hw/usb-ohci.c

   1 /*
   2  * QEMU USB OHCI Emulation
   3  * Copyright (c) 2004 Gianni Tedesco
   4  * Copyright (c) 2006 CodeSourcery
   5  * Copyright (c) 2006 Openedhand Ltd.
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  20  *
  21  * TODO:
  22  *  o Isochronous transfers
  23  *  o Allocate bandwidth in frames properly
  24  *  o Disable timers when nothing needs to be done, or remove timer usage
  25  *    all together.
  26  *  o Handle unrecoverable errors properly
  27  *  o BIOS work to boot from USB storage
  28 */
  29
  30 #include "hw.h"
  31 #include "qemu-timer.h"
  32 #include "usb.h"
  33 #include "pci.h"
  34 #include "pxa.h"
  35
  36 //#define DEBUG_OHCI
  37 /* Dump packet contents.  */
  38 //#define DEBUG_PACKET
  39 //#define DEBUG_ISOCH
  40 /* This causes frames to occur 1000x slower */
  41 //#define OHCI_TIME_WARP 1
  42
  43 #ifdef DEBUG_OHCI
  44 #define dprintf printf
  45 #else
  46 #define dprintf(...)
  47 #endif
  48
  49 /* Number of Downstream Ports on the root hub.  */
  50
  51 #define OHCI_MAX_PORTS 15
  52
  53 static int64_t usb_frame_time;
  54 static int64_t usb_bit_time;
  55
  56 typedef struct OHCIPort {
  57     USBPort port;
  58     uint32_t ctrl;
  59 } OHCIPort;
  60
  61 enum ohci_type {
  62     OHCI_TYPE_PCI,
  63     OHCI_TYPE_PXA
  64 };
  65
  66 typedef struct {
  67     qemu_irq irq;
  68     enum ohci_type type;
  69     target_phys_addr_t mem_base;
  70     int mem;
  71     int num_ports;
  72     const char *name;
  73
  74     QEMUTimer *eof_timer;
  75     int64_t sof_time;
  76
  77     /* OHCI state */
  78     /* Control partition */
  79     uint32_t ctl, status;
  80     uint32_t intr_status;
  81     uint32_t intr;
  82
  83     /* memory pointer partition */
  84     uint32_t hcca;
  85     uint32_t ctrl_head, ctrl_cur;
  86     uint32_t bulk_head, bulk_cur;
  87     uint32_t per_cur;
  88     uint32_t done;
  89     int done_count;
  90
  91     /* Frame counter partition */
  92     uint32_t fsmps:15;
  93     uint32_t fit:1;
  94     uint32_t fi:14;
  95     uint32_t frt:1;
  96     uint16_t frame_number;
  97     uint16_t padding;
  98     uint32_t pstart;
  99     uint32_t lst;
 100
 101     /* Root Hub partition */
 102     uint32_t rhdesc_a, rhdesc_b;
 103     uint32_t rhstatus;
 104     OHCIPort rhport[OHCI_MAX_PORTS];
 105
 106     /* PXA27x Non-OHCI events */
 107     uint32_t hstatus;
 108     uint32_t hmask;
 109     uint32_t hreset;
 110     uint32_t htest;
 111
 112     /* Active packets.  */
 113     uint32_t old_ctl;
 114     USBPacket usb_packet;
 115     uint8_t usb_buf[8192];
 116     uint32_t async_td;
 117     int async_complete;
 118
 119 } OHCIState;
 120
 121 /* Host Controller Communications Area */
 122 struct ohci_hcca {
 123     uint32_t intr[32];
 124     uint16_t frame, pad;
 125     uint32_t done;
 126 };
 127
 128 static void ohci_bus_stop(OHCIState *ohci);
 129
 130 /* Bitfields for the first word of an Endpoint Desciptor.  */
 131 #define OHCI_ED_FA_SHIFT  0
 132 #define OHCI_ED_FA_MASK   (0x7f<<OHCI_ED_FA_SHIFT)
 133 #define OHCI_ED_EN_SHIFT  7
 134 #define OHCI_ED_EN_MASK   (0xf<<OHCI_ED_EN_SHIFT)
 135 #define OHCI_ED_D_SHIFT   11
 136 #define OHCI_ED_D_MASK    (3<<OHCI_ED_D_SHIFT)
 137 #define OHCI_ED_S         (1<<13)
 138 #define OHCI_ED_K         (1<<14)
 139 #define OHCI_ED_F         (1<<15)
 140 #define OHCI_ED_MPS_SHIFT 16
 141 #define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
 142
 143 /* Flags in the head field of an Endpoint Desciptor.  */
 144 #define OHCI_ED_H         1
 145 #define OHCI_ED_C         2
 146
 147 /* Bitfields for the first word of a Transfer Desciptor.  */
 148 #define OHCI_TD_R         (1<<18)
 149 #define OHCI_TD_DP_SHIFT  19
 150 #define OHCI_TD_DP_MASK   (3<<OHCI_TD_DP_SHIFT)
 151 #define OHCI_TD_DI_SHIFT  21
 152 #define OHCI_TD_DI_MASK   (7<<OHCI_TD_DI_SHIFT)
 153 #define OHCI_TD_T0        (1<<24)
 154 #define OHCI_TD_T1        (1<<24)
 155 #define OHCI_TD_EC_SHIFT  26
 156 #define OHCI_TD_EC_MASK   (3<<OHCI_TD_EC_SHIFT)
 157 #define OHCI_TD_CC_SHIFT  28
 158 #define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
 159
 160 /* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
 161 /* CC & DI - same as in the General Transfer Desciptor */
 162 #define OHCI_TD_SF_SHIFT  0
 163 #define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
 164 #define OHCI_TD_FC_SHIFT  24
 165 #define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
 166
 167 /* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
 168 #define OHCI_TD_PSW_CC_SHIFT 12
 169 #define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
 170 #define OHCI_TD_PSW_SIZE_SHIFT 0
 171 #define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
 172
 173 #define OHCI_PAGE_MASK    0xfffff000
 174 #define OHCI_OFFSET_MASK  0xfff
 175
 176 #define OHCI_DPTR_MASK    0xfffffff0
 177
 178 #define OHCI_BM(val, field) \
 179   (((val) & OHCI_##field##_MASK) >> OHCI_##field##_SHIFT)
 180
 181 #define OHCI_SET_BM(val, field, newval) do { \
 182     val &= ~OHCI_##field##_MASK; \
 183     val |= ((newval) << OHCI_##field##_SHIFT) & OHCI_##field##_MASK; \
 184     } while(0)
 185
 186 /* endpoint descriptor */
 187 struct ohci_ed {
 188     uint32_t flags;
 189     uint32_t tail;
 190     uint32_t head;
 191     uint32_t next;
 192 };
 193
 194 /* General transfer descriptor */
 195 struct ohci_td {
 196     uint32_t flags;
 197     uint32_t cbp;
 198     uint32_t next;
 199     uint32_t be;
 200 };
 201
 202 /* Isochronous transfer descriptor */
 203 struct ohci_iso_td {
 204     uint32_t flags;
 205     uint32_t bp;
 206     uint32_t next;
 207     uint32_t be;
 208     uint16_t offset[8];
 209 };
 210
 211 #define USB_HZ                      12000000
 212
 213 /* OHCI Local stuff */
 214 #define OHCI_CTL_CBSR         ((1<<0)|(1<<1))
 215 #define OHCI_CTL_PLE          (1<<2)
 216 #define OHCI_CTL_IE           (1<<3)
 217 #define OHCI_CTL_CLE          (1<<4)
 218 #define OHCI_CTL_BLE          (1<<5)
 219 #define OHCI_CTL_HCFS         ((1<<6)|(1<<7))
 220 #define  OHCI_USB_RESET       0x00
 221 #define  OHCI_USB_RESUME      0x40
 222 #define  OHCI_USB_OPERATIONAL 0x80
 223 #define  OHCI_USB_SUSPEND     0xc0
 224 #define OHCI_CTL_IR           (1<<8)
 225 #define OHCI_CTL_RWC          (1<<9)
 226 #define OHCI_CTL_RWE          (1<<10)
 227
 228 #define OHCI_STATUS_HCR       (1<<0)
 229 #define OHCI_STATUS_CLF       (1<<1)
 230 #define OHCI_STATUS_BLF       (1<<2)
 231 #define OHCI_STATUS_OCR       (1<<3)
 232 #define OHCI_STATUS_SOC       ((1<<6)|(1<<7))
 233
 234 #define OHCI_INTR_SO          (1<<0) /* Scheduling overrun */
 235 #define OHCI_INTR_WD          (1<<1) /* HcDoneHead writeback */
 236 #define OHCI_INTR_SF          (1<<2) /* Start of frame */
 237 #define OHCI_INTR_RD          (1<<3) /* Resume detect */
 238 #define OHCI_INTR_UE          (1<<4) /* Unrecoverable error */
 239 #define OHCI_INTR_FNO         (1<<5) /* Frame number overflow */
 240 #define OHCI_INTR_RHSC        (1<<6) /* Root hub status change */
 241 #define OHCI_INTR_OC          (1<<30) /* Ownership change */
 242 #define OHCI_INTR_MIE         (1<<31) /* Master Interrupt Enable */
 243
 244 #define OHCI_HCCA_SIZE        0x100
 245 #define OHCI_HCCA_MASK        0xffffff00
 246
 247 #define OHCI_EDPTR_MASK       0xfffffff0
 248
 249 #define OHCI_FMI_FI           0x00003fff
 250 #define OHCI_FMI_FSMPS        0xffff0000
 251 #define OHCI_FMI_FIT          0x80000000
 252
 253 #define OHCI_FR_RT            (1<<31)
 254
 255 #define OHCI_LS_THRESH        0x628
 256
 257 #define OHCI_RHA_RW_MASK      0x00000000 /* Mask of supported features.  */
 258 #define OHCI_RHA_PSM          (1<<8)
 259 #define OHCI_RHA_NPS          (1<<9)
 260 #define OHCI_RHA_DT           (1<<10)
 261 #define OHCI_RHA_OCPM         (1<<11)
 262 #define OHCI_RHA_NOCP         (1<<12)
 263 #define OHCI_RHA_POTPGT_MASK  0xff000000
 264
 265 #define OHCI_RHS_LPS          (1<<0)
 266 #define OHCI_RHS_OCI          (1<<1)
 267 #define OHCI_RHS_DRWE         (1<<15)
 268 #define OHCI_RHS_LPSC         (1<<16)
 269 #define OHCI_RHS_OCIC         (1<<17)
 270 #define OHCI_RHS_CRWE         (1<<31)
 271
 272 #define OHCI_PORT_CCS         (1<<0)
 273 #define OHCI_PORT_PES         (1<<1)
 274 #define OHCI_PORT_PSS         (1<<2)
 275 #define OHCI_PORT_POCI        (1<<3)
 276 #define OHCI_PORT_PRS         (1<<4)
 277 #define OHCI_PORT_PPS         (1<<8)
 278 #define OHCI_PORT_LSDA        (1<<9)
 279 #define OHCI_PORT_CSC         (1<<16)
 280 #define OHCI_PORT_PESC        (1<<17)
 281 #define OHCI_PORT_PSSC        (1<<18)
 282 #define OHCI_PORT_OCIC        (1<<19)
 283 #define OHCI_PORT_PRSC        (1<<20)
 284 #define OHCI_PORT_WTC         (OHCI_PORT_CSC|OHCI_PORT_PESC|OHCI_PORT_PSSC \
 285                                |OHCI_PORT_OCIC|OHCI_PORT_PRSC)
 286
 287 #define OHCI_TD_DIR_SETUP     0x0
 288 #define OHCI_TD_DIR_OUT       0x1
 289 #define OHCI_TD_DIR_IN        0x2
 290 #define OHCI_TD_DIR_RESERVED  0x3
 291
 292 #define OHCI_CC_NOERROR             0x0
 293 #define OHCI_CC_CRC                 0x1
 294 #define OHCI_CC_BITSTUFFING         0x2
 295 #define OHCI_CC_DATATOGGLEMISMATCH  0x3
 296 #define OHCI_CC_STALL               0x4
 297 #define OHCI_CC_DEVICENOTRESPONDING 0x5
 298 #define OHCI_CC_PIDCHECKFAILURE     0x6
 299 #define OHCI_CC_UNDEXPETEDPID       0x7
 300 #define OHCI_CC_DATAOVERRUN         0x8
 301 #define OHCI_CC_DATAUNDERRUN        0x9
 302 #define OHCI_CC_BUFFEROVERRUN       0xc
 303 #define OHCI_CC_BUFFERUNDERRUN      0xd
 304
 305 #define OHCI_HRESET_FSBIR       (1 << 0)
 306
 307 /* Update IRQ levels */
 308 static inline void ohci_intr_update(OHCIState *ohci)
 309 {
 310     int level = 0;
 311
 312     if ((ohci->intr & OHCI_INTR_MIE) &&
 313         (ohci->intr_status & ohci->intr))
 314         level = 1;
 315
 316     qemu_set_irq(ohci->irq, level);
 317 }
 318
 319 /* Set an interrupt */
 320 static inline void ohci_set_interrupt(OHCIState *ohci, uint32_t intr)
 321 {
 322     ohci->intr_status |= intr;
 323     ohci_intr_update(ohci);
 324 }
 325
 326 /* Attach or detach a device on a root hub port.  */
 327 static void ohci_attach(USBPort *port1, USBDevice *dev)
 328 {
 329     OHCIState *s = port1->opaque;
 330     OHCIPort *port = &s->rhport[port1->index];
 331     uint32_t old_state = port->ctrl;
 332
 333     if (dev) {
 334         if (port->port.dev) {
 335             usb_attach(port1, NULL);
 336         }
 337         /* set connect status */
 338         port->ctrl |= OHCI_PORT_CCS | OHCI_PORT_CSC;
 339
 340         /* update speed */
 341         if (dev->speed == USB_SPEED_LOW)
 342             port->ctrl |= OHCI_PORT_LSDA;
 343         else
 344             port->ctrl &= ~OHCI_PORT_LSDA;
 345         port->port.dev = dev;
 346
 347         /* notify of remote-wakeup */
 348         if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND)
 349             ohci_set_interrupt(s, OHCI_INTR_RD);
 350
 351         /* send the attach message */
 352         usb_send_msg(dev, USB_MSG_ATTACH);
 353         dprintf("usb-ohci: Attached port %d\n", port1->index);
 354     } else {
 355         /* set connect status */
 356         if (port->ctrl & OHCI_PORT_CCS) {
 357             port->ctrl &= ~OHCI_PORT_CCS;
 358             port->ctrl |= OHCI_PORT_CSC;
 359         }
 360         /* disable port */
 361         if (port->ctrl & OHCI_PORT_PES) {
 362             port->ctrl &= ~OHCI_PORT_PES;
 363             port->ctrl |= OHCI_PORT_PESC;
 364         }
 365         dev = port->port.dev;
 366         if (dev) {
 367             /* send the detach message */
 368             usb_send_msg(dev, USB_MSG_DETACH);
 369         }
 370         port->port.dev = NULL;
 371         dprintf("usb-ohci: Detached port %d\n", port1->index);
 372     }
 373
 374     if (old_state != port->ctrl)
 375         ohci_set_interrupt(s, OHCI_INTR_RHSC);
 376 }
 377
 378 /* Reset the controller */
 379 static void ohci_reset(void *opaque)
 380 {
 381     OHCIState *ohci = opaque;
 382     OHCIPort *port;
 383     int i;
 384
 385     ohci_bus_stop(ohci);
 386     ohci->ctl = 0;
 387     ohci->old_ctl = 0;
 388     ohci->status = 0;
 389     ohci->intr_status = 0;
 390     ohci->intr = OHCI_INTR_MIE;
 391
 392     ohci->hcca = 0;
 393     ohci->ctrl_head = ohci->ctrl_cur = 0;
 394     ohci->bulk_head = ohci->bulk_cur = 0;
 395     ohci->per_cur = 0;
 396     ohci->done = 0;
 397     ohci->done_count = 7;
 398
 399     /* FSMPS is marked TBD in OCHI 1.0, what gives ffs?
 400      * I took the value linux sets ...
 401      */
 402     ohci->fsmps = 0x2778;
 403     ohci->fi = 0x2edf;
 404     ohci->fit = 0;
 405     ohci->frt = 0;
 406     ohci->frame_number = 0;
 407     ohci->pstart = 0;
 408     ohci->lst = OHCI_LS_THRESH;
 409
 410     ohci->rhdesc_a = OHCI_RHA_NPS | ohci->num_ports;
 411     ohci->rhdesc_b = 0x0; /* Impl. specific */
 412     ohci->rhstatus = 0;
 413
 414     for (i = 0; i < ohci->num_ports; i++)
 415       {
 416         port = &ohci->rhport[i];
 417         port->ctrl = 0;
 418         if (port->port.dev)
 419             ohci_attach(&port->port, port->port.dev);
 420       }
 421     if (ohci->async_td) {
 422         usb_cancel_packet(&ohci->usb_packet);
 423         ohci->async_td = 0;
 424     }
 425     dprintf("usb-ohci: Reset %s\n", ohci->name);
 426 }
 427
 428 /* Get an array of dwords from main memory */
 429 static inline int get_dwords(uint32_t addr, uint32_t *buf, int num)
 430 {
 431     int i;
 432
 433     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 434         cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
 435         *buf = le32_to_cpu(*buf);
 436     }
 437
 438     return 1;
 439 }
 440
 441 /* Put an array of dwords in to main memory */
 442 static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)
 443 {
 444     int i;
 445
 446     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 447         uint32_t tmp = cpu_to_le32(*buf);
 448         cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
 449     }
 450
 451     return 1;
 452 }
 453
 454 /* Get an array of words from main memory */
 455 static inline int get_words(uint32_t addr, uint16_t *buf, int num)
 456 {
 457     int i;
 458
 459     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 460         cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
 461         *buf = le16_to_cpu(*buf);
 462     }
 463
 464     return 1;
 465 }
 466
 467 /* Put an array of words in to main memory */
 468 static inline int put_words(uint32_t addr, uint16_t *buf, int num)
 469 {
 470     int i;
 471
 472     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 473         uint16_t tmp = cpu_to_le16(*buf);
 474         cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
 475     }
 476
 477     return 1;
 478 }
 479
 480 static inline int ohci_read_ed(uint32_t addr, struct ohci_ed *ed)
 481 {
 482     return get_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 483 }
 484
 485 static inline int ohci_read_td(uint32_t addr, struct ohci_td *td)
 486 {
 487     return get_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 488 }
 489
 490 static inline int ohci_read_iso_td(uint32_t addr, struct ohci_iso_td *td)
 491 {
 492     return (get_dwords(addr, (uint32_t *)td, 4) &&
 493             get_words(addr + 16, td->offset, 8));
 494 }
 495
 496 static inline int ohci_put_ed(uint32_t addr, struct ohci_ed *ed)
 497 {
 498     return put_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 499 }
 500
 501 static inline int ohci_put_td(uint32_t addr, struct ohci_td *td)
 502 {
 503     return put_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 504 }
 505
 506 static inline int ohci_put_iso_td(uint32_t addr, struct ohci_iso_td *td)
 507 {
 508     return (put_dwords(addr, (uint32_t *)td, 4) &&
 509             put_words(addr + 16, td->offset, 8));
 510 }
 511
 512 /* Read/Write the contents of a TD from/to main memory.  */
 513 static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
 514 {
 515     uint32_t ptr;
 516     uint32_t n;
 517
 518     ptr = td->cbp;
 519     n = 0x1000 - (ptr & 0xfff);
 520     if (n > len)
 521         n = len;
 522     cpu_physical_memory_rw(ptr, buf, n, write);
 523     if (n == len)
 524         return;
 525     ptr = td->be & ~0xfffu;
 526     buf += n;
 527     cpu_physical_memory_rw(ptr, buf, len - n, write);
 528 }
 529
 530 /* Read/Write the contents of an ISO TD from/to main memory.  */
 531 static void ohci_copy_iso_td(uint32_t start_addr, uint32_t end_addr,
 532                              uint8_t *buf, int len, int write)
 533 {
 534     uint32_t ptr;
 535     uint32_t n;
 536
 537     ptr = start_addr;
 538     n = 0x1000 - (ptr & 0xfff);
 539     if (n > len)
 540         n = len;
 541     cpu_physical_memory_rw(ptr, buf, n, write);
 542     if (n == len)
 543         return;
 544     ptr = end_addr & ~0xfffu;
 545     buf += n;
 546     cpu_physical_memory_rw(ptr, buf, len - n, write);
 547 }
 548
 549 static void ohci_process_lists(OHCIState *ohci, int completion);
 550
 551 static void ohci_async_complete_packet(USBPacket *packet, void *opaque)
 552 {
 553     OHCIState *ohci = opaque;
 554 #ifdef DEBUG_PACKET
 555     dprintf("Async packet complete\n");
 556 #endif
 557     ohci->async_complete = 1;
 558     ohci_process_lists(ohci, 1);
 559 }
 560
 561 #define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
 562
 563 static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
 564                                int completion)
 565 {
 566     int dir;
 567     size_t len = 0;
 568     char *str = NULL;
 569     int pid;
 570     int ret;
 571     int i;
 572     USBDevice *dev;
 573     struct ohci_iso_td iso_td;
 574     uint32_t addr;
 575     uint16_t starting_frame;
 576     int16_t relative_frame_number;
 577     int frame_count;
 578     uint32_t start_offset, next_offset, end_offset = 0;
 579     uint32_t start_addr, end_addr;
 580
 581     addr = ed->head & OHCI_DPTR_MASK;
 582
 583     if (!ohci_read_iso_td(addr, &iso_td)) {
 584         printf("usb-ohci: ISO_TD read error at %x\n", addr);
 585         return 0;
 586     }
 587
 588     starting_frame = OHCI_BM(iso_td.flags, TD_SF);
 589     frame_count = OHCI_BM(iso_td.flags, TD_FC);
 590     relative_frame_number = USUB(ohci->frame_number, starting_frame);
 591
 592 #ifdef DEBUG_ISOCH
 593     printf("--- ISO_TD ED head 0x%.8x tailp 0x%.8x\n"
 594            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 595            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 596            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 597            "frame_number 0x%.8x starting_frame 0x%.8x\n"
 598            "frame_count  0x%.8x relative %d\n"
 599            "di 0x%.8x cc 0x%.8x\n",
 600            ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
 601            iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
 602            iso_td.offset[0], iso_td.offset[1], iso_td.offset[2], iso_td.offset[3],
 603            iso_td.offset[4], iso_td.offset[5], iso_td.offset[6], iso_td.offset[7],
 604            ohci->frame_number, starting_frame,
 605            frame_count, relative_frame_number,
 606            OHCI_BM(iso_td.flags, TD_DI), OHCI_BM(iso_td.flags, TD_CC));
 607 #endif
 608
 609     if (relative_frame_number < 0) {
 610         dprintf("usb-ohci: ISO_TD R=%d < 0\n", relative_frame_number);
 611         return 1;
 612     } else if (relative_frame_number > frame_count) {
 613         /* ISO TD expired - retire the TD to the Done Queue and continue with
 614            the next ISO TD of the same ED */
 615         dprintf("usb-ohci: ISO_TD R=%d > FC=%d\n", relative_frame_number,
 616                frame_count);
 617         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 618         ed->head &= ~OHCI_DPTR_MASK;
 619         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 620         iso_td.next = ohci->done;
 621         ohci->done = addr;
 622         i = OHCI_BM(iso_td.flags, TD_DI);
 623         if (i < ohci->done_count)
 624             ohci->done_count = i;
 625         ohci_put_iso_td(addr, &iso_td);
 626         return 0;
 627     }
 628
 629     dir = OHCI_BM(ed->flags, ED_D);
 630     switch (dir) {
 631     case OHCI_TD_DIR_IN:
 632         str = "in";
 633         pid = USB_TOKEN_IN;
 634         break;
 635     case OHCI_TD_DIR_OUT:
 636         str = "out";
 637         pid = USB_TOKEN_OUT;
 638         break;
 639     case OHCI_TD_DIR_SETUP:
 640         str = "setup";
 641         pid = USB_TOKEN_SETUP;
 642         break;
 643     default:
 644         printf("usb-ohci: Bad direction %d\n", dir);
 645         return 1;
 646     }
 647
 648     if (!iso_td.bp || !iso_td.be) {
 649         printf("usb-ohci: ISO_TD bp 0x%.8x be 0x%.8x\n", iso_td.bp, iso_td.be);
 650         return 1;
 651     }
 652
 653     start_offset = iso_td.offset[relative_frame_number];
 654     next_offset = iso_td.offset[relative_frame_number + 1];
 655
 656     if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) ||
 657         ((relative_frame_number < frame_count) &&
 658          !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
 659         printf("usb-ohci: ISO_TD cc != not accessed 0x%.8x 0x%.8x\n",
 660                start_offset, next_offset);
 661         return 1;
 662     }
 663
 664     if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
 665         printf("usb-ohci: ISO_TD start_offset=0x%.8x > next_offset=0x%.8x\n",
 666                 start_offset, next_offset);
 667         return 1;
 668     }
 669
 670     if ((start_offset & 0x1000) == 0) {
 671         start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 672             (start_offset & OHCI_OFFSET_MASK);
 673     } else {
 674         start_addr = (iso_td.be & OHCI_PAGE_MASK) |
 675             (start_offset & OHCI_OFFSET_MASK);
 676     }
 677
 678     if (relative_frame_number < frame_count) {
 679         end_offset = next_offset - 1;
 680         if ((end_offset & 0x1000) == 0) {
 681             end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 682                 (end_offset & OHCI_OFFSET_MASK);
 683         } else {
 684             end_addr = (iso_td.be & OHCI_PAGE_MASK) |
 685                 (end_offset & OHCI_OFFSET_MASK);
 686         }
 687     } else {
 688         /* Last packet in the ISO TD */
 689         end_addr = iso_td.be;
 690     }
 691
 692     if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
 693         len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
 694             - (start_addr & OHCI_OFFSET_MASK);
 695     } else {
 696         len = end_addr - start_addr + 1;
 697     }
 698
 699     if (len && dir != OHCI_TD_DIR_IN) {
 700         ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, len, 0);
 701     }
 702
 703     if (completion) {
 704         ret = ohci->usb_packet.len;
 705     } else {
 706         ret = USB_RET_NODEV;
 707         for (i = 0; i < ohci->num_ports; i++) {
 708             dev = ohci->rhport[i].port.dev;
 709             if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
 710                 continue;
 711             ohci->usb_packet.pid = pid;
 712             ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
 713             ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
 714             ohci->usb_packet.data = ohci->usb_buf;
 715             ohci->usb_packet.len = len;
 716             ohci->usb_packet.complete_cb = ohci_async_complete_packet;
 717             ohci->usb_packet.complete_opaque = ohci;
 718             ret = dev->handle_packet(dev, &ohci->usb_packet);
 719             if (ret != USB_RET_NODEV)
 720                 break;
 721         }
 722
 723         if (ret == USB_RET_ASYNC) {
 724             return 1;
 725         }
 726     }
 727
 728 #ifdef DEBUG_ISOCH
 729     printf("so 0x%.8x eo 0x%.8x\nsa 0x%.8x ea 0x%.8x\ndir %s len %zu ret %d\n",
 730            start_offset, end_offset, start_addr, end_addr, str, len, ret);
 731 #endif
 732
 733     /* Writeback */
 734     if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
 735         /* IN transfer succeeded */
 736         ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, ret, 1);
 737         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 738                     OHCI_CC_NOERROR);
 739         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
 740     } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
 741         /* OUT transfer succeeded */
 742         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 743                     OHCI_CC_NOERROR);
 744         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
 745     } else {
 746         if (ret > (ssize_t) len) {
 747             printf("usb-ohci: DataOverrun %d > %zu\n", ret, len);
 748             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 749                         OHCI_CC_DATAOVERRUN);
 750             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 751                         len);
 752         } else if (ret >= 0) {
 753             printf("usb-ohci: DataUnderrun %d\n", ret);
 754             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 755                         OHCI_CC_DATAUNDERRUN);
 756         } else {
 757             switch (ret) {
 758             case USB_RET_NODEV:
 759                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 760                             OHCI_CC_DEVICENOTRESPONDING);
 761                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 762                             0);
 763                 break;
 764             case USB_RET_NAK:
 765             case USB_RET_STALL:
 766                 printf("usb-ohci: got NAK/STALL %d\n", ret);
 767                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 768                             OHCI_CC_STALL);
 769                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 770                             0);
 771                 break;
 772             default:
 773                 printf("usb-ohci: Bad device response %d\n", ret);
 774                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 775                             OHCI_CC_UNDEXPETEDPID);
 776                 break;
 777             }
 778         }
 779     }
 780
 781     if (relative_frame_number == frame_count) {
 782         /* Last data packet of ISO TD - retire the TD to the Done Queue */
 783         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
 784         ed->head &= ~OHCI_DPTR_MASK;
 785         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 786         iso_td.next = ohci->done;
 787         ohci->done = addr;
 788         i = OHCI_BM(iso_td.flags, TD_DI);
 789         if (i < ohci->done_count)
 790             ohci->done_count = i;
 791     }
 792     ohci_put_iso_td(addr, &iso_td);
 793     return 1;
 794 }
 795
 796 /* Service a transport descriptor.
 797    Returns nonzero to terminate processing of this endpoint.  */
 798
 799 static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 800 {
 801     int dir;
 802     size_t len = 0;
 803     char *str = NULL;
 804     int pid;
 805     int ret;
 806     int i;
 807     USBDevice *dev;
 808     struct ohci_td td;
 809     uint32_t addr;
 810     int flag_r;
 811     int completion;
 812
 813     addr = ed->head & OHCI_DPTR_MASK;
 814     /* See if this TD has already been submitted to the device.  */
 815     completion = (addr == ohci->async_td);
 816     if (completion && !ohci->async_complete) {
 817 #ifdef DEBUG_PACKET
 818         dprintf("Skipping async TD\n");
 819 #endif
 820         return 1;
 821     }
 822     if (!ohci_read_td(addr, &td)) {
 823         fprintf(stderr, "usb-ohci: TD read error at %x\n", addr);
 824         return 0;
 825     }
 826
 827     dir = OHCI_BM(ed->flags, ED_D);
 828     switch (dir) {
 829     case OHCI_TD_DIR_OUT:
 830     case OHCI_TD_DIR_IN:
 831         /* Same value.  */
 832         break;
 833     default:
 834         dir = OHCI_BM(td.flags, TD_DP);
 835         break;
 836     }
 837
 838     switch (dir) {
 839     case OHCI_TD_DIR_IN:
 840         str = "in";
 841         pid = USB_TOKEN_IN;
 842         break;
 843     case OHCI_TD_DIR_OUT:
 844         str = "out";
 845         pid = USB_TOKEN_OUT;
 846         break;
 847     case OHCI_TD_DIR_SETUP:
 848         str = "setup";
 849         pid = USB_TOKEN_SETUP;
 850         break;
 851     default:
 852         fprintf(stderr, "usb-ohci: Bad direction\n");
 853         return 1;
 854     }
 855     if (td.cbp && td.be) {
 856         if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) {
 857             len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff);
 858         } else {
 859             len = (td.be - td.cbp) + 1;
 860         }
 861
 862         if (len && dir != OHCI_TD_DIR_IN && !completion) {
 863             ohci_copy_td(&td, ohci->usb_buf, len, 0);
 864         }
 865     }
 866
 867     flag_r = (td.flags & OHCI_TD_R) != 0;
 868 #ifdef DEBUG_PACKET
 869     dprintf(" TD @ 0x%.8x %u bytes %s r=%d cbp=0x%.8x be=0x%.8x\n",
 870             addr, len, str, flag_r, td.cbp, td.be);
 871
 872     if (len > 0 && dir != OHCI_TD_DIR_IN) {
 873         dprintf("  data:");
 874         for (i = 0; i < len; i++)
 875             printf(" %.2x", ohci->usb_buf[i]);
 876         dprintf("\n");
 877     }
 878 #endif
 879     if (completion) {
 880         ret = ohci->usb_packet.len;
 881         ohci->async_td = 0;
 882         ohci->async_complete = 0;
 883     } else {
 884         ret = USB_RET_NODEV;
 885         for (i = 0; i < ohci->num_ports; i++) {
 886             dev = ohci->rhport[i].port.dev;
 887             if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
 888                 continue;
 889
 890             if (ohci->async_td) {
 891                 /* ??? The hardware should allow one active packet per
 892                    endpoint.  We only allow one active packet per controller.
 893                    This should be sufficient as long as devices respond in a
 894                    timely manner.
 895                  */
 896 #ifdef DEBUG_PACKET
 897                 dprintf("Too many pending packets\n");
 898 #endif
 899                 return 1;
 900             }
 901             ohci->usb_packet.pid = pid;
 902             ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
 903             ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
 904             ohci->usb_packet.data = ohci->usb_buf;
 905             ohci->usb_packet.len = len;
 906             ohci->usb_packet.complete_cb = ohci_async_complete_packet;
 907             ohci->usb_packet.complete_opaque = ohci;
 908             ret = dev->handle_packet(dev, &ohci->usb_packet);
 909             if (ret != USB_RET_NODEV)
 910                 break;
 911         }
 912 #ifdef DEBUG_PACKET
 913         dprintf("ret=%d\n", ret);
 914 #endif
 915         if (ret == USB_RET_ASYNC) {
 916             ohci->async_td = addr;
 917             return 1;
 918         }
 919     }
 920     if (ret >= 0) {
 921         if (dir == OHCI_TD_DIR_IN) {
 922             ohci_copy_td(&td, ohci->usb_buf, ret, 1);
 923 #ifdef DEBUG_PACKET
 924             dprintf("  data:");
 925             for (i = 0; i < ret; i++)
 926                 printf(" %.2x", ohci->usb_buf[i]);
 927             dprintf("\n");
 928 #endif
 929         } else {
 930             ret = len;
 931         }
 932     }
 933
 934     /* Writeback */
 935     if (ret == len || (dir == OHCI_TD_DIR_IN && ret >= 0 && flag_r)) {
 936         /* Transmission succeeded.  */
 937         if (ret == len) {
 938             td.cbp = 0;
 939         } else {
 940             td.cbp += ret;
 941             if ((td.cbp & 0xfff) + ret > 0xfff) {
 942                 td.cbp &= 0xfff;
 943                 td.cbp |= td.be & ~0xfff;
 944             }
 945         }
 946         td.flags |= OHCI_TD_T1;
 947         td.flags ^= OHCI_TD_T0;
 948         OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_NOERROR);
 949         OHCI_SET_BM(td.flags, TD_EC, 0);
 950
 951         ed->head &= ~OHCI_ED_C;
 952         if (td.flags & OHCI_TD_T0)
 953             ed->head |= OHCI_ED_C;
 954     } else {
 955         if (ret >= 0) {
 956             dprintf("usb-ohci: Underrun\n");
 957             OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAUNDERRUN);
 958         } else {
 959             switch (ret) {
 960             case USB_RET_NODEV:
 961                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DEVICENOTRESPONDING);
 962             case USB_RET_NAK:
 963                 dprintf("usb-ohci: got NAK\n");
 964                 return 1;
 965             case USB_RET_STALL:
 966                 dprintf("usb-ohci: got STALL\n");
 967                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_STALL);
 968                 break;
 969             case USB_RET_BABBLE:
 970                 dprintf("usb-ohci: got BABBLE\n");
 971                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 972                 break;
 973             default:
 974                 fprintf(stderr, "usb-ohci: Bad device response %d\n", ret);
 975                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_UNDEXPETEDPID);
 976                 OHCI_SET_BM(td.flags, TD_EC, 3);
 977                 break;
 978             }
 979         }
 980         ed->head |= OHCI_ED_H;
 981     }
 982
 983     /* Retire this TD */
 984     ed->head &= ~OHCI_DPTR_MASK;
 985     ed->head |= td.next & OHCI_DPTR_MASK;
 986     td.next = ohci->done;
 987     ohci->done = addr;
 988     i = OHCI_BM(td.flags, TD_DI);
 989     if (i < ohci->done_count)
 990         ohci->done_count = i;
 991     ohci_put_td(addr, &td);
 992     return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR;
 993 }
 994
 995 /* Service an endpoint list.  Returns nonzero if active TD were found.  */
 996 static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
 997 {
 998     struct ohci_ed ed;
 999     uint32_t next_ed;
1000     uint32_t cur;
1001     int active;
1002
1003     active = 0;
1004
1005     if (head == 0)
1006         return 0;
1007
1008     for (cur = head; cur; cur = next_ed) {
1009         if (!ohci_read_ed(cur, &ed)) {
1010             fprintf(stderr, "usb-ohci: ED read error at %x\n", cur);
1011             return 0;
1012         }
1013
1014         next_ed = ed.next & OHCI_DPTR_MASK;
1015
1016         if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
1017             uint32_t addr;
1018             /* Cancel pending packets for ED that have been paused.  */
1019             addr = ed.head & OHCI_DPTR_MASK;
1020             if (ohci->async_td && addr == ohci->async_td) {
1021                 usb_cancel_packet(&ohci->usb_packet);
1022                 ohci->async_td = 0;
1023             }
1024             continue;
1025         }
1026
1027         while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
1028 #ifdef DEBUG_PACKET
1029             dprintf("ED @ 0x%.8x fa=%u en=%u d=%u s=%u k=%u f=%u mps=%u "
1030                     "h=%u c=%u\n  head=0x%.8x tailp=0x%.8x next=0x%.8x\n", cur,
1031                     OHCI_BM(ed.flags, ED_FA), OHCI_BM(ed.flags, ED_EN),
1032                     OHCI_BM(ed.flags, ED_D), (ed.flags & OHCI_ED_S)!= 0,
1033                     (ed.flags & OHCI_ED_K) != 0, (ed.flags & OHCI_ED_F) != 0,
1034                     OHCI_BM(ed.flags, ED_MPS), (ed.head & OHCI_ED_H) != 0,
1035                     (ed.head & OHCI_ED_C) != 0, ed.head & OHCI_DPTR_MASK,
1036                     ed.tail & OHCI_DPTR_MASK, ed.next & OHCI_DPTR_MASK);
1037 #endif
1038             active = 1;
1039
1040             if ((ed.flags & OHCI_ED_F) == 0) {
1041                 if (ohci_service_td(ohci, &ed))
1042                     break;
1043             } else {
1044                 /* Handle isochronous endpoints */
1045                 if (ohci_service_iso_td(ohci, &ed, completion))
1046                     break;
1047             }
1048         }
1049
1050         ohci_put_ed(cur, &ed);
1051     }
1052
1053     return active;
1054 }
1055
1056 /* Generate a SOF event, and set a timer for EOF */
1057 static void ohci_sof(OHCIState *ohci)
1058 {
1059     ohci->sof_time = qemu_get_clock(vm_clock);
1060     qemu_mod_timer(ohci->eof_timer, ohci->sof_time + usb_frame_time);
1061     ohci_set_interrupt(ohci, OHCI_INTR_SF);
1062 }
1063
1064 /* Process Control and Bulk lists.  */
1065 static void ohci_process_lists(OHCIState *ohci, int completion)
1066 {
1067     if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
1068         if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head)
1069           dprintf("usb-ohci: head %x, cur %x\n",
1070                           ohci->ctrl_head, ohci->ctrl_cur);
1071         if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
1072             ohci->ctrl_cur = 0;
1073             ohci->status &= ~OHCI_STATUS_CLF;
1074         }
1075     }
1076
1077     if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
1078         if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
1079             ohci->bulk_cur = 0;
1080             ohci->status &= ~OHCI_STATUS_BLF;
1081         }
1082     }
1083 }
1084
1085 /* Do frame processing on frame boundary */
1086 static void ohci_frame_boundary(void *opaque)
1087 {
1088     OHCIState *ohci = opaque;
1089     struct ohci_hcca hcca;
1090
1091     cpu_physical_memory_rw(ohci->hcca, (uint8_t *)&hcca, sizeof(hcca), 0);
1092
1093     /* Process all the lists at the end of the frame */
1094     if (ohci->ctl & OHCI_CTL_PLE) {
1095         int n;
1096
1097         n = ohci->frame_number & 0x1f;
1098         ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
1099     }
1100
1101     /* Cancel all pending packets if either of the lists has been disabled.  */
1102     if (ohci->async_td &&
1103         ohci->old_ctl & (~ohci->ctl) & (OHCI_CTL_BLE | OHCI_CTL_CLE)) {
1104         usb_cancel_packet(&ohci->usb_packet);
1105         ohci->async_td = 0;
1106     }
1107     ohci->old_ctl = ohci->ctl;
1108     ohci_process_lists(ohci, 0);
1109
1110     /* Frame boundary, so do EOF stuf here */
1111     ohci->frt = ohci->fit;
1112
1113     /* XXX: endianness */
1114     ohci->frame_number = (ohci->frame_number + 1) & 0xffff;
1115     hcca.frame = cpu_to_le32(ohci->frame_number);
1116
1117     if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) {
1118         if (!ohci->done)
1119             abort();
1120         if (ohci->intr & ohci->intr_status)
1121             ohci->done |= 1;
1122         hcca.done = cpu_to_le32(ohci->done);
1123         ohci->done = 0;
1124         ohci->done_count = 7;
1125         ohci_set_interrupt(ohci, OHCI_INTR_WD);
1126     }
1127
1128     if (ohci->done_count != 7 && ohci->done_count != 0)
1129         ohci->done_count--;
1130
1131     /* Do SOF stuff here */
1132     ohci_sof(ohci);
1133
1134     /* Writeback HCCA */
1135     cpu_physical_memory_rw(ohci->hcca, (uint8_t *)&hcca, sizeof(hcca), 1);
1136 }
1137
1138 /* Start sending SOF tokens across the USB bus, lists are processed in
1139  * next frame
1140  */
1141 static int ohci_bus_start(OHCIState *ohci)
1142 {
1143     ohci->eof_timer = qemu_new_timer(vm_clock,
1144                     ohci_frame_boundary,
1145                     ohci);
1146
1147     if (ohci->eof_timer == NULL) {
1148         fprintf(stderr, "usb-ohci: %s: qemu_new_timer failed\n", ohci->name);
1149         /* TODO: Signal unrecoverable error */
1150         return 0;
1151     }
1152
1153     dprintf("usb-ohci: %s: USB Operational\n", ohci->name);
1154
1155     ohci_sof(ohci);
1156
1157     return 1;
1158 }
1159
1160 /* Stop sending SOF tokens on the bus */
1161 static void ohci_bus_stop(OHCIState *ohci)
1162 {
1163     if (ohci->eof_timer)
1164         qemu_del_timer(ohci->eof_timer);
1165     ohci->eof_timer = NULL;
1166 }
1167
1168 /* Sets a flag in a port status register but only set it if the port is
1169  * connected, if not set ConnectStatusChange flag. If flag is enabled
1170  * return 1.
1171  */
1172 static int ohci_port_set_if_connected(OHCIState *ohci, int i, uint32_t val)
1173 {
1174     int ret = 1;
1175
1176     /* writing a 0 has no effect */
1177     if (val == 0)
1178         return 0;
1179
1180     /* If CurrentConnectStatus is cleared we set
1181      * ConnectStatusChange
1182      */
1183     if (!(ohci->rhport[i].ctrl & OHCI_PORT_CCS)) {
1184         ohci->rhport[i].ctrl |= OHCI_PORT_CSC;
1185         if (ohci->rhstatus & OHCI_RHS_DRWE) {
1186             /* TODO: CSC is a wakeup event */
1187         }
1188         return 0;
1189     }
1190
1191     if (ohci->rhport[i].ctrl & val)
1192         ret = 0;
1193
1194     /* set the bit */
1195     ohci->rhport[i].ctrl |= val;
1196
1197     return ret;
1198 }
1199
1200 /* Set the frame interval - frame interval toggle is manipulated by the hcd only */
1201 static void ohci_set_frame_interval(OHCIState *ohci, uint16_t val)
1202 {
1203     val &= OHCI_FMI_FI;
1204
1205     if (val != ohci->fi) {
1206         dprintf("usb-ohci: %s: FrameInterval = 0x%x (%u)\n",
1207             ohci->name, ohci->fi, ohci->fi);
1208     }
1209
1210     ohci->fi = val;
1211 }
1212
1213 static void ohci_port_power(OHCIState *ohci, int i, int p)
1214 {
1215     if (p) {
1216         ohci->rhport[i].ctrl |= OHCI_PORT_PPS;
1217     } else {
1218         ohci->rhport[i].ctrl &= ~(OHCI_PORT_PPS|
1219                     OHCI_PORT_CCS|
1220                     OHCI_PORT_PSS|
1221                     OHCI_PORT_PRS);
1222     }
1223 }
1224
1225 /* Set HcControlRegister */
1226 static void ohci_set_ctl(OHCIState *ohci, uint32_t val)
1227 {
1228     uint32_t old_state;
1229     uint32_t new_state;
1230
1231     old_state = ohci->ctl & OHCI_CTL_HCFS;
1232     ohci->ctl = val;
1233     new_state = ohci->ctl & OHCI_CTL_HCFS;
1234
1235     /* no state change */
1236     if (old_state == new_state)
1237         return;
1238
1239     switch (new_state) {
1240     case OHCI_USB_OPERATIONAL:
1241         ohci_bus_start(ohci);
1242         break;
1243     case OHCI_USB_SUSPEND:
1244         ohci_bus_stop(ohci);
1245         dprintf("usb-ohci: %s: USB Suspended\n", ohci->name);
1246         break;
1247     case OHCI_USB_RESUME:
1248         dprintf("usb-ohci: %s: USB Resume\n", ohci->name);
1249         break;
1250     case OHCI_USB_RESET:
1251         ohci_reset(ohci);
1252         dprintf("usb-ohci: %s: USB Reset\n", ohci->name);
1253         break;
1254     }
1255 }
1256
1257 static uint32_t ohci_get_frame_remaining(OHCIState *ohci)
1258 {
1259     uint16_t fr;
1260     int64_t tks;
1261
1262     if ((ohci->ctl & OHCI_CTL_HCFS) != OHCI_USB_OPERATIONAL)
1263         return (ohci->frt << 31);
1264
1265     /* Being in USB operational state guarnatees sof_time was
1266      * set already.
1267      */
1268     tks = qemu_get_clock(vm_clock) - ohci->sof_time;
1269
1270     /* avoid muldiv if possible */
1271     if (tks >= usb_frame_time)
1272         return (ohci->frt << 31);
1273
1274     tks = muldiv64(1, tks, usb_bit_time);
1275     fr = (uint16_t)(ohci->fi - tks);
1276
1277     return (ohci->frt << 31) | fr;
1278 }
1279
1280
1281 /* Set root hub status */
1282 static void ohci_set_hub_status(OHCIState *ohci, uint32_t val)
1283 {
1284     uint32_t old_state;
1285
1286     old_state = ohci->rhstatus;
1287
1288     /* write 1 to clear OCIC */
1289     if (val & OHCI_RHS_OCIC)
1290         ohci->rhstatus &= ~OHCI_RHS_OCIC;
1291
1292     if (val & OHCI_RHS_LPS) {
1293         int i;
1294
1295         for (i = 0; i < ohci->num_ports; i++)
1296             ohci_port_power(ohci, i, 0);
1297         dprintf("usb-ohci: powered down all ports\n");
1298     }
1299
1300     if (val & OHCI_RHS_LPSC) {
1301         int i;
1302
1303         for (i = 0; i < ohci->num_ports; i++)
1304             ohci_port_power(ohci, i, 1);
1305         dprintf("usb-ohci: powered up all ports\n");
1306     }
1307
1308     if (val & OHCI_RHS_DRWE)
1309         ohci->rhstatus |= OHCI_RHS_DRWE;
1310
1311     if (val & OHCI_RHS_CRWE)
1312         ohci->rhstatus &= ~OHCI_RHS_DRWE;
1313
1314     if (old_state != ohci->rhstatus)
1315         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1316 }
1317
1318 /* Set root hub port status */
1319 static void ohci_port_set_status(OHCIState *ohci, int portnum, uint32_t val)
1320 {
1321     uint32_t old_state;
1322     OHCIPort *port;
1323
1324     port = &ohci->rhport[portnum];
1325     old_state = port->ctrl;
1326
1327     /* Write to clear CSC, PESC, PSSC, OCIC, PRSC */
1328     if (val & OHCI_PORT_WTC)
1329         port->ctrl &= ~(val & OHCI_PORT_WTC);
1330
1331     if (val & OHCI_PORT_CCS)
1332         port->ctrl &= ~OHCI_PORT_PES;
1333
1334     ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PES);
1335
1336     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PSS))
1337         dprintf("usb-ohci: port %d: SUSPEND\n", portnum);
1338
1339     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PRS)) {
1340         dprintf("usb-ohci: port %d: RESET\n", portnum);
1341         usb_send_msg(port->port.dev, USB_MSG_RESET);
1342         port->ctrl &= ~OHCI_PORT_PRS;
1343         /* ??? Should this also set OHCI_PORT_PESC.  */
1344         port->ctrl |= OHCI_PORT_PES | OHCI_PORT_PRSC;
1345     }
1346
1347     /* Invert order here to ensure in ambiguous case, device is
1348      * powered up...
1349      */
1350     if (val & OHCI_PORT_LSDA)
1351         ohci_port_power(ohci, portnum, 0);
1352     if (val & OHCI_PORT_PPS)
1353         ohci_port_power(ohci, portnum, 1);
1354
1355     if (old_state != port->ctrl)
1356         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1357
1358     return;
1359 }
1360
1361 static uint32_t ohci_mem_read(void *ptr, target_phys_addr_t addr)
1362 {
1363     OHCIState *ohci = ptr;
1364
1365     addr -= ohci->mem_base;
1366
1367     /* Only aligned reads are allowed on OHCI */
1368     if (addr & 3) {
1369         fprintf(stderr, "usb-ohci: Mis-aligned read\n");
1370         return 0xffffffff;
1371     }
1372
1373     if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1374         /* HcRhPortStatus */
1375         return ohci->rhport[(addr - 0x54) >> 2].ctrl | OHCI_PORT_PPS;
1376     }
1377
1378     switch (addr >> 2) {
1379     case 0: /* HcRevision */
1380         return 0x10;
1381
1382     case 1: /* HcControl */
1383         return ohci->ctl;
1384
1385     case 2: /* HcCommandStatus */
1386         return ohci->status;
1387
1388     case 3: /* HcInterruptStatus */
1389         return ohci->intr_status;
1390
1391     case 4: /* HcInterruptEnable */
1392     case 5: /* HcInterruptDisable */
1393         return ohci->intr;
1394
1395     case 6: /* HcHCCA */
1396         return ohci->hcca;
1397
1398     case 7: /* HcPeriodCurrentED */
1399         return ohci->per_cur;
1400
1401     case 8: /* HcControlHeadED */
1402         return ohci->ctrl_head;
1403
1404     case 9: /* HcControlCurrentED */
1405         return ohci->ctrl_cur;
1406
1407     case 10: /* HcBulkHeadED */
1408         return ohci->bulk_head;
1409
1410     case 11: /* HcBulkCurrentED */
1411         return ohci->bulk_cur;
1412
1413     case 12: /* HcDoneHead */
1414         return ohci->done;
1415
1416     case 13: /* HcFmInterval */
1417         return (ohci->fit << 31) | (ohci->fsmps << 16) | (ohci->fi);
1418
1419     case 14: /* HcFmRemaining */
1420         return ohci_get_frame_remaining(ohci);
1421
1422     case 15: /* HcFmNumber */
1423         return ohci->frame_number;
1424
1425     case 16: /* HcPeriodicStart */
1426         return ohci->pstart;
1427
1428     case 17: /* HcLSThreshold */
1429         return ohci->lst;
1430
1431     case 18: /* HcRhDescriptorA */
1432         return ohci->rhdesc_a;
1433
1434     case 19: /* HcRhDescriptorB */
1435         return ohci->rhdesc_b;
1436
1437     case 20: /* HcRhStatus */
1438         return ohci->rhstatus;
1439
1440     /* PXA27x specific registers */
1441     case 24: /* HcStatus */
1442         return ohci->hstatus & ohci->hmask;
1443
1444     case 25: /* HcHReset */
1445         return ohci->hreset;
1446
1447     case 26: /* HcHInterruptEnable */
1448         return ohci->hmask;
1449
1450     case 27: /* HcHInterruptTest */
1451         return ohci->htest;
1452
1453     default:
1454         fprintf(stderr, "ohci_read: Bad offset %x\n", (int)addr);
1455         return 0xffffffff;
1456     }
1457 }
1458
1459 static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
1460 {
1461     OHCIState *ohci = ptr;
1462
1463     addr -= ohci->mem_base;
1464
1465     /* Only aligned reads are allowed on OHCI */
1466     if (addr & 3) {
1467         fprintf(stderr, "usb-ohci: Mis-aligned write\n");
1468         return;
1469     }
1470
1471     if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1472         /* HcRhPortStatus */
1473         ohci_port_set_status(ohci, (addr - 0x54) >> 2, val);
1474         return;
1475     }
1476
1477     switch (addr >> 2) {
1478     case 1: /* HcControl */
1479         ohci_set_ctl(ohci, val);
1480         break;
1481
1482     case 2: /* HcCommandStatus */
1483         /* SOC is read-only */
1484         val = (val & ~OHCI_STATUS_SOC);
1485
1486         /* Bits written as '0' remain unchanged in the register */
1487         ohci->status |= val;
1488
1489         if (ohci->status & OHCI_STATUS_HCR)
1490             ohci_reset(ohci);
1491         break;
1492
1493     case 3: /* HcInterruptStatus */
1494         ohci->intr_status &= ~val;
1495         ohci_intr_update(ohci);
1496         break;
1497
1498     case 4: /* HcInterruptEnable */
1499         ohci->intr |= val;
1500         ohci_intr_update(ohci);
1501         break;
1502
1503     case 5: /* HcInterruptDisable */
1504         ohci->intr &= ~val;
1505         ohci_intr_update(ohci);
1506         break;
1507
1508     case 6: /* HcHCCA */
1509         ohci->hcca = val & OHCI_HCCA_MASK;
1510         break;
1511
1512     case 8: /* HcControlHeadED */
1513         ohci->ctrl_head = val & OHCI_EDPTR_MASK;
1514         break;
1515
1516     case 9: /* HcControlCurrentED */
1517         ohci->ctrl_cur = val & OHCI_EDPTR_MASK;
1518         break;
1519
1520     case 10: /* HcBulkHeadED */
1521         ohci->bulk_head = val & OHCI_EDPTR_MASK;
1522         break;
1523
1524     case 11: /* HcBulkCurrentED */
1525         ohci->bulk_cur = val & OHCI_EDPTR_MASK;
1526         break;
1527
1528     case 13: /* HcFmInterval */
1529         ohci->fsmps = (val & OHCI_FMI_FSMPS) >> 16;
1530         ohci->fit = (val & OHCI_FMI_FIT) >> 31;
1531         ohci_set_frame_interval(ohci, val);
1532         break;
1533
1534     case 15: /* HcFmNumber */
1535         break;
1536
1537     case 16: /* HcPeriodicStart */
1538         ohci->pstart = val & 0xffff;
1539         break;
1540
1541     case 17: /* HcLSThreshold */
1542         ohci->lst = val & 0xffff;
1543         break;
1544
1545     case 18: /* HcRhDescriptorA */
1546         ohci->rhdesc_a &= ~OHCI_RHA_RW_MASK;
1547         ohci->rhdesc_a |= val & OHCI_RHA_RW_MASK;
1548         break;
1549
1550     case 19: /* HcRhDescriptorB */
1551         break;
1552
1553     case 20: /* HcRhStatus */
1554         ohci_set_hub_status(ohci, val);
1555         break;
1556
1557     /* PXA27x specific registers */
1558     case 24: /* HcStatus */
1559         ohci->hstatus &= ~(val & ohci->hmask);
1560
1561     case 25: /* HcHReset */
1562         ohci->hreset = val & ~OHCI_HRESET_FSBIR;
1563         if (val & OHCI_HRESET_FSBIR)
1564             ohci_reset(ohci);
1565         break;
1566
1567     case 26: /* HcHInterruptEnable */
1568         ohci->hmask = val;
1569         break;
1570
1571     case 27: /* HcHInterruptTest */
1572         ohci->htest = val;
1573         break;
1574
1575     default:
1576         fprintf(stderr, "ohci_write: Bad offset %x\n", (int)addr);
1577         break;
1578     }
1579 }
1580
1581 /* Only dword reads are defined on OHCI register space */
1582 static CPUReadMemoryFunc *ohci_readfn[3]={
1583     ohci_mem_read,
1584     ohci_mem_read,
1585     ohci_mem_read
1586 };
1587
1588 /* Only dword writes are defined on OHCI register space */
1589 static CPUWriteMemoryFunc *ohci_writefn[3]={
1590     ohci_mem_write,
1591     ohci_mem_write,
1592     ohci_mem_write
1593 };
1594
1595 static void usb_ohci_init(OHCIState *ohci, int num_ports, int devfn,
1596             qemu_irq irq, enum ohci_type type, const char *name)
1597 {
1598     int i;
1599
1600     if (usb_frame_time == 0) {
1601 #if OHCI_TIME_WARP
1602         usb_frame_time = ticks_per_sec;
1603         usb_bit_time = muldiv64(1, ticks_per_sec, USB_HZ/1000);
1604 #else
1605         usb_frame_time = muldiv64(1, ticks_per_sec, 1000);
1606         if (ticks_per_sec >= USB_HZ) {
1607             usb_bit_time = muldiv64(1, ticks_per_sec, USB_HZ);
1608         } else {
1609             usb_bit_time = 1;
1610         }
1611 #endif
1612         dprintf("usb-ohci: usb_bit_time=%lli usb_frame_time=%lli\n",
1613                 usb_frame_time, usb_bit_time);
1614     }
1615
1616     ohci->mem = cpu_register_io_memory(0, ohci_readfn, ohci_writefn, ohci);
1617     ohci->name = name;
1618
1619     ohci->irq = irq;
1620     ohci->type = type;
1621
1622     ohci->num_ports = num_ports;
1623     for (i = 0; i < num_ports; i++) {
1624         qemu_register_usb_port(&ohci->rhport[i].port, ohci, i, ohci_attach);
1625     }
1626
1627     ohci->async_td = 0;
1628     qemu_register_reset(ohci_reset, ohci);
1629     ohci_reset(ohci);
1630 }
1631
1632 typedef struct {
1633     PCIDevice pci_dev;
1634     OHCIState state;
1635 } OHCIPCIState;
1636
1637 static void ohci_mapfunc(PCIDevice *pci_dev, int i,
1638             uint32_t addr, uint32_t size, int type)
1639 {
1640     OHCIPCIState *ohci = (OHCIPCIState *)pci_dev;
1641     ohci->state.mem_base = addr;
1642     cpu_register_physical_memory(addr, size, ohci->state.mem);
1643 }
1644
1645 void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn)
1646 {
1647     OHCIPCIState *ohci;
1648     int vid = 0x106b;
1649     int did = 0x003f;
1650
1651     ohci = (OHCIPCIState *)pci_register_device(bus, "OHCI USB", sizeof(*ohci),
1652                                                devfn, NULL, NULL);
1653     if (ohci == NULL) {
1654         fprintf(stderr, "usb-ohci: Failed to register PCI device\n");
1655         return;
1656     }
1657
1658     ohci->pci_dev.config[0x00] = vid & 0xff;
1659     ohci->pci_dev.config[0x01] = (vid >> 8) & 0xff;
1660     ohci->pci_dev.config[0x02] = did & 0xff;
1661     ohci->pci_dev.config[0x03] = (did >> 8) & 0xff;
1662     ohci->pci_dev.config[0x09] = 0x10; /* OHCI */
1663     ohci->pci_dev.config[0x0a] = 0x3;
1664     ohci->pci_dev.config[0x0b] = 0xc;
1665     ohci->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
1666
1667     usb_ohci_init(&ohci->state, num_ports, devfn, ohci->pci_dev.irq[0],
1668                   OHCI_TYPE_PCI, ohci->pci_dev.name);
1669
1670     pci_register_io_region((struct PCIDevice *)ohci, 0, 256,
1671                            PCI_ADDRESS_SPACE_MEM, ohci_mapfunc);
1672 }
1673
1674 void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
1675                        qemu_irq irq)
1676 {
1677     OHCIState *ohci = (OHCIState *)qemu_mallocz(sizeof(OHCIState));
1678
1679     usb_ohci_init(ohci, num_ports, devfn, irq,
1680                   OHCI_TYPE_PXA, "OHCI USB");
1681     ohci->mem_base = base;
1682
1683     cpu_register_physical_memory(ohci->mem_base, 0x1000, ohci->mem);
1684 }