hw/usb/hcd-uhci.c

   1 /*
   2  * USB UHCI controller emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * Copyright (c) 2008 Max Krasnyansky
   7  *     Magor rewrite of the UHCI data structures parser and frame processor
   8  *     Support for fully async operation and multiple outstanding transactions
   9  *
  10  * Permission is hereby granted, free of charge, to any person obtaining a copy
  11  * of this software and associated documentation files (the "Software"), to deal
  12  * in the Software without restriction, including without limitation the rights
  13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14  * copies of the Software, and to permit persons to whom the Software is
  15  * furnished to do so, subject to the following conditions:
  16  *
  17  * The above copyright notice and this permission notice shall be included in
  18  * all copies or substantial portions of the Software.
  19  *
  20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  26  * THE SOFTWARE.
  27  */
  28 #include "hw/hw.h"
  29 #include "hw/usb.h"
  30 #include "hw/pci.h"
  31 #include "qemu-timer.h"
  32 #include "iov.h"
  33 #include "dma.h"
  34 #include "trace.h"
  35
  36 //#define DEBUG
  37 //#define DEBUG_DUMP_DATA
  38
  39 #define UHCI_CMD_FGR      (1 << 4)
  40 #define UHCI_CMD_EGSM     (1 << 3)
  41 #define UHCI_CMD_GRESET   (1 << 2)
  42 #define UHCI_CMD_HCRESET  (1 << 1)
  43 #define UHCI_CMD_RS       (1 << 0)
  44
  45 #define UHCI_STS_HCHALTED (1 << 5)
  46 #define UHCI_STS_HCPERR   (1 << 4)
  47 #define UHCI_STS_HSERR    (1 << 3)
  48 #define UHCI_STS_RD       (1 << 2)
  49 #define UHCI_STS_USBERR   (1 << 1)
  50 #define UHCI_STS_USBINT   (1 << 0)
  51
  52 #define TD_CTRL_SPD     (1 << 29)
  53 #define TD_CTRL_ERROR_SHIFT  27
  54 #define TD_CTRL_IOS     (1 << 25)
  55 #define TD_CTRL_IOC     (1 << 24)
  56 #define TD_CTRL_ACTIVE  (1 << 23)
  57 #define TD_CTRL_STALL   (1 << 22)
  58 #define TD_CTRL_BABBLE  (1 << 20)
  59 #define TD_CTRL_NAK     (1 << 19)
  60 #define TD_CTRL_TIMEOUT (1 << 18)
  61
  62 #define UHCI_PORT_SUSPEND (1 << 12)
  63 #define UHCI_PORT_RESET (1 << 9)
  64 #define UHCI_PORT_LSDA  (1 << 8)
  65 #define UHCI_PORT_RD    (1 << 6)
  66 #define UHCI_PORT_ENC   (1 << 3)
  67 #define UHCI_PORT_EN    (1 << 2)
  68 #define UHCI_PORT_CSC   (1 << 1)
  69 #define UHCI_PORT_CCS   (1 << 0)
  70
  71 #define UHCI_PORT_READ_ONLY    (0x1bb)
  72 #define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
  73
  74 #define FRAME_TIMER_FREQ 1000
  75
  76 #define FRAME_MAX_LOOPS  256
  77
  78 #define NB_PORTS 2
  79
  80 enum {
  81     TD_RESULT_STOP_FRAME = 10,
  82     TD_RESULT_COMPLETE,
  83     TD_RESULT_NEXT_QH,
  84     TD_RESULT_ASYNC_START,
  85     TD_RESULT_ASYNC_CONT,
  86 };
  87
  88 typedef struct UHCIState UHCIState;
  89 typedef struct UHCIAsync UHCIAsync;
  90 typedef struct UHCIQueue UHCIQueue;
  91
  92 /*
  93  * Pending async transaction.
  94  * 'packet' must be the first field because completion
  95  * handler does "(UHCIAsync *) pkt" cast.
  96  */
  97
  98 struct UHCIAsync {
  99     USBPacket packet;
 100     QEMUSGList sgl;
 101     UHCIQueue *queue;
 102     QTAILQ_ENTRY(UHCIAsync) next;
 103     uint32_t  td;
 104     uint8_t   isoc;
 105     uint8_t   done;
 106 };
 107
 108 struct UHCIQueue {
 109     uint32_t  token;
 110     UHCIState *uhci;
 111     QTAILQ_ENTRY(UHCIQueue) next;
 112     QTAILQ_HEAD(, UHCIAsync) asyncs;
 113     int8_t    valid;
 114 };
 115
 116 typedef struct UHCIPort {
 117     USBPort port;
 118     uint16_t ctrl;
 119 } UHCIPort;
 120
 121 struct UHCIState {
 122     PCIDevice dev;
 123     MemoryRegion io_bar;
 124     USBBus bus; /* Note unused when we're a companion controller */
 125     uint16_t cmd; /* cmd register */
 126     uint16_t status;
 127     uint16_t intr; /* interrupt enable register */
 128     uint16_t frnum; /* frame number */
 129     uint32_t fl_base_addr; /* frame list base address */
 130     uint8_t sof_timing;
 131     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
 132     int64_t expire_time;
 133     QEMUTimer *frame_timer;
 134     QEMUBH *bh;
 135     uint32_t frame_bytes;
 136     UHCIPort ports[NB_PORTS];
 137
 138     /* Interrupts that should be raised at the end of the current frame.  */
 139     uint32_t pending_int_mask;
 140
 141     /* Active packets */
 142     QTAILQ_HEAD(, UHCIQueue) queues;
 143     uint8_t num_ports_vmstate;
 144
 145     /* Properties */
 146     char *masterbus;
 147     uint32_t firstport;
 148 };
 149
 150 typedef struct UHCI_TD {
 151     uint32_t link;
 152     uint32_t ctrl; /* see TD_CTRL_xxx */
 153     uint32_t token;
 154     uint32_t buffer;
 155 } UHCI_TD;
 156
 157 typedef struct UHCI_QH {
 158     uint32_t link;
 159     uint32_t el_link;
 160 } UHCI_QH;
 161
 162 static inline int32_t uhci_queue_token(UHCI_TD *td)
 163 {
 164     /* covers ep, dev, pid -> identifies the endpoint */
 165     return td->token & 0x7ffff;
 166 }
 167
 168 static UHCIQueue *uhci_queue_get(UHCIState *s, UHCI_TD *td)
 169 {
 170     uint32_t token = uhci_queue_token(td);
 171     UHCIQueue *queue;
 172
 173     QTAILQ_FOREACH(queue, &s->queues, next) {
 174         if (queue->token == token) {
 175             return queue;
 176         }
 177     }
 178
 179     queue = g_new0(UHCIQueue, 1);
 180     queue->uhci = s;
 181     queue->token = token;
 182     QTAILQ_INIT(&queue->asyncs);
 183     QTAILQ_INSERT_HEAD(&s->queues, queue, next);
 184     trace_usb_uhci_queue_add(queue->token);
 185     return queue;
 186 }
 187
 188 static void uhci_queue_free(UHCIQueue *queue)
 189 {
 190     UHCIState *s = queue->uhci;
 191
 192     trace_usb_uhci_queue_del(queue->token);
 193     QTAILQ_REMOVE(&s->queues, queue, next);
 194     g_free(queue);
 195 }
 196
 197 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t addr)
 198 {
 199     UHCIAsync *async = g_new0(UHCIAsync, 1);
 200
 201     async->queue = queue;
 202     async->td = addr;
 203     usb_packet_init(&async->packet);
 204     pci_dma_sglist_init(&async->sgl, &queue->uhci->dev, 1);
 205     trace_usb_uhci_packet_add(async->queue->token, async->td);
 206
 207     return async;
 208 }
 209
 210 static void uhci_async_free(UHCIAsync *async)
 211 {
 212     trace_usb_uhci_packet_del(async->queue->token, async->td);
 213     usb_packet_cleanup(&async->packet);
 214     qemu_sglist_destroy(&async->sgl);
 215     g_free(async);
 216 }
 217
 218 static void uhci_async_link(UHCIAsync *async)
 219 {
 220     UHCIQueue *queue = async->queue;
 221     QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
 222     trace_usb_uhci_packet_link_async(async->queue->token, async->td);
 223 }
 224
 225 static void uhci_async_unlink(UHCIAsync *async)
 226 {
 227     UHCIQueue *queue = async->queue;
 228     QTAILQ_REMOVE(&queue->asyncs, async, next);
 229     trace_usb_uhci_packet_unlink_async(async->queue->token, async->td);
 230 }
 231
 232 static void uhci_async_cancel(UHCIAsync *async)
 233 {
 234     trace_usb_uhci_packet_cancel(async->queue->token, async->td, async->done);
 235     if (!async->done)
 236         usb_cancel_packet(&async->packet);
 237     uhci_async_free(async);
 238 }
 239
 240 /*
 241  * Mark all outstanding async packets as invalid.
 242  * This is used for canceling them when TDs are removed by the HCD.
 243  */
 244 static void uhci_async_validate_begin(UHCIState *s)
 245 {
 246     UHCIQueue *queue;
 247
 248     QTAILQ_FOREACH(queue, &s->queues, next) {
 249         queue->valid--;
 250     }
 251 }
 252
 253 /*
 254  * Cancel async packets that are no longer valid
 255  */
 256 static void uhci_async_validate_end(UHCIState *s)
 257 {
 258     UHCIQueue *queue, *n;
 259     UHCIAsync *async;
 260
 261     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
 262         if (queue->valid > 0) {
 263             continue;
 264         }
 265         while (!QTAILQ_EMPTY(&queue->asyncs)) {
 266             async = QTAILQ_FIRST(&queue->asyncs);
 267             uhci_async_unlink(async);
 268             uhci_async_cancel(async);
 269         }
 270         uhci_queue_free(queue);
 271     }
 272 }
 273
 274 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
 275 {
 276     UHCIQueue *queue;
 277     UHCIAsync *curr, *n;
 278
 279     QTAILQ_FOREACH(queue, &s->queues, next) {
 280         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
 281             if (!usb_packet_is_inflight(&curr->packet) ||
 282                 curr->packet.ep->dev != dev) {
 283                 continue;
 284             }
 285             uhci_async_unlink(curr);
 286             uhci_async_cancel(curr);
 287         }
 288     }
 289 }
 290
 291 static void uhci_async_cancel_all(UHCIState *s)
 292 {
 293     UHCIQueue *queue;
 294     UHCIAsync *curr, *n;
 295
 296     QTAILQ_FOREACH(queue, &s->queues, next) {
 297         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
 298             uhci_async_unlink(curr);
 299             uhci_async_cancel(curr);
 300         }
 301         uhci_queue_free(queue);
 302     }
 303 }
 304
 305 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, UHCI_TD *td)
 306 {
 307     uint32_t token = uhci_queue_token(td);
 308     UHCIQueue *queue;
 309     UHCIAsync *async;
 310
 311     QTAILQ_FOREACH(queue, &s->queues, next) {
 312         if (queue->token == token) {
 313             break;
 314         }
 315     }
 316     if (queue == NULL) {
 317         return NULL;
 318     }
 319
 320     QTAILQ_FOREACH(async, &queue->asyncs, next) {
 321         if (async->td == addr) {
 322             return async;
 323         }
 324     }
 325
 326     return NULL;
 327 }
 328
 329 static void uhci_update_irq(UHCIState *s)
 330 {
 331     int level;
 332     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
 333         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
 334         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
 335         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
 336         (s->status & UHCI_STS_HSERR) ||
 337         (s->status & UHCI_STS_HCPERR)) {
 338         level = 1;
 339     } else {
 340         level = 0;
 341     }
 342     qemu_set_irq(s->dev.irq[3], level);
 343 }
 344
 345 static void uhci_reset(void *opaque)
 346 {
 347     UHCIState *s = opaque;
 348     uint8_t *pci_conf;
 349     int i;
 350     UHCIPort *port;
 351
 352     trace_usb_uhci_reset();
 353
 354     pci_conf = s->dev.config;
 355
 356     pci_conf[0x6a] = 0x01; /* usb clock */
 357     pci_conf[0x6b] = 0x00;
 358     s->cmd = 0;
 359     s->status = 0;
 360     s->status2 = 0;
 361     s->intr = 0;
 362     s->fl_base_addr = 0;
 363     s->sof_timing = 64;
 364
 365     for(i = 0; i < NB_PORTS; i++) {
 366         port = &s->ports[i];
 367         port->ctrl = 0x0080;
 368         if (port->port.dev && port->port.dev->attached) {
 369             usb_port_reset(&port->port);
 370         }
 371     }
 372
 373     uhci_async_cancel_all(s);
 374     qemu_bh_cancel(s->bh);
 375     uhci_update_irq(s);
 376 }
 377
 378 static void uhci_pre_save(void *opaque)
 379 {
 380     UHCIState *s = opaque;
 381
 382     uhci_async_cancel_all(s);
 383 }
 384
 385 static const VMStateDescription vmstate_uhci_port = {
 386     .name = "uhci port",
 387     .version_id = 1,
 388     .minimum_version_id = 1,
 389     .minimum_version_id_old = 1,
 390     .fields      = (VMStateField []) {
 391         VMSTATE_UINT16(ctrl, UHCIPort),
 392         VMSTATE_END_OF_LIST()
 393     }
 394 };
 395
 396 static const VMStateDescription vmstate_uhci = {
 397     .name = "uhci",
 398     .version_id = 2,
 399     .minimum_version_id = 1,
 400     .minimum_version_id_old = 1,
 401     .pre_save = uhci_pre_save,
 402     .fields      = (VMStateField []) {
 403         VMSTATE_PCI_DEVICE(dev, UHCIState),
 404         VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
 405         VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
 406                              vmstate_uhci_port, UHCIPort),
 407         VMSTATE_UINT16(cmd, UHCIState),
 408         VMSTATE_UINT16(status, UHCIState),
 409         VMSTATE_UINT16(intr, UHCIState),
 410         VMSTATE_UINT16(frnum, UHCIState),
 411         VMSTATE_UINT32(fl_base_addr, UHCIState),
 412         VMSTATE_UINT8(sof_timing, UHCIState),
 413         VMSTATE_UINT8(status2, UHCIState),
 414         VMSTATE_TIMER(frame_timer, UHCIState),
 415         VMSTATE_INT64_V(expire_time, UHCIState, 2),
 416         VMSTATE_END_OF_LIST()
 417     }
 418 };
 419
 420 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 421 {
 422     UHCIState *s = opaque;
 423
 424     addr &= 0x1f;
 425     switch(addr) {
 426     case 0x0c:
 427         s->sof_timing = val;
 428         break;
 429     }
 430 }
 431
 432 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
 433 {
 434     UHCIState *s = opaque;
 435     uint32_t val;
 436
 437     addr &= 0x1f;
 438     switch(addr) {
 439     case 0x0c:
 440         val = s->sof_timing;
 441         break;
 442     default:
 443         val = 0xff;
 444         break;
 445     }
 446     return val;
 447 }
 448
 449 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 450 {
 451     UHCIState *s = opaque;
 452
 453     addr &= 0x1f;
 454     trace_usb_uhci_mmio_writew(addr, val);
 455
 456     switch(addr) {
 457     case 0x00:
 458         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
 459             /* start frame processing */
 460             trace_usb_uhci_schedule_start();
 461             s->expire_time = qemu_get_clock_ns(vm_clock) +
 462                 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
 463             qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
 464             s->status &= ~UHCI_STS_HCHALTED;
 465         } else if (!(val & UHCI_CMD_RS)) {
 466             s->status |= UHCI_STS_HCHALTED;
 467         }
 468         if (val & UHCI_CMD_GRESET) {
 469             UHCIPort *port;
 470             int i;
 471
 472             /* send reset on the USB bus */
 473             for(i = 0; i < NB_PORTS; i++) {
 474                 port = &s->ports[i];
 475                 usb_device_reset(port->port.dev);
 476             }
 477             uhci_reset(s);
 478             return;
 479         }
 480         if (val & UHCI_CMD_HCRESET) {
 481             uhci_reset(s);
 482             return;
 483         }
 484         s->cmd = val;
 485         break;
 486     case 0x02:
 487         s->status &= ~val;
 488         /* XXX: the chip spec is not coherent, so we add a hidden
 489            register to distinguish between IOC and SPD */
 490         if (val & UHCI_STS_USBINT)
 491             s->status2 = 0;
 492         uhci_update_irq(s);
 493         break;
 494     case 0x04:
 495         s->intr = val;
 496         uhci_update_irq(s);
 497         break;
 498     case 0x06:
 499         if (s->status & UHCI_STS_HCHALTED)
 500             s->frnum = val & 0x7ff;
 501         break;
 502     case 0x10 ... 0x1f:
 503         {
 504             UHCIPort *port;
 505             USBDevice *dev;
 506             int n;
 507
 508             n = (addr >> 1) & 7;
 509             if (n >= NB_PORTS)
 510                 return;
 511             port = &s->ports[n];
 512             dev = port->port.dev;
 513             if (dev && dev->attached) {
 514                 /* port reset */
 515                 if ( (val & UHCI_PORT_RESET) &&
 516                      !(port->ctrl & UHCI_PORT_RESET) ) {
 517                     usb_device_reset(dev);
 518                 }
 519             }
 520             port->ctrl &= UHCI_PORT_READ_ONLY;
 521             port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
 522             /* some bits are reset when a '1' is written to them */
 523             port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
 524         }
 525         break;
 526     }
 527 }
 528
 529 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
 530 {
 531     UHCIState *s = opaque;
 532     uint32_t val;
 533
 534     addr &= 0x1f;
 535     switch(addr) {
 536     case 0x00:
 537         val = s->cmd;
 538         break;
 539     case 0x02:
 540         val = s->status;
 541         break;
 542     case 0x04:
 543         val = s->intr;
 544         break;
 545     case 0x06:
 546         val = s->frnum;
 547         break;
 548     case 0x10 ... 0x1f:
 549         {
 550             UHCIPort *port;
 551             int n;
 552             n = (addr >> 1) & 7;
 553             if (n >= NB_PORTS)
 554                 goto read_default;
 555             port = &s->ports[n];
 556             val = port->ctrl;
 557         }
 558         break;
 559     default:
 560     read_default:
 561         val = 0xff7f; /* disabled port */
 562         break;
 563     }
 564
 565     trace_usb_uhci_mmio_readw(addr, val);
 566
 567     return val;
 568 }
 569
 570 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 571 {
 572     UHCIState *s = opaque;
 573
 574     addr &= 0x1f;
 575     trace_usb_uhci_mmio_writel(addr, val);
 576
 577     switch(addr) {
 578     case 0x08:
 579         s->fl_base_addr = val & ~0xfff;
 580         break;
 581     }
 582 }
 583
 584 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
 585 {
 586     UHCIState *s = opaque;
 587     uint32_t val;
 588
 589     addr &= 0x1f;
 590     switch(addr) {
 591     case 0x08:
 592         val = s->fl_base_addr;
 593         break;
 594     default:
 595         val = 0xffffffff;
 596         break;
 597     }
 598     trace_usb_uhci_mmio_readl(addr, val);
 599     return val;
 600 }
 601
 602 /* signal resume if controller suspended */
 603 static void uhci_resume (void *opaque)
 604 {
 605     UHCIState *s = (UHCIState *)opaque;
 606
 607     if (!s)
 608         return;
 609
 610     if (s->cmd & UHCI_CMD_EGSM) {
 611         s->cmd |= UHCI_CMD_FGR;
 612         s->status |= UHCI_STS_RD;
 613         uhci_update_irq(s);
 614     }
 615 }
 616
 617 static void uhci_attach(USBPort *port1)
 618 {
 619     UHCIState *s = port1->opaque;
 620     UHCIPort *port = &s->ports[port1->index];
 621
 622     /* set connect status */
 623     port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
 624
 625     /* update speed */
 626     if (port->port.dev->speed == USB_SPEED_LOW) {
 627         port->ctrl |= UHCI_PORT_LSDA;
 628     } else {
 629         port->ctrl &= ~UHCI_PORT_LSDA;
 630     }
 631
 632     uhci_resume(s);
 633 }
 634
 635 static void uhci_detach(USBPort *port1)
 636 {
 637     UHCIState *s = port1->opaque;
 638     UHCIPort *port = &s->ports[port1->index];
 639
 640     uhci_async_cancel_device(s, port1->dev);
 641
 642     /* set connect status */
 643     if (port->ctrl & UHCI_PORT_CCS) {
 644         port->ctrl &= ~UHCI_PORT_CCS;
 645         port->ctrl |= UHCI_PORT_CSC;
 646     }
 647     /* disable port */
 648     if (port->ctrl & UHCI_PORT_EN) {
 649         port->ctrl &= ~UHCI_PORT_EN;
 650         port->ctrl |= UHCI_PORT_ENC;
 651     }
 652
 653     uhci_resume(s);
 654 }
 655
 656 static void uhci_child_detach(USBPort *port1, USBDevice *child)
 657 {
 658     UHCIState *s = port1->opaque;
 659
 660     uhci_async_cancel_device(s, child);
 661 }
 662
 663 static void uhci_wakeup(USBPort *port1)
 664 {
 665     UHCIState *s = port1->opaque;
 666     UHCIPort *port = &s->ports[port1->index];
 667
 668     if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
 669         port->ctrl |= UHCI_PORT_RD;
 670         uhci_resume(s);
 671     }
 672 }
 673
 674 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
 675 {
 676     USBDevice *dev;
 677     int i;
 678
 679     for (i = 0; i < NB_PORTS; i++) {
 680         UHCIPort *port = &s->ports[i];
 681         if (!(port->ctrl & UHCI_PORT_EN)) {
 682             continue;
 683         }
 684         dev = usb_find_device(&port->port, addr);
 685         if (dev != NULL) {
 686             return dev;
 687         }
 688     }
 689     return NULL;
 690 }
 691
 692 static void uhci_async_complete(USBPort *port, USBPacket *packet);
 693 static void uhci_process_frame(UHCIState *s);
 694
 695 /* return -1 if fatal error (frame must be stopped)
 696           0 if TD successful
 697           1 if TD unsuccessful or inactive
 698 */
 699 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
 700 {
 701     int len = 0, max_len, err, ret;
 702     uint8_t pid;
 703
 704     max_len = ((td->token >> 21) + 1) & 0x7ff;
 705     pid = td->token & 0xff;
 706
 707     ret = async->packet.result;
 708
 709     if (td->ctrl & TD_CTRL_IOS)
 710         td->ctrl &= ~TD_CTRL_ACTIVE;
 711
 712     if (ret < 0)
 713         goto out;
 714
 715     len = async->packet.result;
 716     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
 717
 718     /* The NAK bit may have been set by a previous frame, so clear it
 719        here.  The docs are somewhat unclear, but win2k relies on this
 720        behavior.  */
 721     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
 722     if (td->ctrl & TD_CTRL_IOC)
 723         *int_mask |= 0x01;
 724
 725     if (pid == USB_TOKEN_IN) {
 726         if (len > max_len) {
 727             ret = USB_RET_BABBLE;
 728             goto out;
 729         }
 730
 731         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
 732             *int_mask |= 0x02;
 733             /* short packet: do not update QH */
 734             trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
 735                                                     async->td);
 736             return TD_RESULT_NEXT_QH;
 737         }
 738     }
 739
 740     /* success */
 741     trace_usb_uhci_packet_complete_success(async->queue->token, async->td);
 742     return TD_RESULT_COMPLETE;
 743
 744 out:
 745     switch(ret) {
 746     case USB_RET_STALL:
 747         td->ctrl |= TD_CTRL_STALL;
 748         td->ctrl &= ~TD_CTRL_ACTIVE;
 749         s->status |= UHCI_STS_USBERR;
 750         if (td->ctrl & TD_CTRL_IOC) {
 751             *int_mask |= 0x01;
 752         }
 753         uhci_update_irq(s);
 754         trace_usb_uhci_packet_complete_stall(async->queue->token, async->td);
 755         return TD_RESULT_NEXT_QH;
 756
 757     case USB_RET_BABBLE:
 758         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
 759         td->ctrl &= ~TD_CTRL_ACTIVE;
 760         s->status |= UHCI_STS_USBERR;
 761         if (td->ctrl & TD_CTRL_IOC) {
 762             *int_mask |= 0x01;
 763         }
 764         uhci_update_irq(s);
 765         /* frame interrupted */
 766         trace_usb_uhci_packet_complete_babble(async->queue->token, async->td);
 767         return TD_RESULT_STOP_FRAME;
 768
 769     case USB_RET_NAK:
 770         td->ctrl |= TD_CTRL_NAK;
 771         if (pid == USB_TOKEN_SETUP)
 772             break;
 773         return TD_RESULT_NEXT_QH;
 774
 775     case USB_RET_IOERROR:
 776     case USB_RET_NODEV:
 777     default:
 778         break;
 779     }
 780
 781     /* Retry the TD if error count is not zero */
 782
 783     td->ctrl |= TD_CTRL_TIMEOUT;
 784     err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
 785     if (err != 0) {
 786         err--;
 787         if (err == 0) {
 788             td->ctrl &= ~TD_CTRL_ACTIVE;
 789             s->status |= UHCI_STS_USBERR;
 790             if (td->ctrl & TD_CTRL_IOC)
 791                 *int_mask |= 0x01;
 792             uhci_update_irq(s);
 793             trace_usb_uhci_packet_complete_error(async->queue->token,
 794                                                  async->td);
 795         }
 796     }
 797     td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
 798         (err << TD_CTRL_ERROR_SHIFT);
 799     return TD_RESULT_NEXT_QH;
 800 }
 801
 802 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td,
 803                           uint32_t *int_mask, bool queuing)
 804 {
 805     UHCIAsync *async;
 806     int len = 0, max_len;
 807     uint8_t pid;
 808     USBDevice *dev;
 809     USBEndpoint *ep;
 810
 811     /* Is active ? */
 812     if (!(td->ctrl & TD_CTRL_ACTIVE))
 813         return TD_RESULT_NEXT_QH;
 814
 815     async = uhci_async_find_td(s, addr, td);
 816     if (async) {
 817         /* Already submitted */
 818         async->queue->valid = 32;
 819
 820         if (!async->done)
 821             return TD_RESULT_ASYNC_CONT;
 822         if (queuing) {
 823             /* we are busy filling the queue, we are not prepared
 824                to consume completed packages then, just leave them
 825                in async state */
 826             return TD_RESULT_ASYNC_CONT;
 827         }
 828
 829         uhci_async_unlink(async);
 830         goto done;
 831     }
 832
 833     /* Allocate new packet */
 834     async = uhci_async_alloc(uhci_queue_get(s, td), addr);
 835
 836     /* valid needs to be large enough to handle 10 frame delay
 837      * for initial isochronous requests
 838      */
 839     async->queue->valid = 32;
 840     async->isoc  = td->ctrl & TD_CTRL_IOS;
 841
 842     max_len = ((td->token >> 21) + 1) & 0x7ff;
 843     pid = td->token & 0xff;
 844
 845     dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
 846     ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
 847     usb_packet_setup(&async->packet, pid, ep);
 848     qemu_sglist_add(&async->sgl, td->buffer, max_len);
 849     usb_packet_map(&async->packet, &async->sgl);
 850
 851     switch(pid) {
 852     case USB_TOKEN_OUT:
 853     case USB_TOKEN_SETUP:
 854         len = usb_handle_packet(dev, &async->packet);
 855         if (len >= 0)
 856             len = max_len;
 857         break;
 858
 859     case USB_TOKEN_IN:
 860         len = usb_handle_packet(dev, &async->packet);
 861         break;
 862
 863     default:
 864         /* invalid pid : frame interrupted */
 865         uhci_async_free(async);
 866         s->status |= UHCI_STS_HCPERR;
 867         uhci_update_irq(s);
 868         return TD_RESULT_STOP_FRAME;
 869     }
 870
 871     if (len == USB_RET_ASYNC) {
 872         uhci_async_link(async);
 873         return TD_RESULT_ASYNC_START;
 874     }
 875
 876     async->packet.result = len;
 877
 878 done:
 879     len = uhci_complete_td(s, td, async, int_mask);
 880     usb_packet_unmap(&async->packet);
 881     uhci_async_free(async);
 882     return len;
 883 }
 884
 885 static void uhci_async_complete(USBPort *port, USBPacket *packet)
 886 {
 887     UHCIAsync *async = container_of(packet, UHCIAsync, packet);
 888     UHCIState *s = async->queue->uhci;
 889
 890     if (async->isoc) {
 891         UHCI_TD td;
 892         uint32_t link = async->td;
 893         uint32_t int_mask = 0, val;
 894
 895         pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
 896         le32_to_cpus(&td.link);
 897         le32_to_cpus(&td.ctrl);
 898         le32_to_cpus(&td.token);
 899         le32_to_cpus(&td.buffer);
 900
 901         uhci_async_unlink(async);
 902         uhci_complete_td(s, &td, async, &int_mask);
 903         s->pending_int_mask |= int_mask;
 904
 905         /* update the status bits of the TD */
 906         val = cpu_to_le32(td.ctrl);
 907         pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
 908         uhci_async_free(async);
 909     } else {
 910         async->done = 1;
 911         if (s->frame_bytes < 1280) {
 912             qemu_bh_schedule(s->bh);
 913         }
 914     }
 915 }
 916
 917 static int is_valid(uint32_t link)
 918 {
 919     return (link & 1) == 0;
 920 }
 921
 922 static int is_qh(uint32_t link)
 923 {
 924     return (link & 2) != 0;
 925 }
 926
 927 static int depth_first(uint32_t link)
 928 {
 929     return (link & 4) != 0;
 930 }
 931
 932 /* QH DB used for detecting QH loops */
 933 #define UHCI_MAX_QUEUES 128
 934 typedef struct {
 935     uint32_t addr[UHCI_MAX_QUEUES];
 936     int      count;
 937 } QhDb;
 938
 939 static void qhdb_reset(QhDb *db)
 940 {
 941     db->count = 0;
 942 }
 943
 944 /* Add QH to DB. Returns 1 if already present or DB is full. */
 945 static int qhdb_insert(QhDb *db, uint32_t addr)
 946 {
 947     int i;
 948     for (i = 0; i < db->count; i++)
 949         if (db->addr[i] == addr)
 950             return 1;
 951
 952     if (db->count >= UHCI_MAX_QUEUES)
 953         return 1;
 954
 955     db->addr[db->count++] = addr;
 956     return 0;
 957 }
 958
 959 static void uhci_fill_queue(UHCIState *s, UHCI_TD *td)
 960 {
 961     uint32_t int_mask = 0;
 962     uint32_t plink = td->link;
 963     uint32_t token = uhci_queue_token(td);
 964     UHCI_TD ptd;
 965     int ret;
 966
 967     while (is_valid(plink)) {
 968         pci_dma_read(&s->dev, plink & ~0xf, &ptd, sizeof(ptd));
 969         le32_to_cpus(&ptd.link);
 970         le32_to_cpus(&ptd.ctrl);
 971         le32_to_cpus(&ptd.token);
 972         le32_to_cpus(&ptd.buffer);
 973         if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
 974             break;
 975         }
 976         if (uhci_queue_token(&ptd) != token) {
 977             break;
 978         }
 979         trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
 980         ret = uhci_handle_td(s, plink, &ptd, &int_mask, true);
 981         if (ret == TD_RESULT_ASYNC_CONT) {
 982             break;
 983         }
 984         assert(ret == TD_RESULT_ASYNC_START);
 985         assert(int_mask == 0);
 986         plink = ptd.link;
 987     }
 988 }
 989
 990 static void uhci_process_frame(UHCIState *s)
 991 {
 992     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
 993     uint32_t curr_qh, td_count = 0;
 994     int cnt, ret;
 995     UHCI_TD td;
 996     UHCI_QH qh;
 997     QhDb qhdb;
 998
 999     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
1000
1001     pci_dma_read(&s->dev, frame_addr, &link, 4);
1002     le32_to_cpus(&link);
1003
1004     int_mask = 0;
1005     curr_qh  = 0;
1006
1007     qhdb_reset(&qhdb);
1008
1009     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1010         if (s->frame_bytes >= 1280) {
1011             /* We've reached the usb 1.1 bandwidth, which is
1012                1280 bytes/frame, stop processing */
1013             trace_usb_uhci_frame_stop_bandwidth();
1014             break;
1015         }
1016         if (is_qh(link)) {
1017             /* QH */
1018             trace_usb_uhci_qh_load(link & ~0xf);
1019
1020             if (qhdb_insert(&qhdb, link)) {
1021                 /*
1022                  * We're going in circles. Which is not a bug because
1023                  * HCD is allowed to do that as part of the BW management.
1024                  *
1025                  * Stop processing here if no transaction has been done
1026                  * since we've been here last time.
1027                  */
1028                 if (td_count == 0) {
1029                     trace_usb_uhci_frame_loop_stop_idle();
1030                     break;
1031                 } else {
1032                     trace_usb_uhci_frame_loop_continue();
1033                     td_count = 0;
1034                     qhdb_reset(&qhdb);
1035                     qhdb_insert(&qhdb, link);
1036                 }
1037             }
1038
1039             pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1040             le32_to_cpus(&qh.link);
1041             le32_to_cpus(&qh.el_link);
1042
1043             if (!is_valid(qh.el_link)) {
1044                 /* QH w/o elements */
1045                 curr_qh = 0;
1046                 link = qh.link;
1047             } else {
1048                 /* QH with elements */
1049                 curr_qh = link;
1050                 link = qh.el_link;
1051             }
1052             continue;
1053         }
1054
1055         /* TD */
1056         pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
1057         le32_to_cpus(&td.link);
1058         le32_to_cpus(&td.ctrl);
1059         le32_to_cpus(&td.token);
1060         le32_to_cpus(&td.buffer);
1061         trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1062
1063         old_td_ctrl = td.ctrl;
1064         ret = uhci_handle_td(s, link, &td, &int_mask, false);
1065         if (old_td_ctrl != td.ctrl) {
1066             /* update the status bits of the TD */
1067             val = cpu_to_le32(td.ctrl);
1068             pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1069         }
1070
1071         switch (ret) {
1072         case TD_RESULT_STOP_FRAME: /* interrupted frame */
1073             goto out;
1074
1075         case TD_RESULT_NEXT_QH:
1076         case TD_RESULT_ASYNC_CONT:
1077             trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1078             link = curr_qh ? qh.link : td.link;
1079             continue;
1080
1081         case TD_RESULT_ASYNC_START:
1082             trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1083             if (is_valid(td.link)) {
1084                 uhci_fill_queue(s, &td);
1085             }
1086             link = curr_qh ? qh.link : td.link;
1087             continue;
1088
1089         case TD_RESULT_COMPLETE:
1090             trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1091             link = td.link;
1092             td_count++;
1093             s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1094
1095             if (curr_qh) {
1096                 /* update QH element link */
1097                 qh.el_link = link;
1098                 val = cpu_to_le32(qh.el_link);
1099                 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1100
1101                 if (!depth_first(link)) {
1102                     /* done with this QH */
1103                     curr_qh = 0;
1104                     link    = qh.link;
1105                 }
1106             }
1107             break;
1108
1109         default:
1110             assert(!"unknown return code");
1111         }
1112
1113         /* go to the next entry */
1114     }
1115
1116 out:
1117     s->pending_int_mask |= int_mask;
1118 }
1119
1120 static void uhci_bh(void *opaque)
1121 {
1122     UHCIState *s = opaque;
1123     uhci_process_frame(s);
1124 }
1125
1126 static void uhci_frame_timer(void *opaque)
1127 {
1128     UHCIState *s = opaque;
1129
1130     /* prepare the timer for the next frame */
1131     s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1132     s->frame_bytes = 0;
1133     qemu_bh_cancel(s->bh);
1134
1135     if (!(s->cmd & UHCI_CMD_RS)) {
1136         /* Full stop */
1137         trace_usb_uhci_schedule_stop();
1138         qemu_del_timer(s->frame_timer);
1139         uhci_async_cancel_all(s);
1140         /* set hchalted bit in status - UHCI11D 2.1.2 */
1141         s->status |= UHCI_STS_HCHALTED;
1142         return;
1143     }
1144
1145     /* Complete the previous frame */
1146     if (s->pending_int_mask) {
1147         s->status2 |= s->pending_int_mask;
1148         s->status  |= UHCI_STS_USBINT;
1149         uhci_update_irq(s);
1150     }
1151     s->pending_int_mask = 0;
1152
1153     /* Start new frame */
1154     s->frnum = (s->frnum + 1) & 0x7ff;
1155
1156     trace_usb_uhci_frame_start(s->frnum);
1157
1158     uhci_async_validate_begin(s);
1159
1160     uhci_process_frame(s);
1161
1162     uhci_async_validate_end(s);
1163
1164     qemu_mod_timer(s->frame_timer, s->expire_time);
1165 }
1166
1167 static const MemoryRegionPortio uhci_portio[] = {
1168     { 0, 32, 2, .write = uhci_ioport_writew, },
1169     { 0, 32, 2, .read = uhci_ioport_readw, },
1170     { 0, 32, 4, .write = uhci_ioport_writel, },
1171     { 0, 32, 4, .read = uhci_ioport_readl, },
1172     { 0, 32, 1, .write = uhci_ioport_writeb, },
1173     { 0, 32, 1, .read = uhci_ioport_readb, },
1174     PORTIO_END_OF_LIST()
1175 };
1176
1177 static const MemoryRegionOps uhci_ioport_ops = {
1178     .old_portio = uhci_portio,
1179 };
1180
1181 static USBPortOps uhci_port_ops = {
1182     .attach = uhci_attach,
1183     .detach = uhci_detach,
1184     .child_detach = uhci_child_detach,
1185     .wakeup = uhci_wakeup,
1186     .complete = uhci_async_complete,
1187 };
1188
1189 static USBBusOps uhci_bus_ops = {
1190 };
1191
1192 static int usb_uhci_common_initfn(PCIDevice *dev)
1193 {
1194     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1195     uint8_t *pci_conf = s->dev.config;
1196     int i;
1197
1198     pci_conf[PCI_CLASS_PROG] = 0x00;
1199     /* TODO: reset value should be 0. */
1200     pci_conf[PCI_INTERRUPT_PIN] = 4; /* interrupt pin D */
1201     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1202
1203     if (s->masterbus) {
1204         USBPort *ports[NB_PORTS];
1205         for(i = 0; i < NB_PORTS; i++) {
1206             ports[i] = &s->ports[i].port;
1207         }
1208         if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1209                 s->firstport, s, &uhci_port_ops,
1210                 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1211             return -1;
1212         }
1213     } else {
1214         usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1215         for (i = 0; i < NB_PORTS; i++) {
1216             usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1217                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1218         }
1219     }
1220     s->bh = qemu_bh_new(uhci_bh, s);
1221     s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1222     s->num_ports_vmstate = NB_PORTS;
1223     QTAILQ_INIT(&s->queues);
1224
1225     qemu_register_reset(uhci_reset, s);
1226
1227     memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1228     /* Use region 4 for consistency with real hardware.  BSD guests seem
1229        to rely on this.  */
1230     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1231
1232     return 0;
1233 }
1234
1235 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1236 {
1237     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1238     uint8_t *pci_conf = s->dev.config;
1239
1240     /* USB misc control 1/2 */
1241     pci_set_long(pci_conf + 0x40,0x00001000);
1242     /* PM capability */
1243     pci_set_long(pci_conf + 0x80,0x00020001);
1244     /* USB legacy support  */
1245     pci_set_long(pci_conf + 0xc0,0x00002000);
1246
1247     return usb_uhci_common_initfn(dev);
1248 }
1249
1250 static int usb_uhci_exit(PCIDevice *dev)
1251 {
1252     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1253
1254     memory_region_destroy(&s->io_bar);
1255     return 0;
1256 }
1257
1258 static Property uhci_properties[] = {
1259     DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1260     DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1261     DEFINE_PROP_END_OF_LIST(),
1262 };
1263
1264 static void piix3_uhci_class_init(ObjectClass *klass, void *data)
1265 {
1266     DeviceClass *dc = DEVICE_CLASS(klass);
1267     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1268
1269     k->init = usb_uhci_common_initfn;
1270     k->exit = usb_uhci_exit;
1271     k->vendor_id = PCI_VENDOR_ID_INTEL;
1272     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_2;
1273     k->revision = 0x01;
1274     k->class_id = PCI_CLASS_SERIAL_USB;
1275     dc->vmsd = &vmstate_uhci;
1276     dc->props = uhci_properties;
1277 }
1278
1279 static TypeInfo piix3_uhci_info = {
1280     .name          = "piix3-usb-uhci",
1281     .parent        = TYPE_PCI_DEVICE,
1282     .instance_size = sizeof(UHCIState),
1283     .class_init    = piix3_uhci_class_init,
1284 };
1285
1286 static void piix4_uhci_class_init(ObjectClass *klass, void *data)
1287 {
1288     DeviceClass *dc = DEVICE_CLASS(klass);
1289     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1290
1291     k->init = usb_uhci_common_initfn;
1292     k->exit = usb_uhci_exit;
1293     k->vendor_id = PCI_VENDOR_ID_INTEL;
1294     k->device_id = PCI_DEVICE_ID_INTEL_82371AB_2;
1295     k->revision = 0x01;
1296     k->class_id = PCI_CLASS_SERIAL_USB;
1297     dc->vmsd = &vmstate_uhci;
1298     dc->props = uhci_properties;
1299 }
1300
1301 static TypeInfo piix4_uhci_info = {
1302     .name          = "piix4-usb-uhci",
1303     .parent        = TYPE_PCI_DEVICE,
1304     .instance_size = sizeof(UHCIState),
1305     .class_init    = piix4_uhci_class_init,
1306 };
1307
1308 static void vt82c686b_uhci_class_init(ObjectClass *klass, void *data)
1309 {
1310     DeviceClass *dc = DEVICE_CLASS(klass);
1311     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1312
1313     k->init = usb_uhci_vt82c686b_initfn;
1314     k->exit = usb_uhci_exit;
1315     k->vendor_id = PCI_VENDOR_ID_VIA;
1316     k->device_id = PCI_DEVICE_ID_VIA_UHCI;
1317     k->revision = 0x01;
1318     k->class_id = PCI_CLASS_SERIAL_USB;
1319     dc->vmsd = &vmstate_uhci;
1320     dc->props = uhci_properties;
1321 }
1322
1323 static TypeInfo vt82c686b_uhci_info = {
1324     .name          = "vt82c686b-usb-uhci",
1325     .parent        = TYPE_PCI_DEVICE,
1326     .instance_size = sizeof(UHCIState),
1327     .class_init    = vt82c686b_uhci_class_init,
1328 };
1329
1330 static void ich9_uhci1_class_init(ObjectClass *klass, void *data)
1331 {
1332     DeviceClass *dc = DEVICE_CLASS(klass);
1333     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1334
1335     k->init = usb_uhci_common_initfn;
1336     k->vendor_id = PCI_VENDOR_ID_INTEL;
1337     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1;
1338     k->revision = 0x03;
1339     k->class_id = PCI_CLASS_SERIAL_USB;
1340     dc->vmsd = &vmstate_uhci;
1341     dc->props = uhci_properties;
1342 }
1343
1344 static TypeInfo ich9_uhci1_info = {
1345     .name          = "ich9-usb-uhci1",
1346     .parent        = TYPE_PCI_DEVICE,
1347     .instance_size = sizeof(UHCIState),
1348     .class_init    = ich9_uhci1_class_init,
1349 };
1350
1351 static void ich9_uhci2_class_init(ObjectClass *klass, void *data)
1352 {
1353     DeviceClass *dc = DEVICE_CLASS(klass);
1354     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1355
1356     k->init = usb_uhci_common_initfn;
1357     k->vendor_id = PCI_VENDOR_ID_INTEL;
1358     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2;
1359     k->revision = 0x03;
1360     k->class_id = PCI_CLASS_SERIAL_USB;
1361     dc->vmsd = &vmstate_uhci;
1362     dc->props = uhci_properties;
1363 }
1364
1365 static TypeInfo ich9_uhci2_info = {
1366     .name          = "ich9-usb-uhci2",
1367     .parent        = TYPE_PCI_DEVICE,
1368     .instance_size = sizeof(UHCIState),
1369     .class_init    = ich9_uhci2_class_init,
1370 };
1371
1372 static void ich9_uhci3_class_init(ObjectClass *klass, void *data)
1373 {
1374     DeviceClass *dc = DEVICE_CLASS(klass);
1375     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1376
1377     k->init = usb_uhci_common_initfn;
1378     k->vendor_id = PCI_VENDOR_ID_INTEL;
1379     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3;
1380     k->revision = 0x03;
1381     k->class_id = PCI_CLASS_SERIAL_USB;
1382     dc->vmsd = &vmstate_uhci;
1383     dc->props = uhci_properties;
1384 }
1385
1386 static TypeInfo ich9_uhci3_info = {
1387     .name          = "ich9-usb-uhci3",
1388     .parent        = TYPE_PCI_DEVICE,
1389     .instance_size = sizeof(UHCIState),
1390     .class_init    = ich9_uhci3_class_init,
1391 };
1392
1393 static void uhci_register_types(void)
1394 {
1395     type_register_static(&piix3_uhci_info);
1396     type_register_static(&piix4_uhci_info);
1397     type_register_static(&vt82c686b_uhci_info);
1398     type_register_static(&ich9_uhci1_info);
1399     type_register_static(&ich9_uhci2_info);
1400     type_register_static(&ich9_uhci3_info);
1401 }
1402
1403 type_init(uhci_register_types)