[PATCH v2 00/17] hw/usb/ehci: Add 64-bit descriptor addressing support

[PATCH v2 00/17] hw/usb/ehci: Add 64-bit descriptor addressing support

[Jamin Lin]

EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
which provides the upper 32 bits of descriptor addresses when the
controller advertises 64-bit capability.

Currently QEMU EHCI model only partially supports this functionality and
descriptor addresses are effectively treated as 32-bit. This becomes
problematic on systems where system memory is located above the 4GB
boundary.

The Linux EHCI driver enables 64-bit addressing if the controller
advertises the capability. During initialization it programs the
segment register to zero:

  https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600

The driver also notes that descriptor structures allocated from the
DMA pool use segment zero semantics. Descriptor memory is allocated
using the DMA API and platforms may configure a 64-bit DMA mask,
allowing descriptor memory to be placed above 4GB.

On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
result, descriptor addresses constructed directly from the EHCI
registers do not match the actual system addresses used by the
controller when accessing queue heads (QH) and queue element transfer
descriptors (qTD).

This patch series implements full 64-bit descriptor addressing support
in the EHCI emulation. Descriptor address handling is updated to use
64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
are extended to support the upper address bits provided by the segment
register.

In addition, a descriptor-addr-offset property is introduced so
platforms can apply an address translation when descriptor memory
resides above the 4GB boundary.

The AST2700 machine uses this property to account for its DRAM mapping
at 0x400000000 and enables 64-bit EHCI DMA addressing.

Test Result:
1. EHCI 32bits with ast2600-evb machine
Command line:
./build/qemu-system-arm \
  -machine ast2600-evb \
  -m 1G \
  -drive file=image-bmc,if=mtd,format=raw \
  -nographic \
  -device usb-kbd,bus=usb-bus.1,id=mykbd \
  -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
  -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
  -snapshot \
  -nographic
Result:
unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller

2. EHCI 64bits with ast2700a2-evb machine
Command line:
./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
 -bios ast27x0_bootrom.bin \
 -drive file=image-bmc,format=raw,if=mtd \
 -snapshot \
 -device usb-kbd,bus=usb-bus.3,id=mykbd \
 -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
 -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
Result:
root@ast2700-default:~# lsusb
unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
 
v1
 1. Fix checkpatch coding style issues
 2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
 3. Add descriptor address offset property
 4. Enable 64-bit EHCI DMA addressing on AST2700
 5. Configure descriptor address offset for AST2700

v2
 1. Remove unused EHCIfstn structure and dead code
 2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
 3. Replace DPRINTF debug logs with trace events
 4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
 5. Fix review issue
 
Jamin Lin (17):
  hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
  hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with
    qemu_log_mask(LOG_GUEST_ERROR)
  hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
  hw/usb/hcd-ehci: Change descriptor addresses to 64-bit
  hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
    capability
  hw/usb/hcd-ehci: Reject CTRLDSSEGMENT writes without 64-bit capability
  hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
  hw/usb/hcd-ehci: Add descriptor address offset property
  hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
  hw/arm/aspeed_ast27x0: Set EHCI descriptor address offset
  tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
    AST2600 SDK
  tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
    AST2700 A1/A2

 hw/usb/hcd-ehci.h                             |  55 ++-
 hw/arm/aspeed_ast27x0.c                       |   5 +
 hw/usb/hcd-ehci-pci.c                         |   4 +
 hw/usb/hcd-ehci-sysbus.c                      |   4 +
 hw/usb/hcd-ehci.c                             | 371 ++++++++++--------
 hw/usb/trace-events                           |  25 +-
 .../aarch64/test_aspeed_ast2700a1.py          |   7 +
 .../aarch64/test_aspeed_ast2700a2.py          |   7 +
 .../functional/arm/test_aspeed_ast2600_sdk.py |   7 +
 9 files changed, 294 insertions(+), 191 deletions(-)

-- 
2.43.0

[PATCH v2 01/17] hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code

[Jamin Lin]

The EHCIfstn structure, defined according to EHCI spec section 3.7,
is currently unused in the EHCI implementation. Remove it to reduce
unused code and improve maintainability.

Additionally, drop a block of disabled (#if 0) code in
ehci_state_advqueue() that was never implemented. This code path
is incomplete and has no functional impact.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h |  7 -------
 hw/usb/hcd-ehci.c | 11 -----------
 2 files changed, 18 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 0ae8c06331..3aec0e047c 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -202,13 +202,6 @@ typedef struct EHCIqh {
 #define BUFPTR_SBYTES_SH              5
 } EHCIqh;
 
-/*  EHCI spec version 1.0 Section 3.7
- */
-typedef struct EHCIfstn {
-    uint32_t next;                    /* Standard next link pointer */
-    uint32_t backptr;                 /* Standard next link pointer */
-} EHCIfstn;
-
 enum async_state {
     EHCI_ASYNC_NONE = 0,
     EHCI_ASYNC_INITIALIZED,
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 57f930b099..5ea8461f70 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1756,17 +1756,6 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 /* Section 4.10.2 - paragraph 3 */
 static int ehci_state_advqueue(EHCIQueue *q)
 {
-#if 0
-    /* TO-DO: 4.10.2 - paragraph 2
-     * if I-bit is set to 1 and QH is not active
-     * go to horizontal QH
-     */
-    if (I-bit set) {
-        ehci_set_state(ehci, async, EST_HORIZONTALQH);
-        goto out;
-    }
-#endif
-
     /*
      * want data and alt-next qTD is valid
      */
-- 
2.43.0

[PATCH v2 02/17] hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch

[Jamin Lin]

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/usb/hcd-ehci.h | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3aec0e047c..736407fd52 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -43,7 +43,8 @@ typedef struct EHCIPacket EHCIPacket;
 typedef struct EHCIQueue EHCIQueue;
 typedef struct EHCIState EHCIState;
 
-/*  EHCI spec version 1.0 Section 3.3
+/*
+ * EHCI spec version 1.0 Section 3.3
  */
 typedef struct EHCIitd {
     uint32_t next;
@@ -74,7 +75,8 @@ typedef struct EHCIitd {
 #define ITD_BUFPTR_MULT_SH       0
 } EHCIitd;
 
-/*  EHCI spec version 1.0 Section 3.4
+/*
+ * EHCI spec version 1.0 Section 3.4
  */
 typedef struct EHCIsitd {
     uint32_t next;                  /* Standard next link pointer */
@@ -118,7 +120,8 @@ typedef struct EHCIsitd {
     uint32_t backptr;                 /* Standard next link pointer */
 } EHCIsitd;
 
-/*  EHCI spec version 1.0 Section 3.5
+/*
+ * EHCI spec version 1.0 Section 3.5
  */
 typedef struct EHCIqtd {
     uint32_t next;                    /* Standard next link pointer */
@@ -148,7 +151,8 @@ typedef struct EHCIqtd {
 #define QTD_BUFPTR_SH                 12
 } EHCIqtd;
 
-/*  EHCI spec version 1.0 Section 3.6
+/*
+ * EHCI spec version 1.0 Section 3.6
  */
 typedef struct EHCIqh {
     uint32_t next;                    /* Standard next link pointer */
@@ -230,7 +234,8 @@ struct EHCIQueue {
     int async;
     int transact_ctr;
 
-    /* cached data from guest - needs to be flushed
+    /*
+     * cached data from guest - needs to be flushed
      * when guest removes an entry (doorbell, handshake sequence)
      */
     EHCIqh qh;             /* copy of current QH (being worked on) */
@@ -268,7 +273,7 @@ struct EHCIState {
      */
     uint8_t caps[CAPA_SIZE];
     union {
-        uint32_t opreg[0x44/sizeof(uint32_t)];
+        uint32_t opreg[0x44 / sizeof(uint32_t)];
         struct {
             uint32_t usbcmd;
             uint32_t usbsts;
-- 
2.43.0

[PATCH v2 03/17] hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch

[Jamin Lin]

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.c | 126 +++++++++++++++++++++++++---------------------
 1 file changed, 69 insertions(+), 57 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 5ea8461f70..9b92384bac 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -41,21 +41,23 @@
 #define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
 #define UFRAME_TIMER_NS  (FRAME_TIMER_NS / 8)
 
-#define NB_MAXINTRATE    8        // Max rate at which controller issues ints
-#define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
-#define MAX_QH           100      // Max allowable queue heads in a chain
+#define NB_MAXINTRATE    8      /* Max rate at which controller issues ints */
+#define BUFF_SIZE        (5 * 4096) /* Max bytes to transfer per transaction */
+#define MAX_QH           100      /* Max allowable queue heads in a chain */
 #define MIN_UFR_PER_TICK 24       /* Min frames to process when catching up */
 #define PERIODIC_ACTIVE  512      /* Micro-frames */
 
-/*  Internal periodic / asynchronous schedule state machine states
+/*
+ * Internal periodic / asynchronous schedule state machine states
  */
 typedef enum {
     EST_INACTIVE = 1000,
     EST_ACTIVE,
     EST_EXECUTING,
     EST_SLEEPING,
-    /*  The following states are internal to the state machine function
-    */
+    /*
+     * The following states are internal to the state machine function
+     */
     EST_WAITLISTHEAD,
     EST_FETCHENTRY,
     EST_FETCHQH,
@@ -71,13 +73,13 @@ typedef enum {
 /* macros for accessing fields within next link pointer entry */
 #define NLPTR_GET(x)             ((x) & 0xffffffe0)
 #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
-#define NLPTR_TBIT(x)            ((x) & 1)  // 1=invalid, 0=valid
+#define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
 
 /* link pointer types */
-#define NLPTR_TYPE_ITD           0     // isoc xfer descriptor
-#define NLPTR_TYPE_QH            1     // queue head
-#define NLPTR_TYPE_STITD         2     // split xaction, isoc xfer descriptor
-#define NLPTR_TYPE_FSTN          3     // frame span traversal node
+#define NLPTR_TYPE_ITD           0     /* isoc xfer descriptor */
+#define NLPTR_TYPE_QH            1     /* queue head */
+#define NLPTR_TYPE_STITD         2     /* split xaction, isoc xfer descriptor */
+#define NLPTR_TYPE_FSTN          3     /* frame span traversal node */
 
 #define SET_LAST_RUN_CLOCK(s) \
     (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -88,10 +90,10 @@ typedef enum {
 
 #define set_field(data, newval, field) do { \
     uint32_t val = *data; \
-    val &= ~ field##_MASK; \
+    val &= ~field##_MASK; \
     val |= ((newval) << field##_SH) & field##_MASK; \
     *data = val; \
-    } while(0)
+    } while (0)
 
 static const char *ehci_state_names[] = {
     [EST_INACTIVE]     = "INACTIVE",
@@ -472,8 +474,10 @@ static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
     }
 }
 
-/* Finish executing and writeback a packet outside of the regular
-   fetchqh -> fetchqtd -> execute -> writeback cycle */
+/*
+ * Finish executing and writeback a packet outside of the regular
+ * fetchqh -> fetchqtd -> execute -> writeback cycle
+ */
 static void ehci_writeback_async_complete_packet(EHCIPacket *p)
 {
     EHCIQueue *q = p->queue;
@@ -733,7 +737,7 @@ static void ehci_detach(USBPort *port)
     ehci_queues_rip_device(s, port->dev, 0);
     ehci_queues_rip_device(s, port->dev, 1);
 
-    *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
+    *portsc &= ~(PORTSC_CONNECT | PORTSC_PED | PORTSC_SUSPEND);
     *portsc |= PORTSC_CSC;
 
     ehci_raise_irq(s, USBSTS_PCD);
@@ -858,7 +862,7 @@ void ehci_reset(void *opaque)
      * Do the detach before touching portsc, so that it correctly gets send to
      * us or to our companion based on PORTSC_POWNER before the reset.
      */
-    for(i = 0; i < EHCI_PORTS; i++) {
+    for (i = 0; i < EHCI_PORTS; i++) {
         devs[i] = s->ports[i].dev;
         if (devs[i] && devs[i]->attached) {
             usb_detach(&s->ports[i]);
@@ -877,7 +881,7 @@ void ehci_reset(void *opaque)
     s->astate = EST_INACTIVE;
     s->pstate = EST_INACTIVE;
 
-    for(i = 0; i < EHCI_PORTS; i++) {
+    for (i = 0; i < EHCI_PORTS; i++) {
         if (s->companion_ports[i]) {
             s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
         } else {
@@ -942,8 +946,9 @@ static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
     uint32_t *portsc = &s->portsc[port];
     uint32_t orig;
 
-    if (s->companion_ports[port] == NULL)
+    if (s->companion_ports[port] == NULL) {
         return;
+    }
 
     owner = owner & PORTSC_POWNER;
     orig  = *portsc & PORTSC_POWNER;
@@ -988,7 +993,7 @@ static void ehci_port_write(void *ptr, hwaddr addr,
         trace_usb_ehci_port_reset(port, 1);
     }
 
-    if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
+    if (!(val & PORTSC_PRESET) && (*portsc & PORTSC_PRESET)) {
         trace_usb_ehci_port_reset(port, 0);
         if (dev && dev->attached) {
             usb_port_reset(&s->ports[port]);
@@ -1065,8 +1070,10 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
         break;
 
     case USBSTS:
-        val &= USBSTS_RO_MASK;              // bits 6 through 31 are RO
-        ehci_clear_usbsts(s, val);          // bits 0 through 5 are R/WC
+        /* bits 6 through 31 are RO */
+        val &= USBSTS_RO_MASK;
+        /* bits 0 through 5 are R/WC */
+        ehci_clear_usbsts(s, val);
         val = s->usbsts;
         ehci_update_irq(s);
         break;
@@ -1131,8 +1138,7 @@ static void ehci_flush_qh(EHCIQueue *q)
     put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
 }
 
-// 4.10.2
-
+/* 4.10.2 */
 static int ehci_qh_do_overlay(EHCIQueue *q)
 {
     EHCIPacket *p = QTAILQ_FIRST(&q->packets);
@@ -1145,8 +1151,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
     assert(p != NULL);
     assert(p->qtdaddr == q->qtdaddr);
 
-    // remember values in fields to preserve in qh after overlay
-
+    /*  remember values in fields to preserve in qh after overlay */
     dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
     ping    = q->qh.token & QTD_TOKEN_PING;
 
@@ -1170,7 +1175,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
     }
 
     if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
-        // preserve QH DT bit
+        /* preserve QH DT bit */
         q->qh.token &= ~QTD_TOKEN_DTOGGLE;
         q->qh.token |= dtoggle;
     }
@@ -1397,9 +1402,7 @@ static int ehci_execute(EHCIPacket *p, const char *action)
     return 1;
 }
 
-/*  4.7.2
- */
-
+/* 4.7.2 */
 static int ehci_process_itd(EHCIState *ehci,
                             EHCIitd *itd,
                             uint32_t addr)
@@ -1411,13 +1414,13 @@ static int ehci_process_itd(EHCIState *ehci,
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
 
-    dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
+    dir = (itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
     devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
     endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
     max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
     mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
 
-    for(i = 0; i < 8; i++) {
+    for (i = 0; i < 8; i++) {
         if (itd->transact[i] & ITD_XACT_ACTIVE) {
             pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
             off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
@@ -1513,8 +1516,9 @@ static int ehci_process_itd(EHCIState *ehci,
 }
 
 
-/*  This state is the entry point for asynchronous schedule
- *  processing.  Entry here constitutes a EHCI start event state (4.8.5)
+/*
+ * This state is the entry point for asynchronous schedule
+ * processing.  Entry here constitutes a EHCI start event state (4.8.5)
  */
 static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
 {
@@ -1531,7 +1535,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     ehci_queues_rip_unused(ehci, async);
 
     /*  Find the head of the list (4.9.1.1) */
-    for(i = 0; i < MAX_QH; i++) {
+    for (i = 0; i < MAX_QH; i++) {
         if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
                        sizeof(EHCIqh) >> 2) < 0) {
             return 0;
@@ -1564,8 +1568,9 @@ out:
 }
 
 
-/*  This state is the entry point for periodic schedule processing as
- *  well as being a continuation state for async processing.
+/*
+ * This state is the entry point for periodic schedule processing as
+ * well as being a continuation state for async processing.
  */
 static int ehci_state_fetchentry(EHCIState *ehci, int async)
 {
@@ -1674,7 +1679,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
 
 #if EHCI_DEBUG
     if (q->qhaddr != q->qh.next) {
-    DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
+        DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
                q->qhaddr,
                q->qh.epchar & QH_EPCHAR_H,
                q->qh.token & QTD_TOKEN_HALT,
@@ -1924,8 +1929,10 @@ static int ehci_state_execute(EHCIQueue *q)
         return -1;
     }
 
-    // TODO verify enough time remains in the uframe as in 4.4.1.1
-    // TODO write back ptr to async list when done or out of time
+    /*
+     * TODO verify enough time remains in the uframe as in 4.4.1.1
+     * TODO write back ptr to async list when done or out of time
+     */
 
     /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
     if (!q->async && q->transact_ctr == 0) {
@@ -2036,7 +2043,7 @@ static void ehci_advance_state(EHCIState *ehci, int async)
     int again;
 
     do {
-        switch(ehci_get_state(ehci, async)) {
+        switch (ehci_get_state(ehci, async)) {
         case EST_WAITLISTHEAD:
             again = ehci_state_waitlisthead(ehci, async);
             break;
@@ -2115,21 +2122,20 @@ static void ehci_advance_state(EHCIState *ehci, int async)
             ehci_reset(ehci);
             again = 0;
         }
-    }
-    while (again);
+    } while (again);
 }
 
 static void ehci_advance_async_state(EHCIState *ehci)
 {
     const int async = 1;
 
-    switch(ehci_get_state(ehci, async)) {
+    switch (ehci_get_state(ehci, async)) {
     case EST_INACTIVE:
         if (!ehci_async_enabled(ehci)) {
             break;
         }
         ehci_set_state(ehci, async, EST_ACTIVE);
-        // No break, fall through to ACTIVE
+        /* No break, fall through to ACTIVE */
 
     case EST_ACTIVE:
         if (!ehci_async_enabled(ehci)) {
@@ -2153,7 +2159,8 @@ static void ehci_advance_async_state(EHCIState *ehci)
         ehci_set_state(ehci, async, EST_WAITLISTHEAD);
         ehci_advance_state(ehci, async);
 
-        /* If the doorbell is set, the guest wants to make a change to the
+        /*
+         * If the doorbell is set, the guest wants to make a change to the
          * schedule. The host controller needs to release cached data.
          * (section 4.8.2)
          */
@@ -2180,13 +2187,13 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
     uint32_t list;
     const int async = 0;
 
-    // 4.6
+    /* 4.6 */
 
-    switch(ehci_get_state(ehci, async)) {
+    switch (ehci_get_state(ehci, async)) {
     case EST_INACTIVE:
         if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
             ehci_set_state(ehci, async, EST_ACTIVE);
-            // No break, fall through to ACTIVE
+            /* No break, fall through to ACTIVE */
         } else
             break;
 
@@ -2210,7 +2217,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
 
         DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
                 ehci->frindex / 8, list, entry);
-        ehci_set_fetch_addr(ehci, async,entry);
+        ehci_set_fetch_addr(ehci, async, entry);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
         ehci_queues_rip_unused(ehci, async);
@@ -2235,7 +2242,8 @@ static void ehci_update_frindex(EHCIState *ehci, int uframes)
         ehci_raise_irq(ehci, USBSTS_FLR);
     }
 
-    /* How many times will frindex roll over 0x4000 with this frame count?
+    /*
+     * How many times will frindex roll over 0x4000 with this frame count?
      * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
      */
     int rollovers = (ehci->frindex + uframes) / 0x4000;
@@ -2315,8 +2323,9 @@ static void ehci_work_bh(void *opaque)
         ehci->async_stepdown++;
     }
 
-    /*  Async is not inside loop since it executes everything it can once
-     *  called
+    /*
+     * Async is not inside loop since it executes everything it can once
+     * called
      */
     if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
         need_timer++;
@@ -2334,15 +2343,18 @@ static void ehci_work_bh(void *opaque)
     }
 
     if (need_timer) {
-        /* If we've raised int, we speed up the timer, so that we quickly
-         * notice any new packets queued up in response */
+        /*
+         * If we've raised int, we speed up the timer, so that we quickly
+         * notice any new packets queued up in response
+         */
         if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
             expire_time = t_now +
                 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
             ehci->int_req_by_async = false;
         } else {
-            expire_time = t_now + (NANOSECONDS_PER_SECOND
-                               * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
+            expire_time = t_now
+                + (NANOSECONDS_PER_SECOND * (ehci->async_stepdown + 1) /
+                   FRAME_TIMER_FREQ);
         }
         timer_mod(ehci->frame_timer, expire_time);
     }
-- 
2.43.0

[PATCH v2 04/17] hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)

[Jamin Lin]

Replace direct fprintf(stderr, ...) calls with qemu_log_mask()
using LOG_GUEST_ERROR in the EHCI controller implementation.

Direct writes to stderr are discouraged in QEMU as they bypass
the logging framework and cannot be filtered or controlled at
runtime. Using qemu_log_mask() ensures that guest-visible errors
are properly categorized and can be managed via QEMU logging
options.

All affected messages correspond to guest-triggerable error
conditions, so LOG_GUEST_ERROR is used consistently.

This change improves integration with QEMU's logging infrastructure
and aligns with upstream coding guidelines.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.c | 43 +++++++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 9b92384bac..bebd137f94 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -36,6 +36,7 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "system/runstate.h"
+#include "qemu/log.h"
 
 #define FRAME_TIMER_FREQ 1000
 #define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
@@ -425,7 +426,7 @@ static int ehci_get_pid(EHCIqtd *qtd)
     case 2:
         return USB_TOKEN_SETUP;
     default:
-        fprintf(stderr, "bad token\n");
+        qemu_log_mask(LOG_GUEST_ERROR, "bad token\n");
         return 0;
     }
 }
@@ -532,7 +533,7 @@ static void ehci_free_packet(EHCIPacket *p)
     }
     if (p->async == EHCI_ASYNC_FINISHED &&
             p->packet.status == USB_RET_SUCCESS) {
-        fprintf(stderr,
+        qemu_log_mask(LOG_GUEST_ERROR,
                 "EHCI: Dropping completed packet from halted %s ep %02X\n",
                 (p->pid == USB_TOKEN_IN) ? "in" : "out",
                 get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
@@ -1042,8 +1043,9 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
         /* not supporting dynamic frame list size at the moment */
         if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
-            fprintf(stderr, "attempt to set frame list size -- value %d\n",
-                    (int)val & USBCMD_FLS);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "attempt to set frame list size -- value %d\n",
+                          (int)val & USBCMD_FLS);
             val &= ~USBCMD_FLS;
         }
 
@@ -1101,7 +1103,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
     case PERIODICLISTBASE:
         if (ehci_periodic_enabled(s)) {
-            fprintf(stderr,
+            qemu_log_mask(LOG_GUEST_ERROR,
               "ehci: PERIODIC list base register set while periodic schedule\n"
               "      is enabled and HC is enabled\n");
         }
@@ -1109,7 +1111,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
     case ASYNCLISTADDR:
         if (ehci_async_enabled(s)) {
-            fprintf(stderr,
+            qemu_log_mask(LOG_GUEST_ERROR,
               "ehci: ASYNC list address register set while async schedule\n"
               "      is enabled and HC is enabled\n");
         }
@@ -1200,7 +1202,7 @@ static int ehci_init_transfer(EHCIPacket *p)
 
     while (bytes > 0) {
         if (cpage > 4) {
-            fprintf(stderr, "cpage out of range (%u)\n", cpage);
+            qemu_log_mask(LOG_GUEST_ERROR, "cpage out of range (%u)\n", cpage);
             qemu_sglist_destroy(&p->sgl);
             return -1;
         }
@@ -1306,7 +1308,8 @@ static void ehci_execute_complete(EHCIQueue *q)
         break;
     default:
         /* should not be triggerable */
-        fprintf(stderr, "USB invalid response %d\n", p->packet.status);
+        qemu_log_mask(LOG_GUEST_ERROR, "USB invalid response %d\n",
+                      p->packet.status);
         g_assert_not_reached();
     }
 
@@ -1354,7 +1357,7 @@ static int ehci_execute(EHCIPacket *p, const char *action)
            p->async == EHCI_ASYNC_INITIALIZED);
 
     if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
-        fprintf(stderr, "Attempting to execute inactive qtd\n");
+        qemu_log_mask(LOG_GUEST_ERROR, "Attempting to execute inactive qtd\n");
         return -1;
     }
 
@@ -1395,7 +1398,8 @@ static int ehci_execute(EHCIPacket *p, const char *action)
             p->packet.actual_length);
 
     if (p->packet.actual_length > BUFF_SIZE) {
-        fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ret from usb_handle_packet > BUFF_SIZE\n");
         return -1;
     }
 
@@ -1479,8 +1483,9 @@ static int ehci_process_itd(EHCIState *ehci,
             case USB_RET_SUCCESS:
                 break;
             default:
-                fprintf(stderr, "Unexpected iso usb result: %d\n",
-                        ehci->ipacket.status);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Unexpected iso usb result: %d\n",
+                              ehci->ipacket.status);
                 /* Fall through */
             case USB_RET_IOERROR:
             case USB_RET_NODEV:
@@ -1584,7 +1589,8 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
 
     /* section 4.8, only QH in async schedule */
     if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
-        fprintf(stderr, "non queue head request in async schedule\n");
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "non queue head request in async schedule\n");
         return -1;
     }
 
@@ -1606,7 +1612,7 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
 
     default:
         /* TODO: handle FSTN type */
-        fprintf(stderr, "FETCHENTRY: entry at %X is of type %u "
+        qemu_log_mask(LOG_GUEST_ERROR, "FETCHENTRY: entry at %X is of type %u "
                 "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
         return -1;
     }
@@ -2112,13 +2118,14 @@ static void ehci_advance_state(EHCIState *ehci, int async)
             break;
 
         default:
-            fprintf(stderr, "Bad state!\n");
+            qemu_log_mask(LOG_GUEST_ERROR, "Bad state!\n");
             g_assert_not_reached();
         }
 
         if (again < 0 || itd_count > 16) {
             /* TODO: notify guest (raise HSE irq?) */
-            fprintf(stderr, "processing error - resetting ehci HC\n");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "processing error - resetting ehci HC\n");
             ehci_reset(ehci);
             again = 0;
         }
@@ -2175,7 +2182,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
 
     default:
         /* this should only be due to a developer mistake */
-        fprintf(stderr, "ehci: Bad asynchronous state %d. "
+        qemu_log_mask(LOG_GUEST_ERROR, "ehci: Bad asynchronous state %d. "
                 "Resetting to active\n", ehci->astate);
         g_assert_not_reached();
     }
@@ -2225,7 +2232,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
 
     default:
         /* this should only be due to a developer mistake */
-        fprintf(stderr, "ehci: Bad periodic state %d. "
+        qemu_log_mask(LOG_GUEST_ERROR, "ehci: Bad periodic state %d. "
                 "Resetting to active\n", ehci->pstate);
         g_assert_not_reached();
     }
-- 
2.43.0

[PATCH v2 05/17] hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events

[Jamin Lin]

Replace legacy DPRINTF() debug logging in the EHCI host controller
implementation with QEMU trace events.

The EHCI_DEBUG macro and associated DPRINTF() definitions are
removed as they are no longer needed.

Trace events are added for:
- packet submission and completion
- queue head execution state
- periodic schedule advancement
- ITD error conditions
- port state handling
- skipped microframes

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h   | 10 ---------
 hw/usb/hcd-ehci.c   | 49 +++++++++++++++++++--------------------------
 hw/usb/trace-events |  9 +++++++++
 3 files changed, 30 insertions(+), 38 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 736407fd52..4234591cb4 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -24,16 +24,6 @@
 #include "hw/pci/pci_device.h"
 #include "hw/core/sysbus.h"
 
-#ifndef EHCI_DEBUG
-#define EHCI_DEBUG   0
-#endif
-
-#if EHCI_DEBUG
-#define DPRINTF printf
-#else
-#define DPRINTF(...)
-#endif
-
 #define MMIO_SIZE        0x1000
 #define CAPA_SIZE        0x10
 
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index bebd137f94..d0ea4949f9 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -839,7 +839,7 @@ static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
     for (i = 0; i < EHCI_PORTS; i++) {
         port = &ehci->ports[i];
         if (!(ehci->portsc[i] & PORTSC_PED)) {
-            DPRINTF("Port %d not enabled\n", i);
+            trace_usb_ehci_port_disable(i);
             continue;
         }
         dev = usb_find_device(port, addr);
@@ -1281,10 +1281,8 @@ static void ehci_execute_complete(EHCIQueue *q)
     assert(p->async == EHCI_ASYNC_INITIALIZED ||
            p->async == EHCI_ASYNC_FINISHED);
 
-    DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
-            "status %d, actual_length %d\n",
-            q->qhaddr, q->qh.next, q->qtdaddr,
-            p->packet.status, p->packet.actual_length);
+    trace_usb_ehci_execute_complete(q->qhaddr, q->qh.next, q->qtdaddr,
+                                    p->packet.status, p->packet.actual_length);
 
     switch (p->packet.status) {
     case USB_RET_SUCCESS:
@@ -1327,7 +1325,7 @@ static void ehci_execute_complete(EHCIQueue *q)
     } else {
         tbytes = 0;
     }
-    DPRINTF("updating tbytes to %d\n", tbytes);
+    trace_usb_ehci_qh_tbytes(tbytes);
     set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
 
     ehci_finish_transfer(q, p->packet.actual_length);
@@ -1392,10 +1390,9 @@ static int ehci_execute(EHCIPacket *p, const char *action)
 
     trace_usb_ehci_packet_action(p->queue, p, action);
     usb_handle_packet(p->queue->dev, &p->packet);
-    DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
-            "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
-            p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
-            p->packet.actual_length);
+    trace_usb_ehci_packet_submit(p->queue->qhaddr, p->qtd.next, p->qtdaddr,
+                                 p->pid, p->packet.iov.size, endp,
+                                 p->packet.status, p->packet.actual_length);
 
     if (p->packet.actual_length > BUFF_SIZE) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -1472,7 +1469,8 @@ static int ehci_process_itd(EHCIState *ehci,
                     usb_handle_packet(dev, &ehci->ipacket);
                     usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
                 } else {
-                    DPRINTF("ISOCH: attempt to address non-iso endpoint\n");
+                    trace_usb_ehci_log("ISOCH: "
+                                       "attempt to address non-iso endpoint");
                     ehci->ipacket.status = USB_RET_NAK;
                     ehci->ipacket.actual_length = 0;
                 }
@@ -1675,24 +1673,22 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
         if (ehci->usbsts & USBSTS_REC) {
             ehci_clear_usbsts(ehci, USBSTS_REC);
         } else {
-            DPRINTF("FETCHQH:  QH 0x%08x. H-bit set, reclamation status reset"
-                       " - done processing\n", q->qhaddr);
+            trace_usb_ehci_fetchqh_reclaim_done(q->qhaddr);
             ehci_set_state(ehci, async, EST_ACTIVE);
             q = NULL;
             goto out;
         }
     }
 
-#if EHCI_DEBUG
-    if (q->qhaddr != q->qh.next) {
-        DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
-               q->qhaddr,
-               q->qh.epchar & QH_EPCHAR_H,
-               q->qh.token & QTD_TOKEN_HALT,
-               q->qh.token & QTD_TOKEN_ACTIVE,
-               q->qh.next);
+    if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
+        if (q->qhaddr != q->qh.next) {
+            trace_usb_ehci_fetchqh_dbg(q->qhaddr,
+                                       q->qh.epchar & QH_EPCHAR_H,
+                                       q->qh.token & QTD_TOKEN_HALT,
+                                       q->qh.token & QTD_TOKEN_ACTIVE,
+                                       q->qh.next);
+        }
     }
-#endif
 
     if (q->qh.token & QTD_TOKEN_HALT) {
         ehci_set_state(ehci, async, EST_HORIZONTALQH);
@@ -2154,7 +2150,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
         /* make sure guest has acknowledged the doorbell interrupt */
         /* TO-DO: is this really needed? */
         if (ehci->usbsts & USBSTS_IAA) {
-            DPRINTF("IAA status bit still set.\n");
+            trace_usb_ehci_log("IAA status bit still set.");
             break;
         }
 
@@ -2221,9 +2217,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
         if (get_dwords(ehci, list, &entry, 1) < 0) {
             break;
         }
-
-        DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
-                ehci->frindex / 8, list, entry);
+        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry);
         ehci_set_fetch_addr(ehci, async, entry);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
@@ -2291,8 +2285,7 @@ static void ehci_work_bh(void *opaque)
             ehci_update_frindex(ehci, skipped_uframes);
             ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
             uframes -= skipped_uframes;
-            DPRINTF("WARNING - EHCI skipped %"PRIu64" uframes\n",
-                    skipped_uframes);
+            trace_usb_ehci_skipped_uframes(skipped_uframes);
         }
 
         for (i = 0; i < uframes; i++) {
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index dd04f14add..0d4318dcf1 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -89,6 +89,7 @@ usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
 usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
 usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
 usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
+usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
 usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
 usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
 usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
@@ -100,13 +101,21 @@ usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
 usb_ehci_port_suspend(uint32_t port) "port #%d"
 usb_ehci_port_wakeup(uint32_t port) "port #%d"
 usb_ehci_port_resume(uint32_t port) "port #%d"
+usb_ehci_port_disable(uint32_t port) "port #%d"
 usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
 usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
+usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
 usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
 usb_ehci_guest_bug(const char *reason) "%s"
 usb_ehci_doorbell_ring(void) ""
 usb_ehci_doorbell_ack(void) ""
 usb_ehci_dma_error(void) ""
+usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
+usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
+usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
+usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
+usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
+usb_ehci_log(const char *msg) "%s"
 
 # hcd-uhci.c
 usb_uhci_reset(void) "=== RESET ==="
-- 
2.43.0

[PATCH v2 06/17] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit

[Jamin Lin]

Change internal EHCI descriptor addresses from uint32_t to uint64_t.

The following fields are updated:
- EHCIPacket::qtdaddr
- EHCIQueue::{qhaddr, qtdaddr}
- EHCIState::{a_fetch_addr, p_fetch_addr}

Update get_dwords() and put_dwords() to take 64-bit addresses and
propagate the type change through the descriptor traversal paths.

Adjust NLPTR_GET() to operate on 64-bit values:

    #define NLPTR_GET(x) ((x) & ~0x1fULL)

so that link pointer masking works correctly when descriptor
addresses exceed 32-bit space. The previous mask (0xffffffe0)
implicitly truncated addresses to 32 bits.

This patch does not change the on-wire descriptor layout yet.
It only removes the internal 32-bit address limit and prepares
for later patches that will add full 64-bit QH/qTD/iTD/siTD support.

Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
use uint64_t for the address argument and print it with PRIx64. This
ensures full 64-bit addresses are shown in trace output and improves
debugging of queue heads and transfer descriptors.

Since the type of fetch_addr changes from 32-bit to 64-bit,
bump the VMState version.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h   | 12 ++++++----
 hw/usb/hcd-ehci.c   | 57 +++++++++++++++++++++++++++------------------
 hw/usb/trace-events | 24 +++++++++----------
 3 files changed, 53 insertions(+), 40 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 4234591cb4..24eea9d23b 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -208,7 +208,7 @@ struct EHCIPacket {
     QTAILQ_ENTRY(EHCIPacket) next;
 
     EHCIqtd qtd;           /* copy of current QTD (being worked on) */
-    uint32_t qtdaddr;      /* address QTD read from                 */
+    uint64_t qtdaddr;      /* address QTD read from                 */
 
     USBPacket packet;
     QEMUSGList sgl;
@@ -229,8 +229,8 @@ struct EHCIQueue {
      * when guest removes an entry (doorbell, handshake sequence)
      */
     EHCIqh qh;             /* copy of current QH (being worked on) */
-    uint32_t qhaddr;       /* address QH read from                 */
-    uint32_t qtdaddr;      /* address QTD read from                */
+    uint64_t qhaddr;       /* address QH read from                 */
+    uint64_t qtdaddr;      /* address QTD read from                */
     int last_pid;          /* pid of last packet executed          */
     USBDevice *dev;
     QTAILQ_HEAD(, EHCIPacket) packets;
@@ -294,8 +294,10 @@ struct EHCIState {
     EHCIQueueHead pqueues;
 
     /* which address to look at next */
-    uint32_t a_fetch_addr;
-    uint32_t p_fetch_addr;
+    uint32_t a_fetch_addr_pre_v3;
+    uint32_t p_fetch_addr_pre_v3;
+    uint64_t a_fetch_addr;
+    uint64_t p_fetch_addr;
 
     USBPacket ipacket;
     QEMUSGList isgl;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index d0ea4949f9..315e8813f5 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -72,7 +72,7 @@ typedef enum {
 } EHCI_STATES;
 
 /* macros for accessing fields within next link pointer entry */
-#define NLPTR_GET(x)             ((x) & 0xffffffe0)
+#define NLPTR_GET(x)             ((x) & ~0x1fULL)
 #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
 #define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
 
@@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
     return async ? s->astate : s->pstate;
 }
 
-static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
+static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
 {
     if (async) {
         s->a_fetch_addr = addr;
@@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
     }
 }
 
-static int ehci_get_fetch_addr(EHCIState *s, int async)
+static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
 {
     return async ? s->a_fetch_addr : s->p_fetch_addr;
 }
@@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState *s)
 }
 
 /* Get an array of dwords from main memory */
-static inline int get_dwords(EHCIState *ehci, uint32_t addr,
+static inline int get_dwords(EHCIState *ehci, uint64_t addr,
                              uint32_t *buf, int num)
 {
     int i;
@@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t addr,
 }
 
 /* Put an array of dwords in to main memory */
-static inline int put_dwords(EHCIState *ehci, uint32_t addr,
+static inline int put_dwords(EHCIState *ehci, uint64_t addr,
                              uint32_t *buf, int num)
 {
     int i;
@@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
 
 /* queue management */
 
-static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
+static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
 {
     EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
     EHCIQueue *q;
@@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const char *warn)
     g_free(q);
 }
 
-static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
                                         int async)
 {
     EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
@@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
 {
     uint32_t *qh = (uint32_t *) &q->qh;
     uint32_t dwords = sizeof(EHCIqh) >> 2;
-    uint32_t addr = NLPTR_GET(q->qhaddr);
+    uint64_t addr = NLPTR_GET(q->qhaddr);
 
     put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
 }
@@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const char *action)
 /* 4.7.2 */
 static int ehci_process_itd(EHCIState *ehci,
                             EHCIitd *itd,
-                            uint32_t addr)
+                            uint64_t addr)
 {
     USBDevice *dev;
     USBEndpoint *ep;
     uint32_t i, len, pid, dir, devaddr, endp;
-    uint32_t pg, off, ptr1, ptr2, max, mult;
+    uint32_t pg, off, max, mult;
+    uint64_t ptr1, ptr2;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
 
@@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     EHCIqh qh;
     int i = 0;
     int again = 0;
-    uint32_t entry = ehci->asynclistaddr;
+    uint64_t entry = ehci->asynclistaddr;
 
     /* set reclamation flag at start event (4.8.6) */
     if (async) {
@@ -1578,7 +1579,7 @@ out:
 static int ehci_state_fetchentry(EHCIState *ehci, int async)
 {
     int again = 0;
-    uint32_t entry = ehci_get_fetch_addr(ehci, async);
+    uint64_t entry = ehci_get_fetch_addr(ehci, async);
 
     if (NLPTR_TBIT(entry)) {
         ehci_set_state(ehci, async, EST_ACTIVE);
@@ -1610,8 +1611,10 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
 
     default:
         /* TODO: handle FSTN type */
-        qemu_log_mask(LOG_GUEST_ERROR, "FETCHENTRY: entry at %X is of type %u "
-                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "FETCHENTRY: entry at %" PRIx64 "is of type %" PRIu64
+                      "which is not supported yet\n",
+                      entry, NLPTR_TYPE_GET(entry));
         return -1;
     }
 
@@ -1621,7 +1624,7 @@ out:
 
 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIQueue *q;
     EHCIqh qh;
 
@@ -1710,7 +1713,7 @@ out:
 
 static int ehci_state_fetchitd(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIitd itd;
 
     assert(!async);
@@ -1736,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
 
 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIsitd sitd;
 
     assert(!async);
@@ -1794,7 +1797,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
     EHCIqtd qtd;
     EHCIPacket *p;
     int again = 1;
-    uint32_t addr;
+    uint64_t addr;
 
     addr = NLPTR_GET(q->qtdaddr);
     if (get_dwords(q->ehci, addr +  8, &qtd.token,   1) < 0) {
@@ -1877,7 +1880,7 @@ static int ehci_fill_queue(EHCIPacket *p)
     USBEndpoint *ep = p->packet.ep;
     EHCIQueue *q = p->queue;
     EHCIqtd qtd = p->qtd;
-    uint32_t qtdaddr;
+    uint64_t qtdaddr;
 
     for (;;) {
         if (NLPTR_TBIT(qtd.next) != 0) {
@@ -2000,7 +2003,8 @@ static int ehci_state_executing(EHCIQueue *q)
 static int ehci_state_writeback(EHCIQueue *q)
 {
     EHCIPacket *p = QTAILQ_FIRST(&q->packets);
-    uint32_t *qtd, addr;
+    uint32_t *qtd;
+    uint64_t addr;
     int again = 0;
 
     /*  Write back the QTD from the QH area */
@@ -2441,6 +2445,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
         }
     }
 
+    if (version_id < 3) {
+        s->a_fetch_addr = s->a_fetch_addr_pre_v3;
+        s->p_fetch_addr = s->p_fetch_addr_pre_v3;
+    }
+
     return 0;
 }
 
@@ -2472,7 +2481,7 @@ static void usb_ehci_vm_state_change(void *opaque, bool running, RunState state)
 
 const VMStateDescription vmstate_ehci = {
     .name        = "ehci-core",
-    .version_id  = 2,
+    .version_id  = 3,
     .minimum_version_id  = 1,
     .pre_save    = usb_ehci_pre_save,
     .post_load   = usb_ehci_post_load,
@@ -2501,8 +2510,10 @@ const VMStateDescription vmstate_ehci = {
         /* schedule state */
         VMSTATE_UINT32(astate, EHCIState),
         VMSTATE_UINT32(pstate, EHCIState),
-        VMSTATE_UINT32(a_fetch_addr, EHCIState),
-        VMSTATE_UINT32(p_fetch_addr, EHCIState),
+        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
+        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),
+        VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
+        VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 0d4318dcf1..8c90688bb3 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio 0x%04
 usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
 usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
 usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
-usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
-usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
-usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
+usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
+usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
+usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%" PRIx64 " - c %d, h %d, dtc %d, i %d"
 usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
-usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
-usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
-usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
-usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
-usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x: next 0x%08x - active %d"
+usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
+usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
+usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr %d"
+usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
+usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%" PRIx64 ": next 0x%08x - active %d"
 usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
 usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
 usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
@@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
 usb_ehci_port_disable(uint32_t port) "port #%d"
 usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
 usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
-usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
+usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ", next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
 usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
 usb_ehci_guest_bug(const char *reason) "%s"
 usb_ehci_doorbell_ring(void) ""
 usb_ehci_doorbell_ack(void) ""
 usb_ehci_dma_error(void) ""
-usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
-usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
-usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
+usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
+usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
+usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
 usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
 usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
 usb_ehci_log(const char *msg) "%s"
-- 
2.43.0

[PATCH v2 07/17] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability

[Jamin Lin]

Introduce a new boolean property, "caps-64bit-addr", to control
HCCPARAMS[0] (64-bit Addressing Capability).

When enabled, the EHCI controller advertises support for 64-bit
address memory pointers as defined in the EHCI specification
(Table 2-7, HCCPARAMS). This allows software to use the 64-bit
data structure formats described in Appendix B.

When disabled (default), the controller reports 32-bit addressing
capability and uses the standard 32-bit data structures.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/usb/hcd-ehci.h        | 1 +
 hw/usb/hcd-ehci-pci.c    | 2 ++
 hw/usb/hcd-ehci-sysbus.c | 2 ++
 hw/usb/hcd-ehci.c        | 5 ++++-
 4 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 24eea9d23b..fe4c508c32 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -256,6 +256,7 @@ struct EHCIState {
 
     /* properties */
     uint32_t maxframes;
+    bool caps_64bit_addr;
 
     /*
      *  EHCI spec version 1.0 Section 2.3
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 9febcc1031..2ea8549db9 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -137,6 +137,8 @@ static void usb_ehci_pci_write_config(PCIDevice *dev, uint32_t addr,
 
 static const Property ehci_pci_properties[] = {
     DEFINE_PROP_UINT32("maxframes", EHCIPCIState, ehci.maxframes, 128),
+    DEFINE_PROP_BOOL("caps-64bit-addr", EHCIPCIState, ehci.caps_64bit_addr,
+                     false),
 };
 
 static const VMStateDescription vmstate_ehci_pci = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index b31032bbf3..61215e9f3d 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -34,6 +34,8 @@ static const Property ehci_sysbus_properties[] = {
     DEFINE_PROP_UINT32("maxframes", EHCISysBusState, ehci.maxframes, 128),
     DEFINE_PROP_BOOL("companion-enable", EHCISysBusState, ehci.companion_enable,
                      false),
+    DEFINE_PROP_BOOL("caps-64bit-addr", EHCISysBusState, ehci.caps_64bit_addr,
+                     false),
 };
 
 static void usb_ehci_sysbus_realize(DeviceState *dev, Error **errp)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 315e8813f5..e3bff8e518 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2532,6 +2532,9 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
                    s->maxframes);
         return;
     }
+    if (s->caps_64bit_addr) {
+        s->caps[0x08] |= BIT(0);
+    }
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
     memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
@@ -2591,7 +2594,7 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     s->caps[0x05] = 0x00;        /* No companion ports at present */
     s->caps[0x06] = 0x00;
     s->caps[0x07] = 0x00;
-    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
+    s->caps[0x08] = 0x80;        /* We can cache whole frame */
     s->caps[0x0a] = 0x00;
     s->caps[0x0b] = 0x00;
 
-- 
2.43.0

[PATCH v2 08/17] hw/usb/hcd-ehci: Reject CTRLDSSEGMENT writes without 64-bit capability

[Jamin Lin]

The EHCI CTRLDSSEGMENT register provides the upper 32 bits [63:32] used to
form 64-bit addresses for EHCI control data structures. Per EHCI 1.0
spec section 2.3.5, when the HCCPARAMS 64-bit Addressing Capability bit
is zero, CTRLDSSEGMENT is not used: software cannot write it and reads
must return zero.

Add a capability check in the operational register write handler and
reject guest writes to CTRLDSSEGMENT when 64-bit addressing is
not enabled.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index e3bff8e518..54a1a6f7f3 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1108,7 +1108,14 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
               "      is enabled and HC is enabled\n");
         }
         break;
-
+    case CTRLDSSEGMENT:
+        if (!s->caps_64bit_addr) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "ehci: write to CTRLDSSEGMENT while "
+                          "      64-bit addressing capability is disabled\n");
+            return;
+        }
+        break;
     case ASYNCLISTADDR:
         if (ehci_async_enabled(s)) {
             qemu_log_mask(LOG_GUEST_ERROR,
-- 
2.43.0

[PATCH v2 09/17] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register supplies the upper 32 bits which are
concatenated with 32-bit link pointer fields to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

The current implementation assumes 32-bit QH descriptor addresses
and directly uses link pointer values without applying the
CTRLDSSEGMENT upper dword.

Introduce a helper, ehci_get_desc_addr(), to construct full 64-bit
descriptor addresses when 64-bit capability is enabled. Update QH
traversal paths (async list walk, horizontal QH link, and periodic
schedule entry handling) to use the translated 64-bit addresses.

Introduce ehci_get_buf_addr() to construct full 64-bit buffer
addresses from bufptr[] and bufptr_hi[] fields. Use this helper
when calculating transfer buffer addresses so that data buffers
above 4GB are correctly handled.

Also add bufptr_hi[5] to EHCIqh to support 64-bit buffer pointer
fields as defined in Appendix B.

When 64-bit capability is disabled, descriptor addresses remain
32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h   |  4 ++++
 hw/usb/hcd-ehci.c   | 48 ++++++++++++++++++++++++++++++++++-----------
 hw/usb/trace-events |  2 +-
 3 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index fe4c508c32..773f376834 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -141,6 +141,9 @@ typedef struct EHCIqtd {
 #define QTD_BUFPTR_SH                 12
 } EHCIqtd;
 
+/* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
+#define EHCI_QH_OVERLAY_COUNT 12
+
 /*
  * EHCI spec version 1.0 Section 3.6
  */
@@ -194,6 +197,7 @@ typedef struct EHCIqh {
 #define BUFPTR_FRAMETAG_MASK          0x0000001f
 #define BUFPTR_SBYTES_MASK            0x00000fe0
 #define BUFPTR_SBYTES_SH              5
+    uint32_t bufptr_hi[5];
 } EHCIqh;
 
 enum async_state {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 54a1a6f7f3..d1d68b0342 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -147,6 +147,24 @@ static const char *addr2str(hwaddr addr)
     return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
 }
 
+static uint64_t ehci_get_buf_addr(EHCIState *s, uint32_t hi, uint32_t low,
+                                  uint32_t mask)
+{
+    uint64_t addr;
+
+    addr = (uint64_t)(low & mask);
+    if (s->caps_64bit_addr) {
+        addr |= (uint64_t)hi << 32;
+    }
+
+    return addr;
+}
+
+static uint64_t ehci_get_desc_addr(EHCIState *s, uint32_t low)
+{
+    return ehci_get_buf_addr(s, s->ctrldssegment, low, UINT32_MAX);
+}
+
 static void ehci_trace_usbsts(uint32_t mask, int state)
 {
     /* interrupts */
@@ -440,7 +458,7 @@ static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
         (qh->current_qtd != q->qh.current_qtd) ||
         (q->async && qh->next_qtd != q->qh.next_qtd) ||
         (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
-                                 7 * sizeof(uint32_t)) != 0) ||
+                EHCI_QH_OVERLAY_COUNT * sizeof(uint32_t)) != 0) ||
         (q->dev != NULL && q->dev->addr != devaddr)) {
         return false;
     } else {
@@ -1536,7 +1554,9 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     EHCIqh qh;
     int i = 0;
     int again = 0;
-    uint64_t entry = ehci->asynclistaddr;
+    uint64_t entry = 0;
+
+    entry = ehci_get_desc_addr(ehci, ehci->asynclistaddr);
 
     /* set reclamation flag at start event (4.8.6) */
     if (async) {
@@ -1564,8 +1584,8 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
             goto out;
         }
 
-        entry = qh.next;
-        if (entry == ehci->asynclistaddr) {
+        entry = ehci_get_desc_addr(ehci, qh.next);
+        if (entry == ehci_get_desc_addr(ehci, ehci->asynclistaddr)) {
             break;
         }
     }
@@ -1691,7 +1711,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
     }
 
     if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
-        if (q->qhaddr != q->qh.next) {
+        if (q->qhaddr != ehci_get_desc_addr(ehci, q->qh.next)) {
             trace_usb_ehci_fetchqh_dbg(q->qhaddr,
                                        q->qh.epchar & QH_EPCHAR_H,
                                        q->qh.token & QTD_TOKEN_HALT,
@@ -1868,10 +1888,12 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
 
 static int ehci_state_horizqh(EHCIQueue *q)
 {
+    uint64_t addr;
     int again = 0;
 
-    if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
-        ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
+    addr = ehci_get_desc_addr(q->ehci, q->qh.next);
+    if (ehci_get_fetch_addr(q->ehci, q->async) != addr) {
+        ehci_set_fetch_addr(q->ehci, q->async, addr);
         ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
         again = 1;
     } else {
@@ -2200,6 +2222,8 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
     uint32_t entry;
     uint32_t list;
     const int async = 0;
+    uint64_t entry64;
+    uint64_t list64;
 
     /* 4.6 */
 
@@ -2224,12 +2248,14 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
             break;
         }
         list |= ((ehci->frindex & 0x1ff8) >> 1);
-
-        if (get_dwords(ehci, list, &entry, 1) < 0) {
+        list64 = ehci_get_desc_addr(ehci, list);
+        if (get_dwords(ehci, list64, &entry, 1) < 0) {
             break;
         }
-        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry);
-        ehci_set_fetch_addr(ehci, async, entry);
+        entry64 = ehci_get_desc_addr(ehci, entry);
+        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8,
+                                              list64, entry64);
+        ehci_set_fetch_addr(ehci, async, entry64);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
         ehci_queues_rip_unused(ehci, async);
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 8c90688bb3..67249d69c2 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -113,7 +113,7 @@ usb_ehci_dma_error(void) ""
 usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
 usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
 usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
-usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
+usb_ehci_periodic_state_advance(uint32_t frame, uint64_t list, uint64_t entry) "frame=%d, list=0x%" PRIx64 ", entry=0x%" PRIx64
 usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
 usb_ehci_log(const char *msg) "%s"
 
-- 
2.43.0

[PATCH v2 10/17] hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit addressing when the 64-bit Addressing Capability
bit in HCCPARAMS is set. In that mode, the CTRLDSSEGMENT register
provides the upper 32 bits that are concatenated with 32-bit link
pointer values to form 64-bit control data structure addresses
(EHCI 1.0, section 2.3.5 and Appendix B).

qTD link pointers (current_qtd/next_qtd/altnext_qtd and qTD.next)
are stored as 32-bit values in the data structures and must be
expanded to full 64-bit descriptor addresses when 64-bit mode is
enabled. Update the qTD traversal paths to use ehci_get_desc_addr()
when following link pointers.

Appendix B also defines high dword fields for qTD buffer pointers.
Add bufptr_hi[5] to EHCIqtd and extend qTD fetch and QH overlay
handling to load and propagate the high buffer pointer fields.

When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h |  1 +
 hw/usb/hcd-ehci.c | 19 ++++++++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 773f376834..712de9d50e 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -139,6 +139,7 @@ typedef struct EHCIqtd {
     uint32_t bufptr[5];               /* Standard buffer pointer */
 #define QTD_BUFPTR_MASK               0xfffff000
 #define QTD_BUFPTR_SH                 12
+    uint32_t bufptr_hi[5];
 } EHCIqtd;
 
 /* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index d1d68b0342..5d070e204f 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -473,7 +473,8 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
             (p->qtd.next != qtd->next)) ||
         (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
         p->qtd.token != qtd->token ||
-        p->qtd.bufptr[0] != qtd->bufptr[0]) {
+        p->qtd.bufptr[0] != qtd->bufptr[0] ||
+        p->qtd.bufptr_hi[0] != qtd->bufptr_hi[0]) {
         return false;
     } else {
         return true;
@@ -1199,6 +1200,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
 
     for (i = 0; i < 5; i++) {
         q->qh.bufptr[i] = p->qtd.bufptr[i];
+        q->qh.bufptr_hi[i] = p->qtd.bufptr_hi[i];
     }
 
     if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
@@ -1232,7 +1234,8 @@ static int ehci_init_transfer(EHCIPacket *p)
             return -1;
         }
 
-        page  = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
+        page = ehci_get_buf_addr(p->queue->ehci, p->qtd.bufptr_hi[cpage],
+                                 p->qtd.bufptr[cpage], QTD_BUFPTR_MASK);
         page += offset;
         plen  = bytes;
         if (plen > 4096 - offset) {
@@ -1726,7 +1729,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
     } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
                (NLPTR_TBIT(q->qh.current_qtd) == 0) &&
                (q->qh.current_qtd != 0)) {
-        q->qtdaddr = q->qh.current_qtd;
+        q->qtdaddr = ehci_get_desc_addr(ehci, q->qh.current_qtd);
         ehci_set_state(ehci, async, EST_FETCHQTD);
 
     } else {
@@ -1798,14 +1801,14 @@ static int ehci_state_advqueue(EHCIQueue *q)
      */
     if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
         (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
-        q->qtdaddr = q->qh.altnext_qtd;
+        q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.altnext_qtd);
         ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
 
     /*
      *  next qTD is valid
      */
     } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
-        q->qtdaddr = q->qh.next_qtd;
+        q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.next_qtd);
         ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
 
     /*
@@ -1834,7 +1837,9 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
     if (get_dwords(q->ehci, addr +  0, &qtd.next,    1) < 0 ||
         get_dwords(q->ehci, addr +  4, &qtd.altnext, 1) < 0 ||
         get_dwords(q->ehci, addr + 12, qtd.bufptr,
-                   ARRAY_SIZE(qtd.bufptr)) < 0) {
+                   ARRAY_SIZE(qtd.bufptr)) < 0 ||
+        get_dwords(q->ehci, addr + 32, qtd.bufptr_hi,
+                   ARRAY_SIZE(qtd.bufptr_hi)) < 0) {
         return 0;
     }
     ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
@@ -1915,7 +1920,7 @@ static int ehci_fill_queue(EHCIPacket *p)
         if (NLPTR_TBIT(qtd.next) != 0) {
             break;
         }
-        qtdaddr = qtd.next;
+        qtdaddr = ehci_get_desc_addr(q->ehci, qtd.next);
         /*
          * Detect circular td lists, Windows creates these, counting on the
          * active bit going low after execution to make the queue stop.
-- 
2.43.0

[PATCH v2 11/17] hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

iTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the iTD traversal path to use ehci_get_desc_addr() when
following link pointers.

Appendix B also defines high dword fields for iTD buffer pointers.
Add bufptr_hi[7] to EHCIitd and use ehci_get_buf_addr() to construct
full 64-bit buffer addresses from bufptr[] and bufptr_hi[] fields
when processing isochronous transfers. This allows buffers above
4GB to be handled correctly.

When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h | 1 +
 hw/usb/hcd-ehci.c | 9 ++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 712de9d50e..af8c080c60 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -63,6 +63,7 @@ typedef struct EHCIitd {
 #define ITD_BUFPTR_MAXPKT_SH     0
 #define ITD_BUFPTR_MULT_MASK     0x00000003
 #define ITD_BUFPTR_MULT_SH       0
+    uint32_t bufptr_hi[7];
 } EHCIitd;
 
 /*
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 5d070e204f..5d61b1dd64 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1463,7 +1463,8 @@ static int ehci_process_itd(EHCIState *ehci,
                 return -1;
             }
 
-            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
+            ptr1 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg],
+                                     itd->bufptr[pg], ITD_BUFPTR_MASK);
             qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
             if (off + len > 4096) {
                 /* transfer crosses page border */
@@ -1471,7 +1472,9 @@ static int ehci_process_itd(EHCIState *ehci,
                     qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
-                ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
+                ptr2 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg + 1],
+                                         itd->bufptr[pg + 1],
+                                         ITD_BUFPTR_MASK);
                 uint32_t len2 = off + len - 4096;
                 uint32_t len1 = len - len2;
                 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
@@ -1761,7 +1764,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
 
     put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
                sizeof(EHCIitd) >> 2);
-    ehci_set_fetch_addr(ehci, async, itd.next);
+    ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, itd.next));
     ehci_set_state(ehci, async, EST_FETCHENTRY);
 
     return 1;
-- 
2.43.0

[PATCH v2 12/17] hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

siTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the siTD traversal path to use ehci_get_desc_addr() when
following link pointers.

Appendix B also defines high dword fields for siTD buffer pointers.
Add bufptr_hi[] fields to EHCIsitd and use ehci_get_buf_addr() to
construct full 64-bit buffer addresses from bufptr[] and bufptr_hi[]
when processing split isochronous transfers. This allows buffers
above 4GB to be handled correctly.

When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h | 1 +
 hw/usb/hcd-ehci.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index af8c080c60..6406f536e8 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -109,6 +109,7 @@ typedef struct EHCIsitd {
 #define SITD_BUFPTR_TCNT_MASK         0x00000007
 
     uint32_t backptr;                 /* Standard next link pointer */
+    uint32_t bufptr_hi[2];
 } EHCIsitd;
 
 /*
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 5d61b1dd64..24133af9db 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1791,7 +1791,7 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
         warn_report("Skipping active siTD");
     }
 
-    ehci_set_fetch_addr(ehci, async, sitd.next);
+    ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, sitd.next));
     ehci_set_state(ehci, async, EST_FETCHENTRY);
     return 1;
 }
-- 
2.43.0

[PATCH v2 13/17] hw/usb/hcd-ehci: Add descriptor address offset property

[Jamin Lin]

When 64-bit addressing is supported, the Linux EHCI driver programs the
segment register to zero. See ehci_run function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c

The driver comment also notes that descriptor structures allocated from
the DMA pool use segment zero semantics.

Descriptor memory is allocated using the DMA API. The platform driver
configures a 64-bit DMA mask so memory can be allocated above 4GB.
See ehci_platform_probe function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-platform.c

On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
As a result, descriptor addresses constructed directly from the guest
EHCI registers do not match the actual system address used by the
controller when fetching queue heads (QH) and queue element transfer
descriptors (qTD).

Introduce a descriptor-addr-offset property so platforms can provide an
address offset applied when constructing descriptor addresses. This
allows systems where DRAM resides above 4GB to correctly access EHCI
descriptors while keeping the default behavior unchanged for existing
machines.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h        | 1 +
 hw/usb/hcd-ehci-pci.c    | 2 ++
 hw/usb/hcd-ehci-sysbus.c | 2 ++
 hw/usb/hcd-ehci.c        | 7 ++++++-
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 6406f536e8..05d8db4a5d 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -264,6 +264,7 @@ struct EHCIState {
     /* properties */
     uint32_t maxframes;
     bool caps_64bit_addr;
+    uint64_t descriptor_addr_offset;
 
     /*
      *  EHCI spec version 1.0 Section 2.3
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 2ea8549db9..115d05ede0 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -139,6 +139,8 @@ static const Property ehci_pci_properties[] = {
     DEFINE_PROP_UINT32("maxframes", EHCIPCIState, ehci.maxframes, 128),
     DEFINE_PROP_BOOL("caps-64bit-addr", EHCIPCIState, ehci.caps_64bit_addr,
                      false),
+    DEFINE_PROP_UINT64("descriptor-addr-offset", EHCIPCIState,
+                       ehci.descriptor_addr_offset, 0),
 };
 
 static const VMStateDescription vmstate_ehci_pci = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 61215e9f3d..df138fb339 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -36,6 +36,8 @@ static const Property ehci_sysbus_properties[] = {
                      false),
     DEFINE_PROP_BOOL("caps-64bit-addr", EHCISysBusState, ehci.caps_64bit_addr,
                      false),
+    DEFINE_PROP_UINT64("descriptor-addr-offset", EHCISysBusState,
+                       ehci.descriptor_addr_offset, 0),
 };
 
 static void usb_ehci_sysbus_realize(DeviceState *dev, Error **errp)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 24133af9db..0af9e47fc1 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -162,7 +162,12 @@ static uint64_t ehci_get_buf_addr(EHCIState *s, uint32_t hi, uint32_t low,
 
 static uint64_t ehci_get_desc_addr(EHCIState *s, uint32_t low)
 {
-    return ehci_get_buf_addr(s, s->ctrldssegment, low, UINT32_MAX);
+    uint64_t addr;
+
+    addr = ehci_get_buf_addr(s, s->ctrldssegment, low, UINT32_MAX);
+    addr += s->descriptor_addr_offset;
+
+    return addr;
 }
 
 static void ehci_trace_usbsts(uint32_t mask, int state)
-- 
2.43.0

[PATCH v2 14/17] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing

[Jamin Lin]

AST2700 supports a 64-bit DRAM address space. Therefore, DMA
transactions must be capable of accessing 64-bit addresses.

Enable the "caps-64bit-addr" property for the EHCI controllers
on AST2700 so that USB DMA operations can correctly handle
64-bit memory addresses.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 87dcb82e1b..4a1f7cad73 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -856,6 +856,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
 
     /* EHCI */
     for (i = 0; i < sc->ehcis_num; i++) {
+        object_property_set_bool(OBJECT(&s->ehci[i]), "caps-64bit-addr", true,
+                                 &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-- 
2.43.0

[PATCH v2 15/17] hw/arm/aspeed_ast27x0: Set EHCI descriptor address offset

[Jamin Lin]

On AST2700 platforms, system DRAM is mapped above 4GB with the
base address at 0x400000000.

The Linux EHCI driver programs the segment register to zero when
64-bit addressing is supported. As a result, descriptor addresses
derived from the EHCI registers do not include the DRAM base
address.

Descriptor memory is allocated through the DMA API with a 64-bit
DMA mask, which allows descriptors to be placed in DRAM above 4GB.
When running on AST2700, this means EHCI queue heads (QH) and queue
element transfer descriptors (qTD) reside at addresses starting
from 0x400000000.

Set the descriptor-addr-offset property to the DRAM base so the
emulated EHCI controller can construct the correct descriptor
addresses when accessing system memory.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast27x0.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 4a1f7cad73..3cdbf78ac1 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -858,6 +858,9 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < sc->ehcis_num; i++) {
         object_property_set_bool(OBJECT(&s->ehci[i]), "caps-64bit-addr", true,
                                  &error_abort);
+        object_property_set_int(OBJECT(&s->ehci[i]), "descriptor-addr-offset",
+                                sc->memmap[ASPEED_DEV_SDRAM],
+                                &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-- 
2.43.0

[PATCH v2 16/17] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK

[Jamin Lin]

Add a functional test to verify USB EHCI support on the AST2600
SDK machine by attaching a USB keyboard device and checking its
enumeration via lsusb.

This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 tests/functional/arm/test_aspeed_ast2600_sdk.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/functional/arm/test_aspeed_ast2600_sdk.py b/tests/functional/arm/test_aspeed_ast2600_sdk.py
index d787e90d10..01548dd135 100755
--- a/tests/functional/arm/test_aspeed_ast2600_sdk.py
+++ b/tests/functional/arm/test_aspeed_ast2600_sdk.py
@@ -40,6 +40,11 @@ def do_ast2600_i3c_test(self):
             'i3ctransfer -d /dev/bus/i3c/5-1234567890ab -r 8 | grep 0x | xargs',
             '0x12 0x34 0x56 0x78 0x90 0xab 0xcd 0xef')
 
+    def do_ast2600_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def test_arm_ast2600_evb_sdk(self):
         self.set_machine('ast2600-evb')
         self.require_netdev('user')
@@ -54,6 +59,7 @@ def test_arm_ast2600_evb_sdk(self):
         self.vm.add_args('-netdev', 'user,id=net1')
         self.vm.add_args('-device',
             'mock-i3c-target,bus=dw.i3c.5,pid=0xab9078563412')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.1')
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2600-default-image", "image-bmc"))
 
@@ -81,6 +87,7 @@ def test_arm_ast2600_evb_sdk(self):
              '/sbin/hwclock -f /dev/rtc1', year)
         self.do_ast2600_pcie_test()
         self.do_ast2600_i3c_test()
+        self.do_ast2600_usb_ehci_test()
 
 
 if __name__ == '__main__':
-- 
2.43.0

[PATCH v2 17/17] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2

[Jamin Lin]

Add a functional test to verify USB EHCI support on the AST2700 A2/A1
by attaching a USB keyboard device and checking its
enumeration via lsusb.

This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 tests/functional/aarch64/test_aspeed_ast2700a1.py | 7 +++++++
 tests/functional/aarch64/test_aspeed_ast2700a2.py | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700a1.py b/tests/functional/aarch64/test_aspeed_ast2700a1.py
index b0c08854da..42b8b200cf 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a1.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a1.py
@@ -118,6 +118,11 @@ def do_ast2700_pcie_test(self):
             'ip addr show dev eth2',
             'inet 10.0.2.15/24')
 
+    def do_ast2700_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def start_ast2700_test(self, name, bus_id):
         num_cpu = 4
         load_images_list = [
@@ -161,10 +166,12 @@ def test_aarch64_ast2700a1_evb_sdk_v11_01(self):
         self.archive_extract(self.ASSET_SDK_V1101_AST2700A1)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
         self.start_ast2700_test('ast2700-a1-image', 1)
         self.verify_openbmc_boot_and_login('ast2700-a1')
         self.do_ast2700_i2c_test(1)
         self.do_ast2700_pcie_test()
+        self.do_ast2700_usb_ehci_test()
 
     def test_aarch64_ast2700a1_evb_sdk_vbootrom_v11_01(self):
         self.set_machine('ast2700a1-evb')
diff --git a/tests/functional/aarch64/test_aspeed_ast2700a2.py b/tests/functional/aarch64/test_aspeed_ast2700a2.py
index ed414999f4..40e0ad81ed 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a2.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a2.py
@@ -121,6 +121,11 @@ def do_ast2700_pcie_test(self):
             'ip addr show dev eth2',
             'inet 10.0.2.15/24')
 
+    def do_ast2700_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def start_ast2700_test(self, name, bus_id):
         num_cpu = 4
         load_images_list = [
@@ -164,10 +169,12 @@ def test_aarch64_ast2700a2_evb_sdk_v11_01(self):
         self.archive_extract(self.ASSET_SDK_V1101_AST2700A2)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
         self.start_ast2700_test('ast2700-default-image', 1)
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test(1)
         self.do_ast2700_pcie_test()
+        self.do_ast2700_usb_ehci_test()
 
     def test_aarch64_ast2700a2_evb_sdk_vbootrom_v11_01(self):
         self.set_machine('ast2700a2-evb')
-- 
2.43.0

Re: [PATCH v2 06/17] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit

[Philippe Mathieu-Daudé]

On 14/4/26 10:00, Jamin Lin wrote:
> Change internal EHCI descriptor addresses from uint32_t to uint64_t.
> 
> The following fields are updated:
> - EHCIPacket::qtdaddr
> - EHCIQueue::{qhaddr, qtdaddr}
> - EHCIState::{a_fetch_addr, p_fetch_addr}
> 
> Update get_dwords() and put_dwords() to take 64-bit addresses and
> propagate the type change through the descriptor traversal paths.
> 
> Adjust NLPTR_GET() to operate on 64-bit values:
> 
>      #define NLPTR_GET(x) ((x) & ~0x1fULL)
> 
> so that link pointer masking works correctly when descriptor
> addresses exceed 32-bit space. The previous mask (0xffffffe0)
> implicitly truncated addresses to 32 bits.
> 
> This patch does not change the on-wire descriptor layout yet.
> It only removes the internal 32-bit address limit and prepares
> for later patches that will add full 64-bit QH/qTD/iTD/siTD support.
> 
> Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> use uint64_t for the address argument and print it with PRIx64. This
> ensures full 64-bit addresses are shown in trace output and improves
> debugging of queue heads and transfer descriptors.
> 
> Since the type of fetch_addr changes from 32-bit to 64-bit,
> bump the VMState version.
> 
> No functional change.
> 
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
>   hw/usb/hcd-ehci.h   | 12 ++++++----
>   hw/usb/hcd-ehci.c   | 57 +++++++++++++++++++++++++++------------------
>   hw/usb/trace-events | 24 +++++++++----------
>   3 files changed, 53 insertions(+), 40 deletions(-)


> @@ -294,8 +294,10 @@ struct EHCIState {
>       EHCIQueueHead pqueues;
>   
>       /* which address to look at next */
> -    uint32_t a_fetch_addr;
> -    uint32_t p_fetch_addr;
> +    uint32_t a_fetch_addr_pre_v3;
> +    uint32_t p_fetch_addr_pre_v3;
> +    uint64_t a_fetch_addr;
> +    uint64_t p_fetch_addr;


> @@ -2441,6 +2445,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
>           }
>       }
>   
> +    if (version_id < 3) {
> +        s->a_fetch_addr = s->a_fetch_addr_pre_v3;
> +        s->p_fetch_addr = s->p_fetch_addr_pre_v3;
> +    }
> +
>       return 0;
>   }
>   
> @@ -2472,7 +2481,7 @@ static void usb_ehci_vm_state_change(void *opaque, bool running, RunState state)
>   
>   const VMStateDescription vmstate_ehci = {
>       .name        = "ehci-core",
> -    .version_id  = 2,
> +    .version_id  = 3,
>       .minimum_version_id  = 1,
>       .pre_save    = usb_ehci_pre_save,
>       .post_load   = usb_ehci_post_load,
> @@ -2501,8 +2510,10 @@ const VMStateDescription vmstate_ehci = {
>           /* schedule state */
>           VMSTATE_UINT32(astate, EHCIState),
>           VMSTATE_UINT32(pstate, EHCIState),
> -        VMSTATE_UINT32(a_fetch_addr, EHCIState),
> -        VMSTATE_UINT32(p_fetch_addr, EHCIState),
> +        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
> +        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),

IIUC we want VMSTATE_UINT32_TEST(..., 3) here, for "<3".

> +        VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
> +        VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),

These ones are correct (">=3").

>           VMSTATE_END_OF_LIST()
>       }
>   };

RE: [PATCH v2 06/17] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit

[Jamin Lin]

Hi Philippe

> >   const VMStateDescription vmstate_ehci = {
> >       .name        = "ehci-core",
> > -    .version_id  = 2,
> > +    .version_id  = 3,
> >       .minimum_version_id  = 1,
> >       .pre_save    = usb_ehci_pre_save,
> >       .post_load   = usb_ehci_post_load,
> > @@ -2501,8 +2510,10 @@ const VMStateDescription vmstate_ehci = {
> >           /* schedule state */
> >           VMSTATE_UINT32(astate, EHCIState),
> >           VMSTATE_UINT32(pstate, EHCIState),
> > -        VMSTATE_UINT32(a_fetch_addr, EHCIState),
> > -        VMSTATE_UINT32(p_fetch_addr, EHCIState),
> > +        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
> > +        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),
> 
> IIUC we want VMSTATE_UINT32_TEST(..., 3) here, for "<3".
> 
> > +        VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
> > +        VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
> 
> These ones are correct (">=3").
> 
> >           VMSTATE_END_OF_LIST()
> >       }
> >   };

Thanks for the review and suggestion.
How about the following changes?
Thanks-Jamin

+static bool ehci_core_is_before_version_3(void *opaque, int version_id)
+{
+    return version_id < 3;
+}
+
 const VMStateDescription vmstate_ehci = {
     .name        = "ehci-core",
     .version_id  = 3,
@@ -2510,8 +2515,10 @@ const VMStateDescription vmstate_ehci = {
         /* schedule state */
         VMSTATE_UINT32(astate, EHCIState),
         VMSTATE_UINT32(pstate, EHCIState),
-        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
-        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),
+        VMSTATE_UINT32_TEST(a_fetch_addr_pre_v3, EHCIState,
+                            ehci_core_is_before_version_3),
+        VMSTATE_UINT32_TEST(p_fetch_addr_pre_v3, EHCIState,
+                            ehci_core_is_before_version_3),
         VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
         VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
         VMSTATE_END_OF_LIST()

Re: [PATCH v2 06/17] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit

[Philippe Mathieu-Daudé]

On 15/4/26 02:54, Jamin Lin wrote:
> Hi Philippe
> 
>>>    const VMStateDescription vmstate_ehci = {
>>>        .name        = "ehci-core",
>>> -    .version_id  = 2,
>>> +    .version_id  = 3,
>>>        .minimum_version_id  = 1,
>>>        .pre_save    = usb_ehci_pre_save,
>>>        .post_load   = usb_ehci_post_load,
>>> @@ -2501,8 +2510,10 @@ const VMStateDescription vmstate_ehci = {
>>>            /* schedule state */
>>>            VMSTATE_UINT32(astate, EHCIState),
>>>            VMSTATE_UINT32(pstate, EHCIState),
>>> -        VMSTATE_UINT32(a_fetch_addr, EHCIState),
>>> -        VMSTATE_UINT32(p_fetch_addr, EHCIState),
>>> +        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
>>> +        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),
>>
>> IIUC we want VMSTATE_UINT32_TEST(..., 3) here, for "<3".
>>
>>> +        VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
>>> +        VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
>>
>> These ones are correct (">=3").
>>
>>>            VMSTATE_END_OF_LIST()
>>>        }
>>>    };
> 
> Thanks for the review and suggestion.
> How about the following changes?
> Thanks-Jamin
> 
> +static bool ehci_core_is_before_version_3(void *opaque, int version_id)
> +{
> +    return version_id < 3;
> +}
> +
>   const VMStateDescription vmstate_ehci = {
>       .name        = "ehci-core",
>       .version_id  = 3,
> @@ -2510,8 +2515,10 @@ const VMStateDescription vmstate_ehci = {
>           /* schedule state */
>           VMSTATE_UINT32(astate, EHCIState),
>           VMSTATE_UINT32(pstate, EHCIState),
> -        VMSTATE_UINT32_V(a_fetch_addr_pre_v3, EHCIState, 2),
> -        VMSTATE_UINT32_V(p_fetch_addr_pre_v3, EHCIState, 2),
> +        VMSTATE_UINT32_TEST(a_fetch_addr_pre_v3, EHCIState,
> +                            ehci_core_is_before_version_3),
> +        VMSTATE_UINT32_TEST(p_fetch_addr_pre_v3, EHCIState,
> +                            ehci_core_is_before_version_3),
>           VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
>           VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
>           VMSTATE_END_OF_LIST()

LGTM, thanks!