arm host: Fix linker warning (m68k targets)
[qemu.git] / hw / usb-uhci.c
blob335b66887aa7ecdd57025f213fbcbec5fc1b2ec1
1 /*
2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
28 #include "hw.h"
29 #include "usb.h"
30 #include "pci.h"
31 #include "qemu-timer.h"
32 #include "usb-uhci.h"
34 //#define DEBUG
35 //#define DEBUG_DUMP_DATA
37 #define UHCI_CMD_FGR (1 << 4)
38 #define UHCI_CMD_EGSM (1 << 3)
39 #define UHCI_CMD_GRESET (1 << 2)
40 #define UHCI_CMD_HCRESET (1 << 1)
41 #define UHCI_CMD_RS (1 << 0)
43 #define UHCI_STS_HCHALTED (1 << 5)
44 #define UHCI_STS_HCPERR (1 << 4)
45 #define UHCI_STS_HSERR (1 << 3)
46 #define UHCI_STS_RD (1 << 2)
47 #define UHCI_STS_USBERR (1 << 1)
48 #define UHCI_STS_USBINT (1 << 0)
50 #define TD_CTRL_SPD (1 << 29)
51 #define TD_CTRL_ERROR_SHIFT 27
52 #define TD_CTRL_IOS (1 << 25)
53 #define TD_CTRL_IOC (1 << 24)
54 #define TD_CTRL_ACTIVE (1 << 23)
55 #define TD_CTRL_STALL (1 << 22)
56 #define TD_CTRL_BABBLE (1 << 20)
57 #define TD_CTRL_NAK (1 << 19)
58 #define TD_CTRL_TIMEOUT (1 << 18)
60 #define UHCI_PORT_RESET (1 << 9)
61 #define UHCI_PORT_LSDA (1 << 8)
62 #define UHCI_PORT_ENC (1 << 3)
63 #define UHCI_PORT_EN (1 << 2)
64 #define UHCI_PORT_CSC (1 << 1)
65 #define UHCI_PORT_CCS (1 << 0)
67 #define FRAME_TIMER_FREQ 1000
69 #define FRAME_MAX_LOOPS 100
71 #define NB_PORTS 2
73 #ifdef DEBUG
74 #define DPRINTF printf
76 static const char *pid2str(int pid)
78 switch (pid) {
79 case USB_TOKEN_SETUP: return "SETUP";
80 case USB_TOKEN_IN: return "IN";
81 case USB_TOKEN_OUT: return "OUT";
83 return "?";
86 #else
87 #define DPRINTF(...)
88 #endif
90 #ifdef DEBUG_DUMP_DATA
91 static void dump_data(const uint8_t *data, int len)
93 int i;
95 printf("uhci: data: ");
96 for(i = 0; i < len; i++)
97 printf(" %02x", data[i]);
98 printf("\n");
100 #else
101 static void dump_data(const uint8_t *data, int len) {}
102 #endif
105 * Pending async transaction.
106 * 'packet' must be the first field because completion
107 * handler does "(UHCIAsync *) pkt" cast.
109 typedef struct UHCIAsync {
110 USBPacket packet;
111 struct UHCIAsync *next;
112 uint32_t td;
113 uint32_t token;
114 int8_t valid;
115 uint8_t isoc;
116 uint8_t done;
117 uint8_t buffer[2048];
118 } UHCIAsync;
120 typedef struct UHCIPort {
121 USBPort port;
122 uint16_t ctrl;
123 } UHCIPort;
125 typedef struct UHCIState {
126 PCIDevice dev;
127 USBBus bus;
128 uint16_t cmd; /* cmd register */
129 uint16_t status;
130 uint16_t intr; /* interrupt enable register */
131 uint16_t frnum; /* frame number */
132 uint32_t fl_base_addr; /* frame list base address */
133 uint8_t sof_timing;
134 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
135 int64_t expire_time;
136 QEMUTimer *frame_timer;
137 UHCIPort ports[NB_PORTS];
139 /* Interrupts that should be raised at the end of the current frame. */
140 uint32_t pending_int_mask;
142 /* Active packets */
143 UHCIAsync *async_pending;
144 UHCIAsync *async_pool;
145 uint8_t num_ports_vmstate;
146 } UHCIState;
148 typedef struct UHCI_TD {
149 uint32_t link;
150 uint32_t ctrl; /* see TD_CTRL_xxx */
151 uint32_t token;
152 uint32_t buffer;
153 } UHCI_TD;
155 typedef struct UHCI_QH {
156 uint32_t link;
157 uint32_t el_link;
158 } UHCI_QH;
160 static UHCIAsync *uhci_async_alloc(UHCIState *s)
162 UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
164 memset(&async->packet, 0, sizeof(async->packet));
165 async->valid = 0;
166 async->td = 0;
167 async->token = 0;
168 async->done = 0;
169 async->isoc = 0;
170 async->next = NULL;
172 return async;
175 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
177 qemu_free(async);
180 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
182 async->next = s->async_pending;
183 s->async_pending = async;
186 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
188 UHCIAsync *curr = s->async_pending;
189 UHCIAsync **prev = &s->async_pending;
191 while (curr) {
192 if (curr == async) {
193 *prev = curr->next;
194 return;
197 prev = &curr->next;
198 curr = curr->next;
202 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
204 DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
205 async->td, async->token, async->done);
207 if (!async->done)
208 usb_cancel_packet(&async->packet);
209 uhci_async_free(s, async);
213 * Mark all outstanding async packets as invalid.
214 * This is used for canceling them when TDs are removed by the HCD.
216 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
218 UHCIAsync *async = s->async_pending;
220 while (async) {
221 async->valid--;
222 async = async->next;
224 return NULL;
228 * Cancel async packets that are no longer valid
230 static void uhci_async_validate_end(UHCIState *s)
232 UHCIAsync *curr = s->async_pending;
233 UHCIAsync **prev = &s->async_pending;
234 UHCIAsync *next;
236 while (curr) {
237 if (curr->valid > 0) {
238 prev = &curr->next;
239 curr = curr->next;
240 continue;
243 next = curr->next;
245 /* Unlink */
246 *prev = next;
248 uhci_async_cancel(s, curr);
250 curr = next;
254 static void uhci_async_cancel_all(UHCIState *s)
256 UHCIAsync *curr = s->async_pending;
257 UHCIAsync *next;
259 while (curr) {
260 next = curr->next;
262 uhci_async_cancel(s, curr);
264 curr = next;
267 s->async_pending = NULL;
270 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
272 UHCIAsync *async = s->async_pending;
273 UHCIAsync *match = NULL;
274 int count = 0;
277 * We're looking for the best match here. ie both td addr and token.
278 * Otherwise we return last good match. ie just token.
279 * It's ok to match just token because it identifies the transaction
280 * rather well, token includes: device addr, endpoint, size, etc.
282 * Also since we queue async transactions in reverse order by returning
283 * last good match we restores the order.
285 * It's expected that we wont have a ton of outstanding transactions.
286 * If we ever do we'd want to optimize this algorithm.
289 while (async) {
290 if (async->token == token) {
291 /* Good match */
292 match = async;
294 if (async->td == addr) {
295 /* Best match */
296 break;
300 async = async->next;
301 count++;
304 if (count > 64)
305 fprintf(stderr, "uhci: warning lots of async transactions\n");
307 return match;
310 static void uhci_attach(USBPort *port1, USBDevice *dev);
312 static void uhci_update_irq(UHCIState *s)
314 int level;
315 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
316 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
317 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
318 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
319 (s->status & UHCI_STS_HSERR) ||
320 (s->status & UHCI_STS_HCPERR)) {
321 level = 1;
322 } else {
323 level = 0;
325 qemu_set_irq(s->dev.irq[3], level);
328 static void uhci_reset(void *opaque)
330 UHCIState *s = opaque;
331 uint8_t *pci_conf;
332 int i;
333 UHCIPort *port;
335 DPRINTF("uhci: full reset\n");
337 pci_conf = s->dev.config;
339 pci_conf[0x6a] = 0x01; /* usb clock */
340 pci_conf[0x6b] = 0x00;
341 s->cmd = 0;
342 s->status = 0;
343 s->status2 = 0;
344 s->intr = 0;
345 s->fl_base_addr = 0;
346 s->sof_timing = 64;
348 for(i = 0; i < NB_PORTS; i++) {
349 port = &s->ports[i];
350 port->ctrl = 0x0080;
351 if (port->port.dev)
352 uhci_attach(&port->port, port->port.dev);
355 uhci_async_cancel_all(s);
358 static void uhci_pre_save(void *opaque)
360 UHCIState *s = opaque;
362 uhci_async_cancel_all(s);
365 static const VMStateDescription vmstate_uhci_port = {
366 .name = "uhci port",
367 .version_id = 1,
368 .minimum_version_id = 1,
369 .minimum_version_id_old = 1,
370 .fields = (VMStateField []) {
371 VMSTATE_UINT16(ctrl, UHCIPort),
372 VMSTATE_END_OF_LIST()
376 static const VMStateDescription vmstate_uhci = {
377 .name = "uhci",
378 .version_id = 1,
379 .minimum_version_id = 1,
380 .minimum_version_id_old = 1,
381 .pre_save = uhci_pre_save,
382 .fields = (VMStateField []) {
383 VMSTATE_PCI_DEVICE(dev, UHCIState),
384 VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
385 VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
386 vmstate_uhci_port, UHCIPort),
387 VMSTATE_UINT16(cmd, UHCIState),
388 VMSTATE_UINT16(status, UHCIState),
389 VMSTATE_UINT16(intr, UHCIState),
390 VMSTATE_UINT16(frnum, UHCIState),
391 VMSTATE_UINT32(fl_base_addr, UHCIState),
392 VMSTATE_UINT8(sof_timing, UHCIState),
393 VMSTATE_UINT8(status2, UHCIState),
394 VMSTATE_TIMER(frame_timer, UHCIState),
395 VMSTATE_END_OF_LIST()
399 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
401 UHCIState *s = opaque;
403 addr &= 0x1f;
404 switch(addr) {
405 case 0x0c:
406 s->sof_timing = val;
407 break;
411 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
413 UHCIState *s = opaque;
414 uint32_t val;
416 addr &= 0x1f;
417 switch(addr) {
418 case 0x0c:
419 val = s->sof_timing;
420 break;
421 default:
422 val = 0xff;
423 break;
425 return val;
428 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
430 UHCIState *s = opaque;
432 addr &= 0x1f;
433 DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
435 switch(addr) {
436 case 0x00:
437 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
438 /* start frame processing */
439 qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
440 s->status &= ~UHCI_STS_HCHALTED;
441 } else if (!(val & UHCI_CMD_RS)) {
442 s->status |= UHCI_STS_HCHALTED;
444 if (val & UHCI_CMD_GRESET) {
445 UHCIPort *port;
446 USBDevice *dev;
447 int i;
449 /* send reset on the USB bus */
450 for(i = 0; i < NB_PORTS; i++) {
451 port = &s->ports[i];
452 dev = port->port.dev;
453 if (dev) {
454 usb_send_msg(dev, USB_MSG_RESET);
457 uhci_reset(s);
458 return;
460 if (val & UHCI_CMD_HCRESET) {
461 uhci_reset(s);
462 return;
464 s->cmd = val;
465 break;
466 case 0x02:
467 s->status &= ~val;
468 /* XXX: the chip spec is not coherent, so we add a hidden
469 register to distinguish between IOC and SPD */
470 if (val & UHCI_STS_USBINT)
471 s->status2 = 0;
472 uhci_update_irq(s);
473 break;
474 case 0x04:
475 s->intr = val;
476 uhci_update_irq(s);
477 break;
478 case 0x06:
479 if (s->status & UHCI_STS_HCHALTED)
480 s->frnum = val & 0x7ff;
481 break;
482 case 0x10 ... 0x1f:
484 UHCIPort *port;
485 USBDevice *dev;
486 int n;
488 n = (addr >> 1) & 7;
489 if (n >= NB_PORTS)
490 return;
491 port = &s->ports[n];
492 dev = port->port.dev;
493 if (dev) {
494 /* port reset */
495 if ( (val & UHCI_PORT_RESET) &&
496 !(port->ctrl & UHCI_PORT_RESET) ) {
497 usb_send_msg(dev, USB_MSG_RESET);
500 port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
501 /* some bits are reset when a '1' is written to them */
502 port->ctrl &= ~(val & 0x000a);
504 break;
508 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
510 UHCIState *s = opaque;
511 uint32_t val;
513 addr &= 0x1f;
514 switch(addr) {
515 case 0x00:
516 val = s->cmd;
517 break;
518 case 0x02:
519 val = s->status;
520 break;
521 case 0x04:
522 val = s->intr;
523 break;
524 case 0x06:
525 val = s->frnum;
526 break;
527 case 0x10 ... 0x1f:
529 UHCIPort *port;
530 int n;
531 n = (addr >> 1) & 7;
532 if (n >= NB_PORTS)
533 goto read_default;
534 port = &s->ports[n];
535 val = port->ctrl;
537 break;
538 default:
539 read_default:
540 val = 0xff7f; /* disabled port */
541 break;
544 DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
546 return val;
549 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
551 UHCIState *s = opaque;
553 addr &= 0x1f;
554 DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
556 switch(addr) {
557 case 0x08:
558 s->fl_base_addr = val & ~0xfff;
559 break;
563 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
565 UHCIState *s = opaque;
566 uint32_t val;
568 addr &= 0x1f;
569 switch(addr) {
570 case 0x08:
571 val = s->fl_base_addr;
572 break;
573 default:
574 val = 0xffffffff;
575 break;
577 return val;
580 /* signal resume if controller suspended */
581 static void uhci_resume (void *opaque)
583 UHCIState *s = (UHCIState *)opaque;
585 if (!s)
586 return;
588 if (s->cmd & UHCI_CMD_EGSM) {
589 s->cmd |= UHCI_CMD_FGR;
590 s->status |= UHCI_STS_RD;
591 uhci_update_irq(s);
595 static void uhci_attach(USBPort *port1, USBDevice *dev)
597 UHCIState *s = port1->opaque;
598 UHCIPort *port = &s->ports[port1->index];
600 if (dev) {
601 if (port->port.dev) {
602 usb_attach(port1, NULL);
604 /* set connect status */
605 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
607 /* update speed */
608 if (dev->speed == USB_SPEED_LOW)
609 port->ctrl |= UHCI_PORT_LSDA;
610 else
611 port->ctrl &= ~UHCI_PORT_LSDA;
613 uhci_resume(s);
615 port->port.dev = dev;
616 /* send the attach message */
617 usb_send_msg(dev, USB_MSG_ATTACH);
618 } else {
619 /* set connect status */
620 if (port->ctrl & UHCI_PORT_CCS) {
621 port->ctrl &= ~UHCI_PORT_CCS;
622 port->ctrl |= UHCI_PORT_CSC;
624 /* disable port */
625 if (port->ctrl & UHCI_PORT_EN) {
626 port->ctrl &= ~UHCI_PORT_EN;
627 port->ctrl |= UHCI_PORT_ENC;
630 uhci_resume(s);
632 dev = port->port.dev;
633 if (dev) {
634 /* send the detach message */
635 usb_send_msg(dev, USB_MSG_DETACH);
637 port->port.dev = NULL;
641 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
643 int i, ret;
645 DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
646 pid2str(p->pid), p->devaddr, p->devep, p->len);
647 if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
648 dump_data(p->data, p->len);
650 ret = USB_RET_NODEV;
651 for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
652 UHCIPort *port = &s->ports[i];
653 USBDevice *dev = port->port.dev;
655 if (dev && (port->ctrl & UHCI_PORT_EN))
656 ret = dev->info->handle_packet(dev, p);
659 DPRINTF("uhci: packet exit. ret %d len %d\n", ret, p->len);
660 if (p->pid == USB_TOKEN_IN && ret > 0)
661 dump_data(p->data, ret);
663 return ret;
666 static void uhci_async_complete(USBPacket * packet, void *opaque);
667 static void uhci_process_frame(UHCIState *s);
669 /* return -1 if fatal error (frame must be stopped)
670 0 if TD successful
671 1 if TD unsuccessful or inactive
673 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
675 int len = 0, max_len, err, ret;
676 uint8_t pid;
678 max_len = ((td->token >> 21) + 1) & 0x7ff;
679 pid = td->token & 0xff;
681 ret = async->packet.len;
683 if (td->ctrl & TD_CTRL_IOC)
684 *int_mask |= 0x01;
686 if (td->ctrl & TD_CTRL_IOS)
687 td->ctrl &= ~TD_CTRL_ACTIVE;
689 if (ret < 0)
690 goto out;
692 len = async->packet.len;
693 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
695 /* The NAK bit may have been set by a previous frame, so clear it
696 here. The docs are somewhat unclear, but win2k relies on this
697 behavior. */
698 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
700 if (pid == USB_TOKEN_IN) {
701 if (len > max_len) {
702 len = max_len;
703 ret = USB_RET_BABBLE;
704 goto out;
707 if (len > 0) {
708 /* write the data back */
709 cpu_physical_memory_write(td->buffer, async->buffer, len);
712 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
713 *int_mask |= 0x02;
714 /* short packet: do not update QH */
715 DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
716 return 1;
720 /* success */
721 return 0;
723 out:
724 switch(ret) {
725 case USB_RET_STALL:
726 td->ctrl |= TD_CTRL_STALL;
727 td->ctrl &= ~TD_CTRL_ACTIVE;
728 return 1;
730 case USB_RET_BABBLE:
731 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
732 td->ctrl &= ~TD_CTRL_ACTIVE;
733 /* frame interrupted */
734 return -1;
736 case USB_RET_NAK:
737 td->ctrl |= TD_CTRL_NAK;
738 if (pid == USB_TOKEN_SETUP)
739 break;
740 return 1;
742 case USB_RET_NODEV:
743 default:
744 break;
747 /* Retry the TD if error count is not zero */
749 td->ctrl |= TD_CTRL_TIMEOUT;
750 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
751 if (err != 0) {
752 err--;
753 if (err == 0) {
754 td->ctrl &= ~TD_CTRL_ACTIVE;
755 s->status |= UHCI_STS_USBERR;
756 uhci_update_irq(s);
759 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
760 (err << TD_CTRL_ERROR_SHIFT);
761 return 1;
764 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
766 UHCIAsync *async;
767 int len = 0, max_len;
768 uint8_t pid, isoc;
769 uint32_t token;
771 /* Is active ? */
772 if (!(td->ctrl & TD_CTRL_ACTIVE))
773 return 1;
775 /* token field is not unique for isochronous requests,
776 * so use the destination buffer
778 if (td->ctrl & TD_CTRL_IOS) {
779 token = td->buffer;
780 isoc = 1;
781 } else {
782 token = td->token;
783 isoc = 0;
786 async = uhci_async_find_td(s, addr, token);
787 if (async) {
788 /* Already submitted */
789 async->valid = 32;
791 if (!async->done)
792 return 1;
794 uhci_async_unlink(s, async);
795 goto done;
798 /* Allocate new packet */
799 async = uhci_async_alloc(s);
800 if (!async)
801 return 1;
803 /* valid needs to be large enough to handle 10 frame delay
804 * for initial isochronous requests
806 async->valid = 32;
807 async->td = addr;
808 async->token = token;
809 async->isoc = isoc;
811 max_len = ((td->token >> 21) + 1) & 0x7ff;
812 pid = td->token & 0xff;
814 async->packet.pid = pid;
815 async->packet.devaddr = (td->token >> 8) & 0x7f;
816 async->packet.devep = (td->token >> 15) & 0xf;
817 async->packet.data = async->buffer;
818 async->packet.len = max_len;
819 async->packet.complete_cb = uhci_async_complete;
820 async->packet.complete_opaque = s;
822 switch(pid) {
823 case USB_TOKEN_OUT:
824 case USB_TOKEN_SETUP:
825 cpu_physical_memory_read(td->buffer, async->buffer, max_len);
826 len = uhci_broadcast_packet(s, &async->packet);
827 if (len >= 0)
828 len = max_len;
829 break;
831 case USB_TOKEN_IN:
832 len = uhci_broadcast_packet(s, &async->packet);
833 break;
835 default:
836 /* invalid pid : frame interrupted */
837 uhci_async_free(s, async);
838 s->status |= UHCI_STS_HCPERR;
839 uhci_update_irq(s);
840 return -1;
843 if (len == USB_RET_ASYNC) {
844 uhci_async_link(s, async);
845 return 2;
848 async->packet.len = len;
850 done:
851 len = uhci_complete_td(s, td, async, int_mask);
852 uhci_async_free(s, async);
853 return len;
856 static void uhci_async_complete(USBPacket *packet, void *opaque)
858 UHCIState *s = opaque;
859 UHCIAsync *async = (UHCIAsync *) packet;
861 DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
863 if (async->isoc) {
864 UHCI_TD td;
865 uint32_t link = async->td;
866 uint32_t int_mask = 0, val;
867 int len;
869 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
870 le32_to_cpus(&td.link);
871 le32_to_cpus(&td.ctrl);
872 le32_to_cpus(&td.token);
873 le32_to_cpus(&td.buffer);
875 uhci_async_unlink(s, async);
876 len = uhci_complete_td(s, &td, async, &int_mask);
877 s->pending_int_mask |= int_mask;
879 /* update the status bits of the TD */
880 val = cpu_to_le32(td.ctrl);
881 cpu_physical_memory_write((link & ~0xf) + 4,
882 (const uint8_t *)&val, sizeof(val));
883 uhci_async_free(s, async);
884 } else {
885 async->done = 1;
886 uhci_process_frame(s);
890 static int is_valid(uint32_t link)
892 return (link & 1) == 0;
895 static int is_qh(uint32_t link)
897 return (link & 2) != 0;
900 static int depth_first(uint32_t link)
902 return (link & 4) != 0;
905 /* QH DB used for detecting QH loops */
906 #define UHCI_MAX_QUEUES 128
907 typedef struct {
908 uint32_t addr[UHCI_MAX_QUEUES];
909 int count;
910 } QhDb;
912 static void qhdb_reset(QhDb *db)
914 db->count = 0;
917 /* Add QH to DB. Returns 1 if already present or DB is full. */
918 static int qhdb_insert(QhDb *db, uint32_t addr)
920 int i;
921 for (i = 0; i < db->count; i++)
922 if (db->addr[i] == addr)
923 return 1;
925 if (db->count >= UHCI_MAX_QUEUES)
926 return 1;
928 db->addr[db->count++] = addr;
929 return 0;
932 static void uhci_process_frame(UHCIState *s)
934 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
935 uint32_t curr_qh;
936 int cnt, ret;
937 UHCI_TD td;
938 UHCI_QH qh;
939 QhDb qhdb;
941 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
943 DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
945 cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
946 le32_to_cpus(&link);
948 int_mask = 0;
949 curr_qh = 0;
951 qhdb_reset(&qhdb);
953 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
954 if (is_qh(link)) {
955 /* QH */
957 if (qhdb_insert(&qhdb, link)) {
959 * We're going in circles. Which is not a bug because
960 * HCD is allowed to do that as part of the BW management.
961 * In our case though it makes no sense to spin here. Sync transations
962 * are already done, and async completion handler will re-process
963 * the frame when something is ready.
965 DPRINTF("uhci: detected loop. qh 0x%x\n", link);
966 break;
969 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
970 le32_to_cpus(&qh.link);
971 le32_to_cpus(&qh.el_link);
973 DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
974 link, qh.link, qh.el_link);
976 if (!is_valid(qh.el_link)) {
977 /* QH w/o elements */
978 curr_qh = 0;
979 link = qh.link;
980 } else {
981 /* QH with elements */
982 curr_qh = link;
983 link = qh.el_link;
985 continue;
988 /* TD */
989 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
990 le32_to_cpus(&td.link);
991 le32_to_cpus(&td.ctrl);
992 le32_to_cpus(&td.token);
993 le32_to_cpus(&td.buffer);
995 DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
996 link, td.link, td.ctrl, td.token, curr_qh);
998 old_td_ctrl = td.ctrl;
999 ret = uhci_handle_td(s, link, &td, &int_mask);
1000 if (old_td_ctrl != td.ctrl) {
1001 /* update the status bits of the TD */
1002 val = cpu_to_le32(td.ctrl);
1003 cpu_physical_memory_write((link & ~0xf) + 4,
1004 (const uint8_t *)&val, sizeof(val));
1007 if (ret < 0) {
1008 /* interrupted frame */
1009 break;
1012 if (ret == 2 || ret == 1) {
1013 DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1014 link, ret == 2 ? "pend" : "skip",
1015 td.link, td.ctrl, td.token, curr_qh);
1017 link = curr_qh ? qh.link : td.link;
1018 continue;
1021 /* completed TD */
1023 DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1024 link, td.link, td.ctrl, td.token, curr_qh);
1026 link = td.link;
1028 if (curr_qh) {
1029 /* update QH element link */
1030 qh.el_link = link;
1031 val = cpu_to_le32(qh.el_link);
1032 cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1033 (const uint8_t *)&val, sizeof(val));
1035 if (!depth_first(link)) {
1036 /* done with this QH */
1038 DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1039 curr_qh, qh.link, qh.el_link);
1041 curr_qh = 0;
1042 link = qh.link;
1046 /* go to the next entry */
1049 s->pending_int_mask |= int_mask;
1052 static void uhci_frame_timer(void *opaque)
1054 UHCIState *s = opaque;
1056 /* prepare the timer for the next frame */
1057 s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1059 if (!(s->cmd & UHCI_CMD_RS)) {
1060 /* Full stop */
1061 qemu_del_timer(s->frame_timer);
1062 /* set hchalted bit in status - UHCI11D 2.1.2 */
1063 s->status |= UHCI_STS_HCHALTED;
1065 DPRINTF("uhci: halted\n");
1066 return;
1069 /* Complete the previous frame */
1070 if (s->pending_int_mask) {
1071 s->status2 |= s->pending_int_mask;
1072 s->status |= UHCI_STS_USBINT;
1073 uhci_update_irq(s);
1075 s->pending_int_mask = 0;
1077 /* Start new frame */
1078 s->frnum = (s->frnum + 1) & 0x7ff;
1080 DPRINTF("uhci: new frame #%u\n" , s->frnum);
1082 uhci_async_validate_begin(s);
1084 uhci_process_frame(s);
1086 uhci_async_validate_end(s);
1088 qemu_mod_timer(s->frame_timer, s->expire_time);
1091 static void uhci_map(PCIDevice *pci_dev, int region_num,
1092 pcibus_t addr, pcibus_t size, int type)
1094 UHCIState *s = (UHCIState *)pci_dev;
1096 register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1097 register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1098 register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1099 register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1100 register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1101 register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1104 static int usb_uhci_common_initfn(UHCIState *s)
1106 uint8_t *pci_conf = s->dev.config;
1107 int i;
1109 pci_conf[PCI_REVISION_ID] = 0x01; // revision number
1110 pci_conf[PCI_CLASS_PROG] = 0x00;
1111 pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1112 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1113 /* TODO: reset value should be 0. */
1114 pci_conf[PCI_INTERRUPT_PIN] = 4; // interrupt pin 3
1115 pci_conf[0x60] = 0x10; // release number
1117 usb_bus_new(&s->bus, &s->dev.qdev);
1118 for(i = 0; i < NB_PORTS; i++) {
1119 usb_register_port(&s->bus, &s->ports[i].port, s, i, uhci_attach);
1121 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1122 s->expire_time = qemu_get_clock(vm_clock) +
1123 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1124 s->num_ports_vmstate = NB_PORTS;
1126 qemu_register_reset(uhci_reset, s);
1128 /* Use region 4 for consistency with real hardware. BSD guests seem
1129 to rely on this. */
1130 pci_register_bar(&s->dev, 4, 0x20,
1131 PCI_BASE_ADDRESS_SPACE_IO, uhci_map);
1133 return 0;
1136 static int usb_uhci_piix3_initfn(PCIDevice *dev)
1138 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1139 uint8_t *pci_conf = s->dev.config;
1141 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1142 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
1143 return usb_uhci_common_initfn(s);
1146 static int usb_uhci_piix4_initfn(PCIDevice *dev)
1148 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1149 uint8_t *pci_conf = s->dev.config;
1151 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1152 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
1153 return usb_uhci_common_initfn(s);
1156 static PCIDeviceInfo uhci_info[] = {
1158 .qdev.name = "piix3-usb-uhci",
1159 .qdev.size = sizeof(UHCIState),
1160 .qdev.vmsd = &vmstate_uhci,
1161 .init = usb_uhci_piix3_initfn,
1163 .qdev.name = "piix4-usb-uhci",
1164 .qdev.size = sizeof(UHCIState),
1165 .qdev.vmsd = &vmstate_uhci,
1166 .init = usb_uhci_piix4_initfn,
1168 /* end of list */
1172 static void uhci_register(void)
1174 pci_qdev_register_many(uhci_info);
1176 device_init(uhci_register);
1178 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1180 pci_create_simple(bus, devfn, "piix3-usb-uhci");
1183 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1185 pci_create_simple(bus, devfn, "piix4-usb-uhci");