hw/usb/hcd-ohci.c

   1 /*
   2  * QEMU USB OHCI Emulation
   3  * Copyright (c) 2004 Gianni Tedesco
   4  * Copyright (c) 2006 CodeSourcery
   5  * Copyright (c) 2006 Openedhand Ltd.
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  *
  20  * TODO:
  21  *  o Isochronous transfers
  22  *  o Allocate bandwidth in frames properly
  23  *  o Disable timers when nothing needs to be done, or remove timer usage
  24  *    all together.
  25  *  o BIOS work to boot from USB storage
  26 */
  27
  28 #include "qemu/osdep.h"
  29 #include "hw/hw.h"
  30 #include "qapi/error.h"
  31 #include "qemu/timer.h"
  32 #include "hw/usb.h"
  33 #include "hw/pci/pci.h"
  34 #include "hw/sysbus.h"
  35 #include "hw/qdev-dma.h"
  36 #include "trace.h"
  37
  38 /* This causes frames to occur 1000x slower */
  39 //#define OHCI_TIME_WARP 1
  40
  41 /* Number of Downstream Ports on the root hub.  */
  42
  43 #define OHCI_MAX_PORTS 15
  44
  45 #define ED_LINK_LIMIT 4
  46
  47 static int64_t usb_frame_time;
  48 static int64_t usb_bit_time;
  49
  50 typedef struct OHCIPort {
  51     USBPort port;
  52     uint32_t ctrl;
  53 } OHCIPort;
  54
  55 typedef struct {
  56     USBBus bus;
  57     qemu_irq irq;
  58     MemoryRegion mem;
  59     AddressSpace *as;
  60     int num_ports;
  61     const char *name;
  62
  63     QEMUTimer *eof_timer;
  64     int64_t sof_time;
  65
  66     /* OHCI state */
  67     /* Control partition */
  68     uint32_t ctl, status;
  69     uint32_t intr_status;
  70     uint32_t intr;
  71
  72     /* memory pointer partition */
  73     uint32_t hcca;
  74     uint32_t ctrl_head, ctrl_cur;
  75     uint32_t bulk_head, bulk_cur;
  76     uint32_t per_cur;
  77     uint32_t done;
  78     int32_t done_count;
  79
  80     /* Frame counter partition */
  81     uint16_t fsmps;
  82     uint8_t fit;
  83     uint16_t fi;
  84     uint8_t frt;
  85     uint16_t frame_number;
  86     uint16_t padding;
  87     uint32_t pstart;
  88     uint32_t lst;
  89
  90     /* Root Hub partition */
  91     uint32_t rhdesc_a, rhdesc_b;
  92     uint32_t rhstatus;
  93     OHCIPort rhport[OHCI_MAX_PORTS];
  94
  95     /* PXA27x Non-OHCI events */
  96     uint32_t hstatus;
  97     uint32_t hmask;
  98     uint32_t hreset;
  99     uint32_t htest;
 100
 101     /* SM501 local memory offset */
 102     dma_addr_t localmem_base;
 103
 104     /* Active packets.  */
 105     uint32_t old_ctl;
 106     USBPacket usb_packet;
 107     uint8_t usb_buf[8192];
 108     uint32_t async_td;
 109     bool async_complete;
 110
 111 } OHCIState;
 112
 113 /* Host Controller Communications Area */
 114 struct ohci_hcca {
 115     uint32_t intr[32];
 116     uint16_t frame, pad;
 117     uint32_t done;
 118 };
 119 #define HCCA_WRITEBACK_OFFSET   offsetof(struct ohci_hcca, frame)
 120 #define HCCA_WRITEBACK_SIZE     8 /* frame, pad, done */
 121
 122 #define ED_WBACK_OFFSET offsetof(struct ohci_ed, head)
 123 #define ED_WBACK_SIZE   4
 124
 125 static void ohci_bus_stop(OHCIState *ohci);
 126 static void ohci_async_cancel_device(OHCIState *ohci, USBDevice *dev);
 127
 128 /* Bitfields for the first word of an Endpoint Desciptor.  */
 129 #define OHCI_ED_FA_SHIFT  0
 130 #define OHCI_ED_FA_MASK   (0x7f<<OHCI_ED_FA_SHIFT)
 131 #define OHCI_ED_EN_SHIFT  7
 132 #define OHCI_ED_EN_MASK   (0xf<<OHCI_ED_EN_SHIFT)
 133 #define OHCI_ED_D_SHIFT   11
 134 #define OHCI_ED_D_MASK    (3<<OHCI_ED_D_SHIFT)
 135 #define OHCI_ED_S         (1<<13)
 136 #define OHCI_ED_K         (1<<14)
 137 #define OHCI_ED_F         (1<<15)
 138 #define OHCI_ED_MPS_SHIFT 16
 139 #define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
 140
 141 /* Flags in the head field of an Endpoint Desciptor.  */
 142 #define OHCI_ED_H         1
 143 #define OHCI_ED_C         2
 144
 145 /* Bitfields for the first word of a Transfer Desciptor.  */
 146 #define OHCI_TD_R         (1<<18)
 147 #define OHCI_TD_DP_SHIFT  19
 148 #define OHCI_TD_DP_MASK   (3<<OHCI_TD_DP_SHIFT)
 149 #define OHCI_TD_DI_SHIFT  21
 150 #define OHCI_TD_DI_MASK   (7<<OHCI_TD_DI_SHIFT)
 151 #define OHCI_TD_T0        (1<<24)
 152 #define OHCI_TD_T1        (1<<25)
 153 #define OHCI_TD_EC_SHIFT  26
 154 #define OHCI_TD_EC_MASK   (3<<OHCI_TD_EC_SHIFT)
 155 #define OHCI_TD_CC_SHIFT  28
 156 #define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
 157
 158 /* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
 159 /* CC & DI - same as in the General Transfer Desciptor */
 160 #define OHCI_TD_SF_SHIFT  0
 161 #define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
 162 #define OHCI_TD_FC_SHIFT  24
 163 #define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
 164
 165 /* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
 166 #define OHCI_TD_PSW_CC_SHIFT 12
 167 #define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
 168 #define OHCI_TD_PSW_SIZE_SHIFT 0
 169 #define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
 170
 171 #define OHCI_PAGE_MASK    0xfffff000
 172 #define OHCI_OFFSET_MASK  0xfff
 173
 174 #define OHCI_DPTR_MASK    0xfffffff0
 175
 176 #define OHCI_BM(val, field) \
 177   (((val) & OHCI_##field##_MASK) >> OHCI_##field##_SHIFT)
 178
 179 #define OHCI_SET_BM(val, field, newval) do { \
 180     val &= ~OHCI_##field##_MASK; \
 181     val |= ((newval) << OHCI_##field##_SHIFT) & OHCI_##field##_MASK; \
 182     } while(0)
 183
 184 /* endpoint descriptor */
 185 struct ohci_ed {
 186     uint32_t flags;
 187     uint32_t tail;
 188     uint32_t head;
 189     uint32_t next;
 190 };
 191
 192 /* General transfer descriptor */
 193 struct ohci_td {
 194     uint32_t flags;
 195     uint32_t cbp;
 196     uint32_t next;
 197     uint32_t be;
 198 };
 199
 200 /* Isochronous transfer descriptor */
 201 struct ohci_iso_td {
 202     uint32_t flags;
 203     uint32_t bp;
 204     uint32_t next;
 205     uint32_t be;
 206     uint16_t offset[8];
 207 };
 208
 209 #define USB_HZ                      12000000
 210
 211 /* OHCI Local stuff */
 212 #define OHCI_CTL_CBSR         ((1<<0)|(1<<1))
 213 #define OHCI_CTL_PLE          (1<<2)
 214 #define OHCI_CTL_IE           (1<<3)
 215 #define OHCI_CTL_CLE          (1<<4)
 216 #define OHCI_CTL_BLE          (1<<5)
 217 #define OHCI_CTL_HCFS         ((1<<6)|(1<<7))
 218 #define  OHCI_USB_RESET       0x00
 219 #define  OHCI_USB_RESUME      0x40
 220 #define  OHCI_USB_OPERATIONAL 0x80
 221 #define  OHCI_USB_SUSPEND     0xc0
 222 #define OHCI_CTL_IR           (1<<8)
 223 #define OHCI_CTL_RWC          (1<<9)
 224 #define OHCI_CTL_RWE          (1<<10)
 225
 226 #define OHCI_STATUS_HCR       (1<<0)
 227 #define OHCI_STATUS_CLF       (1<<1)
 228 #define OHCI_STATUS_BLF       (1<<2)
 229 #define OHCI_STATUS_OCR       (1<<3)
 230 #define OHCI_STATUS_SOC       ((1<<6)|(1<<7))
 231
 232 #define OHCI_INTR_SO          (1U<<0) /* Scheduling overrun */
 233 #define OHCI_INTR_WD          (1U<<1) /* HcDoneHead writeback */
 234 #define OHCI_INTR_SF          (1U<<2) /* Start of frame */
 235 #define OHCI_INTR_RD          (1U<<3) /* Resume detect */
 236 #define OHCI_INTR_UE          (1U<<4) /* Unrecoverable error */
 237 #define OHCI_INTR_FNO         (1U<<5) /* Frame number overflow */
 238 #define OHCI_INTR_RHSC        (1U<<6) /* Root hub status change */
 239 #define OHCI_INTR_OC          (1U<<30) /* Ownership change */
 240 #define OHCI_INTR_MIE         (1U<<31) /* Master Interrupt Enable */
 241
 242 #define OHCI_HCCA_SIZE        0x100
 243 #define OHCI_HCCA_MASK        0xffffff00
 244
 245 #define OHCI_EDPTR_MASK       0xfffffff0
 246
 247 #define OHCI_FMI_FI           0x00003fff
 248 #define OHCI_FMI_FSMPS        0xffff0000
 249 #define OHCI_FMI_FIT          0x80000000
 250
 251 #define OHCI_FR_RT            (1U<<31)
 252
 253 #define OHCI_LS_THRESH        0x628
 254
 255 #define OHCI_RHA_RW_MASK      0x00000000 /* Mask of supported features.  */
 256 #define OHCI_RHA_PSM          (1<<8)
 257 #define OHCI_RHA_NPS          (1<<9)
 258 #define OHCI_RHA_DT           (1<<10)
 259 #define OHCI_RHA_OCPM         (1<<11)
 260 #define OHCI_RHA_NOCP         (1<<12)
 261 #define OHCI_RHA_POTPGT_MASK  0xff000000
 262
 263 #define OHCI_RHS_LPS          (1U<<0)
 264 #define OHCI_RHS_OCI          (1U<<1)
 265 #define OHCI_RHS_DRWE         (1U<<15)
 266 #define OHCI_RHS_LPSC         (1U<<16)
 267 #define OHCI_RHS_OCIC         (1U<<17)
 268 #define OHCI_RHS_CRWE         (1U<<31)
 269
 270 #define OHCI_PORT_CCS         (1<<0)
 271 #define OHCI_PORT_PES         (1<<1)
 272 #define OHCI_PORT_PSS         (1<<2)
 273 #define OHCI_PORT_POCI        (1<<3)
 274 #define OHCI_PORT_PRS         (1<<4)
 275 #define OHCI_PORT_PPS         (1<<8)
 276 #define OHCI_PORT_LSDA        (1<<9)
 277 #define OHCI_PORT_CSC         (1<<16)
 278 #define OHCI_PORT_PESC        (1<<17)
 279 #define OHCI_PORT_PSSC        (1<<18)
 280 #define OHCI_PORT_OCIC        (1<<19)
 281 #define OHCI_PORT_PRSC        (1<<20)
 282 #define OHCI_PORT_WTC         (OHCI_PORT_CSC|OHCI_PORT_PESC|OHCI_PORT_PSSC \
 283                                |OHCI_PORT_OCIC|OHCI_PORT_PRSC)
 284
 285 #define OHCI_TD_DIR_SETUP     0x0
 286 #define OHCI_TD_DIR_OUT       0x1
 287 #define OHCI_TD_DIR_IN        0x2
 288 #define OHCI_TD_DIR_RESERVED  0x3
 289
 290 #define OHCI_CC_NOERROR             0x0
 291 #define OHCI_CC_CRC                 0x1
 292 #define OHCI_CC_BITSTUFFING         0x2
 293 #define OHCI_CC_DATATOGGLEMISMATCH  0x3
 294 #define OHCI_CC_STALL               0x4
 295 #define OHCI_CC_DEVICENOTRESPONDING 0x5
 296 #define OHCI_CC_PIDCHECKFAILURE     0x6
 297 #define OHCI_CC_UNDEXPETEDPID       0x7
 298 #define OHCI_CC_DATAOVERRUN         0x8
 299 #define OHCI_CC_DATAUNDERRUN        0x9
 300 #define OHCI_CC_BUFFEROVERRUN       0xc
 301 #define OHCI_CC_BUFFERUNDERRUN      0xd
 302
 303 #define OHCI_HRESET_FSBIR       (1 << 0)
 304
 305 static void ohci_die(OHCIState *ohci);
 306
 307 /* Update IRQ levels */
 308 static inline void ohci_intr_update(OHCIState *ohci)
 309 {
 310     int level = 0;
 311
 312     if ((ohci->intr & OHCI_INTR_MIE) &&
 313         (ohci->intr_status & ohci->intr))
 314         level = 1;
 315
 316     qemu_set_irq(ohci->irq, level);
 317 }
 318
 319 /* Set an interrupt */
 320 static inline void ohci_set_interrupt(OHCIState *ohci, uint32_t intr)
 321 {
 322     ohci->intr_status |= intr;
 323     ohci_intr_update(ohci);
 324 }
 325
 326 /* Attach or detach a device on a root hub port.  */
 327 static void ohci_attach(USBPort *port1)
 328 {
 329     OHCIState *s = port1->opaque;
 330     OHCIPort *port = &s->rhport[port1->index];
 331     uint32_t old_state = port->ctrl;
 332
 333     /* set connect status */
 334     port->ctrl |= OHCI_PORT_CCS | OHCI_PORT_CSC;
 335
 336     /* update speed */
 337     if (port->port.dev->speed == USB_SPEED_LOW) {
 338         port->ctrl |= OHCI_PORT_LSDA;
 339     } else {
 340         port->ctrl &= ~OHCI_PORT_LSDA;
 341     }
 342
 343     /* notify of remote-wakeup */
 344     if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND) {
 345         ohci_set_interrupt(s, OHCI_INTR_RD);
 346     }
 347
 348     trace_usb_ohci_port_attach(port1->index);
 349
 350     if (old_state != port->ctrl) {
 351         ohci_set_interrupt(s, OHCI_INTR_RHSC);
 352     }
 353 }
 354
 355 static void ohci_detach(USBPort *port1)
 356 {
 357     OHCIState *s = port1->opaque;
 358     OHCIPort *port = &s->rhport[port1->index];
 359     uint32_t old_state = port->ctrl;
 360
 361     ohci_async_cancel_device(s, port1->dev);
 362
 363     /* set connect status */
 364     if (port->ctrl & OHCI_PORT_CCS) {
 365         port->ctrl &= ~OHCI_PORT_CCS;
 366         port->ctrl |= OHCI_PORT_CSC;
 367     }
 368     /* disable port */
 369     if (port->ctrl & OHCI_PORT_PES) {
 370         port->ctrl &= ~OHCI_PORT_PES;
 371         port->ctrl |= OHCI_PORT_PESC;
 372     }
 373     trace_usb_ohci_port_detach(port1->index);
 374
 375     if (old_state != port->ctrl) {
 376         ohci_set_interrupt(s, OHCI_INTR_RHSC);
 377     }
 378 }
 379
 380 static void ohci_wakeup(USBPort *port1)
 381 {
 382     OHCIState *s = port1->opaque;
 383     OHCIPort *port = &s->rhport[port1->index];
 384     uint32_t intr = 0;
 385     if (port->ctrl & OHCI_PORT_PSS) {
 386         trace_usb_ohci_port_wakeup(port1->index);
 387         port->ctrl |= OHCI_PORT_PSSC;
 388         port->ctrl &= ~OHCI_PORT_PSS;
 389         intr = OHCI_INTR_RHSC;
 390     }
 391     /* Note that the controller can be suspended even if this port is not */
 392     if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND) {
 393         trace_usb_ohci_remote_wakeup(s->name);
 394         /* This is the one state transition the controller can do by itself */
 395         s->ctl &= ~OHCI_CTL_HCFS;
 396         s->ctl |= OHCI_USB_RESUME;
 397         /* In suspend mode only ResumeDetected is possible, not RHSC:
 398          * see the OHCI spec 5.1.2.3.
 399          */
 400         intr = OHCI_INTR_RD;
 401     }
 402     ohci_set_interrupt(s, intr);
 403 }
 404
 405 static void ohci_child_detach(USBPort *port1, USBDevice *child)
 406 {
 407     OHCIState *s = port1->opaque;
 408
 409     ohci_async_cancel_device(s, child);
 410 }
 411
 412 static USBDevice *ohci_find_device(OHCIState *ohci, uint8_t addr)
 413 {
 414     USBDevice *dev;
 415     int i;
 416
 417     for (i = 0; i < ohci->num_ports; i++) {
 418         if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0) {
 419             continue;
 420         }
 421         dev = usb_find_device(&ohci->rhport[i].port, addr);
 422         if (dev != NULL) {
 423             return dev;
 424         }
 425     }
 426     return NULL;
 427 }
 428
 429 static void ohci_stop_endpoints(OHCIState *ohci)
 430 {
 431     USBDevice *dev;
 432     int i, j;
 433
 434     for (i = 0; i < ohci->num_ports; i++) {
 435         dev = ohci->rhport[i].port.dev;
 436         if (dev && dev->attached) {
 437             usb_device_ep_stopped(dev, &dev->ep_ctl);
 438             for (j = 0; j < USB_MAX_ENDPOINTS; j++) {
 439                 usb_device_ep_stopped(dev, &dev->ep_in[j]);
 440                 usb_device_ep_stopped(dev, &dev->ep_out[j]);
 441             }
 442         }
 443     }
 444 }
 445
 446 static void ohci_roothub_reset(OHCIState *ohci)
 447 {
 448     OHCIPort *port;
 449     int i;
 450
 451     ohci_bus_stop(ohci);
 452     ohci->rhdesc_a = OHCI_RHA_NPS | ohci->num_ports;
 453     ohci->rhdesc_b = 0x0; /* Impl. specific */
 454     ohci->rhstatus = 0;
 455
 456     for (i = 0; i < ohci->num_ports; i++) {
 457         port = &ohci->rhport[i];
 458         port->ctrl = 0;
 459         if (port->port.dev && port->port.dev->attached) {
 460             usb_port_reset(&port->port);
 461         }
 462     }
 463     if (ohci->async_td) {
 464         usb_cancel_packet(&ohci->usb_packet);
 465         ohci->async_td = 0;
 466     }
 467     ohci_stop_endpoints(ohci);
 468 }
 469
 470 /* Reset the controller */
 471 static void ohci_soft_reset(OHCIState *ohci)
 472 {
 473     trace_usb_ohci_reset(ohci->name);
 474
 475     ohci_bus_stop(ohci);
 476     ohci->ctl = (ohci->ctl & OHCI_CTL_IR) | OHCI_USB_SUSPEND;
 477     ohci->old_ctl = 0;
 478     ohci->status = 0;
 479     ohci->intr_status = 0;
 480     ohci->intr = OHCI_INTR_MIE;
 481
 482     ohci->hcca = 0;
 483     ohci->ctrl_head = ohci->ctrl_cur = 0;
 484     ohci->bulk_head = ohci->bulk_cur = 0;
 485     ohci->per_cur = 0;
 486     ohci->done = 0;
 487     ohci->done_count = 7;
 488
 489     /* FSMPS is marked TBD in OCHI 1.0, what gives ffs?
 490      * I took the value linux sets ...
 491      */
 492     ohci->fsmps = 0x2778;
 493     ohci->fi = 0x2edf;
 494     ohci->fit = 0;
 495     ohci->frt = 0;
 496     ohci->frame_number = 0;
 497     ohci->pstart = 0;
 498     ohci->lst = OHCI_LS_THRESH;
 499 }
 500
 501 static void ohci_hard_reset(OHCIState *ohci)
 502 {
 503     ohci_soft_reset(ohci);
 504     ohci->ctl = 0;
 505     ohci_roothub_reset(ohci);
 506 }
 507
 508 /* Get an array of dwords from main memory */
 509 static inline int get_dwords(OHCIState *ohci,
 510                              dma_addr_t addr, uint32_t *buf, int num)
 511 {
 512     int i;
 513
 514     addr += ohci->localmem_base;
 515
 516     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 517         if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
 518             return -1;
 519         }
 520         *buf = le32_to_cpu(*buf);
 521     }
 522
 523     return 0;
 524 }
 525
 526 /* Put an array of dwords in to main memory */
 527 static inline int put_dwords(OHCIState *ohci,
 528                              dma_addr_t addr, uint32_t *buf, int num)
 529 {
 530     int i;
 531
 532     addr += ohci->localmem_base;
 533
 534     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 535         uint32_t tmp = cpu_to_le32(*buf);
 536         if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
 537             return -1;
 538         }
 539     }
 540
 541     return 0;
 542 }
 543
 544 /* Get an array of words from main memory */
 545 static inline int get_words(OHCIState *ohci,
 546                             dma_addr_t addr, uint16_t *buf, int num)
 547 {
 548     int i;
 549
 550     addr += ohci->localmem_base;
 551
 552     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 553         if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
 554             return -1;
 555         }
 556         *buf = le16_to_cpu(*buf);
 557     }
 558
 559     return 0;
 560 }
 561
 562 /* Put an array of words in to main memory */
 563 static inline int put_words(OHCIState *ohci,
 564                             dma_addr_t addr, uint16_t *buf, int num)
 565 {
 566     int i;
 567
 568     addr += ohci->localmem_base;
 569
 570     for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 571         uint16_t tmp = cpu_to_le16(*buf);
 572         if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
 573             return -1;
 574         }
 575     }
 576
 577     return 0;
 578 }
 579
 580 static inline int ohci_read_ed(OHCIState *ohci,
 581                                dma_addr_t addr, struct ohci_ed *ed)
 582 {
 583     return get_dwords(ohci, addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 584 }
 585
 586 static inline int ohci_read_td(OHCIState *ohci,
 587                                dma_addr_t addr, struct ohci_td *td)
 588 {
 589     return get_dwords(ohci, addr, (uint32_t *)td, sizeof(*td) >> 2);
 590 }
 591
 592 static inline int ohci_read_iso_td(OHCIState *ohci,
 593                                    dma_addr_t addr, struct ohci_iso_td *td)
 594 {
 595     return get_dwords(ohci, addr, (uint32_t *)td, 4) ||
 596            get_words(ohci, addr + 16, td->offset, 8);
 597 }
 598
 599 static inline int ohci_read_hcca(OHCIState *ohci,
 600                                  dma_addr_t addr, struct ohci_hcca *hcca)
 601 {
 602     return dma_memory_read(ohci->as, addr + ohci->localmem_base,
 603                            hcca, sizeof(*hcca));
 604 }
 605
 606 static inline int ohci_put_ed(OHCIState *ohci,
 607                               dma_addr_t addr, struct ohci_ed *ed)
 608 {
 609     /* ed->tail is under control of the HCD.
 610      * Since just ed->head is changed by HC, just write back this
 611      */
 612
 613     return put_dwords(ohci, addr + ED_WBACK_OFFSET,
 614                       (uint32_t *)((char *)ed + ED_WBACK_OFFSET),
 615                       ED_WBACK_SIZE >> 2);
 616 }
 617
 618 static inline int ohci_put_td(OHCIState *ohci,
 619                               dma_addr_t addr, struct ohci_td *td)
 620 {
 621     return put_dwords(ohci, addr, (uint32_t *)td, sizeof(*td) >> 2);
 622 }
 623
 624 static inline int ohci_put_iso_td(OHCIState *ohci,
 625                                   dma_addr_t addr, struct ohci_iso_td *td)
 626 {
 627     return put_dwords(ohci, addr, (uint32_t *)td, 4) ||
 628            put_words(ohci, addr + 16, td->offset, 8);
 629 }
 630
 631 static inline int ohci_put_hcca(OHCIState *ohci,
 632                                 dma_addr_t addr, struct ohci_hcca *hcca)
 633 {
 634     return dma_memory_write(ohci->as,
 635                             addr + ohci->localmem_base + HCCA_WRITEBACK_OFFSET,
 636                             (char *)hcca + HCCA_WRITEBACK_OFFSET,
 637                             HCCA_WRITEBACK_SIZE);
 638 }
 639
 640 /* Read/Write the contents of a TD from/to main memory.  */
 641 static int ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
 642                         uint8_t *buf, int len, DMADirection dir)
 643 {
 644     dma_addr_t ptr, n;
 645
 646     ptr = td->cbp;
 647     n = 0x1000 - (ptr & 0xfff);
 648     if (n > len)
 649         n = len;
 650
 651     if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
 652         return -1;
 653     }
 654     if (n == len) {
 655         return 0;
 656     }
 657     ptr = td->be & ~0xfffu;
 658     buf += n;
 659     if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
 660                       len - n, dir)) {
 661         return -1;
 662     }
 663     return 0;
 664 }
 665
 666 /* Read/Write the contents of an ISO TD from/to main memory.  */
 667 static int ohci_copy_iso_td(OHCIState *ohci,
 668                             uint32_t start_addr, uint32_t end_addr,
 669                             uint8_t *buf, int len, DMADirection dir)
 670 {
 671     dma_addr_t ptr, n;
 672
 673     ptr = start_addr;
 674     n = 0x1000 - (ptr & 0xfff);
 675     if (n > len)
 676         n = len;
 677
 678     if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
 679         return -1;
 680     }
 681     if (n == len) {
 682         return 0;
 683     }
 684     ptr = end_addr & ~0xfffu;
 685     buf += n;
 686     if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
 687                       len - n, dir)) {
 688         return -1;
 689     }
 690     return 0;
 691 }
 692
 693 static void ohci_process_lists(OHCIState *ohci, int completion);
 694
 695 static void ohci_async_complete_packet(USBPort *port, USBPacket *packet)
 696 {
 697     OHCIState *ohci = container_of(packet, OHCIState, usb_packet);
 698
 699     trace_usb_ohci_async_complete();
 700     ohci->async_complete = true;
 701     ohci_process_lists(ohci, 1);
 702 }
 703
 704 #define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
 705
 706 static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
 707                                int completion)
 708 {
 709     int dir;
 710     size_t len = 0;
 711     const char *str = NULL;
 712     int pid;
 713     int ret;
 714     int i;
 715     USBDevice *dev;
 716     USBEndpoint *ep;
 717     struct ohci_iso_td iso_td;
 718     uint32_t addr;
 719     uint16_t starting_frame;
 720     int16_t relative_frame_number;
 721     int frame_count;
 722     uint32_t start_offset, next_offset, end_offset = 0;
 723     uint32_t start_addr, end_addr;
 724
 725     addr = ed->head & OHCI_DPTR_MASK;
 726
 727     if (ohci_read_iso_td(ohci, addr, &iso_td)) {
 728         trace_usb_ohci_iso_td_read_failed(addr);
 729         ohci_die(ohci);
 730         return 1;
 731     }
 732
 733     starting_frame = OHCI_BM(iso_td.flags, TD_SF);
 734     frame_count = OHCI_BM(iso_td.flags, TD_FC);
 735     relative_frame_number = USUB(ohci->frame_number, starting_frame);
 736
 737     trace_usb_ohci_iso_td_head(
 738            ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
 739            iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
 740            ohci->frame_number, starting_frame,
 741            frame_count, relative_frame_number);
 742     trace_usb_ohci_iso_td_head_offset(
 743            iso_td.offset[0], iso_td.offset[1],
 744            iso_td.offset[2], iso_td.offset[3],
 745            iso_td.offset[4], iso_td.offset[5],
 746            iso_td.offset[6], iso_td.offset[7]);
 747
 748     if (relative_frame_number < 0) {
 749         trace_usb_ohci_iso_td_relative_frame_number_neg(relative_frame_number);
 750         return 1;
 751     } else if (relative_frame_number > frame_count) {
 752         /* ISO TD expired - retire the TD to the Done Queue and continue with
 753            the next ISO TD of the same ED */
 754         trace_usb_ohci_iso_td_relative_frame_number_big(relative_frame_number,
 755                                                         frame_count);
 756         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 757         ed->head &= ~OHCI_DPTR_MASK;
 758         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 759         iso_td.next = ohci->done;
 760         ohci->done = addr;
 761         i = OHCI_BM(iso_td.flags, TD_DI);
 762         if (i < ohci->done_count)
 763             ohci->done_count = i;
 764         if (ohci_put_iso_td(ohci, addr, &iso_td)) {
 765             ohci_die(ohci);
 766             return 1;
 767         }
 768         return 0;
 769     }
 770
 771     dir = OHCI_BM(ed->flags, ED_D);
 772     switch (dir) {
 773     case OHCI_TD_DIR_IN:
 774         str = "in";
 775         pid = USB_TOKEN_IN;
 776         break;
 777     case OHCI_TD_DIR_OUT:
 778         str = "out";
 779         pid = USB_TOKEN_OUT;
 780         break;
 781     case OHCI_TD_DIR_SETUP:
 782         str = "setup";
 783         pid = USB_TOKEN_SETUP;
 784         break;
 785     default:
 786         trace_usb_ohci_iso_td_bad_direction(dir);
 787         return 1;
 788     }
 789
 790     if (!iso_td.bp || !iso_td.be) {
 791         trace_usb_ohci_iso_td_bad_bp_be(iso_td.bp, iso_td.be);
 792         return 1;
 793     }
 794
 795     start_offset = iso_td.offset[relative_frame_number];
 796     next_offset = iso_td.offset[relative_frame_number + 1];
 797
 798     if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) ||
 799         ((relative_frame_number < frame_count) &&
 800          !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
 801         trace_usb_ohci_iso_td_bad_cc_not_accessed(start_offset, next_offset);
 802         return 1;
 803     }
 804
 805     if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
 806         trace_usb_ohci_iso_td_bad_cc_overrun(start_offset, next_offset);
 807         return 1;
 808     }
 809
 810     if ((start_offset & 0x1000) == 0) {
 811         start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 812             (start_offset & OHCI_OFFSET_MASK);
 813     } else {
 814         start_addr = (iso_td.be & OHCI_PAGE_MASK) |
 815             (start_offset & OHCI_OFFSET_MASK);
 816     }
 817
 818     if (relative_frame_number < frame_count) {
 819         end_offset = next_offset - 1;
 820         if ((end_offset & 0x1000) == 0) {
 821             end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 822                 (end_offset & OHCI_OFFSET_MASK);
 823         } else {
 824             end_addr = (iso_td.be & OHCI_PAGE_MASK) |
 825                 (end_offset & OHCI_OFFSET_MASK);
 826         }
 827     } else {
 828         /* Last packet in the ISO TD */
 829         end_addr = iso_td.be;
 830     }
 831
 832     if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
 833         len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
 834             - (start_addr & OHCI_OFFSET_MASK);
 835     } else {
 836         len = end_addr - start_addr + 1;
 837     }
 838
 839     if (len && dir != OHCI_TD_DIR_IN) {
 840         if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, len,
 841                              DMA_DIRECTION_TO_DEVICE)) {
 842             ohci_die(ohci);
 843             return 1;
 844         }
 845     }
 846
 847     if (!completion) {
 848         bool int_req = relative_frame_number == frame_count &&
 849                        OHCI_BM(iso_td.flags, TD_DI) == 0;
 850         dev = ohci_find_device(ohci, OHCI_BM(ed->flags, ED_FA));
 851         ep = usb_ep_get(dev, pid, OHCI_BM(ed->flags, ED_EN));
 852         usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, false, int_req);
 853         usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, len);
 854         usb_handle_packet(dev, &ohci->usb_packet);
 855         if (ohci->usb_packet.status == USB_RET_ASYNC) {
 856             usb_device_flush_ep_queue(dev, ep);
 857             return 1;
 858         }
 859     }
 860     if (ohci->usb_packet.status == USB_RET_SUCCESS) {
 861         ret = ohci->usb_packet.actual_length;
 862     } else {
 863         ret = ohci->usb_packet.status;
 864     }
 865
 866     trace_usb_ohci_iso_td_so(start_offset, end_offset, start_addr, end_addr,
 867                              str, len, ret);
 868
 869     /* Writeback */
 870     if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
 871         /* IN transfer succeeded */
 872         if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, ret,
 873                              DMA_DIRECTION_FROM_DEVICE)) {
 874             ohci_die(ohci);
 875             return 1;
 876         }
 877         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 878                     OHCI_CC_NOERROR);
 879         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
 880     } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
 881         /* OUT transfer succeeded */
 882         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 883                     OHCI_CC_NOERROR);
 884         OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
 885     } else {
 886         if (ret > (ssize_t) len) {
 887             trace_usb_ohci_iso_td_data_overrun(ret, len);
 888             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 889                         OHCI_CC_DATAOVERRUN);
 890             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 891                         len);
 892         } else if (ret >= 0) {
 893             trace_usb_ohci_iso_td_data_underrun(ret);
 894             OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 895                         OHCI_CC_DATAUNDERRUN);
 896         } else {
 897             switch (ret) {
 898             case USB_RET_IOERROR:
 899             case USB_RET_NODEV:
 900                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 901                             OHCI_CC_DEVICENOTRESPONDING);
 902                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 903                             0);
 904                 break;
 905             case USB_RET_NAK:
 906             case USB_RET_STALL:
 907                 trace_usb_ohci_iso_td_nak(ret);
 908                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 909                             OHCI_CC_STALL);
 910                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 911                             0);
 912                 break;
 913             default:
 914                 trace_usb_ohci_iso_td_bad_response(ret);
 915                 OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 916                             OHCI_CC_UNDEXPETEDPID);
 917                 break;
 918             }
 919         }
 920     }
 921
 922     if (relative_frame_number == frame_count) {
 923         /* Last data packet of ISO TD - retire the TD to the Done Queue */
 924         OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
 925         ed->head &= ~OHCI_DPTR_MASK;
 926         ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 927         iso_td.next = ohci->done;
 928         ohci->done = addr;
 929         i = OHCI_BM(iso_td.flags, TD_DI);
 930         if (i < ohci->done_count)
 931             ohci->done_count = i;
 932     }
 933     if (ohci_put_iso_td(ohci, addr, &iso_td)) {
 934         ohci_die(ohci);
 935     }
 936     return 1;
 937 }
 938
 939 #ifdef trace_event_get_state
 940 static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len)
 941 {
 942     bool print16 = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_SHORT);
 943     bool printall = !!trace_event_get_state(TRACE_USB_OHCI_TD_PKT_FULL);
 944     const int width = 16;
 945     int i;
 946     char tmp[3 * width + 1];
 947     char *p = tmp;
 948
 949     if (!printall && !print16) {
 950         return;
 951     }
 952
 953     for (i = 0; ; i++) {
 954         if (i && (!(i % width) || (i == len))) {
 955             if (!printall) {
 956                 trace_usb_ohci_td_pkt_short(msg, tmp);
 957                 break;
 958             }
 959             trace_usb_ohci_td_pkt_full(msg, tmp);
 960             p = tmp;
 961             *p = 0;
 962         }
 963         if (i == len) {
 964             break;
 965         }
 966
 967         p += sprintf(p, " %.2x", buf[i]);
 968     }
 969 }
 970 #else
 971 static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len)
 972 {
 973 }
 974 #endif
 975
 976 /* Service a transport descriptor.
 977    Returns nonzero to terminate processing of this endpoint.  */
 978
 979 static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 980 {
 981     int dir;
 982     size_t len = 0, pktlen = 0;
 983     const char *str = NULL;
 984     int pid;
 985     int ret;
 986     int i;
 987     USBDevice *dev;
 988     USBEndpoint *ep;
 989     struct ohci_td td;
 990     uint32_t addr;
 991     int flag_r;
 992     int completion;
 993
 994     addr = ed->head & OHCI_DPTR_MASK;
 995     /* See if this TD has already been submitted to the device.  */
 996     completion = (addr == ohci->async_td);
 997     if (completion && !ohci->async_complete) {
 998         trace_usb_ohci_td_skip_async();
 999         return 1;
1000     }
1001     if (ohci_read_td(ohci, addr, &td)) {
1002         trace_usb_ohci_td_read_error(addr);
1003         ohci_die(ohci);
1004         return 1;
1005     }
1006
1007     dir = OHCI_BM(ed->flags, ED_D);
1008     switch (dir) {
1009     case OHCI_TD_DIR_OUT:
1010     case OHCI_TD_DIR_IN:
1011         /* Same value.  */
1012         break;
1013     default:
1014         dir = OHCI_BM(td.flags, TD_DP);
1015         break;
1016     }
1017
1018     switch (dir) {
1019     case OHCI_TD_DIR_IN:
1020         str = "in";
1021         pid = USB_TOKEN_IN;
1022         break;
1023     case OHCI_TD_DIR_OUT:
1024         str = "out";
1025         pid = USB_TOKEN_OUT;
1026         break;
1027     case OHCI_TD_DIR_SETUP:
1028         str = "setup";
1029         pid = USB_TOKEN_SETUP;
1030         break;
1031     default:
1032         trace_usb_ohci_td_bad_direction(dir);
1033         return 1;
1034     }
1035     if (td.cbp && td.be) {
1036         if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) {
1037             len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff);
1038         } else {
1039             len = (td.be - td.cbp) + 1;
1040         }
1041
1042         pktlen = len;
1043         if (len && dir != OHCI_TD_DIR_IN) {
1044             /* The endpoint may not allow us to transfer it all now */
1045             pktlen = (ed->flags & OHCI_ED_MPS_MASK) >> OHCI_ED_MPS_SHIFT;
1046             if (pktlen > len) {
1047                 pktlen = len;
1048             }
1049             if (!completion) {
1050                 if (ohci_copy_td(ohci, &td, ohci->usb_buf, pktlen,
1051                                  DMA_DIRECTION_TO_DEVICE)) {
1052                     ohci_die(ohci);
1053                 }
1054             }
1055         }
1056     }
1057
1058     flag_r = (td.flags & OHCI_TD_R) != 0;
1059     trace_usb_ohci_td_pkt_hdr(addr, (int64_t)pktlen, (int64_t)len, str,
1060                               flag_r, td.cbp, td.be);
1061     ohci_td_pkt("OUT", ohci->usb_buf, pktlen);
1062
1063     if (completion) {
1064         ohci->async_td = 0;
1065         ohci->async_complete = false;
1066     } else {
1067         if (ohci->async_td) {
1068             /* ??? The hardware should allow one active packet per
1069                endpoint.  We only allow one active packet per controller.
1070                This should be sufficient as long as devices respond in a
1071                timely manner.
1072             */
1073             trace_usb_ohci_td_too_many_pending();
1074             return 1;
1075         }
1076         dev = ohci_find_device(ohci, OHCI_BM(ed->flags, ED_FA));
1077         ep = usb_ep_get(dev, pid, OHCI_BM(ed->flags, ED_EN));
1078         usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, !flag_r,
1079                          OHCI_BM(td.flags, TD_DI) == 0);
1080         usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, pktlen);
1081         usb_handle_packet(dev, &ohci->usb_packet);
1082         trace_usb_ohci_td_packet_status(ohci->usb_packet.status);
1083
1084         if (ohci->usb_packet.status == USB_RET_ASYNC) {
1085             usb_device_flush_ep_queue(dev, ep);
1086             ohci->async_td = addr;
1087             return 1;
1088         }
1089     }
1090     if (ohci->usb_packet.status == USB_RET_SUCCESS) {
1091         ret = ohci->usb_packet.actual_length;
1092     } else {
1093         ret = ohci->usb_packet.status;
1094     }
1095
1096     if (ret >= 0) {
1097         if (dir == OHCI_TD_DIR_IN) {
1098             if (ohci_copy_td(ohci, &td, ohci->usb_buf, ret,
1099                              DMA_DIRECTION_FROM_DEVICE)) {
1100                 ohci_die(ohci);
1101             }
1102             ohci_td_pkt("IN", ohci->usb_buf, pktlen);
1103         } else {
1104             ret = pktlen;
1105         }
1106     }
1107
1108     /* Writeback */
1109     if (ret == pktlen || (dir == OHCI_TD_DIR_IN && ret >= 0 && flag_r)) {
1110         /* Transmission succeeded.  */
1111         if (ret == len) {
1112             td.cbp = 0;
1113         } else {
1114             if ((td.cbp & 0xfff) + ret > 0xfff) {
1115                 td.cbp = (td.be & ~0xfff) + ((td.cbp + ret) & 0xfff);
1116             } else {
1117                 td.cbp += ret;
1118             }
1119         }
1120         td.flags |= OHCI_TD_T1;
1121         td.flags ^= OHCI_TD_T0;
1122         OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_NOERROR);
1123         OHCI_SET_BM(td.flags, TD_EC, 0);
1124
1125         if ((dir != OHCI_TD_DIR_IN) && (ret != len)) {
1126             /* Partial packet transfer: TD not ready to retire yet */
1127             goto exit_no_retire;
1128         }
1129
1130         /* Setting ED_C is part of the TD retirement process */
1131         ed->head &= ~OHCI_ED_C;
1132         if (td.flags & OHCI_TD_T0)
1133             ed->head |= OHCI_ED_C;
1134     } else {
1135         if (ret >= 0) {
1136             trace_usb_ohci_td_underrun();
1137             OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAUNDERRUN);
1138         } else {
1139             switch (ret) {
1140             case USB_RET_IOERROR:
1141             case USB_RET_NODEV:
1142                 trace_usb_ohci_td_dev_error();
1143                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DEVICENOTRESPONDING);
1144                 break;
1145             case USB_RET_NAK:
1146                 trace_usb_ohci_td_nak();
1147                 return 1;
1148             case USB_RET_STALL:
1149                 trace_usb_ohci_td_stall();
1150                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_STALL);
1151                 break;
1152             case USB_RET_BABBLE:
1153                 trace_usb_ohci_td_babble();
1154                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
1155                 break;
1156             default:
1157                 trace_usb_ohci_td_bad_device_response(ret);
1158                 OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_UNDEXPETEDPID);
1159                 OHCI_SET_BM(td.flags, TD_EC, 3);
1160                 break;
1161             }
1162         }
1163         ed->head |= OHCI_ED_H;
1164     }
1165
1166     /* Retire this TD */
1167     ed->head &= ~OHCI_DPTR_MASK;
1168     ed->head |= td.next & OHCI_DPTR_MASK;
1169     td.next = ohci->done;
1170     ohci->done = addr;
1171     i = OHCI_BM(td.flags, TD_DI);
1172     if (i < ohci->done_count)
1173         ohci->done_count = i;
1174 exit_no_retire:
1175     if (ohci_put_td(ohci, addr, &td)) {
1176         ohci_die(ohci);
1177         return 1;
1178     }
1179     return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR;
1180 }
1181
1182 /* Service an endpoint list.  Returns nonzero if active TD were found.  */
1183 static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
1184 {
1185     struct ohci_ed ed;
1186     uint32_t next_ed;
1187     uint32_t cur;
1188     int active;
1189     uint32_t link_cnt = 0;
1190     active = 0;
1191
1192     if (head == 0)
1193         return 0;
1194
1195     for (cur = head; cur; cur = next_ed) {
1196         if (ohci_read_ed(ohci, cur, &ed)) {
1197             trace_usb_ohci_ed_read_error(cur);
1198             ohci_die(ohci);
1199             return 0;
1200         }
1201
1202         next_ed = ed.next & OHCI_DPTR_MASK;
1203
1204         if (++link_cnt > ED_LINK_LIMIT) {
1205             ohci_die(ohci);
1206             return 0;
1207         }
1208
1209         if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
1210             uint32_t addr;
1211             /* Cancel pending packets for ED that have been paused.  */
1212             addr = ed.head & OHCI_DPTR_MASK;
1213             if (ohci->async_td && addr == ohci->async_td) {
1214                 usb_cancel_packet(&ohci->usb_packet);
1215                 ohci->async_td = 0;
1216                 usb_device_ep_stopped(ohci->usb_packet.ep->dev,
1217                                       ohci->usb_packet.ep);
1218             }
1219             continue;
1220         }
1221
1222         while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
1223             trace_usb_ohci_ed_pkt(cur, (ed.head & OHCI_ED_H) != 0,
1224                     (ed.head & OHCI_ED_C) != 0, ed.head & OHCI_DPTR_MASK,
1225                     ed.tail & OHCI_DPTR_MASK, ed.next & OHCI_DPTR_MASK);
1226             trace_usb_ohci_ed_pkt_flags(
1227                     OHCI_BM(ed.flags, ED_FA), OHCI_BM(ed.flags, ED_EN),
1228                     OHCI_BM(ed.flags, ED_D), (ed.flags & OHCI_ED_S)!= 0,
1229                     (ed.flags & OHCI_ED_K) != 0, (ed.flags & OHCI_ED_F) != 0,
1230                     OHCI_BM(ed.flags, ED_MPS));
1231
1232             active = 1;
1233
1234             if ((ed.flags & OHCI_ED_F) == 0) {
1235                 if (ohci_service_td(ohci, &ed))
1236                     break;
1237             } else {
1238                 /* Handle isochronous endpoints */
1239                 if (ohci_service_iso_td(ohci, &ed, completion))
1240                     break;
1241             }
1242         }
1243
1244         if (ohci_put_ed(ohci, cur, &ed)) {
1245             ohci_die(ohci);
1246             return 0;
1247         }
1248     }
1249
1250     return active;
1251 }
1252
1253 /* set a timer for EOF */
1254 static void ohci_eof_timer(OHCIState *ohci)
1255 {
1256     ohci->sof_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1257     timer_mod(ohci->eof_timer, ohci->sof_time + usb_frame_time);
1258 }
1259 /* Set a timer for EOF and generate a SOF event */
1260 static void ohci_sof(OHCIState *ohci)
1261 {
1262     ohci_eof_timer(ohci);
1263     ohci_set_interrupt(ohci, OHCI_INTR_SF);
1264 }
1265
1266 /* Process Control and Bulk lists.  */
1267 static void ohci_process_lists(OHCIState *ohci, int completion)
1268 {
1269     if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
1270         if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head) {
1271             trace_usb_ohci_process_lists(ohci->ctrl_head, ohci->ctrl_cur);
1272         }
1273         if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
1274             ohci->ctrl_cur = 0;
1275             ohci->status &= ~OHCI_STATUS_CLF;
1276         }
1277     }
1278
1279     if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
1280         if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
1281             ohci->bulk_cur = 0;
1282             ohci->status &= ~OHCI_STATUS_BLF;
1283         }
1284     }
1285 }
1286
1287 /* Do frame processing on frame boundary */
1288 static void ohci_frame_boundary(void *opaque)
1289 {
1290     OHCIState *ohci = opaque;
1291     struct ohci_hcca hcca;
1292
1293     if (ohci_read_hcca(ohci, ohci->hcca, &hcca)) {
1294         trace_usb_ohci_hcca_read_error(ohci->hcca);
1295         ohci_die(ohci);
1296         return;
1297     }
1298
1299     /* Process all the lists at the end of the frame */
1300     if (ohci->ctl & OHCI_CTL_PLE) {
1301         int n;
1302
1303         n = ohci->frame_number & 0x1f;
1304         ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
1305     }
1306
1307     /* Cancel all pending packets if either of the lists has been disabled.  */
1308     if (ohci->old_ctl & (~ohci->ctl) & (OHCI_CTL_BLE | OHCI_CTL_CLE)) {
1309         if (ohci->async_td) {
1310             usb_cancel_packet(&ohci->usb_packet);
1311             ohci->async_td = 0;
1312         }
1313         ohci_stop_endpoints(ohci);
1314     }
1315     ohci->old_ctl = ohci->ctl;
1316     ohci_process_lists(ohci, 0);
1317
1318     /* Stop if UnrecoverableError happened or ohci_sof will crash */
1319     if (ohci->intr_status & OHCI_INTR_UE) {
1320         return;
1321     }
1322
1323     /* Frame boundary, so do EOF stuf here */
1324     ohci->frt = ohci->fit;
1325
1326     /* Increment frame number and take care of endianness. */
1327     ohci->frame_number = (ohci->frame_number + 1) & 0xffff;
1328     hcca.frame = cpu_to_le16(ohci->frame_number);
1329
1330     if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) {
1331         if (!ohci->done)
1332             abort();
1333         if (ohci->intr & ohci->intr_status)
1334             ohci->done |= 1;
1335         hcca.done = cpu_to_le32(ohci->done);
1336         ohci->done = 0;
1337         ohci->done_count = 7;
1338         ohci_set_interrupt(ohci, OHCI_INTR_WD);
1339     }
1340
1341     if (ohci->done_count != 7 && ohci->done_count != 0)
1342         ohci->done_count--;
1343
1344     /* Do SOF stuff here */
1345     ohci_sof(ohci);
1346
1347     /* Writeback HCCA */
1348     if (ohci_put_hcca(ohci, ohci->hcca, &hcca)) {
1349         ohci_die(ohci);
1350     }
1351 }
1352
1353 /* Start sending SOF tokens across the USB bus, lists are processed in
1354  * next frame
1355  */
1356 static int ohci_bus_start(OHCIState *ohci)
1357 {
1358     trace_usb_ohci_start(ohci->name);
1359
1360     /* Delay the first SOF event by one frame time as
1361      * linux driver is not ready to receive it and
1362      * can meet some race conditions
1363      */
1364
1365     ohci_eof_timer(ohci);
1366
1367     return 1;
1368 }
1369
1370 /* Stop sending SOF tokens on the bus */
1371 static void ohci_bus_stop(OHCIState *ohci)
1372 {
1373     trace_usb_ohci_stop(ohci->name);
1374     timer_del(ohci->eof_timer);
1375 }
1376
1377 /* Sets a flag in a port status register but only set it if the port is
1378  * connected, if not set ConnectStatusChange flag. If flag is enabled
1379  * return 1.
1380  */
1381 static int ohci_port_set_if_connected(OHCIState *ohci, int i, uint32_t val)
1382 {
1383     int ret = 1;
1384
1385     /* writing a 0 has no effect */
1386     if (val == 0)
1387         return 0;
1388
1389     /* If CurrentConnectStatus is cleared we set
1390      * ConnectStatusChange
1391      */
1392     if (!(ohci->rhport[i].ctrl & OHCI_PORT_CCS)) {
1393         ohci->rhport[i].ctrl |= OHCI_PORT_CSC;
1394         if (ohci->rhstatus & OHCI_RHS_DRWE) {
1395             /* TODO: CSC is a wakeup event */
1396         }
1397         return 0;
1398     }
1399
1400     if (ohci->rhport[i].ctrl & val)
1401         ret = 0;
1402
1403     /* set the bit */
1404     ohci->rhport[i].ctrl |= val;
1405
1406     return ret;
1407 }
1408
1409 /* Set the frame interval - frame interval toggle is manipulated by the hcd only */
1410 static void ohci_set_frame_interval(OHCIState *ohci, uint16_t val)
1411 {
1412     val &= OHCI_FMI_FI;
1413
1414     if (val != ohci->fi) {
1415         trace_usb_ohci_set_frame_interval(ohci->name, ohci->fi, ohci->fi);
1416     }
1417
1418     ohci->fi = val;
1419 }
1420
1421 static void ohci_port_power(OHCIState *ohci, int i, int p)
1422 {
1423     if (p) {
1424         ohci->rhport[i].ctrl |= OHCI_PORT_PPS;
1425     } else {
1426         ohci->rhport[i].ctrl &= ~(OHCI_PORT_PPS|
1427                     OHCI_PORT_CCS|
1428                     OHCI_PORT_PSS|
1429                     OHCI_PORT_PRS);
1430     }
1431 }
1432
1433 /* Set HcControlRegister */
1434 static void ohci_set_ctl(OHCIState *ohci, uint32_t val)
1435 {
1436     uint32_t old_state;
1437     uint32_t new_state;
1438
1439     old_state = ohci->ctl & OHCI_CTL_HCFS;
1440     ohci->ctl = val;
1441     new_state = ohci->ctl & OHCI_CTL_HCFS;
1442
1443     /* no state change */
1444     if (old_state == new_state)
1445         return;
1446
1447     trace_usb_ohci_set_ctl(ohci->name, new_state);
1448     switch (new_state) {
1449     case OHCI_USB_OPERATIONAL:
1450         ohci_bus_start(ohci);
1451         break;
1452     case OHCI_USB_SUSPEND:
1453         ohci_bus_stop(ohci);
1454         /* clear pending SF otherwise linux driver loops in ohci_irq() */
1455         ohci->intr_status &= ~OHCI_INTR_SF;
1456         ohci_intr_update(ohci);
1457         break;
1458     case OHCI_USB_RESUME:
1459         trace_usb_ohci_resume(ohci->name);
1460         break;
1461     case OHCI_USB_RESET:
1462         ohci_roothub_reset(ohci);
1463         break;
1464     }
1465 }
1466
1467 static uint32_t ohci_get_frame_remaining(OHCIState *ohci)
1468 {
1469     uint16_t fr;
1470     int64_t tks;
1471
1472     if ((ohci->ctl & OHCI_CTL_HCFS) != OHCI_USB_OPERATIONAL)
1473         return (ohci->frt << 31);
1474
1475     /* Being in USB operational state guarnatees sof_time was
1476      * set already.
1477      */
1478     tks = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - ohci->sof_time;
1479
1480     /* avoid muldiv if possible */
1481     if (tks >= usb_frame_time)
1482         return (ohci->frt << 31);
1483
1484     tks = tks / usb_bit_time;
1485     fr = (uint16_t)(ohci->fi - tks);
1486
1487     return (ohci->frt << 31) | fr;
1488 }
1489
1490
1491 /* Set root hub status */
1492 static void ohci_set_hub_status(OHCIState *ohci, uint32_t val)
1493 {
1494     uint32_t old_state;
1495
1496     old_state = ohci->rhstatus;
1497
1498     /* write 1 to clear OCIC */
1499     if (val & OHCI_RHS_OCIC)
1500         ohci->rhstatus &= ~OHCI_RHS_OCIC;
1501
1502     if (val & OHCI_RHS_LPS) {
1503         int i;
1504
1505         for (i = 0; i < ohci->num_ports; i++)
1506             ohci_port_power(ohci, i, 0);
1507         trace_usb_ohci_hub_power_down();
1508     }
1509
1510     if (val & OHCI_RHS_LPSC) {
1511         int i;
1512
1513         for (i = 0; i < ohci->num_ports; i++)
1514             ohci_port_power(ohci, i, 1);
1515         trace_usb_ohci_hub_power_up();
1516     }
1517
1518     if (val & OHCI_RHS_DRWE)
1519         ohci->rhstatus |= OHCI_RHS_DRWE;
1520
1521     if (val & OHCI_RHS_CRWE)
1522         ohci->rhstatus &= ~OHCI_RHS_DRWE;
1523
1524     if (old_state != ohci->rhstatus)
1525         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1526 }
1527
1528 /* Set root hub port status */
1529 static void ohci_port_set_status(OHCIState *ohci, int portnum, uint32_t val)
1530 {
1531     uint32_t old_state;
1532     OHCIPort *port;
1533
1534     port = &ohci->rhport[portnum];
1535     old_state = port->ctrl;
1536
1537     /* Write to clear CSC, PESC, PSSC, OCIC, PRSC */
1538     if (val & OHCI_PORT_WTC)
1539         port->ctrl &= ~(val & OHCI_PORT_WTC);
1540
1541     if (val & OHCI_PORT_CCS)
1542         port->ctrl &= ~OHCI_PORT_PES;
1543
1544     ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PES);
1545
1546     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PSS)) {
1547         trace_usb_ohci_port_suspend(portnum);
1548     }
1549
1550     if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PRS)) {
1551         trace_usb_ohci_port_reset(portnum);
1552         usb_device_reset(port->port.dev);
1553         port->ctrl &= ~OHCI_PORT_PRS;
1554         /* ??? Should this also set OHCI_PORT_PESC.  */
1555         port->ctrl |= OHCI_PORT_PES | OHCI_PORT_PRSC;
1556     }
1557
1558     /* Invert order here to ensure in ambiguous case, device is
1559      * powered up...
1560      */
1561     if (val & OHCI_PORT_LSDA)
1562         ohci_port_power(ohci, portnum, 0);
1563     if (val & OHCI_PORT_PPS)
1564         ohci_port_power(ohci, portnum, 1);
1565
1566     if (old_state != port->ctrl)
1567         ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1568 }
1569
1570 static uint64_t ohci_mem_read(void *opaque,
1571                               hwaddr addr,
1572                               unsigned size)
1573 {
1574     OHCIState *ohci = opaque;
1575     uint32_t retval;
1576
1577     /* Only aligned reads are allowed on OHCI */
1578     if (addr & 3) {
1579         trace_usb_ohci_mem_read_unaligned(addr);
1580         return 0xffffffff;
1581     } else if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1582         /* HcRhPortStatus */
1583         retval = ohci->rhport[(addr - 0x54) >> 2].ctrl | OHCI_PORT_PPS;
1584     } else {
1585         switch (addr >> 2) {
1586         case 0: /* HcRevision */
1587             retval = 0x10;
1588             break;
1589
1590         case 1: /* HcControl */
1591             retval = ohci->ctl;
1592             break;
1593
1594         case 2: /* HcCommandStatus */
1595             retval = ohci->status;
1596             break;
1597
1598         case 3: /* HcInterruptStatus */
1599             retval = ohci->intr_status;
1600             break;
1601
1602         case 4: /* HcInterruptEnable */
1603         case 5: /* HcInterruptDisable */
1604             retval = ohci->intr;
1605             break;
1606
1607         case 6: /* HcHCCA */
1608             retval = ohci->hcca;
1609             break;
1610
1611         case 7: /* HcPeriodCurrentED */
1612             retval = ohci->per_cur;
1613             break;
1614
1615         case 8: /* HcControlHeadED */
1616             retval = ohci->ctrl_head;
1617             break;
1618
1619         case 9: /* HcControlCurrentED */
1620             retval = ohci->ctrl_cur;
1621             break;
1622
1623         case 10: /* HcBulkHeadED */
1624             retval = ohci->bulk_head;
1625             break;
1626
1627         case 11: /* HcBulkCurrentED */
1628             retval = ohci->bulk_cur;
1629             break;
1630
1631         case 12: /* HcDoneHead */
1632             retval = ohci->done;
1633             break;
1634
1635         case 13: /* HcFmInterretval */
1636             retval = (ohci->fit << 31) | (ohci->fsmps << 16) | (ohci->fi);
1637             break;
1638
1639         case 14: /* HcFmRemaining */
1640             retval = ohci_get_frame_remaining(ohci);
1641             break;
1642
1643         case 15: /* HcFmNumber */
1644             retval = ohci->frame_number;
1645             break;
1646
1647         case 16: /* HcPeriodicStart */
1648             retval = ohci->pstart;
1649             break;
1650
1651         case 17: /* HcLSThreshold */
1652             retval = ohci->lst;
1653             break;
1654
1655         case 18: /* HcRhDescriptorA */
1656             retval = ohci->rhdesc_a;
1657             break;
1658
1659         case 19: /* HcRhDescriptorB */
1660             retval = ohci->rhdesc_b;
1661             break;
1662
1663         case 20: /* HcRhStatus */
1664             retval = ohci->rhstatus;
1665             break;
1666
1667         /* PXA27x specific registers */
1668         case 24: /* HcStatus */
1669             retval = ohci->hstatus & ohci->hmask;
1670             break;
1671
1672         case 25: /* HcHReset */
1673             retval = ohci->hreset;
1674             break;
1675
1676         case 26: /* HcHInterruptEnable */
1677             retval = ohci->hmask;
1678             break;
1679
1680         case 27: /* HcHInterruptTest */
1681             retval = ohci->htest;
1682             break;
1683
1684         default:
1685             trace_usb_ohci_mem_read_bad_offset(addr);
1686             retval = 0xffffffff;
1687         }
1688     }
1689
1690     return retval;
1691 }
1692
1693 static void ohci_mem_write(void *opaque,
1694                            hwaddr addr,
1695                            uint64_t val,
1696                            unsigned size)
1697 {
1698     OHCIState *ohci = opaque;
1699
1700     /* Only aligned reads are allowed on OHCI */
1701     if (addr & 3) {
1702         trace_usb_ohci_mem_write_unaligned(addr);
1703         return;
1704     }
1705
1706     if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1707         /* HcRhPortStatus */
1708         ohci_port_set_status(ohci, (addr - 0x54) >> 2, val);
1709         return;
1710     }
1711
1712     switch (addr >> 2) {
1713     case 1: /* HcControl */
1714         ohci_set_ctl(ohci, val);
1715         break;
1716
1717     case 2: /* HcCommandStatus */
1718         /* SOC is read-only */
1719         val = (val & ~OHCI_STATUS_SOC);
1720
1721         /* Bits written as '0' remain unchanged in the register */
1722         ohci->status |= val;
1723
1724         if (ohci->status & OHCI_STATUS_HCR)
1725             ohci_soft_reset(ohci);
1726         break;
1727
1728     case 3: /* HcInterruptStatus */
1729         ohci->intr_status &= ~val;
1730         ohci_intr_update(ohci);
1731         break;
1732
1733     case 4: /* HcInterruptEnable */
1734         ohci->intr |= val;
1735         ohci_intr_update(ohci);
1736         break;
1737
1738     case 5: /* HcInterruptDisable */
1739         ohci->intr &= ~val;
1740         ohci_intr_update(ohci);
1741         break;
1742
1743     case 6: /* HcHCCA */
1744         ohci->hcca = val & OHCI_HCCA_MASK;
1745         break;
1746
1747     case 7: /* HcPeriodCurrentED */
1748         /* Ignore writes to this read-only register, Linux does them */
1749         break;
1750
1751     case 8: /* HcControlHeadED */
1752         ohci->ctrl_head = val & OHCI_EDPTR_MASK;
1753         break;
1754
1755     case 9: /* HcControlCurrentED */
1756         ohci->ctrl_cur = val & OHCI_EDPTR_MASK;
1757         break;
1758
1759     case 10: /* HcBulkHeadED */
1760         ohci->bulk_head = val & OHCI_EDPTR_MASK;
1761         break;
1762
1763     case 11: /* HcBulkCurrentED */
1764         ohci->bulk_cur = val & OHCI_EDPTR_MASK;
1765         break;
1766
1767     case 13: /* HcFmInterval */
1768         ohci->fsmps = (val & OHCI_FMI_FSMPS) >> 16;
1769         ohci->fit = (val & OHCI_FMI_FIT) >> 31;
1770         ohci_set_frame_interval(ohci, val);
1771         break;
1772
1773     case 15: /* HcFmNumber */
1774         break;
1775
1776     case 16: /* HcPeriodicStart */
1777         ohci->pstart = val & 0xffff;
1778         break;
1779
1780     case 17: /* HcLSThreshold */
1781         ohci->lst = val & 0xffff;
1782         break;
1783
1784     case 18: /* HcRhDescriptorA */
1785         ohci->rhdesc_a &= ~OHCI_RHA_RW_MASK;
1786         ohci->rhdesc_a |= val & OHCI_RHA_RW_MASK;
1787         break;
1788
1789     case 19: /* HcRhDescriptorB */
1790         break;
1791
1792     case 20: /* HcRhStatus */
1793         ohci_set_hub_status(ohci, val);
1794         break;
1795
1796     /* PXA27x specific registers */
1797     case 24: /* HcStatus */
1798         ohci->hstatus &= ~(val & ohci->hmask);
1799         break;
1800
1801     case 25: /* HcHReset */
1802         ohci->hreset = val & ~OHCI_HRESET_FSBIR;
1803         if (val & OHCI_HRESET_FSBIR)
1804             ohci_hard_reset(ohci);
1805         break;
1806
1807     case 26: /* HcHInterruptEnable */
1808         ohci->hmask = val;
1809         break;
1810
1811     case 27: /* HcHInterruptTest */
1812         ohci->htest = val;
1813         break;
1814
1815     default:
1816         trace_usb_ohci_mem_write_bad_offset(addr);
1817         break;
1818     }
1819 }
1820
1821 static void ohci_async_cancel_device(OHCIState *ohci, USBDevice *dev)
1822 {
1823     if (ohci->async_td &&
1824         usb_packet_is_inflight(&ohci->usb_packet) &&
1825         ohci->usb_packet.ep->dev == dev) {
1826         usb_cancel_packet(&ohci->usb_packet);
1827         ohci->async_td = 0;
1828     }
1829 }
1830
1831 static const MemoryRegionOps ohci_mem_ops = {
1832     .read = ohci_mem_read,
1833     .write = ohci_mem_write,
1834     .endianness = DEVICE_LITTLE_ENDIAN,
1835 };
1836
1837 static USBPortOps ohci_port_ops = {
1838     .attach = ohci_attach,
1839     .detach = ohci_detach,
1840     .child_detach = ohci_child_detach,
1841     .wakeup = ohci_wakeup,
1842     .complete = ohci_async_complete_packet,
1843 };
1844
1845 static USBBusOps ohci_bus_ops = {
1846 };
1847
1848 static void usb_ohci_init(OHCIState *ohci, DeviceState *dev,
1849                           int num_ports, dma_addr_t localmem_base,
1850                           char *masterbus, uint32_t firstport,
1851                           AddressSpace *as, Error **errp)
1852 {
1853     Error *err = NULL;
1854     int i;
1855
1856     ohci->as = as;
1857
1858     if (num_ports > OHCI_MAX_PORTS) {
1859         error_setg(errp, "OHCI num-ports=%d is too big (limit is %d ports)",
1860                    num_ports, OHCI_MAX_PORTS);
1861         return;
1862     }
1863
1864     if (usb_frame_time == 0) {
1865 #ifdef OHCI_TIME_WARP
1866         usb_frame_time = NANOSECONDS_PER_SECOND;
1867         usb_bit_time = NANOSECONDS_PER_SECOND / (USB_HZ / 1000);
1868 #else
1869         usb_frame_time = NANOSECONDS_PER_SECOND / 1000;
1870         if (NANOSECONDS_PER_SECOND >= USB_HZ) {
1871             usb_bit_time = NANOSECONDS_PER_SECOND / USB_HZ;
1872         } else {
1873             usb_bit_time = 1;
1874         }
1875 #endif
1876         trace_usb_ohci_init_time(usb_frame_time, usb_bit_time);
1877     }
1878
1879     ohci->num_ports = num_ports;
1880     if (masterbus) {
1881         USBPort *ports[OHCI_MAX_PORTS];
1882         for(i = 0; i < num_ports; i++) {
1883             ports[i] = &ohci->rhport[i].port;
1884         }
1885         usb_register_companion(masterbus, ports, num_ports,
1886                                firstport, ohci, &ohci_port_ops,
1887                                USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL,
1888                                &err);
1889         if (err) {
1890             error_propagate(errp, err);
1891             return;
1892         }
1893     } else {
1894         usb_bus_new(&ohci->bus, sizeof(ohci->bus), &ohci_bus_ops, dev);
1895         for (i = 0; i < num_ports; i++) {
1896             usb_register_port(&ohci->bus, &ohci->rhport[i].port,
1897                               ohci, i, &ohci_port_ops,
1898                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1899         }
1900     }
1901
1902     memory_region_init_io(&ohci->mem, OBJECT(dev), &ohci_mem_ops,
1903                           ohci, "ohci", 256);
1904     ohci->localmem_base = localmem_base;
1905
1906     ohci->name = object_get_typename(OBJECT(dev));
1907     usb_packet_init(&ohci->usb_packet);
1908
1909     ohci->async_td = 0;
1910
1911     ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1912                                    ohci_frame_boundary, ohci);
1913 }
1914
1915 #define TYPE_PCI_OHCI "pci-ohci"
1916 #define PCI_OHCI(obj) OBJECT_CHECK(OHCIPCIState, (obj), TYPE_PCI_OHCI)
1917
1918 typedef struct {
1919     /*< private >*/
1920     PCIDevice parent_obj;
1921     /*< public >*/
1922
1923     OHCIState state;
1924     char *masterbus;
1925     uint32_t num_ports;
1926     uint32_t firstport;
1927 } OHCIPCIState;
1928
1929 /** A typical O/EHCI will stop operating, set itself into error state
1930  * (which can be queried by MMIO) and will set PERR in its config
1931  * space to signal that it got an error
1932  */
1933 static void ohci_die(OHCIState *ohci)
1934 {
1935     OHCIPCIState *dev = container_of(ohci, OHCIPCIState, state);
1936
1937     trace_usb_ohci_die();
1938
1939     ohci_set_interrupt(ohci, OHCI_INTR_UE);
1940     ohci_bus_stop(ohci);
1941     pci_set_word(dev->parent_obj.config + PCI_STATUS,
1942                  PCI_STATUS_DETECTED_PARITY);
1943 }
1944
1945 static void usb_ohci_realize_pci(PCIDevice *dev, Error **errp)
1946 {
1947     Error *err = NULL;
1948     OHCIPCIState *ohci = PCI_OHCI(dev);
1949
1950     dev->config[PCI_CLASS_PROG] = 0x10; /* OHCI */
1951     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
1952
1953     usb_ohci_init(&ohci->state, DEVICE(dev), ohci->num_ports, 0,
1954                   ohci->masterbus, ohci->firstport,
1955                   pci_get_address_space(dev), &err);
1956     if (err) {
1957         error_propagate(errp, err);
1958         return;
1959     }
1960
1961     ohci->state.irq = pci_allocate_irq(dev);
1962     pci_register_bar(dev, 0, 0, &ohci->state.mem);
1963 }
1964
1965 static void usb_ohci_exit(PCIDevice *dev)
1966 {
1967     OHCIPCIState *ohci = PCI_OHCI(dev);
1968     OHCIState *s = &ohci->state;
1969
1970     trace_usb_ohci_exit(s->name);
1971     ohci_bus_stop(s);
1972
1973     if (s->async_td) {
1974         usb_cancel_packet(&s->usb_packet);
1975         s->async_td = 0;
1976     }
1977     ohci_stop_endpoints(s);
1978
1979     if (!ohci->masterbus) {
1980         usb_bus_release(&s->bus);
1981     }
1982
1983     timer_del(s->eof_timer);
1984     timer_free(s->eof_timer);
1985 }
1986
1987 static void usb_ohci_reset_pci(DeviceState *d)
1988 {
1989     PCIDevice *dev = PCI_DEVICE(d);
1990     OHCIPCIState *ohci = PCI_OHCI(dev);
1991     OHCIState *s = &ohci->state;
1992
1993     ohci_hard_reset(s);
1994 }
1995
1996 #define TYPE_SYSBUS_OHCI "sysbus-ohci"
1997 #define SYSBUS_OHCI(obj) OBJECT_CHECK(OHCISysBusState, (obj), TYPE_SYSBUS_OHCI)
1998
1999 typedef struct {
2000     /*< private >*/
2001     SysBusDevice parent_obj;
2002     /*< public >*/
2003
2004     OHCIState ohci;
2005     uint32_t num_ports;
2006     dma_addr_t dma_offset;
2007 } OHCISysBusState;
2008
2009 static void ohci_realize_pxa(DeviceState *dev, Error **errp)
2010 {
2011     OHCISysBusState *s = SYSBUS_OHCI(dev);
2012     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
2013
2014     /* Cannot fail as we pass NULL for masterbus */
2015     usb_ohci_init(&s->ohci, dev, s->num_ports, s->dma_offset, NULL, 0,
2016                   &address_space_memory, &error_abort);
2017     sysbus_init_irq(sbd, &s->ohci.irq);
2018     sysbus_init_mmio(sbd, &s->ohci.mem);
2019 }
2020
2021 static void usb_ohci_reset_sysbus(DeviceState *dev)
2022 {
2023     OHCISysBusState *s = SYSBUS_OHCI(dev);
2024     OHCIState *ohci = &s->ohci;
2025
2026     ohci_hard_reset(ohci);
2027 }
2028
2029 static Property ohci_pci_properties[] = {
2030     DEFINE_PROP_STRING("masterbus", OHCIPCIState, masterbus),
2031     DEFINE_PROP_UINT32("num-ports", OHCIPCIState, num_ports, 3),
2032     DEFINE_PROP_UINT32("firstport", OHCIPCIState, firstport, 0),
2033     DEFINE_PROP_END_OF_LIST(),
2034 };
2035
2036 static const VMStateDescription vmstate_ohci_state_port = {
2037     .name = "ohci-core/port",
2038     .version_id = 1,
2039     .minimum_version_id = 1,
2040     .fields = (VMStateField[]) {
2041         VMSTATE_UINT32(ctrl, OHCIPort),
2042         VMSTATE_END_OF_LIST()
2043     },
2044 };
2045
2046 static bool ohci_eof_timer_needed(void *opaque)
2047 {
2048     OHCIState *ohci = opaque;
2049
2050     return timer_pending(ohci->eof_timer);
2051 }
2052
2053 static const VMStateDescription vmstate_ohci_eof_timer = {
2054     .name = "ohci-core/eof-timer",
2055     .version_id = 1,
2056     .minimum_version_id = 1,
2057     .needed = ohci_eof_timer_needed,
2058     .fields = (VMStateField[]) {
2059         VMSTATE_TIMER_PTR(eof_timer, OHCIState),
2060         VMSTATE_END_OF_LIST()
2061     },
2062 };
2063
2064 static const VMStateDescription vmstate_ohci_state = {
2065     .name = "ohci-core",
2066     .version_id = 1,
2067     .minimum_version_id = 1,
2068     .fields = (VMStateField[]) {
2069         VMSTATE_INT64(sof_time, OHCIState),
2070         VMSTATE_UINT32(ctl, OHCIState),
2071         VMSTATE_UINT32(status, OHCIState),
2072         VMSTATE_UINT32(intr_status, OHCIState),
2073         VMSTATE_UINT32(intr, OHCIState),
2074         VMSTATE_UINT32(hcca, OHCIState),
2075         VMSTATE_UINT32(ctrl_head, OHCIState),
2076         VMSTATE_UINT32(ctrl_cur, OHCIState),
2077         VMSTATE_UINT32(bulk_head, OHCIState),
2078         VMSTATE_UINT32(bulk_cur, OHCIState),
2079         VMSTATE_UINT32(per_cur, OHCIState),
2080         VMSTATE_UINT32(done, OHCIState),
2081         VMSTATE_INT32(done_count, OHCIState),
2082         VMSTATE_UINT16(fsmps, OHCIState),
2083         VMSTATE_UINT8(fit, OHCIState),
2084         VMSTATE_UINT16(fi, OHCIState),
2085         VMSTATE_UINT8(frt, OHCIState),
2086         VMSTATE_UINT16(frame_number, OHCIState),
2087         VMSTATE_UINT16(padding, OHCIState),
2088         VMSTATE_UINT32(pstart, OHCIState),
2089         VMSTATE_UINT32(lst, OHCIState),
2090         VMSTATE_UINT32(rhdesc_a, OHCIState),
2091         VMSTATE_UINT32(rhdesc_b, OHCIState),
2092         VMSTATE_UINT32(rhstatus, OHCIState),
2093         VMSTATE_STRUCT_ARRAY(rhport, OHCIState, OHCI_MAX_PORTS, 0,
2094                              vmstate_ohci_state_port, OHCIPort),
2095         VMSTATE_UINT32(hstatus, OHCIState),
2096         VMSTATE_UINT32(hmask, OHCIState),
2097         VMSTATE_UINT32(hreset, OHCIState),
2098         VMSTATE_UINT32(htest, OHCIState),
2099         VMSTATE_UINT32(old_ctl, OHCIState),
2100         VMSTATE_UINT8_ARRAY(usb_buf, OHCIState, 8192),
2101         VMSTATE_UINT32(async_td, OHCIState),
2102         VMSTATE_BOOL(async_complete, OHCIState),
2103         VMSTATE_END_OF_LIST()
2104     },
2105     .subsections = (const VMStateDescription*[]) {
2106         &vmstate_ohci_eof_timer,
2107         NULL
2108     }
2109 };
2110
2111 static const VMStateDescription vmstate_ohci = {
2112     .name = "ohci",
2113     .version_id = 1,
2114     .minimum_version_id = 1,
2115     .fields = (VMStateField[]) {
2116         VMSTATE_PCI_DEVICE(parent_obj, OHCIPCIState),
2117         VMSTATE_STRUCT(state, OHCIPCIState, 1, vmstate_ohci_state, OHCIState),
2118         VMSTATE_END_OF_LIST()
2119     }
2120 };
2121
2122 static void ohci_pci_class_init(ObjectClass *klass, void *data)
2123 {
2124     DeviceClass *dc = DEVICE_CLASS(klass);
2125     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2126
2127     k->realize = usb_ohci_realize_pci;
2128     k->exit = usb_ohci_exit;
2129     k->vendor_id = PCI_VENDOR_ID_APPLE;
2130     k->device_id = PCI_DEVICE_ID_APPLE_IPID_USB;
2131     k->class_id = PCI_CLASS_SERIAL_USB;
2132     set_bit(DEVICE_CATEGORY_USB, dc->categories);
2133     dc->desc = "Apple USB Controller";
2134     dc->props = ohci_pci_properties;
2135     dc->hotpluggable = false;
2136     dc->vmsd = &vmstate_ohci;
2137     dc->reset = usb_ohci_reset_pci;
2138 }
2139
2140 static const TypeInfo ohci_pci_info = {
2141     .name          = TYPE_PCI_OHCI,
2142     .parent        = TYPE_PCI_DEVICE,
2143     .instance_size = sizeof(OHCIPCIState),
2144     .class_init    = ohci_pci_class_init,
2145 };
2146
2147 static Property ohci_sysbus_properties[] = {
2148     DEFINE_PROP_UINT32("num-ports", OHCISysBusState, num_ports, 3),
2149     DEFINE_PROP_DMAADDR("dma-offset", OHCISysBusState, dma_offset, 0),
2150     DEFINE_PROP_END_OF_LIST(),
2151 };
2152
2153 static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
2154 {
2155     DeviceClass *dc = DEVICE_CLASS(klass);
2156
2157     dc->realize = ohci_realize_pxa;
2158     set_bit(DEVICE_CATEGORY_USB, dc->categories);
2159     dc->desc = "OHCI USB Controller";
2160     dc->props = ohci_sysbus_properties;
2161     dc->reset = usb_ohci_reset_sysbus;
2162 }
2163
2164 static const TypeInfo ohci_sysbus_info = {
2165     .name          = TYPE_SYSBUS_OHCI,
2166     .parent        = TYPE_SYS_BUS_DEVICE,
2167     .instance_size = sizeof(OHCISysBusState),
2168     .class_init    = ohci_sysbus_class_init,
2169 };
2170
2171 static void ohci_register_types(void)
2172 {
2173     type_register_static(&ohci_pci_info);
2174     type_register_static(&ohci_sysbus_info);
2175 }
2176
2177 type_init(ohci_register_types)