hw/usb-uhci.c

   1 /*
   2  * USB UHCI controller emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * Copyright (c) 2008 Max Krasnyansky
   7  *     Magor rewrite of the UHCI data structures parser and frame processor
   8  *     Support for fully async operation and multiple outstanding transactions
   9  *
  10  * Permission is hereby granted, free of charge, to any person obtaining a copy
  11  * of this software and associated documentation files (the "Software"), to deal
  12  * in the Software without restriction, including without limitation the rights
  13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14  * copies of the Software, and to permit persons to whom the Software is
  15  * furnished to do so, subject to the following conditions:
  16  *
  17  * The above copyright notice and this permission notice shall be included in
  18  * all copies or substantial portions of the Software.
  19  *
  20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  26  * THE SOFTWARE.
  27  */
  28 #include "hw.h"
  29 #include "usb.h"
  30 #include "pci.h"
  31 #include "qemu-timer.h"
  32
  33 //#define DEBUG
  34 //#define DEBUG_DUMP_DATA
  35
  36 #define UHCI_CMD_FGR      (1 << 4)
  37 #define UHCI_CMD_EGSM     (1 << 3)
  38 #define UHCI_CMD_GRESET   (1 << 2)
  39 #define UHCI_CMD_HCRESET  (1 << 1)
  40 #define UHCI_CMD_RS       (1 << 0)
  41
  42 #define UHCI_STS_HCHALTED (1 << 5)
  43 #define UHCI_STS_HCPERR   (1 << 4)
  44 #define UHCI_STS_HSERR    (1 << 3)
  45 #define UHCI_STS_RD       (1 << 2)
  46 #define UHCI_STS_USBERR   (1 << 1)
  47 #define UHCI_STS_USBINT   (1 << 0)
  48
  49 #define TD_CTRL_SPD     (1 << 29)
  50 #define TD_CTRL_ERROR_SHIFT  27
  51 #define TD_CTRL_IOS     (1 << 25)
  52 #define TD_CTRL_IOC     (1 << 24)
  53 #define TD_CTRL_ACTIVE  (1 << 23)
  54 #define TD_CTRL_STALL   (1 << 22)
  55 #define TD_CTRL_BABBLE  (1 << 20)
  56 #define TD_CTRL_NAK     (1 << 19)
  57 #define TD_CTRL_TIMEOUT (1 << 18)
  58
  59 #define UHCI_PORT_RESET (1 << 9)
  60 #define UHCI_PORT_LSDA  (1 << 8)
  61 #define UHCI_PORT_ENC   (1 << 3)
  62 #define UHCI_PORT_EN    (1 << 2)
  63 #define UHCI_PORT_CSC   (1 << 1)
  64 #define UHCI_PORT_CCS   (1 << 0)
  65
  66 #define FRAME_TIMER_FREQ 1000
  67
  68 #define FRAME_MAX_LOOPS  100
  69
  70 #define NB_PORTS 2
  71
  72 #ifdef DEBUG
  73 #define dprintf printf
  74
  75 static const char *pid2str(int pid)
  76 {
  77     switch (pid) {
  78     case USB_TOKEN_SETUP: return "SETUP";
  79     case USB_TOKEN_IN:    return "IN";
  80     case USB_TOKEN_OUT:   return "OUT";
  81     }
  82     return "?";
  83 }
  84
  85 #else
  86 #define dprintf(...)
  87 #endif
  88
  89 #ifdef DEBUG_DUMP_DATA
  90 static void dump_data(const uint8_t *data, int len)
  91 {
  92     int i;
  93
  94     printf("uhci: data: ");
  95     for(i = 0; i < len; i++)
  96         printf(" %02x", data[i]);
  97     printf("\n");
  98 }
  99 #else
 100 static void dump_data(const uint8_t *data, int len) {}
 101 #endif
 102
 103 /*
 104  * Pending async transaction.
 105  * 'packet' must be the first field because completion
 106  * handler does "(UHCIAsync *) pkt" cast.
 107  */
 108 typedef struct UHCIAsync {
 109     USBPacket packet;
 110     struct UHCIAsync *next;
 111     uint32_t  td;
 112     uint32_t  token;
 113     int8_t    valid;
 114     uint8_t   done;
 115     uint8_t   buffer[2048];
 116 } UHCIAsync;
 117
 118 typedef struct UHCIPort {
 119     USBPort port;
 120     uint16_t ctrl;
 121 } UHCIPort;
 122
 123 typedef struct UHCIState {
 124     PCIDevice dev;
 125     USBBus *bus;
 126     uint16_t cmd; /* cmd register */
 127     uint16_t status;
 128     uint16_t intr; /* interrupt enable register */
 129     uint16_t frnum; /* frame number */
 130     uint32_t fl_base_addr; /* frame list base address */
 131     uint8_t sof_timing;
 132     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
 133     QEMUTimer *frame_timer;
 134     UHCIPort ports[NB_PORTS];
 135
 136     /* Interrupts that should be raised at the end of the current frame.  */
 137     uint32_t pending_int_mask;
 138
 139     /* Active packets */
 140     UHCIAsync *async_pending;
 141     UHCIAsync *async_pool;
 142 } UHCIState;
 143
 144 typedef struct UHCI_TD {
 145     uint32_t link;
 146     uint32_t ctrl; /* see TD_CTRL_xxx */
 147     uint32_t token;
 148     uint32_t buffer;
 149 } UHCI_TD;
 150
 151 typedef struct UHCI_QH {
 152     uint32_t link;
 153     uint32_t el_link;
 154 } UHCI_QH;
 155
 156 static UHCIAsync *uhci_async_alloc(UHCIState *s)
 157 {
 158     UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
 159
 160     memset(&async->packet, 0, sizeof(async->packet));
 161     async->valid = 0;
 162     async->td    = 0;
 163     async->token = 0;
 164     async->done  = 0;
 165     async->next  = NULL;
 166
 167     return async;
 168 }
 169
 170 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
 171 {
 172     qemu_free(async);
 173 }
 174
 175 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
 176 {
 177     async->next = s->async_pending;
 178     s->async_pending = async;
 179 }
 180
 181 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
 182 {
 183     UHCIAsync *curr = s->async_pending;
 184     UHCIAsync **prev = &s->async_pending;
 185
 186     while (curr) {
 187         if (curr == async) {
 188             *prev = curr->next;
 189             return;
 190         }
 191
 192         prev = &curr->next;
 193         curr = curr->next;
 194     }
 195 }
 196
 197 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
 198 {
 199     dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",
 200            async->td, async->token, async->done);
 201
 202     if (!async->done)
 203         usb_cancel_packet(&async->packet);
 204     uhci_async_free(s, async);
 205 }
 206
 207 /*
 208  * Mark all outstanding async packets as invalid.
 209  * This is used for canceling them when TDs are removed by the HCD.
 210  */
 211 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
 212 {
 213     UHCIAsync *async = s->async_pending;
 214
 215     while (async) {
 216         async->valid--;
 217         async = async->next;
 218     }
 219     return NULL;
 220 }
 221
 222 /*
 223  * Cancel async packets that are no longer valid
 224  */
 225 static void uhci_async_validate_end(UHCIState *s)
 226 {
 227     UHCIAsync *curr = s->async_pending;
 228     UHCIAsync **prev = &s->async_pending;
 229     UHCIAsync *next;
 230
 231     while (curr) {
 232         if (curr->valid > 0) {
 233             prev = &curr->next;
 234             curr = curr->next;
 235             continue;
 236         }
 237
 238         next = curr->next;
 239
 240         /* Unlink */
 241         *prev = next;
 242
 243         uhci_async_cancel(s, curr);
 244
 245         curr = next;
 246     }
 247 }
 248
 249 static void uhci_async_cancel_all(UHCIState *s)
 250 {
 251     UHCIAsync *curr = s->async_pending;
 252     UHCIAsync *next;
 253
 254     while (curr) {
 255         next = curr->next;
 256
 257         uhci_async_cancel(s, curr);
 258
 259         curr = next;
 260     }
 261
 262     s->async_pending = NULL;
 263 }
 264
 265 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
 266 {
 267     UHCIAsync *async = s->async_pending;
 268     UHCIAsync *match = NULL;
 269     int count = 0;
 270
 271     /*
 272      * We're looking for the best match here. ie both td addr and token.
 273      * Otherwise we return last good match. ie just token.
 274      * It's ok to match just token because it identifies the transaction
 275      * rather well, token includes: device addr, endpoint, size, etc.
 276      *
 277      * Also since we queue async transactions in reverse order by returning
 278      * last good match we restores the order.
 279      *
 280      * It's expected that we wont have a ton of outstanding transactions.
 281      * If we ever do we'd want to optimize this algorithm.
 282      */
 283
 284     while (async) {
 285         if (async->token == token) {
 286             /* Good match */
 287             match = async;
 288
 289             if (async->td == addr) {
 290                 /* Best match */
 291                 break;
 292             }
 293         }
 294
 295         async = async->next;
 296         count++;
 297     }
 298
 299     if (count > 64)
 300         fprintf(stderr, "uhci: warning lots of async transactions\n");
 301
 302     return match;
 303 }
 304
 305 static void uhci_attach(USBPort *port1, USBDevice *dev);
 306
 307 static void uhci_update_irq(UHCIState *s)
 308 {
 309     int level;
 310     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
 311         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
 312         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
 313         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
 314         (s->status & UHCI_STS_HSERR) ||
 315         (s->status & UHCI_STS_HCPERR)) {
 316         level = 1;
 317     } else {
 318         level = 0;
 319     }
 320     qemu_set_irq(s->dev.irq[3], level);
 321 }
 322
 323 static void uhci_reset(void *opaque)
 324 {
 325     UHCIState *s = opaque;
 326     uint8_t *pci_conf;
 327     int i;
 328     UHCIPort *port;
 329
 330     dprintf("uhci: full reset\n");
 331
 332     pci_conf = s->dev.config;
 333
 334     pci_conf[0x6a] = 0x01; /* usb clock */
 335     pci_conf[0x6b] = 0x00;
 336     s->cmd = 0;
 337     s->status = 0;
 338     s->status2 = 0;
 339     s->intr = 0;
 340     s->fl_base_addr = 0;
 341     s->sof_timing = 64;
 342
 343     for(i = 0; i < NB_PORTS; i++) {
 344         port = &s->ports[i];
 345         port->ctrl = 0x0080;
 346         if (port->port.dev)
 347             uhci_attach(&port->port, port->port.dev);
 348     }
 349
 350     uhci_async_cancel_all(s);
 351 }
 352
 353 static void uhci_save(QEMUFile *f, void *opaque)
 354 {
 355     UHCIState *s = opaque;
 356     uint8_t num_ports = NB_PORTS;
 357     int i;
 358
 359     uhci_async_cancel_all(s);
 360
 361     pci_device_save(&s->dev, f);
 362
 363     qemu_put_8s(f, &num_ports);
 364     for (i = 0; i < num_ports; ++i)
 365         qemu_put_be16s(f, &s->ports[i].ctrl);
 366     qemu_put_be16s(f, &s->cmd);
 367     qemu_put_be16s(f, &s->status);
 368     qemu_put_be16s(f, &s->intr);
 369     qemu_put_be16s(f, &s->frnum);
 370     qemu_put_be32s(f, &s->fl_base_addr);
 371     qemu_put_8s(f, &s->sof_timing);
 372     qemu_put_8s(f, &s->status2);
 373     qemu_put_timer(f, s->frame_timer);
 374 }
 375
 376 static int uhci_load(QEMUFile *f, void *opaque, int version_id)
 377 {
 378     UHCIState *s = opaque;
 379     uint8_t num_ports;
 380     int i, ret;
 381
 382     if (version_id > 1)
 383         return -EINVAL;
 384
 385     ret = pci_device_load(&s->dev, f);
 386     if (ret < 0)
 387         return ret;
 388
 389     qemu_get_8s(f, &num_ports);
 390     if (num_ports != NB_PORTS)
 391         return -EINVAL;
 392
 393     for (i = 0; i < num_ports; ++i)
 394         qemu_get_be16s(f, &s->ports[i].ctrl);
 395     qemu_get_be16s(f, &s->cmd);
 396     qemu_get_be16s(f, &s->status);
 397     qemu_get_be16s(f, &s->intr);
 398     qemu_get_be16s(f, &s->frnum);
 399     qemu_get_be32s(f, &s->fl_base_addr);
 400     qemu_get_8s(f, &s->sof_timing);
 401     qemu_get_8s(f, &s->status2);
 402     qemu_get_timer(f, s->frame_timer);
 403
 404     return 0;
 405 }
 406
 407 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 408 {
 409     UHCIState *s = opaque;
 410
 411     addr &= 0x1f;
 412     switch(addr) {
 413     case 0x0c:
 414         s->sof_timing = val;
 415         break;
 416     }
 417 }
 418
 419 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
 420 {
 421     UHCIState *s = opaque;
 422     uint32_t val;
 423
 424     addr &= 0x1f;
 425     switch(addr) {
 426     case 0x0c:
 427         val = s->sof_timing;
 428         break;
 429     default:
 430         val = 0xff;
 431         break;
 432     }
 433     return val;
 434 }
 435
 436 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 437 {
 438     UHCIState *s = opaque;
 439
 440     addr &= 0x1f;
 441     dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
 442
 443     switch(addr) {
 444     case 0x00:
 445         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
 446             /* start frame processing */
 447             qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
 448             s->status &= ~UHCI_STS_HCHALTED;
 449         } else if (!(val & UHCI_CMD_RS)) {
 450             s->status |= UHCI_STS_HCHALTED;
 451         }
 452         if (val & UHCI_CMD_GRESET) {
 453             UHCIPort *port;
 454             USBDevice *dev;
 455             int i;
 456
 457             /* send reset on the USB bus */
 458             for(i = 0; i < NB_PORTS; i++) {
 459                 port = &s->ports[i];
 460                 dev = port->port.dev;
 461                 if (dev) {
 462                     usb_send_msg(dev, USB_MSG_RESET);
 463                 }
 464             }
 465             uhci_reset(s);
 466             return;
 467         }
 468         if (val & UHCI_CMD_HCRESET) {
 469             uhci_reset(s);
 470             return;
 471         }
 472         s->cmd = val;
 473         break;
 474     case 0x02:
 475         s->status &= ~val;
 476         /* XXX: the chip spec is not coherent, so we add a hidden
 477            register to distinguish between IOC and SPD */
 478         if (val & UHCI_STS_USBINT)
 479             s->status2 = 0;
 480         uhci_update_irq(s);
 481         break;
 482     case 0x04:
 483         s->intr = val;
 484         uhci_update_irq(s);
 485         break;
 486     case 0x06:
 487         if (s->status & UHCI_STS_HCHALTED)
 488             s->frnum = val & 0x7ff;
 489         break;
 490     case 0x10 ... 0x1f:
 491         {
 492             UHCIPort *port;
 493             USBDevice *dev;
 494             int n;
 495
 496             n = (addr >> 1) & 7;
 497             if (n >= NB_PORTS)
 498                 return;
 499             port = &s->ports[n];
 500             dev = port->port.dev;
 501             if (dev) {
 502                 /* port reset */
 503                 if ( (val & UHCI_PORT_RESET) &&
 504                      !(port->ctrl & UHCI_PORT_RESET) ) {
 505                     usb_send_msg(dev, USB_MSG_RESET);
 506                 }
 507             }
 508             port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
 509             /* some bits are reset when a '1' is written to them */
 510             port->ctrl &= ~(val & 0x000a);
 511         }
 512         break;
 513     }
 514 }
 515
 516 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
 517 {
 518     UHCIState *s = opaque;
 519     uint32_t val;
 520
 521     addr &= 0x1f;
 522     switch(addr) {
 523     case 0x00:
 524         val = s->cmd;
 525         break;
 526     case 0x02:
 527         val = s->status;
 528         break;
 529     case 0x04:
 530         val = s->intr;
 531         break;
 532     case 0x06:
 533         val = s->frnum;
 534         break;
 535     case 0x10 ... 0x1f:
 536         {
 537             UHCIPort *port;
 538             int n;
 539             n = (addr >> 1) & 7;
 540             if (n >= NB_PORTS)
 541                 goto read_default;
 542             port = &s->ports[n];
 543             val = port->ctrl;
 544         }
 545         break;
 546     default:
 547     read_default:
 548         val = 0xff7f; /* disabled port */
 549         break;
 550     }
 551
 552     dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
 553
 554     return val;
 555 }
 556
 557 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 558 {
 559     UHCIState *s = opaque;
 560
 561     addr &= 0x1f;
 562     dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
 563
 564     switch(addr) {
 565     case 0x08:
 566         s->fl_base_addr = val & ~0xfff;
 567         break;
 568     }
 569 }
 570
 571 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
 572 {
 573     UHCIState *s = opaque;
 574     uint32_t val;
 575
 576     addr &= 0x1f;
 577     switch(addr) {
 578     case 0x08:
 579         val = s->fl_base_addr;
 580         break;
 581     default:
 582         val = 0xffffffff;
 583         break;
 584     }
 585     return val;
 586 }
 587
 588 /* signal resume if controller suspended */
 589 static void uhci_resume (void *opaque)
 590 {
 591     UHCIState *s = (UHCIState *)opaque;
 592
 593     if (!s)
 594         return;
 595
 596     if (s->cmd & UHCI_CMD_EGSM) {
 597         s->cmd |= UHCI_CMD_FGR;
 598         s->status |= UHCI_STS_RD;
 599         uhci_update_irq(s);
 600     }
 601 }
 602
 603 static void uhci_attach(USBPort *port1, USBDevice *dev)
 604 {
 605     UHCIState *s = port1->opaque;
 606     UHCIPort *port = &s->ports[port1->index];
 607
 608     if (dev) {
 609         if (port->port.dev) {
 610             usb_attach(port1, NULL);
 611         }
 612         /* set connect status */
 613         port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
 614
 615         /* update speed */
 616         if (dev->speed == USB_SPEED_LOW)
 617             port->ctrl |= UHCI_PORT_LSDA;
 618         else
 619             port->ctrl &= ~UHCI_PORT_LSDA;
 620
 621         uhci_resume(s);
 622
 623         port->port.dev = dev;
 624         /* send the attach message */
 625         usb_send_msg(dev, USB_MSG_ATTACH);
 626     } else {
 627         /* set connect status */
 628         if (port->ctrl & UHCI_PORT_CCS) {
 629             port->ctrl &= ~UHCI_PORT_CCS;
 630             port->ctrl |= UHCI_PORT_CSC;
 631         }
 632         /* disable port */
 633         if (port->ctrl & UHCI_PORT_EN) {
 634             port->ctrl &= ~UHCI_PORT_EN;
 635             port->ctrl |= UHCI_PORT_ENC;
 636         }
 637
 638         uhci_resume(s);
 639
 640         dev = port->port.dev;
 641         if (dev) {
 642             /* send the detach message */
 643             usb_send_msg(dev, USB_MSG_DETACH);
 644         }
 645         port->port.dev = NULL;
 646     }
 647 }
 648
 649 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
 650 {
 651     int i, ret;
 652
 653     dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
 654            pid2str(p->pid), p->devaddr, p->devep, p->len);
 655     if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
 656         dump_data(p->data, p->len);
 657
 658     ret = USB_RET_NODEV;
 659     for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
 660         UHCIPort *port = &s->ports[i];
 661         USBDevice *dev = port->port.dev;
 662
 663         if (dev && (port->ctrl & UHCI_PORT_EN))
 664             ret = dev->info->handle_packet(dev, p);
 665     }
 666
 667     dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);
 668     if (p->pid == USB_TOKEN_IN && ret > 0)
 669         dump_data(p->data, ret);
 670
 671     return ret;
 672 }
 673
 674 static void uhci_async_complete(USBPacket * packet, void *opaque);
 675 static void uhci_process_frame(UHCIState *s);
 676
 677 /* return -1 if fatal error (frame must be stopped)
 678           0 if TD successful
 679           1 if TD unsuccessful or inactive
 680 */
 681 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
 682 {
 683     int len = 0, max_len, err, ret;
 684     uint8_t pid;
 685
 686     max_len = ((td->token >> 21) + 1) & 0x7ff;
 687     pid = td->token & 0xff;
 688
 689     ret = async->packet.len;
 690
 691     if (td->ctrl & TD_CTRL_IOC)
 692         *int_mask |= 0x01;
 693
 694     if (td->ctrl & TD_CTRL_IOS)
 695         td->ctrl &= ~TD_CTRL_ACTIVE;
 696
 697     if (ret < 0)
 698         goto out;
 699
 700     len = async->packet.len;
 701     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
 702
 703     /* The NAK bit may have been set by a previous frame, so clear it
 704        here.  The docs are somewhat unclear, but win2k relies on this
 705        behavior.  */
 706     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
 707
 708     if (pid == USB_TOKEN_IN) {
 709         if (len > max_len) {
 710             len = max_len;
 711             ret = USB_RET_BABBLE;
 712             goto out;
 713         }
 714
 715         if (len > 0) {
 716             /* write the data back */
 717             cpu_physical_memory_write(td->buffer, async->buffer, len);
 718         }
 719
 720         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
 721             *int_mask |= 0x02;
 722             /* short packet: do not update QH */
 723             dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
 724             return 1;
 725         }
 726     }
 727
 728     /* success */
 729     return 0;
 730
 731 out:
 732     switch(ret) {
 733     case USB_RET_STALL:
 734         td->ctrl |= TD_CTRL_STALL;
 735         td->ctrl &= ~TD_CTRL_ACTIVE;
 736         return 1;
 737
 738     case USB_RET_BABBLE:
 739         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
 740         td->ctrl &= ~TD_CTRL_ACTIVE;
 741         /* frame interrupted */
 742         return -1;
 743
 744     case USB_RET_NAK:
 745         td->ctrl |= TD_CTRL_NAK;
 746         if (pid == USB_TOKEN_SETUP)
 747             break;
 748         return 1;
 749
 750     case USB_RET_NODEV:
 751     default:
 752         break;
 753     }
 754
 755     /* Retry the TD if error count is not zero */
 756
 757     td->ctrl |= TD_CTRL_TIMEOUT;
 758     err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
 759     if (err != 0) {
 760         err--;
 761         if (err == 0) {
 762             td->ctrl &= ~TD_CTRL_ACTIVE;
 763             s->status |= UHCI_STS_USBERR;
 764             uhci_update_irq(s);
 765         }
 766     }
 767     td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
 768         (err << TD_CTRL_ERROR_SHIFT);
 769     return 1;
 770 }
 771
 772 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
 773 {
 774     UHCIAsync *async;
 775     int len = 0, max_len;
 776     uint8_t pid;
 777
 778     /* Is active ? */
 779     if (!(td->ctrl & TD_CTRL_ACTIVE))
 780         return 1;
 781
 782     async = uhci_async_find_td(s, addr, td->token);
 783     if (async) {
 784         /* Already submitted */
 785         async->valid = 32;
 786
 787         if (!async->done)
 788             return 1;
 789
 790         uhci_async_unlink(s, async);
 791         goto done;
 792     }
 793
 794     /* Allocate new packet */
 795     async = uhci_async_alloc(s);
 796     if (!async)
 797         return 1;
 798
 799     async->valid = 10;
 800     async->td    = addr;
 801     async->token = td->token;
 802
 803     max_len = ((td->token >> 21) + 1) & 0x7ff;
 804     pid = td->token & 0xff;
 805
 806     async->packet.pid     = pid;
 807     async->packet.devaddr = (td->token >> 8) & 0x7f;
 808     async->packet.devep   = (td->token >> 15) & 0xf;
 809     async->packet.data    = async->buffer;
 810     async->packet.len     = max_len;
 811     async->packet.complete_cb     = uhci_async_complete;
 812     async->packet.complete_opaque = s;
 813
 814     switch(pid) {
 815     case USB_TOKEN_OUT:
 816     case USB_TOKEN_SETUP:
 817         cpu_physical_memory_read(td->buffer, async->buffer, max_len);
 818         len = uhci_broadcast_packet(s, &async->packet);
 819         if (len >= 0)
 820             len = max_len;
 821         break;
 822
 823     case USB_TOKEN_IN:
 824         len = uhci_broadcast_packet(s, &async->packet);
 825         break;
 826
 827     default:
 828         /* invalid pid : frame interrupted */
 829         uhci_async_free(s, async);
 830         s->status |= UHCI_STS_HCPERR;
 831         uhci_update_irq(s);
 832         return -1;
 833     }
 834
 835     if (len == USB_RET_ASYNC) {
 836         uhci_async_link(s, async);
 837         return 2;
 838     }
 839
 840     async->packet.len = len;
 841
 842 done:
 843     len = uhci_complete_td(s, td, async, int_mask);
 844     uhci_async_free(s, async);
 845     return len;
 846 }
 847
 848 static void uhci_async_complete(USBPacket *packet, void *opaque)
 849 {
 850     UHCIState *s = opaque;
 851     UHCIAsync *async = (UHCIAsync *) packet;
 852
 853     dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
 854
 855     async->done = 1;
 856
 857     uhci_process_frame(s);
 858 }
 859
 860 static int is_valid(uint32_t link)
 861 {
 862     return (link & 1) == 0;
 863 }
 864
 865 static int is_qh(uint32_t link)
 866 {
 867     return (link & 2) != 0;
 868 }
 869
 870 static int depth_first(uint32_t link)
 871 {
 872     return (link & 4) != 0;
 873 }
 874
 875 /* QH DB used for detecting QH loops */
 876 #define UHCI_MAX_QUEUES 128
 877 typedef struct {
 878     uint32_t addr[UHCI_MAX_QUEUES];
 879     int      count;
 880 } QhDb;
 881
 882 static void qhdb_reset(QhDb *db)
 883 {
 884     db->count = 0;
 885 }
 886
 887 /* Add QH to DB. Returns 1 if already present or DB is full. */
 888 static int qhdb_insert(QhDb *db, uint32_t addr)
 889 {
 890     int i;
 891     for (i = 0; i < db->count; i++)
 892         if (db->addr[i] == addr)
 893             return 1;
 894
 895     if (db->count >= UHCI_MAX_QUEUES)
 896         return 1;
 897
 898     db->addr[db->count++] = addr;
 899     return 0;
 900 }
 901
 902 static void uhci_process_frame(UHCIState *s)
 903 {
 904     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
 905     uint32_t curr_qh;
 906     int cnt, ret;
 907     UHCI_TD td;
 908     UHCI_QH qh;
 909     QhDb qhdb;
 910
 911     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
 912
 913     dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
 914
 915     cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
 916     le32_to_cpus(&link);
 917
 918     int_mask = 0;
 919     curr_qh  = 0;
 920
 921     qhdb_reset(&qhdb);
 922
 923     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
 924         if (is_qh(link)) {
 925             /* QH */
 926
 927             if (qhdb_insert(&qhdb, link)) {
 928                 /*
 929                  * We're going in circles. Which is not a bug because
 930                  * HCD is allowed to do that as part of the BW management.
 931                  * In our case though it makes no sense to spin here. Sync transations
 932                  * are already done, and async completion handler will re-process
 933                  * the frame when something is ready.
 934                  */
 935                 dprintf("uhci: detected loop. qh 0x%x\n", link);
 936                 break;
 937             }
 938
 939             cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
 940             le32_to_cpus(&qh.link);
 941             le32_to_cpus(&qh.el_link);
 942
 943             dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
 944                     link, qh.link, qh.el_link);
 945
 946             if (!is_valid(qh.el_link)) {
 947                 /* QH w/o elements */
 948                 curr_qh = 0;
 949                 link = qh.link;
 950             } else {
 951                 /* QH with elements */
 952                 curr_qh = link;
 953                 link = qh.el_link;
 954             }
 955             continue;
 956         }
 957
 958         /* TD */
 959         cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
 960         le32_to_cpus(&td.link);
 961         le32_to_cpus(&td.ctrl);
 962         le32_to_cpus(&td.token);
 963         le32_to_cpus(&td.buffer);
 964
 965         dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 966                 link, td.link, td.ctrl, td.token, curr_qh);
 967
 968         old_td_ctrl = td.ctrl;
 969         ret = uhci_handle_td(s, link, &td, &int_mask);
 970         if (old_td_ctrl != td.ctrl) {
 971             /* update the status bits of the TD */
 972             val = cpu_to_le32(td.ctrl);
 973             cpu_physical_memory_write((link & ~0xf) + 4,
 974                                       (const uint8_t *)&val, sizeof(val));
 975         }
 976
 977         if (ret < 0) {
 978             /* interrupted frame */
 979             break;
 980         }
 981
 982         if (ret == 2 || ret == 1) {
 983             dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 984                     link, ret == 2 ? "pend" : "skip",
 985                     td.link, td.ctrl, td.token, curr_qh);
 986
 987             link = curr_qh ? qh.link : td.link;
 988             continue;
 989         }
 990
 991         /* completed TD */
 992
 993         dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 994                 link, td.link, td.ctrl, td.token, curr_qh);
 995
 996         link = td.link;
 997
 998         if (curr_qh) {
 999             /* update QH element link */
1000             qh.el_link = link;
1001             val = cpu_to_le32(qh.el_link);
1002             cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1003                                           (const uint8_t *)&val, sizeof(val));
1004
1005             if (!depth_first(link)) {
1006                /* done with this QH */
1007
1008                dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1009                        curr_qh, qh.link, qh.el_link);
1010
1011                curr_qh = 0;
1012                link    = qh.link;
1013             }
1014         }
1015
1016         /* go to the next entry */
1017     }
1018
1019     s->pending_int_mask = int_mask;
1020 }
1021
1022 static void uhci_frame_timer(void *opaque)
1023 {
1024     UHCIState *s = opaque;
1025     int64_t expire_time;
1026
1027     if (!(s->cmd & UHCI_CMD_RS)) {
1028         /* Full stop */
1029         qemu_del_timer(s->frame_timer);
1030         /* set hchalted bit in status - UHCI11D 2.1.2 */
1031         s->status |= UHCI_STS_HCHALTED;
1032
1033         dprintf("uhci: halted\n");
1034         return;
1035     }
1036
1037     /* Complete the previous frame */
1038     if (s->pending_int_mask) {
1039         s->status2 |= s->pending_int_mask;
1040         s->status  |= UHCI_STS_USBINT;
1041         uhci_update_irq(s);
1042     }
1043
1044     /* Start new frame */
1045     s->frnum = (s->frnum + 1) & 0x7ff;
1046
1047     dprintf("uhci: new frame #%u\n" , s->frnum);
1048
1049     uhci_async_validate_begin(s);
1050
1051     uhci_process_frame(s);
1052
1053     uhci_async_validate_end(s);
1054
1055     /* prepare the timer for the next frame */
1056     expire_time = qemu_get_clock(vm_clock) +
1057         (ticks_per_sec / FRAME_TIMER_FREQ);
1058     qemu_mod_timer(s->frame_timer, expire_time);
1059 }
1060
1061 static void uhci_map(PCIDevice *pci_dev, int region_num,
1062                     uint32_t addr, uint32_t size, int type)
1063 {
1064     UHCIState *s = (UHCIState *)pci_dev;
1065
1066     register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1067     register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1068     register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1069     register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1070     register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1071     register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1072 }
1073
1074 static int usb_uhci_common_initfn(UHCIState *s)
1075 {
1076     uint8_t *pci_conf = s->dev.config;
1077     int i;
1078
1079     pci_conf[0x08] = 0x01; // revision number
1080     pci_conf[0x09] = 0x00;
1081     pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1082     pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1083     pci_conf[0x3d] = 4; // interrupt pin 3
1084     pci_conf[0x60] = 0x10; // release number
1085
1086     s->bus = usb_bus_new(&s->dev.qdev);
1087     for(i = 0; i < NB_PORTS; i++) {
1088         usb_register_port(s->bus, &s->ports[i].port, s, i, uhci_attach);
1089     }
1090     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1091
1092     qemu_register_reset(uhci_reset, s);
1093     uhci_reset(s);
1094
1095     /* Use region 4 for consistency with real hardware.  BSD guests seem
1096        to rely on this.  */
1097     pci_register_bar(&s->dev, 4, 0x20,
1098                            PCI_ADDRESS_SPACE_IO, uhci_map);
1099
1100     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1101     return 0;
1102 }
1103
1104 static int usb_uhci_piix3_initfn(PCIDevice *dev)
1105 {
1106     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1107     uint8_t *pci_conf = s->dev.config;
1108
1109     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1110     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
1111     return usb_uhci_common_initfn(s);
1112 }
1113
1114 static int usb_uhci_piix4_initfn(PCIDevice *dev)
1115 {
1116     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1117     uint8_t *pci_conf = s->dev.config;
1118
1119     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1120     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
1121     return usb_uhci_common_initfn(s);
1122 }
1123
1124 static PCIDeviceInfo uhci_info[] = {
1125     {
1126         .qdev.name    = "PIIX3 USB-UHCI",
1127         .qdev.size    = sizeof(UHCIState),
1128         .init         = usb_uhci_piix3_initfn,
1129     },{
1130         .qdev.name    = "PIIX4 USB-UHCI",
1131         .qdev.size    = sizeof(UHCIState),
1132         .init         = usb_uhci_piix4_initfn,
1133     },{
1134         /* end of list */
1135     }
1136 };
1137
1138 static void uhci_register(void)
1139 {
1140     pci_qdev_register_many(uhci_info);
1141 }
1142 device_init(uhci_register);
1143
1144 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1145 {
1146     pci_create_simple(bus, devfn, "PIIX3 USB-UHCI");
1147 }
1148
1149 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1150 {
1151     pci_create_simple(bus, devfn, "PIIX4 USB-UHCI");
1152 }