* [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support
@ 2026-05-04 2:53 Jamin Lin
2026-05-04 2:53 ` [PATCH v6 01/11] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK Jamin Lin
` (11 more replies)
0 siblings, 12 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
which provides the upper 32 bits of descriptor addresses when the
controller advertises 64-bit capability.
Currently QEMU EHCI model only partially supports this functionality and
descriptor addresses are effectively treated as 32-bit. This becomes
problematic on systems where system memory is located above the 4GB
boundary.
The Linux EHCI driver enables 64-bit addressing if the controller
advertises the capability. During initialization it programs the
segment register to zero:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600
The driver also notes that descriptor structures allocated from the
DMA pool use segment zero semantics. Descriptor memory is allocated
using the DMA API and platforms may configure a 64-bit DMA mask,
allowing descriptor memory to be placed above 4GB.
On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
result, descriptor addresses constructed directly from the EHCI
registers do not match the actual system addresses used by the
controller when accessing queue heads (QH) and queue element transfer
descriptors (qTD).
This patch series implements full 64-bit descriptor addressing support
in the EHCI emulation. Descriptor address handling is updated to use
64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
are extended to support the upper address bits provided by the segment
register.
Add a ctrldssegment-default property so platforms can provide a
descriptor address offset when constructing descriptor addresses.
This allows systems where DRAM resides above 4GB to access EHCI
descriptors correctly.
The AST2700 machine uses this property to account for its DRAM mapping
at 0x400000000 and enables 64-bit EHCI DMA addressing.
Test Result:
1. EHCI 32bits with ast2600-evb machine
Command line:
./build/qemu-system-arm \
-machine ast2600-evb \
-m 1G \
-drive file=image-bmc,if=mtd,format=raw \
-nographic \
-device usb-kbd,bus=usb-bus.1,id=mykbd \
-drive id=usbdisk,if=none,file=image0.ext4,format=raw \
-device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
-snapshot \
-nographic
Result:
unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
2. EHCI 64bits with ast2700a2-evb machine
Command line:
./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
-bios ast27x0_bootrom.bin \
-drive file=image-bmc,format=raw,if=mtd \
-snapshot \
-device usb-kbd,bus=usb-bus.3,id=mykbd \
-drive id=usbdisk,if=none,file=image0.ext4,format=raw \
-device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
Result:
root@ast2700-default:~# lsusb
unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
v1
1. Fix checkpatch coding style issues
2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
3. Add descriptor address offset property
4. Enable 64-bit EHCI DMA addressing on AST2700
5. Configure descriptor address offset for AST2700
v2
1. Remove unused EHCIfstn structure and dead code
2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
3. Replace DPRINTF debug logs with trace events
4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
5. Fix review issue
v3:
1. Add Migration version test function
2. Add EHCI 64-bit buffer pointer fields description in commit log
v4:
1. Reorder patches in the series
2. Fix EHCI migration issues
3. Introduce a common properties macro for both sysbus and PCI
4. Drop the descriptor address offset property
5. Add ctrldssegment-default property
6. Address review comments
v5:
1. Add 11.0 machine compatibility properties
v6:
1. Update reviewer suggested improvements.
Jamin Lin (11):
tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
AST2600 SDK
hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
compatibility
hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
capability
hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
hw/usb/hcd-ehci: Add ctrldssegment-default property
hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
AST2700 A1/A2
hw/usb/hcd-ehci.h | 29 +++-
hw/arm/aspeed_ast27x0.c | 5 +
hw/core/machine.c | 5 +-
hw/usb/hcd-ehci.c | 162 +++++++++++++-----
hw/usb/trace-events | 26 +--
.../aarch64/test_aspeed_ast2700a1.py | 7 +
.../aarch64/test_aspeed_ast2700a2.py | 7 +
.../functional/arm/test_aspeed_ast2600_sdk.py | 7 +
8 files changed, 185 insertions(+), 63 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 27+ messages in thread
* [PATCH v6 01/11] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility Jamin Lin
` (10 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Add a functional test to verify USB EHCI support on the AST2600
SDK machine by attaching a USB keyboard device and checking its
enumeration via lsusb.
This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
tests/functional/arm/test_aspeed_ast2600_sdk.py | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tests/functional/arm/test_aspeed_ast2600_sdk.py b/tests/functional/arm/test_aspeed_ast2600_sdk.py
index d787e90d10..01548dd135 100755
--- a/tests/functional/arm/test_aspeed_ast2600_sdk.py
+++ b/tests/functional/arm/test_aspeed_ast2600_sdk.py
@@ -40,6 +40,11 @@ def do_ast2600_i3c_test(self):
'i3ctransfer -d /dev/bus/i3c/5-1234567890ab -r 8 | grep 0x | xargs',
'0x12 0x34 0x56 0x78 0x90 0xab 0xcd 0xef')
+ def do_ast2600_usb_ehci_test(self):
+ exec_command_and_wait_for_pattern(self,
+ 'lsusb',
+ 'QEMU QEMU USB Keyboard')
+
def test_arm_ast2600_evb_sdk(self):
self.set_machine('ast2600-evb')
self.require_netdev('user')
@@ -54,6 +59,7 @@ def test_arm_ast2600_evb_sdk(self):
self.vm.add_args('-netdev', 'user,id=net1')
self.vm.add_args('-device',
'mock-i3c-target,bus=dw.i3c.5,pid=0xab9078563412')
+ self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.1')
self.do_test_arm_aspeed_sdk_start(
self.scratch_file("ast2600-default-image", "image-bmc"))
@@ -81,6 +87,7 @@ def test_arm_ast2600_evb_sdk(self):
'/sbin/hwclock -f /dev/rtc1', year)
self.do_ast2600_pcie_test()
self.do_ast2600_i3c_test()
+ self.do_ast2600_usb_ehci_test()
if __name__ == '__main__':
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
2026-05-04 2:53 ` [PATCH v6 01/11] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 5:19 ` Cédric Le Goater
2026-05-04 12:17 ` Philippe Mathieu-Daudé
2026-05-04 2:53 ` [PATCH v6 03/11] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability Jamin Lin
` (9 subsequent siblings)
11 siblings, 2 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Change internal EHCI descriptor addresses from uint32_t to uint64_t.
The following fields are updated:
- EHCIPacket::qtdaddr
- EHCIQueue::{qhaddr, qtdaddr}
- EHCIState::{a_fetch_addr, p_fetch_addr}
Update get_dwords() and put_dwords() to take 64-bit addresses and
propagate the type change through the descriptor traversal paths.
Adjust NLPTR_GET() to operate on 64-bit values:
#define NLPTR_GET(x) ((x) & ~0x1fULL)
so that link pointer masking works correctly when descriptor
addresses exceed 32-bit space. The previous mask (0xffffffe0)
implicitly truncated addresses to 32 bits.
This patch does not change the on-wire descriptor layout yet.
It only removes the internal 32-bit address limit and prepares
for later patches that will add full 64-bit QH/qTD/iTD/siTD support.
Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
use uint64_t for the address argument and print it with PRIx64. This
ensures full 64-bit addresses are shown in trace output and improves
debugging of queue heads and transfer descriptors.
Migration compatibility:
To preserve backward migration compatibility, keep the legacy 32-bit
fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
new 64-bit fields.
Migration format is selected using a machine compat property
"x-migrate-fetch-addr-64bit":
- Old machine types migrate 32-bit fetch addresses
- New machine types migrate full 64-bit fetch addresses
This is implemented using VMSTATE_UINT32_TEST() and
VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
In pre_save, the 32-bit shadow fields are populated when migrating
to old machine types. In post_load, the 32-bit values are restored
into the 64-bit fields when loading old migration streams.
No functional change.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/usb/hcd-ehci.h | 17 +++++++----
hw/core/machine.c | 5 +++-
hw/usb/hcd-ehci.c | 72 ++++++++++++++++++++++++++++++++-------------
hw/usb/trace-events | 24 +++++++--------
4 files changed, 78 insertions(+), 40 deletions(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index d038ee1e31..3acbddfc5c 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -208,7 +208,7 @@ struct EHCIPacket {
QTAILQ_ENTRY(EHCIPacket) next;
EHCIqtd qtd; /* copy of current QTD (being worked on) */
- uint32_t qtdaddr; /* address QTD read from */
+ uint64_t qtdaddr; /* address QTD read from */
USBPacket packet;
QEMUSGList sgl;
@@ -229,8 +229,8 @@ struct EHCIQueue {
* when guest removes an entry (doorbell, handshake sequence)
*/
EHCIqh qh; /* copy of current QH (being worked on) */
- uint32_t qhaddr; /* address QH read from */
- uint32_t qtdaddr; /* address QTD read from */
+ uint64_t qhaddr; /* address QH read from */
+ uint64_t qtdaddr; /* address QTD read from */
int last_pid; /* pid of last packet executed */
USBDevice *dev;
QTAILQ_HEAD(, EHCIPacket) packets;
@@ -256,6 +256,7 @@ struct EHCIState {
/* properties */
uint32_t maxframes;
+ bool migrate_fetch_addr_64bit;
/*
* EHCI spec version 1.0 Section 2.3
@@ -294,8 +295,10 @@ struct EHCIState {
EHCIQueueHead pqueues;
/* which address to look at next */
- uint32_t a_fetch_addr;
- uint32_t p_fetch_addr;
+ uint32_t a_fetch_addr_32;
+ uint32_t p_fetch_addr_32;
+ uint64_t a_fetch_addr;
+ uint64_t p_fetch_addr;
USBPacket ipacket;
QEMUSGList isgl;
@@ -308,7 +311,9 @@ struct EHCIState {
};
#define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
- DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
+ DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
+ DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
+ ehci.migrate_fetch_addr_64bit, true)
extern const VMStateDescription vmstate_ehci;
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 1b661fd36a..54336da294 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -39,7 +39,10 @@
#include "hw/acpi/generic_event_device.h"
#include "qemu/audio.h"
-GlobalProperty hw_compat_11_0[] = {};
+GlobalProperty hw_compat_11_0[] = {
+ { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
+ { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
+};
const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
GlobalProperty hw_compat_10_2[] = {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 28a60e4c1a..9d74259289 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -72,7 +72,7 @@ typedef enum {
} EHCI_STATES;
/* macros for accessing fields within next link pointer entry */
-#define NLPTR_GET(x) ((x) & 0xffffffe0)
+#define NLPTR_GET(x) ((x) & ~0x1fULL)
#define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
#define NLPTR_TBIT(x) ((x) & 1) /* 1=invalid, 0=valid */
@@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
return async ? s->astate : s->pstate;
}
-static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
+static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
{
if (async) {
s->a_fetch_addr = addr;
@@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
}
}
-static int ehci_get_fetch_addr(EHCIState *s, int async)
+static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
{
return async ? s->a_fetch_addr : s->p_fetch_addr;
}
@@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState *s)
}
/* Get an array of dwords from main memory */
-static inline int get_dwords(EHCIState *ehci, uint32_t addr,
+static inline int get_dwords(EHCIState *ehci, uint64_t addr,
uint32_t *buf, int num)
{
int i;
@@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t addr,
}
/* Put an array of dwords in to main memory */
-static inline int put_dwords(EHCIState *ehci, uint32_t addr,
+static inline int put_dwords(EHCIState *ehci, uint64_t addr,
uint32_t *buf, int num)
{
int i;
@@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
/* queue management */
-static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
+static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
{
EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
EHCIQueue *q;
@@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const char *warn)
g_free(q);
}
-static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
+static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
int async)
{
EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
@@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
{
uint32_t *qh = (uint32_t *) &q->qh;
uint32_t dwords = sizeof(EHCIqh) >> 2;
- uint32_t addr = NLPTR_GET(q->qhaddr);
+ uint64_t addr = NLPTR_GET(q->qhaddr);
put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
}
@@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const char *action)
/* 4.7.2 */
static int ehci_process_itd(EHCIState *ehci,
EHCIitd *itd,
- uint32_t addr)
+ uint64_t addr)
{
USBDevice *dev;
USBEndpoint *ep;
uint32_t i, len, pid, dir, devaddr, endp;
- uint32_t pg, off, ptr1, ptr2, max, mult;
+ uint32_t pg, off, max, mult;
+ uint64_t ptr1, ptr2;
ehci->periodic_sched_active = PERIODIC_ACTIVE;
@@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
EHCIqh qh;
int i = 0;
int again = 0;
- uint32_t entry = ehci->asynclistaddr;
+ uint64_t entry = ehci->asynclistaddr;
/* set reclamation flag at start event (4.8.6) */
if (async) {
@@ -1578,7 +1579,7 @@ out:
static int ehci_state_fetchentry(EHCIState *ehci, int async)
{
int again = 0;
- uint32_t entry = ehci_get_fetch_addr(ehci, async);
+ uint64_t entry = ehci_get_fetch_addr(ehci, async);
if (NLPTR_TBIT(entry)) {
ehci_set_state(ehci, async, EST_ACTIVE);
@@ -1611,7 +1612,7 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
default:
/* TODO: handle FSTN type */
qemu_log_mask(LOG_GUEST_ERROR,
- "FETCHENTRY: entry at 0x%x is of type %u "
+ "FETCHENTRY: entry at %" PRIx64 "is of type %" PRIu64 " "
"which is not supported yet\n",
entry, NLPTR_TYPE_GET(entry));
return -1;
@@ -1623,7 +1624,7 @@ out:
static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
{
- uint32_t entry;
+ uint64_t entry;
EHCIQueue *q;
EHCIqh qh;
@@ -1712,7 +1713,7 @@ out:
static int ehci_state_fetchitd(EHCIState *ehci, int async)
{
- uint32_t entry;
+ uint64_t entry;
EHCIitd itd;
assert(!async);
@@ -1738,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
static int ehci_state_fetchsitd(EHCIState *ehci, int async)
{
- uint32_t entry;
+ uint64_t entry;
EHCIsitd sitd;
assert(!async);
@@ -1802,7 +1803,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
EHCIqtd qtd;
EHCIPacket *p;
int again = 1;
- uint32_t addr;
+ uint64_t addr;
addr = NLPTR_GET(q->qtdaddr);
if (get_dwords(q->ehci, addr + 8, &qtd.token, 1) < 0) {
@@ -1885,7 +1886,7 @@ static int ehci_fill_queue(EHCIPacket *p)
USBEndpoint *ep = p->packet.ep;
EHCIQueue *q = p->queue;
EHCIqtd qtd = p->qtd;
- uint32_t qtdaddr;
+ uint64_t qtdaddr;
for (;;) {
if (NLPTR_TBIT(qtd.next) != 0) {
@@ -2008,7 +2009,8 @@ static int ehci_state_executing(EHCIQueue *q)
static int ehci_state_writeback(EHCIQueue *q)
{
EHCIPacket *p = QTAILQ_FIRST(&q->packets);
- uint32_t *qtd, addr;
+ uint32_t *qtd;
+ uint64_t addr;
int again = 0;
/* Write back the QTD from the QH area */
@@ -2414,6 +2416,18 @@ static USBBusOps ehci_bus_ops_standalone = {
.wakeup_endpoint = ehci_wakeup_endpoint,
};
+static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
+{
+ EHCIState *s = opaque;
+
+ return s->migrate_fetch_addr_64bit;
+}
+
+static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
+{
+ return !ehci_fetch_addr_64_needed(opaque, version_id);
+}
+
static int usb_ehci_pre_save(void *opaque)
{
EHCIState *ehci = opaque;
@@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
ehci->frindex = new_frindex;
+ if (!ehci->migrate_fetch_addr_64bit) {
+ ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
+ ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
+ }
+
return 0;
}
@@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
}
}
+ if (!s->migrate_fetch_addr_64bit) {
+ s->a_fetch_addr = s->a_fetch_addr_32;
+ s->p_fetch_addr = s->p_fetch_addr_32;
+ }
+
return 0;
}
@@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
/* schedule state */
VMSTATE_UINT32(astate, EHCIState),
VMSTATE_UINT32(pstate, EHCIState),
- VMSTATE_UINT32(a_fetch_addr, EHCIState),
- VMSTATE_UINT32(p_fetch_addr, EHCIState),
+ VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
+ ehci_fetch_addr_32_needed),
+ VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
+ ehci_fetch_addr_32_needed),
+ VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
+ ehci_fetch_addr_64_needed),
+ VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
+ ehci_fetch_addr_64_needed),
VMSTATE_END_OF_LIST()
}
};
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 0d4318dcf1..8c90688bb3 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio 0x%04
usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
-usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
-usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
-usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
+usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
+usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
+usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%" PRIx64 " - c %d, h %d, dtc %d, i %d"
usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
-usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
-usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
-usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
-usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
-usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x: next 0x%08x - active %d"
+usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
+usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
+usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr %d"
+usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
+usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%" PRIx64 ": next 0x%08x - active %d"
usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
@@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
usb_ehci_port_disable(uint32_t port) "port #%d"
usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
-usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
+usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ", next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
usb_ehci_guest_bug(const char *reason) "%s"
usb_ehci_doorbell_ring(void) ""
usb_ehci_doorbell_ack(void) ""
usb_ehci_dma_error(void) ""
-usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
-usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
-usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
+usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
+usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
+usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
usb_ehci_log(const char *msg) "%s"
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 03/11] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
2026-05-04 2:53 ` [PATCH v6 01/11] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK Jamin Lin
2026-05-04 2:53 ` [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 04/11] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing Jamin Lin
` (8 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
Introduce a new boolean property, "caps-64bit-addr", to control
HCCPARAMS[0] (64-bit Addressing Capability).
When enabled, the EHCI controller advertises support for 64-bit
address memory pointers as defined in the EHCI specification
(Table 2-7, HCCPARAMS). This allows software to use the 64-bit
data structure formats described in Appendix B.
When disabled (default), the controller reports 32-bit addressing
capability and uses the standard 32-bit data structures.
The EHCI CTRLDSSEGMENT register provides the upper 32 bits [63:32] used to
form 64-bit addresses for EHCI control data structures. Per EHCI 1.0
spec section 2.3.5, when the HCCPARAMS 64-bit Addressing Capability bit
is zero, CTRLDSSEGMENT is not used: software cannot write it and reads
must return zero.
Add a capability check in the operational register write handler and
reject guest writes to CTRLDSSEGMENT when 64-bit addressing is
not enabled.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/usb/hcd-ehci.h | 5 ++++-
hw/usb/hcd-ehci.c | 14 +++++++++++++-
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3acbddfc5c..f1f2fde578 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -257,6 +257,7 @@ struct EHCIState {
/* properties */
uint32_t maxframes;
bool migrate_fetch_addr_64bit;
+ bool caps_64bit_addr;
/*
* EHCI spec version 1.0 Section 2.3
@@ -313,7 +314,9 @@ struct EHCIState {
#define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
- ehci.migrate_fetch_addr_64bit, true)
+ ehci.migrate_fetch_addr_64bit, true), \
+ DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
+ ehci.caps_64bit_addr, false)
extern const VMStateDescription vmstate_ehci;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 9d74259289..7166a93fd2 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1109,6 +1109,15 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
}
break;
+ case CTRLDSSEGMENT:
+ if (!s->caps_64bit_addr) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "ehci: write to CTRLDSSEGMENT while "
+ "64-bit addressing capability is disabled\n");
+ return;
+ }
+ break;
+
case ASYNCLISTADDR:
if (ehci_async_enabled(s)) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -2554,6 +2563,9 @@ void usb_ehci_realize(EHCIState *s, DeviceState *dev, Error **errp)
s->maxframes);
return;
}
+ if (s->caps_64bit_addr) {
+ s->caps[0x08] |= BIT(0);
+ }
memory_region_add_subregion(&s->mem, s->capsbase, &s->mem_caps);
memory_region_add_subregion(&s->mem, s->opregbase, &s->mem_opreg);
@@ -2613,7 +2625,7 @@ void usb_ehci_init(EHCIState *s, DeviceState *dev)
s->caps[0x05] = 0x00; /* No companion ports at present */
s->caps[0x06] = 0x00;
s->caps[0x07] = 0x00;
- s->caps[0x08] = 0x80; /* We can cache whole frame, no 64-bit */
+ s->caps[0x08] = 0x80; /* We can cache whole frame */
s->caps[0x0a] = 0x00;
s->caps[0x0b] = 0x00;
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 04/11] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (2 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 03/11] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 05/11] hw/usb/hcd-ehci: Implement 64-bit qTD " Jamin Lin
` (7 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register supplies the upper 32 bits which are
concatenated with 32-bit link pointer fields to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).
The current implementation assumes 32-bit QH descriptor addresses
and directly uses link pointer values without applying the
CTRLDSSEGMENT upper dword.
Introduce a helper, ehci_get_desc_addr(), to construct full 64-bit
descriptor addresses when 64-bit capability is enabled. Update QH
traversal paths (async list walk, horizontal QH link, and periodic
schedule entry handling) to use the translated 64-bit addresses.
EHCI 64-bit buffer pointer fields are defined in Appendix B as
split 32-bit low/high parts located at separate offsets, rather
than a single contiguous 64-bit field. Therefore, the buffer
pointers cannot be represented as uint64_t bufptr[5] without
violating the descriptor layout defined by the specification.
Introduce ehci_get_buf_addr() to construct full 64-bit buffer
addresses from bufptr[] and bufptr_hi[] fields. Use this helper
when calculating transfer buffer addresses so that data buffers
above 4GB are correctly handled.
Also add bufptr_hi[5] to EHCIqh to support 64-bit buffer pointer
fields as defined in Appendix B.
When 64-bit capability is disabled, descriptor addresses remain
32-bit and existing behaviour is unchanged.
Note: Similar split 64-bit buffer pointer handling is required for
qTD, iTD and siTD descriptors, which will be addressed in follow-up
changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/usb/hcd-ehci.h | 4 ++++
hw/usb/hcd-ehci.c | 47 ++++++++++++++++++++++++++++++++++-----------
hw/usb/trace-events | 2 +-
3 files changed, 41 insertions(+), 12 deletions(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index f1f2fde578..3428839ec6 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -141,6 +141,9 @@ typedef struct EHCIqtd {
#define QTD_BUFPTR_SH 12
} EHCIqtd;
+/* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
+#define EHCI_QH_OVERLAY_COUNT 12
+
/*
* EHCI spec version 1.0 Section 3.6
*/
@@ -194,6 +197,7 @@ typedef struct EHCIqh {
#define BUFPTR_FRAMETAG_MASK 0x0000001f
#define BUFPTR_SBYTES_MASK 0x00000fe0
#define BUFPTR_SBYTES_SH 5
+ uint32_t bufptr_hi[5];
} EHCIqh;
enum async_state {
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 7166a93fd2..e770f0a7fa 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -147,6 +147,23 @@ static const char *addr2str(hwaddr addr)
return nr2str(ehci_mmio_names, ARRAY_SIZE(ehci_mmio_names), addr);
}
+static uint64_t ehci_get_buf_addr(const EHCIState *s, uint32_t hi,
+ uint32_t lo, uint32_t lo_mask)
+{
+ uint64_t addr = lo & lo_mask;
+
+ if (s->caps_64bit_addr) {
+ addr = deposit64(addr, 32, 32, hi);
+ }
+
+ return addr;
+}
+
+static uint64_t ehci_get_desc_addr(const EHCIState *s, uint32_t lo)
+{
+ return ehci_get_buf_addr(s, s->ctrldssegment, lo, UINT32_MAX);
+}
+
static void ehci_trace_usbsts(uint32_t mask, int state)
{
/* interrupts */
@@ -440,7 +457,7 @@ static bool ehci_verify_qh(EHCIQueue *q, EHCIqh *qh)
(qh->current_qtd != q->qh.current_qtd) ||
(q->async && qh->next_qtd != q->qh.next_qtd) ||
(memcmp(&qh->altnext_qtd, &q->qh.altnext_qtd,
- 7 * sizeof(uint32_t)) != 0) ||
+ EHCI_QH_OVERLAY_COUNT * sizeof(uint32_t)) != 0) ||
(q->dev != NULL && q->dev->addr != devaddr)) {
return false;
} else {
@@ -1538,7 +1555,9 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
EHCIqh qh;
int i = 0;
int again = 0;
- uint64_t entry = ehci->asynclistaddr;
+ uint64_t entry = 0;
+
+ entry = ehci_get_desc_addr(ehci, ehci->asynclistaddr);
/* set reclamation flag at start event (4.8.6) */
if (async) {
@@ -1566,8 +1585,8 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
goto out;
}
- entry = qh.next;
- if (entry == ehci->asynclistaddr) {
+ entry = ehci_get_desc_addr(ehci, qh.next);
+ if (entry == ehci_get_desc_addr(ehci, ehci->asynclistaddr)) {
break;
}
}
@@ -1693,7 +1712,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
}
if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) {
- if (q->qhaddr != q->qh.next) {
+ if (q->qhaddr != ehci_get_desc_addr(ehci, q->qh.next)) {
trace_usb_ehci_fetchqh_dbg(q->qhaddr,
q->qh.epchar & QH_EPCHAR_H,
q->qh.token & QTD_TOKEN_HALT,
@@ -1876,10 +1895,12 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
static int ehci_state_horizqh(EHCIQueue *q)
{
+ uint64_t addr;
int again = 0;
- if (ehci_get_fetch_addr(q->ehci, q->async) != q->qh.next) {
- ehci_set_fetch_addr(q->ehci, q->async, q->qh.next);
+ addr = ehci_get_desc_addr(q->ehci, q->qh.next);
+ if (ehci_get_fetch_addr(q->ehci, q->async) != addr) {
+ ehci_set_fetch_addr(q->ehci, q->async, addr);
ehci_set_state(q->ehci, q->async, EST_FETCHENTRY);
again = 1;
} else {
@@ -2205,6 +2226,8 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
uint32_t entry;
uint32_t list;
const int async = 0;
+ uint64_t entry64;
+ uint64_t list64;
/* 4.6 */
@@ -2229,12 +2252,14 @@ static void ehci_advance_periodic_state(EHCIState *ehci)
break;
}
list |= ((ehci->frindex & 0x1ff8) >> 1);
-
- if (get_dwords(ehci, list, &entry, 1) < 0) {
+ list64 = ehci_get_desc_addr(ehci, list);
+ if (get_dwords(ehci, list64, &entry, 1) < 0) {
break;
}
- trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry);
- ehci_set_fetch_addr(ehci, async, entry);
+ entry64 = ehci_get_desc_addr(ehci, entry);
+ trace_usb_ehci_periodic_state_advance(ehci->frindex / 8,
+ list64, entry64);
+ ehci_set_fetch_addr(ehci, async, entry64);
ehci_set_state(ehci, async, EST_FETCHENTRY);
ehci_advance_state(ehci, async);
ehci_queues_rip_unused(ehci, async);
diff --git a/hw/usb/trace-events b/hw/usb/trace-events
index 8c90688bb3..67249d69c2 100644
--- a/hw/usb/trace-events
+++ b/hw/usb/trace-events
@@ -113,7 +113,7 @@ usb_ehci_dma_error(void) ""
usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
-usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
+usb_ehci_periodic_state_advance(uint32_t frame, uint64_t list, uint64_t entry) "frame=%d, list=0x%" PRIx64 ", entry=0x%" PRIx64
usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
usb_ehci_log(const char *msg) "%s"
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 05/11] hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (3 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 04/11] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 06/11] hw/usb/hcd-ehci: Implement 64-bit iTD " Jamin Lin
` (6 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
EHCI supports 64-bit addressing when the 64-bit Addressing Capability
bit in HCCPARAMS is set. In that mode, the CTRLDSSEGMENT register
provides the upper 32 bits that are concatenated with 32-bit link
pointer values to form 64-bit control data structure addresses
(EHCI 1.0, section 2.3.5 and Appendix B).
qTD link pointers (current_qtd/next_qtd/altnext_qtd and qTD.next)
are stored as 32-bit values in the data structures and must be
expanded to full 64-bit descriptor addresses when 64-bit mode is
enabled. Update the qTD traversal paths to use ehci_get_desc_addr()
when following link pointers.
Appendix B also defines high dword fields for qTD buffer pointers.
Add bufptr_hi[5] to EHCIqtd and extend qTD fetch and QH overlay
handling to load and propagate the high buffer pointer fields.
When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/usb/hcd-ehci.h | 1 +
hw/usb/hcd-ehci.c | 19 ++++++++++++-------
2 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3428839ec6..fc66aacd9f 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -139,6 +139,7 @@ typedef struct EHCIqtd {
uint32_t bufptr[5]; /* Standard buffer pointer */
#define QTD_BUFPTR_MASK 0xfffff000
#define QTD_BUFPTR_SH 12
+ uint32_t bufptr_hi[5];
} EHCIqtd;
/* QH overlay: altnext_qtd, token, bufptr[5], bufptr_hi[5] */
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index e770f0a7fa..238f08b4a5 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -472,7 +472,8 @@ static bool ehci_verify_qtd(EHCIPacket *p, EHCIqtd *qtd)
(p->qtd.next != qtd->next)) ||
(!NLPTR_TBIT(p->qtd.altnext) && (p->qtd.altnext != qtd->altnext)) ||
p->qtd.token != qtd->token ||
- p->qtd.bufptr[0] != qtd->bufptr[0]) {
+ p->qtd.bufptr[0] != qtd->bufptr[0] ||
+ p->qtd.bufptr_hi[0] != qtd->bufptr_hi[0]) {
return false;
} else {
return true;
@@ -1200,6 +1201,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q)
for (i = 0; i < 5; i++) {
q->qh.bufptr[i] = p->qtd.bufptr[i];
+ q->qh.bufptr_hi[i] = p->qtd.bufptr_hi[i];
}
if (!(q->qh.epchar & QH_EPCHAR_DTC)) {
@@ -1233,7 +1235,8 @@ static int ehci_init_transfer(EHCIPacket *p)
return -1;
}
- page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK;
+ page = ehci_get_buf_addr(p->queue->ehci, p->qtd.bufptr_hi[cpage],
+ p->qtd.bufptr[cpage], QTD_BUFPTR_MASK);
page += offset;
plen = bytes;
if (plen > 4096 - offset) {
@@ -1727,7 +1730,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
} else if ((q->qh.token & QTD_TOKEN_ACTIVE) &&
(NLPTR_TBIT(q->qh.current_qtd) == 0) &&
(q->qh.current_qtd != 0)) {
- q->qtdaddr = q->qh.current_qtd;
+ q->qtdaddr = ehci_get_desc_addr(ehci, q->qh.current_qtd);
ehci_set_state(ehci, async, EST_FETCHQTD);
} else {
@@ -1805,14 +1808,14 @@ static int ehci_state_advqueue(EHCIQueue *q)
*/
if (((q->qh.token & QTD_TOKEN_TBYTES_MASK) != 0) &&
(NLPTR_TBIT(q->qh.altnext_qtd) == 0)) {
- q->qtdaddr = q->qh.altnext_qtd;
+ q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.altnext_qtd);
ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
/*
* next qTD is valid
*/
} else if (NLPTR_TBIT(q->qh.next_qtd) == 0) {
- q->qtdaddr = q->qh.next_qtd;
+ q->qtdaddr = ehci_get_desc_addr(q->ehci, q->qh.next_qtd);
ehci_set_state(q->ehci, q->async, EST_FETCHQTD);
/*
@@ -1841,7 +1844,9 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
if (get_dwords(q->ehci, addr + 0, &qtd.next, 1) < 0 ||
get_dwords(q->ehci, addr + 4, &qtd.altnext, 1) < 0 ||
get_dwords(q->ehci, addr + 12, qtd.bufptr,
- ARRAY_SIZE(qtd.bufptr)) < 0) {
+ ARRAY_SIZE(qtd.bufptr)) < 0 ||
+ get_dwords(q->ehci, addr + 32, qtd.bufptr_hi,
+ ARRAY_SIZE(qtd.bufptr_hi)) < 0) {
return 0;
}
ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &qtd);
@@ -1922,7 +1927,7 @@ static int ehci_fill_queue(EHCIPacket *p)
if (NLPTR_TBIT(qtd.next) != 0) {
break;
}
- qtdaddr = qtd.next;
+ qtdaddr = ehci_get_desc_addr(q->ehci, qtd.next);
/*
* Detect circular td lists, Windows creates these, counting on the
* active bit going low after execution to make the queue stop.
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 06/11] hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (4 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 05/11] hw/usb/hcd-ehci: Implement 64-bit qTD " Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 07/11] hw/usb/hcd-ehci: Implement 64-bit siTD " Jamin Lin
` (5 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).
iTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the iTD traversal path to use ehci_get_desc_addr() when
following link pointers.
Appendix B also defines high dword fields for iTD buffer pointers.
Add bufptr_hi[7] to EHCIitd and use ehci_get_buf_addr() to construct
full 64-bit buffer addresses from bufptr[] and bufptr_hi[] fields
when processing isochronous transfers. This allows buffers above
4GB to be handled correctly.
When 64-bit capability is disabled, descriptor and buffer addresses
remain 32-bit and existing behaviour is unchanged.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/usb/hcd-ehci.h | 1 +
hw/usb/hcd-ehci.c | 9 ++++++---
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index fc66aacd9f..8e6a8cdfb0 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -63,6 +63,7 @@ typedef struct EHCIitd {
#define ITD_BUFPTR_MAXPKT_SH 0
#define ITD_BUFPTR_MULT_MASK 0x00000003
#define ITD_BUFPTR_MULT_SH 0
+ uint32_t bufptr_hi[7];
} EHCIitd;
/*
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 238f08b4a5..611882ba1d 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1464,7 +1464,8 @@ static int ehci_process_itd(EHCIState *ehci,
return -1;
}
- ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
+ ptr1 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg],
+ itd->bufptr[pg], ITD_BUFPTR_MASK);
qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
if (off + len > 4096) {
/* transfer crosses page border */
@@ -1472,7 +1473,9 @@ static int ehci_process_itd(EHCIState *ehci,
qemu_sglist_destroy(&ehci->isgl);
return -1; /* avoid page pg + 1 */
}
- ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
+ ptr2 = ehci_get_buf_addr(ehci, itd->bufptr_hi[pg + 1],
+ itd->bufptr[pg + 1],
+ ITD_BUFPTR_MASK);
uint32_t len2 = off + len - 4096;
uint32_t len1 = len - len2;
qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
@@ -1762,7 +1765,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
put_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &itd,
sizeof(EHCIitd) >> 2);
- ehci_set_fetch_addr(ehci, async, itd.next);
+ ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, itd.next));
ehci_set_state(ehci, async, EST_FETCHENTRY);
return 1;
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 07/11] hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (5 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 06/11] hw/usb/hcd-ehci: Implement 64-bit iTD " Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property Jamin Lin
` (4 subsequent siblings)
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
EHCI supports 64-bit control data structure addressing when the
64-bit Addressing Capability bit in HCCPARAMS is set. In that mode,
the CTRLDSSEGMENT register provides the upper 32 bits that are
concatenated with 32-bit link pointer values to form full 64-bit
descriptor addresses (EHCI 1.0, section 2.3.5 and Appendix B).
siTD link pointers are stored as 32-bit values and must be expanded
to full 64-bit descriptor addresses when 64-bit mode is enabled.
Update the siTD traversal path to use ehci_get_desc_addr() when
following link pointers.
When 64-bit capability is disabled, descriptor addresses remain
32-bit and existing behaviour is unchanged.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/usb/hcd-ehci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 611882ba1d..b1c7bfd90c 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1792,7 +1792,7 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async)
warn_report("Skipping active siTD");
}
- ehci_set_fetch_addr(ehci, async, sitd.next);
+ ehci_set_fetch_addr(ehci, async, ehci_get_desc_addr(ehci, sitd.next));
ehci_set_state(ehci, async, EST_FETCHENTRY);
return 1;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (6 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 07/11] hw/usb/hcd-ehci: Implement 64-bit siTD " Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 11:18 ` Philippe Mathieu-Daudé
2026-05-04 2:53 ` [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default Jamin Lin
` (3 subsequent siblings)
11 siblings, 1 reply; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
When 64-bit addressing is supported, the Linux EHCI driver programs the
segment register to zero. See ehci_run function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c
The driver comment also notes that descriptor structures allocated from
the DMA pool use segment zero semantics.
Descriptor memory is allocated using the DMA API. The platform driver
configures a 64-bit DMA mask so memory can be allocated above 4GB.
See ehci_platform_probe function:
https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-platform.c
On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
As a result, descriptor addresses constructed directly from the guest
EHCI registers do not match the actual system address used by the
controller when fetching queue heads (QH) and queue element transfer
descriptors (qTD).
Add a ctrldssegment-default property so platforms can provide a
descriptor address offset when constructing descriptor addresses.
This allows systems where DRAM resides above 4GB to access EHCI
descriptors correctly.
The default value is zero, so existing machines are not affected.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
hw/usb/hcd-ehci.h | 5 ++++-
hw/usb/hcd-ehci.c | 1 +
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 8e6a8cdfb0..3d57e1de5f 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -264,6 +264,7 @@ struct EHCIState {
uint32_t maxframes;
bool migrate_fetch_addr_64bit;
bool caps_64bit_addr;
+ uint32_t ctrldssegment_default;
/*
* EHCI spec version 1.0 Section 2.3
@@ -322,7 +323,9 @@ struct EHCIState {
DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
ehci.migrate_fetch_addr_64bit, true), \
DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
- ehci.caps_64bit_addr, false)
+ ehci.caps_64bit_addr, false), \
+ DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
+ ehci.ctrldssegment_default, 0)
extern const VMStateDescription vmstate_ehci;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index b1c7bfd90c..62c3770ac5 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1134,6 +1134,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr,
"64-bit addressing capability is disabled\n");
return;
}
+ val |= s->ctrldssegment_default;
break;
case ASYNCLISTADDR:
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (7 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 11:19 ` Philippe Mathieu-Daudé
2026-05-04 2:53 ` [PATCH v6 10/11] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing Jamin Lin
` (2 subsequent siblings)
11 siblings, 1 reply; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
On AST2700 platforms, system DRAM is mapped above 4GB with a base
address at 0x400000000.
The Linux EHCI driver programs the segment register to zero when
64-bit addressing is supported. As a result, descriptor addresses
derived from the EHCI registers do not include the DRAM base
address.
Descriptor memory is allocated through the DMA API with a 64-bit
DMA mask, allowing descriptors to reside in DRAM above 4GB. On
AST2700, EHCI queue heads (QH) and queue element transfer
descriptors (qTD) are therefore placed at addresses starting from
0x400000000.
Set the ctrldssegment-default property to "sc->memmap[ASPEED_DEV_SDRAM] >> 32"
so the upper 32 bits of descriptor addresses are adjusted accordingly. This
allows the emulated EHCI controller to construct correct system
addresses when accessing descriptors in DRAM above 4GB.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
hw/arm/aspeed_ast27x0.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 87dcb82e1b..ea527479e6 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -856,6 +856,9 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
/* EHCI */
for (i = 0; i < sc->ehcis_num; i++) {
+ object_property_set_int(OBJECT(&s->ehci[i]), "ctrldssegment-default",
+ sc->memmap[ASPEED_DEV_SDRAM] >> 32,
+ &error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
return;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 10/11] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (8 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 11/11] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2 Jamin Lin
2026-05-04 5:27 ` [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Cédric Le Goater
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
AST2700 supports a 64-bit DRAM address space. Therefore, DMA
transactions must be capable of accessing 64-bit addresses.
Enable the "caps-64bit-addr" property for the EHCI controllers
on AST2700 so that USB DMA operations can correctly handle
64-bit memory addresses.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/arm/aspeed_ast27x0.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index ea527479e6..a8f0bc389c 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -859,6 +859,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
object_property_set_int(OBJECT(&s->ehci[i]), "ctrldssegment-default",
sc->memmap[ASPEED_DEV_SDRAM] >> 32,
&error_abort);
+ object_property_set_bool(OBJECT(&s->ehci[i]), "caps-64bit-addr", true,
+ &error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
return;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* [PATCH v6 11/11] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (9 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 10/11] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing Jamin Lin
@ 2026-05-04 2:53 ` Jamin Lin
2026-05-04 5:27 ` [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Cédric Le Goater
11 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-04 2:53 UTC (permalink / raw)
To: philmd@linaro.org, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Jamin Lin, Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
Add a functional test to verify USB EHCI support on the AST2700 A2/A1
by attaching a USB keyboard device and checking its
enumeration via lsusb.
This introduces a helper routine that runs lsusb in the guest
and validates that the emulated "QEMU USB Keyboard" is detected.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
---
tests/functional/aarch64/test_aspeed_ast2700a1.py | 7 +++++++
tests/functional/aarch64/test_aspeed_ast2700a2.py | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/tests/functional/aarch64/test_aspeed_ast2700a1.py b/tests/functional/aarch64/test_aspeed_ast2700a1.py
index b0c08854da..42b8b200cf 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a1.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a1.py
@@ -118,6 +118,11 @@ def do_ast2700_pcie_test(self):
'ip addr show dev eth2',
'inet 10.0.2.15/24')
+ def do_ast2700_usb_ehci_test(self):
+ exec_command_and_wait_for_pattern(self,
+ 'lsusb',
+ 'QEMU QEMU USB Keyboard')
+
def start_ast2700_test(self, name, bus_id):
num_cpu = 4
load_images_list = [
@@ -161,10 +166,12 @@ def test_aarch64_ast2700a1_evb_sdk_v11_01(self):
self.archive_extract(self.ASSET_SDK_V1101_AST2700A1)
self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
self.vm.add_args('-netdev', 'user,id=net1')
+ self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
self.start_ast2700_test('ast2700-a1-image', 1)
self.verify_openbmc_boot_and_login('ast2700-a1')
self.do_ast2700_i2c_test(1)
self.do_ast2700_pcie_test()
+ self.do_ast2700_usb_ehci_test()
def test_aarch64_ast2700a1_evb_sdk_vbootrom_v11_01(self):
self.set_machine('ast2700a1-evb')
diff --git a/tests/functional/aarch64/test_aspeed_ast2700a2.py b/tests/functional/aarch64/test_aspeed_ast2700a2.py
index ed414999f4..40e0ad81ed 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a2.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a2.py
@@ -121,6 +121,11 @@ def do_ast2700_pcie_test(self):
'ip addr show dev eth2',
'inet 10.0.2.15/24')
+ def do_ast2700_usb_ehci_test(self):
+ exec_command_and_wait_for_pattern(self,
+ 'lsusb',
+ 'QEMU QEMU USB Keyboard')
+
def start_ast2700_test(self, name, bus_id):
num_cpu = 4
load_images_list = [
@@ -164,10 +169,12 @@ def test_aarch64_ast2700a2_evb_sdk_v11_01(self):
self.archive_extract(self.ASSET_SDK_V1101_AST2700A2)
self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
self.vm.add_args('-netdev', 'user,id=net1')
+ self.vm.add_args('-device', 'usb-kbd,bus=usb-bus.3')
self.start_ast2700_test('ast2700-default-image', 1)
self.verify_openbmc_boot_and_login('ast2700-default')
self.do_ast2700_i2c_test(1)
self.do_ast2700_pcie_test()
+ self.do_ast2700_usb_ehci_test()
def test_aarch64_ast2700a2_evb_sdk_vbootrom_v11_01(self):
self.set_machine('ast2700a2-evb')
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread
* Re: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility
2026-05-04 2:53 ` [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility Jamin Lin
@ 2026-05-04 5:19 ` Cédric Le Goater
2026-05-04 12:17 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-04 5:19 UTC (permalink / raw)
To: Jamin Lin, philmd@linaro.org, peterx@redhat.com, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 5/4/26 04:53, Jamin Lin wrote:
> Change internal EHCI descriptor addresses from uint32_t to uint64_t.
>
> The following fields are updated:
> - EHCIPacket::qtdaddr
> - EHCIQueue::{qhaddr, qtdaddr}
> - EHCIState::{a_fetch_addr, p_fetch_addr}
>
> Update get_dwords() and put_dwords() to take 64-bit addresses and
> propagate the type change through the descriptor traversal paths.
>
> Adjust NLPTR_GET() to operate on 64-bit values:
>
> #define NLPTR_GET(x) ((x) & ~0x1fULL)
>
> so that link pointer masking works correctly when descriptor
> addresses exceed 32-bit space. The previous mask (0xffffffe0)
> implicitly truncated addresses to 32 bits.
>
> This patch does not change the on-wire descriptor layout yet.
> It only removes the internal 32-bit address limit and prepares
> for later patches that will add full 64-bit QH/qTD/iTD/siTD support.
>
> Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> use uint64_t for the address argument and print it with PRIx64. This
> ensures full 64-bit addresses are shown in trace output and improves
> debugging of queue heads and transfer descriptors.
>
> Migration compatibility:
>
> To preserve backward migration compatibility, keep the legacy 32-bit
> fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
> new 64-bit fields.
>
> Migration format is selected using a machine compat property
> "x-migrate-fetch-addr-64bit":
>
> - Old machine types migrate 32-bit fetch addresses
> - New machine types migrate full 64-bit fetch addresses
>
> This is implemented using VMSTATE_UINT32_TEST() and
> VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
>
> In pre_save, the 32-bit shadow fields are populated when migrating
> to old machine types. In post_load, the 32-bit values are restored
> into the 64-bit fields when loading old migration streams.
>
> No functional change.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/usb/hcd-ehci.h | 17 +++++++----
> hw/core/machine.c | 5 +++-
> hw/usb/hcd-ehci.c | 72 ++++++++++++++++++++++++++++++++-------------
> hw/usb/trace-events | 24 +++++++--------
> 4 files changed, 78 insertions(+), 40 deletions(-)
>
> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
> index d038ee1e31..3acbddfc5c 100644
> --- a/hw/usb/hcd-ehci.h
> +++ b/hw/usb/hcd-ehci.h
> @@ -208,7 +208,7 @@ struct EHCIPacket {
> QTAILQ_ENTRY(EHCIPacket) next;
>
> EHCIqtd qtd; /* copy of current QTD (being worked on) */
> - uint32_t qtdaddr; /* address QTD read from */
> + uint64_t qtdaddr; /* address QTD read from */
>
> USBPacket packet;
> QEMUSGList sgl;
> @@ -229,8 +229,8 @@ struct EHCIQueue {
> * when guest removes an entry (doorbell, handshake sequence)
> */
> EHCIqh qh; /* copy of current QH (being worked on) */
> - uint32_t qhaddr; /* address QH read from */
> - uint32_t qtdaddr; /* address QTD read from */
> + uint64_t qhaddr; /* address QH read from */
> + uint64_t qtdaddr; /* address QTD read from */
> int last_pid; /* pid of last packet executed */
> USBDevice *dev;
> QTAILQ_HEAD(, EHCIPacket) packets;
> @@ -256,6 +256,7 @@ struct EHCIState {
>
> /* properties */
> uint32_t maxframes;
> + bool migrate_fetch_addr_64bit;
>
> /*
> * EHCI spec version 1.0 Section 2.3
> @@ -294,8 +295,10 @@ struct EHCIState {
> EHCIQueueHead pqueues;
>
> /* which address to look at next */
> - uint32_t a_fetch_addr;
> - uint32_t p_fetch_addr;
> + uint32_t a_fetch_addr_32;
> + uint32_t p_fetch_addr_32;
> + uint64_t a_fetch_addr;
> + uint64_t p_fetch_addr;
>
> USBPacket ipacket;
> QEMUSGList isgl;
> @@ -308,7 +311,9 @@ struct EHCIState {
> };
>
> #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> - DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> + DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> + DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> + ehci.migrate_fetch_addr_64bit, true)
>
> extern const VMStateDescription vmstate_ehci;
>
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 1b661fd36a..54336da294 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -39,7 +39,10 @@
> #include "hw/acpi/generic_event_device.h"
> #include "qemu/audio.h"
>
> -GlobalProperty hw_compat_11_0[] = {};
> +GlobalProperty hw_compat_11_0[] = {
> + { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> + { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> +};
> const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
>
> GlobalProperty hw_compat_10_2[] = {
> diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
> index 28a60e4c1a..9d74259289 100644
> --- a/hw/usb/hcd-ehci.c
> +++ b/hw/usb/hcd-ehci.c
> @@ -72,7 +72,7 @@ typedef enum {
> } EHCI_STATES;
>
> /* macros for accessing fields within next link pointer entry */
> -#define NLPTR_GET(x) ((x) & 0xffffffe0)
> +#define NLPTR_GET(x) ((x) & ~0x1fULL)
> #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3)
> #define NLPTR_TBIT(x) ((x) & 1) /* 1=invalid, 0=valid */
>
> @@ -287,7 +287,7 @@ static int ehci_get_state(EHCIState *s, int async)
> return async ? s->astate : s->pstate;
> }
>
> -static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
> +static void ehci_set_fetch_addr(EHCIState *s, int async, uint64_t addr)
> {
> if (async) {
> s->a_fetch_addr = addr;
> @@ -296,7 +296,7 @@ static void ehci_set_fetch_addr(EHCIState *s, int async, uint32_t addr)
> }
> }
>
> -static int ehci_get_fetch_addr(EHCIState *s, int async)
> +static uint64_t ehci_get_fetch_addr(EHCIState *s, int async)
> {
> return async ? s->a_fetch_addr : s->p_fetch_addr;
> }
> @@ -373,7 +373,7 @@ static inline bool ehci_periodic_enabled(EHCIState *s)
> }
>
> /* Get an array of dwords from main memory */
> -static inline int get_dwords(EHCIState *ehci, uint32_t addr,
> +static inline int get_dwords(EHCIState *ehci, uint64_t addr,
> uint32_t *buf, int num)
> {
> int i;
> @@ -395,7 +395,7 @@ static inline int get_dwords(EHCIState *ehci, uint32_t addr,
> }
>
> /* Put an array of dwords in to main memory */
> -static inline int put_dwords(EHCIState *ehci, uint32_t addr,
> +static inline int put_dwords(EHCIState *ehci, uint64_t addr,
> uint32_t *buf, int num)
> {
> int i;
> @@ -549,7 +549,7 @@ static void ehci_free_packet(EHCIPacket *p)
>
> /* queue management */
>
> -static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint32_t addr, int async)
> +static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, uint64_t addr, int async)
> {
> EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
> EHCIQueue *q;
> @@ -622,7 +622,7 @@ static void ehci_free_queue(EHCIQueue *q, const char *warn)
> g_free(q);
> }
>
> -static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint32_t addr,
> +static EHCIQueue *ehci_find_queue_by_qh(EHCIState *ehci, uint64_t addr,
> int async)
> {
> EHCIQueueHead *head = async ? &ehci->aqueues : &ehci->pqueues;
> @@ -1135,7 +1135,7 @@ static void ehci_flush_qh(EHCIQueue *q)
> {
> uint32_t *qh = (uint32_t *) &q->qh;
> uint32_t dwords = sizeof(EHCIqh) >> 2;
> - uint32_t addr = NLPTR_GET(q->qhaddr);
> + uint64_t addr = NLPTR_GET(q->qhaddr);
>
> put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);
> }
> @@ -1406,12 +1406,13 @@ static int ehci_execute(EHCIPacket *p, const char *action)
> /* 4.7.2 */
> static int ehci_process_itd(EHCIState *ehci,
> EHCIitd *itd,
> - uint32_t addr)
> + uint64_t addr)
> {
> USBDevice *dev;
> USBEndpoint *ep;
> uint32_t i, len, pid, dir, devaddr, endp;
> - uint32_t pg, off, ptr1, ptr2, max, mult;
> + uint32_t pg, off, max, mult;
> + uint64_t ptr1, ptr2;
>
> ehci->periodic_sched_active = PERIODIC_ACTIVE;
>
> @@ -1528,7 +1529,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async)
> EHCIqh qh;
> int i = 0;
> int again = 0;
> - uint32_t entry = ehci->asynclistaddr;
> + uint64_t entry = ehci->asynclistaddr;
>
> /* set reclamation flag at start event (4.8.6) */
> if (async) {
> @@ -1578,7 +1579,7 @@ out:
> static int ehci_state_fetchentry(EHCIState *ehci, int async)
> {
> int again = 0;
> - uint32_t entry = ehci_get_fetch_addr(ehci, async);
> + uint64_t entry = ehci_get_fetch_addr(ehci, async);
>
> if (NLPTR_TBIT(entry)) {
> ehci_set_state(ehci, async, EST_ACTIVE);
> @@ -1611,7 +1612,7 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async)
> default:
> /* TODO: handle FSTN type */
> qemu_log_mask(LOG_GUEST_ERROR,
> - "FETCHENTRY: entry at 0x%x is of type %u "
> + "FETCHENTRY: entry at %" PRIx64 "is of type %" PRIu64 " "
^
missing space.
I will amend the patch when applying.
> "which is not supported yet\n",
> entry, NLPTR_TYPE_GET(entry));
> return -1;
> @@ -1623,7 +1624,7 @@ out:
>
> static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async)
> {
> - uint32_t entry;
> + uint64_t entry;
> EHCIQueue *q;
> EHCIqh qh;
>
> @@ -1712,7 +1713,7 @@ out:
>
> static int ehci_state_fetchitd(EHCIState *ehci, int async)
> {
> - uint32_t entry;
> + uint64_t entry;
> EHCIitd itd;
>
> assert(!async);
> @@ -1738,7 +1739,7 @@ static int ehci_state_fetchitd(EHCIState *ehci, int async)
>
> static int ehci_state_fetchsitd(EHCIState *ehci, int async)
> {
> - uint32_t entry;
> + uint64_t entry;
> EHCIsitd sitd;
>
> assert(!async);
> @@ -1802,7 +1803,7 @@ static int ehci_state_fetchqtd(EHCIQueue *q)
> EHCIqtd qtd;
> EHCIPacket *p;
> int again = 1;
> - uint32_t addr;
> + uint64_t addr;
>
> addr = NLPTR_GET(q->qtdaddr);
> if (get_dwords(q->ehci, addr + 8, &qtd.token, 1) < 0) {
> @@ -1885,7 +1886,7 @@ static int ehci_fill_queue(EHCIPacket *p)
> USBEndpoint *ep = p->packet.ep;
> EHCIQueue *q = p->queue;
> EHCIqtd qtd = p->qtd;
> - uint32_t qtdaddr;
> + uint64_t qtdaddr;
>
> for (;;) {
> if (NLPTR_TBIT(qtd.next) != 0) {
> @@ -2008,7 +2009,8 @@ static int ehci_state_executing(EHCIQueue *q)
> static int ehci_state_writeback(EHCIQueue *q)
> {
> EHCIPacket *p = QTAILQ_FIRST(&q->packets);
> - uint32_t *qtd, addr;
> + uint32_t *qtd;
> + uint64_t addr;
> int again = 0;
>
> /* Write back the QTD from the QH area */
> @@ -2414,6 +2416,18 @@ static USBBusOps ehci_bus_ops_standalone = {
> .wakeup_endpoint = ehci_wakeup_endpoint,
> };
>
> +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
> +{
> + EHCIState *s = opaque;
> +
> + return s->migrate_fetch_addr_64bit;
> +}
> +
> +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
> +{
> + return !ehci_fetch_addr_64_needed(opaque, version_id);
> +}
> +
> static int usb_ehci_pre_save(void *opaque)
> {
> EHCIState *ehci = opaque;
> @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
> ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
> ehci->frindex = new_frindex;
>
> + if (!ehci->migrate_fetch_addr_64bit) {
> + ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> + ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> + }
> +
> return 0;
> }
>
> @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
> }
> }
>
> + if (!s->migrate_fetch_addr_64bit) {
> + s->a_fetch_addr = s->a_fetch_addr_32;
> + s->p_fetch_addr = s->p_fetch_addr_32;
> + }
> +
> return 0;
> }
>
> @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
> /* schedule state */
> VMSTATE_UINT32(astate, EHCIState),
> VMSTATE_UINT32(pstate, EHCIState),
> - VMSTATE_UINT32(a_fetch_addr, EHCIState),
> - VMSTATE_UINT32(p_fetch_addr, EHCIState),
> + VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> + ehci_fetch_addr_32_needed),
> + VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> + ehci_fetch_addr_32_needed),
> + VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> + ehci_fetch_addr_64_needed),
> + VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> + ehci_fetch_addr_64_needed),
> VMSTATE_END_OF_LIST()
> }
> };
> diff --git a/hw/usb/trace-events b/hw/usb/trace-events
> index 0d4318dcf1..8c90688bb3 100644
> --- a/hw/usb/trace-events
> +++ b/hw/usb/trace-events
> @@ -86,15 +86,15 @@ usb_ehci_portsc_write(uint32_t addr, uint32_t port, uint32_t val) "wr mmio 0x%04
> usb_ehci_portsc_change(uint32_t addr, uint32_t port, uint32_t new, uint32_t old) "ch mmio 0x%04x [port %d] = 0x%x (old: 0x%x)"
> usb_ehci_usbsts(const char *sts, int state) "usbsts %s %d"
> usb_ehci_state(const char *schedule, const char *state) "%s schedule %s"
> -usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
> -usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d"
> -usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d"
> +usb_ehci_qh_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%" PRIx64 ": next 0x%08x qtds 0x%08x,0x%08x,0x%08x"
> +usb_ehci_qh_fields(uint64_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%" PRIx64 " - rl %d, mplen %d, eps %d, ep %d, dev %d"
> +usb_ehci_qh_bits(uint64_t addr, int c, int h, int dtc, int i) "QH @ 0x%" PRIx64 " - c %d, h %d, dtc %d, i %d"
> usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d"
> -usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x"
> -usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d"
> -usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d"
> -usb_ehci_itd(uint32_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%08x: next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
> -usb_ehci_sitd(uint32_t addr, uint32_t nxt, uint32_t active) "ITD @ 0x%08x: next 0x%08x - active %d"
> +usb_ehci_qtd_ptrs(void *q, uint64_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%" PRIx64 ": next 0x%08x altnext 0x%08x"
> +usb_ehci_qtd_fields(uint64_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%" PRIx64 " - tbytes %d, cpage %d, cerr %d, pid %d"
> +usb_ehci_qtd_bits(uint64_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%" PRIx64 " - ioc %d, active %d, halt %d, babble %d, xacterr %d"
> +usb_ehci_itd(uint64_t addr, uint32_t nxt, uint32_t mplen, uint32_t mult, uint32_t ep, uint32_t devaddr) "ITD @ 0x%" PRIx64 ": next 0x%08x - mplen %d, mult %d, ep %d, dev %d"
> +usb_ehci_sitd(uint64_t addr, uint32_t nxt, uint32_t active) "SITD @ 0x%" PRIx64 ": next 0x%08x - active %d"
> usb_ehci_port_attach(uint32_t port, const char *owner, const char *device) "attach port #%d, owner %s, device %s"
> usb_ehci_port_detach(uint32_t port, const char *owner) "detach port #%d, owner %s"
> usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d"
> @@ -104,15 +104,15 @@ usb_ehci_port_resume(uint32_t port) "port #%d"
> usb_ehci_port_disable(uint32_t port) "port #%d"
> usb_ehci_queue_action(void *q, const char *action) "q %p: %s"
> usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s"
> -usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
> +usb_ehci_packet_submit(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%" PRIx64 ", next=0x%x, qtd=0x%" PRIx64 ", pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d"
> usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x"
> usb_ehci_guest_bug(const char *reason) "%s"
> usb_ehci_doorbell_ring(void) ""
> usb_ehci_doorbell_ack(void) ""
> usb_ehci_dma_error(void) ""
> -usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d"
> -usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing"
> -usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
> +usb_ehci_execute_complete(uint64_t qhaddr, uint32_t next, uint64_t qtdaddr, int status, int actual_length) "qhaddr=0x%" PRIx64 ", next=0x%x, qtdaddr=0x%" PRIx64 ", status=%d, actual_length=%d"
> +usb_ehci_fetchqh_reclaim_done(uint64_t qhaddr) "QH 0x%" PRIx64 " H-bit set, reclamation status reset - done processing"
> +usb_ehci_fetchqh_dbg(uint64_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%" PRIx64 " (h 0x%x halt 0x%x active 0x%x) next 0x%08x"
> usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x"
> usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes"
> usb_ehci_log(const char *msg) "%s"
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Thanks,
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
` (10 preceding siblings ...)
2026-05-04 2:53 ` [PATCH v6 11/11] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2 Jamin Lin
@ 2026-05-04 5:27 ` Cédric Le Goater
2026-05-11 6:13 ` Cédric Le Goater
11 siblings, 1 reply; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-04 5:27 UTC (permalink / raw)
To: Jamin Lin, philmd@linaro.org, peterx@redhat.com, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 5/4/26 04:53, Jamin Lin wrote:
> EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
> which provides the upper 32 bits of descriptor addresses when the
> controller advertises 64-bit capability.
>
> Currently QEMU EHCI model only partially supports this functionality and
> descriptor addresses are effectively treated as 32-bit. This becomes
> problematic on systems where system memory is located above the 4GB
> boundary.
>
> The Linux EHCI driver enables 64-bit addressing if the controller
> advertises the capability. During initialization it programs the
> segment register to zero:
>
> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600
>
> The driver also notes that descriptor structures allocated from the
> DMA pool use segment zero semantics. Descriptor memory is allocated
> using the DMA API and platforms may configure a 64-bit DMA mask,
> allowing descriptor memory to be placed above 4GB.
>
> On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
> result, descriptor addresses constructed directly from the EHCI
> registers do not match the actual system addresses used by the
> controller when accessing queue heads (QH) and queue element transfer
> descriptors (qTD).
>
> This patch series implements full 64-bit descriptor addressing support
> in the EHCI emulation. Descriptor address handling is updated to use
> 64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
> are extended to support the upper address bits provided by the segment
> register.
>
> Add a ctrldssegment-default property so platforms can provide a
> descriptor address offset when constructing descriptor addresses.
> This allows systems where DRAM resides above 4GB to access EHCI
> descriptors correctly.
>
> The AST2700 machine uses this property to account for its DRAM mapping
> at 0x400000000 and enables 64-bit EHCI DMA addressing.
>
> Test Result:
> 1. EHCI 32bits with ast2600-evb machine
> Command line:
> ./build/qemu-system-arm \
> -machine ast2600-evb \
> -m 1G \
> -drive file=image-bmc,if=mtd,format=raw \
> -nographic \
> -device usb-kbd,bus=usb-bus.1,id=mykbd \
> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
> -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
> -snapshot \
> -nographic
> Result:
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
> Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
> Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
>
> 2. EHCI 64bits with ast2700a2-evb machine
> Command line:
> ./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
> -bios ast27x0_bootrom.bin \
> -drive file=image-bmc,format=raw,if=mtd \
> -snapshot \
> -device usb-kbd,bus=usb-bus.3,id=mykbd \
> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
> -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
> Result:
> root@ast2700-default:~# lsusb
> unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
> Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
> Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
> Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>
> v1
> 1. Fix checkpatch coding style issues
> 2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
> 3. Add descriptor address offset property
> 4. Enable 64-bit EHCI DMA addressing on AST2700
> 5. Configure descriptor address offset for AST2700
>
> v2
> 1. Remove unused EHCIfstn structure and dead code
> 2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
> 3. Replace DPRINTF debug logs with trace events
> 4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
> 5. Fix review issue
>
> v3:
> 1. Add Migration version test function
> 2. Add EHCI 64-bit buffer pointer fields description in commit log
>
> v4:
> 1. Reorder patches in the series
> 2. Fix EHCI migration issues
> 3. Introduce a common properties macro for both sysbus and PCI
> 4. Drop the descriptor address offset property
> 5. Add ctrldssegment-default property
> 6. Address review comments
>
> v5:
> 1. Add 11.0 machine compatibility properties
>
> v6:
> 1. Update reviewer suggested improvements.
>
> Jamin Lin (11):
> tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
> AST2600 SDK
> hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
> compatibility
> hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
> capability
> hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
> hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
> hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
> hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
> hw/usb/hcd-ehci: Add ctrldssegment-default property
> hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
> hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
> tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
> AST2700 A1/A2
>
> hw/usb/hcd-ehci.h | 29 +++-
> hw/arm/aspeed_ast27x0.c | 5 +
> hw/core/machine.c | 5 +-
> hw/usb/hcd-ehci.c | 162 +++++++++++++-----
> hw/usb/trace-events | 26 +--
> .../aarch64/test_aspeed_ast2700a1.py | 7 +
> .../aarch64/test_aspeed_ast2700a2.py | 7 +
> .../functional/arm/test_aspeed_ast2600_sdk.py | 7 +
> 8 files changed, 185 insertions(+), 63 deletions(-)
>
Applied to
https://github.com/legoater/qemu aspeed-next
Please base future contributions on this branch.
Thanks,
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 2:53 ` [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property Jamin Lin
@ 2026-05-04 11:18 ` Philippe Mathieu-Daudé
2026-05-04 12:17 ` Cédric Le Goater
0 siblings, 1 reply; 27+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-05-04 11:18 UTC (permalink / raw)
To: Jamin Lin, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
On 4/5/26 04:53, Jamin Lin wrote:
> When 64-bit addressing is supported, the Linux EHCI driver programs the
> segment register to zero. See ehci_run function:
> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c
>
> The driver comment also notes that descriptor structures allocated from
> the DMA pool use segment zero semantics.
>
> Descriptor memory is allocated using the DMA API. The platform driver
> configures a 64-bit DMA mask so memory can be allocated above 4GB.
> See ehci_platform_probe function:
> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-platform.c
>
> On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
> As a result, descriptor addresses constructed directly from the guest
> EHCI registers do not match the actual system address used by the
> controller when fetching queue heads (QH) and queue element transfer
> descriptors (qTD).
>
> Add a ctrldssegment-default property so platforms can provide a
> descriptor address offset when constructing descriptor addresses.
> This allows systems where DRAM resides above 4GB to access EHCI
> descriptors correctly.
>
> The default value is zero, so existing machines are not affected.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> ---
> hw/usb/hcd-ehci.h | 5 ++++-
> hw/usb/hcd-ehci.c | 1 +
> 2 files changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
> index 8e6a8cdfb0..3d57e1de5f 100644
> --- a/hw/usb/hcd-ehci.h
> +++ b/hw/usb/hcd-ehci.h
> @@ -264,6 +264,7 @@ struct EHCIState {
> uint32_t maxframes;
> bool migrate_fetch_addr_64bit;
> bool caps_64bit_addr;
> + uint32_t ctrldssegment_default;
>
> /*
> * EHCI spec version 1.0 Section 2.3
> @@ -322,7 +323,9 @@ struct EHCIState {
> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> ehci.migrate_fetch_addr_64bit, true), \
> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
> - ehci.caps_64bit_addr, false)
> + ehci.caps_64bit_addr, false), \
> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
> + ehci.ctrldssegment_default, 0)
ctrl-ds-segment-default and ctrl_ds_segment_default?
Otherwise,
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
2026-05-04 2:53 ` [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default Jamin Lin
@ 2026-05-04 11:19 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 27+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-05-04 11:19 UTC (permalink / raw)
To: Jamin Lin, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com, Cédric Le Goater
On 4/5/26 04:53, Jamin Lin wrote:
> On AST2700 platforms, system DRAM is mapped above 4GB with a base
> address at 0x400000000.
>
> The Linux EHCI driver programs the segment register to zero when
> 64-bit addressing is supported. As a result, descriptor addresses
> derived from the EHCI registers do not include the DRAM base
> address.
>
> Descriptor memory is allocated through the DMA API with a 64-bit
> DMA mask, allowing descriptors to reside in DRAM above 4GB. On
> AST2700, EHCI queue heads (QH) and queue element transfer
> descriptors (qTD) are therefore placed at addresses starting from
> 0x400000000.
>
> Set the ctrldssegment-default property to "sc->memmap[ASPEED_DEV_SDRAM] >> 32"
> so the upper 32 bits of descriptor addresses are adjusted accordingly. This
> allows the emulated EHCI controller to construct correct system
> addresses when accessing descriptors in DRAM above 4GB.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> ---
> hw/arm/aspeed_ast27x0.c | 3 +++
> 1 file changed, 3 insertions(+)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility
2026-05-04 2:53 ` [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility Jamin Lin
2026-05-04 5:19 ` Cédric Le Goater
@ 2026-05-04 12:17 ` Philippe Mathieu-Daudé
2026-05-06 2:09 ` Jamin Lin
1 sibling, 1 reply; 27+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-05-04 12:17 UTC (permalink / raw)
To: Jamin Lin, peterx@redhat.com, Cédric Le Goater,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 4/5/26 04:53, Jamin Lin wrote:
> Change internal EHCI descriptor addresses from uint32_t to uint64_t.
>
> The following fields are updated:
> - EHCIPacket::qtdaddr
> - EHCIQueue::{qhaddr, qtdaddr}
> - EHCIState::{a_fetch_addr, p_fetch_addr}
>
> Update get_dwords() and put_dwords() to take 64-bit addresses and
> propagate the type change through the descriptor traversal paths.
>
> Adjust NLPTR_GET() to operate on 64-bit values:
>
> #define NLPTR_GET(x) ((x) & ~0x1fULL)
>
> so that link pointer masking works correctly when descriptor
> addresses exceed 32-bit space. The previous mask (0xffffffe0)
> implicitly truncated addresses to 32 bits.
>
> This patch does not change the on-wire descriptor layout yet.
> It only removes the internal 32-bit address limit and prepares
> for later patches that will add full 64-bit QH/qTD/iTD/siTD support.
>
> Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> use uint64_t for the address argument and print it with PRIx64. This
> ensures full 64-bit addresses are shown in trace output and improves
> debugging of queue heads and transfer descriptors.
>
> Migration compatibility:
>
> To preserve backward migration compatibility, keep the legacy 32-bit
> fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
> new 64-bit fields.
>
> Migration format is selected using a machine compat property
> "x-migrate-fetch-addr-64bit":
>
> - Old machine types migrate 32-bit fetch addresses
> - New machine types migrate full 64-bit fetch addresses
>
> This is implemented using VMSTATE_UINT32_TEST() and
> VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
>
> In pre_save, the 32-bit shadow fields are populated when migrating
> to old machine types. In post_load, the 32-bit values are restored
> into the 64-bit fields when loading old migration streams.
>
> No functional change.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/usb/hcd-ehci.h | 17 +++++++----
> hw/core/machine.c | 5 +++-
> hw/usb/hcd-ehci.c | 72 ++++++++++++++++++++++++++++++++-------------
> hw/usb/trace-events | 24 +++++++--------
> 4 files changed, 78 insertions(+), 40 deletions(-)
> @@ -256,6 +256,7 @@ struct EHCIState {
>
> /* properties */
> uint32_t maxframes;
> + bool migrate_fetch_addr_64bit;
>
> /*
> * EHCI spec version 1.0 Section 2.3
> @@ -294,8 +295,10 @@ struct EHCIState {
> EHCIQueueHead pqueues;
>
> /* which address to look at next */
> - uint32_t a_fetch_addr;
> - uint32_t p_fetch_addr;
> + uint32_t a_fetch_addr_32;
> + uint32_t p_fetch_addr_32;
Technically '?_fetch_addr_32' aren't "which address to look at next"
anymore, but simple migration helpers. Could be worth adding a comment?
And rename including 'migrat{e,ion}'? Can be cleared on top.
> + uint64_t a_fetch_addr;
> + uint64_t p_fetch_addr;
>
> USBPacket ipacket;
> QEMUSGList isgl;
> @@ -308,7 +311,9 @@ struct EHCIState {
> };
>
> #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> - DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> + DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> + DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> + ehci.migrate_fetch_addr_64bit, true)
>
> extern const VMStateDescription vmstate_ehci;
>
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 1b661fd36a..54336da294 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -39,7 +39,10 @@
> #include "hw/acpi/generic_event_device.h"
> #include "qemu/audio.h"
>
> -GlobalProperty hw_compat_11_0[] = {};
> +GlobalProperty hw_compat_11_0[] = {
> + { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> + { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> +};
> const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
Good.
> +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
> +{
> + EHCIState *s = opaque;
> +
> + return s->migrate_fetch_addr_64bit;
> +}
> +
> +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
> +{
> + return !ehci_fetch_addr_64_needed(opaque, version_id);
> +}
> +
> static int usb_ehci_pre_save(void *opaque)
> {
> EHCIState *ehci = opaque;
> @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
> ehci->last_run_ns -= (ehci->frindex - new_frindex) * UFRAME_TIMER_NS;
> ehci->frindex = new_frindex;
>
> + if (!ehci->migrate_fetch_addr_64bit) {
> + ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> + ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> + }
> +
> return 0;
> }
>
> @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int version_id)
> }
> }
>
> + if (!s->migrate_fetch_addr_64bit) {
> + s->a_fetch_addr = s->a_fetch_addr_32;
> + s->p_fetch_addr = s->p_fetch_addr_32;
> + }
> +
> return 0;
> }
>
> @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
> /* schedule state */
> VMSTATE_UINT32(astate, EHCIState),
> VMSTATE_UINT32(pstate, EHCIState),
> - VMSTATE_UINT32(a_fetch_addr, EHCIState),
> - VMSTATE_UINT32(p_fetch_addr, EHCIState),
> + VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> + ehci_fetch_addr_32_needed),
> + VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> + ehci_fetch_addr_32_needed),
> + VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> + ehci_fetch_addr_64_needed),
> + VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> + ehci_fetch_addr_64_needed),
Hmmmm. I didn't review all previous versions, for my own education, why
don't we use VMSTATE_UINT64_V() here? Did you test (pre-11 <-> this
series) migration? My understanding was we need to maintain the stream
size to avoid mismatch.
> VMSTATE_END_OF_LIST()
> }
> };
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 11:18 ` Philippe Mathieu-Daudé
@ 2026-05-04 12:17 ` Cédric Le Goater
2026-05-04 12:42 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-04 12:17 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, Jamin Lin, peterx@redhat.com,
Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Zhao Liu,
open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 5/4/26 13:18, Philippe Mathieu-Daudé wrote:
> On 4/5/26 04:53, Jamin Lin wrote:
>> When 64-bit addressing is supported, the Linux EHCI driver programs the
>> segment register to zero. See ehci_run function:
>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c
>>
>> The driver comment also notes that descriptor structures allocated from
>> the DMA pool use segment zero semantics.
>>
>> Descriptor memory is allocated using the DMA API. The platform driver
>> configures a 64-bit DMA mask so memory can be allocated above 4GB.
>> See ehci_platform_probe function:
>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-platform.c
>>
>> On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
>> As a result, descriptor addresses constructed directly from the guest
>> EHCI registers do not match the actual system address used by the
>> controller when fetching queue heads (QH) and queue element transfer
>> descriptors (qTD).
>>
>> Add a ctrldssegment-default property so platforms can provide a
>> descriptor address offset when constructing descriptor addresses.
>> This allows systems where DRAM resides above 4GB to access EHCI
>> descriptors correctly.
>>
>> The default value is zero, so existing machines are not affected.
>>
>> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
>> Reviewed-by: Cédric Le Goater <clg@redhat.com>
>> ---
>> hw/usb/hcd-ehci.h | 5 ++++-
>> hw/usb/hcd-ehci.c | 1 +
>> 2 files changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
>> index 8e6a8cdfb0..3d57e1de5f 100644
>> --- a/hw/usb/hcd-ehci.h
>> +++ b/hw/usb/hcd-ehci.h
>> @@ -264,6 +264,7 @@ struct EHCIState {
>> uint32_t maxframes;
>> bool migrate_fetch_addr_64bit;
>> bool caps_64bit_addr;
>> + uint32_t ctrldssegment_default;
>> /*
>> * EHCI spec version 1.0 Section 2.3
>> @@ -322,7 +323,9 @@ struct EHCIState {
>> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
>> ehci.migrate_fetch_addr_64bit, true), \
>> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
>> - ehci.caps_64bit_addr, false)
>> + ehci.caps_64bit_addr, false), \
>> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
>> + ehci.ctrldssegment_default, 0)
>
> ctrl-ds-segment-default and ctrl_ds_segment_default?
>
> Otherwise,
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>
yeah. I agree. That's the general pattern for property names.
Thanks,
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 12:17 ` Cédric Le Goater
@ 2026-05-04 12:42 ` Philippe Mathieu-Daudé
2026-05-04 13:12 ` Cédric Le Goater
0 siblings, 1 reply; 27+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-05-04 12:42 UTC (permalink / raw)
To: Cédric Le Goater, Jamin Lin, peterx@redhat.com,
Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Zhao Liu,
open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 4/5/26 14:17, Cédric Le Goater wrote:
> On 5/4/26 13:18, Philippe Mathieu-Daudé wrote:
>> On 4/5/26 04:53, Jamin Lin wrote:
>>> When 64-bit addressing is supported, the Linux EHCI driver programs the
>>> segment register to zero. See ehci_run function:
>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-
>>> hcd.c
>>>
>>> The driver comment also notes that descriptor structures allocated from
>>> the DMA pool use segment zero semantics.
>>>
>>> Descriptor memory is allocated using the DMA API. The platform driver
>>> configures a 64-bit DMA mask so memory can be allocated above 4GB.
>>> See ehci_platform_probe function:
>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-
>>> platform.c
>>>
>>> On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
>>> As a result, descriptor addresses constructed directly from the guest
>>> EHCI registers do not match the actual system address used by the
>>> controller when fetching queue heads (QH) and queue element transfer
>>> descriptors (qTD).
>>>
>>> Add a ctrldssegment-default property so platforms can provide a
>>> descriptor address offset when constructing descriptor addresses.
>>> This allows systems where DRAM resides above 4GB to access EHCI
>>> descriptors correctly.
>>>
>>> The default value is zero, so existing machines are not affected.
>>>
>>> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
>>> Reviewed-by: Cédric Le Goater <clg@redhat.com>
>>> ---
>>> hw/usb/hcd-ehci.h | 5 ++++-
>>> hw/usb/hcd-ehci.c | 1 +
>>> 2 files changed, 5 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
>>> index 8e6a8cdfb0..3d57e1de5f 100644
>>> --- a/hw/usb/hcd-ehci.h
>>> +++ b/hw/usb/hcd-ehci.h
>>> @@ -264,6 +264,7 @@ struct EHCIState {
>>> uint32_t maxframes;
>>> bool migrate_fetch_addr_64bit;
>>> bool caps_64bit_addr;
>>> + uint32_t ctrldssegment_default;
>>> /*
>>> * EHCI spec version 1.0 Section 2.3
>>> @@ -322,7 +323,9 @@ struct EHCIState {
>>> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
>>> ehci.migrate_fetch_addr_64bit, true), \
>>> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
>>> - ehci.caps_64bit_addr, false)
>>> + ehci.caps_64bit_addr, false), \
>>> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
>>> + ehci.ctrldssegment_default, 0)
>>
>> ctrl-ds-segment-default and ctrl_ds_segment_default?
>>
>> Otherwise,
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>
>
> yeah. I agree. That's the general pattern for property names.
I don't get the '-default' suffix. Alternatives:
dram-segment-base-addr or even x-dram-segment-base-addr since I still
believe this is a AST2700 issue, likely not mapping RAM appropriately.
>
> Thanks,
>
> C.
>
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 12:42 ` Philippe Mathieu-Daudé
@ 2026-05-04 13:12 ` Cédric Le Goater
2026-05-06 1:22 ` Jamin Lin
0 siblings, 1 reply; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-04 13:12 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, Jamin Lin, peterx@redhat.com,
Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Zhao Liu,
open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 5/4/26 14:42, Philippe Mathieu-Daudé wrote:
> On 4/5/26 14:17, Cédric Le Goater wrote:
>> On 5/4/26 13:18, Philippe Mathieu-Daudé wrote:
>>> On 4/5/26 04:53, Jamin Lin wrote:
>>>> When 64-bit addressing is supported, the Linux EHCI driver programs the
>>>> segment register to zero. See ehci_run function:
>>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci- hcd.c
>>>>
>>>> The driver comment also notes that descriptor structures allocated from
>>>> the DMA pool use segment zero semantics.
>>>>
>>>> Descriptor memory is allocated using the DMA API. The platform driver
>>>> configures a 64-bit DMA mask so memory can be allocated above 4GB.
>>>> See ehci_platform_probe function:
>>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci- platform.c
>>>>
>>>> On AST2700 platforms, system DRAM is mapped above 4GB at 0x400000000.
>>>> As a result, descriptor addresses constructed directly from the guest
>>>> EHCI registers do not match the actual system address used by the
>>>> controller when fetching queue heads (QH) and queue element transfer
>>>> descriptors (qTD).
>>>>
>>>> Add a ctrldssegment-default property so platforms can provide a
>>>> descriptor address offset when constructing descriptor addresses.
>>>> This allows systems where DRAM resides above 4GB to access EHCI
>>>> descriptors correctly.
>>>>
>>>> The default value is zero, so existing machines are not affected.
>>>>
>>>> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
>>>> Reviewed-by: Cédric Le Goater <clg@redhat.com>
>>>> ---
>>>> hw/usb/hcd-ehci.h | 5 ++++-
>>>> hw/usb/hcd-ehci.c | 1 +
>>>> 2 files changed, 5 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
>>>> index 8e6a8cdfb0..3d57e1de5f 100644
>>>> --- a/hw/usb/hcd-ehci.h
>>>> +++ b/hw/usb/hcd-ehci.h
>>>> @@ -264,6 +264,7 @@ struct EHCIState {
>>>> uint32_t maxframes;
>>>> bool migrate_fetch_addr_64bit;
>>>> bool caps_64bit_addr;
>>>> + uint32_t ctrldssegment_default;
>>>> /*
>>>> * EHCI spec version 1.0 Section 2.3
>>>> @@ -322,7 +323,9 @@ struct EHCIState {
>>>> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
>>>> ehci.migrate_fetch_addr_64bit, true), \
>>>> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
>>>> - ehci.caps_64bit_addr, false)
>>>> + ehci.caps_64bit_addr, false), \
>>>> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
>>>> + ehci.ctrldssegment_default, 0)
>>>
>>> ctrl-ds-segment-default and ctrl_ds_segment_default?
>>>
>>> Otherwise,
>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>>>
>>
>> yeah. I agree. That's the general pattern for property names.
>
> I don't get the '-default' suffix. Alternatives:
>
> dram-segment-base-addr or even x-dram-segment-base-addr
What ever makes sense. EHCI specs have :
CTRLDSSEGMENT 4G Segment Selector
The purpose of the "ctrldssegment-default" property is to force
a default value of the CTRLDSSEGMENT register for the ast2700.
Jamin, how are we sure the DMAs are allocated in this 4G segment ?
because RAM covers 8G :
0000000400000000-00000005ffffffff (prio 0, ram): ram
> since I still believe this is a AST2700 issue, likely not mapping
> RAM appropriately.
Other controllers would be impacted no ?
Linux (upstream) forces the CTRLDSSEGMENT value :
/*
* hcc_params controls whether ehci->regs->segment must (!!!)
* be used; it constrains QH/ITD/SITD and QTD locations.
* dma_pool consistent memory always uses segment zero.
* streaming mappings for I/O buffers, like dma_map_single(),
* can return segments above 4GB, if the device allows.
*
* NOTE: the dma mask is visible through dev->dma_mask, so
* drivers can pass this info along ... like NETIF_F_HIGHDMA,
* Scsi_Host.highmem_io, and so forth. It's readonly to all
* host side drivers though.
*/
hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
if (HCC_64BIT_ADDR(hcc_params)) {
ehci_writel(ehci, 0, &ehci->regs->segment); <------- here
#if 0
// this is deeply broken on almost all architectures
if (!dma_set_mask(hcd->self.controller, DMA_BIT_MASK(64)))
ehci_info(ehci, "enabled 64bit DMA\n");
#endif
}
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* RE: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-04 13:12 ` Cédric Le Goater
@ 2026-05-06 1:22 ` Jamin Lin
2026-05-06 3:36 ` Jamin Lin
0 siblings, 1 reply; 27+ messages in thread
From: Jamin Lin @ 2026-05-06 1:22 UTC (permalink / raw)
To: Cédric Le Goater, Philippe Mathieu-Daudé,
peterx@redhat.com, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Hi Cédric, Philippe
> Subject: Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default
> property
>
> On 5/4/26 14:42, Philippe Mathieu-Daudé wrote:
> > On 4/5/26 14:17, Cédric Le Goater wrote:
> >> On 5/4/26 13:18, Philippe Mathieu-Daudé wrote:
> >>> On 4/5/26 04:53, Jamin Lin wrote:
> >>>> When 64-bit addressing is supported, the Linux EHCI driver programs
> >>>> the segment register to zero. See ehci_run function:
> >>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci
> >>>> - hcd.c
> >>>>
> >>>> The driver comment also notes that descriptor structures allocated
> >>>> from the DMA pool use segment zero semantics.
> >>>>
> >>>> Descriptor memory is allocated using the DMA API. The platform
> >>>> driver configures a 64-bit DMA mask so memory can be allocated above
> 4GB.
> >>>> See ehci_platform_probe function:
> >>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci
> >>>> - platform.c
> >>>>
> >>>> On AST2700 platforms, system DRAM is mapped above 4GB at
> 0x400000000.
> >>>> As a result, descriptor addresses constructed directly from the
> >>>> guest EHCI registers do not match the actual system address used by
> >>>> the controller when fetching queue heads (QH) and queue element
> >>>> transfer descriptors (qTD).
> >>>>
> >>>> Add a ctrldssegment-default property so platforms can provide a
> >>>> descriptor address offset when constructing descriptor addresses.
> >>>> This allows systems where DRAM resides above 4GB to access EHCI
> >>>> descriptors correctly.
> >>>>
> >>>> The default value is zero, so existing machines are not affected.
> >>>>
> >>>> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> >>>> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> >>>> ---
> >>>> hw/usb/hcd-ehci.h | 5 ++++-
> >>>> hw/usb/hcd-ehci.c | 1 +
> >>>> 2 files changed, 5 insertions(+), 1 deletion(-)
> >>>>
> >>>> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index
> >>>> 8e6a8cdfb0..3d57e1de5f 100644
> >>>> --- a/hw/usb/hcd-ehci.h
> >>>> +++ b/hw/usb/hcd-ehci.h
> >>>> @@ -264,6 +264,7 @@ struct EHCIState {
> >>>> uint32_t maxframes;
> >>>> bool migrate_fetch_addr_64bit;
> >>>> bool caps_64bit_addr;
> >>>> + uint32_t ctrldssegment_default;
> >>>> /*
> >>>> * EHCI spec version 1.0 Section 2.3 @@ -322,7 +323,9 @@
> >>>> struct EHCIState {
> >>>> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> >>>> ehci.migrate_fetch_addr_64bit, true),
> \
> >>>> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
> >>>> - ehci.caps_64bit_addr, false)
> >>>> + ehci.caps_64bit_addr, false), \
> >>>> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
> >>>> + ehci.ctrldssegment_default, 0)
> >>>
> >>> ctrl-ds-segment-default and ctrl_ds_segment_default?
> >>>
> >>> Otherwise,
> >>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> >>>
> >>
> >> yeah. I agree. That's the general pattern for property names.
> >
> > I don't get the '-default' suffix. Alternatives:
> >
> > dram-segment-base-addr or even x-dram-segment-base-addr
>
> What ever makes sense. EHCI specs have :
>
> CTRLDSSEGMENT 4G Segment Selector
>
> The purpose of the "ctrldssegment-default" property is to force a default value
> of the CTRLDSSEGMENT register for the ast2700.
>
> Jamin, how are we sure the DMAs are allocated in this 4G segment ?
> because RAM covers 8G :
>
> 0000000400000000-00000005ffffffff (prio 0, ram): ram
>
It is a firmware issue. After discussing it with the USB driver owner, we found that this issue occurs when users use 8GB DRAM because the driver does not configure CTRLDSSEGMENT.
Currently, our SDK only supports up to 2GB DRAM, so users should not encounter this issue under normal conditions.
However, this could become a potential issue if users configure the DRAM size to 8GB.
>
> > since I still believe this is a AST2700 issue, likely not mapping RAM
> > appropriately.
>
> Other controllers would be impacted no ?
> Linux (upstream) forces the CTRLDSSEGMENT value :
>
Linux (upstream) forces CTRLDSSEGMENT to 0, which means only DRAM addresses below 4GB are allowed.
Therefore, AST2700 hardware sets the default value of CTRLDSSEGMENT to 4, which maps to the AST2700 DRAM required base address 0x400000000.
In other words, the AST2700 firmware only needs to configure bits 0 and 1 of CTRLDSSEGMENT.
However, setting only bits 0 and 1 in the firmware is not sufficient for QEMU, because QEMU is not aware that the AST2700 hardware initializes the default value of CTRLDSSEGMENT to 4.
In conclusion, should I rename this property to ctrl-ds-segment-default and ctrl_ds_segment_default?
Also, should I create a new patch for this change, or resend the entire patch series?
Thanks,
Jamin
> /*
> * hcc_params controls whether ehci->regs->segment must (!!!)
> * be used; it constrains QH/ITD/SITD and QTD locations.
> * dma_pool consistent memory always uses segment zero.
> * streaming mappings for I/O buffers, like dma_map_single(),
> * can return segments above 4GB, if the device allows.
> *
> * NOTE: the dma mask is visible through dev->dma_mask, so
> * drivers can pass this info along ... like NETIF_F_HIGHDMA,
> * Scsi_Host.highmem_io, and so forth. It's readonly to all
> * host side drivers though.
> */
> hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
> if (HCC_64BIT_ADDR(hcc_params)) {
> ehci_writel(ehci, 0, &ehci->regs->segment); <------- here
> #if 0
> // this is deeply broken on almost all architectures
> if (!dma_set_mask(hcd->self.controller, DMA_BIT_MASK(64)))
> ehci_info(ehci, "enabled 64bit DMA\n"); #endif
> }
>
>
> C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* RE: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility
2026-05-04 12:17 ` Philippe Mathieu-Daudé
@ 2026-05-06 2:09 ` Jamin Lin
2026-05-06 3:38 ` Jamin Lin
0 siblings, 1 reply; 27+ messages in thread
From: Jamin Lin @ 2026-05-06 2:09 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, peterx@redhat.com,
Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Zhao Liu,
open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Hi Philippe
> Subject: Re: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to
> 64-bit with migration compatibility
>
> On 4/5/26 04:53, Jamin Lin wrote:
> > Change internal EHCI descriptor addresses from uint32_t to uint64_t.
> >
> > The following fields are updated:
> > - EHCIPacket::qtdaddr
> > - EHCIQueue::{qhaddr, qtdaddr}
> > - EHCIState::{a_fetch_addr, p_fetch_addr}
> >
> > Update get_dwords() and put_dwords() to take 64-bit addresses and
> > propagate the type change through the descriptor traversal paths.
> >
> > Adjust NLPTR_GET() to operate on 64-bit values:
> >
> > #define NLPTR_GET(x) ((x) & ~0x1fULL)
> >
> > so that link pointer masking works correctly when descriptor addresses
> > exceed 32-bit space. The previous mask (0xffffffe0) implicitly
> > truncated addresses to 32 bits.
> >
> > This patch does not change the on-wire descriptor layout yet.
> > It only removes the internal 32-bit address limit and prepares for
> > later patches that will add full 64-bit QH/qTD/iTD/siTD support.
> >
> > Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD to
> > use uint64_t for the address argument and print it with PRIx64. This
> > ensures full 64-bit addresses are shown in trace output and improves
> > debugging of queue heads and transfer descriptors.
> >
> > Migration compatibility:
> >
> > To preserve backward migration compatibility, keep the legacy 32-bit
> > fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside the
> > new 64-bit fields.
> >
> > Migration format is selected using a machine compat property
> > "x-migrate-fetch-addr-64bit":
> >
> > - Old machine types migrate 32-bit fetch addresses
> > - New machine types migrate full 64-bit fetch addresses
> >
> > This is implemented using VMSTATE_UINT32_TEST() and
> > VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
> >
> > In pre_save, the 32-bit shadow fields are populated when migrating to
> > old machine types. In post_load, the 32-bit values are restored into
> > the 64-bit fields when loading old migration streams.
> >
> > No functional change.
> >
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > ---
> > hw/usb/hcd-ehci.h | 17 +++++++----
> > hw/core/machine.c | 5 +++-
> > hw/usb/hcd-ehci.c | 72
> ++++++++++++++++++++++++++++++++-------------
> > hw/usb/trace-events | 24 +++++++--------
> > 4 files changed, 78 insertions(+), 40 deletions(-)
>
>
> > @@ -256,6 +256,7 @@ struct EHCIState {
> >
> > /* properties */
> > uint32_t maxframes;
> > + bool migrate_fetch_addr_64bit;
> >
> > /*
> > * EHCI spec version 1.0 Section 2.3 @@ -294,8 +295,10 @@
> > struct EHCIState {
> > EHCIQueueHead pqueues;
> >
> > /* which address to look at next */
> > - uint32_t a_fetch_addr;
> > - uint32_t p_fetch_addr;
> > + uint32_t a_fetch_addr_32;
> > + uint32_t p_fetch_addr_32;
>
> Technically '?_fetch_addr_32' aren't "which address to look at next"
> anymore, but simple migration helpers. Could be worth adding a comment?
> And rename including 'migrat{e,ion}'? Can be cleared on top.
>
Will update to
/*
* Migration compatibility fields for old machine types that only
* support 32-bit fetch addresses in the migration stream.
*
* New machine types migrate the full 64-bit runtime fetch address.
*/
uint32_t migrate_a_fetch_addr;
uint32_t migrate_p_fetch_addr;
/*
* Controls migration stream compatibility for old machine types.
* Old machine types only transfer 32-bit fetch addresses.
*/
bool migrate_fetch_addr_64bit;
> > + uint64_t a_fetch_addr;
> > + uint64_t p_fetch_addr;
> >
> > USBPacket ipacket;
> > QEMUSGList isgl;
> > @@ -308,7 +311,9 @@ struct EHCIState {
> > };
> >
> > #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> > - DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> > + DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> > + DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> > + ehci.migrate_fetch_addr_64bit, true)
> >
> > extern const VMStateDescription vmstate_ehci;
> >
> > diff --git a/hw/core/machine.c b/hw/core/machine.c index
> > 1b661fd36a..54336da294 100644
> > --- a/hw/core/machine.c
> > +++ b/hw/core/machine.c
> > @@ -39,7 +39,10 @@
> > #include "hw/acpi/generic_event_device.h"
> > #include "qemu/audio.h"
> >
> > -GlobalProperty hw_compat_11_0[] = {};
> > +GlobalProperty hw_compat_11_0[] = {
> > + { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> > + { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" }, };
> > const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
>
> Good.
>
> > +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id) {
> > + EHCIState *s = opaque;
> > +
> > + return s->migrate_fetch_addr_64bit; }
> > +
> > +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id) {
> > + return !ehci_fetch_addr_64_needed(opaque, version_id); }
> > +
> > static int usb_ehci_pre_save(void *opaque)
> > {
> > EHCIState *ehci = opaque;
> > @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
> > ehci->last_run_ns -= (ehci->frindex - new_frindex) *
> UFRAME_TIMER_NS;
> > ehci->frindex = new_frindex;
> >
> > + if (!ehci->migrate_fetch_addr_64bit) {
> > + ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> > + ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> > + }
> > +
> > return 0;
> > }
> >
> > @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque, int
> version_id)
> > }
> > }
> >
> > + if (!s->migrate_fetch_addr_64bit) {
> > + s->a_fetch_addr = s->a_fetch_addr_32;
> > + s->p_fetch_addr = s->p_fetch_addr_32;
> > + }
> > +
> > return 0;
> > }
> >
> > @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
> > /* schedule state */
> > VMSTATE_UINT32(astate, EHCIState),
> > VMSTATE_UINT32(pstate, EHCIState),
> > - VMSTATE_UINT32(a_fetch_addr, EHCIState),
> > - VMSTATE_UINT32(p_fetch_addr, EHCIState),
> > + VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> > + ehci_fetch_addr_32_needed),
> > + VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> > + ehci_fetch_addr_32_needed),
> > + VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> > + ehci_fetch_addr_64_needed),
> > + VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> > + ehci_fetch_addr_64_needed),
>
> Hmmmm. I didn't review all previous versions, for my own education, why
> don't we use VMSTATE_UINT64_V() here? Did you test (pre-11 <-> this
> series) migration? My understanding was we need to maintain the stream size
> to avoid mismatch.
>
Please see the migration test steps here:
https://patchwork.kernel.org/project/qemu-devel/patch/20260423051804.362095-9-jamin_lin@aspeedtech.com/#26911317
I tested migration compatibility with both v11 and v10.2.
I originally tried using VMSTATE_UINT64_V(). That implementation was similar to the v3 version of this series, which you previously reviewed:
https://patchwork.kernel.org/project/qemu-devel/patch/20260416014928.1279360-7-jamin_lin@aspeedtech.com/
Unfortunately, that approach caused migration failures.
The issue is that older machine types do not contain the 64-bit fetch address fields in their migration ABI. Simply adding VMSTATE_UINT64_V() changes the migration stream layout, which breaks compatibility with older machine types / older QEMU versions.
The migration failure looks like this:
qemu-system-x86_64: Missing section footer for 0000:00:03.0/ehci
qemu-system-x86_64: load of migration failed: Invalid argument: Section footer error, section_id: 42
Because of this, I used migrate_fetch_addr_64bit to preserve the original 32-bit migration stream for older compatible machine types while enabling the 64-bit migration format only for newer machine types.
Thanks,
Jamin
diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index 3d57e1de5f..7b3e92895a 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -303,8 +303,8 @@ struct EHCIState {
EHCIQueueHead pqueues;
/* which address to look at next */
- uint32_t a_fetch_addr_32;
- uint32_t p_fetch_addr_32;
+ uint32_t migrate_a_fetch_addr;
+ uint32_t migrate_p_fetch_addr;
uint64_t a_fetch_addr;
uint64_t p_fetch_addr;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 62c3770ac5..d3b9890726 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -2459,16 +2459,9 @@ static USBBusOps ehci_bus_ops_standalone = {
.wakeup_endpoint = ehci_wakeup_endpoint,
};
-static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
+static bool ehci_core_is_before_version_3(void *opaque, int version_id)
{
- EHCIState *s = opaque;
-
- return s->migrate_fetch_addr_64bit;
-}
-
-static bool ehci_fetch_addr_32_needed(void *opaque, int version_id)
-{
- return !ehci_fetch_addr_64_needed(opaque, version_id);
+ return version_id < 3;
}
static int usb_ehci_pre_save(void *opaque)
@@ -2482,8 +2475,8 @@ static int usb_ehci_pre_save(void *opaque)
ehci->frindex = new_frindex;
if (!ehci->migrate_fetch_addr_64bit) {
- ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
- ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
+ ehci->migrate_a_fetch_addr = ehci->a_fetch_addr;
+ ehci->migrate_p_fetch_addr = ehci->p_fetch_addr;
}
return 0;
@@ -2507,8 +2500,8 @@ static int usb_ehci_post_load(void *opaque, int version_id)
}
if (!s->migrate_fetch_addr_64bit) {
- s->a_fetch_addr = s->a_fetch_addr_32;
- s->p_fetch_addr = s->p_fetch_addr_32;
+ s->a_fetch_addr = s->migrate_a_fetch_addr;
+ s->p_fetch_addr = s->migrate_p_fetch_addr;
}
return 0;
@@ -2542,7 +2535,7 @@ static void usb_ehci_vm_state_change(void *opaque, bool running, RunState state)
const VMStateDescription vmstate_ehci = {
.name = "ehci-core",
- .version_id = 2,
+ .version_id = 3,
.minimum_version_id = 1,
.pre_save = usb_ehci_pre_save,
.post_load = usb_ehci_post_load,
@@ -2571,14 +2564,12 @@ const VMStateDescription vmstate_ehci = {
/* schedule state */
VMSTATE_UINT32(astate, EHCIState),
VMSTATE_UINT32(pstate, EHCIState),
- VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
- ehci_fetch_addr_32_needed),
- VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
- ehci_fetch_addr_32_needed),
- VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
- ehci_fetch_addr_64_needed),
- VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
- ehci_fetch_addr_64_needed),
+ VMSTATE_UINT32_TEST(migrate_a_fetch_addr, EHCIState,
+ ehci_core_is_before_version_3),
+ VMSTATE_UINT32_TEST(migrate_p_fetch_addr, EHCIState,
+ ehci_core_is_before_version_3),
+ VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
+ VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
VMSTATE_END_OF_LIST()
}
};
^ permalink raw reply related [flat|nested] 27+ messages in thread
* RE: [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property
2026-05-06 1:22 ` Jamin Lin
@ 2026-05-06 3:36 ` Jamin Lin
0 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-06 3:36 UTC (permalink / raw)
To: Cédric Le Goater, Philippe Mathieu-Daudé,
peterx@redhat.com, Cédric Le Goater, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Hi Cédric, Philippe
Please help to review.
hw/usb/ehci: Improve migration helper and property naming
https://patchwork.kernel.org/project/qemu-devel/list/?series=1090233
Thanks,
Jamin
> Hi Cédric, Philippe
>
> > Subject: Re: [PATCH v6 08/11] hw/usb/hcd-ehci: Add
> > ctrldssegment-default property
> >
> > On 5/4/26 14:42, Philippe Mathieu-Daudé wrote:
> > > On 4/5/26 14:17, Cédric Le Goater wrote:
> > >> On 5/4/26 13:18, Philippe Mathieu-Daudé wrote:
> > >>> On 4/5/26 04:53, Jamin Lin wrote:
> > >>>> When 64-bit addressing is supported, the Linux EHCI driver
> > >>>> programs the segment register to zero. See ehci_run function:
> > >>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/eh
> > >>>> ci
> > >>>> - hcd.c
> > >>>>
> > >>>> The driver comment also notes that descriptor structures
> > >>>> allocated from the DMA pool use segment zero semantics.
> > >>>>
> > >>>> Descriptor memory is allocated using the DMA API. The platform
> > >>>> driver configures a 64-bit DMA mask so memory can be allocated
> > >>>> above
> > 4GB.
> > >>>> See ehci_platform_probe function:
> > >>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/eh
> > >>>> ci
> > >>>> - platform.c
> > >>>>
> > >>>> On AST2700 platforms, system DRAM is mapped above 4GB at
> > 0x400000000.
> > >>>> As a result, descriptor addresses constructed directly from the
> > >>>> guest EHCI registers do not match the actual system address used
> > >>>> by the controller when fetching queue heads (QH) and queue
> > >>>> element transfer descriptors (qTD).
> > >>>>
> > >>>> Add a ctrldssegment-default property so platforms can provide a
> > >>>> descriptor address offset when constructing descriptor addresses.
> > >>>> This allows systems where DRAM resides above 4GB to access EHCI
> > >>>> descriptors correctly.
> > >>>>
> > >>>> The default value is zero, so existing machines are not affected.
> > >>>>
> > >>>> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > >>>> Reviewed-by: Cédric Le Goater <clg@redhat.com>
> > >>>> ---
> > >>>> hw/usb/hcd-ehci.h | 5 ++++-
> > >>>> hw/usb/hcd-ehci.c | 1 +
> > >>>> 2 files changed, 5 insertions(+), 1 deletion(-)
> > >>>>
> > >>>> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index
> > >>>> 8e6a8cdfb0..3d57e1de5f 100644
> > >>>> --- a/hw/usb/hcd-ehci.h
> > >>>> +++ b/hw/usb/hcd-ehci.h
> > >>>> @@ -264,6 +264,7 @@ struct EHCIState {
> > >>>> uint32_t maxframes;
> > >>>> bool migrate_fetch_addr_64bit;
> > >>>> bool caps_64bit_addr;
> > >>>> + uint32_t ctrldssegment_default;
> > >>>> /*
> > >>>> * EHCI spec version 1.0 Section 2.3 @@ -322,7 +323,9
> @@
> > >>>> struct EHCIState {
> > >>>> DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> > >>>> ehci.migrate_fetch_addr_64bit,
> true),
> > \
> > >>>> DEFINE_PROP_BOOL("caps-64bit-addr", _state, \
> > >>>> - ehci.caps_64bit_addr, false)
> > >>>> + ehci.caps_64bit_addr, false), \
> > >>>> + DEFINE_PROP_UINT32("ctrldssegment-default", _state, \
> > >>>> + ehci.ctrldssegment_default, 0)
> > >>>
> > >>> ctrl-ds-segment-default and ctrl_ds_segment_default?
> > >>>
> > >>> Otherwise,
> > >>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> > >>>
> > >>
> > >> yeah. I agree. That's the general pattern for property names.
> > >
> > > I don't get the '-default' suffix. Alternatives:
> > >
> > > dram-segment-base-addr or even x-dram-segment-base-addr
> >
> > What ever makes sense. EHCI specs have :
> >
> > CTRLDSSEGMENT 4G Segment Selector
> >
> > The purpose of the "ctrldssegment-default" property is to force a
> > default value of the CTRLDSSEGMENT register for the ast2700.
> >
> > Jamin, how are we sure the DMAs are allocated in this 4G segment ?
> > because RAM covers 8G :
> >
> > 0000000400000000-00000005ffffffff (prio 0, ram): ram
> >
>
> It is a firmware issue. After discussing it with the USB driver owner, we found
> that this issue occurs when users use 8GB DRAM because the driver does not
> configure CTRLDSSEGMENT.
> Currently, our SDK only supports up to 2GB DRAM, so users should not
> encounter this issue under normal conditions.
> However, this could become a potential issue if users configure the DRAM size
> to 8GB.
>
> >
> > > since I still believe this is a AST2700 issue, likely not mapping
> > > RAM appropriately.
> >
> > Other controllers would be impacted no ?
> > Linux (upstream) forces the CTRLDSSEGMENT value :
> >
> Linux (upstream) forces CTRLDSSEGMENT to 0, which means only DRAM
> addresses below 4GB are allowed.
>
> Therefore, AST2700 hardware sets the default value of CTRLDSSEGMENT to 4,
> which maps to the AST2700 DRAM required base address 0x400000000.
>
> In other words, the AST2700 firmware only needs to configure bits 0 and 1 of
> CTRLDSSEGMENT.
>
> However, setting only bits 0 and 1 in the firmware is not sufficient for QEMU,
> because QEMU is not aware that the AST2700 hardware initializes the default
> value of CTRLDSSEGMENT to 4.
>
> In conclusion, should I rename this property to ctrl-ds-segment-default and
> ctrl_ds_segment_default?
> Also, should I create a new patch for this change, or resend the entire patch
> series?
>
> Thanks,
> Jamin
> > /*
> > * hcc_params controls whether ehci->regs->segment must (!!!)
> > * be used; it constrains QH/ITD/SITD and QTD locations.
> > * dma_pool consistent memory always uses segment zero.
> > * streaming mappings for I/O buffers, like dma_map_single(),
> > * can return segments above 4GB, if the device allows.
> > *
> > * NOTE: the dma mask is visible through dev->dma_mask, so
> > * drivers can pass this info along ... like NETIF_F_HIGHDMA,
> > * Scsi_Host.highmem_io, and so forth. It's readonly to all
> > * host side drivers though.
> > */
> > hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
> > if (HCC_64BIT_ADDR(hcc_params)) {
> > ehci_writel(ehci, 0, &ehci->regs->segment); <------- here
> > #if 0
> > // this is deeply broken on almost all architectures
> > if (!dma_set_mask(hcd->self.controller, DMA_BIT_MASK(64)))
> > ehci_info(ehci, "enabled 64bit DMA\n"); #endif
> > }
> >
> >
> > C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* RE: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility
2026-05-06 2:09 ` Jamin Lin
@ 2026-05-06 3:38 ` Jamin Lin
0 siblings, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-06 3:38 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, peterx@redhat.com,
Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Zhao Liu,
open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Hi Cédric, Philippe
Please help to review.
hw/usb/ehci: Improve migration helper and property naming
https://patchwork.kernel.org/project/qemu-devel/list/?series=1090233
Thanks,
Jamin
> Subject: RE: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses
> to 64-bit with migration compatibility
>
> Hi Philippe
>
> > Subject: Re: [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor
> > addresses to 64-bit with migration compatibility
> >
> > On 4/5/26 04:53, Jamin Lin wrote:
> > > Change internal EHCI descriptor addresses from uint32_t to uint64_t.
> > >
> > > The following fields are updated:
> > > - EHCIPacket::qtdaddr
> > > - EHCIQueue::{qhaddr, qtdaddr}
> > > - EHCIState::{a_fetch_addr, p_fetch_addr}
> > >
> > > Update get_dwords() and put_dwords() to take 64-bit addresses and
> > > propagate the type change through the descriptor traversal paths.
> > >
> > > Adjust NLPTR_GET() to operate on 64-bit values:
> > >
> > > #define NLPTR_GET(x) ((x) & ~0x1fULL)
> > >
> > > so that link pointer masking works correctly when descriptor
> > > addresses exceed 32-bit space. The previous mask (0xffffffe0)
> > > implicitly truncated addresses to 32 bits.
> > >
> > > This patch does not change the on-wire descriptor layout yet.
> > > It only removes the internal 32-bit address limit and prepares for
> > > later patches that will add full 64-bit QH/qTD/iTD/siTD support.
> > >
> > > Update the EHCI trace-events prototypes for QH, qTD, iTD, and siTD
> > > to use uint64_t for the address argument and print it with PRIx64.
> > > This ensures full 64-bit addresses are shown in trace output and
> > > improves debugging of queue heads and transfer descriptors.
> > >
> > > Migration compatibility:
> > >
> > > To preserve backward migration compatibility, keep the legacy 32-bit
> > > fetch address fields (a_fetch_addr_32, p_fetch_addr_32) alongside
> > > the new 64-bit fields.
> > >
> > > Migration format is selected using a machine compat property
> > > "x-migrate-fetch-addr-64bit":
> > >
> > > - Old machine types migrate 32-bit fetch addresses
> > > - New machine types migrate full 64-bit fetch addresses
> > >
> > > This is implemented using VMSTATE_UINT32_TEST() and
> > > VMSTATE_UINT64_TEST() so that only the appropriate format is migrated.
> > >
> > > In pre_save, the 32-bit shadow fields are populated when migrating
> > > to old machine types. In post_load, the 32-bit values are restored
> > > into the 64-bit fields when loading old migration streams.
> > >
> > > No functional change.
> > >
> > > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > > ---
> > > hw/usb/hcd-ehci.h | 17 +++++++----
> > > hw/core/machine.c | 5 +++-
> > > hw/usb/hcd-ehci.c | 72
> > ++++++++++++++++++++++++++++++++-------------
> > > hw/usb/trace-events | 24 +++++++--------
> > > 4 files changed, 78 insertions(+), 40 deletions(-)
> >
> >
> > > @@ -256,6 +256,7 @@ struct EHCIState {
> > >
> > > /* properties */
> > > uint32_t maxframes;
> > > + bool migrate_fetch_addr_64bit;
> > >
> > > /*
> > > * EHCI spec version 1.0 Section 2.3 @@ -294,8 +295,10 @@
> > > struct EHCIState {
> > > EHCIQueueHead pqueues;
> > >
> > > /* which address to look at next */
> > > - uint32_t a_fetch_addr;
> > > - uint32_t p_fetch_addr;
> > > + uint32_t a_fetch_addr_32;
> > > + uint32_t p_fetch_addr_32;
> >
> > Technically '?_fetch_addr_32' aren't "which address to look at next"
> > anymore, but simple migration helpers. Could be worth adding a comment?
> > And rename including 'migrat{e,ion}'? Can be cleared on top.
> >
> Will update to
>
> /*
> * Migration compatibility fields for old machine types that only
> * support 32-bit fetch addresses in the migration stream.
> *
> * New machine types migrate the full 64-bit runtime fetch address.
> */
> uint32_t migrate_a_fetch_addr;
> uint32_t migrate_p_fetch_addr;
>
> /*
> * Controls migration stream compatibility for old machine types.
> * Old machine types only transfer 32-bit fetch addresses.
> */
> bool migrate_fetch_addr_64bit;
>
> > > + uint64_t a_fetch_addr;
> > > + uint64_t p_fetch_addr;
> > >
> > > USBPacket ipacket;
> > > QEMUSGList isgl;
> > > @@ -308,7 +311,9 @@ struct EHCIState {
> > > };
> > >
> > > #define DEFINE_EHCI_COMMON_PROPERTIES(_state) \
> > > - DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128)
> > > + DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128), \
> > > + DEFINE_PROP_BOOL("x-migrate-fetch-addr-64bit", _state, \
> > > + ehci.migrate_fetch_addr_64bit, true)
> > >
> > > extern const VMStateDescription vmstate_ehci;
> > >
> > > diff --git a/hw/core/machine.c b/hw/core/machine.c index
> > > 1b661fd36a..54336da294 100644
> > > --- a/hw/core/machine.c
> > > +++ b/hw/core/machine.c
> > > @@ -39,7 +39,10 @@
> > > #include "hw/acpi/generic_event_device.h"
> > > #include "qemu/audio.h"
> > >
> > > -GlobalProperty hw_compat_11_0[] = {};
> > > +GlobalProperty hw_compat_11_0[] = {
> > > + { "sysbus-ehci-usb", "x-migrate-fetch-addr-64bit", "off" },
> > > + { "pci-ehci-usb", "x-migrate-fetch-addr-64bit", "off" }, };
> > > const size_t hw_compat_11_0_len =
> G_N_ELEMENTS(hw_compat_11_0);
> >
> > Good.
> >
> > > +static bool ehci_fetch_addr_64_needed(void *opaque, int version_id) {
> > > + EHCIState *s = opaque;
> > > +
> > > + return s->migrate_fetch_addr_64bit; }
> > > +
> > > +static bool ehci_fetch_addr_32_needed(void *opaque, int version_id) {
> > > + return !ehci_fetch_addr_64_needed(opaque, version_id); }
> > > +
> > > static int usb_ehci_pre_save(void *opaque)
> > > {
> > > EHCIState *ehci = opaque;
> > > @@ -2424,6 +2438,11 @@ static int usb_ehci_pre_save(void *opaque)
> > > ehci->last_run_ns -= (ehci->frindex - new_frindex) *
> > UFRAME_TIMER_NS;
> > > ehci->frindex = new_frindex;
> > >
> > > + if (!ehci->migrate_fetch_addr_64bit) {
> > > + ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> > > + ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> > > + }
> > > +
> > > return 0;
> > > }
> > >
> > > @@ -2444,6 +2463,11 @@ static int usb_ehci_post_load(void *opaque,
> > > int
> > version_id)
> > > }
> > > }
> > >
> > > + if (!s->migrate_fetch_addr_64bit) {
> > > + s->a_fetch_addr = s->a_fetch_addr_32;
> > > + s->p_fetch_addr = s->p_fetch_addr_32;
> > > + }
> > > +
> > > return 0;
> > > }
> > >
> > > @@ -2504,8 +2528,14 @@ const VMStateDescription vmstate_ehci = {
> > > /* schedule state */
> > > VMSTATE_UINT32(astate, EHCIState),
> > > VMSTATE_UINT32(pstate, EHCIState),
> > > - VMSTATE_UINT32(a_fetch_addr, EHCIState),
> > > - VMSTATE_UINT32(p_fetch_addr, EHCIState),
> > > + VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> > > + ehci_fetch_addr_32_needed),
> > > + VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> > > + ehci_fetch_addr_32_needed),
> > > + VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> > > + ehci_fetch_addr_64_needed),
> > > + VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> > > + ehci_fetch_addr_64_needed),
> >
> > Hmmmm. I didn't review all previous versions, for my own education,
> > why don't we use VMSTATE_UINT64_V() here? Did you test (pre-11 <->
> > this
> > series) migration? My understanding was we need to maintain the stream
> > size to avoid mismatch.
> >
> Please see the migration test steps here:
> https://patchwork.kernel.org/project/qemu-devel/patch/20260423051804.362
> 095-9-jamin_lin@aspeedtech.com/#26911317
> I tested migration compatibility with both v11 and v10.2.
>
> I originally tried using VMSTATE_UINT64_V(). That implementation was similar
> to the v3 version of this series, which you previously reviewed:
> https://patchwork.kernel.org/project/qemu-devel/patch/20260416014928.127
> 9360-7-jamin_lin@aspeedtech.com/
>
> Unfortunately, that approach caused migration failures.
>
> The issue is that older machine types do not contain the 64-bit fetch address
> fields in their migration ABI. Simply adding VMSTATE_UINT64_V() changes the
> migration stream layout, which breaks compatibility with older machine types
> / older QEMU versions.
>
> The migration failure looks like this:
> qemu-system-x86_64: Missing section footer for 0000:00:03.0/ehci
> qemu-system-x86_64: load of migration failed: Invalid argument: Section
> footer error, section_id: 42
>
> Because of this, I used migrate_fetch_addr_64bit to preserve the original
> 32-bit migration stream for older compatible machine types while enabling
> the 64-bit migration format only for newer machine types.
>
> Thanks,
> Jamin
>
> diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index
> 3d57e1de5f..7b3e92895a 100644
> --- a/hw/usb/hcd-ehci.h
> +++ b/hw/usb/hcd-ehci.h
> @@ -303,8 +303,8 @@ struct EHCIState {
> EHCIQueueHead pqueues;
>
> /* which address to look at next */
> - uint32_t a_fetch_addr_32;
> - uint32_t p_fetch_addr_32;
> + uint32_t migrate_a_fetch_addr;
> + uint32_t migrate_p_fetch_addr;
> uint64_t a_fetch_addr;
> uint64_t p_fetch_addr;
>
> diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index
> 62c3770ac5..d3b9890726 100644
> --- a/hw/usb/hcd-ehci.c
> +++ b/hw/usb/hcd-ehci.c
> @@ -2459,16 +2459,9 @@ static USBBusOps ehci_bus_ops_standalone = {
> .wakeup_endpoint = ehci_wakeup_endpoint, };
>
> -static bool ehci_fetch_addr_64_needed(void *opaque, int version_id)
> +static bool ehci_core_is_before_version_3(void *opaque, int version_id)
> {
> - EHCIState *s = opaque;
> -
> - return s->migrate_fetch_addr_64bit;
> -}
> -
> -static bool ehci_fetch_addr_32_needed(void *opaque, int version_id) -{
> - return !ehci_fetch_addr_64_needed(opaque, version_id);
> + return version_id < 3;
> }
>
> static int usb_ehci_pre_save(void *opaque) @@ -2482,8 +2475,8 @@ static
> int usb_ehci_pre_save(void *opaque)
> ehci->frindex = new_frindex;
>
> if (!ehci->migrate_fetch_addr_64bit) {
> - ehci->a_fetch_addr_32 = ehci->a_fetch_addr;
> - ehci->p_fetch_addr_32 = ehci->p_fetch_addr;
> + ehci->migrate_a_fetch_addr = ehci->a_fetch_addr;
> + ehci->migrate_p_fetch_addr = ehci->p_fetch_addr;
> }
>
> return 0;
> @@ -2507,8 +2500,8 @@ static int usb_ehci_post_load(void *opaque, int
> version_id)
> }
>
> if (!s->migrate_fetch_addr_64bit) {
> - s->a_fetch_addr = s->a_fetch_addr_32;
> - s->p_fetch_addr = s->p_fetch_addr_32;
> + s->a_fetch_addr = s->migrate_a_fetch_addr;
> + s->p_fetch_addr = s->migrate_p_fetch_addr;
> }
>
> return 0;
> @@ -2542,7 +2535,7 @@ static void usb_ehci_vm_state_change(void
> *opaque, bool running, RunState state)
>
> const VMStateDescription vmstate_ehci = {
> .name = "ehci-core",
> - .version_id = 2,
> + .version_id = 3,
> .minimum_version_id = 1,
> .pre_save = usb_ehci_pre_save,
> .post_load = usb_ehci_post_load,
> @@ -2571,14 +2564,12 @@ const VMStateDescription vmstate_ehci = {
> /* schedule state */
> VMSTATE_UINT32(astate, EHCIState),
> VMSTATE_UINT32(pstate, EHCIState),
> - VMSTATE_UINT32_TEST(a_fetch_addr_32, EHCIState,
> - ehci_fetch_addr_32_needed),
> - VMSTATE_UINT32_TEST(p_fetch_addr_32, EHCIState,
> - ehci_fetch_addr_32_needed),
> - VMSTATE_UINT64_TEST(a_fetch_addr, EHCIState,
> - ehci_fetch_addr_64_needed),
> - VMSTATE_UINT64_TEST(p_fetch_addr, EHCIState,
> - ehci_fetch_addr_64_needed),
> + VMSTATE_UINT32_TEST(migrate_a_fetch_addr, EHCIState,
> + ehci_core_is_before_version_3),
> + VMSTATE_UINT32_TEST(migrate_p_fetch_addr, EHCIState,
> + ehci_core_is_before_version_3),
> + VMSTATE_UINT64_V(a_fetch_addr, EHCIState, 3),
> + VMSTATE_UINT64_V(p_fetch_addr, EHCIState, 3),
> VMSTATE_END_OF_LIST()
> }
> };
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support
2026-05-04 5:27 ` [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Cédric Le Goater
@ 2026-05-11 6:13 ` Cédric Le Goater
2026-05-11 6:30 ` Jamin Lin
2026-05-12 14:47 ` Cédric Le Goater
0 siblings, 2 replies; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-11 6:13 UTC (permalink / raw)
To: Jamin Lin, philmd@linaro.org, peterx@redhat.com, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
On 5/4/26 07:27, Cédric Le Goater wrote:
> On 5/4/26 04:53, Jamin Lin wrote:
>> EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
>> which provides the upper 32 bits of descriptor addresses when the
>> controller advertises 64-bit capability.
>>
>> Currently QEMU EHCI model only partially supports this functionality and
>> descriptor addresses are effectively treated as 32-bit. This becomes
>> problematic on systems where system memory is located above the 4GB
>> boundary.
>>
>> The Linux EHCI driver enables 64-bit addressing if the controller
>> advertises the capability. During initialization it programs the
>> segment register to zero:
>>
>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600
>>
>> The driver also notes that descriptor structures allocated from the
>> DMA pool use segment zero semantics. Descriptor memory is allocated
>> using the DMA API and platforms may configure a 64-bit DMA mask,
>> allowing descriptor memory to be placed above 4GB.
>>
>> On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
>> result, descriptor addresses constructed directly from the EHCI
>> registers do not match the actual system addresses used by the
>> controller when accessing queue heads (QH) and queue element transfer
>> descriptors (qTD).
>>
>> This patch series implements full 64-bit descriptor addressing support
>> in the EHCI emulation. Descriptor address handling is updated to use
>> 64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
>> are extended to support the upper address bits provided by the segment
>> register.
>>
>> Add a ctrldssegment-default property so platforms can provide a
>> descriptor address offset when constructing descriptor addresses.
>> This allows systems where DRAM resides above 4GB to access EHCI
>> descriptors correctly.
>>
>> The AST2700 machine uses this property to account for its DRAM mapping
>> at 0x400000000 and enables 64-bit EHCI DMA addressing.
>>
>> Test Result:
>> 1. EHCI 32bits with ast2600-evb machine
>> Command line:
>> ./build/qemu-system-arm \
>> -machine ast2600-evb \
>> -m 1G \
>> -drive file=image-bmc,if=mtd,format=raw \
>> -nographic \
>> -device usb-kbd,bus=usb-bus.1,id=mykbd \
>> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>> -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
>> -snapshot \
>> -nographic
>> Result:
>> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
>> Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
>> Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
>>
>> 2. EHCI 64bits with ast2700a2-evb machine
>> Command line:
>> ./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
>> -bios ast27x0_bootrom.bin \
>> -drive file=image-bmc,format=raw,if=mtd \
>> -snapshot \
>> -device usb-kbd,bus=usb-bus.3,id=mykbd \
>> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>> -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
>> Result:
>> root@ast2700-default:~# lsusb
>> unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
>> Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
>> Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
>> Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>> v1
>> 1. Fix checkpatch coding style issues
>> 2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
>> 3. Add descriptor address offset property
>> 4. Enable 64-bit EHCI DMA addressing on AST2700
>> 5. Configure descriptor address offset for AST2700
>>
>> v2
>> 1. Remove unused EHCIfstn structure and dead code
>> 2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
>> 3. Replace DPRINTF debug logs with trace events
>> 4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
>> 5. Fix review issue
>>
>> v3:
>> 1. Add Migration version test function
>> 2. Add EHCI 64-bit buffer pointer fields description in commit log
>>
>> v4:
>> 1. Reorder patches in the series
>> 2. Fix EHCI migration issues
>> 3. Introduce a common properties macro for both sysbus and PCI
>> 4. Drop the descriptor address offset property
>> 5. Add ctrldssegment-default property
>> 6. Address review comments
>>
>> v5:
>> 1. Add 11.0 machine compatibility properties
>>
>> v6:
>> 1. Update reviewer suggested improvements.
>> Jamin Lin (11):
>> tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
>> AST2600 SDK
>> hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
>> compatibility
>> hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
>> capability
>> hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
>> hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
>> hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
>> hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
>> hw/usb/hcd-ehci: Add ctrldssegment-default property
>> hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
>> hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
>> tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
>> AST2700 A1/A2
>>
>> hw/usb/hcd-ehci.h | 29 +++-
>> hw/arm/aspeed_ast27x0.c | 5 +
>> hw/core/machine.c | 5 +-
>> hw/usb/hcd-ehci.c | 162 +++++++++++++-----
>> hw/usb/trace-events | 26 +--
>> .../aarch64/test_aspeed_ast2700a1.py | 7 +
>> .../aarch64/test_aspeed_ast2700a2.py | 7 +
>> .../functional/arm/test_aspeed_ast2600_sdk.py | 7 +
>> 8 files changed, 185 insertions(+), 63 deletions(-)
>>
>
> Applied to
>
> https://github.com/legoater/qemu aspeed-next
Jamin,
I dropped the series from aspeed-next and kept :
tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK
The USB subsystem is orphan but it is still used in the virt world.
This series is modifying the EHCI internals in such way that migration
is impacted and the CTRLDSSEGMENT (Control Data Structure Segment
Register) implementation is incomplete AFAICT. From EHCI specs :
This register allows the host software to locate all control data
structures within the *same 4 Gigabyte memory segment*.
Linux driver seems buggy too.
Overall, the risk of regression is too high given the time I can dedicate
to this topic.
Thanks for all the good work you done there, specially for migration.
If someone can Ack the series and step forward to become USB maintainer,
then I will reconsider.
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* RE: [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support
2026-05-11 6:13 ` Cédric Le Goater
@ 2026-05-11 6:30 ` Jamin Lin
2026-05-12 14:47 ` Cédric Le Goater
1 sibling, 0 replies; 27+ messages in thread
From: Jamin Lin @ 2026-05-11 6:30 UTC (permalink / raw)
To: Cédric Le Goater, philmd@linaro.org, peterx@redhat.com,
Peter Maydell, Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery,
Joel Stanley, Zhao Liu, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
Hi flwu, Nabih
> Subject: Re: [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing
> support
> Jamin,
>
> I dropped the series from aspeed-next and kept :
>
> tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
> AST2600 SDK
>
> The USB subsystem is orphan but it is still used in the virt world.
> This series is modifying the EHCI internals in such way that migration is
> impacted and the CTRLDSSEGMENT (Control Data Structure Segment
> Register) implementation is incomplete AFAICT. From EHCI specs :
>
> This register allows the host software to locate all control data
> structures within the *same 4 Gigabyte memory segment*.
>
> Linux driver seems buggy too.
>
> Overall, the risk of regression is too high given the time I can dedicate to this
> topic.
>
> Thanks for all the good work you done there, specially for migration.
> If someone can Ack the series and step forward to become USB maintainer,
> then I will reconsider.
>
>
Just to let you know the upstream status.
If you want to use USB EHCI on AST2700, please apply this patch series to your codebase.
Thanks,
Jamin
> C.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support
2026-05-11 6:13 ` Cédric Le Goater
2026-05-11 6:30 ` Jamin Lin
@ 2026-05-12 14:47 ` Cédric Le Goater
1 sibling, 0 replies; 27+ messages in thread
From: Cédric Le Goater @ 2026-05-12 14:47 UTC (permalink / raw)
To: Jamin Lin, philmd@linaro.org, peterx@redhat.com, Peter Maydell,
Steven Lee, Troy Lee, Kane Chen, Andrew Jeffery, Joel Stanley,
Zhao Liu, open list:ASPEED BMCs, open list:All patches CC here,
'Marc-André Lureau', 'Gerd Hoffmann'
Cc: Troy Lee, farosas@suse.de, flwu@google.com,
nabihestefan@google.com
+ Gerd, Marc-André,
May be they can provide some more feedback.
On 5/11/26 08:13, Cédric Le Goater wrote:
> On 5/4/26 07:27, Cédric Le Goater wrote:
>> On 5/4/26 04:53, Jamin Lin wrote:
>>> EHCI supports 64-bit addressing through the CTRLDSSEGMENT register,
>>> which provides the upper 32 bits of descriptor addresses when the
>>> controller advertises 64-bit capability.
>>>
>>> Currently QEMU EHCI model only partially supports this functionality and
>>> descriptor addresses are effectively treated as 32-bit. This becomes
>>> problematic on systems where system memory is located above the 4GB
>>> boundary.
>>>
>>> The Linux EHCI driver enables 64-bit addressing if the controller
>>> advertises the capability. During initialization it programs the
>>> segment register to zero:
>>>
>>> https://github.com/torvalds/linux/blob/master/drivers/usb/host/ehci-hcd.c#L600
>>>
>>> The driver also notes that descriptor structures allocated from the
>>> DMA pool use segment zero semantics. Descriptor memory is allocated
>>> using the DMA API and platforms may configure a 64-bit DMA mask,
>>> allowing descriptor memory to be placed above 4GB.
>>>
>>> On AST2700 platforms, system DRAM is mapped at 0x400000000. As a
>>> result, descriptor addresses constructed directly from the EHCI
>>> registers do not match the actual system addresses used by the
>>> controller when accessing queue heads (QH) and queue element transfer
>>> descriptors (qTD).
>>>
>>> This patch series implements full 64-bit descriptor addressing support
>>> in the EHCI emulation. Descriptor address handling is updated to use
>>> 64-bit values and the descriptor structures (QH, qTD, iTD and siTD)
>>> are extended to support the upper address bits provided by the segment
>>> register.
>>>
>>> Add a ctrldssegment-default property so platforms can provide a
>>> descriptor address offset when constructing descriptor addresses.
>>> This allows systems where DRAM resides above 4GB to access EHCI
>>> descriptors correctly.
>>>
>>> The AST2700 machine uses this property to account for its DRAM mapping
>>> at 0x400000000 and enables 64-bit EHCI DMA addressing.
>>>
>>> Test Result:
>>> 1. EHCI 32bits with ast2600-evb machine
>>> Command line:
>>> ./build/qemu-system-arm \
>>> -machine ast2600-evb \
>>> -m 1G \
>>> -drive file=image-bmc,if=mtd,format=raw \
>>> -nographic \
>>> -device usb-kbd,bus=usb-bus.1,id=mykbd \
>>> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>>> -device usb-storage,bus=usb-bus.1,id=mystorage,drive=usbdisk
>>> -snapshot \
>>> -nographic
>>> Result:
>>> unable to initialize usb specBus 001 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
>>> Bus 001 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
>>> Bus 001 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>>> Bus 002 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
>>>
>>> 2. EHCI 64bits with ast2700a2-evb machine
>>> Command line:
>>> ./build/qemu-system-aarch64 -M ast2700a2-evb -nographic\
>>> -bios ast27x0_bootrom.bin \
>>> -drive file=image-bmc,format=raw,if=mtd \
>>> -snapshot \
>>> -device usb-kbd,bus=usb-bus.3,id=mykbd \
>>> -drive id=usbdisk,if=none,file=image0.ext4,format=raw \
>>> -device usb-storage,bus=usb-bus.3,id=mystorage,drive=usbdisk
>>> Result:
>>> root@ast2700-default:~# lsusb
>>> unable to initialize usb specBus 001 Device 001: ID 1d6b:0001 Linux 6.18.3-v00.08.01-g172b7e27a30d uhci_hcd Generic UHCI Host Controller
>>> Bus 002 Device 001: ID 1d6b:0002 Linux 6.18.3-v00.08.01-g172b7e27a30d ehci_hcd EHCI Host Controller
>>> Bus 002 Device 002: ID 0627:0001 QEMU QEMU USB Keyboard
>>> Bus 002 Device 003: ID 46f4:0001 QEMU QEMU USB HARDDRIVE
>>> v1
>>> 1. Fix checkpatch coding style issues
>>> 2. Implement 64-bit addressing for QH/qTD/iTD/siTD descriptors
>>> 3. Add descriptor address offset property
>>> 4. Enable 64-bit EHCI DMA addressing on AST2700
>>> 5. Configure descriptor address offset for AST2700
>>>
>>> v2
>>> 1. Remove unused EHCIfstn structure and dead code
>>> 2. Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
>>> 3. Replace DPRINTF debug logs with trace events
>>> 4. Add functional tests for USB EHCI on AST2600 and AST2700 A1/A2
>>> 5. Fix review issue
>>>
>>> v3:
>>> 1. Add Migration version test function
>>> 2. Add EHCI 64-bit buffer pointer fields description in commit log
>>>
>>> v4:
>>> 1. Reorder patches in the series
>>> 2. Fix EHCI migration issues
>>> 3. Introduce a common properties macro for both sysbus and PCI
>>> 4. Drop the descriptor address offset property
>>> 5. Add ctrldssegment-default property
>>> 6. Address review comments
>>>
>>> v5:
>>> 1. Add 11.0 machine compatibility properties
>>>
>>> v6:
>>> 1. Update reviewer suggested improvements.
>>> Jamin Lin (11):
>>> tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for
>>> AST2600 SDK
>>> hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration
>>> compatibility
>>> hw/usb/hcd-ehci: Add property to advertise 64-bit addressing
>>> capability
>>> hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing
>>> hw/usb/hcd-ehci: Implement 64-bit qTD descriptor addressing
>>> hw/usb/hcd-ehci: Implement 64-bit iTD descriptor addressing
>>> hw/usb/hcd-ehci: Implement 64-bit siTD descriptor addressing
>>> hw/usb/hcd-ehci: Add ctrldssegment-default property
>>> hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default
>>> hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing
>>> tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for
>>> AST2700 A1/A2
>>>
>>> hw/usb/hcd-ehci.h | 29 +++-
>>> hw/arm/aspeed_ast27x0.c | 5 +
>>> hw/core/machine.c | 5 +-
>>> hw/usb/hcd-ehci.c | 162 +++++++++++++-----
>>> hw/usb/trace-events | 26 +--
>>> .../aarch64/test_aspeed_ast2700a1.py | 7 +
>>> .../aarch64/test_aspeed_ast2700a2.py | 7 +
>>> .../functional/arm/test_aspeed_ast2600_sdk.py | 7 +
>>> 8 files changed, 185 insertions(+), 63 deletions(-)
>>>
>>
>> Applied to
>>
>> https://github.com/legoater/qemu aspeed-next
>
> Jamin,
>
> I dropped the series from aspeed-next and kept :
>
> tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK
>
> The USB subsystem is orphan but it is still used in the virt world.
> This series is modifying the EHCI internals in such way that migration
> is impacted and the CTRLDSSEGMENT (Control Data Structure Segment
> Register) implementation is incomplete AFAICT. From EHCI specs :
>
> This register allows the host software to locate all control data
> structures within the *same 4 Gigabyte memory segment*.
>
> Linux driver seems buggy too.
>
> Overall, the risk of regression is too high given the time I can dedicate
> to this topic.
>
> Thanks for all the good work you done there, specially for migration.
> If someone can Ack the series and step forward to become USB maintainer,
> then I will reconsider.
Thanks,
C.
^ permalink raw reply [flat|nested] 27+ messages in thread
end of thread, other threads:[~2026-05-12 14:49 UTC | newest]
Thread overview: 27+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-04 2:53 [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Jamin Lin
2026-05-04 2:53 ` [PATCH v6 01/11] tests/functional/arm/test_aspeed_ast2600_sdk: Add USB EHCI test for AST2600 SDK Jamin Lin
2026-05-04 2:53 ` [PATCH v6 02/11] hw/usb/hcd-ehci: Change descriptor addresses to 64-bit with migration compatibility Jamin Lin
2026-05-04 5:19 ` Cédric Le Goater
2026-05-04 12:17 ` Philippe Mathieu-Daudé
2026-05-06 2:09 ` Jamin Lin
2026-05-06 3:38 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 03/11] hw/usb/hcd-ehci: Add property to advertise 64-bit addressing capability Jamin Lin
2026-05-04 2:53 ` [PATCH v6 04/11] hw/usb/hcd-ehci: Implement 64-bit QH descriptor addressing Jamin Lin
2026-05-04 2:53 ` [PATCH v6 05/11] hw/usb/hcd-ehci: Implement 64-bit qTD " Jamin Lin
2026-05-04 2:53 ` [PATCH v6 06/11] hw/usb/hcd-ehci: Implement 64-bit iTD " Jamin Lin
2026-05-04 2:53 ` [PATCH v6 07/11] hw/usb/hcd-ehci: Implement 64-bit siTD " Jamin Lin
2026-05-04 2:53 ` [PATCH v6 08/11] hw/usb/hcd-ehci: Add ctrldssegment-default property Jamin Lin
2026-05-04 11:18 ` Philippe Mathieu-Daudé
2026-05-04 12:17 ` Cédric Le Goater
2026-05-04 12:42 ` Philippe Mathieu-Daudé
2026-05-04 13:12 ` Cédric Le Goater
2026-05-06 1:22 ` Jamin Lin
2026-05-06 3:36 ` Jamin Lin
2026-05-04 2:53 ` [PATCH v6 09/11] hw/arm/aspeed_ast27x0: Set EHCI ctrldssegment-default Jamin Lin
2026-05-04 11:19 ` Philippe Mathieu-Daudé
2026-05-04 2:53 ` [PATCH v6 10/11] hw/arm/aspeed_ast27x0: Enable 64-bit EHCI DMA addressing Jamin Lin
2026-05-04 2:53 ` [PATCH v6 11/11] tests/functional/aarch64/test_aspeed_ast2700: Add USB EHCI test for AST2700 A1/A2 Jamin Lin
2026-05-04 5:27 ` [PATCH v6 00/11] hw/usb/ehci: Add 64-bit descriptor addressing support Cédric Le Goater
2026-05-11 6:13 ` Cédric Le Goater
2026-05-11 6:30 ` Jamin Lin
2026-05-12 14:47 ` Cédric Le Goater
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox