2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 //#define DEBUG_PACKET
29 #define UHCI_CMD_GRESET (1 << 2)
30 #define UHCI_CMD_HCRESET (1 << 1)
31 #define UHCI_CMD_RS (1 << 0)
33 #define UHCI_STS_HCHALTED (1 << 5)
34 #define UHCI_STS_HCPERR (1 << 4)
35 #define UHCI_STS_HSERR (1 << 3)
36 #define UHCI_STS_RD (1 << 2)
37 #define UHCI_STS_USBERR (1 << 1)
38 #define UHCI_STS_USBINT (1 << 0)
40 #define TD_CTRL_SPD (1 << 29)
41 #define TD_CTRL_ERROR_SHIFT 27
42 #define TD_CTRL_IOS (1 << 25)
43 #define TD_CTRL_IOC (1 << 24)
44 #define TD_CTRL_ACTIVE (1 << 23)
45 #define TD_CTRL_STALL (1 << 22)
46 #define TD_CTRL_BABBLE (1 << 20)
47 #define TD_CTRL_NAK (1 << 19)
48 #define TD_CTRL_TIMEOUT (1 << 18)
50 #define UHCI_PORT_RESET (1 << 9)
51 #define UHCI_PORT_LSDA (1 << 8)
52 #define UHCI_PORT_ENC (1 << 3)
53 #define UHCI_PORT_EN (1 << 2)
54 #define UHCI_PORT_CSC (1 << 1)
55 #define UHCI_PORT_CCS (1 << 0)
57 #define FRAME_TIMER_FREQ 1000
59 #define FRAME_MAX_LOOPS 100
63 typedef struct UHCIPort
{
68 typedef struct UHCIState
{
70 uint16_t cmd
; /* cmd register */
72 uint16_t intr
; /* interrupt enable register */
73 uint16_t frnum
; /* frame number */
74 uint32_t fl_base_addr
; /* frame list base address */
76 uint8_t status2
; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
77 QEMUTimer
*frame_timer
;
78 UHCIPort ports
[NB_PORTS
];
81 typedef struct UHCI_TD
{
83 uint32_t ctrl
; /* see TD_CTRL_xxx */
88 typedef struct UHCI_QH
{
93 static void uhci_attach(USBPort
*port1
, USBDevice
*dev
);
95 static void uhci_update_irq(UHCIState
*s
)
98 if (((s
->status2
& 1) && (s
->intr
& (1 << 2))) ||
99 ((s
->status2
& 2) && (s
->intr
& (1 << 3))) ||
100 ((s
->status
& UHCI_STS_USBERR
) && (s
->intr
& (1 << 0))) ||
101 ((s
->status
& UHCI_STS_RD
) && (s
->intr
& (1 << 1))) ||
102 (s
->status
& UHCI_STS_HSERR
) ||
103 (s
->status
& UHCI_STS_HCPERR
)) {
108 pci_set_irq(&s
->dev
, 3, level
);
111 static void uhci_reset(UHCIState
*s
)
117 pci_conf
= s
->dev
.config
;
119 pci_conf
[0x6a] = 0x01; /* usb clock */
120 pci_conf
[0x6b] = 0x00;
127 for(i
= 0; i
< NB_PORTS
; i
++) {
131 uhci_attach(&port
->port
, port
->port
.dev
);
135 static void uhci_ioport_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
137 UHCIState
*s
= opaque
;
147 static uint32_t uhci_ioport_readb(void *opaque
, uint32_t addr
)
149 UHCIState
*s
= opaque
;
164 static void uhci_ioport_writew(void *opaque
, uint32_t addr
, uint32_t val
)
166 UHCIState
*s
= opaque
;
170 printf("uhci writew port=0x%04x val=0x%04x\n", addr
, val
);
174 if ((val
& UHCI_CMD_RS
) && !(s
->cmd
& UHCI_CMD_RS
)) {
175 /* start frame processing */
176 qemu_mod_timer(s
->frame_timer
, qemu_get_clock(vm_clock
));
177 s
->status
&= ~UHCI_STS_HCHALTED
;
178 } else if (!(val
& UHCI_CMD_RS
)) {
179 s
->status
|= UHCI_STS_HCHALTED
;
181 if (val
& UHCI_CMD_GRESET
) {
186 /* send reset on the USB bus */
187 for(i
= 0; i
< NB_PORTS
; i
++) {
189 dev
= port
->port
.dev
;
191 dev
->handle_packet(dev
,
192 USB_MSG_RESET
, 0, 0, NULL
, 0);
198 if (val
& UHCI_CMD_HCRESET
) {
206 /* XXX: the chip spec is not coherent, so we add a hidden
207 register to distinguish between IOC and SPD */
208 if (val
& UHCI_STS_USBINT
)
217 if (s
->status
& UHCI_STS_HCHALTED
)
218 s
->frnum
= val
& 0x7ff;
230 dev
= port
->port
.dev
;
233 if ( (val
& UHCI_PORT_RESET
) &&
234 !(port
->ctrl
& UHCI_PORT_RESET
) ) {
235 dev
->handle_packet(dev
,
236 USB_MSG_RESET
, 0, 0, NULL
, 0);
239 port
->ctrl
= (port
->ctrl
& 0x01fb) | (val
& ~0x01fb);
240 /* some bits are reset when a '1' is written to them */
241 port
->ctrl
&= ~(val
& 0x000a);
247 static uint32_t uhci_ioport_readw(void *opaque
, uint32_t addr
)
249 UHCIState
*s
= opaque
;
279 val
= 0xff7f; /* disabled port */
283 printf("uhci readw port=0x%04x val=0x%04x\n", addr
, val
);
288 static void uhci_ioport_writel(void *opaque
, uint32_t addr
, uint32_t val
)
290 UHCIState
*s
= opaque
;
294 printf("uhci writel port=0x%04x val=0x%08x\n", addr
, val
);
298 s
->fl_base_addr
= val
& ~0xfff;
303 static uint32_t uhci_ioport_readl(void *opaque
, uint32_t addr
)
305 UHCIState
*s
= opaque
;
311 val
= s
->fl_base_addr
;
320 static void uhci_attach(USBPort
*port1
, USBDevice
*dev
)
322 UHCIState
*s
= port1
->opaque
;
323 UHCIPort
*port
= &s
->ports
[port1
->index
];
326 if (port
->port
.dev
) {
327 usb_attach(port1
, NULL
);
329 /* set connect status */
330 if (!(port
->ctrl
& UHCI_PORT_CCS
)) {
331 port
->ctrl
|= UHCI_PORT_CCS
| UHCI_PORT_CSC
;
334 if (dev
->speed
== USB_SPEED_LOW
)
335 port
->ctrl
|= UHCI_PORT_LSDA
;
337 port
->ctrl
&= ~UHCI_PORT_LSDA
;
338 port
->port
.dev
= dev
;
339 /* send the attach message */
340 dev
->handle_packet(dev
,
341 USB_MSG_ATTACH
, 0, 0, NULL
, 0);
343 /* set connect status */
344 if (!(port
->ctrl
& UHCI_PORT_CCS
)) {
345 port
->ctrl
|= UHCI_PORT_CCS
| UHCI_PORT_CSC
;
348 if (port
->ctrl
& UHCI_PORT_EN
) {
349 port
->ctrl
&= ~UHCI_PORT_EN
;
350 port
->ctrl
|= UHCI_PORT_ENC
;
352 dev
= port
->port
.dev
;
354 /* send the detach message */
355 dev
->handle_packet(dev
,
356 USB_MSG_DETACH
, 0, 0, NULL
, 0);
358 port
->port
.dev
= NULL
;
362 static int uhci_broadcast_packet(UHCIState
*s
, uint8_t pid
,
363 uint8_t devaddr
, uint8_t devep
,
364 uint8_t *data
, int len
)
374 case USB_TOKEN_SETUP
: pidstr
= "SETUP"; break;
375 case USB_TOKEN_IN
: pidstr
= "IN"; break;
376 case USB_TOKEN_OUT
: pidstr
= "OUT"; break;
377 default: pidstr
= "?"; break;
379 printf("frame %d: pid=%s addr=0x%02x ep=%d len=%d\n",
380 s
->frnum
, pidstr
, devaddr
, devep
, len
);
381 if (pid
!= USB_TOKEN_IN
) {
382 printf(" data_out=");
383 for(i
= 0; i
< len
; i
++) {
384 printf(" %02x", data
[i
]);
390 for(i
= 0; i
< NB_PORTS
; i
++) {
392 dev
= port
->port
.dev
;
393 if (dev
&& (port
->ctrl
& UHCI_PORT_EN
)) {
394 ret
= dev
->handle_packet(dev
, pid
,
397 if (ret
!= USB_RET_NODEV
) {
400 printf(" ret=%d ", ret
);
401 if (pid
== USB_TOKEN_IN
&& ret
> 0) {
403 for(i
= 0; i
< ret
; i
++) {
404 printf(" %02x", data
[i
]);
414 return USB_RET_NODEV
;
417 /* return -1 if fatal error (frame must be stopped)
419 1 if TD unsuccessful or inactive
421 static int uhci_handle_td(UHCIState
*s
, UHCI_TD
*td
, int *int_mask
)
425 int len
, max_len
, err
, ret
;
427 if (td
->ctrl
& TD_CTRL_IOC
) {
431 if (!(td
->ctrl
& TD_CTRL_ACTIVE
))
435 max_len
= ((td
->token
>> 21) + 1) & 0x7ff;
436 pid
= td
->token
& 0xff;
439 case USB_TOKEN_SETUP
:
440 cpu_physical_memory_read(td
->buffer
, buf
, max_len
);
441 ret
= uhci_broadcast_packet(s
, pid
,
442 (td
->token
>> 8) & 0x7f,
443 (td
->token
>> 15) & 0xf,
448 ret
= uhci_broadcast_packet(s
, pid
,
449 (td
->token
>> 8) & 0x7f,
450 (td
->token
>> 15) & 0xf,
456 ret
= USB_RET_BABBLE
;
459 /* write the data back */
460 cpu_physical_memory_write(td
->buffer
, buf
, len
);
467 /* invalid pid : frame interrupted */
468 s
->status
|= UHCI_STS_HCPERR
;
472 if (td
->ctrl
& TD_CTRL_IOS
)
473 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
475 td
->ctrl
= (td
->ctrl
& ~0x7ff) | ((len
- 1) & 0x7ff);
476 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
477 if (pid
== USB_TOKEN_IN
&&
478 (td
->ctrl
& TD_CTRL_SPD
) &&
481 /* short packet: do not update QH */
492 td
->ctrl
|= TD_CTRL_TIMEOUT
;
493 err
= (td
->ctrl
>> TD_CTRL_ERROR_SHIFT
) & 3;
497 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
498 s
->status
|= UHCI_STS_USBERR
;
502 td
->ctrl
= (td
->ctrl
& ~(3 << TD_CTRL_ERROR_SHIFT
)) |
503 (err
<< TD_CTRL_ERROR_SHIFT
);
506 td
->ctrl
|= TD_CTRL_NAK
;
507 if (pid
== USB_TOKEN_SETUP
)
511 td
->ctrl
|= TD_CTRL_STALL
;
512 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
515 td
->ctrl
|= TD_CTRL_BABBLE
| TD_CTRL_STALL
;
516 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
517 /* frame interrupted */
523 static void uhci_frame_timer(void *opaque
)
525 UHCIState
*s
= opaque
;
527 uint32_t frame_addr
, link
, old_td_ctrl
, val
;
528 int int_mask
, cnt
, ret
;
532 if (!(s
->cmd
& UHCI_CMD_RS
)) {
533 qemu_del_timer(s
->frame_timer
);
534 /* set hchalted bit in status - UHCI11D 2.1.2 */
535 s
->status
|= UHCI_STS_HCHALTED
;
538 frame_addr
= s
->fl_base_addr
+ ((s
->frnum
& 0x3ff) << 2);
539 cpu_physical_memory_read(frame_addr
, (uint8_t *)&link
, 4);
542 cnt
= FRAME_MAX_LOOPS
;
543 while ((link
& 1) == 0) {
549 cpu_physical_memory_read(link
& ~0xf, (uint8_t *)&qh
, sizeof(qh
));
550 le32_to_cpus(&qh
.link
);
551 le32_to_cpus(&qh
.el_link
);
553 if (qh
.el_link
& 1) {
554 /* no element : go to next entry */
556 } else if (qh
.el_link
& 2) {
563 cpu_physical_memory_read(qh
.el_link
& ~0xf,
564 (uint8_t *)&td
, sizeof(td
));
565 le32_to_cpus(&td
.link
);
566 le32_to_cpus(&td
.ctrl
);
567 le32_to_cpus(&td
.token
);
568 le32_to_cpus(&td
.buffer
);
569 old_td_ctrl
= td
.ctrl
;
570 ret
= uhci_handle_td(s
, &td
, &int_mask
);
571 /* update the status bits of the TD */
572 if (old_td_ctrl
!= td
.ctrl
) {
573 val
= cpu_to_le32(td
.ctrl
);
574 cpu_physical_memory_write((qh
.el_link
& ~0xf) + 4,
575 (const uint8_t *)&val
,
579 break; /* interrupted frame */
581 /* update qh element link */
582 qh
.el_link
= td
.link
;
583 val
= cpu_to_le32(qh
.el_link
);
584 cpu_physical_memory_write((link
& ~0xf) + 4,
585 (const uint8_t *)&val
,
587 if (qh
.el_link
& 4) {
592 /* go to next entry */
597 cpu_physical_memory_read(link
& ~0xf, (uint8_t *)&td
, sizeof(td
));
598 le32_to_cpus(&td
.link
);
599 le32_to_cpus(&td
.ctrl
);
600 le32_to_cpus(&td
.token
);
601 le32_to_cpus(&td
.buffer
);
602 old_td_ctrl
= td
.ctrl
;
603 ret
= uhci_handle_td(s
, &td
, &int_mask
);
604 /* update the status bits of the TD */
605 if (old_td_ctrl
!= td
.ctrl
) {
606 val
= cpu_to_le32(td
.ctrl
);
607 cpu_physical_memory_write((link
& ~0xf) + 4,
608 (const uint8_t *)&val
,
612 break; /* interrupted frame */
616 s
->frnum
= (s
->frnum
+ 1) & 0x7ff;
618 s
->status2
|= int_mask
;
619 s
->status
|= UHCI_STS_USBINT
;
622 /* prepare the timer for the next frame */
623 expire_time
= qemu_get_clock(vm_clock
) +
624 (ticks_per_sec
/ FRAME_TIMER_FREQ
);
625 qemu_mod_timer(s
->frame_timer
, expire_time
);
628 static void uhci_map(PCIDevice
*pci_dev
, int region_num
,
629 uint32_t addr
, uint32_t size
, int type
)
631 UHCIState
*s
= (UHCIState
*)pci_dev
;
633 register_ioport_write(addr
, 32, 2, uhci_ioport_writew
, s
);
634 register_ioport_read(addr
, 32, 2, uhci_ioport_readw
, s
);
635 register_ioport_write(addr
, 32, 4, uhci_ioport_writel
, s
);
636 register_ioport_read(addr
, 32, 4, uhci_ioport_readl
, s
);
637 register_ioport_write(addr
, 32, 1, uhci_ioport_writeb
, s
);
638 register_ioport_read(addr
, 32, 1, uhci_ioport_readb
, s
);
641 void usb_uhci_init(PCIBus
*bus
, USBPort
**usb_ports
)
648 s
= (UHCIState
*)pci_register_device(bus
,
649 "USB-UHCI", sizeof(UHCIState
),
650 ((PCIDevice
*)piix3_state
)->devfn
+ 2,
652 pci_conf
= s
->dev
.config
;
653 pci_conf
[0x00] = 0x86;
654 pci_conf
[0x01] = 0x80;
655 pci_conf
[0x02] = 0x20;
656 pci_conf
[0x03] = 0x70;
657 pci_conf
[0x08] = 0x01; // revision number
658 pci_conf
[0x09] = 0x00;
659 pci_conf
[0x0a] = 0x03;
660 pci_conf
[0x0b] = 0x0c;
661 pci_conf
[0x0e] = 0x00; // header_type
662 pci_conf
[0x3d] = 4; // interrupt pin 3
663 pci_conf
[0x60] = 0x10; // release number
665 for(i
= 0; i
< NB_PORTS
; i
++) {
667 port
->port
.opaque
= s
;
668 port
->port
.index
= i
;
669 port
->port
.attach
= uhci_attach
;
670 usb_ports
[i
] = &port
->port
;
672 s
->frame_timer
= qemu_new_timer(vm_clock
, uhci_frame_timer
, s
);
676 /* Use region 4 for consistency with real hardware. BSD guests seem
678 pci_register_io_region(&s
->dev
, 4, 0x20,
679 PCI_ADDRESS_SPACE_IO
, uhci_map
);