uboot usb ehci 控制传输

1.问题陈述
在添加uboot中增加一个function后，uboot中usb driver出现无法发送控制命令的问题。
2.如何追述问题原因
通过usb 分析仪进行usb总线上发包分析，分析仪显示在设备初始化阶段并没有检测到有效的packet发送。
直接追究其原因是有没有正确将qh于qtd传递到内存中， 接下来贴上一些有关qh意识qtd初始化的代码
1.
int
submit_control_msg(struct usb_device *dev, unsigned long pipe, void *buffer,
  int length, struct devrequest *setup)
{


if (usb_pipetype(pipe) != PIPE_CONTROL) {
debug("non-control pipe (type=%lu)", usb_pipetype(pipe));
return -1;
}


if (usb_pipedevice(pipe) == rootdev) {
if (rootdev == 0)
dev->speed = USB_SPEED_HIGH;
return ehci_submit_root(dev, pipe, buffer, length, setup);
}
return ehci_submit_async(dev, pipe, buffer, length, setup);
}


这个函数很简单只是判定是否是root hub，现在我们分析的设备并不是root hub dev所以我先直接进入ehci_submit_async进行分析，随后我们在回头看看如果是root dev的情况
这个函数非常长，但是还是比较容易读懂的，接下来我们逐行进行分析
static int
ehci_submit_async(struct usb_device *dev, unsigned long pipe, void *buffer,
  int length, struct devrequest *req)
{
struct QH *qh;
struct qTD *td;
struct qTD *tdp;
volatile struct qTD *vtd;
volatile struct qTD *pvtd;
unsigned long ts;
//uint32_t *tdp;
uint32_t endpt, token, usbsts;
uint32_t c, toggle;
uint32_t cmd;
int ret = 0;


// TODO - revert printf to debug
debug("dev=%p, pipe=%lx, buffer=%p, length=%d, req=%p\n", dev, pipe,
     buffer, length, req);
if (req != NULL)
debug("req=%u (%#x), type=%u (%#x), value=%u (%#x), index=%u\n",
     req->request, req->request,
     req->requesttype, req->requesttype,
     le16_to_cpu(req->value), le16_to_cpu(req->value),
     le16_to_cpu(req->index));


qh = ehci_alloc(sizeof(struct QH), 32); // 分配一个qh
if (qh == NULL) {
debug("unable to allocate QH\n");
return -1;
}


/* Add it to the little chain */
qh_list.qh_list = qh; //qh_list 是一个全局变量，async执行的起始地址是指向该qh_ist,这是一个无效的qh，这里我们将qh_list视为一个链表头指针

qh->qh_list = NULL;
qh->qtd_list = NULL;
/*初始化qh*/
qh->qh_link = cpu_to_hc32((uint32_t)qh_list.qh_dma | QH_LINK_TYPE_QH); //qh 指向qh链表头指针
c = (usb_pipespeed(pipe) != USB_SPEED_HIGH &&
    usb_pipeendpoint(pipe) == 0) ? 1 : 0;
endpt = (8 << 28) |
   (c << 27) |
   (usb_maxpacket(dev, pipe) << 16) |
   (0 << 15) |
   (1 << 14) |
   (usb_pipespeed(pipe) << 12) |
   (usb_pipeendpoint(pipe) << 8) |
   (0 << 7) | (usb_pipedevice(pipe) << 0);
qh->qh_endpt1 = cpu_to_hc32(endpt);
endpt = (1 << 30) |
   (dev->portnr << 23) |
   (dev->parent->devnum << 16) | (0 << 8) | (0 << 0);
qh->qh_endpt2 = cpu_to_hc32(endpt);
qh->qh_overlay.qt_next = cpu_to_hc32(QT_NEXT_TERMINATE);
qh->qh_overlay.qt_altnext = cpu_to_hc32(QT_NEXT_TERMINATE);


tdp = NULL;

toggle = usb_gettoggle(dev, usb_pipeendpoint(pipe), usb_pipeout(pipe));
/*control msg 至少有2个包  第一个是setup，第二个是data （如果有data的话）第三个握手包 */
if (req != NULL) {
td = ehci_alloc(sizeof(struct qTD), 32);
if (td == NULL) {
debug("unable to allocate SETUP td\n");
goto fail;
}

if (qh->qtd_list == NULL) {
qh->qtd_list = td;
qh->qh_overlay.qt_next = td->qt_dma;//qh 的overlay部分指向第一个setup qtd
}


if (tdp != NULL) {
tdp->qt_next = cpu_to_hc32(td->qt_dma);
tdp->qtd_list = td;
}

tdp = td; //这个是qtd的指针chain
td->qtd_list = NULL;

td->qt_next = cpu_to_hc32(QT_NEXT_TERMINATE);
td->qt_altnext = cpu_to_hc32(QT_NEXT_TERMINATE);
token = (0 << 31) |
   (sizeof(*req) << 16) |
   (0 << 15) | (0 << 12) | (3 << 10) | (2 << 8) | (0x80 << 0);
td->qt_token = cpu_to_hc32(token);
if (ehci_td_buffer(td, req, sizeof(*req)) != 0) {
debug("unable construct SETUP td\n");
ehci_free(td, sizeof(*td));
goto fail;
}


toggle = 1;
}




if (length > 0 || req == NULL) {
td = ehci_alloc(sizeof(struct qTD), 32);
if (td == NULL) {
printf("unable to allocate DATA td\n"); // TODO puts -> debug
goto fail;
}


if (qh->qtd_list == NULL) {
qh->qtd_list = td;
qh->qh_overlay.qt_next = td->qt_dma;
}

if (tdp != NULL) {
tdp->qt_next = cpu_to_hc32(td->qt_dma);  //tpd 现在是指向的是setup 包 ，赋值操作将data qtd的地址存放在set up qtd中
tdp->qtd_list = td;
}

tdp = td;
td->qtd_list = NULL;

td->qt_next = cpu_to_hc32(QT_NEXT_TERMINATE);
td->qt_altnext = cpu_to_hc32(QT_NEXT_TERMINATE);
token = (toggle << 31) |
   (length << 16) |
   ((req == NULL ? 1 : 0) << 15) |
   (0 << 12) |
   (3 << 10) |
   ((usb_pipein(pipe) ? 1 : 0) << 8) | (0x80 << 0);
td->qt_token = cpu_to_hc32(token);
if (ehci_td_buffer(td, buffer, length) != 0) {
puts("unable construct DATA td\n"); // TODO puts -> debug
ehci_free(td, sizeof(*td));
goto fail;
}
}


if (req != NULL) {
td = ehci_alloc(sizeof(struct qTD), 32);
if (td == NULL) {
puts("unable to allocate ACK td\n"); // TODO puts -> debug
goto fail;
}


if (qh->qtd_list == NULL) {
qh->qtd_list = td;
qh->qh_overlay.qt_next = td->qt_dma;
}


if (tdp != NULL) {
tdp->qt_next = cpu_to_hc32(td->qt_dma);
tdp->qtd_list = td;
}

tdp = td;
td->qtd_list = NULL;

td->qt_next = cpu_to_hc32(QT_NEXT_TERMINATE);
td->qt_altnext = cpu_to_hc32(QT_NEXT_TERMINATE);
token = (toggle << 31) |
   (0 << 16) |
   (1 << 15) |
   (0 << 12) |
   (3 << 10) |
   ((usb_pipein(pipe) ? 0 : 1) << 8) | (0x80 << 0);
td->qt_token = cpu_to_hc32(token);

td->qt_buffer[0] = 0;
td->qt_buffer[1] = 0;
td->qt_buffer[2] = 0;
td->qt_buffer[3] = 0;
td->qt_buffer[4] = 0;

}


qh_list.qh_link = cpu_to_hc32((uint32_t)qh->qh_dma | QH_LINK_TYPE_QH); //qh链表头指针的next 物理地址指针指向当前qh的物理地址


ehci_flush_qh(&qh_list); // flush cache

dump_qh (&qh_list, 0);


usbsts = ehci_readl(&hcor->or_usbsts);
ehci_writel(&hcor->or_usbsts, (usbsts & 0x3f)); //清除状态寄存器


/* Enable async. schedule. */
cmd = ehci_readl(&hcor->or_usbcmd);
cmd |= CMD_ASE;
ehci_writel(&hcor->or_usbcmd, cmd);


ret = handshake((uint32_t *)&hcor->or_usbsts, STD_ASS, STD_ASS,200 * 1000);
if (ret < 0) {
printf("EHCI fail timeout STD_ASS set\n");
goto fail;
}


//printf("ip9028: asynclistaddr=%08x\n", ehci_readl(&hcor->or_asynclistaddr));


/* Wait for TDs to be processed. */
ts = get_timer(0);


vtd = td;
pvtd = td->qt_dma;

do { //轮询等待 数据包发送完毕
/* Invalidate dcache */
ehci_inv_qh(&qh_list);
#ifdef DEBUG
printf("TOKEN=%#x %x %#x %x\n", vtd->qt_token, vtd, pvtd->qt_token, pvtd);
#endif


if (!(vtd->qt_token & 0x80)) {
#ifdef DEBUG
printf("END-TOKEN=%#x\n", vtd->qt_token);
#endif
break;
}
} while (get_timer(ts) < CONFIG_SYS_HZ);


/* Disable async schedule. */
cmd = ehci_readl(&hcor->or_usbcmd);
cmd &= ~CMD_ASE;
ehci_writel(&hcor->or_usbcmd, cmd);


//printf("ip9028: asynclistaddr=%08x\n", ehci_readl(&hcor->or_asynclistaddr));


ret = handshake((uint32_t *)&hcor->or_usbsts, STD_ASS, 0, 200 * 1000);
if (ret < 0) {
printf("EHCI fail timeout STD_ASS reset\n");
goto fail;
}


//printf("ip9028: asynclistaddr=%08x\n", ehci_readl(&hcor->or_asynclistaddr));


dump_qh (&qh_list, 0);


qh_list.qh_link = cpu_to_hc32((uint32_t)qh_list.qh_dma | QH_LINK_TYPE_QH);


token = hc32_to_cpu(qh->qh_overlay.qt_token);
if (!(token & 0x80)) { //分析当前的的stat 
debug("TOKEN=%#x\n", token);
switch (token & 0xfc) {
case 0:
toggle = token >> 31;
usb_settoggle(dev, usb_pipeendpoint(pipe),
      usb_pipeout(pipe), toggle);
dev->status = 0;
break;
case 0x40:
//debug("USB_ST_STALLED\n");
puts("USB_ST_STALLED\n");
dev->status = USB_ST_STALLED;
break;
case 0xa0:
case 0x20:
//debug("USB_ST_BUF_ERR\n");
puts("USB_ST_BUF_ERR\n");
dev->status = USB_ST_BUF_ERR;
break;
case 0x50:
case 0x10:
//debug("USB_ST_BABBLE_DET\n");
puts("USB_ST_BABBLE_DET\n");
dev->status = USB_ST_BABBLE_DET;
break;
default:
//debug("USB_ST_CRC_ERR\n");
puts("USB_ST_CRC_ERR\n");
dev->status = USB_ST_CRC_ERR;
break;
}
dev->act_len = length - ((token >> 16) & 0x7fff);
} else {
dev->act_len = 0;
debug("dev=%u, usbsts=%#x, p[1]=%#x, p[2]=%#x\n",
     dev->devnum, ehci_readl(&hcor->or_usbsts),
     ehci_readl(&hcor->or_portsc[0]),
     ehci_readl(&hcor->or_portsc[1]));
}


return (dev->status != USB_ST_NOT_PROC) ? 0 : -1;


fail:
td = (void *)hc32_to_cpu(qh->qh_overlay.qt_next);
while (td != (void *)QT_NEXT_TERMINATE) {
qh->qh_overlay.qt_next = td->qt_next;
ehci_free(td, sizeof(*td));
td = (void *)hc32_to_cpu(qh->qh_overlay.qt_next);
}
ehci_free(qh, sizeof(*qh));

return -1;
}


代码解析完毕，在实验当中发现，在启动异步传输之前，有一段时间延时便可以成功的发送数据包，
对于当前情况唯一的解释是：qh和qtd flush 在启动异步传输的时候没有及时的flush到ddr中。在flush data 中增加一定的延时问题则不再出现