWNER;
    }

    s->companion_count++;
1029
    s->caps[0x05] = (s->companion_count << 4) | portcount;
1030 1031 1032 1033

    return 0;
}

1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053
static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
{
    USBDevice *dev;
    USBPort *port;
    int i;

    for (i = 0; i < NB_PORTS; i++) {
        port = &ehci->ports[i];
        if (!(ehci->portsc[i] & PORTSC_PED)) {
            DPRINTF("Port %d not enabled\n", i);
            continue;
        }
        dev = usb_find_device(port, addr);
        if (dev != NULL) {
            return dev;
        }
    }
    return NULL;
}

G
Gerd Hoffmann 已提交
1054 1055 1056 1057 1058
/* 4.1 host controller initialization */
static void ehci_reset(void *opaque)
{
    EHCIState *s = opaque;
    int i;
1059
    USBDevice *devs[NB_PORTS];
G
Gerd Hoffmann 已提交
1060

G
Gerd Hoffmann 已提交
1061
    trace_usb_ehci_reset();
G
Gerd Hoffmann 已提交
1062

1063 1064 1065 1066 1067 1068
    /*
     * Do the detach before touching portsc, so that it correctly gets send to
     * us or to our companion based on PORTSC_POWNER before the reset.
     */
    for(i = 0; i < NB_PORTS; i++) {
        devs[i] = s->ports[i].dev;
1069 1070
        if (devs[i] && devs[i]->attached) {
            usb_detach(&s->ports[i]);
1071 1072 1073
        }
    }

1074 1075
    memset(&s->opreg, 0x00, sizeof(s->opreg));
    memset(&s->portsc, 0x00, sizeof(s->portsc));
G
Gerd Hoffmann 已提交
1076 1077 1078

    s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
    s->usbsts = USBSTS_HALT;
1079 1080
    s->usbsts_pending = 0;
    s->usbsts_frindex = 0;
G
Gerd Hoffmann 已提交
1081 1082 1083 1084 1085

    s->astate = EST_INACTIVE;
    s->pstate = EST_INACTIVE;

    for(i = 0; i < NB_PORTS; i++) {
1086 1087 1088 1089 1090
        if (s->companion_ports[i]) {
            s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
        } else {
            s->portsc[i] = PORTSC_PPOWER;
        }
1091 1092
        if (devs[i] && devs[i]->attached) {
            usb_attach(&s->ports[i]);
G
Gerd Hoffmann 已提交
1093
            usb_device_reset(devs[i]);
G
Gerd Hoffmann 已提交
1094 1095
        }
    }
1096 1097
    ehci_queues_rip_all(s, 0);
    ehci_queues_rip_all(s, 1);
G
Gerd Hoffmann 已提交
1098
    qemu_del_timer(s->frame_timer);
1099
    qemu_bh_cancel(s->async_bh);
G
Gerd Hoffmann 已提交
1100 1101
}

A
Avi Kivity 已提交
1102
static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
1103
                               unsigned size)
G
Gerd Hoffmann 已提交
1104 1105
{
    EHCIState *s = ptr;
1106
    return s->caps[addr];
G
Gerd Hoffmann 已提交
1107 1108
}

A
Avi Kivity 已提交
1109
static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
1110
                                unsigned size)
G
Gerd Hoffmann 已提交
1111 1112 1113 1114
{
    EHCIState *s = ptr;
    uint32_t val;

1115 1116
    val = s->opreg[addr >> 2];
    trace_usb_ehci_opreg_read(addr + OPREGBASE, addr2str(addr), val);
G
Gerd Hoffmann 已提交
1117 1118 1119
    return val;
}

A
Avi Kivity 已提交
1120
static uint64_t ehci_port_read(void *ptr, hwaddr addr,
1121
                               unsigned size)
G
Gerd Hoffmann 已提交
1122 1123 1124 1125
{
    EHCIState *s = ptr;
    uint32_t val;

1126 1127
    val = s->portsc[addr >> 2];
    trace_usb_ehci_portsc_read(addr + PORTSC_BEGIN, addr >> 2, val);
G
Gerd Hoffmann 已提交
1128 1129 1130
    return val;
}

1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
{
    USBDevice *dev = s->ports[port].dev;
    uint32_t *portsc = &s->portsc[port];
    uint32_t orig;

    if (s->companion_ports[port] == NULL)
        return;

    owner = owner & PORTSC_POWNER;
    orig  = *portsc & PORTSC_POWNER;

    if (!(owner ^ orig)) {
        return;
    }

1147 1148
    if (dev && dev->attached) {
        usb_detach(&s->ports[port]);
1149 1150 1151 1152 1153
    }

    *portsc &= ~PORTSC_POWNER;
    *portsc |= owner;

1154 1155
    if (dev && dev->attached) {
        usb_attach(&s->ports[port]);
1156 1157 1158
    }
}

A
Avi Kivity 已提交
1159
static void ehci_port_write(void *ptr, hwaddr addr,
1160
                            uint64_t val, unsigned size)
G
Gerd Hoffmann 已提交
1161
{
1162 1163
    EHCIState *s = ptr;
    int port = addr >> 2;
G
Gerd Hoffmann 已提交
1164
    uint32_t *portsc = &s->portsc[port];
1165
    uint32_t old = *portsc;
G
Gerd Hoffmann 已提交
1166 1167
    USBDevice *dev = s->ports[port].dev;

1168 1169
    trace_usb_ehci_portsc_write(addr + PORTSC_BEGIN, addr >> 2, val);

1170 1171 1172 1173
    /* Clear rwc bits */
    *portsc &= ~(val & PORTSC_RWC_MASK);
    /* The guest may clear, but not set the PED bit */
    *portsc &= val | ~PORTSC_PED;
1174 1175 1176
    /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
    handle_port_owner_write(s, port, val);
    /* And finally apply RO_MASK */
G
Gerd Hoffmann 已提交
1177 1178 1179
    val &= PORTSC_RO_MASK;

    if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
G
Gerd Hoffmann 已提交
1180
        trace_usb_ehci_port_reset(port, 1);
G
Gerd Hoffmann 已提交
1181 1182 1183
    }

    if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
G
Gerd Hoffmann 已提交
1184
        trace_usb_ehci_port_reset(port, 0);
1185
        if (dev && dev->attached) {
G
Gerd Hoffmann 已提交
1186
            usb_port_reset(&s->ports[port]);
G
Gerd Hoffmann 已提交
1187 1188 1189
            *portsc &= ~PORTSC_CSC;
        }

1190 1191
        /*
         *  Table 2.16 Set the enable bit(and enable bit change) to indicate
G
Gerd Hoffmann 已提交
1192 1193
         *  to SW that this port has a high speed device attached
         */
1194
        if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
1195 1196
            val |= PORTSC_PED;
        }
G
Gerd Hoffmann 已提交
1197 1198 1199 1200
    }

    *portsc &= ~PORTSC_RO_MASK;
    *portsc |= val;
1201
    trace_usb_ehci_portsc_change(addr + PORTSC_BEGIN, addr >> 2, *portsc, old);
G
Gerd Hoffmann 已提交
1202 1203
}

A
Avi Kivity 已提交
1204
static void ehci_opreg_write(void *ptr, hwaddr addr,
1205
                             uint64_t val, unsigned size)
G
Gerd Hoffmann 已提交
1206 1207
{
    EHCIState *s = ptr;
1208
    uint32_t *mmio = s->opreg + (addr >> 2);
G
Gerd Hoffmann 已提交
1209
    uint32_t old = *mmio;
G
Gerd Hoffmann 已提交
1210
    int i;
G
Gerd Hoffmann 已提交
1211

1212
    trace_usb_ehci_opreg_write(addr + OPREGBASE, addr2str(addr), val);
G
Gerd Hoffmann 已提交
1213

1214
    switch (addr + OPREGBASE) {
G
Gerd Hoffmann 已提交
1215
    case USBCMD:
G
Gerd Hoffmann 已提交
1216 1217 1218 1219 1220 1221
        if (val & USBCMD_HCRESET) {
            ehci_reset(s);
            val = s->usbcmd;
            break;
        }

1222 1223 1224
        /* not supporting dynamic frame list size at the moment */
        if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
            fprintf(stderr, "attempt to set frame list size -- value %d\n",
1225
                    (int)val & USBCMD_FLS);
1226 1227 1228
            val &= ~USBCMD_FLS;
        }

1229 1230 1231 1232 1233 1234 1235
        if (val & USBCMD_IAAD) {
            /*
             * Process IAAD immediately, otherwise the Linux IAAD watchdog may
             * trigger and re-use a qh without us seeing the unlink.
             */
            s->async_stepdown = 0;
            qemu_bh_schedule(s->async_bh);
G
Gerd Hoffmann 已提交
1236
            trace_usb_ehci_doorbell_ring();
1237 1238
        }

G
Gerd Hoffmann 已提交
1239 1240
        if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
            ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
G
Gerd Hoffmann 已提交
1241
            if (s->pstate == EST_INACTIVE) {
G
Gerd Hoffmann 已提交
1242 1243
                SET_LAST_RUN_CLOCK(s);
            }
1244
            s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
G
Gerd Hoffmann 已提交
1245
            ehci_update_halt(s);
G
Gerd Hoffmann 已提交
1246 1247
            s->async_stepdown = 0;
            qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
G
Gerd Hoffmann 已提交
1248 1249 1250 1251
        }
        break;

    case USBSTS:
J
Jim Meyering 已提交
1252 1253
        val &= USBSTS_RO_MASK;              // bits 6 through 31 are RO
        ehci_clear_usbsts(s, val);          // bits 0 through 5 are R/WC
G
Gerd Hoffmann 已提交
1254
        val = s->usbsts;
1255
        ehci_update_irq(s);
G
Gerd Hoffmann 已提交
1256 1257 1258 1259 1260 1261
        break;

    case USBINTR:
        val &= USBINTR_MASK;
        break;

1262 1263 1264 1265
    case FRINDEX:
        val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */
        break;

G
Gerd Hoffmann 已提交
1266 1267 1268 1269
    case CONFIGFLAG:
        val &= 0x1;
        if (val) {
            for(i = 0; i < NB_PORTS; i++)
1270
                handle_port_owner_write(s, i, 0);
G
Gerd Hoffmann 已提交
1271 1272 1273 1274
        }
        break;

    case PERIODICLISTBASE:
1275
        if (ehci_periodic_enabled(s)) {
G
Gerd Hoffmann 已提交
1276 1277 1278 1279 1280 1281 1282
            fprintf(stderr,
              "ehci: PERIODIC list base register set while periodic schedule\n"
              "      is enabled and HC is enabled\n");
        }
        break;

    case ASYNCLISTADDR:
1283
        if (ehci_async_enabled(s)) {
G
Gerd Hoffmann 已提交
1284 1285 1286 1287 1288 1289 1290
            fprintf(stderr,
              "ehci: ASYNC list address register set while async schedule\n"
              "      is enabled and HC is enabled\n");
        }
        break;
    }

G
Gerd Hoffmann 已提交
1291
    *mmio = val;
1292
    trace_usb_ehci_opreg_change(addr + OPREGBASE, addr2str(addr), *mmio, old);
G
Gerd Hoffmann 已提交
1293 1294 1295 1296 1297 1298
}


// TODO : Put in common header file, duplication from usb-ohci.c

/* Get an array of dwords from main memory */
1299 1300
static inline int get_dwords(EHCIState *ehci, uint32_t addr,
                             uint32_t *buf, int num)
G
Gerd Hoffmann 已提交
1301 1302 1303 1304
{
    int i;

    for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
1305
        pci_dma_read(&ehci->dev, addr, buf, sizeof(*buf));
G
Gerd Hoffmann 已提交
1306 1307 1308 1309 1310 1311 1312
        *buf = le32_to_cpu(*buf);
    }

    return 1;
}

/* Put an array of dwords in to main memory */
1313 1314
static inline int put_dwords(EHCIState *ehci, uint32_t addr,
                             uint32_t *buf, int num)
G
Gerd Hoffmann 已提交
1315 1316 1317 1318 1319
{
    int i;

    for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
        uint32_t tmp = cpu_to_le32(*buf);
1320
        pci_dma_write(&ehci->dev, addr, &tmp, sizeof(tmp));
G
Gerd Hoffmann 已提交
1321 1322 1323 1324 1325
    }

    return 1;
}

G
Gerd Hoffmann 已提交
1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
/*
 *  Write the qh back to guest physical memory.  This step isn't
 *  in the EHCI spec but we need to do it since we don't share
 *  physical memory with our guest VM.
 *
 *  The first three dwords are read-only for the EHCI, so skip them
 *  when writing back the qh.
 */
static void ehci_flush_qh(EHCIQueue *q)
{
    uint32_t *qh = (uint32_t *) &q->qh;
    uint32_t dwords = sizeof(EHCIqh) >> 2;
    uint32_t addr = NLPTR_GET(q->qhaddr);

    put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
}

G
Gerd Hoffmann 已提交
1343 1344
// 4.10.2

G
Gerd Hoffmann 已提交
1345
static int ehci_qh_do_overlay(EHCIQueue *q)
G
Gerd Hoffmann 已提交
1346
{
G
Gerd Hoffmann 已提交
1347
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
G
Gerd Hoffmann 已提交
1348 1349 1350 1351 1352 1353
    int i;
    int dtoggle;
    int ping;
    int eps;
    int reload;

G
Gerd Hoffmann 已提交
1354 1355 1356
    assert(p != NULL);
    assert(p->qtdaddr == q->qtdaddr);

G
Gerd Hoffmann 已提交
1357 1358
    // remember values in fields to preserve in qh after overlay

G
Gerd Hoffmann 已提交
1359 1360
    dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
    ping    = q->qh.token & QTD_TOKEN_PING;
G
Gerd Hoffmann 已提交
1361

G
Gerd Hoffmann 已提交
1362 1363 1364 1365
    q->qh.current_qtd = p->qtdaddr;
    q->qh.next_qtd    = p->qtd.next;
    q->qh.altnext_qtd = p->qtd.altnext;
    q->qh.token       = p->qtd.token;
G
Gerd Hoffmann 已提交
1366 1367


G
Gerd Hoffmann 已提交
1368
    eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
G
Gerd Hoffmann 已提交
1369
    if (eps == EHCI_QH_EPS_HIGH) {
G
Gerd Hoffmann 已提交
1370 1371
        q->qh.token &= ~QTD_TOKEN_PING;
        q->qh.token |= ping;
G
Gerd Hoffmann 已提交
1372 1373
    }

G
Gerd Hoffmann 已提交
1374 1375
    reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
    set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
G
Gerd Hoffmann 已提交
1376 1377

    for (i = 0; i < 5; i++) {
G
Gerd Hoffmann 已提交
1378
        q->qh.bufptr[i] = p->qtd.bufptr[i];
G
Gerd Hoffmann 已提交
1379 1380
    }

G
Gerd Hoffmann 已提交
1381
    if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
G
Gerd Hoffmann 已提交
1382
        // preserve QH DT bit
G
Gerd Hoffmann 已提交
1383 1384
        q->qh.token &= ~QTD_TOKEN_DTOGGLE;
        q->qh.token |= dtoggle;
G
Gerd Hoffmann 已提交
1385 1386
    }

G
Gerd Hoffmann 已提交
1387 1388
    q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
    q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
G
Gerd Hoffmann 已提交
1389

G
Gerd Hoffmann 已提交
1390
    ehci_flush_qh(q);
G
Gerd Hoffmann 已提交
1391 1392 1393 1394

    return 0;
}

G
Gerd Hoffmann 已提交
1395
static int ehci_init_transfer(EHCIPacket *p)
G
Gerd Hoffmann 已提交
1396
{
1397
    uint32_t cpage, offset, bytes, plen;
1398
    dma_addr_t page;
G
Gerd Hoffmann 已提交
1399

G
Gerd Hoffmann 已提交
1400 1401 1402 1403
    cpage  = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
    bytes  = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
    offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
    pci_dma_sglist_init(&p->sgl, &p->queue->ehci->dev, 5);
G
Gerd Hoffmann 已提交
1404

1405 1406 1407 1408 1409
    while (bytes > 0) {
        if (cpage > 4) {
            fprintf(stderr, "cpage out of range (%d)\n", cpage);
            return USB_RET_PROCERR;
        }
G
Gerd Hoffmann 已提交
1410

G
Gerd Hoffmann 已提交
1411
        page  = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1412 1413 1414 1415 1416 1417
        page += offset;
        plen  = bytes;
        if (plen > 4096 - offset) {
            plen = 4096 - offset;
            offset = 0;
            cpage++;
G
Gerd Hoffmann 已提交
1418 1419
        }

G
Gerd Hoffmann 已提交
1420
        qemu_sglist_add(&p->sgl, page, plen);
1421 1422 1423 1424
        bytes -= plen;
    }
    return 0;
}
G
Gerd Hoffmann 已提交
1425

1426 1427 1428
static void ehci_finish_transfer(EHCIQueue *q, int status)
{
    uint32_t cpage, offset;
G
Gerd Hoffmann 已提交
1429

1430 1431 1432 1433
    if (status > 0) {
        /* update cpage & offset */
        cpage  = get_field(q->qh.token, QTD_TOKEN_CPAGE);
        offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
G
Gerd Hoffmann 已提交
1434

1435 1436 1437
        offset += status;
        cpage  += offset >> QTD_BUFPTR_SH;
        offset &= ~QTD_BUFPTR_MASK;
G
Gerd Hoffmann 已提交
1438

1439 1440 1441 1442
        set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
        q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
        q->qh.bufptr[0] |= offset;
    }
G
Gerd Hoffmann 已提交
1443 1444
}

1445
static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
G
Gerd Hoffmann 已提交
1446
{
G
Gerd Hoffmann 已提交
1447
    EHCIPacket *p;
1448 1449 1450 1451 1452 1453 1454 1455
    EHCIState *s = port->opaque;
    uint32_t portsc = s->portsc[port->index];

    if (portsc & PORTSC_POWNER) {
        USBPort *companion = s->companion_ports[port->index];
        companion->ops->complete(companion, packet);
        return;
    }
G
Gerd Hoffmann 已提交
1456

G
Gerd Hoffmann 已提交
1457 1458 1459 1460 1461
    p = container_of(packet, EHCIPacket, packet);
    trace_usb_ehci_packet_action(p->queue, p, "wakeup");
    assert(p->async == EHCI_ASYNC_INFLIGHT);
    p->async = EHCI_ASYNC_FINISHED;
    p->usb_status = packet->result;
1462 1463 1464 1465

    if (p->queue->async) {
        qemu_bh_schedule(p->queue->ehci->async_bh);
    }
G
Gerd Hoffmann 已提交
1466 1467
}

G
Gerd Hoffmann 已提交
1468
static void ehci_execute_complete(EHCIQueue *q)
G
Gerd Hoffmann 已提交
1469
{
G
Gerd Hoffmann 已提交
1470 1471 1472 1473
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);

    assert(p != NULL);
    assert(p->qtdaddr == q->qtdaddr);
1474 1475
    assert(p->async == EHCI_ASYNC_INITIALIZED ||
           p->async == EHCI_ASYNC_FINISHED);
G
Gerd Hoffmann 已提交
1476 1477

    DPRINTF("execute_complete: qhaddr 0x%x, next %x, qtdaddr 0x%x, status %d\n",
G
Gerd Hoffmann 已提交
1478
            q->qhaddr, q->qh.next, q->qtdaddr, q->usb_status);
G
Gerd Hoffmann 已提交
1479

G
Gerd Hoffmann 已提交
1480 1481
    if (p->usb_status < 0) {
        switch (p->usb_status) {
H
Hans de Goede 已提交
1482
        case USB_RET_IOERROR:
G
Gerd Hoffmann 已提交
1483
        case USB_RET_NODEV:
G
Gerd Hoffmann 已提交
1484
            q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
H
Hans de Goede 已提交
1485
            set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1486
            ehci_raise_irq(q->ehci, USBSTS_ERRINT);
G
Gerd Hoffmann 已提交
1487 1488
            break;
        case USB_RET_STALL:
G
Gerd Hoffmann 已提交
1489
            q->qh.token |= QTD_TOKEN_HALT;
1490
            ehci_raise_irq(q->ehci, USBSTS_ERRINT);
G
Gerd Hoffmann 已提交
1491 1492
            break;
        case USB_RET_NAK:
1493 1494
            set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
            return; /* We're not done yet with this transaction */
G
Gerd Hoffmann 已提交
1495
        case USB_RET_BABBLE:
G
Gerd Hoffmann 已提交
1496
            q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1497
            ehci_raise_irq(q->ehci, USBSTS_ERRINT);
G
Gerd Hoffmann 已提交
1498 1499
            break;
        default:
G
Gerd Hoffmann 已提交
1500
            /* should not be triggerable */
G
Gerd Hoffmann 已提交
1501
            fprintf(stderr, "USB invalid response %d\n", p->usb_status);
G
Gerd Hoffmann 已提交
1502
            assert(0);
G
Gerd Hoffmann 已提交
1503 1504 1505 1506
            break;
        }
    } else {
        // TODO check 4.12 for splits
1507
        uint32_t tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
G
Gerd Hoffmann 已提交
1508

1509 1510
        if (tbytes && p->pid == USB_TOKEN_IN) {
            tbytes -= p->usb_status;
G
Gerd Hoffmann 已提交
1511
        } else {
1512
            tbytes = 0;
G
Gerd Hoffmann 已提交
1513 1514
        }

1515 1516
        DPRINTF("updating tbytes to %d\n", tbytes);
        set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
G
Gerd Hoffmann 已提交
1517
    }
G
Gerd Hoffmann 已提交
1518
    ehci_finish_transfer(q, p->usb_status);
1519
    usb_packet_unmap(&p->packet, &p->sgl);
G
Gerd Hoffmann 已提交
1520
    qemu_sglist_destroy(&p->sgl);
1521
    p->async = EHCI_ASYNC_NONE;
G
Gerd Hoffmann 已提交
1522

G
Gerd Hoffmann 已提交
1523 1524
    q->qh.token ^= QTD_TOKEN_DTOGGLE;
    q->qh.token &= ~QTD_TOKEN_ACTIVE;
G
Gerd Hoffmann 已提交
1525

1526
    if (q->qh.token & QTD_TOKEN_IOC) {
1527
        ehci_raise_irq(q->ehci, USBSTS_INT);
G
Gerd Hoffmann 已提交
1528 1529 1530 1531 1532
    }
}

// 4.10.3

G
Gerd Hoffmann 已提交
1533
static int ehci_execute(EHCIPacket *p, const char *action)
G
Gerd Hoffmann 已提交
1534
{
1535
    USBEndpoint *ep;
G
Gerd Hoffmann 已提交
1536 1537 1538
    int ret;
    int endp;

1539 1540 1541
    assert(p->async == EHCI_ASYNC_NONE ||
           p->async == EHCI_ASYNC_INITIALIZED);

1542 1543
    if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
        fprintf(stderr, "Attempting to execute inactive qtd\n");
G
Gerd Hoffmann 已提交
1544 1545 1546
        return USB_RET_PROCERR;
    }

1547
    if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1548 1549
        ehci_trace_guest_bug(p->queue->ehci,
                             "guest requested more bytes than allowed");
G
Gerd Hoffmann 已提交
1550 1551 1552
        return USB_RET_PROCERR;
    }

1553
    p->pid = (p->qtd.token & QTD_TOKEN_PID_MASK) >> QTD_TOKEN_PID_SH;
G
Gerd Hoffmann 已提交
1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
    switch (p->pid) {
    case 0:
        p->pid = USB_TOKEN_OUT;
        break;
    case 1:
        p->pid = USB_TOKEN_IN;
        break;
    case 2:
        p->pid = USB_TOKEN_SETUP;
        break;
    default:
        fprintf(stderr, "bad token\n");
        break;
G
Gerd Hoffmann 已提交
1567 1568
    }

1569
    endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1570
    ep = usb_ep_get(p->queue->dev, p->pid, endp);
G
Gerd Hoffmann 已提交
1571

1572 1573 1574 1575 1576 1577 1578 1579 1580
    if (p->async == EHCI_ASYNC_NONE) {
        if (ehci_init_transfer(p) != 0) {
            return USB_RET_PROCERR;
        }

        usb_packet_setup(&p->packet, p->pid, ep, p->qtdaddr);
        usb_packet_map(&p->packet, &p->sgl);
        p->async = EHCI_ASYNC_INITIALIZED;
    }
1581

G
Gerd Hoffmann 已提交
1582
    trace_usb_ehci_packet_action(p->queue, p, action);
1583
    ret = usb_handle_packet(p->queue->dev, &p->packet);
1584
    DPRINTF("submit: qh %x next %x qtd %x pid %x len %zd endp %x ret %d\n",
1585
            q->qhaddr, q->qh.next, q->qtdaddr, q->pid,
1586
            q->packet.iov.size, endp, ret);
G
Gerd Hoffmann 已提交
1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599

    if (ret > BUFF_SIZE) {
        fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
        return USB_RET_PROCERR;
    }

    return ret;
}

/*  4.7.2
 */

static int ehci_process_itd(EHCIState *ehci,
G
Gerd Hoffmann 已提交
1600 1601
                            EHCIitd *itd,
                            uint32_t addr)
G
Gerd Hoffmann 已提交
1602 1603
{
    USBDevice *dev;
1604
    USBEndpoint *ep;
G
Gerd Hoffmann 已提交
1605
    int ret;
1606
    uint32_t i, len, pid, dir, devaddr, endp;
G
Gerd Hoffmann 已提交
1607
    uint32_t pg, off, ptr1, ptr2, max, mult;
G
Gerd Hoffmann 已提交
1608 1609

    dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
G
Gerd Hoffmann 已提交
1610
    devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
G
Gerd Hoffmann 已提交
1611
    endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
G
Gerd Hoffmann 已提交
1612 1613
    max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
    mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
G
Gerd Hoffmann 已提交
1614 1615 1616

    for(i = 0; i < 8; i++) {
        if (itd->transact[i] & ITD_XACT_ACTIVE) {
G
Gerd Hoffmann 已提交
1617 1618 1619 1620 1621 1622 1623 1624 1625
            pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
            off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
            ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
            len  = get_field(itd->transact[i], ITD_XACT_LENGTH);

            if (len > max * mult) {
                len = max * mult;
            }
G
Gerd Hoffmann 已提交
1626 1627 1628 1629 1630

            if (len > BUFF_SIZE) {
                return USB_RET_PROCERR;
            }

1631
            pci_dma_sglist_init(&ehci->isgl, &ehci->dev, 2);
G
Gerd Hoffmann 已提交
1632 1633
            if (off + len > 4096) {
                /* transfer crosses page border */
1634 1635 1636 1637
                uint32_t len2 = off + len - 4096;
                uint32_t len1 = len - len2;
                qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
                qemu_sglist_add(&ehci->isgl, ptr2, len2);
G
Gerd Hoffmann 已提交
1638
            } else {
1639
                qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
G
Gerd Hoffmann 已提交
1640
            }
G
Gerd Hoffmann 已提交
1641

1642
            pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
G
Gerd Hoffmann 已提交
1643

1644 1645
            dev = ehci_find_device(ehci, devaddr);
            ep = usb_ep_get(dev, pid, endp);
1646
            if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
G
Gerd Hoffmann 已提交
1647
                usb_packet_setup(&ehci->ipacket, pid, ep, addr);
G
Gerd Hoffmann 已提交
1648 1649 1650
                usb_packet_map(&ehci->ipacket, &ehci->isgl);
                ret = usb_handle_packet(dev, &ehci->ipacket);
                assert(ret != USB_RET_ASYNC);
1651
                usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
G
Gerd Hoffmann 已提交
1652 1653 1654 1655
            } else {
                DPRINTF("ISOCH: attempt to addess non-iso endpoint\n");
                ret = USB_RET_NAK;
            }
1656 1657
            qemu_sglist_destroy(&ehci->isgl);

1658
            if (ret < 0) {
1659 1660 1661 1662
                switch (ret) {
                default:
                    fprintf(stderr, "Unexpected iso usb result: %d\n", ret);
                    /* Fall through */
H
Hans de Goede 已提交
1663
                case USB_RET_IOERROR:
1664 1665 1666 1667
                case USB_RET_NODEV:
                    /* 3.3.2: XACTERR is only allowed on IN transactions */
                    if (dir) {
                        itd->transact[i] |= ITD_XACT_XACTERR;
1668
                        ehci_raise_irq(ehci, USBSTS_ERRINT);
1669 1670 1671 1672
                    }
                    break;
                case USB_RET_BABBLE:
                    itd->transact[i] |= ITD_XACT_BABBLE;
1673
                    ehci_raise_irq(ehci, USBSTS_ERRINT);
1674
                    break;
1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687
                case USB_RET_NAK:
                    /* no data for us, so do a zero-length transfer */
                    ret = 0;
                    break;
                }
            }
            if (ret >= 0) {
                if (!dir) {
                    /* OUT */
                    set_field(&itd->transact[i], len - ret, ITD_XACT_LENGTH);
                } else {
                    /* IN */
                    set_field(&itd->transact[i], ret, ITD_XACT_LENGTH);
G
Gerd Hoffmann 已提交
1688 1689
                }
            }
1690
            if (itd->transact[i] & ITD_XACT_IOC) {
1691
                ehci_raise_irq(ehci, USBSTS_INT);
1692
            }
G
Gerd Hoffmann 已提交
1693
            itd->transact[i] &= ~ITD_XACT_ACTIVE;
G
Gerd Hoffmann 已提交
1694 1695 1696 1697 1698
        }
    }
    return 0;
}

G
Gerd Hoffmann 已提交
1699

G
Gerd Hoffmann 已提交
1700 1701 1702
/*  This state is the entry point for asynchronous schedule
 *  processing.  Entry here consitutes a EHCI start event state (4.8.5)
 */
1703
static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
G
Gerd Hoffmann 已提交
1704
{
G
Gerd Hoffmann 已提交
1705
    EHCIqh qh;
G
Gerd Hoffmann 已提交
1706 1707 1708 1709 1710 1711
    int i = 0;
    int again = 0;
    uint32_t entry = ehci->asynclistaddr;

    /* set reclamation flag at start event (4.8.6) */
    if (async) {
G
Gerd Hoffmann 已提交
1712
        ehci_set_usbsts(ehci, USBSTS_REC);
G
Gerd Hoffmann 已提交
1713 1714
    }

1715
    ehci_queues_rip_unused(ehci, async);
G
Gerd Hoffmann 已提交
1716

G
Gerd Hoffmann 已提交
1717 1718
    /*  Find the head of the list (4.9.1.1) */
    for(i = 0; i < MAX_QH; i++) {
1719 1720
        get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
                   sizeof(EHCIqh) >> 2);
G
Gerd Hoffmann 已提交
1721
        ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
G
Gerd Hoffmann 已提交
1722

G
Gerd Hoffmann 已提交
1723
        if (qh.epchar & QH_EPCHAR_H) {
G
Gerd Hoffmann 已提交
1724 1725 1726 1727
            if (async) {
                entry |= (NLPTR_TYPE_QH << 1);
            }

G
Gerd Hoffmann 已提交
1728
            ehci_set_fetch_addr(ehci, async, entry);
1729
            ehci_set_state(ehci, async, EST_FETCHENTRY);
G
Gerd Hoffmann 已提交
1730 1731 1732 1733
            again = 1;
            goto out;
        }

G
Gerd Hoffmann 已提交
1734
        entry = qh.next;
G
Gerd Hoffmann 已提交
1735 1736 1737 1738 1739 1740 1741
        if (entry == ehci->asynclistaddr) {
            break;
        }
    }

    /* no head found for list. */

1742
    ehci_set_state(ehci, async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
1743 1744 1745 1746 1747 1748 1749 1750 1751

out:
    return again;
}


/*  This state is the entry point for periodic schedule processing as
 *  well as being a continuation state for async processing.
 */
1752
static int ehci_state_fetchentry(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
1753 1754
{
    int again = 0;
G
Gerd Hoffmann 已提交
1755
    uint32_t entry = ehci_get_fetch_addr(ehci, async);
G
Gerd Hoffmann 已提交
1756

1757
    if (NLPTR_TBIT(entry)) {
1758
        ehci_set_state(ehci, async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769
        goto out;
    }

    /* section 4.8, only QH in async schedule */
    if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
        fprintf(stderr, "non queue head request in async schedule\n");
        return -1;
    }

    switch (NLPTR_TYPE_GET(entry)) {
    case NLPTR_TYPE_QH:
1770
        ehci_set_state(ehci, async, EST_FETCHQH);
G
Gerd Hoffmann 已提交
1771 1772 1773 1774
        again = 1;
        break;

    case NLPTR_TYPE_ITD:
1775
        ehci_set_state(ehci, async, EST_FETCHITD);
G
Gerd Hoffmann 已提交
1776 1777 1778
        again = 1;
        break;

G
Gerd Hoffmann 已提交
1779 1780 1781 1782 1783
    case NLPTR_TYPE_STITD:
        ehci_set_state(ehci, async, EST_FETCHSITD);
        again = 1;
        break;

G
Gerd Hoffmann 已提交
1784
    default:
G
Gerd Hoffmann 已提交
1785
        /* TODO: handle FSTN type */
G
Gerd Hoffmann 已提交
1786 1787 1788 1789 1790 1791 1792 1793 1794
        fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "
                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
        return -1;
    }

out:
    return again;
}

G
Gerd Hoffmann 已提交
1795
static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
1796
{
G
Gerd Hoffmann 已提交
1797
    EHCIPacket *p;
1798
    uint32_t entry, devaddr, endp;
G
Gerd Hoffmann 已提交
1799
    EHCIQueue *q;
1800
    EHCIqh qh;
G
Gerd Hoffmann 已提交
1801

G
Gerd Hoffmann 已提交
1802
    entry = ehci_get_fetch_addr(ehci, async);
1803
    q = ehci_find_queue_by_qh(ehci, entry, async);
G
Gerd Hoffmann 已提交
1804
    if (NULL == q) {
G
Gerd Hoffmann 已提交
1805
        q = ehci_alloc_queue(ehci, entry, async);
G
Gerd Hoffmann 已提交
1806
    }
G
Gerd Hoffmann 已提交
1807
    p = QTAILQ_FIRST(&q->packets);
G
Gerd Hoffmann 已提交
1808

G
Gerd Hoffmann 已提交
1809
    q->seen++;
G
Gerd Hoffmann 已提交
1810 1811 1812 1813 1814 1815
    if (q->seen > 1) {
        /* we are going in circles -- stop processing */
        ehci_set_state(ehci, async, EST_ACTIVE);
        q = NULL;
        goto out;
    }
G
Gerd Hoffmann 已提交
1816

1817
    get_dwords(ehci, NLPTR_GET(q->qhaddr),
1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831
               (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
    ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);

    /*
     * The overlay area of the qh should never be changed by the guest,
     * except when idle, in which case the reset is a nop.
     */
    devaddr = get_field(qh.epchar, QH_EPCHAR_DEVADDR);
    endp    = get_field(qh.epchar, QH_EPCHAR_EP);
    if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
        (endp    != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
        (memcmp(&qh.current_qtd, &q->qh.current_qtd,
                                 9 * sizeof(uint32_t)) != 0) ||
        (q->dev != NULL && q->dev->addr != devaddr)) {
G
Gerd Hoffmann 已提交
1832 1833 1834
        if (ehci_reset_queue(q) > 0) {
            ehci_trace_guest_bug(ehci, "guest updated active QH");
        }
1835 1836 1837 1838
        p = NULL;
    }
    q->qh = qh;

1839 1840 1841 1842 1843
    q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
    if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
        q->transact_ctr = 4;
    }

1844 1845 1846 1847
    if (q->dev == NULL) {
        q->dev = ehci_find_device(q->ehci, devaddr);
    }

G
Gerd Hoffmann 已提交
1848
    if (p && p->async == EHCI_ASYNC_FINISHED) {
G
Gerd Hoffmann 已提交
1849
        /* I/O finished -- continue processing queue */
G
Gerd Hoffmann 已提交
1850
        trace_usb_ehci_packet_action(p->queue, p, "complete");
G
Gerd Hoffmann 已提交
1851 1852 1853
        ehci_set_state(ehci, async, EST_EXECUTING);
        goto out;
    }
G
Gerd Hoffmann 已提交
1854 1855

    if (async && (q->qh.epchar & QH_EPCHAR_H)) {
G
Gerd Hoffmann 已提交
1856 1857 1858

        /*  EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
        if (ehci->usbsts & USBSTS_REC) {
G
Gerd Hoffmann 已提交
1859
            ehci_clear_usbsts(ehci, USBSTS_REC);
G
Gerd Hoffmann 已提交
1860 1861
        } else {
            DPRINTF("FETCHQH:  QH 0x%08x. H-bit set, reclamation status reset"
G
Gerd Hoffmann 已提交
1862
                       " - done processing\n", q->qhaddr);
1863
            ehci_set_state(ehci, async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
1864
            q = NULL;
G
Gerd Hoffmann 已提交
1865 1866 1867 1868 1869
            goto out;
        }
    }

#if EHCI_DEBUG
G
Gerd Hoffmann 已提交
1870
    if (q->qhaddr != q->qh.next) {
G
Gerd Hoffmann 已提交
1871
    DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
G
Gerd Hoffmann 已提交
1872 1873 1874 1875 1876
               q->qhaddr,
               q->qh.epchar & QH_EPCHAR_H,
               q->qh.token & QTD_TOKEN_HALT,
               q->qh.token & QTD_TOKEN_ACTIVE,
               q->qh.next);
G
Gerd Hoffmann 已提交
1877 1878 1879
    }
#endif

G
Gerd Hoffmann 已提交
1880
    if (q->qh.token & QTD_TOKEN_HALT) {
1881
        ehci_set_state(ehci, async, EST_HORIZONTALQH);
G
Gerd Hoffmann 已提交
1882

1883 1884
    } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
               (NLPTR_TBIT(q->qh.current_qtd) == 0)) {
G
Gerd Hoffmann 已提交
1885
        q->qtdaddr = q->qh.current_qtd;
1886
        ehci_set_state(ehci, async, EST_FETCHQTD);
G
Gerd Hoffmann 已提交
1887 1888 1889

    } else {
        /*  EHCI spec version 1.0 Section 4.10.2 */
1890
        ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
G
Gerd Hoffmann 已提交
1891 1892 1893
    }

out:
G
Gerd Hoffmann 已提交
1894
    return q;
G
Gerd Hoffmann 已提交
1895 1896
}

1897
static int ehci_state_fetchitd(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
1898
{
G
Gerd Hoffmann 已提交
1899
    uint32_t entry;
G
Gerd Hoffmann 已提交
1900 1901
    EHCIitd itd;

G
Gerd Hoffmann 已提交
1902 1903 1904
    assert(!async);
    entry = ehci_get_fetch_addr(ehci, async);

1905
    get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
G
Gerd Hoffmann 已提交
1906
               sizeof(EHCIitd) >> 2);
G
Gerd Hoffmann 已提交
1907
    ehci_trace_itd(ehci, entry, &itd);
G
Gerd Hoffmann 已提交
1908

G
Gerd Hoffmann 已提交
1909
    if (ehci_process_itd(ehci, &itd, entry) != 0) {
G
Gerd Hoffmann 已提交
1910 1911 1912
        return -1;
    }

1913 1914
    put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
               sizeof(EHCIitd) >> 2);
G
Gerd Hoffmann 已提交
1915
    ehci_set_fetch_addr(ehci, async, itd.next);
1916
    ehci_set_state(ehci, async, EST_FETCHENTRY);
G
Gerd Hoffmann 已提交
1917 1918 1919 1920

    return 1;
}

G
Gerd Hoffmann 已提交
1921 1922 1923 1924 1925 1926 1927 1928
static int ehci_state_fetchsitd(EHCIState *ehci, int async)
{
    uint32_t entry;
    EHCIsitd sitd;

    assert(!async);
    entry = ehci_get_fetch_addr(ehci, async);

1929
    get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
G
Gerd Hoffmann 已提交
1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944
               sizeof(EHCIsitd) >> 2);
    ehci_trace_sitd(ehci, entry, &sitd);

    if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
        /* siTD is not active, nothing to do */;
    } else {
        /* TODO: split transfers are not implemented */
        fprintf(stderr, "WARNING: Skipping active siTD\n");
    }

    ehci_set_fetch_addr(ehci, async, sitd.next);
    ehci_set_state(ehci, async, EST_FETCHENTRY);
    return 1;
}

G
Gerd Hoffmann 已提交
1945
/* Section 4.10.2 - paragraph 3 */
1946
static int ehci_state_advqueue(EHCIQueue *q)
G
Gerd Hoffmann 已提交
1947 1948 1949 1950 1951 1952 1953
{
#if 0
    /* TO-DO: 4.10.2 - paragraph 2
     * if I-bit is set to 1 and QH is not active
     * go to horizontal QH
     */
    if (I-bit set) {
1954
        ehci_set_state(ehci, async, EST_HORIZONTALQH);
G
Gerd Hoffmann 已提交
1955 1956 1957 1958 1959 1960 1961
        goto out;
    }
#endif

    /*
     * want data and alt-next qTD is valid
     */
G
Gerd Hoffmann 已提交
1962 1963 1964
    if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
        (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
        q->qtdaddr = q->qh.altnext_qtd;
1965
        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
G
Gerd Hoffmann 已提交
1966 1967 1968 1969

    /*
     *  next qTD is valid
     */
1970
    } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
G
Gerd Hoffmann 已提交
1971
        q->qtdaddr = q->qh.next_qtd;
1972
        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
G
Gerd Hoffmann 已提交
1973 1974 1975 1976 1977

    /*
     *  no valid qTD, try next QH
     */
    } else {
1978
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
G
Gerd Hoffmann 已提交
1979 1980 1981 1982 1983 1984
    }

    return 1;
}

/* Section 4.10.2 - paragraph 4 */
1985
static int ehci_state_fetchqtd(EHCIQueue *q)
G
Gerd Hoffmann 已提交
1986
{
G
Gerd Hoffmann 已提交
1987 1988
    EHCIqtd qtd;
    EHCIPacket *p;
G
Gerd Hoffmann 已提交
1989 1990
    int again = 0;

G
Gerd Hoffmann 已提交
1991
    get_dwords(q->ehci, NLPTR_GET(q->qtdaddr), (uint32_t *) &qtd,
1992
               sizeof(EHCIqtd) >> 2);
G
Gerd Hoffmann 已提交
1993
    ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
G
Gerd Hoffmann 已提交
1994

G
Gerd Hoffmann 已提交
1995 1996
    p = QTAILQ_FIRST(&q->packets);
    if (p != NULL) {
1997 1998 1999 2000 2001
        if (p->qtdaddr != q->qtdaddr ||
            (!NLPTR_TBIT(p->qtd.next) && (p->qtd.next != qtd.next)) ||
            (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd.altnext)) ||
            p->qtd.bufptr[0] != qtd.bufptr[0]) {
            ehci_cancel_queue(q);
G
Gerd Hoffmann 已提交
2002
            ehci_trace_guest_bug(q->ehci, "guest updated active QH or qTD");
2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
            p = NULL;
        } else {
            p->qtd = qtd;
            ehci_qh_do_overlay(q);
        }
    }

    if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
        if (p != NULL) {
            /* transfer canceled by guest (clear active) */
            ehci_cancel_queue(q);
            p = NULL;
        }
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
        again = 1;
    } else if (p != NULL) {
2019 2020
        switch (p->async) {
        case EHCI_ASYNC_NONE:
2021
        case EHCI_ASYNC_INITIALIZED:
2022
            /* Not yet executed (MULT), or previously nacked (int) packet */
2023 2024
            ehci_set_state(q->ehci, q->async, EST_EXECUTE);
            break;
2025
        case EHCI_ASYNC_INFLIGHT:
2026
            /* Unfinished async handled packet, go horizontal */
2027
            ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2028 2029
            break;
        case EHCI_ASYNC_FINISHED:
2030 2031 2032 2033
            /*
             * We get here when advqueue moves to a packet which is already
             * finished, which can happen with packets queued up by fill_queue
             */
2034
            ehci_set_state(q->ehci, q->async, EST_EXECUTING);
2035
            break;
G
Gerd Hoffmann 已提交
2036 2037
        }
        again = 1;
2038
    } else {
G
Gerd Hoffmann 已提交
2039 2040 2041
        p = ehci_alloc_packet(q);
        p->qtdaddr = q->qtdaddr;
        p->qtd = qtd;
2042
        ehci_set_state(q->ehci, q->async, EST_EXECUTE);
G
Gerd Hoffmann 已提交
2043 2044 2045 2046 2047 2048
        again = 1;
    }

    return again;
}

2049
static int ehci_state_horizqh(EHCIQueue *q)
G
Gerd Hoffmann 已提交
2050 2051 2052
{
    int again = 0;

2053 2054 2055
    if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
        ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
        ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
G
Gerd Hoffmann 已提交
2056 2057
        again = 1;
    } else {
2058
        ehci_set_state(q->ehci, q->async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
2059 2060 2061 2062 2063
    }

    return again;
}

2064
static int ehci_fill_queue(EHCIPacket *p)
G
Gerd Hoffmann 已提交
2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087
{
    EHCIQueue *q = p->queue;
    EHCIqtd qtd = p->qtd;
    uint32_t qtdaddr;

    for (;;) {
        if (NLPTR_TBIT(qtd.altnext) == 0) {
            break;
        }
        if (NLPTR_TBIT(qtd.next) != 0) {
            break;
        }
        qtdaddr = qtd.next;
        get_dwords(q->ehci, NLPTR_GET(qtdaddr),
                   (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
        ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
        if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
            break;
        }
        p = ehci_alloc_packet(q);
        p->qtdaddr = qtdaddr;
        p->qtd = qtd;
        p->usb_status = ehci_execute(p, "queue");
2088 2089 2090
        if (p->usb_status == USB_RET_PROCERR) {
            break;
        }
2091
        assert(p->usb_status == USB_RET_ASYNC);
G
Gerd Hoffmann 已提交
2092 2093
        p->async = EHCI_ASYNC_INFLIGHT;
    }
2094
    return p->usb_status;
G
Gerd Hoffmann 已提交
2095 2096
}

2097
static int ehci_state_execute(EHCIQueue *q)
G
Gerd Hoffmann 已提交
2098
{
G
Gerd Hoffmann 已提交
2099
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
G
Gerd Hoffmann 已提交
2100 2101
    int again = 0;

G
Gerd Hoffmann 已提交
2102 2103 2104
    assert(p != NULL);
    assert(p->qtdaddr == q->qtdaddr);

G
Gerd Hoffmann 已提交
2105
    if (ehci_qh_do_overlay(q) != 0) {
G
Gerd Hoffmann 已提交
2106 2107 2108 2109 2110 2111
        return -1;
    }

    // TODO verify enough time remains in the uframe as in 4.4.1.1
    // TODO write back ptr to async list when done or out of time

2112 2113 2114 2115 2116
    /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
    if (!q->async && q->transact_ctr == 0) {
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
        again = 1;
        goto out;
G
Gerd Hoffmann 已提交
2117 2118
    }

2119
    if (q->async) {
G
Gerd Hoffmann 已提交
2120
        ehci_set_usbsts(q->ehci, USBSTS_REC);
G
Gerd Hoffmann 已提交
2121 2122
    }

G
Gerd Hoffmann 已提交
2123
    p->usb_status = ehci_execute(p, "process");
G
Gerd Hoffmann 已提交
2124
    if (p->usb_status == USB_RET_PROCERR) {
G
Gerd Hoffmann 已提交
2125 2126 2127
        again = -1;
        goto out;
    }
G
Gerd Hoffmann 已提交
2128
    if (p->usb_status == USB_RET_ASYNC) {
G
Gerd Hoffmann 已提交
2129
        ehci_flush_qh(q);
G
Gerd Hoffmann 已提交
2130
        trace_usb_ehci_packet_action(p->queue, p, "async");
G
Gerd Hoffmann 已提交
2131
        p->async = EHCI_ASYNC_INFLIGHT;
2132
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2133 2134 2135 2136 2137
        if (q->async) {
            again = (ehci_fill_queue(p) == USB_RET_PROCERR) ? -1 : 1;
        } else {
            again = 1;
        }
G
Gerd Hoffmann 已提交
2138
        goto out;
G
Gerd Hoffmann 已提交
2139 2140
    }

2141
    ehci_set_state(q->ehci, q->async, EST_EXECUTING);
G
Gerd Hoffmann 已提交
2142 2143
    again = 1;

G
Gerd Hoffmann 已提交
2144 2145 2146 2147
out:
    return again;
}

2148
static int ehci_state_executing(EHCIQueue *q)
G
Gerd Hoffmann 已提交
2149
{
G
Gerd Hoffmann 已提交
2150
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
G
Gerd Hoffmann 已提交
2151

G
Gerd Hoffmann 已提交
2152 2153 2154
    assert(p != NULL);
    assert(p->qtdaddr == q->qtdaddr);

G
Gerd Hoffmann 已提交
2155
    ehci_execute_complete(q);
G
Gerd Hoffmann 已提交
2156

2157 2158 2159
    /* 4.10.3 */
    if (!q->async && q->transact_ctr > 0) {
        q->transact_ctr--;
G
Gerd Hoffmann 已提交
2160 2161 2162
    }

    /* 4.10.5 */
G
Gerd Hoffmann 已提交
2163
    if (p->usb_status == USB_RET_NAK) {
2164
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
G
Gerd Hoffmann 已提交
2165
    } else {
2166
        ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
G
Gerd Hoffmann 已提交
2167 2168
    }

G
Gerd Hoffmann 已提交
2169
    ehci_flush_qh(q);
2170
    return 1;
G
Gerd Hoffmann 已提交
2171 2172 2173
}


2174
static int ehci_state_writeback(EHCIQueue *q)
G
Gerd Hoffmann 已提交
2175
{
G
Gerd Hoffmann 已提交
2176
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
G
Gerd Hoffmann 已提交
2177
    uint32_t *qtd, addr;
G
Gerd Hoffmann 已提交
2178 2179 2180
    int again = 0;

    /*  Write back the QTD from the QH area */
G
Gerd Hoffmann 已提交
2181 2182 2183 2184
    assert(p != NULL);
    assert(p->qtdaddr == q->qtdaddr);

    ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
G
Gerd Hoffmann 已提交
2185 2186 2187
    qtd = (uint32_t *) &q->qh.next_qtd;
    addr = NLPTR_GET(p->qtdaddr);
    put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 2);
G
Gerd Hoffmann 已提交
2188
    ehci_free_packet(p);
G
Gerd Hoffmann 已提交
2189

G
Gerd Hoffmann 已提交
2190 2191 2192 2193 2194 2195 2196
    /*
     * EHCI specs say go horizontal here.
     *
     * We can also advance the queue here for performance reasons.  We
     * need to take care to only take that shortcut in case we've
     * processed the qtd just written back without errors, i.e. halt
     * bit is clear.
G
Gerd Hoffmann 已提交
2197
     */
G
Gerd Hoffmann 已提交
2198
    if (q->qh.token & QTD_TOKEN_HALT) {
2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211
        /*
         * We should not do any further processing on a halted queue!
         * This is esp. important for bulk endpoints with pipelining enabled
         * (redirection to a real USB device), where we must cancel all the
         * transfers after this one so that:
         * 1) If they've completed already, they are not processed further
         *    causing more stalls, originating from the same failed transfer
         * 2) If still in flight, they are cancelled before the guest does
         *    a clear stall, otherwise the guest and device can loose sync!
         */
        while ((p = QTAILQ_FIRST(&q->packets)) != NULL) {
            ehci_free_packet(p);
        }
2212
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
G
Gerd Hoffmann 已提交
2213 2214
        again = 1;
    } else {
2215
        ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
G
Gerd Hoffmann 已提交
2216
        again = 1;
G
Gerd Hoffmann 已提交
2217
    }
G
Gerd Hoffmann 已提交
2218 2219 2220 2221 2222 2223 2224
    return again;
}

/*
 * This is the state machine that is common to both async and periodic
 */

2225
static void ehci_advance_state(EHCIState *ehci, int async)
G
Gerd Hoffmann 已提交
2226
{
G
Gerd Hoffmann 已提交
2227
    EHCIQueue *q = NULL;
G
Gerd Hoffmann 已提交
2228 2229 2230
    int again;

    do {
2231
        switch(ehci_get_state(ehci, async)) {
G
Gerd Hoffmann 已提交
2232
        case EST_WAITLISTHEAD:
2233
            again = ehci_state_waitlisthead(ehci, async);
G
Gerd Hoffmann 已提交
2234 2235 2236
            break;

        case EST_FETCHENTRY:
2237
            again = ehci_state_fetchentry(ehci, async);
G
Gerd Hoffmann 已提交
2238 2239 2240
            break;

        case EST_FETCHQH:
G
Gerd Hoffmann 已提交
2241
            q = ehci_state_fetchqh(ehci, async);
2242 2243 2244 2245 2246 2247
            if (q != NULL) {
                assert(q->async == async);
                again = 1;
            } else {
                again = 0;
            }
G
Gerd Hoffmann 已提交
2248 2249 2250
            break;

        case EST_FETCHITD:
2251
            again = ehci_state_fetchitd(ehci, async);
G
Gerd Hoffmann 已提交
2252 2253
            break;

G
Gerd Hoffmann 已提交
2254 2255 2256 2257
        case EST_FETCHSITD:
            again = ehci_state_fetchsitd(ehci, async);
            break;

G
Gerd Hoffmann 已提交
2258
        case EST_ADVANCEQUEUE:
2259
            again = ehci_state_advqueue(q);
G
Gerd Hoffmann 已提交
2260 2261 2262
            break;

        case EST_FETCHQTD:
2263
            again = ehci_state_fetchqtd(q);
G
Gerd Hoffmann 已提交
2264 2265 2266
            break;

        case EST_HORIZONTALQH:
2267
            again = ehci_state_horizqh(q);
G
Gerd Hoffmann 已提交
2268 2269 2270
            break;

        case EST_EXECUTE:
2271
            again = ehci_state_execute(q);
G
Gerd Hoffmann 已提交
2272 2273 2274
            if (async) {
                ehci->async_stepdown = 0;
            }
G
Gerd Hoffmann 已提交
2275 2276 2277
            break;

        case EST_EXECUTING:
G
Gerd Hoffmann 已提交
2278
            assert(q != NULL);
G
Gerd Hoffmann 已提交
2279 2280 2281
            if (async) {
                ehci->async_stepdown = 0;
            }
2282
            again = ehci_state_executing(q);
G
Gerd Hoffmann 已提交
2283 2284 2285
            break;

        case EST_WRITEBACK:
G
Gerd Hoffmann 已提交
2286
            assert(q != NULL);
2287
            again = ehci_state_writeback(q);
G
Gerd Hoffmann 已提交
2288 2289 2290 2291 2292
            break;

        default:
            fprintf(stderr, "Bad state!\n");
            again = -1;
G
Gerd Hoffmann 已提交
2293
            assert(0);
G
Gerd Hoffmann 已提交
2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307
            break;
        }

        if (again < 0) {
            fprintf(stderr, "processing error - resetting ehci HC\n");
            ehci_reset(ehci);
            again = 0;
        }
    }
    while (again);
}

static void ehci_advance_async_state(EHCIState *ehci)
{
2308
    const int async = 1;
G
Gerd Hoffmann 已提交
2309

2310
    switch(ehci_get_state(ehci, async)) {
G
Gerd Hoffmann 已提交
2311
    case EST_INACTIVE:
2312
        if (!ehci_async_enabled(ehci)) {
G
Gerd Hoffmann 已提交
2313 2314
            break;
        }
2315
        ehci_set_state(ehci, async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
2316 2317 2318
        // No break, fall through to ACTIVE

    case EST_ACTIVE:
2319
        if (!ehci_async_enabled(ehci)) {
2320
            ehci_queues_rip_all(ehci, async);
2321
            ehci_set_state(ehci, async, EST_INACTIVE);
G
Gerd Hoffmann 已提交
2322 2323 2324
            break;
        }

2325
        /* make sure guest has acknowledged the doorbell interrupt */
G
Gerd Hoffmann 已提交
2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336
        /* TO-DO: is this really needed? */
        if (ehci->usbsts & USBSTS_IAA) {
            DPRINTF("IAA status bit still set.\n");
            break;
        }

        /* check that address register has been set */
        if (ehci->asynclistaddr == 0) {
            break;
        }

2337 2338
        ehci_set_state(ehci, async, EST_WAITLISTHEAD);
        ehci_advance_state(ehci, async);
2339 2340 2341 2342 2343 2344 2345

        /* If the doorbell is set, the guest wants to make a change to the
         * schedule. The host controller needs to release cached data.
         * (section 4.8.2)
         */
        if (ehci->usbcmd & USBCMD_IAAD) {
            /* Remove all unseen qhs from the async qhs queue */
2346
            ehci_queues_rip_unseen(ehci, async);
G
Gerd Hoffmann 已提交
2347
            trace_usb_ehci_doorbell_ack();
2348
            ehci->usbcmd &= ~USBCMD_IAAD;
2349
            ehci_raise_irq(ehci, USBSTS_IAA);
2350
        }
G
Gerd Hoffmann 已提交
2351 2352 2353 2354 2355 2356
        break;

    default:
        /* this should only be due to a developer mistake */
        fprintf(stderr, "ehci: Bad asynchronous state %d. "
                "Resetting to active\n", ehci->astate);
G
Gerd Hoffmann 已提交
2357
        assert(0);
G
Gerd Hoffmann 已提交
2358 2359 2360 2361 2362 2363 2364
    }
}

static void ehci_advance_periodic_state(EHCIState *ehci)
{
    uint32_t entry;
    uint32_t list;
2365
    const int async = 0;
G
Gerd Hoffmann 已提交
2366 2367 2368

    // 4.6

2369
    switch(ehci_get_state(ehci, async)) {
G
Gerd Hoffmann 已提交
2370
    case EST_INACTIVE:
2371
        if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2372
            ehci_set_state(ehci, async, EST_ACTIVE);
G
Gerd Hoffmann 已提交
2373 2374 2375 2376 2377
            // No break, fall through to ACTIVE
        } else
            break;

    case EST_ACTIVE:
2378
        if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2379
            ehci_queues_rip_all(ehci, async);
2380
            ehci_set_state(ehci, async, EST_INACTIVE);
G
Gerd Hoffmann 已提交
2381 2382 2383 2384 2385 2386 2387 2388 2389 2390
            break;
        }

        list = ehci->periodiclistbase & 0xfffff000;
        /* check that register has been set */
        if (list == 0) {
            break;
        }
        list |= ((ehci->frindex & 0x1ff8) >> 1);

2391
        pci_dma_read(&ehci->dev, list, &entry, sizeof entry);
G
Gerd Hoffmann 已提交
2392 2393 2394 2395
        entry = le32_to_cpu(entry);

        DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
                ehci->frindex / 8, list, entry);
G
Gerd Hoffmann 已提交
2396
        ehci_set_fetch_addr(ehci, async,entry);
2397 2398
        ehci_set_state(ehci, async, EST_FETCHENTRY);
        ehci_advance_state(ehci, async);
2399
        ehci_queues_rip_unused(ehci, async);
G
Gerd Hoffmann 已提交
2400 2401 2402 2403 2404 2405
        break;

    default:
        /* this should only be due to a developer mistake */
        fprintf(stderr, "ehci: Bad periodic state %d. "
                "Resetting to active\n", ehci->pstate);
G
Gerd Hoffmann 已提交
2406
        assert(0);
G
Gerd Hoffmann 已提交
2407 2408 2409
    }
}

G
Gerd Hoffmann 已提交
2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421
static void ehci_update_frindex(EHCIState *ehci, int frames)
{
    int i;

    if (!ehci_enabled(ehci)) {
        return;
    }

    for (i = 0; i < frames; i++) {
        ehci->frindex += 8;

        if (ehci->frindex == 0x00002000) {
2422
            ehci_raise_irq(ehci, USBSTS_FLR);
G
Gerd Hoffmann 已提交
2423 2424 2425
        }

        if (ehci->frindex == 0x00004000) {
2426
            ehci_raise_irq(ehci, USBSTS_FLR);
G
Gerd Hoffmann 已提交
2427
            ehci->frindex = 0;
2428
            if (ehci->usbsts_frindex >= 0x00004000) {
2429 2430 2431 2432
                ehci->usbsts_frindex -= 0x00004000;
            } else {
                ehci->usbsts_frindex = 0;
            }
G
Gerd Hoffmann 已提交
2433 2434 2435 2436
        }
    }
}

G
Gerd Hoffmann 已提交
2437 2438 2439
static void ehci_frame_timer(void *opaque)
{
    EHCIState *ehci = opaque;
2440
    int need_timer = 0;
G
Gerd Hoffmann 已提交
2441
    int64_t expire_time, t_now;
G
Gerd Hoffmann 已提交
2442
    uint64_t ns_elapsed;
G
Gerd Hoffmann 已提交
2443
    int frames, skipped_frames;
G
Gerd Hoffmann 已提交
2444 2445 2446
    int i;

    t_now = qemu_get_clock_ns(vm_clock);
G
Gerd Hoffmann 已提交
2447 2448
    ns_elapsed = t_now - ehci->last_run_ns;
    frames = ns_elapsed / FRAME_TIMER_NS;
G
Gerd Hoffmann 已提交
2449

G
Gerd Hoffmann 已提交
2450
    if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2451
        need_timer++;
2452
        ehci->async_stepdown = 0;
G
Gerd Hoffmann 已提交
2453

G
Gerd Hoffmann 已提交
2454 2455 2456 2457 2458 2459 2460 2461
        if (frames > ehci->maxframes) {
            skipped_frames = frames - ehci->maxframes;
            ehci_update_frindex(ehci, skipped_frames);
            ehci->last_run_ns += FRAME_TIMER_NS * skipped_frames;
            frames -= skipped_frames;
            DPRINTF("WARNING - EHCI skipped %d frames\n", skipped_frames);
        }

G
Gerd Hoffmann 已提交
2462
        for (i = 0; i < frames; i++) {
2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475
            /*
             * If we're running behind schedule, we should not catch up
             * too fast, as that will make some guests unhappy:
             * 1) We must process a minimum of MIN_FR_PER_TICK frames,
             *    otherwise we will never catch up
             * 2) Process frames until the guest has requested an irq (IOC)
             */
            if (i >= MIN_FR_PER_TICK) {
                ehci_commit_irq(ehci);
                if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
                    break;
                }
            }
G
Gerd Hoffmann 已提交
2476
            ehci_update_frindex(ehci, 1);
G
Gerd Hoffmann 已提交
2477
            ehci_advance_periodic_state(ehci);
G
Gerd Hoffmann 已提交
2478 2479 2480 2481 2482 2483 2484 2485
            ehci->last_run_ns += FRAME_TIMER_NS;
        }
    } else {
        if (ehci->async_stepdown < ehci->maxframes / 2) {
            ehci->async_stepdown++;
        }
        ehci_update_frindex(ehci, frames);
        ehci->last_run_ns += FRAME_TIMER_NS * frames;
G
Gerd Hoffmann 已提交
2486 2487 2488 2489 2490
    }

    /*  Async is not inside loop since it executes everything it can once
     *  called
     */
G
Gerd Hoffmann 已提交
2491
    if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2492
        need_timer++;
2493
        ehci_advance_async_state(ehci);
G
Gerd Hoffmann 已提交
2494
    }
G
Gerd Hoffmann 已提交
2495

2496 2497 2498 2499
    ehci_commit_irq(ehci);
    if (ehci->usbsts_pending) {
        need_timer++;
        ehci->async_stepdown = 0;
G
Gerd Hoffmann 已提交
2500
    }
2501

2502
    if (need_timer) {
2503 2504
        expire_time = t_now + (get_ticks_per_sec()
                               * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2505 2506
        qemu_mod_timer(ehci->frame_timer, expire_time);
    }
G
Gerd Hoffmann 已提交
2507 2508
}

2509 2510 2511 2512 2513
static void ehci_async_bh(void *opaque)
{
    EHCIState *ehci = opaque;
    ehci_advance_async_state(ehci);
}
G
Gerd Hoffmann 已提交
2514

2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536
static const MemoryRegionOps ehci_mmio_caps_ops = {
    .read = ehci_caps_read,
    .valid.min_access_size = 1,
    .valid.max_access_size = 4,
    .impl.min_access_size = 1,
    .impl.max_access_size = 1,
    .endianness = DEVICE_LITTLE_ENDIAN,
};

static const MemoryRegionOps ehci_mmio_opreg_ops = {
    .read = ehci_opreg_read,
    .write = ehci_opreg_write,
    .valid.min_access_size = 4,
    .valid.max_access_size = 4,
    .endianness = DEVICE_LITTLE_ENDIAN,
};

static const MemoryRegionOps ehci_mmio_port_ops = {
    .read = ehci_port_read,
    .write = ehci_port_write,
    .valid.min_access_size = 4,
    .valid.max_access_size = 4,
A
Avi Kivity 已提交
2537
    .endianness = DEVICE_LITTLE_ENDIAN,
G
Gerd Hoffmann 已提交
2538 2539 2540 2541 2542 2543 2544
};

static int usb_ehci_initfn(PCIDevice *dev);

static USBPortOps ehci_port_ops = {
    .attach = ehci_attach,
    .detach = ehci_detach,
2545
    .child_detach = ehci_child_detach,
2546
    .wakeup = ehci_wakeup,
G
Gerd Hoffmann 已提交
2547 2548 2549
    .complete = ehci_async_complete_packet,
};

2550
static USBBusOps ehci_bus_ops = {
2551
    .register_companion = ehci_register_companion,
2552 2553
};

G
Gerd Hoffmann 已提交
2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573
static int usb_ehci_post_load(void *opaque, int version_id)
{
    EHCIState *s = opaque;
    int i;

    for (i = 0; i < NB_PORTS; i++) {
        USBPort *companion = s->companion_ports[i];
        if (companion == NULL) {
            continue;
        }
        if (s->portsc[i] & PORTSC_POWNER) {
            companion->dev = s->ports[i].dev;
        } else {
            companion->dev = NULL;
        }
    }

    return 0;
}

2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599
static void usb_ehci_vm_state_change(void *opaque, int running, RunState state)
{
    EHCIState *ehci = opaque;

    /*
     * We don't migrate the EHCIQueue-s, instead we rebuild them for the
     * schedule in guest memory. We must do the rebuilt ASAP, so that
     * USB-devices which have async handled packages have a packet in the
     * ep queue to match the completion with.
     */
    if (state == RUN_STATE_RUNNING) {
        ehci_advance_async_state(ehci);
    }

    /*
     * The schedule rebuilt from guest memory could cause the migration dest
     * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
     * will never have existed on the destination. Therefor we must flush the
     * async schedule on savevm to catch any not yet noticed unlinks.
     */
    if (state == RUN_STATE_SAVE_VM) {
        ehci_advance_async_state(ehci);
        ehci_queues_rip_unseen(ehci, 1);
    }
}

G
Gerd Hoffmann 已提交
2600
static const VMStateDescription vmstate_ehci = {
G
Gerd Hoffmann 已提交
2601
    .name        = "ehci",
2602 2603
    .version_id  = 2,
    .minimum_version_id  = 1,
G
Gerd Hoffmann 已提交
2604 2605 2606 2607 2608 2609
    .post_load   = usb_ehci_post_load,
    .fields      = (VMStateField[]) {
        VMSTATE_PCI_DEVICE(dev, EHCIState),
        /* mmio registers */
        VMSTATE_UINT32(usbcmd, EHCIState),
        VMSTATE_UINT32(usbsts, EHCIState),
2610 2611
        VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
        VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
G
Gerd Hoffmann 已提交
2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634
        VMSTATE_UINT32(usbintr, EHCIState),
        VMSTATE_UINT32(frindex, EHCIState),
        VMSTATE_UINT32(ctrldssegment, EHCIState),
        VMSTATE_UINT32(periodiclistbase, EHCIState),
        VMSTATE_UINT32(asynclistaddr, EHCIState),
        VMSTATE_UINT32(configflag, EHCIState),
        VMSTATE_UINT32(portsc[0], EHCIState),
        VMSTATE_UINT32(portsc[1], EHCIState),
        VMSTATE_UINT32(portsc[2], EHCIState),
        VMSTATE_UINT32(portsc[3], EHCIState),
        VMSTATE_UINT32(portsc[4], EHCIState),
        VMSTATE_UINT32(portsc[5], EHCIState),
        /* frame timer */
        VMSTATE_TIMER(frame_timer, EHCIState),
        VMSTATE_UINT64(last_run_ns, EHCIState),
        VMSTATE_UINT32(async_stepdown, EHCIState),
        /* schedule state */
        VMSTATE_UINT32(astate, EHCIState),
        VMSTATE_UINT32(pstate, EHCIState),
        VMSTATE_UINT32(a_fetch_addr, EHCIState),
        VMSTATE_UINT32(p_fetch_addr, EHCIState),
        VMSTATE_END_OF_LIST()
    }
G
Gerd Hoffmann 已提交
2635 2636
};

G
Gerd Hoffmann 已提交
2637 2638 2639 2640 2641
static Property ehci_properties[] = {
    DEFINE_PROP_UINT32("maxframes", EHCIState, maxframes, 128),
    DEFINE_PROP_END_OF_LIST(),
};

2642 2643
static void ehci_class_init(ObjectClass *klass, void *data)
{
2644
    DeviceClass *dc = DEVICE_CLASS(klass);
2645 2646 2647 2648 2649 2650 2651
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);

    k->init = usb_ehci_initfn;
    k->vendor_id = PCI_VENDOR_ID_INTEL;
    k->device_id = PCI_DEVICE_ID_INTEL_82801D; /* ich4 */
    k->revision = 0x10;
    k->class_id = PCI_CLASS_SERIAL_USB;
2652 2653
    dc->vmsd = &vmstate_ehci;
    dc->props = ehci_properties;
2654 2655
}

2656 2657 2658 2659 2660
static TypeInfo ehci_info = {
    .name          = "usb-ehci",
    .parent        = TYPE_PCI_DEVICE,
    .instance_size = sizeof(EHCIState),
    .class_init    = ehci_class_init,
2661 2662
};

2663 2664
static void ich9_ehci_class_init(ObjectClass *klass, void *data)
{
2665
    DeviceClass *dc = DEVICE_CLASS(klass);
2666 2667 2668 2669 2670 2671 2672
    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);

    k->init = usb_ehci_initfn;
    k->vendor_id = PCI_VENDOR_ID_INTEL;
    k->device_id = PCI_DEVICE_ID_INTEL_82801I_EHCI1;
    k->revision = 0x03;
    k->class_id = PCI_CLASS_SERIAL_USB;
2673 2674
    dc->vmsd = &vmstate_ehci;
    dc->props = ehci_properties;
2675 2676
}

2677 2678 2679 2680 2681
static TypeInfo ich9_ehci_info = {
    .name          = "ich9-usb-ehci1",
    .parent        = TYPE_PCI_DEVICE,
    .instance_size = sizeof(EHCIState),
    .class_init    = ich9_ehci_class_init,
G
Gerd Hoffmann 已提交
2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695
};

static int usb_ehci_initfn(PCIDevice *dev)
{
    EHCIState *s = DO_UPCAST(EHCIState, dev, dev);
    uint8_t *pci_conf = s->dev.config;
    int i;

    pci_set_byte(&pci_conf[PCI_CLASS_PROG], 0x20);

    /* capabilities pointer */
    pci_set_byte(&pci_conf[PCI_CAPABILITY_LIST], 0x00);
    //pci_set_byte(&pci_conf[PCI_CAPABILITY_LIST], 0x50);

2696
    pci_set_byte(&pci_conf[PCI_INTERRUPT_PIN], 4); /* interrupt pin D */
G
Gerd Hoffmann 已提交
2697 2698 2699 2700 2701
    pci_set_byte(&pci_conf[PCI_MIN_GNT], 0);
    pci_set_byte(&pci_conf[PCI_MAX_LAT], 0);

    // pci_conf[0x50] = 0x01; // power management caps

2702
    pci_set_byte(&pci_conf[USB_SBRN], USB_RELEASE_2); // release number (2.1.4)
G
Gerd Hoffmann 已提交
2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718
    pci_set_byte(&pci_conf[0x61], 0x20);  // frame length adjustment (2.1.5)
    pci_set_word(&pci_conf[0x62], 0x00);  // port wake up capability (2.1.6)

    pci_conf[0x64] = 0x00;
    pci_conf[0x65] = 0x00;
    pci_conf[0x66] = 0x00;
    pci_conf[0x67] = 0x00;
    pci_conf[0x68] = 0x01;
    pci_conf[0x69] = 0x00;
    pci_conf[0x6a] = 0x00;
    pci_conf[0x6b] = 0x00;  // USBLEGSUP
    pci_conf[0x6c] = 0x00;
    pci_conf[0x6d] = 0x00;
    pci_conf[0x6e] = 0x00;
    pci_conf[0x6f] = 0xc0;  // USBLEFCTLSTS

2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731
    /* 2.2 host controller interface version */
    s->caps[0x00] = (uint8_t) OPREGBASE;
    s->caps[0x01] = 0x00;
    s->caps[0x02] = 0x00;
    s->caps[0x03] = 0x01;        /* HC version */
    s->caps[0x04] = NB_PORTS;    /* Number of downstream ports */
    s->caps[0x05] = 0x00;        /* No companion ports at present */
    s->caps[0x06] = 0x00;
    s->caps[0x07] = 0x00;
    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
    s->caps[0x09] = 0x68;        /* EECP */
    s->caps[0x0a] = 0x00;
    s->caps[0x0b] = 0x00;
G
Gerd Hoffmann 已提交
2732 2733 2734

    s->irq = s->dev.irq[3];

2735
    usb_bus_new(&s->bus, &ehci_bus_ops, &s->dev.qdev);
G
Gerd Hoffmann 已提交
2736 2737 2738 2739 2740 2741 2742
    for(i = 0; i < NB_PORTS; i++) {
        usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
                          USB_SPEED_MASK_HIGH);
        s->ports[i].dev = 0;
    }

    s->frame_timer = qemu_new_timer_ns(vm_clock, ehci_frame_timer, s);
2743
    s->async_bh = qemu_bh_new(ehci_async_bh, s);
2744 2745
    QTAILQ_INIT(&s->aqueues);
    QTAILQ_INIT(&s->pqueues);
2746
    usb_packet_init(&s->ipacket);
G
Gerd Hoffmann 已提交
2747 2748

    qemu_register_reset(ehci_reset, s);
2749
    qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
G
Gerd Hoffmann 已提交
2750

2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762
    memory_region_init(&s->mem, "ehci", MMIO_SIZE);
    memory_region_init_io(&s->mem_caps, &ehci_mmio_caps_ops, s,
                          "capabilities", OPREGBASE);
    memory_region_init_io(&s->mem_opreg, &ehci_mmio_opreg_ops, s,
                          "operational", PORTSC_BEGIN - OPREGBASE);
    memory_region_init_io(&s->mem_ports, &ehci_mmio_port_ops, s,
                          "ports", PORTSC_END - PORTSC_BEGIN);

    memory_region_add_subregion(&s->mem, 0,            &s->mem_caps);
    memory_region_add_subregion(&s->mem, OPREGBASE,    &s->mem_opreg);
    memory_region_add_subregion(&s->mem, PORTSC_BEGIN, &s->mem_ports);

2763
    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mem);
G
Gerd Hoffmann 已提交
2764 2765 2766 2767

    return 0;
}

A
Andreas Färber 已提交
2768
static void ehci_register_types(void)
G
Gerd Hoffmann 已提交
2769
{
2770 2771
    type_register_static(&ehci_info);
    type_register_static(&ich9_ehci_info);
G
Gerd Hoffmann 已提交
2772
}
A
Andreas Färber 已提交
2773 2774

type_init(ehci_register_types)
G
Gerd Hoffmann 已提交
2775 2776 2777 2778

/*
 * vim: expandtab ts=4
 */