hw/usb-uhci.c

   1 /*
   2  * USB UHCI controller emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "vl.h"
  25
  26 //#define DEBUG
  27 //#define DEBUG_PACKET
  28
  29 #define UHCI_CMD_FGR      (1 << 4)
  30 #define UHCI_CMD_EGSM     (1 << 3)
  31 #define UHCI_CMD_GRESET   (1 << 2)
  32 #define UHCI_CMD_HCRESET  (1 << 1)
  33 #define UHCI_CMD_RS       (1 << 0)
  34
  35 #define UHCI_STS_HCHALTED (1 << 5)
  36 #define UHCI_STS_HCPERR   (1 << 4)
  37 #define UHCI_STS_HSERR    (1 << 3)
  38 #define UHCI_STS_RD       (1 << 2)
  39 #define UHCI_STS_USBERR   (1 << 1)
  40 #define UHCI_STS_USBINT   (1 << 0)
  41
  42 #define TD_CTRL_SPD     (1 << 29)
  43 #define TD_CTRL_ERROR_SHIFT  27
  44 #define TD_CTRL_IOS     (1 << 25)
  45 #define TD_CTRL_IOC     (1 << 24)
  46 #define TD_CTRL_ACTIVE  (1 << 23)
  47 #define TD_CTRL_STALL   (1 << 22)
  48 #define TD_CTRL_BABBLE  (1 << 20)
  49 #define TD_CTRL_NAK     (1 << 19)
  50 #define TD_CTRL_TIMEOUT (1 << 18)
  51
  52 #define UHCI_PORT_RESET (1 << 9)
  53 #define UHCI_PORT_LSDA  (1 << 8)
  54 #define UHCI_PORT_ENC   (1 << 3)
  55 #define UHCI_PORT_EN    (1 << 2)
  56 #define UHCI_PORT_CSC   (1 << 1)
  57 #define UHCI_PORT_CCS   (1 << 0)
  58
  59 #define FRAME_TIMER_FREQ 1000
  60
  61 #define FRAME_MAX_LOOPS  100
  62
  63 #define NB_PORTS 2
  64
  65 typedef struct UHCIPort {
  66     USBPort port;
  67     uint16_t ctrl;
  68 } UHCIPort;
  69
  70 typedef struct UHCIState {
  71     PCIDevice dev;
  72     uint16_t cmd; /* cmd register */
  73     uint16_t status;
  74     uint16_t intr; /* interrupt enable register */
  75     uint16_t frnum; /* frame number */
  76     uint32_t fl_base_addr; /* frame list base address */
  77     uint8_t sof_timing;
  78     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
  79     QEMUTimer *frame_timer;
  80     UHCIPort ports[NB_PORTS];
  81
  82     /* Interrupts that should be raised at the end of the current frame.  */
  83     uint32_t pending_int_mask;
  84     /* For simplicity of implementation we only allow a single pending USB
  85        request.  This means all usb traffic on this controller is effectively
  86        suspended until that transfer completes.  When the transfer completes
  87        the next transfer from that queue will be processed.  However
  88        other queues will not be processed until the next frame.  The solution
  89        is to allow multiple pending requests.  */
  90     uint32_t async_qh;
  91     USBPacket usb_packet;
  92     uint8_t usb_buf[2048];
  93 } UHCIState;
  94
  95 typedef struct UHCI_TD {
  96     uint32_t link;
  97     uint32_t ctrl; /* see TD_CTRL_xxx */
  98     uint32_t token;
  99     uint32_t buffer;
 100 } UHCI_TD;
 101
 102 typedef struct UHCI_QH {
 103     uint32_t link;
 104     uint32_t el_link;
 105 } UHCI_QH;
 106
 107 static void uhci_attach(USBPort *port1, USBDevice *dev);
 108
 109 static void uhci_update_irq(UHCIState *s)
 110 {
 111     int level;
 112     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
 113         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
 114         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
 115         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
 116         (s->status & UHCI_STS_HSERR) ||
 117         (s->status & UHCI_STS_HCPERR)) {
 118         level = 1;
 119     } else {
 120         level = 0;
 121     }
 122     qemu_set_irq(s->dev.irq[3], level);
 123 }
 124
 125 static void uhci_reset(UHCIState *s)
 126 {
 127     uint8_t *pci_conf;
 128     int i;
 129     UHCIPort *port;
 130
 131     pci_conf = s->dev.config;
 132
 133     pci_conf[0x6a] = 0x01; /* usb clock */
 134     pci_conf[0x6b] = 0x00;
 135     s->cmd = 0;
 136     s->status = 0;
 137     s->status2 = 0;
 138     s->intr = 0;
 139     s->fl_base_addr = 0;
 140     s->sof_timing = 64;
 141     for(i = 0; i < NB_PORTS; i++) {
 142         port = &s->ports[i];
 143         port->ctrl = 0x0080;
 144         if (port->port.dev)
 145             uhci_attach(&port->port, port->port.dev);
 146     }
 147 }
 148
 149 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 150 {
 151     UHCIState *s = opaque;
 152
 153     addr &= 0x1f;
 154     switch(addr) {
 155     case 0x0c:
 156         s->sof_timing = val;
 157         break;
 158     }
 159 }
 160
 161 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
 162 {
 163     UHCIState *s = opaque;
 164     uint32_t val;
 165
 166     addr &= 0x1f;
 167     switch(addr) {
 168     case 0x0c:
 169         val = s->sof_timing;
 170         break;
 171     default:
 172         val = 0xff;
 173         break;
 174     }
 175     return val;
 176 }
 177
 178 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 179 {
 180     UHCIState *s = opaque;
 181
 182     addr &= 0x1f;
 183 #ifdef DEBUG
 184     printf("uhci writew port=0x%04x val=0x%04x\n", addr, val);
 185 #endif
 186     switch(addr) {
 187     case 0x00:
 188         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
 189             /* start frame processing */
 190             qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
 191             s->status &= ~UHCI_STS_HCHALTED;
 192         } else if (!(val & UHCI_CMD_RS)) {
 193             s->status |= UHCI_STS_HCHALTED;
 194         }
 195         if (val & UHCI_CMD_GRESET) {
 196             UHCIPort *port;
 197             USBDevice *dev;
 198             int i;
 199
 200             /* send reset on the USB bus */
 201             for(i = 0; i < NB_PORTS; i++) {
 202                 port = &s->ports[i];
 203                 dev = port->port.dev;
 204                 if (dev) {
 205                     usb_send_msg(dev, USB_MSG_RESET);
 206                 }
 207             }
 208             uhci_reset(s);
 209             return;
 210         }
 211         if (val & UHCI_CMD_HCRESET) {
 212             uhci_reset(s);
 213             return;
 214         }
 215         s->cmd = val;
 216         break;
 217     case 0x02:
 218         s->status &= ~val;
 219         /* XXX: the chip spec is not coherent, so we add a hidden
 220            register to distinguish between IOC and SPD */
 221         if (val & UHCI_STS_USBINT)
 222             s->status2 = 0;
 223         uhci_update_irq(s);
 224         break;
 225     case 0x04:
 226         s->intr = val;
 227         uhci_update_irq(s);
 228         break;
 229     case 0x06:
 230         if (s->status & UHCI_STS_HCHALTED)
 231             s->frnum = val & 0x7ff;
 232         break;
 233     case 0x10 ... 0x1f:
 234         {
 235             UHCIPort *port;
 236             USBDevice *dev;
 237             int n;
 238
 239             n = (addr >> 1) & 7;
 240             if (n >= NB_PORTS)
 241                 return;
 242             port = &s->ports[n];
 243             dev = port->port.dev;
 244             if (dev) {
 245                 /* port reset */
 246                 if ( (val & UHCI_PORT_RESET) &&
 247                      !(port->ctrl & UHCI_PORT_RESET) ) {
 248                     usb_send_msg(dev, USB_MSG_RESET);
 249                 }
 250             }
 251             port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
 252             /* some bits are reset when a '1' is written to them */
 253             port->ctrl &= ~(val & 0x000a);
 254         }
 255         break;
 256     }
 257 }
 258
 259 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
 260 {
 261     UHCIState *s = opaque;
 262     uint32_t val;
 263
 264     addr &= 0x1f;
 265     switch(addr) {
 266     case 0x00:
 267         val = s->cmd;
 268         break;
 269     case 0x02:
 270         val = s->status;
 271         break;
 272     case 0x04:
 273         val = s->intr;
 274         break;
 275     case 0x06:
 276         val = s->frnum;
 277         break;
 278     case 0x10 ... 0x1f:
 279         {
 280             UHCIPort *port;
 281             int n;
 282             n = (addr >> 1) & 7;
 283             if (n >= NB_PORTS)
 284                 goto read_default;
 285             port = &s->ports[n];
 286             val = port->ctrl;
 287         }
 288         break;
 289     default:
 290     read_default:
 291         val = 0xff7f; /* disabled port */
 292         break;
 293     }
 294 #ifdef DEBUG
 295     printf("uhci readw port=0x%04x val=0x%04x\n", addr, val);
 296 #endif
 297     return val;
 298 }
 299
 300 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 301 {
 302     UHCIState *s = opaque;
 303
 304     addr &= 0x1f;
 305 #ifdef DEBUG
 306     printf("uhci writel port=0x%04x val=0x%08x\n", addr, val);
 307 #endif
 308     switch(addr) {
 309     case 0x08:
 310         s->fl_base_addr = val & ~0xfff;
 311         break;
 312     }
 313 }
 314
 315 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
 316 {
 317     UHCIState *s = opaque;
 318     uint32_t val;
 319
 320     addr &= 0x1f;
 321     switch(addr) {
 322     case 0x08:
 323         val = s->fl_base_addr;
 324         break;
 325     default:
 326         val = 0xffffffff;
 327         break;
 328     }
 329     return val;
 330 }
 331
 332 /* signal resume if controller suspended */
 333 static void uhci_resume (void *opaque)
 334 {
 335     UHCIState *s = (UHCIState *)opaque;
 336
 337     if (!s)
 338         return;
 339
 340     if (s->cmd & UHCI_CMD_EGSM) {
 341         s->cmd |= UHCI_CMD_FGR;
 342         s->status |= UHCI_STS_RD;
 343         uhci_update_irq(s);
 344     }
 345 }
 346
 347 static void uhci_attach(USBPort *port1, USBDevice *dev)
 348 {
 349     UHCIState *s = port1->opaque;
 350     UHCIPort *port = &s->ports[port1->index];
 351
 352     if (dev) {
 353         if (port->port.dev) {
 354             usb_attach(port1, NULL);
 355         }
 356         /* set connect status */
 357         port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
 358
 359         /* update speed */
 360         if (dev->speed == USB_SPEED_LOW)
 361             port->ctrl |= UHCI_PORT_LSDA;
 362         else
 363             port->ctrl &= ~UHCI_PORT_LSDA;
 364
 365         uhci_resume(s);
 366
 367         port->port.dev = dev;
 368         /* send the attach message */
 369         usb_send_msg(dev, USB_MSG_ATTACH);
 370     } else {
 371         /* set connect status */
 372         if (port->ctrl & UHCI_PORT_CCS) {
 373             port->ctrl &= ~UHCI_PORT_CCS;
 374             port->ctrl |= UHCI_PORT_CSC;
 375         }
 376         /* disable port */
 377         if (port->ctrl & UHCI_PORT_EN) {
 378             port->ctrl &= ~UHCI_PORT_EN;
 379             port->ctrl |= UHCI_PORT_ENC;
 380         }
 381
 382         uhci_resume(s);
 383
 384         dev = port->port.dev;
 385         if (dev) {
 386             /* send the detach message */
 387             usb_send_msg(dev, USB_MSG_DETACH);
 388         }
 389         port->port.dev = NULL;
 390     }
 391 }
 392
 393 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
 394 {
 395     UHCIPort *port;
 396     USBDevice *dev;
 397     int i, ret;
 398
 399 #ifdef DEBUG_PACKET
 400     {
 401         const char *pidstr;
 402         switch(p->pid) {
 403         case USB_TOKEN_SETUP: pidstr = "SETUP"; break;
 404         case USB_TOKEN_IN: pidstr = "IN"; break;
 405         case USB_TOKEN_OUT: pidstr = "OUT"; break;
 406         default: pidstr = "?"; break;
 407         }
 408         printf("frame %d: pid=%s addr=0x%02x ep=%d len=%d\n",
 409                s->frnum, pidstr, p->devaddr, p->devep, p->len);
 410         if (p->pid != USB_TOKEN_IN) {
 411             printf("     data_out=");
 412             for(i = 0; i < p->len; i++) {
 413                 printf(" %02x", p->data[i]);
 414             }
 415             printf("\n");
 416         }
 417     }
 418 #endif
 419     for(i = 0; i < NB_PORTS; i++) {
 420         port = &s->ports[i];
 421         dev = port->port.dev;
 422         if (dev && (port->ctrl & UHCI_PORT_EN)) {
 423             ret = dev->handle_packet(dev, p);
 424             if (ret != USB_RET_NODEV) {
 425 #ifdef DEBUG_PACKET
 426                 if (ret == USB_RET_ASYNC) {
 427                     printf("usb-uhci: Async packet\n");
 428                 } else {
 429                     printf("     ret=%d ", ret);
 430                     if (p->pid == USB_TOKEN_IN && ret > 0) {
 431                         printf("data_in=");
 432                         for(i = 0; i < ret; i++) {
 433                             printf(" %02x", p->data[i]);
 434                         }
 435                     }
 436                     printf("\n");
 437                 }
 438 #endif
 439                 return ret;
 440             }
 441         }
 442     }
 443     return USB_RET_NODEV;
 444 }
 445
 446 static void uhci_async_complete_packet(USBPacket * packet, void *opaque);
 447
 448 /* return -1 if fatal error (frame must be stopped)
 449           0 if TD successful
 450           1 if TD unsuccessful or inactive
 451 */
 452 static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
 453 {
 454     uint8_t pid;
 455     int len, max_len, err, ret;
 456
 457     /* ??? This is wrong for async completion.  */
 458     if (td->ctrl & TD_CTRL_IOC) {
 459         *int_mask |= 0x01;
 460     }
 461
 462     if (!(td->ctrl & TD_CTRL_ACTIVE))
 463         return 1;
 464
 465     /* TD is active */
 466     max_len = ((td->token >> 21) + 1) & 0x7ff;
 467     pid = td->token & 0xff;
 468     if (s->async_qh) {
 469         ret = s->usb_packet.len;
 470         if (ret >= 0) {
 471             len = ret;
 472             if (len > max_len) {
 473                 len = max_len;
 474                 ret = USB_RET_BABBLE;
 475             }
 476             if (len > 0) {
 477                 /* write the data back */
 478                 cpu_physical_memory_write(td->buffer, s->usb_buf, len);
 479             }
 480         } else {
 481             len = 0;
 482         }
 483         s->async_qh = 0;
 484     } else {
 485         s->usb_packet.pid = pid;
 486         s->usb_packet.devaddr = (td->token >> 8) & 0x7f;
 487         s->usb_packet.devep = (td->token >> 15) & 0xf;
 488         s->usb_packet.data = s->usb_buf;
 489         s->usb_packet.len = max_len;
 490         s->usb_packet.complete_cb = uhci_async_complete_packet;
 491         s->usb_packet.complete_opaque = s;
 492         switch(pid) {
 493         case USB_TOKEN_OUT:
 494         case USB_TOKEN_SETUP:
 495             cpu_physical_memory_read(td->buffer, s->usb_buf, max_len);
 496             ret = uhci_broadcast_packet(s, &s->usb_packet);
 497             len = max_len;
 498             break;
 499         case USB_TOKEN_IN:
 500             ret = uhci_broadcast_packet(s, &s->usb_packet);
 501             if (ret >= 0) {
 502                 len = ret;
 503                 if (len > max_len) {
 504                     len = max_len;
 505                     ret = USB_RET_BABBLE;
 506                 }
 507                 if (len > 0) {
 508                     /* write the data back */
 509                     cpu_physical_memory_write(td->buffer, s->usb_buf, len);
 510                 }
 511             } else {
 512                 len = 0;
 513             }
 514             break;
 515         default:
 516             /* invalid pid : frame interrupted */
 517             s->status |= UHCI_STS_HCPERR;
 518             uhci_update_irq(s);
 519             return -1;
 520         }
 521     }
 522     if (ret == USB_RET_ASYNC) {
 523         return 2;
 524     }
 525     if (td->ctrl & TD_CTRL_IOS)
 526         td->ctrl &= ~TD_CTRL_ACTIVE;
 527     if (ret >= 0) {
 528         td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
 529         /* The NAK bit may have been set by a previous frame, so clear it
 530            here.  The docs are somewhat unclear, but win2k relies on this
 531            behavior.  */
 532         td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
 533         if (pid == USB_TOKEN_IN &&
 534             (td->ctrl & TD_CTRL_SPD) &&
 535             len < max_len) {
 536             *int_mask |= 0x02;
 537             /* short packet: do not update QH */
 538             return 1;
 539         } else {
 540             /* success */
 541             return 0;
 542         }
 543     } else {
 544         switch(ret) {
 545         default:
 546         case USB_RET_NODEV:
 547         do_timeout:
 548             td->ctrl |= TD_CTRL_TIMEOUT;
 549             err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
 550             if (err != 0) {
 551                 err--;
 552                 if (err == 0) {
 553                     td->ctrl &= ~TD_CTRL_ACTIVE;
 554                     s->status |= UHCI_STS_USBERR;
 555                     uhci_update_irq(s);
 556                 }
 557             }
 558             td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
 559                 (err << TD_CTRL_ERROR_SHIFT);
 560             return 1;
 561         case USB_RET_NAK:
 562             td->ctrl |= TD_CTRL_NAK;
 563             if (pid == USB_TOKEN_SETUP)
 564                 goto do_timeout;
 565             return 1;
 566         case USB_RET_STALL:
 567             td->ctrl |= TD_CTRL_STALL;
 568             td->ctrl &= ~TD_CTRL_ACTIVE;
 569             return 1;
 570         case USB_RET_BABBLE:
 571             td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
 572             td->ctrl &= ~TD_CTRL_ACTIVE;
 573             /* frame interrupted */
 574             return -1;
 575         }
 576     }
 577 }
 578
 579 static void uhci_async_complete_packet(USBPacket * packet, void *opaque)
 580 {
 581     UHCIState *s = opaque;
 582     UHCI_QH qh;
 583     UHCI_TD td;
 584     uint32_t link;
 585     uint32_t old_td_ctrl;
 586     uint32_t val;
 587     int ret;
 588
 589     link = s->async_qh;
 590     if (!link) {
 591         /* This should never happen. It means a TD somehow got removed
 592            without cancelling the associated async IO request.  */
 593         return;
 594     }
 595     cpu_physical_memory_read(link & ~0xf, (uint8_t *)&qh, sizeof(qh));
 596     le32_to_cpus(&qh.link);
 597     le32_to_cpus(&qh.el_link);
 598     /* Re-process the queue containing the async packet.  */
 599     while (1) {
 600         cpu_physical_memory_read(qh.el_link & ~0xf,
 601                                  (uint8_t *)&td, sizeof(td));
 602         le32_to_cpus(&td.link);
 603         le32_to_cpus(&td.ctrl);
 604         le32_to_cpus(&td.token);
 605         le32_to_cpus(&td.buffer);
 606         old_td_ctrl = td.ctrl;
 607         ret = uhci_handle_td(s, &td, &s->pending_int_mask);
 608         /* update the status bits of the TD */
 609         if (old_td_ctrl != td.ctrl) {
 610             val = cpu_to_le32(td.ctrl);
 611             cpu_physical_memory_write((qh.el_link & ~0xf) + 4,
 612                                       (const uint8_t *)&val,
 613                                       sizeof(val));
 614         }
 615         if (ret < 0)
 616             break; /* interrupted frame */
 617         if (ret == 2) {
 618             s->async_qh = link;
 619             break;
 620         } else if (ret == 0) {
 621             /* update qh element link */
 622             qh.el_link = td.link;
 623             val = cpu_to_le32(qh.el_link);
 624             cpu_physical_memory_write((link & ~0xf) + 4,
 625                                       (const uint8_t *)&val,
 626                                       sizeof(val));
 627             if (!(qh.el_link & 4))
 628                 break;
 629         }
 630         break;
 631     }
 632 }
 633
 634 static void uhci_frame_timer(void *opaque)
 635 {
 636     UHCIState *s = opaque;
 637     int64_t expire_time;
 638     uint32_t frame_addr, link, old_td_ctrl, val;
 639     int int_mask, cnt, ret;
 640     UHCI_TD td;
 641     UHCI_QH qh;
 642     uint32_t old_async_qh;
 643
 644     if (!(s->cmd & UHCI_CMD_RS)) {
 645         qemu_del_timer(s->frame_timer);
 646         /* set hchalted bit in status - UHCI11D 2.1.2 */
 647         s->status |= UHCI_STS_HCHALTED;
 648         return;
 649     }
 650     /* Complete the previous frame.  */
 651     s->frnum = (s->frnum + 1) & 0x7ff;
 652     if (s->pending_int_mask) {
 653         s->status2 |= s->pending_int_mask;
 654         s->status |= UHCI_STS_USBINT;
 655         uhci_update_irq(s);
 656     }
 657     old_async_qh = s->async_qh;
 658     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
 659     cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
 660     le32_to_cpus(&link);
 661     int_mask = 0;
 662     cnt = FRAME_MAX_LOOPS;
 663     while ((link & 1) == 0) {
 664         if (--cnt == 0)
 665             break;
 666         /* valid frame */
 667         if (link & 2) {
 668             /* QH */
 669             if (link == s->async_qh) {
 670                 /* We've found a previously issues packet.
 671                    Nothing else to do.  */
 672                 old_async_qh = 0;
 673                 break;
 674             }
 675             cpu_physical_memory_read(link & ~0xf, (uint8_t *)&qh, sizeof(qh));
 676             le32_to_cpus(&qh.link);
 677             le32_to_cpus(&qh.el_link);
 678         depth_first:
 679             if (qh.el_link & 1) {
 680                 /* no element : go to next entry */
 681                 link = qh.link;
 682             } else if (qh.el_link & 2) {
 683                 /* QH */
 684                 link = qh.el_link;
 685             } else if (s->async_qh) {
 686                 /* We can only cope with one pending packet.  Keep looking
 687                    for the previously issued packet.  */
 688                 link = qh.link;
 689             } else {
 690                 /* TD */
 691                 if (--cnt == 0)
 692                     break;
 693                 cpu_physical_memory_read(qh.el_link & ~0xf,
 694                                          (uint8_t *)&td, sizeof(td));
 695                 le32_to_cpus(&td.link);
 696                 le32_to_cpus(&td.ctrl);
 697                 le32_to_cpus(&td.token);
 698                 le32_to_cpus(&td.buffer);
 699                 old_td_ctrl = td.ctrl;
 700                 ret = uhci_handle_td(s, &td, &int_mask);
 701                 /* update the status bits of the TD */
 702                 if (old_td_ctrl != td.ctrl) {
 703                     val = cpu_to_le32(td.ctrl);
 704                     cpu_physical_memory_write((qh.el_link & ~0xf) + 4,
 705                                               (const uint8_t *)&val,
 706                                               sizeof(val));
 707                 }
 708                 if (ret < 0)
 709                     break; /* interrupted frame */
 710                 if (ret == 2) {
 711                     s->async_qh = link;
 712                 } else if (ret == 0) {
 713                     /* update qh element link */
 714                     qh.el_link = td.link;
 715                     val = cpu_to_le32(qh.el_link);
 716                     cpu_physical_memory_write((link & ~0xf) + 4,
 717                                               (const uint8_t *)&val,
 718                                               sizeof(val));
 719                     if (qh.el_link & 4) {
 720                         /* depth first */
 721                         goto depth_first;
 722                     }
 723                 }
 724                 /* go to next entry */
 725                 link = qh.link;
 726             }
 727         } else {
 728             /* TD */
 729             cpu_physical_memory_read(link & ~0xf, (uint8_t *)&td, sizeof(td));
 730             le32_to_cpus(&td.link);
 731             le32_to_cpus(&td.ctrl);
 732             le32_to_cpus(&td.token);
 733             le32_to_cpus(&td.buffer);
 734             /* Ignore isochonous transfers while there is an async packet
 735                pending.  This is wrong, but we don't implement isochronous
 736                transfers anyway.  */
 737             if (s->async_qh == 0) {
 738                 old_td_ctrl = td.ctrl;
 739                 ret = uhci_handle_td(s, &td, &int_mask);
 740                 /* update the status bits of the TD */
 741                 if (old_td_ctrl != td.ctrl) {
 742                     val = cpu_to_le32(td.ctrl);
 743                     cpu_physical_memory_write((link & ~0xf) + 4,
 744                                               (const uint8_t *)&val,
 745                                               sizeof(val));
 746                 }
 747                 if (ret < 0)
 748                     break; /* interrupted frame */
 749                 if (ret == 2) {
 750                     /* We can't handle async isochronous transfers.
 751                        Cancel The packet.  */
 752                     fprintf(stderr, "usb-uhci: Unimplemented async packet\n");
 753                     usb_cancel_packet(&s->usb_packet);
 754                 }
 755             }
 756             link = td.link;
 757         }
 758     }
 759     s->pending_int_mask = int_mask;
 760     if (old_async_qh) {
 761         /* A previously started transfer has disappeared from the transfer
 762            list.  There's nothing useful we can do with it now, so just
 763            discard the packet and hope it wasn't too important.  */
 764 #ifdef DEBUG
 765         printf("Discarding USB packet\n");
 766 #endif
 767         usb_cancel_packet(&s->usb_packet);
 768         s->async_qh = 0;
 769     }
 770     /* prepare the timer for the next frame */
 771     expire_time = qemu_get_clock(vm_clock) +
 772         (ticks_per_sec / FRAME_TIMER_FREQ);
 773     qemu_mod_timer(s->frame_timer, expire_time);
 774 }
 775
 776 static void uhci_map(PCIDevice *pci_dev, int region_num,
 777                     uint32_t addr, uint32_t size, int type)
 778 {
 779     UHCIState *s = (UHCIState *)pci_dev;
 780
 781     register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
 782     register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
 783     register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
 784     register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
 785     register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
 786     register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
 787 }
 788
 789 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
 790 {
 791     UHCIState *s;
 792     uint8_t *pci_conf;
 793     int i;
 794
 795     s = (UHCIState *)pci_register_device(bus,
 796                                         "USB-UHCI", sizeof(UHCIState),
 797                                         devfn, NULL, NULL);
 798     pci_conf = s->dev.config;
 799     pci_conf[0x00] = 0x86;
 800     pci_conf[0x01] = 0x80;
 801     pci_conf[0x02] = 0x20;
 802     pci_conf[0x03] = 0x70;
 803     pci_conf[0x08] = 0x01; // revision number
 804     pci_conf[0x09] = 0x00;
 805     pci_conf[0x0a] = 0x03;
 806     pci_conf[0x0b] = 0x0c;
 807     pci_conf[0x0e] = 0x00; // header_type
 808     pci_conf[0x3d] = 4; // interrupt pin 3
 809     pci_conf[0x60] = 0x10; // release number
 810
 811     for(i = 0; i < NB_PORTS; i++) {
 812         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
 813     }
 814     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
 815
 816     uhci_reset(s);
 817
 818     /* Use region 4 for consistency with real hardware.  BSD guests seem
 819        to rely on this.  */
 820     pci_register_io_region(&s->dev, 4, 0x20,
 821                            PCI_ADDRESS_SPACE_IO, uhci_map);
 822 }
 823
 824 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
 825 {
 826     UHCIState *s;
 827     uint8_t *pci_conf;
 828     int i;
 829
 830     s = (UHCIState *)pci_register_device(bus,
 831                                         "USB-UHCI", sizeof(UHCIState),
 832                                         devfn, NULL, NULL);
 833     pci_conf = s->dev.config;
 834     pci_conf[0x00] = 0x86;
 835     pci_conf[0x01] = 0x80;
 836     pci_conf[0x02] = 0x12;
 837     pci_conf[0x03] = 0x71;
 838     pci_conf[0x08] = 0x01; // revision number
 839     pci_conf[0x09] = 0x00;
 840     pci_conf[0x0a] = 0x03;
 841     pci_conf[0x0b] = 0x0c;
 842     pci_conf[0x0e] = 0x00; // header_type
 843     pci_conf[0x3d] = 4; // interrupt pin 3
 844     pci_conf[0x60] = 0x10; // release number
 845
 846     for(i = 0; i < NB_PORTS; i++) {
 847         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
 848     }
 849     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
 850
 851     uhci_reset(s);
 852
 853     /* Use region 4 for consistency with real hardware.  BSD guests seem
 854        to rely on this.  */
 855     pci_register_io_region(&s->dev, 4, 0x20,
 856                            PCI_ADDRESS_SPACE_IO, uhci_map);
 857 }
 858