summaryrefslogtreecommitdiff
path: root/hw/usb/hcd-ehci.c
AgeCommit message (Collapse)AuthorFilesLines
2012-10-25ehci: Detect going in circles when filling the queueHans de Goede1-1/+8
For ctrl endpoints Windows (atleast Win7) creates circular td lists, so far these were not a problem because we would stop filling the queue if altnext was set. Since further patches in this patchset remove the altnext check this does become a problem and we need detection for going in circles. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-10-25ehci: Speed up the timer of raising int from the async scheduleHans de Goede1-1/+12
Often the guest will queue up new packets in response to a packet, in the async schedule with its IOC flag set, completing. By speeding up the frame-timer, we notice these new packets earlier. This increases the speed (MB/s) of a Linux guest reading from a USB mass storage device by a factor of 1.15 on top of the "Improve latency of interrupt delivery" speed-ups, both with and without input pipelining enabled. I've not tested the speed-up of this patch without the "Improve latency of interrupt delivery" patch. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-10-25ehci: Improve latency of interrupt delivery and async schedule scanningHans de Goede1-8/+2
While doing various performance tests of reading from USB mass storage devices I noticed the following:: 1) When an async handled packet completes, we don't immediately report an interrupt to the guest, instead we wait for the frame-timer to run and report it from there 2) If 1) has been fixed and an async handled packet takes a while to complete, then async_stepdown will become a high value, which means that there will be a large latency before any new packets queued by the guest in response to the interrupt get seen 1) was done deliberately as part of commit f0ad01f92: http://www.kraxel.org/cgit/qemu/commit/?h=usb.57&id=f0ad01f92ca02eee7cadbfd225c5de753ebd5fce Since setting the interrupt immediately on async packet completion was causing issues with Linux guests, I believe this recently fixed Linux bug explains why this is happening: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=361aabf395e4a23cf554cf4ec0c0c6963b8beb01 Note that we can *not* count on this fix being present in all Linux guests! I was hoping that the recently added support for Interrupt Threshold Control would fix the issues with Linux guests, but adding a simple ehci_commit_irq() call to ehci_async_bh() still caused problems with Linux guests. The problem is, that when doing ehci_commit_irq() from ehci_async_bh(), the "old" frindex value is used to calculate usbsts_frindex, and when the frame-timer then runs possibly very shortly after ehci_async_bh(), it increases the frame-timer, and thus any interrupts raised from that frame-timer run, will also get reported to the guest immediately, rather then being delayed to the next frame-timer run. Luckily the solution for this is simple, this means that we need to increase frindex before calling ehci_commit_irq() from ehci_async_bh(), which in the end boils down to simple calling ehci_frame_timer() instead of ehci_async_bh() from the bh. This may seem like it causes a lot of extra work to be done, but this is not true. Any work done from the frame-timer processing the periodic schedule is work which then does not need to be done the next time the frame timer runs, also the frame-timer will re-arm itself at (possibly) a later time then it was armed for saving a vmexit at that time. As an additional advantage moving to simply calling the frame-timer also fixes 2) as the packet completion will set async_stepdown to 0, and the re-arming of the timer with an async_stepdown of 0 ensures that any newly queued up packets get seen in a reasonable amount of time. This improves the speed (MB/s) of a Linux guest reading from a USB mass storage device by a factor of 1.5 - 1.7 with input pipelining disabled, and by a factor of 1.8 with input pipelining enabled. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-10-25ehci: Set int flag on a short input packetHans de Goede1-0/+4
According to 4.15.1.2 an interrupt must be raised when a short packet is received. If we don't do this it may take a significant time for the guest to notice a short trasnfer has completed, since only the last td will have its IOC flag set, and a short transfer may complete in an earlier packet. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-10-25ehci: Get rid of packet tbytes fieldHans de Goede1-11/+9
This field is used in some places to track the tbytes field of the token, but in other places the field is used directly, use it directly everywhere for consistency. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-10-23Rename target_phys_addr_t to hwaddrAvi Kivity1-10/+10
target_phys_addr_t is unwieldly, violates the C standard (_t suffixes are reserved) and its purpose doesn't match the name (most target_phys_addr_t addresses are not target specific). Replace it with a finger-friendly, standards conformant hwaddr. Outstanding patchsets can be fixed up with the command git rebase -i --exec 'find -name "*.[ch]" | xargs s/target_phys_addr_t/hwaddr/g' origin Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-09-26ehci: Fix interrupt packet MULT handlingHans de Goede1-20/+20
There are several issues with our handling of the MULT epcap field of interrupt qhs, which this patch fixes. 1) When we don't execute a transaction because of the transaction counter being 0, p->async stays EHCI_ASYNC_NONE, and the next time we process the same qtd we hit an assert in ehci_state_fetchqtd because of this. Even though I believe that this is caused by 3 below, this patch still removes the assert, as that can still happen without 3, when multiple packets are queued for the same interrupt ep. 2) We only *check* the transaction counter from ehci_state_execute, any packets queued up by fill_queue bypass this check. This is fixed by not calling fill_queue for interrupt packets. 3) Some versions of Windows set the MULT field of the qh to 0, which is a clear violation of the EHCI spec, but still they do it. This means that we will never execute a qtd for these, making interrupt ep-s on USB-2 devices not work, and after recent changes, triggering 1). So far we've stored the transaction counter in our copy of the mult field, but with this beginnig at 0 already when dealing with these version of windows this won't work. So this patch adds a transact_ctr field to our qh struct, and sets this to the MULT field value on fetchqh. When the MULT field value is 0, we set it to 4. Assuming that windows gets way with setting it to 0, by the actual hardware going horizontal on a 1 -> 0 transition, which will give it 4 transactions (MULT goes from 0 - 3). Note that we cannot stop on detecting the 1 -> 0 transition, as our decrement of the transaction counter, and checking for it are done in 2 different places. Reported-by: Shawn Starr <shawn.starr@rogers.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-13ehci: Walk async schedule before and after migrationHans de Goede1-0/+28
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-13ehci: Don't set seen to 0 when removing unseen queue-headsHans de Goede1-6/+18
When removing unseen queue-heads from the async queue list, we should not set the seen flag to 0, as this may cause them to be removed by ehci_queues_rip_unused() during the next call to ehci_advance_async_state() if the timer is late or running at a low frequency. Note: 1) This *may* have caused the instant unlink / relinks described in commit 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0 2) Rather then putting more if-s inside ehci_queues_rip_unused, this patch instead introduces a new ehci_queues_rip_unseen function. 3) This patch also makes it save to call ehci_queues_rip_unseen() multiple times, which gets used in the folluw up patch titled: "ehci: Walk async schedule before and after migration" Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-12ehci: Don't process too much frames in 1 timer tick (v2)Hans de Goede1-0/+14
The Linux ehci isoc scheduling code fills the entire schedule ahead of time minus 80 frames. If we make a large jump in where we are in the schedule, ie 40 frames, then the scheduler all of a sudden will only have 40 frames left to work in, causing it to fail packet submissions with error -27 (-EFBIG). Changes in v2: -Don't hardcode a maximum number of frames to process in one tick, instead: -Process a minimum number of frames to ensure we do eventually catch up -Stop (after the minimum number) when the guest has requested an irq Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-12ehci: Fix interrupts stopping when Interrupt Threshold Control is 8Hans de Goede1-1/+1
If Interrupt Threshold Control is 8 or a multiple of 8, then s->usbsts_frindex can become exactly 0x4000, at which point (s->usbsts_frindex > s->frindex) will never become true, as s->usbsts_frindex will not be lowered / reset in this case. This patch fixes this. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-12ehci: switch to new-style memory opsGerd Hoffmann1-89/+84
Also register different memory regions for capabilities, operational registers and port status registers. Create separate tracepoints for operational regs and port status regs. Ditch a bunch of sanity checks because the memory core will do this for us now. Offloading the byte, word and dword access handling to the memory core also has the side effect of fixing ehci register access on bigendian hosts. Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: Correct a comment in fetchqtd packet processingHans de Goede1-1/+4
Since my previous comment said "Should never happen", I tried changing the next line to an assert(0), which did not go well, which as the new comments explains is logical if you think about it for a moment. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: Handle USB_RET_PROCERR in ehci_fill_queueHans de Goede1-3/+6
USB_RET_PROCERR can be triggered by the guest (by for example requesting more then BUFFSIZE bytes), so don't assert on it. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: Fix memory leak in handling of NAK-ed packetsHans de Goede1-11/+27
Currently each time we try to execute a NAK-ed packet we redo ehci_init_transfer, and usb_packet_map, re-allocing (without freeing) the sg list every time. This patch fixes this, it does this by introducing another async state, so that we also properly cleanup a NAK-ed packet on cancel. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: Add some additional ehci_trace_guest_bug() callsHans de Goede1-6/+13
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: add doorbell trace eventsGerd Hoffmann1-1/+2
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: trace guest bugsGerd Hoffmann1-6/+20
make qemu_queue_{cancel,reset} return the number of packets released, so the caller can figure whenever there have been active packets even though there shouldn't have been any. Add tracepoint to log this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: check for EHCI_ASYNC_FINISHED first in ehci_free_packetGerd Hoffmann1-6/+6
Otherwise we'll see the packet free twice in the trace log even though it actually happens only once. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-09-11ehci: Properly report completed but not yet processed packets to the guestHans de Goede1-0/+13
Reported packets which have completed before being cancelled as such to the host. Note that the new code path this patch adds is untested since it I've been unable to actually trigger the race which needs this code path. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-09-11ehci: Properly cleanup packets on cancelHans de Goede1-0/+2
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-09-11ehci: Update copyright headers to reflect recent workHans de Goede1-0/+5
Update copyright headers to reflect all the work Gerd and I have been doing on the EHCI emulation. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-09-11ehci: Validate qh is not changed unexpectedly by the guestHans de Goede1-11/+28
-combine the qh check with the check for devaddr changes -also ensure that p gets set to NULL when the queue gets cancelled on devaddr change, which was not done properly before this patch Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-09-11Revert "ehci: don't flush cache on doorbell rings."Hans de Goede1-29/+6
This reverts commit 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0, which got added to fix an issue where the real, underlying cause was not stopping the ep queue on an error. Now that the underlying cause is fixed by the "usb: Halt ep queue and cancel pending packets on a packet error" patch, the "don't flush" fix is no longer needed. Not only is it not needed, it causes us to see cancellations (unlinks) done by the Linux EHCI driver too late, which in combination with the new usb-core packet-id generation where qtd addresses are used as ids, causes duplicate ids for in flight packets. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-09-11usb: controllers do not need to check for babble themselvesHans de Goede1-4/+0
If an (emulated) usb-device tries to write more data to a packet then its iov len, this will trigger an assert in usb_packet_copy(), and if a driver somehow circumvents that check and writes more data to the iov then there is space, we have a much bigger problem then not correctly reporting babble to the guest. In practice babble will only happen with (real) redirected devices, and there both the usb-host os and the qemu usb-device code already check for it. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31ehci: Fix interrupt endpoints no longer workingHans de Goede1-2/+11
One of the recent changes (likely the addition of queuing support) has broken interrupt endpoints, this patch fixes this. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-08-31ehci: handle TD deactivation of inflight packetsGerd Hoffmann1-15/+23
Check the TDs of inflight packets, cancel packets in case the guest clears the active bit. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31ehci: add ehci_cancel_queue()Gerd Hoffmann1-10/+20
Factor out function to cancel all packets of a queue. No behavior change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31ehci: simplify ehci_state_executingHans de Goede1-12/+1
ehci_state_executing does not need to check for p->usb_status == USB_RET_ASYNC or USB_RET_PROCERR, since ehci_execute_complete already does a similar check and will trigger an assert if either value is encountered. USB_RET_ASYNC should never be the packet status when execute_complete runs for obvious reasons, and USB_RET_PROCERR is only used by ehci_state_execute / ehci_execute not by ehci_state_executing / ehci_execute_complete. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31ehci: Remove unnecessary ehci_flush_qh callHans de Goede1-1/+0
ehci_qh_do_overlay() already calls ehci_flush_qh() before it returns, calling it twice is useless. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31ehci: Schedule async-bh when IAAD bit gets setHans de Goede1-0/+9
After the "ehci: Print a warning when a queue unexpectedly contains packets on cancel" commit. Under certain reproducable conditions I was getting the following message: "EHCI: Warning queue not empty on queue reset". After aprox. 8 hours of debugging I've finally found the cause. The Linux EHCI driver has an IAAD watchdog, to work around certain EHCI hardware sometimes not acknowledging the doorbell at all. This watchdog has a timeout of 10 ms, which is less then the time between 2 runs through the async schedule when async_stepdown is at its highest value. Thus the watchdog can trigger, after which Linux clears the IAAD bit and re-uses the QH. IOW we were not properly detecting the unlink of the qh, due to us missing (ignoring for more then 10 ms) the IAAD command, which triggered the warning. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-08-31ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream activeHans de Goede1-1/+1
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2012-08-31usb: unique packet idsGerd Hoffmann1-4/+5
This patch adds IDs to usb packets. Those IDs are (a) supposed to be unique for the lifecycle of a packet (from packet setup until the packet is either completed or canceled) and (b) stable across migration. uhci, ohci, ehci and xhci use the guest physical address of the transfer descriptor for this. musb needs a different approach because there is no transfer descriptor. But musb also doesn't support pipelining, so we have never more than one packet per endpoint in flight. So we go create an ID based on endpoint and device address. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-31usb: Halt ep queue en cancel pending packets on a packet errorHans de Goede1-0/+13
For controllers which queue up more then 1 packet at a time, we must halt the ep queue, and inside the controller code cancel all pending packets on an error. There are multiple reasons for this: 1) Guests expect the controllers to halt ep queues on error, so that they get the opportunity to cancel transfers which the scheduled after the failing one, before processing continues 2) Not cancelling queued up packets after a failed transfer also messes up the controller state machine, in the case of EHCI causing the following assert to trigger: "assert(p->qtdaddr == q->qtdaddr)" at hcd-ehci.c:2075 3) For bulk endpoints with pipelining enabled (redirection to a real USB device), we must cancel all the transfers after this a failed one so that: a) If they've completed already, they are not processed further causing more stalls to be reported, originating from the same failed transfer b) If still in flight, they are cancelled before the guest does a clear stall, otherwise the guest and device can loose sync! Note this patch only touches the ehci and uhci controller changes, since AFAIK no other controllers actually queue up multiple transfer. If I'm wrong on this other controllers need to be updated too! Also note that this patch was heavily tested with the ehci code, where I had a reproducer for a device causing a transfer to fail. The uhci code is not tested with actually failing transfers and could do with a thorough review! Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-16ehci: Fix setting of halt bit from usbcmd register updatesHans de Goede1-7/+8
This fixes linux guests started without any USB devices not seeing newly plugged devices until "lsusb" is done inside the guest. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-16ehci: fix Interrupt Threshold Control implementationGerd Hoffmann1-2/+10
First, not all interrupts are subject to Interrupt Threshold Control, some of them must be delivered without delay. Second, Interrupt Threshold Control state must be part of vmstate, otherwise we might loose IRQs on migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-08-15ehci: fix assertion typoAlejandro Martinez Ruiz1-1/+1
Signed-off-by: Alejandro Martinez Ruiz <alex@securiforest.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-07-12ehci: improve expire time calculationGerd Hoffmann1-4/+4
Move down the expire time calculation down in the frame timer, to the point where the timer is actually reloaded. This way we'll notice any async_stepdown changes (especially resetting to 0 due to usb activity). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-12ehci: implement Interrupt Threshold Control supportGerd Hoffmann1-29/+54
Also reorganize and comment the irq functions while being at it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-12ehci: raise irq in the frame timerGerd Hoffmann1-2/+2
With the async schedule being kicked from other places than the frame timer (commit 0f588df8b3688b00e77aabaa32e26ece5f19bd39) it may happen that we call ehci_commit_interrupt() more than once per frame. Move the call from the async schedule handler to the frame timer to restore old irq behavior, which is more correct. Fixes regressions with some linux kernel versions. TODO: implement full Interrupt Threshold Control support. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-09ehci: Kick async schedule on wakeup in the non companion caseHans de Goede1-2/+3
Commit 0f588df8b3688b00e77aabaa32e26ece5f19bd39, added code to ehci_wakeup to kick the async schedule on wakeup, but the else was positioned wrong making it trigger for devices which are routed to the companion rather then to the ehci controller itself. This patch fixes this. Note that the "programming style" with using the return at the end of the companion block matches how the companion case is handled in the other ports ops, and is done this way for consistency. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-09usb-ehci: Fix an assert whenever isoc transfers are usedHans de Goede1-0/+1
hcd-ehci.c is missing an usb_packet_init() call for the ipacket UsbPacket it uses for isoc transfers, triggering an assert (taking the entire vm down) in usb_packet_setup as soon as any isoc transfers are done by a high speed USB device. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-09ehci: don't flush cache on doorbell rings.Gerd Hoffmann1-6/+29
Commit 4be23939ab0d7019c7e59a37485b416fbbf0f073 makes ehci instantly zap any unlinked queue heads when the guest rings the doorbell. While hacking up uas support this turned out to be a problem. The linux kernel can unlink and instantly relink the very same queue head, thereby killing any async packets in flight. That alone isn't an issue yet, the packet will canceled and resubmitted and everything is fine. We'll run into trouble though in case the async packet is completed already, so we can't cancel it any more. The transaction is simply lost then. usb_ehci_qh_ptrs q (nil) - QH @ 39c4f000: next 39c4f122 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_qh_ptrs q 0x7f95feba90a0 - QH @ 39c4f000: next 39c4f122 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_qh_ptrs q 0x7f95fe515210 - QH @ 39c4f120: next 39c4f0c2 qtds 29dbce40,29dbc4e0,00000009 usb_ehci_qh_fields QH @ 39c4f120 - rl 4, mplen 512, eps 2, ep 1, dev 2 usb_ehci_packet_action q 0x7f95fe515210 p 0x7f95fdec32a0: alloc usb_packet_state_change bus 0, port 2, ep 1, packet 0x7f95fdec32e0, state undef -> setup usb_ehci_packet_action q 0x7f95fe515210 p 0x7f95fdec32a0: process usb_uas_command dev 2, tag 0x2, lun 0, lun64 00000000-00000000 scsi_req_parsed target 0 lun 0 tag 2 command 42 dir 2 length 16384 scsi_req_parsed_lba target 0 lun 0 tag 2 command 42 lba 5933312 scsi_req_alloc target 0 lun 0 tag 2 scsi_req_continue target 0 lun 0 tag 2 scsi_req_data target 0 lun 0 tag 2 len 16384 usb_uas_scsi_data dev 2, tag 0x2, bytes 16384 usb_uas_write_ready dev 2, tag 0x2 usb_packet_state_change bus 0, port 2, ep 1, packet 0x7f95fdec32e0, state setup -> complete usb_ehci_packet_action q 0x7f95fe515210 p 0x7f95fdec32a0: free usb_ehci_qh_ptrs q 0x7f95fdec3210 - QH @ 39c4f0c0: next 39c4f002 qtds 29dbce40,00000001,00000009 usb_ehci_qh_fields QH @ 39c4f0c0 - rl 4, mplen 512, eps 2, ep 2, dev 2 usb_ehci_queue_action q 0x7f95fe5152a0: free usb_packet_state_change bus 0, port 2, ep 2, packet 0x7f95feba9170, state async -> complete ^^^ async packets completes. usb_ehci_packet_action q 0x7f95fdec3210 p 0x7f95feba9130: wakeup usb_ehci_qh_ptrs q (nil) - QH @ 39c4f000: next 39c4f122 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_qh_ptrs q 0x7f95feba90a0 - QH @ 39c4f000: next 39c4f122 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_qh_ptrs q 0x7f95fe515210 - QH @ 39c4f120: next 39c4f002 qtds 29dbc4e0,29dbc8a0,00000009 usb_ehci_qh_fields QH @ 39c4f120 - rl 4, mplen 512, eps 2, ep 1, dev 2 usb_ehci_queue_action q 0x7f95fdec3210: free usb_ehci_packet_action q 0x7f95fdec3210 p 0x7f95feba9130: free ^^^ endpoint #2 queue head removed from schedule, doorbell makes ehci zap the queue, the (completed) usb packet is freed too and gets lost. usb_ehci_qh_ptrs q (nil) - QH @ 39c4f000: next 39c4f0c2 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_qh_ptrs q 0x7f95feba90a0 - QH @ 39c4f000: next 39c4f0c2 qtds 00000000,00000001,39c50000 usb_ehci_qh_fields QH @ 39c4f000 - rl 0, mplen 0, eps 0, ep 0, dev 0 usb_ehci_queue_action q 0x7f9600dff570: alloc usb_ehci_qh_ptrs q 0x7f9600dff570 - QH @ 39c4f0c0: next 39c4f122 qtds 29dbce40,00000001,00000009 usb_ehci_qh_fields QH @ 39c4f0c0 - rl 4, mplen 512, eps 2, ep 2, dev 2 usb_ehci_packet_action q 0x7f9600dff570 p 0x7f95feba9130: alloc usb_packet_state_change bus 0, port 2, ep 2, packet 0x7f95feba9170, state undef -> setup usb_ehci_packet_action q 0x7f9600dff570 p 0x7f95feba9130: process usb_packet_state_change bus 0, port 2, ep 2, packet 0x7f95feba9170, state setup -> async usb_ehci_packet_action q 0x7f9600dff570 p 0x7f95feba9130: async ^^^ linux kernel relinked the queue head, ehci creates a new usb packet, but we should have delivered the completed one instead. usb_ehci_qh_ptrs q 0x7f95fe515210 - QH @ 39c4f120: next 39c4f002 qtds 29dbc4e0,29dbc8a0,00000009 usb_ehci_qh_fields QH @ 39c4f120 - rl 4, mplen 512, eps 2, ep 1, dev 2 So instead of instantly zapping the queue we'll set a flag that the queue needs revalidation in case we'll see it again in the schedule. ehci then checks that the queue head fields addressing / describing the endpoint and the qtd pointer match the cached content before reusing it. Cc: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-09ehci: fix td writebackGerd Hoffmann1-2/+4
Only write back the dwords the hc is supposed to update. Should not make a difference in theory as the guest must not touch the td while it is active to avoid races. But it is still more correct. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-07-09ehci: fix ehci_qh_do_overlayGerd Hoffmann1-19/+18
Use ehci_flush_qh to make sure we touch inly the fields the hc is allowed to touch. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-06-27usb: Convert usb_packet_{map, unmap} to universal DMA helpersDavid Gibson1-2/+2
The USB UHCI and EHCI drivers were converted some time ago to use the pci_dma_*() helper functions. However, this conversion was not complete because in some places both these drivers do DMA via the usb_packet_map() function in usb-libhw.c. That function directly used cpu_physical_memory_map(). Now that the sglist code uses DMA wrappers properly, we can convert the functions in usb-libhw.c, thus conpleting the conversion of UHCI and EHCI to use the DMA wrappers. Note that usb_packet_map() invokes dma_memory_map() with a NULL invalidate callback function. When IOMMU support is added, this will mean that usb_packet_map() and the corresponding usb_packet_unmap() must be called in close proximity without dropping the qemu device lock - otherwise the guest might invalidate IOMMU mappings while they are still in use by the device code. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-06-20ehci: tracing improvementsGerd Hoffmann1-2/+5
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-06-20ehci: add live migration supportGerd Hoffmann1-6/+56
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-06-07ehci: rework frame skippingGerd Hoffmann1-15/+10
Move the framecount check out of the loop and use the new ehci_update_frindex function to skip frames if needed. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-06-07ehci: adaptive wakeup rate.Gerd Hoffmann1-18/+39
Adapt the frame timer sleeps according to the actual needs. With the periodic schedule being active we'll have to wakeup 1000 times per second and go check for work. In case only the async schedule is active we can be more lazy though. When idle ehci will increate the sleep time step by step, so qemu has to wake up less frequently. When we'll see transactions on the bus or the guest fiddles with the schedule enable/disable bits we'll return to a 1000 Hz wakeup rate and full speed. With both schedules disabled we stop wakeups altogether. This patch also drops the freq property (configures wakeup rate manually) which is obsoleted by this patch. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>