21dda465fc
* Run docker probe only if docker or podman are available
The docker probe uses "sudo -n" which can cause an e-mail with a security warning
each time when configure is run. Therefore run docker probe only if either docker
or podman are available.
That avoids the problematic "sudo -n" on build environments which have neither
docker nor podman installed.
Fixes: c4575b59155e2e00 ("configure: store container engine in config-host.mak")
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20221030083510.310584-1-sw@weilnetz.de>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20221117172532.538149-2-alex.bennee@linaro.org>
* tests/avocado/machine_aspeed.py: Reduce noise on the console for SDK tests
The Aspeed SDK images are based on OpenBMC which starts a lot of
services. The output noise on the console can break from time to time
the test waiting for the logging prompt.
Change the U-Boot bootargs variable to add "quiet" to the kernel
command line and reduce the output volume. This also drops the test on
the CPU id which was nice to have but not essential.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20221104075347.370503-1-clg@kaod.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20221117172532.538149-3-alex.bennee@linaro.org>
* tests/docker: allow user to override check target
This is useful when trying to bisect a particular failing test behind
a docker run. For example:
make docker-test-clang@fedora \
TARGET_LIST=arm-softmmu \
TEST_COMMAND="meson test qtest-arm/qos-test" \
J=9 V=1
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-4-alex.bennee@linaro.org>
* docs/devel: add a maintainers section to development process
We don't currently have a clear place in the documentation to describe
the roles and responsibilities of a maintainer. Lets create one so we
can. I've moved a few small bits out of other files to try and keep
everything in one place.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-5-alex.bennee@linaro.org>
* docs/devel: make language a little less code centric
We welcome all sorts of patches.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-6-alex.bennee@linaro.org>
* docs/devel: simplify the minimal checklist
The bullet points are quite long and contain process tips. Move those
bits of the bullet to the relevant sections and link to them. Use a
table for nicer formatting of the checklist.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-7-alex.bennee@linaro.org>
* docs/devel: try and improve the language around patch review
It is important that contributors take the review process seriously
and we collaborate in a respectful way while avoiding personal
attacks. Try and make this clear in the language.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-8-alex.bennee@linaro.org>
* tests/avocado: Raise timeout for boot_linux.py:BootLinuxPPC64.test_pseries_tcg
On my machine, a debug build of QEMU takes about 260 seconds to
complete this test, so with the current timeout value of 180 seconds
it always times out. Double the timeout value to 360 so the test
definitely has enough time to complete.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20221110142901.3832318-1-peter.maydell@linaro.org>
Message-Id: <20221117172532.538149-9-alex.bennee@linaro.org>
* tests/avocado: introduce alpine virt test for CI
The boot_linux tests download and run a full cloud image boot and
start a full distro. While the ability to test the full boot chain is
worthwhile it is perhaps a little too heavy weight and causes issues
in CI. Fix this by introducing a new alpine linux ISO boot in
machine_aarch64_virt.
This boots a fully loaded -cpu max with all the bells and whistles in
31s on my machine. A full debug build takes around 180s on my machine
so we set a more generous timeout to cover that.
We don't add a test for lesser GIC versions although there is some
coverage for that already in the boot_xen.py tests. If we want to
introduce more comprehensive testing we can do it with a custom kernel
and initrd rather than a full distro boot.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-10-alex.bennee@linaro.org>
* tests/avocado: skip aarch64 cloud TCG tests in CI
We now have a much lighter weight test in machine_aarch64_virt which
tests the full boot chain in less time. Rename the tests while we are
at it to make it clear it is a Fedora cloud image.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221117172532.538149-11-alex.bennee@linaro.org>
* gitlab: integrate coverage report
This should hopefully give is nice coverage information about what our
tests (or at least the subset we are running) have hit. Ideally we
would want a way to trigger coverage on tests likely to be affected by
the current commit.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221117172532.538149-12-alex.bennee@linaro.org>
* vhost: mask VIRTIO_F_RING_RESET for vhost and vhost-user devices
Commit 69e1c14aa2 ("virtio: core: vq reset feature negotation support")
enabled VIRTIO_F_RING_RESET by default for all virtio devices.
This feature is not currently emulated by QEMU, so for vhost and
vhost-user devices we need to make sure it is supported by the offloaded
device emulation (in-kernel or in another process).
To do this we need to add VIRTIO_F_RING_RESET to the features bitmap
passed to vhost_get_features(). This way it will be masked if the device
does not support it.
This issue was initially discovered with vhost-vsock and vhost-user-vsock,
and then also tested with vhost-user-rng which confirmed the same issue.
They fail when sending features through VHOST_SET_FEATURES ioctl or
VHOST_USER_SET_FEATURES message, since VIRTIO_F_RING_RESET is negotiated
by the guest (Linux >= v6.0), but not supported by the device.
Fixes: 69e1c14aa2 ("virtio: core: vq reset feature negotation support")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1318
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-Id: <20221121101101.29400-1-sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
* tests: acpi: whitelist DSDT before moving PRQx to _SB scope
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20221121153613.3972225-2-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi: x86: move RPQx field back to _SB scope
Commit 47a373faa6b2 (acpi: pc/q35: drop ad-hoc PCI-ISA bridge AML routines and let bus ennumeration generate AML)
moved ISA bridge AML generation to respective devices and was using
aml_alias() to provide PRQx fields in _SB. scope. However, it turned
out that SeaBIOS was not able to process Alias opcode when parsing DSDT,
resulting in lack of keyboard during boot (SeaBIOS console, grub, FreeDOS).
While fix for SeaBIOS is posted
https://mail.coreboot.org/hyperkitty/list/seabios@seabios.org/thread/RGPL7HESH5U5JRLEO6FP77CZVHZK5J65/
fixed SeaBIOS might not make into QEMU-7.2 in time.
Hence this workaround that puts PRQx back into _SB scope
and gets rid of aliases in ISA bridge description, so
DSDT will be parsable by broken SeaBIOS.
That brings back hardcoded references to ISA bridge
PCI0.S08.P40C/PCI0.SF8.PIRQ
where middle part now is auto generated based on slot it's
plugged in, but it should be fine as bridge initialization
also hardcodes PCI address of the bridge so it can't ever
move. Once QEMU tree has fixed SeaBIOS blob, we should be able
to drop this part and revert back to alias based approach
Reported-by: Volker Rümelin <vr_qemu@t-online.de>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20221121153613.3972225-3-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* tests: acpi: x86: update expected DSDT after moving PRQx fields in _SB scope
Expected DSDT changes,
pc:
- Field (P40C, ByteAcc, NoLock, Preserve)
+ Scope (\_SB)
{
- PRQ0, 8,
- PRQ1, 8,
- PRQ2, 8,
- PRQ3, 8
+ Field (PCI0.S08.P40C, ByteAcc, NoLock, Preserve)
+ {
+ PRQ0, 8,
+ PRQ1, 8,
+ PRQ2, 8,
+ PRQ3, 8
+ }
}
- Alias (PRQ0, \_SB.PRQ0)
- Alias (PRQ1, \_SB.PRQ1)
- Alias (PRQ2, \_SB.PRQ2)
- Alias (PRQ3, \_SB.PRQ3)
q35:
- Field (PIRQ, ByteAcc, NoLock, Preserve)
- {
- PRQA, 8,
- PRQB, 8,
- PRQC, 8,
- PRQD, 8,
- Offset (0x08),
- PRQE, 8,
- PRQF, 8,
- PRQG, 8,
- PRQH, 8
+ Scope (\_SB)
+ {
+ Field (PCI0.SF8.PIRQ, ByteAcc, NoLock, Preserve)
+ {
+ PRQA, 8,
+ PRQB, 8,
+ PRQC, 8,
+ PRQD, 8,
+ Offset (0x08),
+ PRQE, 8,
+ PRQF, 8,
+ PRQG, 8,
+ PRQH, 8
+ }
}
- Alias (PRQA, \_SB.PRQA)
- Alias (PRQB, \_SB.PRQB)
- Alias (PRQC, \_SB.PRQC)
- Alias (PRQD, \_SB.PRQD)
- Alias (PRQE, \_SB.PRQE)
- Alias (PRQF, \_SB.PRQF)
- Alias (PRQG, \_SB.PRQG)
- Alias (PRQH, \_SB.PRQH)
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20221121153613.3972225-4-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* MAINTAINERS: add mst to list of biosbits maintainers
Adding Michael's name to the list of bios bits maintainers so that all changes
and fixes into biosbits framework can go through his tree and he is notified.
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Ani Sinha <ani@anisinha.ca>
Message-Id: <20221111151138.36988-1-ani@anisinha.ca>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* tests/avocado: configure acpi-bits to use avocado timeout
Instead of using a hardcoded timeout, just rely on Avocado's built-in
test case timeout. This helps avoid timeout issues on machines where 60
seconds is not sufficient.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-Id: <20221115212759.3095751-1-jsnow@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Ani Sinha <ani@anisinha.ca>
* acpi/tests/avocado/bits: keep the work directory when BITS_DEBUG is set in env
Debugging bits issue often involves running the QEMU command line manually
outside of the avocado environment with the generated ISO. Hence, its
inconvenient if the iso gets cleaned up after the test has finished. This change
makes sure that the work directory is kept after the test finishes if the test
is run with BITS_DEBUG=1 in the environment so that the iso is available for use
with the QEMU command line.
CC: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Ani Sinha <ani@anisinha.ca>
Message-Id: <20221117113630.543495-1-ani@anisinha.ca>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: disable error for out of spec queue-enable
Virtio 1.0 is pretty clear that features have to be
negotiated before enabling VQs. Unfortunately Seabios
ignored this ever since gaining 1.0 support (UEFI is ok).
Comment the error out for now, and add a TODO.
Fixes: 3c37f8b8d1 ("virtio: introduce virtio_queue_enable()")
Cc: "Kangjie Xu" <kangjie.xu@linux.alibaba.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221121200339.362452-1-mst@redhat.com>
* hw/loongarch: Add default stdout uart in fdt
Add "chosen" subnode into LoongArch fdt, and set it's
"stdout-path" prop to uart node.
Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221115114923.3372414-1-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
* hw/loongarch: Fix setprop_sized method in fdt rtc node.
Fix setprop_sized method in fdt rtc node.
Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221116040300.3459818-1-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
* hw/loongarch: Replace the value of uart info with macro
Using macro to replace the value of uart info such as addr, size
in acpi_build method.
Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20221115115008.3372489-1-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
* target/arm: Don't do two-stage lookup if stage 2 is disabled
In get_phys_addr_with_struct(), we call get_phys_addr_twostage() if
the CPU supports EL2. However, we don't check here that stage 2 is
actually enabled. Instead we only check that inside
get_phys_addr_twostage() to skip stage 2 translation. This means
that even if stage 2 is disabled we still tell the stage 1 lookup to
do its page table walks via stage 2.
This works by luck for normal CPU accesses, but it breaks for debug
accesses, which are used by the disassembler and also by semihosting
file reads and writes, because the debug case takes a different code
path inside S1_ptw_translate().
This means that setups that use semihosting for file loads are broken
(a regression since 7.1, introduced in recent ptw refactoring), and
that sometimes disassembly in debug logs reports "unable to read
memory" rather than showing the guest insns.
Fix the bug by hoisting the "is stage 2 enabled?" check up to
get_phys_addr_with_struct(), so that we handle S2 disabled the same
way we do the "no EL2" case, with a simple single stage lookup.
Reported-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221121212404.1450382-1-peter.maydell@linaro.org
* target/arm: Use signed quantity to represent VMSAv8-64 translation level
The LPA2 extension implements 52-bit virtual addressing for 4k and 16k
translation granules, and for the former, this means an additional level
of translation is needed. This means we start counting at -1 instead of
0 when doing a walk, and so 'level' is now a signed quantity, and should
be typed as such. So turn it from uint32_t into int32_t.
This avoids a level of -1 getting misinterpreted as being >= 3, and
terminating a page table walk prematurely with a bogus output address.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Update VERSION for v7.2.0-rc2
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/avocado: Update the URLs of the advent calendar images
The qemu-advent-calendar.org server will be decommissioned soon.
I've mirrored the images that we use for the QEMU CI to gitlab,
so update their URLs to point to the new location.
Message-Id: <20221121102436.78635-1-thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest: Decrease the amount of output from the qom-test
The logs in the gitlab-CI have a size constraint, and sometimes
we already hit this limit. The biggest part of the log then seems
to be filled by the qom-test, so we should decrease the size of
the output - which can be done easily by not printing the path
for each property, since the path has already been logged at the
beginning of each node that we handle here.
However, if we omit the path, we should make sure to not recurse
into child nodes in between, so that it is clear to which node
each property belongs. Thus store the children and links in a
temporary list and recurse only at the end of each node, when
all properties have already been printed.
Message-Id: <20221121194240.149268-1-thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/avocado: use new rootfs for orangepi test
The old URL wasn't stable. I suspect the current URL will only be
stable for a few months so maybe we need another strategy for hosting
rootfs snapshots?
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20221118113309.1057790-1-alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* Revert "usbredir: avoid queuing hello packet on snapshot restore"
Run state is also in RUN_STATE_PRELAUNCH while "-S" is used.
This reverts commit 0631d4b448454ae8a1ab091c447e3f71ab6e088a
Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
The original commit broke the usage of usbredir with libvirt, which
starts every domain with "-S".
This workaround is no longer needed because the usbredir behavior
has been fixed in the meantime:
https://gitlab.freedesktop.org/spice/usbredir/-/merge_requests/61
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Message-Id: <1689cec3eadcea87255e390cb236033aca72e168.1669193161.git.jtomko@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* gtk: disable GTK Clipboard with a new meson option
The GTK Clipboard implementation may cause guest hangs.
Therefore implement new configure switch: --enable-gtk-clipboard,
as a meson option disabled by default, which warns in the help
text about the experimental nature of the feature.
Regenerate the meson build options to include it.
The initialization of the clipboard is gtk.c, as well as the
compilation of gtk-clipboard.c are now conditional on this new
option to be set.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1150
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
Message-Id: <20221121135538.14625-1-cfontana@suse.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/usb/hcd-xhci.c: spelling: tranfer
Fixes: effaf5a240e03020f4ae953e10b764622c3e87cc
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20221105114851.306206-1-mjt@msgid.tls.msk.ru>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ui/gtk: prevent ui lock up when dpy_gl_update called again before current draw event occurs
A warning, "qemu: warning: console: no gl-unblock within" followed by
guest scanout lockup can happen if dpy_gl_update is called in a row
and the second call is made before gd_draw_event scheduled by the first
call is taking place. This is because draw call returns without decrementing
gl_block ref count if the dmabuf was already submitted as shown below.
(gd_gl_area_draw/gd_egl_draw)
if (dmabuf) {
if (!dmabuf->draw_submitted) {
return;
} else {
dmabuf->draw_submitted = false;
}
}
So it should not schedule any redundant draw event in case draw_submitted is
already set in gd_egl_fluch/gd_gl_area_scanout_flush.
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20221021192315.9110-1-dongwon.kim@intel.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/usb/hcd-xhci: Reset the XHCIState with device_cold_reset()
Currently the hcd-xhci-pci and hcd-xhci-sysbus devices, which are
mostly wrappers around the TYPE_XHCI device, which is a direct
subclass of TYPE_DEVICE. Since TYPE_DEVICE devices are not on any
qbus and do not get automatically reset, the wrapper devices both
reset the TYPE_XHCI device in their own reset functions. However,
they do this using device_legacy_reset(), which will reset the device
itself but not any bus it has.
Switch to device_cold_reset(), which avoids using a deprecated
function and also propagates reset along any child buses.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20221014145423.2102706-1-peter.maydell@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/audio/intel-hda: don't reset codecs twice
Currently the intel-hda device has a reset method which manually
resets all the codecs by calling device_legacy_reset() on them. This
means they get reset twice, once because child devices on a qbus get
reset before the parent device's reset method is called, and then
again because we're manually resetting them.
Drop the manual reset call, and ensure that codecs are still reset
when the guest does a reset via ICH6_GCTL_RESET by using
device_cold_reset() (which resets all the devices on the qbus as well
as the device itself) instead of a direct call to the reset function.
This is a slight ordering change because the (only) codec reset now
happens before the controller registers etc are reset, rather than
once before and then once after, but the codec reset function
hda_audio_reset() doesn't care.
This lets us drop a use of device_legacy_reset(), which is
deprecated.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221014142632.2092404-2-peter.maydell@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/audio/intel-hda: Drop unnecessary prototype
The only use of intel_hda_reset() is after its definition, so we
don't need to separately declare its prototype at the top of the
file; drop the unnecessary line.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221014142632.2092404-3-peter.maydell@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* add syx snapshot extras
* it compiles!
* virtiofsd: Add `sigreturn` to the seccomp whitelist
The virtiofsd currently crashes on s390x. This is because of a
`sigreturn` system call. See audit log below:
type=SECCOMP msg=audit(1669382477.611:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 pid=6649 comm="virtiofsd" exe="/usr/libexec/virtiofsd" sig=31 arch=80000016 syscall=119 compat=0 ip=0x3fff15f748a code=0x80000000AUID="unset" UID="root" GID="root" ARCH=s390x SYSCALL=sigreturn
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: German Maglione <gmaglione@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221125143946.27717-1-mhartmay@linux.ibm.com>
* libvhost-user: Fix wrong type of argument to formatting function (reported by LGTM)
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-Id: <20220422070144.1043697-2-sw@weilnetz.de>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-2-sw@weilnetz.de>
* libvhost-user: Fix format strings
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220422070144.1043697-3-sw@weilnetz.de>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-3-sw@weilnetz.de>
* libvhost-user: Fix two more format strings
This fix is required for 32 bit hosts. The bug was detected by CI
for arm-linux, but is also relevant for i386-linux.
Reported-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-4-sw@weilnetz.de>
* libvhost-user: Add format attribute to local function vu_panic
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220422070144.1043697-4-sw@weilnetz.de>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-5-sw@weilnetz.de>
* MAINTAINERS: Add subprojects/libvhost-user to section "vhost"
Signed-off-by: Stefan Weil <sw@weilnetz.de>
[Michael agreed to act as maintainer for libvhost-user via email in
https://lore.kernel.org/qemu-devel/20221123015218-mutt-send-email-mst@kernel.org/.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-6-sw@weilnetz.de>
* Add G_GNUC_PRINTF to function qemu_set_info_str and fix related issues
With the G_GNUC_PRINTF function attribute the compiler detects
two potential insecure format strings:
../../../net/stream.c:248:31: warning: format string is not a string literal (potentially insecure) [-Wformat-security]
qemu_set_info_str(&s->nc, uri);
^~~
../../../net/stream.c:322:31: warning: format string is not a string literal (potentially insecure) [-Wformat-security]
qemu_set_info_str(&s->nc, uri);
^~~
There are also two other warnings:
../../../net/socket.c:182:35: warning: zero-length gnu_printf format string [-Wformat-zero-length]
182 | qemu_set_info_str(&s->nc, "");
| ^~
../../../net/stream.c:170:35: warning: zero-length gnu_printf format string [-Wformat-zero-length]
170 | qemu_set_info_str(&s->nc, "");
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221126152507.283271-7-sw@weilnetz.de>
* del ramfile
* update seabios source from 1.16.0 to 1.16.1
git shortlog rel-1.16.0..rel-1.16.1
===================================
Gerd Hoffmann (3):
malloc: use variable for ZoneHigh size
malloc: use large ZoneHigh when there is enough memory
virtio-blk: use larger default request size
Igor Mammedov (1):
acpi: parse Alias object
Volker Rümelin (2):
pci: refactor the pci_config_*() functions
reset: force standard PCI configuration access
Xiaofei Lee (1):
virtio-blk: Fix incorrect type conversion in virtio_blk_op()
Xuan Zhuo (2):
virtio-mmio: read/write the hi 32 features for mmio
virtio: finalize features before using device
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* update seabios binaries to 1.16.1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* fix for non i386 archs
* replay: Fix declaration of replay_read_next_clock
Fixes the build with gcc 13:
replay/replay-time.c:34:6: error: conflicting types for \
'replay_read_next_clock' due to enum/integer mismatch; \
have 'void(ReplayClockKind)' [-Werror=enum-int-mismatch]
34 | void replay_read_next_clock(ReplayClockKind kind)
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from ../qemu/replay/replay-time.c:14:
replay/replay-internal.h:139:6: note: previous declaration of \
'replay_read_next_clock' with type 'void(unsigned int)'
139 | void replay_read_next_clock(unsigned int kind);
| ^~~~~~~~~~~~~~~~~~~~~~
Fixes: 8eda206e090 ("replay: recording and replaying clock ticks")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221129010547.284051-1-richard.henderson@linaro.org>
* hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler
Only 3 command types are logged: no need to call qxl_phys2virt()
for the other types. Using different cases will help to pass
different structure sizes to qxl_phys2virt() in a pair of commits.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-2-philmd@linaro.org>
* hw/display/qxl: Document qxl_phys2virt()
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-3-philmd@linaro.org>
* hw/display/qxl: Pass requested buffer size to qxl_phys2virt()
Currently qxl_phys2virt() doesn't check for buffer overrun.
In order to do so in the next commit, pass the buffer size
as argument.
For QXLCursor in qxl_render_cursor() -> qxl_cursor() we
verify the size of the chunked data ahead, checking we can
access 'sizeof(QXLCursor) + chunk->data_size' bytes.
Since in the SPICE_CURSOR_TYPE_MONO case the cursor is
assumed to fit in one chunk, no change are required.
In SPICE_CURSOR_TYPE_ALPHA the ahead read is handled in
qxl_unpack_chunks().
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-4-philmd@linaro.org>
* hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144)
Have qxl_get_check_slot_offset() return false if the requested
buffer size does not fit within the slot memory region.
Similarly qxl_phys2virt() now returns NULL in such case, and
qxl_dirty_one_surface() aborts.
This avoids buffer overrun in the host pointer returned by
memory_region_get_ram_ptr().
Fixes: CVE-2022-4144 (out-of-bounds read)
Reported-by: Wenxu Yin (@awxylitol)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-5-philmd@linaro.org>
* hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221128202741.4945-6-philmd@linaro.org>
* block-backend: avoid bdrv_unregister_buf() NULL pointer deref
bdrv_*() APIs expect a valid BlockDriverState. Calling them with bs=NULL
leads to undefined behavior.
Jonathan Cameron reported this following NULL pointer dereference when a
VM with a virtio-blk device and a memory-backend-file object is
terminated:
1. qemu_cleanup() closes all drives, setting blk->root to NULL
2. qemu_cleanup() calls user_creatable_cleanup(), which results in a RAM
block notifier callback because the memory-backend-file is destroyed.
3. blk_unregister_buf() is called by virtio-blk's BlockRamRegistrar
notifier callback and undefined behavior occurs.
Fixes: baf422684d73 ("virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint")
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221121211923.1993171-1-stefanha@redhat.com>
* target/arm: Set TCGCPUOps.restore_state_to_opc for v7m
This setting got missed, breaking v7m.
Fixes: 56c6c98df85c ("target/arm: Convert to tcg_ops restore_state_to_opc")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1347
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Evgeny Ermakov <evgeny.v.ermakov@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221129204146.550394-1-richard.henderson@linaro.org>
* Update VERSION for v7.2.0-rc3
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* hooks are now post mem access
* tests/qtests: override "force-legacy" for gpio virtio-mmio tests
The GPIO device is a VIRTIO_F_VERSION_1 devices but running with a
legacy MMIO interface we miss out that feature bit causing confusion.
For the GPIO test force the mmio bus to support non-legacy so we can
properly test it.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1333
Message-Id: <20221130112439.2527228-2-alex.bennee@linaro.org>
Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* vhost: enable vrings in vhost_dev_start() for vhost-user devices
Commit 02b61f38d3 ("hw/virtio: incorporate backend features in features")
properly negotiates VHOST_USER_F_PROTOCOL_FEATURES with the vhost-user
backend, but we forgot to enable vrings as specified in
docs/interop/vhost-user.rst:
If ``VHOST_USER_F_PROTOCOL_FEATURES`` has not been negotiated, the
ring starts directly in the enabled state.
If ``VHOST_USER_F_PROTOCOL_FEATURES`` has been negotiated, the ring is
initialized in a disabled state and is enabled by
``VHOST_USER_SET_VRING_ENABLE`` with parameter 1.
Some vhost-user front-ends already did this by calling
vhost_ops.vhost_set_vring_enable() directly:
- backends/cryptodev-vhost.c
- hw/net/virtio-net.c
- hw/virtio/vhost-user-gpio.c
But most didn't do that, so we would leave the vrings disabled and some
backends would not work. We observed this issue with the rust version of
virtiofsd [1], which uses the event loop [2] provided by the
vhost-user-backend crate where requests are not processed if vring is
not enabled.
Let's fix this issue by enabling the vrings in vhost_dev_start() for
vhost-user front-ends that don't already do this directly. Same thing
also in vhost_dev_stop() where we disable vrings.
[1] https://gitlab.com/virtio-fs/virtiofsd
[2] https://github.com/rust-vmm/vhost/blob/240fc2966/crates/vhost-user-backend/src/event_loop.rs#L217
Fixes: 02b61f38d3 ("hw/virtio: incorporate backend features in features")
Reported-by: German Maglione <gmaglione@redhat.com>
Tested-by: German Maglione <gmaglione@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Message-Id: <20221123131630.52020-1-sgarzare@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221130112439.2527228-3-alex.bennee@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* hw/virtio: add started_vu status field to vhost-user-gpio
As per the fix to vhost-user-blk in f5b22d06fb (vhost: recheck dev
state in the vhost_migration_log routine) we really should track the
connection and starting separately.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221130112439.2527228-4-alex.bennee@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* hw/virtio: generalise CHR_EVENT_CLOSED handling
..and use for both virtio-user-blk and virtio-user-gpio. This avoids
the circular close by deferring shutdown due to disconnection until a
later point. virtio-user-blk already had this mechanism in place so
generalise it as a vhost-user helper function and use for both blk and
gpio devices.
While we are at it we also fix up vhost-user-gpio to re-establish the
event handler after close down so we can reconnect later.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Message-Id: <20221130112439.2527228-5-alex.bennee@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* include/hw: VM state takes precedence in virtio_device_should_start
The VM status should always preempt the device status for these
checks. This ensures the device is in the correct state when we
suspend the VM prior to migrations. This restores the checks to the
order they where in before the refactoring moved things around.
While we are at it lets improve our documentation of the various
fields involved and document the two functions.
Fixes: 9f6bcfd99f (hw/virtio: move vm_running check to virtio_device_started)
Fixes: 259d69c00b (hw/virtio: introduce virtio_device_should_start)
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20221130112439.2527228-6-alex.bennee@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* hw/nvme: fix aio cancel in format
There are several bugs in the async cancel code for the Format command.
Firstly, cancelling a format operation neglects to set iocb->ret as well
as clearing the iocb->aiocb after cancelling the underlying aiocb which
causes the aio callback to ignore the cancellation. Trivial fix.
Secondly, and worse, because the request is queued up for posting to the
CQ in a bottom half, if the cancellation is due to the submission queue
being deleted (which calls blk_aio_cancel), the req structure is
deallocated in nvme_del_sq prior to the bottom half being schedulued.
Fix this by simply removing the bottom half, there is no reason to defer
it anyway.
Fixes: 3bcf26d3d619 ("hw/nvme: reimplement format nvm to allow cancellation")
Reported-by: Jonathan Derrick <jonathan.derrick@linux.dev>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* hw/nvme: fix aio cancel in flush
Make sure that iocb->aiocb is NULL'ed when cancelling.
Fix a potential use-after-free by removing the bottom half and enqueuing
the completion directly.
Fixes: 38f4ac65ac88 ("hw/nvme: reimplement flush to allow cancellation")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* hw/nvme: fix aio cancel in zone reset
If the zone reset operation is cancelled but the block unmap operation
completes normally, the callback will continue resetting the next zone
since it neglects to check iocb->ret which will have been set to
-ECANCELED. Make sure that this is checked and bail out if an error is
present.
Secondly, fix a potential use-after-free by removing the bottom half and
enqueuing the completion directly.
Fixes: 63d96e4ffd71 ("hw/nvme: reimplement zone reset to allow cancellation")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* hw/nvme: fix aio cancel in dsm
When the DSM operation is cancelled asynchronously, we set iocb->ret to
-ECANCELED. However, the callback function only checks the return value
of the completed aio, which may have completed succesfully prior to the
cancellation and thus the callback ends up continuing the dsm operation
instead of bailing out. Fix this.
Secondly, fix a potential use-after-free by removing the bottom half and
enqueuing the completion directly.
Fixes: d7d1474fd85d ("hw/nvme: reimplement dsm to allow cancellation")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* hw/nvme: remove copy bh scheduling
Fix a potential use-after-free by removing the bottom half and enqueuing
the completion directly.
Fixes: 796d20681d9b ("hw/nvme: reimplement the copy command to allow aio cancellation")
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
* target/i386: allow MMX instructions with CR4.OSFXSR=0
MMX state is saved/restored by FSAVE/FRSTOR so the instructions are
not illegal opcodes even if CR4.OSFXSR=0. Make sure that validate_vex
takes into account the prefix and only checks HF_OSFXSR_MASK in the
presence of an SSE instruction.
Fixes: 20581aadec5e ("target/i386: validate VEX prefixes via the instructions' exception classes", 2022-10-18)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1350
Reported-by: Helge Konetzka (@hejko on gitlab.com)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Always completely initialize TranslateFault
In get_physical_address, the canonical address check failed to
set TranslateFault.stage2, which resulted in an uninitialized
read from the struct when reporting the fault in x86_cpu_tlb_fill.
Adjust all error paths to use structure assignment so that the
entire struct is always initialized.
Reported-by: Daniel Hoffman <dhoff749@gmail.com>
Fixes: 9bbcf372193a ("target/i386: Reorg GET_HPHYS")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20221201074522.178498-1-richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1324
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/loongarch/virt: Add cfi01 pflash device
Add cfi01 pflash device for LoongArch virt machine
Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221130100647.398565-1-yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
* Sync pc on breakpoints
* tests/qtest/migration-test: Fix unlink error and memory leaks
When running the migration test compiled with Clang from Fedora 37
and sanitizers enabled, there is an error complaining about unlink():
../tests/qtest/migration-test.c:1072:12: runtime error: null pointer
passed as argument 1, which is declared to never be null
/usr/include/unistd.h:858:48: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
../tests/qtest/migration-test.c:1072:12 in
(test program exited with status code 1)
TAP parsing error: Too few tests run (expected 33, got 20)
The data->clientcert and data->clientkey pointers can indeed be unset
in some tests, so we have to check them before calling unlink() with
those.
While we're at it, I also noticed that the code is only freeing
some but not all of the allocated strings in this function, and
indeed, valgrind is also complaining about memory leaks here.
So let's call g_free() on all allocated strings to avoid leaking
memory here.
Message-Id: <20221125083054.117504-1-thuth@redhat.com>
Tested-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* target/s390x/tcg: Fix and improve the SACF instruction
The SET ADDRESS SPACE CONTROL FAST instruction is not privileged, it can be
used from problem space, too. Just the switching to the home address space
is privileged and should still generate a privilege exception. This bug is
e.g. causing programs like Java that use the "getcpu" vdso kernel function
to crash (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990417#26 ).
While we're at it, also check if DAT is not enabled. In that case the
instruction is supposed to generate a special operation exception.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/655
Message-Id: <20221201184443.136355-1-thuth@redhat.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* hw/display/next-fb: Fix comment typo
Signed-off-by: Evgeny Ermakov <evgeny.v.ermakov@gmail.com>
Message-Id: <20221125160849.23711-1-evgeny.v.ermakov@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
* fix dev snapshots
* working syx snaps
* Revert "hw/loongarch/virt: Add cfi01 pflash device"
This reverts commit 14dccc8ea6ece7ee63273144fb55e4770a05e0fd.
Signed-off-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20221205113007.683505-1-gaosong@loongson.cn>
* Update VERSION for v7.2.0-rc4
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Ani Sinha <ani@anisinha.ca>
Signed-off-by: John Snow <jsnow@redhat.com>
Signed-off-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Evgeny Ermakov <evgeny.v.ermakov@gmail.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Co-authored-by: Stefan Weil <sw@weilnetz.de>
Co-authored-by: Cédric Le Goater <clg@kaod.org>
Co-authored-by: Alex Bennée <alex.bennee@linaro.org>
Co-authored-by: Peter Maydell <peter.maydell@linaro.org>
Co-authored-by: Stefano Garzarella <sgarzare@redhat.com>
Co-authored-by: Igor Mammedov <imammedo@redhat.com>
Co-authored-by: Ani Sinha <ani@anisinha.ca>
Co-authored-by: John Snow <jsnow@redhat.com>
Co-authored-by: Michael S. Tsirkin <mst@redhat.com>
Co-authored-by: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Co-authored-by: Stefan Hajnoczi <stefanha@redhat.com>
Co-authored-by: Ard Biesheuvel <ardb@kernel.org>
Co-authored-by: Thomas Huth <thuth@redhat.com>
Co-authored-by: Joelle van Dyne <j@getutm.app>
Co-authored-by: Claudio Fontana <cfontana@suse.de>
Co-authored-by: Michael Tokarev <mjt@tls.msk.ru>
Co-authored-by: Dongwon Kim <dongwon.kim@intel.com>
Co-authored-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Co-authored-by: Stefan Weil via <qemu-devel@nongnu.org>
Co-authored-by: Gerd Hoffmann <kraxel@redhat.com>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Co-authored-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Co-authored-by: Evgeny Ermakov <evgeny.v.ermakov@gmail.com>
Co-authored-by: Klaus Jensen <k.jensen@samsung.com>
Co-authored-by: Paolo Bonzini <pbonzini@redhat.com>
Co-authored-by: Song Gao <gaosong@loongson.cn>
3670 lines
107 KiB
C
3670 lines
107 KiB
C
/*
|
|
* USB xHCI controller emulation
|
|
*
|
|
* Copyright (c) 2011 Securiforest
|
|
* Date: 2011-05-11 ; Author: Hector Martin <hector@marcansoft.com>
|
|
* Based on usb-ohci.c, emulates Renesas NEC USB 3.0
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/timer.h"
|
|
#include "qemu/log.h"
|
|
#include "qemu/module.h"
|
|
#include "qemu/queue.h"
|
|
#include "migration/vmstate.h"
|
|
#include "hw/qdev-properties.h"
|
|
#include "trace.h"
|
|
#include "qapi/error.h"
|
|
|
|
#include "hcd-xhci.h"
|
|
|
|
//#define DEBUG_XHCI
|
|
//#define DEBUG_DATA
|
|
|
|
#ifdef DEBUG_XHCI
|
|
#define DPRINTF(...) fprintf(stderr, __VA_ARGS__)
|
|
#else
|
|
#define DPRINTF(...) do {} while (0)
|
|
#endif
|
|
#define FIXME(_msg) do { fprintf(stderr, "FIXME %s:%d %s\n", \
|
|
__func__, __LINE__, _msg); abort(); } while (0)
|
|
|
|
#define TRB_LINK_LIMIT 32
|
|
#define COMMAND_LIMIT 256
|
|
#define TRANSFER_LIMIT 256
|
|
|
|
#define LEN_CAP 0x40
|
|
#define LEN_OPER (0x400 + 0x10 * XHCI_MAXPORTS)
|
|
#define LEN_RUNTIME ((XHCI_MAXINTRS + 1) * 0x20)
|
|
#define LEN_DOORBELL ((XHCI_MAXSLOTS + 1) * 0x20)
|
|
|
|
#define OFF_OPER LEN_CAP
|
|
#define OFF_RUNTIME 0x1000
|
|
#define OFF_DOORBELL 0x2000
|
|
|
|
#if (OFF_OPER + LEN_OPER) > OFF_RUNTIME
|
|
#error Increase OFF_RUNTIME
|
|
#endif
|
|
#if (OFF_RUNTIME + LEN_RUNTIME) > OFF_DOORBELL
|
|
#error Increase OFF_DOORBELL
|
|
#endif
|
|
#if (OFF_DOORBELL + LEN_DOORBELL) > XHCI_LEN_REGS
|
|
# error Increase XHCI_LEN_REGS
|
|
#endif
|
|
|
|
/* bit definitions */
|
|
#define USBCMD_RS (1<<0)
|
|
#define USBCMD_HCRST (1<<1)
|
|
#define USBCMD_INTE (1<<2)
|
|
#define USBCMD_HSEE (1<<3)
|
|
#define USBCMD_LHCRST (1<<7)
|
|
#define USBCMD_CSS (1<<8)
|
|
#define USBCMD_CRS (1<<9)
|
|
#define USBCMD_EWE (1<<10)
|
|
#define USBCMD_EU3S (1<<11)
|
|
|
|
#define USBSTS_HCH (1<<0)
|
|
#define USBSTS_HSE (1<<2)
|
|
#define USBSTS_EINT (1<<3)
|
|
#define USBSTS_PCD (1<<4)
|
|
#define USBSTS_SSS (1<<8)
|
|
#define USBSTS_RSS (1<<9)
|
|
#define USBSTS_SRE (1<<10)
|
|
#define USBSTS_CNR (1<<11)
|
|
#define USBSTS_HCE (1<<12)
|
|
|
|
|
|
#define PORTSC_CCS (1<<0)
|
|
#define PORTSC_PED (1<<1)
|
|
#define PORTSC_OCA (1<<3)
|
|
#define PORTSC_PR (1<<4)
|
|
#define PORTSC_PLS_SHIFT 5
|
|
#define PORTSC_PLS_MASK 0xf
|
|
#define PORTSC_PP (1<<9)
|
|
#define PORTSC_SPEED_SHIFT 10
|
|
#define PORTSC_SPEED_MASK 0xf
|
|
#define PORTSC_SPEED_FULL (1<<10)
|
|
#define PORTSC_SPEED_LOW (2<<10)
|
|
#define PORTSC_SPEED_HIGH (3<<10)
|
|
#define PORTSC_SPEED_SUPER (4<<10)
|
|
#define PORTSC_PIC_SHIFT 14
|
|
#define PORTSC_PIC_MASK 0x3
|
|
#define PORTSC_LWS (1<<16)
|
|
#define PORTSC_CSC (1<<17)
|
|
#define PORTSC_PEC (1<<18)
|
|
#define PORTSC_WRC (1<<19)
|
|
#define PORTSC_OCC (1<<20)
|
|
#define PORTSC_PRC (1<<21)
|
|
#define PORTSC_PLC (1<<22)
|
|
#define PORTSC_CEC (1<<23)
|
|
#define PORTSC_CAS (1<<24)
|
|
#define PORTSC_WCE (1<<25)
|
|
#define PORTSC_WDE (1<<26)
|
|
#define PORTSC_WOE (1<<27)
|
|
#define PORTSC_DR (1<<30)
|
|
#define PORTSC_WPR (1<<31)
|
|
|
|
#define CRCR_RCS (1<<0)
|
|
#define CRCR_CS (1<<1)
|
|
#define CRCR_CA (1<<2)
|
|
#define CRCR_CRR (1<<3)
|
|
|
|
#define IMAN_IP (1<<0)
|
|
#define IMAN_IE (1<<1)
|
|
|
|
#define ERDP_EHB (1<<3)
|
|
|
|
#define TRB_SIZE 16
|
|
typedef struct XHCITRB {
|
|
uint64_t parameter;
|
|
uint32_t status;
|
|
uint32_t control;
|
|
dma_addr_t addr;
|
|
bool ccs;
|
|
} XHCITRB;
|
|
|
|
enum {
|
|
PLS_U0 = 0,
|
|
PLS_U1 = 1,
|
|
PLS_U2 = 2,
|
|
PLS_U3 = 3,
|
|
PLS_DISABLED = 4,
|
|
PLS_RX_DETECT = 5,
|
|
PLS_INACTIVE = 6,
|
|
PLS_POLLING = 7,
|
|
PLS_RECOVERY = 8,
|
|
PLS_HOT_RESET = 9,
|
|
PLS_COMPILANCE_MODE = 10,
|
|
PLS_TEST_MODE = 11,
|
|
PLS_RESUME = 15,
|
|
};
|
|
|
|
#define CR_LINK TR_LINK
|
|
|
|
#define TRB_C (1<<0)
|
|
#define TRB_TYPE_SHIFT 10
|
|
#define TRB_TYPE_MASK 0x3f
|
|
#define TRB_TYPE(t) (((t).control >> TRB_TYPE_SHIFT) & TRB_TYPE_MASK)
|
|
|
|
#define TRB_EV_ED (1<<2)
|
|
|
|
#define TRB_TR_ENT (1<<1)
|
|
#define TRB_TR_ISP (1<<2)
|
|
#define TRB_TR_NS (1<<3)
|
|
#define TRB_TR_CH (1<<4)
|
|
#define TRB_TR_IOC (1<<5)
|
|
#define TRB_TR_IDT (1<<6)
|
|
#define TRB_TR_TBC_SHIFT 7
|
|
#define TRB_TR_TBC_MASK 0x3
|
|
#define TRB_TR_BEI (1<<9)
|
|
#define TRB_TR_TLBPC_SHIFT 16
|
|
#define TRB_TR_TLBPC_MASK 0xf
|
|
#define TRB_TR_FRAMEID_SHIFT 20
|
|
#define TRB_TR_FRAMEID_MASK 0x7ff
|
|
#define TRB_TR_SIA (1<<31)
|
|
|
|
#define TRB_TR_DIR (1<<16)
|
|
|
|
#define TRB_CR_SLOTID_SHIFT 24
|
|
#define TRB_CR_SLOTID_MASK 0xff
|
|
#define TRB_CR_EPID_SHIFT 16
|
|
#define TRB_CR_EPID_MASK 0x1f
|
|
|
|
#define TRB_CR_BSR (1<<9)
|
|
#define TRB_CR_DC (1<<9)
|
|
|
|
#define TRB_LK_TC (1<<1)
|
|
|
|
#define TRB_INTR_SHIFT 22
|
|
#define TRB_INTR_MASK 0x3ff
|
|
#define TRB_INTR(t) (((t).status >> TRB_INTR_SHIFT) & TRB_INTR_MASK)
|
|
|
|
#define EP_TYPE_MASK 0x7
|
|
#define EP_TYPE_SHIFT 3
|
|
|
|
#define EP_STATE_MASK 0x7
|
|
#define EP_DISABLED (0<<0)
|
|
#define EP_RUNNING (1<<0)
|
|
#define EP_HALTED (2<<0)
|
|
#define EP_STOPPED (3<<0)
|
|
#define EP_ERROR (4<<0)
|
|
|
|
#define SLOT_STATE_MASK 0x1f
|
|
#define SLOT_STATE_SHIFT 27
|
|
#define SLOT_STATE(s) (((s)>>SLOT_STATE_SHIFT)&SLOT_STATE_MASK)
|
|
#define SLOT_ENABLED 0
|
|
#define SLOT_DEFAULT 1
|
|
#define SLOT_ADDRESSED 2
|
|
#define SLOT_CONFIGURED 3
|
|
|
|
#define SLOT_CONTEXT_ENTRIES_MASK 0x1f
|
|
#define SLOT_CONTEXT_ENTRIES_SHIFT 27
|
|
|
|
#define get_field(data, field) \
|
|
(((data) >> field##_SHIFT) & field##_MASK)
|
|
|
|
#define set_field(data, newval, field) do { \
|
|
uint32_t val = *data; \
|
|
val &= ~(field##_MASK << field##_SHIFT); \
|
|
val |= ((newval) & field##_MASK) << field##_SHIFT; \
|
|
*data = val; \
|
|
} while (0)
|
|
|
|
typedef enum EPType {
|
|
ET_INVALID = 0,
|
|
ET_ISO_OUT,
|
|
ET_BULK_OUT,
|
|
ET_INTR_OUT,
|
|
ET_CONTROL,
|
|
ET_ISO_IN,
|
|
ET_BULK_IN,
|
|
ET_INTR_IN,
|
|
} EPType;
|
|
|
|
typedef struct XHCITransfer {
|
|
XHCIEPContext *epctx;
|
|
USBPacket packet;
|
|
QEMUSGList sgl;
|
|
bool running_async;
|
|
bool running_retry;
|
|
bool complete;
|
|
bool int_req;
|
|
unsigned int iso_pkts;
|
|
unsigned int streamid;
|
|
bool in_xfer;
|
|
bool iso_xfer;
|
|
bool timed_xfer;
|
|
|
|
unsigned int trb_count;
|
|
XHCITRB *trbs;
|
|
|
|
TRBCCode status;
|
|
|
|
unsigned int pkts;
|
|
unsigned int pktsize;
|
|
unsigned int cur_pkt;
|
|
|
|
uint64_t mfindex_kick;
|
|
|
|
QTAILQ_ENTRY(XHCITransfer) next;
|
|
} XHCITransfer;
|
|
|
|
struct XHCIStreamContext {
|
|
dma_addr_t pctx;
|
|
unsigned int sct;
|
|
XHCIRing ring;
|
|
};
|
|
|
|
struct XHCIEPContext {
|
|
XHCIState *xhci;
|
|
unsigned int slotid;
|
|
unsigned int epid;
|
|
|
|
XHCIRing ring;
|
|
uint32_t xfer_count;
|
|
QTAILQ_HEAD(, XHCITransfer) transfers;
|
|
XHCITransfer *retry;
|
|
EPType type;
|
|
dma_addr_t pctx;
|
|
unsigned int max_psize;
|
|
uint32_t state;
|
|
uint32_t kick_active;
|
|
|
|
/* streams */
|
|
unsigned int max_pstreams;
|
|
bool lsa;
|
|
unsigned int nr_pstreams;
|
|
XHCIStreamContext *pstreams;
|
|
|
|
/* iso xfer scheduling */
|
|
unsigned int interval;
|
|
int64_t mfindex_last;
|
|
QEMUTimer *kick_timer;
|
|
};
|
|
|
|
typedef struct XHCIEvRingSeg {
|
|
uint32_t addr_low;
|
|
uint32_t addr_high;
|
|
uint32_t size;
|
|
uint32_t rsvd;
|
|
} XHCIEvRingSeg;
|
|
|
|
static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid, unsigned int streamid);
|
|
static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid);
|
|
static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid);
|
|
static void xhci_xfer_report(XHCITransfer *xfer);
|
|
static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v);
|
|
static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v);
|
|
static USBEndpoint *xhci_epid_to_usbep(XHCIEPContext *epctx);
|
|
|
|
static const char *TRBType_names[] = {
|
|
[TRB_RESERVED] = "TRB_RESERVED",
|
|
[TR_NORMAL] = "TR_NORMAL",
|
|
[TR_SETUP] = "TR_SETUP",
|
|
[TR_DATA] = "TR_DATA",
|
|
[TR_STATUS] = "TR_STATUS",
|
|
[TR_ISOCH] = "TR_ISOCH",
|
|
[TR_LINK] = "TR_LINK",
|
|
[TR_EVDATA] = "TR_EVDATA",
|
|
[TR_NOOP] = "TR_NOOP",
|
|
[CR_ENABLE_SLOT] = "CR_ENABLE_SLOT",
|
|
[CR_DISABLE_SLOT] = "CR_DISABLE_SLOT",
|
|
[CR_ADDRESS_DEVICE] = "CR_ADDRESS_DEVICE",
|
|
[CR_CONFIGURE_ENDPOINT] = "CR_CONFIGURE_ENDPOINT",
|
|
[CR_EVALUATE_CONTEXT] = "CR_EVALUATE_CONTEXT",
|
|
[CR_RESET_ENDPOINT] = "CR_RESET_ENDPOINT",
|
|
[CR_STOP_ENDPOINT] = "CR_STOP_ENDPOINT",
|
|
[CR_SET_TR_DEQUEUE] = "CR_SET_TR_DEQUEUE",
|
|
[CR_RESET_DEVICE] = "CR_RESET_DEVICE",
|
|
[CR_FORCE_EVENT] = "CR_FORCE_EVENT",
|
|
[CR_NEGOTIATE_BW] = "CR_NEGOTIATE_BW",
|
|
[CR_SET_LATENCY_TOLERANCE] = "CR_SET_LATENCY_TOLERANCE",
|
|
[CR_GET_PORT_BANDWIDTH] = "CR_GET_PORT_BANDWIDTH",
|
|
[CR_FORCE_HEADER] = "CR_FORCE_HEADER",
|
|
[CR_NOOP] = "CR_NOOP",
|
|
[ER_TRANSFER] = "ER_TRANSFER",
|
|
[ER_COMMAND_COMPLETE] = "ER_COMMAND_COMPLETE",
|
|
[ER_PORT_STATUS_CHANGE] = "ER_PORT_STATUS_CHANGE",
|
|
[ER_BANDWIDTH_REQUEST] = "ER_BANDWIDTH_REQUEST",
|
|
[ER_DOORBELL] = "ER_DOORBELL",
|
|
[ER_HOST_CONTROLLER] = "ER_HOST_CONTROLLER",
|
|
[ER_DEVICE_NOTIFICATION] = "ER_DEVICE_NOTIFICATION",
|
|
[ER_MFINDEX_WRAP] = "ER_MFINDEX_WRAP",
|
|
[CR_VENDOR_NEC_FIRMWARE_REVISION] = "CR_VENDOR_NEC_FIRMWARE_REVISION",
|
|
[CR_VENDOR_NEC_CHALLENGE_RESPONSE] = "CR_VENDOR_NEC_CHALLENGE_RESPONSE",
|
|
};
|
|
|
|
static const char *TRBCCode_names[] = {
|
|
[CC_INVALID] = "CC_INVALID",
|
|
[CC_SUCCESS] = "CC_SUCCESS",
|
|
[CC_DATA_BUFFER_ERROR] = "CC_DATA_BUFFER_ERROR",
|
|
[CC_BABBLE_DETECTED] = "CC_BABBLE_DETECTED",
|
|
[CC_USB_TRANSACTION_ERROR] = "CC_USB_TRANSACTION_ERROR",
|
|
[CC_TRB_ERROR] = "CC_TRB_ERROR",
|
|
[CC_STALL_ERROR] = "CC_STALL_ERROR",
|
|
[CC_RESOURCE_ERROR] = "CC_RESOURCE_ERROR",
|
|
[CC_BANDWIDTH_ERROR] = "CC_BANDWIDTH_ERROR",
|
|
[CC_NO_SLOTS_ERROR] = "CC_NO_SLOTS_ERROR",
|
|
[CC_INVALID_STREAM_TYPE_ERROR] = "CC_INVALID_STREAM_TYPE_ERROR",
|
|
[CC_SLOT_NOT_ENABLED_ERROR] = "CC_SLOT_NOT_ENABLED_ERROR",
|
|
[CC_EP_NOT_ENABLED_ERROR] = "CC_EP_NOT_ENABLED_ERROR",
|
|
[CC_SHORT_PACKET] = "CC_SHORT_PACKET",
|
|
[CC_RING_UNDERRUN] = "CC_RING_UNDERRUN",
|
|
[CC_RING_OVERRUN] = "CC_RING_OVERRUN",
|
|
[CC_VF_ER_FULL] = "CC_VF_ER_FULL",
|
|
[CC_PARAMETER_ERROR] = "CC_PARAMETER_ERROR",
|
|
[CC_BANDWIDTH_OVERRUN] = "CC_BANDWIDTH_OVERRUN",
|
|
[CC_CONTEXT_STATE_ERROR] = "CC_CONTEXT_STATE_ERROR",
|
|
[CC_NO_PING_RESPONSE_ERROR] = "CC_NO_PING_RESPONSE_ERROR",
|
|
[CC_EVENT_RING_FULL_ERROR] = "CC_EVENT_RING_FULL_ERROR",
|
|
[CC_INCOMPATIBLE_DEVICE_ERROR] = "CC_INCOMPATIBLE_DEVICE_ERROR",
|
|
[CC_MISSED_SERVICE_ERROR] = "CC_MISSED_SERVICE_ERROR",
|
|
[CC_COMMAND_RING_STOPPED] = "CC_COMMAND_RING_STOPPED",
|
|
[CC_COMMAND_ABORTED] = "CC_COMMAND_ABORTED",
|
|
[CC_STOPPED] = "CC_STOPPED",
|
|
[CC_STOPPED_LENGTH_INVALID] = "CC_STOPPED_LENGTH_INVALID",
|
|
[CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR]
|
|
= "CC_MAX_EXIT_LATENCY_TOO_LARGE_ERROR",
|
|
[CC_ISOCH_BUFFER_OVERRUN] = "CC_ISOCH_BUFFER_OVERRUN",
|
|
[CC_EVENT_LOST_ERROR] = "CC_EVENT_LOST_ERROR",
|
|
[CC_UNDEFINED_ERROR] = "CC_UNDEFINED_ERROR",
|
|
[CC_INVALID_STREAM_ID_ERROR] = "CC_INVALID_STREAM_ID_ERROR",
|
|
[CC_SECONDARY_BANDWIDTH_ERROR] = "CC_SECONDARY_BANDWIDTH_ERROR",
|
|
[CC_SPLIT_TRANSACTION_ERROR] = "CC_SPLIT_TRANSACTION_ERROR",
|
|
};
|
|
|
|
static const char *ep_state_names[] = {
|
|
[EP_DISABLED] = "disabled",
|
|
[EP_RUNNING] = "running",
|
|
[EP_HALTED] = "halted",
|
|
[EP_STOPPED] = "stopped",
|
|
[EP_ERROR] = "error",
|
|
};
|
|
|
|
static const char *lookup_name(uint32_t index, const char **list, uint32_t llen)
|
|
{
|
|
if (index >= llen || list[index] == NULL) {
|
|
return "???";
|
|
}
|
|
return list[index];
|
|
}
|
|
|
|
static const char *trb_name(XHCITRB *trb)
|
|
{
|
|
return lookup_name(TRB_TYPE(*trb), TRBType_names,
|
|
ARRAY_SIZE(TRBType_names));
|
|
}
|
|
|
|
static const char *event_name(XHCIEvent *event)
|
|
{
|
|
return lookup_name(event->ccode, TRBCCode_names,
|
|
ARRAY_SIZE(TRBCCode_names));
|
|
}
|
|
|
|
static const char *ep_state_name(uint32_t state)
|
|
{
|
|
return lookup_name(state, ep_state_names,
|
|
ARRAY_SIZE(ep_state_names));
|
|
}
|
|
|
|
bool xhci_get_flag(XHCIState *xhci, enum xhci_flags bit)
|
|
{
|
|
return xhci->flags & (1 << bit);
|
|
}
|
|
|
|
void xhci_set_flag(XHCIState *xhci, enum xhci_flags bit)
|
|
{
|
|
xhci->flags |= (1 << bit);
|
|
}
|
|
|
|
static uint64_t xhci_mfindex_get(XHCIState *xhci)
|
|
{
|
|
int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
|
|
return (now - xhci->mfindex_start) / 125000;
|
|
}
|
|
|
|
static void xhci_mfwrap_update(XHCIState *xhci)
|
|
{
|
|
const uint32_t bits = USBCMD_RS | USBCMD_EWE;
|
|
uint32_t mfindex, left;
|
|
int64_t now;
|
|
|
|
if ((xhci->usbcmd & bits) == bits) {
|
|
now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
|
|
mfindex = ((now - xhci->mfindex_start) / 125000) & 0x3fff;
|
|
left = 0x4000 - mfindex;
|
|
timer_mod(xhci->mfwrap_timer, now + left * 125000);
|
|
} else {
|
|
timer_del(xhci->mfwrap_timer);
|
|
}
|
|
}
|
|
|
|
static void xhci_mfwrap_timer(void *opaque)
|
|
{
|
|
XHCIState *xhci = opaque;
|
|
XHCIEvent wrap = { ER_MFINDEX_WRAP, CC_SUCCESS };
|
|
|
|
xhci_event(xhci, &wrap, 0);
|
|
xhci_mfwrap_update(xhci);
|
|
}
|
|
|
|
static void xhci_die(XHCIState *xhci)
|
|
{
|
|
xhci->usbsts |= USBSTS_HCE;
|
|
DPRINTF("xhci: asserted controller error\n");
|
|
}
|
|
|
|
static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
|
|
{
|
|
if (sizeof(dma_addr_t) == 4) {
|
|
return low;
|
|
} else {
|
|
return low | (((dma_addr_t)high << 16) << 16);
|
|
}
|
|
}
|
|
|
|
static inline dma_addr_t xhci_mask64(uint64_t addr)
|
|
{
|
|
if (sizeof(dma_addr_t) == 4) {
|
|
return addr & 0xffffffff;
|
|
} else {
|
|
return addr;
|
|
}
|
|
}
|
|
|
|
static inline void xhci_dma_read_u32s(XHCIState *xhci, dma_addr_t addr,
|
|
uint32_t *buf, size_t len)
|
|
{
|
|
int i;
|
|
|
|
assert((len % sizeof(uint32_t)) == 0);
|
|
|
|
if (dma_memory_read(xhci->as, addr, buf, len,
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
memset(buf, 0xff, len);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
|
|
for (i = 0; i < (len / sizeof(uint32_t)); i++) {
|
|
buf[i] = le32_to_cpu(buf[i]);
|
|
}
|
|
}
|
|
|
|
static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
|
|
const uint32_t *buf, size_t len)
|
|
{
|
|
int i;
|
|
uint32_t tmp[5];
|
|
uint32_t n = len / sizeof(uint32_t);
|
|
|
|
assert((len % sizeof(uint32_t)) == 0);
|
|
assert(n <= ARRAY_SIZE(tmp));
|
|
|
|
for (i = 0; i < n; i++) {
|
|
tmp[i] = cpu_to_le32(buf[i]);
|
|
}
|
|
if (dma_memory_write(xhci->as, addr, tmp, len,
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
}
|
|
|
|
static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
|
|
{
|
|
int index;
|
|
|
|
if (!uport->dev) {
|
|
return NULL;
|
|
}
|
|
switch (uport->dev->speed) {
|
|
case USB_SPEED_LOW:
|
|
case USB_SPEED_FULL:
|
|
case USB_SPEED_HIGH:
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
index = uport->index + xhci->numports_3;
|
|
} else {
|
|
index = uport->index;
|
|
}
|
|
break;
|
|
case USB_SPEED_SUPER:
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
index = uport->index;
|
|
} else {
|
|
index = uport->index + xhci->numports_2;
|
|
}
|
|
break;
|
|
default:
|
|
return NULL;
|
|
}
|
|
return &xhci->ports[index];
|
|
}
|
|
|
|
static void xhci_intr_update(XHCIState *xhci, int v)
|
|
{
|
|
int level = 0;
|
|
|
|
if (v == 0) {
|
|
if (xhci->intr[0].iman & IMAN_IP &&
|
|
xhci->intr[0].iman & IMAN_IE &&
|
|
xhci->usbcmd & USBCMD_INTE) {
|
|
level = 1;
|
|
}
|
|
if (xhci->intr_raise) {
|
|
if (xhci->intr_raise(xhci, 0, level)) {
|
|
xhci->intr[0].iman &= ~IMAN_IP;
|
|
}
|
|
}
|
|
}
|
|
if (xhci->intr_update) {
|
|
xhci->intr_update(xhci, v,
|
|
xhci->intr[v].iman & IMAN_IE);
|
|
}
|
|
}
|
|
|
|
static void xhci_intr_raise(XHCIState *xhci, int v)
|
|
{
|
|
bool pending = (xhci->intr[v].erdp_low & ERDP_EHB);
|
|
|
|
xhci->intr[v].erdp_low |= ERDP_EHB;
|
|
xhci->intr[v].iman |= IMAN_IP;
|
|
xhci->usbsts |= USBSTS_EINT;
|
|
|
|
if (pending) {
|
|
return;
|
|
}
|
|
if (!(xhci->intr[v].iman & IMAN_IE)) {
|
|
return;
|
|
}
|
|
|
|
if (!(xhci->usbcmd & USBCMD_INTE)) {
|
|
return;
|
|
}
|
|
if (xhci->intr_raise) {
|
|
if (xhci->intr_raise(xhci, v, true)) {
|
|
xhci->intr[v].iman &= ~IMAN_IP;
|
|
}
|
|
}
|
|
}
|
|
|
|
static inline int xhci_running(XHCIState *xhci)
|
|
{
|
|
return !(xhci->usbsts & USBSTS_HCH);
|
|
}
|
|
|
|
static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
|
|
{
|
|
XHCIInterrupter *intr = &xhci->intr[v];
|
|
XHCITRB ev_trb;
|
|
dma_addr_t addr;
|
|
|
|
ev_trb.parameter = cpu_to_le64(event->ptr);
|
|
ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
|
|
ev_trb.control = (event->slotid << 24) | (event->epid << 16) |
|
|
event->flags | (event->type << TRB_TYPE_SHIFT);
|
|
if (intr->er_pcs) {
|
|
ev_trb.control |= TRB_C;
|
|
}
|
|
ev_trb.control = cpu_to_le32(ev_trb.control);
|
|
|
|
trace_usb_xhci_queue_event(v, intr->er_ep_idx, trb_name(&ev_trb),
|
|
event_name(event), ev_trb.parameter,
|
|
ev_trb.status, ev_trb.control);
|
|
|
|
addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
|
|
if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE,
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
xhci_die(xhci);
|
|
}
|
|
|
|
intr->er_ep_idx++;
|
|
if (intr->er_ep_idx >= intr->er_size) {
|
|
intr->er_ep_idx = 0;
|
|
intr->er_pcs = !intr->er_pcs;
|
|
}
|
|
}
|
|
|
|
static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v)
|
|
{
|
|
XHCIInterrupter *intr;
|
|
dma_addr_t erdp;
|
|
unsigned int dp_idx;
|
|
|
|
if (v >= xhci->numintrs) {
|
|
DPRINTF("intr nr out of range (%d >= %d)\n", v, xhci->numintrs);
|
|
return;
|
|
}
|
|
intr = &xhci->intr[v];
|
|
|
|
erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
|
|
if (erdp < intr->er_start ||
|
|
erdp >= (intr->er_start + TRB_SIZE*intr->er_size)) {
|
|
DPRINTF("xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
|
|
DPRINTF("xhci: ER[%d] at "DMA_ADDR_FMT" len %d\n",
|
|
v, intr->er_start, intr->er_size);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
|
|
dp_idx = (erdp - intr->er_start) / TRB_SIZE;
|
|
assert(dp_idx < intr->er_size);
|
|
|
|
if ((intr->er_ep_idx + 2) % intr->er_size == dp_idx) {
|
|
DPRINTF("xhci: ER %d full, send ring full error\n", v);
|
|
XHCIEvent full = {ER_HOST_CONTROLLER, CC_EVENT_RING_FULL_ERROR};
|
|
xhci_write_event(xhci, &full, v);
|
|
} else if ((intr->er_ep_idx + 1) % intr->er_size == dp_idx) {
|
|
DPRINTF("xhci: ER %d full, drop event\n", v);
|
|
} else {
|
|
xhci_write_event(xhci, event, v);
|
|
}
|
|
|
|
xhci_intr_raise(xhci, v);
|
|
}
|
|
|
|
static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
|
|
dma_addr_t base)
|
|
{
|
|
ring->dequeue = base;
|
|
ring->ccs = 1;
|
|
}
|
|
|
|
static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
|
|
dma_addr_t *addr)
|
|
{
|
|
uint32_t link_cnt = 0;
|
|
|
|
while (1) {
|
|
TRBType type;
|
|
if (dma_memory_read(xhci->as, ring->dequeue, trb, TRB_SIZE,
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
return 0;
|
|
}
|
|
trb->addr = ring->dequeue;
|
|
trb->ccs = ring->ccs;
|
|
le64_to_cpus(&trb->parameter);
|
|
le32_to_cpus(&trb->status);
|
|
le32_to_cpus(&trb->control);
|
|
|
|
trace_usb_xhci_fetch_trb(ring->dequeue, trb_name(trb),
|
|
trb->parameter, trb->status, trb->control);
|
|
|
|
if ((trb->control & TRB_C) != ring->ccs) {
|
|
return 0;
|
|
}
|
|
|
|
type = TRB_TYPE(*trb);
|
|
|
|
if (type != TR_LINK) {
|
|
if (addr) {
|
|
*addr = ring->dequeue;
|
|
}
|
|
ring->dequeue += TRB_SIZE;
|
|
return type;
|
|
} else {
|
|
if (++link_cnt > TRB_LINK_LIMIT) {
|
|
trace_usb_xhci_enforced_limit("trb-link");
|
|
return 0;
|
|
}
|
|
ring->dequeue = xhci_mask64(trb->parameter);
|
|
if (trb->control & TRB_LK_TC) {
|
|
ring->ccs = !ring->ccs;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
|
|
{
|
|
XHCITRB trb;
|
|
int length = 0;
|
|
dma_addr_t dequeue = ring->dequeue;
|
|
bool ccs = ring->ccs;
|
|
/* hack to bundle together the two/three TDs that make a setup transfer */
|
|
bool control_td_set = 0;
|
|
uint32_t link_cnt = 0;
|
|
|
|
do {
|
|
TRBType type;
|
|
if (dma_memory_read(xhci->as, dequeue, &trb, TRB_SIZE,
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
return -1;
|
|
}
|
|
le64_to_cpus(&trb.parameter);
|
|
le32_to_cpus(&trb.status);
|
|
le32_to_cpus(&trb.control);
|
|
|
|
if ((trb.control & TRB_C) != ccs) {
|
|
return -length;
|
|
}
|
|
|
|
type = TRB_TYPE(trb);
|
|
|
|
if (type == TR_LINK) {
|
|
if (++link_cnt > TRB_LINK_LIMIT) {
|
|
return -length;
|
|
}
|
|
dequeue = xhci_mask64(trb.parameter);
|
|
if (trb.control & TRB_LK_TC) {
|
|
ccs = !ccs;
|
|
}
|
|
continue;
|
|
}
|
|
|
|
length += 1;
|
|
dequeue += TRB_SIZE;
|
|
|
|
if (type == TR_SETUP) {
|
|
control_td_set = 1;
|
|
} else if (type == TR_STATUS) {
|
|
control_td_set = 0;
|
|
}
|
|
|
|
if (!control_td_set && !(trb.control & TRB_TR_CH)) {
|
|
return length;
|
|
}
|
|
|
|
/*
|
|
* According to the xHCI spec, Transfer Ring segments should have
|
|
* a maximum size of 64 kB (see chapter "6 Data Structures")
|
|
*/
|
|
} while (length < TRB_LINK_LIMIT * 65536 / TRB_SIZE);
|
|
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: exceeded maximum transfer ring size!\n",
|
|
__func__);
|
|
|
|
return -1;
|
|
}
|
|
|
|
static void xhci_er_reset(XHCIState *xhci, int v)
|
|
{
|
|
XHCIInterrupter *intr = &xhci->intr[v];
|
|
XHCIEvRingSeg seg;
|
|
dma_addr_t erstba = xhci_addr64(intr->erstba_low, intr->erstba_high);
|
|
|
|
if (intr->erstsz == 0 || erstba == 0) {
|
|
/* disabled */
|
|
intr->er_start = 0;
|
|
intr->er_size = 0;
|
|
return;
|
|
}
|
|
/* cache the (sole) event ring segment location */
|
|
if (intr->erstsz != 1) {
|
|
DPRINTF("xhci: invalid value for ERSTSZ: %d\n", intr->erstsz);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
if (dma_memory_read(xhci->as, erstba, &seg, sizeof(seg),
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
|
|
__func__);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
|
|
le32_to_cpus(&seg.addr_low);
|
|
le32_to_cpus(&seg.addr_high);
|
|
le32_to_cpus(&seg.size);
|
|
if (seg.size < 16 || seg.size > 4096) {
|
|
DPRINTF("xhci: invalid value for segment size: %d\n", seg.size);
|
|
xhci_die(xhci);
|
|
return;
|
|
}
|
|
intr->er_start = xhci_addr64(seg.addr_low, seg.addr_high);
|
|
intr->er_size = seg.size;
|
|
|
|
intr->er_ep_idx = 0;
|
|
intr->er_pcs = 1;
|
|
|
|
DPRINTF("xhci: event ring[%d]:" DMA_ADDR_FMT " [%d]\n",
|
|
v, intr->er_start, intr->er_size);
|
|
}
|
|
|
|
static void xhci_run(XHCIState *xhci)
|
|
{
|
|
trace_usb_xhci_run();
|
|
xhci->usbsts &= ~USBSTS_HCH;
|
|
xhci->mfindex_start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
|
|
}
|
|
|
|
static void xhci_stop(XHCIState *xhci)
|
|
{
|
|
trace_usb_xhci_stop();
|
|
xhci->usbsts |= USBSTS_HCH;
|
|
xhci->crcr_low &= ~CRCR_CRR;
|
|
}
|
|
|
|
static XHCIStreamContext *xhci_alloc_stream_contexts(unsigned count,
|
|
dma_addr_t base)
|
|
{
|
|
XHCIStreamContext *stctx;
|
|
unsigned int i;
|
|
|
|
stctx = g_new0(XHCIStreamContext, count);
|
|
for (i = 0; i < count; i++) {
|
|
stctx[i].pctx = base + i * 16;
|
|
stctx[i].sct = -1;
|
|
}
|
|
return stctx;
|
|
}
|
|
|
|
static void xhci_reset_streams(XHCIEPContext *epctx)
|
|
{
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < epctx->nr_pstreams; i++) {
|
|
epctx->pstreams[i].sct = -1;
|
|
}
|
|
}
|
|
|
|
static void xhci_alloc_streams(XHCIEPContext *epctx, dma_addr_t base)
|
|
{
|
|
assert(epctx->pstreams == NULL);
|
|
epctx->nr_pstreams = 2 << epctx->max_pstreams;
|
|
epctx->pstreams = xhci_alloc_stream_contexts(epctx->nr_pstreams, base);
|
|
}
|
|
|
|
static void xhci_free_streams(XHCIEPContext *epctx)
|
|
{
|
|
assert(epctx->pstreams != NULL);
|
|
|
|
g_free(epctx->pstreams);
|
|
epctx->pstreams = NULL;
|
|
epctx->nr_pstreams = 0;
|
|
}
|
|
|
|
static int xhci_epmask_to_eps_with_streams(XHCIState *xhci,
|
|
unsigned int slotid,
|
|
uint32_t epmask,
|
|
XHCIEPContext **epctxs,
|
|
USBEndpoint **eps)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
USBEndpoint *ep;
|
|
int i, j;
|
|
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
slot = &xhci->slots[slotid - 1];
|
|
|
|
for (i = 2, j = 0; i <= 31; i++) {
|
|
if (!(epmask & (1u << i))) {
|
|
continue;
|
|
}
|
|
|
|
epctx = slot->eps[i - 1];
|
|
ep = xhci_epid_to_usbep(epctx);
|
|
if (!epctx || !epctx->nr_pstreams || !ep) {
|
|
continue;
|
|
}
|
|
|
|
if (epctxs) {
|
|
epctxs[j] = epctx;
|
|
}
|
|
eps[j++] = ep;
|
|
}
|
|
return j;
|
|
}
|
|
|
|
static void xhci_free_device_streams(XHCIState *xhci, unsigned int slotid,
|
|
uint32_t epmask)
|
|
{
|
|
USBEndpoint *eps[30];
|
|
int nr_eps;
|
|
|
|
nr_eps = xhci_epmask_to_eps_with_streams(xhci, slotid, epmask, NULL, eps);
|
|
if (nr_eps) {
|
|
usb_device_free_streams(eps[0]->dev, eps, nr_eps);
|
|
}
|
|
}
|
|
|
|
static TRBCCode xhci_alloc_device_streams(XHCIState *xhci, unsigned int slotid,
|
|
uint32_t epmask)
|
|
{
|
|
XHCIEPContext *epctxs[30];
|
|
USBEndpoint *eps[30];
|
|
int i, r, nr_eps, req_nr_streams, dev_max_streams;
|
|
|
|
nr_eps = xhci_epmask_to_eps_with_streams(xhci, slotid, epmask, epctxs,
|
|
eps);
|
|
if (nr_eps == 0) {
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
req_nr_streams = epctxs[0]->nr_pstreams;
|
|
dev_max_streams = eps[0]->max_streams;
|
|
|
|
for (i = 1; i < nr_eps; i++) {
|
|
/*
|
|
* HdG: I don't expect these to ever trigger, but if they do we need
|
|
* to come up with another solution, ie group identical endpoints
|
|
* together and make an usb_device_alloc_streams call per group.
|
|
*/
|
|
if (epctxs[i]->nr_pstreams != req_nr_streams) {
|
|
FIXME("guest streams config not identical for all eps");
|
|
return CC_RESOURCE_ERROR;
|
|
}
|
|
if (eps[i]->max_streams != dev_max_streams) {
|
|
FIXME("device streams config not identical for all eps");
|
|
return CC_RESOURCE_ERROR;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* max-streams in both the device descriptor and in the controller is a
|
|
* power of 2. But stream id 0 is reserved, so if a device can do up to 4
|
|
* streams the guest will ask for 5 rounded up to the next power of 2 which
|
|
* becomes 8. For emulated devices usb_device_alloc_streams is a nop.
|
|
*
|
|
* For redirected devices however this is an issue, as there we must ask
|
|
* the real xhci controller to alloc streams, and the host driver for the
|
|
* real xhci controller will likely disallow allocating more streams then
|
|
* the device can handle.
|
|
*
|
|
* So we limit the requested nr_streams to the maximum number the device
|
|
* can handle.
|
|
*/
|
|
if (req_nr_streams > dev_max_streams) {
|
|
req_nr_streams = dev_max_streams;
|
|
}
|
|
|
|
r = usb_device_alloc_streams(eps[0]->dev, eps, nr_eps, req_nr_streams);
|
|
if (r != 0) {
|
|
DPRINTF("xhci: alloc streams failed\n");
|
|
return CC_RESOURCE_ERROR;
|
|
}
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static XHCIStreamContext *xhci_find_stream(XHCIEPContext *epctx,
|
|
unsigned int streamid,
|
|
uint32_t *cc_error)
|
|
{
|
|
XHCIStreamContext *sctx;
|
|
dma_addr_t base;
|
|
uint32_t ctx[2], sct;
|
|
|
|
assert(streamid != 0);
|
|
if (epctx->lsa) {
|
|
if (streamid >= epctx->nr_pstreams) {
|
|
*cc_error = CC_INVALID_STREAM_ID_ERROR;
|
|
return NULL;
|
|
}
|
|
sctx = epctx->pstreams + streamid;
|
|
} else {
|
|
fprintf(stderr, "xhci: FIXME: secondary streams not implemented yet");
|
|
*cc_error = CC_INVALID_STREAM_TYPE_ERROR;
|
|
return NULL;
|
|
}
|
|
|
|
if (sctx->sct == -1) {
|
|
xhci_dma_read_u32s(epctx->xhci, sctx->pctx, ctx, sizeof(ctx));
|
|
sct = (ctx[0] >> 1) & 0x07;
|
|
if (epctx->lsa && sct != 1) {
|
|
*cc_error = CC_INVALID_STREAM_TYPE_ERROR;
|
|
return NULL;
|
|
}
|
|
sctx->sct = sct;
|
|
base = xhci_addr64(ctx[0] & ~0xf, ctx[1]);
|
|
xhci_ring_init(epctx->xhci, &sctx->ring, base);
|
|
}
|
|
return sctx;
|
|
}
|
|
|
|
static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
|
|
XHCIStreamContext *sctx, uint32_t state)
|
|
{
|
|
XHCIRing *ring = NULL;
|
|
uint32_t ctx[5];
|
|
uint32_t ctx2[2];
|
|
|
|
xhci_dma_read_u32s(xhci, epctx->pctx, ctx, sizeof(ctx));
|
|
ctx[0] &= ~EP_STATE_MASK;
|
|
ctx[0] |= state;
|
|
|
|
/* update ring dequeue ptr */
|
|
if (epctx->nr_pstreams) {
|
|
if (sctx != NULL) {
|
|
ring = &sctx->ring;
|
|
xhci_dma_read_u32s(xhci, sctx->pctx, ctx2, sizeof(ctx2));
|
|
ctx2[0] &= 0xe;
|
|
ctx2[0] |= sctx->ring.dequeue | sctx->ring.ccs;
|
|
ctx2[1] = (sctx->ring.dequeue >> 16) >> 16;
|
|
xhci_dma_write_u32s(xhci, sctx->pctx, ctx2, sizeof(ctx2));
|
|
}
|
|
} else {
|
|
ring = &epctx->ring;
|
|
}
|
|
if (ring) {
|
|
ctx[2] = ring->dequeue | ring->ccs;
|
|
ctx[3] = (ring->dequeue >> 16) >> 16;
|
|
|
|
DPRINTF("xhci: set epctx: " DMA_ADDR_FMT " state=%d dequeue=%08x%08x\n",
|
|
epctx->pctx, state, ctx[3], ctx[2]);
|
|
}
|
|
|
|
xhci_dma_write_u32s(xhci, epctx->pctx, ctx, sizeof(ctx));
|
|
if (epctx->state != state) {
|
|
trace_usb_xhci_ep_state(epctx->slotid, epctx->epid,
|
|
ep_state_name(epctx->state),
|
|
ep_state_name(state));
|
|
}
|
|
epctx->state = state;
|
|
}
|
|
|
|
static void xhci_ep_kick_timer(void *opaque)
|
|
{
|
|
XHCIEPContext *epctx = opaque;
|
|
xhci_kick_epctx(epctx, 0);
|
|
}
|
|
|
|
static XHCIEPContext *xhci_alloc_epctx(XHCIState *xhci,
|
|
unsigned int slotid,
|
|
unsigned int epid)
|
|
{
|
|
XHCIEPContext *epctx;
|
|
|
|
epctx = g_new0(XHCIEPContext, 1);
|
|
epctx->xhci = xhci;
|
|
epctx->slotid = slotid;
|
|
epctx->epid = epid;
|
|
|
|
QTAILQ_INIT(&epctx->transfers);
|
|
epctx->kick_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, xhci_ep_kick_timer, epctx);
|
|
|
|
return epctx;
|
|
}
|
|
|
|
static void xhci_init_epctx(XHCIEPContext *epctx,
|
|
dma_addr_t pctx, uint32_t *ctx)
|
|
{
|
|
dma_addr_t dequeue;
|
|
|
|
dequeue = xhci_addr64(ctx[2] & ~0xf, ctx[3]);
|
|
|
|
epctx->type = (ctx[1] >> EP_TYPE_SHIFT) & EP_TYPE_MASK;
|
|
epctx->pctx = pctx;
|
|
epctx->max_psize = ctx[1]>>16;
|
|
epctx->max_psize *= 1+((ctx[1]>>8)&0xff);
|
|
epctx->max_pstreams = (ctx[0] >> 10) & epctx->xhci->max_pstreams_mask;
|
|
epctx->lsa = (ctx[0] >> 15) & 1;
|
|
if (epctx->max_pstreams) {
|
|
xhci_alloc_streams(epctx, dequeue);
|
|
} else {
|
|
xhci_ring_init(epctx->xhci, &epctx->ring, dequeue);
|
|
epctx->ring.ccs = ctx[2] & 1;
|
|
}
|
|
|
|
epctx->interval = 1 << ((ctx[0] >> 16) & 0xff);
|
|
}
|
|
|
|
static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid, dma_addr_t pctx,
|
|
uint32_t *ctx)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
|
|
trace_usb_xhci_ep_enable(slotid, epid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
assert(epid >= 1 && epid <= 31);
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
if (slot->eps[epid-1]) {
|
|
xhci_disable_ep(xhci, slotid, epid);
|
|
}
|
|
|
|
epctx = xhci_alloc_epctx(xhci, slotid, epid);
|
|
slot->eps[epid-1] = epctx;
|
|
xhci_init_epctx(epctx, pctx, ctx);
|
|
|
|
DPRINTF("xhci: endpoint %d.%d type is %d, max transaction (burst) "
|
|
"size is %d\n", epid/2, epid%2, epctx->type, epctx->max_psize);
|
|
|
|
epctx->mfindex_last = 0;
|
|
|
|
epctx->state = EP_RUNNING;
|
|
ctx[0] &= ~EP_STATE_MASK;
|
|
ctx[0] |= EP_RUNNING;
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static XHCITransfer *xhci_ep_alloc_xfer(XHCIEPContext *epctx,
|
|
uint32_t length)
|
|
{
|
|
uint32_t limit = epctx->nr_pstreams + 16;
|
|
XHCITransfer *xfer;
|
|
|
|
if (epctx->xfer_count >= limit) {
|
|
return NULL;
|
|
}
|
|
|
|
xfer = g_new0(XHCITransfer, 1);
|
|
xfer->epctx = epctx;
|
|
xfer->trbs = g_new(XHCITRB, length);
|
|
xfer->trb_count = length;
|
|
usb_packet_init(&xfer->packet);
|
|
|
|
QTAILQ_INSERT_TAIL(&epctx->transfers, xfer, next);
|
|
epctx->xfer_count++;
|
|
|
|
return xfer;
|
|
}
|
|
|
|
static void xhci_ep_free_xfer(XHCITransfer *xfer)
|
|
{
|
|
QTAILQ_REMOVE(&xfer->epctx->transfers, xfer, next);
|
|
xfer->epctx->xfer_count--;
|
|
|
|
usb_packet_cleanup(&xfer->packet);
|
|
g_free(xfer->trbs);
|
|
g_free(xfer);
|
|
}
|
|
|
|
static int xhci_ep_nuke_one_xfer(XHCITransfer *t, TRBCCode report)
|
|
{
|
|
int killed = 0;
|
|
|
|
if (report && (t->running_async || t->running_retry)) {
|
|
t->status = report;
|
|
xhci_xfer_report(t);
|
|
}
|
|
|
|
if (t->running_async) {
|
|
usb_cancel_packet(&t->packet);
|
|
t->running_async = 0;
|
|
killed = 1;
|
|
}
|
|
if (t->running_retry) {
|
|
if (t->epctx) {
|
|
t->epctx->retry = NULL;
|
|
timer_del(t->epctx->kick_timer);
|
|
}
|
|
t->running_retry = 0;
|
|
killed = 1;
|
|
}
|
|
g_free(t->trbs);
|
|
|
|
t->trbs = NULL;
|
|
t->trb_count = 0;
|
|
|
|
return killed;
|
|
}
|
|
|
|
static int xhci_ep_nuke_xfers(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid, TRBCCode report)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
XHCITransfer *xfer;
|
|
int killed = 0;
|
|
USBEndpoint *ep = NULL;
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
assert(epid >= 1 && epid <= 31);
|
|
|
|
DPRINTF("xhci_ep_nuke_xfers(%d, %d)\n", slotid, epid);
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
|
|
if (!slot->eps[epid-1]) {
|
|
return 0;
|
|
}
|
|
|
|
epctx = slot->eps[epid-1];
|
|
|
|
for (;;) {
|
|
xfer = QTAILQ_FIRST(&epctx->transfers);
|
|
if (xfer == NULL) {
|
|
break;
|
|
}
|
|
killed += xhci_ep_nuke_one_xfer(xfer, report);
|
|
if (killed) {
|
|
report = 0; /* Only report once */
|
|
}
|
|
xhci_ep_free_xfer(xfer);
|
|
}
|
|
|
|
ep = xhci_epid_to_usbep(epctx);
|
|
if (ep) {
|
|
usb_device_ep_stopped(ep->dev, ep);
|
|
}
|
|
return killed;
|
|
}
|
|
|
|
static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
|
|
trace_usb_xhci_ep_disable(slotid, epid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
assert(epid >= 1 && epid <= 31);
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
|
|
if (!slot->eps[epid-1]) {
|
|
DPRINTF("xhci: slot %d ep %d already disabled\n", slotid, epid);
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
xhci_ep_nuke_xfers(xhci, slotid, epid, 0);
|
|
|
|
epctx = slot->eps[epid-1];
|
|
|
|
if (epctx->nr_pstreams) {
|
|
xhci_free_streams(epctx);
|
|
}
|
|
|
|
/* only touch guest RAM if we're not resetting the HC */
|
|
if (xhci->dcbaap_low || xhci->dcbaap_high) {
|
|
xhci_set_ep_state(xhci, epctx, NULL, EP_DISABLED);
|
|
}
|
|
|
|
timer_free(epctx->kick_timer);
|
|
g_free(epctx);
|
|
slot->eps[epid-1] = NULL;
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static TRBCCode xhci_stop_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
|
|
trace_usb_xhci_ep_stop(slotid, epid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
if (epid < 1 || epid > 31) {
|
|
DPRINTF("xhci: bad ep %d\n", epid);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
|
|
if (!slot->eps[epid-1]) {
|
|
DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
|
|
return CC_EP_NOT_ENABLED_ERROR;
|
|
}
|
|
|
|
if (xhci_ep_nuke_xfers(xhci, slotid, epid, CC_STOPPED) > 0) {
|
|
DPRINTF("xhci: FIXME: endpoint stopped w/ xfers running, "
|
|
"data might be lost\n");
|
|
}
|
|
|
|
epctx = slot->eps[epid-1];
|
|
|
|
xhci_set_ep_state(xhci, epctx, NULL, EP_STOPPED);
|
|
|
|
if (epctx->nr_pstreams) {
|
|
xhci_reset_streams(epctx);
|
|
}
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static TRBCCode xhci_reset_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
|
|
trace_usb_xhci_ep_reset(slotid, epid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
if (epid < 1 || epid > 31) {
|
|
DPRINTF("xhci: bad ep %d\n", epid);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
|
|
if (!slot->eps[epid-1]) {
|
|
DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
|
|
return CC_EP_NOT_ENABLED_ERROR;
|
|
}
|
|
|
|
epctx = slot->eps[epid-1];
|
|
|
|
if (epctx->state != EP_HALTED) {
|
|
DPRINTF("xhci: reset EP while EP %d not halted (%d)\n",
|
|
epid, epctx->state);
|
|
return CC_CONTEXT_STATE_ERROR;
|
|
}
|
|
|
|
if (xhci_ep_nuke_xfers(xhci, slotid, epid, 0) > 0) {
|
|
DPRINTF("xhci: FIXME: endpoint reset w/ xfers running, "
|
|
"data might be lost\n");
|
|
}
|
|
|
|
if (!xhci->slots[slotid-1].uport ||
|
|
!xhci->slots[slotid-1].uport->dev ||
|
|
!xhci->slots[slotid-1].uport->dev->attached) {
|
|
return CC_USB_TRANSACTION_ERROR;
|
|
}
|
|
|
|
xhci_set_ep_state(xhci, epctx, NULL, EP_STOPPED);
|
|
|
|
if (epctx->nr_pstreams) {
|
|
xhci_reset_streams(epctx);
|
|
}
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid, unsigned int streamid,
|
|
uint64_t pdequeue)
|
|
{
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
XHCIStreamContext *sctx;
|
|
dma_addr_t dequeue;
|
|
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
if (epid < 1 || epid > 31) {
|
|
DPRINTF("xhci: bad ep %d\n", epid);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
trace_usb_xhci_ep_set_dequeue(slotid, epid, streamid, pdequeue);
|
|
dequeue = xhci_mask64(pdequeue);
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
|
|
if (!slot->eps[epid-1]) {
|
|
DPRINTF("xhci: slot %d ep %d not enabled\n", slotid, epid);
|
|
return CC_EP_NOT_ENABLED_ERROR;
|
|
}
|
|
|
|
epctx = slot->eps[epid-1];
|
|
|
|
if (epctx->state != EP_STOPPED) {
|
|
DPRINTF("xhci: set EP dequeue pointer while EP %d not stopped\n", epid);
|
|
return CC_CONTEXT_STATE_ERROR;
|
|
}
|
|
|
|
if (epctx->nr_pstreams) {
|
|
uint32_t err;
|
|
sctx = xhci_find_stream(epctx, streamid, &err);
|
|
if (sctx == NULL) {
|
|
return err;
|
|
}
|
|
xhci_ring_init(xhci, &sctx->ring, dequeue & ~0xf);
|
|
sctx->ring.ccs = dequeue & 1;
|
|
} else {
|
|
sctx = NULL;
|
|
xhci_ring_init(xhci, &epctx->ring, dequeue & ~0xF);
|
|
epctx->ring.ccs = dequeue & 1;
|
|
}
|
|
|
|
xhci_set_ep_state(xhci, epctx, sctx, EP_STOPPED);
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
|
|
{
|
|
XHCIState *xhci = xfer->epctx->xhci;
|
|
int i;
|
|
|
|
xfer->int_req = false;
|
|
qemu_sglist_init(&xfer->sgl, DEVICE(xhci), xfer->trb_count, xhci->as);
|
|
for (i = 0; i < xfer->trb_count; i++) {
|
|
XHCITRB *trb = &xfer->trbs[i];
|
|
dma_addr_t addr;
|
|
unsigned int chunk = 0;
|
|
|
|
if (trb->control & TRB_TR_IOC) {
|
|
xfer->int_req = true;
|
|
}
|
|
|
|
switch (TRB_TYPE(*trb)) {
|
|
case TR_DATA:
|
|
if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
|
|
DPRINTF("xhci: data direction mismatch for TR_DATA\n");
|
|
goto err;
|
|
}
|
|
/* fallthrough */
|
|
case TR_NORMAL:
|
|
case TR_ISOCH:
|
|
addr = xhci_mask64(trb->parameter);
|
|
chunk = trb->status & 0x1ffff;
|
|
if (trb->control & TRB_TR_IDT) {
|
|
if (chunk > 8 || in_xfer) {
|
|
DPRINTF("xhci: invalid immediate data TRB\n");
|
|
goto err;
|
|
}
|
|
qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
|
|
} else {
|
|
qemu_sglist_add(&xfer->sgl, addr, chunk);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
|
|
err:
|
|
qemu_sglist_destroy(&xfer->sgl);
|
|
xhci_die(xhci);
|
|
return -1;
|
|
}
|
|
|
|
static void xhci_xfer_unmap(XHCITransfer *xfer)
|
|
{
|
|
usb_packet_unmap(&xfer->packet, &xfer->sgl);
|
|
qemu_sglist_destroy(&xfer->sgl);
|
|
}
|
|
|
|
static void xhci_xfer_report(XHCITransfer *xfer)
|
|
{
|
|
uint32_t edtla = 0;
|
|
unsigned int left;
|
|
bool reported = 0;
|
|
bool shortpkt = 0;
|
|
XHCIEvent event = {ER_TRANSFER, CC_SUCCESS};
|
|
XHCIState *xhci = xfer->epctx->xhci;
|
|
int i;
|
|
|
|
left = xfer->packet.actual_length;
|
|
|
|
for (i = 0; i < xfer->trb_count; i++) {
|
|
XHCITRB *trb = &xfer->trbs[i];
|
|
unsigned int chunk = 0;
|
|
|
|
switch (TRB_TYPE(*trb)) {
|
|
case TR_SETUP:
|
|
chunk = trb->status & 0x1ffff;
|
|
if (chunk > 8) {
|
|
chunk = 8;
|
|
}
|
|
break;
|
|
case TR_DATA:
|
|
case TR_NORMAL:
|
|
case TR_ISOCH:
|
|
chunk = trb->status & 0x1ffff;
|
|
if (chunk > left) {
|
|
chunk = left;
|
|
if (xfer->status == CC_SUCCESS) {
|
|
shortpkt = 1;
|
|
}
|
|
}
|
|
left -= chunk;
|
|
edtla += chunk;
|
|
break;
|
|
case TR_STATUS:
|
|
reported = 0;
|
|
shortpkt = 0;
|
|
break;
|
|
}
|
|
|
|
if (!reported && ((trb->control & TRB_TR_IOC) ||
|
|
(shortpkt && (trb->control & TRB_TR_ISP)) ||
|
|
(xfer->status != CC_SUCCESS && left == 0))) {
|
|
event.slotid = xfer->epctx->slotid;
|
|
event.epid = xfer->epctx->epid;
|
|
event.length = (trb->status & 0x1ffff) - chunk;
|
|
event.flags = 0;
|
|
event.ptr = trb->addr;
|
|
if (xfer->status == CC_SUCCESS) {
|
|
event.ccode = shortpkt ? CC_SHORT_PACKET : CC_SUCCESS;
|
|
} else {
|
|
event.ccode = xfer->status;
|
|
}
|
|
if (TRB_TYPE(*trb) == TR_EVDATA) {
|
|
event.ptr = trb->parameter;
|
|
event.flags |= TRB_EV_ED;
|
|
event.length = edtla & 0xffffff;
|
|
DPRINTF("xhci_xfer_data: EDTLA=%d\n", event.length);
|
|
edtla = 0;
|
|
}
|
|
xhci_event(xhci, &event, TRB_INTR(*trb));
|
|
reported = 1;
|
|
if (xfer->status != CC_SUCCESS) {
|
|
return;
|
|
}
|
|
}
|
|
|
|
switch (TRB_TYPE(*trb)) {
|
|
case TR_SETUP:
|
|
reported = 0;
|
|
shortpkt = 0;
|
|
break;
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
static void xhci_stall_ep(XHCITransfer *xfer)
|
|
{
|
|
XHCIEPContext *epctx = xfer->epctx;
|
|
XHCIState *xhci = epctx->xhci;
|
|
uint32_t err;
|
|
XHCIStreamContext *sctx;
|
|
|
|
if (epctx->type == ET_ISO_IN || epctx->type == ET_ISO_OUT) {
|
|
/* never halt isoch endpoints, 4.10.2 */
|
|
return;
|
|
}
|
|
|
|
if (epctx->nr_pstreams) {
|
|
sctx = xhci_find_stream(epctx, xfer->streamid, &err);
|
|
if (sctx == NULL) {
|
|
return;
|
|
}
|
|
sctx->ring.dequeue = xfer->trbs[0].addr;
|
|
sctx->ring.ccs = xfer->trbs[0].ccs;
|
|
xhci_set_ep_state(xhci, epctx, sctx, EP_HALTED);
|
|
} else {
|
|
epctx->ring.dequeue = xfer->trbs[0].addr;
|
|
epctx->ring.ccs = xfer->trbs[0].ccs;
|
|
xhci_set_ep_state(xhci, epctx, NULL, EP_HALTED);
|
|
}
|
|
}
|
|
|
|
static int xhci_setup_packet(XHCITransfer *xfer)
|
|
{
|
|
USBEndpoint *ep;
|
|
int dir;
|
|
|
|
dir = xfer->in_xfer ? USB_TOKEN_IN : USB_TOKEN_OUT;
|
|
|
|
if (xfer->packet.ep) {
|
|
ep = xfer->packet.ep;
|
|
} else {
|
|
ep = xhci_epid_to_usbep(xfer->epctx);
|
|
if (!ep) {
|
|
DPRINTF("xhci: slot %d has no device\n",
|
|
xfer->epctx->slotid);
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
xhci_xfer_create_sgl(xfer, dir == USB_TOKEN_IN); /* Also sets int_req */
|
|
usb_packet_setup(&xfer->packet, dir, ep, xfer->streamid,
|
|
xfer->trbs[0].addr, false, xfer->int_req);
|
|
if (usb_packet_map(&xfer->packet, &xfer->sgl)) {
|
|
qemu_sglist_destroy(&xfer->sgl);
|
|
return -1;
|
|
}
|
|
DPRINTF("xhci: setup packet pid 0x%x addr %d ep %d\n",
|
|
xfer->packet.pid, ep->dev->addr, ep->nr);
|
|
return 0;
|
|
}
|
|
|
|
static int xhci_try_complete_packet(XHCITransfer *xfer)
|
|
{
|
|
if (xfer->packet.status == USB_RET_ASYNC) {
|
|
trace_usb_xhci_xfer_async(xfer);
|
|
xfer->running_async = 1;
|
|
xfer->running_retry = 0;
|
|
xfer->complete = 0;
|
|
return 0;
|
|
} else if (xfer->packet.status == USB_RET_NAK) {
|
|
trace_usb_xhci_xfer_nak(xfer);
|
|
xfer->running_async = 0;
|
|
xfer->running_retry = 1;
|
|
xfer->complete = 0;
|
|
return 0;
|
|
} else {
|
|
xfer->running_async = 0;
|
|
xfer->running_retry = 0;
|
|
xfer->complete = 1;
|
|
xhci_xfer_unmap(xfer);
|
|
}
|
|
|
|
if (xfer->packet.status == USB_RET_SUCCESS) {
|
|
trace_usb_xhci_xfer_success(xfer, xfer->packet.actual_length);
|
|
xfer->status = CC_SUCCESS;
|
|
xhci_xfer_report(xfer);
|
|
return 0;
|
|
}
|
|
|
|
/* error */
|
|
trace_usb_xhci_xfer_error(xfer, xfer->packet.status);
|
|
switch (xfer->packet.status) {
|
|
case USB_RET_NODEV:
|
|
case USB_RET_IOERROR:
|
|
xfer->status = CC_USB_TRANSACTION_ERROR;
|
|
xhci_xfer_report(xfer);
|
|
xhci_stall_ep(xfer);
|
|
break;
|
|
case USB_RET_STALL:
|
|
xfer->status = CC_STALL_ERROR;
|
|
xhci_xfer_report(xfer);
|
|
xhci_stall_ep(xfer);
|
|
break;
|
|
case USB_RET_BABBLE:
|
|
xfer->status = CC_BABBLE_DETECTED;
|
|
xhci_xfer_report(xfer);
|
|
xhci_stall_ep(xfer);
|
|
break;
|
|
default:
|
|
DPRINTF("%s: FIXME: status = %d\n", __func__,
|
|
xfer->packet.status);
|
|
FIXME("unhandled USB_RET_*");
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int xhci_fire_ctl_transfer(XHCIState *xhci, XHCITransfer *xfer)
|
|
{
|
|
XHCITRB *trb_setup, *trb_status;
|
|
uint8_t bmRequestType;
|
|
|
|
trb_setup = &xfer->trbs[0];
|
|
trb_status = &xfer->trbs[xfer->trb_count-1];
|
|
|
|
trace_usb_xhci_xfer_start(xfer, xfer->epctx->slotid,
|
|
xfer->epctx->epid, xfer->streamid);
|
|
|
|
/* at most one Event Data TRB allowed after STATUS */
|
|
if (TRB_TYPE(*trb_status) == TR_EVDATA && xfer->trb_count > 2) {
|
|
trb_status--;
|
|
}
|
|
|
|
/* do some sanity checks */
|
|
if (TRB_TYPE(*trb_setup) != TR_SETUP) {
|
|
DPRINTF("xhci: ep0 first TD not SETUP: %d\n",
|
|
TRB_TYPE(*trb_setup));
|
|
return -1;
|
|
}
|
|
if (TRB_TYPE(*trb_status) != TR_STATUS) {
|
|
DPRINTF("xhci: ep0 last TD not STATUS: %d\n",
|
|
TRB_TYPE(*trb_status));
|
|
return -1;
|
|
}
|
|
if (!(trb_setup->control & TRB_TR_IDT)) {
|
|
DPRINTF("xhci: Setup TRB doesn't have IDT set\n");
|
|
return -1;
|
|
}
|
|
if ((trb_setup->status & 0x1ffff) != 8) {
|
|
DPRINTF("xhci: Setup TRB has bad length (%d)\n",
|
|
(trb_setup->status & 0x1ffff));
|
|
return -1;
|
|
}
|
|
|
|
bmRequestType = trb_setup->parameter;
|
|
|
|
xfer->in_xfer = bmRequestType & USB_DIR_IN;
|
|
xfer->iso_xfer = false;
|
|
xfer->timed_xfer = false;
|
|
|
|
if (xhci_setup_packet(xfer) < 0) {
|
|
return -1;
|
|
}
|
|
xfer->packet.parameter = trb_setup->parameter;
|
|
|
|
usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
|
|
xhci_try_complete_packet(xfer);
|
|
return 0;
|
|
}
|
|
|
|
static void xhci_calc_intr_kick(XHCIState *xhci, XHCITransfer *xfer,
|
|
XHCIEPContext *epctx, uint64_t mfindex)
|
|
{
|
|
uint64_t asap = ((mfindex + epctx->interval - 1) &
|
|
~(epctx->interval-1));
|
|
uint64_t kick = epctx->mfindex_last + epctx->interval;
|
|
|
|
assert(epctx->interval != 0);
|
|
xfer->mfindex_kick = MAX(asap, kick);
|
|
}
|
|
|
|
static void xhci_calc_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
|
|
XHCIEPContext *epctx, uint64_t mfindex)
|
|
{
|
|
if (xfer->trbs[0].control & TRB_TR_SIA) {
|
|
uint64_t asap = ((mfindex + epctx->interval - 1) &
|
|
~(epctx->interval-1));
|
|
if (asap >= epctx->mfindex_last &&
|
|
asap <= epctx->mfindex_last + epctx->interval * 4) {
|
|
xfer->mfindex_kick = epctx->mfindex_last + epctx->interval;
|
|
} else {
|
|
xfer->mfindex_kick = asap;
|
|
}
|
|
} else {
|
|
xfer->mfindex_kick = ((xfer->trbs[0].control >> TRB_TR_FRAMEID_SHIFT)
|
|
& TRB_TR_FRAMEID_MASK) << 3;
|
|
xfer->mfindex_kick |= mfindex & ~0x3fff;
|
|
if (xfer->mfindex_kick + 0x100 < mfindex) {
|
|
xfer->mfindex_kick += 0x4000;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void xhci_check_intr_iso_kick(XHCIState *xhci, XHCITransfer *xfer,
|
|
XHCIEPContext *epctx, uint64_t mfindex)
|
|
{
|
|
if (xfer->mfindex_kick > mfindex) {
|
|
timer_mod(epctx->kick_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
|
|
(xfer->mfindex_kick - mfindex) * 125000);
|
|
xfer->running_retry = 1;
|
|
} else {
|
|
epctx->mfindex_last = xfer->mfindex_kick;
|
|
timer_del(epctx->kick_timer);
|
|
xfer->running_retry = 0;
|
|
}
|
|
}
|
|
|
|
|
|
static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
|
|
{
|
|
uint64_t mfindex;
|
|
|
|
DPRINTF("xhci_submit(slotid=%d,epid=%d)\n", epctx->slotid, epctx->epid);
|
|
|
|
xfer->in_xfer = epctx->type>>2;
|
|
|
|
switch(epctx->type) {
|
|
case ET_INTR_OUT:
|
|
case ET_INTR_IN:
|
|
xfer->pkts = 0;
|
|
xfer->iso_xfer = false;
|
|
xfer->timed_xfer = true;
|
|
mfindex = xhci_mfindex_get(xhci);
|
|
xhci_calc_intr_kick(xhci, xfer, epctx, mfindex);
|
|
xhci_check_intr_iso_kick(xhci, xfer, epctx, mfindex);
|
|
if (xfer->running_retry) {
|
|
return -1;
|
|
}
|
|
break;
|
|
case ET_BULK_OUT:
|
|
case ET_BULK_IN:
|
|
xfer->pkts = 0;
|
|
xfer->iso_xfer = false;
|
|
xfer->timed_xfer = false;
|
|
break;
|
|
case ET_ISO_OUT:
|
|
case ET_ISO_IN:
|
|
xfer->pkts = 1;
|
|
xfer->iso_xfer = true;
|
|
xfer->timed_xfer = true;
|
|
mfindex = xhci_mfindex_get(xhci);
|
|
xhci_calc_iso_kick(xhci, xfer, epctx, mfindex);
|
|
xhci_check_intr_iso_kick(xhci, xfer, epctx, mfindex);
|
|
if (xfer->running_retry) {
|
|
return -1;
|
|
}
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("endpoint type", epctx->type);
|
|
return -1;
|
|
}
|
|
|
|
if (xhci_setup_packet(xfer) < 0) {
|
|
return -1;
|
|
}
|
|
usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
|
|
xhci_try_complete_packet(xfer);
|
|
return 0;
|
|
}
|
|
|
|
static int xhci_fire_transfer(XHCIState *xhci, XHCITransfer *xfer, XHCIEPContext *epctx)
|
|
{
|
|
trace_usb_xhci_xfer_start(xfer, xfer->epctx->slotid,
|
|
xfer->epctx->epid, xfer->streamid);
|
|
return xhci_submit(xhci, xfer, epctx);
|
|
}
|
|
|
|
static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
|
|
unsigned int epid, unsigned int streamid)
|
|
{
|
|
XHCIEPContext *epctx;
|
|
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
assert(epid >= 1 && epid <= 31);
|
|
|
|
if (!xhci->slots[slotid-1].enabled) {
|
|
DPRINTF("xhci: xhci_kick_ep for disabled slot %d\n", slotid);
|
|
return;
|
|
}
|
|
epctx = xhci->slots[slotid-1].eps[epid-1];
|
|
if (!epctx) {
|
|
DPRINTF("xhci: xhci_kick_ep for disabled endpoint %d,%d\n",
|
|
epid, slotid);
|
|
return;
|
|
}
|
|
|
|
if (epctx->kick_active) {
|
|
return;
|
|
}
|
|
xhci_kick_epctx(epctx, streamid);
|
|
}
|
|
|
|
static bool xhci_slot_ok(XHCIState *xhci, int slotid)
|
|
{
|
|
return (xhci->slots[slotid - 1].uport &&
|
|
xhci->slots[slotid - 1].uport->dev &&
|
|
xhci->slots[slotid - 1].uport->dev->attached);
|
|
}
|
|
|
|
static void xhci_kick_epctx(XHCIEPContext *epctx, unsigned int streamid)
|
|
{
|
|
XHCIState *xhci = epctx->xhci;
|
|
XHCIStreamContext *stctx = NULL;
|
|
XHCITransfer *xfer;
|
|
XHCIRing *ring;
|
|
USBEndpoint *ep = NULL;
|
|
uint64_t mfindex;
|
|
unsigned int count = 0;
|
|
int length;
|
|
int i;
|
|
|
|
trace_usb_xhci_ep_kick(epctx->slotid, epctx->epid, streamid);
|
|
assert(!epctx->kick_active);
|
|
|
|
/* If the device has been detached, but the guest has not noticed this
|
|
yet the 2 above checks will succeed, but we must NOT continue */
|
|
if (!xhci_slot_ok(xhci, epctx->slotid)) {
|
|
return;
|
|
}
|
|
|
|
if (epctx->retry) {
|
|
XHCITransfer *xfer = epctx->retry;
|
|
|
|
trace_usb_xhci_xfer_retry(xfer);
|
|
assert(xfer->running_retry);
|
|
if (xfer->timed_xfer) {
|
|
/* time to kick the transfer? */
|
|
mfindex = xhci_mfindex_get(xhci);
|
|
xhci_check_intr_iso_kick(xhci, xfer, epctx, mfindex);
|
|
if (xfer->running_retry) {
|
|
return;
|
|
}
|
|
xfer->timed_xfer = 0;
|
|
xfer->running_retry = 1;
|
|
}
|
|
if (xfer->iso_xfer) {
|
|
/* retry iso transfer */
|
|
if (xhci_setup_packet(xfer) < 0) {
|
|
return;
|
|
}
|
|
usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
|
|
assert(xfer->packet.status != USB_RET_NAK);
|
|
xhci_try_complete_packet(xfer);
|
|
} else {
|
|
/* retry nak'ed transfer */
|
|
if (xhci_setup_packet(xfer) < 0) {
|
|
return;
|
|
}
|
|
usb_handle_packet(xfer->packet.ep->dev, &xfer->packet);
|
|
if (xfer->packet.status == USB_RET_NAK) {
|
|
xhci_xfer_unmap(xfer);
|
|
return;
|
|
}
|
|
xhci_try_complete_packet(xfer);
|
|
}
|
|
assert(!xfer->running_retry);
|
|
if (xfer->complete) {
|
|
/* update ring dequeue ptr */
|
|
xhci_set_ep_state(xhci, epctx, stctx, epctx->state);
|
|
xhci_ep_free_xfer(epctx->retry);
|
|
}
|
|
epctx->retry = NULL;
|
|
}
|
|
|
|
if (epctx->state == EP_HALTED) {
|
|
DPRINTF("xhci: ep halted, not running schedule\n");
|
|
return;
|
|
}
|
|
|
|
|
|
if (epctx->nr_pstreams) {
|
|
uint32_t err;
|
|
stctx = xhci_find_stream(epctx, streamid, &err);
|
|
if (stctx == NULL) {
|
|
return;
|
|
}
|
|
ring = &stctx->ring;
|
|
xhci_set_ep_state(xhci, epctx, stctx, EP_RUNNING);
|
|
} else {
|
|
ring = &epctx->ring;
|
|
streamid = 0;
|
|
xhci_set_ep_state(xhci, epctx, NULL, EP_RUNNING);
|
|
}
|
|
if (!ring->dequeue) {
|
|
return;
|
|
}
|
|
|
|
epctx->kick_active++;
|
|
while (1) {
|
|
length = xhci_ring_chain_length(xhci, ring);
|
|
if (length <= 0) {
|
|
if (epctx->type == ET_ISO_OUT || epctx->type == ET_ISO_IN) {
|
|
/* 4.10.3.1 */
|
|
XHCIEvent ev = { ER_TRANSFER };
|
|
ev.ccode = epctx->type == ET_ISO_IN ?
|
|
CC_RING_OVERRUN : CC_RING_UNDERRUN;
|
|
ev.slotid = epctx->slotid;
|
|
ev.epid = epctx->epid;
|
|
ev.ptr = epctx->ring.dequeue;
|
|
xhci_event(xhci, &ev, xhci->slots[epctx->slotid-1].intr);
|
|
}
|
|
break;
|
|
}
|
|
xfer = xhci_ep_alloc_xfer(epctx, length);
|
|
if (xfer == NULL) {
|
|
break;
|
|
}
|
|
|
|
for (i = 0; i < length; i++) {
|
|
TRBType type;
|
|
type = xhci_ring_fetch(xhci, ring, &xfer->trbs[i], NULL);
|
|
if (!type) {
|
|
xhci_die(xhci);
|
|
xhci_ep_free_xfer(xfer);
|
|
epctx->kick_active--;
|
|
return;
|
|
}
|
|
}
|
|
xfer->streamid = streamid;
|
|
|
|
if (epctx->epid == 1) {
|
|
xhci_fire_ctl_transfer(xhci, xfer);
|
|
} else {
|
|
xhci_fire_transfer(xhci, xfer, epctx);
|
|
}
|
|
if (!xhci_slot_ok(xhci, epctx->slotid)) {
|
|
/* surprise removal -> stop processing */
|
|
break;
|
|
}
|
|
if (xfer->complete) {
|
|
/* update ring dequeue ptr */
|
|
xhci_set_ep_state(xhci, epctx, stctx, epctx->state);
|
|
xhci_ep_free_xfer(xfer);
|
|
xfer = NULL;
|
|
}
|
|
|
|
if (epctx->state == EP_HALTED) {
|
|
break;
|
|
}
|
|
if (xfer != NULL && xfer->running_retry) {
|
|
DPRINTF("xhci: xfer nacked, stopping schedule\n");
|
|
epctx->retry = xfer;
|
|
xhci_xfer_unmap(xfer);
|
|
break;
|
|
}
|
|
if (count++ > TRANSFER_LIMIT) {
|
|
trace_usb_xhci_enforced_limit("transfers");
|
|
break;
|
|
}
|
|
}
|
|
epctx->kick_active--;
|
|
|
|
ep = xhci_epid_to_usbep(epctx);
|
|
if (ep) {
|
|
usb_device_flush_ep_queue(ep->dev, ep);
|
|
}
|
|
}
|
|
|
|
static TRBCCode xhci_enable_slot(XHCIState *xhci, unsigned int slotid)
|
|
{
|
|
trace_usb_xhci_slot_enable(slotid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
xhci->slots[slotid-1].enabled = 1;
|
|
xhci->slots[slotid-1].uport = NULL;
|
|
memset(xhci->slots[slotid-1].eps, 0, sizeof(XHCIEPContext*)*31);
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static TRBCCode xhci_disable_slot(XHCIState *xhci, unsigned int slotid)
|
|
{
|
|
int i;
|
|
|
|
trace_usb_xhci_slot_disable(slotid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
for (i = 1; i <= 31; i++) {
|
|
if (xhci->slots[slotid-1].eps[i-1]) {
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
}
|
|
}
|
|
|
|
xhci->slots[slotid-1].enabled = 0;
|
|
xhci->slots[slotid-1].addressed = 0;
|
|
xhci->slots[slotid-1].uport = NULL;
|
|
xhci->slots[slotid-1].intr = 0;
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static USBPort *xhci_lookup_uport(XHCIState *xhci, uint32_t *slot_ctx)
|
|
{
|
|
USBPort *uport;
|
|
char path[32];
|
|
int i, pos, port;
|
|
|
|
port = (slot_ctx[1]>>16) & 0xFF;
|
|
if (port < 1 || port > xhci->numports) {
|
|
return NULL;
|
|
}
|
|
port = xhci->ports[port-1].uport->index+1;
|
|
pos = snprintf(path, sizeof(path), "%d", port);
|
|
for (i = 0; i < 5; i++) {
|
|
port = (slot_ctx[0] >> 4*i) & 0x0f;
|
|
if (!port) {
|
|
break;
|
|
}
|
|
pos += snprintf(path + pos, sizeof(path) - pos, ".%d", port);
|
|
}
|
|
|
|
QTAILQ_FOREACH(uport, &xhci->bus.used, next) {
|
|
if (strcmp(uport->path, path) == 0) {
|
|
return uport;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
|
|
uint64_t pictx, bool bsr)
|
|
{
|
|
XHCISlot *slot;
|
|
USBPort *uport;
|
|
USBDevice *dev;
|
|
dma_addr_t ictx, octx, dcbaap;
|
|
uint64_t poctx;
|
|
uint32_t ictl_ctx[2];
|
|
uint32_t slot_ctx[4];
|
|
uint32_t ep0_ctx[5];
|
|
int i;
|
|
TRBCCode res;
|
|
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
|
|
ldq_le_dma(xhci->as, dcbaap + 8 * slotid, &poctx, MEMTXATTRS_UNSPECIFIED);
|
|
ictx = xhci_mask64(pictx);
|
|
octx = xhci_mask64(poctx);
|
|
|
|
DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
|
|
DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
|
|
|
|
xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
|
|
|
|
if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) {
|
|
DPRINTF("xhci: invalid input context control %08x %08x\n",
|
|
ictl_ctx[0], ictl_ctx[1]);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
xhci_dma_read_u32s(xhci, ictx+32, slot_ctx, sizeof(slot_ctx));
|
|
xhci_dma_read_u32s(xhci, ictx+64, ep0_ctx, sizeof(ep0_ctx));
|
|
|
|
DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
|
|
DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
|
|
ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
|
|
|
|
uport = xhci_lookup_uport(xhci, slot_ctx);
|
|
if (uport == NULL) {
|
|
DPRINTF("xhci: port not found\n");
|
|
return CC_TRB_ERROR;
|
|
}
|
|
trace_usb_xhci_slot_address(slotid, uport->path);
|
|
|
|
dev = uport->dev;
|
|
if (!dev || !dev->attached) {
|
|
DPRINTF("xhci: port %s not connected\n", uport->path);
|
|
return CC_USB_TRANSACTION_ERROR;
|
|
}
|
|
|
|
for (i = 0; i < xhci->numslots; i++) {
|
|
if (i == slotid-1) {
|
|
continue;
|
|
}
|
|
if (xhci->slots[i].uport == uport) {
|
|
DPRINTF("xhci: port %s already assigned to slot %d\n",
|
|
uport->path, i+1);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
}
|
|
|
|
slot = &xhci->slots[slotid-1];
|
|
slot->uport = uport;
|
|
slot->ctx = octx;
|
|
slot->intr = get_field(slot_ctx[2], TRB_INTR);
|
|
|
|
/* Make sure device is in USB_STATE_DEFAULT state */
|
|
usb_device_reset(dev);
|
|
if (bsr) {
|
|
slot_ctx[3] = SLOT_DEFAULT << SLOT_STATE_SHIFT;
|
|
} else {
|
|
USBPacket p;
|
|
uint8_t buf[1];
|
|
|
|
slot_ctx[3] = (SLOT_ADDRESSED << SLOT_STATE_SHIFT) | slotid;
|
|
memset(&p, 0, sizeof(p));
|
|
usb_packet_addbuf(&p, buf, sizeof(buf));
|
|
usb_packet_setup(&p, USB_TOKEN_OUT,
|
|
usb_ep_get(dev, USB_TOKEN_OUT, 0), 0,
|
|
0, false, false);
|
|
usb_device_handle_control(dev, &p,
|
|
DeviceOutRequest | USB_REQ_SET_ADDRESS,
|
|
slotid, 0, 0, NULL);
|
|
assert(p.status != USB_RET_ASYNC);
|
|
usb_packet_cleanup(&p);
|
|
}
|
|
|
|
res = xhci_enable_ep(xhci, slotid, 1, octx+32, ep0_ctx);
|
|
|
|
DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
|
|
ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
|
|
|
|
xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
xhci_dma_write_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
|
|
|
|
xhci->slots[slotid-1].addressed = 1;
|
|
return res;
|
|
}
|
|
|
|
|
|
static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
|
|
uint64_t pictx, bool dc)
|
|
{
|
|
dma_addr_t ictx, octx;
|
|
uint32_t ictl_ctx[2];
|
|
uint32_t slot_ctx[4];
|
|
uint32_t islot_ctx[4];
|
|
uint32_t ep_ctx[5];
|
|
int i;
|
|
TRBCCode res;
|
|
|
|
trace_usb_xhci_slot_configure(slotid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
ictx = xhci_mask64(pictx);
|
|
octx = xhci->slots[slotid-1].ctx;
|
|
|
|
DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
|
|
DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
|
|
|
|
if (dc) {
|
|
for (i = 2; i <= 31; i++) {
|
|
if (xhci->slots[slotid-1].eps[i-1]) {
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
}
|
|
}
|
|
|
|
xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
|
|
slot_ctx[3] |= SLOT_ADDRESSED << SLOT_STATE_SHIFT;
|
|
DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
|
|
|
|
if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) {
|
|
DPRINTF("xhci: invalid input context control %08x %08x\n",
|
|
ictl_ctx[0], ictl_ctx[1]);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
xhci_dma_read_u32s(xhci, ictx+32, islot_ctx, sizeof(islot_ctx));
|
|
xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
|
|
if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) {
|
|
DPRINTF("xhci: invalid slot state %08x\n", slot_ctx[3]);
|
|
return CC_CONTEXT_STATE_ERROR;
|
|
}
|
|
|
|
xhci_free_device_streams(xhci, slotid, ictl_ctx[0] | ictl_ctx[1]);
|
|
|
|
for (i = 2; i <= 31; i++) {
|
|
if (ictl_ctx[0] & (1<<i)) {
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
}
|
|
if (ictl_ctx[1] & (1<<i)) {
|
|
xhci_dma_read_u32s(xhci, ictx+32+(32*i), ep_ctx, sizeof(ep_ctx));
|
|
DPRINTF("xhci: input ep%d.%d context: %08x %08x %08x %08x %08x\n",
|
|
i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
|
|
ep_ctx[3], ep_ctx[4]);
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
res = xhci_enable_ep(xhci, slotid, i, octx+(32*i), ep_ctx);
|
|
if (res != CC_SUCCESS) {
|
|
return res;
|
|
}
|
|
DPRINTF("xhci: output ep%d.%d context: %08x %08x %08x %08x %08x\n",
|
|
i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
|
|
ep_ctx[3], ep_ctx[4]);
|
|
xhci_dma_write_u32s(xhci, octx+(32*i), ep_ctx, sizeof(ep_ctx));
|
|
}
|
|
}
|
|
|
|
res = xhci_alloc_device_streams(xhci, slotid, ictl_ctx[1]);
|
|
if (res != CC_SUCCESS) {
|
|
for (i = 2; i <= 31; i++) {
|
|
if (ictl_ctx[1] & (1u << i)) {
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
}
|
|
}
|
|
return res;
|
|
}
|
|
|
|
slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
|
|
slot_ctx[3] |= SLOT_CONFIGURED << SLOT_STATE_SHIFT;
|
|
slot_ctx[0] &= ~(SLOT_CONTEXT_ENTRIES_MASK << SLOT_CONTEXT_ENTRIES_SHIFT);
|
|
slot_ctx[0] |= islot_ctx[0] & (SLOT_CONTEXT_ENTRIES_MASK <<
|
|
SLOT_CONTEXT_ENTRIES_SHIFT);
|
|
DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
|
|
xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
|
|
static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
|
|
uint64_t pictx)
|
|
{
|
|
dma_addr_t ictx, octx;
|
|
uint32_t ictl_ctx[2];
|
|
uint32_t iep0_ctx[5];
|
|
uint32_t ep0_ctx[5];
|
|
uint32_t islot_ctx[4];
|
|
uint32_t slot_ctx[4];
|
|
|
|
trace_usb_xhci_slot_evaluate(slotid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
ictx = xhci_mask64(pictx);
|
|
octx = xhci->slots[slotid-1].ctx;
|
|
|
|
DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
|
|
DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
|
|
|
|
xhci_dma_read_u32s(xhci, ictx, ictl_ctx, sizeof(ictl_ctx));
|
|
|
|
if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) {
|
|
DPRINTF("xhci: invalid input context control %08x %08x\n",
|
|
ictl_ctx[0], ictl_ctx[1]);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
if (ictl_ctx[1] & 0x1) {
|
|
xhci_dma_read_u32s(xhci, ictx+32, islot_ctx, sizeof(islot_ctx));
|
|
|
|
DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
|
|
islot_ctx[0], islot_ctx[1], islot_ctx[2], islot_ctx[3]);
|
|
|
|
xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
|
|
slot_ctx[1] &= ~0xFFFF; /* max exit latency */
|
|
slot_ctx[1] |= islot_ctx[1] & 0xFFFF;
|
|
/* update interrupter target field */
|
|
xhci->slots[slotid-1].intr = get_field(islot_ctx[2], TRB_INTR);
|
|
set_field(&slot_ctx[2], xhci->slots[slotid-1].intr, TRB_INTR);
|
|
|
|
DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
|
|
xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
}
|
|
|
|
if (ictl_ctx[1] & 0x2) {
|
|
xhci_dma_read_u32s(xhci, ictx+64, iep0_ctx, sizeof(iep0_ctx));
|
|
|
|
DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
|
|
iep0_ctx[0], iep0_ctx[1], iep0_ctx[2],
|
|
iep0_ctx[3], iep0_ctx[4]);
|
|
|
|
xhci_dma_read_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
|
|
|
|
ep0_ctx[1] &= ~0xFFFF0000; /* max packet size*/
|
|
ep0_ctx[1] |= iep0_ctx[1] & 0xFFFF0000;
|
|
|
|
DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
|
|
ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
|
|
|
|
xhci_dma_write_u32s(xhci, octx+32, ep0_ctx, sizeof(ep0_ctx));
|
|
}
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
|
|
{
|
|
uint32_t slot_ctx[4];
|
|
dma_addr_t octx;
|
|
int i;
|
|
|
|
trace_usb_xhci_slot_reset(slotid);
|
|
assert(slotid >= 1 && slotid <= xhci->numslots);
|
|
|
|
octx = xhci->slots[slotid-1].ctx;
|
|
|
|
DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
|
|
|
|
for (i = 2; i <= 31; i++) {
|
|
if (xhci->slots[slotid-1].eps[i-1]) {
|
|
xhci_disable_ep(xhci, slotid, i);
|
|
}
|
|
}
|
|
|
|
xhci_dma_read_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
|
|
slot_ctx[3] |= SLOT_DEFAULT << SLOT_STATE_SHIFT;
|
|
DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
|
|
slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
|
|
xhci_dma_write_u32s(xhci, octx, slot_ctx, sizeof(slot_ctx));
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *trb)
|
|
{
|
|
unsigned int slotid;
|
|
slotid = (trb->control >> TRB_CR_SLOTID_SHIFT) & TRB_CR_SLOTID_MASK;
|
|
if (slotid < 1 || slotid > xhci->numslots) {
|
|
DPRINTF("xhci: bad slot id %d\n", slotid);
|
|
event->ccode = CC_TRB_ERROR;
|
|
return 0;
|
|
} else if (!xhci->slots[slotid-1].enabled) {
|
|
DPRINTF("xhci: slot id %d not enabled\n", slotid);
|
|
event->ccode = CC_SLOT_NOT_ENABLED_ERROR;
|
|
return 0;
|
|
}
|
|
return slotid;
|
|
}
|
|
|
|
/* cleanup slot state on usb device detach */
|
|
static void xhci_detach_slot(XHCIState *xhci, USBPort *uport)
|
|
{
|
|
int slot, ep;
|
|
|
|
for (slot = 0; slot < xhci->numslots; slot++) {
|
|
if (xhci->slots[slot].uport == uport) {
|
|
break;
|
|
}
|
|
}
|
|
if (slot == xhci->numslots) {
|
|
return;
|
|
}
|
|
|
|
for (ep = 0; ep < 31; ep++) {
|
|
if (xhci->slots[slot].eps[ep]) {
|
|
xhci_ep_nuke_xfers(xhci, slot + 1, ep + 1, 0);
|
|
}
|
|
}
|
|
xhci->slots[slot].uport = NULL;
|
|
}
|
|
|
|
static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
|
|
{
|
|
dma_addr_t ctx;
|
|
uint8_t bw_ctx[xhci->numports+1];
|
|
|
|
DPRINTF("xhci_get_port_bandwidth()\n");
|
|
|
|
ctx = xhci_mask64(pctx);
|
|
|
|
DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx);
|
|
|
|
/* TODO: actually implement real values here */
|
|
bw_ctx[0] = 0;
|
|
memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
|
|
if (dma_memory_write(xhci->as, ctx, bw_ctx, sizeof(bw_ctx),
|
|
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
|
|
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n",
|
|
__func__);
|
|
return CC_TRB_ERROR;
|
|
}
|
|
|
|
return CC_SUCCESS;
|
|
}
|
|
|
|
static uint32_t rotl(uint32_t v, unsigned count)
|
|
{
|
|
count &= 31;
|
|
return (v << count) | (v >> (32 - count));
|
|
}
|
|
|
|
|
|
static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo)
|
|
{
|
|
uint32_t val;
|
|
val = rotl(lo - 0x49434878, 32 - ((hi>>8) & 0x1F));
|
|
val += rotl(lo + 0x49434878, hi & 0x1F);
|
|
val -= rotl(hi ^ 0x49434878, (lo >> 16) & 0x1F);
|
|
return ~val;
|
|
}
|
|
|
|
static void xhci_process_commands(XHCIState *xhci)
|
|
{
|
|
XHCITRB trb;
|
|
TRBType type;
|
|
XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS};
|
|
dma_addr_t addr;
|
|
unsigned int i, slotid = 0, count = 0;
|
|
|
|
DPRINTF("xhci_process_commands()\n");
|
|
if (!xhci_running(xhci)) {
|
|
DPRINTF("xhci_process_commands() called while xHC stopped or paused\n");
|
|
return;
|
|
}
|
|
|
|
xhci->crcr_low |= CRCR_CRR;
|
|
|
|
while ((type = xhci_ring_fetch(xhci, &xhci->cmd_ring, &trb, &addr))) {
|
|
event.ptr = addr;
|
|
switch (type) {
|
|
case CR_ENABLE_SLOT:
|
|
for (i = 0; i < xhci->numslots; i++) {
|
|
if (!xhci->slots[i].enabled) {
|
|
break;
|
|
}
|
|
}
|
|
if (i >= xhci->numslots) {
|
|
DPRINTF("xhci: no device slots available\n");
|
|
event.ccode = CC_NO_SLOTS_ERROR;
|
|
} else {
|
|
slotid = i+1;
|
|
event.ccode = xhci_enable_slot(xhci, slotid);
|
|
}
|
|
break;
|
|
case CR_DISABLE_SLOT:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
event.ccode = xhci_disable_slot(xhci, slotid);
|
|
}
|
|
break;
|
|
case CR_ADDRESS_DEVICE:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
event.ccode = xhci_address_slot(xhci, slotid, trb.parameter,
|
|
trb.control & TRB_CR_BSR);
|
|
}
|
|
break;
|
|
case CR_CONFIGURE_ENDPOINT:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
event.ccode = xhci_configure_slot(xhci, slotid, trb.parameter,
|
|
trb.control & TRB_CR_DC);
|
|
}
|
|
break;
|
|
case CR_EVALUATE_CONTEXT:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
event.ccode = xhci_evaluate_slot(xhci, slotid, trb.parameter);
|
|
}
|
|
break;
|
|
case CR_STOP_ENDPOINT:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
|
|
& TRB_CR_EPID_MASK;
|
|
event.ccode = xhci_stop_ep(xhci, slotid, epid);
|
|
}
|
|
break;
|
|
case CR_RESET_ENDPOINT:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
|
|
& TRB_CR_EPID_MASK;
|
|
event.ccode = xhci_reset_ep(xhci, slotid, epid);
|
|
}
|
|
break;
|
|
case CR_SET_TR_DEQUEUE:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
unsigned int epid = (trb.control >> TRB_CR_EPID_SHIFT)
|
|
& TRB_CR_EPID_MASK;
|
|
unsigned int streamid = (trb.status >> 16) & 0xffff;
|
|
event.ccode = xhci_set_ep_dequeue(xhci, slotid,
|
|
epid, streamid,
|
|
trb.parameter);
|
|
}
|
|
break;
|
|
case CR_RESET_DEVICE:
|
|
slotid = xhci_get_slot(xhci, &event, &trb);
|
|
if (slotid) {
|
|
event.ccode = xhci_reset_slot(xhci, slotid);
|
|
}
|
|
break;
|
|
case CR_GET_PORT_BANDWIDTH:
|
|
event.ccode = xhci_get_port_bandwidth(xhci, trb.parameter);
|
|
break;
|
|
case CR_NOOP:
|
|
event.ccode = CC_SUCCESS;
|
|
break;
|
|
case CR_VENDOR_NEC_FIRMWARE_REVISION:
|
|
if (xhci->nec_quirks) {
|
|
event.type = 48; /* NEC reply */
|
|
event.length = 0x3034;
|
|
} else {
|
|
event.ccode = CC_TRB_ERROR;
|
|
}
|
|
break;
|
|
case CR_VENDOR_NEC_CHALLENGE_RESPONSE:
|
|
if (xhci->nec_quirks) {
|
|
uint32_t chi = trb.parameter >> 32;
|
|
uint32_t clo = trb.parameter;
|
|
uint32_t val = xhci_nec_challenge(chi, clo);
|
|
event.length = val & 0xFFFF;
|
|
event.epid = val >> 16;
|
|
slotid = val >> 24;
|
|
event.type = 48; /* NEC reply */
|
|
} else {
|
|
event.ccode = CC_TRB_ERROR;
|
|
}
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("command", type);
|
|
event.ccode = CC_TRB_ERROR;
|
|
break;
|
|
}
|
|
event.slotid = slotid;
|
|
xhci_event(xhci, &event, 0);
|
|
|
|
if (count++ > COMMAND_LIMIT) {
|
|
trace_usb_xhci_enforced_limit("commands");
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
|
|
static bool xhci_port_have_device(XHCIPort *port)
|
|
{
|
|
if (!port->uport->dev || !port->uport->dev->attached) {
|
|
return false; /* no device present */
|
|
}
|
|
if (!((1 << port->uport->dev->speed) & port->speedmask)) {
|
|
return false; /* speed mismatch */
|
|
}
|
|
return true;
|
|
}
|
|
|
|
static void xhci_port_notify(XHCIPort *port, uint32_t bits)
|
|
{
|
|
XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,
|
|
port->portnr << 24 };
|
|
|
|
if ((port->portsc & bits) == bits) {
|
|
return;
|
|
}
|
|
trace_usb_xhci_port_notify(port->portnr, bits);
|
|
port->portsc |= bits;
|
|
if (!xhci_running(port->xhci)) {
|
|
return;
|
|
}
|
|
xhci_event(port->xhci, &ev, 0);
|
|
}
|
|
|
|
static void xhci_port_update(XHCIPort *port, int is_detach)
|
|
{
|
|
uint32_t pls = PLS_RX_DETECT;
|
|
|
|
assert(port);
|
|
port->portsc = PORTSC_PP;
|
|
if (!is_detach && xhci_port_have_device(port)) {
|
|
port->portsc |= PORTSC_CCS;
|
|
switch (port->uport->dev->speed) {
|
|
case USB_SPEED_LOW:
|
|
port->portsc |= PORTSC_SPEED_LOW;
|
|
pls = PLS_POLLING;
|
|
break;
|
|
case USB_SPEED_FULL:
|
|
port->portsc |= PORTSC_SPEED_FULL;
|
|
pls = PLS_POLLING;
|
|
break;
|
|
case USB_SPEED_HIGH:
|
|
port->portsc |= PORTSC_SPEED_HIGH;
|
|
pls = PLS_POLLING;
|
|
break;
|
|
case USB_SPEED_SUPER:
|
|
port->portsc |= PORTSC_SPEED_SUPER;
|
|
port->portsc |= PORTSC_PED;
|
|
pls = PLS_U0;
|
|
break;
|
|
}
|
|
}
|
|
set_field(&port->portsc, pls, PORTSC_PLS);
|
|
trace_usb_xhci_port_link(port->portnr, pls);
|
|
xhci_port_notify(port, PORTSC_CSC);
|
|
}
|
|
|
|
static void xhci_port_reset(XHCIPort *port, bool warm_reset)
|
|
{
|
|
trace_usb_xhci_port_reset(port->portnr, warm_reset);
|
|
|
|
if (!xhci_port_have_device(port)) {
|
|
return;
|
|
}
|
|
|
|
usb_device_reset(port->uport->dev);
|
|
|
|
switch (port->uport->dev->speed) {
|
|
case USB_SPEED_SUPER:
|
|
if (warm_reset) {
|
|
port->portsc |= PORTSC_WRC;
|
|
}
|
|
/* fall through */
|
|
case USB_SPEED_LOW:
|
|
case USB_SPEED_FULL:
|
|
case USB_SPEED_HIGH:
|
|
set_field(&port->portsc, PLS_U0, PORTSC_PLS);
|
|
trace_usb_xhci_port_link(port->portnr, PLS_U0);
|
|
port->portsc |= PORTSC_PED;
|
|
break;
|
|
}
|
|
|
|
port->portsc &= ~PORTSC_PR;
|
|
xhci_port_notify(port, PORTSC_PRC);
|
|
}
|
|
|
|
static void xhci_reset(DeviceState *dev)
|
|
{
|
|
XHCIState *xhci = XHCI(dev);
|
|
int i;
|
|
|
|
trace_usb_xhci_reset();
|
|
if (!(xhci->usbsts & USBSTS_HCH)) {
|
|
DPRINTF("xhci: reset while running!\n");
|
|
}
|
|
|
|
xhci->usbcmd = 0;
|
|
xhci->usbsts = USBSTS_HCH;
|
|
xhci->dnctrl = 0;
|
|
xhci->crcr_low = 0;
|
|
xhci->crcr_high = 0;
|
|
xhci->dcbaap_low = 0;
|
|
xhci->dcbaap_high = 0;
|
|
xhci->config = 0;
|
|
|
|
for (i = 0; i < xhci->numslots; i++) {
|
|
xhci_disable_slot(xhci, i+1);
|
|
}
|
|
|
|
for (i = 0; i < xhci->numports; i++) {
|
|
xhci_port_update(xhci->ports + i, 0);
|
|
}
|
|
|
|
for (i = 0; i < xhci->numintrs; i++) {
|
|
xhci->intr[i].iman = 0;
|
|
xhci->intr[i].imod = 0;
|
|
xhci->intr[i].erstsz = 0;
|
|
xhci->intr[i].erstba_low = 0;
|
|
xhci->intr[i].erstba_high = 0;
|
|
xhci->intr[i].erdp_low = 0;
|
|
xhci->intr[i].erdp_high = 0;
|
|
|
|
xhci->intr[i].er_ep_idx = 0;
|
|
xhci->intr[i].er_pcs = 1;
|
|
xhci->intr[i].ev_buffer_put = 0;
|
|
xhci->intr[i].ev_buffer_get = 0;
|
|
}
|
|
|
|
xhci->mfindex_start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
|
|
xhci_mfwrap_update(xhci);
|
|
}
|
|
|
|
static uint64_t xhci_cap_read(void *ptr, hwaddr reg, unsigned size)
|
|
{
|
|
XHCIState *xhci = ptr;
|
|
uint32_t ret;
|
|
|
|
switch (reg) {
|
|
case 0x00: /* HCIVERSION, CAPLENGTH */
|
|
ret = 0x01000000 | LEN_CAP;
|
|
break;
|
|
case 0x04: /* HCSPARAMS 1 */
|
|
ret = ((xhci->numports_2+xhci->numports_3)<<24)
|
|
| (xhci->numintrs<<8) | xhci->numslots;
|
|
break;
|
|
case 0x08: /* HCSPARAMS 2 */
|
|
ret = 0x0000000f;
|
|
break;
|
|
case 0x0c: /* HCSPARAMS 3 */
|
|
ret = 0x00000000;
|
|
break;
|
|
case 0x10: /* HCCPARAMS */
|
|
if (sizeof(dma_addr_t) == 4) {
|
|
ret = 0x00080000 | (xhci->max_pstreams_mask << 12);
|
|
} else {
|
|
ret = 0x00080001 | (xhci->max_pstreams_mask << 12);
|
|
}
|
|
break;
|
|
case 0x14: /* DBOFF */
|
|
ret = OFF_DOORBELL;
|
|
break;
|
|
case 0x18: /* RTSOFF */
|
|
ret = OFF_RUNTIME;
|
|
break;
|
|
|
|
/* extended capabilities */
|
|
case 0x20: /* Supported Protocol:00 */
|
|
ret = 0x02000402; /* USB 2.0 */
|
|
break;
|
|
case 0x24: /* Supported Protocol:04 */
|
|
ret = 0x20425355; /* "USB " */
|
|
break;
|
|
case 0x28: /* Supported Protocol:08 */
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
ret = (xhci->numports_2<<8) | (xhci->numports_3+1);
|
|
} else {
|
|
ret = (xhci->numports_2<<8) | 1;
|
|
}
|
|
break;
|
|
case 0x2c: /* Supported Protocol:0c */
|
|
ret = 0x00000000; /* reserved */
|
|
break;
|
|
case 0x30: /* Supported Protocol:00 */
|
|
ret = 0x03000002; /* USB 3.0 */
|
|
break;
|
|
case 0x34: /* Supported Protocol:04 */
|
|
ret = 0x20425355; /* "USB " */
|
|
break;
|
|
case 0x38: /* Supported Protocol:08 */
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
ret = (xhci->numports_3<<8) | 1;
|
|
} else {
|
|
ret = (xhci->numports_3<<8) | (xhci->numports_2+1);
|
|
}
|
|
break;
|
|
case 0x3c: /* Supported Protocol:0c */
|
|
ret = 0x00000000; /* reserved */
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("cap read", reg);
|
|
ret = 0;
|
|
}
|
|
|
|
trace_usb_xhci_cap_read(reg, ret);
|
|
return ret;
|
|
}
|
|
|
|
static uint64_t xhci_port_read(void *ptr, hwaddr reg, unsigned size)
|
|
{
|
|
XHCIPort *port = ptr;
|
|
uint32_t ret;
|
|
|
|
switch (reg) {
|
|
case 0x00: /* PORTSC */
|
|
ret = port->portsc;
|
|
break;
|
|
case 0x04: /* PORTPMSC */
|
|
case 0x08: /* PORTLI */
|
|
ret = 0;
|
|
break;
|
|
case 0x0c: /* reserved */
|
|
default:
|
|
trace_usb_xhci_unimplemented("port read", reg);
|
|
ret = 0;
|
|
}
|
|
|
|
trace_usb_xhci_port_read(port->portnr, reg, ret);
|
|
return ret;
|
|
}
|
|
|
|
static void xhci_port_write(void *ptr, hwaddr reg,
|
|
uint64_t val, unsigned size)
|
|
{
|
|
XHCIPort *port = ptr;
|
|
uint32_t portsc, notify;
|
|
|
|
trace_usb_xhci_port_write(port->portnr, reg, val);
|
|
|
|
switch (reg) {
|
|
case 0x00: /* PORTSC */
|
|
/* write-1-to-start bits */
|
|
if (val & PORTSC_WPR) {
|
|
xhci_port_reset(port, true);
|
|
break;
|
|
}
|
|
if (val & PORTSC_PR) {
|
|
xhci_port_reset(port, false);
|
|
break;
|
|
}
|
|
|
|
portsc = port->portsc;
|
|
notify = 0;
|
|
/* write-1-to-clear bits*/
|
|
portsc &= ~(val & (PORTSC_CSC|PORTSC_PEC|PORTSC_WRC|PORTSC_OCC|
|
|
PORTSC_PRC|PORTSC_PLC|PORTSC_CEC));
|
|
if (val & PORTSC_LWS) {
|
|
/* overwrite PLS only when LWS=1 */
|
|
uint32_t old_pls = get_field(port->portsc, PORTSC_PLS);
|
|
uint32_t new_pls = get_field(val, PORTSC_PLS);
|
|
switch (new_pls) {
|
|
case PLS_U0:
|
|
if (old_pls != PLS_U0) {
|
|
set_field(&portsc, new_pls, PORTSC_PLS);
|
|
trace_usb_xhci_port_link(port->portnr, new_pls);
|
|
notify = PORTSC_PLC;
|
|
}
|
|
break;
|
|
case PLS_U3:
|
|
if (old_pls < PLS_U3) {
|
|
set_field(&portsc, new_pls, PORTSC_PLS);
|
|
trace_usb_xhci_port_link(port->portnr, new_pls);
|
|
}
|
|
break;
|
|
case PLS_RESUME:
|
|
/* windows does this for some reason, don't spam stderr */
|
|
break;
|
|
default:
|
|
DPRINTF("%s: ignore pls write (old %d, new %d)\n",
|
|
__func__, old_pls, new_pls);
|
|
break;
|
|
}
|
|
}
|
|
/* read/write bits */
|
|
portsc &= ~(PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE);
|
|
portsc |= (val & (PORTSC_PP|PORTSC_WCE|PORTSC_WDE|PORTSC_WOE));
|
|
port->portsc = portsc;
|
|
if (notify) {
|
|
xhci_port_notify(port, notify);
|
|
}
|
|
break;
|
|
case 0x04: /* PORTPMSC */
|
|
case 0x08: /* PORTLI */
|
|
default:
|
|
trace_usb_xhci_unimplemented("port write", reg);
|
|
}
|
|
}
|
|
|
|
static uint64_t xhci_oper_read(void *ptr, hwaddr reg, unsigned size)
|
|
{
|
|
XHCIState *xhci = ptr;
|
|
uint32_t ret;
|
|
|
|
switch (reg) {
|
|
case 0x00: /* USBCMD */
|
|
ret = xhci->usbcmd;
|
|
break;
|
|
case 0x04: /* USBSTS */
|
|
ret = xhci->usbsts;
|
|
break;
|
|
case 0x08: /* PAGESIZE */
|
|
ret = 1; /* 4KiB */
|
|
break;
|
|
case 0x14: /* DNCTRL */
|
|
ret = xhci->dnctrl;
|
|
break;
|
|
case 0x18: /* CRCR low */
|
|
ret = xhci->crcr_low & ~0xe;
|
|
break;
|
|
case 0x1c: /* CRCR high */
|
|
ret = xhci->crcr_high;
|
|
break;
|
|
case 0x30: /* DCBAAP low */
|
|
ret = xhci->dcbaap_low;
|
|
break;
|
|
case 0x34: /* DCBAAP high */
|
|
ret = xhci->dcbaap_high;
|
|
break;
|
|
case 0x38: /* CONFIG */
|
|
ret = xhci->config;
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("oper read", reg);
|
|
ret = 0;
|
|
}
|
|
|
|
trace_usb_xhci_oper_read(reg, ret);
|
|
return ret;
|
|
}
|
|
|
|
static void xhci_oper_write(void *ptr, hwaddr reg,
|
|
uint64_t val, unsigned size)
|
|
{
|
|
XHCIState *xhci = XHCI(ptr);
|
|
|
|
trace_usb_xhci_oper_write(reg, val);
|
|
|
|
switch (reg) {
|
|
case 0x00: /* USBCMD */
|
|
if ((val & USBCMD_RS) && !(xhci->usbcmd & USBCMD_RS)) {
|
|
xhci_run(xhci);
|
|
} else if (!(val & USBCMD_RS) && (xhci->usbcmd & USBCMD_RS)) {
|
|
xhci_stop(xhci);
|
|
}
|
|
if (val & USBCMD_CSS) {
|
|
/* save state */
|
|
xhci->usbsts &= ~USBSTS_SRE;
|
|
}
|
|
if (val & USBCMD_CRS) {
|
|
/* restore state */
|
|
xhci->usbsts |= USBSTS_SRE;
|
|
}
|
|
xhci->usbcmd = val & 0xc0f;
|
|
xhci_mfwrap_update(xhci);
|
|
if (val & USBCMD_HCRST) {
|
|
xhci_reset(DEVICE(xhci));
|
|
}
|
|
xhci_intr_update(xhci, 0);
|
|
break;
|
|
|
|
case 0x04: /* USBSTS */
|
|
/* these bits are write-1-to-clear */
|
|
xhci->usbsts &= ~(val & (USBSTS_HSE|USBSTS_EINT|USBSTS_PCD|USBSTS_SRE));
|
|
xhci_intr_update(xhci, 0);
|
|
break;
|
|
|
|
case 0x14: /* DNCTRL */
|
|
xhci->dnctrl = val & 0xffff;
|
|
break;
|
|
case 0x18: /* CRCR low */
|
|
xhci->crcr_low = (val & 0xffffffcf) | (xhci->crcr_low & CRCR_CRR);
|
|
break;
|
|
case 0x1c: /* CRCR high */
|
|
xhci->crcr_high = val;
|
|
if (xhci->crcr_low & (CRCR_CA|CRCR_CS) && (xhci->crcr_low & CRCR_CRR)) {
|
|
XHCIEvent event = {ER_COMMAND_COMPLETE, CC_COMMAND_RING_STOPPED};
|
|
xhci->crcr_low &= ~CRCR_CRR;
|
|
xhci_event(xhci, &event, 0);
|
|
DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
|
|
} else {
|
|
dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
|
|
xhci_ring_init(xhci, &xhci->cmd_ring, base);
|
|
}
|
|
xhci->crcr_low &= ~(CRCR_CA | CRCR_CS);
|
|
break;
|
|
case 0x30: /* DCBAAP low */
|
|
xhci->dcbaap_low = val & 0xffffffc0;
|
|
break;
|
|
case 0x34: /* DCBAAP high */
|
|
xhci->dcbaap_high = val;
|
|
break;
|
|
case 0x38: /* CONFIG */
|
|
xhci->config = val & 0xff;
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("oper write", reg);
|
|
}
|
|
}
|
|
|
|
static uint64_t xhci_runtime_read(void *ptr, hwaddr reg,
|
|
unsigned size)
|
|
{
|
|
XHCIState *xhci = ptr;
|
|
uint32_t ret = 0;
|
|
|
|
if (reg < 0x20) {
|
|
switch (reg) {
|
|
case 0x00: /* MFINDEX */
|
|
ret = xhci_mfindex_get(xhci) & 0x3fff;
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("runtime read", reg);
|
|
break;
|
|
}
|
|
} else {
|
|
int v = (reg - 0x20) / 0x20;
|
|
XHCIInterrupter *intr = &xhci->intr[v];
|
|
switch (reg & 0x1f) {
|
|
case 0x00: /* IMAN */
|
|
ret = intr->iman;
|
|
break;
|
|
case 0x04: /* IMOD */
|
|
ret = intr->imod;
|
|
break;
|
|
case 0x08: /* ERSTSZ */
|
|
ret = intr->erstsz;
|
|
break;
|
|
case 0x10: /* ERSTBA low */
|
|
ret = intr->erstba_low;
|
|
break;
|
|
case 0x14: /* ERSTBA high */
|
|
ret = intr->erstba_high;
|
|
break;
|
|
case 0x18: /* ERDP low */
|
|
ret = intr->erdp_low;
|
|
break;
|
|
case 0x1c: /* ERDP high */
|
|
ret = intr->erdp_high;
|
|
break;
|
|
}
|
|
}
|
|
|
|
trace_usb_xhci_runtime_read(reg, ret);
|
|
return ret;
|
|
}
|
|
|
|
static void xhci_runtime_write(void *ptr, hwaddr reg,
|
|
uint64_t val, unsigned size)
|
|
{
|
|
XHCIState *xhci = ptr;
|
|
XHCIInterrupter *intr;
|
|
int v;
|
|
|
|
trace_usb_xhci_runtime_write(reg, val);
|
|
|
|
if (reg < 0x20) {
|
|
trace_usb_xhci_unimplemented("runtime write", reg);
|
|
return;
|
|
}
|
|
v = (reg - 0x20) / 0x20;
|
|
intr = &xhci->intr[v];
|
|
|
|
switch (reg & 0x1f) {
|
|
case 0x00: /* IMAN */
|
|
if (val & IMAN_IP) {
|
|
intr->iman &= ~IMAN_IP;
|
|
}
|
|
intr->iman &= ~IMAN_IE;
|
|
intr->iman |= val & IMAN_IE;
|
|
xhci_intr_update(xhci, v);
|
|
break;
|
|
case 0x04: /* IMOD */
|
|
intr->imod = val;
|
|
break;
|
|
case 0x08: /* ERSTSZ */
|
|
intr->erstsz = val & 0xffff;
|
|
break;
|
|
case 0x10: /* ERSTBA low */
|
|
if (xhci->nec_quirks) {
|
|
/* NEC driver bug: it doesn't align this to 64 bytes */
|
|
intr->erstba_low = val & 0xfffffff0;
|
|
} else {
|
|
intr->erstba_low = val & 0xffffffc0;
|
|
}
|
|
break;
|
|
case 0x14: /* ERSTBA high */
|
|
intr->erstba_high = val;
|
|
xhci_er_reset(xhci, v);
|
|
break;
|
|
case 0x18: /* ERDP low */
|
|
if (val & ERDP_EHB) {
|
|
intr->erdp_low &= ~ERDP_EHB;
|
|
}
|
|
intr->erdp_low = (val & ~ERDP_EHB) | (intr->erdp_low & ERDP_EHB);
|
|
if (val & ERDP_EHB) {
|
|
dma_addr_t erdp = xhci_addr64(intr->erdp_low, intr->erdp_high);
|
|
unsigned int dp_idx = (erdp - intr->er_start) / TRB_SIZE;
|
|
if (erdp >= intr->er_start &&
|
|
erdp < (intr->er_start + TRB_SIZE * intr->er_size) &&
|
|
dp_idx != intr->er_ep_idx) {
|
|
xhci_intr_raise(xhci, v);
|
|
}
|
|
}
|
|
break;
|
|
case 0x1c: /* ERDP high */
|
|
intr->erdp_high = val;
|
|
break;
|
|
default:
|
|
trace_usb_xhci_unimplemented("oper write", reg);
|
|
}
|
|
}
|
|
|
|
static uint64_t xhci_doorbell_read(void *ptr, hwaddr reg,
|
|
unsigned size)
|
|
{
|
|
/* doorbells always read as 0 */
|
|
trace_usb_xhci_doorbell_read(reg, 0);
|
|
return 0;
|
|
}
|
|
|
|
static void xhci_doorbell_write(void *ptr, hwaddr reg,
|
|
uint64_t val, unsigned size)
|
|
{
|
|
XHCIState *xhci = ptr;
|
|
unsigned int epid, streamid;
|
|
|
|
trace_usb_xhci_doorbell_write(reg, val);
|
|
|
|
if (!xhci_running(xhci)) {
|
|
DPRINTF("xhci: wrote doorbell while xHC stopped or paused\n");
|
|
return;
|
|
}
|
|
|
|
reg >>= 2;
|
|
|
|
if (reg == 0) {
|
|
if (val == 0) {
|
|
xhci_process_commands(xhci);
|
|
} else {
|
|
DPRINTF("xhci: bad doorbell 0 write: 0x%x\n",
|
|
(uint32_t)val);
|
|
}
|
|
} else {
|
|
epid = val & 0xff;
|
|
streamid = (val >> 16) & 0xffff;
|
|
if (reg > xhci->numslots) {
|
|
DPRINTF("xhci: bad doorbell %d\n", (int)reg);
|
|
} else if (epid == 0 || epid > 31) {
|
|
DPRINTF("xhci: bad doorbell %d write: 0x%x\n",
|
|
(int)reg, (uint32_t)val);
|
|
} else {
|
|
xhci_kick_ep(xhci, reg, epid, streamid);
|
|
}
|
|
}
|
|
}
|
|
|
|
static void xhci_cap_write(void *opaque, hwaddr addr, uint64_t val,
|
|
unsigned width)
|
|
{
|
|
/* nothing */
|
|
}
|
|
|
|
static const MemoryRegionOps xhci_cap_ops = {
|
|
.read = xhci_cap_read,
|
|
.write = xhci_cap_write,
|
|
.valid.min_access_size = 1,
|
|
.valid.max_access_size = 4,
|
|
.impl.min_access_size = 4,
|
|
.impl.max_access_size = 4,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static const MemoryRegionOps xhci_oper_ops = {
|
|
.read = xhci_oper_read,
|
|
.write = xhci_oper_write,
|
|
.valid.min_access_size = 4,
|
|
.valid.max_access_size = sizeof(dma_addr_t),
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static const MemoryRegionOps xhci_port_ops = {
|
|
.read = xhci_port_read,
|
|
.write = xhci_port_write,
|
|
.valid.min_access_size = 4,
|
|
.valid.max_access_size = 4,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static const MemoryRegionOps xhci_runtime_ops = {
|
|
.read = xhci_runtime_read,
|
|
.write = xhci_runtime_write,
|
|
.valid.min_access_size = 4,
|
|
.valid.max_access_size = sizeof(dma_addr_t),
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static const MemoryRegionOps xhci_doorbell_ops = {
|
|
.read = xhci_doorbell_read,
|
|
.write = xhci_doorbell_write,
|
|
.valid.min_access_size = 4,
|
|
.valid.max_access_size = 4,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void xhci_attach(USBPort *usbport)
|
|
{
|
|
XHCIState *xhci = usbport->opaque;
|
|
XHCIPort *port = xhci_lookup_port(xhci, usbport);
|
|
|
|
xhci_port_update(port, 0);
|
|
}
|
|
|
|
static void xhci_detach(USBPort *usbport)
|
|
{
|
|
XHCIState *xhci = usbport->opaque;
|
|
XHCIPort *port = xhci_lookup_port(xhci, usbport);
|
|
|
|
xhci_detach_slot(xhci, usbport);
|
|
xhci_port_update(port, 1);
|
|
}
|
|
|
|
static void xhci_wakeup(USBPort *usbport)
|
|
{
|
|
XHCIState *xhci = usbport->opaque;
|
|
XHCIPort *port = xhci_lookup_port(xhci, usbport);
|
|
|
|
assert(port);
|
|
if (get_field(port->portsc, PORTSC_PLS) != PLS_U3) {
|
|
return;
|
|
}
|
|
set_field(&port->portsc, PLS_RESUME, PORTSC_PLS);
|
|
xhci_port_notify(port, PORTSC_PLC);
|
|
}
|
|
|
|
static void xhci_complete(USBPort *port, USBPacket *packet)
|
|
{
|
|
XHCITransfer *xfer = container_of(packet, XHCITransfer, packet);
|
|
|
|
if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
|
|
xhci_ep_nuke_one_xfer(xfer, 0);
|
|
return;
|
|
}
|
|
xhci_try_complete_packet(xfer);
|
|
xhci_kick_epctx(xfer->epctx, xfer->streamid);
|
|
if (xfer->complete) {
|
|
xhci_ep_free_xfer(xfer);
|
|
}
|
|
}
|
|
|
|
static void xhci_child_detach(USBPort *uport, USBDevice *child)
|
|
{
|
|
USBBus *bus = usb_bus_from_device(child);
|
|
XHCIState *xhci = container_of(bus, XHCIState, bus);
|
|
|
|
xhci_detach_slot(xhci, child->port);
|
|
}
|
|
|
|
static USBPortOps xhci_uport_ops = {
|
|
.attach = xhci_attach,
|
|
.detach = xhci_detach,
|
|
.wakeup = xhci_wakeup,
|
|
.complete = xhci_complete,
|
|
.child_detach = xhci_child_detach,
|
|
};
|
|
|
|
static int xhci_find_epid(USBEndpoint *ep)
|
|
{
|
|
if (ep->nr == 0) {
|
|
return 1;
|
|
}
|
|
if (ep->pid == USB_TOKEN_IN) {
|
|
return ep->nr * 2 + 1;
|
|
} else {
|
|
return ep->nr * 2;
|
|
}
|
|
}
|
|
|
|
static USBEndpoint *xhci_epid_to_usbep(XHCIEPContext *epctx)
|
|
{
|
|
USBPort *uport;
|
|
uint32_t token;
|
|
|
|
if (!epctx) {
|
|
return NULL;
|
|
}
|
|
uport = epctx->xhci->slots[epctx->slotid - 1].uport;
|
|
if (!uport || !uport->dev) {
|
|
return NULL;
|
|
}
|
|
token = (epctx->epid & 1) ? USB_TOKEN_IN : USB_TOKEN_OUT;
|
|
return usb_ep_get(uport->dev, token, epctx->epid >> 1);
|
|
}
|
|
|
|
static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
|
|
unsigned int stream)
|
|
{
|
|
XHCIState *xhci = container_of(bus, XHCIState, bus);
|
|
int slotid;
|
|
|
|
DPRINTF("%s\n", __func__);
|
|
slotid = ep->dev->addr;
|
|
if (slotid == 0 || slotid > xhci->numslots ||
|
|
!xhci->slots[slotid - 1].enabled) {
|
|
DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr);
|
|
return;
|
|
}
|
|
xhci_kick_ep(xhci, slotid, xhci_find_epid(ep), stream);
|
|
}
|
|
|
|
static USBBusOps xhci_bus_ops = {
|
|
.wakeup_endpoint = xhci_wakeup_endpoint,
|
|
};
|
|
|
|
static void usb_xhci_init(XHCIState *xhci)
|
|
{
|
|
XHCIPort *port;
|
|
unsigned int i, usbports, speedmask;
|
|
|
|
xhci->usbsts = USBSTS_HCH;
|
|
|
|
if (xhci->numports_2 > XHCI_MAXPORTS_2) {
|
|
xhci->numports_2 = XHCI_MAXPORTS_2;
|
|
}
|
|
if (xhci->numports_3 > XHCI_MAXPORTS_3) {
|
|
xhci->numports_3 = XHCI_MAXPORTS_3;
|
|
}
|
|
usbports = MAX(xhci->numports_2, xhci->numports_3);
|
|
xhci->numports = xhci->numports_2 + xhci->numports_3;
|
|
|
|
usb_bus_new(&xhci->bus, sizeof(xhci->bus), &xhci_bus_ops, xhci->hostOpaque);
|
|
|
|
for (i = 0; i < usbports; i++) {
|
|
speedmask = 0;
|
|
if (i < xhci->numports_2) {
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
port = &xhci->ports[i + xhci->numports_3];
|
|
port->portnr = i + 1 + xhci->numports_3;
|
|
} else {
|
|
port = &xhci->ports[i];
|
|
port->portnr = i + 1;
|
|
}
|
|
port->uport = &xhci->uports[i];
|
|
port->speedmask =
|
|
USB_SPEED_MASK_LOW |
|
|
USB_SPEED_MASK_FULL |
|
|
USB_SPEED_MASK_HIGH;
|
|
assert(i < XHCI_MAXPORTS);
|
|
snprintf(port->name, sizeof(port->name), "usb2 port #%d", i+1);
|
|
speedmask |= port->speedmask;
|
|
}
|
|
if (i < xhci->numports_3) {
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_SS_FIRST)) {
|
|
port = &xhci->ports[i];
|
|
port->portnr = i + 1;
|
|
} else {
|
|
port = &xhci->ports[i + xhci->numports_2];
|
|
port->portnr = i + 1 + xhci->numports_2;
|
|
}
|
|
port->uport = &xhci->uports[i];
|
|
port->speedmask = USB_SPEED_MASK_SUPER;
|
|
assert(i < XHCI_MAXPORTS);
|
|
snprintf(port->name, sizeof(port->name), "usb3 port #%d", i+1);
|
|
speedmask |= port->speedmask;
|
|
}
|
|
usb_register_port(&xhci->bus, &xhci->uports[i], xhci, i,
|
|
&xhci_uport_ops, speedmask);
|
|
}
|
|
}
|
|
|
|
static void usb_xhci_realize(DeviceState *dev, Error **errp)
|
|
{
|
|
int i;
|
|
|
|
XHCIState *xhci = XHCI(dev);
|
|
|
|
if (xhci->numintrs > XHCI_MAXINTRS) {
|
|
xhci->numintrs = XHCI_MAXINTRS;
|
|
}
|
|
while (xhci->numintrs & (xhci->numintrs - 1)) { /* ! power of 2 */
|
|
xhci->numintrs++;
|
|
}
|
|
if (xhci->numintrs < 1) {
|
|
xhci->numintrs = 1;
|
|
}
|
|
if (xhci->numslots > XHCI_MAXSLOTS) {
|
|
xhci->numslots = XHCI_MAXSLOTS;
|
|
}
|
|
if (xhci->numslots < 1) {
|
|
xhci->numslots = 1;
|
|
}
|
|
if (xhci_get_flag(xhci, XHCI_FLAG_ENABLE_STREAMS)) {
|
|
xhci->max_pstreams_mask = 7; /* == 256 primary streams */
|
|
} else {
|
|
xhci->max_pstreams_mask = 0;
|
|
}
|
|
|
|
usb_xhci_init(xhci);
|
|
xhci->mfwrap_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, xhci_mfwrap_timer, xhci);
|
|
|
|
memory_region_init(&xhci->mem, OBJECT(dev), "xhci", XHCI_LEN_REGS);
|
|
memory_region_init_io(&xhci->mem_cap, OBJECT(dev), &xhci_cap_ops, xhci,
|
|
"capabilities", LEN_CAP);
|
|
memory_region_init_io(&xhci->mem_oper, OBJECT(dev), &xhci_oper_ops, xhci,
|
|
"operational", 0x400);
|
|
memory_region_init_io(&xhci->mem_runtime, OBJECT(dev), &xhci_runtime_ops,
|
|
xhci, "runtime", LEN_RUNTIME);
|
|
memory_region_init_io(&xhci->mem_doorbell, OBJECT(dev), &xhci_doorbell_ops,
|
|
xhci, "doorbell", LEN_DOORBELL);
|
|
|
|
memory_region_add_subregion(&xhci->mem, 0, &xhci->mem_cap);
|
|
memory_region_add_subregion(&xhci->mem, OFF_OPER, &xhci->mem_oper);
|
|
memory_region_add_subregion(&xhci->mem, OFF_RUNTIME, &xhci->mem_runtime);
|
|
memory_region_add_subregion(&xhci->mem, OFF_DOORBELL, &xhci->mem_doorbell);
|
|
|
|
for (i = 0; i < xhci->numports; i++) {
|
|
XHCIPort *port = &xhci->ports[i];
|
|
uint32_t offset = OFF_OPER + 0x400 + 0x10 * i;
|
|
port->xhci = xhci;
|
|
memory_region_init_io(&port->mem, OBJECT(dev), &xhci_port_ops, port,
|
|
port->name, 0x10);
|
|
memory_region_add_subregion(&xhci->mem, offset, &port->mem);
|
|
}
|
|
}
|
|
|
|
static void usb_xhci_unrealize(DeviceState *dev)
|
|
{
|
|
int i;
|
|
XHCIState *xhci = XHCI(dev);
|
|
|
|
trace_usb_xhci_exit();
|
|
|
|
for (i = 0; i < xhci->numslots; i++) {
|
|
xhci_disable_slot(xhci, i + 1);
|
|
}
|
|
|
|
if (xhci->mfwrap_timer) {
|
|
timer_free(xhci->mfwrap_timer);
|
|
xhci->mfwrap_timer = NULL;
|
|
}
|
|
|
|
memory_region_del_subregion(&xhci->mem, &xhci->mem_cap);
|
|
memory_region_del_subregion(&xhci->mem, &xhci->mem_oper);
|
|
memory_region_del_subregion(&xhci->mem, &xhci->mem_runtime);
|
|
memory_region_del_subregion(&xhci->mem, &xhci->mem_doorbell);
|
|
|
|
for (i = 0; i < xhci->numports; i++) {
|
|
XHCIPort *port = &xhci->ports[i];
|
|
memory_region_del_subregion(&xhci->mem, &port->mem);
|
|
}
|
|
|
|
usb_bus_release(&xhci->bus);
|
|
}
|
|
|
|
static int usb_xhci_post_load(void *opaque, int version_id)
|
|
{
|
|
XHCIState *xhci = opaque;
|
|
XHCISlot *slot;
|
|
XHCIEPContext *epctx;
|
|
dma_addr_t dcbaap, pctx;
|
|
uint32_t slot_ctx[4];
|
|
uint32_t ep_ctx[5];
|
|
int slotid, epid, state;
|
|
uint64_t addr;
|
|
|
|
dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
|
|
|
|
for (slotid = 1; slotid <= xhci->numslots; slotid++) {
|
|
slot = &xhci->slots[slotid-1];
|
|
if (!slot->addressed) {
|
|
continue;
|
|
}
|
|
ldq_le_dma(xhci->as, dcbaap + 8 * slotid, &addr, MEMTXATTRS_UNSPECIFIED);
|
|
slot->ctx = xhci_mask64(addr);
|
|
|
|
xhci_dma_read_u32s(xhci, slot->ctx, slot_ctx, sizeof(slot_ctx));
|
|
slot->uport = xhci_lookup_uport(xhci, slot_ctx);
|
|
if (!slot->uport) {
|
|
/* should not happen, but may trigger on guest bugs */
|
|
slot->enabled = 0;
|
|
slot->addressed = 0;
|
|
continue;
|
|
}
|
|
assert(slot->uport && slot->uport->dev);
|
|
|
|
for (epid = 1; epid <= 31; epid++) {
|
|
pctx = slot->ctx + 32 * epid;
|
|
xhci_dma_read_u32s(xhci, pctx, ep_ctx, sizeof(ep_ctx));
|
|
state = ep_ctx[0] & EP_STATE_MASK;
|
|
if (state == EP_DISABLED) {
|
|
continue;
|
|
}
|
|
epctx = xhci_alloc_epctx(xhci, slotid, epid);
|
|
slot->eps[epid-1] = epctx;
|
|
xhci_init_epctx(epctx, pctx, ep_ctx);
|
|
epctx->state = state;
|
|
if (state == EP_RUNNING) {
|
|
/* kick endpoint after vmload is finished */
|
|
timer_mod(epctx->kick_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
|
|
}
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static const VMStateDescription vmstate_xhci_ring = {
|
|
.name = "xhci-ring",
|
|
.version_id = 1,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_UINT64(dequeue, XHCIRing),
|
|
VMSTATE_BOOL(ccs, XHCIRing),
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
static const VMStateDescription vmstate_xhci_port = {
|
|
.name = "xhci-port",
|
|
.version_id = 1,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_UINT32(portsc, XHCIPort),
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
static const VMStateDescription vmstate_xhci_slot = {
|
|
.name = "xhci-slot",
|
|
.version_id = 1,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_BOOL(enabled, XHCISlot),
|
|
VMSTATE_BOOL(addressed, XHCISlot),
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
static const VMStateDescription vmstate_xhci_event = {
|
|
.name = "xhci-event",
|
|
.version_id = 1,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_UINT32(type, XHCIEvent),
|
|
VMSTATE_UINT32(ccode, XHCIEvent),
|
|
VMSTATE_UINT64(ptr, XHCIEvent),
|
|
VMSTATE_UINT32(length, XHCIEvent),
|
|
VMSTATE_UINT32(flags, XHCIEvent),
|
|
VMSTATE_UINT8(slotid, XHCIEvent),
|
|
VMSTATE_UINT8(epid, XHCIEvent),
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
static bool xhci_er_full(void *opaque, int version_id)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static const VMStateDescription vmstate_xhci_intr = {
|
|
.name = "xhci-intr",
|
|
.version_id = 1,
|
|
.fields = (VMStateField[]) {
|
|
/* registers */
|
|
VMSTATE_UINT32(iman, XHCIInterrupter),
|
|
VMSTATE_UINT32(imod, XHCIInterrupter),
|
|
VMSTATE_UINT32(erstsz, XHCIInterrupter),
|
|
VMSTATE_UINT32(erstba_low, XHCIInterrupter),
|
|
VMSTATE_UINT32(erstba_high, XHCIInterrupter),
|
|
VMSTATE_UINT32(erdp_low, XHCIInterrupter),
|
|
VMSTATE_UINT32(erdp_high, XHCIInterrupter),
|
|
|
|
/* state */
|
|
VMSTATE_BOOL(msix_used, XHCIInterrupter),
|
|
VMSTATE_BOOL(er_pcs, XHCIInterrupter),
|
|
VMSTATE_UINT64(er_start, XHCIInterrupter),
|
|
VMSTATE_UINT32(er_size, XHCIInterrupter),
|
|
VMSTATE_UINT32(er_ep_idx, XHCIInterrupter),
|
|
|
|
/* event queue (used if ring is full) */
|
|
VMSTATE_BOOL(er_full_unused, XHCIInterrupter),
|
|
VMSTATE_UINT32_TEST(ev_buffer_put, XHCIInterrupter, xhci_er_full),
|
|
VMSTATE_UINT32_TEST(ev_buffer_get, XHCIInterrupter, xhci_er_full),
|
|
VMSTATE_STRUCT_ARRAY_TEST(ev_buffer, XHCIInterrupter, EV_QUEUE,
|
|
xhci_er_full, 1,
|
|
vmstate_xhci_event, XHCIEvent),
|
|
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
const VMStateDescription vmstate_xhci = {
|
|
.name = "xhci-core",
|
|
.version_id = 1,
|
|
.post_load = usb_xhci_post_load,
|
|
.fields = (VMStateField[]) {
|
|
VMSTATE_STRUCT_VARRAY_UINT32(ports, XHCIState, numports, 1,
|
|
vmstate_xhci_port, XHCIPort),
|
|
VMSTATE_STRUCT_VARRAY_UINT32(slots, XHCIState, numslots, 1,
|
|
vmstate_xhci_slot, XHCISlot),
|
|
VMSTATE_STRUCT_VARRAY_UINT32(intr, XHCIState, numintrs, 1,
|
|
vmstate_xhci_intr, XHCIInterrupter),
|
|
|
|
/* Operational Registers */
|
|
VMSTATE_UINT32(usbcmd, XHCIState),
|
|
VMSTATE_UINT32(usbsts, XHCIState),
|
|
VMSTATE_UINT32(dnctrl, XHCIState),
|
|
VMSTATE_UINT32(crcr_low, XHCIState),
|
|
VMSTATE_UINT32(crcr_high, XHCIState),
|
|
VMSTATE_UINT32(dcbaap_low, XHCIState),
|
|
VMSTATE_UINT32(dcbaap_high, XHCIState),
|
|
VMSTATE_UINT32(config, XHCIState),
|
|
|
|
/* Runtime Registers & state */
|
|
VMSTATE_INT64(mfindex_start, XHCIState),
|
|
VMSTATE_TIMER_PTR(mfwrap_timer, XHCIState),
|
|
VMSTATE_STRUCT(cmd_ring, XHCIState, 1, vmstate_xhci_ring, XHCIRing),
|
|
|
|
VMSTATE_END_OF_LIST()
|
|
}
|
|
};
|
|
|
|
static Property xhci_properties[] = {
|
|
DEFINE_PROP_BIT("streams", XHCIState, flags,
|
|
XHCI_FLAG_ENABLE_STREAMS, true),
|
|
DEFINE_PROP_UINT32("p2", XHCIState, numports_2, 4),
|
|
DEFINE_PROP_UINT32("p3", XHCIState, numports_3, 4),
|
|
DEFINE_PROP_LINK("host", XHCIState, hostOpaque, TYPE_DEVICE,
|
|
DeviceState *),
|
|
DEFINE_PROP_END_OF_LIST(),
|
|
};
|
|
|
|
static void xhci_class_init(ObjectClass *klass, void *data)
|
|
{
|
|
DeviceClass *dc = DEVICE_CLASS(klass);
|
|
|
|
dc->realize = usb_xhci_realize;
|
|
dc->unrealize = usb_xhci_unrealize;
|
|
dc->reset = xhci_reset;
|
|
device_class_set_props(dc, xhci_properties);
|
|
dc->user_creatable = false;
|
|
}
|
|
|
|
static const TypeInfo xhci_info = {
|
|
.name = TYPE_XHCI,
|
|
.parent = TYPE_DEVICE,
|
|
.instance_size = sizeof(XHCIState),
|
|
.class_init = xhci_class_init,
|
|
};
|
|
|
|
static void xhci_register_types(void)
|
|
{
|
|
type_register_static(&xhci_info);
|
|
}
|
|
|
|
type_init(xhci_register_types)
|