[PATCH v5 00/18] hw/usb/ehci: Add 64-bit descriptor addressing support

[PATCH v5 00/18] hw/usb/ehci: Add 64-bit descriptor addressing support

[Jamin Lin]

EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
which provides the upper 32 bits of descriptor addresses when the
controller advertises 64-bit capability.

Currently QEMU EHCI model only partially supports this functionality and
descriptor addresses are effectively treated as 32-bit. This becomes
problematic on systems where system memory is located above the 4GB
boundary.

The Linux EHCI driver enables 64-bit addressing if the controller
advertises the capability. During initialization it programs the
segment register to zero:

  https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600

The driver also notes that descriptor structures allocated from the
DMA pool use segment zero semantics. Descriptor memory is allocated
using the DMA API and platforms may configure a 64-bit DMA mask,
allowing descriptor memory to be placed above 4GB.

On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
result, descriptor addresses constructed directly from the EHCI
registers do not match the actual system addresses used by the
controller when accessing queue heads (QH) and queue element transfer
descriptors (qTD).

This patch series implements full 64-bit descriptor addressing support
in the EHCI emulation. Descriptor address handling is updated to use
64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
are extended to support the upper address bits provided by the segment
register.

Add a ctrldssegment-default property so platforms can provide a
descriptor address offset when constructing descriptor addresses.
This allows systems where DRAM resides above 4GB to access EHCI
descriptors correctly.

The AST2700 machine uses this property to account for its DRAM mapping
at 0x400000000 and enables 64-bit EHCI DMA addressing.

Test Result:
1. EHCI 32bits with ast2600-evb machine
Command line:
./build/qemu-system-arm \
  -machine ast2600-evb \
  -m 1G \
  -drive file=image-bmc,if=mtd,format=raw \
  -nographic \
  -device usb-kbd,bus=usb-bus.1,id=mykbd \
  -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
  -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
  -snapshot \
  -nographic
Result:
unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller

2. EHCI 64bits with ast2700a2-evb machine
Command line:
./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
 -bios ast27x0_bootrom.bin \
 -drive file=image-bmc,format=raw,if=mtd \
 -snapshot \
 -device usb-kbd,bus=usb-bus.3,id=mykbd \
 -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
 -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
Result:
root@ast2700-default:~# lsusb
unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
 
v1
 1. Fix checkpatch coding style issues
 2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
 3. Add descriptor address offset property
 4. Enable 64-bit EHCI DMA addressing on AST2700
 5. Configure descriptor address offset for AST2700

v2
 1. Remove unused EHCIfstn structure and dead code
 2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
 3. Replace DPRINTF debug logs with trace events
 4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
 5. Fix review issue

v3:
 1. Add Migration version test function
 2. Add EHCI 64-bit buffer pointer fields description in commit log

v4:
 1. Reorder patches in the series
 2. Fix EHCI migration issues
 3. Introduce a common properties macro for both sysbus and PCI
 4. Drop the descriptor address offset property
 5. Add ctrldssegment-default property
 6. Address review comments

v5:
 1. Add 11.0 machine compatibility properties

Jamin Lin (18):
  tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
    AST2600 SDK
  hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
  hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with
    qemu_log_mask(LOG_GUEST_ERROR)
  hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
  hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci
  hw/core: Add 11.0 machine compatibility properties
  hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
    compatibility
  hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
    capability
  hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
  hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
  hw/usb/hcd-ehci: Add ctrldssegment-default property
  hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
  hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
  tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
    AST2700 A1/A2

 hw/usb/hcd-ehci.h                             |  64 +--
 include/hw/core/boards.h                      |   3 +
 include/hw/i386/pc.h                          |   3 +
 hw/arm/aspeed_ast27x0.c                       |   4 +
 hw/arm/virt.c                                 |   8 +
 hw/core/machine.c                             |   6 +
 hw/i386/pc.c                                  |   3 +
 hw/i386/pc_piix.c                             |  11 +-
 hw/i386/pc_q35.c                              |  11 +-
 hw/m68k/virt.c                                |   7 +
 hw/ppc/spapr.c                                |  13 +-
 hw/s390x/s390-virtio-ccw.c                    |  11 +
 hw/usb/hcd-ehci-pci.c                         |   2 +-
 hw/usb/hcd-ehci-sysbus.c                      |   2 +-
 hw/usb/hcd-ehci.c                             | 382 +++++++++++-------
 hw/usb/trace-events                           |  25 +-
 .../aarch64/test_aspeed_ast2700a1.py          |   7 +
 .../aarch64/test_aspeed_ast2700a2.py          |   7 +
 .../functional/arm/test_aspeed_ast2600_sdk.py |   7 +
 19 files changed, 384 insertions(+), 192 deletions(-)

-- 
2.43.0

[PATCH v5 01/18] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK

[Jamin Lin]

Add a functional test to verify USB EHCI support on the AST2600
SDK machine by attaching a USB keyboard device and checking its
enumeration via lsusb.

This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 tests/functional/arm/test_aspeed_ast2600_sdk.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/functional/arm/test_aspeed_ast2600_sdk.py b/tests/functional/arm/test_aspeed_ast2600_sdk.py
index d787e90d10..01548dd135 100755
--- a/tests/functional/arm/test_aspeed_ast2600_sdk.py
+++ b/tests/functional/arm/test_aspeed_ast2600_sdk.py
@@ -40,6 +40,11 @@ def do_ast2600_i3c_test(self):
             'i3ctransfer -d /dev/bus/i3c/5-1234567890ab -r 8 | grep 0x | xargs',
             '0x12 0x34 0x56 0x78 0x90 0xab 0xcd 0xef')
 
+    def do_ast2600_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def test_arm_ast2600_evb_sdk(self):
         self.set_machine('ast2600-evb')
         self.require_netdev('user')
@@ -54,6 +59,7 @@ def test_arm_ast2600_evb_sdk(self):
         self.vm.add_args('-netdev', 'user,id=net1')
         self.vm.add_args('-device',
             'mock-i3c-target,bus=dw.i3c.5,pid=0xab9078563412')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.1')
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2600-default-image", "image-bmc"))
 
@@ -81,6 +87,7 @@ def test_arm_ast2600_evb_sdk(self):
              '/sbin/hwclock -f /dev/rtc1', year)
         self.do_ast2600_pcie_test()
         self.do_ast2600_i3c_test()
+        self.do_ast2600_usb_ehci_test()
 
 
 if __name__ == '__main__':
-- 
2.43.0

[PATCH v5 02/18] hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code

[Jamin Lin]

The EHCIfstn structure, defined according to EHCI spec section 3.7,
is currently unused in the EHCI implementation. Remove it to reduce
unused code and improve maintainability.

Additionally, drop a block of disabled (#if 0) code in
ehci_state_advqueue() that was never implemented. This code path
is incomplete and has no functional impact.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/usb/hcd-ehci.h | 7 -------
 hw/usb/hcd-ehci.c | 6 ------
 2 files changed, 13 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 0ae8c06331..3aec0e047c 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -202,13 +202,6 @@ typedef struct EHCIqh {
 #define BUFPTR_SBYTES_SH              5
 } EHCIqh;
 
-/*  EHCI spec version 1.0 Section 3.7
- */
-typedef struct EHCIfstn {
-    uint32_t next;                    /* Standard next link pointer */
-    uint32_t backptr;                 /* Standard next link pointer */
-} EHCIfstn;
-
 enum async_state {
     EHCI_ASYNC_NONE = 0,
     EHCI_ASYNC_INITIALIZED,
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 57f930b099..23167bf96f 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1756,16 +1756,10 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 /* Section 4.10.2 - paragraph 3 */
 static int ehci_state_advqueue(EHCIQueue *q)
 {
-#if 0
     /* TO-DO: 4.10.2 - paragraph 2
      * if I-bit is set to 1 and QH is not active
      * go to horizontal QH
      */
-    if (I-bit set) {
-        ehci_set_state(ehci, async, EST_HORIZONTALQH);
-        goto out;
-    }
-#endif
 
     /*
      * want data and alt-next qTD is valid
-- 
2.43.0

[PATCH v5 03/18] hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch

[Jamin Lin]

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3aec0e047c..736407fd52 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -43,7 +43,8 @@ typedef struct EHCIPacket EHCIPacket;
 typedef struct EHCIQueue EHCIQueue;
 typedef struct EHCIState EHCIState;
 
-/*  EHCI spec version 1.0 Section 3.3
+/*
+ * EHCI spec version 1.0 Section 3.3
  */
 typedef struct EHCIitd {
     uint32_t next;
@@ -74,7 +75,8 @@ typedef struct EHCIitd {
 #define ITD_BUFPTR_MULT_SH       0
 } EHCIitd;
 
-/*  EHCI spec version 1.0 Section 3.4
+/*
+ * EHCI spec version 1.0 Section 3.4
  */
 typedef struct EHCIsitd {
     uint32_t next;                  /* Standard next link pointer */
@@ -118,7 +120,8 @@ typedef struct EHCIsitd {
     uint32_t backptr;                 /* Standard next link pointer */
 } EHCIsitd;
 
-/*  EHCI spec version 1.0 Section 3.5
+/*
+ * EHCI spec version 1.0 Section 3.5
  */
 typedef struct EHCIqtd {
     uint32_t next;                    /* Standard next link pointer */
@@ -148,7 +151,8 @@ typedef struct EHCIqtd {
 #define QTD_BUFPTR_SH                 12
 } EHCIqtd;
 
-/*  EHCI spec version 1.0 Section 3.6
+/*
+ * EHCI spec version 1.0 Section 3.6
  */
 typedef struct EHCIqh {
     uint32_t next;                    /* Standard next link pointer */
@@ -230,7 +234,8 @@ struct EHCIQueue {
     int async;
     int transact_ctr;
 
-    /* cached data from guest - needs to be flushed
+    /*
+     * cached data from guest - needs to be flushed
      * when guest removes an entry (doorbell, handshake sequence)
      */
     EHCIqh qh;             /* copy of current QH (being worked on) */
@@ -268,7 +273,7 @@ struct EHCIState {
      */
     uint8_t caps[CAPA_SIZE];
     union {
-        uint32_t opreg[0x44/sizeof(uint32_t)];
+        uint32_t opreg[0x44 / sizeof(uint32_t)];
         struct {
             uint32_t usbcmd;
             uint32_t usbsts;
-- 
2.43.0

[PATCH v5 04/18] hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch

[Jamin Lin]

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.c | 129 +++++++++++++++++++++++++---------------------
 1 file changed, 71 insertions(+), 58 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 23167bf96f..7e0b767eb9 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -41,21 +41,23 @@
 #define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
 #define UFRAME_TIMER_NS  (FRAME_TIMER_NS / 8)
 
-#define NB_MAXINTRATE    8        // Max rate at which controller issues ints
-#define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
-#define MAX_QH           100      // Max allowable queue heads in a chain
+#define NB_MAXINTRATE    8      /* Max rate at which controller issues ints */
+#define BUFF_SIZE        (5 * 4096) /* Max bytes to transfer per transaction */
+#define MAX_QH           100      /* Max allowable queue heads in a chain */
 #define MIN_UFR_PER_TICK 24       /* Min frames to process when catching up */
 #define PERIODIC_ACTIVE  512      /* Micro-frames */
 
-/*  Internal periodic / asynchronous schedule state machine states
+/*
+ * Internal periodic / asynchronous schedule state machine states
  */
 typedef enum {
     EST_INACTIVE = 1000,
     EST_ACTIVE,
     EST_EXECUTING,
     EST_SLEEPING,
-    /*  The following states are internal to the state machine function
-    */
+    /*
+     * The following states are internal to the state machine function
+     */
     EST_WAITLISTHEAD,
     EST_FETCHENTRY,
     EST_FETCHQH,
@@ -71,13 +73,13 @@ typedef enum {
 /* macros for accessing fields within next link pointer entry */
 #define NLPTR_GET(x)             ((x) & 0xffffffe0)
 #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
-#define NLPTR_TBIT(x)            ((x) & 1)  // 1=invalid, 0=valid
+#define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
 
 /* link pointer types */
-#define NLPTR_TYPE_ITD           0     // isoc xfer descriptor
-#define NLPTR_TYPE_QH            1     // queue head
-#define NLPTR_TYPE_STITD         2     // split xaction, isoc xfer descriptor
-#define NLPTR_TYPE_FSTN          3     // frame span traversal node
+#define NLPTR_TYPE_ITD           0     /* isoc xfer descriptor */
+#define NLPTR_TYPE_QH            1     /* queue head */
+#define NLPTR_TYPE_STITD         2     /* split xaction, isoc xfer descriptor */
+#define NLPTR_TYPE_FSTN          3     /* frame span traversal node */
 
 #define SET_LAST_RUN_CLOCK(s) \
     (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -88,10 +90,10 @@ typedef enum {
 
 #define set_field(data, newval, field) do { \
     uint32_t val = *data; \
-    val &= ~ field##_MASK; \
+    val &= ~field##_MASK; \
     val |= ((newval) << field##_SH) & field##_MASK; \
     *data = val; \
-    } while(0)
+    } while (0)
 
 static const char *ehci_state_names[] = {
     [EST_INACTIVE]     = "INACTIVE",
@@ -472,8 +474,10 @@ static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd)
     }
 }
 
-/* Finish executing and writeback a packet outside of the regular
-   fetchqh -> fetchqtd -> execute -> writeback cycle */
+/*
+ * Finish executing and writeback a packet outside of the regular
+ * fetchqh -> fetchqtd -> execute -> writeback cycle
+ */
 static void ehci_writeback_async_complete_packet(EHCIPacket *p)
 {
     EHCIQueue *q = p->queue;
@@ -733,7 +737,7 @@ static void ehci_detach(USBPort *port)
     ehci_queues_rip_device(s, port->dev, 0);
     ehci_queues_rip_device(s, port->dev, 1);
 
-    *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND);
+    *portsc &= ~(PORTSC_CONNECT | PORTSC_PED | PORTSC_SUSPEND);
     *portsc |= PORTSC_CSC;
 
     ehci_raise_irq(s, USBSTS_PCD);
@@ -858,7 +862,7 @@ void ehci_reset(void *opaque)
      * Do the detach before touching portsc, so that it correctly gets send to
      * us or to our companion based on PORTSC_POWNER before the reset.
      */
-    for(i = 0; i < EHCI_PORTS; i++) {
+    for (i = 0; i < EHCI_PORTS; i++) {
         devs[i] = s->ports[i].dev;
         if (devs[i] && devs[i]->attached) {
             usb_detach(&s->ports[i]);
@@ -877,7 +881,7 @@ void ehci_reset(void *opaque)
     s->astate = EST_INACTIVE;
     s->pstate = EST_INACTIVE;
 
-    for(i = 0; i < EHCI_PORTS; i++) {
+    for (i = 0; i < EHCI_PORTS; i++) {
         if (s->companion_ports[i]) {
             s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER;
         } else {
@@ -942,8 +946,9 @@ static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)
     uint32_t *portsc = &s->portsc[port];
     uint32_t orig;
 
-    if (s->companion_ports[port] == NULL)
+    if (s->companion_ports[port] == NULL) {
         return;
+    }
 
     owner = owner & PORTSC_POWNER;
     orig  = *portsc & PORTSC_POWNER;
@@ -988,7 +993,7 @@ static void ehci_port_write(void *ptr, hwaddr addr,
         trace_usb_ehci_port_reset(port, 1);
     }
 
-    if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {
+    if (!(val & PORTSC_PRESET) && (*portsc & PORTSC_PRESET)) {
         trace_usb_ehci_port_reset(port, 0);
         if (dev && dev->attached) {
             usb_port_reset(&s->ports[port]);
@@ -1065,8 +1070,10 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
         break;
 
     case USBSTS:
-        val &= USBSTS_RO_MASK;              // bits 6 through 31 are RO
-        ehci_clear_usbsts(s, val);          // bits 0 through 5 are R/WC
+        /* bits 6 through 31 are RO */
+        val &= USBSTS_RO_MASK;
+        /* bits 0 through 5 are R/WC */
+        ehci_clear_usbsts(s, val);
         val = s->usbsts;
         ehci_update_irq(s);
         break;
@@ -1131,8 +1138,7 @@ static void ehci_flush_qh(EHCIQueue *q)
     put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
 }
 
-// 4.10.2
-
+/* 4.10.2 */
 static int ehci_qh_do_overlay(EHCIQueue *q)
 {
     EHCIPacket *p = QTAILQ_FIRST(&q->packets);
@@ -1145,8 +1151,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
     assert(p != NULL);
     assert(p->qtdaddr == q->qtdaddr);
 
-    // remember values in fields to preserve in qh after overlay
-
+    /*  remember values in fields to preserve in qh after overlay */
     dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE;
     ping    = q->qh.token & QTD_TOKEN_PING;
 
@@ -1170,7 +1175,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
     }
 
     if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
-        // preserve QH DT bit
+        /* preserve QH DT bit */
         q->qh.token &= ~QTD_TOKEN_DTOGGLE;
         q->qh.token |= dtoggle;
     }
@@ -1397,9 +1402,7 @@ static int ehci_execute(EHCIPacket *p, const char *action)
     return 1;
 }
 
-/*  4.7.2
- */
-
+/* 4.7.2 */
 static int ehci_process_itd(EHCIState *ehci,
                             EHCIitd *itd,
                             uint32_t addr)
@@ -1411,13 +1414,13 @@ static int ehci_process_itd(EHCIState *ehci,
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
 
-    dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
+    dir = (itd->bufptr[1] & ITD_BUFPTR_DIRECTION);
     devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR);
     endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP);
     max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT);
     mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT);
 
-    for(i = 0; i < 8; i++) {
+    for (i = 0; i < 8; i++) {
         if (itd->transact[i] & ITD_XACT_ACTIVE) {
             pg   = get_field(itd->transact[i], ITD_XACT_PGSEL);
             off  = itd->transact[i] & ITD_XACT_OFFSET_MASK;
@@ -1513,8 +1516,9 @@ static int ehci_process_itd(EHCIState *ehci,
 }
 
 
-/*  This state is the entry point for asynchronous schedule
- *  processing.  Entry here constitutes a EHCI start event state (4.8.5)
+/*
+ * This state is the entry point for asynchronous schedule
+ * processing.  Entry here constitutes a EHCI start event state (4.8.5)
  */
 static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
 {
@@ -1531,7 +1535,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     ehci_queues_rip_unused(ehci, async);
 
     /*  Find the head of the list (4.9.1.1) */
-    for(i = 0; i < MAX_QH; i++) {
+    for (i = 0; i < MAX_QH; i++) {
         if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh,
                        sizeof(EHCIqh) >> 2) < 0) {
             return 0;
@@ -1564,8 +1568,9 @@ out:
 }
 
 
-/*  This state is the entry point for periodic schedule processing as
- *  well as being a continuation state for async processing.
+/*
+ * This state is the entry point for periodic schedule processing as
+ * well as being a continuation state for async processing.
  */
 static int ehci_state_fetchentry(EHCIState *ehci, int async)
 {
@@ -1674,7 +1679,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
 
 #if EHCI_DEBUG
     if (q->qhaddr != q->qh.next) {
-    DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
+        DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
                q->qhaddr,
                q->qh.epchar & QH_EPCHAR_H,
                q->qh.token & QTD_TOKEN_HALT,
@@ -1756,7 +1761,8 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 /* Section 4.10.2 - paragraph 3 */
 static int ehci_state_advqueue(EHCIQueue *q)
 {
-    /* TO-DO: 4.10.2 - paragraph 2
+    /*
+     * TO-DO: 4.10.2 - paragraph 2
      * if I-bit is set to 1 and QH is not active
      * go to horizontal QH
      */
@@ -1929,8 +1935,10 @@ static int ehci_state_execute(EHCIQueue *q)
         return -1;
     }
 
-    // TODO verify enough time remains in the uframe as in 4.4.1.1
-    // TODO write back ptr to async list when done or out of time
+    /*
+     * TODO verify enough time remains in the uframe as in 4.4.1.1
+     * TODO write back ptr to async list when done or out of time
+     */
 
     /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */
     if (!q->async && q->transact_ctr == 0) {
@@ -2041,7 +2049,7 @@ static void ehci_advance_state(EHCIState *ehci, int async)
     int again;
 
     do {
-        switch(ehci_get_state(ehci, async)) {
+        switch (ehci_get_state(ehci, async)) {
         case EST_WAITLISTHEAD:
             again = ehci_state_waitlisthead(ehci, async);
             break;
@@ -2120,21 +2128,20 @@ static void ehci_advance_state(EHCIState *ehci, int async)
             ehci_reset(ehci);
             again = 0;
         }
-    }
-    while (again);
+    } while (again);
 }
 
 static void ehci_advance_async_state(EHCIState *ehci)
 {
     const int async = 1;
 
-    switch(ehci_get_state(ehci, async)) {
+    switch (ehci_get_state(ehci, async)) {
     case EST_INACTIVE:
         if (!ehci_async_enabled(ehci)) {
             break;
         }
         ehci_set_state(ehci, async, EST_ACTIVE);
-        // No break, fall through to ACTIVE
+        /* No break, fall through to ACTIVE */
 
     case EST_ACTIVE:
         if (!ehci_async_enabled(ehci)) {
@@ -2158,7 +2165,8 @@ static void ehci_advance_async_state(EHCIState *ehci)
         ehci_set_state(ehci, async, EST_WAITLISTHEAD);
         ehci_advance_state(ehci, async);
 
-        /* If the doorbell is set, the guest wants to make a change to the
+        /*
+         * If the doorbell is set, the guest wants to make a change to the
          * schedule. The host controller needs to release cached data.
          * (section 4.8.2)
          */
@@ -2185,13 +2193,13 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
     uint32_t list;
     const int async = 0;
 
-    // 4.6
+    /* 4.6 */
 
-    switch(ehci_get_state(ehci, async)) {
+    switch (ehci_get_state(ehci, async)) {
     case EST_INACTIVE:
         if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) {
             ehci_set_state(ehci, async, EST_ACTIVE);
-            // No break, fall through to ACTIVE
+            /* No break, fall through to ACTIVE */
         } else
             break;
 
@@ -2215,7 +2223,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
 
         DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
                 ehci->frindex / 8, list, entry);
-        ehci_set_fetch_addr(ehci, async,entry);
+        ehci_set_fetch_addr(ehci, async, entry);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
         ehci_queues_rip_unused(ehci, async);
@@ -2240,7 +2248,8 @@ static void ehci_update_frindex(EHCIState *ehci, int uframes)
         ehci_raise_irq(ehci, USBSTS_FLR);
     }
 
-    /* How many times will frindex roll over 0x4000 with this frame count?
+    /*
+     * How many times will frindex roll over 0x4000 with this frame count?
      * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0
      */
     int rollovers = (ehci->frindex + uframes) / 0x4000;
@@ -2320,8 +2329,9 @@ static void ehci_work_bh(void *opaque)
         ehci->async_stepdown++;
     }
 
-    /*  Async is not inside loop since it executes everything it can once
-     *  called
+    /*
+     * Async is not inside loop since it executes everything it can once
+     * called
      */
     if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) {
         need_timer++;
@@ -2339,15 +2349,18 @@ static void ehci_work_bh(void *opaque)
     }
 
     if (need_timer) {
-        /* If we've raised int, we speed up the timer, so that we quickly
-         * notice any new packets queued up in response */
+        /*
+         * If we've raised int, we speed up the timer, so that we quickly
+         * notice any new packets queued up in response
+         */
         if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) {
             expire_time = t_now +
                 NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4);
             ehci->int_req_by_async = false;
         } else {
-            expire_time = t_now + (NANOSECONDS_PER_SECOND
-                               * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ);
+            expire_time = t_now
+                + (NANOSECONDS_PER_SECOND * (ehci->async_stepdown + 1) /
+                   FRAME_TIMER_FREQ);
         }
         timer_mod(ehci->frame_timer, expire_time);
     }
-- 
2.43.0

[PATCH v5 05/18] hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)

[Jamin Lin]

Replace direct fprintf(stderr, ...) calls with qemu_log_mask()
using LOG_GUEST_ERROR in the EHCI controller implementation.

Direct writes to stderr are discouraged in QEMU as they bypass
the logging framework and cannot be filtered or controlled at
runtime. Using qemu_log_mask() ensures that guest-visible errors
are properly categorized and can be managed via QEMU logging
options.

All affected messages correspond to guest-triggerable error
conditions, so LOG_GUEST_ERROR is used consistently.

This change improves integration with QEMU's logging infrastructure
and aligns with upstream coding guidelines.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/usb/hcd-ehci.c | 46 +++++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 7e0b767eb9..8acaedeaa9 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -36,6 +36,7 @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "system/runstate.h"
+#include "qemu/log.h"
 
 #define FRAME_TIMER_FREQ 1000
 #define FRAME_TIMER_NS   (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ)
@@ -425,7 +426,7 @@ static int ehci_get_pid(EHCIqtd *qtd)
     case 2:
         return USB_TOKEN_SETUP;
     default:
-        fprintf(stderr, "bad token\n");
+        qemu_log_mask(LOG_GUEST_ERROR, "bad token\n");
         return 0;
     }
 }
@@ -532,7 +533,7 @@ static void ehci_free_packet(EHCIPacket *p)
     }
     if (p->async == EHCI_ASYNC_FINISHED &&
             p->packet.status == USB_RET_SUCCESS) {
-        fprintf(stderr,
+        qemu_log_mask(LOG_GUEST_ERROR,
                 "EHCI: Dropping completed packet from halted %s ep %02X\n",
                 (p->pid == USB_TOKEN_IN) ? "in" : "out",
                 get_field(p->queue->qh.epchar, QH_EPCHAR_EP));
@@ -1042,8 +1043,9 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
         /* not supporting dynamic frame list size at the moment */
         if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) {
-            fprintf(stderr, "attempt to set frame list size -- value %d\n",
-                    (int)val & USBCMD_FLS);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "attempt to set frame list size -- value %" PRId64
+                          "\n", val & USBCMD_FLS);
             val &= ~USBCMD_FLS;
         }
 
@@ -1101,7 +1103,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
     case PERIODICLISTBASE:
         if (ehci_periodic_enabled(s)) {
-            fprintf(stderr,
+            qemu_log_mask(LOG_GUEST_ERROR,
               "ehci: PERIODIC list base register set while periodic schedule\n"
               "      is enabled and HC is enabled\n");
         }
@@ -1109,7 +1111,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
 
     case ASYNCLISTADDR:
         if (ehci_async_enabled(s)) {
-            fprintf(stderr,
+            qemu_log_mask(LOG_GUEST_ERROR,
               "ehci: ASYNC list address register set while async schedule\n"
               "      is enabled and HC is enabled\n");
         }
@@ -1200,7 +1202,7 @@ static int ehci_init_transfer(EHCIPacket *p)
 
     while (bytes > 0) {
         if (cpage > 4) {
-            fprintf(stderr, "cpage out of range (%u)\n", cpage);
+            qemu_log_mask(LOG_GUEST_ERROR, "cpage out of range (%u)\n", cpage);
             qemu_sglist_destroy(&p->sgl);
             return -1;
         }
@@ -1306,7 +1308,8 @@ static void ehci_execute_complete(EHCIQueue *q)
         break;
     default:
         /* should not be triggerable */
-        fprintf(stderr, "USB invalid response %d\n", p->packet.status);
+        qemu_log_mask(LOG_GUEST_ERROR, "USB invalid response %d\n",
+                      p->packet.status);
         g_assert_not_reached();
     }
 
@@ -1354,7 +1357,7 @@ static int ehci_execute(EHCIPacket *p, const char *action)
            p->async == EHCI_ASYNC_INITIALIZED);
 
     if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) {
-        fprintf(stderr, "Attempting to execute inactive qtd\n");
+        qemu_log_mask(LOG_GUEST_ERROR, "Attempting to execute inactive qtd\n");
         return -1;
     }
 
@@ -1395,7 +1398,8 @@ static int ehci_execute(EHCIPacket *p, const char *action)
             p->packet.actual_length);
 
     if (p->packet.actual_length > BUFF_SIZE) {
-        fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n");
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ret from usb_handle_packet > BUFF_SIZE\n");
         return -1;
     }
 
@@ -1479,8 +1483,9 @@ static int ehci_process_itd(EHCIState *ehci,
             case USB_RET_SUCCESS:
                 break;
             default:
-                fprintf(stderr, "Unexpected iso usb result: %d\n",
-                        ehci->ipacket.status);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Unexpected iso usb result: %d\n",
+                              ehci->ipacket.status);
                 /* Fall through */
             case USB_RET_IOERROR:
             case USB_RET_NODEV:
@@ -1584,7 +1589,8 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
 
     /* section 4.8, only QH in async schedule */
     if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {
-        fprintf(stderr, "non queue head request in async schedule\n");
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "non queue head request in async schedule\n");
         return -1;
     }
 
@@ -1606,8 +1612,10 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
 
     default:
         /* TODO: handle FSTN type */
-        fprintf(stderr, "FETCHENTRY: entry at %X is of type %u "
-                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "FETCHENTRY: entry at 0x%x is of type %u "
+                      "which is not supported yet\n",
+                      entry, NLPTR_TYPE_GET(entry));
         return -1;
     }
 
@@ -2118,13 +2126,13 @@ static void ehci_advance_state(EHCIState *ehci, int async)
             break;
 
         default:
-            fprintf(stderr, "Bad state!\n");
             g_assert_not_reached();
         }
 
         if (again < 0 || itd_count > 16) {
             /* TODO: notify guest (raise HSE irq?) */
-            fprintf(stderr, "processing error - resetting ehci HC\n");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "processing error - resetting ehci HC\n");
             ehci_reset(ehci);
             again = 0;
         }
@@ -2181,8 +2189,6 @@ static void ehci_advance_async_state(EHCIState *ehci)
 
     default:
         /* this should only be due to a developer mistake */
-        fprintf(stderr, "ehci: Bad asynchronous state %d. "
-                "Resetting to active\n", ehci->astate);
         g_assert_not_reached();
     }
 }
@@ -2231,8 +2237,6 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
 
     default:
         /* this should only be due to a developer mistake */
-        fprintf(stderr, "ehci: Bad periodic state %d. "
-                "Resetting to active\n", ehci->pstate);
         g_assert_not_reached();
     }
 }
-- 
2.43.0

[PATCH v5 06/18] hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events

[Jamin Lin]

Replace legacy DPRINTF() debug logging in the EHCI host controller
implementation with QEMU trace events.

The EHCI_DEBUG macro and associated DPRINTF() definitions are
removed as they are no longer needed.

Trace events are added for:
- packet submission and completion
- queue head execution state
- periodic schedule advancement
- ITD error conditions
- port state handling
- skipped microframes

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h   | 10 ---------
 hw/usb/hcd-ehci.c   | 49 +++++++++++++++++++--------------------------
 hw/usb/trace-events |  9 +++++++++
 3 files changed, 30 insertions(+), 38 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 736407fd52..4234591cb4 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -24,16 +24,6 @@
 #include "hw/pci/pci_device.h"
 #include "hw/core/sysbus.h"
 
-#ifndef EHCI_DEBUG
-#define EHCI_DEBUG   0
-#endif
-
-#if EHCI_DEBUG
-#define DPRINTF printf
-#else
-#define DPRINTF(...)
-#endif
-
 #define MMIO_SIZE        0x1000
 #define CAPA_SIZE        0x10
 
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 8acaedeaa9..28a60e4c1a 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -839,7 +839,7 @@ static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr)
     for (i = 0; i < EHCI_PORTS; i++) {
         port = &ehci->ports[i];
         if (!(ehci->portsc[i] & PORTSC_PED)) {
-            DPRINTF("Port %d not enabled\n", i);
+            trace_usb_ehci_port_disable(i);
             continue;
         }
         dev = usb_find_device(port, addr);
@@ -1281,10 +1281,8 @@ static void ehci_execute_complete(EHCIQueue *q)
     assert(p->async == EHCI_ASYNC_INITIALIZED ||
            p->async == EHCI_ASYNC_FINISHED);
 
-    DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, "
-            "status %d, actual_length %d\n",
-            q->qhaddr, q->qh.next, q->qtdaddr,
-            p->packet.status, p->packet.actual_length);
+    trace_usb_ehci_execute_complete(q->qhaddr, q->qh.next, q->qtdaddr,
+                                    p->packet.status, p->packet.actual_length);
 
     switch (p->packet.status) {
     case USB_RET_SUCCESS:
@@ -1327,7 +1325,7 @@ static void ehci_execute_complete(EHCIQueue *q)
     } else {
         tbytes = 0;
     }
-    DPRINTF("updating tbytes to %d\n", tbytes);
+    trace_usb_ehci_qh_tbytes(tbytes);
     set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES);
 
     ehci_finish_transfer(q, p->packet.actual_length);
@@ -1392,10 +1390,9 @@ static int ehci_execute(EHCIPacket *p, const char *action)
 
     trace_usb_ehci_packet_action(p->queue, p, action);
     usb_handle_packet(p->queue->dev, &p->packet);
-    DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x "
-            "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next,
-            p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status,
-            p->packet.actual_length);
+    trace_usb_ehci_packet_submit(p->queue->qhaddr, p->qtd.next, p->qtdaddr,
+                                 p->pid, p->packet.iov.size, endp,
+                                 p->packet.status, p->packet.actual_length);
 
     if (p->packet.actual_length > BUFF_SIZE) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -1472,7 +1469,8 @@ static int ehci_process_itd(EHCIState *ehci,
                     usb_handle_packet(dev, &ehci->ipacket);
                     usb_packet_unmap(&ehci->ipacket, &ehci->isgl);
                 } else {
-                    DPRINTF("ISOCH: attempt to address non-iso endpoint\n");
+                    trace_usb_ehci_log("ISOCH: "
+                                       "attempt to address non-iso endpoint");
                     ehci->ipacket.status = USB_RET_NAK;
                     ehci->ipacket.actual_length = 0;
                 }
@@ -1677,24 +1675,22 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
         if (ehci->usbsts & USBSTS_REC) {
             ehci_clear_usbsts(ehci, USBSTS_REC);
         } else {
-            DPRINTF("FETCHQH:  QH 0x%08x. H-bit set, reclamation status reset"
-                       " - done processing\n", q->qhaddr);
+            trace_usb_ehci_fetchqh_reclaim_done(q->qhaddr);
             ehci_set_state(ehci, async, EST_ACTIVE);
             q = NULL;
             goto out;
         }
     }
 
-#if EHCI_DEBUG
-    if (q->qhaddr != q->qh.next) {
-        DPRINTF("FETCHQH:  QH 0x%08x (h %x halt %x active %x) next 0x%08x\n",
-               q->qhaddr,
-               q->qh.epchar & QH_EPCHAR_H,
-               q->qh.token & QTD_TOKEN_HALT,
-               q->qh.token & QTD_TOKEN_ACTIVE,
-               q->qh.next);
+    if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
+        if (q->qhaddr != q->qh.next) {
+            trace_usb_ehci_fetchqh_dbg(q->qhaddr,
+                                       q->qh.epchar & QH_EPCHAR_H,
+                                       q->qh.token & QTD_TOKEN_HALT,
+                                       q->qh.token & QTD_TOKEN_ACTIVE,
+                                       q->qh.next);
+        }
     }
-#endif
 
     if (q->qh.token & QTD_TOKEN_HALT) {
         ehci_set_state(ehci, async, EST_HORIZONTALQH);
@@ -2161,7 +2157,7 @@ static void ehci_advance_async_state(EHCIState *ehci)
         /* make sure guest has acknowledged the doorbell interrupt */
         /* TO-DO: is this really needed? */
         if (ehci->usbsts & USBSTS_IAA) {
-            DPRINTF("IAA status bit still set.\n");
+            trace_usb_ehci_log("IAA status bit still set.");
             break;
         }
 
@@ -2226,9 +2222,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
         if (get_dwords(ehci, list, &entry, 1) < 0) {
             break;
         }
-
-        DPRINTF("PERIODIC state adv fr=%d.  [%08X] -> %08X\n",
-                ehci->frindex / 8, list, entry);
+        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry);
         ehci_set_fetch_addr(ehci, async, entry);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
@@ -2294,8 +2288,7 @@ static void ehci_work_bh(void *opaque)
             ehci_update_frindex(ehci, skipped_uframes);
             ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes;
             uframes -= skipped_uframes;
-            DPRINTF("WARNING - EHCI skipped %"PRIu64" uframes\n",
-                    skipped_uframes);
+            trace_usb_ehci_skipped_uframes(skipped_uframes);
         }
 
         for (i = 0; i < uframes; i++) {
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index dd04f14add..0d4318dcf1 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -89,6 +89,7 @@ usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
 usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
 usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
 usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
+usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
 usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
 usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
 usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
@@ -100,13 +101,21 @@ usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
 usb_ehci_port_suspend(uint32_t port) "port #%d"
 usb_ehci_port_wakeup(uint32_t port) "port #%d"
 usb_ehci_port_resume(uint32_t port) "port #%d"
+usb_ehci_port_disable(uint32_t port) "port #%d"
 usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
 usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
+usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
 usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
 usb_ehci_guest_bug(const char *reason) "%s"
 usb_ehci_doorbell_ring(void) ""
 usb_ehci_doorbell_ack(void) ""
 usb_ehci_dma_error(void) ""
+usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
+usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
+usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
+usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
+usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
+usb_ehci_log(const char *msg) "%s"
 
 # hcd-uhci.c
 usb_uhci_reset(void) "=== RESET ==="
-- 
2.43.0

[PATCH v5 07/18] hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci

[Jamin Lin]

EHCI properties are currently defined separately in both sysbus and
PCI implementations, leading to duplicated code for common fields
such as "maxframes".

Introduce DEFINE_EHCI_COMMON_PROPERTIES() to consolidate shared
property definitions and reuse them across both EHCISysBusState
and EHCIPCIState.

This reduces code duplication and keeps property definitions
consistent between different EHCI device variants.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h        | 3 +++
 hw/usb/hcd-ehci-pci.c    | 2 +-
 hw/usb/hcd-ehci-sysbus.c | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 4234591cb4..d038ee1e31 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -307,6 +307,9 @@ struct EHCIState {
     VMChangeStateEntry *vmstate;
 };
 
+#define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
+    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
+
 extern const VMStateDescription vmstate_ehci;
 
 void usb_ehci_init(EHCIState *s, DeviceState *dev);
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index 9febcc1031..fd35d25340 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -136,7 +136,7 @@ static void usb_ehci_pci_write_config(PCIDevice *dev, uint32_t addr,
 }
 
 static const Property ehci_pci_properties[] = {
-    DEFINE_PROP_UINT32("maxframes", EHCIPCIState, ehci.maxframes, 128),
+    DEFINE_EHCI_COMMON_PROPERTIES(EHCIPCIState),
 };
 
 static const VMStateDescription vmstate_ehci_pci = {
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index b31032bbf3..7f7c7f8a2f 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -31,7 +31,7 @@ static const VMStateDescription vmstate_ehci_sysbus = {
 };
 
 static const Property ehci_sysbus_properties[] = {
-    DEFINE_PROP_UINT32("maxframes", EHCISysBusState, ehci.maxframes, 128),
+    DEFINE_EHCI_COMMON_PROPERTIES(EHCISysBusState),
     DEFINE_PROP_BOOL("companion-enable", EHCISysBusState, ehci.companion_enable,
                      false),
 };
-- 
2.43.0

[PATCH v5 08/18] hw/core: Add 11.0 machine compatibility properties

[Jamin Lin]

Introduce hw_compat_11_0 and pc_compat_11_0 compatibility property arrays,
and wire them into the 11.0 machine types.

Update all machine types so that version 11.0 inherits from 11.1 and applies
the 11.0 compatibility properties. This follows the standard pattern where
older machine types retain legacy behavior through compat properties, while
newer machine types provide updated defaults.

This change allows devices to maintain migration and behavior compatibility
for the 11.0 machine type, while enabling new behavior to be introduced in
later machine versions.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 include/hw/core/boards.h   |  3 +++
 include/hw/i386/pc.h       |  3 +++
 hw/arm/virt.c              |  8 ++++++++
 hw/core/machine.c          |  3 +++
 hw/i386/pc.c               |  3 +++
 hw/i386/pc_piix.c          | 11 ++++++++++-
 hw/i386/pc_q35.c           | 11 ++++++++++-
 hw/m68k/virt.c             |  7 +++++++
 hw/ppc/spapr.c             | 13 ++++++++++++-
 hw/s390x/s390-virtio-ccw.c | 11 +++++++++++
 10 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h
index b8dad0a107..db83fe9292 100644
--- a/include/hw/core/boards.h
+++ b/include/hw/core/boards.h
@@ -798,6 +798,9 @@ struct MachineState {
         } \
     } while (0)
 
+extern GlobalProperty hw_compat_11_0[];
+extern const size_t hw_compat_11_0_len;
+
 extern GlobalProperty hw_compat_10_2[];
 extern const size_t hw_compat_10_2_len;
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 22325324d0..85a74363b5 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -208,6 +208,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size);
 /* sgx.c */
 void pc_machine_init_sgx_epc(PCMachineState *pcms);
 
+extern GlobalProperty pc_compat_11_0[];
+extern const size_t pc_compat_11_0_len;
+
 extern GlobalProperty pc_compat_10_2[];
 extern const size_t pc_compat_10_2_len;
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index ec0d8475ca..4855105f18 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3719,8 +3719,16 @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
+static void virt_machine_11_1_options(MachineClass *mc)
+{
+
+}
+DEFINE_VIRT_MACHINE_AS_LATEST(11, 1)
+
 static void virt_machine_11_0_options(MachineClass *mc)
 {
+     virt_machine_11_1_options(mc);
+     compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
 }
 DEFINE_VIRT_MACHINE_AS_LATEST(11, 0)
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 0aa77a57e9..1abc8ae737 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -38,6 +38,9 @@
 #include "hw/acpi/generic_event_device.h"
 #include "qemu/audio.h"
 
+GlobalProperty hw_compat_11_0[] = {};
+const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
+
 GlobalProperty hw_compat_10_2[] = {
     { "scsi-block", "migrate-pr", "off" },
     { "isa-cirrus-vga", "global-vmstate", "true" },
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 4b53b5be4a..2ecad3c503 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -73,6 +73,9 @@
 #include "hw/xen/xen-bus.h"
 #endif
 
+GlobalProperty pc_compat_11_0[] = {};
+const size_t pc_compat_11_0_len = G_N_ELEMENTS(pc_compat_11_0);
+
 GlobalProperty pc_compat_10_2[] = {};
 const size_t pc_compat_10_2_len = G_N_ELEMENTS(pc_compat_10_2);
 
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 4d71e0d51a..19e9641246 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -428,11 +428,20 @@ static void pc_i440fx_machine_options(MachineClass *m)
                      pc_piix_compat_defaults, pc_piix_compat_defaults_len);
 }
 
-static void pc_i440fx_machine_11_0_options(MachineClass *m)
+static void pc_i440fx_machine_11_1_options(MachineClass *m)
 {
     pc_i440fx_machine_options(m);
 }
 
+DEFINE_I440FX_MACHINE_AS_LATEST(11, 1);
+
+static void pc_i440fx_machine_11_0_options(MachineClass *m)
+{
+    pc_i440fx_machine_11_1_options(m);
+    compat_props_add(m->compat_props, hw_compat_11_0, hw_compat_11_0_len);
+    compat_props_add(m->compat_props, pc_compat_11_0, pc_compat_11_0_len);
+}
+
 DEFINE_I440FX_MACHINE_AS_LATEST(11, 0);
 
 static void pc_i440fx_machine_10_2_options(MachineClass *m)
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index cb23322f5a..72dd3324df 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -364,11 +364,20 @@ static void pc_q35_machine_options(MachineClass *m)
                      pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 }
 
-static void pc_q35_machine_11_0_options(MachineClass *m)
+static void pc_q35_machine_11_1_options(MachineClass *m)
 {
     pc_q35_machine_options(m);
 }
 
+DEFINE_Q35_MACHINE_AS_LATEST(11, 1);
+
+static void pc_q35_machine_11_0_options(MachineClass *m)
+{
+    pc_q35_machine_11_1_options(m);
+    compat_props_add(m->compat_props, hw_compat_11_0, hw_compat_11_0_len);
+    compat_props_add(m->compat_props, pc_compat_11_0, pc_compat_11_0_len);
+}
+
 DEFINE_Q35_MACHINE_AS_LATEST(11, 0);
 
 static void pc_q35_machine_10_2_options(MachineClass *m)
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index ffe6e23415..b056ef603c 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -367,8 +367,15 @@ type_init(virt_machine_register_types)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_IMPL(false, major, minor)
 
+static void virt_machine_11_1_options(MachineClass *mc)
+{
+}
+DEFINE_VIRT_MACHINE_AS_LATEST(11, 1)
+
 static void virt_machine_11_0_options(MachineClass *mc)
 {
+    virt_machine_11_1_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
 }
 DEFINE_VIRT_MACHINE_AS_LATEST(11, 0)
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 0ab39dfea6..5876f97979 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4760,12 +4760,23 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
 #define DEFINE_SPAPR_MACHINE(major, minor) \
     DEFINE_SPAPR_MACHINE_IMPL(false, major, minor)
 
+/*
+ * pseries-11.1
+ */
+static void spapr_machine_11_1_class_options(MachineClass *mc)
+{
+    /* Defaults for the latest behaviour inherited from the base class */
+}
+
+DEFINE_SPAPR_MACHINE_AS_LATEST(11, 1);
+
 /*
  * pseries-11.0
  */
 static void spapr_machine_11_0_class_options(MachineClass *mc)
 {
-    /* Defaults for the latest behaviour inherited from the base class */
+    spapr_machine_11_1_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
 }
 
 DEFINE_SPAPR_MACHINE_AS_LATEST(11, 0);
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 3ef009463d..f5b6051a67 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -906,13 +906,24 @@ static const TypeInfo ccw_machine_info = {
 #define DEFINE_CCW_MACHINE(major, minor) \
     DEFINE_CCW_MACHINE_IMPL(false, major, minor)
 
+static void ccw_machine_11_1_instance_options(MachineState *machine)
+{
+}
+
+static void ccw_machine_11_1_class_options(MachineClass *mc)
+{
+}
+DEFINE_CCW_MACHINE_AS_LATEST(11, 1);
 
 static void ccw_machine_11_0_instance_options(MachineState *machine)
 {
+    ccw_machine_11_1_instance_options(machine);
 }
 
 static void ccw_machine_11_0_class_options(MachineClass *mc)
 {
+    ccw_machine_11_1_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
 }
 DEFINE_CCW_MACHINE_AS_LATEST(11, 0);
 
-- 
2.43.0

[PATCH v5 09/18] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility

[Jamin Lin]

Change internal EHCI descriptor addresses from uint32_t to uint64_t.

The following fields are updated:
- EHCIPacket::qtdaddr
- EHCIQueue::{qhaddr, qtdaddr}
- EHCIState::{a_fetch_addr, p_fetch_addr}

Update get_dwords() and put_dwords() to take 64-bit addresses and
propagate the type change through the descriptor traversal paths.

Adjust NLPTR_GET() to operate on 64-bit values:

    #define NLPTR_GET(x) ((x) & ~0x1fULL)

so that link pointer masking works correctly when descriptor
addresses exceed 32-bit space. The previous mask (0xffffffe0)
implicitly truncated addresses to 32 bits.

This patch does not change the on-wire descriptor layout yet.
It only removes the internal 32-bit address limit and prepares
for later patches that will add full 64-bit QH/qTD/iTD/siTD support.

Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
use uint64_t for the address argument and print it with PRIx64. This
ensures full 64-bit addresses are shown in trace output and improves
debugging of queue heads and transfer descriptors.

Migration compatibility:

To preserve backward migration compatibility, keep the legacy 32-bit
fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
new 64-bit fields.

Migration format is selected using a machine compat property
"x-migrate-fetch-addr-64bit":

- Old machine types migrate 32-bit fetch addresses
- New machine types migrate full 64-bit fetch addresses

This is implemented using VMSTATE_UINT32_TEST() and
VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.

In pre_save, the 32-bit shadow fields are populated when migrating
to old machine types. In post_load, the 32-bit values are restored
into the 64-bit fields when loading old migration streams.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/usb/hcd-ehci.h   | 17 +++++++----
 hw/core/machine.c   |  5 +++-
 hw/usb/hcd-ehci.c   | 72 ++++++++++++++++++++++++++++++++-------------
 hw/usb/trace-events | 24 +++++++--------
 4 files changed, 78 insertions(+), 40 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index d038ee1e31..3acbddfc5c 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -208,7 +208,7 @@ struct EHCIPacket {
     QTAILQ_ENTRY(EHCIPacket) next;
 
     EHCIqtd qtd;           /* copy of current QTD (being worked on) */
-    uint32_t qtdaddr;      /* address QTD read from                 */
+    uint64_t qtdaddr;      /* address QTD read from                 */
 
     USBPacket packet;
     QEMUSGList sgl;
@@ -229,8 +229,8 @@ struct EHCIQueue {
      * when guest removes an entry (doorbell, handshake sequence)
      */
     EHCIqh qh;             /* copy of current QH (being worked on) */
-    uint32_t qhaddr;       /* address QH read from                 */
-    uint32_t qtdaddr;      /* address QTD read from                */
+    uint64_t qhaddr;       /* address QH read from                 */
+    uint64_t qtdaddr;      /* address QTD read from                */
     int last_pid;          /* pid of last packet executed          */
     USBDevice *dev;
     QTAILQ_HEAD(, EHCIPacket) packets;
@@ -256,6 +256,7 @@ struct EHCIState {
 
     /* properties */
     uint32_t maxframes;
+    bool migrate_fetch_addr_64bit;
 
     /*
      *  EHCI spec version 1.0 Section 2.3
@@ -294,8 +295,10 @@ struct EHCIState {
     EHCIQueueHead pqueues;
 
     /* which address to look at next */
-    uint32_t a_fetch_addr;
-    uint32_t p_fetch_addr;
+    uint32_t a_fetch_addr_32;
+    uint32_t p_fetch_addr_32;
+    uint64_t a_fetch_addr;
+    uint64_t p_fetch_addr;
 
     USBPacket ipacket;
     QEMUSGList isgl;
@@ -308,7 +311,9 @@ struct EHCIState {
 };
 
 #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
-    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
+    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
+    DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
+                     ehci.migrate_fetch_addr_64bit, true)
 
 extern const VMStateDescription vmstate_ehci;
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 1abc8ae737..b0c1580b16 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -38,7 +38,10 @@
 #include "hw/acpi/generic_event_device.h"
 #include "qemu/audio.h"
 
-GlobalProperty hw_compat_11_0[] = {};
+GlobalProperty hw_compat_11_0[] = {
+    { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
+    { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
+};
 const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
 
 GlobalProperty hw_compat_10_2[] = {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 28a60e4c1a..0c8bdb48ad 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -72,7 +72,7 @@ typedef enum {
 } EHCI_STATES;
 
 /* macros for accessing fields within next link pointer entry */
-#define NLPTR_GET(x)             ((x) & 0xffffffe0)
+#define NLPTR_GET(x)             ((x) & ~0x1fULL)
 #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
 #define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
 
@@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
     return async ? s->astate : s->pstate;
 }
 
-static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
+static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
 {
     if (async) {
         s->a_fetch_addr = addr;
@@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
     }
 }
 
-static int ehci_get_fetch_addr(EHCIState *s, int async)
+static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
 {
     return async ? s->a_fetch_addr : s->p_fetch_addr;
 }
@@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState *s)
 }
 
 /* Get an array of dwords from main memory */
-static inline int get_dwords(EHCIState *ehci, uint32_t addr,
+static inline int get_dwords(EHCIState *ehci, uint64_t addr,
                              uint32_t *buf, int num)
 {
     int i;
@@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t addr,
 }
 
 /* Put an array of dwords in to main memory */
-static inline int put_dwords(EHCIState *ehci, uint32_t addr,
+static inline int put_dwords(EHCIState *ehci, uint64_t addr,
                              uint32_t *buf, int num)
 {
     int i;
@@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
 
 /* queue management */
 
-static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
+static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
 {
     EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
     EHCIQueue *q;
@@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const char *warn)
     g_free(q);
 }
 
-static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
                                         int async)
 {
     EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
@@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
 {
     uint32_t *qh = (uint32_t *) &q->qh;
     uint32_t dwords = sizeof(EHCIqh) >> 2;
-    uint32_t addr = NLPTR_GET(q->qhaddr);
+    uint64_t addr = NLPTR_GET(q->qhaddr);
 
     put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
 }
@@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const char *action)
 /* 4.7.2 */
 static int ehci_process_itd(EHCIState *ehci,
                             EHCIitd *itd,
-                            uint32_t addr)
+                            uint64_t addr)
 {
     USBDevice *dev;
     USBEndpoint *ep;
     uint32_t i, len, pid, dir, devaddr, endp;
-    uint32_t pg, off, ptr1, ptr2, max, mult;
+    uint32_t pg, off, max, mult;
+    uint64_t ptr1, ptr2;
 
     ehci->periodic_sched_active = PERIODIC_ACTIVE;
 
@@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     EHCIqh qh;
     int i = 0;
     int again = 0;
-    uint32_t entry = ehci->asynclistaddr;
+    uint64_t entry = ehci->asynclistaddr;
 
     /* set reclamation flag at start event (4.8.6) */
     if (async) {
@@ -1578,7 +1579,7 @@ out:
 static int ehci_state_fetchentry(EHCIState *ehci, int async)
 {
     int again = 0;
-    uint32_t entry = ehci_get_fetch_addr(ehci, async);
+    uint64_t entry = ehci_get_fetch_addr(ehci, async);
 
     if (NLPTR_TBIT(entry)) {
         ehci_set_state(ehci, async, EST_ACTIVE);
@@ -1611,7 +1612,7 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
     default:
         /* TODO: handle FSTN type */
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "FETCHENTRY: entry at 0x%x is of type %u "
+                      "FETCHENTRY: entry at %" PRIx64 "is of type %" PRIu64
                       "which is not supported yet\n",
                       entry, NLPTR_TYPE_GET(entry));
         return -1;
@@ -1623,7 +1624,7 @@ out:
 
 static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIQueue *q;
     EHCIqh qh;
 
@@ -1712,7 +1713,7 @@ out:
 
 static int ehci_state_fetchitd(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIitd itd;
 
     assert(!async);
@@ -1738,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
 
 static int ehci_state_fetchsitd(EHCIState *ehci, int async)
 {
-    uint32_t entry;
+    uint64_t entry;
     EHCIsitd sitd;
 
     assert(!async);
@@ -1802,7 +1803,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
     EHCIqtd qtd;
     EHCIPacket *p;
     int again = 1;
-    uint32_t addr;
+    uint64_t addr;
 
     addr = NLPTR_GET(q->qtdaddr);
     if (get_dwords(q->ehci, addr +  8, &qtd.token,   1) < 0) {
@@ -1885,7 +1886,7 @@ static int ehci_fill_queue(EHCIPacket *p)
     USBEndpoint *ep = p->packet.ep;
     EHCIQueue *q = p->queue;
     EHCIqtd qtd = p->qtd;
-    uint32_t qtdaddr;
+    uint64_t qtdaddr;
 
     for (;;) {
         if (NLPTR_TBIT(qtd.next) != 0) {
@@ -2008,7 +2009,8 @@ static int ehci_state_executing(EHCIQueue *q)
 static int ehci_state_writeback(EHCIQueue *q)
 {
     EHCIPacket *p = QTAILQ_FIRST(&q->packets);
-    uint32_t *qtd, addr;
+    uint32_t *qtd;
+    uint64_t addr;
     int again = 0;
 
     /*  Write back the QTD from the QH area */
@@ -2414,6 +2416,18 @@ static USBBusOps ehci_bus_ops_standalone = {
     .wakeup_endpoint = ehci_wakeup_endpoint,
 };
 
+static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
+{
+    EHCIState *s = opaque;
+
+    return s->migrate_fetch_addr_64bit;
+}
+
+static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
+{
+    return !ehci_fetch_addr_64_needed(opaque, version_id);
+}
+
 static int usb_ehci_pre_save(void *opaque)
 {
     EHCIState *ehci = opaque;
@@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
     ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
     ehci->frindex = new_frindex;
 
+    if (!ehci->migrate_fetch_addr_64bit) {
+        ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
+        ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
+    }
+
     return 0;
 }
 
@@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
         }
     }
 
+    if (!s->migrate_fetch_addr_64bit) {
+        s->a_fetch_addr = s->a_fetch_addr_32;
+        s->p_fetch_addr = s->p_fetch_addr_32;
+    }
+
     return 0;
 }
 
@@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
         /* schedule state */
         VMSTATE_UINT32(astate, EHCIState),
         VMSTATE_UINT32(pstate, EHCIState),
-        VMSTATE_UINT32(a_fetch_addr, EHCIState),
-        VMSTATE_UINT32(p_fetch_addr, EHCIState),
+        VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
+                            ehci_fetch_addr_32_needed),
+        VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
+                            ehci_fetch_addr_32_needed),
+        VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
+                            ehci_fetch_addr_64_needed),
+        VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
+                            ehci_fetch_addr_64_needed),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 0d4318dcf1..8c90688bb3 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio 0x%04
 usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
 usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
 usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
-usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
-usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
-usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
+usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
+usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
+usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%" PRIx64 " - c %d, h %d, dtc %d, i %d"
 usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
-usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
-usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
-usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
-usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
-usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x: next 0x%08x - active %d"
+usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
+usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
+usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr %d"
+usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
+usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%" PRIx64 ": next 0x%08x - active %d"
 usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
 usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
 usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
@@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
 usb_ehci_port_disable(uint32_t port) "port #%d"
 usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
 usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
-usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
+usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ", next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
 usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
 usb_ehci_guest_bug(const char *reason) "%s"
 usb_ehci_doorbell_ring(void) ""
 usb_ehci_doorbell_ack(void) ""
 usb_ehci_dma_error(void) ""
-usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
-usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
-usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
+usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
+usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
+usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
 usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
 usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
 usb_ehci_log(const char *msg) "%s"
-- 
2.43.0

[PATCH v5 10/18] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability

[Jamin Lin]

Introduce a new boolean property, "caps-64bit-addr", to control
HCCPARAMS[0] (64-bit Addressing Capability).

When enabled, the EHCI controller advertises support for 64-bit
address memory pointers as defined in the EHCI specification
(Table 2-7, HCCPARAMS). This allows software to use the 64-bit
data structure formats described in Appendix B.

When disabled (default), the controller reports 32-bit addressing
capability and uses the standard 32-bit data structures.

The EHCI CTRLDSSEGMENT register provides the upper 32 bits [63:32] used to
form 64-bit addresses for EHCI control data structures. Per EHCI 1.0
spec section 2.3.5, when the HCCPARAMS 64-bit Addressing Capability bit
is zero, CTRLDSSEGMENT is not used: software cannot write it and reads
must return zero.

Add a capability check in the operational register write handler and
reject guest writes to CTRLDSSEGMENT when 64-bit addressing is
not enabled.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h |  5 ++++-
 hw/usb/hcd-ehci.c | 14 +++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3acbddfc5c..f1f2fde578 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -257,6 +257,7 @@ struct EHCIState {
     /* properties */
     uint32_t maxframes;
     bool migrate_fetch_addr_64bit;
+    bool caps_64bit_addr;
 
     /*
      *  EHCI spec version 1.0 Section 2.3
@@ -313,7 +314,9 @@ struct EHCIState {
 #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
     DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
     DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
-                     ehci.migrate_fetch_addr_64bit, true)
+                     ehci.migrate_fetch_addr_64bit, true), \
+    DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
+                     ehci.caps_64bit_addr, false)
 
 extern const VMStateDescription vmstate_ehci;
 
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 0c8bdb48ad..b23ff92e12 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1109,6 +1109,15 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
         }
         break;
 
+    case CTRLDSSEGMENT:
+        if (!s->caps_64bit_addr) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "ehci: write to CTRLDSSEGMENT while "
+                          "      64-bit addressing capability is disabled\n");
+            return;
+        }
+        break;
+
     case ASYNCLISTADDR:
         if (ehci_async_enabled(s)) {
             qemu_log_mask(LOG_GUEST_ERROR,
@@ -2554,6 +2563,9 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
                    s->maxframes);
         return;
     }
+    if (s->caps_64bit_addr) {
+        s->caps[0x08] |= BIT(0);
+    }
 
     memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
     memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
@@ -2613,7 +2625,7 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
     s->caps[0x05] = 0x00;        /* No companion ports at present */
     s->caps[0x06] = 0x00;
     s->caps[0x07] = 0x00;
-    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
+    s->caps[0x08] = 0x80;        /* We can cache whole frame */
     s->caps[0x0a] = 0x00;
     s->caps[0x0b] = 0x00;
 
-- 
2.43.0

[PATCH v5 11/18] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register supplies the upper 32 bits which are
concatenated with 32-bit link pointer fields to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

The current implementation assumes 32-bit QH descriptor addresses
and directly uses link pointer values without applying the
CTRLDSSEGMENT upper dword.

Introduce a helper, ehci_get_desc_addr(), to construct full 64-bit
descriptor addresses when 64-bit capability is enabled. Update QH
traversal paths (async list walk, horizontal QH link, and periodic
schedule entry handling) to use the translated 64-bit addresses.

EHCI 64-bit buffer pointer fields are defined in Appendix B as
split 32-bit low/high parts located at separate offsets, rather
than a single contiguous 64-bit field. Therefore, the buffer
pointers cannot be represented as uint64_t bufptr[5] without
violating the descriptor layout defined by the specification.

Introduce ehci_get_buf_addr() to construct full 64-bit buffer
addresses from bufptr[] and bufptr_hi[] fields. Use this helper
when calculating transfer buffer addresses so that data buffers
above 4GB are correctly handled.

Also add bufptr_hi[5] to EHCIqh to support 64-bit buffer pointer
fields as defined in Appendix B.

When 64-bit capability is disabled, descriptor addresses remain
32-bit and existing behaviour is unchanged.

Note: Similar split 64-bit buffer pointer handling is required for
qTD, iTD and siTD descriptors, which will be addressed in follow-up
changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h   |  4 ++++
 hw/usb/hcd-ehci.c   | 47 ++++++++++++++++++++++++++++++++++-----------
 hw/usb/trace-events |  2 +-
 3 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index f1f2fde578..3428839ec6 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -141,6 +141,9 @@ typedef struct EHCIqtd {
 #define QTD_BUFPTR_SH                 12
 } EHCIqtd;
 
+/* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
+#define EHCI_QH_OVERLAY_COUNT 12
+
 /*
  * EHCI spec version 1.0 Section 3.6
  */
@@ -194,6 +197,7 @@ typedef struct EHCIqh {
 #define BUFPTR_FRAMETAG_MASK          0x0000001f
 #define BUFPTR_SBYTES_MASK            0x00000fe0
 #define BUFPTR_SBYTES_SH              5
+    uint32_t bufptr_hi[5];
 } EHCIqh;
 
 enum async_state {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index b23ff92e12..5ffd4c9885 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -147,6 +147,23 @@ static const char *addr2str(hwaddr addr)
     return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
 }
 
+static uint64_t ehci_get_buf_addr(const EHCIState *s, uint32_t hi,
+                                  uint32_t lo, uint32_t lo_mask)
+{
+    uint64_t addr = lo & lo_mask;
+
+    if (s->caps_64bit_addr) {
+        addr = deposit64(addr, 32, 32, hi);
+    }
+
+    return addr;
+}
+
+static uint64_t ehci_get_desc_addr(const EHCIState *s, uint32_t lo)
+{
+    return ehci_get_buf_addr(s, s->ctrldssegment, lo, UINT32_MAX);
+}
+
 static void ehci_trace_usbsts(uint32_t mask, int state)
 {
     /* interrupts */
@@ -440,7 +457,7 @@ static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
         (qh->current_qtd != q->qh.current_qtd) ||
         (q->async && qh->next_qtd != q->qh.next_qtd) ||
         (memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
-                                 7 * sizeof(uint32_t)) != 0) ||
+                EHCI_QH_OVERLAY_COUNT * sizeof(uint32_t)) != 0) ||
         (q->dev != NULL && q->dev->addr != devaddr)) {
         return false;
     } else {
@@ -1538,7 +1555,9 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
     EHCIqh qh;
     int i = 0;
     int again = 0;
-    uint64_t entry = ehci->asynclistaddr;
+    uint64_t entry = 0;
+
+    entry = ehci_get_desc_addr(ehci, ehci->asynclistaddr);
 
     /* set reclamation flag at start event (4.8.6) */
     if (async) {
@@ -1566,8 +1585,8 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
             goto out;
         }
 
-        entry = qh.next;
-        if (entry == ehci->asynclistaddr) {
+        entry = ehci_get_desc_addr(ehci, qh.next);
+        if (entry == ehci_get_desc_addr(ehci, ehci->asynclistaddr)) {
             break;
         }
     }
@@ -1693,7 +1712,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
     }
 
     if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
-        if (q->qhaddr != q->qh.next) {
+        if (q->qhaddr != ehci_get_desc_addr(ehci, q->qh.next)) {
             trace_usb_ehci_fetchqh_dbg(q->qhaddr,
                                        q->qh.epchar & QH_EPCHAR_H,
                                        q->qh.token & QTD_TOKEN_HALT,
@@ -1876,10 +1895,12 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
 
 static int ehci_state_horizqh(EHCIQueue *q)
 {
+    uint64_t addr;
     int again = 0;
 
-    if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
-        ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
+    addr = ehci_get_desc_addr(q->ehci, q->qh.next);
+    if (ehci_get_fetch_addr(q->ehci, q->async) != addr) {
+        ehci_set_fetch_addr(q->ehci, q->async, addr);
         ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
         again = 1;
     } else {
@@ -2205,6 +2226,8 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
     uint32_t entry;
     uint32_t list;
     const int async = 0;
+    uint64_t entry64;
+    uint64_t list64;
 
     /* 4.6 */
 
@@ -2229,12 +2252,14 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
             break;
         }
         list |= ((ehci->frindex & 0x1ff8) >> 1);
-
-        if (get_dwords(ehci, list, &entry, 1) < 0) {
+        list64 = ehci_get_desc_addr(ehci, list);
+        if (get_dwords(ehci, list64, &entry, 1) < 0) {
             break;
         }
-        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry);
-        ehci_set_fetch_addr(ehci, async, entry);
+        entry64 = ehci_get_desc_addr(ehci, entry);
+        trace_usb_ehci_periodic_state_advance(ehci->frindex / 8,
+                                              list64, entry64);
+        ehci_set_fetch_addr(ehci, async, entry64);
         ehci_set_state(ehci, async, EST_FETCHENTRY);
         ehci_advance_state(ehci, async);
         ehci_queues_rip_unused(ehci, async);
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 8c90688bb3..67249d69c2 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -113,7 +113,7 @@ usb_ehci_dma_error(void) ""
 usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
 usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
 usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
-usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
+usb_ehci_periodic_state_advance(uint32_t frame, uint64_t list, uint64_t entry) "frame=%d, list=0x%" PRIx64 ", entry=0x%" PRIx64
 usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
 usb_ehci_log(const char *msg) "%s"
 
-- 
2.43.0

[PATCH v5 12/18] hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit addressing when the 64-bit Addressing Capability
bit in HCCPARAMS is set. In that mode, the CTRLDSSEGMENT register
provides the upper 32 bits that are concatenated with 32-bit link
pointer values to form 64-bit control data structure addresses
(EHCI 1.0, section 2.3.5 and Appendix B).

qTD link pointers (current_qtd/next_qtd/altnext_qtd and qTD.next)
are stored as 32-bit values in the data structures and must be
expanded to full 64-bit descriptor addresses when 64-bit mode is
enabled. Update the qTD traversal paths to use ehci_get_desc_addr()
when following link pointers.

Appendix B also defines high dword fields for qTD buffer pointers.
Add bufptr_hi[5] to EHCIqtd and extend qTD fetch and QH overlay
handling to load and propagate the high buffer pointer fields.

When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h |  1 +
 hw/usb/hcd-ehci.c | 19 ++++++++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3428839ec6..fc66aacd9f 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -139,6 +139,7 @@ typedef struct EHCIqtd {
     uint32_t bufptr[5];               /* Standard buffer pointer */
 #define QTD_BUFPTR_MASK               0xfffff000
 #define QTD_BUFPTR_SH                 12
+    uint32_t bufptr_hi[5];
 } EHCIqtd;
 
 /* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 5ffd4c9885..e82e0f625c 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -472,7 +472,8 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
             (p->qtd.next != qtd->next)) ||
         (!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
         p->qtd.token != qtd->token ||
-        p->qtd.bufptr[0] != qtd->bufptr[0]) {
+        p->qtd.bufptr[0] != qtd->bufptr[0] ||
+        p->qtd.bufptr_hi[0] != qtd->bufptr_hi[0]) {
         return false;
     } else {
         return true;
@@ -1200,6 +1201,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
 
     for (i = 0; i < 5; i++) {
         q->qh.bufptr[i] = p->qtd.bufptr[i];
+        q->qh.bufptr_hi[i] = p->qtd.bufptr_hi[i];
     }
 
     if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
@@ -1233,7 +1235,8 @@ static int ehci_init_transfer(EHCIPacket *p)
             return -1;
         }
 
-        page  = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
+        page = ehci_get_buf_addr(p->queue->ehci, p->qtd.bufptr_hi[cpage],
+                                 p->qtd.bufptr[cpage], QTD_BUFPTR_MASK);
         page += offset;
         plen  = bytes;
         if (plen > 4096 - offset) {
@@ -1727,7 +1730,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
     } else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
                (NLPTR_TBIT(q->qh.current_qtd) == 0) &&
                (q->qh.current_qtd != 0)) {
-        q->qtdaddr = q->qh.current_qtd;
+        q->qtdaddr = ehci_get_desc_addr(ehci, q->qh.current_qtd);
         ehci_set_state(ehci, async, EST_FETCHQTD);
 
     } else {
@@ -1805,14 +1808,14 @@ static int ehci_state_advqueue(EHCIQueue *q)
      */
     if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
         (NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
-        q->qtdaddr = q->qh.altnext_qtd;
+        q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.altnext_qtd);
         ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
 
     /*
      *  next qTD is valid
      */
     } else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
-        q->qtdaddr = q->qh.next_qtd;
+        q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.next_qtd);
         ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
 
     /*
@@ -1841,7 +1844,9 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
     if (get_dwords(q->ehci, addr +  0, &qtd.next,    1) < 0 ||
         get_dwords(q->ehci, addr +  4, &qtd.altnext, 1) < 0 ||
         get_dwords(q->ehci, addr + 12, qtd.bufptr,
-                   ARRAY_SIZE(qtd.bufptr)) < 0) {
+                   ARRAY_SIZE(qtd.bufptr)) < 0 ||
+        get_dwords(q->ehci, addr + 32, qtd.bufptr_hi,
+                   ARRAY_SIZE(qtd.bufptr_hi)) < 0) {
         return 0;
     }
     ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
@@ -1922,7 +1927,7 @@ static int ehci_fill_queue(EHCIPacket *p)
         if (NLPTR_TBIT(qtd.next) != 0) {
             break;
         }
-        qtdaddr = qtd.next;
+        qtdaddr = ehci_get_desc_addr(q->ehci, qtd.next);
         /*
          * Detect circular td lists, Windows creates these, counting on the
          * active bit going low after execution to make the queue stop.
-- 
2.43.0

[PATCH v5 13/18] hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

iTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the iTD traversal path to use ehci_get_desc_addr() when
following link pointers.

Appendix B also defines high dword fields for iTD buffer pointers.
Add bufptr_hi[7] to EHCIitd and use ehci_get_buf_addr() to construct
full 64-bit buffer addresses from bufptr[] and bufptr_hi[] fields
when processing isochronous transfers. This allows buffers above
4GB to be handled correctly.

When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.h | 1 +
 hw/usb/hcd-ehci.c | 9 ++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index fc66aacd9f..8e6a8cdfb0 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -63,6 +63,7 @@ typedef struct EHCIitd {
 #define ITD_BUFPTR_MAXPKT_SH     0
 #define ITD_BUFPTR_MULT_MASK     0x00000003
 #define ITD_BUFPTR_MULT_SH       0
+    uint32_t bufptr_hi[7];
 } EHCIitd;
 
 /*
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index e82e0f625c..43a01a796f 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1464,7 +1464,8 @@ static int ehci_process_itd(EHCIState *ehci,
                 return -1;
             }
 
-            ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
+            ptr1 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg],
+                                     itd->bufptr[pg], ITD_BUFPTR_MASK);
             qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
             if (off + len > 4096) {
                 /* transfer crosses page border */
@@ -1472,7 +1473,9 @@ static int ehci_process_itd(EHCIState *ehci,
                     qemu_sglist_destroy(&ehci->isgl);
                     return -1;  /* avoid page pg + 1 */
                 }
-                ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
+                ptr2 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg + 1],
+                                         itd->bufptr[pg + 1],
+                                         ITD_BUFPTR_MASK);
                 uint32_t len2 = off + len - 4096;
                 uint32_t len1 = len - len2;
                 qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
@@ -1762,7 +1765,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
 
     put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
                sizeof(EHCIitd) >> 2);
-    ehci_set_fetch_addr(ehci, async, itd.next);
+    ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, itd.next));
     ehci_set_state(ehci, async, EST_FETCHENTRY);
 
     return 1;
-- 
2.43.0

[PATCH v5 14/18] hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing

[Jamin Lin]

EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).

siTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the siTD traversal path to use ehci_get_desc_addr() when
following link pointers.

When 64-bit capability is disabled, descriptor addresses remain
32-bit and existing behaviour is unchanged.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/hcd-ehci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 43a01a796f..dfeb8ef70f 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1792,7 +1792,7 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
         warn_report("Skipping active siTD");
     }
 
-    ehci_set_fetch_addr(ehci, async, sitd.next);
+    ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, sitd.next));
     ehci_set_state(ehci, async, EST_FETCHENTRY);
     return 1;
 }
-- 
2.43.0

[PATCH v5 15/18] hw/usb/hcd-ehci: Add ctrldssegment-default property

[Jamin Lin]

When 64-bit addressing is supported, the Linux EHCI driver programs the
segment register to zero. See ehci_run function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c

The driver comment also notes that descriptor structures allocated from
the DMA pool use segment zero semantics.

Descriptor memory is allocated using the DMA API. The platform driver
configures a 64-bit DMA mask so memory can be allocated above 4GB.
See ehci_platform_probe function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-platform.c

On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
As a result, descriptor addresses constructed directly from the guest
EHCI registers do not match the actual system address used by the
controller when fetching queue heads (QH) and queue element transfer
descriptors (qTD).

Add a ctrldssegment-default property so platforms can provide a
descriptor address offset when constructing descriptor addresses.
This allows systems where DRAM resides above 4GB to access EHCI
descriptors correctly.

The default value is zero, so existing machines are not affected.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/usb/hcd-ehci.h | 5 ++++-
 hw/usb/hcd-ehci.c | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 8e6a8cdfb0..3d57e1de5f 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -264,6 +264,7 @@ struct EHCIState {
     uint32_t maxframes;
     bool migrate_fetch_addr_64bit;
     bool caps_64bit_addr;
+    uint32_t ctrldssegment_default;
 
     /*
      *  EHCI spec version 1.0 Section 2.3
@@ -322,7 +323,9 @@ struct EHCIState {
     DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
                      ehci.migrate_fetch_addr_64bit, true), \
     DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
-                     ehci.caps_64bit_addr, false)
+                     ehci.caps_64bit_addr, false), \
+    DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
+                       ehci.ctrldssegment_default, 0)
 
 extern const VMStateDescription vmstate_ehci;
 
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index dfeb8ef70f..e8086f0432 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1134,6 +1134,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
                           "      64-bit addressing capability is disabled\n");
             return;
         }
+        val |= s->ctrldssegment_default;
         break;
 
     case ASYNCLISTADDR:
-- 
2.43.0

[PATCH v5 16/18] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default

[Jamin Lin]

On AST2700 platforms, system DRAM is mapped above 4GB with a base
address at 0x400000000.

The Linux EHCI driver programs the segment register to zero when
64-bit addressing is supported. As a result, descriptor addresses
derived from the EHCI registers do not include the DRAM base
address.

Descriptor memory is allocated through the DMA API with a 64-bit
DMA mask, allowing descriptors to reside in DRAM above 4GB. On
AST2700, EHCI queue heads (QH) and queue element transfer
descriptors (qTD) are therefore placed at addresses starting from
0x400000000.

Set the ctrldssegment-default property to 0x4 so the upper
32 bits of descriptor addresses are adjusted accordingly. This
allows the emulated EHCI controller to construct correct system
addresses when accessing descriptors in DRAM above 4GB.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 87dcb82e1b..0cb39dc191 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -856,6 +856,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
 
     /* EHCI */
     for (i = 0; i < sc->ehcis_num; i++) {
+        object_property_set_int(OBJECT(&s->ehci[i]), "ctrldssegment-default",
+                                0x4, &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-- 
2.43.0

[PATCH v5 17/18] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing

[Jamin Lin]

AST2700 supports a 64-bit DRAM address space. Therefore, DMA
transactions must be capable of accessing 64-bit addresses.

Enable the "caps-64bit-addr" property for the EHCI controllers
on AST2700 so that USB DMA operations can correctly handle
64-bit memory addresses.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/arm/aspeed_ast27x0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 0cb39dc191..4959cc9e43 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -858,6 +858,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < sc->ehcis_num; i++) {
         object_property_set_int(OBJECT(&s->ehci[i]), "ctrldssegment-default",
                                 0x4, &error_abort);
+        object_property_set_bool(OBJECT(&s->ehci[i]), "caps-64bit-addr", true,
+                                 &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-- 
2.43.0

[PATCH v5 18/18] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2

[Jamin Lin]

Add a functional test to verify USB EHCI support on the AST2700 A2/A1
by attaching a USB keyboard device and checking its
enumeration via lsusb.

This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700a1.py | 7 +++++++
 tests/functional/aarch64/test_aspeed_ast2700a2.py | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700a1.py b/tests/functional/aarch64/test_aspeed_ast2700a1.py
index b0c08854da..42b8b200cf 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a1.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a1.py
@@ -118,6 +118,11 @@ def do_ast2700_pcie_test(self):
             'ip addr show dev eth2',
             'inet 10.0.2.15/24')
 
+    def do_ast2700_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def start_ast2700_test(self, name, bus_id):
         num_cpu = 4
         load_images_list = [
@@ -161,10 +166,12 @@ def test_aarch64_ast2700a1_evb_sdk_v11_01(self):
         self.archive_extract(self.ASSET_SDK_V1101_AST2700A1)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
         self.start_ast2700_test('ast2700-a1-image', 1)
         self.verify_openbmc_boot_and_login('ast2700-a1')
         self.do_ast2700_i2c_test(1)
         self.do_ast2700_pcie_test()
+        self.do_ast2700_usb_ehci_test()
 
     def test_aarch64_ast2700a1_evb_sdk_vbootrom_v11_01(self):
         self.set_machine('ast2700a1-evb')
diff --git a/tests/functional/aarch64/test_aspeed_ast2700a2.py b/tests/functional/aarch64/test_aspeed_ast2700a2.py
index ed414999f4..40e0ad81ed 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a2.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a2.py
@@ -121,6 +121,11 @@ def do_ast2700_pcie_test(self):
             'ip addr show dev eth2',
             'inet 10.0.2.15/24')
 
+    def do_ast2700_usb_ehci_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lsusb',
+            'QEMU QEMU USB Keyboard')
+
     def start_ast2700_test(self, name, bus_id):
         num_cpu = 4
         load_images_list = [
@@ -164,10 +169,12 @@ def test_aarch64_ast2700a2_evb_sdk_v11_01(self):
         self.archive_extract(self.ASSET_SDK_V1101_AST2700A2)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
+        self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
         self.start_ast2700_test('ast2700-default-image', 1)
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test(1)
         self.do_ast2700_pcie_test()
+        self.do_ast2700_usb_ehci_test()
 
     def test_aarch64_ast2700a2_evb_sdk_vbootrom_v11_01(self):
         self.set_machine('ast2700a2-evb')
-- 
2.43.0

Re: [PATCH v5 09/18] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility

[Peter Xu]

On Fri, Apr 24, 2026 at 08:05:21AM +0000, Jamin Lin wrote:
>  hw/usb/hcd-ehci.h   | 17 +++++++----
>  hw/core/machine.c   |  5 +++-
>  hw/usb/hcd-ehci.c   | 72 ++++++++++++++++++++++++++++++++-------------
>  hw/usb/trace-events | 24 +++++++--------
>  4 files changed, 78 insertions(+), 40 deletions(-)

I skimmed the migration relevant bits, it looks all fine now, thanks.

-- 
Peter Xu

Re: [PATCH v5 07/18] hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci

[Philippe Mathieu-Daudé]

On 24/4/26 10:05, Jamin Lin wrote:
> EHCI properties are currently defined separately in both sysbus and
> PCI implementations, leading to duplicated code for common fields
> such as "maxframes".
> 
> Introduce DEFINE_EHCI_COMMON_PROPERTIES() to consolidate shared
> property definitions and reuse them across both EHCISysBusState
> and EHCIPCIState.
> 
> This reduces code duplication and keeps property definitions
> consistent between different EHCI device variants.
> 
> No functional change.
> 
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
>   hw/usb/hcd-ehci.h        | 3 +++
>   hw/usb/hcd-ehci-pci.c    | 2 +-
>   hw/usb/hcd-ehci-sysbus.c | 2 +-
>   3 files changed, 5 insertions(+), 2 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Re: [PATCH v5 10/18] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability

[Cédric Le Goater]

On 4/24/26 10:05, Jamin Lin wrote:
> Introduce a new boolean property, "caps-64bit-addr", to control
> HCCPARAMS[0] (64-bit Addressing Capability).
> 
> When enabled, the EHCI controller advertises support for 64-bit
> address memory pointers as defined in the EHCI specification
> (Table 2-7, HCCPARAMS). This allows software to use the 64-bit
> data structure formats described in Appendix B.
> 
> When disabled (default), the controller reports 32-bit addressing
> capability and uses the standard 32-bit data structures.
> 
> The EHCI CTRLDSSEGMENT register provides the upper 32 bits [63:32] used to
> form 64-bit addresses for EHCI control data structures. Per EHCI 1.0
> spec section 2.3.5, when the HCCPARAMS 64-bit Addressing Capability bit
> is zero, CTRLDSSEGMENT is not used: software cannot write it and reads
> must return zero.
> 
> Add a capability check in the operational register write handler and
> reject guest writes to CTRLDSSEGMENT when 64-bit addressing is
> not enabled.
> 
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---
>   hw/usb/hcd-ehci.h |  5 ++++-
>   hw/usb/hcd-ehci.c | 14 +++++++++++++-
>   2 files changed, 17 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
> index 3acbddfc5c..f1f2fde578 100644
> --- a/hw/usb/hcd-ehci.h
> +++ b/hw/usb/hcd-ehci.h
> @@ -257,6 +257,7 @@ struct EHCIState {
>       /* properties */
>       uint32_t maxframes;
>       bool migrate_fetch_addr_64bit;
> +    bool caps_64bit_addr;
>   
>       /*
>        *  EHCI spec version 1.0 Section 2.3
> @@ -313,7 +314,9 @@ struct EHCIState {
>   #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
>       DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
>       DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> -                     ehci.migrate_fetch_addr_64bit, true)
> +                     ehci.migrate_fetch_addr_64bit, true), \
> +    DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
> +                     ehci.caps_64bit_addr, false)
>   
>   extern const VMStateDescription vmstate_ehci;
>   
> diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
> index 0c8bdb48ad..b23ff92e12 100644
> --- a/hw/usb/hcd-ehci.c
> +++ b/hw/usb/hcd-ehci.c
> @@ -1109,6 +1109,15 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
>           }
>           break;
>   
> +    case CTRLDSSEGMENT:
> +        if (!s->caps_64bit_addr) {
> +            qemu_log_mask(LOG_GUEST_ERROR,
> +                          "ehci: write to CTRLDSSEGMENT while "
> +                          "      64-bit addressing capability is disabled\n");

Please remove the extra spaces at the beginning of line.

Thanks,

C.



> +            return;
> +        }
> +        break;
> +
>       case ASYNCLISTADDR:
>           if (ehci_async_enabled(s)) {
>               qemu_log_mask(LOG_GUEST_ERROR,
> @@ -2554,6 +2563,9 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
>                      s->maxframes);
>           return;
>       }
> +    if (s->caps_64bit_addr) {
> +        s->caps[0x08] |= BIT(0);
> +    }
>   
>       memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
>       memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
> @@ -2613,7 +2625,7 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
>       s->caps[0x05] = 0x00;        /* No companion ports at present */
>       s->caps[0x06] = 0x00;
>       s->caps[0x07] = 0x00;
> -    s->caps[0x08] = 0x80;        /* We can cache whole frame, no 64-bit */
> +    s->caps[0x08] = 0x80;        /* We can cache whole frame */
>       s->caps[0x0a] = 0x00;
>       s->caps[0x0b] = 0x00;
>   

Re: [PATCH v5 16/18] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default

[Cédric Le Goater]

On 4/24/26 10:05, Jamin Lin wrote:
> On AST2700 platforms, system DRAM is mapped above 4GB with a base
> address at 0x400000000.
> 
> The Linux EHCI driver programs the segment register to zero when
> 64-bit addressing is supported. As a result, descriptor addresses
> derived from the EHCI registers do not include the DRAM base
> address.
> 
> Descriptor memory is allocated through the DMA API with a 64-bit
> DMA mask, allowing descriptors to reside in DRAM above 4GB. On
> AST2700, EHCI queue heads (QH) and queue element transfer
> descriptors (qTD) are therefore placed at addresses starting from
> 0x400000000.
> 
> Set the ctrldssegment-default property to 0x4 so the upper
> 32 bits of descriptor addresses are adjusted accordingly. This
> allows the emulated EHCI controller to construct correct system
> addresses when accessing descriptors in DRAM above 4GB.
> 
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> ---
>   hw/arm/aspeed_ast27x0.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
> index 87dcb82e1b..0cb39dc191 100644
> --- a/hw/arm/aspeed_ast27x0.c
> +++ b/hw/arm/aspeed_ast27x0.c
> @@ -856,6 +856,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
>   
>       /* EHCI */
>       for (i = 0; i < sc->ehcis_num; i++) {
> +        object_property_set_int(OBJECT(&s->ehci[i]), "ctrldssegment-default",
> +                                0x4, &error_abort);

Please replace "0x4" with "sc->memmap[ASPEED_DEV_SDRAM] >> 32"

Thanks,

C.



>           if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
>               return;
>           }

Re: [PATCH v5 09/18] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility

[Cédric Le Goater]

On 4/24/26 10:05, Jamin Lin wrote:
> Change internal EHCI descriptor addresses from uint32_t to uint64_t.
> 
> The following fields are updated:
> - EHCIPacket::qtdaddr
> - EHCIQueue::{qhaddr, qtdaddr}
> - EHCIState::{a_fetch_addr, p_fetch_addr}
> 
> Update get_dwords() and put_dwords() to take 64-bit addresses and
> propagate the type change through the descriptor traversal paths.
> 
> Adjust NLPTR_GET() to operate on 64-bit values:
> 
>      #define NLPTR_GET(x) ((x) & ~0x1fULL)
> 
> so that link pointer masking works correctly when descriptor
> addresses exceed 32-bit space. The previous mask (0xffffffe0)
> implicitly truncated addresses to 32 bits.
> 
> This patch does not change the on-wire descriptor layout yet.
> It only removes the internal 32-bit address limit and prepares
> for later patches that will add full 64-bit QH/qTD/iTD/siTD support.
> 
> Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> use uint64_t for the address argument and print it with PRIx64. This
> ensures full 64-bit addresses are shown in trace output and improves
> debugging of queue heads and transfer descriptors.
> 
> Migration compatibility:
> 
> To preserve backward migration compatibility, keep the legacy 32-bit
> fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
> new 64-bit fields.
> 
> Migration format is selected using a machine compat property
> "x-migrate-fetch-addr-64bit":
> 
> - Old machine types migrate 32-bit fetch addresses
> - New machine types migrate full 64-bit fetch addresses
> 
> This is implemented using VMSTATE_UINT32_TEST() and
> VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
> 
> In pre_save, the 32-bit shadow fields are populated when migrating
> to old machine types. In post_load, the 32-bit values are restored
> into the 64-bit fields when loading old migration streams.
> 
> No functional change.
> 
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
>   hw/usb/hcd-ehci.h   | 17 +++++++----
>   hw/core/machine.c   |  5 +++-
>   hw/usb/hcd-ehci.c   | 72 ++++++++++++++++++++++++++++++++-------------
>   hw/usb/trace-events | 24 +++++++--------
>   4 files changed, 78 insertions(+), 40 deletions(-)
> 
> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
> index d038ee1e31..3acbddfc5c 100644
> --- a/hw/usb/hcd-ehci.h
> +++ b/hw/usb/hcd-ehci.h
> @@ -208,7 +208,7 @@ struct EHCIPacket {
>       QTAILQ_ENTRY(EHCIPacket) next;
>   
>       EHCIqtd qtd;           /* copy of current QTD (being worked on) */
> -    uint32_t qtdaddr;      /* address QTD read from                 */
> +    uint64_t qtdaddr;      /* address QTD read from                 */
>   
>       USBPacket packet;
>       QEMUSGList sgl;
> @@ -229,8 +229,8 @@ struct EHCIQueue {
>        * when guest removes an entry (doorbell, handshake sequence)
>        */
>       EHCIqh qh;             /* copy of current QH (being worked on) */
> -    uint32_t qhaddr;       /* address QH read from                 */
> -    uint32_t qtdaddr;      /* address QTD read from                */
> +    uint64_t qhaddr;       /* address QH read from                 */
> +    uint64_t qtdaddr;      /* address QTD read from                */
>       int last_pid;          /* pid of last packet executed          */
>       USBDevice *dev;
>       QTAILQ_HEAD(, EHCIPacket) packets;
> @@ -256,6 +256,7 @@ struct EHCIState {
>   
>       /* properties */
>       uint32_t maxframes;
> +    bool migrate_fetch_addr_64bit;
>   
>       /*
>        *  EHCI spec version 1.0 Section 2.3
> @@ -294,8 +295,10 @@ struct EHCIState {
>       EHCIQueueHead pqueues;
>   
>       /* which address to look at next */
> -    uint32_t a_fetch_addr;
> -    uint32_t p_fetch_addr;
> +    uint32_t a_fetch_addr_32;
> +    uint32_t p_fetch_addr_32;
> +    uint64_t a_fetch_addr;
> +    uint64_t p_fetch_addr;
>   
>       USBPacket ipacket;
>       QEMUSGList isgl;
> @@ -308,7 +311,9 @@ struct EHCIState {
>   };
>   
>   #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> -    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> +    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> +    DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> +                     ehci.migrate_fetch_addr_64bit, true)
>   
>   extern const VMStateDescription vmstate_ehci;
>   
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 1abc8ae737..b0c1580b16 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -38,7 +38,10 @@
>   #include "hw/acpi/generic_event_device.h"
>   #include "qemu/audio.h"
>   
> -GlobalProperty hw_compat_11_0[] = {};
> +GlobalProperty hw_compat_11_0[] = {
> +    { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> +    { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> +};
>   const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
>   
>   GlobalProperty hw_compat_10_2[] = {
> diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
> index 28a60e4c1a..0c8bdb48ad 100644
> --- a/hw/usb/hcd-ehci.c
> +++ b/hw/usb/hcd-ehci.c
> @@ -72,7 +72,7 @@ typedef enum {
>   } EHCI_STATES;
>   
>   /* macros for accessing fields within next link pointer entry */
> -#define NLPTR_GET(x)             ((x) & 0xffffffe0)
> +#define NLPTR_GET(x)             ((x) & ~0x1fULL)
>   #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
>   #define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
>   
> @@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
>       return async ? s->astate : s->pstate;
>   }
>   
> -static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
> +static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
>   {
>       if (async) {
>           s->a_fetch_addr = addr;
> @@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
>       }
>   }
>   
> -static int ehci_get_fetch_addr(EHCIState *s, int async)
> +static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
>   {
>       return async ? s->a_fetch_addr : s->p_fetch_addr;
>   }
> @@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState *s)
>   }
>   
>   /* Get an array of dwords from main memory */
> -static inline int get_dwords(EHCIState *ehci, uint32_t addr,
> +static inline int get_dwords(EHCIState *ehci, uint64_t addr,
>                                uint32_t *buf, int num)
>   {
>       int i;
> @@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t addr,
>   }
>   
>   /* Put an array of dwords in to main memory */
> -static inline int put_dwords(EHCIState *ehci, uint32_t addr,
> +static inline int put_dwords(EHCIState *ehci, uint64_t addr,
>                                uint32_t *buf, int num)
>   {
>       int i;
> @@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
>   
>   /* queue management */
>   
> -static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
> +static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
>   {
>       EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
>       EHCIQueue *q;
> @@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const char *warn)
>       g_free(q);
>   }
>   
> -static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
> +static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
>                                           int async)
>   {
>       EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
> @@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
>   {
>       uint32_t *qh = (uint32_t *) &q->qh;
>       uint32_t dwords = sizeof(EHCIqh) >> 2;
> -    uint32_t addr = NLPTR_GET(q->qhaddr);
> +    uint64_t addr = NLPTR_GET(q->qhaddr);
>   
>       put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
>   }
> @@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const char *action)
>   /* 4.7.2 */
>   static int ehci_process_itd(EHCIState *ehci,
>                               EHCIitd *itd,
> -                            uint32_t addr)
> +                            uint64_t addr)
>   {
>       USBDevice *dev;
>       USBEndpoint *ep;
>       uint32_t i, len, pid, dir, devaddr, endp;
> -    uint32_t pg, off, ptr1, ptr2, max, mult;
> +    uint32_t pg, off, max, mult;
> +    uint64_t ptr1, ptr2;
>   
>       ehci->periodic_sched_active = PERIODIC_ACTIVE;
>   
> @@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,  int async)
>       EHCIqh qh;
>       int i = 0;
>       int again = 0;
> -    uint32_t entry = ehci->asynclistaddr;
> +    uint64_t entry = ehci->asynclistaddr;
>   
>       /* set reclamation flag at start event (4.8.6) */
>       if (async) {
> @@ -1578,7 +1579,7 @@ out:
>   static int ehci_state_fetchentry(EHCIState *ehci, int async)
>   {
>       int again = 0;
> -    uint32_t entry = ehci_get_fetch_addr(ehci, async);
> +    uint64_t entry = ehci_get_fetch_addr(ehci, async);
>   
>       if (NLPTR_TBIT(entry)) {
>           ehci_set_state(ehci, async, EST_ACTIVE);
> @@ -1611,7 +1612,7 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
>       default:
>           /* TODO: handle FSTN type */
>           qemu_log_mask(LOG_GUEST_ERROR,
> -                      "FETCHENTRY: entry at 0x%x is of type %u "
> +                      "FETCHENTRY: entry at %" PRIx64 "is of type %" PRIu64

This should be :

                          "FETCHENTRY: entry at %" PRIx64 " is of type %" PRIu64 " "

>                         "which is not supported yet\n",
>                         entry, NLPTR_TYPE_GET(entry));
>           return -1;
> @@ -1623,7 +1624,7 @@ out:
>   
>   static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
>   {
> -    uint32_t entry;
> +    uint64_t entry;
>       EHCIQueue *q;
>       EHCIqh qh;
>   
> @@ -1712,7 +1713,7 @@ out:
>   
>   static int ehci_state_fetchitd(EHCIState *ehci, int async)
>   {
> -    uint32_t entry;
> +    uint64_t entry;
>       EHCIitd itd;
>   
>       assert(!async);
> @@ -1738,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
>   
>   static int ehci_state_fetchsitd(EHCIState *ehci, int async)
>   {
> -    uint32_t entry;
> +    uint64_t entry;
>       EHCIsitd sitd;
>   
>       assert(!async);
> @@ -1802,7 +1803,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
>       EHCIqtd qtd;
>       EHCIPacket *p;
>       int again = 1;
> -    uint32_t addr;
> +    uint64_t addr;
>   
>       addr = NLPTR_GET(q->qtdaddr);
>       if (get_dwords(q->ehci, addr +  8, &qtd.token,   1) < 0) {
> @@ -1885,7 +1886,7 @@ static int ehci_fill_queue(EHCIPacket *p)
>       USBEndpoint *ep = p->packet.ep;
>       EHCIQueue *q = p->queue;
>       EHCIqtd qtd = p->qtd;
> -    uint32_t qtdaddr;
> +    uint64_t qtdaddr;
>   
>       for (;;) {
>           if (NLPTR_TBIT(qtd.next) != 0) {
> @@ -2008,7 +2009,8 @@ static int ehci_state_executing(EHCIQueue *q)
>   static int ehci_state_writeback(EHCIQueue *q)
>   {
>       EHCIPacket *p = QTAILQ_FIRST(&q->packets);
> -    uint32_t *qtd, addr;
> +    uint32_t *qtd;
> +    uint64_t addr;
>       int again = 0;
>   
>       /*  Write back the QTD from the QH area */
> @@ -2414,6 +2416,18 @@ static USBBusOps ehci_bus_ops_standalone = {
>       .wakeup_endpoint = ehci_wakeup_endpoint,
>   };
>   
> +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
> +{
> +    EHCIState *s = opaque;
> +
> +    return s->migrate_fetch_addr_64bit;
> +}
> +
> +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
> +{
> +    return !ehci_fetch_addr_64_needed(opaque, version_id);
> +}
> +
>   static int usb_ehci_pre_save(void *opaque)
>   {
>       EHCIState *ehci = opaque;
> @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
>       ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
>       ehci->frindex = new_frindex;
>   
> +    if (!ehci->migrate_fetch_addr_64bit) {
> +        ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> +        ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> +    }
> +
>       return 0;
>   }
>   
> @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
>           }
>       }
>   
> +    if (!s->migrate_fetch_addr_64bit) {
> +        s->a_fetch_addr = s->a_fetch_addr_32;
> +        s->p_fetch_addr = s->p_fetch_addr_32;
> +    }
> +
>       return 0;
>   }
>   
> @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
>           /* schedule state */
>           VMSTATE_UINT32(astate, EHCIState),
>           VMSTATE_UINT32(pstate, EHCIState),
> -        VMSTATE_UINT32(a_fetch_addr, EHCIState),
> -        VMSTATE_UINT32(p_fetch_addr, EHCIState),
> +        VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> +                            ehci_fetch_addr_32_needed),
> +        VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> +                            ehci_fetch_addr_32_needed),
> +        VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> +                            ehci_fetch_addr_64_needed),
> +        VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> +                            ehci_fetch_addr_64_needed),
>           VMSTATE_END_OF_LIST()
>       }
>   };
> diff --git a/hw/usb/trace-events b/hw/usb/trace-events
> index 0d4318dcf1..8c90688bb3 100644
> --- a/hw/usb/trace-events
> +++ b/hw/usb/trace-events
> @@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio 0x%04
>   usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
>   usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
>   usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
> -usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
> -usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
> -usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
> +usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
> +usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
> +usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%" PRIx64 " - c %d, h %d, dtc %d, i %d"
>   usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
> -usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
> -usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
> -usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
> -usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
> -usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x: next 0x%08x - active %d"
> +usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
> +usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
> +usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr %d"
> +usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
> +usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%" PRIx64 ": next 0x%08x - active %d"
>   usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
>   usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
>   usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
> @@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
>   usb_ehci_port_disable(uint32_t port) "port #%d"
>   usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
>   usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
> -usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
> +usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ", next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
>   usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
>   usb_ehci_guest_bug(const char *reason) "%s"
>   usb_ehci_doorbell_ring(void) ""
>   usb_ehci_doorbell_ack(void) ""
>   usb_ehci_dma_error(void) ""
> -usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
> -usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
> -usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
> +usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
> +usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
> +usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
>   usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
>   usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
>   usb_ehci_log(const char *msg) "%s"

Re: [PATCH v5 00/18] hw/usb/ehci: Add 64-bit descriptor addressing support

[Cédric Le Goater]

Jamin,

On 4/24/26 10:05, Jamin Lin wrote:
> EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
> which provides the upper 32 bits of descriptor addresses when the
> controller advertises 64-bit capability.
> 
> Currently QEMU EHCI model only partially supports this functionality and
> descriptor addresses are effectively treated as 32-bit. This becomes
> problematic on systems where system memory is located above the 4GB
> boundary.
> 
> The Linux EHCI driver enables 64-bit addressing if the controller
> advertises the capability. During initialization it programs the
> segment register to zero:
> 
>    https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600
> 
> The driver also notes that descriptor structures allocated from the
> DMA pool use segment zero semantics. Descriptor memory is allocated
> using the DMA API and platforms may configure a 64-bit DMA mask,
> allowing descriptor memory to be placed above 4GB.
> 
> On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
> result, descriptor addresses constructed directly from the EHCI
> registers do not match the actual system addresses used by the
> controller when accessing queue heads (QH) and queue element transfer
> descriptors (qTD).
> 
> This patch series implements full 64-bit descriptor addressing support
> in the EHCI emulation. Descriptor address handling is updated to use
> 64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
> are extended to support the upper address bits provided by the segment
> register.
> 
> Add a ctrldssegment-default property so platforms can provide a
> descriptor address offset when constructing descriptor addresses.
> This allows systems where DRAM resides above 4GB to access EHCI
> descriptors correctly.
> 
> The AST2700 machine uses this property to account for its DRAM mapping
> at 0x400000000 and enables 64-bit EHCI DMA addressing.
> 
> Test Result:
> 1. EHCI 32bits with ast2600-evb machine
> Command line:
> ./build/qemu-system-arm \
>    -machine ast2600-evb \
>    -m 1G \
>    -drive file=image-bmc,if=mtd,format=raw \
>    -nographic \
>    -device usb-kbd,bus=usb-bus.1,id=mykbd \
>    -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>    -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
>    -snapshot \
>    -nographic
> Result:
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
> Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
> Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
> 
> 2. EHCI 64bits with ast2700a2-evb machine
> Command line:
> ./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
>   -bios ast27x0_bootrom.bin \
>   -drive file=image-bmc,format=raw,if=mtd \
>   -snapshot \
>   -device usb-kbd,bus=usb-bus.3,id=mykbd \
>   -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>   -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
> Result:
> root@ast2700-default:~# lsusb
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
> Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
> Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
> Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>   
> v1
>   1. Fix checkpatch coding style issues
>   2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
>   3. Add descriptor address offset property
>   4. Enable 64-bit EHCI DMA addressing on AST2700
>   5. Configure descriptor address offset for AST2700
> 
> v2
>   1. Remove unused EHCIfstn structure and dead code
>   2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
>   3. Replace DPRINTF debug logs with trace events
>   4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
>   5. Fix review issue
> 
> v3:
>   1. Add Migration version test function
>   2. Add EHCI 64-bit buffer pointer fields description in commit log
> 
> v4:
>   1. Reorder patches in the series
>   2. Fix EHCI migration issues
>   3. Introduce a common properties macro for both sysbus and PCI
>   4. Drop the descriptor address offset property
>   5. Add ctrldssegment-default property
>   6. Address review comments
> 
> v5:
>   1. Add 11.0 machine compatibility properties
> 
> Jamin Lin (18):
>    tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
>      AST2600 SDK
>    hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
>    hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
>    hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
>    hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with
>      qemu_log_mask(LOG_GUEST_ERROR)
>    hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
>    hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci
>    hw/core: Add 11.0 machine compatibility properties
>    hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
>      compatibility
>    hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
>      capability
>    hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
>    hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
>    hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
>    hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
>    hw/usb/hcd-ehci: Add ctrldssegment-default property
>    hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
>    hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
>    tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
>      AST2700 A1/A2
> 
>   hw/usb/hcd-ehci.h                             |  64 +--
>   include/hw/core/boards.h                      |   3 +
>   include/hw/i386/pc.h                          |   3 +
>   hw/arm/aspeed_ast27x0.c                       |   4 +
>   hw/arm/virt.c                                 |   8 +
>   hw/core/machine.c                             |   6 +
>   hw/i386/pc.c                                  |   3 +
>   hw/i386/pc_piix.c                             |  11 +-
>   hw/i386/pc_q35.c                              |  11 +-
>   hw/m68k/virt.c                                |   7 +
>   hw/ppc/spapr.c                                |  13 +-
>   hw/s390x/s390-virtio-ccw.c                    |  11 +
>   hw/usb/hcd-ehci-pci.c                         |   2 +-
>   hw/usb/hcd-ehci-sysbus.c                      |   2 +-
>   hw/usb/hcd-ehci.c                             | 382 +++++++++++-------
>   hw/usb/trace-events                           |  25 +-
>   .../aarch64/test_aspeed_ast2700a1.py          |   7 +
>   .../aarch64/test_aspeed_ast2700a2.py          |   7 +
>   .../functional/arm/test_aspeed_ast2600_sdk.py |   7 +
>   19 files changed, 384 insertions(+), 192 deletions(-)
> 

Patches 1-9 are merged. Could you please resend the remaining patches
in a v6 with the with suggested improvements ? I will queue the
series in aspeed-next.


Thanks,

C.

RE: [PATCH v5 10/18] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability

[Jamin Lin]

Hi Cédric

> Subject: Re: [PATCH v5 10/18] hw/usb/hcd-ehci: Add property to advertise
> 64-bit addressing capability
> 
> On 4/24/26 10:05, Jamin Lin wrote:
> > Introduce a new boolean property, "caps-64bit-addr", to control
> > HCCPARAMS[0] (64-bit Addressing Capability).
> >
> > When enabled, the EHCI controller advertises support for 64-bit
> > address memory pointers as defined in the EHCI specification (Table
> > 2-7, HCCPARAMS). This allows software to use the 64-bit data structure
> > formats described in Appendix B.
> >
> > When disabled (default), the controller reports 32-bit addressing
> > capability and uses the standard 32-bit data structures.
> >
> > The EHCI CTRLDSSEGMENT register provides the upper 32 bits [63:32]
> > used to form 64-bit addresses for EHCI control data structures. Per
> > EHCI 1.0 spec section 2.3.5, when the HCCPARAMS 64-bit Addressing
> > Capability bit is zero, CTRLDSSEGMENT is not used: software cannot
> > write it and reads must return zero.
> >
> > Add a capability check in the operational register write handler and
> > reject guest writes to CTRLDSSEGMENT when 64-bit addressing is not
> > enabled.
> >
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > Reviewed-by: Cédric Le Goater <clg@redhat.com>
> > Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> > ---
> >   hw/usb/hcd-ehci.h |  5 ++++-
> >   hw/usb/hcd-ehci.c | 14 +++++++++++++-
> >   2 files changed, 17 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index
> > 3acbddfc5c..f1f2fde578 100644
> > --- a/hw/usb/hcd-ehci.h
> > +++ b/hw/usb/hcd-ehci.h
> > @@ -257,6 +257,7 @@ struct EHCIState {
> >       /* properties */
> >       uint32_t maxframes;
> >       bool migrate_fetch_addr_64bit;
> > +    bool caps_64bit_addr;
> >
> >       /*
> >        *  EHCI spec version 1.0 Section 2.3 @@ -313,7 +314,9 @@ struct
> > EHCIState {
> >   #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> >       DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> >       DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> > -                     ehci.migrate_fetch_addr_64bit, true)
> > +                     ehci.migrate_fetch_addr_64bit, true), \
> > +    DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
> > +                     ehci.caps_64bit_addr, false)
> >
> >   extern const VMStateDescription vmstate_ehci;
> >
> > diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index
> > 0c8bdb48ad..b23ff92e12 100644
> > --- a/hw/usb/hcd-ehci.c
> > +++ b/hw/usb/hcd-ehci.c
> > @@ -1109,6 +1109,15 @@ static void ehci_opreg_write(void *ptr, hwaddr
> addr,
> >           }
> >           break;
> >
> > +    case CTRLDSSEGMENT:
> > +        if (!s->caps_64bit_addr) {
> > +            qemu_log_mask(LOG_GUEST_ERROR,
> > +                          "ehci: write to CTRLDSSEGMENT while "
> > +                          "      64-bit addressing capability is
> disabled\n");
> 
> Please remove the extra spaces at the beginning of line.
> 
Thanks for the review and suggestion.
Will do.
Jamin
> Thanks,
> 
> C.
> 
> 
> 
> > +            return;
> > +        }
> > +        break;
> > +
> >       case ASYNCLISTADDR:
> >           if (ehci_async_enabled(s)) {
> >               qemu_log_mask(LOG_GUEST_ERROR, @@ -2554,6
> +2563,9 @@
> > void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
> >                      s->maxframes);
> >           return;
> >       }
> > +    if (s->caps_64bit_addr) {
> > +        s->caps[0x08] |= BIT(0);
> > +    }
> >
> >       memory_region_add_subregion(&s->mem, s->capsbase,
> &s->mem_caps);
> >       memory_region_add_subregion(&s->mem, s->opregbase,
> > &s->mem_opreg); @@ -2613,7 +2625,7 @@ void usb_ehci_init(EHCIState *s,
> DeviceState *dev)
> >       s->caps[0x05] = 0x00;        /* No companion ports at present */
> >       s->caps[0x06] = 0x00;
> >       s->caps[0x07] = 0x00;
> > -    s->caps[0x08] = 0x80;        /* We can cache whole frame, no
> 64-bit */
> > +    s->caps[0x08] = 0x80;        /* We can cache whole frame */
> >       s->caps[0x0a] = 0x00;
> >       s->caps[0x0b] = 0x00;
> >

RE: [PATCH v5 16/18] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default

[Jamin Lin]

Hi Cédric

> Subject: Re: [PATCH v5 16/18] hw/arm/aspeed_ast27x0: Set EHCI
> ctrldssegment-default
> 
> On 4/24/26 10:05, Jamin Lin wrote:
> > On AST2700 platforms, system DRAM is mapped above 4GB with a base
> > address at 0x400000000.
> >
> > The Linux EHCI driver programs the segment register to zero when
> > 64-bit addressing is supported. As a result, descriptor addresses
> > derived from the EHCI registers do not include the DRAM base address.
> >
> > Descriptor memory is allocated through the DMA API with a 64-bit DMA
> > mask, allowing descriptors to reside in DRAM above 4GB. On AST2700,
> > EHCI queue heads (QH) and queue element transfer descriptors (qTD) are
> > therefore placed at addresses starting from 0x400000000.
> >
> > Set the ctrldssegment-default property to 0x4 so the upper
> > 32 bits of descriptor addresses are adjusted accordingly. This allows
> > the emulated EHCI controller to construct correct system addresses
> > when accessing descriptors in DRAM above 4GB.
> >
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > Reviewed-by: Cédric Le Goater <clg@redhat.com>
> > ---
> >   hw/arm/aspeed_ast27x0.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c index
> > 87dcb82e1b..0cb39dc191 100644
> > --- a/hw/arm/aspeed_ast27x0.c
> > +++ b/hw/arm/aspeed_ast27x0.c
> > @@ -856,6 +856,8 @@ static void aspeed_soc_ast2700_realize(DeviceState
> > *dev, Error **errp)
> >
> >       /* EHCI */
> >       for (i = 0; i < sc->ehcis_num; i++) {
> > +        object_property_set_int(OBJECT(&s->ehci[i]),
> "ctrldssegment-default",
> > +                                0x4, &error_abort);
> 
> Please replace "0x4" with "sc->memmap[ASPEED_DEV_SDRAM] >> 32"
> 
Thanks for the review and suggestion.
Will do.
Jamin
> Thanks,
> 
> C.
> 
> 
> 
> >           if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
> >               return;
> >           }

RE: [PATCH v5 09/18] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility

[Jamin Lin]

Hi Cédric

> Subject: Re: [PATCH v5 09/18] hw/usb/hcd-ehci: Change descriptor addresses to
> 64-bit with migration compatibility
> 
> On 4/24/26 10:05, Jamin Lin wrote:
> > Change internal EHCI descriptor addresses from uint32_t to uint64_t.
> >
> > The following fields are updated:
> > - EHCIPacket::qtdaddr
> > - EHCIQueue::{qhaddr, qtdaddr}
> > - EHCIState::{a_fetch_addr, p_fetch_addr}
> >
> > Update get_dwords() and put_dwords() to take 64-bit addresses and
> > propagate the type change through the descriptor traversal paths.
> >
> > Adjust NLPTR_GET() to operate on 64-bit values:
> >
> >      #define NLPTR_GET(x) ((x) & ~0x1fULL)
> >
> > so that link pointer masking works correctly when descriptor addresses
> > exceed 32-bit space. The previous mask (0xffffffe0) implicitly
> > truncated addresses to 32 bits.
> >
> > This patch does not change the on-wire descriptor layout yet.
> > It only removes the internal 32-bit address limit and prepares for
> > later patches that will add full 64-bit QH/qTD/iTD/siTD support.
> >
> > Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> > use uint64_t for the address argument and print it with PRIx64. This
> > ensures full 64-bit addresses are shown in trace output and improves
> > debugging of queue heads and transfer descriptors.
> >
> > Migration compatibility:
> >
> > To preserve backward migration compatibility, keep the legacy 32-bit
> > fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
> > new 64-bit fields.
> >
> > Migration format is selected using a machine compat property
> > "x-migrate-fetch-addr-64bit":
> >
> > - Old machine types migrate 32-bit fetch addresses
> > - New machine types migrate full 64-bit fetch addresses
> >
> > This is implemented using VMSTATE_UINT32_TEST() and
> > VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
> >
> > In pre_save, the 32-bit shadow fields are populated when migrating to
> > old machine types. In post_load, the 32-bit values are restored into
> > the 64-bit fields when loading old migration streams.
> >
> > No functional change.
> >
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > ---
> >   hw/usb/hcd-ehci.h   | 17 +++++++----
> >   hw/core/machine.c   |  5 +++-
> >   hw/usb/hcd-ehci.c   | 72
> ++++++++++++++++++++++++++++++++-------------
> >   hw/usb/trace-events | 24 +++++++--------
> >   4 files changed, 78 insertions(+), 40 deletions(-)
> >
> > diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index
> > d038ee1e31..3acbddfc5c 100644
> > --- a/hw/usb/hcd-ehci.h
> > +++ b/hw/usb/hcd-ehci.h
> > @@ -208,7 +208,7 @@ struct EHCIPacket {
> >       QTAILQ_ENTRY(EHCIPacket) next;
> >
> >       EHCIqtd qtd;           /* copy of current QTD (being worked on)
> */
> > -    uint32_t qtdaddr;      /* address QTD read from
> */
> > +    uint64_t qtdaddr;      /* address QTD read from
> */
> >
> >       USBPacket packet;
> >       QEMUSGList sgl;
> > @@ -229,8 +229,8 @@ struct EHCIQueue {
> >        * when guest removes an entry (doorbell, handshake sequence)
> >        */
> >       EHCIqh qh;             /* copy of current QH (being worked on)
> */
> > -    uint32_t qhaddr;       /* address QH read from
> */
> > -    uint32_t qtdaddr;      /* address QTD read from
> */
> > +    uint64_t qhaddr;       /* address QH read from
> */
> > +    uint64_t qtdaddr;      /* address QTD read from
> */
> >       int last_pid;          /* pid of last packet executed          */
> >       USBDevice *dev;
> >       QTAILQ_HEAD(, EHCIPacket) packets; @@ -256,6 +256,7 @@ struct
> > EHCIState {
> >
> >       /* properties */
> >       uint32_t maxframes;
> > +    bool migrate_fetch_addr_64bit;
> >
> >       /*
> >        *  EHCI spec version 1.0 Section 2.3 @@ -294,8 +295,10 @@
> > struct EHCIState {
> >       EHCIQueueHead pqueues;
> >
> >       /* which address to look at next */
> > -    uint32_t a_fetch_addr;
> > -    uint32_t p_fetch_addr;
> > +    uint32_t a_fetch_addr_32;
> > +    uint32_t p_fetch_addr_32;
> > +    uint64_t a_fetch_addr;
> > +    uint64_t p_fetch_addr;
> >
> >       USBPacket ipacket;
> >       QEMUSGList isgl;
> > @@ -308,7 +311,9 @@ struct EHCIState {
> >   };
> >
> >   #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> > -    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> > +    DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> > +    DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> > +                     ehci.migrate_fetch_addr_64bit, true)
> >
> >   extern const VMStateDescription vmstate_ehci;
> >
> > diff --git a/hw/core/machine.c b/hw/core/machine.c index
> > 1abc8ae737..b0c1580b16 100644
> > --- a/hw/core/machine.c
> > +++ b/hw/core/machine.c
> > @@ -38,7 +38,10 @@
> >   #include "hw/acpi/generic_event_device.h"
> >   #include "qemu/audio.h"
> >
> > -GlobalProperty hw_compat_11_0[] = {};
> > +GlobalProperty hw_compat_11_0[] = {
> > +    { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> > +    { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" }, };
> >   const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
> >
> >   GlobalProperty hw_compat_10_2[] = {
> > diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index
> > 28a60e4c1a..0c8bdb48ad 100644
> > --- a/hw/usb/hcd-ehci.c
> > +++ b/hw/usb/hcd-ehci.c
> > @@ -72,7 +72,7 @@ typedef enum {
> >   } EHCI_STATES;
> >
> >   /* macros for accessing fields within next link pointer entry */
> > -#define NLPTR_GET(x)             ((x) & 0xffffffe0)
> > +#define NLPTR_GET(x)             ((x) & ~0x1fULL)
> >   #define NLPTR_TYPE_GET(x)        (((x) >> 1) & 3)
> >   #define NLPTR_TBIT(x)            ((x) & 1)  /* 1=invalid, 0=valid */
> >
> > @@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
> >       return async ? s->astate : s->pstate;
> >   }
> >
> > -static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t
> > addr)
> > +static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t
> > +addr)
> >   {
> >       if (async) {
> >           s->a_fetch_addr = addr;
> > @@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int
> async, uint32_t addr)
> >       }
> >   }
> >
> > -static int ehci_get_fetch_addr(EHCIState *s, int async)
> > +static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
> >   {
> >       return async ? s->a_fetch_addr : s->p_fetch_addr;
> >   }
> > @@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState
> *s)
> >   }
> >
> >   /* Get an array of dwords from main memory */ -static inline int
> > get_dwords(EHCIState *ehci, uint32_t addr,
> > +static inline int get_dwords(EHCIState *ehci, uint64_t addr,
> >                                uint32_t *buf, int num)
> >   {
> >       int i;
> > @@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t
> addr,
> >   }
> >
> >   /* Put an array of dwords in to main memory */ -static inline int
> > put_dwords(EHCIState *ehci, uint32_t addr,
> > +static inline int put_dwords(EHCIState *ehci, uint64_t addr,
> >                                uint32_t *buf, int num)
> >   {
> >       int i;
> > @@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
> >
> >   /* queue management */
> >
> > -static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr,
> > int async)
> > +static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr,
> > +int async)
> >   {
> >       EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
> >       EHCIQueue *q;
> > @@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const
> char *warn)
> >       g_free(q);
> >   }
> >
> > -static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t
> > addr,
> > +static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t
> > +addr,
> >                                           int async)
> >   {
> >       EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
> > @@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
> >   {
> >       uint32_t *qh = (uint32_t *) &q->qh;
> >       uint32_t dwords = sizeof(EHCIqh) >> 2;
> > -    uint32_t addr = NLPTR_GET(q->qhaddr);
> > +    uint64_t addr = NLPTR_GET(q->qhaddr);
> >
> >       put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
> >   }
> > @@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const
> char *action)
> >   /* 4.7.2 */
> >   static int ehci_process_itd(EHCIState *ehci,
> >                               EHCIitd *itd,
> > -                            uint32_t addr)
> > +                            uint64_t addr)
> >   {
> >       USBDevice *dev;
> >       USBEndpoint *ep;
> >       uint32_t i, len, pid, dir, devaddr, endp;
> > -    uint32_t pg, off, ptr1, ptr2, max, mult;
> > +    uint32_t pg, off, max, mult;
> > +    uint64_t ptr1, ptr2;
> >
> >       ehci->periodic_sched_active = PERIODIC_ACTIVE;
> >
> > @@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci,
> int async)
> >       EHCIqh qh;
> >       int i = 0;
> >       int again = 0;
> > -    uint32_t entry = ehci->asynclistaddr;
> > +    uint64_t entry = ehci->asynclistaddr;
> >
> >       /* set reclamation flag at start event (4.8.6) */
> >       if (async) {
> > @@ -1578,7 +1579,7 @@ out:
> >   static int ehci_state_fetchentry(EHCIState *ehci, int async)
> >   {
> >       int again = 0;
> > -    uint32_t entry = ehci_get_fetch_addr(ehci, async);
> > +    uint64_t entry = ehci_get_fetch_addr(ehci, async);
> >
> >       if (NLPTR_TBIT(entry)) {
> >           ehci_set_state(ehci, async, EST_ACTIVE); @@ -1611,7 +1612,7
> > @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
> >       default:
> >           /* TODO: handle FSTN type */
> >           qemu_log_mask(LOG_GUEST_ERROR,
> > -                      "FETCHENTRY: entry at 0x%x is of type %u "
> > +                      "FETCHENTRY: entry at %" PRIx64 "is of type %"
> > + PRIu64
> 
> This should be :
> 
>                           "FETCHENTRY: entry at %" PRIx64 " is of type
> %" PRIu64 " "
> 
Thanks for the review and suggestion.
Will do.
Jamin
> >                         "which is not supported yet\n",
> >                         entry, NLPTR_TYPE_GET(entry));
> >           return -1;
> > @@ -1623,7 +1624,7 @@ out:
> >
> >   static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
> >   {
> > -    uint32_t entry;
> > +    uint64_t entry;
> >       EHCIQueue *q;
> >       EHCIqh qh;
> >
> > @@ -1712,7 +1713,7 @@ out:
> >
> >   static int ehci_state_fetchitd(EHCIState *ehci, int async)
> >   {
> > -    uint32_t entry;
> > +    uint64_t entry;
> >       EHCIitd itd;
> >
> >       assert(!async);
> > @@ -1738,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci,
> > int async)
> >
> >   static int ehci_state_fetchsitd(EHCIState *ehci, int async)
> >   {
> > -    uint32_t entry;
> > +    uint64_t entry;
> >       EHCIsitd sitd;
> >
> >       assert(!async);
> > @@ -1802,7 +1803,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
> >       EHCIqtd qtd;
> >       EHCIPacket *p;
> >       int again = 1;
> > -    uint32_t addr;
> > +    uint64_t addr;
> >
> >       addr = NLPTR_GET(q->qtdaddr);
> >       if (get_dwords(q->ehci, addr +  8, &qtd.token,   1) < 0) {
> > @@ -1885,7 +1886,7 @@ static int ehci_fill_queue(EHCIPacket *p)
> >       USBEndpoint *ep = p->packet.ep;
> >       EHCIQueue *q = p->queue;
> >       EHCIqtd qtd = p->qtd;
> > -    uint32_t qtdaddr;
> > +    uint64_t qtdaddr;
> >
> >       for (;;) {
> >           if (NLPTR_TBIT(qtd.next) != 0) { @@ -2008,7 +2009,8 @@
> > static int ehci_state_executing(EHCIQueue *q)
> >   static int ehci_state_writeback(EHCIQueue *q)
> >   {
> >       EHCIPacket *p = QTAILQ_FIRST(&q->packets);
> > -    uint32_t *qtd, addr;
> > +    uint32_t *qtd;
> > +    uint64_t addr;
> >       int again = 0;
> >
> >       /*  Write back the QTD from the QH area */ @@ -2414,6 +2416,18
> > @@ static USBBusOps ehci_bus_ops_standalone = {
> >       .wakeup_endpoint = ehci_wakeup_endpoint,
> >   };
> >
> > +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id) {
> > +    EHCIState *s = opaque;
> > +
> > +    return s->migrate_fetch_addr_64bit; }
> > +
> > +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id) {
> > +    return !ehci_fetch_addr_64_needed(opaque, version_id); }
> > +
> >   static int usb_ehci_pre_save(void *opaque)
> >   {
> >       EHCIState *ehci = opaque;
> > @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
> >       ehci->last_run_ns -= (ehci->frindex - new_frindex) *
> UFRAME_TIMER_NS;
> >       ehci->frindex = new_frindex;
> >
> > +    if (!ehci->migrate_fetch_addr_64bit) {
> > +        ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> > +        ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> > +    }
> > +
> >       return 0;
> >   }
> >
> > @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int
> version_id)
> >           }
> >       }
> >
> > +    if (!s->migrate_fetch_addr_64bit) {
> > +        s->a_fetch_addr = s->a_fetch_addr_32;
> > +        s->p_fetch_addr = s->p_fetch_addr_32;
> > +    }
> > +
> >       return 0;
> >   }
> >
> > @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
> >           /* schedule state */
> >           VMSTATE_UINT32(astate, EHCIState),
> >           VMSTATE_UINT32(pstate, EHCIState),
> > -        VMSTATE_UINT32(a_fetch_addr, EHCIState),
> > -        VMSTATE_UINT32(p_fetch_addr, EHCIState),
> > +        VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> > +                            ehci_fetch_addr_32_needed),
> > +        VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> > +                            ehci_fetch_addr_32_needed),
> > +        VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> > +                            ehci_fetch_addr_64_needed),
> > +        VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> > +                            ehci_fetch_addr_64_needed),
> >           VMSTATE_END_OF_LIST()
> >       }
> >   };
> > diff --git a/hw/usb/trace-events b/hw/usb/trace-events index
> > 0d4318dcf1..8c90688bb3 100644
> > --- a/hw/usb/trace-events
> > +++ b/hw/usb/trace-events
> > @@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port,
> uint32_t val) "wr mmio 0x%04
> >   usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new,
> uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
> >   usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
> >   usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
> > -usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd,
> uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds
> 0x%08x,0x%08x,0x%08x"
> > -usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int
> devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
> > -usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c
> %d, h %d, dtc %d, i %d"
> > +usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd,
> uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds
> 0x%08x,0x%08x,0x%08x"
> > +usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int
> devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
> > +usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%"
> PRIx64 " - c %d, h %d, dtc %d, i %d"
> >   usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
> > -usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q
> %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
> > -usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid)
> "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
> > -usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int
> xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
> > -usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult,
> uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult
> %d, ep %d, dev %d"
> > -usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x:
> next 0x%08x - active %d"
> > +usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q
> %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
> > +usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid)
> "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
> > +usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int
> xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr
> %d"
> > +usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult,
> uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d,
> mult %d, ep %d, dev %d"
> > +usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%"
> PRIx64 ": next 0x%08x - active %d"
> >   usb_ehci_port_attach(uint32_t port, const char *owner, const char
> *device) "attach port #%d, owner %s, device %s"
> >   usb_ehci_port_detach(uint32_t port, const char *owner) "detach port
> #%d, owner %s"
> >   usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
> > @@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
> >   usb_ehci_port_disable(uint32_t port) "port #%d"
> >   usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
> >   usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p:
> %s"
> > -usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr,
> int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x,
> qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
> > +usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr,
> int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ",
> next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d,
> actual_length=%d"
> >   usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask)
> "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
> >   usb_ehci_guest_bug(const char *reason) "%s"
> >   usb_ehci_doorbell_ring(void) ""
> >   usb_ehci_doorbell_ack(void) ""
> >   usb_ehci_dma_error(void) ""
> > -usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t
> qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x,
> status=%d, actual_length=%d"
> > -usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set,
> reclamation status reset - done processing"
> > -usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t
> active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next
> 0x%08x"
> > +usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t
> qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x,
> qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
> > +usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit
> set, reclamation status reset - done processing"
> > +usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t
> active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next
> 0x%08x"
> >   usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t
> entry) "frame=%d, list=0x%x, entry=0x%x"
> >   usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %"
> PRIu64 " uframes"
> >   usb_ehci_log(const char *msg) "%s"
> 
> 

RE: [PATCH v5 00/18] hw/usb/ehci: Add 64-bit descriptor addressing support

[Jamin Lin]

Hi Cédric

> Subject: Re: [PATCH v5 00/18] hw/usb/ehci: Add 64-bit descriptor addressing
> support
> 
> Jamin,
> 
> On 4/24/26 10:05, Jamin Lin wrote:
> > EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
> > which provides the upper 32 bits of descriptor addresses when the
> > controller advertises 64-bit capability.
> >
> > Currently QEMU EHCI model only partially supports this functionality
> > and descriptor addresses are effectively treated as 32-bit. This
> > becomes problematic on systems where system memory is located above
> > the 4GB boundary.
> >
> > The Linux EHCI driver enables 64-bit addressing if the controller
> > advertises the capability. During initialization it programs the
> > segment register to zero:
> >
> >
> > https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hc
> > d.c#L600
> >
> > The driver also notes that descriptor structures allocated from the
> > DMA pool use segment zero semantics. Descriptor memory is allocated
> > using the DMA API and platforms may configure a 64-bit DMA mask,
> > allowing descriptor memory to be placed above 4GB.
> >
> > On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
> > result, descriptor addresses constructed directly from the EHCI
> > registers do not match the actual system addresses used by the
> > controller when accessing queue heads (QH) and queue element transfer
> > descriptors (qTD).
> >
> > This patch series implements full 64-bit descriptor addressing support
> > in the EHCI emulation. Descriptor address handling is updated to use
> > 64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
> > are extended to support the upper address bits provided by the segment
> > register.
> >
> > Add a ctrldssegment-default property so platforms can provide a
> > descriptor address offset when constructing descriptor addresses.
> > This allows systems where DRAM resides above 4GB to access EHCI
> > descriptors correctly.
> >
> > The AST2700 machine uses this property to account for its DRAM mapping
> > at 0x400000000 and enables 64-bit EHCI DMA addressing.
> >
> > Test Result:
> > 1. EHCI 32bits with ast2600-evb machine Command line:
> > ./build/qemu-system-arm \
> >    -machine ast2600-evb \
> >    -m 1G \
> >    -drive file=image-bmc,if=mtd,format=raw \
> >    -nographic \
> >    -device usb-kbd,bus=usb-bus.1,id=mykbd \
> >    -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
> >    -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
> >    -snapshot \
> >    -nographic
> > Result:
> > unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux
> > 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller Bus 001
> > Device 002: ID 0627:0001 QEMU QEMU USB Keyboard Bus 001 Device 003:
> ID
> > 46f4:0001 QEMU QEMU USB HARDDRIVE Bus 002 Device 001: ID 1d6b:0001
> > Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host
> > Controller
> >
> > 2. EHCI 64bits with ast2700a2-evb machine Command line:
> > ./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
> >   -bios ast27x0_bootrom.bin \
> >   -drive file=image-bmc,format=raw,if=mtd \
> >   -snapshot \
> >   -device usb-kbd,bus=usb-bus.3,id=mykbd \
> >   -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
> >   -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
> > Result:
> > root@ast2700-default:~# lsusb
> > unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux
> > 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
> > Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d
> > ehci_hcd EHCI Host Controller Bus 002 Device 002: ID 0627:0001 QEMU
> > QEMU USB Keyboard Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB
> > HARDDRIVE
> >
> > v1
> >   1. Fix checkpatch coding style issues
> >   2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
> >   3. Add descriptor address offset property
> >   4. Enable 64-bit EHCI DMA addressing on AST2700
> >   5. Configure descriptor address offset for AST2700
> >
> > v2
> >   1. Remove unused EHCIfstn structure and dead code
> >   2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
> >   3. Replace DPRINTF debug logs with trace events
> >   4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
> >   5. Fix review issue
> >
> > v3:
> >   1. Add Migration version test function
> >   2. Add EHCI 64-bit buffer pointer fields description in commit log
> >
> > v4:
> >   1. Reorder patches in the series
> >   2. Fix EHCI migration issues
> >   3. Introduce a common properties macro for both sysbus and PCI
> >   4. Drop the descriptor address offset property
> >   5. Add ctrldssegment-default property
> >   6. Address review comments
> >
> > v5:
> >   1. Add 11.0 machine compatibility properties
> >
> > Jamin Lin (18):
> >    tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
> >      AST2600 SDK
> >    hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
> >    hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
> >    hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
> >    hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with
> >      qemu_log_mask(LOG_GUEST_ERROR)
> >    hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
> >    hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci
> >    hw/core: Add 11.0 machine compatibility properties
> >    hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
> >      compatibility
> >    hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
> >      capability
> >    hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
> >    hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
> >    hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
> >    hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
> >    hw/usb/hcd-ehci: Add ctrldssegment-default property
> >    hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
> >    hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
> >    tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
> >      AST2700 A1/A2
> >
> >   hw/usb/hcd-ehci.h                             |  64 +--
> >   include/hw/core/boards.h                      |   3 +
> >   include/hw/i386/pc.h                          |   3 +
> >   hw/arm/aspeed_ast27x0.c                       |   4 +
> >   hw/arm/virt.c                                 |   8 +
> >   hw/core/machine.c                             |   6 +
> >   hw/i386/pc.c                                  |   3 +
> >   hw/i386/pc_piix.c                             |  11 +-
> >   hw/i386/pc_q35.c                              |  11 +-
> >   hw/m68k/virt.c                                |   7 +
> >   hw/ppc/spapr.c                                |  13 +-
> >   hw/s390x/s390-virtio-ccw.c                    |  11 +
> >   hw/usb/hcd-ehci-pci.c                         |   2 +-
> >   hw/usb/hcd-ehci-sysbus.c                      |   2 +-
> >   hw/usb/hcd-ehci.c                             | 382
> +++++++++++-------
> >   hw/usb/trace-events                           |  25 +-
> >   .../aarch64/test_aspeed_ast2700a1.py          |   7 +
> >   .../aarch64/test_aspeed_ast2700a2.py          |   7 +
> >   .../functional/arm/test_aspeed_ast2600_sdk.py |   7 +
> >   19 files changed, 384 insertions(+), 192 deletions(-)
> >
> 
> Patches 1-9 are merged. Could you please resend the remaining patches in a
> v6 with the with suggested improvements ? I will queue the series in
> aspeed-next.
> 
Thanks for the review and suggestion.
Will resend v6.
Jamin
> 
> Thanks,
> 
> C.
>