qemu

1
/*
2
 * QEMU USB EHCI Emulation
3
 *
4
 * Copyright(c) 2008  Emutex Ltd. (address@hidden)
5
 * Copyright(c) 2011-2012 Red Hat, Inc.
6
 *
7
 * Red Hat Authors:
8
 * Gerd Hoffmann <kraxel@redhat.com>
9
 * Hans de Goede <hdegoede@redhat.com>
10
 *
11
 * EHCI project was started by Mark Burkley, with contributions by
12
 * Niels de Vos.  David S. Ahern continued working on it.  Kevin Wolf,
13
 * Jan Kiszka and Vincent Palatin contributed bugfixes.
14
 *
15
 * This library is free software; you can redistribute it and/or
16
 * modify it under the terms of the GNU Lesser General Public
17
 * License as published by the Free Software Foundation; either
18
 * version 2.1 of the License, or (at your option) any later version.
19
 *
20
 * This library is distributed in the hope that it will be useful,
21
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
23
 * Lesser General Public License for more details.
24
 *
25
 * You should have received a copy of the GNU Lesser General Public License
26
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27
 */
28

29
#include "qemu/osdep.h"
30
#include "qapi/error.h"
31
#include "hw/irq.h"
32
#include "hw/usb/ehci-regs.h"
33
#include "hw/usb/hcd-ehci.h"
34
#include "migration/vmstate.h"
35
#include "trace.h"
36
#include "qemu/error-report.h"
37
#include "qemu/main-loop.h"
38
#include "sysemu/runstate.h"
39

40
#define FRAME_TIMER_FREQ 1000
41
#define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
42
#define UFRAME_TIMER_NS  (FRAME_TIMER_NS / 8)
43

44
#define NB_MAXINTRATE    8        // Max rate at which controller issues ints
45
#define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
46
#define MAX_QH           100      // Max allowable queue heads in a chain
47
#define MIN_UFR_PER_TICK 24       /* Min frames to process when catching up */
48
#define PERIODIC_ACTIVE  512      /* Micro-frames */
49

50
/*  Internal periodic / asynchronous schedule state machine states
51
 */
52
typedef enum {
53
    EST_INACTIVE = 1000,
54
    EST_ACTIVE,
55
    EST_EXECUTING,
56
    EST_SLEEPING,
57
    /*  The following states are internal to the state machine function
58
    */
59
    EST_WAITLISTHEAD,
60
    EST_FETCHENTRY,
61
    EST_FETCHQH,
62
    EST_FETCHITD,
63
    EST_FETCHSITD,
64
    EST_ADVANCEQUEUE,
65
    EST_FETCHQTD,
66
    EST_EXECUTE,
67
    EST_WRITEBACK,
68
    EST_HORIZONTALQH
69
} EHCI_STATES;
70

71
/* macros for accessing fields within next link pointer entry */
72
#define NLPTR_GET(x)             ((x) & 0xffffffe0)
73
#define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
74
#define NLPTR_TBIT(x)            ((x) & 1)  // 1=invalid, 0=valid
75

76
/* link pointer types */
77
#define NLPTR_TYPE_ITD           0     // isoc xfer descriptor
78
#define NLPTR_TYPE_QH            1     // queue head
79
#define NLPTR_TYPE_STITD         2     // split xaction, isoc xfer descriptor
80
#define NLPTR_TYPE_FSTN          3     // frame span traversal node
81

82
#define SET_LAST_RUN_CLOCK(s) \
83
    (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
84

85
/* nifty macros from Arnon's EHCI version  */
86
#define get_field(data, field) \
87
    (((data) & field##_MASK) >> field##_SH)
88

89
#define set_field(data, newval, field) do { \
90
    uint32_t val = *data; \
91
    val &= ~ field##_MASK; \
92
    val |= ((newval) << field##_SH) & field##_MASK; \
93
    *data = val; \
94
    } while(0)
95

96
static const char *ehci_state_names[] = {
97
    [EST_INACTIVE]     = "INACTIVE",
98
    [EST_ACTIVE]       = "ACTIVE",
99
    [EST_EXECUTING]    = "EXECUTING",
100
    [EST_SLEEPING]     = "SLEEPING",
101
    [EST_WAITLISTHEAD] = "WAITLISTHEAD",
102
    [EST_FETCHENTRY]   = "FETCH ENTRY",
103
    [EST_FETCHQH]      = "FETCH QH",
104
    [EST_FETCHITD]     = "FETCH ITD",
105
    [EST_ADVANCEQUEUE] = "ADVANCEQUEUE",
106
    [EST_FETCHQTD]     = "FETCH QTD",
107
    [EST_EXECUTE]      = "EXECUTE",
108
    [EST_WRITEBACK]    = "WRITEBACK",
109
    [EST_HORIZONTALQH] = "HORIZONTALQH",
110
};
111

112
static const char *ehci_mmio_names[] = {
113
    [USBCMD]            = "USBCMD",
114
    [USBSTS]            = "USBSTS",
115
    [USBINTR]           = "USBINTR",
116
    [FRINDEX]           = "FRINDEX",
117
    [PERIODICLISTBASE]  = "P-LIST BASE",
118
    [ASYNCLISTADDR]     = "A-LIST ADDR",
119
    [CONFIGFLAG]        = "CONFIGFLAG",
120
};
121

122
static int ehci_state_executing(EHCIQueue *q);
123
static int ehci_state_writeback(EHCIQueue *q);
124
static int ehci_state_advqueue(EHCIQueue *q);
125
static int ehci_fill_queue(EHCIPacket *p);
126
static void ehci_free_packet(EHCIPacket *p);
127

128
static const char *nr2str(const char **n, size_t len, uint32_t nr)
129
{
130
    if (nr < len && n[nr] != NULL) {
131
        return n[nr];
132
    } else {
133
        return "unknown";
134
    }
135
}
136

137
static const char *state2str(uint32_t state)
138
{
139
    return nr2str(ehci_state_names, ARRAY_SIZE(ehci_state_names), state);
140
}
141

142
static const char *addr2str(hwaddr addr)
143
{
144
    return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
145
}
146

147
static void ehci_trace_usbsts(uint32_t mask, int state)
148
{
149
    /* interrupts */
150
    if (mask & USBSTS_INT) {
151
        trace_usb_ehci_usbsts("INT", state);
152
    }
153
    if (mask & USBSTS_ERRINT) {
154
        trace_usb_ehci_usbsts("ERRINT", state);
155
    }
156
    if (mask & USBSTS_PCD) {
157
        trace_usb_ehci_usbsts("PCD", state);
158
    }
159
    if (mask & USBSTS_FLR) {
160
        trace_usb_ehci_usbsts("FLR", state);
161
    }
162
    if (mask & USBSTS_HSE) {
163
        trace_usb_ehci_usbsts("HSE", state);
164
    }
165
    if (mask & USBSTS_IAA) {
166
        trace_usb_ehci_usbsts("IAA", state);
167
    }
168

169
    /* status */
170
    if (mask & USBSTS_HALT) {
171
        trace_usb_ehci_usbsts("HALT", state);
172
    }
173
    if (mask & USBSTS_REC) {
174
        trace_usb_ehci_usbsts("REC", state);
175
    }
176
    if (mask & USBSTS_PSS) {
177
        trace_usb_ehci_usbsts("PSS", state);
178
    }
179
    if (mask & USBSTS_ASS) {
180
        trace_usb_ehci_usbsts("ASS", state);
181
    }
182
}
183

184
static inline void ehci_set_usbsts(EHCIState *s, int mask)
185
{
186
    if ((s->usbsts & mask) == mask) {
187
        return;
188
    }
189
    ehci_trace_usbsts(mask, 1);
190
    s->usbsts |= mask;
191
}
192

193
static inline void ehci_clear_usbsts(EHCIState *s, int mask)
194
{
195
    if ((s->usbsts & mask) == 0) {
196
        return;
197
    }
198
    ehci_trace_usbsts(mask, 0);
199
    s->usbsts &= ~mask;
200
}
201

202
/* update irq line */
203
static inline void ehci_update_irq(EHCIState *s)
204
{
205
    int level = 0;
206

207
    if ((s->usbsts & USBINTR_MASK) & s->usbintr) {
208
        level = 1;
209
    }
210

211
    trace_usb_ehci_irq(level, s->frindex, s->usbsts, s->usbintr);
212
    qemu_set_irq(s->irq, level);
213
}
214

215
/* flag interrupt condition */
216
static inline void ehci_raise_irq(EHCIState *s, int intr)
217
{
218
    if (intr & (USBSTS_PCD | USBSTS_FLR | USBSTS_HSE)) {
219
        s->usbsts |= intr;
220
        ehci_update_irq(s);
221
    } else {
222
        s->usbsts_pending |= intr;
223
    }
224
}
225

226
/*
227
 * Commit pending interrupts (added via ehci_raise_irq),
228
 * at the rate allowed by "Interrupt Threshold Control".
229
 */
230
static inline void ehci_commit_irq(EHCIState *s)
231
{
232
    uint32_t itc;
233

234
    if (!s->usbsts_pending) {
235
        return;
236
    }
237
    if (s->usbsts_frindex > s->frindex) {
238
        return;
239
    }
240

241
    itc = (s->usbcmd >> 16) & 0xff;
242
    s->usbsts |= s->usbsts_pending;
243
    s->usbsts_pending = 0;
244
    s->usbsts_frindex = s->frindex + itc;
245
    ehci_update_irq(s);
246
}
247

248
static void ehci_update_halt(EHCIState *s)
249
{
250
    if (s->usbcmd & USBCMD_RUNSTOP) {
251
        ehci_clear_usbsts(s, USBSTS_HALT);
252
    } else {
253
        if (s->astate == EST_INACTIVE && s->pstate == EST_INACTIVE) {
254
            ehci_set_usbsts(s, USBSTS_HALT);
255
        }
256
    }
257
}
258

259
static void ehci_set_state(EHCIState *s, int async, int state)
260
{
261
    if (async) {
262
        trace_usb_ehci_state("async", state2str(state));
263
        s->astate = state;
264
        if (s->astate == EST_INACTIVE) {
265
            ehci_clear_usbsts(s, USBSTS_ASS);
266
            ehci_update_halt(s);
267
        } else {
268
            ehci_set_usbsts(s, USBSTS_ASS);
269
        }
270
    } else {
271
        trace_usb_ehci_state("periodic", state2str(state));
272
        s->pstate = state;
273
        if (s->pstate == EST_INACTIVE) {
274
            ehci_clear_usbsts(s, USBSTS_PSS);
275
            ehci_update_halt(s);
276
        } else {
277
            ehci_set_usbsts(s, USBSTS_PSS);
278
        }
279
    }
280
}
281

282
static int ehci_get_state(EHCIState *s, int async)
283
{
284
    return async ? s->astate : s->pstate;
285
}
286

287
static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
288
{
289
    if (async) {
290
        s->a_fetch_addr = addr;
291
    } else {
292
        s->p_fetch_addr = addr;
293
    }
294
}
295

296
static int ehci_get_fetch_addr(EHCIState *s, int async)
297
{
298
    return async ? s->a_fetch_addr : s->p_fetch_addr;
299
}
300

301
static void ehci_trace_qh(EHCIQueue *q, hwaddr addr, EHCIqh *qh)
302
{
303
    /* need three here due to argument count limits */
304
    trace_usb_ehci_qh_ptrs(q, addr, qh->next,
305
                           qh->current_qtd, qh->next_qtd, qh->altnext_qtd);
306
    trace_usb_ehci_qh_fields(addr,
307
                             get_field(qh->epchar, QH_EPCHAR_RL),
308
                             get_field(qh->epchar, QH_EPCHAR_MPLEN),
309
                             get_field(qh->epchar, QH_EPCHAR_EPS),
310
                             get_field(qh->epchar, QH_EPCHAR_EP),
311
                             get_field(qh->epchar, QH_EPCHAR_DEVADDR));
312
    trace_usb_ehci_qh_bits(addr,
313
                           (bool)(qh->epchar & QH_EPCHAR_C),
314
                           (bool)(qh->epchar & QH_EPCHAR_H),
315
                           (bool)(qh->epchar & QH_EPCHAR_DTC),
316
                           (bool)(qh->epchar & QH_EPCHAR_I));
317
}
318

319
static void ehci_trace_qtd(EHCIQueue *q, hwaddr addr, EHCIqtd *qtd)
320
{
321
    /* need three here due to argument count limits */
322
    trace_usb_ehci_qtd_ptrs(q, addr, qtd->next, qtd->altnext);
323
    trace_usb_ehci_qtd_fields(addr,
324
                              get_field(qtd->token, QTD_TOKEN_TBYTES),
325
                              get_field(qtd->token, QTD_TOKEN_CPAGE),
326
                              get_field(qtd->token, QTD_TOKEN_CERR),
327
                              get_field(qtd->token, QTD_TOKEN_PID));
328
    trace_usb_ehci_qtd_bits(addr,
329
                            (bool)(qtd->token & QTD_TOKEN_IOC),
330
                            (bool)(qtd->token & QTD_TOKEN_ACTIVE),
331
                            (bool)(qtd->token & QTD_TOKEN_HALT),
332
                            (bool)(qtd->token & QTD_TOKEN_BABBLE),
333
                            (bool)(qtd->token & QTD_TOKEN_XACTERR));
334
}
335

336
static void ehci_trace_itd(EHCIState *s, hwaddr addr, EHCIitd *itd)
337
{
338
    trace_usb_ehci_itd(addr, itd->next,
339
                       get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT),
340
                       get_field(itd->bufptr[2], ITD_BUFPTR_MULT),
341
                       get_field(itd->bufptr[0], ITD_BUFPTR_EP),
342
                       get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR));
343
}
344

345
static void ehci_trace_sitd(EHCIState *s, hwaddr addr,
346
                            EHCIsitd *sitd)
347
{
348
    trace_usb_ehci_sitd(addr, sitd->next,
349
                        (bool)(sitd->results & SITD_RESULTS_ACTIVE));
350
}
351

352
static void ehci_trace_guest_bug(EHCIState *s, const char *message)
353
{
354
    trace_usb_ehci_guest_bug(message);
355
}
356

357
static inline bool ehci_enabled(EHCIState *s)
358
{
359
    return s->usbcmd & USBCMD_RUNSTOP;
360
}
361

362
static inline bool ehci_async_enabled(EHCIState *s)
363
{
364
    return ehci_enabled(s) && (s->usbcmd & USBCMD_ASE);
365
}
366

367
static inline bool ehci_periodic_enabled(EHCIState *s)
368
{
369
    return ehci_enabled(s) && (s->usbcmd & USBCMD_PSE);
370
}
371

372
/* Get an array of dwords from main memory */
373
static inline int get_dwords(EHCIState *ehci, uint32_t addr,
374
                             uint32_t *buf, int num)
375
{
376
    int i;
377

378
    if (!ehci->as) {
379
        ehci_raise_irq(ehci, USBSTS_HSE);
380
        ehci->usbcmd &= ~USBCMD_RUNSTOP;
381
        trace_usb_ehci_dma_error();
382
        return -1;
383
    }
384

385
    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
386
        dma_memory_read(ehci->as, addr, buf, sizeof(*buf),
387
                        MEMTXATTRS_UNSPECIFIED);
388
        *buf = le32_to_cpu(*buf);
389
    }
390

391
    return num;
392
}
393

394
/* Put an array of dwords in to main memory */
395
static inline int put_dwords(EHCIState *ehci, uint32_t addr,
396
                             uint32_t *buf, int num)
397
{
398
    int i;
399

400
    if (!ehci->as) {
401
        ehci_raise_irq(ehci, USBSTS_HSE);
402
        ehci->usbcmd &= ~USBCMD_RUNSTOP;
403
        trace_usb_ehci_dma_error();
404
        return -1;
405
    }
406

407
    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
408
        uint32_t tmp = cpu_to_le32(*buf);
409
        dma_memory_write(ehci->as, addr, &tmp, sizeof(tmp),
410
                         MEMTXATTRS_UNSPECIFIED);
411
    }
412

413
    return num;
414
}
415

416
static int ehci_get_pid(EHCIqtd *qtd)
417
{
418
    switch (get_field(qtd->token, QTD_TOKEN_PID)) {
419
    case 0:
420
        return USB_TOKEN_OUT;
421
    case 1:
422
        return USB_TOKEN_IN;
423
    case 2:
424
        return USB_TOKEN_SETUP;
425
    default:
426
        fprintf(stderr, "bad token\n");
427
        return 0;
428
    }
429
}
430

431
static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
432
{
433
    uint32_t devaddr = get_field(qh->epchar, QH_EPCHAR_DEVADDR);
434
    uint32_t endp    = get_field(qh->epchar, QH_EPCHAR_EP);
435
    if ((devaddr != get_field(q->qh.epchar, QH_EPCHAR_DEVADDR)) ||
436
        (endp    != get_field(q->qh.epchar, QH_EPCHAR_EP)) ||
437
        (qh->current_qtd != q->qh.current_qtd) ||
438
        (q->async && qh->next_qtd != q->qh.next_qtd) ||
439
        (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
440
                                 7 * sizeof(uint32_t)) != 0) ||
441
        (q->dev != NULL && q->dev->addr != devaddr)) {
442
        return false;
443
    } else {
444
        return true;
445
    }
446
}
447

448
static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
449
{
450
    if (p->qtdaddr != p->queue->qtdaddr ||
451
        (p->queue->async && !NLPTR_TBIT(p->qtd.next) &&
452
            (p->qtd.next != qtd->next)) ||
453
        (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
454
        p->qtd.token != qtd->token ||
455
        p->qtd.bufptr[0] != qtd->bufptr[0]) {
456
        return false;
457
    } else {
458
        return true;
459
    }
460
}
461

462
static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
463
{
464
    int ep  = get_field(q->qh.epchar, QH_EPCHAR_EP);
465
    int pid = ehci_get_pid(qtd);
466

467
    /* Note the pid changing is normal for ep 0 (the control ep) */
468
    if (q->last_pid && ep != 0 && pid != q->last_pid) {
469
        return false;
470
    } else {
471
        return true;
472
    }
473
}
474

475
/* Finish executing and writeback a packet outside of the regular
476
   fetchqh -> fetchqtd -> execute -> writeback cycle */
477
static void ehci_writeback_async_complete_packet(EHCIPacket *p)
478
{
479
    EHCIQueue *q = p->queue;
480
    EHCIqtd qtd;
481
    EHCIqh qh;
482
    int state;
483

484
    /* Verify the qh + qtd, like we do when going through fetchqh & fetchqtd */
485
    get_dwords(q->ehci, NLPTR_GET(q->qhaddr),
486
               (uint32_t *) &qh, sizeof(EHCIqh) >> 2);
487
    get_dwords(q->ehci, NLPTR_GET(q->qtdaddr),
488
               (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2);
489
    if (!ehci_verify_qh(q, &qh) || !ehci_verify_qtd(p, &qtd)) {
490
        p->async = EHCI_ASYNC_INITIALIZED;
491
        ehci_free_packet(p);
492
        return;
493
    }
494

495
    state = ehci_get_state(q->ehci, q->async);
496
    ehci_state_executing(q);
497
    ehci_state_writeback(q); /* Frees the packet! */
498
    if (!(q->qh.token & QTD_TOKEN_HALT)) {
499
        ehci_state_advqueue(q);
500
    }
501
    ehci_set_state(q->ehci, q->async, state);
502
}
503

504
/* packet management */
505

506
static EHCIPacket *ehci_alloc_packet(EHCIQueue *q)
507
{
508
    EHCIPacket *p;
509

510
    p = g_new0(EHCIPacket, 1);
511
    p->queue = q;
512
    usb_packet_init(&p->packet);
513
    QTAILQ_INSERT_TAIL(&q->packets, p, next);
514
    trace_usb_ehci_packet_action(p->queue, p, "alloc");
515
    return p;
516
}
517

518
static void ehci_free_packet(EHCIPacket *p)
519
{
520
    if (p->async == EHCI_ASYNC_FINISHED &&
521
            !(p->queue->qh.token & QTD_TOKEN_HALT)) {
522
        ehci_writeback_async_complete_packet(p);
523
        return;
524
    }
525
    trace_usb_ehci_packet_action(p->queue, p, "free");
526
    if (p->async == EHCI_ASYNC_INFLIGHT) {
527
        usb_cancel_packet(&p->packet);
528
    }
529
    if (p->async == EHCI_ASYNC_FINISHED &&
530
            p->packet.status == USB_RET_SUCCESS) {
531
        fprintf(stderr,
532
                "EHCI: Dropping completed packet from halted %s ep %02X\n",
533
                (p->pid == USB_TOKEN_IN) ? "in" : "out",
534
                get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
535
    }
536
    if (p->async != EHCI_ASYNC_NONE) {
537
        usb_packet_unmap(&p->packet, &p->sgl);
538
        qemu_sglist_destroy(&p->sgl);
539
    }
540
    QTAILQ_REMOVE(&p->queue->packets, p, next);
541
    usb_packet_cleanup(&p->packet);
542
    g_free(p);
543
}
544

545
/* queue management */
546

547
static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
548
{
549
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
550
    EHCIQueue *q;
551

552
    q = g_malloc0(sizeof(*q));
553
    q->ehci = ehci;
554
    q->qhaddr = addr;
555
    q->async = async;
556
    QTAILQ_INIT(&q->packets);
557
    QTAILQ_INSERT_HEAD(head, q, next);
558
    trace_usb_ehci_queue_action(q, "alloc");
559
    return q;
560
}
561

562
static void ehci_queue_stopped(EHCIQueue *q)
563
{
564
    int endp  = get_field(q->qh.epchar, QH_EPCHAR_EP);
565

566
    if (!q->last_pid || !q->dev) {
567
        return;
568
    }
569

570
    usb_device_ep_stopped(q->dev, usb_ep_get(q->dev, q->last_pid, endp));
571
}
572

573
static int ehci_cancel_queue(EHCIQueue *q)
574
{
575
    EHCIPacket *p;
576
    int packets = 0;
577

578
    p = QTAILQ_FIRST(&q->packets);
579
    if (p == NULL) {
580
        goto leave;
581
    }
582

583
    trace_usb_ehci_queue_action(q, "cancel");
584
    do {
585
        ehci_free_packet(p);
586
        packets++;
587
    } while ((p = QTAILQ_FIRST(&q->packets)) != NULL);
588

589
leave:
590
    ehci_queue_stopped(q);
591
    return packets;
592
}
593

594
static int ehci_reset_queue(EHCIQueue *q)
595
{
596
    int packets;
597

598
    trace_usb_ehci_queue_action(q, "reset");
599
    packets = ehci_cancel_queue(q);
600
    q->dev = NULL;
601
    q->qtdaddr = 0;
602
    q->last_pid = 0;
603
    return packets;
604
}
605

606
static void ehci_free_queue(EHCIQueue *q, const char *warn)
607
{
608
    EHCIQueueHead *head = q->async ? &q->ehci->aqueues : &q->ehci->pqueues;
609
    int cancelled;
610

611
    trace_usb_ehci_queue_action(q, "free");
612
    cancelled = ehci_cancel_queue(q);
613
    if (warn && cancelled > 0) {
614
        ehci_trace_guest_bug(q->ehci, warn);
615
    }
616
    QTAILQ_REMOVE(head, q, next);
617
    g_free(q);
618
}
619

620
static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
621
                                        int async)
622
{
623
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
624
    EHCIQueue *q;
625

626
    QTAILQ_FOREACH(q, head, next) {
627
        if (addr == q->qhaddr) {
628
            return q;
629
        }
630
    }
631
    return NULL;
632
}
633

634
static void ehci_queues_rip_unused(EHCIState *ehci, int async)
635
{
636
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
637
    const char *warn = async ? "guest unlinked busy QH" : NULL;
638
    uint64_t maxage = FRAME_TIMER_NS * ehci->maxframes * 4;
639
    EHCIQueue *q, *tmp;
640

641
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
642
        if (q->seen) {
643
            q->seen = 0;
644
            q->ts = ehci->last_run_ns;
645
            continue;
646
        }
647
        if (ehci->last_run_ns < q->ts + maxage) {
648
            continue;
649
        }
650
        ehci_free_queue(q, warn);
651
    }
652
}
653

654
static void ehci_queues_rip_unseen(EHCIState *ehci, int async)
655
{
656
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
657
    EHCIQueue *q, *tmp;
658

659
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
660
        if (!q->seen) {
661
            ehci_free_queue(q, NULL);
662
        }
663
    }
664
}
665

666
static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev, int async)
667
{
668
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
669
    EHCIQueue *q, *tmp;
670

671
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
672
        if (q->dev != dev) {
673
            continue;
674
        }
675
        ehci_free_queue(q, NULL);
676
    }
677
}
678

679
static void ehci_queues_rip_all(EHCIState *ehci, int async)
680
{
681
    EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
682
    const char *warn = async ? "guest stopped busy async schedule" : NULL;
683
    EHCIQueue *q, *tmp;
684

685
    QTAILQ_FOREACH_SAFE(q, head, next, tmp) {
686
        ehci_free_queue(q, warn);
687
    }
688
}
689

690
/* Attach or detach a device on root hub */
691

692
static void ehci_attach(USBPort *port)
693
{
694
    EHCIState *s = port->opaque;
695
    uint32_t *portsc = &s->portsc[port->index];
696
    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
697

698
    trace_usb_ehci_port_attach(port->index, owner, port->dev->product_desc);
699

700
    if (*portsc & PORTSC_POWNER) {
701
        USBPort *companion = s->companion_ports[port->index];
702
        companion->dev = port->dev;
703
        companion->ops->attach(companion);
704
        return;
705
    }
706

707
    *portsc |= PORTSC_CONNECT;
708
    *portsc |= PORTSC_CSC;
709

710
    ehci_raise_irq(s, USBSTS_PCD);
711
}
712

713
static void ehci_detach(USBPort *port)
714
{
715
    EHCIState *s = port->opaque;
716
    uint32_t *portsc = &s->portsc[port->index];
717
    const char *owner = (*portsc & PORTSC_POWNER) ? "comp" : "ehci";
718

719
    trace_usb_ehci_port_detach(port->index, owner);
720

721
    if (*portsc & PORTSC_POWNER) {
722
        USBPort *companion = s->companion_ports[port->index];
723
        companion->ops->detach(companion);
724
        companion->dev = NULL;
725
        /*
726
         * EHCI spec 4.2.2: "When a disconnect occurs... On the event,
727
         * the port ownership is returned immediately to the EHCI controller."
728
         */
729
        *portsc &= ~PORTSC_POWNER;
730
        return;
731
    }
732

733
    ehci_queues_rip_device(s, port->dev, 0);
734
    ehci_queues_rip_device(s, port->dev, 1);
735

736
    *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
737
    *portsc |= PORTSC_CSC;
738

739
    ehci_raise_irq(s, USBSTS_PCD);
740
}
741

742
static void ehci_child_detach(USBPort *port, USBDevice *child)
743
{
744
    EHCIState *s = port->opaque;
745
    uint32_t portsc = s->portsc[port->index];
746

747
    if (portsc & PORTSC_POWNER) {
748
        USBPort *companion = s->companion_ports[port->index];
749
        companion->ops->child_detach(companion, child);
750
        return;
751
    }
752

753
    ehci_queues_rip_device(s, child, 0);
754
    ehci_queues_rip_device(s, child, 1);
755
}
756

757
static void ehci_wakeup(USBPort *port)
758
{
759
    EHCIState *s = port->opaque;
760
    uint32_t *portsc = &s->portsc[port->index];
761

762
    if (*portsc & PORTSC_POWNER) {
763
        USBPort *companion = s->companion_ports[port->index];
764
        if (companion->ops->wakeup) {
765
            companion->ops->wakeup(companion);
766
        }
767
        return;
768
    }
769

770
    if (*portsc & PORTSC_SUSPEND) {
771
        trace_usb_ehci_port_wakeup(port->index);
772
        *portsc |= PORTSC_FPRES;
773
        ehci_raise_irq(s, USBSTS_PCD);
774
    }
775

776
    qemu_bh_schedule(s->async_bh);
777
}
778

779
static void ehci_register_companion(USBBus *bus, USBPort *ports[],
780
                                    uint32_t portcount, uint32_t firstport,
781
                                    Error **errp)
782
{
783
    EHCIState *s = container_of(bus, EHCIState, bus);
784
    uint32_t i;
785

786
    if (firstport + portcount > EHCI_PORTS) {
787
        error_setg(errp, "firstport must be between 0 and %u",
788
                   EHCI_PORTS - portcount);
789
        return;
790
    }
791

792
    for (i = 0; i < portcount; i++) {
793
        if (s->companion_ports[firstport + i]) {
794
            error_setg(errp, "firstport %u asks for ports %u-%u,"
795
                       " but port %u has a companion assigned already",
796
                       firstport, firstport, firstport + portcount - 1,
797
                       firstport + i);
798
            return;
799
        }
800
    }
801

802
    for (i = 0; i < portcount; i++) {
803
        s->companion_ports[firstport + i] = ports[i];
804
        s->ports[firstport + i].speedmask |=
805
            USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;
806
        /* Ensure devs attached before the initial reset go to the companion */
807
        s->portsc[firstport + i] = PORTSC_POWNER;
808
    }
809

810
    s->companion_count++;
811
    s->caps[0x05] = (s->companion_count << 4) | portcount;
812
}
813

814
static void ehci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
815
                                 unsigned int stream)
816
{
817
    EHCIState *s = container_of(bus, EHCIState, bus);
818
    uint32_t portsc = s->portsc[ep->dev->port->index];
819

820
    if (portsc & PORTSC_POWNER) {
821
        return;
822
    }
823

824
    s->periodic_sched_active = PERIODIC_ACTIVE;
825
    qemu_bh_schedule(s->async_bh);
826
}
827

828
static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
829
{
830
    USBDevice *dev;
831
    USBPort *port;
832
    int i;
833

834
    for (i = 0; i < EHCI_PORTS; i++) {
835
        port = &ehci->ports[i];
836
        if (!(ehci->portsc[i] & PORTSC_PED)) {
837
            DPRINTF("Port %d not enabled\n", i);
838
            continue;
839
        }
840
        dev = usb_find_device(port, addr);
841
        if (dev != NULL) {
842
            return dev;
843
        }
844
    }
845
    return NULL;
846
}
847

848
/* 4.1 host controller initialization */
849
void ehci_reset(void *opaque)
850
{
851
    EHCIState *s = opaque;
852
    int i;
853
    USBDevice *devs[EHCI_PORTS];
854

855
    trace_usb_ehci_reset();
856

857
    /*
858
     * Do the detach before touching portsc, so that it correctly gets send to
859
     * us or to our companion based on PORTSC_POWNER before the reset.
860
     */
861
    for(i = 0; i < EHCI_PORTS; i++) {
862
        devs[i] = s->ports[i].dev;
863
        if (devs[i] && devs[i]->attached) {
864
            usb_detach(&s->ports[i]);
865
        }
866
    }
867

868
    memset(&s->opreg, 0x00, sizeof(s->opreg));
869
    memset(&s->portsc, 0x00, sizeof(s->portsc));
870

871
    s->usbcmd = NB_MAXINTRATE << USBCMD_ITC_SH;
872
    s->usbsts = USBSTS_HALT;
873
    s->usbsts_pending = 0;
874
    s->usbsts_frindex = 0;
875
    ehci_update_irq(s);
876

877
    s->astate = EST_INACTIVE;
878
    s->pstate = EST_INACTIVE;
879

880
    for(i = 0; i < EHCI_PORTS; i++) {
881
        if (s->companion_ports[i]) {
882
            s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
883
        } else {
884
            s->portsc[i] = PORTSC_PPOWER;
885
        }
886
        if (devs[i] && devs[i]->attached) {
887
            usb_attach(&s->ports[i]);
888
            usb_device_reset(devs[i]);
889
        }
890
    }
891
    ehci_queues_rip_all(s, 0);
892
    ehci_queues_rip_all(s, 1);
893
    timer_del(s->frame_timer);
894
    qemu_bh_cancel(s->async_bh);
895
}
896

897
static uint64_t ehci_caps_read(void *ptr, hwaddr addr,
898
                               unsigned size)
899
{
900
    EHCIState *s = ptr;
901
    return s->caps[addr];
902
}
903

904
static void ehci_caps_write(void *ptr, hwaddr addr,
905
                             uint64_t val, unsigned size)
906
{
907
}
908

909
static uint64_t ehci_opreg_read(void *ptr, hwaddr addr,
910
                                unsigned size)
911
{
912
    EHCIState *s = ptr;
913
    uint32_t val;
914

915
    switch (addr) {
916
    case FRINDEX:
917
        /* Round down to mult of 8, else it can go backwards on migration */
918
        val = s->frindex & ~7;
919
        break;
920
    default:
921
        val = s->opreg[addr >> 2];
922
    }
923

924
    trace_usb_ehci_opreg_read(addr + s->opregbase, addr2str(addr), val);
925
    return val;
926
}
927

928
static uint64_t ehci_port_read(void *ptr, hwaddr addr,
929
                               unsigned size)
930
{
931
    EHCIState *s = ptr;
932
    uint32_t val;
933

934
    val = s->portsc[addr >> 2];
935
    trace_usb_ehci_portsc_read(addr + s->portscbase, addr >> 2, val);
936
    return val;
937
}
938

939
static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
940
{
941
    USBDevice *dev = s->ports[port].dev;
942
    uint32_t *portsc = &s->portsc[port];
943
    uint32_t orig;
944

945
    if (s->companion_ports[port] == NULL)
946
        return;
947

948
    owner = owner & PORTSC_POWNER;
949
    orig  = *portsc & PORTSC_POWNER;
950

951
    if (!(owner ^ orig)) {
952
        return;
953
    }
954

955
    if (dev && dev->attached) {
956
        usb_detach(&s->ports[port]);
957
    }
958

959
    *portsc &= ~PORTSC_POWNER;
960
    *portsc |= owner;
961

962
    if (dev && dev->attached) {
963
        usb_attach(&s->ports[port]);
964
    }
965
}
966

967
static void ehci_port_write(void *ptr, hwaddr addr,
968
                            uint64_t val, unsigned size)
969
{
970
    EHCIState *s = ptr;
971
    int port = addr >> 2;
972
    uint32_t *portsc = &s->portsc[port];
973
    uint32_t old = *portsc;
974
    USBDevice *dev = s->ports[port].dev;
975

976
    trace_usb_ehci_portsc_write(addr + s->portscbase, addr >> 2, val);
977

978
    /* Clear rwc bits */
979
    *portsc &= ~(val & PORTSC_RWC_MASK);
980
    /* The guest may clear, but not set the PED bit */
981
    *portsc &= val | ~PORTSC_PED;
982
    /* POWNER is masked out by RO_MASK as it is RO when we've no companion */
983
    handle_port_owner_write(s, port, val);
984
    /* And finally apply RO_MASK */
985
    val &= PORTSC_RO_MASK;
986

987
    if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {
988
        trace_usb_ehci_port_reset(port, 1);
989
    }
990

991
    if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
992
        trace_usb_ehci_port_reset(port, 0);
993
        if (dev && dev->attached) {
994
            usb_port_reset(&s->ports[port]);
995
            *portsc &= ~PORTSC_CSC;
996
        }
997

998
        /*
999
         *  Table 2.16 Set the enable bit(and enable bit change) to indicate
1000
         *  to SW that this port has a high speed device attached
1001
         */
1002
        if (dev && dev->attached && (dev->speedmask & USB_SPEED_MASK_HIGH)) {
1003
            val |= PORTSC_PED;
1004
        }
1005
    }
1006

1007
    if ((val & PORTSC_SUSPEND) && !(*portsc & PORTSC_SUSPEND)) {
1008
        trace_usb_ehci_port_suspend(port);
1009
    }
1010
    if (!(val & PORTSC_FPRES) && (*portsc & PORTSC_FPRES)) {
1011
        trace_usb_ehci_port_resume(port);
1012
        val &= ~PORTSC_SUSPEND;
1013
    }
1014

1015
    *portsc &= ~PORTSC_RO_MASK;
1016
    *portsc |= val;
1017
    trace_usb_ehci_portsc_change(addr + s->portscbase, addr >> 2, *portsc, old);
1018
}
1019

1020
static void ehci_opreg_write(void *ptr, hwaddr addr,
1021
                             uint64_t val, unsigned size)
1022
{
1023
    EHCIState *s = ptr;
1024
    uint32_t *mmio = s->opreg + (addr >> 2);
1025
    uint32_t old = *mmio;
1026
    int i;
1027

1028
    trace_usb_ehci_opreg_write(addr + s->opregbase, addr2str(addr), val);
1029

1030
    switch (addr) {
1031
    case USBCMD:
1032
        if (val & USBCMD_HCRESET) {
1033
            ehci_reset(s);
1034
            val = s->usbcmd;
1035
            break;
1036
        }
1037

1038
        /* not supporting dynamic frame list size at the moment */
1039
        if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
1040
            fprintf(stderr, "attempt to set frame list size -- value %d\n",
1041
                    (int)val & USBCMD_FLS);
1042
            val &= ~USBCMD_FLS;
1043
        }
1044

1045
        if (val & USBCMD_IAAD) {
1046
            /*
1047
             * Process IAAD immediately, otherwise the Linux IAAD watchdog may
1048
             * trigger and re-use a qh without us seeing the unlink.
1049
             */
1050
            s->async_stepdown = 0;
1051
            qemu_bh_schedule(s->async_bh);
1052
            trace_usb_ehci_doorbell_ring();
1053
        }
1054

1055
        if (((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & val) !=
1056
            ((USBCMD_RUNSTOP | USBCMD_PSE | USBCMD_ASE) & s->usbcmd)) {
1057
            if (s->pstate == EST_INACTIVE) {
1058
                SET_LAST_RUN_CLOCK(s);
1059
            }
1060
            s->usbcmd = val; /* Set usbcmd for ehci_update_halt() */
1061
            ehci_update_halt(s);
1062
            s->async_stepdown = 0;
1063
            qemu_bh_schedule(s->async_bh);
1064
        }
1065
        break;
1066

1067
    case USBSTS:
1068
        val &= USBSTS_RO_MASK;              // bits 6 through 31 are RO
1069
        ehci_clear_usbsts(s, val);          // bits 0 through 5 are R/WC
1070
        val = s->usbsts;
1071
        ehci_update_irq(s);
1072
        break;
1073

1074
    case USBINTR:
1075
        val &= USBINTR_MASK;
1076
        if (ehci_enabled(s) && (USBSTS_FLR & val)) {
1077
            qemu_bh_schedule(s->async_bh);
1078
        }
1079
        break;
1080

1081
    case FRINDEX:
1082
        val &= 0x00003fff; /* frindex is 14bits */
1083
        s->usbsts_frindex = val;
1084
        break;
1085

1086
    case CONFIGFLAG:
1087
        val &= 0x1;
1088
        if (val) {
1089
            for (i = 0; i < EHCI_PORTS; i++) {
1090
                handle_port_owner_write(s, i, 0);
1091
            }
1092
        }
1093
        break;
1094

1095
    case PERIODICLISTBASE:
1096
        if (ehci_periodic_enabled(s)) {
1097
            fprintf(stderr,
1098
              "ehci: PERIODIC list base register set while periodic schedule\n"
1099
              "      is enabled and HC is enabled\n");
1100
        }
1101
        break;
1102

1103
    case ASYNCLISTADDR:
1104
        if (ehci_async_enabled(s)) {
1105
            fprintf(stderr,
1106
              "ehci: ASYNC list address register set while async schedule\n"
1107
              "      is enabled and HC is enabled\n");
1108
        }
1109
        break;
1110
    }
1111

1112
    *mmio = val;
1113
    trace_usb_ehci_opreg_change(addr + s->opregbase, addr2str(addr),
1114
                                *mmio, old);
1115
}
1116

1117
/*
1118
 *  Write the qh back to guest physical memory.  This step isn't
1119
 *  in the EHCI spec but we need to do it since we don't share
1120
 *  physical memory with our guest VM.
1121
 *
1122
 *  The first three dwords are read-only for the EHCI, so skip them
1123
 *  when writing back the qh.
1124
 */
1125
static void ehci_flush_qh(EHCIQueue *q)
1126
{
1127
    uint32_t *qh = (uint32_t *) &q->qh;
1128
    uint32_t dwords = sizeof(EHCIqh) >> 2;
1129
    uint32_t addr = NLPTR_GET(q->qhaddr);
1130

1131
    put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
1132
}
1133

1134
// 4.10.2
1135

1136
static int ehci_qh_do_overlay(EHCIQueue *q)
1137
{
1138
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1139
    int i;
1140
    int dtoggle;
1141
    int ping;
1142
    int eps;
1143
    int reload;
1144

1145
    assert(p != NULL);
1146
    assert(p->qtdaddr == q->qtdaddr);
1147

1148
    // remember values in fields to preserve in qh after overlay
1149

1150
    dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
1151
    ping    = q->qh.token & QTD_TOKEN_PING;
1152

1153
    q->qh.current_qtd = p->qtdaddr;
1154
    q->qh.next_qtd    = p->qtd.next;
1155
    q->qh.altnext_qtd = p->qtd.altnext;
1156
    q->qh.token       = p->qtd.token;
1157

1158

1159
    eps = get_field(q->qh.epchar, QH_EPCHAR_EPS);
1160
    if (eps == EHCI_QH_EPS_HIGH) {
1161
        q->qh.token &= ~QTD_TOKEN_PING;
1162
        q->qh.token |= ping;
1163
    }
1164

1165
    reload = get_field(q->qh.epchar, QH_EPCHAR_RL);
1166
    set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT);
1167

1168
    for (i = 0; i < 5; i++) {
1169
        q->qh.bufptr[i] = p->qtd.bufptr[i];
1170
    }
1171

1172
    if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
1173
        // preserve QH DT bit
1174
        q->qh.token &= ~QTD_TOKEN_DTOGGLE;
1175
        q->qh.token |= dtoggle;
1176
    }
1177

1178
    q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK;
1179
    q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK;
1180

1181
    ehci_flush_qh(q);
1182

1183
    return 0;
1184
}
1185

1186
static int ehci_init_transfer(EHCIPacket *p)
1187
{
1188
    uint32_t cpage, offset, bytes, plen;
1189
    dma_addr_t page;
1190

1191
    cpage  = get_field(p->qtd.token, QTD_TOKEN_CPAGE);
1192
    bytes  = get_field(p->qtd.token, QTD_TOKEN_TBYTES);
1193
    offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK;
1194
    qemu_sglist_init(&p->sgl, p->queue->ehci->device, 5, p->queue->ehci->as);
1195

1196
    while (bytes > 0) {
1197
        if (cpage > 4) {
1198
            fprintf(stderr, "cpage out of range (%u)\n", cpage);
1199
            qemu_sglist_destroy(&p->sgl);
1200
            return -1;
1201
        }
1202

1203
        page  = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
1204
        page += offset;
1205
        plen  = bytes;
1206
        if (plen > 4096 - offset) {
1207
            plen = 4096 - offset;
1208
            offset = 0;
1209
            cpage++;
1210
        }
1211

1212
        qemu_sglist_add(&p->sgl, page, plen);
1213
        bytes -= plen;
1214
    }
1215
    return 0;
1216
}
1217

1218
static void ehci_finish_transfer(EHCIQueue *q, int len)
1219
{
1220
    uint32_t cpage, offset;
1221

1222
    if (len > 0) {
1223
        /* update cpage & offset */
1224
        cpage  = get_field(q->qh.token, QTD_TOKEN_CPAGE);
1225
        offset = q->qh.bufptr[0] & ~QTD_BUFPTR_MASK;
1226

1227
        offset += len;
1228
        cpage  += offset >> QTD_BUFPTR_SH;
1229
        offset &= ~QTD_BUFPTR_MASK;
1230

1231
        set_field(&q->qh.token, cpage, QTD_TOKEN_CPAGE);
1232
        q->qh.bufptr[0] &= QTD_BUFPTR_MASK;
1233
        q->qh.bufptr[0] |= offset;
1234
    }
1235
}
1236

1237
static void ehci_async_complete_packet(USBPort *port, USBPacket *packet)
1238
{
1239
    EHCIPacket *p;
1240
    EHCIState *s = port->opaque;
1241
    uint32_t portsc = s->portsc[port->index];
1242

1243
    if (portsc & PORTSC_POWNER) {
1244
        USBPort *companion = s->companion_ports[port->index];
1245
        companion->ops->complete(companion, packet);
1246
        return;
1247
    }
1248

1249
    p = container_of(packet, EHCIPacket, packet);
1250
    assert(p->async == EHCI_ASYNC_INFLIGHT);
1251

1252
    if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
1253
        trace_usb_ehci_packet_action(p->queue, p, "remove");
1254
        ehci_free_packet(p);
1255
        return;
1256
    }
1257

1258
    trace_usb_ehci_packet_action(p->queue, p, "wakeup");
1259
    p->async = EHCI_ASYNC_FINISHED;
1260

1261
    if (!p->queue->async) {
1262
        s->periodic_sched_active = PERIODIC_ACTIVE;
1263
    }
1264
    qemu_bh_schedule(s->async_bh);
1265
}
1266

1267
static void ehci_execute_complete(EHCIQueue *q)
1268
{
1269
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1270
    uint32_t tbytes;
1271

1272
    assert(p != NULL);
1273
    assert(p->qtdaddr == q->qtdaddr);
1274
    assert(p->async == EHCI_ASYNC_INITIALIZED ||
1275
           p->async == EHCI_ASYNC_FINISHED);
1276

1277
    DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
1278
            "status %d, actual_length %d\n",
1279
            q->qhaddr, q->qh.next, q->qtdaddr,
1280
            p->packet.status, p->packet.actual_length);
1281

1282
    switch (p->packet.status) {
1283
    case USB_RET_SUCCESS:
1284
        break;
1285
    case USB_RET_IOERROR:
1286
    case USB_RET_NODEV:
1287
        q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_XACTERR);
1288
        set_field(&q->qh.token, 0, QTD_TOKEN_CERR);
1289
        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1290
        break;
1291
    case USB_RET_STALL:
1292
        q->qh.token |= QTD_TOKEN_HALT;
1293
        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1294
        break;
1295
    case USB_RET_NAK:
1296
        set_field(&q->qh.altnext_qtd, 0, QH_ALTNEXT_NAKCNT);
1297
        return; /* We're not done yet with this transaction */
1298
    case USB_RET_BABBLE:
1299
        q->qh.token |= (QTD_TOKEN_HALT | QTD_TOKEN_BABBLE);
1300
        ehci_raise_irq(q->ehci, USBSTS_ERRINT);
1301
        break;
1302
    default:
1303
        /* should not be triggerable */
1304
        fprintf(stderr, "USB invalid response %d\n", p->packet.status);
1305
        g_assert_not_reached();
1306
    }
1307

1308
    /* TODO check 4.12 for splits */
1309
    tbytes = get_field(q->qh.token, QTD_TOKEN_TBYTES);
1310
    if (tbytes && p->pid == USB_TOKEN_IN) {
1311
        tbytes -= p->packet.actual_length;
1312
        if (tbytes) {
1313
            /* 4.15.1.2 must raise int on a short input packet */
1314
            ehci_raise_irq(q->ehci, USBSTS_INT);
1315
            if (q->async) {
1316
                q->ehci->int_req_by_async = true;
1317
            }
1318
        }
1319
    } else {
1320
        tbytes = 0;
1321
    }
1322
    DPRINTF("updating tbytes to %d\n", tbytes);
1323
    set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
1324

1325
    ehci_finish_transfer(q, p->packet.actual_length);
1326
    usb_packet_unmap(&p->packet, &p->sgl);
1327
    qemu_sglist_destroy(&p->sgl);
1328
    p->async = EHCI_ASYNC_NONE;
1329

1330
    q->qh.token ^= QTD_TOKEN_DTOGGLE;
1331
    q->qh.token &= ~QTD_TOKEN_ACTIVE;
1332

1333
    if (q->qh.token & QTD_TOKEN_IOC) {
1334
        ehci_raise_irq(q->ehci, USBSTS_INT);
1335
        if (q->async) {
1336
            q->ehci->int_req_by_async = true;
1337
        }
1338
    }
1339
}
1340

1341
/* 4.10.3 returns "again" */
1342
static int ehci_execute(EHCIPacket *p, const char *action)
1343
{
1344
    USBEndpoint *ep;
1345
    int endp;
1346
    bool spd;
1347

1348
    assert(p->async == EHCI_ASYNC_NONE ||
1349
           p->async == EHCI_ASYNC_INITIALIZED);
1350

1351
    if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
1352
        fprintf(stderr, "Attempting to execute inactive qtd\n");
1353
        return -1;
1354
    }
1355

1356
    if (get_field(p->qtd.token, QTD_TOKEN_TBYTES) > BUFF_SIZE) {
1357
        ehci_trace_guest_bug(p->queue->ehci,
1358
                             "guest requested more bytes than allowed");
1359
        return -1;
1360
    }
1361

1362
    if (!ehci_verify_pid(p->queue, &p->qtd)) {
1363
        ehci_queue_stopped(p->queue); /* Mark the ep in the prev dir stopped */
1364
    }
1365
    p->pid = ehci_get_pid(&p->qtd);
1366
    p->queue->last_pid = p->pid;
1367
    endp = get_field(p->queue->qh.epchar, QH_EPCHAR_EP);
1368
    ep = usb_ep_get(p->queue->dev, p->pid, endp);
1369

1370
    if (p->async == EHCI_ASYNC_NONE) {
1371
        if (ehci_init_transfer(p) != 0) {
1372
            return -1;
1373
        }
1374

1375
        spd = (p->pid == USB_TOKEN_IN && NLPTR_TBIT(p->qtd.altnext) == 0);
1376
        usb_packet_setup(&p->packet, p->pid, ep, 0, p->qtdaddr, spd,
1377
                         (p->qtd.token & QTD_TOKEN_IOC) != 0);
1378
        if (usb_packet_map(&p->packet, &p->sgl)) {
1379
            qemu_sglist_destroy(&p->sgl);
1380
            return -1;
1381
        }
1382
        p->async = EHCI_ASYNC_INITIALIZED;
1383
    }
1384

1385
    trace_usb_ehci_packet_action(p->queue, p, action);
1386
    usb_handle_packet(p->queue->dev, &p->packet);
1387
    DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
1388
            "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
1389
            p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
1390
            p->packet.actual_length);
1391

1392
    if (p->packet.actual_length > BUFF_SIZE) {
1393
        fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
1394
        return -1;
1395
    }
1396

1397
    return 1;
1398
}
1399

1400
/*  4.7.2
1401
 */
1402

1403
static int ehci_process_itd(EHCIState *ehci,
1404
                            EHCIitd *itd,
1405
                            uint32_t addr)
1406
{
1407
    USBDevice *dev;
1408
    USBEndpoint *ep;
1409
    uint32_t i, len, pid, dir, devaddr, endp;
1410
    uint32_t pg, off, ptr1, ptr2, max, mult;
1411

1412
    ehci->periodic_sched_active = PERIODIC_ACTIVE;
1413

1414
    dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
1415
    devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
1416
    endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
1417
    max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
1418
    mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
1419

1420
    for(i = 0; i < 8; i++) {
1421
        if (itd->transact[i] & ITD_XACT_ACTIVE) {
1422
            pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
1423
            off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
1424
            len  = get_field(itd->transact[i], ITD_XACT_LENGTH);
1425

1426
            if (len > max * mult) {
1427
                len = max * mult;
1428
            }
1429
            if (len > BUFF_SIZE || pg > 6) {
1430
                return -1;
1431
            }
1432

1433
            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
1434
            qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
1435
            if (off + len > 4096) {
1436
                /* transfer crosses page border */
1437
                if (pg == 6) {
1438
                    qemu_sglist_destroy(&ehci->isgl);
1439
                    return -1;  /* avoid page pg + 1 */
1440
                }
1441
                ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
1442
                uint32_t len2 = off + len - 4096;
1443
                uint32_t len1 = len - len2;
1444
                qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
1445
                qemu_sglist_add(&ehci->isgl, ptr2, len2);
1446
            } else {
1447
                qemu_sglist_add(&ehci->isgl, ptr1 + off, len);
1448
            }
1449

1450
            dev = ehci_find_device(ehci, devaddr);
1451
            if (dev == NULL) {
1452
                ehci_trace_guest_bug(ehci, "no device found");
1453
                ehci->ipacket.status = USB_RET_NODEV;
1454
                ehci->ipacket.actual_length = 0;
1455
            } else {
1456
                pid = dir ? USB_TOKEN_IN : USB_TOKEN_OUT;
1457
                ep = usb_ep_get(dev, pid, endp);
1458
                if (ep && ep->type == USB_ENDPOINT_XFER_ISOC) {
1459
                    usb_packet_setup(&ehci->ipacket, pid, ep, 0, addr, false,
1460
                                     (itd->transact[i] & ITD_XACT_IOC) != 0);
1461
                    if (usb_packet_map(&ehci->ipacket, &ehci->isgl)) {
1462
                        qemu_sglist_destroy(&ehci->isgl);
1463
                        return -1;
1464
                    }
1465
                    usb_handle_packet(dev, &ehci->ipacket);
1466
                    usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
1467
                } else {
1468
                    DPRINTF("ISOCH: attempt to address non-iso endpoint\n");
1469
                    ehci->ipacket.status = USB_RET_NAK;
1470
                    ehci->ipacket.actual_length = 0;
1471
                }
1472
            }
1473
            qemu_sglist_destroy(&ehci->isgl);
1474

1475
            switch (ehci->ipacket.status) {
1476
            case USB_RET_SUCCESS:
1477
                break;
1478
            default:
1479
                fprintf(stderr, "Unexpected iso usb result: %d\n",
1480
                        ehci->ipacket.status);
1481
                /* Fall through */
1482
            case USB_RET_IOERROR:
1483
            case USB_RET_NODEV:
1484
                /* 3.3.2: XACTERR is only allowed on IN transactions */
1485
                if (dir) {
1486
                    itd->transact[i] |= ITD_XACT_XACTERR;
1487
                    ehci_raise_irq(ehci, USBSTS_ERRINT);
1488
                }
1489
                break;
1490
            case USB_RET_BABBLE:
1491
                itd->transact[i] |= ITD_XACT_BABBLE;
1492
                ehci_raise_irq(ehci, USBSTS_ERRINT);
1493
                break;
1494
            case USB_RET_NAK:
1495
                /* no data for us, so do a zero-length transfer */
1496
                ehci->ipacket.actual_length = 0;
1497
                break;
1498
            }
1499
            if (!dir) {
1500
                set_field(&itd->transact[i], len - ehci->ipacket.actual_length,
1501
                          ITD_XACT_LENGTH); /* OUT */
1502
            } else {
1503
                set_field(&itd->transact[i], ehci->ipacket.actual_length,
1504
                          ITD_XACT_LENGTH); /* IN */
1505
            }
1506
            if (itd->transact[i] & ITD_XACT_IOC) {
1507
                ehci_raise_irq(ehci, USBSTS_INT);
1508
            }
1509
            itd->transact[i] &= ~ITD_XACT_ACTIVE;
1510
        }
1511
    }
1512
    return 0;
1513
}
1514

1515

1516
/*  This state is the entry point for asynchronous schedule
1517
 *  processing.  Entry here constitutes a EHCI start event state (4.8.5)
1518
 */
1519
static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
1520
{
1521
    EHCIqh qh;
1522
    int i = 0;
1523
    int again = 0;
1524
    uint32_t entry = ehci->asynclistaddr;
1525

1526
    /* set reclamation flag at start event (4.8.6) */
1527
    if (async) {
1528
        ehci_set_usbsts(ehci, USBSTS_REC);
1529
    }
1530

1531
    ehci_queues_rip_unused(ehci, async);
1532

1533
    /*  Find the head of the list (4.9.1.1) */
1534
    for(i = 0; i < MAX_QH; i++) {
1535
        if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
1536
                       sizeof(EHCIqh) >> 2) < 0) {
1537
            return 0;
1538
        }
1539
        ehci_trace_qh(NULL, NLPTR_GET(entry), &qh);
1540

1541
        if (qh.epchar & QH_EPCHAR_H) {
1542
            if (async) {
1543
                entry |= (NLPTR_TYPE_QH << 1);
1544
            }
1545

1546
            ehci_set_fetch_addr(ehci, async, entry);
1547
            ehci_set_state(ehci, async, EST_FETCHENTRY);
1548
            again = 1;
1549
            goto out;
1550
        }
1551

1552
        entry = qh.next;
1553
        if (entry == ehci->asynclistaddr) {
1554
            break;
1555
        }
1556
    }
1557

1558
    /* no head found for list. */
1559

1560
    ehci_set_state(ehci, async, EST_ACTIVE);
1561

1562
out:
1563
    return again;
1564
}
1565

1566

1567
/*  This state is the entry point for periodic schedule processing as
1568
 *  well as being a continuation state for async processing.
1569
 */
1570
static int ehci_state_fetchentry(EHCIState *ehci, int async)
1571
{
1572
    int again = 0;
1573
    uint32_t entry = ehci_get_fetch_addr(ehci, async);
1574

1575
    if (NLPTR_TBIT(entry)) {
1576
        ehci_set_state(ehci, async, EST_ACTIVE);
1577
        goto out;
1578
    }
1579

1580
    /* section 4.8, only QH in async schedule */
1581
    if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
1582
        fprintf(stderr, "non queue head request in async schedule\n");
1583
        return -1;
1584
    }
1585

1586
    switch (NLPTR_TYPE_GET(entry)) {
1587
    case NLPTR_TYPE_QH:
1588
        ehci_set_state(ehci, async, EST_FETCHQH);
1589
        again = 1;
1590
        break;
1591

1592
    case NLPTR_TYPE_ITD:
1593
        ehci_set_state(ehci, async, EST_FETCHITD);
1594
        again = 1;
1595
        break;
1596

1597
    case NLPTR_TYPE_STITD:
1598
        ehci_set_state(ehci, async, EST_FETCHSITD);
1599
        again = 1;
1600
        break;
1601

1602
    default:
1603
        /* TODO: handle FSTN type */
1604
        fprintf(stderr, "FETCHENTRY: entry at %X is of type %u "
1605
                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
1606
        return -1;
1607
    }
1608

1609
out:
1610
    return again;
1611
}
1612

1613
static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
1614
{
1615
    uint32_t entry;
1616
    EHCIQueue *q;
1617
    EHCIqh qh;
1618

1619
    entry = ehci_get_fetch_addr(ehci, async);
1620
    q = ehci_find_queue_by_qh(ehci, entry, async);
1621
    if (q == NULL) {
1622
        q = ehci_alloc_queue(ehci, entry, async);
1623
    }
1624

1625
    q->seen++;
1626
    if (q->seen > 1) {
1627
        /* we are going in circles -- stop processing */
1628
        ehci_set_state(ehci, async, EST_ACTIVE);
1629
        q = NULL;
1630
        goto out;
1631
    }
1632

1633
    if (get_dwords(ehci, NLPTR_GET(q->qhaddr),
1634
                   (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) {
1635
        q = NULL;
1636
        goto out;
1637
    }
1638
    ehci_trace_qh(q, NLPTR_GET(q->qhaddr), &qh);
1639

1640
    /*
1641
     * The overlay area of the qh should never be changed by the guest,
1642
     * except when idle, in which case the reset is a nop.
1643
     */
1644
    if (!ehci_verify_qh(q, &qh)) {
1645
        if (ehci_reset_queue(q) > 0) {
1646
            ehci_trace_guest_bug(ehci, "guest updated active QH");
1647
        }
1648
    }
1649
    q->qh = qh;
1650

1651
    q->transact_ctr = get_field(q->qh.epcap, QH_EPCAP_MULT);
1652
    if (q->transact_ctr == 0) { /* Guest bug in some versions of windows */
1653
        q->transact_ctr = 4;
1654
    }
1655

1656
    if (q->dev == NULL) {
1657
        q->dev = ehci_find_device(q->ehci,
1658
                                  get_field(q->qh.epchar, QH_EPCHAR_DEVADDR));
1659
    }
1660

1661
    if (async && (q->qh.epchar & QH_EPCHAR_H)) {
1662

1663
        /*  EHCI spec version 1.0 Section 4.8.3 & 4.10.1 */
1664
        if (ehci->usbsts & USBSTS_REC) {
1665
            ehci_clear_usbsts(ehci, USBSTS_REC);
1666
        } else {
1667
            DPRINTF("FETCHQH:  QH 0x%08x. H-bit set, reclamation status reset"
1668
                       " - done processing\n", q->qhaddr);
1669
            ehci_set_state(ehci, async, EST_ACTIVE);
1670
            q = NULL;
1671
            goto out;
1672
        }
1673
    }
1674

1675
#if EHCI_DEBUG
1676
    if (q->qhaddr != q->qh.next) {
1677
    DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
1678
               q->qhaddr,
1679
               q->qh.epchar & QH_EPCHAR_H,
1680
               q->qh.token & QTD_TOKEN_HALT,
1681
               q->qh.token & QTD_TOKEN_ACTIVE,
1682
               q->qh.next);
1683
    }
1684
#endif
1685

1686
    if (q->qh.token & QTD_TOKEN_HALT) {
1687
        ehci_set_state(ehci, async, EST_HORIZONTALQH);
1688

1689
    } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
1690
               (NLPTR_TBIT(q->qh.current_qtd) == 0) &&
1691
               (q->qh.current_qtd != 0)) {
1692
        q->qtdaddr = q->qh.current_qtd;
1693
        ehci_set_state(ehci, async, EST_FETCHQTD);
1694

1695
    } else {
1696
        /*  EHCI spec version 1.0 Section 4.10.2 */
1697
        ehci_set_state(ehci, async, EST_ADVANCEQUEUE);
1698
    }
1699

1700
out:
1701
    return q;
1702
}
1703

1704
static int ehci_state_fetchitd(EHCIState *ehci, int async)
1705
{
1706
    uint32_t entry;
1707
    EHCIitd itd;
1708

1709
    assert(!async);
1710
    entry = ehci_get_fetch_addr(ehci, async);
1711

1712
    if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1713
                   sizeof(EHCIitd) >> 2) < 0) {
1714
        return -1;
1715
    }
1716
    ehci_trace_itd(ehci, entry, &itd);
1717

1718
    if (ehci_process_itd(ehci, &itd, entry) != 0) {
1719
        return -1;
1720
    }
1721

1722
    put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
1723
               sizeof(EHCIitd) >> 2);
1724
    ehci_set_fetch_addr(ehci, async, itd.next);
1725
    ehci_set_state(ehci, async, EST_FETCHENTRY);
1726

1727
    return 1;
1728
}
1729

1730
static int ehci_state_fetchsitd(EHCIState *ehci, int async)
1731
{
1732
    uint32_t entry;
1733
    EHCIsitd sitd;
1734

1735
    assert(!async);
1736
    entry = ehci_get_fetch_addr(ehci, async);
1737

1738
    if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *)&sitd,
1739
                   sizeof(EHCIsitd) >> 2) < 0) {
1740
        return 0;
1741
    }
1742
    ehci_trace_sitd(ehci, entry, &sitd);
1743

1744
    if (!(sitd.results & SITD_RESULTS_ACTIVE)) {
1745
        /* siTD is not active, nothing to do */;
1746
    } else {
1747
        /* TODO: split transfers are not implemented */
1748
        warn_report("Skipping active siTD");
1749
    }
1750

1751
    ehci_set_fetch_addr(ehci, async, sitd.next);
1752
    ehci_set_state(ehci, async, EST_FETCHENTRY);
1753
    return 1;
1754
}
1755

1756
/* Section 4.10.2 - paragraph 3 */
1757
static int ehci_state_advqueue(EHCIQueue *q)
1758
{
1759
#if 0
1760
    /* TO-DO: 4.10.2 - paragraph 2
1761
     * if I-bit is set to 1 and QH is not active
1762
     * go to horizontal QH
1763
     */
1764
    if (I-bit set) {
1765
        ehci_set_state(ehci, async, EST_HORIZONTALQH);
1766
        goto out;
1767
    }
1768
#endif
1769

1770
    /*
1771
     * want data and alt-next qTD is valid
1772
     */
1773
    if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
1774
        (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
1775
        q->qtdaddr = q->qh.altnext_qtd;
1776
        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1777

1778
    /*
1779
     *  next qTD is valid
1780
     */
1781
    } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
1782
        q->qtdaddr = q->qh.next_qtd;
1783
        ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
1784

1785
    /*
1786
     *  no valid qTD, try next QH
1787
     */
1788
    } else {
1789
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1790
    }
1791

1792
    return 1;
1793
}
1794

1795
/* Section 4.10.2 - paragraph 4 */
1796
static int ehci_state_fetchqtd(EHCIQueue *q)
1797
{
1798
    EHCIqtd qtd;
1799
    EHCIPacket *p;
1800
    int again = 1;
1801
    uint32_t addr;
1802

1803
    addr = NLPTR_GET(q->qtdaddr);
1804
    if (get_dwords(q->ehci, addr +  8, &qtd.token,   1) < 0) {
1805
        return 0;
1806
    }
1807
    barrier();
1808
    if (get_dwords(q->ehci, addr +  0, &qtd.next,    1) < 0 ||
1809
        get_dwords(q->ehci, addr +  4, &qtd.altnext, 1) < 0 ||
1810
        get_dwords(q->ehci, addr + 12, qtd.bufptr,
1811
                   ARRAY_SIZE(qtd.bufptr)) < 0) {
1812
        return 0;
1813
    }
1814
    ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
1815

1816
    p = QTAILQ_FIRST(&q->packets);
1817
    if (p != NULL) {
1818
        if (!ehci_verify_qtd(p, &qtd)) {
1819
            ehci_cancel_queue(q);
1820
            if (qtd.token & QTD_TOKEN_ACTIVE) {
1821
                ehci_trace_guest_bug(q->ehci, "guest updated active qTD");
1822
            }
1823
            p = NULL;
1824
        } else {
1825
            p->qtd = qtd;
1826
            ehci_qh_do_overlay(q);
1827
        }
1828
    }
1829

1830
    if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1831
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1832
    } else if (p != NULL) {
1833
        switch (p->async) {
1834
        case EHCI_ASYNC_NONE:
1835
        case EHCI_ASYNC_INITIALIZED:
1836
            /* Not yet executed (MULT), or previously nacked (int) packet */
1837
            ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1838
            break;
1839
        case EHCI_ASYNC_INFLIGHT:
1840
            /* Check if the guest has added new tds to the queue */
1841
            again = ehci_fill_queue(QTAILQ_LAST(&q->packets));
1842
            /* Unfinished async handled packet, go horizontal */
1843
            ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1844
            break;
1845
        case EHCI_ASYNC_FINISHED:
1846
            /* Complete executing of the packet */
1847
            ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1848
            break;
1849
        }
1850
    } else if (q->dev == NULL) {
1851
        ehci_trace_guest_bug(q->ehci, "no device attached to queue");
1852
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1853
    } else {
1854
        p = ehci_alloc_packet(q);
1855
        p->qtdaddr = q->qtdaddr;
1856
        p->qtd = qtd;
1857
        ehci_set_state(q->ehci, q->async, EST_EXECUTE);
1858
    }
1859

1860
    return again;
1861
}
1862

1863
static int ehci_state_horizqh(EHCIQueue *q)
1864
{
1865
    int again = 0;
1866

1867
    if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
1868
        ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
1869
        ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
1870
        again = 1;
1871
    } else {
1872
        ehci_set_state(q->ehci, q->async, EST_ACTIVE);
1873
    }
1874

1875
    return again;
1876
}
1877

1878
/* Returns "again" */
1879
static int ehci_fill_queue(EHCIPacket *p)
1880
{
1881
    USBEndpoint *ep = p->packet.ep;
1882
    EHCIQueue *q = p->queue;
1883
    EHCIqtd qtd = p->qtd;
1884
    uint32_t qtdaddr;
1885

1886
    for (;;) {
1887
        if (NLPTR_TBIT(qtd.next) != 0) {
1888
            break;
1889
        }
1890
        qtdaddr = qtd.next;
1891
        /*
1892
         * Detect circular td lists, Windows creates these, counting on the
1893
         * active bit going low after execution to make the queue stop.
1894
         */
1895
        QTAILQ_FOREACH(p, &q->packets, next) {
1896
            if (p->qtdaddr == qtdaddr) {
1897
                goto leave;
1898
            }
1899
        }
1900
        if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),
1901
                       (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {
1902
            return -1;
1903
        }
1904
        ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);
1905
        if (!(qtd.token & QTD_TOKEN_ACTIVE)) {
1906
            break;
1907
        }
1908
        if (!ehci_verify_pid(q, &qtd)) {
1909
            ehci_trace_guest_bug(q->ehci, "guest queued token with wrong pid");
1910
            break;
1911
        }
1912
        p = ehci_alloc_packet(q);
1913
        p->qtdaddr = qtdaddr;
1914
        p->qtd = qtd;
1915
        if (ehci_execute(p, "queue") == -1) {
1916
            return -1;
1917
        }
1918
        assert(p->packet.status == USB_RET_ASYNC);
1919
        p->async = EHCI_ASYNC_INFLIGHT;
1920
    }
1921
leave:
1922
    usb_device_flush_ep_queue(ep->dev, ep);
1923
    return 1;
1924
}
1925

1926
static int ehci_state_execute(EHCIQueue *q)
1927
{
1928
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1929
    int again = 0;
1930

1931
    assert(p != NULL);
1932
    assert(p->qtdaddr == q->qtdaddr);
1933

1934
    if (ehci_qh_do_overlay(q) != 0) {
1935
        return -1;
1936
    }
1937

1938
    // TODO verify enough time remains in the uframe as in 4.4.1.1
1939
    // TODO write back ptr to async list when done or out of time
1940

1941
    /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
1942
    if (!q->async && q->transact_ctr == 0) {
1943
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1944
        again = 1;
1945
        goto out;
1946
    }
1947

1948
    if (q->async) {
1949
        ehci_set_usbsts(q->ehci, USBSTS_REC);
1950
    }
1951

1952
    again = ehci_execute(p, "process");
1953
    if (again == -1) {
1954
        goto out;
1955
    }
1956
    if (p->packet.status == USB_RET_ASYNC) {
1957
        ehci_flush_qh(q);
1958
        trace_usb_ehci_packet_action(p->queue, p, "async");
1959
        p->async = EHCI_ASYNC_INFLIGHT;
1960
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1961
        if (q->async) {
1962
            again = ehci_fill_queue(p);
1963
        } else {
1964
            again = 1;
1965
        }
1966
        goto out;
1967
    }
1968

1969
    ehci_set_state(q->ehci, q->async, EST_EXECUTING);
1970
    again = 1;
1971

1972
out:
1973
    return again;
1974
}
1975

1976
static int ehci_state_executing(EHCIQueue *q)
1977
{
1978
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
1979

1980
    assert(p != NULL);
1981
    assert(p->qtdaddr == q->qtdaddr);
1982

1983
    ehci_execute_complete(q);
1984

1985
    /* 4.10.3 */
1986
    if (!q->async && q->transact_ctr > 0) {
1987
        q->transact_ctr--;
1988
    }
1989

1990
    /* 4.10.5 */
1991
    if (p->packet.status == USB_RET_NAK) {
1992
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
1993
    } else {
1994
        ehci_set_state(q->ehci, q->async, EST_WRITEBACK);
1995
    }
1996

1997
    ehci_flush_qh(q);
1998
    return 1;
1999
}
2000

2001

2002
static int ehci_state_writeback(EHCIQueue *q)
2003
{
2004
    EHCIPacket *p = QTAILQ_FIRST(&q->packets);
2005
    uint32_t *qtd, addr;
2006
    int again = 0;
2007

2008
    /*  Write back the QTD from the QH area */
2009
    assert(p != NULL);
2010
    assert(p->qtdaddr == q->qtdaddr);
2011

2012
    ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);
2013
    qtd = (uint32_t *) &q->qh.next_qtd;
2014
    addr = NLPTR_GET(p->qtdaddr);
2015
    /* First write back the offset */
2016
    put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qtd + 3, 1);
2017
    /* Then write back the token, clearing the 'active' bit */
2018
    put_dwords(q->ehci, addr + 2 * sizeof(uint32_t), qtd + 2, 1);
2019
    ehci_free_packet(p);
2020

2021
    /*
2022
     * EHCI specs say go horizontal here.
2023
     *
2024
     * We can also advance the queue here for performance reasons.  We
2025
     * need to take care to only take that shortcut in case we've
2026
     * processed the qtd just written back without errors, i.e. halt
2027
     * bit is clear.
2028
     */
2029
    if (q->qh.token & QTD_TOKEN_HALT) {
2030
        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);
2031
        again = 1;
2032
    } else {
2033
        ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);
2034
        again = 1;
2035
    }
2036
    return again;
2037
}
2038

2039
/*
2040
 * This is the state machine that is common to both async and periodic
2041
 */
2042

2043
static void ehci_advance_state(EHCIState *ehci, int async)
2044
{
2045
    EHCIQueue *q = NULL;
2046
    int itd_count = 0;
2047
    int again;
2048

2049
    do {
2050
        switch(ehci_get_state(ehci, async)) {
2051
        case EST_WAITLISTHEAD:
2052
            again = ehci_state_waitlisthead(ehci, async);
2053
            break;
2054

2055
        case EST_FETCHENTRY:
2056
            again = ehci_state_fetchentry(ehci, async);
2057
            break;
2058

2059
        case EST_FETCHQH:
2060
            q = ehci_state_fetchqh(ehci, async);
2061
            if (q != NULL) {
2062
                assert(q->async == async);
2063
                again = 1;
2064
            } else {
2065
                again = 0;
2066
            }
2067
            break;
2068

2069
        case EST_FETCHITD:
2070
            again = ehci_state_fetchitd(ehci, async);
2071
            itd_count++;
2072
            break;
2073

2074
        case EST_FETCHSITD:
2075
            again = ehci_state_fetchsitd(ehci, async);
2076
            itd_count++;
2077
            break;
2078

2079
        case EST_ADVANCEQUEUE:
2080
            assert(q != NULL);
2081
            again = ehci_state_advqueue(q);
2082
            break;
2083

2084
        case EST_FETCHQTD:
2085
            assert(q != NULL);
2086
            again = ehci_state_fetchqtd(q);
2087
            break;
2088

2089
        case EST_HORIZONTALQH:
2090
            assert(q != NULL);
2091
            again = ehci_state_horizqh(q);
2092
            break;
2093

2094
        case EST_EXECUTE:
2095
            assert(q != NULL);
2096
            again = ehci_state_execute(q);
2097
            if (async) {
2098
                ehci->async_stepdown = 0;
2099
            }
2100
            break;
2101

2102
        case EST_EXECUTING:
2103
            assert(q != NULL);
2104
            if (async) {
2105
                ehci->async_stepdown = 0;
2106
            }
2107
            again = ehci_state_executing(q);
2108
            break;
2109

2110
        case EST_WRITEBACK:
2111
            assert(q != NULL);
2112
            again = ehci_state_writeback(q);
2113
            if (!async) {
2114
                ehci->periodic_sched_active = PERIODIC_ACTIVE;
2115
            }
2116
            break;
2117

2118
        default:
2119
            fprintf(stderr, "Bad state!\n");
2120
            g_assert_not_reached();
2121
        }
2122

2123
        if (again < 0 || itd_count > 16) {
2124
            /* TODO: notify guest (raise HSE irq?) */
2125
            fprintf(stderr, "processing error - resetting ehci HC\n");
2126
            ehci_reset(ehci);
2127
            again = 0;
2128
        }
2129
    }
2130
    while (again);
2131
}
2132

2133
static void ehci_advance_async_state(EHCIState *ehci)
2134
{
2135
    const int async = 1;
2136

2137
    switch(ehci_get_state(ehci, async)) {
2138
    case EST_INACTIVE:
2139
        if (!ehci_async_enabled(ehci)) {
2140
            break;
2141
        }
2142
        ehci_set_state(ehci, async, EST_ACTIVE);
2143
        // No break, fall through to ACTIVE
2144

2145
    case EST_ACTIVE:
2146
        if (!ehci_async_enabled(ehci)) {
2147
            ehci_queues_rip_all(ehci, async);
2148
            ehci_set_state(ehci, async, EST_INACTIVE);
2149
            break;
2150
        }
2151

2152
        /* make sure guest has acknowledged the doorbell interrupt */
2153
        /* TO-DO: is this really needed? */
2154
        if (ehci->usbsts & USBSTS_IAA) {
2155
            DPRINTF("IAA status bit still set.\n");
2156
            break;
2157
        }
2158

2159
        /* check that address register has been set */
2160
        if (ehci->asynclistaddr == 0) {
2161
            break;
2162
        }
2163

2164
        ehci_set_state(ehci, async, EST_WAITLISTHEAD);
2165
        ehci_advance_state(ehci, async);
2166

2167
        /* If the doorbell is set, the guest wants to make a change to the
2168
         * schedule. The host controller needs to release cached data.
2169
         * (section 4.8.2)
2170
         */
2171
        if (ehci->usbcmd & USBCMD_IAAD) {
2172
            /* Remove all unseen qhs from the async qhs queue */
2173
            ehci_queues_rip_unseen(ehci, async);
2174
            trace_usb_ehci_doorbell_ack();
2175
            ehci->usbcmd &= ~USBCMD_IAAD;
2176
            ehci_raise_irq(ehci, USBSTS_IAA);
2177
        }
2178
        break;
2179

2180
    default:
2181
        /* this should only be due to a developer mistake */
2182
        fprintf(stderr, "ehci: Bad asynchronous state %d. "
2183
                "Resetting to active\n", ehci->astate);
2184
        g_assert_not_reached();
2185
    }
2186
}
2187

2188
static void ehci_advance_periodic_state(EHCIState *ehci)
2189
{
2190
    uint32_t entry;
2191
    uint32_t list;
2192
    const int async = 0;
2193

2194
    // 4.6
2195

2196
    switch(ehci_get_state(ehci, async)) {
2197
    case EST_INACTIVE:
2198
        if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
2199
            ehci_set_state(ehci, async, EST_ACTIVE);
2200
            // No break, fall through to ACTIVE
2201
        } else
2202
            break;
2203

2204
    case EST_ACTIVE:
2205
        if (!(ehci->frindex & 7) && !ehci_periodic_enabled(ehci)) {
2206
            ehci_queues_rip_all(ehci, async);
2207
            ehci_set_state(ehci, async, EST_INACTIVE);
2208
            break;
2209
        }
2210

2211
        list = ehci->periodiclistbase & 0xfffff000;
2212
        /* check that register has been set */
2213
        if (list == 0) {
2214
            break;
2215
        }
2216
        list |= ((ehci->frindex & 0x1ff8) >> 1);
2217

2218
        if (get_dwords(ehci, list, &entry, 1) < 0) {
2219
            break;
2220
        }
2221

2222
        DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
2223
                ehci->frindex / 8, list, entry);
2224
        ehci_set_fetch_addr(ehci, async,entry);
2225
        ehci_set_state(ehci, async, EST_FETCHENTRY);
2226
        ehci_advance_state(ehci, async);
2227
        ehci_queues_rip_unused(ehci, async);
2228
        break;
2229

2230
    default:
2231
        /* this should only be due to a developer mistake */
2232
        fprintf(stderr, "ehci: Bad periodic state %d. "
2233
                "Resetting to active\n", ehci->pstate);
2234
        g_assert_not_reached();
2235
    }
2236
}
2237

2238
static void ehci_update_frindex(EHCIState *ehci, int uframes)
2239
{
2240
    if (!ehci_enabled(ehci) && ehci->pstate == EST_INACTIVE) {
2241
        return;
2242
    }
2243

2244
    /* Generate FLR interrupt if frame index rolls over 0x2000 */
2245
    if ((ehci->frindex % 0x2000) + uframes >= 0x2000) {
2246
        ehci_raise_irq(ehci, USBSTS_FLR);
2247
    }
2248

2249
    /* How many times will frindex roll over 0x4000 with this frame count?
2250
     * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
2251
     */
2252
    int rollovers = (ehci->frindex + uframes) / 0x4000;
2253
    if (rollovers > 0) {
2254
        if (ehci->usbsts_frindex >= (rollovers * 0x4000)) {
2255
            ehci->usbsts_frindex -= 0x4000 * rollovers;
2256
        } else {
2257
            ehci->usbsts_frindex = 0;
2258
        }
2259
    }
2260

2261
    ehci->frindex = (ehci->frindex + uframes) % 0x4000;
2262
}
2263

2264
static void ehci_work_bh(void *opaque)
2265
{
2266
    EHCIState *ehci = opaque;
2267
    int need_timer = 0;
2268
    int64_t expire_time, t_now;
2269
    uint64_t ns_elapsed;
2270
    uint64_t uframes, skipped_uframes;
2271
    int i;
2272

2273
    if (ehci->working) {
2274
        return;
2275
    }
2276
    ehci->working = true;
2277

2278
    t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2279
    ns_elapsed = t_now - ehci->last_run_ns;
2280
    uframes = ns_elapsed / UFRAME_TIMER_NS;
2281

2282
    if (ehci_periodic_enabled(ehci) || ehci->pstate != EST_INACTIVE) {
2283
        need_timer++;
2284

2285
        if (uframes > (ehci->maxframes * 8)) {
2286
            skipped_uframes = uframes - (ehci->maxframes * 8);
2287
            ehci_update_frindex(ehci, skipped_uframes);
2288
            ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
2289
            uframes -= skipped_uframes;
2290
            DPRINTF("WARNING - EHCI skipped %d uframes\n", skipped_uframes);
2291
        }
2292

2293
        for (i = 0; i < uframes; i++) {
2294
            /*
2295
             * If we're running behind schedule, we should not catch up
2296
             * too fast, as that will make some guests unhappy:
2297
             * 1) We must process a minimum of MIN_UFR_PER_TICK frames,
2298
             *    otherwise we will never catch up
2299
             * 2) Process frames until the guest has requested an irq (IOC)
2300
             */
2301
            if (i >= MIN_UFR_PER_TICK) {
2302
                ehci_commit_irq(ehci);
2303
                if ((ehci->usbsts & USBINTR_MASK) & ehci->usbintr) {
2304
                    break;
2305
                }
2306
            }
2307
            if (ehci->periodic_sched_active) {
2308
                ehci->periodic_sched_active--;
2309
            }
2310
            ehci_update_frindex(ehci, 1);
2311
            if ((ehci->frindex & 7) == 0) {
2312
                ehci_advance_periodic_state(ehci);
2313
            }
2314
            ehci->last_run_ns += UFRAME_TIMER_NS;
2315
        }
2316
    } else {
2317
        ehci->periodic_sched_active = 0;
2318
        ehci_update_frindex(ehci, uframes);
2319
        ehci->last_run_ns += UFRAME_TIMER_NS * uframes;
2320
    }
2321

2322
    if (ehci->periodic_sched_active) {
2323
        ehci->async_stepdown = 0;
2324
    } else if (ehci->async_stepdown < ehci->maxframes / 2) {
2325
        ehci->async_stepdown++;
2326
    }
2327

2328
    /*  Async is not inside loop since it executes everything it can once
2329
     *  called
2330
     */
2331
    if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
2332
        need_timer++;
2333
        ehci_advance_async_state(ehci);
2334
    }
2335

2336
    ehci_commit_irq(ehci);
2337
    if (ehci->usbsts_pending) {
2338
        need_timer++;
2339
        ehci->async_stepdown = 0;
2340
    }
2341

2342
    if (ehci_enabled(ehci) && (ehci->usbintr & USBSTS_FLR)) {
2343
        need_timer++;
2344
    }
2345

2346
    if (need_timer) {
2347
        /* If we've raised int, we speed up the timer, so that we quickly
2348
         * notice any new packets queued up in response */
2349
        if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
2350
            expire_time = t_now +
2351
                NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
2352
            ehci->int_req_by_async = false;
2353
        } else {
2354
            expire_time = t_now + (NANOSECONDS_PER_SECOND
2355
                               * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
2356
        }
2357
        timer_mod(ehci->frame_timer, expire_time);
2358
    }
2359

2360
    ehci->working = false;
2361
}
2362

2363
static void ehci_work_timer(void *opaque)
2364
{
2365
    EHCIState *ehci = opaque;
2366

2367
    qemu_bh_schedule(ehci->async_bh);
2368
}
2369

2370
static const MemoryRegionOps ehci_mmio_caps_ops = {
2371
    .read = ehci_caps_read,
2372
    .write = ehci_caps_write,
2373
    .valid.min_access_size = 1,
2374
    .valid.max_access_size = 4,
2375
    .impl.min_access_size = 1,
2376
    .impl.max_access_size = 1,
2377
    .endianness = DEVICE_LITTLE_ENDIAN,
2378
};
2379

2380
static const MemoryRegionOps ehci_mmio_opreg_ops = {
2381
    .read = ehci_opreg_read,
2382
    .write = ehci_opreg_write,
2383
    .valid.min_access_size = 4,
2384
    .valid.max_access_size = 4,
2385
    .endianness = DEVICE_LITTLE_ENDIAN,
2386
};
2387

2388
static const MemoryRegionOps ehci_mmio_port_ops = {
2389
    .read = ehci_port_read,
2390
    .write = ehci_port_write,
2391
    .valid.min_access_size = 4,
2392
    .valid.max_access_size = 4,
2393
    .endianness = DEVICE_LITTLE_ENDIAN,
2394
};
2395

2396
static USBPortOps ehci_port_ops = {
2397
    .attach = ehci_attach,
2398
    .detach = ehci_detach,
2399
    .child_detach = ehci_child_detach,
2400
    .wakeup = ehci_wakeup,
2401
    .complete = ehci_async_complete_packet,
2402
};
2403

2404
static USBBusOps ehci_bus_ops_companion = {
2405
    .register_companion = ehci_register_companion,
2406
    .wakeup_endpoint = ehci_wakeup_endpoint,
2407
};
2408
static USBBusOps ehci_bus_ops_standalone = {
2409
    .wakeup_endpoint = ehci_wakeup_endpoint,
2410
};
2411

2412
static int usb_ehci_pre_save(void *opaque)
2413
{
2414
    EHCIState *ehci = opaque;
2415
    uint32_t new_frindex;
2416

2417
    /* Round down frindex to a multiple of 8 for migration compatibility */
2418
    new_frindex = ehci->frindex & ~7;
2419
    ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
2420
    ehci->frindex = new_frindex;
2421

2422
    return 0;
2423
}
2424

2425
static int usb_ehci_post_load(void *opaque, int version_id)
2426
{
2427
    EHCIState *s = opaque;
2428
    int i;
2429

2430
    for (i = 0; i < EHCI_PORTS; i++) {
2431
        USBPort *companion = s->companion_ports[i];
2432
        if (companion == NULL) {
2433
            continue;
2434
        }
2435
        if (s->portsc[i] & PORTSC_POWNER) {
2436
            companion->dev = s->ports[i].dev;
2437
        } else {
2438
            companion->dev = NULL;
2439
        }
2440
    }
2441

2442
    return 0;
2443
}
2444

2445
static void usb_ehci_vm_state_change(void *opaque, bool running, RunState state)
2446
{
2447
    EHCIState *ehci = opaque;
2448

2449
    /*
2450
     * We don't migrate the EHCIQueue-s, instead we rebuild them for the
2451
     * schedule in guest memory. We must do the rebuilt ASAP, so that
2452
     * USB-devices which have async handled packages have a packet in the
2453
     * ep queue to match the completion with.
2454
     */
2455
    if (running) {
2456
        ehci_advance_async_state(ehci);
2457
    }
2458

2459
    /*
2460
     * The schedule rebuilt from guest memory could cause the migration dest
2461
     * to miss a QH unlink, and fail to cancel packets, since the unlinked QH
2462
     * will never have existed on the destination. Therefore we must flush the
2463
     * async schedule on savevm to catch any not yet noticed unlinks.
2464
     */
2465
    if (state == RUN_STATE_SAVE_VM) {
2466
        ehci_advance_async_state(ehci);
2467
        ehci_queues_rip_unseen(ehci, 1);
2468
    }
2469
}
2470

2471
const VMStateDescription vmstate_ehci = {
2472
    .name        = "ehci-core",
2473
    .version_id  = 2,
2474
    .minimum_version_id  = 1,
2475
    .pre_save    = usb_ehci_pre_save,
2476
    .post_load   = usb_ehci_post_load,
2477
    .fields = (const VMStateField[]) {
2478
        /* mmio registers */
2479
        VMSTATE_UINT32(usbcmd, EHCIState),
2480
        VMSTATE_UINT32(usbsts, EHCIState),
2481
        VMSTATE_UINT32_V(usbsts_pending, EHCIState, 2),
2482
        VMSTATE_UINT32_V(usbsts_frindex, EHCIState, 2),
2483
        VMSTATE_UINT32(usbintr, EHCIState),
2484
        VMSTATE_UINT32(frindex, EHCIState),
2485
        VMSTATE_UINT32(ctrldssegment, EHCIState),
2486
        VMSTATE_UINT32(periodiclistbase, EHCIState),
2487
        VMSTATE_UINT32(asynclistaddr, EHCIState),
2488
        VMSTATE_UINT32(configflag, EHCIState),
2489
        VMSTATE_UINT32(portsc[0], EHCIState),
2490
        VMSTATE_UINT32(portsc[1], EHCIState),
2491
        VMSTATE_UINT32(portsc[2], EHCIState),
2492
        VMSTATE_UINT32(portsc[3], EHCIState),
2493
        VMSTATE_UINT32(portsc[4], EHCIState),
2494
        VMSTATE_UINT32(portsc[5], EHCIState),
2495
        /* frame timer */
2496
        VMSTATE_TIMER_PTR(frame_timer, EHCIState),
2497
        VMSTATE_UINT64(last_run_ns, EHCIState),
2498
        VMSTATE_UINT32(async_stepdown, EHCIState),
2499
        /* schedule state */
2500
        VMSTATE_UINT32(astate, EHCIState),
2501
        VMSTATE_UINT32(pstate, EHCIState),
2502
        VMSTATE_UINT32(a_fetch_addr, EHCIState),
2503
        VMSTATE_UINT32(p_fetch_addr, EHCIState),
2504
        VMSTATE_END_OF_LIST()
2505
    }
2506
};
2507

2508
void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
2509
{
2510
    int i;
2511

2512
    if (s->portnr > EHCI_PORTS) {
2513
        error_setg(errp, "Too many ports! Max. port number is %d.",
2514
                   EHCI_PORTS);
2515
        return;
2516
    }
2517
    if (s->maxframes < 8 || s->maxframes > 512)  {
2518
        error_setg(errp, "maxframes %d out if range (8 .. 512)",
2519
                   s->maxframes);
2520
        return;
2521
    }
2522

2523
    memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
2524
    memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
2525
    memory_region_add_subregion(&s->mem, s->opregbase + s->portscbase,
2526
                                &s->mem_ports);
2527

2528
    usb_bus_new(&s->bus, sizeof(s->bus), s->companion_enable ?
2529
                &ehci_bus_ops_companion : &ehci_bus_ops_standalone, dev);
2530
    for (i = 0; i < s->portnr; i++) {
2531
        usb_register_port(&s->bus, &s->ports[i], s, i, &ehci_port_ops,
2532
                          USB_SPEED_MASK_HIGH);
2533
        s->ports[i].dev = 0;
2534
    }
2535

2536
    s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ehci_work_timer, s);
2537
    s->async_bh = qemu_bh_new_guarded(ehci_work_bh, s,
2538
                                      &dev->mem_reentrancy_guard);
2539
    s->device = dev;
2540

2541
    s->vmstate = qemu_add_vm_change_state_handler(usb_ehci_vm_state_change, s);
2542
}
2543

2544
void usb_ehci_unrealize(EHCIState *s, DeviceState *dev)
2545
{
2546
    trace_usb_ehci_unrealize();
2547

2548
    if (s->frame_timer) {
2549
        timer_free(s->frame_timer);
2550
        s->frame_timer = NULL;
2551
    }
2552
    if (s->async_bh) {
2553
        qemu_bh_delete(s->async_bh);
2554
    }
2555

2556
    ehci_queues_rip_all(s, 0);
2557
    ehci_queues_rip_all(s, 1);
2558

2559
    memory_region_del_subregion(&s->mem, &s->mem_caps);
2560
    memory_region_del_subregion(&s->mem, &s->mem_opreg);
2561
    memory_region_del_subregion(&s->mem, &s->mem_ports);
2562

2563
    usb_bus_release(&s->bus);
2564

2565
    if (s->vmstate) {
2566
        qemu_del_vm_change_state_handler(s->vmstate);
2567
    }
2568
}
2569

2570
void usb_ehci_init(EHCIState *s, DeviceState *dev)
2571
{
2572
    /* 2.2 host controller interface version */
2573
    s->caps[0x00] = (uint8_t)(s->opregbase - s->capsbase);
2574
    s->caps[0x01] = 0x00;
2575
    s->caps[0x02] = 0x00;
2576
    s->caps[0x03] = 0x01;        /* HC version */
2577
    s->caps[0x04] = s->portnr;   /* Number of downstream ports */
2578
    s->caps[0x05] = 0x00;        /* No companion ports at present */
2579
    s->caps[0x06] = 0x00;
2580
    s->caps[0x07] = 0x00;
2581
    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
2582
    s->caps[0x0a] = 0x00;
2583
    s->caps[0x0b] = 0x00;
2584

2585
    QTAILQ_INIT(&s->aqueues);
2586
    QTAILQ_INIT(&s->pqueues);
2587
    usb_packet_init(&s->ipacket);
2588

2589
    memory_region_init(&s->mem, OBJECT(dev), "ehci", MMIO_SIZE);
2590
    memory_region_init_io(&s->mem_caps, OBJECT(dev), &ehci_mmio_caps_ops, s,
2591
                          "capabilities", CAPA_SIZE);
2592
    memory_region_init_io(&s->mem_opreg, OBJECT(dev), &ehci_mmio_opreg_ops, s,
2593
                          "operational", s->portscbase);
2594
    memory_region_init_io(&s->mem_ports, OBJECT(dev), &ehci_mmio_port_ops, s,
2595
                          "ports", 4 * s->portnr);
2596
}
2597

2598
void usb_ehci_finalize(EHCIState *s)
2599
{
2600
    usb_packet_cleanup(&s->ipacket);
2601
}
2602

2603
/*
2604
 * vim: expandtab ts=4
2605
 */
2606