]> git.proxmox.com Git - qemu.git/blame - hw/usb-uhci.c
Revert "Update irqs on reset and device load"
[qemu.git] / hw / usb-uhci.c
CommitLineData
bb36d470
FB
1/*
2 * USB UHCI controller emulation
5fafdf24 3 *
bb36d470 4 * Copyright (c) 2005 Fabrice Bellard
5fafdf24 5 *
54f254f9
AL
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
9 *
bb36d470
FB
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
16 *
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
19 *
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
27 */
87ecb68b
PB
28#include "hw.h"
29#include "usb.h"
30#include "pci.h"
31#include "qemu-timer.h"
bb36d470
FB
32
33//#define DEBUG
54f254f9 34//#define DEBUG_DUMP_DATA
bb36d470 35
96217e31
TS
36#define UHCI_CMD_FGR (1 << 4)
37#define UHCI_CMD_EGSM (1 << 3)
bb36d470
FB
38#define UHCI_CMD_GRESET (1 << 2)
39#define UHCI_CMD_HCRESET (1 << 1)
40#define UHCI_CMD_RS (1 << 0)
41
42#define UHCI_STS_HCHALTED (1 << 5)
43#define UHCI_STS_HCPERR (1 << 4)
44#define UHCI_STS_HSERR (1 << 3)
45#define UHCI_STS_RD (1 << 2)
46#define UHCI_STS_USBERR (1 << 1)
47#define UHCI_STS_USBINT (1 << 0)
48
49#define TD_CTRL_SPD (1 << 29)
50#define TD_CTRL_ERROR_SHIFT 27
51#define TD_CTRL_IOS (1 << 25)
52#define TD_CTRL_IOC (1 << 24)
53#define TD_CTRL_ACTIVE (1 << 23)
54#define TD_CTRL_STALL (1 << 22)
55#define TD_CTRL_BABBLE (1 << 20)
56#define TD_CTRL_NAK (1 << 19)
57#define TD_CTRL_TIMEOUT (1 << 18)
58
59#define UHCI_PORT_RESET (1 << 9)
60#define UHCI_PORT_LSDA (1 << 8)
61#define UHCI_PORT_ENC (1 << 3)
62#define UHCI_PORT_EN (1 << 2)
63#define UHCI_PORT_CSC (1 << 1)
64#define UHCI_PORT_CCS (1 << 0)
65
66#define FRAME_TIMER_FREQ 1000
67
68#define FRAME_MAX_LOOPS 100
69
70#define NB_PORTS 2
71
54f254f9
AL
72#ifdef DEBUG
73#define dprintf printf
74
75const char *pid2str(int pid)
76{
77 switch (pid) {
78 case USB_TOKEN_SETUP: return "SETUP";
79 case USB_TOKEN_IN: return "IN";
80 case USB_TOKEN_OUT: return "OUT";
81 }
82 return "?";
83}
84
85#else
86#define dprintf(...)
87#endif
88
89#ifdef DEBUG_DUMP_DATA
90static void dump_data(const uint8_t *data, int len)
91{
92 int i;
93
94 printf("uhci: data: ");
95 for(i = 0; i < len; i++)
96 printf(" %02x", data[i]);
97 printf("\n");
98}
99#else
100static void dump_data(const uint8_t *data, int len) {}
101#endif
102
103/*
104 * Pending async transaction.
105 * 'packet' must be the first field because completion
106 * handler does "(UHCIAsync *) pkt" cast.
107 */
108typedef struct UHCIAsync {
109 USBPacket packet;
110 struct UHCIAsync *next;
111 uint32_t td;
112 uint32_t token;
113 int8_t valid;
114 uint8_t done;
115 uint8_t buffer[2048];
116} UHCIAsync;
117
bb36d470
FB
118typedef struct UHCIPort {
119 USBPort port;
120 uint16_t ctrl;
bb36d470
FB
121} UHCIPort;
122
123typedef struct UHCIState {
124 PCIDevice dev;
125 uint16_t cmd; /* cmd register */
126 uint16_t status;
127 uint16_t intr; /* interrupt enable register */
128 uint16_t frnum; /* frame number */
129 uint32_t fl_base_addr; /* frame list base address */
130 uint8_t sof_timing;
131 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
132 QEMUTimer *frame_timer;
133 UHCIPort ports[NB_PORTS];
4d611c9a
PB
134
135 /* Interrupts that should be raised at the end of the current frame. */
136 uint32_t pending_int_mask;
54f254f9
AL
137
138 /* Active packets */
139 UHCIAsync *async_pending;
140 UHCIAsync *async_pool;
bb36d470
FB
141} UHCIState;
142
143typedef struct UHCI_TD {
144 uint32_t link;
145 uint32_t ctrl; /* see TD_CTRL_xxx */
146 uint32_t token;
147 uint32_t buffer;
148} UHCI_TD;
149
150typedef struct UHCI_QH {
151 uint32_t link;
152 uint32_t el_link;
153} UHCI_QH;
154
54f254f9
AL
155static UHCIAsync *uhci_async_alloc(UHCIState *s)
156{
157 UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
487414f1
AL
158
159 memset(&async->packet, 0, sizeof(async->packet));
160 async->valid = 0;
161 async->td = 0;
162 async->token = 0;
163 async->done = 0;
164 async->next = NULL;
54f254f9
AL
165
166 return async;
167}
168
169static void uhci_async_free(UHCIState *s, UHCIAsync *async)
170{
171 qemu_free(async);
172}
173
174static void uhci_async_link(UHCIState *s, UHCIAsync *async)
175{
176 async->next = s->async_pending;
177 s->async_pending = async;
178}
179
180static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
181{
182 UHCIAsync *curr = s->async_pending;
183 UHCIAsync **prev = &s->async_pending;
184
185 while (curr) {
186 if (curr == async) {
187 *prev = curr->next;
188 return;
189 }
190
191 prev = &curr->next;
192 curr = curr->next;
193 }
194}
195
196static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
197{
198 dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",
199 async->td, async->token, async->done);
200
201 if (!async->done)
202 usb_cancel_packet(&async->packet);
203 uhci_async_free(s, async);
204}
205
206/*
207 * Mark all outstanding async packets as invalid.
208 * This is used for canceling them when TDs are removed by the HCD.
209 */
210static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
211{
212 UHCIAsync *async = s->async_pending;
213
214 while (async) {
215 async->valid--;
216 async = async->next;
217 }
218 return NULL;
219}
220
221/*
222 * Cancel async packets that are no longer valid
223 */
224static void uhci_async_validate_end(UHCIState *s)
225{
226 UHCIAsync *curr = s->async_pending;
227 UHCIAsync **prev = &s->async_pending;
228 UHCIAsync *next;
229
230 while (curr) {
231 if (curr->valid > 0) {
232 prev = &curr->next;
233 curr = curr->next;
234 continue;
235 }
236
237 next = curr->next;
238
239 /* Unlink */
240 *prev = next;
241
242 uhci_async_cancel(s, curr);
243
244 curr = next;
245 }
246}
247
248static void uhci_async_cancel_all(UHCIState *s)
249{
250 UHCIAsync *curr = s->async_pending;
251 UHCIAsync *next;
252
253 while (curr) {
254 next = curr->next;
255
256 uhci_async_cancel(s, curr);
257
258 curr = next;
259 }
260
261 s->async_pending = NULL;
262}
263
264static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
265{
266 UHCIAsync *async = s->async_pending;
e8ee3c72
AJ
267 UHCIAsync *match = NULL;
268 int count = 0;
269
270 /*
271 * We're looking for the best match here. ie both td addr and token.
272 * Otherwise we return last good match. ie just token.
273 * It's ok to match just token because it identifies the transaction
274 * rather well, token includes: device addr, endpoint, size, etc.
275 *
276 * Also since we queue async transactions in reverse order by returning
277 * last good match we restores the order.
278 *
279 * It's expected that we wont have a ton of outstanding transactions.
280 * If we ever do we'd want to optimize this algorithm.
281 */
54f254f9
AL
282
283 while (async) {
e8ee3c72
AJ
284 if (async->token == token) {
285 /* Good match */
286 match = async;
287
288 if (async->td == addr) {
289 /* Best match */
290 break;
54f254f9
AL
291 }
292 }
293
294 async = async->next;
e8ee3c72 295 count++;
54f254f9 296 }
e8ee3c72
AJ
297
298 if (count > 64)
299 fprintf(stderr, "uhci: warning lots of async transactions\n");
300
301 return match;
54f254f9
AL
302}
303
bb36d470
FB
304static void uhci_attach(USBPort *port1, USBDevice *dev);
305
306static void uhci_update_irq(UHCIState *s)
307{
308 int level;
309 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
310 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
311 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
312 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
313 (s->status & UHCI_STS_HSERR) ||
314 (s->status & UHCI_STS_HCPERR)) {
315 level = 1;
316 } else {
317 level = 0;
318 }
d537cf6c 319 qemu_set_irq(s->dev.irq[3], level);
bb36d470
FB
320}
321
322static void uhci_reset(UHCIState *s)
323{
324 uint8_t *pci_conf;
325 int i;
326 UHCIPort *port;
327
6f382b5e
AL
328 dprintf("uhci: full reset\n");
329
bb36d470
FB
330 pci_conf = s->dev.config;
331
332 pci_conf[0x6a] = 0x01; /* usb clock */
333 pci_conf[0x6b] = 0x00;
334 s->cmd = 0;
335 s->status = 0;
336 s->status2 = 0;
337 s->intr = 0;
338 s->fl_base_addr = 0;
339 s->sof_timing = 64;
54f254f9 340
bb36d470
FB
341 for(i = 0; i < NB_PORTS; i++) {
342 port = &s->ports[i];
343 port->ctrl = 0x0080;
a594cfbf
FB
344 if (port->port.dev)
345 uhci_attach(&port->port, port->port.dev);
bb36d470 346 }
54f254f9
AL
347
348 uhci_async_cancel_all(s);
bb36d470
FB
349}
350
b9dc033c
AZ
351static void uhci_save(QEMUFile *f, void *opaque)
352{
353 UHCIState *s = opaque;
354 uint8_t num_ports = NB_PORTS;
355 int i;
356
6f382b5e
AL
357 uhci_async_cancel_all(s);
358
b9dc033c
AZ
359 pci_device_save(&s->dev, f);
360
361 qemu_put_8s(f, &num_ports);
362 for (i = 0; i < num_ports; ++i)
363 qemu_put_be16s(f, &s->ports[i].ctrl);
364 qemu_put_be16s(f, &s->cmd);
365 qemu_put_be16s(f, &s->status);
366 qemu_put_be16s(f, &s->intr);
367 qemu_put_be16s(f, &s->frnum);
368 qemu_put_be32s(f, &s->fl_base_addr);
369 qemu_put_8s(f, &s->sof_timing);
370 qemu_put_8s(f, &s->status2);
371 qemu_put_timer(f, s->frame_timer);
372}
373
374static int uhci_load(QEMUFile *f, void *opaque, int version_id)
375{
376 UHCIState *s = opaque;
377 uint8_t num_ports;
378 int i, ret;
379
380 if (version_id > 1)
381 return -EINVAL;
382
383 ret = pci_device_load(&s->dev, f);
384 if (ret < 0)
385 return ret;
386
387 qemu_get_8s(f, &num_ports);
388 if (num_ports != NB_PORTS)
389 return -EINVAL;
390
391 for (i = 0; i < num_ports; ++i)
392 qemu_get_be16s(f, &s->ports[i].ctrl);
393 qemu_get_be16s(f, &s->cmd);
394 qemu_get_be16s(f, &s->status);
395 qemu_get_be16s(f, &s->intr);
396 qemu_get_be16s(f, &s->frnum);
397 qemu_get_be32s(f, &s->fl_base_addr);
398 qemu_get_8s(f, &s->sof_timing);
399 qemu_get_8s(f, &s->status2);
400 qemu_get_timer(f, s->frame_timer);
401
402 return 0;
403}
404
bb36d470
FB
405static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
406{
407 UHCIState *s = opaque;
3b46e624 408
bb36d470
FB
409 addr &= 0x1f;
410 switch(addr) {
411 case 0x0c:
412 s->sof_timing = val;
413 break;
414 }
415}
416
417static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
418{
419 UHCIState *s = opaque;
420 uint32_t val;
421
422 addr &= 0x1f;
423 switch(addr) {
424 case 0x0c:
425 val = s->sof_timing;
d80cfb3f 426 break;
bb36d470
FB
427 default:
428 val = 0xff;
429 break;
430 }
431 return val;
432}
433
434static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
435{
436 UHCIState *s = opaque;
3b46e624 437
bb36d470 438 addr &= 0x1f;
54f254f9
AL
439 dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
440
bb36d470
FB
441 switch(addr) {
442 case 0x00:
443 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
444 /* start frame processing */
445 qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
52328140 446 s->status &= ~UHCI_STS_HCHALTED;
467d409f 447 } else if (!(val & UHCI_CMD_RS)) {
52328140 448 s->status |= UHCI_STS_HCHALTED;
bb36d470
FB
449 }
450 if (val & UHCI_CMD_GRESET) {
451 UHCIPort *port;
452 USBDevice *dev;
453 int i;
454
455 /* send reset on the USB bus */
456 for(i = 0; i < NB_PORTS; i++) {
457 port = &s->ports[i];
a594cfbf 458 dev = port->port.dev;
bb36d470 459 if (dev) {
4d611c9a 460 usb_send_msg(dev, USB_MSG_RESET);
bb36d470
FB
461 }
462 }
463 uhci_reset(s);
464 return;
465 }
5e9ab4c4 466 if (val & UHCI_CMD_HCRESET) {
bb36d470
FB
467 uhci_reset(s);
468 return;
469 }
470 s->cmd = val;
471 break;
472 case 0x02:
473 s->status &= ~val;
474 /* XXX: the chip spec is not coherent, so we add a hidden
475 register to distinguish between IOC and SPD */
476 if (val & UHCI_STS_USBINT)
477 s->status2 = 0;
478 uhci_update_irq(s);
479 break;
480 case 0x04:
481 s->intr = val;
482 uhci_update_irq(s);
483 break;
484 case 0x06:
485 if (s->status & UHCI_STS_HCHALTED)
486 s->frnum = val & 0x7ff;
487 break;
488 case 0x10 ... 0x1f:
489 {
490 UHCIPort *port;
491 USBDevice *dev;
492 int n;
493
494 n = (addr >> 1) & 7;
495 if (n >= NB_PORTS)
496 return;
497 port = &s->ports[n];
a594cfbf 498 dev = port->port.dev;
bb36d470
FB
499 if (dev) {
500 /* port reset */
5fafdf24 501 if ( (val & UHCI_PORT_RESET) &&
bb36d470 502 !(port->ctrl & UHCI_PORT_RESET) ) {
4d611c9a 503 usb_send_msg(dev, USB_MSG_RESET);
bb36d470
FB
504 }
505 }
506 port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
507 /* some bits are reset when a '1' is written to them */
508 port->ctrl &= ~(val & 0x000a);
509 }
510 break;
511 }
512}
513
514static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
515{
516 UHCIState *s = opaque;
517 uint32_t val;
518
519 addr &= 0x1f;
520 switch(addr) {
521 case 0x00:
522 val = s->cmd;
523 break;
524 case 0x02:
525 val = s->status;
526 break;
527 case 0x04:
528 val = s->intr;
529 break;
530 case 0x06:
531 val = s->frnum;
532 break;
533 case 0x10 ... 0x1f:
534 {
535 UHCIPort *port;
536 int n;
537 n = (addr >> 1) & 7;
5fafdf24 538 if (n >= NB_PORTS)
bb36d470
FB
539 goto read_default;
540 port = &s->ports[n];
541 val = port->ctrl;
542 }
543 break;
544 default:
545 read_default:
546 val = 0xff7f; /* disabled port */
547 break;
548 }
54f254f9
AL
549
550 dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
551
bb36d470
FB
552 return val;
553}
554
555static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
556{
557 UHCIState *s = opaque;
558
559 addr &= 0x1f;
54f254f9
AL
560 dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
561
bb36d470
FB
562 switch(addr) {
563 case 0x08:
564 s->fl_base_addr = val & ~0xfff;
565 break;
566 }
567}
568
569static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
570{
571 UHCIState *s = opaque;
572 uint32_t val;
573
574 addr &= 0x1f;
575 switch(addr) {
576 case 0x08:
577 val = s->fl_base_addr;
578 break;
579 default:
580 val = 0xffffffff;
581 break;
582 }
583 return val;
584}
585
96217e31
TS
586/* signal resume if controller suspended */
587static void uhci_resume (void *opaque)
588{
589 UHCIState *s = (UHCIState *)opaque;
590
591 if (!s)
592 return;
593
594 if (s->cmd & UHCI_CMD_EGSM) {
595 s->cmd |= UHCI_CMD_FGR;
596 s->status |= UHCI_STS_RD;
597 uhci_update_irq(s);
598 }
599}
600
bb36d470
FB
601static void uhci_attach(USBPort *port1, USBDevice *dev)
602{
603 UHCIState *s = port1->opaque;
604 UHCIPort *port = &s->ports[port1->index];
605
606 if (dev) {
a594cfbf 607 if (port->port.dev) {
bb36d470
FB
608 usb_attach(port1, NULL);
609 }
610 /* set connect status */
61064870
PB
611 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
612
bb36d470
FB
613 /* update speed */
614 if (dev->speed == USB_SPEED_LOW)
615 port->ctrl |= UHCI_PORT_LSDA;
616 else
617 port->ctrl &= ~UHCI_PORT_LSDA;
96217e31
TS
618
619 uhci_resume(s);
620
a594cfbf 621 port->port.dev = dev;
bb36d470 622 /* send the attach message */
4d611c9a 623 usb_send_msg(dev, USB_MSG_ATTACH);
bb36d470
FB
624 } else {
625 /* set connect status */
61064870
PB
626 if (port->ctrl & UHCI_PORT_CCS) {
627 port->ctrl &= ~UHCI_PORT_CCS;
628 port->ctrl |= UHCI_PORT_CSC;
bb36d470
FB
629 }
630 /* disable port */
631 if (port->ctrl & UHCI_PORT_EN) {
632 port->ctrl &= ~UHCI_PORT_EN;
633 port->ctrl |= UHCI_PORT_ENC;
634 }
96217e31
TS
635
636 uhci_resume(s);
637
a594cfbf 638 dev = port->port.dev;
bb36d470
FB
639 if (dev) {
640 /* send the detach message */
4d611c9a 641 usb_send_msg(dev, USB_MSG_DETACH);
bb36d470 642 }
a594cfbf 643 port->port.dev = NULL;
bb36d470
FB
644 }
645}
646
4d611c9a 647static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
bb36d470 648{
bb36d470
FB
649 int i, ret;
650
54f254f9
AL
651 dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
652 pid2str(p->pid), p->devaddr, p->devep, p->len);
5d808245 653 if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
54f254f9
AL
654 dump_data(p->data, p->len);
655
656 ret = USB_RET_NODEV;
657 for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
658 UHCIPort *port = &s->ports[i];
659 USBDevice *dev = port->port.dev;
660
661 if (dev && (port->ctrl & UHCI_PORT_EN))
4d611c9a 662 ret = dev->handle_packet(dev, p);
bb36d470 663 }
54f254f9
AL
664
665 dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);
666 if (p->pid == USB_TOKEN_IN && ret > 0)
667 dump_data(p->data, ret);
668
669 return ret;
bb36d470
FB
670}
671
54f254f9
AL
672static void uhci_async_complete(USBPacket * packet, void *opaque);
673static void uhci_process_frame(UHCIState *s);
4d611c9a 674
bb36d470
FB
675/* return -1 if fatal error (frame must be stopped)
676 0 if TD successful
677 1 if TD unsuccessful or inactive
678*/
54f254f9 679static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
bb36d470 680{
54f254f9 681 int len = 0, max_len, err, ret;
bb36d470 682 uint8_t pid;
bb36d470 683
54f254f9
AL
684 max_len = ((td->token >> 21) + 1) & 0x7ff;
685 pid = td->token & 0xff;
686
687 ret = async->packet.len;
688
689 if (td->ctrl & TD_CTRL_IOC)
bb36d470 690 *int_mask |= 0x01;
3b46e624 691
54f254f9
AL
692 if (td->ctrl & TD_CTRL_IOS)
693 td->ctrl &= ~TD_CTRL_ACTIVE;
bb36d470 694
54f254f9
AL
695 if (ret < 0)
696 goto out;
b9dc033c 697
54f254f9
AL
698 len = async->packet.len;
699 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
700
701 /* The NAK bit may have been set by a previous frame, so clear it
702 here. The docs are somewhat unclear, but win2k relies on this
703 behavior. */
704 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
705
706 if (pid == USB_TOKEN_IN) {
707 if (len > max_len) {
4d611c9a 708 len = max_len;
54f254f9
AL
709 ret = USB_RET_BABBLE;
710 goto out;
4d611c9a 711 }
b9dc033c 712
54f254f9
AL
713 if (len > 0) {
714 /* write the data back */
715 cpu_physical_memory_write(td->buffer, async->buffer, len);
716 }
717
718 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
bb36d470
FB
719 *int_mask |= 0x02;
720 /* short packet: do not update QH */
54f254f9 721 dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
bb36d470 722 return 1;
bb36d470 723 }
54f254f9
AL
724 }
725
726 /* success */
727 return 0;
728
729out:
730 switch(ret) {
731 case USB_RET_STALL:
732 td->ctrl |= TD_CTRL_STALL;
733 td->ctrl &= ~TD_CTRL_ACTIVE;
734 return 1;
735
736 case USB_RET_BABBLE:
737 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
738 td->ctrl &= ~TD_CTRL_ACTIVE;
739 /* frame interrupted */
740 return -1;
741
742 case USB_RET_NAK:
743 td->ctrl |= TD_CTRL_NAK;
744 if (pid == USB_TOKEN_SETUP)
745 break;
746 return 1;
747
748 case USB_RET_NODEV:
749 default:
750 break;
751 }
752
753 /* Retry the TD if error count is not zero */
754
755 td->ctrl |= TD_CTRL_TIMEOUT;
756 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
757 if (err != 0) {
758 err--;
759 if (err == 0) {
bb36d470 760 td->ctrl &= ~TD_CTRL_ACTIVE;
54f254f9
AL
761 s->status |= UHCI_STS_USBERR;
762 uhci_update_irq(s);
bb36d470
FB
763 }
764 }
54f254f9
AL
765 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
766 (err << TD_CTRL_ERROR_SHIFT);
767 return 1;
bb36d470
FB
768}
769
54f254f9
AL
770static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
771{
772 UHCIAsync *async;
5d808245 773 int len = 0, max_len;
54f254f9
AL
774 uint8_t pid;
775
776 /* Is active ? */
777 if (!(td->ctrl & TD_CTRL_ACTIVE))
778 return 1;
779
780 async = uhci_async_find_td(s, addr, td->token);
781 if (async) {
782 /* Already submitted */
a145ea51 783 async->valid = 32;
54f254f9
AL
784
785 if (!async->done)
786 return 1;
787
788 uhci_async_unlink(s, async);
789 goto done;
790 }
791
792 /* Allocate new packet */
793 async = uhci_async_alloc(s);
794 if (!async)
795 return 1;
796
797 async->valid = 10;
798 async->td = addr;
799 async->token = td->token;
800
801 max_len = ((td->token >> 21) + 1) & 0x7ff;
802 pid = td->token & 0xff;
803
804 async->packet.pid = pid;
805 async->packet.devaddr = (td->token >> 8) & 0x7f;
806 async->packet.devep = (td->token >> 15) & 0xf;
807 async->packet.data = async->buffer;
808 async->packet.len = max_len;
809 async->packet.complete_cb = uhci_async_complete;
810 async->packet.complete_opaque = s;
811
812 switch(pid) {
813 case USB_TOKEN_OUT:
814 case USB_TOKEN_SETUP:
815 cpu_physical_memory_read(td->buffer, async->buffer, max_len);
5d808245
AJ
816 len = uhci_broadcast_packet(s, &async->packet);
817 if (len >= 0)
818 len = max_len;
54f254f9
AL
819 break;
820
821 case USB_TOKEN_IN:
5d808245 822 len = uhci_broadcast_packet(s, &async->packet);
54f254f9
AL
823 break;
824
825 default:
826 /* invalid pid : frame interrupted */
827 uhci_async_free(s, async);
828 s->status |= UHCI_STS_HCPERR;
829 uhci_update_irq(s);
830 return -1;
831 }
832
5d808245 833 if (len == USB_RET_ASYNC) {
54f254f9
AL
834 uhci_async_link(s, async);
835 return 2;
836 }
837
5d808245 838 async->packet.len = len;
54f254f9
AL
839
840done:
5d808245 841 len = uhci_complete_td(s, td, async, int_mask);
54f254f9 842 uhci_async_free(s, async);
5d808245 843 return len;
54f254f9
AL
844}
845
846static void uhci_async_complete(USBPacket *packet, void *opaque)
4d611c9a
PB
847{
848 UHCIState *s = opaque;
54f254f9
AL
849 UHCIAsync *async = (UHCIAsync *) packet;
850
851 dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
852
853 async->done = 1;
854
855 uhci_process_frame(s);
856}
857
858static int is_valid(uint32_t link)
859{
860 return (link & 1) == 0;
861}
862
863static int is_qh(uint32_t link)
864{
865 return (link & 2) != 0;
866}
867
868static int depth_first(uint32_t link)
869{
870 return (link & 4) != 0;
871}
872
873/* QH DB used for detecting QH loops */
874#define UHCI_MAX_QUEUES 128
875typedef struct {
876 uint32_t addr[UHCI_MAX_QUEUES];
877 int count;
878} QhDb;
879
880static void qhdb_reset(QhDb *db)
881{
882 db->count = 0;
883}
884
885/* Add QH to DB. Returns 1 if already present or DB is full. */
886static int qhdb_insert(QhDb *db, uint32_t addr)
887{
888 int i;
889 for (i = 0; i < db->count; i++)
890 if (db->addr[i] == addr)
891 return 1;
892
893 if (db->count >= UHCI_MAX_QUEUES)
894 return 1;
895
896 db->addr[db->count++] = addr;
897 return 0;
898}
899
900static void uhci_process_frame(UHCIState *s)
901{
902 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
903 uint32_t curr_qh;
904 int cnt, ret;
4d611c9a 905 UHCI_TD td;
54f254f9
AL
906 UHCI_QH qh;
907 QhDb qhdb;
4d611c9a 908
54f254f9
AL
909 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
910
911 dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
912
913 cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
914 le32_to_cpus(&link);
b9dc033c 915
54f254f9
AL
916 int_mask = 0;
917 curr_qh = 0;
918
919 qhdb_reset(&qhdb);
920
921 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
922 if (is_qh(link)) {
923 /* QH */
924
925 if (qhdb_insert(&qhdb, link)) {
926 /*
927 * We're going in circles. Which is not a bug because
928 * HCD is allowed to do that as part of the BW management.
929 * In our case though it makes no sense to spin here. Sync transations
930 * are already done, and async completion handler will re-process
931 * the frame when something is ready.
932 */
933 dprintf("uhci: detected loop. qh 0x%x\n", link);
934 break;
935 }
936
937 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
938 le32_to_cpus(&qh.link);
939 le32_to_cpus(&qh.el_link);
940
941 dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
942 link, qh.link, qh.el_link);
943
944 if (!is_valid(qh.el_link)) {
945 /* QH w/o elements */
946 curr_qh = 0;
947 link = qh.link;
948 } else {
949 /* QH with elements */
950 curr_qh = link;
951 link = qh.el_link;
952 }
953 continue;
954 }
955
956 /* TD */
957 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
b9dc033c
AZ
958 le32_to_cpus(&td.link);
959 le32_to_cpus(&td.ctrl);
960 le32_to_cpus(&td.token);
961 le32_to_cpus(&td.buffer);
b9dc033c 962
54f254f9
AL
963 dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
964 link, td.link, td.ctrl, td.token, curr_qh);
965
966 old_td_ctrl = td.ctrl;
967 ret = uhci_handle_td(s, link, &td, &int_mask);
b9dc033c 968 if (old_td_ctrl != td.ctrl) {
54f254f9 969 /* update the status bits of the TD */
b9dc033c
AZ
970 val = cpu_to_le32(td.ctrl);
971 cpu_physical_memory_write((link & ~0xf) + 4,
54f254f9 972 (const uint8_t *)&val, sizeof(val));
b9dc033c 973 }
54f254f9
AL
974
975 if (ret < 0) {
976 /* interrupted frame */
977 break;
b9dc033c 978 }
b9dc033c 979
54f254f9
AL
980 if (ret == 2 || ret == 1) {
981 dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
982 link, ret == 2 ? "pend" : "skip",
983 td.link, td.ctrl, td.token, curr_qh);
b9dc033c 984
54f254f9
AL
985 link = curr_qh ? qh.link : td.link;
986 continue;
4d611c9a 987 }
54f254f9
AL
988
989 /* completed TD */
990
991 dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
992 link, td.link, td.ctrl, td.token, curr_qh);
993
994 link = td.link;
995
996 if (curr_qh) {
997 /* update QH element link */
998 qh.el_link = link;
4d611c9a 999 val = cpu_to_le32(qh.el_link);
54f254f9
AL
1000 cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1001 (const uint8_t *)&val, sizeof(val));
1002
1003 if (!depth_first(link)) {
1004 /* done with this QH */
1005
1006 dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1007 curr_qh, qh.link, qh.el_link);
1008
1009 curr_qh = 0;
1010 link = qh.link;
1011 }
4d611c9a 1012 }
54f254f9
AL
1013
1014 /* go to the next entry */
4d611c9a 1015 }
54f254f9
AL
1016
1017 s->pending_int_mask = int_mask;
4d611c9a
PB
1018}
1019
bb36d470
FB
1020static void uhci_frame_timer(void *opaque)
1021{
1022 UHCIState *s = opaque;
1023 int64_t expire_time;
bb36d470
FB
1024
1025 if (!(s->cmd & UHCI_CMD_RS)) {
54f254f9 1026 /* Full stop */
bb36d470 1027 qemu_del_timer(s->frame_timer);
52328140
FB
1028 /* set hchalted bit in status - UHCI11D 2.1.2 */
1029 s->status |= UHCI_STS_HCHALTED;
6f382b5e
AL
1030
1031 dprintf("uhci: halted\n");
bb36d470
FB
1032 return;
1033 }
54f254f9
AL
1034
1035 /* Complete the previous frame */
4d611c9a
PB
1036 if (s->pending_int_mask) {
1037 s->status2 |= s->pending_int_mask;
54f254f9 1038 s->status |= UHCI_STS_USBINT;
4d611c9a
PB
1039 uhci_update_irq(s);
1040 }
b9dc033c 1041
54f254f9
AL
1042 /* Start new frame */
1043 s->frnum = (s->frnum + 1) & 0x7ff;
1044
1045 dprintf("uhci: new frame #%u\n" , s->frnum);
1046
1047 uhci_async_validate_begin(s);
1048
1049 uhci_process_frame(s);
1050
1051 uhci_async_validate_end(s);
b9dc033c 1052
bb36d470 1053 /* prepare the timer for the next frame */
5fafdf24 1054 expire_time = qemu_get_clock(vm_clock) +
bb36d470
FB
1055 (ticks_per_sec / FRAME_TIMER_FREQ);
1056 qemu_mod_timer(s->frame_timer, expire_time);
1057}
1058
5fafdf24 1059static void uhci_map(PCIDevice *pci_dev, int region_num,
bb36d470
FB
1060 uint32_t addr, uint32_t size, int type)
1061{
1062 UHCIState *s = (UHCIState *)pci_dev;
1063
1064 register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1065 register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1066 register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1067 register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1068 register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1069 register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1070}
1071
afcc3cdf 1072void usb_uhci_piix3_init(PCIBus *bus, int devfn)
bb36d470
FB
1073{
1074 UHCIState *s;
1075 uint8_t *pci_conf;
bb36d470
FB
1076 int i;
1077
1078 s = (UHCIState *)pci_register_device(bus,
1079 "USB-UHCI", sizeof(UHCIState),
502a5395 1080 devfn, NULL, NULL);
bb36d470 1081 pci_conf = s->dev.config;
deb54399
AL
1082 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1083 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
bb36d470
FB
1084 pci_conf[0x08] = 0x01; // revision number
1085 pci_conf[0x09] = 0x00;
173a543b 1086 pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
6407f373 1087 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
f04308e4 1088 pci_conf[0x3d] = 4; // interrupt pin 3
38ca0f6d 1089 pci_conf[0x60] = 0x10; // release number
3b46e624 1090
bb36d470 1091 for(i = 0; i < NB_PORTS; i++) {
0d92ed30 1092 qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
bb36d470
FB
1093 }
1094 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1095
1096 uhci_reset(s);
1097
38ca0f6d
PB
1098 /* Use region 4 for consistency with real hardware. BSD guests seem
1099 to rely on this. */
28c2c264 1100 pci_register_bar(&s->dev, 4, 0x20,
bb36d470 1101 PCI_ADDRESS_SPACE_IO, uhci_map);
6f382b5e
AL
1102
1103 register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
bb36d470 1104}
afcc3cdf
TS
1105
1106void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1107{
1108 UHCIState *s;
1109 uint8_t *pci_conf;
1110 int i;
1111
1112 s = (UHCIState *)pci_register_device(bus,
1113 "USB-UHCI", sizeof(UHCIState),
1114 devfn, NULL, NULL);
1115 pci_conf = s->dev.config;
deb54399
AL
1116 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1117 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
afcc3cdf
TS
1118 pci_conf[0x08] = 0x01; // revision number
1119 pci_conf[0x09] = 0x00;
173a543b 1120 pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
6407f373 1121 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
afcc3cdf
TS
1122 pci_conf[0x3d] = 4; // interrupt pin 3
1123 pci_conf[0x60] = 0x10; // release number
1124
1125 for(i = 0; i < NB_PORTS; i++) {
1126 qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1127 }
1128 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1129
1130 uhci_reset(s);
1131
1132 /* Use region 4 for consistency with real hardware. BSD guests seem
1133 to rely on this. */
28c2c264 1134 pci_register_bar(&s->dev, 4, 0x20,
afcc3cdf 1135 PCI_ADDRESS_SPACE_IO, uhci_map);
54f254f9
AL
1136
1137 register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
afcc3cdf 1138}