]> git.proxmox.com Git - qemu.git/blob - hw/usb-uhci.c
uhci: rewrite UHCI emulator, fully async operation with multiple outstanding transact...
[qemu.git] / hw / usb-uhci.c
1 /*
2 * USB UHCI controller emulation
3 *
4 * Copyright (c) 2005 Fabrice Bellard
5 *
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
9 *
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
16 *
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
19 *
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
27 */
28 #include "hw.h"
29 #include "usb.h"
30 #include "pci.h"
31 #include "qemu-timer.h"
32
33 //#define DEBUG
34 //#define DEBUG_DUMP_DATA
35
36 #define UHCI_CMD_FGR (1 << 4)
37 #define UHCI_CMD_EGSM (1 << 3)
38 #define UHCI_CMD_GRESET (1 << 2)
39 #define UHCI_CMD_HCRESET (1 << 1)
40 #define UHCI_CMD_RS (1 << 0)
41
42 #define UHCI_STS_HCHALTED (1 << 5)
43 #define UHCI_STS_HCPERR (1 << 4)
44 #define UHCI_STS_HSERR (1 << 3)
45 #define UHCI_STS_RD (1 << 2)
46 #define UHCI_STS_USBERR (1 << 1)
47 #define UHCI_STS_USBINT (1 << 0)
48
49 #define TD_CTRL_SPD (1 << 29)
50 #define TD_CTRL_ERROR_SHIFT 27
51 #define TD_CTRL_IOS (1 << 25)
52 #define TD_CTRL_IOC (1 << 24)
53 #define TD_CTRL_ACTIVE (1 << 23)
54 #define TD_CTRL_STALL (1 << 22)
55 #define TD_CTRL_BABBLE (1 << 20)
56 #define TD_CTRL_NAK (1 << 19)
57 #define TD_CTRL_TIMEOUT (1 << 18)
58
59 #define UHCI_PORT_RESET (1 << 9)
60 #define UHCI_PORT_LSDA (1 << 8)
61 #define UHCI_PORT_ENC (1 << 3)
62 #define UHCI_PORT_EN (1 << 2)
63 #define UHCI_PORT_CSC (1 << 1)
64 #define UHCI_PORT_CCS (1 << 0)
65
66 #define FRAME_TIMER_FREQ 1000
67
68 #define FRAME_MAX_LOOPS 100
69
70 #define NB_PORTS 2
71
72 #ifdef DEBUG
73 #define dprintf printf
74
75 const char *pid2str(int pid)
76 {
77 switch (pid) {
78 case USB_TOKEN_SETUP: return "SETUP";
79 case USB_TOKEN_IN: return "IN";
80 case USB_TOKEN_OUT: return "OUT";
81 }
82 return "?";
83 }
84
85 #else
86 #define dprintf(...)
87 #endif
88
89 #ifdef DEBUG_DUMP_DATA
90 static void dump_data(const uint8_t *data, int len)
91 {
92 int i;
93
94 printf("uhci: data: ");
95 for(i = 0; i < len; i++)
96 printf(" %02x", data[i]);
97 printf("\n");
98 }
99 #else
100 static void dump_data(const uint8_t *data, int len) {}
101 #endif
102
103 /*
104 * Pending async transaction.
105 * 'packet' must be the first field because completion
106 * handler does "(UHCIAsync *) pkt" cast.
107 */
108 typedef struct UHCIAsync {
109 USBPacket packet;
110 struct UHCIAsync *next;
111 uint32_t td;
112 uint32_t token;
113 int8_t valid;
114 uint8_t done;
115 uint8_t buffer[2048];
116 } UHCIAsync;
117
118 typedef struct UHCIPort {
119 USBPort port;
120 uint16_t ctrl;
121 } UHCIPort;
122
123 typedef struct UHCIState {
124 PCIDevice dev;
125 uint16_t cmd; /* cmd register */
126 uint16_t status;
127 uint16_t intr; /* interrupt enable register */
128 uint16_t frnum; /* frame number */
129 uint32_t fl_base_addr; /* frame list base address */
130 uint8_t sof_timing;
131 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
132 QEMUTimer *frame_timer;
133 UHCIPort ports[NB_PORTS];
134
135 /* Interrupts that should be raised at the end of the current frame. */
136 uint32_t pending_int_mask;
137
138 /* Active packets */
139 UHCIAsync *async_pending;
140 UHCIAsync *async_pool;
141 } UHCIState;
142
143 typedef struct UHCI_TD {
144 uint32_t link;
145 uint32_t ctrl; /* see TD_CTRL_xxx */
146 uint32_t token;
147 uint32_t buffer;
148 } UHCI_TD;
149
150 typedef struct UHCI_QH {
151 uint32_t link;
152 uint32_t el_link;
153 } UHCI_QH;
154
155 static UHCIAsync *uhci_async_alloc(UHCIState *s)
156 {
157 UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
158 if (async) {
159 memset(&async->packet, 0, sizeof(async->packet));
160 async->valid = 0;
161 async->td = 0;
162 async->token = 0;
163 async->done = 0;
164 async->next = NULL;
165 }
166
167 return async;
168 }
169
170 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
171 {
172 qemu_free(async);
173 }
174
175 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
176 {
177 async->next = s->async_pending;
178 s->async_pending = async;
179 }
180
181 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
182 {
183 UHCIAsync *curr = s->async_pending;
184 UHCIAsync **prev = &s->async_pending;
185
186 while (curr) {
187 if (curr == async) {
188 *prev = curr->next;
189 return;
190 }
191
192 prev = &curr->next;
193 curr = curr->next;
194 }
195 }
196
197 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
198 {
199 dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",
200 async->td, async->token, async->done);
201
202 if (!async->done)
203 usb_cancel_packet(&async->packet);
204 uhci_async_free(s, async);
205 }
206
207 /*
208 * Mark all outstanding async packets as invalid.
209 * This is used for canceling them when TDs are removed by the HCD.
210 */
211 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
212 {
213 UHCIAsync *async = s->async_pending;
214
215 while (async) {
216 async->valid--;
217 async = async->next;
218 }
219 return NULL;
220 }
221
222 /*
223 * Cancel async packets that are no longer valid
224 */
225 static void uhci_async_validate_end(UHCIState *s)
226 {
227 UHCIAsync *curr = s->async_pending;
228 UHCIAsync **prev = &s->async_pending;
229 UHCIAsync *next;
230
231 while (curr) {
232 if (curr->valid > 0) {
233 prev = &curr->next;
234 curr = curr->next;
235 continue;
236 }
237
238 next = curr->next;
239
240 /* Unlink */
241 *prev = next;
242
243 uhci_async_cancel(s, curr);
244
245 curr = next;
246 }
247 }
248
249 static void uhci_async_cancel_all(UHCIState *s)
250 {
251 UHCIAsync *curr = s->async_pending;
252 UHCIAsync *next;
253
254 while (curr) {
255 next = curr->next;
256
257 uhci_async_cancel(s, curr);
258
259 curr = next;
260 }
261
262 s->async_pending = NULL;
263 }
264
265 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
266 {
267 UHCIAsync *async = s->async_pending;
268
269 while (async) {
270 if (async->td == addr) {
271 if (async->token == token)
272 return async;
273
274 /*
275 * TD was reused for a different transfer.
276 * Invalidate the original one asap.
277 */
278 if (async->valid > 0) {
279 async->valid = 0;
280 dprintf("husb: bad reuse. td 0x%x\n", async->td);
281 }
282 }
283
284 async = async->next;
285 }
286 return NULL;
287 }
288
289 static void uhci_attach(USBPort *port1, USBDevice *dev);
290
291 static void uhci_update_irq(UHCIState *s)
292 {
293 int level;
294 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
295 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
296 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
297 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
298 (s->status & UHCI_STS_HSERR) ||
299 (s->status & UHCI_STS_HCPERR)) {
300 level = 1;
301 } else {
302 level = 0;
303 }
304 qemu_set_irq(s->dev.irq[3], level);
305 }
306
307 static void uhci_reset(UHCIState *s)
308 {
309 uint8_t *pci_conf;
310 int i;
311 UHCIPort *port;
312
313 pci_conf = s->dev.config;
314
315 pci_conf[0x6a] = 0x01; /* usb clock */
316 pci_conf[0x6b] = 0x00;
317 s->cmd = 0;
318 s->status = 0;
319 s->status2 = 0;
320 s->intr = 0;
321 s->fl_base_addr = 0;
322 s->sof_timing = 64;
323
324 for(i = 0; i < NB_PORTS; i++) {
325 port = &s->ports[i];
326 port->ctrl = 0x0080;
327 if (port->port.dev)
328 uhci_attach(&port->port, port->port.dev);
329 }
330
331 uhci_async_cancel_all(s);
332 }
333
334 #if 1
335 static void uhci_save(QEMUFile *f, void *opaque)
336 {
337 UHCIState *s = opaque;
338 uint8_t num_ports = NB_PORTS;
339 int i;
340
341 pci_device_save(&s->dev, f);
342
343 qemu_put_8s(f, &num_ports);
344 for (i = 0; i < num_ports; ++i)
345 qemu_put_be16s(f, &s->ports[i].ctrl);
346 qemu_put_be16s(f, &s->cmd);
347 qemu_put_be16s(f, &s->status);
348 qemu_put_be16s(f, &s->intr);
349 qemu_put_be16s(f, &s->frnum);
350 qemu_put_be32s(f, &s->fl_base_addr);
351 qemu_put_8s(f, &s->sof_timing);
352 qemu_put_8s(f, &s->status2);
353 qemu_put_timer(f, s->frame_timer);
354 }
355
356 static int uhci_load(QEMUFile *f, void *opaque, int version_id)
357 {
358 UHCIState *s = opaque;
359 uint8_t num_ports;
360 int i, ret;
361
362 if (version_id > 1)
363 return -EINVAL;
364
365 ret = pci_device_load(&s->dev, f);
366 if (ret < 0)
367 return ret;
368
369 qemu_get_8s(f, &num_ports);
370 if (num_ports != NB_PORTS)
371 return -EINVAL;
372
373 for (i = 0; i < num_ports; ++i)
374 qemu_get_be16s(f, &s->ports[i].ctrl);
375 qemu_get_be16s(f, &s->cmd);
376 qemu_get_be16s(f, &s->status);
377 qemu_get_be16s(f, &s->intr);
378 qemu_get_be16s(f, &s->frnum);
379 qemu_get_be32s(f, &s->fl_base_addr);
380 qemu_get_8s(f, &s->sof_timing);
381 qemu_get_8s(f, &s->status2);
382 qemu_get_timer(f, s->frame_timer);
383
384 return 0;
385 }
386 #endif
387
388 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
389 {
390 UHCIState *s = opaque;
391
392 addr &= 0x1f;
393 switch(addr) {
394 case 0x0c:
395 s->sof_timing = val;
396 break;
397 }
398 }
399
400 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
401 {
402 UHCIState *s = opaque;
403 uint32_t val;
404
405 addr &= 0x1f;
406 switch(addr) {
407 case 0x0c:
408 val = s->sof_timing;
409 break;
410 default:
411 val = 0xff;
412 break;
413 }
414 return val;
415 }
416
417 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
418 {
419 UHCIState *s = opaque;
420
421 addr &= 0x1f;
422 dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
423
424 switch(addr) {
425 case 0x00:
426 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
427 /* start frame processing */
428 qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
429 s->status &= ~UHCI_STS_HCHALTED;
430 } else if (!(val & UHCI_CMD_RS)) {
431 s->status |= UHCI_STS_HCHALTED;
432 }
433 if (val & UHCI_CMD_GRESET) {
434 UHCIPort *port;
435 USBDevice *dev;
436 int i;
437
438 /* send reset on the USB bus */
439 for(i = 0; i < NB_PORTS; i++) {
440 port = &s->ports[i];
441 dev = port->port.dev;
442 if (dev) {
443 usb_send_msg(dev, USB_MSG_RESET);
444 }
445 }
446 uhci_reset(s);
447 return;
448 }
449 if (val & UHCI_CMD_HCRESET) {
450 uhci_reset(s);
451 return;
452 }
453 s->cmd = val;
454 break;
455 case 0x02:
456 s->status &= ~val;
457 /* XXX: the chip spec is not coherent, so we add a hidden
458 register to distinguish between IOC and SPD */
459 if (val & UHCI_STS_USBINT)
460 s->status2 = 0;
461 uhci_update_irq(s);
462 break;
463 case 0x04:
464 s->intr = val;
465 uhci_update_irq(s);
466 break;
467 case 0x06:
468 if (s->status & UHCI_STS_HCHALTED)
469 s->frnum = val & 0x7ff;
470 break;
471 case 0x10 ... 0x1f:
472 {
473 UHCIPort *port;
474 USBDevice *dev;
475 int n;
476
477 n = (addr >> 1) & 7;
478 if (n >= NB_PORTS)
479 return;
480 port = &s->ports[n];
481 dev = port->port.dev;
482 if (dev) {
483 /* port reset */
484 if ( (val & UHCI_PORT_RESET) &&
485 !(port->ctrl & UHCI_PORT_RESET) ) {
486 usb_send_msg(dev, USB_MSG_RESET);
487 }
488 }
489 port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
490 /* some bits are reset when a '1' is written to them */
491 port->ctrl &= ~(val & 0x000a);
492 }
493 break;
494 }
495 }
496
497 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
498 {
499 UHCIState *s = opaque;
500 uint32_t val;
501
502 addr &= 0x1f;
503 switch(addr) {
504 case 0x00:
505 val = s->cmd;
506 break;
507 case 0x02:
508 val = s->status;
509 break;
510 case 0x04:
511 val = s->intr;
512 break;
513 case 0x06:
514 val = s->frnum;
515 break;
516 case 0x10 ... 0x1f:
517 {
518 UHCIPort *port;
519 int n;
520 n = (addr >> 1) & 7;
521 if (n >= NB_PORTS)
522 goto read_default;
523 port = &s->ports[n];
524 val = port->ctrl;
525 }
526 break;
527 default:
528 read_default:
529 val = 0xff7f; /* disabled port */
530 break;
531 }
532
533 dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
534
535 return val;
536 }
537
538 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
539 {
540 UHCIState *s = opaque;
541
542 addr &= 0x1f;
543 dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
544
545 switch(addr) {
546 case 0x08:
547 s->fl_base_addr = val & ~0xfff;
548 break;
549 }
550 }
551
552 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
553 {
554 UHCIState *s = opaque;
555 uint32_t val;
556
557 addr &= 0x1f;
558 switch(addr) {
559 case 0x08:
560 val = s->fl_base_addr;
561 break;
562 default:
563 val = 0xffffffff;
564 break;
565 }
566 return val;
567 }
568
569 /* signal resume if controller suspended */
570 static void uhci_resume (void *opaque)
571 {
572 UHCIState *s = (UHCIState *)opaque;
573
574 if (!s)
575 return;
576
577 if (s->cmd & UHCI_CMD_EGSM) {
578 s->cmd |= UHCI_CMD_FGR;
579 s->status |= UHCI_STS_RD;
580 uhci_update_irq(s);
581 }
582 }
583
584 static void uhci_attach(USBPort *port1, USBDevice *dev)
585 {
586 UHCIState *s = port1->opaque;
587 UHCIPort *port = &s->ports[port1->index];
588
589 if (dev) {
590 if (port->port.dev) {
591 usb_attach(port1, NULL);
592 }
593 /* set connect status */
594 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
595
596 /* update speed */
597 if (dev->speed == USB_SPEED_LOW)
598 port->ctrl |= UHCI_PORT_LSDA;
599 else
600 port->ctrl &= ~UHCI_PORT_LSDA;
601
602 uhci_resume(s);
603
604 port->port.dev = dev;
605 /* send the attach message */
606 usb_send_msg(dev, USB_MSG_ATTACH);
607 } else {
608 /* set connect status */
609 if (port->ctrl & UHCI_PORT_CCS) {
610 port->ctrl &= ~UHCI_PORT_CCS;
611 port->ctrl |= UHCI_PORT_CSC;
612 }
613 /* disable port */
614 if (port->ctrl & UHCI_PORT_EN) {
615 port->ctrl &= ~UHCI_PORT_EN;
616 port->ctrl |= UHCI_PORT_ENC;
617 }
618
619 uhci_resume(s);
620
621 dev = port->port.dev;
622 if (dev) {
623 /* send the detach message */
624 usb_send_msg(dev, USB_MSG_DETACH);
625 }
626 port->port.dev = NULL;
627 }
628 }
629
630 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
631 {
632 int i, ret;
633
634 dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
635 pid2str(p->pid), p->devaddr, p->devep, p->len);
636 if (p->pid == USB_TOKEN_OUT)
637 dump_data(p->data, p->len);
638
639 ret = USB_RET_NODEV;
640 for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
641 UHCIPort *port = &s->ports[i];
642 USBDevice *dev = port->port.dev;
643
644 if (dev && (port->ctrl & UHCI_PORT_EN))
645 ret = dev->handle_packet(dev, p);
646 }
647
648 dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);
649 if (p->pid == USB_TOKEN_IN && ret > 0)
650 dump_data(p->data, ret);
651
652 return ret;
653 }
654
655 static void uhci_async_complete(USBPacket * packet, void *opaque);
656 static void uhci_process_frame(UHCIState *s);
657
658 /* return -1 if fatal error (frame must be stopped)
659 0 if TD successful
660 1 if TD unsuccessful or inactive
661 */
662 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
663 {
664 int len = 0, max_len, err, ret;
665 uint8_t pid;
666
667 max_len = ((td->token >> 21) + 1) & 0x7ff;
668 pid = td->token & 0xff;
669
670 ret = async->packet.len;
671
672 if (td->ctrl & TD_CTRL_IOC)
673 *int_mask |= 0x01;
674
675 if (td->ctrl & TD_CTRL_IOS)
676 td->ctrl &= ~TD_CTRL_ACTIVE;
677
678 if (ret < 0)
679 goto out;
680
681 len = async->packet.len;
682 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
683
684 /* The NAK bit may have been set by a previous frame, so clear it
685 here. The docs are somewhat unclear, but win2k relies on this
686 behavior. */
687 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
688
689 if (pid == USB_TOKEN_IN) {
690 if (len > max_len) {
691 len = max_len;
692 ret = USB_RET_BABBLE;
693 goto out;
694 }
695
696 if (len > 0) {
697 /* write the data back */
698 cpu_physical_memory_write(td->buffer, async->buffer, len);
699 }
700
701 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
702 *int_mask |= 0x02;
703 /* short packet: do not update QH */
704 dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
705 return 1;
706 }
707 }
708
709 /* success */
710 return 0;
711
712 out:
713 switch(ret) {
714 case USB_RET_STALL:
715 td->ctrl |= TD_CTRL_STALL;
716 td->ctrl &= ~TD_CTRL_ACTIVE;
717 return 1;
718
719 case USB_RET_BABBLE:
720 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
721 td->ctrl &= ~TD_CTRL_ACTIVE;
722 /* frame interrupted */
723 return -1;
724
725 case USB_RET_NAK:
726 td->ctrl |= TD_CTRL_NAK;
727 if (pid == USB_TOKEN_SETUP)
728 break;
729 return 1;
730
731 case USB_RET_NODEV:
732 default:
733 break;
734 }
735
736 /* Retry the TD if error count is not zero */
737
738 td->ctrl |= TD_CTRL_TIMEOUT;
739 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
740 if (err != 0) {
741 err--;
742 if (err == 0) {
743 td->ctrl &= ~TD_CTRL_ACTIVE;
744 s->status |= UHCI_STS_USBERR;
745 uhci_update_irq(s);
746 }
747 }
748 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
749 (err << TD_CTRL_ERROR_SHIFT);
750 return 1;
751 }
752
753 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
754 {
755 UHCIAsync *async;
756 int len = 0, max_len, ret = 0;
757 uint8_t pid;
758
759 /* Is active ? */
760 if (!(td->ctrl & TD_CTRL_ACTIVE))
761 return 1;
762
763 async = uhci_async_find_td(s, addr, td->token);
764 if (async) {
765 /* Already submitted */
766 async->valid = 10;
767
768 if (!async->done)
769 return 1;
770
771 uhci_async_unlink(s, async);
772 goto done;
773 }
774
775 /* Allocate new packet */
776 async = uhci_async_alloc(s);
777 if (!async)
778 return 1;
779
780 async->valid = 10;
781 async->td = addr;
782 async->token = td->token;
783
784 max_len = ((td->token >> 21) + 1) & 0x7ff;
785 pid = td->token & 0xff;
786
787 async->packet.pid = pid;
788 async->packet.devaddr = (td->token >> 8) & 0x7f;
789 async->packet.devep = (td->token >> 15) & 0xf;
790 async->packet.data = async->buffer;
791 async->packet.len = max_len;
792 async->packet.complete_cb = uhci_async_complete;
793 async->packet.complete_opaque = s;
794
795 switch(pid) {
796 case USB_TOKEN_OUT:
797 case USB_TOKEN_SETUP:
798 cpu_physical_memory_read(td->buffer, async->buffer, max_len);
799 ret = uhci_broadcast_packet(s, &async->packet);
800 len = max_len;
801 break;
802
803 case USB_TOKEN_IN:
804 ret = uhci_broadcast_packet(s, &async->packet);
805 break;
806
807 default:
808 /* invalid pid : frame interrupted */
809 uhci_async_free(s, async);
810 s->status |= UHCI_STS_HCPERR;
811 uhci_update_irq(s);
812 return -1;
813 }
814
815 if (ret == USB_RET_ASYNC) {
816 uhci_async_link(s, async);
817 return 2;
818 }
819
820 async->packet.len = ret;
821
822 done:
823 ret = uhci_complete_td(s, td, async, int_mask);
824 uhci_async_free(s, async);
825 return ret;
826 }
827
828 static void uhci_async_complete(USBPacket *packet, void *opaque)
829 {
830 UHCIState *s = opaque;
831 UHCIAsync *async = (UHCIAsync *) packet;
832
833 dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
834
835 async->done = 1;
836
837 uhci_process_frame(s);
838 }
839
840 static int is_valid(uint32_t link)
841 {
842 return (link & 1) == 0;
843 }
844
845 static int is_qh(uint32_t link)
846 {
847 return (link & 2) != 0;
848 }
849
850 static int depth_first(uint32_t link)
851 {
852 return (link & 4) != 0;
853 }
854
855 /* QH DB used for detecting QH loops */
856 #define UHCI_MAX_QUEUES 128
857 typedef struct {
858 uint32_t addr[UHCI_MAX_QUEUES];
859 int count;
860 } QhDb;
861
862 static void qhdb_reset(QhDb *db)
863 {
864 db->count = 0;
865 }
866
867 /* Add QH to DB. Returns 1 if already present or DB is full. */
868 static int qhdb_insert(QhDb *db, uint32_t addr)
869 {
870 int i;
871 for (i = 0; i < db->count; i++)
872 if (db->addr[i] == addr)
873 return 1;
874
875 if (db->count >= UHCI_MAX_QUEUES)
876 return 1;
877
878 db->addr[db->count++] = addr;
879 return 0;
880 }
881
882 static void uhci_process_frame(UHCIState *s)
883 {
884 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
885 uint32_t curr_qh;
886 int cnt, ret;
887 UHCI_TD td;
888 UHCI_QH qh;
889 QhDb qhdb;
890
891 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
892
893 dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
894
895 cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
896 le32_to_cpus(&link);
897
898 int_mask = 0;
899 curr_qh = 0;
900
901 qhdb_reset(&qhdb);
902
903 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
904 if (is_qh(link)) {
905 /* QH */
906
907 if (qhdb_insert(&qhdb, link)) {
908 /*
909 * We're going in circles. Which is not a bug because
910 * HCD is allowed to do that as part of the BW management.
911 * In our case though it makes no sense to spin here. Sync transations
912 * are already done, and async completion handler will re-process
913 * the frame when something is ready.
914 */
915 dprintf("uhci: detected loop. qh 0x%x\n", link);
916 break;
917 }
918
919 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
920 le32_to_cpus(&qh.link);
921 le32_to_cpus(&qh.el_link);
922
923 dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
924 link, qh.link, qh.el_link);
925
926 if (!is_valid(qh.el_link)) {
927 /* QH w/o elements */
928 curr_qh = 0;
929 link = qh.link;
930 } else {
931 /* QH with elements */
932 curr_qh = link;
933 link = qh.el_link;
934 }
935 continue;
936 }
937
938 /* TD */
939 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
940 le32_to_cpus(&td.link);
941 le32_to_cpus(&td.ctrl);
942 le32_to_cpus(&td.token);
943 le32_to_cpus(&td.buffer);
944
945 dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
946 link, td.link, td.ctrl, td.token, curr_qh);
947
948 old_td_ctrl = td.ctrl;
949 ret = uhci_handle_td(s, link, &td, &int_mask);
950 if (old_td_ctrl != td.ctrl) {
951 /* update the status bits of the TD */
952 val = cpu_to_le32(td.ctrl);
953 cpu_physical_memory_write((link & ~0xf) + 4,
954 (const uint8_t *)&val, sizeof(val));
955 }
956
957 if (ret < 0) {
958 /* interrupted frame */
959 break;
960 }
961
962 if (ret == 2 || ret == 1) {
963 dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
964 link, ret == 2 ? "pend" : "skip",
965 td.link, td.ctrl, td.token, curr_qh);
966
967 link = curr_qh ? qh.link : td.link;
968 continue;
969 }
970
971 /* completed TD */
972
973 dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
974 link, td.link, td.ctrl, td.token, curr_qh);
975
976 link = td.link;
977
978 if (curr_qh) {
979 /* update QH element link */
980 qh.el_link = link;
981 val = cpu_to_le32(qh.el_link);
982 cpu_physical_memory_write((curr_qh & ~0xf) + 4,
983 (const uint8_t *)&val, sizeof(val));
984
985 if (!depth_first(link)) {
986 /* done with this QH */
987
988 dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
989 curr_qh, qh.link, qh.el_link);
990
991 curr_qh = 0;
992 link = qh.link;
993 }
994 }
995
996 /* go to the next entry */
997 }
998
999 s->pending_int_mask = int_mask;
1000 }
1001
1002 static void uhci_frame_timer(void *opaque)
1003 {
1004 UHCIState *s = opaque;
1005 int64_t expire_time;
1006
1007 if (!(s->cmd & UHCI_CMD_RS)) {
1008 /* Full stop */
1009 qemu_del_timer(s->frame_timer);
1010 /* set hchalted bit in status - UHCI11D 2.1.2 */
1011 s->status |= UHCI_STS_HCHALTED;
1012 return;
1013 }
1014
1015 /* Complete the previous frame */
1016 if (s->pending_int_mask) {
1017 s->status2 |= s->pending_int_mask;
1018 s->status |= UHCI_STS_USBINT;
1019 uhci_update_irq(s);
1020 }
1021
1022 /* Start new frame */
1023 s->frnum = (s->frnum + 1) & 0x7ff;
1024
1025 dprintf("uhci: new frame #%u\n" , s->frnum);
1026
1027 uhci_async_validate_begin(s);
1028
1029 uhci_process_frame(s);
1030
1031 uhci_async_validate_end(s);
1032
1033 /* prepare the timer for the next frame */
1034 expire_time = qemu_get_clock(vm_clock) +
1035 (ticks_per_sec / FRAME_TIMER_FREQ);
1036 qemu_mod_timer(s->frame_timer, expire_time);
1037 }
1038
1039 static void uhci_map(PCIDevice *pci_dev, int region_num,
1040 uint32_t addr, uint32_t size, int type)
1041 {
1042 UHCIState *s = (UHCIState *)pci_dev;
1043
1044 register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1045 register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1046 register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1047 register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1048 register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1049 register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1050 }
1051
1052 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1053 {
1054 UHCIState *s;
1055 uint8_t *pci_conf;
1056 int i;
1057
1058 s = (UHCIState *)pci_register_device(bus,
1059 "USB-UHCI", sizeof(UHCIState),
1060 devfn, NULL, NULL);
1061 pci_conf = s->dev.config;
1062 pci_conf[0x00] = 0x86;
1063 pci_conf[0x01] = 0x80;
1064 pci_conf[0x02] = 0x20;
1065 pci_conf[0x03] = 0x70;
1066 pci_conf[0x08] = 0x01; // revision number
1067 pci_conf[0x09] = 0x00;
1068 pci_conf[0x0a] = 0x03;
1069 pci_conf[0x0b] = 0x0c;
1070 pci_conf[0x0e] = 0x00; // header_type
1071 pci_conf[0x3d] = 4; // interrupt pin 3
1072 pci_conf[0x60] = 0x10; // release number
1073
1074 for(i = 0; i < NB_PORTS; i++) {
1075 qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1076 }
1077 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1078
1079 uhci_reset(s);
1080
1081 /* Use region 4 for consistency with real hardware. BSD guests seem
1082 to rely on this. */
1083 pci_register_io_region(&s->dev, 4, 0x20,
1084 PCI_ADDRESS_SPACE_IO, uhci_map);
1085 }
1086
1087 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1088 {
1089 UHCIState *s;
1090 uint8_t *pci_conf;
1091 int i;
1092
1093 s = (UHCIState *)pci_register_device(bus,
1094 "USB-UHCI", sizeof(UHCIState),
1095 devfn, NULL, NULL);
1096 pci_conf = s->dev.config;
1097 pci_conf[0x00] = 0x86;
1098 pci_conf[0x01] = 0x80;
1099 pci_conf[0x02] = 0x12;
1100 pci_conf[0x03] = 0x71;
1101 pci_conf[0x08] = 0x01; // revision number
1102 pci_conf[0x09] = 0x00;
1103 pci_conf[0x0a] = 0x03;
1104 pci_conf[0x0b] = 0x0c;
1105 pci_conf[0x0e] = 0x00; // header_type
1106 pci_conf[0x3d] = 4; // interrupt pin 3
1107 pci_conf[0x60] = 0x10; // release number
1108
1109 for(i = 0; i < NB_PORTS; i++) {
1110 qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1111 }
1112 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1113
1114 uhci_reset(s);
1115
1116 /* Use region 4 for consistency with real hardware. BSD guests seem
1117 to rely on this. */
1118 pci_register_io_region(&s->dev, 4, 0x20,
1119 PCI_ADDRESS_SPACE_IO, uhci_map);
1120
1121 register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1122 }