uhci: Add a completions_only flag for async completions
[qemu/ar7.git] / hw / usb / hcd-uhci.c
blobef326330d30b55c954ee2021e5d82d71e41cf772
1 /*
2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
28 #include "hw/hw.h"
29 #include "hw/usb.h"
30 #include "hw/pci.h"
31 #include "qemu-timer.h"
32 #include "iov.h"
33 #include "dma.h"
34 #include "trace.h"
36 //#define DEBUG
37 //#define DEBUG_DUMP_DATA
39 #define UHCI_CMD_FGR (1 << 4)
40 #define UHCI_CMD_EGSM (1 << 3)
41 #define UHCI_CMD_GRESET (1 << 2)
42 #define UHCI_CMD_HCRESET (1 << 1)
43 #define UHCI_CMD_RS (1 << 0)
45 #define UHCI_STS_HCHALTED (1 << 5)
46 #define UHCI_STS_HCPERR (1 << 4)
47 #define UHCI_STS_HSERR (1 << 3)
48 #define UHCI_STS_RD (1 << 2)
49 #define UHCI_STS_USBERR (1 << 1)
50 #define UHCI_STS_USBINT (1 << 0)
52 #define TD_CTRL_SPD (1 << 29)
53 #define TD_CTRL_ERROR_SHIFT 27
54 #define TD_CTRL_IOS (1 << 25)
55 #define TD_CTRL_IOC (1 << 24)
56 #define TD_CTRL_ACTIVE (1 << 23)
57 #define TD_CTRL_STALL (1 << 22)
58 #define TD_CTRL_BABBLE (1 << 20)
59 #define TD_CTRL_NAK (1 << 19)
60 #define TD_CTRL_TIMEOUT (1 << 18)
62 #define UHCI_PORT_SUSPEND (1 << 12)
63 #define UHCI_PORT_RESET (1 << 9)
64 #define UHCI_PORT_LSDA (1 << 8)
65 #define UHCI_PORT_RD (1 << 6)
66 #define UHCI_PORT_ENC (1 << 3)
67 #define UHCI_PORT_EN (1 << 2)
68 #define UHCI_PORT_CSC (1 << 1)
69 #define UHCI_PORT_CCS (1 << 0)
71 #define UHCI_PORT_READ_ONLY (0x1bb)
72 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
74 #define FRAME_TIMER_FREQ 1000
76 #define FRAME_MAX_LOOPS 256
78 #define NB_PORTS 2
80 enum {
81 TD_RESULT_STOP_FRAME = 10,
82 TD_RESULT_COMPLETE,
83 TD_RESULT_NEXT_QH,
84 TD_RESULT_ASYNC_START,
85 TD_RESULT_ASYNC_CONT,
88 typedef struct UHCIState UHCIState;
89 typedef struct UHCIAsync UHCIAsync;
90 typedef struct UHCIQueue UHCIQueue;
91 typedef struct UHCIInfo UHCIInfo;
92 typedef struct UHCIPCIDeviceClass UHCIPCIDeviceClass;
94 struct UHCIInfo {
95 const char *name;
96 uint16_t vendor_id;
97 uint16_t device_id;
98 uint8_t revision;
99 uint8_t irq_pin;
100 int (*initfn)(PCIDevice *dev);
101 bool unplug;
104 struct UHCIPCIDeviceClass {
105 PCIDeviceClass parent_class;
106 UHCIInfo info;
110 * Pending async transaction.
111 * 'packet' must be the first field because completion
112 * handler does "(UHCIAsync *) pkt" cast.
115 struct UHCIAsync {
116 USBPacket packet;
117 QEMUSGList sgl;
118 UHCIQueue *queue;
119 QTAILQ_ENTRY(UHCIAsync) next;
120 uint32_t td_addr;
121 uint8_t done;
124 struct UHCIQueue {
125 uint32_t qh_addr;
126 uint32_t token;
127 UHCIState *uhci;
128 USBEndpoint *ep;
129 QTAILQ_ENTRY(UHCIQueue) next;
130 QTAILQ_HEAD(asyncs_head, UHCIAsync) asyncs;
131 int8_t valid;
134 typedef struct UHCIPort {
135 USBPort port;
136 uint16_t ctrl;
137 } UHCIPort;
139 struct UHCIState {
140 PCIDevice dev;
141 MemoryRegion io_bar;
142 USBBus bus; /* Note unused when we're a companion controller */
143 uint16_t cmd; /* cmd register */
144 uint16_t status;
145 uint16_t intr; /* interrupt enable register */
146 uint16_t frnum; /* frame number */
147 uint32_t fl_base_addr; /* frame list base address */
148 uint8_t sof_timing;
149 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
150 int64_t expire_time;
151 QEMUTimer *frame_timer;
152 QEMUBH *bh;
153 uint32_t frame_bytes;
154 uint32_t frame_bandwidth;
155 bool completions_only;
156 UHCIPort ports[NB_PORTS];
158 /* Interrupts that should be raised at the end of the current frame. */
159 uint32_t pending_int_mask;
160 int irq_pin;
162 /* Active packets */
163 QTAILQ_HEAD(, UHCIQueue) queues;
164 uint8_t num_ports_vmstate;
166 /* Properties */
167 char *masterbus;
168 uint32_t firstport;
171 typedef struct UHCI_TD {
172 uint32_t link;
173 uint32_t ctrl; /* see TD_CTRL_xxx */
174 uint32_t token;
175 uint32_t buffer;
176 } UHCI_TD;
178 typedef struct UHCI_QH {
179 uint32_t link;
180 uint32_t el_link;
181 } UHCI_QH;
183 static void uhci_async_cancel(UHCIAsync *async);
184 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
186 static inline int32_t uhci_queue_token(UHCI_TD *td)
188 if ((td->token & (0xf << 15)) == 0) {
189 /* ctrl ep, cover ep and dev, not pid! */
190 return td->token & 0x7ff00;
191 } else {
192 /* covers ep, dev, pid -> identifies the endpoint */
193 return td->token & 0x7ffff;
197 static UHCIQueue *uhci_queue_new(UHCIState *s, uint32_t qh_addr, UHCI_TD *td,
198 USBEndpoint *ep)
200 UHCIQueue *queue;
202 queue = g_new0(UHCIQueue, 1);
203 queue->uhci = s;
204 queue->qh_addr = qh_addr;
205 queue->token = uhci_queue_token(td);
206 queue->ep = ep;
207 QTAILQ_INIT(&queue->asyncs);
208 QTAILQ_INSERT_HEAD(&s->queues, queue, next);
209 /* valid needs to be large enough to handle 10 frame delay
210 * for initial isochronous requests */
211 queue->valid = 32;
212 trace_usb_uhci_queue_add(queue->token);
213 return queue;
216 static void uhci_queue_free(UHCIQueue *queue, const char *reason)
218 UHCIState *s = queue->uhci;
219 UHCIAsync *async;
221 while (!QTAILQ_EMPTY(&queue->asyncs)) {
222 async = QTAILQ_FIRST(&queue->asyncs);
223 uhci_async_cancel(async);
226 trace_usb_uhci_queue_del(queue->token, reason);
227 QTAILQ_REMOVE(&s->queues, queue, next);
228 g_free(queue);
231 static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
233 uint32_t token = uhci_queue_token(td);
234 UHCIQueue *queue;
236 QTAILQ_FOREACH(queue, &s->queues, next) {
237 if (queue->token == token) {
238 return queue;
241 return NULL;
244 static bool uhci_queue_verify(UHCIQueue *queue, uint32_t qh_addr, UHCI_TD *td,
245 uint32_t td_addr, bool queuing)
247 UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
249 return queue->qh_addr == qh_addr &&
250 queue->token == uhci_queue_token(td) &&
251 (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
252 first->td_addr == td_addr);
255 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t td_addr)
257 UHCIAsync *async = g_new0(UHCIAsync, 1);
259 async->queue = queue;
260 async->td_addr = td_addr;
261 usb_packet_init(&async->packet);
262 pci_dma_sglist_init(&async->sgl, &queue->uhci->dev, 1);
263 trace_usb_uhci_packet_add(async->queue->token, async->td_addr);
265 return async;
268 static void uhci_async_free(UHCIAsync *async)
270 trace_usb_uhci_packet_del(async->queue->token, async->td_addr);
271 usb_packet_cleanup(&async->packet);
272 qemu_sglist_destroy(&async->sgl);
273 g_free(async);
276 static void uhci_async_link(UHCIAsync *async)
278 UHCIQueue *queue = async->queue;
279 QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
280 trace_usb_uhci_packet_link_async(async->queue->token, async->td_addr);
283 static void uhci_async_unlink(UHCIAsync *async)
285 UHCIQueue *queue = async->queue;
286 QTAILQ_REMOVE(&queue->asyncs, async, next);
287 trace_usb_uhci_packet_unlink_async(async->queue->token, async->td_addr);
290 static void uhci_async_cancel(UHCIAsync *async)
292 uhci_async_unlink(async);
293 trace_usb_uhci_packet_cancel(async->queue->token, async->td_addr,
294 async->done);
295 if (!async->done)
296 usb_cancel_packet(&async->packet);
297 usb_packet_unmap(&async->packet, &async->sgl);
298 uhci_async_free(async);
302 * Mark all outstanding async packets as invalid.
303 * This is used for canceling them when TDs are removed by the HCD.
305 static void uhci_async_validate_begin(UHCIState *s)
307 UHCIQueue *queue;
309 QTAILQ_FOREACH(queue, &s->queues, next) {
310 queue->valid--;
315 * Cancel async packets that are no longer valid
317 static void uhci_async_validate_end(UHCIState *s)
319 UHCIQueue *queue, *n;
321 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
322 if (!queue->valid) {
323 uhci_queue_free(queue, "validate-end");
328 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
330 UHCIQueue *queue, *n;
332 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
333 if (queue->ep->dev == dev) {
334 uhci_queue_free(queue, "cancel-device");
339 static void uhci_async_cancel_all(UHCIState *s)
341 UHCIQueue *queue, *nq;
343 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
344 uhci_queue_free(queue, "cancel-all");
348 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
350 UHCIQueue *queue;
351 UHCIAsync *async;
353 QTAILQ_FOREACH(queue, &s->queues, next) {
354 QTAILQ_FOREACH(async, &queue->asyncs, next) {
355 if (async->td_addr == td_addr) {
356 return async;
360 return NULL;
363 static void uhci_update_irq(UHCIState *s)
365 int level;
366 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
367 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
368 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
369 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
370 (s->status & UHCI_STS_HSERR) ||
371 (s->status & UHCI_STS_HCPERR)) {
372 level = 1;
373 } else {
374 level = 0;
376 qemu_set_irq(s->dev.irq[s->irq_pin], level);
379 static void uhci_reset(void *opaque)
381 UHCIState *s = opaque;
382 uint8_t *pci_conf;
383 int i;
384 UHCIPort *port;
386 trace_usb_uhci_reset();
388 pci_conf = s->dev.config;
390 pci_conf[0x6a] = 0x01; /* usb clock */
391 pci_conf[0x6b] = 0x00;
392 s->cmd = 0;
393 s->status = 0;
394 s->status2 = 0;
395 s->intr = 0;
396 s->fl_base_addr = 0;
397 s->sof_timing = 64;
399 for(i = 0; i < NB_PORTS; i++) {
400 port = &s->ports[i];
401 port->ctrl = 0x0080;
402 if (port->port.dev && port->port.dev->attached) {
403 usb_port_reset(&port->port);
407 uhci_async_cancel_all(s);
408 qemu_bh_cancel(s->bh);
409 uhci_update_irq(s);
412 static const VMStateDescription vmstate_uhci_port = {
413 .name = "uhci port",
414 .version_id = 1,
415 .minimum_version_id = 1,
416 .minimum_version_id_old = 1,
417 .fields = (VMStateField []) {
418 VMSTATE_UINT16(ctrl, UHCIPort),
419 VMSTATE_END_OF_LIST()
423 static int uhci_post_load(void *opaque, int version_id)
425 UHCIState *s = opaque;
427 if (version_id < 2) {
428 s->expire_time = qemu_get_clock_ns(vm_clock) +
429 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
431 return 0;
434 static const VMStateDescription vmstate_uhci = {
435 .name = "uhci",
436 .version_id = 2,
437 .minimum_version_id = 1,
438 .minimum_version_id_old = 1,
439 .post_load = uhci_post_load,
440 .fields = (VMStateField []) {
441 VMSTATE_PCI_DEVICE(dev, UHCIState),
442 VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
443 VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
444 vmstate_uhci_port, UHCIPort),
445 VMSTATE_UINT16(cmd, UHCIState),
446 VMSTATE_UINT16(status, UHCIState),
447 VMSTATE_UINT16(intr, UHCIState),
448 VMSTATE_UINT16(frnum, UHCIState),
449 VMSTATE_UINT32(fl_base_addr, UHCIState),
450 VMSTATE_UINT8(sof_timing, UHCIState),
451 VMSTATE_UINT8(status2, UHCIState),
452 VMSTATE_TIMER(frame_timer, UHCIState),
453 VMSTATE_INT64_V(expire_time, UHCIState, 2),
454 VMSTATE_END_OF_LIST()
458 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
460 UHCIState *s = opaque;
462 addr &= 0x1f;
463 switch(addr) {
464 case 0x0c:
465 s->sof_timing = val;
466 break;
470 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
472 UHCIState *s = opaque;
473 uint32_t val;
475 addr &= 0x1f;
476 switch(addr) {
477 case 0x0c:
478 val = s->sof_timing;
479 break;
480 default:
481 val = 0xff;
482 break;
484 return val;
487 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
489 UHCIState *s = opaque;
491 addr &= 0x1f;
492 trace_usb_uhci_mmio_writew(addr, val);
494 switch(addr) {
495 case 0x00:
496 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
497 /* start frame processing */
498 trace_usb_uhci_schedule_start();
499 s->expire_time = qemu_get_clock_ns(vm_clock) +
500 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
501 qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
502 s->status &= ~UHCI_STS_HCHALTED;
503 } else if (!(val & UHCI_CMD_RS)) {
504 s->status |= UHCI_STS_HCHALTED;
506 if (val & UHCI_CMD_GRESET) {
507 UHCIPort *port;
508 int i;
510 /* send reset on the USB bus */
511 for(i = 0; i < NB_PORTS; i++) {
512 port = &s->ports[i];
513 usb_device_reset(port->port.dev);
515 uhci_reset(s);
516 return;
518 if (val & UHCI_CMD_HCRESET) {
519 uhci_reset(s);
520 return;
522 s->cmd = val;
523 break;
524 case 0x02:
525 s->status &= ~val;
526 /* XXX: the chip spec is not coherent, so we add a hidden
527 register to distinguish between IOC and SPD */
528 if (val & UHCI_STS_USBINT)
529 s->status2 = 0;
530 uhci_update_irq(s);
531 break;
532 case 0x04:
533 s->intr = val;
534 uhci_update_irq(s);
535 break;
536 case 0x06:
537 if (s->status & UHCI_STS_HCHALTED)
538 s->frnum = val & 0x7ff;
539 break;
540 case 0x10 ... 0x1f:
542 UHCIPort *port;
543 USBDevice *dev;
544 int n;
546 n = (addr >> 1) & 7;
547 if (n >= NB_PORTS)
548 return;
549 port = &s->ports[n];
550 dev = port->port.dev;
551 if (dev && dev->attached) {
552 /* port reset */
553 if ( (val & UHCI_PORT_RESET) &&
554 !(port->ctrl & UHCI_PORT_RESET) ) {
555 usb_device_reset(dev);
558 port->ctrl &= UHCI_PORT_READ_ONLY;
559 port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
560 /* some bits are reset when a '1' is written to them */
561 port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
563 break;
567 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
569 UHCIState *s = opaque;
570 uint32_t val;
572 addr &= 0x1f;
573 switch(addr) {
574 case 0x00:
575 val = s->cmd;
576 break;
577 case 0x02:
578 val = s->status;
579 break;
580 case 0x04:
581 val = s->intr;
582 break;
583 case 0x06:
584 val = s->frnum;
585 break;
586 case 0x10 ... 0x1f:
588 UHCIPort *port;
589 int n;
590 n = (addr >> 1) & 7;
591 if (n >= NB_PORTS)
592 goto read_default;
593 port = &s->ports[n];
594 val = port->ctrl;
596 break;
597 default:
598 read_default:
599 val = 0xff7f; /* disabled port */
600 break;
603 trace_usb_uhci_mmio_readw(addr, val);
605 return val;
608 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
610 UHCIState *s = opaque;
612 addr &= 0x1f;
613 trace_usb_uhci_mmio_writel(addr, val);
615 switch(addr) {
616 case 0x08:
617 s->fl_base_addr = val & ~0xfff;
618 break;
622 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
624 UHCIState *s = opaque;
625 uint32_t val;
627 addr &= 0x1f;
628 switch(addr) {
629 case 0x08:
630 val = s->fl_base_addr;
631 break;
632 default:
633 val = 0xffffffff;
634 break;
636 trace_usb_uhci_mmio_readl(addr, val);
637 return val;
640 /* signal resume if controller suspended */
641 static void uhci_resume (void *opaque)
643 UHCIState *s = (UHCIState *)opaque;
645 if (!s)
646 return;
648 if (s->cmd & UHCI_CMD_EGSM) {
649 s->cmd |= UHCI_CMD_FGR;
650 s->status |= UHCI_STS_RD;
651 uhci_update_irq(s);
655 static void uhci_attach(USBPort *port1)
657 UHCIState *s = port1->opaque;
658 UHCIPort *port = &s->ports[port1->index];
660 /* set connect status */
661 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
663 /* update speed */
664 if (port->port.dev->speed == USB_SPEED_LOW) {
665 port->ctrl |= UHCI_PORT_LSDA;
666 } else {
667 port->ctrl &= ~UHCI_PORT_LSDA;
670 uhci_resume(s);
673 static void uhci_detach(USBPort *port1)
675 UHCIState *s = port1->opaque;
676 UHCIPort *port = &s->ports[port1->index];
678 uhci_async_cancel_device(s, port1->dev);
680 /* set connect status */
681 if (port->ctrl & UHCI_PORT_CCS) {
682 port->ctrl &= ~UHCI_PORT_CCS;
683 port->ctrl |= UHCI_PORT_CSC;
685 /* disable port */
686 if (port->ctrl & UHCI_PORT_EN) {
687 port->ctrl &= ~UHCI_PORT_EN;
688 port->ctrl |= UHCI_PORT_ENC;
691 uhci_resume(s);
694 static void uhci_child_detach(USBPort *port1, USBDevice *child)
696 UHCIState *s = port1->opaque;
698 uhci_async_cancel_device(s, child);
701 static void uhci_wakeup(USBPort *port1)
703 UHCIState *s = port1->opaque;
704 UHCIPort *port = &s->ports[port1->index];
706 if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
707 port->ctrl |= UHCI_PORT_RD;
708 uhci_resume(s);
712 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
714 USBDevice *dev;
715 int i;
717 for (i = 0; i < NB_PORTS; i++) {
718 UHCIPort *port = &s->ports[i];
719 if (!(port->ctrl & UHCI_PORT_EN)) {
720 continue;
722 dev = usb_find_device(&port->port, addr);
723 if (dev != NULL) {
724 return dev;
727 return NULL;
730 static void uhci_read_td(UHCIState *s, UHCI_TD *td, uint32_t link)
732 pci_dma_read(&s->dev, link & ~0xf, td, sizeof(*td));
733 le32_to_cpus(&td->link);
734 le32_to_cpus(&td->ctrl);
735 le32_to_cpus(&td->token);
736 le32_to_cpus(&td->buffer);
739 static int uhci_handle_td_error(UHCIState *s, UHCI_TD *td, uint32_t td_addr,
740 int status, uint32_t *int_mask)
742 uint32_t queue_token = uhci_queue_token(td);
743 int ret;
745 switch (status) {
746 case USB_RET_NAK:
747 td->ctrl |= TD_CTRL_NAK;
748 return TD_RESULT_NEXT_QH;
750 case USB_RET_STALL:
751 td->ctrl |= TD_CTRL_STALL;
752 trace_usb_uhci_packet_complete_stall(queue_token, td_addr);
753 ret = TD_RESULT_NEXT_QH;
754 break;
756 case USB_RET_BABBLE:
757 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
758 /* frame interrupted */
759 trace_usb_uhci_packet_complete_babble(queue_token, td_addr);
760 ret = TD_RESULT_STOP_FRAME;
761 break;
763 case USB_RET_IOERROR:
764 case USB_RET_NODEV:
765 default:
766 td->ctrl |= TD_CTRL_TIMEOUT;
767 td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
768 trace_usb_uhci_packet_complete_error(queue_token, td_addr);
769 ret = TD_RESULT_NEXT_QH;
770 break;
773 td->ctrl &= ~TD_CTRL_ACTIVE;
774 s->status |= UHCI_STS_USBERR;
775 if (td->ctrl & TD_CTRL_IOC) {
776 *int_mask |= 0x01;
778 uhci_update_irq(s);
779 return ret;
782 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
784 int len = 0, max_len;
785 uint8_t pid;
787 max_len = ((td->token >> 21) + 1) & 0x7ff;
788 pid = td->token & 0xff;
790 if (td->ctrl & TD_CTRL_IOS)
791 td->ctrl &= ~TD_CTRL_ACTIVE;
793 if (async->packet.status != USB_RET_SUCCESS) {
794 return uhci_handle_td_error(s, td, async->td_addr,
795 async->packet.status, int_mask);
798 len = async->packet.actual_length;
799 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
801 /* The NAK bit may have been set by a previous frame, so clear it
802 here. The docs are somewhat unclear, but win2k relies on this
803 behavior. */
804 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
805 if (td->ctrl & TD_CTRL_IOC)
806 *int_mask |= 0x01;
808 if (pid == USB_TOKEN_IN) {
809 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
810 *int_mask |= 0x02;
811 /* short packet: do not update QH */
812 trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
813 async->td_addr);
814 return TD_RESULT_NEXT_QH;
818 /* success */
819 trace_usb_uhci_packet_complete_success(async->queue->token,
820 async->td_addr);
821 return TD_RESULT_COMPLETE;
824 static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
825 UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
827 int ret, max_len;
828 bool spd;
829 bool queuing = (q != NULL);
830 uint8_t pid = td->token & 0xff;
831 UHCIAsync *async = uhci_async_find_td(s, td_addr);
833 if (async) {
834 if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
835 assert(q == NULL || q == async->queue);
836 q = async->queue;
837 } else {
838 uhci_queue_free(async->queue, "guest re-used pending td");
839 async = NULL;
843 if (q == NULL) {
844 q = uhci_queue_find(s, td);
845 if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
846 uhci_queue_free(q, "guest re-used qh");
847 q = NULL;
851 if (q) {
852 q->valid = 32;
855 /* Is active ? */
856 if (!(td->ctrl & TD_CTRL_ACTIVE)) {
857 if (async) {
858 /* Guest marked a pending td non-active, cancel the queue */
859 uhci_queue_free(async->queue, "pending td non-active");
862 * ehci11d spec page 22: "Even if the Active bit in the TD is already
863 * cleared when the TD is fetched ... an IOC interrupt is generated"
865 if (td->ctrl & TD_CTRL_IOC) {
866 *int_mask |= 0x01;
868 return TD_RESULT_NEXT_QH;
871 if (async) {
872 if (queuing) {
873 /* we are busy filling the queue, we are not prepared
874 to consume completed packages then, just leave them
875 in async state */
876 return TD_RESULT_ASYNC_CONT;
878 if (!async->done) {
879 UHCI_TD last_td;
880 UHCIAsync *last = QTAILQ_LAST(&async->queue->asyncs, asyncs_head);
882 * While we are waiting for the current td to complete, the guest
883 * may have added more tds to the queue. Note we re-read the td
884 * rather then caching it, as we want to see guest made changes!
886 uhci_read_td(s, &last_td, last->td_addr);
887 uhci_queue_fill(async->queue, &last_td);
889 return TD_RESULT_ASYNC_CONT;
891 uhci_async_unlink(async);
892 goto done;
895 if (s->completions_only) {
896 return TD_RESULT_ASYNC_CONT;
899 /* Allocate new packet */
900 if (q == NULL) {
901 USBDevice *dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
902 USBEndpoint *ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
904 if (ep == NULL) {
905 return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
906 int_mask);
908 q = uhci_queue_new(s, qh_addr, td, ep);
910 async = uhci_async_alloc(q, td_addr);
912 max_len = ((td->token >> 21) + 1) & 0x7ff;
913 spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
914 usb_packet_setup(&async->packet, pid, q->ep, td_addr, spd,
915 (td->ctrl & TD_CTRL_IOC) != 0);
916 qemu_sglist_add(&async->sgl, td->buffer, max_len);
917 usb_packet_map(&async->packet, &async->sgl);
919 switch(pid) {
920 case USB_TOKEN_OUT:
921 case USB_TOKEN_SETUP:
922 usb_handle_packet(q->ep->dev, &async->packet);
923 if (async->packet.status == USB_RET_SUCCESS) {
924 async->packet.actual_length = max_len;
926 break;
928 case USB_TOKEN_IN:
929 usb_handle_packet(q->ep->dev, &async->packet);
930 break;
932 default:
933 /* invalid pid : frame interrupted */
934 usb_packet_unmap(&async->packet, &async->sgl);
935 uhci_async_free(async);
936 s->status |= UHCI_STS_HCPERR;
937 uhci_update_irq(s);
938 return TD_RESULT_STOP_FRAME;
941 if (async->packet.status == USB_RET_ASYNC) {
942 uhci_async_link(async);
943 if (!queuing) {
944 uhci_queue_fill(q, td);
946 return TD_RESULT_ASYNC_START;
949 done:
950 ret = uhci_complete_td(s, td, async, int_mask);
951 usb_packet_unmap(&async->packet, &async->sgl);
952 uhci_async_free(async);
953 return ret;
956 static void uhci_async_complete(USBPort *port, USBPacket *packet)
958 UHCIAsync *async = container_of(packet, UHCIAsync, packet);
959 UHCIState *s = async->queue->uhci;
961 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
962 uhci_async_unlink(async);
963 uhci_async_cancel(async);
964 return;
967 async->done = 1;
968 /* Force processing of this packet *now*, needed for migration */
969 s->completions_only = true;
970 qemu_bh_schedule(s->bh);
973 static int is_valid(uint32_t link)
975 return (link & 1) == 0;
978 static int is_qh(uint32_t link)
980 return (link & 2) != 0;
983 static int depth_first(uint32_t link)
985 return (link & 4) != 0;
988 /* QH DB used for detecting QH loops */
989 #define UHCI_MAX_QUEUES 128
990 typedef struct {
991 uint32_t addr[UHCI_MAX_QUEUES];
992 int count;
993 } QhDb;
995 static void qhdb_reset(QhDb *db)
997 db->count = 0;
1000 /* Add QH to DB. Returns 1 if already present or DB is full. */
1001 static int qhdb_insert(QhDb *db, uint32_t addr)
1003 int i;
1004 for (i = 0; i < db->count; i++)
1005 if (db->addr[i] == addr)
1006 return 1;
1008 if (db->count >= UHCI_MAX_QUEUES)
1009 return 1;
1011 db->addr[db->count++] = addr;
1012 return 0;
1015 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td)
1017 uint32_t int_mask = 0;
1018 uint32_t plink = td->link;
1019 UHCI_TD ptd;
1020 int ret;
1022 while (is_valid(plink)) {
1023 uhci_read_td(q->uhci, &ptd, plink);
1024 if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
1025 break;
1027 if (uhci_queue_token(&ptd) != q->token) {
1028 break;
1030 trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
1031 ret = uhci_handle_td(q->uhci, q, q->qh_addr, &ptd, plink, &int_mask);
1032 if (ret == TD_RESULT_ASYNC_CONT) {
1033 break;
1035 assert(ret == TD_RESULT_ASYNC_START);
1036 assert(int_mask == 0);
1037 plink = ptd.link;
1039 usb_device_flush_ep_queue(q->ep->dev, q->ep);
1042 static void uhci_process_frame(UHCIState *s)
1044 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
1045 uint32_t curr_qh, td_count = 0;
1046 int cnt, ret;
1047 UHCI_TD td;
1048 UHCI_QH qh;
1049 QhDb qhdb;
1051 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
1053 pci_dma_read(&s->dev, frame_addr, &link, 4);
1054 le32_to_cpus(&link);
1056 int_mask = 0;
1057 curr_qh = 0;
1059 qhdb_reset(&qhdb);
1061 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1062 if (!s->completions_only && s->frame_bytes >= s->frame_bandwidth) {
1063 /* We've reached the usb 1.1 bandwidth, which is
1064 1280 bytes/frame, stop processing */
1065 trace_usb_uhci_frame_stop_bandwidth();
1066 break;
1068 if (is_qh(link)) {
1069 /* QH */
1070 trace_usb_uhci_qh_load(link & ~0xf);
1072 if (qhdb_insert(&qhdb, link)) {
1074 * We're going in circles. Which is not a bug because
1075 * HCD is allowed to do that as part of the BW management.
1077 * Stop processing here if no transaction has been done
1078 * since we've been here last time.
1080 if (td_count == 0) {
1081 trace_usb_uhci_frame_loop_stop_idle();
1082 break;
1083 } else {
1084 trace_usb_uhci_frame_loop_continue();
1085 td_count = 0;
1086 qhdb_reset(&qhdb);
1087 qhdb_insert(&qhdb, link);
1091 pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1092 le32_to_cpus(&qh.link);
1093 le32_to_cpus(&qh.el_link);
1095 if (!is_valid(qh.el_link)) {
1096 /* QH w/o elements */
1097 curr_qh = 0;
1098 link = qh.link;
1099 } else {
1100 /* QH with elements */
1101 curr_qh = link;
1102 link = qh.el_link;
1104 continue;
1107 /* TD */
1108 uhci_read_td(s, &td, link);
1109 trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1111 old_td_ctrl = td.ctrl;
1112 ret = uhci_handle_td(s, NULL, curr_qh, &td, link, &int_mask);
1113 if (old_td_ctrl != td.ctrl) {
1114 /* update the status bits of the TD */
1115 val = cpu_to_le32(td.ctrl);
1116 pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1119 switch (ret) {
1120 case TD_RESULT_STOP_FRAME: /* interrupted frame */
1121 goto out;
1123 case TD_RESULT_NEXT_QH:
1124 case TD_RESULT_ASYNC_CONT:
1125 trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1126 link = curr_qh ? qh.link : td.link;
1127 continue;
1129 case TD_RESULT_ASYNC_START:
1130 trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1131 link = curr_qh ? qh.link : td.link;
1132 continue;
1134 case TD_RESULT_COMPLETE:
1135 trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1136 link = td.link;
1137 td_count++;
1138 s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1140 if (curr_qh) {
1141 /* update QH element link */
1142 qh.el_link = link;
1143 val = cpu_to_le32(qh.el_link);
1144 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1146 if (!depth_first(link)) {
1147 /* done with this QH */
1148 curr_qh = 0;
1149 link = qh.link;
1152 break;
1154 default:
1155 assert(!"unknown return code");
1158 /* go to the next entry */
1161 out:
1162 s->pending_int_mask |= int_mask;
1165 static void uhci_bh(void *opaque)
1167 UHCIState *s = opaque;
1168 uhci_process_frame(s);
1171 static void uhci_frame_timer(void *opaque)
1173 UHCIState *s = opaque;
1175 /* prepare the timer for the next frame */
1176 s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1177 s->frame_bytes = 0;
1178 s->completions_only = false;
1179 qemu_bh_cancel(s->bh);
1181 if (!(s->cmd & UHCI_CMD_RS)) {
1182 /* Full stop */
1183 trace_usb_uhci_schedule_stop();
1184 qemu_del_timer(s->frame_timer);
1185 uhci_async_cancel_all(s);
1186 /* set hchalted bit in status - UHCI11D 2.1.2 */
1187 s->status |= UHCI_STS_HCHALTED;
1188 return;
1191 /* Complete the previous frame */
1192 if (s->pending_int_mask) {
1193 s->status2 |= s->pending_int_mask;
1194 s->status |= UHCI_STS_USBINT;
1195 uhci_update_irq(s);
1197 s->pending_int_mask = 0;
1199 /* Start new frame */
1200 s->frnum = (s->frnum + 1) & 0x7ff;
1202 trace_usb_uhci_frame_start(s->frnum);
1204 uhci_async_validate_begin(s);
1206 uhci_process_frame(s);
1208 uhci_async_validate_end(s);
1210 qemu_mod_timer(s->frame_timer, s->expire_time);
1213 static const MemoryRegionPortio uhci_portio[] = {
1214 { 0, 32, 2, .write = uhci_ioport_writew, },
1215 { 0, 32, 2, .read = uhci_ioport_readw, },
1216 { 0, 32, 4, .write = uhci_ioport_writel, },
1217 { 0, 32, 4, .read = uhci_ioport_readl, },
1218 { 0, 32, 1, .write = uhci_ioport_writeb, },
1219 { 0, 32, 1, .read = uhci_ioport_readb, },
1220 PORTIO_END_OF_LIST()
1223 static const MemoryRegionOps uhci_ioport_ops = {
1224 .old_portio = uhci_portio,
1227 static USBPortOps uhci_port_ops = {
1228 .attach = uhci_attach,
1229 .detach = uhci_detach,
1230 .child_detach = uhci_child_detach,
1231 .wakeup = uhci_wakeup,
1232 .complete = uhci_async_complete,
1235 static USBBusOps uhci_bus_ops = {
1238 static int usb_uhci_common_initfn(PCIDevice *dev)
1240 PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
1241 UHCIPCIDeviceClass *u = container_of(pc, UHCIPCIDeviceClass, parent_class);
1242 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1243 uint8_t *pci_conf = s->dev.config;
1244 int i;
1246 pci_conf[PCI_CLASS_PROG] = 0x00;
1247 /* TODO: reset value should be 0. */
1248 pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1250 s->irq_pin = u->info.irq_pin;
1251 pci_config_set_interrupt_pin(pci_conf, s->irq_pin + 1);
1253 if (s->masterbus) {
1254 USBPort *ports[NB_PORTS];
1255 for(i = 0; i < NB_PORTS; i++) {
1256 ports[i] = &s->ports[i].port;
1258 if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1259 s->firstport, s, &uhci_port_ops,
1260 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1261 return -1;
1263 } else {
1264 usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1265 for (i = 0; i < NB_PORTS; i++) {
1266 usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1267 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1270 s->bh = qemu_bh_new(uhci_bh, s);
1271 s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1272 s->num_ports_vmstate = NB_PORTS;
1273 QTAILQ_INIT(&s->queues);
1275 qemu_register_reset(uhci_reset, s);
1277 memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1278 /* Use region 4 for consistency with real hardware. BSD guests seem
1279 to rely on this. */
1280 pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1282 return 0;
1285 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1287 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1288 uint8_t *pci_conf = s->dev.config;
1290 /* USB misc control 1/2 */
1291 pci_set_long(pci_conf + 0x40,0x00001000);
1292 /* PM capability */
1293 pci_set_long(pci_conf + 0x80,0x00020001);
1294 /* USB legacy support */
1295 pci_set_long(pci_conf + 0xc0,0x00002000);
1297 return usb_uhci_common_initfn(dev);
1300 static void usb_uhci_exit(PCIDevice *dev)
1302 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1304 memory_region_destroy(&s->io_bar);
1307 static Property uhci_properties[] = {
1308 DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1309 DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1310 DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1311 DEFINE_PROP_END_OF_LIST(),
1314 static void uhci_class_init(ObjectClass *klass, void *data)
1316 DeviceClass *dc = DEVICE_CLASS(klass);
1317 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1318 UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);
1319 UHCIInfo *info = data;
1321 k->init = info->initfn ? info->initfn : usb_uhci_common_initfn;
1322 k->exit = info->unplug ? usb_uhci_exit : NULL;
1323 k->vendor_id = info->vendor_id;
1324 k->device_id = info->device_id;
1325 k->revision = info->revision;
1326 k->class_id = PCI_CLASS_SERIAL_USB;
1327 dc->vmsd = &vmstate_uhci;
1328 dc->props = uhci_properties;
1329 u->info = *info;
1332 static UHCIInfo uhci_info[] = {
1334 .name = "piix3-usb-uhci",
1335 .vendor_id = PCI_VENDOR_ID_INTEL,
1336 .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1337 .revision = 0x01,
1338 .irq_pin = 3,
1339 .unplug = true,
1341 .name = "piix4-usb-uhci",
1342 .vendor_id = PCI_VENDOR_ID_INTEL,
1343 .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1344 .revision = 0x01,
1345 .irq_pin = 3,
1346 .unplug = true,
1348 .name = "vt82c686b-usb-uhci",
1349 .vendor_id = PCI_VENDOR_ID_VIA,
1350 .device_id = PCI_DEVICE_ID_VIA_UHCI,
1351 .revision = 0x01,
1352 .irq_pin = 3,
1353 .initfn = usb_uhci_vt82c686b_initfn,
1354 .unplug = true,
1356 .name = "ich9-usb-uhci1", /* 00:1d.0 */
1357 .vendor_id = PCI_VENDOR_ID_INTEL,
1358 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1359 .revision = 0x03,
1360 .irq_pin = 0,
1361 .unplug = false,
1363 .name = "ich9-usb-uhci2", /* 00:1d.1 */
1364 .vendor_id = PCI_VENDOR_ID_INTEL,
1365 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1366 .revision = 0x03,
1367 .irq_pin = 1,
1368 .unplug = false,
1370 .name = "ich9-usb-uhci3", /* 00:1d.2 */
1371 .vendor_id = PCI_VENDOR_ID_INTEL,
1372 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1373 .revision = 0x03,
1374 .irq_pin = 2,
1375 .unplug = false,
1377 .name = "ich9-usb-uhci4", /* 00:1a.0 */
1378 .vendor_id = PCI_VENDOR_ID_INTEL,
1379 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI4,
1380 .revision = 0x03,
1381 .irq_pin = 0,
1382 .unplug = false,
1384 .name = "ich9-usb-uhci5", /* 00:1a.1 */
1385 .vendor_id = PCI_VENDOR_ID_INTEL,
1386 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI5,
1387 .revision = 0x03,
1388 .irq_pin = 1,
1389 .unplug = false,
1391 .name = "ich9-usb-uhci6", /* 00:1a.2 */
1392 .vendor_id = PCI_VENDOR_ID_INTEL,
1393 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI6,
1394 .revision = 0x03,
1395 .irq_pin = 2,
1396 .unplug = false,
1400 static void uhci_register_types(void)
1402 TypeInfo uhci_type_info = {
1403 .parent = TYPE_PCI_DEVICE,
1404 .instance_size = sizeof(UHCIState),
1405 .class_size = sizeof(UHCIPCIDeviceClass),
1406 .class_init = uhci_class_init,
1408 int i;
1410 for (i = 0; i < ARRAY_SIZE(uhci_info); i++) {
1411 uhci_type_info.name = uhci_info[i].name;
1412 uhci_type_info.class_data = uhci_info + i;
1413 type_register(&uhci_type_info);
1417 type_init(uhci_register_types)