fix build error on ARM due to wrong glibc check
[qemu/kevin.git] / hw / usb / hcd-uhci.c
blobd053791de0e0a4850ea4a7f3fcc0b2aef891cdf5
1 /*
2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
28 #include "hw/hw.h"
29 #include "hw/usb.h"
30 #include "hw/pci.h"
31 #include "qemu-timer.h"
32 #include "iov.h"
33 #include "dma.h"
34 #include "trace.h"
36 //#define DEBUG
37 //#define DEBUG_DUMP_DATA
39 #define UHCI_CMD_FGR (1 << 4)
40 #define UHCI_CMD_EGSM (1 << 3)
41 #define UHCI_CMD_GRESET (1 << 2)
42 #define UHCI_CMD_HCRESET (1 << 1)
43 #define UHCI_CMD_RS (1 << 0)
45 #define UHCI_STS_HCHALTED (1 << 5)
46 #define UHCI_STS_HCPERR (1 << 4)
47 #define UHCI_STS_HSERR (1 << 3)
48 #define UHCI_STS_RD (1 << 2)
49 #define UHCI_STS_USBERR (1 << 1)
50 #define UHCI_STS_USBINT (1 << 0)
52 #define TD_CTRL_SPD (1 << 29)
53 #define TD_CTRL_ERROR_SHIFT 27
54 #define TD_CTRL_IOS (1 << 25)
55 #define TD_CTRL_IOC (1 << 24)
56 #define TD_CTRL_ACTIVE (1 << 23)
57 #define TD_CTRL_STALL (1 << 22)
58 #define TD_CTRL_BABBLE (1 << 20)
59 #define TD_CTRL_NAK (1 << 19)
60 #define TD_CTRL_TIMEOUT (1 << 18)
62 #define UHCI_PORT_SUSPEND (1 << 12)
63 #define UHCI_PORT_RESET (1 << 9)
64 #define UHCI_PORT_LSDA (1 << 8)
65 #define UHCI_PORT_RD (1 << 6)
66 #define UHCI_PORT_ENC (1 << 3)
67 #define UHCI_PORT_EN (1 << 2)
68 #define UHCI_PORT_CSC (1 << 1)
69 #define UHCI_PORT_CCS (1 << 0)
71 #define UHCI_PORT_READ_ONLY (0x1bb)
72 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
74 #define FRAME_TIMER_FREQ 1000
76 #define FRAME_MAX_LOOPS 256
78 #define NB_PORTS 2
80 enum {
81 TD_RESULT_STOP_FRAME = 10,
82 TD_RESULT_COMPLETE,
83 TD_RESULT_NEXT_QH,
84 TD_RESULT_ASYNC_START,
85 TD_RESULT_ASYNC_CONT,
88 typedef struct UHCIState UHCIState;
89 typedef struct UHCIAsync UHCIAsync;
90 typedef struct UHCIQueue UHCIQueue;
91 typedef struct UHCIInfo UHCIInfo;
92 typedef struct UHCIPCIDeviceClass UHCIPCIDeviceClass;
94 struct UHCIInfo {
95 const char *name;
96 uint16_t vendor_id;
97 uint16_t device_id;
98 uint8_t revision;
99 uint8_t irq_pin;
100 int (*initfn)(PCIDevice *dev);
101 bool unplug;
104 struct UHCIPCIDeviceClass {
105 PCIDeviceClass parent_class;
106 UHCIInfo info;
110 * Pending async transaction.
111 * 'packet' must be the first field because completion
112 * handler does "(UHCIAsync *) pkt" cast.
115 struct UHCIAsync {
116 USBPacket packet;
117 QEMUSGList sgl;
118 UHCIQueue *queue;
119 QTAILQ_ENTRY(UHCIAsync) next;
120 uint32_t td_addr;
121 uint8_t done;
124 struct UHCIQueue {
125 uint32_t qh_addr;
126 uint32_t token;
127 UHCIState *uhci;
128 USBEndpoint *ep;
129 QTAILQ_ENTRY(UHCIQueue) next;
130 QTAILQ_HEAD(asyncs_head, UHCIAsync) asyncs;
131 int8_t valid;
134 typedef struct UHCIPort {
135 USBPort port;
136 uint16_t ctrl;
137 } UHCIPort;
139 struct UHCIState {
140 PCIDevice dev;
141 MemoryRegion io_bar;
142 USBBus bus; /* Note unused when we're a companion controller */
143 uint16_t cmd; /* cmd register */
144 uint16_t status;
145 uint16_t intr; /* interrupt enable register */
146 uint16_t frnum; /* frame number */
147 uint32_t fl_base_addr; /* frame list base address */
148 uint8_t sof_timing;
149 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
150 int64_t expire_time;
151 QEMUTimer *frame_timer;
152 QEMUBH *bh;
153 uint32_t frame_bytes;
154 uint32_t frame_bandwidth;
155 bool completions_only;
156 UHCIPort ports[NB_PORTS];
158 /* Interrupts that should be raised at the end of the current frame. */
159 uint32_t pending_int_mask;
160 int irq_pin;
162 /* Active packets */
163 QTAILQ_HEAD(, UHCIQueue) queues;
164 uint8_t num_ports_vmstate;
166 /* Properties */
167 char *masterbus;
168 uint32_t firstport;
171 typedef struct UHCI_TD {
172 uint32_t link;
173 uint32_t ctrl; /* see TD_CTRL_xxx */
174 uint32_t token;
175 uint32_t buffer;
176 } UHCI_TD;
178 typedef struct UHCI_QH {
179 uint32_t link;
180 uint32_t el_link;
181 } UHCI_QH;
183 static void uhci_async_cancel(UHCIAsync *async);
184 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
186 static inline int32_t uhci_queue_token(UHCI_TD *td)
188 if ((td->token & (0xf << 15)) == 0) {
189 /* ctrl ep, cover ep and dev, not pid! */
190 return td->token & 0x7ff00;
191 } else {
192 /* covers ep, dev, pid -> identifies the endpoint */
193 return td->token & 0x7ffff;
197 static UHCIQueue *uhci_queue_new(UHCIState *s, uint32_t qh_addr, UHCI_TD *td,
198 USBEndpoint *ep)
200 UHCIQueue *queue;
202 queue = g_new0(UHCIQueue, 1);
203 queue->uhci = s;
204 queue->qh_addr = qh_addr;
205 queue->token = uhci_queue_token(td);
206 queue->ep = ep;
207 QTAILQ_INIT(&queue->asyncs);
208 QTAILQ_INSERT_HEAD(&s->queues, queue, next);
209 /* valid needs to be large enough to handle 10 frame delay
210 * for initial isochronous requests */
211 queue->valid = 32;
212 trace_usb_uhci_queue_add(queue->token);
213 return queue;
216 static void uhci_queue_free(UHCIQueue *queue, const char *reason)
218 UHCIState *s = queue->uhci;
219 UHCIAsync *async;
221 while (!QTAILQ_EMPTY(&queue->asyncs)) {
222 async = QTAILQ_FIRST(&queue->asyncs);
223 uhci_async_cancel(async);
226 trace_usb_uhci_queue_del(queue->token, reason);
227 QTAILQ_REMOVE(&s->queues, queue, next);
228 g_free(queue);
231 static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
233 uint32_t token = uhci_queue_token(td);
234 UHCIQueue *queue;
236 QTAILQ_FOREACH(queue, &s->queues, next) {
237 if (queue->token == token) {
238 return queue;
241 return NULL;
244 static bool uhci_queue_verify(UHCIQueue *queue, uint32_t qh_addr, UHCI_TD *td,
245 uint32_t td_addr, bool queuing)
247 UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
249 return queue->qh_addr == qh_addr &&
250 queue->token == uhci_queue_token(td) &&
251 (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
252 first->td_addr == td_addr);
255 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t td_addr)
257 UHCIAsync *async = g_new0(UHCIAsync, 1);
259 async->queue = queue;
260 async->td_addr = td_addr;
261 usb_packet_init(&async->packet);
262 pci_dma_sglist_init(&async->sgl, &queue->uhci->dev, 1);
263 trace_usb_uhci_packet_add(async->queue->token, async->td_addr);
265 return async;
268 static void uhci_async_free(UHCIAsync *async)
270 trace_usb_uhci_packet_del(async->queue->token, async->td_addr);
271 usb_packet_cleanup(&async->packet);
272 qemu_sglist_destroy(&async->sgl);
273 g_free(async);
276 static void uhci_async_link(UHCIAsync *async)
278 UHCIQueue *queue = async->queue;
279 QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
280 trace_usb_uhci_packet_link_async(async->queue->token, async->td_addr);
283 static void uhci_async_unlink(UHCIAsync *async)
285 UHCIQueue *queue = async->queue;
286 QTAILQ_REMOVE(&queue->asyncs, async, next);
287 trace_usb_uhci_packet_unlink_async(async->queue->token, async->td_addr);
290 static void uhci_async_cancel(UHCIAsync *async)
292 uhci_async_unlink(async);
293 trace_usb_uhci_packet_cancel(async->queue->token, async->td_addr,
294 async->done);
295 if (!async->done)
296 usb_cancel_packet(&async->packet);
297 usb_packet_unmap(&async->packet, &async->sgl);
298 uhci_async_free(async);
302 * Mark all outstanding async packets as invalid.
303 * This is used for canceling them when TDs are removed by the HCD.
305 static void uhci_async_validate_begin(UHCIState *s)
307 UHCIQueue *queue;
309 QTAILQ_FOREACH(queue, &s->queues, next) {
310 queue->valid--;
315 * Cancel async packets that are no longer valid
317 static void uhci_async_validate_end(UHCIState *s)
319 UHCIQueue *queue, *n;
321 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
322 if (!queue->valid) {
323 uhci_queue_free(queue, "validate-end");
328 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
330 UHCIQueue *queue, *n;
332 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
333 if (queue->ep->dev == dev) {
334 uhci_queue_free(queue, "cancel-device");
339 static void uhci_async_cancel_all(UHCIState *s)
341 UHCIQueue *queue, *nq;
343 QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
344 uhci_queue_free(queue, "cancel-all");
348 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
350 UHCIQueue *queue;
351 UHCIAsync *async;
353 QTAILQ_FOREACH(queue, &s->queues, next) {
354 QTAILQ_FOREACH(async, &queue->asyncs, next) {
355 if (async->td_addr == td_addr) {
356 return async;
360 return NULL;
363 static void uhci_update_irq(UHCIState *s)
365 int level;
366 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
367 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
368 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
369 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
370 (s->status & UHCI_STS_HSERR) ||
371 (s->status & UHCI_STS_HCPERR)) {
372 level = 1;
373 } else {
374 level = 0;
376 qemu_set_irq(s->dev.irq[s->irq_pin], level);
379 static void uhci_reset(void *opaque)
381 UHCIState *s = opaque;
382 uint8_t *pci_conf;
383 int i;
384 UHCIPort *port;
386 trace_usb_uhci_reset();
388 pci_conf = s->dev.config;
390 pci_conf[0x6a] = 0x01; /* usb clock */
391 pci_conf[0x6b] = 0x00;
392 s->cmd = 0;
393 s->status = 0;
394 s->status2 = 0;
395 s->intr = 0;
396 s->fl_base_addr = 0;
397 s->sof_timing = 64;
399 for(i = 0; i < NB_PORTS; i++) {
400 port = &s->ports[i];
401 port->ctrl = 0x0080;
402 if (port->port.dev && port->port.dev->attached) {
403 usb_port_reset(&port->port);
407 uhci_async_cancel_all(s);
408 qemu_bh_cancel(s->bh);
409 uhci_update_irq(s);
412 static const VMStateDescription vmstate_uhci_port = {
413 .name = "uhci port",
414 .version_id = 1,
415 .minimum_version_id = 1,
416 .minimum_version_id_old = 1,
417 .fields = (VMStateField []) {
418 VMSTATE_UINT16(ctrl, UHCIPort),
419 VMSTATE_END_OF_LIST()
423 static int uhci_post_load(void *opaque, int version_id)
425 UHCIState *s = opaque;
427 if (version_id < 2) {
428 s->expire_time = qemu_get_clock_ns(vm_clock) +
429 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
431 return 0;
434 static const VMStateDescription vmstate_uhci = {
435 .name = "uhci",
436 .version_id = 2,
437 .minimum_version_id = 1,
438 .minimum_version_id_old = 1,
439 .post_load = uhci_post_load,
440 .fields = (VMStateField []) {
441 VMSTATE_PCI_DEVICE(dev, UHCIState),
442 VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
443 VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
444 vmstate_uhci_port, UHCIPort),
445 VMSTATE_UINT16(cmd, UHCIState),
446 VMSTATE_UINT16(status, UHCIState),
447 VMSTATE_UINT16(intr, UHCIState),
448 VMSTATE_UINT16(frnum, UHCIState),
449 VMSTATE_UINT32(fl_base_addr, UHCIState),
450 VMSTATE_UINT8(sof_timing, UHCIState),
451 VMSTATE_UINT8(status2, UHCIState),
452 VMSTATE_TIMER(frame_timer, UHCIState),
453 VMSTATE_INT64_V(expire_time, UHCIState, 2),
454 VMSTATE_END_OF_LIST()
458 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
460 UHCIState *s = opaque;
462 addr &= 0x1f;
463 switch(addr) {
464 case 0x0c:
465 s->sof_timing = val;
466 break;
470 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
472 UHCIState *s = opaque;
473 uint32_t val;
475 addr &= 0x1f;
476 switch(addr) {
477 case 0x0c:
478 val = s->sof_timing;
479 break;
480 default:
481 val = 0xff;
482 break;
484 return val;
487 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
489 UHCIState *s = opaque;
491 addr &= 0x1f;
492 trace_usb_uhci_mmio_writew(addr, val);
494 switch(addr) {
495 case 0x00:
496 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
497 /* start frame processing */
498 trace_usb_uhci_schedule_start();
499 s->expire_time = qemu_get_clock_ns(vm_clock) +
500 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
501 qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
502 s->status &= ~UHCI_STS_HCHALTED;
503 } else if (!(val & UHCI_CMD_RS)) {
504 s->status |= UHCI_STS_HCHALTED;
506 if (val & UHCI_CMD_GRESET) {
507 UHCIPort *port;
508 int i;
510 /* send reset on the USB bus */
511 for(i = 0; i < NB_PORTS; i++) {
512 port = &s->ports[i];
513 usb_device_reset(port->port.dev);
515 uhci_reset(s);
516 return;
518 if (val & UHCI_CMD_HCRESET) {
519 uhci_reset(s);
520 return;
522 s->cmd = val;
523 break;
524 case 0x02:
525 s->status &= ~val;
526 /* XXX: the chip spec is not coherent, so we add a hidden
527 register to distinguish between IOC and SPD */
528 if (val & UHCI_STS_USBINT)
529 s->status2 = 0;
530 uhci_update_irq(s);
531 break;
532 case 0x04:
533 s->intr = val;
534 uhci_update_irq(s);
535 break;
536 case 0x06:
537 if (s->status & UHCI_STS_HCHALTED)
538 s->frnum = val & 0x7ff;
539 break;
540 case 0x10 ... 0x1f:
542 UHCIPort *port;
543 USBDevice *dev;
544 int n;
546 n = (addr >> 1) & 7;
547 if (n >= NB_PORTS)
548 return;
549 port = &s->ports[n];
550 dev = port->port.dev;
551 if (dev && dev->attached) {
552 /* port reset */
553 if ( (val & UHCI_PORT_RESET) &&
554 !(port->ctrl & UHCI_PORT_RESET) ) {
555 usb_device_reset(dev);
558 port->ctrl &= UHCI_PORT_READ_ONLY;
559 /* enabled may only be set if a device is connected */
560 if (!(port->ctrl & UHCI_PORT_CCS)) {
561 val &= ~UHCI_PORT_EN;
563 port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
564 /* some bits are reset when a '1' is written to them */
565 port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
567 break;
571 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
573 UHCIState *s = opaque;
574 uint32_t val;
576 addr &= 0x1f;
577 switch(addr) {
578 case 0x00:
579 val = s->cmd;
580 break;
581 case 0x02:
582 val = s->status;
583 break;
584 case 0x04:
585 val = s->intr;
586 break;
587 case 0x06:
588 val = s->frnum;
589 break;
590 case 0x10 ... 0x1f:
592 UHCIPort *port;
593 int n;
594 n = (addr >> 1) & 7;
595 if (n >= NB_PORTS)
596 goto read_default;
597 port = &s->ports[n];
598 val = port->ctrl;
600 break;
601 default:
602 read_default:
603 val = 0xff7f; /* disabled port */
604 break;
607 trace_usb_uhci_mmio_readw(addr, val);
609 return val;
612 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
614 UHCIState *s = opaque;
616 addr &= 0x1f;
617 trace_usb_uhci_mmio_writel(addr, val);
619 switch(addr) {
620 case 0x08:
621 s->fl_base_addr = val & ~0xfff;
622 break;
626 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
628 UHCIState *s = opaque;
629 uint32_t val;
631 addr &= 0x1f;
632 switch(addr) {
633 case 0x08:
634 val = s->fl_base_addr;
635 break;
636 default:
637 val = 0xffffffff;
638 break;
640 trace_usb_uhci_mmio_readl(addr, val);
641 return val;
644 /* signal resume if controller suspended */
645 static void uhci_resume (void *opaque)
647 UHCIState *s = (UHCIState *)opaque;
649 if (!s)
650 return;
652 if (s->cmd & UHCI_CMD_EGSM) {
653 s->cmd |= UHCI_CMD_FGR;
654 s->status |= UHCI_STS_RD;
655 uhci_update_irq(s);
659 static void uhci_attach(USBPort *port1)
661 UHCIState *s = port1->opaque;
662 UHCIPort *port = &s->ports[port1->index];
664 /* set connect status */
665 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
667 /* update speed */
668 if (port->port.dev->speed == USB_SPEED_LOW) {
669 port->ctrl |= UHCI_PORT_LSDA;
670 } else {
671 port->ctrl &= ~UHCI_PORT_LSDA;
674 uhci_resume(s);
677 static void uhci_detach(USBPort *port1)
679 UHCIState *s = port1->opaque;
680 UHCIPort *port = &s->ports[port1->index];
682 uhci_async_cancel_device(s, port1->dev);
684 /* set connect status */
685 if (port->ctrl & UHCI_PORT_CCS) {
686 port->ctrl &= ~UHCI_PORT_CCS;
687 port->ctrl |= UHCI_PORT_CSC;
689 /* disable port */
690 if (port->ctrl & UHCI_PORT_EN) {
691 port->ctrl &= ~UHCI_PORT_EN;
692 port->ctrl |= UHCI_PORT_ENC;
695 uhci_resume(s);
698 static void uhci_child_detach(USBPort *port1, USBDevice *child)
700 UHCIState *s = port1->opaque;
702 uhci_async_cancel_device(s, child);
705 static void uhci_wakeup(USBPort *port1)
707 UHCIState *s = port1->opaque;
708 UHCIPort *port = &s->ports[port1->index];
710 if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
711 port->ctrl |= UHCI_PORT_RD;
712 uhci_resume(s);
716 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
718 USBDevice *dev;
719 int i;
721 for (i = 0; i < NB_PORTS; i++) {
722 UHCIPort *port = &s->ports[i];
723 if (!(port->ctrl & UHCI_PORT_EN)) {
724 continue;
726 dev = usb_find_device(&port->port, addr);
727 if (dev != NULL) {
728 return dev;
731 return NULL;
734 static void uhci_read_td(UHCIState *s, UHCI_TD *td, uint32_t link)
736 pci_dma_read(&s->dev, link & ~0xf, td, sizeof(*td));
737 le32_to_cpus(&td->link);
738 le32_to_cpus(&td->ctrl);
739 le32_to_cpus(&td->token);
740 le32_to_cpus(&td->buffer);
743 static int uhci_handle_td_error(UHCIState *s, UHCI_TD *td, uint32_t td_addr,
744 int status, uint32_t *int_mask)
746 uint32_t queue_token = uhci_queue_token(td);
747 int ret;
749 switch (status) {
750 case USB_RET_NAK:
751 td->ctrl |= TD_CTRL_NAK;
752 return TD_RESULT_NEXT_QH;
754 case USB_RET_STALL:
755 td->ctrl |= TD_CTRL_STALL;
756 trace_usb_uhci_packet_complete_stall(queue_token, td_addr);
757 ret = TD_RESULT_NEXT_QH;
758 break;
760 case USB_RET_BABBLE:
761 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
762 /* frame interrupted */
763 trace_usb_uhci_packet_complete_babble(queue_token, td_addr);
764 ret = TD_RESULT_STOP_FRAME;
765 break;
767 case USB_RET_IOERROR:
768 case USB_RET_NODEV:
769 default:
770 td->ctrl |= TD_CTRL_TIMEOUT;
771 td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
772 trace_usb_uhci_packet_complete_error(queue_token, td_addr);
773 ret = TD_RESULT_NEXT_QH;
774 break;
777 td->ctrl &= ~TD_CTRL_ACTIVE;
778 s->status |= UHCI_STS_USBERR;
779 if (td->ctrl & TD_CTRL_IOC) {
780 *int_mask |= 0x01;
782 uhci_update_irq(s);
783 return ret;
786 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
788 int len = 0, max_len;
789 uint8_t pid;
791 max_len = ((td->token >> 21) + 1) & 0x7ff;
792 pid = td->token & 0xff;
794 if (td->ctrl & TD_CTRL_IOS)
795 td->ctrl &= ~TD_CTRL_ACTIVE;
797 if (async->packet.status != USB_RET_SUCCESS) {
798 return uhci_handle_td_error(s, td, async->td_addr,
799 async->packet.status, int_mask);
802 len = async->packet.actual_length;
803 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
805 /* The NAK bit may have been set by a previous frame, so clear it
806 here. The docs are somewhat unclear, but win2k relies on this
807 behavior. */
808 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
809 if (td->ctrl & TD_CTRL_IOC)
810 *int_mask |= 0x01;
812 if (pid == USB_TOKEN_IN) {
813 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
814 *int_mask |= 0x02;
815 /* short packet: do not update QH */
816 trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
817 async->td_addr);
818 return TD_RESULT_NEXT_QH;
822 /* success */
823 trace_usb_uhci_packet_complete_success(async->queue->token,
824 async->td_addr);
825 return TD_RESULT_COMPLETE;
828 static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
829 UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
831 int ret, max_len;
832 bool spd;
833 bool queuing = (q != NULL);
834 uint8_t pid = td->token & 0xff;
835 UHCIAsync *async = uhci_async_find_td(s, td_addr);
837 if (async) {
838 if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
839 assert(q == NULL || q == async->queue);
840 q = async->queue;
841 } else {
842 uhci_queue_free(async->queue, "guest re-used pending td");
843 async = NULL;
847 if (q == NULL) {
848 q = uhci_queue_find(s, td);
849 if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
850 uhci_queue_free(q, "guest re-used qh");
851 q = NULL;
855 if (q) {
856 q->valid = 32;
859 /* Is active ? */
860 if (!(td->ctrl & TD_CTRL_ACTIVE)) {
861 if (async) {
862 /* Guest marked a pending td non-active, cancel the queue */
863 uhci_queue_free(async->queue, "pending td non-active");
866 * ehci11d spec page 22: "Even if the Active bit in the TD is already
867 * cleared when the TD is fetched ... an IOC interrupt is generated"
869 if (td->ctrl & TD_CTRL_IOC) {
870 *int_mask |= 0x01;
872 return TD_RESULT_NEXT_QH;
875 if (async) {
876 if (queuing) {
877 /* we are busy filling the queue, we are not prepared
878 to consume completed packages then, just leave them
879 in async state */
880 return TD_RESULT_ASYNC_CONT;
882 if (!async->done) {
883 UHCI_TD last_td;
884 UHCIAsync *last = QTAILQ_LAST(&async->queue->asyncs, asyncs_head);
886 * While we are waiting for the current td to complete, the guest
887 * may have added more tds to the queue. Note we re-read the td
888 * rather then caching it, as we want to see guest made changes!
890 uhci_read_td(s, &last_td, last->td_addr);
891 uhci_queue_fill(async->queue, &last_td);
893 return TD_RESULT_ASYNC_CONT;
895 uhci_async_unlink(async);
896 goto done;
899 if (s->completions_only) {
900 return TD_RESULT_ASYNC_CONT;
903 /* Allocate new packet */
904 if (q == NULL) {
905 USBDevice *dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
906 USBEndpoint *ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
908 if (ep == NULL) {
909 return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
910 int_mask);
912 q = uhci_queue_new(s, qh_addr, td, ep);
914 async = uhci_async_alloc(q, td_addr);
916 max_len = ((td->token >> 21) + 1) & 0x7ff;
917 spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
918 usb_packet_setup(&async->packet, pid, q->ep, td_addr, spd,
919 (td->ctrl & TD_CTRL_IOC) != 0);
920 qemu_sglist_add(&async->sgl, td->buffer, max_len);
921 usb_packet_map(&async->packet, &async->sgl);
923 switch(pid) {
924 case USB_TOKEN_OUT:
925 case USB_TOKEN_SETUP:
926 usb_handle_packet(q->ep->dev, &async->packet);
927 if (async->packet.status == USB_RET_SUCCESS) {
928 async->packet.actual_length = max_len;
930 break;
932 case USB_TOKEN_IN:
933 usb_handle_packet(q->ep->dev, &async->packet);
934 break;
936 default:
937 /* invalid pid : frame interrupted */
938 usb_packet_unmap(&async->packet, &async->sgl);
939 uhci_async_free(async);
940 s->status |= UHCI_STS_HCPERR;
941 uhci_update_irq(s);
942 return TD_RESULT_STOP_FRAME;
945 if (async->packet.status == USB_RET_ASYNC) {
946 uhci_async_link(async);
947 if (!queuing) {
948 uhci_queue_fill(q, td);
950 return TD_RESULT_ASYNC_START;
953 done:
954 ret = uhci_complete_td(s, td, async, int_mask);
955 usb_packet_unmap(&async->packet, &async->sgl);
956 uhci_async_free(async);
957 return ret;
960 static void uhci_async_complete(USBPort *port, USBPacket *packet)
962 UHCIAsync *async = container_of(packet, UHCIAsync, packet);
963 UHCIState *s = async->queue->uhci;
965 if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
966 uhci_async_cancel(async);
967 return;
970 async->done = 1;
971 /* Force processing of this packet *now*, needed for migration */
972 s->completions_only = true;
973 qemu_bh_schedule(s->bh);
976 static int is_valid(uint32_t link)
978 return (link & 1) == 0;
981 static int is_qh(uint32_t link)
983 return (link & 2) != 0;
986 static int depth_first(uint32_t link)
988 return (link & 4) != 0;
991 /* QH DB used for detecting QH loops */
992 #define UHCI_MAX_QUEUES 128
993 typedef struct {
994 uint32_t addr[UHCI_MAX_QUEUES];
995 int count;
996 } QhDb;
998 static void qhdb_reset(QhDb *db)
1000 db->count = 0;
1003 /* Add QH to DB. Returns 1 if already present or DB is full. */
1004 static int qhdb_insert(QhDb *db, uint32_t addr)
1006 int i;
1007 for (i = 0; i < db->count; i++)
1008 if (db->addr[i] == addr)
1009 return 1;
1011 if (db->count >= UHCI_MAX_QUEUES)
1012 return 1;
1014 db->addr[db->count++] = addr;
1015 return 0;
1018 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td)
1020 uint32_t int_mask = 0;
1021 uint32_t plink = td->link;
1022 UHCI_TD ptd;
1023 int ret;
1025 while (is_valid(plink)) {
1026 uhci_read_td(q->uhci, &ptd, plink);
1027 if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
1028 break;
1030 if (uhci_queue_token(&ptd) != q->token) {
1031 break;
1033 trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
1034 ret = uhci_handle_td(q->uhci, q, q->qh_addr, &ptd, plink, &int_mask);
1035 if (ret == TD_RESULT_ASYNC_CONT) {
1036 break;
1038 assert(ret == TD_RESULT_ASYNC_START);
1039 assert(int_mask == 0);
1040 plink = ptd.link;
1042 usb_device_flush_ep_queue(q->ep->dev, q->ep);
1045 static void uhci_process_frame(UHCIState *s)
1047 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
1048 uint32_t curr_qh, td_count = 0;
1049 int cnt, ret;
1050 UHCI_TD td;
1051 UHCI_QH qh;
1052 QhDb qhdb;
1054 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
1056 pci_dma_read(&s->dev, frame_addr, &link, 4);
1057 le32_to_cpus(&link);
1059 int_mask = 0;
1060 curr_qh = 0;
1062 qhdb_reset(&qhdb);
1064 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1065 if (!s->completions_only && s->frame_bytes >= s->frame_bandwidth) {
1066 /* We've reached the usb 1.1 bandwidth, which is
1067 1280 bytes/frame, stop processing */
1068 trace_usb_uhci_frame_stop_bandwidth();
1069 break;
1071 if (is_qh(link)) {
1072 /* QH */
1073 trace_usb_uhci_qh_load(link & ~0xf);
1075 if (qhdb_insert(&qhdb, link)) {
1077 * We're going in circles. Which is not a bug because
1078 * HCD is allowed to do that as part of the BW management.
1080 * Stop processing here if no transaction has been done
1081 * since we've been here last time.
1083 if (td_count == 0) {
1084 trace_usb_uhci_frame_loop_stop_idle();
1085 break;
1086 } else {
1087 trace_usb_uhci_frame_loop_continue();
1088 td_count = 0;
1089 qhdb_reset(&qhdb);
1090 qhdb_insert(&qhdb, link);
1094 pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1095 le32_to_cpus(&qh.link);
1096 le32_to_cpus(&qh.el_link);
1098 if (!is_valid(qh.el_link)) {
1099 /* QH w/o elements */
1100 curr_qh = 0;
1101 link = qh.link;
1102 } else {
1103 /* QH with elements */
1104 curr_qh = link;
1105 link = qh.el_link;
1107 continue;
1110 /* TD */
1111 uhci_read_td(s, &td, link);
1112 trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1114 old_td_ctrl = td.ctrl;
1115 ret = uhci_handle_td(s, NULL, curr_qh, &td, link, &int_mask);
1116 if (old_td_ctrl != td.ctrl) {
1117 /* update the status bits of the TD */
1118 val = cpu_to_le32(td.ctrl);
1119 pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1122 switch (ret) {
1123 case TD_RESULT_STOP_FRAME: /* interrupted frame */
1124 goto out;
1126 case TD_RESULT_NEXT_QH:
1127 case TD_RESULT_ASYNC_CONT:
1128 trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1129 link = curr_qh ? qh.link : td.link;
1130 continue;
1132 case TD_RESULT_ASYNC_START:
1133 trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1134 link = curr_qh ? qh.link : td.link;
1135 continue;
1137 case TD_RESULT_COMPLETE:
1138 trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1139 link = td.link;
1140 td_count++;
1141 s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1143 if (curr_qh) {
1144 /* update QH element link */
1145 qh.el_link = link;
1146 val = cpu_to_le32(qh.el_link);
1147 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1149 if (!depth_first(link)) {
1150 /* done with this QH */
1151 curr_qh = 0;
1152 link = qh.link;
1155 break;
1157 default:
1158 assert(!"unknown return code");
1161 /* go to the next entry */
1164 out:
1165 s->pending_int_mask |= int_mask;
1168 static void uhci_bh(void *opaque)
1170 UHCIState *s = opaque;
1171 uhci_process_frame(s);
1174 static void uhci_frame_timer(void *opaque)
1176 UHCIState *s = opaque;
1178 /* prepare the timer for the next frame */
1179 s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1180 s->frame_bytes = 0;
1181 s->completions_only = false;
1182 qemu_bh_cancel(s->bh);
1184 if (!(s->cmd & UHCI_CMD_RS)) {
1185 /* Full stop */
1186 trace_usb_uhci_schedule_stop();
1187 qemu_del_timer(s->frame_timer);
1188 uhci_async_cancel_all(s);
1189 /* set hchalted bit in status - UHCI11D 2.1.2 */
1190 s->status |= UHCI_STS_HCHALTED;
1191 return;
1194 /* Complete the previous frame */
1195 if (s->pending_int_mask) {
1196 s->status2 |= s->pending_int_mask;
1197 s->status |= UHCI_STS_USBINT;
1198 uhci_update_irq(s);
1200 s->pending_int_mask = 0;
1202 /* Start new frame */
1203 s->frnum = (s->frnum + 1) & 0x7ff;
1205 trace_usb_uhci_frame_start(s->frnum);
1207 uhci_async_validate_begin(s);
1209 uhci_process_frame(s);
1211 uhci_async_validate_end(s);
1213 qemu_mod_timer(s->frame_timer, s->expire_time);
1216 static const MemoryRegionPortio uhci_portio[] = {
1217 { 0, 32, 2, .write = uhci_ioport_writew, },
1218 { 0, 32, 2, .read = uhci_ioport_readw, },
1219 { 0, 32, 4, .write = uhci_ioport_writel, },
1220 { 0, 32, 4, .read = uhci_ioport_readl, },
1221 { 0, 32, 1, .write = uhci_ioport_writeb, },
1222 { 0, 32, 1, .read = uhci_ioport_readb, },
1223 PORTIO_END_OF_LIST()
1226 static const MemoryRegionOps uhci_ioport_ops = {
1227 .old_portio = uhci_portio,
1230 static USBPortOps uhci_port_ops = {
1231 .attach = uhci_attach,
1232 .detach = uhci_detach,
1233 .child_detach = uhci_child_detach,
1234 .wakeup = uhci_wakeup,
1235 .complete = uhci_async_complete,
1238 static USBBusOps uhci_bus_ops = {
1241 static int usb_uhci_common_initfn(PCIDevice *dev)
1243 PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
1244 UHCIPCIDeviceClass *u = container_of(pc, UHCIPCIDeviceClass, parent_class);
1245 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1246 uint8_t *pci_conf = s->dev.config;
1247 int i;
1249 pci_conf[PCI_CLASS_PROG] = 0x00;
1250 /* TODO: reset value should be 0. */
1251 pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1253 s->irq_pin = u->info.irq_pin;
1254 pci_config_set_interrupt_pin(pci_conf, s->irq_pin + 1);
1256 if (s->masterbus) {
1257 USBPort *ports[NB_PORTS];
1258 for(i = 0; i < NB_PORTS; i++) {
1259 ports[i] = &s->ports[i].port;
1261 if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1262 s->firstport, s, &uhci_port_ops,
1263 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1264 return -1;
1266 } else {
1267 usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1268 for (i = 0; i < NB_PORTS; i++) {
1269 usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1270 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1273 s->bh = qemu_bh_new(uhci_bh, s);
1274 s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1275 s->num_ports_vmstate = NB_PORTS;
1276 QTAILQ_INIT(&s->queues);
1278 qemu_register_reset(uhci_reset, s);
1280 memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1281 /* Use region 4 for consistency with real hardware. BSD guests seem
1282 to rely on this. */
1283 pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1285 return 0;
1288 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1290 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1291 uint8_t *pci_conf = s->dev.config;
1293 /* USB misc control 1/2 */
1294 pci_set_long(pci_conf + 0x40,0x00001000);
1295 /* PM capability */
1296 pci_set_long(pci_conf + 0x80,0x00020001);
1297 /* USB legacy support */
1298 pci_set_long(pci_conf + 0xc0,0x00002000);
1300 return usb_uhci_common_initfn(dev);
1303 static void usb_uhci_exit(PCIDevice *dev)
1305 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1307 memory_region_destroy(&s->io_bar);
1310 static Property uhci_properties[] = {
1311 DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1312 DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1313 DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1314 DEFINE_PROP_END_OF_LIST(),
1317 static void uhci_class_init(ObjectClass *klass, void *data)
1319 DeviceClass *dc = DEVICE_CLASS(klass);
1320 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1321 UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);
1322 UHCIInfo *info = data;
1324 k->init = info->initfn ? info->initfn : usb_uhci_common_initfn;
1325 k->exit = info->unplug ? usb_uhci_exit : NULL;
1326 k->vendor_id = info->vendor_id;
1327 k->device_id = info->device_id;
1328 k->revision = info->revision;
1329 k->class_id = PCI_CLASS_SERIAL_USB;
1330 k->no_hotplug = 1;
1331 dc->vmsd = &vmstate_uhci;
1332 dc->props = uhci_properties;
1333 u->info = *info;
1336 static UHCIInfo uhci_info[] = {
1338 .name = "piix3-usb-uhci",
1339 .vendor_id = PCI_VENDOR_ID_INTEL,
1340 .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1341 .revision = 0x01,
1342 .irq_pin = 3,
1343 .unplug = true,
1345 .name = "piix4-usb-uhci",
1346 .vendor_id = PCI_VENDOR_ID_INTEL,
1347 .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1348 .revision = 0x01,
1349 .irq_pin = 3,
1350 .unplug = true,
1352 .name = "vt82c686b-usb-uhci",
1353 .vendor_id = PCI_VENDOR_ID_VIA,
1354 .device_id = PCI_DEVICE_ID_VIA_UHCI,
1355 .revision = 0x01,
1356 .irq_pin = 3,
1357 .initfn = usb_uhci_vt82c686b_initfn,
1358 .unplug = true,
1360 .name = "ich9-usb-uhci1", /* 00:1d.0 */
1361 .vendor_id = PCI_VENDOR_ID_INTEL,
1362 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1363 .revision = 0x03,
1364 .irq_pin = 0,
1365 .unplug = false,
1367 .name = "ich9-usb-uhci2", /* 00:1d.1 */
1368 .vendor_id = PCI_VENDOR_ID_INTEL,
1369 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1370 .revision = 0x03,
1371 .irq_pin = 1,
1372 .unplug = false,
1374 .name = "ich9-usb-uhci3", /* 00:1d.2 */
1375 .vendor_id = PCI_VENDOR_ID_INTEL,
1376 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1377 .revision = 0x03,
1378 .irq_pin = 2,
1379 .unplug = false,
1381 .name = "ich9-usb-uhci4", /* 00:1a.0 */
1382 .vendor_id = PCI_VENDOR_ID_INTEL,
1383 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI4,
1384 .revision = 0x03,
1385 .irq_pin = 0,
1386 .unplug = false,
1388 .name = "ich9-usb-uhci5", /* 00:1a.1 */
1389 .vendor_id = PCI_VENDOR_ID_INTEL,
1390 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI5,
1391 .revision = 0x03,
1392 .irq_pin = 1,
1393 .unplug = false,
1395 .name = "ich9-usb-uhci6", /* 00:1a.2 */
1396 .vendor_id = PCI_VENDOR_ID_INTEL,
1397 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI6,
1398 .revision = 0x03,
1399 .irq_pin = 2,
1400 .unplug = false,
1404 static void uhci_register_types(void)
1406 TypeInfo uhci_type_info = {
1407 .parent = TYPE_PCI_DEVICE,
1408 .instance_size = sizeof(UHCIState),
1409 .class_size = sizeof(UHCIPCIDeviceClass),
1410 .class_init = uhci_class_init,
1412 int i;
1414 for (i = 0; i < ARRAY_SIZE(uhci_info); i++) {
1415 uhci_type_info.name = uhci_info[i].name;
1416 uhci_type_info.class_data = uhci_info + i;
1417 type_register(&uhci_type_info);
1421 type_init(uhci_register_types)