hw/usb-ohci.c

   1 /*
   2  * QEMU USB OHCI Emulation
   3  * Copyright (c) 2004 Gianni Tedesco
   4  * Copyright (c) 2006 CodeSourcery
   5  * Copyright (c) 2006 Openedhand Ltd.
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  20  *
  21  * TODO:
  22  *  o Isochronous transfers
  23  *  o Allocate bandwidth in frames properly
  24  *  o Disable timers when nothing needs to be done, or remove timer usage
  25  *    all together.
  26  *  o Handle unrecoverable errors properly
  27  *  o BIOS work to boot from USB storage
  28 */
  29
  30 #include "hw.h"
  31 #include "qemu-timer.h"
  32 #include "usb.h"
  33 #include "pci.h"
  34 #include "pxa.h"
  35
  36 //#define DEBUG_OHCI
  37 /* Dump packet contents.  */
  38 //#define DEBUG_PACKET
  39 //#define DEBUG_ISOCH
  40 /* This causes frames to occur 1000x slower */
  41 //#define OHCI_TIME_WARP 1
  42
  43 #ifdef DEBUG_OHCI
  44 #define dprintf printf
  45 #else
  46 #define dprintf(...)
  47 #endif
  48
  49 /* Number of Downstream Ports on the root hub.  */
  50
  51 #define OHCI_MAX_PORTS 15
  52
  53 static int64_t usb_frame_time;
  54 static int64_t usb_bit_time;
  55
  56 typedef struct OHCIPort {
  57     USBPort port;
  58     uint32_t ctrl;
  59 } OHCIPort;
  60
  61 enum ohci_type {
  62     OHCI_TYPE_PCI,
  63     OHCI_TYPE_PXA
  64 };
  65
  66 typedef struct {
  67     qemu_irq irq;
  68     enum ohci_type type;
  69     int mem;
  70     int num_ports;
  71     const char *name;
  72
  73     QEMUTimer *eof_timer;
  74     int64_t sof_time;
  75
  76     /* OHCI state */
  77     /* Control partition */
  78     uint32_t ctl, status;
  79     uint32_t intr_status;
  80     uint32_t intr;
  81
  82     /* memory pointer partition */
  83     uint32_t hcca;
  84     uint32_t ctrl_head, ctrl_cur;
  85     uint32_t bulk_head, bulk_cur;
  86     uint32_t per_cur;
  87     uint32_t done;
  88     int done_count;
  89
  90     /* Frame counter partition */
  91     uint32_t fsmps:15;
  92     uint32_t fit:1;
  93     uint32_t fi:14;
  94     uint32_t frt:1;
  95     uint16_t frame_number;
  96     uint16_t padding;
  97     uint32_t pstart;
  98     uint32_t lst;
  99
 100     /* Root Hub partition */
 101     uint32_t rhdesc_a, rhdesc_b;
 102     uint32_t rhstatus;
 103     OHCIPort rhport[OHCI_MAX_PORTS];
 104
 105     /* PXA27x Non-OHCI events */
 106     uint32_t hstatus;
 107     uint32_t hmask;
 108     uint32_t hreset;
 109     uint32_t htest;
 110
 111     /* Active packets.  */
 112     uint32_t old_ctl;
 113     USBPacket usb_packet;
 114     uint8_t usb_buf[8192];
 115     uint32_t async_td;
 116     int async_complete;
 117
 118 } OHCIState;
 119
 120 /* Host Controller Communications Area */
 121 struct ohci_hcca {
 122     uint32_t intr[32];
 123     uint16_t frame, pad;
 124     uint32_t done;
 125 };
 126
 127 static void ohci_bus_stop(OHCIState *ohci);
 128
 129 /* Bitfields for the first word of an Endpoint Desciptor.  */
 130 #define OHCI_ED_FA_SHIFT  0
 131 #define OHCI_ED_FA_MASK   (0x7f<<OHCI_ED_FA_SHIFT)
 132 #define OHCI_ED_EN_SHIFT  7
 133 #define OHCI_ED_EN_MASK   (0xf<<OHCI_ED_EN_SHIFT)
 134 #define OHCI_ED_D_SHIFT   11
 135 #define OHCI_ED_D_MASK    (3<<OHCI_ED_D_SHIFT)
 136 #define OHCI_ED_S         (1<<13)
 137 #define OHCI_ED_K         (1<<14)
 138 #define OHCI_ED_F         (1<<15)
 139 #define OHCI_ED_MPS_SHIFT 16
 140 #define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
 141
 142 /* Flags in the head field of an Endpoint Desciptor.  */
 143 #define OHCI_ED_H         1
 144 #define OHCI_ED_C         2
 145
 146 /* Bitfields for the first word of a Transfer Desciptor.  */
 147 #define OHCI_TD_R         (1<<18)
 148 #define OHCI_TD_DP_SHIFT  19
 149 #define OHCI_TD_DP_MASK   (3<<OHCI_TD_DP_SHIFT)
 150 #define OHCI_TD_DI_SHIFT  21
 151 #define OHCI_TD_DI_MASK   (7<<OHCI_TD_DI_SHIFT)
 152 #define OHCI_TD_T0        (1<<24)
 153 #define OHCI_TD_T1        (1<<24)
 154 #define OHCI_TD_EC_SHIFT  26
 155 #define OHCI_TD_EC_MASK   (3<<OHCI_TD_EC_SHIFT)
 156 #define OHCI_TD_CC_SHIFT  28
 157 #define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
 158
 159 /* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
 160 /* CC & DI - same as in the General Transfer Desciptor */
 161 #define OHCI_TD_SF_SHIFT  0
 162 #define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
 163 #define OHCI_TD_FC_SHIFT  24
 164 #define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
 165
 166 /* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
 167 #define OHCI_TD_PSW_CC_SHIFT 12
 168 #define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
 169 #define OHCI_TD_PSW_SIZE_SHIFT 0
 170 #define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
 171
 172 #define OHCI_PAGE_MASK    0xfffff000
 173 #define OHCI_OFFSET_MASK  0xfff
 174
 175 #define OHCI_DPTR_MASK    0xfffffff0
 176
 177 #define OHCI_BM(val, field) \
 178   (((val) & OHCI_##field##_MASK) >> OHCI_##field##_SHIFT)
 179
 180 #define OHCI_SET_BM(val, field, newval) do { \
 181     val &= ~OHCI_##field##_MASK; \
 182     val |= ((newval) << OHCI_##field##_SHIFT) & OHCI_##field##_MASK; \
 183     } while(0)
 184
 185 /* endpoint descriptor */
 186 struct ohci_ed {
 187     uint32_t flags;
 188     uint32_t tail;
 189     uint32_t head;
 190     uint32_t next;
 191 };
 192
 193 /* General transfer descriptor */
 194 struct ohci_td {
 195     uint32_t flags;
 196     uint32_t cbp;
 197     uint32_t next;
 198     uint32_t be;
 199 };
 200
 201 /* Isochronous transfer descriptor */
 202 struct ohci_iso_td {
 203     uint32_t flags;
 204     uint32_t bp;
 205     uint32_t next;
 206     uint32_t be;
 207     uint16_t offset[8];
 208 };
 209
 210 #define USB_HZ                      12000000
 211
 212 /* OHCI Local stuff */
 213 #define OHCI_CTL_CBSR         ((1<<0)|(1<<1))
 214 #define OHCI_CTL_PLE          (1<<2)
 215 #define OHCI_CTL_IE           (1<<3)
 216 #define OHCI_CTL_CLE          (1<<4)
 217 #define OHCI_CTL_BLE          (1<<5)
 218 #define OHCI_CTL_HCFS         ((1<<6)|(1<<7))
 219 #define  OHCI_USB_RESET       0x00
 220 #define  OHCI_USB_RESUME      0x40
 221 #define  OHCI_USB_OPERATIONAL 0x80
 222 #define  OHCI_USB_SUSPEND     0xc0
 223 #define OHCI_CTL_IR           (1<<8)
 224 #define OHCI_CTL_RWC          (1<<9)
 225 #define OHCI_CTL_RWE          (1<<10)
 226
 227 #define OHCI_STATUS_HCR       (1<<0)
 228 #define OHCI_STATUS_CLF       (1<<1)
 229 #define OHCI_STATUS_BLF       (1<<2)
 230 #define OHCI_STATUS_OCR       (1<<3)
 231 #define OHCI_STATUS_SOC       ((1<<6)|(1<<7))
 232
 233 #define OHCI_INTR_SO          (1<<0) /* Scheduling overrun */
 234 #define OHCI_INTR_WD          (1<<1) /* HcDoneHead writeback */
 235 #define OHCI_INTR_SF          (1<<2) /* Start of frame */
 236 #define OHCI_INTR_RD          (1<<3) /* Resume detect */
 237 #define OHCI_INTR_UE          (1<<4) /* Unrecoverable error */
 238 #define OHCI_INTR_FNO         (1<<5) /* Frame number overflow */
 239 #define OHCI_INTR_RHSC        (1<<6) /* Root hub status change */
 240 #define OHCI_INTR_OC          (1<<30) /* Ownership change */
 241 #define OHCI_INTR_MIE         (1<<31) /* Master Interrupt Enable */
 242
 243 #define OHCI_HCCA_SIZE        0x100
 244 #define OHCI_HCCA_MASK        0xffffff00
 245
 246 #define OHCI_EDPTR_MASK       0xfffffff0
 247
 248 #define OHCI_FMI_FI           0x00003fff
 249 #define OHCI_FMI_FSMPS        0xffff0000
 250 #define OHCI_FMI_FIT          0x80000000
 251
 252 #define OHCI_FR_RT            (1<<31)
 253
 254 #define OHCI_LS_THRESH        0x628
 255
 256 #define OHCI_RHA_RW_MASK      0x00000000 /* Mask of supported features.  */
 257 #define OHCI_RHA_PSM          (1<<8)
 258 #define OHCI_RHA_NPS          (1<<9)
 259 #define OHCI_RHA_DT           (1<<10)
 260 #define OHCI_RHA_OCPM         (1<<11)
 261 #define OHCI_RHA_NOCP         (1<<12)
 262 #define OHCI_RHA_POTPGT_MASK  0xff000000
 263
 264 #define OHCI_RHS_LPS          (1<<0)
 265 #define OHCI_RHS_OCI          (1<<1)
 266 #define OHCI_RHS_DRWE         (1<<15)
 267 #define OHCI_RHS_LPSC         (1<<16)
 268 #define OHCI_RHS_OCIC         (1<<17)
 269 #define OHCI_RHS_CRWE         (1<<31)
 270
 271 #define OHCI_PORT_CCS         (1<<0)
 272 #define OHCI_PORT_PES         (1<<1)
 273 #define OHCI_PORT_PSS         (1<<2)
 274 #define OHCI_PORT_POCI        (1<<3)
 275 #define OHCI_PORT_PRS         (1<<4)
 276 #define OHCI_PORT_PPS         (1<<8)
 277 #define OHCI_PORT_LSDA        (1<<9)
 278 #define OHCI_PORT_CSC         (1<<16)
 279 #define OHCI_PORT_PESC        (1<<17)
 280 #define OHCI_PORT_PSSC        (1<<18)
 281 #define OHCI_PORT_OCIC        (1<<19)
 282 #define OHCI_PORT_PRSC        (1<<20)
 283 #define OHCI_PORT_WTC         (OHCI_PORT_CSC|OHCI_PORT_PESC|OHCI_PORT_PSSC \
 284                                |OHCI_PORT_OCIC|OHCI_PORT_PRSC)
 285
 286 #define OHCI_TD_DIR_SETUP     0x0
 287 #define OHCI_TD_DIR_OUT       0x1
 288 #define OHCI_TD_DIR_IN        0x2
 289 #define OHCI_TD_DIR_RESERVED  0x3
 290
 291 #define OHCI_CC_NOERROR             0x0
 292 #define OHCI_CC_CRC                 0x1
 293 #define OHCI_CC_BITSTUFFING         0x2
 294 #define OHCI_CC_DATATOGGLEMISMATCH  0x3
 295 #define OHCI_CC_STALL               0x4
 296 #define OHCI_CC_DEVICENOTRESPONDING 0x5
 297 #define OHCI_CC_PIDCHECKFAILURE     0x6
 298 #define OHCI_CC_UNDEXPETEDPID       0x7
 299 #define OHCI_CC_DATAOVERRUN         0x8
 300 #define OHCI_CC_DATAUNDERRUN        0x9
 301 #define OHCI_CC_BUFFEROVERRUN       0xc
 302 #define OHCI_CC_BUFFERUNDERRUN      0xd
 303
 304 #define OHCI_HRESET_FSBIR       (1 << 0)
 305
 306 /* Update IRQ levels */
 307 static inline void ohci_intr_update(OHCIState *ohci)
 308 {
 309     int level = 0;
 310
 311     if ((ohci->intr & OHCI_INTR_MIE) &&
 312         (ohci->intr_status & ohci->intr))
 313         level = 1;
 314
 315     qemu_set_irq(ohci->irq, level);
 316 }
 317
 318 /* Set an interrupt */
 319 static inline void ohci_set_interrupt(OHCIState *ohci, uint32_t intr)
 320 {
 321     ohci->intr_status |= intr;
 322     ohci_intr_update(ohci);
 323 }
 324
 325 /* Attach or detach a device on a root hub port.  */
 326 static void ohci_attach(USBPort *port1, USBDevice *dev)
 327 {
 328     OHCIState *s = port1->opaque;
 329     OHCIPort *port = &s->rhport[port1->index];
 330     uint32_t old_state = port->ctrl;
 331
 332     if (dev) {
 333         if (port->port.dev) {
 334             usb_attach(port1, NULL);
 335         }
 336         /* set connect status */
 337         port->ctrl |= OHCI_PORT_CCS | OHCI_PORT_CSC;
 338
 339         /* update speed */
 340         if (dev->speed == USB_SPEED_LOW)
 341             port->ctrl |= OHCI_PORT_LSDA;
 342         else
 343             port->ctrl &= ~OHCI_PORT_LSDA;
 344         port->port.dev = dev;
 345
 346         /* notify of remote-wakeup */
 347         if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND)
 348             ohci_set_interrupt(s, OHCI_INTR_RD);
 349
 350         /* send the attach message */
 351         usb_send_msg(dev, USB_MSG_ATTACH);
 352         dprintf("usb-ohci: Attached port %d\n", port1->index);
 353     } else {
 354         /* set connect status */
 355         if (port->ctrl & OHCI_PORT_CCS) {
 356             port->ctrl &= ~OHCI_PORT_CCS;
 357             port->ctrl |= OHCI_PORT_CSC;
 358         }
 359         /* disable port */
 360         if (port->ctrl & OHCI_PORT_PES) {
 361             port->ctrl &= ~OHCI_PORT_PES;
 362             port->ctrl |= OHCI_PORT_PESC;
 363         }
 364         dev = port->port.dev;
 365         if (dev) {
 366             /* send the detach message */
 367             usb_send_msg(dev, USB_MSG_DETACH);
 368         }
 369         port->port.dev = NULL;
 370         dprintf("usb-ohci: Detached port %d\n", port1->index);
 371     }
 372
 373     if (old_state != port->ctrl)
 374         ohci_set_interrupt(s, OHCI_INTR_RHSC);
 375 }
 376
 377 /* Reset the controller */
 378 static void ohci_reset(void *opaque)
 379 {
 380     OHCIState *ohci = opaque;
 381     OHCIPort *port;
 382     int i;
 383
 384     ohci_bus_stop(ohci);
 385     ohci->ctl = 0;
 386     ohci->old_ctl = 0;
 387     ohci->status = 0;
 388     ohci->intr_status = 0;
 389     ohci->intr = OHCI_INTR_MIE;
 390
 391     ohci->hcca = 0;
 392     ohci->ctrl_head = ohci->ctrl_cur = 0;
 393     ohci->bulk_head = ohci->bulk_cur = 0;
 394     ohci->per_cur = 0;
 395     ohci->done = 0;
 396     ohci->done_count = 7;
 397
 398     /* FSMPS is marked TBD in OCHI 1.0, what gives ffs?
 399      * I took the value linux sets ...
 400      */
 401     ohci->fsmps = 0x2778;
 402     ohci->fi = 0x2edf;
 403     ohci->fit = 0;
 404     ohci->frt = 0;
 405     ohci->frame_number = 0;
 406     ohci->pstart = 0;
 407     ohci->lst = OHCI_LS_THRESH;
 408
 409     ohci->rhdesc_a = OHCI_RHA_NPS | ohci->num_ports;
 410     ohci->rhdesc_b = 0x0; /* Impl. specific */
 411     ohci->rhstatus = 0;
 412
 413     for (i = 0; i < ohci->num_ports; i++)
 414       {
 415         port = &ohci->rhport[i];
 416         port->ctrl = 0;
 417         if (port->port.dev)
 418             ohci_attach(&port->port, port->port.dev);
 419       }
 420     if (ohci->async_td) {
 421         usb_cancel_packet(&ohci->usb_packet);
 422         ohci->async_td = 0;
 423     }
 424     dprintf("usb-ohci: Reset %s\n", ohci->name);
 425 }
 426
 427 /* Get an array of dwords from main memory */
 428 static inline int get_dwords(uint32_t addr, uint32_t *buf, int num)
 429 {
 430     int i;
 431
 432     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 433         cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
 434         *buf = le32_to_cpu(*buf);
 435     }
 436
 437     return 1;
 438 }
 439
 440 /* Put an array of dwords in to main memory */
 441 static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)
 442 {
 443     int i;
 444
 445     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 446         uint32_t tmp = cpu_to_le32(*buf);
 447         cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
 448     }
 449
 450     return 1;
 451 }
 452
 453 /* Get an array of words from main memory */
 454 static inline int get_words(uint32_t addr, uint16_t *buf, int num)
 455 {
 456     int i;
 457
 458     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 459         cpu_physical_memory_rw(addr, (uint8_t *)buf, sizeof(*buf), 0);
 460         *buf = le16_to_cpu(*buf);
 461     }
 462
 463     return 1;
 464 }
 465
 466 /* Put an array of words in to main memory */
 467 static inline int put_words(uint32_t addr, uint16_t *buf, int num)
 468 {
 469     int i;
 470
 471     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 472         uint16_t tmp = cpu_to_le16(*buf);
 473         cpu_physical_memory_rw(addr, (uint8_t *)&tmp, sizeof(tmp), 1);
 474     }
 475
 476     return 1;
 477 }
 478
 479 static inline int ohci_read_ed(uint32_t addr, struct ohci_ed *ed)
 480 {
 481     return get_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 482 }
 483
 484 static inline int ohci_read_td(uint32_t addr, struct ohci_td *td)
 485 {
 486     return get_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 487 }
 488
 489 static inline int ohci_read_iso_td(uint32_t addr, struct ohci_iso_td *td)
 490 {
 491     return (get_dwords(addr, (uint32_t *)td, 4) &&
 492             get_words(addr + 16, td->offset, 8));
 493 }
 494
 495 static inline int ohci_put_ed(uint32_t addr, struct ohci_ed *ed)
 496 {
 497     return put_dwords(addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 498 }
 499
 500 static inline int ohci_put_td(uint32_t addr, struct ohci_td *td)
 501 {
 502     return put_dwords(addr, (uint32_t *)td, sizeof(*td) >> 2);
 503 }
 504
 505 static inline int ohci_put_iso_td(uint32_t addr, struct ohci_iso_td *td)
 506 {
 507     return (put_dwords(addr, (uint32_t *)td, 4) &&
 508             put_words(addr + 16, td->offset, 8));
 509 }
 510
 511 /* Read/Write the contents of a TD from/to main memory.  */
 512 static void ohci_copy_td(struct ohci_td *td, uint8_t *buf, int len, int write)
 513 {
 514     uint32_t ptr;
 515     uint32_t n;
 516
 517     ptr = td->cbp;
 518     n = 0x1000 - (ptr & 0xfff);
 519     if (n > len)
 520         n = len;
 521     cpu_physical_memory_rw(ptr, buf, n, write);
 522     if (n == len)
 523         return;
 524     ptr = td->be & ~0xfffu;
 525     buf += n;
 526     cpu_physical_memory_rw(ptr, buf, len - n, write);
 527 }
 528
 529 /* Read/Write the contents of an ISO TD from/to main memory.  */
 530 static void ohci_copy_iso_td(uint32_t start_addr, uint32_t end_addr,
 531                              uint8_t *buf, int len, int write)
 532 {
 533     uint32_t ptr;
 534     uint32_t n;
 535
 536     ptr = start_addr;
 537     n = 0x1000 - (ptr & 0xfff);
 538     if (n > len)
 539         n = len;
 540     cpu_physical_memory_rw(ptr, buf, n, write);
 541     if (n == len)
 542         return;
 543     ptr = end_addr & ~0xfffu;
 544     buf += n;
 545     cpu_physical_memory_rw(ptr, buf, len - n, write);
 546 }
 547
 548 static void ohci_process_lists(OHCIState *ohci, int completion);
 549
 550 static void ohci_async_complete_packet(USBPacket *packet, void *opaque)
 551 {
 552     OHCIState *ohci = opaque;
 553 #ifdef DEBUG_PACKET
 554     dprintf("Async packet complete\n");
 555 #endif
 556     ohci->async_complete = 1;
 557     ohci_process_lists(ohci, 1);
 558 }
 559
 560 #define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
 561
 562 static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
 563                                int completion)
 564 {
 565     int dir;
 566     size_t len = 0;
 567     const char *str = NULL;
 568     int pid;
 569     int ret;
 570     int i;
 571     USBDevice *dev;
 572     struct ohci_iso_td iso_td;
 573     uint32_t addr;
 574     uint16_t starting_frame;
 575     int16_t relative_frame_number;
 576     int frame_count;
 577     uint32_t start_offset, next_offset, end_offset = 0;
 578     uint32_t start_addr, end_addr;
 579
 580     addr = ed->head & OHCI_DPTR_MASK;
 581
 582     if (!ohci_read_iso_td(addr, &iso_td)) {
 583         printf("usb-ohci: ISO_TD read error at %x\n", addr);
 584         return 0;
 585     }
 586
 587     starting_frame = OHCI_BM(iso_td.flags, TD_SF);
 588     frame_count = OHCI_BM(iso_td.flags, TD_FC);
 589     relative_frame_number = USUB(ohci->frame_number, starting_frame);
 590
 591 #ifdef DEBUG_ISOCH
 592     printf("--- ISO_TD ED head 0x%.8x tailp 0x%.8x\n"
 593            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 594            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 595            "0x%.8x 0x%.8x 0x%.8x 0x%.8x\n"
 596            "frame_number 0x%.8x starting_frame 0x%.8x\n"
 597            "frame_count  0x%.8x relative %d\n"
 598            "di 0x%.8x cc 0x%.8x\n",
 599            ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
 600            iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
 601            iso_td.offset[0], iso_td.offset[1], iso_td.offset[2], iso_td.offset[3],
 602            iso_td.offset[4], iso_td.offset[5], iso_td.offset[6], iso_td.offset[7],
 603            ohci->frame_number, starting_frame,
 604            frame_count, relative_frame_number,
 605            OHCI_BM(iso_td.flags, TD_DI), OHCI_BM(iso_td.flags, TD_CC));
 606 #endif
 607
 608     if (relative_frame_number < 0) {
 609         dprintf("usb-ohci: ISO_TD R=%d < 0\n", relative_frame_number);
 610         return 1;
 611     } else if (relative_frame_number > frame_count) {
 612         /* ISO TD expired - retire the TD to the Done Queue and continue with
 613            the next ISO TD of the same ED */
 614         dprintf("usb-ohci: ISO_TD R=%d > FC=%d\n", relative_frame_number,
 615                frame_count);
 616         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 617         ed->head &= ~OHCI_DPTR_MASK;
 618         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 619         iso_td.next = ohci->done;
 620         ohci->done = addr;
 621         i = OHCI_BM(iso_td.flags, TD_DI);
 622         if (i < ohci->done_count)
 623             ohci->done_count = i;
 624         ohci_put_iso_td(addr, &iso_td);
 625         return 0;
 626     }
 627
 628     dir = OHCI_BM(ed->flags, ED_D);
 629     switch (dir) {
 630     case OHCI_TD_DIR_IN:
 631         str = "in";
 632         pid = USB_TOKEN_IN;
 633         break;
 634     case OHCI_TD_DIR_OUT:
 635         str = "out";
 636         pid = USB_TOKEN_OUT;
 637         break;
 638     case OHCI_TD_DIR_SETUP:
 639         str = "setup";
 640         pid = USB_TOKEN_SETUP;
 641         break;
 642     default:
 643         printf("usb-ohci: Bad direction %d\n", dir);
 644         return 1;
 645     }
 646
 647     if (!iso_td.bp || !iso_td.be) {
 648         printf("usb-ohci: ISO_TD bp 0x%.8x be 0x%.8x\n", iso_td.bp, iso_td.be);
 649         return 1;
 650     }
 651
 652     start_offset = iso_td.offset[relative_frame_number];
 653     next_offset = iso_td.offset[relative_frame_number + 1];
 654
 655     if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) ||
 656         ((relative_frame_number < frame_count) &&
 657          !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
 658         printf("usb-ohci: ISO_TD cc != not accessed 0x%.8x 0x%.8x\n",
 659                start_offset, next_offset);
 660         return 1;
 661     }
 662
 663     if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
 664         printf("usb-ohci: ISO_TD start_offset=0x%.8x > next_offset=0x%.8x\n",
 665                 start_offset, next_offset);
 666         return 1;
 667     }
 668
 669     if ((start_offset & 0x1000) == 0) {
 670         start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 671             (start_offset & OHCI_OFFSET_MASK);
 672     } else {
 673         start_addr = (iso_td.be & OHCI_PAGE_MASK) |
 674             (start_offset & OHCI_OFFSET_MASK);
 675     }
 676
 677     if (relative_frame_number < frame_count) {
 678         end_offset = next_offset - 1;
 679         if ((end_offset & 0x1000) == 0) {
 680             end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 681                 (end_offset & OHCI_OFFSET_MASK);
 682         } else {
 683             end_addr = (iso_td.be & OHCI_PAGE_MASK) |
 684                 (end_offset & OHCI_OFFSET_MASK);
 685         }
 686     } else {
 687         /* Last packet in the ISO TD */
 688         end_addr = iso_td.be;
 689     }
 690
 691     if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
 692         len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
 693             - (start_addr & OHCI_OFFSET_MASK);
 694     } else {
 695         len = end_addr - start_addr + 1;
 696     }
 697
 698     if (len && dir != OHCI_TD_DIR_IN) {
 699         ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, len, 0);
 700     }
 701
 702     if (completion) {
 703         ret = ohci->usb_packet.len;
 704     } else {
 705         ret = USB_RET_NODEV;
 706         for (i = 0; i < ohci->num_ports; i++) {
 707             dev = ohci->rhport[i].port.dev;
 708             if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
 709                 continue;
 710             ohci->usb_packet.pid = pid;
 711             ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
 712             ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
 713             ohci->usb_packet.data = ohci->usb_buf;
 714             ohci->usb_packet.len = len;
 715             ohci->usb_packet.complete_cb = ohci_async_complete_packet;
 716             ohci->usb_packet.complete_opaque = ohci;
 717             ret = dev->handle_packet(dev, &ohci->usb_packet);
 718             if (ret != USB_RET_NODEV)
 719                 break;
 720         }
 721
 722         if (ret == USB_RET_ASYNC) {
 723             return 1;
 724         }
 725     }
 726
 727 #ifdef DEBUG_ISOCH
 728     printf("so 0x%.8x eo 0x%.8x\nsa 0x%.8x ea 0x%.8x\ndir %s len %zu ret %d\n",
 729            start_offset, end_offset, start_addr, end_addr, str, len, ret);
 730 #endif
 731
 732     /* Writeback */
 733     if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
 734         /* IN transfer succeeded */
 735         ohci_copy_iso_td(start_addr, end_addr, ohci->usb_buf, ret, 1);
 736         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 737                     OHCI_CC_NOERROR);
 738         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
 739     } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
 740         /* OUT transfer succeeded */
 741         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 742                     OHCI_CC_NOERROR);
 743         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
 744     } else {
 745         if (ret > (ssize_t) len) {
 746             printf("usb-ohci: DataOverrun %d > %zu\n", ret, len);
 747             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 748                         OHCI_CC_DATAOVERRUN);
 749             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 750                         len);
 751         } else if (ret >= 0) {
 752             printf("usb-ohci: DataUnderrun %d\n", ret);
 753             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 754                         OHCI_CC_DATAUNDERRUN);
 755         } else {
 756             switch (ret) {
 757             case USB_RET_NODEV:
 758                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 759                             OHCI_CC_DEVICENOTRESPONDING);
 760                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 761                             0);
 762                 break;
 763             case USB_RET_NAK:
 764             case USB_RET_STALL:
 765                 printf("usb-ohci: got NAK/STALL %d\n", ret);
 766                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 767                             OHCI_CC_STALL);
 768                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 769                             0);
 770                 break;
 771             default:
 772                 printf("usb-ohci: Bad device response %d\n", ret);
 773                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 774                             OHCI_CC_UNDEXPETEDPID);
 775                 break;
 776             }
 777         }
 778     }
 779
 780     if (relative_frame_number == frame_count) {
 781         /* Last data packet of ISO TD - retire the TD to the Done Queue */
 782         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
 783         ed->head &= ~OHCI_DPTR_MASK;
 784         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 785         iso_td.next = ohci->done;
 786         ohci->done = addr;
 787         i = OHCI_BM(iso_td.flags, TD_DI);
 788         if (i < ohci->done_count)
 789             ohci->done_count = i;
 790     }
 791     ohci_put_iso_td(addr, &iso_td);
 792     return 1;
 793 }
 794
 795 /* Service a transport descriptor.
 796    Returns nonzero to terminate processing of this endpoint.  */
 797
 798 static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 799 {
 800     int dir;
 801     size_t len = 0;
 802     const char *str = NULL;
 803     int pid;
 804     int ret;
 805     int i;
 806     USBDevice *dev;
 807     struct ohci_td td;
 808     uint32_t addr;
 809     int flag_r;
 810     int completion;
 811
 812     addr = ed->head & OHCI_DPTR_MASK;
 813     /* See if this TD has already been submitted to the device.  */
 814     completion = (addr == ohci->async_td);
 815     if (completion && !ohci->async_complete) {
 816 #ifdef DEBUG_PACKET
 817         dprintf("Skipping async TD\n");
 818 #endif
 819         return 1;
 820     }
 821     if (!ohci_read_td(addr, &td)) {
 822         fprintf(stderr, "usb-ohci: TD read error at %x\n", addr);
 823         return 0;
 824     }
 825
 826     dir = OHCI_BM(ed->flags, ED_D);
 827     switch (dir) {
 828     case OHCI_TD_DIR_OUT:
 829     case OHCI_TD_DIR_IN:
 830         /* Same value.  */
 831         break;
 832     default:
 833         dir = OHCI_BM(td.flags, TD_DP);
 834         break;
 835     }
 836
 837     switch (dir) {
 838     case OHCI_TD_DIR_IN:
 839         str = "in";
 840         pid = USB_TOKEN_IN;
 841         break;
 842     case OHCI_TD_DIR_OUT:
 843         str = "out";
 844         pid = USB_TOKEN_OUT;
 845         break;
 846     case OHCI_TD_DIR_SETUP:
 847         str = "setup";
 848         pid = USB_TOKEN_SETUP;
 849         break;
 850     default:
 851         fprintf(stderr, "usb-ohci: Bad direction\n");
 852         return 1;
 853     }
 854     if (td.cbp && td.be) {
 855         if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) {
 856             len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff);
 857         } else {
 858             len = (td.be - td.cbp) + 1;
 859         }
 860
 861         if (len && dir != OHCI_TD_DIR_IN && !completion) {
 862             ohci_copy_td(&td, ohci->usb_buf, len, 0);
 863         }
 864     }
 865
 866     flag_r = (td.flags & OHCI_TD_R) != 0;
 867 #ifdef DEBUG_PACKET
 868     dprintf(" TD @ 0x%.8x %u bytes %s r=%d cbp=0x%.8x be=0x%.8x\n",
 869             addr, len, str, flag_r, td.cbp, td.be);
 870
 871     if (len > 0 && dir != OHCI_TD_DIR_IN) {
 872         dprintf("  data:");
 873         for (i = 0; i < len; i++)
 874             printf(" %.2x", ohci->usb_buf[i]);
 875         dprintf("\n");
 876     }
 877 #endif
 878     if (completion) {
 879         ret = ohci->usb_packet.len;
 880         ohci->async_td = 0;
 881         ohci->async_complete = 0;
 882     } else {
 883         ret = USB_RET_NODEV;
 884         for (i = 0; i < ohci->num_ports; i++) {
 885             dev = ohci->rhport[i].port.dev;
 886             if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0)
 887                 continue;
 888
 889             if (ohci->async_td) {
 890                 /* ??? The hardware should allow one active packet per
 891                    endpoint.  We only allow one active packet per controller.
 892                    This should be sufficient as long as devices respond in a
 893                    timely manner.
 894                  */
 895 #ifdef DEBUG_PACKET
 896                 dprintf("Too many pending packets\n");
 897 #endif
 898                 return 1;
 899             }
 900             ohci->usb_packet.pid = pid;
 901             ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA);
 902             ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN);
 903             ohci->usb_packet.data = ohci->usb_buf;
 904             ohci->usb_packet.len = len;
 905             ohci->usb_packet.complete_cb = ohci_async_complete_packet;
 906             ohci->usb_packet.complete_opaque = ohci;
 907             ret = dev->handle_packet(dev, &ohci->usb_packet);
 908             if (ret != USB_RET_NODEV)
 909                 break;
 910         }
 911 #ifdef DEBUG_PACKET
 912         dprintf("ret=%d\n", ret);
 913 #endif
 914         if (ret == USB_RET_ASYNC) {
 915             ohci->async_td = addr;
 916             return 1;
 917         }
 918     }
 919     if (ret >= 0) {
 920         if (dir == OHCI_TD_DIR_IN) {
 921             ohci_copy_td(&td, ohci->usb_buf, ret, 1);
 922 #ifdef DEBUG_PACKET
 923             dprintf("  data:");
 924             for (i = 0; i < ret; i++)
 925                 printf(" %.2x", ohci->usb_buf[i]);
 926             dprintf("\n");
 927 #endif
 928         } else {
 929             ret = len;
 930         }
 931     }
 932
 933     /* Writeback */
 934     if (ret == len || (dir == OHCI_TD_DIR_IN && ret >= 0 && flag_r)) {
 935         /* Transmission succeeded.  */
 936         if (ret == len) {
 937             td.cbp = 0;
 938         } else {
 939             td.cbp += ret;
 940             if ((td.cbp & 0xfff) + ret > 0xfff) {
 941                 td.cbp &= 0xfff;
 942                 td.cbp |= td.be & ~0xfff;
 943             }
 944         }
 945         td.flags |= OHCI_TD_T1;
 946         td.flags ^= OHCI_TD_T0;
 947         OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_NOERROR);
 948         OHCI_SET_BM(td.flags, TD_EC, 0);
 949
 950         ed->head &= ~OHCI_ED_C;
 951         if (td.flags & OHCI_TD_T0)
 952             ed->head |= OHCI_ED_C;
 953     } else {
 954         if (ret >= 0) {
 955             dprintf("usb-ohci: Underrun\n");
 956             OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAUNDERRUN);
 957         } else {
 958             switch (ret) {
 959             case USB_RET_NODEV:
 960                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DEVICENOTRESPONDING);
 961             case USB_RET_NAK:
 962                 dprintf("usb-ohci: got NAK\n");
 963                 return 1;
 964             case USB_RET_STALL:
 965                 dprintf("usb-ohci: got STALL\n");
 966                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_STALL);
 967                 break;
 968             case USB_RET_BABBLE:
 969                 dprintf("usb-ohci: got BABBLE\n");
 970                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 971                 break;
 972             default:
 973                 fprintf(stderr, "usb-ohci: Bad device response %d\n", ret);
 974                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_UNDEXPETEDPID);
 975                 OHCI_SET_BM(td.flags, TD_EC, 3);
 976                 break;
 977             }
 978         }
 979         ed->head |= OHCI_ED_H;
 980     }
 981
 982     /* Retire this TD */
 983     ed->head &= ~OHCI_DPTR_MASK;
 984     ed->head |= td.next & OHCI_DPTR_MASK;
 985     td.next = ohci->done;
 986     ohci->done = addr;
 987     i = OHCI_BM(td.flags, TD_DI);
 988     if (i < ohci->done_count)
 989         ohci->done_count = i;
 990     ohci_put_td(addr, &td);
 991     return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR;
 992 }
 993
 994 /* Service an endpoint list.  Returns nonzero if active TD were found.  */
 995 static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
 996 {
 997     struct ohci_ed ed;
 998     uint32_t next_ed;
 999     uint32_t cur;
1000     int active;
1001
1002     active = 0;
1003
1004     if (head == 0)
1005         return 0;
1006
1007     for (cur = head; cur; cur = next_ed) {
1008         if (!ohci_read_ed(cur, &ed)) {
1009             fprintf(stderr, "usb-ohci: ED read error at %x\n", cur);
1010             return 0;
1011         }
1012
1013         next_ed = ed.next & OHCI_DPTR_MASK;
1014
1015         if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
1016             uint32_t addr;
1017             /* Cancel pending packets for ED that have been paused.  */
1018             addr = ed.head & OHCI_DPTR_MASK;
1019             if (ohci->async_td && addr == ohci->async_td) {
1020                 usb_cancel_packet(&ohci->usb_packet);
1021                 ohci->async_td = 0;
1022             }
1023             continue;
1024         }
1025
1026         while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
1027 #ifdef DEBUG_PACKET
1028             dprintf("ED @ 0x%.8x fa=%u en=%u d=%u s=%u k=%u f=%u mps=%u "
1029                     "h=%u c=%u\n  head=0x%.8x tailp=0x%.8x next=0x%.8x\n", cur,
1030                     OHCI_BM(ed.flags, ED_FA), OHCI_BM(ed.flags, ED_EN),
1031                     OHCI_BM(ed.flags, ED_D), (ed.flags & OHCI_ED_S)!= 0,
1032                     (ed.flags & OHCI_ED_K) != 0, (ed.flags & OHCI_ED_F) != 0,
1033                     OHCI_BM(ed.flags, ED_MPS), (ed.head & OHCI_ED_H) != 0,
1034                     (ed.head & OHCI_ED_C) != 0, ed.head & OHCI_DPTR_MASK,
1035                     ed.tail & OHCI_DPTR_MASK, ed.next & OHCI_DPTR_MASK);
1036 #endif
1037             active = 1;
1038
1039             if ((ed.flags & OHCI_ED_F) == 0) {
1040                 if (ohci_service_td(ohci, &ed))
1041                     break;
1042             } else {
1043                 /* Handle isochronous endpoints */
1044                 if (ohci_service_iso_td(ohci, &ed, completion))
1045                     break;
1046             }
1047         }
1048
1049         ohci_put_ed(cur, &ed);
1050     }
1051
1052     return active;
1053 }
1054
1055 /* Generate a SOF event, and set a timer for EOF */
1056 static void ohci_sof(OHCIState *ohci)
1057 {
1058     ohci->sof_time = qemu_get_clock(vm_clock);
1059     qemu_mod_timer(ohci->eof_timer, ohci->sof_time + usb_frame_time);
1060     ohci_set_interrupt(ohci, OHCI_INTR_SF);
1061 }
1062
1063 /* Process Control and Bulk lists.  */
1064 static void ohci_process_lists(OHCIState *ohci, int completion)
1065 {
1066     if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
1067         if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head)
1068           dprintf("usb-ohci: head %x, cur %x\n",
1069                           ohci->ctrl_head, ohci->ctrl_cur);
1070         if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
1071             ohci->ctrl_cur = 0;
1072             ohci->status &= ~OHCI_STATUS_CLF;
1073         }
1074     }
1075
1076     if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
1077         if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
1078             ohci->bulk_cur = 0;
1079             ohci->status &= ~OHCI_STATUS_BLF;
1080         }
1081     }
1082 }
1083
1084 /* Do frame processing on frame boundary */
1085 static void ohci_frame_boundary(void *opaque)
1086 {
1087     OHCIState *ohci = opaque;
1088     struct ohci_hcca hcca;
1089
1090     cpu_physical_memory_rw(ohci->hcca, (uint8_t *)&hcca, sizeof(hcca), 0);
1091
1092     /* Process all the lists at the end of the frame */
1093     if (ohci->ctl & OHCI_CTL_PLE) {
1094         int n;
1095
1096         n = ohci->frame_number & 0x1f;
1097         ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
1098     }
1099
1100     /* Cancel all pending packets if either of the lists has been disabled.  */
1101     if (ohci->async_td &&
1102         ohci->old_ctl & (~ohci->ctl) & (OHCI_CTL_BLE | OHCI_CTL_CLE)) {
1103         usb_cancel_packet(&ohci->usb_packet);
1104         ohci->async_td = 0;
1105     }
1106     ohci->old_ctl = ohci->ctl;
1107     ohci_process_lists(ohci, 0);
1108
1109     /* Frame boundary, so do EOF stuf here */
1110     ohci->frt = ohci->fit;
1111
1112     /* XXX: endianness */
1113     ohci->frame_number = (ohci->frame_number + 1) & 0xffff;
1114     hcca.frame = cpu_to_le32(ohci->frame_number);
1115
1116     if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) {
1117         if (!ohci->done)
1118             abort();
1119         if (ohci->intr & ohci->intr_status)
1120             ohci->done |= 1;
1121         hcca.done = cpu_to_le32(ohci->done);
1122         ohci->done = 0;
1123         ohci->done_count = 7;
1124         ohci_set_interrupt(ohci, OHCI_INTR_WD);
1125     }
1126
1127     if (ohci->done_count != 7 && ohci->done_count != 0)
1128         ohci->done_count--;
1129
1130     /* Do SOF stuff here */
1131     ohci_sof(ohci);
1132
1133     /* Writeback HCCA */
1134     cpu_physical_memory_rw(ohci->hcca, (uint8_t *)&hcca, sizeof(hcca), 1);
1135 }
1136
1137 /* Start sending SOF tokens across the USB bus, lists are processed in
1138  * next frame
1139  */
1140 static int ohci_bus_start(OHCIState *ohci)
1141 {
1142     ohci->eof_timer = qemu_new_timer(vm_clock,
1143                     ohci_frame_boundary,
1144                     ohci);
1145
1146     if (ohci->eof_timer == NULL) {
1147         fprintf(stderr, "usb-ohci: %s: qemu_new_timer failed\n", ohci->name);
1148         /* TODO: Signal unrecoverable error */
1149         return 0;
1150     }
1151
1152     dprintf("usb-ohci: %s: USB Operational\n", ohci->name);
1153
1154     ohci_sof(ohci);
1155
1156     return 1;
1157 }
1158
1159 /* Stop sending SOF tokens on the bus */
1160 static void ohci_bus_stop(OHCIState *ohci)
1161 {
1162     if (ohci->eof_timer)
1163         qemu_del_timer(ohci->eof_timer);
1164     ohci->eof_timer = NULL;
1165 }
1166
1167 /* Sets a flag in a port status register but only set it if the port is
1168  * connected, if not set ConnectStatusChange flag. If flag is enabled
1169  * return 1.
1170  */
1171 static int ohci_port_set_if_connected(OHCIState *ohci, int i, uint32_t val)
1172 {
1173     int ret = 1;
1174
1175     /* writing a 0 has no effect */
1176     if (val == 0)
1177         return 0;
1178
1179     /* If CurrentConnectStatus is cleared we set
1180      * ConnectStatusChange
1181      */
1182     if (!(ohci->rhport[i].ctrl & OHCI_PORT_CCS)) {
1183         ohci->rhport[i].ctrl |= OHCI_PORT_CSC;
1184         if (ohci->rhstatus & OHCI_RHS_DRWE) {
1185             /* TODO: CSC is a wakeup event */
1186         }
1187         return 0;
1188     }
1189
1190     if (ohci->rhport[i].ctrl & val)
1191         ret = 0;
1192
1193     /* set the bit */
1194     ohci->rhport[i].ctrl |= val;
1195
1196     return ret;
1197 }
1198
1199 /* Set the frame interval - frame interval toggle is manipulated by the hcd only */
1200 static void ohci_set_frame_interval(OHCIState *ohci, uint16_t val)
1201 {
1202     val &= OHCI_FMI_FI;
1203
1204     if (val != ohci->fi) {
1205         dprintf("usb-ohci: %s: FrameInterval = 0x%x (%u)\n",
1206             ohci->name, ohci->fi, ohci->fi);
1207     }
1208
1209     ohci->fi = val;
1210 }
1211
1212 static void ohci_port_power(OHCIState *ohci, int i, int p)
1213 {
1214     if (p) {
1215         ohci->rhport[i].ctrl |= OHCI_PORT_PPS;
1216     } else {
1217         ohci->rhport[i].ctrl &= ~(OHCI_PORT_PPS|
1218                     OHCI_PORT_CCS|
1219                     OHCI_PORT_PSS|
1220                     OHCI_PORT_PRS);
1221     }
1222 }
1223
1224 /* Set HcControlRegister */
1225 static void ohci_set_ctl(OHCIState *ohci, uint32_t val)
1226 {
1227     uint32_t old_state;
1228     uint32_t new_state;
1229
1230     old_state = ohci->ctl & OHCI_CTL_HCFS;
1231     ohci->ctl = val;
1232     new_state = ohci->ctl & OHCI_CTL_HCFS;
1233
1234     /* no state change */
1235     if (old_state == new_state)
1236         return;
1237
1238     switch (new_state) {
1239     case OHCI_USB_OPERATIONAL:
1240         ohci_bus_start(ohci);
1241         break;
1242     case OHCI_USB_SUSPEND:
1243         ohci_bus_stop(ohci);
1244         dprintf("usb-ohci: %s: USB Suspended\n", ohci->name);
1245         break;
1246     case OHCI_USB_RESUME:
1247         dprintf("usb-ohci: %s: USB Resume\n", ohci->name);
1248         break;
1249     case OHCI_USB_RESET:
1250         ohci_reset(ohci);
1251         dprintf("usb-ohci: %s: USB Reset\n", ohci->name);
1252         break;
1253     }
1254 }
1255
1256 static uint32_t ohci_get_frame_remaining(OHCIState *ohci)
1257 {
1258     uint16_t fr;
1259     int64_t tks;
1260
1261     if ((ohci->ctl & OHCI_CTL_HCFS) != OHCI_USB_OPERATIONAL)
1262         return (ohci->frt << 31);
1263
1264     /* Being in USB operational state guarnatees sof_time was
1265      * set already.
1266      */
1267     tks = qemu_get_clock(vm_clock) - ohci->sof_time;
1268
1269     /* avoid muldiv if possible */
1270     if (tks >= usb_frame_time)
1271         return (ohci->frt << 31);
1272
1273     tks = muldiv64(1, tks, usb_bit_time);
1274     fr = (uint16_t)(ohci->fi - tks);
1275
1276     return (ohci->frt << 31) | fr;
1277 }
1278
1279
1280 /* Set root hub status */
1281 static void ohci_set_hub_status(OHCIState *ohci, uint32_t val)
1282 {
1283     uint32_t old_state;
1284
1285     old_state = ohci->rhstatus;
1286
1287     /* write 1 to clear OCIC */
1288     if (val & OHCI_RHS_OCIC)
1289         ohci->rhstatus &= ~OHCI_RHS_OCIC;
1290
1291     if (val & OHCI_RHS_LPS) {
1292         int i;
1293
1294         for (i = 0; i < ohci->num_ports; i++)
1295             ohci_port_power(ohci, i, 0);
1296         dprintf("usb-ohci: powered down all ports\n");
1297     }
1298
1299     if (val & OHCI_RHS_LPSC) {
1300         int i;
1301
1302         for (i = 0; i < ohci->num_ports; i++)
1303             ohci_port_power(ohci, i, 1);
1304         dprintf("usb-ohci: powered up all ports\n");
1305     }
1306
1307     if (val & OHCI_RHS_DRWE)
1308         ohci->rhstatus |= OHCI_RHS_DRWE;
1309
1310     if (val & OHCI_RHS_CRWE)
1311         ohci->rhstatus &= ~OHCI_RHS_DRWE;
1312
1313     if (old_state != ohci->rhstatus)
1314         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1315 }
1316
1317 /* Set root hub port status */
1318 static void ohci_port_set_status(OHCIState *ohci, int portnum, uint32_t val)
1319 {
1320     uint32_t old_state;
1321     OHCIPort *port;
1322
1323     port = &ohci->rhport[portnum];
1324     old_state = port->ctrl;
1325
1326     /* Write to clear CSC, PESC, PSSC, OCIC, PRSC */
1327     if (val & OHCI_PORT_WTC)
1328         port->ctrl &= ~(val & OHCI_PORT_WTC);
1329
1330     if (val & OHCI_PORT_CCS)
1331         port->ctrl &= ~OHCI_PORT_PES;
1332
1333     ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PES);
1334
1335     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PSS))
1336         dprintf("usb-ohci: port %d: SUSPEND\n", portnum);
1337
1338     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PRS)) {
1339         dprintf("usb-ohci: port %d: RESET\n", portnum);
1340         usb_send_msg(port->port.dev, USB_MSG_RESET);
1341         port->ctrl &= ~OHCI_PORT_PRS;
1342         /* ??? Should this also set OHCI_PORT_PESC.  */
1343         port->ctrl |= OHCI_PORT_PES | OHCI_PORT_PRSC;
1344     }
1345
1346     /* Invert order here to ensure in ambiguous case, device is
1347      * powered up...
1348      */
1349     if (val & OHCI_PORT_LSDA)
1350         ohci_port_power(ohci, portnum, 0);
1351     if (val & OHCI_PORT_PPS)
1352         ohci_port_power(ohci, portnum, 1);
1353
1354     if (old_state != port->ctrl)
1355         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1356
1357     return;
1358 }
1359
1360 static uint32_t ohci_mem_read(void *ptr, target_phys_addr_t addr)
1361 {
1362     OHCIState *ohci = ptr;
1363
1364     /* Only aligned reads are allowed on OHCI */
1365     if (addr & 3) {
1366         fprintf(stderr, "usb-ohci: Mis-aligned read\n");
1367         return 0xffffffff;
1368     }
1369
1370     if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1371         /* HcRhPortStatus */
1372         return ohci->rhport[(addr - 0x54) >> 2].ctrl | OHCI_PORT_PPS;
1373     }
1374
1375     switch (addr >> 2) {
1376     case 0: /* HcRevision */
1377         return 0x10;
1378
1379     case 1: /* HcControl */
1380         return ohci->ctl;
1381
1382     case 2: /* HcCommandStatus */
1383         return ohci->status;
1384
1385     case 3: /* HcInterruptStatus */
1386         return ohci->intr_status;
1387
1388     case 4: /* HcInterruptEnable */
1389     case 5: /* HcInterruptDisable */
1390         return ohci->intr;
1391
1392     case 6: /* HcHCCA */
1393         return ohci->hcca;
1394
1395     case 7: /* HcPeriodCurrentED */
1396         return ohci->per_cur;
1397
1398     case 8: /* HcControlHeadED */
1399         return ohci->ctrl_head;
1400
1401     case 9: /* HcControlCurrentED */
1402         return ohci->ctrl_cur;
1403
1404     case 10: /* HcBulkHeadED */
1405         return ohci->bulk_head;
1406
1407     case 11: /* HcBulkCurrentED */
1408         return ohci->bulk_cur;
1409
1410     case 12: /* HcDoneHead */
1411         return ohci->done;
1412
1413     case 13: /* HcFmInterval */
1414         return (ohci->fit << 31) | (ohci->fsmps << 16) | (ohci->fi);
1415
1416     case 14: /* HcFmRemaining */
1417         return ohci_get_frame_remaining(ohci);
1418
1419     case 15: /* HcFmNumber */
1420         return ohci->frame_number;
1421
1422     case 16: /* HcPeriodicStart */
1423         return ohci->pstart;
1424
1425     case 17: /* HcLSThreshold */
1426         return ohci->lst;
1427
1428     case 18: /* HcRhDescriptorA */
1429         return ohci->rhdesc_a;
1430
1431     case 19: /* HcRhDescriptorB */
1432         return ohci->rhdesc_b;
1433
1434     case 20: /* HcRhStatus */
1435         return ohci->rhstatus;
1436
1437     /* PXA27x specific registers */
1438     case 24: /* HcStatus */
1439         return ohci->hstatus & ohci->hmask;
1440
1441     case 25: /* HcHReset */
1442         return ohci->hreset;
1443
1444     case 26: /* HcHInterruptEnable */
1445         return ohci->hmask;
1446
1447     case 27: /* HcHInterruptTest */
1448         return ohci->htest;
1449
1450     default:
1451         fprintf(stderr, "ohci_read: Bad offset %x\n", (int)addr);
1452         return 0xffffffff;
1453     }
1454 }
1455
1456 static void ohci_mem_write(void *ptr, target_phys_addr_t addr, uint32_t val)
1457 {
1458     OHCIState *ohci = ptr;
1459
1460     /* Only aligned reads are allowed on OHCI */
1461     if (addr & 3) {
1462         fprintf(stderr, "usb-ohci: Mis-aligned write\n");
1463         return;
1464     }
1465
1466     if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1467         /* HcRhPortStatus */
1468         ohci_port_set_status(ohci, (addr - 0x54) >> 2, val);
1469         return;
1470     }
1471
1472     switch (addr >> 2) {
1473     case 1: /* HcControl */
1474         ohci_set_ctl(ohci, val);
1475         break;
1476
1477     case 2: /* HcCommandStatus */
1478         /* SOC is read-only */
1479         val = (val & ~OHCI_STATUS_SOC);
1480
1481         /* Bits written as '0' remain unchanged in the register */
1482         ohci->status |= val;
1483
1484         if (ohci->status & OHCI_STATUS_HCR)
1485             ohci_reset(ohci);
1486         break;
1487
1488     case 3: /* HcInterruptStatus */
1489         ohci->intr_status &= ~val;
1490         ohci_intr_update(ohci);
1491         break;
1492
1493     case 4: /* HcInterruptEnable */
1494         ohci->intr |= val;
1495         ohci_intr_update(ohci);
1496         break;
1497
1498     case 5: /* HcInterruptDisable */
1499         ohci->intr &= ~val;
1500         ohci_intr_update(ohci);
1501         break;
1502
1503     case 6: /* HcHCCA */
1504         ohci->hcca = val & OHCI_HCCA_MASK;
1505         break;
1506
1507     case 8: /* HcControlHeadED */
1508         ohci->ctrl_head = val & OHCI_EDPTR_MASK;
1509         break;
1510
1511     case 9: /* HcControlCurrentED */
1512         ohci->ctrl_cur = val & OHCI_EDPTR_MASK;
1513         break;
1514
1515     case 10: /* HcBulkHeadED */
1516         ohci->bulk_head = val & OHCI_EDPTR_MASK;
1517         break;
1518
1519     case 11: /* HcBulkCurrentED */
1520         ohci->bulk_cur = val & OHCI_EDPTR_MASK;
1521         break;
1522
1523     case 13: /* HcFmInterval */
1524         ohci->fsmps = (val & OHCI_FMI_FSMPS) >> 16;
1525         ohci->fit = (val & OHCI_FMI_FIT) >> 31;
1526         ohci_set_frame_interval(ohci, val);
1527         break;
1528
1529     case 15: /* HcFmNumber */
1530         break;
1531
1532     case 16: /* HcPeriodicStart */
1533         ohci->pstart = val & 0xffff;
1534         break;
1535
1536     case 17: /* HcLSThreshold */
1537         ohci->lst = val & 0xffff;
1538         break;
1539
1540     case 18: /* HcRhDescriptorA */
1541         ohci->rhdesc_a &= ~OHCI_RHA_RW_MASK;
1542         ohci->rhdesc_a |= val & OHCI_RHA_RW_MASK;
1543         break;
1544
1545     case 19: /* HcRhDescriptorB */
1546         break;
1547
1548     case 20: /* HcRhStatus */
1549         ohci_set_hub_status(ohci, val);
1550         break;
1551
1552     /* PXA27x specific registers */
1553     case 24: /* HcStatus */
1554         ohci->hstatus &= ~(val & ohci->hmask);
1555
1556     case 25: /* HcHReset */
1557         ohci->hreset = val & ~OHCI_HRESET_FSBIR;
1558         if (val & OHCI_HRESET_FSBIR)
1559             ohci_reset(ohci);
1560         break;
1561
1562     case 26: /* HcHInterruptEnable */
1563         ohci->hmask = val;
1564         break;
1565
1566     case 27: /* HcHInterruptTest */
1567         ohci->htest = val;
1568         break;
1569
1570     default:
1571         fprintf(stderr, "ohci_write: Bad offset %x\n", (int)addr);
1572         break;
1573     }
1574 }
1575
1576 /* Only dword reads are defined on OHCI register space */
1577 static CPUReadMemoryFunc *ohci_readfn[3]={
1578     ohci_mem_read,
1579     ohci_mem_read,
1580     ohci_mem_read
1581 };
1582
1583 /* Only dword writes are defined on OHCI register space */
1584 static CPUWriteMemoryFunc *ohci_writefn[3]={
1585     ohci_mem_write,
1586     ohci_mem_write,
1587     ohci_mem_write
1588 };
1589
1590 static void usb_ohci_init(OHCIState *ohci, int num_ports, int devfn,
1591             qemu_irq irq, enum ohci_type type, const char *name)
1592 {
1593     int i;
1594
1595     if (usb_frame_time == 0) {
1596 #ifdef OHCI_TIME_WARP
1597         usb_frame_time = ticks_per_sec;
1598         usb_bit_time = muldiv64(1, ticks_per_sec, USB_HZ/1000);
1599 #else
1600         usb_frame_time = muldiv64(1, ticks_per_sec, 1000);
1601         if (ticks_per_sec >= USB_HZ) {
1602             usb_bit_time = muldiv64(1, ticks_per_sec, USB_HZ);
1603         } else {
1604             usb_bit_time = 1;
1605         }
1606 #endif
1607         dprintf("usb-ohci: usb_bit_time=%lli usb_frame_time=%lli\n",
1608                 usb_frame_time, usb_bit_time);
1609     }
1610
1611     ohci->mem = cpu_register_io_memory(0, ohci_readfn, ohci_writefn, ohci);
1612     ohci->name = name;
1613
1614     ohci->irq = irq;
1615     ohci->type = type;
1616
1617     ohci->num_ports = num_ports;
1618     for (i = 0; i < num_ports; i++) {
1619         qemu_register_usb_port(&ohci->rhport[i].port, ohci, i, ohci_attach);
1620     }
1621
1622     ohci->async_td = 0;
1623     qemu_register_reset(ohci_reset, ohci);
1624     ohci_reset(ohci);
1625 }
1626
1627 typedef struct {
1628     PCIDevice pci_dev;
1629     OHCIState state;
1630 } OHCIPCIState;
1631
1632 static void ohci_mapfunc(PCIDevice *pci_dev, int i,
1633             uint32_t addr, uint32_t size, int type)
1634 {
1635     OHCIPCIState *ohci = (OHCIPCIState *)pci_dev;
1636     cpu_register_physical_memory(addr, size, ohci->state.mem);
1637 }
1638
1639 void usb_ohci_init_pci(struct PCIBus *bus, int num_ports, int devfn)
1640 {
1641     OHCIPCIState *ohci;
1642     int vid = 0x106b;
1643     int did = 0x003f;
1644
1645     ohci = (OHCIPCIState *)pci_register_device(bus, "OHCI USB", sizeof(*ohci),
1646                                                devfn, NULL, NULL);
1647     if (ohci == NULL) {
1648         fprintf(stderr, "usb-ohci: Failed to register PCI device\n");
1649         return;
1650     }
1651
1652     ohci->pci_dev.config[0x00] = vid & 0xff;
1653     ohci->pci_dev.config[0x01] = (vid >> 8) & 0xff;
1654     ohci->pci_dev.config[0x02] = did & 0xff;
1655     ohci->pci_dev.config[0x03] = (did >> 8) & 0xff;
1656     ohci->pci_dev.config[0x09] = 0x10; /* OHCI */
1657     ohci->pci_dev.config[0x0a] = 0x3;
1658     ohci->pci_dev.config[0x0b] = 0xc;
1659     ohci->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
1660
1661     usb_ohci_init(&ohci->state, num_ports, devfn, ohci->pci_dev.irq[0],
1662                   OHCI_TYPE_PCI, ohci->pci_dev.name);
1663
1664     pci_register_io_region((struct PCIDevice *)ohci, 0, 256,
1665                            PCI_ADDRESS_SPACE_MEM, ohci_mapfunc);
1666 }
1667
1668 void usb_ohci_init_pxa(target_phys_addr_t base, int num_ports, int devfn,
1669                        qemu_irq irq)
1670 {
1671     OHCIState *ohci = (OHCIState *)qemu_mallocz(sizeof(OHCIState));
1672
1673     usb_ohci_init(ohci, num_ports, devfn, irq,
1674                   OHCI_TYPE_PXA, "OHCI USB");
1675
1676     cpu_register_physical_memory(base, 0x1000, ohci->mem);
1677 }