]> git.proxmox.com Git - mirror_qemu.git/blob - hw/usb-uhci.c
isa: always use provided ISA bus when creating an isa device
[mirror_qemu.git] / hw / usb-uhci.c
1 /*
2 * USB UHCI controller emulation
3 *
4 * Copyright (c) 2005 Fabrice Bellard
5 *
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
9 *
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
16 *
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
19 *
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
27 */
28 #include "hw.h"
29 #include "usb.h"
30 #include "pci.h"
31 #include "qemu-timer.h"
32 #include "usb-uhci.h"
33 #include "iov.h"
34 #include "dma.h"
35
36 //#define DEBUG
37 //#define DEBUG_DUMP_DATA
38
39 #define UHCI_CMD_FGR (1 << 4)
40 #define UHCI_CMD_EGSM (1 << 3)
41 #define UHCI_CMD_GRESET (1 << 2)
42 #define UHCI_CMD_HCRESET (1 << 1)
43 #define UHCI_CMD_RS (1 << 0)
44
45 #define UHCI_STS_HCHALTED (1 << 5)
46 #define UHCI_STS_HCPERR (1 << 4)
47 #define UHCI_STS_HSERR (1 << 3)
48 #define UHCI_STS_RD (1 << 2)
49 #define UHCI_STS_USBERR (1 << 1)
50 #define UHCI_STS_USBINT (1 << 0)
51
52 #define TD_CTRL_SPD (1 << 29)
53 #define TD_CTRL_ERROR_SHIFT 27
54 #define TD_CTRL_IOS (1 << 25)
55 #define TD_CTRL_IOC (1 << 24)
56 #define TD_CTRL_ACTIVE (1 << 23)
57 #define TD_CTRL_STALL (1 << 22)
58 #define TD_CTRL_BABBLE (1 << 20)
59 #define TD_CTRL_NAK (1 << 19)
60 #define TD_CTRL_TIMEOUT (1 << 18)
61
62 #define UHCI_PORT_SUSPEND (1 << 12)
63 #define UHCI_PORT_RESET (1 << 9)
64 #define UHCI_PORT_LSDA (1 << 8)
65 #define UHCI_PORT_RD (1 << 6)
66 #define UHCI_PORT_ENC (1 << 3)
67 #define UHCI_PORT_EN (1 << 2)
68 #define UHCI_PORT_CSC (1 << 1)
69 #define UHCI_PORT_CCS (1 << 0)
70
71 #define UHCI_PORT_READ_ONLY (0x1bb)
72 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
73
74 #define FRAME_TIMER_FREQ 1000
75
76 #define FRAME_MAX_LOOPS 100
77
78 #define NB_PORTS 2
79
80 #ifdef DEBUG
81 #define DPRINTF printf
82
83 static const char *pid2str(int pid)
84 {
85 switch (pid) {
86 case USB_TOKEN_SETUP: return "SETUP";
87 case USB_TOKEN_IN: return "IN";
88 case USB_TOKEN_OUT: return "OUT";
89 }
90 return "?";
91 }
92
93 #else
94 #define DPRINTF(...)
95 #endif
96
97 #ifdef DEBUG_DUMP_DATA
98 static void dump_data(USBPacket *p, int ret)
99 {
100 iov_hexdump(p->iov.iov, p->iov.niov, stderr, "uhci", ret);
101 }
102 #else
103 static void dump_data(USBPacket *p, int ret) {}
104 #endif
105
106 typedef struct UHCIState UHCIState;
107
108 /*
109 * Pending async transaction.
110 * 'packet' must be the first field because completion
111 * handler does "(UHCIAsync *) pkt" cast.
112 */
113 typedef struct UHCIAsync {
114 USBPacket packet;
115 QEMUSGList sgl;
116 UHCIState *uhci;
117 QTAILQ_ENTRY(UHCIAsync) next;
118 uint32_t td;
119 uint32_t token;
120 int8_t valid;
121 uint8_t isoc;
122 uint8_t done;
123 } UHCIAsync;
124
125 typedef struct UHCIPort {
126 USBPort port;
127 uint16_t ctrl;
128 } UHCIPort;
129
130 struct UHCIState {
131 PCIDevice dev;
132 MemoryRegion io_bar;
133 USBBus bus; /* Note unused when we're a companion controller */
134 uint16_t cmd; /* cmd register */
135 uint16_t status;
136 uint16_t intr; /* interrupt enable register */
137 uint16_t frnum; /* frame number */
138 uint32_t fl_base_addr; /* frame list base address */
139 uint8_t sof_timing;
140 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
141 int64_t expire_time;
142 QEMUTimer *frame_timer;
143 UHCIPort ports[NB_PORTS];
144
145 /* Interrupts that should be raised at the end of the current frame. */
146 uint32_t pending_int_mask;
147
148 /* Active packets */
149 QTAILQ_HEAD(,UHCIAsync) async_pending;
150 uint8_t num_ports_vmstate;
151
152 /* Properties */
153 char *masterbus;
154 uint32_t firstport;
155 };
156
157 typedef struct UHCI_TD {
158 uint32_t link;
159 uint32_t ctrl; /* see TD_CTRL_xxx */
160 uint32_t token;
161 uint32_t buffer;
162 } UHCI_TD;
163
164 typedef struct UHCI_QH {
165 uint32_t link;
166 uint32_t el_link;
167 } UHCI_QH;
168
169 static UHCIAsync *uhci_async_alloc(UHCIState *s)
170 {
171 UHCIAsync *async = g_malloc(sizeof(UHCIAsync));
172
173 memset(&async->packet, 0, sizeof(async->packet));
174 async->uhci = s;
175 async->valid = 0;
176 async->td = 0;
177 async->token = 0;
178 async->done = 0;
179 async->isoc = 0;
180 usb_packet_init(&async->packet);
181 pci_dma_sglist_init(&async->sgl, &s->dev, 1);
182
183 return async;
184 }
185
186 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
187 {
188 usb_packet_cleanup(&async->packet);
189 qemu_sglist_destroy(&async->sgl);
190 g_free(async);
191 }
192
193 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
194 {
195 QTAILQ_INSERT_HEAD(&s->async_pending, async, next);
196 }
197
198 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
199 {
200 QTAILQ_REMOVE(&s->async_pending, async, next);
201 }
202
203 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
204 {
205 DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
206 async->td, async->token, async->done);
207
208 if (!async->done)
209 usb_cancel_packet(&async->packet);
210 uhci_async_free(s, async);
211 }
212
213 /*
214 * Mark all outstanding async packets as invalid.
215 * This is used for canceling them when TDs are removed by the HCD.
216 */
217 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
218 {
219 UHCIAsync *async;
220
221 QTAILQ_FOREACH(async, &s->async_pending, next) {
222 async->valid--;
223 }
224 return NULL;
225 }
226
227 /*
228 * Cancel async packets that are no longer valid
229 */
230 static void uhci_async_validate_end(UHCIState *s)
231 {
232 UHCIAsync *curr, *n;
233
234 QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
235 if (curr->valid > 0) {
236 continue;
237 }
238 uhci_async_unlink(s, curr);
239 uhci_async_cancel(s, curr);
240 }
241 }
242
243 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
244 {
245 UHCIAsync *curr, *n;
246
247 QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
248 if (curr->packet.owner != dev) {
249 continue;
250 }
251 uhci_async_unlink(s, curr);
252 uhci_async_cancel(s, curr);
253 }
254 }
255
256 static void uhci_async_cancel_all(UHCIState *s)
257 {
258 UHCIAsync *curr, *n;
259
260 QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
261 uhci_async_unlink(s, curr);
262 uhci_async_cancel(s, curr);
263 }
264 }
265
266 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
267 {
268 UHCIAsync *async;
269 UHCIAsync *match = NULL;
270 int count = 0;
271
272 /*
273 * We're looking for the best match here. ie both td addr and token.
274 * Otherwise we return last good match. ie just token.
275 * It's ok to match just token because it identifies the transaction
276 * rather well, token includes: device addr, endpoint, size, etc.
277 *
278 * Also since we queue async transactions in reverse order by returning
279 * last good match we restores the order.
280 *
281 * It's expected that we wont have a ton of outstanding transactions.
282 * If we ever do we'd want to optimize this algorithm.
283 */
284
285 QTAILQ_FOREACH(async, &s->async_pending, next) {
286 if (async->token == token) {
287 /* Good match */
288 match = async;
289
290 if (async->td == addr) {
291 /* Best match */
292 break;
293 }
294 }
295 count++;
296 }
297
298 if (count > 64)
299 fprintf(stderr, "uhci: warning lots of async transactions\n");
300
301 return match;
302 }
303
304 static void uhci_update_irq(UHCIState *s)
305 {
306 int level;
307 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
308 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
309 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
310 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
311 (s->status & UHCI_STS_HSERR) ||
312 (s->status & UHCI_STS_HCPERR)) {
313 level = 1;
314 } else {
315 level = 0;
316 }
317 qemu_set_irq(s->dev.irq[3], level);
318 }
319
320 static void uhci_reset(void *opaque)
321 {
322 UHCIState *s = opaque;
323 uint8_t *pci_conf;
324 int i;
325 UHCIPort *port;
326
327 DPRINTF("uhci: full reset\n");
328
329 pci_conf = s->dev.config;
330
331 pci_conf[0x6a] = 0x01; /* usb clock */
332 pci_conf[0x6b] = 0x00;
333 s->cmd = 0;
334 s->status = 0;
335 s->status2 = 0;
336 s->intr = 0;
337 s->fl_base_addr = 0;
338 s->sof_timing = 64;
339
340 for(i = 0; i < NB_PORTS; i++) {
341 port = &s->ports[i];
342 port->ctrl = 0x0080;
343 if (port->port.dev && port->port.dev->attached) {
344 usb_reset(&port->port);
345 }
346 }
347
348 uhci_async_cancel_all(s);
349 }
350
351 static void uhci_pre_save(void *opaque)
352 {
353 UHCIState *s = opaque;
354
355 uhci_async_cancel_all(s);
356 }
357
358 static const VMStateDescription vmstate_uhci_port = {
359 .name = "uhci port",
360 .version_id = 1,
361 .minimum_version_id = 1,
362 .minimum_version_id_old = 1,
363 .fields = (VMStateField []) {
364 VMSTATE_UINT16(ctrl, UHCIPort),
365 VMSTATE_END_OF_LIST()
366 }
367 };
368
369 static const VMStateDescription vmstate_uhci = {
370 .name = "uhci",
371 .version_id = 2,
372 .minimum_version_id = 1,
373 .minimum_version_id_old = 1,
374 .pre_save = uhci_pre_save,
375 .fields = (VMStateField []) {
376 VMSTATE_PCI_DEVICE(dev, UHCIState),
377 VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
378 VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
379 vmstate_uhci_port, UHCIPort),
380 VMSTATE_UINT16(cmd, UHCIState),
381 VMSTATE_UINT16(status, UHCIState),
382 VMSTATE_UINT16(intr, UHCIState),
383 VMSTATE_UINT16(frnum, UHCIState),
384 VMSTATE_UINT32(fl_base_addr, UHCIState),
385 VMSTATE_UINT8(sof_timing, UHCIState),
386 VMSTATE_UINT8(status2, UHCIState),
387 VMSTATE_TIMER(frame_timer, UHCIState),
388 VMSTATE_INT64_V(expire_time, UHCIState, 2),
389 VMSTATE_END_OF_LIST()
390 }
391 };
392
393 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
394 {
395 UHCIState *s = opaque;
396
397 addr &= 0x1f;
398 switch(addr) {
399 case 0x0c:
400 s->sof_timing = val;
401 break;
402 }
403 }
404
405 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
406 {
407 UHCIState *s = opaque;
408 uint32_t val;
409
410 addr &= 0x1f;
411 switch(addr) {
412 case 0x0c:
413 val = s->sof_timing;
414 break;
415 default:
416 val = 0xff;
417 break;
418 }
419 return val;
420 }
421
422 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
423 {
424 UHCIState *s = opaque;
425
426 addr &= 0x1f;
427 DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
428
429 switch(addr) {
430 case 0x00:
431 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
432 /* start frame processing */
433 s->expire_time = qemu_get_clock_ns(vm_clock) +
434 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
435 qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
436 s->status &= ~UHCI_STS_HCHALTED;
437 } else if (!(val & UHCI_CMD_RS)) {
438 s->status |= UHCI_STS_HCHALTED;
439 }
440 if (val & UHCI_CMD_GRESET) {
441 UHCIPort *port;
442 USBDevice *dev;
443 int i;
444
445 /* send reset on the USB bus */
446 for(i = 0; i < NB_PORTS; i++) {
447 port = &s->ports[i];
448 dev = port->port.dev;
449 if (dev && dev->attached) {
450 usb_send_msg(dev, USB_MSG_RESET);
451 }
452 }
453 uhci_reset(s);
454 return;
455 }
456 if (val & UHCI_CMD_HCRESET) {
457 uhci_reset(s);
458 return;
459 }
460 s->cmd = val;
461 break;
462 case 0x02:
463 s->status &= ~val;
464 /* XXX: the chip spec is not coherent, so we add a hidden
465 register to distinguish between IOC and SPD */
466 if (val & UHCI_STS_USBINT)
467 s->status2 = 0;
468 uhci_update_irq(s);
469 break;
470 case 0x04:
471 s->intr = val;
472 uhci_update_irq(s);
473 break;
474 case 0x06:
475 if (s->status & UHCI_STS_HCHALTED)
476 s->frnum = val & 0x7ff;
477 break;
478 case 0x10 ... 0x1f:
479 {
480 UHCIPort *port;
481 USBDevice *dev;
482 int n;
483
484 n = (addr >> 1) & 7;
485 if (n >= NB_PORTS)
486 return;
487 port = &s->ports[n];
488 dev = port->port.dev;
489 if (dev && dev->attached) {
490 /* port reset */
491 if ( (val & UHCI_PORT_RESET) &&
492 !(port->ctrl & UHCI_PORT_RESET) ) {
493 usb_send_msg(dev, USB_MSG_RESET);
494 }
495 }
496 port->ctrl &= UHCI_PORT_READ_ONLY;
497 port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
498 /* some bits are reset when a '1' is written to them */
499 port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
500 }
501 break;
502 }
503 }
504
505 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
506 {
507 UHCIState *s = opaque;
508 uint32_t val;
509
510 addr &= 0x1f;
511 switch(addr) {
512 case 0x00:
513 val = s->cmd;
514 break;
515 case 0x02:
516 val = s->status;
517 break;
518 case 0x04:
519 val = s->intr;
520 break;
521 case 0x06:
522 val = s->frnum;
523 break;
524 case 0x10 ... 0x1f:
525 {
526 UHCIPort *port;
527 int n;
528 n = (addr >> 1) & 7;
529 if (n >= NB_PORTS)
530 goto read_default;
531 port = &s->ports[n];
532 val = port->ctrl;
533 }
534 break;
535 default:
536 read_default:
537 val = 0xff7f; /* disabled port */
538 break;
539 }
540
541 DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
542
543 return val;
544 }
545
546 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
547 {
548 UHCIState *s = opaque;
549
550 addr &= 0x1f;
551 DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
552
553 switch(addr) {
554 case 0x08:
555 s->fl_base_addr = val & ~0xfff;
556 break;
557 }
558 }
559
560 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
561 {
562 UHCIState *s = opaque;
563 uint32_t val;
564
565 addr &= 0x1f;
566 switch(addr) {
567 case 0x08:
568 val = s->fl_base_addr;
569 break;
570 default:
571 val = 0xffffffff;
572 break;
573 }
574 return val;
575 }
576
577 /* signal resume if controller suspended */
578 static void uhci_resume (void *opaque)
579 {
580 UHCIState *s = (UHCIState *)opaque;
581
582 if (!s)
583 return;
584
585 if (s->cmd & UHCI_CMD_EGSM) {
586 s->cmd |= UHCI_CMD_FGR;
587 s->status |= UHCI_STS_RD;
588 uhci_update_irq(s);
589 }
590 }
591
592 static void uhci_attach(USBPort *port1)
593 {
594 UHCIState *s = port1->opaque;
595 UHCIPort *port = &s->ports[port1->index];
596
597 /* set connect status */
598 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
599
600 /* update speed */
601 if (port->port.dev->speed == USB_SPEED_LOW) {
602 port->ctrl |= UHCI_PORT_LSDA;
603 } else {
604 port->ctrl &= ~UHCI_PORT_LSDA;
605 }
606
607 uhci_resume(s);
608 }
609
610 static void uhci_detach(USBPort *port1)
611 {
612 UHCIState *s = port1->opaque;
613 UHCIPort *port = &s->ports[port1->index];
614
615 uhci_async_cancel_device(s, port1->dev);
616
617 /* set connect status */
618 if (port->ctrl & UHCI_PORT_CCS) {
619 port->ctrl &= ~UHCI_PORT_CCS;
620 port->ctrl |= UHCI_PORT_CSC;
621 }
622 /* disable port */
623 if (port->ctrl & UHCI_PORT_EN) {
624 port->ctrl &= ~UHCI_PORT_EN;
625 port->ctrl |= UHCI_PORT_ENC;
626 }
627
628 uhci_resume(s);
629 }
630
631 static void uhci_child_detach(USBPort *port1, USBDevice *child)
632 {
633 UHCIState *s = port1->opaque;
634
635 uhci_async_cancel_device(s, child);
636 }
637
638 static void uhci_wakeup(USBPort *port1)
639 {
640 UHCIState *s = port1->opaque;
641 UHCIPort *port = &s->ports[port1->index];
642
643 if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
644 port->ctrl |= UHCI_PORT_RD;
645 uhci_resume(s);
646 }
647 }
648
649 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
650 {
651 int i, ret;
652
653 DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %zd\n",
654 pid2str(p->pid), p->devaddr, p->devep, p->iov.size);
655 if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
656 dump_data(p, 0);
657
658 ret = USB_RET_NODEV;
659 for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
660 UHCIPort *port = &s->ports[i];
661 USBDevice *dev = port->port.dev;
662
663 if (dev && dev->attached && (port->ctrl & UHCI_PORT_EN)) {
664 ret = usb_handle_packet(dev, p);
665 }
666 }
667
668 DPRINTF("uhci: packet exit. ret %d len %zd\n", ret, p->iov.size);
669 if (p->pid == USB_TOKEN_IN && ret > 0)
670 dump_data(p, ret);
671
672 return ret;
673 }
674
675 static void uhci_async_complete(USBPort *port, USBPacket *packet);
676 static void uhci_process_frame(UHCIState *s);
677
678 /* return -1 if fatal error (frame must be stopped)
679 0 if TD successful
680 1 if TD unsuccessful or inactive
681 */
682 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
683 {
684 int len = 0, max_len, err, ret;
685 uint8_t pid;
686
687 max_len = ((td->token >> 21) + 1) & 0x7ff;
688 pid = td->token & 0xff;
689
690 ret = async->packet.result;
691
692 if (td->ctrl & TD_CTRL_IOS)
693 td->ctrl &= ~TD_CTRL_ACTIVE;
694
695 if (ret < 0)
696 goto out;
697
698 len = async->packet.result;
699 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
700
701 /* The NAK bit may have been set by a previous frame, so clear it
702 here. The docs are somewhat unclear, but win2k relies on this
703 behavior. */
704 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
705 if (td->ctrl & TD_CTRL_IOC)
706 *int_mask |= 0x01;
707
708 if (pid == USB_TOKEN_IN) {
709 if (len > max_len) {
710 ret = USB_RET_BABBLE;
711 goto out;
712 }
713
714 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
715 *int_mask |= 0x02;
716 /* short packet: do not update QH */
717 DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
718 return 1;
719 }
720 }
721
722 /* success */
723 return 0;
724
725 out:
726 switch(ret) {
727 case USB_RET_STALL:
728 td->ctrl |= TD_CTRL_STALL;
729 td->ctrl &= ~TD_CTRL_ACTIVE;
730 s->status |= UHCI_STS_USBERR;
731 if (td->ctrl & TD_CTRL_IOC) {
732 *int_mask |= 0x01;
733 }
734 uhci_update_irq(s);
735 return 1;
736
737 case USB_RET_BABBLE:
738 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
739 td->ctrl &= ~TD_CTRL_ACTIVE;
740 s->status |= UHCI_STS_USBERR;
741 if (td->ctrl & TD_CTRL_IOC) {
742 *int_mask |= 0x01;
743 }
744 uhci_update_irq(s);
745 /* frame interrupted */
746 return -1;
747
748 case USB_RET_NAK:
749 td->ctrl |= TD_CTRL_NAK;
750 if (pid == USB_TOKEN_SETUP)
751 break;
752 return 1;
753
754 case USB_RET_NODEV:
755 default:
756 break;
757 }
758
759 /* Retry the TD if error count is not zero */
760
761 td->ctrl |= TD_CTRL_TIMEOUT;
762 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
763 if (err != 0) {
764 err--;
765 if (err == 0) {
766 td->ctrl &= ~TD_CTRL_ACTIVE;
767 s->status |= UHCI_STS_USBERR;
768 if (td->ctrl & TD_CTRL_IOC)
769 *int_mask |= 0x01;
770 uhci_update_irq(s);
771 }
772 }
773 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
774 (err << TD_CTRL_ERROR_SHIFT);
775 return 1;
776 }
777
778 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
779 {
780 UHCIAsync *async;
781 int len = 0, max_len;
782 uint8_t pid, isoc;
783 uint32_t token;
784
785 /* Is active ? */
786 if (!(td->ctrl & TD_CTRL_ACTIVE))
787 return 1;
788
789 /* token field is not unique for isochronous requests,
790 * so use the destination buffer
791 */
792 if (td->ctrl & TD_CTRL_IOS) {
793 token = td->buffer;
794 isoc = 1;
795 } else {
796 token = td->token;
797 isoc = 0;
798 }
799
800 async = uhci_async_find_td(s, addr, token);
801 if (async) {
802 /* Already submitted */
803 async->valid = 32;
804
805 if (!async->done)
806 return 1;
807
808 uhci_async_unlink(s, async);
809 goto done;
810 }
811
812 /* Allocate new packet */
813 async = uhci_async_alloc(s);
814 if (!async)
815 return 1;
816
817 /* valid needs to be large enough to handle 10 frame delay
818 * for initial isochronous requests
819 */
820 async->valid = 32;
821 async->td = addr;
822 async->token = token;
823 async->isoc = isoc;
824
825 max_len = ((td->token >> 21) + 1) & 0x7ff;
826 pid = td->token & 0xff;
827
828 usb_packet_setup(&async->packet, pid, (td->token >> 8) & 0x7f,
829 (td->token >> 15) & 0xf);
830 qemu_sglist_add(&async->sgl, td->buffer, max_len);
831 usb_packet_map(&async->packet, &async->sgl);
832
833 switch(pid) {
834 case USB_TOKEN_OUT:
835 case USB_TOKEN_SETUP:
836 len = uhci_broadcast_packet(s, &async->packet);
837 if (len >= 0)
838 len = max_len;
839 break;
840
841 case USB_TOKEN_IN:
842 len = uhci_broadcast_packet(s, &async->packet);
843 break;
844
845 default:
846 /* invalid pid : frame interrupted */
847 uhci_async_free(s, async);
848 s->status |= UHCI_STS_HCPERR;
849 uhci_update_irq(s);
850 return -1;
851 }
852
853 if (len == USB_RET_ASYNC) {
854 uhci_async_link(s, async);
855 return 2;
856 }
857
858 async->packet.result = len;
859
860 done:
861 len = uhci_complete_td(s, td, async, int_mask);
862 usb_packet_unmap(&async->packet);
863 uhci_async_free(s, async);
864 return len;
865 }
866
867 static void uhci_async_complete(USBPort *port, USBPacket *packet)
868 {
869 UHCIAsync *async = container_of(packet, UHCIAsync, packet);
870 UHCIState *s = async->uhci;
871
872 DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
873
874 if (async->isoc) {
875 UHCI_TD td;
876 uint32_t link = async->td;
877 uint32_t int_mask = 0, val;
878
879 pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
880 le32_to_cpus(&td.link);
881 le32_to_cpus(&td.ctrl);
882 le32_to_cpus(&td.token);
883 le32_to_cpus(&td.buffer);
884
885 uhci_async_unlink(s, async);
886 uhci_complete_td(s, &td, async, &int_mask);
887 s->pending_int_mask |= int_mask;
888
889 /* update the status bits of the TD */
890 val = cpu_to_le32(td.ctrl);
891 pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
892 uhci_async_free(s, async);
893 } else {
894 async->done = 1;
895 uhci_process_frame(s);
896 }
897 }
898
899 static int is_valid(uint32_t link)
900 {
901 return (link & 1) == 0;
902 }
903
904 static int is_qh(uint32_t link)
905 {
906 return (link & 2) != 0;
907 }
908
909 static int depth_first(uint32_t link)
910 {
911 return (link & 4) != 0;
912 }
913
914 /* QH DB used for detecting QH loops */
915 #define UHCI_MAX_QUEUES 128
916 typedef struct {
917 uint32_t addr[UHCI_MAX_QUEUES];
918 int count;
919 } QhDb;
920
921 static void qhdb_reset(QhDb *db)
922 {
923 db->count = 0;
924 }
925
926 /* Add QH to DB. Returns 1 if already present or DB is full. */
927 static int qhdb_insert(QhDb *db, uint32_t addr)
928 {
929 int i;
930 for (i = 0; i < db->count; i++)
931 if (db->addr[i] == addr)
932 return 1;
933
934 if (db->count >= UHCI_MAX_QUEUES)
935 return 1;
936
937 db->addr[db->count++] = addr;
938 return 0;
939 }
940
941 static void uhci_process_frame(UHCIState *s)
942 {
943 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
944 uint32_t curr_qh;
945 int cnt, ret;
946 UHCI_TD td;
947 UHCI_QH qh;
948 QhDb qhdb;
949
950 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
951
952 DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
953
954 pci_dma_read(&s->dev, frame_addr, &link, 4);
955 le32_to_cpus(&link);
956
957 int_mask = 0;
958 curr_qh = 0;
959
960 qhdb_reset(&qhdb);
961
962 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
963 if (is_qh(link)) {
964 /* QH */
965
966 if (qhdb_insert(&qhdb, link)) {
967 /*
968 * We're going in circles. Which is not a bug because
969 * HCD is allowed to do that as part of the BW management.
970 * In our case though it makes no sense to spin here. Sync transations
971 * are already done, and async completion handler will re-process
972 * the frame when something is ready.
973 */
974 DPRINTF("uhci: detected loop. qh 0x%x\n", link);
975 break;
976 }
977
978 pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
979 le32_to_cpus(&qh.link);
980 le32_to_cpus(&qh.el_link);
981
982 DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
983 link, qh.link, qh.el_link);
984
985 if (!is_valid(qh.el_link)) {
986 /* QH w/o elements */
987 curr_qh = 0;
988 link = qh.link;
989 } else {
990 /* QH with elements */
991 curr_qh = link;
992 link = qh.el_link;
993 }
994 continue;
995 }
996
997 /* TD */
998 pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
999 le32_to_cpus(&td.link);
1000 le32_to_cpus(&td.ctrl);
1001 le32_to_cpus(&td.token);
1002 le32_to_cpus(&td.buffer);
1003
1004 DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1005 link, td.link, td.ctrl, td.token, curr_qh);
1006
1007 old_td_ctrl = td.ctrl;
1008 ret = uhci_handle_td(s, link, &td, &int_mask);
1009 if (old_td_ctrl != td.ctrl) {
1010 /* update the status bits of the TD */
1011 val = cpu_to_le32(td.ctrl);
1012 pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1013 }
1014
1015 if (ret < 0) {
1016 /* interrupted frame */
1017 break;
1018 }
1019
1020 if (ret == 2 || ret == 1) {
1021 DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1022 link, ret == 2 ? "pend" : "skip",
1023 td.link, td.ctrl, td.token, curr_qh);
1024
1025 link = curr_qh ? qh.link : td.link;
1026 continue;
1027 }
1028
1029 /* completed TD */
1030
1031 DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1032 link, td.link, td.ctrl, td.token, curr_qh);
1033
1034 link = td.link;
1035
1036 if (curr_qh) {
1037 /* update QH element link */
1038 qh.el_link = link;
1039 val = cpu_to_le32(qh.el_link);
1040 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1041
1042 if (!depth_first(link)) {
1043 /* done with this QH */
1044
1045 DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1046 curr_qh, qh.link, qh.el_link);
1047
1048 curr_qh = 0;
1049 link = qh.link;
1050 }
1051 }
1052
1053 /* go to the next entry */
1054 }
1055
1056 s->pending_int_mask |= int_mask;
1057 }
1058
1059 static void uhci_frame_timer(void *opaque)
1060 {
1061 UHCIState *s = opaque;
1062
1063 /* prepare the timer for the next frame */
1064 s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1065
1066 if (!(s->cmd & UHCI_CMD_RS)) {
1067 /* Full stop */
1068 qemu_del_timer(s->frame_timer);
1069 /* set hchalted bit in status - UHCI11D 2.1.2 */
1070 s->status |= UHCI_STS_HCHALTED;
1071
1072 DPRINTF("uhci: halted\n");
1073 return;
1074 }
1075
1076 /* Complete the previous frame */
1077 if (s->pending_int_mask) {
1078 s->status2 |= s->pending_int_mask;
1079 s->status |= UHCI_STS_USBINT;
1080 uhci_update_irq(s);
1081 }
1082 s->pending_int_mask = 0;
1083
1084 /* Start new frame */
1085 s->frnum = (s->frnum + 1) & 0x7ff;
1086
1087 DPRINTF("uhci: new frame #%u\n" , s->frnum);
1088
1089 uhci_async_validate_begin(s);
1090
1091 uhci_process_frame(s);
1092
1093 uhci_async_validate_end(s);
1094
1095 qemu_mod_timer(s->frame_timer, s->expire_time);
1096 }
1097
1098 static const MemoryRegionPortio uhci_portio[] = {
1099 { 0, 32, 2, .write = uhci_ioport_writew, },
1100 { 0, 32, 2, .read = uhci_ioport_readw, },
1101 { 0, 32, 4, .write = uhci_ioport_writel, },
1102 { 0, 32, 4, .read = uhci_ioport_readl, },
1103 { 0, 32, 1, .write = uhci_ioport_writeb, },
1104 { 0, 32, 1, .read = uhci_ioport_readb, },
1105 PORTIO_END_OF_LIST()
1106 };
1107
1108 static const MemoryRegionOps uhci_ioport_ops = {
1109 .old_portio = uhci_portio,
1110 };
1111
1112 static USBPortOps uhci_port_ops = {
1113 .attach = uhci_attach,
1114 .detach = uhci_detach,
1115 .child_detach = uhci_child_detach,
1116 .wakeup = uhci_wakeup,
1117 .complete = uhci_async_complete,
1118 };
1119
1120 static USBBusOps uhci_bus_ops = {
1121 };
1122
1123 static int usb_uhci_common_initfn(PCIDevice *dev)
1124 {
1125 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1126 uint8_t *pci_conf = s->dev.config;
1127 int i;
1128
1129 pci_conf[PCI_CLASS_PROG] = 0x00;
1130 /* TODO: reset value should be 0. */
1131 pci_conf[PCI_INTERRUPT_PIN] = 4; /* interrupt pin D */
1132 pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1133
1134 if (s->masterbus) {
1135 USBPort *ports[NB_PORTS];
1136 for(i = 0; i < NB_PORTS; i++) {
1137 ports[i] = &s->ports[i].port;
1138 }
1139 if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1140 s->firstport, s, &uhci_port_ops,
1141 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1142 return -1;
1143 }
1144 } else {
1145 usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1146 for (i = 0; i < NB_PORTS; i++) {
1147 usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1148 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1149 }
1150 }
1151 s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1152 s->num_ports_vmstate = NB_PORTS;
1153 QTAILQ_INIT(&s->async_pending);
1154
1155 qemu_register_reset(uhci_reset, s);
1156
1157 memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1158 /* Use region 4 for consistency with real hardware. BSD guests seem
1159 to rely on this. */
1160 pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1161
1162 return 0;
1163 }
1164
1165 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1166 {
1167 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1168 uint8_t *pci_conf = s->dev.config;
1169
1170 /* USB misc control 1/2 */
1171 pci_set_long(pci_conf + 0x40,0x00001000);
1172 /* PM capability */
1173 pci_set_long(pci_conf + 0x80,0x00020001);
1174 /* USB legacy support */
1175 pci_set_long(pci_conf + 0xc0,0x00002000);
1176
1177 return usb_uhci_common_initfn(dev);
1178 }
1179
1180 static int usb_uhci_exit(PCIDevice *dev)
1181 {
1182 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1183
1184 memory_region_destroy(&s->io_bar);
1185 return 0;
1186 }
1187
1188 static Property uhci_properties[] = {
1189 DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1190 DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1191 DEFINE_PROP_END_OF_LIST(),
1192 };
1193
1194 static PCIDeviceInfo uhci_info[] = {
1195 {
1196 .qdev.name = "piix3-usb-uhci",
1197 .qdev.size = sizeof(UHCIState),
1198 .qdev.vmsd = &vmstate_uhci,
1199 .init = usb_uhci_common_initfn,
1200 .exit = usb_uhci_exit,
1201 .vendor_id = PCI_VENDOR_ID_INTEL,
1202 .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1203 .revision = 0x01,
1204 .class_id = PCI_CLASS_SERIAL_USB,
1205 .qdev.props = uhci_properties,
1206 },{
1207 .qdev.name = "piix4-usb-uhci",
1208 .qdev.size = sizeof(UHCIState),
1209 .qdev.vmsd = &vmstate_uhci,
1210 .init = usb_uhci_common_initfn,
1211 .exit = usb_uhci_exit,
1212 .vendor_id = PCI_VENDOR_ID_INTEL,
1213 .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1214 .revision = 0x01,
1215 .class_id = PCI_CLASS_SERIAL_USB,
1216 .qdev.props = uhci_properties,
1217 },{
1218 .qdev.name = "vt82c686b-usb-uhci",
1219 .qdev.size = sizeof(UHCIState),
1220 .qdev.vmsd = &vmstate_uhci,
1221 .init = usb_uhci_vt82c686b_initfn,
1222 .exit = usb_uhci_exit,
1223 .vendor_id = PCI_VENDOR_ID_VIA,
1224 .device_id = PCI_DEVICE_ID_VIA_UHCI,
1225 .revision = 0x01,
1226 .class_id = PCI_CLASS_SERIAL_USB,
1227 .qdev.props = uhci_properties,
1228 },{
1229 .qdev.name = "ich9-usb-uhci1",
1230 .qdev.size = sizeof(UHCIState),
1231 .qdev.vmsd = &vmstate_uhci,
1232 .init = usb_uhci_common_initfn,
1233 .vendor_id = PCI_VENDOR_ID_INTEL,
1234 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1235 .revision = 0x03,
1236 .class_id = PCI_CLASS_SERIAL_USB,
1237 .qdev.props = uhci_properties,
1238 },{
1239 .qdev.name = "ich9-usb-uhci2",
1240 .qdev.size = sizeof(UHCIState),
1241 .qdev.vmsd = &vmstate_uhci,
1242 .init = usb_uhci_common_initfn,
1243 .vendor_id = PCI_VENDOR_ID_INTEL,
1244 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1245 .revision = 0x03,
1246 .class_id = PCI_CLASS_SERIAL_USB,
1247 .qdev.props = uhci_properties,
1248 },{
1249 .qdev.name = "ich9-usb-uhci3",
1250 .qdev.size = sizeof(UHCIState),
1251 .qdev.vmsd = &vmstate_uhci,
1252 .init = usb_uhci_common_initfn,
1253 .vendor_id = PCI_VENDOR_ID_INTEL,
1254 .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1255 .revision = 0x03,
1256 .class_id = PCI_CLASS_SERIAL_USB,
1257 .qdev.props = uhci_properties,
1258 },{
1259 /* end of list */
1260 }
1261 };
1262
1263 static void uhci_register(void)
1264 {
1265 pci_qdev_register_many(uhci_info);
1266 }
1267 device_init(uhci_register);
1268
1269 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1270 {
1271 pci_create_simple(bus, devfn, "piix3-usb-uhci");
1272 }
1273
1274 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1275 {
1276 pci_create_simple(bus, devfn, "piix4-usb-uhci");
1277 }
1278
1279 void usb_uhci_vt82c686b_init(PCIBus *bus, int devfn)
1280 {
1281 pci_create_simple(bus, devfn, "vt82c686b-usb-uhci");
1282 }