hw/usb-uhci.c

   1 /*
   2  * USB UHCI controller emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "vl.h"
  25
  26 //#define DEBUG
  27 //#define DEBUG_PACKET
  28
  29 #define UHCI_CMD_GRESET   (1 << 2)
  30 #define UHCI_CMD_HCRESET  (1 << 1)
  31 #define UHCI_CMD_RS       (1 << 0)
  32
  33 #define UHCI_STS_HCHALTED (1 << 5)
  34 #define UHCI_STS_HCPERR   (1 << 4)
  35 #define UHCI_STS_HSERR    (1 << 3)
  36 #define UHCI_STS_RD       (1 << 2)
  37 #define UHCI_STS_USBERR   (1 << 1)
  38 #define UHCI_STS_USBINT   (1 << 0)
  39
  40 #define TD_CTRL_SPD     (1 << 29)
  41 #define TD_CTRL_ERROR_SHIFT  27
  42 #define TD_CTRL_IOS     (1 << 25)
  43 #define TD_CTRL_IOC     (1 << 24)
  44 #define TD_CTRL_ACTIVE  (1 << 23)
  45 #define TD_CTRL_STALL   (1 << 22)
  46 #define TD_CTRL_BABBLE  (1 << 20)
  47 #define TD_CTRL_NAK     (1 << 19)
  48 #define TD_CTRL_TIMEOUT (1 << 18)
  49
  50 #define UHCI_PORT_RESET (1 << 9)
  51 #define UHCI_PORT_LSDA  (1 << 8)
  52 #define UHCI_PORT_ENC   (1 << 3)
  53 #define UHCI_PORT_EN    (1 << 2)
  54 #define UHCI_PORT_CSC   (1 << 1)
  55 #define UHCI_PORT_CCS   (1 << 0)
  56
  57 #define FRAME_TIMER_FREQ 1000
  58
  59 #define FRAME_MAX_LOOPS  100
  60
  61 #define NB_PORTS 2
  62
  63 typedef struct UHCIPort {
  64     USBPort port;
  65     uint16_t ctrl;
  66 } UHCIPort;
  67
  68 typedef struct UHCIState {
  69     PCIDevice dev;
  70     uint16_t cmd; /* cmd register */
  71     uint16_t status;
  72     uint16_t intr; /* interrupt enable register */
  73     uint16_t frnum; /* frame number */
  74     uint32_t fl_base_addr; /* frame list base address */
  75     uint8_t sof_timing;
  76     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
  77     QEMUTimer *frame_timer;
  78     UHCIPort ports[NB_PORTS];
  79
  80     /* Interrupts that should be raised at the end of the current frame.  */
  81     uint32_t pending_int_mask;
  82     /* For simplicity of implementation we only allow a single pending USB
  83        request.  This means all usb traffic on this controller is effectively
  84        suspended until that transfer completes.  When the transfer completes
  85        the next transfer from that queue will be processed.  However
  86        other queues will not be processed until the next frame.  The solution
  87        is to allow multiple pending requests.  */
  88     uint32_t async_qh;
  89     USBPacket usb_packet;
  90     uint8_t usb_buf[2048];
  91 } UHCIState;
  92
  93 typedef struct UHCI_TD {
  94     uint32_t link;
  95     uint32_t ctrl; /* see TD_CTRL_xxx */
  96     uint32_t token;
  97     uint32_t buffer;
  98 } UHCI_TD;
  99
 100 typedef struct UHCI_QH {
 101     uint32_t link;
 102     uint32_t el_link;
 103 } UHCI_QH;
 104
 105 static void uhci_attach(USBPort *port1, USBDevice *dev);
 106
 107 static void uhci_update_irq(UHCIState *s)
 108 {
 109     int level;
 110     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
 111         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
 112         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
 113         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
 114         (s->status & UHCI_STS_HSERR) ||
 115         (s->status & UHCI_STS_HCPERR)) {
 116         level = 1;
 117     } else {
 118         level = 0;
 119     }
 120     pci_set_irq(&s->dev, 3, level);
 121 }
 122
 123 static void uhci_reset(UHCIState *s)
 124 {
 125     uint8_t *pci_conf;
 126     int i;
 127     UHCIPort *port;
 128
 129     pci_conf = s->dev.config;
 130
 131     pci_conf[0x6a] = 0x01; /* usb clock */
 132     pci_conf[0x6b] = 0x00;
 133     s->cmd = 0;
 134     s->status = 0;
 135     s->status2 = 0;
 136     s->intr = 0;
 137     s->fl_base_addr = 0;
 138     s->sof_timing = 64;
 139     for(i = 0; i < NB_PORTS; i++) {
 140         port = &s->ports[i];
 141         port->ctrl = 0x0080;
 142         if (port->port.dev)
 143             uhci_attach(&port->port, port->port.dev);
 144     }
 145 }
 146
 147 static void uhci_save(QEMUFile *f, void *opaque)
 148 {
 149     UHCIState *s = opaque;
 150     uint8_t num_ports = NB_PORTS;
 151     int i;
 152
 153     pci_device_save(&s->dev, f);
 154
 155     qemu_put_8s(f, &num_ports);
 156     for (i = 0; i < num_ports; ++i)
 157         qemu_put_be16s(f, &s->ports[i].ctrl);
 158     qemu_put_be16s(f, &s->cmd);
 159     qemu_put_be16s(f, &s->status);
 160     qemu_put_be16s(f, &s->intr);
 161     qemu_put_be16s(f, &s->frnum);
 162     qemu_put_be32s(f, &s->fl_base_addr);
 163     qemu_put_8s(f, &s->sof_timing);
 164     qemu_put_8s(f, &s->status2);
 165     qemu_put_timer(f, s->frame_timer);
 166 }
 167
 168 static int uhci_load(QEMUFile* f,void* opaque,int version_id)
 169 {
 170     UHCIState *s = opaque;
 171     uint8_t num_ports;
 172     int i, ret;
 173
 174     if (version_id > 1)
 175         return -EINVAL;
 176
 177     ret = pci_device_load(&s->dev, f);
 178     if (ret < 0)
 179         return ret;
 180
 181     qemu_get_8s(f, &num_ports);
 182     if (num_ports != NB_PORTS)
 183         return -EINVAL;
 184
 185     for (i = 0; i < num_ports; ++i)
 186         qemu_get_be16s(f, &s->ports[i].ctrl);
 187     qemu_get_be16s(f, &s->cmd);
 188     qemu_get_be16s(f, &s->status);
 189     qemu_get_be16s(f, &s->intr);
 190     qemu_get_be16s(f, &s->frnum);
 191     qemu_get_be32s(f, &s->fl_base_addr);
 192     qemu_get_8s(f, &s->sof_timing);
 193     qemu_get_8s(f, &s->status2);
 194     qemu_get_timer(f, s->frame_timer);
 195
 196     return 0;
 197 }
 198
 199 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 200 {
 201     UHCIState *s = opaque;
 202
 203     addr &= 0x1f;
 204     switch(addr) {
 205     case 0x0c:
 206         s->sof_timing = val;
 207         break;
 208     }
 209 }
 210
 211 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
 212 {
 213     UHCIState *s = opaque;
 214     uint32_t val;
 215
 216     addr &= 0x1f;
 217     switch(addr) {
 218     case 0x0c:
 219         val = s->sof_timing;
 220         break;
 221     default:
 222         val = 0xff;
 223         break;
 224     }
 225     return val;
 226 }
 227
 228 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 229 {
 230     UHCIState *s = opaque;
 231
 232     addr &= 0x1f;
 233 #ifdef DEBUG
 234     printf("uhci writew port=0x%04x val=0x%04x\n", addr, val);
 235 #endif
 236     switch(addr) {
 237     case 0x00:
 238         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
 239             /* start frame processing */
 240             qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
 241             s->status &= ~UHCI_STS_HCHALTED;
 242         } else if (!(val & UHCI_CMD_RS)) {
 243             s->status |= UHCI_STS_HCHALTED;
 244         }
 245         if (val & UHCI_CMD_GRESET) {
 246             UHCIPort *port;
 247             USBDevice *dev;
 248             int i;
 249
 250             /* send reset on the USB bus */
 251             for(i = 0; i < NB_PORTS; i++) {
 252                 port = &s->ports[i];
 253                 dev = port->port.dev;
 254                 if (dev) {
 255                     usb_send_msg(dev, USB_MSG_RESET);
 256                 }
 257             }
 258             uhci_reset(s);
 259             return;
 260         }
 261         if (val & UHCI_CMD_HCRESET) {
 262             uhci_reset(s);
 263             return;
 264         }
 265         s->cmd = val;
 266         break;
 267     case 0x02:
 268         s->status &= ~val;
 269         /* XXX: the chip spec is not coherent, so we add a hidden
 270            register to distinguish between IOC and SPD */
 271         if (val & UHCI_STS_USBINT)
 272             s->status2 = 0;
 273         uhci_update_irq(s);
 274         break;
 275     case 0x04:
 276         s->intr = val;
 277         uhci_update_irq(s);
 278         break;
 279     case 0x06:
 280         if (s->status & UHCI_STS_HCHALTED)
 281             s->frnum = val & 0x7ff;
 282         break;
 283     case 0x10 ... 0x1f:
 284         {
 285             UHCIPort *port;
 286             USBDevice *dev;
 287             int n;
 288
 289             n = (addr >> 1) & 7;
 290             if (n >= NB_PORTS)
 291                 return;
 292             port = &s->ports[n];
 293             dev = port->port.dev;
 294             if (dev) {
 295                 /* port reset */
 296                 if ( (val & UHCI_PORT_RESET) &&
 297                      !(port->ctrl & UHCI_PORT_RESET) ) {
 298                     usb_send_msg(dev, USB_MSG_RESET);
 299                 }
 300             }
 301             port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
 302             /* some bits are reset when a '1' is written to them */
 303             port->ctrl &= ~(val & 0x000a);
 304         }
 305         break;
 306     }
 307 }
 308
 309 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
 310 {
 311     UHCIState *s = opaque;
 312     uint32_t val;
 313
 314     addr &= 0x1f;
 315     switch(addr) {
 316     case 0x00:
 317         val = s->cmd;
 318         break;
 319     case 0x02:
 320         val = s->status;
 321         break;
 322     case 0x04:
 323         val = s->intr;
 324         break;
 325     case 0x06:
 326         val = s->frnum;
 327         break;
 328     case 0x10 ... 0x1f:
 329         {
 330             UHCIPort *port;
 331             int n;
 332             n = (addr >> 1) & 7;
 333             if (n >= NB_PORTS)
 334                 goto read_default;
 335             port = &s->ports[n];
 336             val = port->ctrl;
 337         }
 338         break;
 339     default:
 340     read_default:
 341         val = 0xff7f; /* disabled port */
 342         break;
 343     }
 344 #ifdef DEBUG
 345     printf("uhci readw port=0x%04x val=0x%04x\n", addr, val);
 346 #endif
 347     return val;
 348 }
 349
 350 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 351 {
 352     UHCIState *s = opaque;
 353
 354     addr &= 0x1f;
 355 #ifdef DEBUG
 356     printf("uhci writel port=0x%04x val=0x%08x\n", addr, val);
 357 #endif
 358     switch(addr) {
 359     case 0x08:
 360         s->fl_base_addr = val & ~0xfff;
 361         break;
 362     }
 363 }
 364
 365 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
 366 {
 367     UHCIState *s = opaque;
 368     uint32_t val;
 369
 370     addr &= 0x1f;
 371     switch(addr) {
 372     case 0x08:
 373         val = s->fl_base_addr;
 374         break;
 375     default:
 376         val = 0xffffffff;
 377         break;
 378     }
 379     return val;
 380 }
 381
 382 static void uhci_attach(USBPort *port1, USBDevice *dev)
 383 {
 384     UHCIState *s = port1->opaque;
 385     UHCIPort *port = &s->ports[port1->index];
 386
 387     if (dev) {
 388         if (port->port.dev) {
 389             usb_attach(port1, NULL);
 390         }
 391         /* set connect status */
 392         port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
 393
 394         /* update speed */
 395         if (dev->speed == USB_SPEED_LOW)
 396             port->ctrl |= UHCI_PORT_LSDA;
 397         else
 398             port->ctrl &= ~UHCI_PORT_LSDA;
 399         port->port.dev = dev;
 400         /* send the attach message */
 401         usb_send_msg(dev, USB_MSG_ATTACH);
 402     } else {
 403         /* set connect status */
 404         if (port->ctrl & UHCI_PORT_CCS) {
 405             port->ctrl &= ~UHCI_PORT_CCS;
 406             port->ctrl |= UHCI_PORT_CSC;
 407         }
 408         /* disable port */
 409         if (port->ctrl & UHCI_PORT_EN) {
 410             port->ctrl &= ~UHCI_PORT_EN;
 411             port->ctrl |= UHCI_PORT_ENC;
 412         }
 413         dev = port->port.dev;
 414         if (dev) {
 415             /* send the detach message */
 416             usb_send_msg(dev, USB_MSG_DETACH);
 417         }
 418         port->port.dev = NULL;
 419     }
 420 }
 421
 422 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
 423 {
 424     UHCIPort *port;
 425     USBDevice *dev;
 426     int i, ret;
 427
 428 #ifdef DEBUG_PACKET
 429     {
 430         const char *pidstr;
 431         switch(p->pid) {
 432         case USB_TOKEN_SETUP: pidstr = "SETUP"; break;
 433         case USB_TOKEN_IN: pidstr = "IN"; break;
 434         case USB_TOKEN_OUT: pidstr = "OUT"; break;
 435         default: pidstr = "?"; break;
 436         }
 437         printf("frame %d: pid=%s addr=0x%02x ep=%d len=%d\n",
 438                s->frnum, pidstr, p->devaddr, p->devep, p->len);
 439         if (p->pid != USB_TOKEN_IN) {
 440             printf("     data_out=");
 441             for(i = 0; i < p->len; i++) {
 442                 printf(" %02x", p->data[i]);
 443             }
 444             printf("\n");
 445         }
 446     }
 447 #endif
 448     for(i = 0; i < NB_PORTS; i++) {
 449         port = &s->ports[i];
 450         dev = port->port.dev;
 451         if (dev && (port->ctrl & UHCI_PORT_EN)) {
 452             ret = dev->handle_packet(dev, p);
 453             if (ret != USB_RET_NODEV) {
 454 #ifdef DEBUG_PACKET
 455                 if (ret == USB_RET_ASYNC) {
 456                     printf("usb-uhci: Async packet\n");
 457                 } else {
 458                     printf("     ret=%d ", ret);
 459                     if (p->pid == USB_TOKEN_IN && ret > 0) {
 460                         printf("data_in=");
 461                         for(i = 0; i < ret; i++) {
 462                             printf(" %02x", p->data[i]);
 463                         }
 464                     }
 465                     printf("\n");
 466                 }
 467 #endif
 468                 return ret;
 469             }
 470         }
 471     }
 472     return USB_RET_NODEV;
 473 }
 474
 475 static void uhci_async_complete_packet(USBPacket * packet, void *opaque);
 476
 477 /* return -1 if fatal error (frame must be stopped)
 478           0 if TD successful
 479           1 if TD unsuccessful or inactive
 480 */
 481 static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
 482 {
 483     uint8_t pid;
 484     int len, max_len, err, ret;
 485
 486     /* ??? This is wrong for async completion.  */
 487     if (td->ctrl & TD_CTRL_IOC) {
 488         *int_mask |= 0x01;
 489     }
 490
 491     if (!(td->ctrl & TD_CTRL_ACTIVE))
 492         return 1;
 493
 494     /* TD is active */
 495     max_len = ((td->token >> 21) + 1) & 0x7ff;
 496     pid = td->token & 0xff;
 497     if (s->async_qh) {
 498         ret = s->usb_packet.len;
 499         if (ret >= 0) {
 500             len = ret;
 501             if (len > max_len) {
 502                 len = max_len;
 503                 ret = USB_RET_BABBLE;
 504             }
 505             if (len > 0) {
 506                 /* write the data back */
 507                 cpu_physical_memory_write(td->buffer, s->usb_buf, len);
 508             }
 509         } else {
 510             len = 0;
 511         }
 512         s->async_qh = 0;
 513     } else {
 514         s->usb_packet.pid = pid;
 515         s->usb_packet.devaddr = (td->token >> 8) & 0x7f;
 516         s->usb_packet.devep = (td->token >> 15) & 0xf;
 517         s->usb_packet.data = s->usb_buf;
 518         s->usb_packet.len = max_len;
 519         s->usb_packet.complete_cb = uhci_async_complete_packet;
 520         s->usb_packet.complete_opaque = s;
 521         switch(pid) {
 522         case USB_TOKEN_OUT:
 523         case USB_TOKEN_SETUP:
 524             cpu_physical_memory_read(td->buffer, s->usb_buf, max_len);
 525             ret = uhci_broadcast_packet(s, &s->usb_packet);
 526             len = max_len;
 527             break;
 528         case USB_TOKEN_IN:
 529             ret = uhci_broadcast_packet(s, &s->usb_packet);
 530             if (ret >= 0) {
 531                 len = ret;
 532                 if (len > max_len) {
 533                     len = max_len;
 534                     ret = USB_RET_BABBLE;
 535                 }
 536                 if (len > 0) {
 537                     /* write the data back */
 538                     cpu_physical_memory_write(td->buffer, s->usb_buf, len);
 539                 }
 540             } else {
 541                 len = 0;
 542             }
 543             break;
 544         default:
 545             /* invalid pid : frame interrupted */
 546             s->status |= UHCI_STS_HCPERR;
 547             uhci_update_irq(s);
 548             return -1;
 549         }
 550     }
 551     if (ret == USB_RET_ASYNC) {
 552         return 2;
 553     }
 554     if (td->ctrl & TD_CTRL_IOS)
 555         td->ctrl &= ~TD_CTRL_ACTIVE;
 556     if (ret >= 0) {
 557         td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
 558         td->ctrl &= ~TD_CTRL_ACTIVE;
 559         if (pid == USB_TOKEN_IN &&
 560             (td->ctrl & TD_CTRL_SPD) &&
 561             len < max_len) {
 562             *int_mask |= 0x02;
 563             /* short packet: do not update QH */
 564             return 1;
 565         } else {
 566             /* success */
 567             return 0;
 568         }
 569     } else {
 570         switch(ret) {
 571         default:
 572         case USB_RET_NODEV:
 573         do_timeout:
 574             td->ctrl |= TD_CTRL_TIMEOUT;
 575             err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
 576             if (err != 0) {
 577                 err--;
 578                 if (err == 0) {
 579                     td->ctrl &= ~TD_CTRL_ACTIVE;
 580                     s->status |= UHCI_STS_USBERR;
 581                     uhci_update_irq(s);
 582                 }
 583             }
 584             td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
 585                 (err << TD_CTRL_ERROR_SHIFT);
 586             return 1;
 587         case USB_RET_NAK:
 588             td->ctrl |= TD_CTRL_NAK;
 589             if (pid == USB_TOKEN_SETUP)
 590                 goto do_timeout;
 591             return 1;
 592         case USB_RET_STALL:
 593             td->ctrl |= TD_CTRL_STALL;
 594             td->ctrl &= ~TD_CTRL_ACTIVE;
 595             return 1;
 596         case USB_RET_BABBLE:
 597             td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
 598             td->ctrl &= ~TD_CTRL_ACTIVE;
 599             /* frame interrupted */
 600             return -1;
 601         }
 602     }
 603 }
 604
 605 static void uhci_async_complete_packet(USBPacket * packet, void *opaque)
 606 {
 607     UHCIState *s = opaque;
 608     UHCI_QH qh;
 609     UHCI_TD td;
 610     uint32_t link;
 611     uint32_t old_td_ctrl;
 612     uint32_t val;
 613     int ret;
 614
 615     link = s->async_qh;
 616     if (!link) {
 617         /* This should never happen. It means a TD somehow got removed
 618            without cancelling the associated async IO request.  */
 619         return;
 620     }
 621     cpu_physical_memory_read(link & ~0xf, (uint8_t *)&qh, sizeof(qh));
 622     le32_to_cpus(&qh.link);
 623     le32_to_cpus(&qh.el_link);
 624     /* Re-process the queue containing the async packet.  */
 625     while (1) {
 626         cpu_physical_memory_read(qh.el_link & ~0xf,
 627                                  (uint8_t *)&td, sizeof(td));
 628         le32_to_cpus(&td.link);
 629         le32_to_cpus(&td.ctrl);
 630         le32_to_cpus(&td.token);
 631         le32_to_cpus(&td.buffer);
 632         old_td_ctrl = td.ctrl;
 633         ret = uhci_handle_td(s, &td, &s->pending_int_mask);
 634         /* update the status bits of the TD */
 635         if (old_td_ctrl != td.ctrl) {
 636             val = cpu_to_le32(td.ctrl);
 637             cpu_physical_memory_write((qh.el_link & ~0xf) + 4,
 638                                       (const uint8_t *)&val,
 639                                       sizeof(val));
 640         }
 641         if (ret < 0)
 642             break; /* interrupted frame */
 643         if (ret == 2) {
 644             s->async_qh = link;
 645             break;
 646         } else if (ret == 0) {
 647             /* update qh element link */
 648             qh.el_link = td.link;
 649             val = cpu_to_le32(qh.el_link);
 650             cpu_physical_memory_write((link & ~0xf) + 4,
 651                                       (const uint8_t *)&val,
 652                                       sizeof(val));
 653             if (!(qh.el_link & 4))
 654                 break;
 655         }
 656         break;
 657     }
 658 }
 659
 660 static void uhci_frame_timer(void *opaque)
 661 {
 662     UHCIState *s = opaque;
 663     int64_t expire_time;
 664     uint32_t frame_addr, link, old_td_ctrl, val;
 665     int int_mask, cnt, ret;
 666     UHCI_TD td;
 667     UHCI_QH qh;
 668     uint32_t old_async_qh;
 669
 670     if (!(s->cmd & UHCI_CMD_RS)) {
 671         qemu_del_timer(s->frame_timer);
 672         /* set hchalted bit in status - UHCI11D 2.1.2 */
 673         s->status |= UHCI_STS_HCHALTED;
 674         return;
 675     }
 676     /* Complete the previous frame.  */
 677     s->frnum = (s->frnum + 1) & 0x7ff;
 678     if (s->pending_int_mask) {
 679         s->status2 |= s->pending_int_mask;
 680         s->status |= UHCI_STS_USBINT;
 681         uhci_update_irq(s);
 682     }
 683     old_async_qh = s->async_qh;
 684     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
 685     cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
 686     le32_to_cpus(&link);
 687     int_mask = 0;
 688     cnt = FRAME_MAX_LOOPS;
 689     while ((link & 1) == 0) {
 690         if (--cnt == 0)
 691             break;
 692         /* valid frame */
 693         if (link & 2) {
 694             /* QH */
 695             if (link == s->async_qh) {
 696                 /* We've found a previously issues packet.
 697                    Nothing else to do.  */
 698                 old_async_qh = 0;
 699                 break;
 700             }
 701             cpu_physical_memory_read(link & ~0xf, (uint8_t *)&qh, sizeof(qh));
 702             le32_to_cpus(&qh.link);
 703             le32_to_cpus(&qh.el_link);
 704         depth_first:
 705             if (qh.el_link & 1) {
 706                 /* no element : go to next entry */
 707                 link = qh.link;
 708             } else if (qh.el_link & 2) {
 709                 /* QH */
 710                 link = qh.el_link;
 711             } else if (s->async_qh) {
 712                 /* We can only cope with one pending packet.  Keep looking
 713                    for the previously issued packet.  */
 714                 link = qh.link;
 715             } else {
 716                 /* TD */
 717                 if (--cnt == 0)
 718                     break;
 719                 cpu_physical_memory_read(qh.el_link & ~0xf,
 720                                          (uint8_t *)&td, sizeof(td));
 721                 le32_to_cpus(&td.link);
 722                 le32_to_cpus(&td.ctrl);
 723                 le32_to_cpus(&td.token);
 724                 le32_to_cpus(&td.buffer);
 725                 old_td_ctrl = td.ctrl;
 726                 ret = uhci_handle_td(s, &td, &int_mask);
 727                 /* update the status bits of the TD */
 728                 if (old_td_ctrl != td.ctrl) {
 729                     val = cpu_to_le32(td.ctrl);
 730                     cpu_physical_memory_write((qh.el_link & ~0xf) + 4,
 731                                               (const uint8_t *)&val,
 732                                               sizeof(val));
 733                 }
 734                 if (ret < 0)
 735                     break; /* interrupted frame */
 736                 if (ret == 2) {
 737                     s->async_qh = link;
 738                 } else if (ret == 0) {
 739                     /* update qh element link */
 740                     qh.el_link = td.link;
 741                     val = cpu_to_le32(qh.el_link);
 742                     cpu_physical_memory_write((link & ~0xf) + 4,
 743                                               (const uint8_t *)&val,
 744                                               sizeof(val));
 745                     if (qh.el_link & 4) {
 746                         /* depth first */
 747                         goto depth_first;
 748                     }
 749                 }
 750                 /* go to next entry */
 751                 link = qh.link;
 752             }
 753         } else {
 754             /* TD */
 755             cpu_physical_memory_read(link & ~0xf, (uint8_t *)&td, sizeof(td));
 756             le32_to_cpus(&td.link);
 757             le32_to_cpus(&td.ctrl);
 758             le32_to_cpus(&td.token);
 759             le32_to_cpus(&td.buffer);
 760             /* Ignore isochonous transfers while there is an async packet
 761                pending.  This is wrong, but we don't implement isochronous
 762                transfers anyway.  */
 763             if (s->async_qh == 0) {
 764                 old_td_ctrl = td.ctrl;
 765                 ret = uhci_handle_td(s, &td, &int_mask);
 766                 /* update the status bits of the TD */
 767                 if (old_td_ctrl != td.ctrl) {
 768                     val = cpu_to_le32(td.ctrl);
 769                     cpu_physical_memory_write((link & ~0xf) + 4,
 770                                               (const uint8_t *)&val,
 771                                               sizeof(val));
 772                 }
 773                 if (ret < 0)
 774                     break; /* interrupted frame */
 775                 if (ret == 2) {
 776                     /* We can't handle async isochronous transfers.
 777                        Cancel The packet.  */
 778                     fprintf(stderr, "usb-uhci: Unimplemented async packet\n");
 779                     usb_cancel_packet(&s->usb_packet);
 780                 }
 781             }
 782             link = td.link;
 783         }
 784     }
 785     s->pending_int_mask = int_mask;
 786     if (old_async_qh) {
 787         /* A previously started transfer has disappeared from the transfer
 788            list.  There's nothing useful we can do with it now, so just
 789            discard the packet and hope it wasn't too important.  */
 790 #ifdef DEBUG
 791         printf("Discarding USB packet\n");
 792 #endif
 793         usb_cancel_packet(&s->usb_packet);
 794         s->async_qh = 0;
 795     }
 796     /* prepare the timer for the next frame */
 797     expire_time = qemu_get_clock(vm_clock) +
 798         (ticks_per_sec / FRAME_TIMER_FREQ);
 799     qemu_mod_timer(s->frame_timer, expire_time);
 800 }
 801
 802 static void uhci_map(PCIDevice *pci_dev, int region_num,
 803                     uint32_t addr, uint32_t size, int type)
 804 {
 805     UHCIState *s = (UHCIState *)pci_dev;
 806
 807     register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
 808     register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
 809     register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
 810     register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
 811     register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
 812     register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
 813 }
 814
 815 void usb_uhci_init(PCIBus *bus, int devfn)
 816 {
 817     UHCIState *s;
 818     uint8_t *pci_conf;
 819     int i;
 820
 821     s = (UHCIState *)pci_register_device(bus,
 822                                         "USB-UHCI", sizeof(UHCIState),
 823                                         devfn, NULL, NULL);
 824     pci_conf = s->dev.config;
 825     pci_conf[0x00] = 0x86;
 826     pci_conf[0x01] = 0x80;
 827     pci_conf[0x02] = 0x20;
 828     pci_conf[0x03] = 0x70;
 829     pci_conf[0x08] = 0x01; // revision number
 830     pci_conf[0x09] = 0x00;
 831     pci_conf[0x0a] = 0x03;
 832     pci_conf[0x0b] = 0x0c;
 833     pci_conf[0x0e] = 0x00; // header_type
 834     pci_conf[0x3d] = 4; // interrupt pin 3
 835     pci_conf[0x60] = 0x10; // release number
 836
 837     for(i = 0; i < NB_PORTS; i++) {
 838         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
 839     }
 840     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
 841
 842     uhci_reset(s);
 843
 844     /* Use region 4 for consistency with real hardware.  BSD guests seem
 845        to rely on this.  */
 846     pci_register_io_region(&s->dev, 4, 0x20,
 847                            PCI_ADDRESS_SPACE_IO, uhci_map);
 848
 849     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
 850 }