]>
Commit | Line | Data |
---|---|---|
bb36d470 FB |
1 | /* |
2 | * USB UHCI controller emulation | |
5fafdf24 | 3 | * |
bb36d470 | 4 | * Copyright (c) 2005 Fabrice Bellard |
5fafdf24 | 5 | * |
54f254f9 AL |
6 | * Copyright (c) 2008 Max Krasnyansky |
7 | * Magor rewrite of the UHCI data structures parser and frame processor | |
8 | * Support for fully async operation and multiple outstanding transactions | |
9 | * | |
bb36d470 FB |
10 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
11 | * of this software and associated documentation files (the "Software"), to deal | |
12 | * in the Software without restriction, including without limitation the rights | |
13 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
14 | * copies of the Software, and to permit persons to whom the Software is | |
15 | * furnished to do so, subject to the following conditions: | |
16 | * | |
17 | * The above copyright notice and this permission notice shall be included in | |
18 | * all copies or substantial portions of the Software. | |
19 | * | |
20 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
21 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
22 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |
23 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
24 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
25 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | |
26 | * THE SOFTWARE. | |
27 | */ | |
87ecb68b PB |
28 | #include "hw.h" |
29 | #include "usb.h" | |
30 | #include "pci.h" | |
31 | #include "qemu-timer.h" | |
bb36d470 FB |
32 | |
33 | //#define DEBUG | |
54f254f9 | 34 | //#define DEBUG_DUMP_DATA |
bb36d470 | 35 | |
96217e31 TS |
36 | #define UHCI_CMD_FGR (1 << 4) |
37 | #define UHCI_CMD_EGSM (1 << 3) | |
bb36d470 FB |
38 | #define UHCI_CMD_GRESET (1 << 2) |
39 | #define UHCI_CMD_HCRESET (1 << 1) | |
40 | #define UHCI_CMD_RS (1 << 0) | |
41 | ||
42 | #define UHCI_STS_HCHALTED (1 << 5) | |
43 | #define UHCI_STS_HCPERR (1 << 4) | |
44 | #define UHCI_STS_HSERR (1 << 3) | |
45 | #define UHCI_STS_RD (1 << 2) | |
46 | #define UHCI_STS_USBERR (1 << 1) | |
47 | #define UHCI_STS_USBINT (1 << 0) | |
48 | ||
49 | #define TD_CTRL_SPD (1 << 29) | |
50 | #define TD_CTRL_ERROR_SHIFT 27 | |
51 | #define TD_CTRL_IOS (1 << 25) | |
52 | #define TD_CTRL_IOC (1 << 24) | |
53 | #define TD_CTRL_ACTIVE (1 << 23) | |
54 | #define TD_CTRL_STALL (1 << 22) | |
55 | #define TD_CTRL_BABBLE (1 << 20) | |
56 | #define TD_CTRL_NAK (1 << 19) | |
57 | #define TD_CTRL_TIMEOUT (1 << 18) | |
58 | ||
59 | #define UHCI_PORT_RESET (1 << 9) | |
60 | #define UHCI_PORT_LSDA (1 << 8) | |
61 | #define UHCI_PORT_ENC (1 << 3) | |
62 | #define UHCI_PORT_EN (1 << 2) | |
63 | #define UHCI_PORT_CSC (1 << 1) | |
64 | #define UHCI_PORT_CCS (1 << 0) | |
65 | ||
66 | #define FRAME_TIMER_FREQ 1000 | |
67 | ||
68 | #define FRAME_MAX_LOOPS 100 | |
69 | ||
70 | #define NB_PORTS 2 | |
71 | ||
54f254f9 AL |
72 | #ifdef DEBUG |
73 | #define dprintf printf | |
74 | ||
75 | const char *pid2str(int pid) | |
76 | { | |
77 | switch (pid) { | |
78 | case USB_TOKEN_SETUP: return "SETUP"; | |
79 | case USB_TOKEN_IN: return "IN"; | |
80 | case USB_TOKEN_OUT: return "OUT"; | |
81 | } | |
82 | return "?"; | |
83 | } | |
84 | ||
85 | #else | |
86 | #define dprintf(...) | |
87 | #endif | |
88 | ||
89 | #ifdef DEBUG_DUMP_DATA | |
90 | static void dump_data(const uint8_t *data, int len) | |
91 | { | |
92 | int i; | |
93 | ||
94 | printf("uhci: data: "); | |
95 | for(i = 0; i < len; i++) | |
96 | printf(" %02x", data[i]); | |
97 | printf("\n"); | |
98 | } | |
99 | #else | |
100 | static void dump_data(const uint8_t *data, int len) {} | |
101 | #endif | |
102 | ||
103 | /* | |
104 | * Pending async transaction. | |
105 | * 'packet' must be the first field because completion | |
106 | * handler does "(UHCIAsync *) pkt" cast. | |
107 | */ | |
108 | typedef struct UHCIAsync { | |
109 | USBPacket packet; | |
110 | struct UHCIAsync *next; | |
111 | uint32_t td; | |
112 | uint32_t token; | |
113 | int8_t valid; | |
114 | uint8_t done; | |
115 | uint8_t buffer[2048]; | |
116 | } UHCIAsync; | |
117 | ||
bb36d470 FB |
118 | typedef struct UHCIPort { |
119 | USBPort port; | |
120 | uint16_t ctrl; | |
bb36d470 FB |
121 | } UHCIPort; |
122 | ||
123 | typedef struct UHCIState { | |
124 | PCIDevice dev; | |
125 | uint16_t cmd; /* cmd register */ | |
126 | uint16_t status; | |
127 | uint16_t intr; /* interrupt enable register */ | |
128 | uint16_t frnum; /* frame number */ | |
129 | uint32_t fl_base_addr; /* frame list base address */ | |
130 | uint8_t sof_timing; | |
131 | uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */ | |
132 | QEMUTimer *frame_timer; | |
133 | UHCIPort ports[NB_PORTS]; | |
4d611c9a PB |
134 | |
135 | /* Interrupts that should be raised at the end of the current frame. */ | |
136 | uint32_t pending_int_mask; | |
54f254f9 AL |
137 | |
138 | /* Active packets */ | |
139 | UHCIAsync *async_pending; | |
140 | UHCIAsync *async_pool; | |
bb36d470 FB |
141 | } UHCIState; |
142 | ||
143 | typedef struct UHCI_TD { | |
144 | uint32_t link; | |
145 | uint32_t ctrl; /* see TD_CTRL_xxx */ | |
146 | uint32_t token; | |
147 | uint32_t buffer; | |
148 | } UHCI_TD; | |
149 | ||
150 | typedef struct UHCI_QH { | |
151 | uint32_t link; | |
152 | uint32_t el_link; | |
153 | } UHCI_QH; | |
154 | ||
54f254f9 AL |
155 | static UHCIAsync *uhci_async_alloc(UHCIState *s) |
156 | { | |
157 | UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync)); | |
158 | if (async) { | |
159 | memset(&async->packet, 0, sizeof(async->packet)); | |
160 | async->valid = 0; | |
161 | async->td = 0; | |
162 | async->token = 0; | |
163 | async->done = 0; | |
164 | async->next = NULL; | |
165 | } | |
166 | ||
167 | return async; | |
168 | } | |
169 | ||
170 | static void uhci_async_free(UHCIState *s, UHCIAsync *async) | |
171 | { | |
172 | qemu_free(async); | |
173 | } | |
174 | ||
175 | static void uhci_async_link(UHCIState *s, UHCIAsync *async) | |
176 | { | |
177 | async->next = s->async_pending; | |
178 | s->async_pending = async; | |
179 | } | |
180 | ||
181 | static void uhci_async_unlink(UHCIState *s, UHCIAsync *async) | |
182 | { | |
183 | UHCIAsync *curr = s->async_pending; | |
184 | UHCIAsync **prev = &s->async_pending; | |
185 | ||
186 | while (curr) { | |
187 | if (curr == async) { | |
188 | *prev = curr->next; | |
189 | return; | |
190 | } | |
191 | ||
192 | prev = &curr->next; | |
193 | curr = curr->next; | |
194 | } | |
195 | } | |
196 | ||
197 | static void uhci_async_cancel(UHCIState *s, UHCIAsync *async) | |
198 | { | |
199 | dprintf("uhci: cancel td 0x%x token 0x%x done %u\n", | |
200 | async->td, async->token, async->done); | |
201 | ||
202 | if (!async->done) | |
203 | usb_cancel_packet(&async->packet); | |
204 | uhci_async_free(s, async); | |
205 | } | |
206 | ||
207 | /* | |
208 | * Mark all outstanding async packets as invalid. | |
209 | * This is used for canceling them when TDs are removed by the HCD. | |
210 | */ | |
211 | static UHCIAsync *uhci_async_validate_begin(UHCIState *s) | |
212 | { | |
213 | UHCIAsync *async = s->async_pending; | |
214 | ||
215 | while (async) { | |
216 | async->valid--; | |
217 | async = async->next; | |
218 | } | |
219 | return NULL; | |
220 | } | |
221 | ||
222 | /* | |
223 | * Cancel async packets that are no longer valid | |
224 | */ | |
225 | static void uhci_async_validate_end(UHCIState *s) | |
226 | { | |
227 | UHCIAsync *curr = s->async_pending; | |
228 | UHCIAsync **prev = &s->async_pending; | |
229 | UHCIAsync *next; | |
230 | ||
231 | while (curr) { | |
232 | if (curr->valid > 0) { | |
233 | prev = &curr->next; | |
234 | curr = curr->next; | |
235 | continue; | |
236 | } | |
237 | ||
238 | next = curr->next; | |
239 | ||
240 | /* Unlink */ | |
241 | *prev = next; | |
242 | ||
243 | uhci_async_cancel(s, curr); | |
244 | ||
245 | curr = next; | |
246 | } | |
247 | } | |
248 | ||
249 | static void uhci_async_cancel_all(UHCIState *s) | |
250 | { | |
251 | UHCIAsync *curr = s->async_pending; | |
252 | UHCIAsync *next; | |
253 | ||
254 | while (curr) { | |
255 | next = curr->next; | |
256 | ||
257 | uhci_async_cancel(s, curr); | |
258 | ||
259 | curr = next; | |
260 | } | |
261 | ||
262 | s->async_pending = NULL; | |
263 | } | |
264 | ||
265 | static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token) | |
266 | { | |
267 | UHCIAsync *async = s->async_pending; | |
268 | ||
269 | while (async) { | |
270 | if (async->td == addr) { | |
271 | if (async->token == token) | |
272 | return async; | |
273 | ||
274 | /* | |
275 | * TD was reused for a different transfer. | |
276 | * Invalidate the original one asap. | |
277 | */ | |
278 | if (async->valid > 0) { | |
279 | async->valid = 0; | |
280 | dprintf("husb: bad reuse. td 0x%x\n", async->td); | |
281 | } | |
282 | } | |
283 | ||
284 | async = async->next; | |
285 | } | |
286 | return NULL; | |
287 | } | |
288 | ||
bb36d470 FB |
289 | static void uhci_attach(USBPort *port1, USBDevice *dev); |
290 | ||
291 | static void uhci_update_irq(UHCIState *s) | |
292 | { | |
293 | int level; | |
294 | if (((s->status2 & 1) && (s->intr & (1 << 2))) || | |
295 | ((s->status2 & 2) && (s->intr & (1 << 3))) || | |
296 | ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) || | |
297 | ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) || | |
298 | (s->status & UHCI_STS_HSERR) || | |
299 | (s->status & UHCI_STS_HCPERR)) { | |
300 | level = 1; | |
301 | } else { | |
302 | level = 0; | |
303 | } | |
d537cf6c | 304 | qemu_set_irq(s->dev.irq[3], level); |
bb36d470 FB |
305 | } |
306 | ||
307 | static void uhci_reset(UHCIState *s) | |
308 | { | |
309 | uint8_t *pci_conf; | |
310 | int i; | |
311 | UHCIPort *port; | |
312 | ||
313 | pci_conf = s->dev.config; | |
314 | ||
315 | pci_conf[0x6a] = 0x01; /* usb clock */ | |
316 | pci_conf[0x6b] = 0x00; | |
317 | s->cmd = 0; | |
318 | s->status = 0; | |
319 | s->status2 = 0; | |
320 | s->intr = 0; | |
321 | s->fl_base_addr = 0; | |
322 | s->sof_timing = 64; | |
54f254f9 | 323 | |
bb36d470 FB |
324 | for(i = 0; i < NB_PORTS; i++) { |
325 | port = &s->ports[i]; | |
326 | port->ctrl = 0x0080; | |
a594cfbf FB |
327 | if (port->port.dev) |
328 | uhci_attach(&port->port, port->port.dev); | |
bb36d470 | 329 | } |
54f254f9 AL |
330 | |
331 | uhci_async_cancel_all(s); | |
bb36d470 FB |
332 | } |
333 | ||
54f254f9 | 334 | #if 1 |
b9dc033c AZ |
335 | static void uhci_save(QEMUFile *f, void *opaque) |
336 | { | |
337 | UHCIState *s = opaque; | |
338 | uint8_t num_ports = NB_PORTS; | |
339 | int i; | |
340 | ||
341 | pci_device_save(&s->dev, f); | |
342 | ||
343 | qemu_put_8s(f, &num_ports); | |
344 | for (i = 0; i < num_ports; ++i) | |
345 | qemu_put_be16s(f, &s->ports[i].ctrl); | |
346 | qemu_put_be16s(f, &s->cmd); | |
347 | qemu_put_be16s(f, &s->status); | |
348 | qemu_put_be16s(f, &s->intr); | |
349 | qemu_put_be16s(f, &s->frnum); | |
350 | qemu_put_be32s(f, &s->fl_base_addr); | |
351 | qemu_put_8s(f, &s->sof_timing); | |
352 | qemu_put_8s(f, &s->status2); | |
353 | qemu_put_timer(f, s->frame_timer); | |
354 | } | |
355 | ||
356 | static int uhci_load(QEMUFile *f, void *opaque, int version_id) | |
357 | { | |
358 | UHCIState *s = opaque; | |
359 | uint8_t num_ports; | |
360 | int i, ret; | |
361 | ||
362 | if (version_id > 1) | |
363 | return -EINVAL; | |
364 | ||
365 | ret = pci_device_load(&s->dev, f); | |
366 | if (ret < 0) | |
367 | return ret; | |
368 | ||
369 | qemu_get_8s(f, &num_ports); | |
370 | if (num_ports != NB_PORTS) | |
371 | return -EINVAL; | |
372 | ||
373 | for (i = 0; i < num_ports; ++i) | |
374 | qemu_get_be16s(f, &s->ports[i].ctrl); | |
375 | qemu_get_be16s(f, &s->cmd); | |
376 | qemu_get_be16s(f, &s->status); | |
377 | qemu_get_be16s(f, &s->intr); | |
378 | qemu_get_be16s(f, &s->frnum); | |
379 | qemu_get_be32s(f, &s->fl_base_addr); | |
380 | qemu_get_8s(f, &s->sof_timing); | |
381 | qemu_get_8s(f, &s->status2); | |
382 | qemu_get_timer(f, s->frame_timer); | |
383 | ||
384 | return 0; | |
385 | } | |
1e414679 | 386 | #endif |
b9dc033c | 387 | |
bb36d470 FB |
388 | static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val) |
389 | { | |
390 | UHCIState *s = opaque; | |
3b46e624 | 391 | |
bb36d470 FB |
392 | addr &= 0x1f; |
393 | switch(addr) { | |
394 | case 0x0c: | |
395 | s->sof_timing = val; | |
396 | break; | |
397 | } | |
398 | } | |
399 | ||
400 | static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr) | |
401 | { | |
402 | UHCIState *s = opaque; | |
403 | uint32_t val; | |
404 | ||
405 | addr &= 0x1f; | |
406 | switch(addr) { | |
407 | case 0x0c: | |
408 | val = s->sof_timing; | |
d80cfb3f | 409 | break; |
bb36d470 FB |
410 | default: |
411 | val = 0xff; | |
412 | break; | |
413 | } | |
414 | return val; | |
415 | } | |
416 | ||
417 | static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val) | |
418 | { | |
419 | UHCIState *s = opaque; | |
3b46e624 | 420 | |
bb36d470 | 421 | addr &= 0x1f; |
54f254f9 AL |
422 | dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val); |
423 | ||
bb36d470 FB |
424 | switch(addr) { |
425 | case 0x00: | |
426 | if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) { | |
427 | /* start frame processing */ | |
428 | qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock)); | |
52328140 | 429 | s->status &= ~UHCI_STS_HCHALTED; |
467d409f | 430 | } else if (!(val & UHCI_CMD_RS)) { |
52328140 | 431 | s->status |= UHCI_STS_HCHALTED; |
bb36d470 FB |
432 | } |
433 | if (val & UHCI_CMD_GRESET) { | |
434 | UHCIPort *port; | |
435 | USBDevice *dev; | |
436 | int i; | |
437 | ||
438 | /* send reset on the USB bus */ | |
439 | for(i = 0; i < NB_PORTS; i++) { | |
440 | port = &s->ports[i]; | |
a594cfbf | 441 | dev = port->port.dev; |
bb36d470 | 442 | if (dev) { |
4d611c9a | 443 | usb_send_msg(dev, USB_MSG_RESET); |
bb36d470 FB |
444 | } |
445 | } | |
446 | uhci_reset(s); | |
447 | return; | |
448 | } | |
5e9ab4c4 | 449 | if (val & UHCI_CMD_HCRESET) { |
bb36d470 FB |
450 | uhci_reset(s); |
451 | return; | |
452 | } | |
453 | s->cmd = val; | |
454 | break; | |
455 | case 0x02: | |
456 | s->status &= ~val; | |
457 | /* XXX: the chip spec is not coherent, so we add a hidden | |
458 | register to distinguish between IOC and SPD */ | |
459 | if (val & UHCI_STS_USBINT) | |
460 | s->status2 = 0; | |
461 | uhci_update_irq(s); | |
462 | break; | |
463 | case 0x04: | |
464 | s->intr = val; | |
465 | uhci_update_irq(s); | |
466 | break; | |
467 | case 0x06: | |
468 | if (s->status & UHCI_STS_HCHALTED) | |
469 | s->frnum = val & 0x7ff; | |
470 | break; | |
471 | case 0x10 ... 0x1f: | |
472 | { | |
473 | UHCIPort *port; | |
474 | USBDevice *dev; | |
475 | int n; | |
476 | ||
477 | n = (addr >> 1) & 7; | |
478 | if (n >= NB_PORTS) | |
479 | return; | |
480 | port = &s->ports[n]; | |
a594cfbf | 481 | dev = port->port.dev; |
bb36d470 FB |
482 | if (dev) { |
483 | /* port reset */ | |
5fafdf24 | 484 | if ( (val & UHCI_PORT_RESET) && |
bb36d470 | 485 | !(port->ctrl & UHCI_PORT_RESET) ) { |
4d611c9a | 486 | usb_send_msg(dev, USB_MSG_RESET); |
bb36d470 FB |
487 | } |
488 | } | |
489 | port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb); | |
490 | /* some bits are reset when a '1' is written to them */ | |
491 | port->ctrl &= ~(val & 0x000a); | |
492 | } | |
493 | break; | |
494 | } | |
495 | } | |
496 | ||
497 | static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr) | |
498 | { | |
499 | UHCIState *s = opaque; | |
500 | uint32_t val; | |
501 | ||
502 | addr &= 0x1f; | |
503 | switch(addr) { | |
504 | case 0x00: | |
505 | val = s->cmd; | |
506 | break; | |
507 | case 0x02: | |
508 | val = s->status; | |
509 | break; | |
510 | case 0x04: | |
511 | val = s->intr; | |
512 | break; | |
513 | case 0x06: | |
514 | val = s->frnum; | |
515 | break; | |
516 | case 0x10 ... 0x1f: | |
517 | { | |
518 | UHCIPort *port; | |
519 | int n; | |
520 | n = (addr >> 1) & 7; | |
5fafdf24 | 521 | if (n >= NB_PORTS) |
bb36d470 FB |
522 | goto read_default; |
523 | port = &s->ports[n]; | |
524 | val = port->ctrl; | |
525 | } | |
526 | break; | |
527 | default: | |
528 | read_default: | |
529 | val = 0xff7f; /* disabled port */ | |
530 | break; | |
531 | } | |
54f254f9 AL |
532 | |
533 | dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val); | |
534 | ||
bb36d470 FB |
535 | return val; |
536 | } | |
537 | ||
538 | static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val) | |
539 | { | |
540 | UHCIState *s = opaque; | |
541 | ||
542 | addr &= 0x1f; | |
54f254f9 AL |
543 | dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val); |
544 | ||
bb36d470 FB |
545 | switch(addr) { |
546 | case 0x08: | |
547 | s->fl_base_addr = val & ~0xfff; | |
548 | break; | |
549 | } | |
550 | } | |
551 | ||
552 | static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr) | |
553 | { | |
554 | UHCIState *s = opaque; | |
555 | uint32_t val; | |
556 | ||
557 | addr &= 0x1f; | |
558 | switch(addr) { | |
559 | case 0x08: | |
560 | val = s->fl_base_addr; | |
561 | break; | |
562 | default: | |
563 | val = 0xffffffff; | |
564 | break; | |
565 | } | |
566 | return val; | |
567 | } | |
568 | ||
96217e31 TS |
569 | /* signal resume if controller suspended */ |
570 | static void uhci_resume (void *opaque) | |
571 | { | |
572 | UHCIState *s = (UHCIState *)opaque; | |
573 | ||
574 | if (!s) | |
575 | return; | |
576 | ||
577 | if (s->cmd & UHCI_CMD_EGSM) { | |
578 | s->cmd |= UHCI_CMD_FGR; | |
579 | s->status |= UHCI_STS_RD; | |
580 | uhci_update_irq(s); | |
581 | } | |
582 | } | |
583 | ||
bb36d470 FB |
584 | static void uhci_attach(USBPort *port1, USBDevice *dev) |
585 | { | |
586 | UHCIState *s = port1->opaque; | |
587 | UHCIPort *port = &s->ports[port1->index]; | |
588 | ||
589 | if (dev) { | |
a594cfbf | 590 | if (port->port.dev) { |
bb36d470 FB |
591 | usb_attach(port1, NULL); |
592 | } | |
593 | /* set connect status */ | |
61064870 PB |
594 | port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC; |
595 | ||
bb36d470 FB |
596 | /* update speed */ |
597 | if (dev->speed == USB_SPEED_LOW) | |
598 | port->ctrl |= UHCI_PORT_LSDA; | |
599 | else | |
600 | port->ctrl &= ~UHCI_PORT_LSDA; | |
96217e31 TS |
601 | |
602 | uhci_resume(s); | |
603 | ||
a594cfbf | 604 | port->port.dev = dev; |
bb36d470 | 605 | /* send the attach message */ |
4d611c9a | 606 | usb_send_msg(dev, USB_MSG_ATTACH); |
bb36d470 FB |
607 | } else { |
608 | /* set connect status */ | |
61064870 PB |
609 | if (port->ctrl & UHCI_PORT_CCS) { |
610 | port->ctrl &= ~UHCI_PORT_CCS; | |
611 | port->ctrl |= UHCI_PORT_CSC; | |
bb36d470 FB |
612 | } |
613 | /* disable port */ | |
614 | if (port->ctrl & UHCI_PORT_EN) { | |
615 | port->ctrl &= ~UHCI_PORT_EN; | |
616 | port->ctrl |= UHCI_PORT_ENC; | |
617 | } | |
96217e31 TS |
618 | |
619 | uhci_resume(s); | |
620 | ||
a594cfbf | 621 | dev = port->port.dev; |
bb36d470 FB |
622 | if (dev) { |
623 | /* send the detach message */ | |
4d611c9a | 624 | usb_send_msg(dev, USB_MSG_DETACH); |
bb36d470 | 625 | } |
a594cfbf | 626 | port->port.dev = NULL; |
bb36d470 FB |
627 | } |
628 | } | |
629 | ||
4d611c9a | 630 | static int uhci_broadcast_packet(UHCIState *s, USBPacket *p) |
bb36d470 | 631 | { |
bb36d470 FB |
632 | int i, ret; |
633 | ||
54f254f9 AL |
634 | dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n", |
635 | pid2str(p->pid), p->devaddr, p->devep, p->len); | |
636 | if (p->pid == USB_TOKEN_OUT) | |
637 | dump_data(p->data, p->len); | |
638 | ||
639 | ret = USB_RET_NODEV; | |
640 | for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) { | |
641 | UHCIPort *port = &s->ports[i]; | |
642 | USBDevice *dev = port->port.dev; | |
643 | ||
644 | if (dev && (port->ctrl & UHCI_PORT_EN)) | |
4d611c9a | 645 | ret = dev->handle_packet(dev, p); |
bb36d470 | 646 | } |
54f254f9 AL |
647 | |
648 | dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len); | |
649 | if (p->pid == USB_TOKEN_IN && ret > 0) | |
650 | dump_data(p->data, ret); | |
651 | ||
652 | return ret; | |
bb36d470 FB |
653 | } |
654 | ||
54f254f9 AL |
655 | static void uhci_async_complete(USBPacket * packet, void *opaque); |
656 | static void uhci_process_frame(UHCIState *s); | |
4d611c9a | 657 | |
bb36d470 FB |
658 | /* return -1 if fatal error (frame must be stopped) |
659 | 0 if TD successful | |
660 | 1 if TD unsuccessful or inactive | |
661 | */ | |
54f254f9 | 662 | static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask) |
bb36d470 | 663 | { |
54f254f9 | 664 | int len = 0, max_len, err, ret; |
bb36d470 | 665 | uint8_t pid; |
bb36d470 | 666 | |
54f254f9 AL |
667 | max_len = ((td->token >> 21) + 1) & 0x7ff; |
668 | pid = td->token & 0xff; | |
669 | ||
670 | ret = async->packet.len; | |
671 | ||
672 | if (td->ctrl & TD_CTRL_IOC) | |
bb36d470 | 673 | *int_mask |= 0x01; |
3b46e624 | 674 | |
54f254f9 AL |
675 | if (td->ctrl & TD_CTRL_IOS) |
676 | td->ctrl &= ~TD_CTRL_ACTIVE; | |
bb36d470 | 677 | |
54f254f9 AL |
678 | if (ret < 0) |
679 | goto out; | |
b9dc033c | 680 | |
54f254f9 AL |
681 | len = async->packet.len; |
682 | td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff); | |
683 | ||
684 | /* The NAK bit may have been set by a previous frame, so clear it | |
685 | here. The docs are somewhat unclear, but win2k relies on this | |
686 | behavior. */ | |
687 | td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK); | |
688 | ||
689 | if (pid == USB_TOKEN_IN) { | |
690 | if (len > max_len) { | |
4d611c9a | 691 | len = max_len; |
54f254f9 AL |
692 | ret = USB_RET_BABBLE; |
693 | goto out; | |
4d611c9a | 694 | } |
b9dc033c | 695 | |
54f254f9 AL |
696 | if (len > 0) { |
697 | /* write the data back */ | |
698 | cpu_physical_memory_write(td->buffer, async->buffer, len); | |
699 | } | |
700 | ||
701 | if ((td->ctrl & TD_CTRL_SPD) && len < max_len) { | |
bb36d470 FB |
702 | *int_mask |= 0x02; |
703 | /* short packet: do not update QH */ | |
54f254f9 | 704 | dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token); |
bb36d470 | 705 | return 1; |
bb36d470 | 706 | } |
54f254f9 AL |
707 | } |
708 | ||
709 | /* success */ | |
710 | return 0; | |
711 | ||
712 | out: | |
713 | switch(ret) { | |
714 | case USB_RET_STALL: | |
715 | td->ctrl |= TD_CTRL_STALL; | |
716 | td->ctrl &= ~TD_CTRL_ACTIVE; | |
717 | return 1; | |
718 | ||
719 | case USB_RET_BABBLE: | |
720 | td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL; | |
721 | td->ctrl &= ~TD_CTRL_ACTIVE; | |
722 | /* frame interrupted */ | |
723 | return -1; | |
724 | ||
725 | case USB_RET_NAK: | |
726 | td->ctrl |= TD_CTRL_NAK; | |
727 | if (pid == USB_TOKEN_SETUP) | |
728 | break; | |
729 | return 1; | |
730 | ||
731 | case USB_RET_NODEV: | |
732 | default: | |
733 | break; | |
734 | } | |
735 | ||
736 | /* Retry the TD if error count is not zero */ | |
737 | ||
738 | td->ctrl |= TD_CTRL_TIMEOUT; | |
739 | err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3; | |
740 | if (err != 0) { | |
741 | err--; | |
742 | if (err == 0) { | |
bb36d470 | 743 | td->ctrl &= ~TD_CTRL_ACTIVE; |
54f254f9 AL |
744 | s->status |= UHCI_STS_USBERR; |
745 | uhci_update_irq(s); | |
bb36d470 FB |
746 | } |
747 | } | |
54f254f9 AL |
748 | td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) | |
749 | (err << TD_CTRL_ERROR_SHIFT); | |
750 | return 1; | |
bb36d470 FB |
751 | } |
752 | ||
54f254f9 AL |
753 | static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask) |
754 | { | |
755 | UHCIAsync *async; | |
756 | int len = 0, max_len, ret = 0; | |
757 | uint8_t pid; | |
758 | ||
759 | /* Is active ? */ | |
760 | if (!(td->ctrl & TD_CTRL_ACTIVE)) | |
761 | return 1; | |
762 | ||
763 | async = uhci_async_find_td(s, addr, td->token); | |
764 | if (async) { | |
765 | /* Already submitted */ | |
766 | async->valid = 10; | |
767 | ||
768 | if (!async->done) | |
769 | return 1; | |
770 | ||
771 | uhci_async_unlink(s, async); | |
772 | goto done; | |
773 | } | |
774 | ||
775 | /* Allocate new packet */ | |
776 | async = uhci_async_alloc(s); | |
777 | if (!async) | |
778 | return 1; | |
779 | ||
780 | async->valid = 10; | |
781 | async->td = addr; | |
782 | async->token = td->token; | |
783 | ||
784 | max_len = ((td->token >> 21) + 1) & 0x7ff; | |
785 | pid = td->token & 0xff; | |
786 | ||
787 | async->packet.pid = pid; | |
788 | async->packet.devaddr = (td->token >> 8) & 0x7f; | |
789 | async->packet.devep = (td->token >> 15) & 0xf; | |
790 | async->packet.data = async->buffer; | |
791 | async->packet.len = max_len; | |
792 | async->packet.complete_cb = uhci_async_complete; | |
793 | async->packet.complete_opaque = s; | |
794 | ||
795 | switch(pid) { | |
796 | case USB_TOKEN_OUT: | |
797 | case USB_TOKEN_SETUP: | |
798 | cpu_physical_memory_read(td->buffer, async->buffer, max_len); | |
799 | ret = uhci_broadcast_packet(s, &async->packet); | |
800 | len = max_len; | |
801 | break; | |
802 | ||
803 | case USB_TOKEN_IN: | |
804 | ret = uhci_broadcast_packet(s, &async->packet); | |
805 | break; | |
806 | ||
807 | default: | |
808 | /* invalid pid : frame interrupted */ | |
809 | uhci_async_free(s, async); | |
810 | s->status |= UHCI_STS_HCPERR; | |
811 | uhci_update_irq(s); | |
812 | return -1; | |
813 | } | |
814 | ||
815 | if (ret == USB_RET_ASYNC) { | |
816 | uhci_async_link(s, async); | |
817 | return 2; | |
818 | } | |
819 | ||
820 | async->packet.len = ret; | |
821 | ||
822 | done: | |
823 | ret = uhci_complete_td(s, td, async, int_mask); | |
824 | uhci_async_free(s, async); | |
825 | return ret; | |
826 | } | |
827 | ||
828 | static void uhci_async_complete(USBPacket *packet, void *opaque) | |
4d611c9a PB |
829 | { |
830 | UHCIState *s = opaque; | |
54f254f9 AL |
831 | UHCIAsync *async = (UHCIAsync *) packet; |
832 | ||
833 | dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token); | |
834 | ||
835 | async->done = 1; | |
836 | ||
837 | uhci_process_frame(s); | |
838 | } | |
839 | ||
840 | static int is_valid(uint32_t link) | |
841 | { | |
842 | return (link & 1) == 0; | |
843 | } | |
844 | ||
845 | static int is_qh(uint32_t link) | |
846 | { | |
847 | return (link & 2) != 0; | |
848 | } | |
849 | ||
850 | static int depth_first(uint32_t link) | |
851 | { | |
852 | return (link & 4) != 0; | |
853 | } | |
854 | ||
855 | /* QH DB used for detecting QH loops */ | |
856 | #define UHCI_MAX_QUEUES 128 | |
857 | typedef struct { | |
858 | uint32_t addr[UHCI_MAX_QUEUES]; | |
859 | int count; | |
860 | } QhDb; | |
861 | ||
862 | static void qhdb_reset(QhDb *db) | |
863 | { | |
864 | db->count = 0; | |
865 | } | |
866 | ||
867 | /* Add QH to DB. Returns 1 if already present or DB is full. */ | |
868 | static int qhdb_insert(QhDb *db, uint32_t addr) | |
869 | { | |
870 | int i; | |
871 | for (i = 0; i < db->count; i++) | |
872 | if (db->addr[i] == addr) | |
873 | return 1; | |
874 | ||
875 | if (db->count >= UHCI_MAX_QUEUES) | |
876 | return 1; | |
877 | ||
878 | db->addr[db->count++] = addr; | |
879 | return 0; | |
880 | } | |
881 | ||
882 | static void uhci_process_frame(UHCIState *s) | |
883 | { | |
884 | uint32_t frame_addr, link, old_td_ctrl, val, int_mask; | |
885 | uint32_t curr_qh; | |
886 | int cnt, ret; | |
4d611c9a | 887 | UHCI_TD td; |
54f254f9 AL |
888 | UHCI_QH qh; |
889 | QhDb qhdb; | |
4d611c9a | 890 | |
54f254f9 AL |
891 | frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2); |
892 | ||
893 | dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr); | |
894 | ||
895 | cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4); | |
896 | le32_to_cpus(&link); | |
b9dc033c | 897 | |
54f254f9 AL |
898 | int_mask = 0; |
899 | curr_qh = 0; | |
900 | ||
901 | qhdb_reset(&qhdb); | |
902 | ||
903 | for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) { | |
904 | if (is_qh(link)) { | |
905 | /* QH */ | |
906 | ||
907 | if (qhdb_insert(&qhdb, link)) { | |
908 | /* | |
909 | * We're going in circles. Which is not a bug because | |
910 | * HCD is allowed to do that as part of the BW management. | |
911 | * In our case though it makes no sense to spin here. Sync transations | |
912 | * are already done, and async completion handler will re-process | |
913 | * the frame when something is ready. | |
914 | */ | |
915 | dprintf("uhci: detected loop. qh 0x%x\n", link); | |
916 | break; | |
917 | } | |
918 | ||
919 | cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh)); | |
920 | le32_to_cpus(&qh.link); | |
921 | le32_to_cpus(&qh.el_link); | |
922 | ||
923 | dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n", | |
924 | link, qh.link, qh.el_link); | |
925 | ||
926 | if (!is_valid(qh.el_link)) { | |
927 | /* QH w/o elements */ | |
928 | curr_qh = 0; | |
929 | link = qh.link; | |
930 | } else { | |
931 | /* QH with elements */ | |
932 | curr_qh = link; | |
933 | link = qh.el_link; | |
934 | } | |
935 | continue; | |
936 | } | |
937 | ||
938 | /* TD */ | |
939 | cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td)); | |
b9dc033c AZ |
940 | le32_to_cpus(&td.link); |
941 | le32_to_cpus(&td.ctrl); | |
942 | le32_to_cpus(&td.token); | |
943 | le32_to_cpus(&td.buffer); | |
b9dc033c | 944 | |
54f254f9 AL |
945 | dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", |
946 | link, td.link, td.ctrl, td.token, curr_qh); | |
947 | ||
948 | old_td_ctrl = td.ctrl; | |
949 | ret = uhci_handle_td(s, link, &td, &int_mask); | |
b9dc033c | 950 | if (old_td_ctrl != td.ctrl) { |
54f254f9 | 951 | /* update the status bits of the TD */ |
b9dc033c AZ |
952 | val = cpu_to_le32(td.ctrl); |
953 | cpu_physical_memory_write((link & ~0xf) + 4, | |
54f254f9 | 954 | (const uint8_t *)&val, sizeof(val)); |
b9dc033c | 955 | } |
54f254f9 AL |
956 | |
957 | if (ret < 0) { | |
958 | /* interrupted frame */ | |
959 | break; | |
b9dc033c | 960 | } |
b9dc033c | 961 | |
54f254f9 AL |
962 | if (ret == 2 || ret == 1) { |
963 | dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", | |
964 | link, ret == 2 ? "pend" : "skip", | |
965 | td.link, td.ctrl, td.token, curr_qh); | |
b9dc033c | 966 | |
54f254f9 AL |
967 | link = curr_qh ? qh.link : td.link; |
968 | continue; | |
4d611c9a | 969 | } |
54f254f9 AL |
970 | |
971 | /* completed TD */ | |
972 | ||
973 | dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", | |
974 | link, td.link, td.ctrl, td.token, curr_qh); | |
975 | ||
976 | link = td.link; | |
977 | ||
978 | if (curr_qh) { | |
979 | /* update QH element link */ | |
980 | qh.el_link = link; | |
4d611c9a | 981 | val = cpu_to_le32(qh.el_link); |
54f254f9 AL |
982 | cpu_physical_memory_write((curr_qh & ~0xf) + 4, |
983 | (const uint8_t *)&val, sizeof(val)); | |
984 | ||
985 | if (!depth_first(link)) { | |
986 | /* done with this QH */ | |
987 | ||
988 | dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n", | |
989 | curr_qh, qh.link, qh.el_link); | |
990 | ||
991 | curr_qh = 0; | |
992 | link = qh.link; | |
993 | } | |
4d611c9a | 994 | } |
54f254f9 AL |
995 | |
996 | /* go to the next entry */ | |
4d611c9a | 997 | } |
54f254f9 AL |
998 | |
999 | s->pending_int_mask = int_mask; | |
4d611c9a PB |
1000 | } |
1001 | ||
bb36d470 FB |
1002 | static void uhci_frame_timer(void *opaque) |
1003 | { | |
1004 | UHCIState *s = opaque; | |
1005 | int64_t expire_time; | |
bb36d470 FB |
1006 | |
1007 | if (!(s->cmd & UHCI_CMD_RS)) { | |
54f254f9 | 1008 | /* Full stop */ |
bb36d470 | 1009 | qemu_del_timer(s->frame_timer); |
52328140 FB |
1010 | /* set hchalted bit in status - UHCI11D 2.1.2 */ |
1011 | s->status |= UHCI_STS_HCHALTED; | |
bb36d470 FB |
1012 | return; |
1013 | } | |
54f254f9 AL |
1014 | |
1015 | /* Complete the previous frame */ | |
4d611c9a PB |
1016 | if (s->pending_int_mask) { |
1017 | s->status2 |= s->pending_int_mask; | |
54f254f9 | 1018 | s->status |= UHCI_STS_USBINT; |
4d611c9a PB |
1019 | uhci_update_irq(s); |
1020 | } | |
b9dc033c | 1021 | |
54f254f9 AL |
1022 | /* Start new frame */ |
1023 | s->frnum = (s->frnum + 1) & 0x7ff; | |
1024 | ||
1025 | dprintf("uhci: new frame #%u\n" , s->frnum); | |
1026 | ||
1027 | uhci_async_validate_begin(s); | |
1028 | ||
1029 | uhci_process_frame(s); | |
1030 | ||
1031 | uhci_async_validate_end(s); | |
b9dc033c | 1032 | |
bb36d470 | 1033 | /* prepare the timer for the next frame */ |
5fafdf24 | 1034 | expire_time = qemu_get_clock(vm_clock) + |
bb36d470 FB |
1035 | (ticks_per_sec / FRAME_TIMER_FREQ); |
1036 | qemu_mod_timer(s->frame_timer, expire_time); | |
1037 | } | |
1038 | ||
5fafdf24 | 1039 | static void uhci_map(PCIDevice *pci_dev, int region_num, |
bb36d470 FB |
1040 | uint32_t addr, uint32_t size, int type) |
1041 | { | |
1042 | UHCIState *s = (UHCIState *)pci_dev; | |
1043 | ||
1044 | register_ioport_write(addr, 32, 2, uhci_ioport_writew, s); | |
1045 | register_ioport_read(addr, 32, 2, uhci_ioport_readw, s); | |
1046 | register_ioport_write(addr, 32, 4, uhci_ioport_writel, s); | |
1047 | register_ioport_read(addr, 32, 4, uhci_ioport_readl, s); | |
1048 | register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s); | |
1049 | register_ioport_read(addr, 32, 1, uhci_ioport_readb, s); | |
1050 | } | |
1051 | ||
afcc3cdf | 1052 | void usb_uhci_piix3_init(PCIBus *bus, int devfn) |
bb36d470 FB |
1053 | { |
1054 | UHCIState *s; | |
1055 | uint8_t *pci_conf; | |
bb36d470 FB |
1056 | int i; |
1057 | ||
1058 | s = (UHCIState *)pci_register_device(bus, | |
1059 | "USB-UHCI", sizeof(UHCIState), | |
502a5395 | 1060 | devfn, NULL, NULL); |
bb36d470 FB |
1061 | pci_conf = s->dev.config; |
1062 | pci_conf[0x00] = 0x86; | |
1063 | pci_conf[0x01] = 0x80; | |
1064 | pci_conf[0x02] = 0x20; | |
1065 | pci_conf[0x03] = 0x70; | |
1066 | pci_conf[0x08] = 0x01; // revision number | |
1067 | pci_conf[0x09] = 0x00; | |
1068 | pci_conf[0x0a] = 0x03; | |
1069 | pci_conf[0x0b] = 0x0c; | |
1070 | pci_conf[0x0e] = 0x00; // header_type | |
f04308e4 | 1071 | pci_conf[0x3d] = 4; // interrupt pin 3 |
38ca0f6d | 1072 | pci_conf[0x60] = 0x10; // release number |
3b46e624 | 1073 | |
bb36d470 | 1074 | for(i = 0; i < NB_PORTS; i++) { |
0d92ed30 | 1075 | qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach); |
bb36d470 FB |
1076 | } |
1077 | s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s); | |
1078 | ||
1079 | uhci_reset(s); | |
1080 | ||
38ca0f6d PB |
1081 | /* Use region 4 for consistency with real hardware. BSD guests seem |
1082 | to rely on this. */ | |
5fafdf24 | 1083 | pci_register_io_region(&s->dev, 4, 0x20, |
bb36d470 FB |
1084 | PCI_ADDRESS_SPACE_IO, uhci_map); |
1085 | } | |
afcc3cdf TS |
1086 | |
1087 | void usb_uhci_piix4_init(PCIBus *bus, int devfn) | |
1088 | { | |
1089 | UHCIState *s; | |
1090 | uint8_t *pci_conf; | |
1091 | int i; | |
1092 | ||
1093 | s = (UHCIState *)pci_register_device(bus, | |
1094 | "USB-UHCI", sizeof(UHCIState), | |
1095 | devfn, NULL, NULL); | |
1096 | pci_conf = s->dev.config; | |
1097 | pci_conf[0x00] = 0x86; | |
1098 | pci_conf[0x01] = 0x80; | |
1099 | pci_conf[0x02] = 0x12; | |
1100 | pci_conf[0x03] = 0x71; | |
1101 | pci_conf[0x08] = 0x01; // revision number | |
1102 | pci_conf[0x09] = 0x00; | |
1103 | pci_conf[0x0a] = 0x03; | |
1104 | pci_conf[0x0b] = 0x0c; | |
1105 | pci_conf[0x0e] = 0x00; // header_type | |
1106 | pci_conf[0x3d] = 4; // interrupt pin 3 | |
1107 | pci_conf[0x60] = 0x10; // release number | |
1108 | ||
1109 | for(i = 0; i < NB_PORTS; i++) { | |
1110 | qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach); | |
1111 | } | |
1112 | s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s); | |
1113 | ||
1114 | uhci_reset(s); | |
1115 | ||
1116 | /* Use region 4 for consistency with real hardware. BSD guests seem | |
1117 | to rely on this. */ | |
1118 | pci_register_io_region(&s->dev, 4, 0x20, | |
1119 | PCI_ADDRESS_SPACE_IO, uhci_map); | |
54f254f9 AL |
1120 | |
1121 | register_savevm("uhci", 0, 1, uhci_save, uhci_load, s); | |
afcc3cdf | 1122 | } |