2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
31 #include "qemu-timer.h"
35 //#define DEBUG_DUMP_DATA
37 #define UHCI_CMD_FGR (1 << 4)
38 #define UHCI_CMD_EGSM (1 << 3)
39 #define UHCI_CMD_GRESET (1 << 2)
40 #define UHCI_CMD_HCRESET (1 << 1)
41 #define UHCI_CMD_RS (1 << 0)
43 #define UHCI_STS_HCHALTED (1 << 5)
44 #define UHCI_STS_HCPERR (1 << 4)
45 #define UHCI_STS_HSERR (1 << 3)
46 #define UHCI_STS_RD (1 << 2)
47 #define UHCI_STS_USBERR (1 << 1)
48 #define UHCI_STS_USBINT (1 << 0)
50 #define TD_CTRL_SPD (1 << 29)
51 #define TD_CTRL_ERROR_SHIFT 27
52 #define TD_CTRL_IOS (1 << 25)
53 #define TD_CTRL_IOC (1 << 24)
54 #define TD_CTRL_ACTIVE (1 << 23)
55 #define TD_CTRL_STALL (1 << 22)
56 #define TD_CTRL_BABBLE (1 << 20)
57 #define TD_CTRL_NAK (1 << 19)
58 #define TD_CTRL_TIMEOUT (1 << 18)
60 #define UHCI_PORT_SUSPEND (1 << 12)
61 #define UHCI_PORT_RESET (1 << 9)
62 #define UHCI_PORT_LSDA (1 << 8)
63 #define UHCI_PORT_RD (1 << 6)
64 #define UHCI_PORT_ENC (1 << 3)
65 #define UHCI_PORT_EN (1 << 2)
66 #define UHCI_PORT_CSC (1 << 1)
67 #define UHCI_PORT_CCS (1 << 0)
69 #define UHCI_PORT_READ_ONLY (0x1bb)
70 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
72 #define FRAME_TIMER_FREQ 1000
74 #define FRAME_MAX_LOOPS 100
79 #define DPRINTF printf
81 static const char *pid2str(int pid
)
84 case USB_TOKEN_SETUP
: return "SETUP";
85 case USB_TOKEN_IN
: return "IN";
86 case USB_TOKEN_OUT
: return "OUT";
95 #ifdef DEBUG_DUMP_DATA
96 static void dump_data(const uint8_t *data
, int len
)
100 printf("uhci: data: ");
101 for(i
= 0; i
< len
; i
++)
102 printf(" %02x", data
[i
]);
106 static void dump_data(const uint8_t *data
, int len
) {}
110 * Pending async transaction.
111 * 'packet' must be the first field because completion
112 * handler does "(UHCIAsync *) pkt" cast.
114 typedef struct UHCIAsync
{
116 QTAILQ_ENTRY(UHCIAsync
) next
;
122 uint8_t buffer
[2048];
125 typedef struct UHCIPort
{
130 typedef struct UHCIState
{
133 uint16_t cmd
; /* cmd register */
135 uint16_t intr
; /* interrupt enable register */
136 uint16_t frnum
; /* frame number */
137 uint32_t fl_base_addr
; /* frame list base address */
139 uint8_t status2
; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
141 QEMUTimer
*frame_timer
;
142 UHCIPort ports
[NB_PORTS
];
144 /* Interrupts that should be raised at the end of the current frame. */
145 uint32_t pending_int_mask
;
148 QTAILQ_HEAD(,UHCIAsync
) async_pending
;
149 uint8_t num_ports_vmstate
;
152 typedef struct UHCI_TD
{
154 uint32_t ctrl
; /* see TD_CTRL_xxx */
159 typedef struct UHCI_QH
{
164 static UHCIAsync
*uhci_async_alloc(UHCIState
*s
)
166 UHCIAsync
*async
= qemu_malloc(sizeof(UHCIAsync
));
168 memset(&async
->packet
, 0, sizeof(async
->packet
));
178 static void uhci_async_free(UHCIState
*s
, UHCIAsync
*async
)
183 static void uhci_async_link(UHCIState
*s
, UHCIAsync
*async
)
185 QTAILQ_INSERT_HEAD(&s
->async_pending
, async
, next
);
188 static void uhci_async_unlink(UHCIState
*s
, UHCIAsync
*async
)
190 QTAILQ_REMOVE(&s
->async_pending
, async
, next
);
193 static void uhci_async_cancel(UHCIState
*s
, UHCIAsync
*async
)
195 DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
196 async
->td
, async
->token
, async
->done
);
199 usb_cancel_packet(&async
->packet
);
200 uhci_async_free(s
, async
);
204 * Mark all outstanding async packets as invalid.
205 * This is used for canceling them when TDs are removed by the HCD.
207 static UHCIAsync
*uhci_async_validate_begin(UHCIState
*s
)
211 QTAILQ_FOREACH(async
, &s
->async_pending
, next
) {
218 * Cancel async packets that are no longer valid
220 static void uhci_async_validate_end(UHCIState
*s
)
224 QTAILQ_FOREACH_SAFE(curr
, &s
->async_pending
, next
, n
) {
225 if (curr
->valid
> 0) {
228 uhci_async_unlink(s
, curr
);
229 uhci_async_cancel(s
, curr
);
233 static void uhci_async_cancel_all(UHCIState
*s
)
237 QTAILQ_FOREACH_SAFE(curr
, &s
->async_pending
, next
, n
) {
238 uhci_async_unlink(s
, curr
);
239 uhci_async_cancel(s
, curr
);
243 static UHCIAsync
*uhci_async_find_td(UHCIState
*s
, uint32_t addr
, uint32_t token
)
246 UHCIAsync
*match
= NULL
;
250 * We're looking for the best match here. ie both td addr and token.
251 * Otherwise we return last good match. ie just token.
252 * It's ok to match just token because it identifies the transaction
253 * rather well, token includes: device addr, endpoint, size, etc.
255 * Also since we queue async transactions in reverse order by returning
256 * last good match we restores the order.
258 * It's expected that we wont have a ton of outstanding transactions.
259 * If we ever do we'd want to optimize this algorithm.
262 QTAILQ_FOREACH(async
, &s
->async_pending
, next
) {
263 if (async
->token
== token
) {
267 if (async
->td
== addr
) {
276 fprintf(stderr
, "uhci: warning lots of async transactions\n");
281 static void uhci_update_irq(UHCIState
*s
)
284 if (((s
->status2
& 1) && (s
->intr
& (1 << 2))) ||
285 ((s
->status2
& 2) && (s
->intr
& (1 << 3))) ||
286 ((s
->status
& UHCI_STS_USBERR
) && (s
->intr
& (1 << 0))) ||
287 ((s
->status
& UHCI_STS_RD
) && (s
->intr
& (1 << 1))) ||
288 (s
->status
& UHCI_STS_HSERR
) ||
289 (s
->status
& UHCI_STS_HCPERR
)) {
294 qemu_set_irq(s
->dev
.irq
[3], level
);
297 static void uhci_reset(void *opaque
)
299 UHCIState
*s
= opaque
;
304 DPRINTF("uhci: full reset\n");
306 pci_conf
= s
->dev
.config
;
308 pci_conf
[0x6a] = 0x01; /* usb clock */
309 pci_conf
[0x6b] = 0x00;
317 for(i
= 0; i
< NB_PORTS
; i
++) {
320 if (port
->port
.dev
) {
321 usb_attach(&port
->port
, port
->port
.dev
);
325 uhci_async_cancel_all(s
);
328 static void uhci_pre_save(void *opaque
)
330 UHCIState
*s
= opaque
;
332 uhci_async_cancel_all(s
);
335 static const VMStateDescription vmstate_uhci_port
= {
338 .minimum_version_id
= 1,
339 .minimum_version_id_old
= 1,
340 .fields
= (VMStateField
[]) {
341 VMSTATE_UINT16(ctrl
, UHCIPort
),
342 VMSTATE_END_OF_LIST()
346 static const VMStateDescription vmstate_uhci
= {
349 .minimum_version_id
= 1,
350 .minimum_version_id_old
= 1,
351 .pre_save
= uhci_pre_save
,
352 .fields
= (VMStateField
[]) {
353 VMSTATE_PCI_DEVICE(dev
, UHCIState
),
354 VMSTATE_UINT8_EQUAL(num_ports_vmstate
, UHCIState
),
355 VMSTATE_STRUCT_ARRAY(ports
, UHCIState
, NB_PORTS
, 1,
356 vmstate_uhci_port
, UHCIPort
),
357 VMSTATE_UINT16(cmd
, UHCIState
),
358 VMSTATE_UINT16(status
, UHCIState
),
359 VMSTATE_UINT16(intr
, UHCIState
),
360 VMSTATE_UINT16(frnum
, UHCIState
),
361 VMSTATE_UINT32(fl_base_addr
, UHCIState
),
362 VMSTATE_UINT8(sof_timing
, UHCIState
),
363 VMSTATE_UINT8(status2
, UHCIState
),
364 VMSTATE_TIMER(frame_timer
, UHCIState
),
365 VMSTATE_INT64_V(expire_time
, UHCIState
, 2),
366 VMSTATE_END_OF_LIST()
370 static void uhci_ioport_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
372 UHCIState
*s
= opaque
;
382 static uint32_t uhci_ioport_readb(void *opaque
, uint32_t addr
)
384 UHCIState
*s
= opaque
;
399 static void uhci_ioport_writew(void *opaque
, uint32_t addr
, uint32_t val
)
401 UHCIState
*s
= opaque
;
404 DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr
, val
);
408 if ((val
& UHCI_CMD_RS
) && !(s
->cmd
& UHCI_CMD_RS
)) {
409 /* start frame processing */
410 qemu_mod_timer(s
->frame_timer
, qemu_get_clock_ns(vm_clock
));
411 s
->status
&= ~UHCI_STS_HCHALTED
;
412 } else if (!(val
& UHCI_CMD_RS
)) {
413 s
->status
|= UHCI_STS_HCHALTED
;
415 if (val
& UHCI_CMD_GRESET
) {
420 /* send reset on the USB bus */
421 for(i
= 0; i
< NB_PORTS
; i
++) {
423 dev
= port
->port
.dev
;
425 usb_send_msg(dev
, USB_MSG_RESET
);
431 if (val
& UHCI_CMD_HCRESET
) {
439 /* XXX: the chip spec is not coherent, so we add a hidden
440 register to distinguish between IOC and SPD */
441 if (val
& UHCI_STS_USBINT
)
450 if (s
->status
& UHCI_STS_HCHALTED
)
451 s
->frnum
= val
& 0x7ff;
463 dev
= port
->port
.dev
;
466 if ( (val
& UHCI_PORT_RESET
) &&
467 !(port
->ctrl
& UHCI_PORT_RESET
) ) {
468 usb_send_msg(dev
, USB_MSG_RESET
);
471 port
->ctrl
&= UHCI_PORT_READ_ONLY
;
472 port
->ctrl
|= (val
& ~UHCI_PORT_READ_ONLY
);
473 /* some bits are reset when a '1' is written to them */
474 port
->ctrl
&= ~(val
& UHCI_PORT_WRITE_CLEAR
);
480 static uint32_t uhci_ioport_readw(void *opaque
, uint32_t addr
)
482 UHCIState
*s
= opaque
;
512 val
= 0xff7f; /* disabled port */
516 DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr
, val
);
521 static void uhci_ioport_writel(void *opaque
, uint32_t addr
, uint32_t val
)
523 UHCIState
*s
= opaque
;
526 DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr
, val
);
530 s
->fl_base_addr
= val
& ~0xfff;
535 static uint32_t uhci_ioport_readl(void *opaque
, uint32_t addr
)
537 UHCIState
*s
= opaque
;
543 val
= s
->fl_base_addr
;
552 /* signal resume if controller suspended */
553 static void uhci_resume (void *opaque
)
555 UHCIState
*s
= (UHCIState
*)opaque
;
560 if (s
->cmd
& UHCI_CMD_EGSM
) {
561 s
->cmd
|= UHCI_CMD_FGR
;
562 s
->status
|= UHCI_STS_RD
;
567 static void uhci_attach(USBPort
*port1
)
569 UHCIState
*s
= port1
->opaque
;
570 UHCIPort
*port
= &s
->ports
[port1
->index
];
572 /* set connect status */
573 port
->ctrl
|= UHCI_PORT_CCS
| UHCI_PORT_CSC
;
576 if (port
->port
.dev
->speed
== USB_SPEED_LOW
) {
577 port
->ctrl
|= UHCI_PORT_LSDA
;
579 port
->ctrl
&= ~UHCI_PORT_LSDA
;
585 static void uhci_detach(USBPort
*port1
)
587 UHCIState
*s
= port1
->opaque
;
588 UHCIPort
*port
= &s
->ports
[port1
->index
];
590 /* set connect status */
591 if (port
->ctrl
& UHCI_PORT_CCS
) {
592 port
->ctrl
&= ~UHCI_PORT_CCS
;
593 port
->ctrl
|= UHCI_PORT_CSC
;
596 if (port
->ctrl
& UHCI_PORT_EN
) {
597 port
->ctrl
&= ~UHCI_PORT_EN
;
598 port
->ctrl
|= UHCI_PORT_ENC
;
604 static void uhci_wakeup(USBDevice
*dev
)
606 USBBus
*bus
= usb_bus_from_device(dev
);
607 UHCIState
*s
= container_of(bus
, UHCIState
, bus
);
608 UHCIPort
*port
= s
->ports
+ dev
->port
->index
;
610 if (port
->ctrl
& UHCI_PORT_SUSPEND
&& !(port
->ctrl
& UHCI_PORT_RD
)) {
611 port
->ctrl
|= UHCI_PORT_RD
;
616 static int uhci_broadcast_packet(UHCIState
*s
, USBPacket
*p
)
620 DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
621 pid2str(p
->pid
), p
->devaddr
, p
->devep
, p
->len
);
622 if (p
->pid
== USB_TOKEN_OUT
|| p
->pid
== USB_TOKEN_SETUP
)
623 dump_data(p
->data
, p
->len
);
626 for (i
= 0; i
< NB_PORTS
&& ret
== USB_RET_NODEV
; i
++) {
627 UHCIPort
*port
= &s
->ports
[i
];
628 USBDevice
*dev
= port
->port
.dev
;
630 if (dev
&& (port
->ctrl
& UHCI_PORT_EN
))
631 ret
= dev
->info
->handle_packet(dev
, p
);
634 DPRINTF("uhci: packet exit. ret %d len %d\n", ret
, p
->len
);
635 if (p
->pid
== USB_TOKEN_IN
&& ret
> 0)
636 dump_data(p
->data
, ret
);
641 static void uhci_async_complete(USBPacket
* packet
, void *opaque
);
642 static void uhci_process_frame(UHCIState
*s
);
644 /* return -1 if fatal error (frame must be stopped)
646 1 if TD unsuccessful or inactive
648 static int uhci_complete_td(UHCIState
*s
, UHCI_TD
*td
, UHCIAsync
*async
, uint32_t *int_mask
)
650 int len
= 0, max_len
, err
, ret
;
653 max_len
= ((td
->token
>> 21) + 1) & 0x7ff;
654 pid
= td
->token
& 0xff;
656 ret
= async
->packet
.len
;
658 if (td
->ctrl
& TD_CTRL_IOS
)
659 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
664 len
= async
->packet
.len
;
665 td
->ctrl
= (td
->ctrl
& ~0x7ff) | ((len
- 1) & 0x7ff);
667 /* The NAK bit may have been set by a previous frame, so clear it
668 here. The docs are somewhat unclear, but win2k relies on this
670 td
->ctrl
&= ~(TD_CTRL_ACTIVE
| TD_CTRL_NAK
);
671 if (td
->ctrl
& TD_CTRL_IOC
)
674 if (pid
== USB_TOKEN_IN
) {
676 ret
= USB_RET_BABBLE
;
681 /* write the data back */
682 cpu_physical_memory_write(td
->buffer
, async
->buffer
, len
);
685 if ((td
->ctrl
& TD_CTRL_SPD
) && len
< max_len
) {
687 /* short packet: do not update QH */
688 DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async
->td
, async
->token
);
699 td
->ctrl
|= TD_CTRL_STALL
;
700 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
704 td
->ctrl
|= TD_CTRL_BABBLE
| TD_CTRL_STALL
;
705 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
706 /* frame interrupted */
710 td
->ctrl
|= TD_CTRL_NAK
;
711 if (pid
== USB_TOKEN_SETUP
)
720 /* Retry the TD if error count is not zero */
722 td
->ctrl
|= TD_CTRL_TIMEOUT
;
723 err
= (td
->ctrl
>> TD_CTRL_ERROR_SHIFT
) & 3;
727 td
->ctrl
&= ~TD_CTRL_ACTIVE
;
728 s
->status
|= UHCI_STS_USBERR
;
729 if (td
->ctrl
& TD_CTRL_IOC
)
734 td
->ctrl
= (td
->ctrl
& ~(3 << TD_CTRL_ERROR_SHIFT
)) |
735 (err
<< TD_CTRL_ERROR_SHIFT
);
739 static int uhci_handle_td(UHCIState
*s
, uint32_t addr
, UHCI_TD
*td
, uint32_t *int_mask
)
742 int len
= 0, max_len
;
747 if (!(td
->ctrl
& TD_CTRL_ACTIVE
))
750 /* token field is not unique for isochronous requests,
751 * so use the destination buffer
753 if (td
->ctrl
& TD_CTRL_IOS
) {
761 async
= uhci_async_find_td(s
, addr
, token
);
763 /* Already submitted */
769 uhci_async_unlink(s
, async
);
773 /* Allocate new packet */
774 async
= uhci_async_alloc(s
);
778 /* valid needs to be large enough to handle 10 frame delay
779 * for initial isochronous requests
783 async
->token
= token
;
786 max_len
= ((td
->token
>> 21) + 1) & 0x7ff;
787 pid
= td
->token
& 0xff;
789 async
->packet
.pid
= pid
;
790 async
->packet
.devaddr
= (td
->token
>> 8) & 0x7f;
791 async
->packet
.devep
= (td
->token
>> 15) & 0xf;
792 async
->packet
.data
= async
->buffer
;
793 async
->packet
.len
= max_len
;
794 async
->packet
.complete_cb
= uhci_async_complete
;
795 async
->packet
.complete_opaque
= s
;
799 case USB_TOKEN_SETUP
:
800 cpu_physical_memory_read(td
->buffer
, async
->buffer
, max_len
);
801 len
= uhci_broadcast_packet(s
, &async
->packet
);
807 len
= uhci_broadcast_packet(s
, &async
->packet
);
811 /* invalid pid : frame interrupted */
812 uhci_async_free(s
, async
);
813 s
->status
|= UHCI_STS_HCPERR
;
818 if (len
== USB_RET_ASYNC
) {
819 uhci_async_link(s
, async
);
823 async
->packet
.len
= len
;
826 len
= uhci_complete_td(s
, td
, async
, int_mask
);
827 uhci_async_free(s
, async
);
831 static void uhci_async_complete(USBPacket
*packet
, void *opaque
)
833 UHCIState
*s
= opaque
;
834 UHCIAsync
*async
= (UHCIAsync
*) packet
;
836 DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async
->td
, async
->token
);
840 uint32_t link
= async
->td
;
841 uint32_t int_mask
= 0, val
;
843 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &td
, sizeof(td
));
844 le32_to_cpus(&td
.link
);
845 le32_to_cpus(&td
.ctrl
);
846 le32_to_cpus(&td
.token
);
847 le32_to_cpus(&td
.buffer
);
849 uhci_async_unlink(s
, async
);
850 uhci_complete_td(s
, &td
, async
, &int_mask
);
851 s
->pending_int_mask
|= int_mask
;
853 /* update the status bits of the TD */
854 val
= cpu_to_le32(td
.ctrl
);
855 cpu_physical_memory_write((link
& ~0xf) + 4,
856 (const uint8_t *)&val
, sizeof(val
));
857 uhci_async_free(s
, async
);
860 uhci_process_frame(s
);
864 static int is_valid(uint32_t link
)
866 return (link
& 1) == 0;
869 static int is_qh(uint32_t link
)
871 return (link
& 2) != 0;
874 static int depth_first(uint32_t link
)
876 return (link
& 4) != 0;
879 /* QH DB used for detecting QH loops */
880 #define UHCI_MAX_QUEUES 128
882 uint32_t addr
[UHCI_MAX_QUEUES
];
886 static void qhdb_reset(QhDb
*db
)
891 /* Add QH to DB. Returns 1 if already present or DB is full. */
892 static int qhdb_insert(QhDb
*db
, uint32_t addr
)
895 for (i
= 0; i
< db
->count
; i
++)
896 if (db
->addr
[i
] == addr
)
899 if (db
->count
>= UHCI_MAX_QUEUES
)
902 db
->addr
[db
->count
++] = addr
;
906 static void uhci_process_frame(UHCIState
*s
)
908 uint32_t frame_addr
, link
, old_td_ctrl
, val
, int_mask
;
915 frame_addr
= s
->fl_base_addr
+ ((s
->frnum
& 0x3ff) << 2);
917 DPRINTF("uhci: processing frame %d addr 0x%x\n" , s
->frnum
, frame_addr
);
919 cpu_physical_memory_read(frame_addr
, (uint8_t *)&link
, 4);
927 for (cnt
= FRAME_MAX_LOOPS
; is_valid(link
) && cnt
; cnt
--) {
931 if (qhdb_insert(&qhdb
, link
)) {
933 * We're going in circles. Which is not a bug because
934 * HCD is allowed to do that as part of the BW management.
935 * In our case though it makes no sense to spin here. Sync transations
936 * are already done, and async completion handler will re-process
937 * the frame when something is ready.
939 DPRINTF("uhci: detected loop. qh 0x%x\n", link
);
943 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &qh
, sizeof(qh
));
944 le32_to_cpus(&qh
.link
);
945 le32_to_cpus(&qh
.el_link
);
947 DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
948 link
, qh
.link
, qh
.el_link
);
950 if (!is_valid(qh
.el_link
)) {
951 /* QH w/o elements */
955 /* QH with elements */
963 cpu_physical_memory_read(link
& ~0xf, (uint8_t *) &td
, sizeof(td
));
964 le32_to_cpus(&td
.link
);
965 le32_to_cpus(&td
.ctrl
);
966 le32_to_cpus(&td
.token
);
967 le32_to_cpus(&td
.buffer
);
969 DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
970 link
, td
.link
, td
.ctrl
, td
.token
, curr_qh
);
972 old_td_ctrl
= td
.ctrl
;
973 ret
= uhci_handle_td(s
, link
, &td
, &int_mask
);
974 if (old_td_ctrl
!= td
.ctrl
) {
975 /* update the status bits of the TD */
976 val
= cpu_to_le32(td
.ctrl
);
977 cpu_physical_memory_write((link
& ~0xf) + 4,
978 (const uint8_t *)&val
, sizeof(val
));
982 /* interrupted frame */
986 if (ret
== 2 || ret
== 1) {
987 DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
988 link
, ret
== 2 ? "pend" : "skip",
989 td
.link
, td
.ctrl
, td
.token
, curr_qh
);
991 link
= curr_qh
? qh
.link
: td
.link
;
997 DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
998 link
, td
.link
, td
.ctrl
, td
.token
, curr_qh
);
1003 /* update QH element link */
1005 val
= cpu_to_le32(qh
.el_link
);
1006 cpu_physical_memory_write((curr_qh
& ~0xf) + 4,
1007 (const uint8_t *)&val
, sizeof(val
));
1009 if (!depth_first(link
)) {
1010 /* done with this QH */
1012 DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1013 curr_qh
, qh
.link
, qh
.el_link
);
1020 /* go to the next entry */
1023 s
->pending_int_mask
|= int_mask
;
1026 static void uhci_frame_timer(void *opaque
)
1028 UHCIState
*s
= opaque
;
1030 /* prepare the timer for the next frame */
1031 s
->expire_time
+= (get_ticks_per_sec() / FRAME_TIMER_FREQ
);
1033 if (!(s
->cmd
& UHCI_CMD_RS
)) {
1035 qemu_del_timer(s
->frame_timer
);
1036 /* set hchalted bit in status - UHCI11D 2.1.2 */
1037 s
->status
|= UHCI_STS_HCHALTED
;
1039 DPRINTF("uhci: halted\n");
1043 /* Complete the previous frame */
1044 if (s
->pending_int_mask
) {
1045 s
->status2
|= s
->pending_int_mask
;
1046 s
->status
|= UHCI_STS_USBINT
;
1049 s
->pending_int_mask
= 0;
1051 /* Start new frame */
1052 s
->frnum
= (s
->frnum
+ 1) & 0x7ff;
1054 DPRINTF("uhci: new frame #%u\n" , s
->frnum
);
1056 uhci_async_validate_begin(s
);
1058 uhci_process_frame(s
);
1060 uhci_async_validate_end(s
);
1062 qemu_mod_timer(s
->frame_timer
, s
->expire_time
);
1065 static void uhci_map(PCIDevice
*pci_dev
, int region_num
,
1066 pcibus_t addr
, pcibus_t size
, int type
)
1068 UHCIState
*s
= (UHCIState
*)pci_dev
;
1070 register_ioport_write(addr
, 32, 2, uhci_ioport_writew
, s
);
1071 register_ioport_read(addr
, 32, 2, uhci_ioport_readw
, s
);
1072 register_ioport_write(addr
, 32, 4, uhci_ioport_writel
, s
);
1073 register_ioport_read(addr
, 32, 4, uhci_ioport_readl
, s
);
1074 register_ioport_write(addr
, 32, 1, uhci_ioport_writeb
, s
);
1075 register_ioport_read(addr
, 32, 1, uhci_ioport_readb
, s
);
1078 static USBPortOps uhci_port_ops
= {
1079 .attach
= uhci_attach
,
1080 .detach
= uhci_detach
,
1081 .wakeup
= uhci_wakeup
,
1084 static int usb_uhci_common_initfn(UHCIState
*s
)
1086 uint8_t *pci_conf
= s
->dev
.config
;
1089 pci_conf
[PCI_REVISION_ID
] = 0x01; // revision number
1090 pci_conf
[PCI_CLASS_PROG
] = 0x00;
1091 pci_config_set_class(pci_conf
, PCI_CLASS_SERIAL_USB
);
1092 /* TODO: reset value should be 0. */
1093 pci_conf
[PCI_INTERRUPT_PIN
] = 4; // interrupt pin 3
1094 pci_conf
[0x60] = 0x10; // release number
1096 usb_bus_new(&s
->bus
, &s
->dev
.qdev
);
1097 for(i
= 0; i
< NB_PORTS
; i
++) {
1098 usb_register_port(&s
->bus
, &s
->ports
[i
].port
, s
, i
, &uhci_port_ops
,
1099 USB_SPEED_MASK_LOW
| USB_SPEED_MASK_FULL
);
1100 usb_port_location(&s
->ports
[i
].port
, NULL
, i
+1);
1102 s
->frame_timer
= qemu_new_timer_ns(vm_clock
, uhci_frame_timer
, s
);
1103 s
->expire_time
= qemu_get_clock_ns(vm_clock
) +
1104 (get_ticks_per_sec() / FRAME_TIMER_FREQ
);
1105 s
->num_ports_vmstate
= NB_PORTS
;
1106 QTAILQ_INIT(&s
->async_pending
);
1108 qemu_register_reset(uhci_reset
, s
);
1110 /* Use region 4 for consistency with real hardware. BSD guests seem
1112 pci_register_bar(&s
->dev
, 4, 0x20,
1113 PCI_BASE_ADDRESS_SPACE_IO
, uhci_map
);
1118 static int usb_uhci_piix3_initfn(PCIDevice
*dev
)
1120 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1121 uint8_t *pci_conf
= s
->dev
.config
;
1123 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_INTEL
);
1124 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_INTEL_82371SB_2
);
1125 return usb_uhci_common_initfn(s
);
1128 static int usb_uhci_piix4_initfn(PCIDevice
*dev
)
1130 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1131 uint8_t *pci_conf
= s
->dev
.config
;
1133 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_INTEL
);
1134 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_INTEL_82371AB_2
);
1135 return usb_uhci_common_initfn(s
);
1138 static int usb_uhci_vt82c686b_initfn(PCIDevice
*dev
)
1140 UHCIState
*s
= DO_UPCAST(UHCIState
, dev
, dev
);
1141 uint8_t *pci_conf
= s
->dev
.config
;
1143 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_VIA
);
1144 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_VIA_UHCI
);
1146 /* USB misc control 1/2 */
1147 pci_set_long(pci_conf
+ 0x40,0x00001000);
1149 pci_set_long(pci_conf
+ 0x80,0x00020001);
1150 /* USB legacy support */
1151 pci_set_long(pci_conf
+ 0xc0,0x00002000);
1153 return usb_uhci_common_initfn(s
);
1156 static PCIDeviceInfo uhci_info
[] = {
1158 .qdev
.name
= "piix3-usb-uhci",
1159 .qdev
.size
= sizeof(UHCIState
),
1160 .qdev
.vmsd
= &vmstate_uhci
,
1161 .init
= usb_uhci_piix3_initfn
,
1163 .qdev
.name
= "piix4-usb-uhci",
1164 .qdev
.size
= sizeof(UHCIState
),
1165 .qdev
.vmsd
= &vmstate_uhci
,
1166 .init
= usb_uhci_piix4_initfn
,
1168 .qdev
.name
= "vt82c686b-usb-uhci",
1169 .qdev
.size
= sizeof(UHCIState
),
1170 .qdev
.vmsd
= &vmstate_uhci
,
1171 .init
= usb_uhci_vt82c686b_initfn
,
1177 static void uhci_register(void)
1179 pci_qdev_register_many(uhci_info
);
1181 device_init(uhci_register
);
1183 void usb_uhci_piix3_init(PCIBus
*bus
, int devfn
)
1185 pci_create_simple(bus
, devfn
, "piix3-usb-uhci");
1188 void usb_uhci_piix4_init(PCIBus
*bus
, int devfn
)
1190 pci_create_simple(bus
, devfn
, "piix4-usb-uhci");
1193 void usb_uhci_vt82c686b_init(PCIBus
*bus
, int devfn
)
1195 pci_create_simple(bus
, devfn
, "vt82c686b-usb-uhci");