2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
31 #include "qemu-timer.h"
35 //#define DEBUG_DUMP_DATA
37 #define UHCI_CMD_FGR (1 << 4)
38 #define UHCI_CMD_EGSM (1 << 3)
39 #define UHCI_CMD_GRESET (1 << 2)
40 #define UHCI_CMD_HCRESET (1 << 1)
41 #define UHCI_CMD_RS (1 << 0)
43 #define UHCI_STS_HCHALTED (1 << 5)
44 #define UHCI_STS_HCPERR (1 << 4)
45 #define UHCI_STS_HSERR (1 << 3)
46 #define UHCI_STS_RD (1 << 2)
47 #define UHCI_STS_USBERR (1 << 1)
48 #define UHCI_STS_USBINT (1 << 0)
50 #define TD_CTRL_SPD (1 << 29)
51 #define TD_CTRL_ERROR_SHIFT 27
52 #define TD_CTRL_IOS (1 << 25)
53 #define TD_CTRL_IOC (1 << 24)
54 #define TD_CTRL_ACTIVE (1 << 23)
55 #define TD_CTRL_STALL (1 << 22)
56 #define TD_CTRL_BABBLE (1 << 20)
57 #define TD_CTRL_NAK (1 << 19)
58 #define TD_CTRL_TIMEOUT (1 << 18)
60 #define UHCI_PORT_SUSPEND (1 << 12)
61 #define UHCI_PORT_RESET (1 << 9)
62 #define UHCI_PORT_LSDA (1 << 8)
63 #define UHCI_PORT_RD (1 << 6)
64 #define UHCI_PORT_ENC (1 << 3)
65 #define UHCI_PORT_EN (1 << 2)
66 #define UHCI_PORT_CSC (1 << 1)
67 #define UHCI_PORT_CCS (1 << 0)
69 #define UHCI_PORT_READ_ONLY (0x1bb)
70 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
72 #define FRAME_TIMER_FREQ 1000
74 #define FRAME_MAX_LOOPS 100
79 #define DPRINTF printf
81 static const char *pid2str(int pid
)
84 case USB_TOKEN_SETUP
: return "SETUP";
85 case USB_TOKEN_IN
: return "IN";
86 case USB_TOKEN_OUT
: return "OUT";
95 #ifdef DEBUG_DUMP_DATA
96 static void dump_data(const uint8_t *data
, int len
)
100 printf("uhci: data: ");
101 for(i
= 0; i
< len
; i
++)
102 printf(" %02x", data
[i
]);
106 static void dump_data(const uint8_t *data
, int len
) {}
110 * Pending async transaction.
111 * 'packet' must be the first field because completion
112 * handler does "(UHCIAsync *) pkt" cast.
114 typedef struct UHCIAsync
{
116 struct UHCIAsync
*next
;
122 uint8_t buffer
[2048];
125 typedef struct UHCIPort
{
130 typedef struct UHCIState
{
133 uint16_t cmd
; /* cmd register */
135 uint16_t intr
; /* interrupt enable register */
136 uint16_t frnum
; /* frame number */
137 uint32_t fl_base_addr
; /* frame list base address */
139 uint8_t status2
; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
141 QEMUTimer
*frame_timer
;
142 UHCIPort ports
[NB_PORTS
];
144 /* Interrupts that should be raised at the end of the current frame. */
145 uint32_t pending_int_mask
;
148 UHCIAsync
*async_pending
;
149 UHCIAsync
*async_pool
;
150 uint8_t num_ports_vmstate
;
153 typedef struct UHCI_TD
{
155 uint32_t ctrl
; /* see TD_CTRL_xxx */
160 typedef struct UHCI_QH
{
165 static UHCIAsync
*uhci_async_alloc(UHCIState
*s
)
167 UHCIAsync
*async
= qemu_malloc(sizeof(UHCIAsync
));
169 memset(&async
->packet
, 0, sizeof(async
->packet
));
180 static void uhci_async_free(UHCIState
*s
, UHCIAsync
*async
)
185 static void uhci_async_link(UHCIState
*s
, UHCIAsync
*async
)
187 async
->next
= s
->async_pending
;
188 s
->async_pending
= async
;
191 static void uhci_async_unlink(UHCIState
*s
, UHCIAsync
*async
)
193 UHCIAsync
*curr
= s
->async_pending
;
194 UHCIAsync
**prev
= &s
->async_pending
;
207 static void uhci_async_cancel(UHCIState
*s
, UHCIAsync
*async
)
209 DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
210 async
->td
, async
->token
, async
->done
);
213 usb_cancel_packet(&async
->packet
);
214 uhci_async_free(s
, async
);
218 * Mark all outstanding async packets as invalid.
219 * This is used for canceling them when TDs are removed by the HCD.
221 static UHCIAsync
*uhci_async_validate_begin(UHCIState
*s
)
223 UHCIAsync
*async
= s
->async_pending
;
233 * Cancel async packets that are no longer valid
235 static void uhci_async_validate_end(UHCIState
*s
)
237 UHCIAsync
*curr
= s
->async_pending
;
238 UHCIAsync
**prev
= &s
->async_pending
;
242 if (curr
->valid
> 0) {
253 uhci_async_cancel(s
, curr
);
259 static void uhci_async_cancel_all(UHCIState
*s
)
261 UHCIAsync
*curr
= s
->async_pending
;
267 uhci_async_cancel(s
, curr
);
272 s
->async_pending
= NULL
;
275 static UHCIAsync
*uhci_async_find_td(UHCIState
*s
, uint32_t addr
, uint32_t token
)
277 UHCIAsync
*async
= s
->async_pending
;
278 UHCIAsync
*match
= NULL
;
282 * We're looking for the best match here. ie both td addr and token.
283 * Otherwise we return last good match. ie just token.
284 * It's ok to match just token because it identifies the transaction
285 * rather well, token includes: device addr, endpoint, size, etc.
287 * Also since we queue async transactions in reverse order by returning
288 * last good match we restores the order.
290 * It's expected that we wont have a ton of outstanding transactions.
291 * If we ever do we'd want to optimize this algorithm.
295 if (async
->token
== token
) {
299 if (async
->td
== addr
) {
310 fprintf(stderr
, "uhci: warning lots of async transactions\n");
315 static void uhci_update_irq(UHCIState
*s
)
318 if (((s
->status2
& 1) && (s
->intr
& (1 << 2))) ||
319 ((s
->status2
& 2) && (s
->intr
& (1 << 3))) ||
320 ((s
->status
& UHCI_STS_USBERR
) && (s
->intr
& (1 << 0))) ||
321 ((s
->status
& UHCI_STS_RD
) && (s
->intr
& (1 << 1))) ||
322 (s
->status
& UHCI_STS_HSERR
) ||
323 (s
->status
& UHCI_STS_HCPERR
)) {
328 qemu_set_irq(s
->dev
.irq
[3], level
);
331 static void uhci_reset(void *opaque
)
333 UHCIState
*s
= opaque
;
338 DPRINTF("uhci: full reset\n");
340 pci_conf
= s
->dev
.config
;
342 pci_conf
[0x6a] = 0x01; /* usb clock */
343 pci_conf
[0x6b] = 0x00;
351 for(i
= 0; i
< NB_PORTS
; i
++) {
354 if (port
->port
.dev
) {
355 usb_attach(&port
->port
, port
->port
.dev
);
359 uhci_async_cancel_all(s
);
362 static void uhci_pre_save(void *opaque
)
364 UHCIState
*s
= opaque
;
366 uhci_async_cancel_all(s
);
369 static const VMStateDescription vmstate_uhci_port
= {
372 .minimum_version_id
= 1,
373 .minimum_version_id_old
= 1,
374 .fields
= (VMStateField
[]) {
375 VMSTATE_UINT16(ctrl
, UHCIPort
),
376 VMSTATE_END_OF_LIST()
380 static const VMStateDescription vmstate_uhci
= {
383 .minimum_version_id
= 1,
384 .minimum_version_id_old
= 1,
385 .pre_save
= uhci_pre_save
,
386 .fields
= (VMStateField
[]) {
387 VMSTATE_PCI_DEVICE(dev
, UHCIState
),
388 VMSTATE_UINT8_EQUAL(num_ports_vmstate
, UHCIState
),
389 VMSTATE_STRUCT_ARRAY(ports
, UHCIState
, NB_PORTS
, 1,
390 vmstate_uhci_port
, UHCIPort
),
391 VMSTATE_UINT16(cmd
, UHCIState
),
392 VMSTATE_UINT16(status
, UHCIState
),
393 VMSTATE_UINT16(intr
, UHCIState
),
394 VMSTATE_UINT16(frnum
, UHCIState
),
395 VMSTATE_UINT32(fl_base_addr
, UHCIState
),
396 VMSTATE_UINT8(sof_timing
, UHCIState
),
397 VMSTATE_UINT8(status2
, UHCIState
),
398 VMSTATE_TIMER(frame_timer
, UHCIState
),
399 VMSTATE_INT64_V(expire_time
, UHCIState
, 2),
400 VMSTATE_END_OF_LIST()
404 static void uhci_ioport_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
406 UHCIState
*s
= opaque
;
416 static uint32_t uhci_ioport_readb(void *opaque
, uint32_t addr
)
418 UHCIState
*s
= opaque
;
433 static void uhci_ioport_writew(void *opaque
, uint32_t addr
, uint32_t val
)
435 UHCIState
*s
= opaque
;
438 DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr
, val
);
442 if ((val
& UHCI_CMD_RS
) && !(s
->cmd
& UHCI_CMD_RS
)) {
443 /* start frame processing */
444 qemu_mod_timer(s
->frame_timer
, qemu_get_clock(vm_clock
));
445 s
->status
&= ~UHCI_STS_HCHALTED
;
446 } else if (!(val
& UHCI_CMD_RS
)) {
447 s
->status
|= UHCI_STS_HCHALTED
;
449 if (val
& UHCI_CMD_GRESET
) {
454 /* send reset on the USB bus */
455 for(i
= 0; i
< NB_PORTS
; i
++) {
457 dev
= port
->port
.dev
;
459 usb_send_msg(dev
, USB_MSG_RESET
);
465 if (val
& UHCI_CMD_HCRESET
) {
473 /* XXX: the chip spec is not coherent, so we add a hidden
474 register to distinguish between IOC and SPD */
475 if (val
& UHCI_STS_USBINT
)
484 if (s
->status
& UHCI_STS_HCHALTED
)
485 s
->frnum
= val
& 0x7ff;
497 dev
= port
->port
.dev
;
500 if ( (val
& UHCI_PORT_RESET
) &&
501 !(port
->ctrl
& UHCI_PORT_RESET
) ) {
502 usb_send_msg(dev
, USB_MSG_RESET
);
505 port
->ctrl
&= UHCI_PORT_READ_ONLY
;
506 port
->ctrl
|= (val
& ~UHCI_PORT_READ_ONLY
);
507 /* some bits are reset when a '1' is written to them */
508 port
->ctrl
&= ~(val
& UHCI_PORT_WRITE_CLEAR
);
514 static uint32_t uhci_ioport_readw(void *opaque
, uint32_t addr
)
516 UHCIState
*s
= opaque
;
546 val
= 0xff7f; /* disabled port */
550 DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr
, val
);
555 static void uhci_ioport_writel(void *opaque
, uint32_t addr
, uint32_t val
)
557 UHCIState
*s
= opaque
;
560 DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr
, val
);
564 s
->fl_base_addr
= val
& ~0xfff;
569 static uint32_t uhci_ioport_readl(void *opaque
, uint32_t addr
)
571 UHCIState
*s
= opaque
;
577 val
= s
->fl_base_addr
;
586 /* signal resume if controller suspended */
587 static void uhci_resume (void *opaque
)
589 UHCIState
*s
= (UHCIState
*)opaque
;
594 if (s
->cmd
& UHCI_CMD_EGSM
) {
595 s
->cmd
|= UHCI_CMD_FGR
;
596 s
->status
|= UHCI_STS_RD
;
601 static void uhci_attach(USBPort
*port1
)
603 UHCIState
*s
= port1
->opaque
;
604 UHCIPort
*port
= &s
->ports
[port1
->index
];
606 /* set connect status */
607 port
->ctrl
|= UHCI_PORT_CCS
| UHCI_PORT_CSC
;
610 if (port
->port
.dev
->speed
== USB_SPEED_LOW
) {
611 port
->ctrl
|= UHCI_PORT_LSDA
;
613 port
->ctrl
&= ~UHCI_PORT_LSDA
;
619 static void uhci_detach(USBPort
*port1
)
621 UHCIState
*s
= port1
->opaque
;
622 UHCIPort
*port
= &s
->ports
[port1
->index
];
624 /* set connect status */
625 if (port
->ctrl
& UHCI_PORT_CCS
) {
626 port
->ctrl
&= ~UHCI_PORT_CCS
;
627 port
->ctrl
|= UHCI_PORT_CSC
;
630 if (port
->ctrl
& UHCI_PORT_EN
) {
631 port
->ctrl
&= ~UHCI_PORT_EN
;
632 port
->ctrl
|= UHCI_PORT_ENC
;
638 static void uhci_wakeup(USBDevice
*dev
)
640 USBBus
*bus
= usb_bus_from_device(dev
);
641 UHCIState
*s
= container_of(bus
, UHCIState
, bus
);
642 UHCIPort
*port
= s
->ports
+ dev
->port
->index
;
644 if (port
->ctrl
& UHCI_PORT_SUSPEND
&& !(port
->ctrl
& UHCI_PORT_RD
)) {
645 port
->ctrl
|= UHCI_PORT_RD
;
650 static int uhci_broadcast_packet(UHCIState
*s
, USBPacket
*p
)
654 DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
655 pid2str(p
->pid
), p
->devaddr
, p
->devep
, p
->len
);
656 if (p
->pid
== USB_TOKEN_OUT
|| p
->pid
== USB_TOKEN_SETUP
)
657 dump_data(p
->data
, p
->len
);
660 for (i
= 0; i
< NB_PORTS
&& ret
== USB_RET_NODEV
; i
++) {
661 UHCIPort
*port
= &s
->ports
[i
];
662 USBDevice
*dev
= port
->port
.dev
;
664 if (dev
&& (port
->ctrl
& UHCI_PORT_EN
))
665 ret
= dev
->info
->handle_packet(dev
, p
);
668 DPRINTF("uhci: packet exit. ret %d len %d\n", ret
, p
->len
);
669 if (p
->pid
== USB_TOKEN_IN
&& ret
> 0)
670 dump_data(p
->data
, ret
);
675 static void uhci_async_complete(USBPacket
* packet
, void *opaque
);
676 static void uhci_process_frame(UHCIState
*s
);
678 /* return -1 if fatal error (frame must be stopped)
680 1 if TD unsuccessful or inactive
682 static int uhci_complete_td(UHCIState
*s
, UHCI_TD
*td
, UHCIAsync
*async
, uint32_t *int_mask
)
684 int len
= 0, max_len
, err
, ret
;
687 max_len
= ((td
->token
>> 21) + 1) & 0x7ff;
688 pid
= td
->token
& 0xff;
690 ret
= async
->packet
.len
;
692 if (td
->ctrl
& TD_CTRL_IOS
)
693 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
698 len
= async
->packet
.len
;
699 td
->ctrl
= (td
->ctrl
& ~0x7ff) | ((len
- 1) & 0x7ff);
701 /* The NAK bit may have been set by a previous frame, so clear it
702 here. The docs are somewhat unclear, but win2k relies on this
704 td
->ctrl
&= ~(TD_CTRL_ACTIVE
| TD_CTRL_NAK
);
705 if (td
->ctrl
& TD_CTRL_IOC
)
708 if (pid
== USB_TOKEN_IN
) {
710 ret
= USB_RET_BABBLE
;
715 /* write the data back */
716 cpu_physical_memory_write(td
->buffer
, async
->buffer
, len
);
719 if ((td
->ctrl
& TD_CTRL_SPD
) && len
< max_len
) {
721 /* short packet: do not update QH */
722 DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async
->td
, async
->token
);
733 td
->ctrl
|= TD_CTRL_STALL
;
734 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
738 td
->ctrl
|= TD_CTRL_BABBLE
| TD_CTRL_STALL
;
739 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
740 /* frame interrupted */
744 td
->ctrl
|= TD_CTRL_NAK
;
745 if (pid
== USB_TOKEN_SETUP
)
754 /* Retry the TD if error count is not zero */
756 td
->ctrl
|= TD_CTRL_TIMEOUT
;
757 err
= (td
->ctrl
>> TD_CTRL_ERROR_SHIFT
) & 3;
761 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
762 s
->status
|= UHCI_STS_USBERR
;
763 if (td
->ctrl
& TD_CTRL_IOC
)
768 td
->ctrl
= (td
->ctrl
& ~(3 << TD_CTRL_ERROR_SHIFT
)) |
769 (err
<< TD_CTRL_ERROR_SHIFT
);
773 static int uhci_handle_td(UHCIState
*s
, uint32_t addr
, UHCI_TD
*td
, uint32_t *int_mask
)
776 int len
= 0, max_len
;
781 if (!(td
->ctrl
& TD_CTRL_ACTIVE
))
784 /* token field is not unique for isochronous requests,
785 * so use the destination buffer
787 if (td
->ctrl
& TD_CTRL_IOS
) {
795 async
= uhci_async_find_td(s
, addr
, token
);
797 /* Already submitted */
803 uhci_async_unlink(s
, async
);
807 /* Allocate new packet */
808 async
= uhci_async_alloc(s
);
812 /* valid needs to be large enough to handle 10 frame delay
813 * for initial isochronous requests
817 async
->token
= token
;
820 max_len
= ((td
->token
>> 21) + 1) & 0x7ff;
821 pid
= td
->token
& 0xff;
823 async
->packet
.pid
= pid
;
824 async
->packet
.devaddr
= (td
->token
>> 8) & 0x7f;
825 async
->packet
.devep
= (td
->token
>> 15) & 0xf;
826 async
->packet
.data
= async
->buffer
;
827 async
->packet
.len
= max_len
;
828 async
->packet
.complete_cb
= uhci_async_complete
;
829 async
->packet
.complete_opaque
= s
;
833 case USB_TOKEN_SETUP
:
834 cpu_physical_memory_read(td
->buffer
, async
->buffer
, max_len
);
835 len
= uhci_broadcast_packet(s
, &async
->packet
);
841 len
= uhci_broadcast_packet(s
, &async
->packet
);
845 /* invalid pid : frame interrupted */
846 uhci_async_free(s
, async
);
847 s
->status
|= UHCI_STS_HCPERR
;
852 if (len
== USB_RET_ASYNC
) {
853 uhci_async_link(s
, async
);
857 async
->packet
.len
= len
;
860 len
= uhci_complete_td(s
, td
, async
, int_mask
);
861 uhci_async_free(s
, async
);
865 static void uhci_async_complete(USBPacket
*packet
, void *opaque
)
867 UHCIState
*s
= opaque
;
868 UHCIAsync
*async
= (UHCIAsync
*) packet
;
870 DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async
->td
, async
->token
);
874 uint32_t link
= async
->td
;
875 uint32_t int_mask
= 0, val
;
877 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &td
, sizeof(td
));
878 le32_to_cpus(&td
.link
);
879 le32_to_cpus(&td
.ctrl
);
880 le32_to_cpus(&td
.token
);
881 le32_to_cpus(&td
.buffer
);
883 uhci_async_unlink(s
, async
);
884 uhci_complete_td(s
, &td
, async
, &int_mask
);
885 s
->pending_int_mask
|= int_mask
;
887 /* update the status bits of the TD */
888 val
= cpu_to_le32(td
.ctrl
);
889 cpu_physical_memory_write((link
& ~0xf) + 4,
890 (const uint8_t *)&val
, sizeof(val
));
891 uhci_async_free(s
, async
);
894 uhci_process_frame(s
);
898 static int is_valid(uint32_t link
)
900 return (link
& 1) == 0;
903 static int is_qh(uint32_t link
)
905 return (link
& 2) != 0;
908 static int depth_first(uint32_t link
)
910 return (link
& 4) != 0;
913 /* QH DB used for detecting QH loops */
914 #define UHCI_MAX_QUEUES 128
916 uint32_t addr
[UHCI_MAX_QUEUES
];
920 static void qhdb_reset(QhDb
*db
)
925 /* Add QH to DB. Returns 1 if already present or DB is full. */
926 static int qhdb_insert(QhDb
*db
, uint32_t addr
)
929 for (i
= 0; i
< db
->count
; i
++)
930 if (db
->addr
[i
] == addr
)
933 if (db
->count
>= UHCI_MAX_QUEUES
)
936 db
->addr
[db
->count
++] = addr
;
940 static void uhci_process_frame(UHCIState
*s
)
942 uint32_t frame_addr
, link
, old_td_ctrl
, val
, int_mask
;
949 frame_addr
= s
->fl_base_addr
+ ((s
->frnum
& 0x3ff) << 2);
951 DPRINTF("uhci: processing frame %d addr 0x%x\n" , s
->frnum
, frame_addr
);
953 cpu_physical_memory_read(frame_addr
, (uint8_t *)&link
, 4);
961 for (cnt
= FRAME_MAX_LOOPS
; is_valid(link
) && cnt
; cnt
--) {
965 if (qhdb_insert(&qhdb
, link
)) {
967 * We're going in circles. Which is not a bug because
968 * HCD is allowed to do that as part of the BW management.
969 * In our case though it makes no sense to spin here. Sync transations
970 * are already done, and async completion handler will re-process
971 * the frame when something is ready.
973 DPRINTF("uhci: detected loop. qh 0x%x\n", link
);
977 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &qh
, sizeof(qh
));
978 le32_to_cpus(&qh
.link
);
979 le32_to_cpus(&qh
.el_link
);
981 DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
982 link
, qh
.link
, qh
.el_link
);
984 if (!is_valid(qh
.el_link
)) {
985 /* QH w/o elements */
989 /* QH with elements */
997 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &td
, sizeof(td
));
998 le32_to_cpus(&td
.link
);
999 le32_to_cpus(&td
.ctrl
);
1000 le32_to_cpus(&td
.token
);
1001 le32_to_cpus(&td
.buffer
);
1003 DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1004 link
, td
.link
, td
.ctrl
, td
.token
, curr_qh
);
1006 old_td_ctrl
= td
.ctrl
;
1007 ret
= uhci_handle_td(s
, link
, &td
, &int_mask
);
1008 if (old_td_ctrl
!= td
.ctrl
) {
1009 /* update the status bits of the TD */
1010 val
= cpu_to_le32(td
.ctrl
);
1011 cpu_physical_memory_write((link
& ~0xf) + 4,
1012 (const uint8_t *)&val
, sizeof(val
));
1016 /* interrupted frame */
1020 if (ret
== 2 || ret
== 1) {
1021 DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1022 link
, ret
== 2 ? "pend" : "skip",
1023 td
.link
, td
.ctrl
, td
.token
, curr_qh
);
1025 link
= curr_qh
? qh
.link
: td
.link
;
1031 DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1032 link
, td
.link
, td
.ctrl
, td
.token
, curr_qh
);
1037 /* update QH element link */
1039 val
= cpu_to_le32(qh
.el_link
);
1040 cpu_physical_memory_write((curr_qh
& ~0xf) + 4,
1041 (const uint8_t *)&val
, sizeof(val
));
1043 if (!depth_first(link
)) {
1044 /* done with this QH */
1046 DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1047 curr_qh
, qh
.link
, qh
.el_link
);
1054 /* go to the next entry */
1057 s
->pending_int_mask
|= int_mask
;
1060 static void uhci_frame_timer(void *opaque
)
1062 UHCIState
*s
= opaque
;
1064 /* prepare the timer for the next frame */
1065 s
->expire_time
+= (get_ticks_per_sec() / FRAME_TIMER_FREQ
);
1067 if (!(s
->cmd
& UHCI_CMD_RS
)) {
1069 qemu_del_timer(s
->frame_timer
);
1070 /* set hchalted bit in status - UHCI11D 2.1.2 */
1071 s
->status
|= UHCI_STS_HCHALTED
;
1073 DPRINTF("uhci: halted\n");
1077 /* Complete the previous frame */
1078 if (s
->pending_int_mask
) {
1079 s
->status2
|= s
->pending_int_mask
;
1080 s
->status
|= UHCI_STS_USBINT
;
1083 s
->pending_int_mask
= 0;
1085 /* Start new frame */
1086 s
->frnum
= (s
->frnum
+ 1) & 0x7ff;
1088 DPRINTF("uhci: new frame #%u\n" , s
->frnum
);
1090 uhci_async_validate_begin(s
);
1092 uhci_process_frame(s
);
1094 uhci_async_validate_end(s
);
1096 qemu_mod_timer(s
->frame_timer
, s
->expire_time
);
1099 static void uhci_map(PCIDevice
*pci_dev
, int region_num
,
1100 pcibus_t addr
, pcibus_t size
, int type
)
1102 UHCIState
*s
= (UHCIState
*)pci_dev
;
1104 register_ioport_write(addr
, 32, 2, uhci_ioport_writew
, s
);
1105 register_ioport_read(addr
, 32, 2, uhci_ioport_readw
, s
);
1106 register_ioport_write(addr
, 32, 4, uhci_ioport_writel
, s
);
1107 register_ioport_read(addr
, 32, 4, uhci_ioport_readl
, s
);
1108 register_ioport_write(addr
, 32, 1, uhci_ioport_writeb
, s
);
1109 register_ioport_read(addr
, 32, 1, uhci_ioport_readb
, s
);
1112 static USBPortOps uhci_port_ops
= {
1113 .attach
= uhci_attach
,
1114 .detach
= uhci_detach
,
1115 .wakeup
= uhci_wakeup
,
1118 static int usb_uhci_common_initfn(UHCIState
*s
)
1120 uint8_t *pci_conf
= s
->dev
.config
;
1123 pci_conf
[PCI_REVISION_ID
] = 0x01; // revision number
1124 pci_conf
[PCI_CLASS_PROG
] = 0x00;
1125 pci_config_set_class(pci_conf
, PCI_CLASS_SERIAL_USB
);
1126 /* TODO: reset value should be 0. */
1127 pci_conf
[PCI_INTERRUPT_PIN
] = 4; // interrupt pin 3
1128 pci_conf
[0x60] = 0x10; // release number
1130 usb_bus_new(&s
->bus
, &s
->dev
.qdev
);
1131 for(i
= 0; i
< NB_PORTS
; i
++) {
1132 usb_register_port(&s
->bus
, &s
->ports
[i
].port
, s
, i
, NULL
, &uhci_port_ops
);
1134 s
->frame_timer
= qemu_new_timer(vm_clock
, uhci_frame_timer
, s
);
1135 s
->expire_time
= qemu_get_clock(vm_clock
) +
1136 (get_ticks_per_sec() / FRAME_TIMER_FREQ
);
1137 s
->num_ports_vmstate
= NB_PORTS
;
1139 qemu_register_reset(uhci_reset
, s
);
1141 /* Use region 4 for consistency with real hardware. BSD guests seem
1143 pci_register_bar(&s
->dev
, 4, 0x20,
1144 PCI_BASE_ADDRESS_SPACE_IO
, uhci_map
);
1149 static int usb_uhci_piix3_initfn(PCIDevice
*dev
)
1151 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1152 uint8_t *pci_conf
= s
->dev
.config
;
1154 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_INTEL
);
1155 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_INTEL_82371SB_2
);
1156 return usb_uhci_common_initfn(s
);
1159 static int usb_uhci_piix4_initfn(PCIDevice
*dev
)
1161 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1162 uint8_t *pci_conf
= s
->dev
.config
;
1164 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_INTEL
);
1165 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_INTEL_82371AB_2
);
1166 return usb_uhci_common_initfn(s
);
1169 static int usb_uhci_vt82c686b_initfn(PCIDevice
*dev
)
1171 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1172 uint8_t *pci_conf
= s
->dev
.config
;
1174 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_VIA
);
1175 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_VIA_UHCI
);
1177 /* USB misc control 1/2 */
1178 pci_set_long(pci_conf
+ 0x40,0x00001000);
1180 pci_set_long(pci_conf
+ 0x80,0x00020001);
1181 /* USB legacy support */
1182 pci_set_long(pci_conf
+ 0xc0,0x00002000);
1184 return usb_uhci_common_initfn(s
);
1187 static PCIDeviceInfo uhci_info
[] = {
1189 .qdev
.name
= "piix3-usb-uhci",
1190 .qdev
.size
= sizeof(UHCIState
),
1191 .qdev
.vmsd
= &vmstate_uhci
,
1192 .init
= usb_uhci_piix3_initfn
,
1194 .qdev
.name
= "piix4-usb-uhci",
1195 .qdev
.size
= sizeof(UHCIState
),
1196 .qdev
.vmsd
= &vmstate_uhci
,
1197 .init
= usb_uhci_piix4_initfn
,
1199 .qdev
.name
= "vt82c686b-usb-uhci",
1200 .qdev
.size
= sizeof(UHCIState
),
1201 .qdev
.vmsd
= &vmstate_uhci
,
1202 .init
= usb_uhci_vt82c686b_initfn
,
1208 static void uhci_register(void)
1210 pci_qdev_register_many(uhci_info
);
1212 device_init(uhci_register
);
1214 void usb_uhci_piix3_init(PCIBus
*bus
, int devfn
)
1216 pci_create_simple(bus
, devfn
, "piix3-usb-uhci");
1219 void usb_uhci_piix4_init(PCIBus
*bus
, int devfn
)
1221 pci_create_simple(bus
, devfn
, "piix4-usb-uhci");
1224 void usb_uhci_vt82c686b_init(PCIBus
*bus
, int devfn
)
1226 pci_create_simple(bus
, devfn
, "vt82c686b-usb-uhci");