* [PATCH v5 1/4] hw/usb/aspeed-udc: Add ASPEED UDC device controller
2026-09-02 2:15 [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Jamin Lin
@ 2026-09-02 2:15 ` Jamin Lin
2026-09-02 2:15 ` [PATCH v5 2/4] hw/usb/aspeed-udc: Add ASPEED UDC gadget USB device Jamin Lin
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Jamin Lin @ 2026-09-02 2:15 UTC (permalink / raw)
To: Paolo Bonzini, Peter Maydell, Cédric Le Goater, Steven Lee,
Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
open list:ARM TCG CPUs, open list:All patches CC here
Cc: Jamin Lin, Troy Lee, Philippe Mathieu-Daudé,
Cédric Le Goater
The AST2600 has a USB 2.0 Device Controller (UDC) at 0x1e6a2000 with one
control endpoint and four programmable endpoints.
Add the controller as a sysbus (system) device: the MMIO register map
described with the registerfields macros, the interrupt line and the
soft reset. This is only the register/system side.
Note: this "device controller" is the system-bus device (TYPE_ASPEED_UDC).
It is not the gadget USB device (TYPE_ASPEED_UDC_GADGET) that a host
controller enumerates, which is added in the next patch.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
include/hw/usb/aspeed-udc.h | 49 ++++++++
hw/usb/aspeed-udc.c | 236 ++++++++++++++++++++++++++++++++++++
hw/arm/Kconfig | 1 +
hw/usb/Kconfig | 3 +
hw/usb/meson.build | 1 +
hw/usb/trace-events | 7 ++
6 files changed, 297 insertions(+)
create mode 100644 include/hw/usb/aspeed-udc.h
create mode 100644 hw/usb/aspeed-udc.c
diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
new file mode 100644
index 0000000000..58fed5f9a2
--- /dev/null
+++ b/include/hw/usb/aspeed-udc.h
@@ -0,0 +1,49 @@
+/*
+ * ASPEED USB Device Controller (UDC)
+ *
+ * Copyright (c) 2026 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_USB_ASPEED_UDC_H
+#define HW_USB_ASPEED_UDC_H
+
+#include "hw/core/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_ASPEED_UDC "aspeed.udc"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedUDCState, ASPEED_UDC)
+
+/*
+ * Register map: root/global block at 0x000 - 0x087, then one 0x10 byte bank
+ * per programmable endpoint from 0x200.
+ */
+#define ASPEED_UDC_MEM_SIZE 0x300
+#define ASPEED_UDC_ROOT_NR_REGS (0x88 >> 2)
+#define ASPEED_UDC_EP_REG_BASE 0x200
+#define ASPEED_UDC_EP_NR_REGS (0x10 >> 2)
+
+/*
+ * EP0 (control) is served through the root registers (UDC_EP0_*), so only
+ * the 4 programmable endpoints get their own register bank / ep[] entry.
+ */
+#define ASPEED_UDC_NUM_EP 4
+
+typedef struct AspeedUDCEP {
+ MemoryRegion mr;
+ uint32_t regs[ASPEED_UDC_EP_NR_REGS];
+ int index;
+} AspeedUDCEP;
+
+struct AspeedUDCState {
+ SysBusDevice parent_obj;
+
+ MemoryRegion udc_container;
+ MemoryRegion root_mr;
+ uint32_t regs[ASPEED_UDC_ROOT_NR_REGS];
+ AspeedUDCEP ep[ASPEED_UDC_NUM_EP];
+ qemu_irq irq;
+};
+
+#endif /* HW_USB_ASPEED_UDC_H */
diff --git a/hw/usb/aspeed-udc.c b/hw/usb/aspeed-udc.c
new file mode 100644
index 0000000000..cd773e979b
--- /dev/null
+++ b/hw/usb/aspeed-udc.c
@@ -0,0 +1,236 @@
+/*
+ * ASPEED USB Device Controller (UDC)
+ *
+ * Copyright (c) 2026 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Models the ASPEED USB Device Controller (UDC). It implements one control
+ * endpoint (EP0) and 4 programmable endpoints.
+ *
+ * This file is the system-bus side of the controller: the MMIO register map,
+ * the interrupt and the soft reset. The gadget USB device presented to a host
+ * controller (and the endpoint data path) is added on top of this.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/core/irq.h"
+#include "hw/core/registerfields.h"
+#include "hw/usb/aspeed-udc.h"
+#include "qemu/module.h"
+#include "trace.h"
+
+/* Root / Global registers (offset from the controller base) */
+REG32(UDC_FUNC_CTRL, 0x00)
+ FIELD(UDC_FUNC_CTRL, UPSTREAM_EN, 0, 1)
+REG32(UDC_IER, 0x08)
+REG32(UDC_ISR, 0x0C)
+ FIELD(UDC_ISR, EP_POOL_ACK, 16, 1)
+ FIELD(UDC_ISR, BUS_RESET, 6, 1)
+ FIELD(UDC_ISR, EP0_IN_ACK, 3, 1)
+ FIELD(UDC_ISR, EP0_OUT_ACK, 1, 1)
+ FIELD(UDC_ISR, EP0_SETUP, 0, 1)
+REG32(UDC_EP_ACK_IER, 0x10)
+REG32(UDC_EP_NAK_IER, 0x14)
+REG32(UDC_EP_ACK_ISR, 0x18)
+REG32(UDC_EP_NAK_ISR, 0x1C)
+REG32(UDC_DEV_RESET, 0x20)
+ FIELD(UDC_DEV_RESET, EP_POOL, 9, 1)
+ FIELD(UDC_DEV_RESET, DMA, 8, 1)
+ FIELD(UDC_DEV_RESET, ROOT, 0, 1)
+REG32(UDC_STS, 0x24)
+ FIELD(UDC_STS, HIGHSPEED, 27, 1)
+REG32(UDC_EP0_CTRL, 0x30)
+ FIELD(UDC_EP0_CTRL, RX_LEN, 16, 7)
+ FIELD(UDC_EP0_CTRL, TX_LEN, 8, 7)
+ FIELD(UDC_EP0_CTRL, RX_RDY, 2, 1)
+ FIELD(UDC_EP0_CTRL, TX_RDY, 1, 1)
+ FIELD(UDC_EP0_CTRL, STALL, 0, 1)
+REG32(UDC_EP0_DATA_BUFF, 0x34)
+/* EP0 SETUP packet buffer: SETUP0 = bytes 0...3, SETUP1 = bytes 4...7 */
+REG32(UDC_SETUP0, 0x80)
+REG32(UDC_SETUP1, 0x84)
+
+/* Per programmable-endpoint registers (offset from the EP register base) */
+REG32(EP_CONFIG, 0x00)
+ FIELD(EP_CONFIG, MAX_PKT, 16, 10)
+ FIELD(EP_CONFIG, EP_NUM, 8, 4)
+ FIELD(EP_CONFIG, DIR_OUT, 4, 1)
+ FIELD(EP_CONFIG, ENABLE, 0, 1)
+REG32(EP_DMA_CTRL, 0x04)
+ FIELD(EP_DMA_CTRL, PROC_STS, 4, 4)
+ FIELD(EP_DMA_CTRL, DESC_OP_EN, 0, 1)
+REG32(EP_DMA_BUFF, 0x08)
+REG32(EP_DMA_STS, 0x0C)
+ FIELD(EP_DMA_STS, PKT_SIZE, 16, 11)
+ FIELD(EP_DMA_STS, RPTR, 8, 8)
+ FIELD(EP_DMA_STS, WPTR, 0, 8)
+
+static void aspeed_udc_update_irq(AspeedUDCState *s)
+{
+ bool level;
+
+ level = (s->regs[R_UDC_ISR] & s->regs[R_UDC_IER]) ||
+ (s->regs[R_UDC_EP_ACK_ISR] & s->regs[R_UDC_EP_ACK_IER]) ||
+ (s->regs[R_UDC_EP_NAK_ISR] & s->regs[R_UDC_EP_NAK_IER]);
+
+ trace_aspeed_udc_irq(s->regs[R_UDC_ISR], s->regs[R_UDC_IER], level);
+ qemu_set_irq(s->irq, level);
+}
+
+static uint64_t aspeed_udc_read(void *opaque, hwaddr offset, unsigned size)
+{
+ AspeedUDCState *s = ASPEED_UDC(opaque);
+ uint32_t reg = offset >> 2;
+ uint32_t val;
+
+ val = s->regs[reg];
+ trace_aspeed_udc_read(offset, val);
+
+ return val;
+}
+
+static void aspeed_udc_write(void *opaque, hwaddr offset, uint64_t data,
+ unsigned size)
+{
+ AspeedUDCState *s = ASPEED_UDC(opaque);
+ uint32_t reg = offset >> 2;
+ uint32_t val = data;
+
+ trace_aspeed_udc_write(offset, val);
+
+ switch (reg) {
+ case R_UDC_IER:
+ case R_UDC_EP_ACK_IER:
+ case R_UDC_EP_NAK_IER:
+ s->regs[reg] = val;
+ aspeed_udc_update_irq(s);
+ break;
+ case R_UDC_ISR:
+ case R_UDC_EP_ACK_ISR:
+ case R_UDC_EP_NAK_ISR:
+ s->regs[reg] &= ~val;
+ aspeed_udc_update_irq(s);
+ break;
+ default:
+ s->regs[reg] = val;
+ break;
+ }
+}
+
+static const MemoryRegionOps aspeed_udc_ops = {
+ .read = aspeed_udc_read,
+ .write = aspeed_udc_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = 1,
+ .max_access_size = 4,
+ },
+ .impl = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static uint64_t aspeed_udc_ep_read(void *opaque, hwaddr offset, unsigned size)
+{
+ AspeedUDCEP *e = opaque;
+ uint32_t reg = offset >> 2;
+ uint32_t val;
+
+ val = e->regs[reg];
+ trace_aspeed_udc_ep_read(e->index, offset, val);
+
+ return val;
+}
+
+static void aspeed_udc_ep_write(void *opaque, hwaddr offset, uint64_t data,
+ unsigned size)
+{
+ AspeedUDCEP *e = opaque;
+ uint32_t reg = offset >> 2;
+
+ trace_aspeed_udc_ep_write(e->index, offset, data);
+ e->regs[reg] = data;
+}
+
+static const MemoryRegionOps aspeed_udc_ep_ops = {
+ .read = aspeed_udc_ep_read,
+ .write = aspeed_udc_ep_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = 1,
+ .max_access_size = 4,
+ },
+ .impl = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static void aspeed_udc_reset_hold(Object *obj, ResetType type)
+{
+ AspeedUDCState *s = ASPEED_UDC(obj);
+ int i;
+
+ memset(s->regs, 0, sizeof(s->regs));
+ for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
+ memset(s->ep[i].regs, 0, sizeof(s->ep[i].regs));
+ }
+
+ /* Device-reset default: root, DMA and EP-pool soft-reset bits set */
+ s->regs[R_UDC_DEV_RESET] = (R_UDC_DEV_RESET_ROOT_MASK |
+ R_UDC_DEV_RESET_DMA_MASK |
+ R_UDC_DEV_RESET_EP_POOL_MASK);
+}
+
+static void aspeed_udc_realize(DeviceState *dev, Error **errp)
+{
+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ AspeedUDCState *s = ASPEED_UDC(dev);
+ int i;
+
+ memory_region_init(&s->udc_container, OBJECT(s), TYPE_ASPEED_UDC,
+ ASPEED_UDC_MEM_SIZE);
+ memory_region_init_io(&s->root_mr, OBJECT(s), &aspeed_udc_ops, s,
+ TYPE_ASPEED_UDC ".root",
+ ASPEED_UDC_ROOT_NR_REGS << 2);
+ memory_region_add_subregion(&s->udc_container, 0, &s->root_mr);
+
+ /* Each programmable endpoint has its own register bank */
+ for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
+ g_autofree char *name = g_strdup_printf(TYPE_ASPEED_UDC ".ep%d", i);
+
+ s->ep[i].index = i;
+ memory_region_init_io(&s->ep[i].mr, OBJECT(s), &aspeed_udc_ep_ops,
+ &s->ep[i], name, ASPEED_UDC_EP_NR_REGS << 2);
+ memory_region_add_subregion(&s->udc_container,
+ ASPEED_UDC_EP_REG_BASE +
+ i * (ASPEED_UDC_EP_NR_REGS << 2),
+ &s->ep[i].mr);
+ }
+
+ sysbus_init_mmio(sbd, &s->udc_container);
+ sysbus_init_irq(sbd, &s->irq);
+}
+
+static void aspeed_udc_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+ dc->desc = "ASPEED USB Device Controller";
+ dc->realize = aspeed_udc_realize;
+ rc->phases.hold = aspeed_udc_reset_hold;
+}
+
+static const TypeInfo aspeed_udc_types[] = {
+ {
+ .name = TYPE_ASPEED_UDC,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(AspeedUDCState),
+ .class_init = aspeed_udc_class_init,
+ },
+};
+
+DEFINE_TYPES(aspeed_udc_types)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 260d2f0751..146ed1a0be 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -536,6 +536,7 @@ config ASPEED_SOC
imply GENERIC_LOADER
imply PCI_DEVICES
imply E1000E_PCI_EXPRESS
+ select ASPEED_UDC
select DS1338
select FTGMAC100
select I2C
diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index de95686720..e4df15fe7c 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -146,3 +146,6 @@ config XLNX_USB_SUBSYS
config USB_CHIPIDEA
bool
select USB_EHCI_SYSBUS
+
+config ASPEED_UDC
+ bool
diff --git a/hw/usb/meson.build b/hw/usb/meson.build
index ba55c28ef6..d4ba60a91c 100644
--- a/hw/usb/meson.build
+++ b/hw/usb/meson.build
@@ -27,6 +27,7 @@ system_ss.add(when: 'CONFIG_USB_XHCI_NEC', if_true: files('hcd-xhci-nec.c'))
system_ss.add(when: 'CONFIG_USB_DWC2', if_true: files('hcd-dwc2.c'))
system_ss.add(when: 'CONFIG_USB_DWC3', if_true: files('hcd-dwc3.c'))
system_ss.add(when: 'CONFIG_USB_CHIPIDEA', if_true: files('chipidea.c'))
+system_ss.add(when: 'CONFIG_ASPEED_UDC', if_true: files('aspeed-udc.c'))
system_ss.add(when: 'CONFIG_IMX_USBPHY', if_true: files('imx-usb-phy.c'))
system_ss.add(when: 'CONFIG_VT82C686', if_true: files('vt82c686-uhci-pci.c'))
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 67249d69c2..ed05304520 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -377,3 +377,10 @@ canokey_handle_data_out(uint8_t ep_out, uint32_t out_len) "ep %d len %d"
canokey_handle_data_in(uint8_t ep_in, uint32_t in_len) "ep %d len %d"
canokey_realize(void)
canokey_unrealize(void)
+
+# aspeed-udc.c
+aspeed_udc_read(uint64_t offset, uint32_t value) "offset 0x%" PRIx64 " value 0x%x"
+aspeed_udc_write(uint64_t offset, uint32_t value) "offset 0x%" PRIx64 " value 0x%x"
+aspeed_udc_ep_read(int ep, uint64_t offset, uint32_t value) "ep %d, offset 0x%" PRIx64 " value 0x%x"
+aspeed_udc_ep_write(int ep, uint64_t offset, uint32_t value) "ep %d, offset 0x%" PRIx64 " value 0x%x"
+aspeed_udc_irq(uint32_t isr, uint32_t ier, int level) "isr 0x%x, ier 0x%x, level %d"
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v5 2/4] hw/usb/aspeed-udc: Add ASPEED UDC gadget USB device
2026-09-02 2:15 [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Jamin Lin
2026-09-02 2:15 ` [PATCH v5 1/4] hw/usb/aspeed-udc: Add ASPEED UDC device controller Jamin Lin
@ 2026-09-02 2:15 ` Jamin Lin
2026-09-02 2:15 ` [PATCH v5 3/4] hw/usb/aspeed-udc: Add programmable endpoint DMA transfers Jamin Lin
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Jamin Lin @ 2026-09-02 2:15 UTC (permalink / raw)
To: Paolo Bonzini, Peter Maydell, Cédric Le Goater, Steven Lee,
Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
open list:ARM TCG CPUs, open list:All patches CC here
Cc: Jamin Lin, Troy Lee, Philippe Mathieu-Daudé
Present the UDC gadget side to a USB host controller as a USB device
(TYPE_ASPEED_UDC_GADGET). This is a normal QEMU USB device, so it can be
attached to any USB host controller bus, not only the BMC's own EHCI. It
links back to its controller through the "udc" property.
This patch implements the control endpoint (EP0), which is enough for the
host to enumerate the gadget. Host control transfers are handled
asynchronously: the SETUP packet is mirrored into the SETUP data buffer,
the EP0 interrupt is raised and the host packet is parked (USB_RET_ASYNC).
The guest gadget driver then drives the data and status stages by writing
UDC_EP0_CTRL; that moves data to/from the driver's DMA buffer and completes
the parked packet back to the host.
SET_ADDRESS is the exception: it is applied synchronously, because the host
controller keeps the transfer bound to address 0 until it completes.
The gadget connects to / disconnects from the host bus when the driver
sets or clears the upstream-enable (pull-up) bit, and is detached on reset.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
---
include/hw/usb/aspeed-udc.h | 28 +++
hw/usb/aspeed-udc.c | 382 +++++++++++++++++++++++++++++++++++-
hw/usb/Kconfig | 1 +
hw/usb/trace-events | 5 +
4 files changed, 413 insertions(+), 3 deletions(-)
diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
index 58fed5f9a2..ab9d016c61 100644
--- a/include/hw/usb/aspeed-udc.h
+++ b/include/hw/usb/aspeed-udc.h
@@ -10,11 +10,19 @@
#define HW_USB_ASPEED_UDC_H
#include "hw/core/sysbus.h"
+#include "hw/usb/usb.h"
#include "qom/object.h"
#define TYPE_ASPEED_UDC "aspeed.udc"
OBJECT_DECLARE_SIMPLE_TYPE(AspeedUDCState, ASPEED_UDC)
+/*
+ * The gadget side of the controller is presented to a USB host controller's
+ * bus as a single USB device that delegates back to the AspeedUDCState.
+ */
+#define TYPE_ASPEED_UDC_GADGET "aspeed.udc-gadget"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedUDCGadget, ASPEED_UDC_GADGET)
+
/*
* Register map: root/global block at 0x000 - 0x087, then one 0x10 byte bank
* per programmable endpoint from 0x200.
@@ -36,14 +44,34 @@ typedef struct AspeedUDCEP {
int index;
} AspeedUDCEP;
+struct AspeedUDCGadget {
+ USBDevice parent_obj;
+ AspeedUDCState *udc;
+};
+
struct AspeedUDCState {
SysBusDevice parent_obj;
MemoryRegion udc_container;
MemoryRegion root_mr;
+ MemoryRegion *dram_mr;
+ AddressSpace dram_as;
uint32_t regs[ASPEED_UDC_ROOT_NR_REGS];
AspeedUDCEP ep[ASPEED_UDC_NUM_EP];
qemu_irq irq;
+
+ /* gadget USB device bound to this controller (set at its realize) */
+ AspeedUDCGadget *usbgadget;
+
+ /*
+ * In-flight EP0 control transfer (host side), deferred until the guest
+ * gadget driver responds via MMIO.
+ */
+ USBPacket *ep0_packet;
+ uint32_t ep0_setup_len;
+ uint32_t ep0_offset;
+ uint8_t *ep0_data;
+ bool ep0_dir_in;
};
#endif /* HW_USB_ASPEED_UDC_H */
diff --git a/hw/usb/aspeed-udc.c b/hw/usb/aspeed-udc.c
index cd773e979b..70a2296062 100644
--- a/hw/usb/aspeed-udc.c
+++ b/hw/usb/aspeed-udc.c
@@ -8,16 +8,26 @@
* Models the ASPEED USB Device Controller (UDC). It implements one control
* endpoint (EP0) and 4 programmable endpoints.
*
- * This file is the system-bus side of the controller: the MMIO register map,
- * the interrupt and the soft reset. The gadget USB device presented to a host
- * controller (and the endpoint data path) is added on top of this.
+ * The model has two faces:
+ * - a SysBus device exposing the MMIO register interface, the interrupt and
+ * the integrated DMA engine to the guest gadget driver;
+ * - a USBDevice presented on a host controller's bus, which forwards host
+ * transactions to the guest gadget driver by raising the matching
+ * controller interrupts and completes them once the guest gadget driver
+ * responds via MMIO.
*/
#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
#include "hw/core/irq.h"
#include "hw/core/registerfields.h"
+#include "hw/core/qdev-properties.h"
#include "hw/usb/aspeed-udc.h"
#include "qemu/module.h"
+#include "qapi/error.h"
+#include "system/dma.h"
+#include "system/address-spaces.h"
#include "trace.h"
/* Root / Global registers (offset from the controller base) */
@@ -47,6 +57,7 @@ REG32(UDC_EP0_CTRL, 0x30)
FIELD(UDC_EP0_CTRL, TX_RDY, 1, 1)
FIELD(UDC_EP0_CTRL, STALL, 0, 1)
REG32(UDC_EP0_DATA_BUFF, 0x34)
+ FIELD(UDC_EP0_DATA_BUFF, BASE_ADDR, 0, 31)
/* EP0 SETUP packet buffer: SETUP0 = bytes 0...3, SETUP1 = bytes 4...7 */
REG32(UDC_SETUP0, 0x80)
REG32(UDC_SETUP1, 0x84)
@@ -66,6 +77,8 @@ REG32(EP_DMA_STS, 0x0C)
FIELD(EP_DMA_STS, RPTR, 8, 8)
FIELD(EP_DMA_STS, WPTR, 0, 8)
+#define ASPEED_UDC_EP0_MAXPKT 64
+
static void aspeed_udc_update_irq(AspeedUDCState *s)
{
bool level;
@@ -78,6 +91,176 @@ static void aspeed_udc_update_irq(AspeedUDCState *s)
qemu_set_irq(s->irq, level);
}
+static void aspeed_udc_raise_isr(AspeedUDCState *s, uint32_t mask)
+{
+ s->regs[R_UDC_ISR] |= mask;
+ aspeed_udc_update_irq(s);
+}
+
+/*
+ * System bus device: MMIO register interface (guest gadget-driver facing)
+ */
+
+/* Connect/disconnect the gadget device from the host bus */
+static void aspeed_udc_set_pullup(AspeedUDCState *s, bool on)
+{
+ USBDevice *udev;
+ Error *err = NULL;
+
+ if (!s->usbgadget) {
+ /* no gadget device bound to this controller */
+ return;
+ }
+
+ udev = USB_DEVICE(s->usbgadget);
+ if (!udev->port) {
+ /* not attached to a host controller bus */
+ return;
+ }
+
+ trace_aspeed_udc_pullup(on, udev->attached);
+ if (on && !udev->attached) {
+ usb_device_attach(udev, &err);
+ if (err) {
+ warn_report_err(err);
+ }
+ } else if (!on && udev->attached) {
+ usb_device_detach(udev);
+ }
+}
+
+/* Complete the in-flight EP0 control transfer back to the host */
+static void aspeed_udc_ep0_complete(AspeedUDCState *s, uint32_t len)
+{
+ USBPacket *p = s->ep0_packet;
+
+ if (!p) {
+ return;
+ }
+
+ s->ep0_packet = NULL;
+ p->actual_length = s->ep0_dir_in ? MIN(len, s->ep0_setup_len)
+ : s->ep0_setup_len;
+ p->status = USB_RET_SUCCESS;
+ trace_aspeed_udc_ep0_complete(s->ep0_dir_in, p->actual_length);
+ usb_generic_async_ctrl_complete(USB_DEVICE(s->usbgadget), p);
+}
+
+static void aspeed_udc_ep0_tx_ready(AspeedUDCState *s, uint32_t val)
+{
+ uint32_t txlen = FIELD_EX32(val, UDC_EP0_CTRL, TX_LEN);
+ uint32_t data_buf_addr = s->regs[R_UDC_EP0_DATA_BUFF];
+ USBPacket *p;
+ uint32_t n;
+
+ if (!s->ep0_dir_in) {
+ /* Status stage IN (zero length) for an OUT / no-data transfer */
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_IN_ACK_MASK);
+ aspeed_udc_ep0_complete(s, s->ep0_offset);
+ return;
+ }
+ /* no control transfer is waiting: nothing to send */
+ if (!s->ep0_packet) {
+ return;
+ }
+
+ /* IN data stage: copy from the guest gadget driver's DMA buffer */
+ n = MIN(txlen, s->ep0_setup_len - s->ep0_offset);
+ if (n && address_space_read(&s->dram_as, data_buf_addr,
+ MEMTXATTRS_UNSPECIFIED,
+ s->ep0_data + s->ep0_offset,
+ n) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: EP0 IN DMA read failed\n", __func__);
+ p = s->ep0_packet;
+ s->ep0_packet = NULL;
+ p->status = USB_RET_IOERROR;
+ usb_generic_async_ctrl_complete(USB_DEVICE(s->usbgadget), p);
+ return;
+ }
+ s->ep0_offset += n;
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_IN_ACK_MASK);
+ if (txlen < ASPEED_UDC_EP0_MAXPKT || s->ep0_offset >= s->ep0_setup_len) {
+ aspeed_udc_ep0_complete(s, s->ep0_offset);
+ }
+}
+
+static void aspeed_udc_ep0_rx_ready(AspeedUDCState *s)
+{
+ uint32_t data_buf_addr = s->regs[R_UDC_EP0_DATA_BUFF];
+ USBPacket *p;
+ uint32_t n;
+
+ if (s->ep0_dir_in) {
+ /* Status stage OUT (zero length) for an IN transfer */
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_OUT_ACK_MASK);
+ return;
+ }
+ /* no control transfer is waiting: nothing to receive */
+ if (!s->ep0_packet) {
+ return;
+ }
+
+ /* OUT data stage: hand host data to the guest gadget driver */
+ n = MIN(s->ep0_setup_len - s->ep0_offset, ASPEED_UDC_EP0_MAXPKT);
+ if (n && address_space_write(&s->dram_as, data_buf_addr,
+ MEMTXATTRS_UNSPECIFIED,
+ s->ep0_data + s->ep0_offset,
+ n) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: EP0 OUT DMA write failed\n", __func__);
+ p = s->ep0_packet;
+ s->ep0_packet = NULL;
+ p->status = USB_RET_IOERROR;
+ usb_generic_async_ctrl_complete(USB_DEVICE(s->usbgadget), p);
+ return;
+ }
+ s->ep0_offset += n;
+ s->regs[R_UDC_EP0_CTRL] = FIELD_DP32(s->regs[R_UDC_EP0_CTRL],
+ UDC_EP0_CTRL, RX_LEN, n);
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_OUT_ACK_MASK);
+}
+
+/*
+ * The guest gadget driver drives EP0 by writing UDC_EP0_CTRL. Translate
+ * those writes into data movement to/from the deferred host control packet
+ * plus the matching ACK interrupts the guest gadget driver expects.
+ */
+static void aspeed_udc_ep0_ctrl_write(AspeedUDCState *s, uint32_t val)
+{
+ USBPacket *p;
+
+ trace_aspeed_udc_ep0_ctrl_write(val, s->ep0_dir_in, s->ep0_offset);
+
+ if (val & R_UDC_EP0_CTRL_STALL_MASK) {
+ /* Gadget stalled EP0: fail the pending control transfer */
+ if (s->ep0_packet) {
+ p = s->ep0_packet;
+ s->ep0_packet = NULL;
+ p->status = USB_RET_STALL;
+ usb_generic_async_ctrl_complete(USB_DEVICE(s->usbgadget), p);
+ }
+ } else if (val & R_UDC_EP0_CTRL_TX_RDY_MASK) {
+ s->regs[R_UDC_EP0_CTRL] &= ~R_UDC_EP0_CTRL_TX_RDY_MASK;
+ aspeed_udc_ep0_tx_ready(s, val);
+ } else if (val & R_UDC_EP0_CTRL_RX_RDY_MASK) {
+ s->regs[R_UDC_EP0_CTRL] &= ~R_UDC_EP0_CTRL_RX_RDY_MASK;
+ aspeed_udc_ep0_rx_ready(s);
+ }
+}
+
+/* The upstream-enable bit connects/disconnects the gadget device */
+static void aspeed_udc_func_ctrl_write(AspeedUDCState *s, uint32_t val)
+{
+ bool was_on = FIELD_EX32(s->regs[R_UDC_FUNC_CTRL],
+ UDC_FUNC_CTRL, UPSTREAM_EN);
+ bool now_on = FIELD_EX32(val, UDC_FUNC_CTRL, UPSTREAM_EN);
+
+ if (now_on != was_on) {
+ aspeed_udc_set_pullup(s, now_on);
+ }
+}
+
static uint64_t aspeed_udc_read(void *opaque, hwaddr offset, unsigned size)
{
AspeedUDCState *s = ASPEED_UDC(opaque);
@@ -100,6 +283,11 @@ static void aspeed_udc_write(void *opaque, hwaddr offset, uint64_t data,
trace_aspeed_udc_write(offset, val);
switch (reg) {
+ case R_UDC_FUNC_CTRL:
+ val &= 0x000e1fff;
+ aspeed_udc_func_ctrl_write(s, val);
+ s->regs[R_UDC_FUNC_CTRL] = val;
+ break;
case R_UDC_IER:
case R_UDC_EP_ACK_IER:
case R_UDC_EP_NAK_IER:
@@ -112,6 +300,16 @@ static void aspeed_udc_write(void *opaque, hwaddr offset, uint64_t data,
s->regs[reg] &= ~val;
aspeed_udc_update_irq(s);
break;
+ case R_UDC_EP0_CTRL:
+ s->regs[reg] = val & (R_UDC_EP0_CTRL_STALL_MASK |
+ R_UDC_EP0_CTRL_TX_RDY_MASK |
+ R_UDC_EP0_CTRL_RX_RDY_MASK |
+ R_UDC_EP0_CTRL_TX_LEN_MASK);
+ aspeed_udc_ep0_ctrl_write(s, val);
+ break;
+ case R_UDC_EP0_DATA_BUFF:
+ s->regs[reg] = val & R_UDC_EP0_DATA_BUFF_BASE_ADDR_MASK;
+ break;
default:
s->regs[reg] = val;
break;
@@ -171,6 +369,7 @@ static const MemoryRegionOps aspeed_udc_ep_ops = {
static void aspeed_udc_reset_hold(Object *obj, ResetType type)
{
AspeedUDCState *s = ASPEED_UDC(obj);
+ USBDevice *udev;
int i;
memset(s->regs, 0, sizeof(s->regs));
@@ -182,6 +381,21 @@ static void aspeed_udc_reset_hold(Object *obj, ResetType type)
s->regs[R_UDC_DEV_RESET] = (R_UDC_DEV_RESET_ROOT_MASK |
R_UDC_DEV_RESET_DMA_MASK |
R_UDC_DEV_RESET_EP_POOL_MASK);
+ s->ep0_packet = NULL;
+
+ /*
+ * A guest reboot resets the controller but leaves the USB device
+ * attached to the host bus with no guest gadget driver behind it.
+ * Detach it, otherwise the rebooted host fails to re-enumerate the
+ * driverless gadget device; it re-attaches when the new driver asserts
+ * pull-up.
+ */
+ if (s->usbgadget) {
+ udev = USB_DEVICE(s->usbgadget);
+ if (udev->attached) {
+ usb_device_detach(udev);
+ }
+ }
}
static void aspeed_udc_realize(DeviceState *dev, Error **errp)
@@ -190,6 +404,12 @@ static void aspeed_udc_realize(DeviceState *dev, Error **errp)
AspeedUDCState *s = ASPEED_UDC(dev);
int i;
+ if (!s->dram_mr) {
+ error_setg(errp, TYPE_ASPEED_UDC ": 'dram' link not set");
+ return;
+ }
+ address_space_init(&s->dram_as, s->dram_mr, "dram");
+
memory_region_init(&s->udc_container, OBJECT(s), TYPE_ASPEED_UDC,
ASPEED_UDC_MEM_SIZE);
memory_region_init_io(&s->root_mr, OBJECT(s), &aspeed_udc_ops, s,
@@ -214,6 +434,20 @@ static void aspeed_udc_realize(DeviceState *dev, Error **errp)
sysbus_init_irq(sbd, &s->irq);
}
+static const Property aspeed_udc_properties[] = {
+ DEFINE_PROP_LINK("dram", AspeedUDCState, dram_mr,
+ TYPE_MEMORY_REGION, MemoryRegion *),
+};
+
+static void aspeed_udc_init(Object *obj)
+{
+ AspeedUDCState *s = ASPEED_UDC(obj);
+
+ object_property_add_link(obj, "usbgadget", TYPE_ASPEED_UDC_GADGET,
+ (Object **)&s->usbgadget,
+ object_property_allow_set_link, 0);
+}
+
static void aspeed_udc_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
@@ -222,6 +456,141 @@ static void aspeed_udc_class_init(ObjectClass *klass, const void *data)
dc->desc = "ASPEED USB Device Controller";
dc->realize = aspeed_udc_realize;
rc->phases.hold = aspeed_udc_reset_hold;
+ device_class_set_props(dc, aspeed_udc_properties);
+}
+
+/*
+ * USB device: gadget device presented on a host controller's bus
+ *
+ * These callbacks run in the context of the host controller. They translate
+ * host transactions into the controller interrupts/state the guest gadget
+ * driver expects, then defer (USB_RET_ASYNC) until the driver responds
+ * through the MMIO register interface above.
+ */
+
+static void aspeed_udc_gadget_handle_reset(USBDevice *udev)
+{
+ AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
+
+ s->ep0_packet = NULL;
+ s->ep0_offset = 0;
+ /* The EHCI host is High-Speed; advertise it to the guest gadget driver */
+ s->regs[R_UDC_STS] = R_UDC_STS_HIGHSPEED_MASK;
+ trace_aspeed_udc_reset(s->regs[R_UDC_IER]);
+ aspeed_udc_raise_isr(s, R_UDC_ISR_BUS_RESET_MASK);
+}
+
+static void aspeed_udc_gadget_handle_control(USBDevice *udev, USBPacket *p,
+ int request, int value, int index,
+ int length, uint8_t *data)
+{
+ AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
+ uint8_t req = request & 0xff;
+ uint8_t type = request >> 8;
+
+ /*
+ * Reconstruct the 8-byte SETUP packet into the SETUP data buffer where
+ * the guest gadget driver reads it from.
+ */
+ s->regs[R_UDC_SETUP0] = type | (req << 8) | ((value & 0xffff) << 16);
+ s->regs[R_UDC_SETUP1] = (index & 0xffff) | ((length & 0xffff) << 16);
+
+ /* A new SETUP clears the EP0 STALL condition */
+ s->regs[R_UDC_EP0_CTRL] &= ~R_UDC_EP0_CTRL_STALL_MASK;
+
+ s->ep0_packet = p;
+ s->ep0_data = data;
+ s->ep0_setup_len = length;
+ s->ep0_offset = 0;
+ s->ep0_dir_in = (type & USB_DIR_IN);
+
+ trace_aspeed_udc_ep0_setup(type, req, value, index, length,
+ s->ep0_dir_in, udev->addr);
+
+ /*
+ * SET_ADDRESS is delivered while the device still answers at the default
+ * address 0 and carries the new address in wValue. The host controller
+ * keeps this transfer's queue bound to address 0 until it completes, so
+ * apply the new address synchronously as the transfer completes.
+ * Completing it asynchronously (USB_RET_ASYNC) would change udev->addr
+ * while the queue is still bound to 0; the host controller sees the
+ * mismatch, tears the queue down and enumeration breaks. The guest gadget
+ * driver is still notified so its state machine advances.
+ */
+ if (type == 0 && req == USB_REQ_SET_ADDRESS) {
+ udev->addr = value;
+ s->ep0_packet = NULL;
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_SETUP_MASK);
+ p->status = USB_RET_SUCCESS;
+ return;
+ }
+
+ aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_SETUP_MASK);
+ p->status = USB_RET_ASYNC;
+}
+
+static void aspeed_udc_gadget_handle_data(USBDevice *udev, USBPacket *p)
+{
+ /* Programmable endpoint (bulk) transfers are added in a later patch. */
+ p->status = USB_RET_STALL;
+}
+
+static void aspeed_udc_gadget_cancel_packet(USBDevice *udev, USBPacket *p)
+{
+ AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
+
+ if (s->ep0_packet == p) {
+ s->ep0_packet = NULL;
+ }
+}
+
+static void aspeed_udc_gadget_realize(USBDevice *udev, Error **errp)
+{
+ AspeedUDCGadget *dev = ASPEED_UDC_GADGET(udev);
+
+ if (!dev->udc) {
+ error_setg(errp, TYPE_ASPEED_UDC_GADGET ": 'udc' link is not set");
+ return;
+ }
+ /* Bind this gadget to its controller through the link property */
+ object_property_set_link(OBJECT(dev->udc), "usbgadget", OBJECT(dev),
+ &error_abort);
+
+ udev->auto_attach = 0;
+ /* The ASPEED UDC is USB 2.0, so it only runs at High-Speed for now */
+ udev->speed = USB_SPEED_HIGH;
+ udev->speedmask = USB_SPEED_MASK_HIGH;
+}
+
+static void aspeed_udc_gadget_unrealize(USBDevice *udev)
+{
+ AspeedUDCGadget *dev = ASPEED_UDC_GADGET(udev);
+
+ if (dev->udc && dev->udc->usbgadget == dev) {
+ object_property_set_link(OBJECT(dev->udc), "usbgadget", NULL,
+ &error_abort);
+ }
+}
+
+static const Property aspeed_udc_gadget_props[] = {
+ DEFINE_PROP_LINK("udc", AspeedUDCGadget, udc, TYPE_ASPEED_UDC,
+ AspeedUDCState *),
+};
+
+static void aspeed_udc_gadget_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+
+ dc->desc = "ASPEED UDC gadget device";
+ uc->product_desc = "ASPEED UDC gadget";
+ uc->realize = aspeed_udc_gadget_realize;
+ uc->unrealize = aspeed_udc_gadget_unrealize;
+ uc->handle_reset = aspeed_udc_gadget_handle_reset;
+ uc->handle_control = aspeed_udc_gadget_handle_control;
+ uc->handle_data = aspeed_udc_gadget_handle_data;
+ uc->cancel_packet = aspeed_udc_gadget_cancel_packet;
+ device_class_set_props(dc, aspeed_udc_gadget_props);
}
static const TypeInfo aspeed_udc_types[] = {
@@ -229,8 +598,15 @@ static const TypeInfo aspeed_udc_types[] = {
.name = TYPE_ASPEED_UDC,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(AspeedUDCState),
+ .instance_init = aspeed_udc_init,
.class_init = aspeed_udc_class_init,
},
+ {
+ .name = TYPE_ASPEED_UDC_GADGET,
+ .parent = TYPE_USB_DEVICE,
+ .instance_size = sizeof(AspeedUDCGadget),
+ .class_init = aspeed_udc_gadget_class_init,
+ },
};
DEFINE_TYPES(aspeed_udc_types)
diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index e4df15fe7c..e8c00f813a 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -149,3 +149,4 @@ config USB_CHIPIDEA
config ASPEED_UDC
bool
+ select USB
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index ed05304520..098c3d6179 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -383,4 +383,9 @@ aspeed_udc_read(uint64_t offset, uint32_t value) "offset 0x%" PRIx64 " value 0x%
aspeed_udc_write(uint64_t offset, uint32_t value) "offset 0x%" PRIx64 " value 0x%x"
aspeed_udc_ep_read(int ep, uint64_t offset, uint32_t value) "ep %d, offset 0x%" PRIx64 " value 0x%x"
aspeed_udc_ep_write(int ep, uint64_t offset, uint32_t value) "ep %d, offset 0x%" PRIx64 " value 0x%x"
+aspeed_udc_pullup(int on, int attached) "on %d, attached %d"
aspeed_udc_irq(uint32_t isr, uint32_t ier, int level) "isr 0x%x, ier 0x%x, level %d"
+aspeed_udc_reset(uint32_t ier) "bus reset, ier 0x%x"
+aspeed_udc_ep0_setup(uint8_t type, uint8_t req, uint16_t value, uint16_t index, uint16_t length, int dir_in, int addr) "bmRequestType 0x%02x, bRequest 0x%02x, wValue 0x%04x, wIndex 0x%04x, wLength %d, dir_in %d, addr %d"
+aspeed_udc_ep0_ctrl_write(uint32_t val, int dir_in, uint32_t offset) "val 0x%x, dir_in %d, off %u"
+aspeed_udc_ep0_complete(int dir_in, int actual) "dir_in %d, actual %d"
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v5 3/4] hw/usb/aspeed-udc: Add programmable endpoint DMA transfers
2026-09-02 2:15 [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Jamin Lin
2026-09-02 2:15 ` [PATCH v5 1/4] hw/usb/aspeed-udc: Add ASPEED UDC device controller Jamin Lin
2026-09-02 2:15 ` [PATCH v5 2/4] hw/usb/aspeed-udc: Add ASPEED UDC gadget USB device Jamin Lin
@ 2026-09-02 2:15 ` Jamin Lin
2026-09-02 5:45 ` Cédric Le Goater
2026-09-02 2:15 ` [PATCH v5 4/4] hw/arm/aspeed_ast2600: Wire up the UDC Jamin Lin
2026-09-02 6:10 ` [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Cédric Le Goater
4 siblings, 1 reply; 7+ messages in thread
From: Jamin Lin @ 2026-09-02 2:15 UTC (permalink / raw)
To: Paolo Bonzini, Peter Maydell, Cédric Le Goater, Steven Lee,
Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
open list:ARM TCG CPUs, open list:All patches CC here
Cc: Jamin Lin, Troy Lee
Add the bulk data plane for the four programmable endpoints. The gadget
driver queues IN data through the descriptor-list DMA ring and arms OUT
buffers through the single-stage DMA registers; host bulk transactions
are served from / delivered into those.
The DMA mode is taken from EP_DMA_CTRL.DESC_OP_EN: IN endpoints use the
descriptor-list ring, OUT endpoints use single-stage buffers.
A transfer larger than one host packet is served across several polls,
with the host packet parked (USB_RET_ASYNC) until the gadget queues (IN)
or arms (OUT) more data, then completed from the matching DMA kick.
With this the gadget data endpoints work, e.g. a mass-storage gadget can
be enumerated and read/written end to end.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/usb/aspeed-udc.h | 8 +
hw/usb/aspeed-udc.c | 456 +++++++++++++++++++++++++++++++++++-
hw/usb/trace-events | 4 +
3 files changed, 463 insertions(+), 5 deletions(-)
diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
index ab9d016c61..7701c1aa34 100644
--- a/include/hw/usb/aspeed-udc.h
+++ b/include/hw/usb/aspeed-udc.h
@@ -42,6 +42,14 @@ typedef struct AspeedUDCEP {
MemoryRegion mr;
uint32_t regs[ASPEED_UDC_EP_NR_REGS];
int index;
+
+ /*
+ * host packet parked until the guest gadget driver queues (IN) or
+ * arms (OUT) data
+ */
+ USBPacket *pkt;
+ /* bytes of the current IN descriptor already served */
+ uint32_t desc_off;
} AspeedUDCEP;
struct AspeedUDCGadget {
diff --git a/hw/usb/aspeed-udc.c b/hw/usb/aspeed-udc.c
index 70a2296062..4c90b4f4c2 100644
--- a/hw/usb/aspeed-udc.c
+++ b/hw/usb/aspeed-udc.c
@@ -72,12 +72,37 @@ REG32(EP_DMA_CTRL, 0x04)
FIELD(EP_DMA_CTRL, PROC_STS, 4, 4)
FIELD(EP_DMA_CTRL, DESC_OP_EN, 0, 1)
REG32(EP_DMA_BUFF, 0x08)
+ FIELD(EP_DMA_BUFF, BASE_ADDR, 0, 31)
REG32(EP_DMA_STS, 0x0C)
FIELD(EP_DMA_STS, PKT_SIZE, 16, 11)
FIELD(EP_DMA_STS, RPTR, 8, 8)
FIELD(EP_DMA_STS, WPTR, 0, 8)
-#define ASPEED_UDC_EP0_MAXPKT 64
+#define ASPEED_UDC_EP0_MAXPKT 64
+#define ASPEED_UDC_EP_MAXPKT 1024
+
+/* DMA descriptor ring (256-stage mode) and descriptor data limits */
+#define ASPEED_UDC_DESCS_COUNT 256
+#define ASPEED_UDC_DESC_MAX_LEN 4096
+
+/* DMA processing-status idle codes */
+#define EP_DMA_CTRL_STS_RX_IDLE 0x0
+#define EP_DMA_CTRL_STS_TX_IDLE 0x8
+
+/* DMA descriptor (DES1) fields, in guest memory */
+#define ASPEED_EP_DESC1_IN_LEN(ctrl) ((ctrl) & 0x1fff)
+/* interrupt-on-completion */
+#define ASPEED_EP_DESC1_INTR BIT(31)
+
+/* Result of moving a host data packet through an endpoint's DMA */
+typedef enum {
+ /* whole packet transferred */
+ ASPEED_UDC_XFER_DONE,
+ /* not finished, keep parked */
+ ASPEED_UDC_XFER_MORE,
+ /* DMA failed */
+ ASPEED_UDC_XFER_ERROR,
+} AspeedUDCXferResult;
static void aspeed_udc_update_irq(AspeedUDCState *s)
{
@@ -97,6 +122,14 @@ static void aspeed_udc_raise_isr(AspeedUDCState *s, uint32_t mask)
aspeed_udc_update_irq(s);
}
+static void aspeed_udc_raise_ep_ack(AspeedUDCState *s, int ep)
+{
+ trace_aspeed_udc_ep_ack(ep);
+ s->regs[R_UDC_EP_ACK_ISR] |= BIT(ep);
+ s->regs[R_UDC_ISR] |= R_UDC_ISR_EP_POOL_ACK_MASK;
+ aspeed_udc_update_irq(s);
+}
+
/*
* System bus device: MMIO register interface (guest gadget-driver facing)
*/
@@ -330,6 +363,287 @@ static const MemoryRegionOps aspeed_udc_ops = {
},
};
+/*
+ * Copy len bytes from guest memory at addr into the IN packet, going through
+ * a bounce buffer one buf-full at a time. Returns false on DMA failure.
+ */
+static bool aspeed_udc_ep_copy_to_pkt(AspeedUDCState *s, int ep, uint32_t addr,
+ uint32_t len, USBPacket *p)
+{
+ uint8_t buf[ASPEED_UDC_EP_MAXPKT];
+ uint32_t copied = 0;
+ uint32_t seg;
+
+ while (copied < len) {
+ seg = MIN(len - copied, sizeof(buf));
+ if (address_space_read(&s->dram_as, addr + copied,
+ MEMTXATTRS_UNSPECIFIED, buf, seg) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: ep %d IN data DMA read failed\n", __func__,
+ ep);
+ return false;
+ }
+ usb_packet_copy(p, buf, seg);
+ copied += seg;
+ }
+
+ return true;
+}
+
+/*
+ * IN transfer: send data to the host by filling its IN packet from the
+ * buffers the guest gadget driver queued in the descriptor ring (from the
+ * read pointer to the write pointer).
+ *
+ * One host packet can be bigger than one descriptor's buffer, so we copy from
+ * several descriptors in a row until the packet is full or the ring is empty.
+ * If a descriptor is too big for the space left in the packet, we copy only
+ * part of it now and copy the rest on the next call; desc_off remembers how
+ * far we got. We move the read pointer to the next descriptor only after a
+ * descriptor is fully copied, so the guest gadget driver can read the pointer
+ * and see how much was sent.
+ *
+ * This function raises the endpoint ACK by itself when the ring becomes empty
+ * or when a descriptor asks for an interrupt.
+ */
+static AspeedUDCXferResult aspeed_udc_ep_xfer_in(AspeedUDCState *s, int ep,
+ USBPacket *p)
+{
+ QEMUIOVector *pktiov = p->combined ? &p->combined->iov : &p->iov;
+ AspeedUDCEP *e = &s->ep[ep];
+ uint32_t mps = FIELD_EX32(e->regs[R_EP_CONFIG], EP_CONFIG, MAX_PKT);
+ uint32_t wptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR);
+ uint32_t rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
+ uint32_t desc_base = e->regs[R_EP_DMA_BUFF];
+ uint32_t desc_addr;
+ uint32_t remaining;
+ uint32_t desc_ctrl;
+ uint32_t pkt_space;
+ /* des_0: data buffer base address, des_1: control/status */
+ uint32_t desc[2];
+ uint32_t offset;
+ uint32_t chunk;
+ uint32_t dlen;
+ bool done = false;
+ bool ack = false;
+
+ if (mps == 0) {
+ /* a MAX_PKT field of 0 means the maximum packet size */
+ mps = ASPEED_UDC_EP_MAXPKT;
+ }
+
+ trace_aspeed_udc_ep_data_in(ep, rptr, wptr, pktiov->size);
+
+ /* walk the queued descriptors, filling the packet */
+ while (rptr != wptr) {
+ if (address_space_read(&s->dram_as, desc_base + rptr * sizeof(desc),
+ MEMTXATTRS_UNSPECIFIED, desc,
+ sizeof(desc)) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: ep %d descriptor DMA read failed\n",
+ __func__, ep);
+ return ASPEED_UDC_XFER_ERROR;
+ }
+ desc_addr = le32_to_cpu(desc[0]) & R_EP_DMA_BUFF_BASE_ADDR_MASK;
+ desc_ctrl = le32_to_cpu(desc[1]);
+ dlen = ASPEED_EP_DESC1_IN_LEN(desc_ctrl);
+ offset = e->desc_off;
+ /* how much to copy: min(descriptor bytes left, packet space left) */
+ remaining = dlen > offset ? dlen - offset : 0;
+ pkt_space = pktiov->size > (uint32_t)p->actual_length ?
+ pktiov->size - (uint32_t)p->actual_length : 0;
+ chunk = MIN(remaining, pkt_space);
+
+ if (!aspeed_udc_ep_copy_to_pkt(s, ep, desc_addr + offset, chunk, p)) {
+ return ASPEED_UDC_XFER_ERROR;
+ }
+ e->desc_off += chunk;
+
+ if (e->desc_off < dlen) {
+ /*
+ * The packet ran out of space in the middle of this descriptor,
+ * so only part of it was copied. Stop here, and leave the read
+ * pointer on this descriptor: the next call resumes copying the
+ * rest (desc_off remembers how far we got).
+ */
+ done = true;
+ break;
+ }
+
+ /*
+ * This descriptor was copied in full. Advance the read pointer to the
+ * next descriptor and reset desc_off so it starts from the beginning.
+ */
+ rptr = (rptr + 1) % ASPEED_UDC_DESCS_COUNT;
+ e->desc_off = 0;
+ if (desc_ctrl & ASPEED_EP_DESC1_INTR) {
+ ack = true;
+ }
+ /*
+ * This descriptor is shorter than the max packet size, i.e. a short
+ * (or zero-length) packet. In USB that marks the end of the transfer,
+ * so stop here.
+ */
+ if (dlen < mps) {
+ done = true;
+ break;
+ }
+ /*
+ * The packet is now completely full, so the host has received all the
+ * data it asked for. Stop here.
+ */
+ if ((uint32_t)p->actual_length >= pktiov->size) {
+ done = true;
+ break;
+ }
+ }
+
+ e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS], EP_DMA_STS,
+ RPTR, rptr);
+ e->regs[R_EP_DMA_CTRL] = FIELD_DP32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL,
+ PROC_STS, EP_DMA_CTRL_STS_TX_IDLE);
+ /* The guest gadget driver completes its request when the ring drains */
+ if (rptr == wptr) {
+ ack = true;
+ }
+ if (ack) {
+ aspeed_udc_raise_ep_ack(s, ep);
+ }
+
+ return done ? ASPEED_UDC_XFER_DONE : ASPEED_UDC_XFER_MORE;
+}
+
+/*
+ * OUT transfer: receive data from the host by copying its OUT packet into the
+ * buffer the guest gadget driver set up (single-stage mode).
+ *
+ * A host packet can be bigger than one buffer, so we copy at most PKT_SIZE
+ * bytes per call, continuing from where the last call stopped
+ * (p->actual_length). The caller keeps the packet parked until it is fully
+ * copied.
+ */
+static AspeedUDCXferResult aspeed_udc_ep_xfer_out(AspeedUDCState *s, int ep,
+ USBPacket *p)
+{
+ AspeedUDCEP *e = &s->ep[ep];
+ uint32_t chunk = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, PKT_SIZE);
+ uint32_t remaining = p->iov.size - (uint32_t)p->actual_length;
+ uint32_t data_buf_addr = e->regs[R_EP_DMA_BUFF];
+ uint32_t len = MIN(remaining, chunk);
+ g_autofree uint8_t *buf = g_malloc(len);
+
+ if (data_buf_addr && len) {
+ usb_packet_copy(p, buf, len);
+ if (address_space_write(&s->dram_as, data_buf_addr,
+ MEMTXATTRS_UNSPECIFIED, buf,
+ len) != MEMTX_OK) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: ep %d OUT data DMA write failed\n",
+ __func__, ep);
+ return ASPEED_UDC_XFER_ERROR;
+ }
+ }
+
+ e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS],
+ EP_DMA_STS, PKT_SIZE, len);
+ e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS],
+ EP_DMA_STS, WPTR, 0);
+ e->regs[R_EP_DMA_CTRL] = FIELD_DP32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL,
+ PROC_STS, EP_DMA_CTRL_STS_RX_IDLE);
+ aspeed_udc_raise_ep_ack(s, ep);
+
+ if ((uint32_t)p->actual_length >= p->iov.size) {
+ return ASPEED_UDC_XFER_DONE;
+ }
+
+ return ASPEED_UDC_XFER_MORE;
+}
+
+/*
+ * IN kick: the guest gadget driver wrote EP_DMA_STS to tell us it queued more
+ * IN data to send to the host. If a host IN request is already waiting
+ * (parked because there was no data before), send the data now and finish it.
+ * If the request needs more data than was queued, keep it parked and wait for
+ * the next kick.
+ */
+static void aspeed_udc_ep_in_kick(AspeedUDCState *s, int ep, uint32_t val)
+{
+ AspeedUDCEP *e = &s->ep[ep];
+ uint32_t cur_rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
+ uint32_t new_rptr = FIELD_EX32(val, EP_DMA_STS, RPTR);
+ uint32_t new_wptr = FIELD_EX32(val, EP_DMA_STS, WPTR);
+ USBPacket *p = e->pkt;
+
+ /*
+ * A normal kick only sets the write pointer and leaves the read-pointer
+ * field 0 (the read pointer is ours to advance). The guest resets the ring
+ * by writing a read pointer that is non-zero and equal to the write
+ * pointer.
+ *
+ * We check non-zero as well as equal: on a normal kick whose write pointer
+ * just wrapped back to 0, both fields would be 0, so an "equal" test alone
+ * would look like a reset by mistake.
+ */
+ if (new_rptr != 0 && new_rptr == new_wptr) {
+ cur_rptr = new_rptr;
+ e->desc_off = 0;
+ }
+ /* store the guest's write, but keep our own read pointer */
+ e->regs[R_EP_DMA_STS] = FIELD_DP32(val, EP_DMA_STS, RPTR, cur_rptr);
+
+ /* nothing to do unless an IN packet is waiting and the ring has data */
+ if (!p || cur_rptr == new_wptr) {
+ return;
+ }
+
+ switch (aspeed_udc_ep_xfer_in(s, ep, p)) {
+ case ASPEED_UDC_XFER_DONE:
+ e->pkt = NULL;
+ p->status = USB_RET_SUCCESS;
+ usb_packet_complete(USB_DEVICE(s->usbgadget), p);
+ break;
+ case ASPEED_UDC_XFER_ERROR:
+ e->pkt = NULL;
+ p->status = USB_RET_IOERROR;
+ usb_packet_complete(USB_DEVICE(s->usbgadget), p);
+ break;
+ case ASPEED_UDC_XFER_MORE:
+ break;
+ }
+}
+
+/*
+ * OUT kick: the guest gadget driver wrote EP_DMA_STS to give us a buffer for
+ * OUT data. If an OUT packet is already waiting (parked because there was no
+ * buffer before), copy its data into the buffer now and finish it. If the
+ * packet has more data than fits, keep it parked and wait for the next buffer.
+ */
+static void aspeed_udc_ep_out_kick(AspeedUDCState *s, int ep)
+{
+ AspeedUDCEP *e = &s->ep[ep];
+ USBPacket *p = e->pkt;
+
+ /* nothing to do unless an OUT packet is waiting and a buffer is ready */
+ if (!p || !FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR)) {
+ return;
+ }
+
+ switch (aspeed_udc_ep_xfer_out(s, ep, p)) {
+ case ASPEED_UDC_XFER_DONE:
+ e->pkt = NULL;
+ p->status = USB_RET_SUCCESS;
+ usb_packet_complete(USB_DEVICE(s->usbgadget), p);
+ break;
+ case ASPEED_UDC_XFER_ERROR:
+ e->pkt = NULL;
+ p->status = USB_RET_IOERROR;
+ usb_packet_complete(USB_DEVICE(s->usbgadget), p);
+ break;
+ case ASPEED_UDC_XFER_MORE:
+ break;
+ }
+}
+
static uint64_t aspeed_udc_ep_read(void *opaque, hwaddr offset, unsigned size)
{
AspeedUDCEP *e = opaque;
@@ -346,10 +660,31 @@ static void aspeed_udc_ep_write(void *opaque, hwaddr offset, uint64_t data,
unsigned size)
{
AspeedUDCEP *e = opaque;
+ AspeedUDCState *s = container_of(e - e->index, AspeedUDCState, ep[0]);
uint32_t reg = offset >> 2;
+ uint32_t val = data;
- trace_aspeed_udc_ep_write(e->index, offset, data);
- e->regs[reg] = data;
+ trace_aspeed_udc_ep_write(e->index, offset, val);
+
+ switch (reg) {
+ case R_EP_DMA_BUFF:
+ e->regs[reg] = val & R_EP_DMA_BUFF_BASE_ADDR_MASK;
+ break;
+ case R_EP_DMA_STS:
+ val &= 0x77ffffff;
+ if (FIELD_EX32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL, DESC_OP_EN)) {
+ /* IN, descriptor-list mode */
+ aspeed_udc_ep_in_kick(s, e->index, val);
+ } else {
+ /* OUT, single-stage mode */
+ e->regs[reg] = val;
+ aspeed_udc_ep_out_kick(s, e->index);
+ }
+ break;
+ default:
+ e->regs[reg] = val;
+ break;
+ }
}
static const MemoryRegionOps aspeed_udc_ep_ops = {
@@ -375,6 +710,8 @@ static void aspeed_udc_reset_hold(Object *obj, ResetType type)
memset(s->regs, 0, sizeof(s->regs));
for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
memset(s->ep[i].regs, 0, sizeof(s->ep[i].regs));
+ s->ep[i].pkt = NULL;
+ s->ep[i].desc_off = 0;
}
/* Device-reset default: root, DMA and EP-pool soft-reset bits set */
@@ -468,6 +805,95 @@ static void aspeed_udc_class_init(ObjectClass *klass, const void *data)
* through the MMIO register interface above.
*/
+static int aspeed_udc_find_ep(AspeedUDCState *s, int ep_nr, bool is_out)
+{
+ uint32_t cfg;
+ int i;
+
+ for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
+ cfg = s->ep[i].regs[R_EP_CONFIG];
+
+ if (!FIELD_EX32(cfg, EP_CONFIG, ENABLE) ||
+ FIELD_EX32(cfg, EP_CONFIG, EP_NUM) != ep_nr) {
+ continue;
+ }
+ if (FIELD_EX32(cfg, EP_CONFIG, DIR_OUT) == is_out) {
+ return i;
+ }
+ }
+
+ return -1;
+}
+
+static void aspeed_udc_ep_data_in(AspeedUDCState *s, int ep, USBPacket *p)
+{
+ AspeedUDCEP *e = &s->ep[ep];
+ uint32_t rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
+ uint32_t wptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR);
+
+ if (rptr == wptr) {
+ /*
+ * No IN data is queued yet. Save the packet and return ASYNC
+ * instead of NAK. A NAK would make the host retry slowly.
+ * aspeed_udc_ep_in_kick() serves and completes this packet later,
+ * once the guest gadget driver queues descriptors.
+ */
+ e->pkt = p;
+ p->status = USB_RET_ASYNC;
+ return;
+ }
+
+ switch (aspeed_udc_ep_xfer_in(s, ep, p)) {
+ case ASPEED_UDC_XFER_DONE:
+ p->status = USB_RET_SUCCESS;
+ break;
+ case ASPEED_UDC_XFER_MORE:
+ /* not fully sent yet: save the packet, wait for more descriptors */
+ e->pkt = p;
+ p->status = USB_RET_ASYNC;
+ break;
+ case ASPEED_UDC_XFER_ERROR:
+ p->status = USB_RET_IOERROR;
+ break;
+ }
+}
+
+static void aspeed_udc_ep_data_out(AspeedUDCState *s, int ep, USBPacket *p)
+{
+ AspeedUDCEP *e = &s->ep[ep];
+ uint32_t sts = e->regs[R_EP_DMA_STS];
+
+ trace_aspeed_udc_ep_data_out(ep, FIELD_EX32(sts, EP_DMA_STS, WPTR),
+ FIELD_EX32(sts, EP_DMA_STS, PKT_SIZE),
+ p->iov.size);
+ if (!FIELD_EX32(sts, EP_DMA_STS, WPTR)) {
+ /*
+ * No OUT buffer is ready yet. Save the packet and return ASYNC
+ * instead of NAK. Writing now could use an old buffer address and
+ * lose the data (for example a mass-storage CBW). A NAK would make
+ * the host retry slowly. aspeed_udc_ep_out_kick() delivers this
+ * packet later, once the guest gadget driver sets up a buffer.
+ */
+ e->pkt = p;
+ p->status = USB_RET_ASYNC;
+ return;
+ }
+
+ switch (aspeed_udc_ep_xfer_out(s, ep, p)) {
+ case ASPEED_UDC_XFER_DONE:
+ p->status = USB_RET_SUCCESS;
+ break;
+ case ASPEED_UDC_XFER_MORE:
+ /* not fully received yet: save the packet, wait for the next buffer */
+ e->pkt = p;
+ p->status = USB_RET_ASYNC;
+ break;
+ case ASPEED_UDC_XFER_ERROR:
+ p->status = USB_RET_IOERROR;
+ break;
+ }
+}
+
static void aspeed_udc_gadget_handle_reset(USBDevice *udev)
{
AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
@@ -531,17 +957,37 @@ static void aspeed_udc_gadget_handle_control(USBDevice *udev, USBPacket *p,
static void aspeed_udc_gadget_handle_data(USBDevice *udev, USBPacket *p)
{
- /* Programmable endpoint (bulk) transfers are added in a later patch. */
- p->status = USB_RET_STALL;
+ AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
+ bool is_out = (p->pid == USB_TOKEN_OUT);
+ int ep = aspeed_udc_find_ep(s, p->ep->nr, is_out);
+
+ trace_aspeed_udc_handle_data(p->ep->nr, is_out ? "OUT" : "IN",
+ p->iov.size, ep);
+ if (ep < 0) {
+ p->status = USB_RET_STALL;
+ return;
+ }
+
+ if (is_out) {
+ aspeed_udc_ep_data_out(s, ep, p);
+ } else {
+ aspeed_udc_ep_data_in(s, ep, p);
+ }
}
static void aspeed_udc_gadget_cancel_packet(USBDevice *udev, USBPacket *p)
{
AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
+ int i;
if (s->ep0_packet == p) {
s->ep0_packet = NULL;
}
+ for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
+ if (s->ep[i].pkt == p) {
+ s->ep[i].pkt = NULL;
+ }
+ }
}
static void aspeed_udc_gadget_realize(USBDevice *udev, Error **errp)
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 098c3d6179..80ead23358 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -389,3 +389,7 @@ aspeed_udc_reset(uint32_t ier) "bus reset, ier 0x%x"
aspeed_udc_ep0_setup(uint8_t type, uint8_t req, uint16_t value, uint16_t index, uint16_t length, int dir_in, int addr) "bmRequestType 0x%02x, bRequest 0x%02x, wValue 0x%04x, wIndex 0x%04x, wLength %d, dir_in %d, addr %d"
aspeed_udc_ep0_ctrl_write(uint32_t val, int dir_in, uint32_t offset) "val 0x%x, dir_in %d, off %u"
aspeed_udc_ep0_complete(int dir_in, int actual) "dir_in %d, actual %d"
+aspeed_udc_handle_data(int ep_nr, const char *dir, uint32_t iov, int ep_idx) "ep_nr %d, %s, iov %u, ep_idx %d"
+aspeed_udc_ep_data_in(unsigned ep, uint32_t rptr, uint32_t wptr, uint32_t iov) "ep %u, rptr %u, wptr %u, iov %u"
+aspeed_udc_ep_data_out(unsigned ep, uint32_t wptr, uint32_t avail, uint32_t iov) "ep %u, wptr %u, avail %u, iov %u"
+aspeed_udc_ep_ack(unsigned ep) "ep %u"
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v5 3/4] hw/usb/aspeed-udc: Add programmable endpoint DMA transfers
2026-09-02 2:15 ` [PATCH v5 3/4] hw/usb/aspeed-udc: Add programmable endpoint DMA transfers Jamin Lin
@ 2026-09-02 5:45 ` Cédric Le Goater
0 siblings, 0 replies; 7+ messages in thread
From: Cédric Le Goater @ 2026-09-02 5:45 UTC (permalink / raw)
To: Jamin Lin, Paolo Bonzini, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, open list:ARM TCG CPUs,
open list:All patches CC here
Cc: Troy Lee
On 9/2/26 04:15, Jamin Lin wrote:
> Add the bulk data plane for the four programmable endpoints. The gadget
> driver queues IN data through the descriptor-list DMA ring and arms OUT
> buffers through the single-stage DMA registers; host bulk transactions
> are served from / delivered into those.
>
> The DMA mode is taken from EP_DMA_CTRL.DESC_OP_EN: IN endpoints use the
> descriptor-list ring, OUT endpoints use single-stage buffers.
>
> A transfer larger than one host packet is served across several polls,
> with the host packet parked (USB_RET_ASYNC) until the gadget queues (IN)
> or arms (OUT) more data, then completed from the matching DMA kick.
>
> With this the gadget data endpoints work, e.g. a mass-storage gadget can
> be enumerated and read/written end to end.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/usb/aspeed-udc.h | 8 +
> hw/usb/aspeed-udc.c | 456 +++++++++++++++++++++++++++++++++++-
> hw/usb/trace-events | 4 +
> 3 files changed, 463 insertions(+), 5 deletions(-)
>
> diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
> index ab9d016c61..7701c1aa34 100644
> --- a/include/hw/usb/aspeed-udc.h
> +++ b/include/hw/usb/aspeed-udc.h
> @@ -42,6 +42,14 @@ typedef struct AspeedUDCEP {
> MemoryRegion mr;
> uint32_t regs[ASPEED_UDC_EP_NR_REGS];
> int index;
> +
> + /*
> + * host packet parked until the guest gadget driver queues (IN) or
> + * arms (OUT) data
> + */
> + USBPacket *pkt;
> + /* bytes of the current IN descriptor already served */
> + uint32_t desc_off;
> } AspeedUDCEP;
>
> struct AspeedUDCGadget {
> diff --git a/hw/usb/aspeed-udc.c b/hw/usb/aspeed-udc.c
> index 70a2296062..4c90b4f4c2 100644
> --- a/hw/usb/aspeed-udc.c
> +++ b/hw/usb/aspeed-udc.c
> @@ -72,12 +72,37 @@ REG32(EP_DMA_CTRL, 0x04)
> FIELD(EP_DMA_CTRL, PROC_STS, 4, 4)
> FIELD(EP_DMA_CTRL, DESC_OP_EN, 0, 1)
> REG32(EP_DMA_BUFF, 0x08)
> + FIELD(EP_DMA_BUFF, BASE_ADDR, 0, 31)
> REG32(EP_DMA_STS, 0x0C)
> FIELD(EP_DMA_STS, PKT_SIZE, 16, 11)
> FIELD(EP_DMA_STS, RPTR, 8, 8)
> FIELD(EP_DMA_STS, WPTR, 0, 8)
>
> -#define ASPEED_UDC_EP0_MAXPKT 64
> +#define ASPEED_UDC_EP0_MAXPKT 64
> +#define ASPEED_UDC_EP_MAXPKT 1024
> +
> +/* DMA descriptor ring (256-stage mode) and descriptor data limits */
> +#define ASPEED_UDC_DESCS_COUNT 256
> +#define ASPEED_UDC_DESC_MAX_LEN 4096
> +
> +/* DMA processing-status idle codes */
> +#define EP_DMA_CTRL_STS_RX_IDLE 0x0
> +#define EP_DMA_CTRL_STS_TX_IDLE 0x8
> +
> +/* DMA descriptor (DES1) fields, in guest memory */
> +#define ASPEED_EP_DESC1_IN_LEN(ctrl) ((ctrl) & 0x1fff)
> +/* interrupt-on-completion */
> +#define ASPEED_EP_DESC1_INTR BIT(31)
> +
> +/* Result of moving a host data packet through an endpoint's DMA */
> +typedef enum {
> + /* whole packet transferred */
> + ASPEED_UDC_XFER_DONE,
> + /* not finished, keep parked */
> + ASPEED_UDC_XFER_MORE,
> + /* DMA failed */
> + ASPEED_UDC_XFER_ERROR,
> +} AspeedUDCXferResult;
>
> static void aspeed_udc_update_irq(AspeedUDCState *s)
> {
> @@ -97,6 +122,14 @@ static void aspeed_udc_raise_isr(AspeedUDCState *s, uint32_t mask)
> aspeed_udc_update_irq(s);
> }
>
> +static void aspeed_udc_raise_ep_ack(AspeedUDCState *s, int ep)
> +{
> + trace_aspeed_udc_ep_ack(ep);
> + s->regs[R_UDC_EP_ACK_ISR] |= BIT(ep);
> + s->regs[R_UDC_ISR] |= R_UDC_ISR_EP_POOL_ACK_MASK;
> + aspeed_udc_update_irq(s);
> +}
> +
> /*
> * System bus device: MMIO register interface (guest gadget-driver facing)
> */
> @@ -330,6 +363,287 @@ static const MemoryRegionOps aspeed_udc_ops = {
> },
> };
>
> +/*
> + * Copy len bytes from guest memory at addr into the IN packet, going through
> + * a bounce buffer one buf-full at a time. Returns false on DMA failure.
> + */
> +static bool aspeed_udc_ep_copy_to_pkt(AspeedUDCState *s, int ep, uint32_t addr,
> + uint32_t len, USBPacket *p)
> +{
> + uint8_t buf[ASPEED_UDC_EP_MAXPKT];
> + uint32_t copied = 0;
> + uint32_t seg;
> +
> + while (copied < len) {
> + seg = MIN(len - copied, sizeof(buf));
> + if (address_space_read(&s->dram_as, addr + copied,
> + MEMTXATTRS_UNSPECIFIED, buf, seg) != MEMTX_OK) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: ep %d IN data DMA read failed\n", __func__,
> + ep);
> + return false;
> + }
> + usb_packet_copy(p, buf, seg);
> + copied += seg;
> + }
> +
> + return true;
> +}
> +
> +/*
> + * IN transfer: send data to the host by filling its IN packet from the
> + * buffers the guest gadget driver queued in the descriptor ring (from the
> + * read pointer to the write pointer).
> + *
> + * One host packet can be bigger than one descriptor's buffer, so we copy from
> + * several descriptors in a row until the packet is full or the ring is empty.
> + * If a descriptor is too big for the space left in the packet, we copy only
> + * part of it now and copy the rest on the next call; desc_off remembers how
> + * far we got. We move the read pointer to the next descriptor only after a
> + * descriptor is fully copied, so the guest gadget driver can read the pointer
> + * and see how much was sent.
> + *
> + * This function raises the endpoint ACK by itself when the ring becomes empty
> + * or when a descriptor asks for an interrupt.
> + */
> +static AspeedUDCXferResult aspeed_udc_ep_xfer_in(AspeedUDCState *s, int ep,
> + USBPacket *p)
> +{
> + QEMUIOVector *pktiov = p->combined ? &p->combined->iov : &p->iov;
> + AspeedUDCEP *e = &s->ep[ep];
> + uint32_t mps = FIELD_EX32(e->regs[R_EP_CONFIG], EP_CONFIG, MAX_PKT);
> + uint32_t wptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR);
> + uint32_t rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
> + uint32_t desc_base = e->regs[R_EP_DMA_BUFF];
> + uint32_t desc_addr;
> + uint32_t remaining;
> + uint32_t desc_ctrl;
> + uint32_t pkt_space;
> + /* des_0: data buffer base address, des_1: control/status */
> + uint32_t desc[2];
> + uint32_t offset;
> + uint32_t chunk;
> + uint32_t dlen;
> + bool done = false;
> + bool ack = false;
> +
> + if (mps == 0) {
> + /* a MAX_PKT field of 0 means the maximum packet size */
> + mps = ASPEED_UDC_EP_MAXPKT;
> + }
> +
> + trace_aspeed_udc_ep_data_in(ep, rptr, wptr, pktiov->size);
> +
> + /* walk the queued descriptors, filling the packet */
> + while (rptr != wptr) {
> + if (address_space_read(&s->dram_as, desc_base + rptr * sizeof(desc),
> + MEMTXATTRS_UNSPECIFIED, desc,
> + sizeof(desc)) != MEMTX_OK) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: ep %d descriptor DMA read failed\n",
> + __func__, ep);
> + return ASPEED_UDC_XFER_ERROR;
> + }
> + desc_addr = le32_to_cpu(desc[0]) & R_EP_DMA_BUFF_BASE_ADDR_MASK;
> + desc_ctrl = le32_to_cpu(desc[1]);
> + dlen = ASPEED_EP_DESC1_IN_LEN(desc_ctrl);
> + offset = e->desc_off;
> + /* how much to copy: min(descriptor bytes left, packet space left) */
> + remaining = dlen > offset ? dlen - offset : 0;
> + pkt_space = pktiov->size > (uint32_t)p->actual_length ?
> + pktiov->size - (uint32_t)p->actual_length : 0;
> + chunk = MIN(remaining, pkt_space);
> +
> + if (!aspeed_udc_ep_copy_to_pkt(s, ep, desc_addr + offset, chunk, p)) {
> + return ASPEED_UDC_XFER_ERROR;
> + }
> + e->desc_off += chunk;
> +
> + if (e->desc_off < dlen) {
> + /*
> + * The packet ran out of space in the middle of this descriptor,
> + * so only part of it was copied. Stop here, and leave the read
> + * pointer on this descriptor: the next call resumes copying the
> + * rest (desc_off remembers how far we got).
> + */
> + done = true;
> + break;
> + }
> +
> + /*
> + * This descriptor was copied in full. Advance the read pointer to the
> + * next descriptor and reset desc_off so it starts from the beginning.
> + */
> + rptr = (rptr + 1) % ASPEED_UDC_DESCS_COUNT;
> + e->desc_off = 0;
> + if (desc_ctrl & ASPEED_EP_DESC1_INTR) {
> + ack = true;
> + }
> + /*
> + * This descriptor is shorter than the max packet size, i.e. a short
> + * (or zero-length) packet. In USB that marks the end of the transfer,
> + * so stop here.
> + */
> + if (dlen < mps) {
> + done = true;
> + break;
> + }
> + /*
> + * The packet is now completely full, so the host has received all the
> + * data it asked for. Stop here.
> + */
> + if ((uint32_t)p->actual_length >= pktiov->size) {
> + done = true;
> + break;
> + }
> + }
> +
> + e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS], EP_DMA_STS,
> + RPTR, rptr);
> + e->regs[R_EP_DMA_CTRL] = FIELD_DP32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL,
> + PROC_STS, EP_DMA_CTRL_STS_TX_IDLE);
> + /* The guest gadget driver completes its request when the ring drains */
> + if (rptr == wptr) {
> + ack = true;
> + }
> + if (ack) {
> + aspeed_udc_raise_ep_ack(s, ep);
> + }
> +
> + return done ? ASPEED_UDC_XFER_DONE : ASPEED_UDC_XFER_MORE;
> +}
> +
> +/*
> + * OUT transfer: receive data from the host by copying its OUT packet into the
> + * buffer the guest gadget driver set up (single-stage mode).
> + *
> + * A host packet can be bigger than one buffer, so we copy at most PKT_SIZE
> + * bytes per call, continuing from where the last call stopped
> + * (p->actual_length). The caller keeps the packet parked until it is fully
> + * copied.
> + */
> +static AspeedUDCXferResult aspeed_udc_ep_xfer_out(AspeedUDCState *s, int ep,
> + USBPacket *p)
> +{
> + AspeedUDCEP *e = &s->ep[ep];
> + uint32_t chunk = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, PKT_SIZE);
> + uint32_t remaining = p->iov.size - (uint32_t)p->actual_length;
> + uint32_t data_buf_addr = e->regs[R_EP_DMA_BUFF];
> + uint32_t len = MIN(remaining, chunk);
> + g_autofree uint8_t *buf = g_malloc(len);
> +
> + if (data_buf_addr && len) {
> + usb_packet_copy(p, buf, len);
> + if (address_space_write(&s->dram_as, data_buf_addr,
> + MEMTXATTRS_UNSPECIFIED, buf,
> + len) != MEMTX_OK) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "%s: ep %d OUT data DMA write failed\n",
> + __func__, ep);
> + return ASPEED_UDC_XFER_ERROR;
> + }
> + }
> +
> + e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS],
> + EP_DMA_STS, PKT_SIZE, len);
> + e->regs[R_EP_DMA_STS] = FIELD_DP32(e->regs[R_EP_DMA_STS],
> + EP_DMA_STS, WPTR, 0);
> + e->regs[R_EP_DMA_CTRL] = FIELD_DP32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL,
> + PROC_STS, EP_DMA_CTRL_STS_RX_IDLE);
> + aspeed_udc_raise_ep_ack(s, ep);
> +
> + if ((uint32_t)p->actual_length >= p->iov.size) {
> + return ASPEED_UDC_XFER_DONE;
> + }
> +
> + return ASPEED_UDC_XFER_MORE;
> +}
> +
> +/*
> + * IN kick: the guest gadget driver wrote EP_DMA_STS to tell us it queued more
> + * IN data to send to the host. If a host IN request is already waiting
> + * (parked because there was no data before), send the data now and finish it.
> + * If the request needs more data than was queued, keep it parked and wait for
> + * the next kick.
> + */
> +static void aspeed_udc_ep_in_kick(AspeedUDCState *s, int ep, uint32_t val)
> +{
> + AspeedUDCEP *e = &s->ep[ep];
> + uint32_t cur_rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
> + uint32_t new_rptr = FIELD_EX32(val, EP_DMA_STS, RPTR);
> + uint32_t new_wptr = FIELD_EX32(val, EP_DMA_STS, WPTR);
> + USBPacket *p = e->pkt;
> +
> + /*
> + * A normal kick only sets the write pointer and leaves the read-pointer
> + * field 0 (the read pointer is ours to advance). The guest resets the ring
> + * by writing a read pointer that is non-zero and equal to the write
> + * pointer.
> + *
> + * We check non-zero as well as equal: on a normal kick whose write pointer
> + * just wrapped back to 0, both fields would be 0, so an "equal" test alone
> + * would look like a reset by mistake.
> + */
> + if (new_rptr != 0 && new_rptr == new_wptr) {
> + cur_rptr = new_rptr;
> + e->desc_off = 0;
> + }
> + /* store the guest's write, but keep our own read pointer */
> + e->regs[R_EP_DMA_STS] = FIELD_DP32(val, EP_DMA_STS, RPTR, cur_rptr);
> +
> + /* nothing to do unless an IN packet is waiting and the ring has data */
> + if (!p || cur_rptr == new_wptr) {
> + return;
> + }
> +
> + switch (aspeed_udc_ep_xfer_in(s, ep, p)) {
> + case ASPEED_UDC_XFER_DONE:
> + e->pkt = NULL;
> + p->status = USB_RET_SUCCESS;
> + usb_packet_complete(USB_DEVICE(s->usbgadget), p);
> + break;
> + case ASPEED_UDC_XFER_ERROR:
> + e->pkt = NULL;
> + p->status = USB_RET_IOERROR;
> + usb_packet_complete(USB_DEVICE(s->usbgadget), p);
> + break;
> + case ASPEED_UDC_XFER_MORE:
> + break;
> + }
> +}
> +
> +/*
> + * OUT kick: the guest gadget driver wrote EP_DMA_STS to give us a buffer for
> + * OUT data. If an OUT packet is already waiting (parked because there was no
> + * buffer before), copy its data into the buffer now and finish it. If the
> + * packet has more data than fits, keep it parked and wait for the next buffer.
> + */
> +static void aspeed_udc_ep_out_kick(AspeedUDCState *s, int ep)
> +{
> + AspeedUDCEP *e = &s->ep[ep];
> + USBPacket *p = e->pkt;
> +
> + /* nothing to do unless an OUT packet is waiting and a buffer is ready */
> + if (!p || !FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR)) {
> + return;
> + }
> +
> + switch (aspeed_udc_ep_xfer_out(s, ep, p)) {
> + case ASPEED_UDC_XFER_DONE:
> + e->pkt = NULL;
> + p->status = USB_RET_SUCCESS;
> + usb_packet_complete(USB_DEVICE(s->usbgadget), p);
> + break;
> + case ASPEED_UDC_XFER_ERROR:
> + e->pkt = NULL;
> + p->status = USB_RET_IOERROR;
> + usb_packet_complete(USB_DEVICE(s->usbgadget), p);
> + break;
> + case ASPEED_UDC_XFER_MORE:
> + break;
> + }
> +}
> +
> static uint64_t aspeed_udc_ep_read(void *opaque, hwaddr offset, unsigned size)
> {
> AspeedUDCEP *e = opaque;
> @@ -346,10 +660,31 @@ static void aspeed_udc_ep_write(void *opaque, hwaddr offset, uint64_t data,
> unsigned size)
> {
> AspeedUDCEP *e = opaque;
> + AspeedUDCState *s = container_of(e - e->index, AspeedUDCState, ep[0]);
> uint32_t reg = offset >> 2;
> + uint32_t val = data;
>
> - trace_aspeed_udc_ep_write(e->index, offset, data);
> - e->regs[reg] = data;
> + trace_aspeed_udc_ep_write(e->index, offset, val);
> +
> + switch (reg) {
> + case R_EP_DMA_BUFF:
> + e->regs[reg] = val & R_EP_DMA_BUFF_BASE_ADDR_MASK;
> + break;
> + case R_EP_DMA_STS:
> + val &= 0x77ffffff;
> + if (FIELD_EX32(e->regs[R_EP_DMA_CTRL], EP_DMA_CTRL, DESC_OP_EN)) {
> + /* IN, descriptor-list mode */
> + aspeed_udc_ep_in_kick(s, e->index, val);
> + } else {
> + /* OUT, single-stage mode */
> + e->regs[reg] = val;
> + aspeed_udc_ep_out_kick(s, e->index);
> + }
> + break;
> + default:
> + e->regs[reg] = val;
> + break;
> + }
> }
>
> static const MemoryRegionOps aspeed_udc_ep_ops = {
> @@ -375,6 +710,8 @@ static void aspeed_udc_reset_hold(Object *obj, ResetType type)
> memset(s->regs, 0, sizeof(s->regs));
> for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
> memset(s->ep[i].regs, 0, sizeof(s->ep[i].regs));
> + s->ep[i].pkt = NULL;
> + s->ep[i].desc_off = 0;
> }
>
> /* Device-reset default: root, DMA and EP-pool soft-reset bits set */
> @@ -468,6 +805,95 @@ static void aspeed_udc_class_init(ObjectClass *klass, const void *data)
> * through the MMIO register interface above.
> */
>
> +static int aspeed_udc_find_ep(AspeedUDCState *s, int ep_nr, bool is_out)
> +{
> + uint32_t cfg;
> + int i;
> +
> + for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
> + cfg = s->ep[i].regs[R_EP_CONFIG];
> +
> + if (!FIELD_EX32(cfg, EP_CONFIG, ENABLE) ||
> + FIELD_EX32(cfg, EP_CONFIG, EP_NUM) != ep_nr) {
> + continue;
> + }
> + if (FIELD_EX32(cfg, EP_CONFIG, DIR_OUT) == is_out) {
> + return i;
> + }
> + }
> +
> + return -1;
> +}
> +
> +static void aspeed_udc_ep_data_in(AspeedUDCState *s, int ep, USBPacket *p)
> +{
> + AspeedUDCEP *e = &s->ep[ep];
> + uint32_t rptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, RPTR);
> + uint32_t wptr = FIELD_EX32(e->regs[R_EP_DMA_STS], EP_DMA_STS, WPTR);
> +
> + if (rptr == wptr) {
> + /*
> + * No IN data is queued yet. Save the packet and return ASYNC
> + * instead of NAK. A NAK would make the host retry slowly.
> + * aspeed_udc_ep_in_kick() serves and completes this packet later,
> + * once the guest gadget driver queues descriptors.
> + */
> + e->pkt = p;
> + p->status = USB_RET_ASYNC;
> + return;
> + }
> +
> + switch (aspeed_udc_ep_xfer_in(s, ep, p)) {
> + case ASPEED_UDC_XFER_DONE:
> + p->status = USB_RET_SUCCESS;
> + break;
> + case ASPEED_UDC_XFER_MORE:
> + /* not fully sent yet: save the packet, wait for more descriptors */
> + e->pkt = p;
> + p->status = USB_RET_ASYNC;
> + break;
> + case ASPEED_UDC_XFER_ERROR:
> + p->status = USB_RET_IOERROR;
> + break;
> + }
> +}
> +
> +static void aspeed_udc_ep_data_out(AspeedUDCState *s, int ep, USBPacket *p)
> +{
> + AspeedUDCEP *e = &s->ep[ep];
> + uint32_t sts = e->regs[R_EP_DMA_STS];
> +
> + trace_aspeed_udc_ep_data_out(ep, FIELD_EX32(sts, EP_DMA_STS, WPTR),
> + FIELD_EX32(sts, EP_DMA_STS, PKT_SIZE),
> + p->iov.size);
> + if (!FIELD_EX32(sts, EP_DMA_STS, WPTR)) {
> + /*
> + * No OUT buffer is ready yet. Save the packet and return ASYNC
> + * instead of NAK. Writing now could use an old buffer address and
> + * lose the data (for example a mass-storage CBW). A NAK would make
> + * the host retry slowly. aspeed_udc_ep_out_kick() delivers this
> + * packet later, once the guest gadget driver sets up a buffer.
> + */
> + e->pkt = p;
> + p->status = USB_RET_ASYNC;
> + return;
> + }
> +
> + switch (aspeed_udc_ep_xfer_out(s, ep, p)) {
> + case ASPEED_UDC_XFER_DONE:
> + p->status = USB_RET_SUCCESS;
> + break;
> + case ASPEED_UDC_XFER_MORE:
> + /* not fully received yet: save the packet, wait for the next buffer */
> + e->pkt = p;
> + p->status = USB_RET_ASYNC;
> + break;
> + case ASPEED_UDC_XFER_ERROR:
> + p->status = USB_RET_IOERROR;
> + break;
> + }
> +}
> +
> static void aspeed_udc_gadget_handle_reset(USBDevice *udev)
> {
> AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
> @@ -531,17 +957,37 @@ static void aspeed_udc_gadget_handle_control(USBDevice *udev, USBPacket *p,
>
> static void aspeed_udc_gadget_handle_data(USBDevice *udev, USBPacket *p)
> {
> - /* Programmable endpoint (bulk) transfers are added in a later patch. */
> - p->status = USB_RET_STALL;
> + AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
> + bool is_out = (p->pid == USB_TOKEN_OUT);
> + int ep = aspeed_udc_find_ep(s, p->ep->nr, is_out);
> +
> + trace_aspeed_udc_handle_data(p->ep->nr, is_out ? "OUT" : "IN",
> + p->iov.size, ep);
> + if (ep < 0) {
> + p->status = USB_RET_STALL;
> + return;
> + }
> +
> + if (is_out) {
> + aspeed_udc_ep_data_out(s, ep, p);
> + } else {
> + aspeed_udc_ep_data_in(s, ep, p);
> + }
> }
>
> static void aspeed_udc_gadget_cancel_packet(USBDevice *udev, USBPacket *p)
> {
> AspeedUDCState *s = ASPEED_UDC_GADGET(udev)->udc;
> + int i;
>
> if (s->ep0_packet == p) {
> s->ep0_packet = NULL;
> }
> + for (i = 0; i < ASPEED_UDC_NUM_EP; i++) {
> + if (s->ep[i].pkt == p) {
> + s->ep[i].pkt = NULL;
> + }
> + }
> }
>
> static void aspeed_udc_gadget_realize(USBDevice *udev, Error **errp)
> diff --git a/hw/usb/trace-events b/hw/usb/trace-events
> index 098c3d6179..80ead23358 100644
> --- a/hw/usb/trace-events
> +++ b/hw/usb/trace-events
> @@ -389,3 +389,7 @@ aspeed_udc_reset(uint32_t ier) "bus reset, ier 0x%x"
> aspeed_udc_ep0_setup(uint8_t type, uint8_t req, uint16_t value, uint16_t index, uint16_t length, int dir_in, int addr) "bmRequestType 0x%02x, bRequest 0x%02x, wValue 0x%04x, wIndex 0x%04x, wLength %d, dir_in %d, addr %d"
> aspeed_udc_ep0_ctrl_write(uint32_t val, int dir_in, uint32_t offset) "val 0x%x, dir_in %d, off %u"
> aspeed_udc_ep0_complete(int dir_in, int actual) "dir_in %d, actual %d"
> +aspeed_udc_handle_data(int ep_nr, const char *dir, uint32_t iov, int ep_idx) "ep_nr %d, %s, iov %u, ep_idx %d"
> +aspeed_udc_ep_data_in(unsigned ep, uint32_t rptr, uint32_t wptr, uint32_t iov) "ep %u, rptr %u, wptr %u, iov %u"
> +aspeed_udc_ep_data_out(unsigned ep, uint32_t wptr, uint32_t avail, uint32_t iov) "ep %u, wptr %u, avail %u, iov %u"
> +aspeed_udc_ep_ack(unsigned ep) "ep %u"
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Thanks,
C.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v5 4/4] hw/arm/aspeed_ast2600: Wire up the UDC
2026-09-02 2:15 [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Jamin Lin
` (2 preceding siblings ...)
2026-09-02 2:15 ` [PATCH v5 3/4] hw/usb/aspeed-udc: Add programmable endpoint DMA transfers Jamin Lin
@ 2026-09-02 2:15 ` Jamin Lin
2026-09-02 6:10 ` [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Cédric Le Goater
4 siblings, 0 replies; 7+ messages in thread
From: Jamin Lin @ 2026-09-02 2:15 UTC (permalink / raw)
To: Paolo Bonzini, Peter Maydell, Cédric Le Goater, Steven Lee,
Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
open list:ARM TCG CPUs, open list:All patches CC here
Cc: Jamin Lin, Troy Lee, Philippe Mathieu-Daudé,
Cédric Le Goater
Create the USB Device Controller (UDC) at 0x1e6a2000 on the AST2600 SoC
and map its registers.
The UDC and the second EHCI host controller (EHCI2) share one SoC
interrupt line. Route both through an OR gate whose output drives that
GIC input, so either device can raise the interrupt without the other
clobbering the line.
The gadget USB device is not created by the SoC. It is a separate,
user-creatable "aspeed.udc-gadget" USB device that the user plugs onto a
USB host controller's bus; it finds its controller through the "udc"
link property, e.g.
-device aspeed.udc-gadget,udc=/machine/soc/udc
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
include/hw/arm/aspeed_soc.h | 4 ++++
hw/arm/aspeed_ast2600.c | 37 ++++++++++++++++++++++++++++++++++---
2 files changed, 38 insertions(+), 3 deletions(-)
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index cd68c7f1ca..fe7b31e42c 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -36,6 +36,8 @@
#include "hw/gpio/aspeed_sgpio.h"
#include "hw/sd/aspeed_sdhci.h"
#include "hw/usb/hcd-ehci.h"
+#include "hw/usb/aspeed-udc.h"
+#include "hw/core/or-irq.h"
#include "qom/object.h"
#include "hw/misc/aspeed_lpc.h"
#include "hw/misc/unimp.h"
@@ -138,6 +140,8 @@ struct Aspeed2600SoCState {
A15MPPrivState a7mpcore;
ARMCPU cpu[ASPEED_CPUS_NUM]; /* XXX belong to a7mpcore */
+ AspeedUDCState udc;
+ OrIRQState ehci2_udc_orgate;
};
#define TYPE_ASPEED2600_SOC "aspeed2600-soc"
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index d1f18e471a..21db95f5ae 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -32,6 +32,7 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
[ASPEED_DEV_SPI1] = 0x1E630000,
[ASPEED_DEV_SPI2] = 0x1E631000,
[ASPEED_DEV_EHCI1] = 0x1E6A1000,
+ [ASPEED_DEV_UDC] = 0x1E6A2000,
[ASPEED_DEV_EHCI2] = 0x1E6A3000,
[ASPEED_DEV_MII1] = 0x1E650000,
[ASPEED_DEV_MII2] = 0x1E650008,
@@ -214,6 +215,10 @@ static void aspeed_soc_ast2600_init(Object *obj)
TYPE_PLATFORM_EHCI);
}
+ object_initialize_child(obj, "udc", &a->udc, TYPE_ASPEED_UDC);
+ object_initialize_child(obj, "ehci2-udc-orgate", &a->ehci2_udc_orgate,
+ TYPE_OR_IRQ);
+
snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
object_initialize_child(obj, "sdmc", &s->sdmc, typename);
object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
@@ -561,6 +566,16 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_SPI1 + i));
}
+ /*
+ * EHCI2 and the UDC share one SoC interrupt line, so OR their outputs
+ * together and drive that GIC input from the OR gate.
+ */
+ object_property_set_int(OBJECT(&a->ehci2_udc_orgate), "num-lines", 2,
+ &error_abort);
+ qdev_realize(DEVICE(&a->ehci2_udc_orgate), NULL, &error_abort);
+ qdev_connect_gpio_out(DEVICE(&a->ehci2_udc_orgate), 0,
+ aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_EHCI2));
+
/* EHCI */
for (i = 0; i < sc->ehcis_num; i++) {
if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
@@ -568,10 +583,26 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
}
aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
sc->memmap[ASPEED_DEV_EHCI1 + i]);
- sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
- aspeed_soc_ast2600_get_irq(s,
- ASPEED_DEV_EHCI1 + i));
}
+ /*
+ * EHCI1 has its own IRQ; EHCI2 shares the UDC's IRQ, so route it through
+ * the OR gate.
+ */
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[0]), 0,
+ aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_EHCI1));
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[1]), 0,
+ qdev_get_gpio_in(DEVICE(&a->ehci2_udc_orgate), 0));
+
+ /* UDC - USB 2.0 Device Controller */
+ object_property_set_link(OBJECT(&a->udc), "dram", OBJECT(s->dram_mr),
+ &error_abort);
+ if (!sysbus_realize(SYS_BUS_DEVICE(&a->udc), errp)) {
+ return;
+ }
+ aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->udc), 0,
+ sc->memmap[ASPEED_DEV_UDC]);
+ sysbus_connect_irq(SYS_BUS_DEVICE(&a->udc), 0,
+ qdev_get_gpio_in(DEVICE(&a->ehci2_udc_orgate), 1));
/* SDMC - SDRAM Memory Controller */
if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC)
2026-09-02 2:15 [PATCH v5 0/4] hw/usb: Add ASPEED USB Device Controller (UDC) Jamin Lin
` (3 preceding siblings ...)
2026-09-02 2:15 ` [PATCH v5 4/4] hw/arm/aspeed_ast2600: Wire up the UDC Jamin Lin
@ 2026-09-02 6:10 ` Cédric Le Goater
4 siblings, 0 replies; 7+ messages in thread
From: Cédric Le Goater @ 2026-09-02 6:10 UTC (permalink / raw)
To: Jamin Lin, Paolo Bonzini, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, open list:ARM TCG CPUs,
open list:All patches CC here
Cc: Troy Lee
On 9/2/26 04:15, Jamin Lin wrote:
> This series adds a QEMU model for the ASPEED USB Device Controller (UDC),
> driven by the Linux "aspeed_udc" gadget driver.
>
> It is the first step of a larger plan to model USB device-side support on
> ASPEED BMC/BIC SoCs, which has three goals:
>
> 1. Model the ASPEED UDC (AST2600 / AST1030). The AST2600 also has USB host
> (EHCI) controllers, so this series targets the AST2600 UDC: its gadget can
> be attached to the SoC's own EHCI bus, letting the guest enumerate its own
> gadget and exercise the UDC end-to-end. [this series]
>
> 2. AST1030 UDC. The AST1030 has no USB host controller, so testing its UDC
> needs a second QEMU instance. The plan is to redirect the UDC gadget out
> of the guest using libusbredir and attach it to another QEMU that runs a
> USB host (a VMM, or an AST2600 / AST2700 guest). [on-going]
>
> 3. ASPEED vHub, as a longer-term goal towards BMC KVM / Virtual Media support
> in QEMU. [future]
>
> This series implements goal 1 only.
>
> Design
> ------
> The UDC is modelled as two QOM objects, because a single object cannot be
> both a SysBusDevice and a USBDevice:
>
> - "aspeed.udc": the sysbus device (MMIO register map, IRQ and DMA engine)
> that the guest gadget driver programs.
>
> - "aspeed.udc-gadget": a user-creatable USB device presented on a USB host
> controller's bus. It links back to its controller through the "udc"
> property.
>
> The SoC creates the controller; the gadget is added on the command line, e.g.
>
> -device aspeed.udc-gadget,udc=/machine/soc/udc
>
> Test result:
> -----------
> The default ASPEED SDK prebuilt image does not enable the UDC driver, so
> build a kernel with CONFIG_USB_ASPEED_UDC=y first.
>
> Start QEMU with the gadget attached to the on-SoC EHCI:
>
> qemu-system-arm -machine ast2600-evb -drive file=<image>,if=mtd,format=raw \
> -device aspeed.udc-gadget,udc=/machine/soc/udc -nographic
>
> In the guest, bring up a mass-storage gadget and verify enumeration and I/O:
>
> 1. Before: only the host controllers are present
> root@ast2600-default:~# lsusb
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty ehci_hcd EHCI Host Controller
> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty uhci_hcd Generic UHCI Host Controller
>
> 2. Enable the gadget
> root@ast2600-default:~# ./usb-storage.sh
> Using UDC: 1e6a2000.usb
> [ 598.582205] Mass Storage Function, version: 2009/09/11
> [ 598.582635] LUN: removable file: (no medium)
> USB Mass Storage gadget is enabled.
> Backing file: /home/root/jamin
> root@ast2600-default:~# [ 598.876395] usb 1-1: new high-speed USB device number 2 using ehci-platform
> [ 599.070035] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 1.00
> [ 599.070821] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
> [ 599.071448] usb 1-1: Product: ASPEED USB Storage
> [ 599.072687] usb 1-1: Manufacturer: ASPEED
> [ 599.073384] usb 1-1: SerialNumber: 1234567890
> [ 599.103625] usb-storage 1-1:1.0: USB Mass Storage device detected
> [ 599.136326] scsi host0: usb-storage 1-1:1.0
> [ 600.230921] scsi 0:0:0:0: Direct-Access Linux File-Stor Gadget 0618 PQ: 0 ANSI: 2
> [ 600.243758] sd 0:0:0:0: Attached scsi generic sg0 type 0
> [ 600.263452] sd 0:0:0:0: Power-on or device reset occurred
> [ 600.289381] sd 0:0:0:0: [sda] 2048 512-byte logical blocks: (1.05 MB/1.00 MiB)
> [ 600.297896] sd 0:0:0:0: [sda] Write Protect is off
> [ 600.306379] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
> [ 600.424608] sda:
> [ 600.425526] sd 0:0:0:0: [sda] Attached SCSI removable disk
>
> 3. After: the gadget enumerates on the EHCI bus
> root@ast2600-default:~# lsusb
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty ehci_hcd EHCI Host Controller
> Bus 001 Device 002: ID 1d6b:0104 ASPEED ASPEED USB Storage
> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty uhci_hcd Generic UHCI Host Controller
>
> 4. Mount and verify data
> root@ast2600-default:~# mount /dev/sda /mnt/
> root@ast2600-default:~# sha256sum /mnt/testfile
> 3308890a1289f6a327c014537523e8ebd0833301af3d25a7c5893dc7050d2c70 /mnt/testfile
> root@ast2600-default:~# umount /mnt
>
> 5. Stop the gadget -> clean disconnect
> root@ast2600-default:~# ./usb-storage.sh stop
> Stopping USB gadget...
> [ 669.866439] usb 1-1: USB disconnect, device number 2
> Stopped.
> root@ast2600-default:~# [ 669.968156] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> [ 669.969307] sd 0:0:0:0: [sda] Synchronize Cache(10) failed: Result: hostbyte=0x01 driverbyte=DRIVER_OK
>
> root@ast2600-default:~# lsusb
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty ehci_hcd EHCI Host Controller
> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.20-dirty-32e49fb4a22b-g32e49fb4a22b-dirty uhci_hcd Generic UHCI Host Controller
>
>
> The contents of this scripts
> ---------------------------
> root@ast2600-default:~# cat usb-storage.sh
> #!/bin/sh
> set -e
>
> G=/sys/kernel/config/usb_gadget/g1
> IMG=/home/root/jamin
> SIZE_MB=64
>
> mount_configfs()
> {
> mountpoint -q /sys/kernel/config || mount -t configfs none /sys/kernel/config
> }
>
> get_udc()
> {
> ls /sys/class/udc | head -n 1
> }
>
> stop_gadget()
> {
> if [ ! -d "$G" ]; then
> return
> fi
>
> echo "Stopping USB gadget..."
>
> # Unbind UDC first
> if [ -f "$G/UDC" ]; then
> echo "" > "$G/UDC" 2>/dev/null || true
> fi
>
> # Clear backing file to release image
> if [ -f "$G/functions/mass_storage.0/lun.0/file" ]; then
> echo "" > "$G/functions/mass_storage.0/lun.0/file" 2>/dev/null || true
> fi
>
> # Remove function link from config
> rm -f "$G/configs/c.1/mass_storage.0" 2>/dev/null || true
>
> echo "Stopped."
> }
>
> start_gadget()
> {
> mount_configfs
>
> UDC="$(get_udc)"
> if [ -z "$UDC" ]; then
> echo "ERROR: No UDC found in /sys/class/udc"
> exit 1
> fi
>
> stop_gadget
>
> echo "Using UDC: $UDC"
>
> modprobe libcomposite 2>/dev/null || true
>
> mkdir -p "$G"
> cd "$G"
>
> echo 0x1d6b > idVendor
> echo 0x0104 > idProduct
> echo 0x0200 > bcdUSB
> echo 0x0100 > bcdDevice
>
> mkdir -p strings/0x409
> echo "1234567890" > strings/0x409/serialnumber
> echo "ASPEED" > strings/0x409/manufacturer
> echo "ASPEED USB Storage" > strings/0x409/product
>
> mkdir -p configs/c.1/strings/0x409
> echo "Mass Storage" > configs/c.1/strings/0x409/configuration
> echo 120 > configs/c.1/MaxPower
>
> if [ ! -f "$IMG" ]; then
> echo "Creating backing image: $IMG"
> dd if=/dev/zero of="$IMG" bs=1M count="$SIZE_MB"
> mkfs.vfat "$IMG"
> fi
>
> mkdir -p functions/mass_storage.0
>
> # Make sure old LUN is detached before changing attributes
> echo "" > functions/mass_storage.0/lun.0/file 2>/dev/null || true
>
> echo 0 > functions/mass_storage.0/stall
> echo 0 > functions/mass_storage.0/lun.0/cdrom
> echo 0 > functions/mass_storage.0/lun.0/ro
> echo 1 > functions/mass_storage.0/lun.0/removable
> echo "$IMG" > functions/mass_storage.0/lun.0/file
>
> ln -sf functions/mass_storage.0 configs/c.1/mass_storage.0
>
> echo "$UDC" > UDC
>
> echo "USB Mass Storage gadget is enabled."
> echo "Backing file: $IMG"
> }
>
> case "$1" in
> start|"")
> start_gadget
> ;;
> stop)
> stop_gadget
> ;;
> restart)
> stop_gadget
> sleep 1
> start_gadget
> ;;
> *)
> echo "Usage: $0 {start|stop|restart}"
> exit 1
> ;;
> esac
>
>
> v1:
> 1. Add ASPEED UDC device controller
> 2. Add ASPEED UDC gadget USB device
>
> v2:
> 1. Replace dynamic memory allocation with fixed-size arrays.
> 2. Use an OR gate to route the interrupt signals from the UDC and EHCI2.
> 3. Split the "Add ASPEED UDC gadget USB device" patch into two patches:
> a. Add ASPEED UDC gadget USB device
> Implement EP0 control transfers.
> b. Add programmable endpoint DMA transfers
> Implement DMA transfers for programmable endpoints.
> 4. Remove unused macros.
>
> v3:
> 1. Remove unused macros.
> 2. Bind the gadget to the controller via a QOM link property
> ("usbgadget", weak) instead of writing the back-pointer directly
>
> v4:
> 1. Move the "select USB" dependency to the appropriate patch.
>
> v5:
> 1. Dynamically allocate the buffer in aspeed_udc_ep_xfer_out() to reduce stack usage.
>
> Jamin Lin (4):
> hw/usb/aspeed-udc: Add ASPEED UDC device controller
> hw/usb/aspeed-udc: Add ASPEED UDC gadget USB device
> hw/usb/aspeed-udc: Add programmable endpoint DMA transfers
> hw/arm/aspeed_ast2600: Wire up the UDC
>
> include/hw/arm/aspeed_soc.h | 4 +
> include/hw/usb/aspeed-udc.h | 85 +++
> hw/arm/aspeed_ast2600.c | 37 +-
> hw/usb/aspeed-udc.c | 1058 +++++++++++++++++++++++++++++++++++
> hw/arm/Kconfig | 1 +
> hw/usb/Kconfig | 4 +
> hw/usb/meson.build | 1 +
> hw/usb/trace-events | 16 +
> 8 files changed, 1203 insertions(+), 3 deletions(-)
> create mode 100644 include/hw/usb/aspeed-udc.h
> create mode 100644 hw/usb/aspeed-udc.c
>
Applied to
https://github.com/legoater/qemu aspeed-next
Thanks,
C.
^ permalink raw reply [flat|nested] 7+ messages in thread