Statistics
| Branch: | Revision:

root / hw / usb-uhci.c @ 7267c094

History | View | Annotate | Download (33.2 kB)

1
/*
2
 * USB UHCI controller emulation
3
 *
4
 * Copyright (c) 2005 Fabrice Bellard
5
 *
6
 * Copyright (c) 2008 Max Krasnyansky
7
 *     Magor rewrite of the UHCI data structures parser and frame processor
8
 *     Support for fully async operation and multiple outstanding transactions
9
 *
10
 * Permission is hereby granted, free of charge, to any person obtaining a copy
11
 * of this software and associated documentation files (the "Software"), to deal
12
 * in the Software without restriction, including without limitation the rights
13
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
 * copies of the Software, and to permit persons to whom the Software is
15
 * furnished to do so, subject to the following conditions:
16
 *
17
 * The above copyright notice and this permission notice shall be included in
18
 * all copies or substantial portions of the Software.
19
 *
20
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26
 * THE SOFTWARE.
27
 */
28
#include "hw.h"
29
#include "usb.h"
30
#include "pci.h"
31
#include "qemu-timer.h"
32
#include "usb-uhci.h"
33
#include "iov.h"
34
#include "dma.h"
35

    
36
//#define DEBUG
37
//#define DEBUG_DUMP_DATA
38

    
39
#define UHCI_CMD_FGR      (1 << 4)
40
#define UHCI_CMD_EGSM     (1 << 3)
41
#define UHCI_CMD_GRESET   (1 << 2)
42
#define UHCI_CMD_HCRESET  (1 << 1)
43
#define UHCI_CMD_RS       (1 << 0)
44

    
45
#define UHCI_STS_HCHALTED (1 << 5)
46
#define UHCI_STS_HCPERR   (1 << 4)
47
#define UHCI_STS_HSERR    (1 << 3)
48
#define UHCI_STS_RD       (1 << 2)
49
#define UHCI_STS_USBERR   (1 << 1)
50
#define UHCI_STS_USBINT   (1 << 0)
51

    
52
#define TD_CTRL_SPD     (1 << 29)
53
#define TD_CTRL_ERROR_SHIFT  27
54
#define TD_CTRL_IOS     (1 << 25)
55
#define TD_CTRL_IOC     (1 << 24)
56
#define TD_CTRL_ACTIVE  (1 << 23)
57
#define TD_CTRL_STALL   (1 << 22)
58
#define TD_CTRL_BABBLE  (1 << 20)
59
#define TD_CTRL_NAK     (1 << 19)
60
#define TD_CTRL_TIMEOUT (1 << 18)
61

    
62
#define UHCI_PORT_SUSPEND (1 << 12)
63
#define UHCI_PORT_RESET (1 << 9)
64
#define UHCI_PORT_LSDA  (1 << 8)
65
#define UHCI_PORT_RD    (1 << 6)
66
#define UHCI_PORT_ENC   (1 << 3)
67
#define UHCI_PORT_EN    (1 << 2)
68
#define UHCI_PORT_CSC   (1 << 1)
69
#define UHCI_PORT_CCS   (1 << 0)
70

    
71
#define UHCI_PORT_READ_ONLY    (0x1bb)
72
#define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
73

    
74
#define FRAME_TIMER_FREQ 1000
75

    
76
#define FRAME_MAX_LOOPS  100
77

    
78
#define NB_PORTS 2
79

    
80
#ifdef DEBUG
81
#define DPRINTF printf
82

    
83
static const char *pid2str(int pid)
84
{
85
    switch (pid) {
86
    case USB_TOKEN_SETUP: return "SETUP";
87
    case USB_TOKEN_IN:    return "IN";
88
    case USB_TOKEN_OUT:   return "OUT";
89
    }
90
    return "?";
91
}
92

    
93
#else
94
#define DPRINTF(...)
95
#endif
96

    
97
#ifdef DEBUG_DUMP_DATA
98
static void dump_data(USBPacket *p, int ret)
99
{
100
    iov_hexdump(p->iov.iov, p->iov.niov, stderr, "uhci", ret);
101
}
102
#else
103
static void dump_data(USBPacket *p, int ret) {}
104
#endif
105

    
106
typedef struct UHCIState UHCIState;
107

    
108
/* 
109
 * Pending async transaction.
110
 * 'packet' must be the first field because completion
111
 * handler does "(UHCIAsync *) pkt" cast.
112
 */
113
typedef struct UHCIAsync {
114
    USBPacket packet;
115
    QEMUSGList sgl;
116
    UHCIState *uhci;
117
    QTAILQ_ENTRY(UHCIAsync) next;
118
    uint32_t  td;
119
    uint32_t  token;
120
    int8_t    valid;
121
    uint8_t   isoc;
122
    uint8_t   done;
123
} UHCIAsync;
124

    
125
typedef struct UHCIPort {
126
    USBPort port;
127
    uint16_t ctrl;
128
} UHCIPort;
129

    
130
struct UHCIState {
131
    PCIDevice dev;
132
    MemoryRegion io_bar;
133
    USBBus bus; /* Note unused when we're a companion controller */
134
    uint16_t cmd; /* cmd register */
135
    uint16_t status;
136
    uint16_t intr; /* interrupt enable register */
137
    uint16_t frnum; /* frame number */
138
    uint32_t fl_base_addr; /* frame list base address */
139
    uint8_t sof_timing;
140
    uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
141
    int64_t expire_time;
142
    QEMUTimer *frame_timer;
143
    UHCIPort ports[NB_PORTS];
144

    
145
    /* Interrupts that should be raised at the end of the current frame.  */
146
    uint32_t pending_int_mask;
147

    
148
    /* Active packets */
149
    QTAILQ_HEAD(,UHCIAsync) async_pending;
150
    uint8_t num_ports_vmstate;
151

    
152
    /* Properties */
153
    char *masterbus;
154
    uint32_t firstport;
155
};
156

    
157
typedef struct UHCI_TD {
158
    uint32_t link;
159
    uint32_t ctrl; /* see TD_CTRL_xxx */
160
    uint32_t token;
161
    uint32_t buffer;
162
} UHCI_TD;
163

    
164
typedef struct UHCI_QH {
165
    uint32_t link;
166
    uint32_t el_link;
167
} UHCI_QH;
168

    
169
static UHCIAsync *uhci_async_alloc(UHCIState *s)
170
{
171
    UHCIAsync *async = g_malloc(sizeof(UHCIAsync));
172

    
173
    memset(&async->packet, 0, sizeof(async->packet));
174
    async->uhci  = s;
175
    async->valid = 0;
176
    async->td    = 0;
177
    async->token = 0;
178
    async->done  = 0;
179
    async->isoc  = 0;
180
    usb_packet_init(&async->packet);
181
    qemu_sglist_init(&async->sgl, 1);
182

    
183
    return async;
184
}
185

    
186
static void uhci_async_free(UHCIState *s, UHCIAsync *async)
187
{
188
    usb_packet_cleanup(&async->packet);
189
    qemu_sglist_destroy(&async->sgl);
190
    g_free(async);
191
}
192

    
193
static void uhci_async_link(UHCIState *s, UHCIAsync *async)
194
{
195
    QTAILQ_INSERT_HEAD(&s->async_pending, async, next);
196
}
197

    
198
static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
199
{
200
    QTAILQ_REMOVE(&s->async_pending, async, next);
201
}
202

    
203
static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
204
{
205
    DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
206
           async->td, async->token, async->done);
207

    
208
    if (!async->done)
209
        usb_cancel_packet(&async->packet);
210
    uhci_async_free(s, async);
211
}
212

    
213
/*
214
 * Mark all outstanding async packets as invalid.
215
 * This is used for canceling them when TDs are removed by the HCD.
216
 */
217
static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
218
{
219
    UHCIAsync *async;
220

    
221
    QTAILQ_FOREACH(async, &s->async_pending, next) {
222
        async->valid--;
223
    }
224
    return NULL;
225
}
226

    
227
/*
228
 * Cancel async packets that are no longer valid
229
 */
230
static void uhci_async_validate_end(UHCIState *s)
231
{
232
    UHCIAsync *curr, *n;
233

    
234
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
235
        if (curr->valid > 0) {
236
            continue;
237
        }
238
        uhci_async_unlink(s, curr);
239
        uhci_async_cancel(s, curr);
240
    }
241
}
242

    
243
static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
244
{
245
    UHCIAsync *curr, *n;
246

    
247
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
248
        if (curr->packet.owner != dev) {
249
            continue;
250
        }
251
        uhci_async_unlink(s, curr);
252
        uhci_async_cancel(s, curr);
253
    }
254
}
255

    
256
static void uhci_async_cancel_all(UHCIState *s)
257
{
258
    UHCIAsync *curr, *n;
259

    
260
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
261
        uhci_async_unlink(s, curr);
262
        uhci_async_cancel(s, curr);
263
    }
264
}
265

    
266
static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
267
{
268
    UHCIAsync *async;
269
    UHCIAsync *match = NULL;
270
    int count = 0;
271

    
272
    /*
273
     * We're looking for the best match here. ie both td addr and token.
274
     * Otherwise we return last good match. ie just token.
275
     * It's ok to match just token because it identifies the transaction
276
     * rather well, token includes: device addr, endpoint, size, etc.
277
     *
278
     * Also since we queue async transactions in reverse order by returning
279
     * last good match we restores the order.
280
     *
281
     * It's expected that we wont have a ton of outstanding transactions.
282
     * If we ever do we'd want to optimize this algorithm.
283
     */
284

    
285
    QTAILQ_FOREACH(async, &s->async_pending, next) {
286
        if (async->token == token) {
287
            /* Good match */
288
            match = async;
289

    
290
            if (async->td == addr) {
291
                /* Best match */
292
                break;
293
            }
294
        }
295
        count++;
296
    }
297

    
298
    if (count > 64)
299
        fprintf(stderr, "uhci: warning lots of async transactions\n");
300

    
301
    return match;
302
}
303

    
304
static void uhci_update_irq(UHCIState *s)
305
{
306
    int level;
307
    if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
308
        ((s->status2 & 2) && (s->intr & (1 << 3))) ||
309
        ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
310
        ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
311
        (s->status & UHCI_STS_HSERR) ||
312
        (s->status & UHCI_STS_HCPERR)) {
313
        level = 1;
314
    } else {
315
        level = 0;
316
    }
317
    qemu_set_irq(s->dev.irq[3], level);
318
}
319

    
320
static void uhci_reset(void *opaque)
321
{
322
    UHCIState *s = opaque;
323
    uint8_t *pci_conf;
324
    int i;
325
    UHCIPort *port;
326

    
327
    DPRINTF("uhci: full reset\n");
328

    
329
    pci_conf = s->dev.config;
330

    
331
    pci_conf[0x6a] = 0x01; /* usb clock */
332
    pci_conf[0x6b] = 0x00;
333
    s->cmd = 0;
334
    s->status = 0;
335
    s->status2 = 0;
336
    s->intr = 0;
337
    s->fl_base_addr = 0;
338
    s->sof_timing = 64;
339

    
340
    for(i = 0; i < NB_PORTS; i++) {
341
        port = &s->ports[i];
342
        port->ctrl = 0x0080;
343
        if (port->port.dev) {
344
            usb_attach(&port->port, port->port.dev);
345
        }
346
    }
347

    
348
    uhci_async_cancel_all(s);
349
}
350

    
351
static void uhci_pre_save(void *opaque)
352
{
353
    UHCIState *s = opaque;
354

    
355
    uhci_async_cancel_all(s);
356
}
357

    
358
static const VMStateDescription vmstate_uhci_port = {
359
    .name = "uhci port",
360
    .version_id = 1,
361
    .minimum_version_id = 1,
362
    .minimum_version_id_old = 1,
363
    .fields      = (VMStateField []) {
364
        VMSTATE_UINT16(ctrl, UHCIPort),
365
        VMSTATE_END_OF_LIST()
366
    }
367
};
368

    
369
static const VMStateDescription vmstate_uhci = {
370
    .name = "uhci",
371
    .version_id = 2,
372
    .minimum_version_id = 1,
373
    .minimum_version_id_old = 1,
374
    .pre_save = uhci_pre_save,
375
    .fields      = (VMStateField []) {
376
        VMSTATE_PCI_DEVICE(dev, UHCIState),
377
        VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
378
        VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
379
                             vmstate_uhci_port, UHCIPort),
380
        VMSTATE_UINT16(cmd, UHCIState),
381
        VMSTATE_UINT16(status, UHCIState),
382
        VMSTATE_UINT16(intr, UHCIState),
383
        VMSTATE_UINT16(frnum, UHCIState),
384
        VMSTATE_UINT32(fl_base_addr, UHCIState),
385
        VMSTATE_UINT8(sof_timing, UHCIState),
386
        VMSTATE_UINT8(status2, UHCIState),
387
        VMSTATE_TIMER(frame_timer, UHCIState),
388
        VMSTATE_INT64_V(expire_time, UHCIState, 2),
389
        VMSTATE_END_OF_LIST()
390
    }
391
};
392

    
393
static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
394
{
395
    UHCIState *s = opaque;
396

    
397
    addr &= 0x1f;
398
    switch(addr) {
399
    case 0x0c:
400
        s->sof_timing = val;
401
        break;
402
    }
403
}
404

    
405
static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
406
{
407
    UHCIState *s = opaque;
408
    uint32_t val;
409

    
410
    addr &= 0x1f;
411
    switch(addr) {
412
    case 0x0c:
413
        val = s->sof_timing;
414
        break;
415
    default:
416
        val = 0xff;
417
        break;
418
    }
419
    return val;
420
}
421

    
422
static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
423
{
424
    UHCIState *s = opaque;
425

    
426
    addr &= 0x1f;
427
    DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
428

    
429
    switch(addr) {
430
    case 0x00:
431
        if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
432
            /* start frame processing */
433
            s->expire_time = qemu_get_clock_ns(vm_clock) +
434
                (get_ticks_per_sec() / FRAME_TIMER_FREQ);
435
            qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
436
            s->status &= ~UHCI_STS_HCHALTED;
437
        } else if (!(val & UHCI_CMD_RS)) {
438
            s->status |= UHCI_STS_HCHALTED;
439
        }
440
        if (val & UHCI_CMD_GRESET) {
441
            UHCIPort *port;
442
            USBDevice *dev;
443
            int i;
444

    
445
            /* send reset on the USB bus */
446
            for(i = 0; i < NB_PORTS; i++) {
447
                port = &s->ports[i];
448
                dev = port->port.dev;
449
                if (dev) {
450
                    usb_send_msg(dev, USB_MSG_RESET);
451
                }
452
            }
453
            uhci_reset(s);
454
            return;
455
        }
456
        if (val & UHCI_CMD_HCRESET) {
457
            uhci_reset(s);
458
            return;
459
        }
460
        s->cmd = val;
461
        break;
462
    case 0x02:
463
        s->status &= ~val;
464
        /* XXX: the chip spec is not coherent, so we add a hidden
465
           register to distinguish between IOC and SPD */
466
        if (val & UHCI_STS_USBINT)
467
            s->status2 = 0;
468
        uhci_update_irq(s);
469
        break;
470
    case 0x04:
471
        s->intr = val;
472
        uhci_update_irq(s);
473
        break;
474
    case 0x06:
475
        if (s->status & UHCI_STS_HCHALTED)
476
            s->frnum = val & 0x7ff;
477
        break;
478
    case 0x10 ... 0x1f:
479
        {
480
            UHCIPort *port;
481
            USBDevice *dev;
482
            int n;
483

    
484
            n = (addr >> 1) & 7;
485
            if (n >= NB_PORTS)
486
                return;
487
            port = &s->ports[n];
488
            dev = port->port.dev;
489
            if (dev) {
490
                /* port reset */
491
                if ( (val & UHCI_PORT_RESET) &&
492
                     !(port->ctrl & UHCI_PORT_RESET) ) {
493
                    usb_send_msg(dev, USB_MSG_RESET);
494
                }
495
            }
496
            port->ctrl &= UHCI_PORT_READ_ONLY;
497
            port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
498
            /* some bits are reset when a '1' is written to them */
499
            port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
500
        }
501
        break;
502
    }
503
}
504

    
505
static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
506
{
507
    UHCIState *s = opaque;
508
    uint32_t val;
509

    
510
    addr &= 0x1f;
511
    switch(addr) {
512
    case 0x00:
513
        val = s->cmd;
514
        break;
515
    case 0x02:
516
        val = s->status;
517
        break;
518
    case 0x04:
519
        val = s->intr;
520
        break;
521
    case 0x06:
522
        val = s->frnum;
523
        break;
524
    case 0x10 ... 0x1f:
525
        {
526
            UHCIPort *port;
527
            int n;
528
            n = (addr >> 1) & 7;
529
            if (n >= NB_PORTS)
530
                goto read_default;
531
            port = &s->ports[n];
532
            val = port->ctrl;
533
        }
534
        break;
535
    default:
536
    read_default:
537
        val = 0xff7f; /* disabled port */
538
        break;
539
    }
540

    
541
    DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
542

    
543
    return val;
544
}
545

    
546
static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
547
{
548
    UHCIState *s = opaque;
549

    
550
    addr &= 0x1f;
551
    DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
552

    
553
    switch(addr) {
554
    case 0x08:
555
        s->fl_base_addr = val & ~0xfff;
556
        break;
557
    }
558
}
559

    
560
static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
561
{
562
    UHCIState *s = opaque;
563
    uint32_t val;
564

    
565
    addr &= 0x1f;
566
    switch(addr) {
567
    case 0x08:
568
        val = s->fl_base_addr;
569
        break;
570
    default:
571
        val = 0xffffffff;
572
        break;
573
    }
574
    return val;
575
}
576

    
577
/* signal resume if controller suspended */
578
static void uhci_resume (void *opaque)
579
{
580
    UHCIState *s = (UHCIState *)opaque;
581

    
582
    if (!s)
583
        return;
584

    
585
    if (s->cmd & UHCI_CMD_EGSM) {
586
        s->cmd |= UHCI_CMD_FGR;
587
        s->status |= UHCI_STS_RD;
588
        uhci_update_irq(s);
589
    }
590
}
591

    
592
static void uhci_attach(USBPort *port1)
593
{
594
    UHCIState *s = port1->opaque;
595
    UHCIPort *port = &s->ports[port1->index];
596

    
597
    /* set connect status */
598
    port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
599

    
600
    /* update speed */
601
    if (port->port.dev->speed == USB_SPEED_LOW) {
602
        port->ctrl |= UHCI_PORT_LSDA;
603
    } else {
604
        port->ctrl &= ~UHCI_PORT_LSDA;
605
    }
606

    
607
    uhci_resume(s);
608
}
609

    
610
static void uhci_detach(USBPort *port1)
611
{
612
    UHCIState *s = port1->opaque;
613
    UHCIPort *port = &s->ports[port1->index];
614

    
615
    uhci_async_cancel_device(s, port1->dev);
616

    
617
    /* set connect status */
618
    if (port->ctrl & UHCI_PORT_CCS) {
619
        port->ctrl &= ~UHCI_PORT_CCS;
620
        port->ctrl |= UHCI_PORT_CSC;
621
    }
622
    /* disable port */
623
    if (port->ctrl & UHCI_PORT_EN) {
624
        port->ctrl &= ~UHCI_PORT_EN;
625
        port->ctrl |= UHCI_PORT_ENC;
626
    }
627

    
628
    uhci_resume(s);
629
}
630

    
631
static void uhci_child_detach(USBPort *port1, USBDevice *child)
632
{
633
    UHCIState *s = port1->opaque;
634

    
635
    uhci_async_cancel_device(s, child);
636
}
637

    
638
static void uhci_wakeup(USBPort *port1)
639
{
640
    UHCIState *s = port1->opaque;
641
    UHCIPort *port = &s->ports[port1->index];
642

    
643
    if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
644
        port->ctrl |= UHCI_PORT_RD;
645
        uhci_resume(s);
646
    }
647
}
648

    
649
static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
650
{
651
    int i, ret;
652

    
653
    DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %zd\n",
654
           pid2str(p->pid), p->devaddr, p->devep, p->iov.size);
655
    if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
656
        dump_data(p, 0);
657

    
658
    ret = USB_RET_NODEV;
659
    for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
660
        UHCIPort *port = &s->ports[i];
661
        USBDevice *dev = port->port.dev;
662

    
663
        if (dev && (port->ctrl & UHCI_PORT_EN))
664
            ret = usb_handle_packet(dev, p);
665
    }
666

    
667
    DPRINTF("uhci: packet exit. ret %d len %zd\n", ret, p->iov.size);
668
    if (p->pid == USB_TOKEN_IN && ret > 0)
669
        dump_data(p, ret);
670

    
671
    return ret;
672
}
673

    
674
static void uhci_async_complete(USBPort *port, USBPacket *packet);
675
static void uhci_process_frame(UHCIState *s);
676

    
677
/* return -1 if fatal error (frame must be stopped)
678
          0 if TD successful
679
          1 if TD unsuccessful or inactive
680
*/
681
static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
682
{
683
    int len = 0, max_len, err, ret;
684
    uint8_t pid;
685

    
686
    max_len = ((td->token >> 21) + 1) & 0x7ff;
687
    pid = td->token & 0xff;
688

    
689
    ret = async->packet.result;
690

    
691
    if (td->ctrl & TD_CTRL_IOS)
692
        td->ctrl &= ~TD_CTRL_ACTIVE;
693

    
694
    if (ret < 0)
695
        goto out;
696

    
697
    len = async->packet.result;
698
    td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
699

    
700
    /* The NAK bit may have been set by a previous frame, so clear it
701
       here.  The docs are somewhat unclear, but win2k relies on this
702
       behavior.  */
703
    td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
704
    if (td->ctrl & TD_CTRL_IOC)
705
        *int_mask |= 0x01;
706

    
707
    if (pid == USB_TOKEN_IN) {
708
        if (len > max_len) {
709
            ret = USB_RET_BABBLE;
710
            goto out;
711
        }
712

    
713
        if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
714
            *int_mask |= 0x02;
715
            /* short packet: do not update QH */
716
            DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
717
            return 1;
718
        }
719
    }
720

    
721
    /* success */
722
    return 0;
723

    
724
out:
725
    switch(ret) {
726
    case USB_RET_STALL:
727
        td->ctrl |= TD_CTRL_STALL;
728
        td->ctrl &= ~TD_CTRL_ACTIVE;
729
        s->status |= UHCI_STS_USBERR;
730
        if (td->ctrl & TD_CTRL_IOC) {
731
            *int_mask |= 0x01;
732
        }
733
        uhci_update_irq(s);
734
        return 1;
735

    
736
    case USB_RET_BABBLE:
737
        td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
738
        td->ctrl &= ~TD_CTRL_ACTIVE;
739
        s->status |= UHCI_STS_USBERR;
740
        if (td->ctrl & TD_CTRL_IOC) {
741
            *int_mask |= 0x01;
742
        }
743
        uhci_update_irq(s);
744
        /* frame interrupted */
745
        return -1;
746

    
747
    case USB_RET_NAK:
748
        td->ctrl |= TD_CTRL_NAK;
749
        if (pid == USB_TOKEN_SETUP)
750
            break;
751
        return 1;
752

    
753
    case USB_RET_NODEV:
754
    default:
755
        break;
756
    }
757

    
758
    /* Retry the TD if error count is not zero */
759

    
760
    td->ctrl |= TD_CTRL_TIMEOUT;
761
    err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
762
    if (err != 0) {
763
        err--;
764
        if (err == 0) {
765
            td->ctrl &= ~TD_CTRL_ACTIVE;
766
            s->status |= UHCI_STS_USBERR;
767
            if (td->ctrl & TD_CTRL_IOC)
768
                *int_mask |= 0x01;
769
            uhci_update_irq(s);
770
        }
771
    }
772
    td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
773
        (err << TD_CTRL_ERROR_SHIFT);
774
    return 1;
775
}
776

    
777
static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
778
{
779
    UHCIAsync *async;
780
    int len = 0, max_len;
781
    uint8_t pid, isoc;
782
    uint32_t token;
783

    
784
    /* Is active ? */
785
    if (!(td->ctrl & TD_CTRL_ACTIVE))
786
        return 1;
787

    
788
    /* token field is not unique for isochronous requests,
789
     * so use the destination buffer 
790
     */
791
    if (td->ctrl & TD_CTRL_IOS) {
792
        token = td->buffer;
793
        isoc = 1;
794
    } else {
795
        token = td->token;
796
        isoc = 0;
797
    }
798

    
799
    async = uhci_async_find_td(s, addr, token);
800
    if (async) {
801
        /* Already submitted */
802
        async->valid = 32;
803

    
804
        if (!async->done)
805
            return 1;
806

    
807
        uhci_async_unlink(s, async);
808
        goto done;
809
    }
810

    
811
    /* Allocate new packet */
812
    async = uhci_async_alloc(s);
813
    if (!async)
814
        return 1;
815

    
816
    /* valid needs to be large enough to handle 10 frame delay
817
     * for initial isochronous requests
818
     */
819
    async->valid = 32;
820
    async->td    = addr;
821
    async->token = token;
822
    async->isoc  = isoc;
823

    
824
    max_len = ((td->token >> 21) + 1) & 0x7ff;
825
    pid = td->token & 0xff;
826

    
827
    usb_packet_setup(&async->packet, pid, (td->token >> 8) & 0x7f,
828
                     (td->token >> 15) & 0xf);
829
    qemu_sglist_add(&async->sgl, td->buffer, max_len);
830
    usb_packet_map(&async->packet, &async->sgl);
831

    
832
    switch(pid) {
833
    case USB_TOKEN_OUT:
834
    case USB_TOKEN_SETUP:
835
        len = uhci_broadcast_packet(s, &async->packet);
836
        if (len >= 0)
837
            len = max_len;
838
        break;
839

    
840
    case USB_TOKEN_IN:
841
        len = uhci_broadcast_packet(s, &async->packet);
842
        break;
843

    
844
    default:
845
        /* invalid pid : frame interrupted */
846
        uhci_async_free(s, async);
847
        s->status |= UHCI_STS_HCPERR;
848
        uhci_update_irq(s);
849
        return -1;
850
    }
851
 
852
    if (len == USB_RET_ASYNC) {
853
        uhci_async_link(s, async);
854
        return 2;
855
    }
856

    
857
    async->packet.result = len;
858

    
859
done:
860
    len = uhci_complete_td(s, td, async, int_mask);
861
    usb_packet_unmap(&async->packet);
862
    uhci_async_free(s, async);
863
    return len;
864
}
865

    
866
static void uhci_async_complete(USBPort *port, USBPacket *packet)
867
{
868
    UHCIAsync *async = container_of(packet, UHCIAsync, packet);
869
    UHCIState *s = async->uhci;
870

    
871
    DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
872

    
873
    if (async->isoc) {
874
        UHCI_TD td;
875
        uint32_t link = async->td;
876
        uint32_t int_mask = 0, val;
877

    
878
        cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
879
        le32_to_cpus(&td.link);
880
        le32_to_cpus(&td.ctrl);
881
        le32_to_cpus(&td.token);
882
        le32_to_cpus(&td.buffer);
883

    
884
        uhci_async_unlink(s, async);
885
        uhci_complete_td(s, &td, async, &int_mask);
886
        s->pending_int_mask |= int_mask;
887

    
888
        /* update the status bits of the TD */
889
        val = cpu_to_le32(td.ctrl);
890
        cpu_physical_memory_write((link & ~0xf) + 4,
891
                                  (const uint8_t *)&val, sizeof(val));
892
        uhci_async_free(s, async);
893
    } else {
894
        async->done = 1;
895
        uhci_process_frame(s);
896
    }
897
}
898

    
899
static int is_valid(uint32_t link)
900
{
901
    return (link & 1) == 0;
902
}
903

    
904
static int is_qh(uint32_t link)
905
{
906
    return (link & 2) != 0;
907
}
908

    
909
static int depth_first(uint32_t link)
910
{
911
    return (link & 4) != 0;
912
}
913

    
914
/* QH DB used for detecting QH loops */
915
#define UHCI_MAX_QUEUES 128
916
typedef struct {
917
    uint32_t addr[UHCI_MAX_QUEUES];
918
    int      count;
919
} QhDb;
920

    
921
static void qhdb_reset(QhDb *db)
922
{
923
    db->count = 0;
924
}
925

    
926
/* Add QH to DB. Returns 1 if already present or DB is full. */
927
static int qhdb_insert(QhDb *db, uint32_t addr)
928
{
929
    int i;
930
    for (i = 0; i < db->count; i++)
931
        if (db->addr[i] == addr)
932
            return 1;
933

    
934
    if (db->count >= UHCI_MAX_QUEUES)
935
        return 1;
936

    
937
    db->addr[db->count++] = addr;
938
    return 0;
939
}
940

    
941
static void uhci_process_frame(UHCIState *s)
942
{
943
    uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
944
    uint32_t curr_qh;
945
    int cnt, ret;
946
    UHCI_TD td;
947
    UHCI_QH qh;
948
    QhDb qhdb;
949

    
950
    frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
951

    
952
    DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
953

    
954
    cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
955
    le32_to_cpus(&link);
956

    
957
    int_mask = 0;
958
    curr_qh  = 0;
959

    
960
    qhdb_reset(&qhdb);
961

    
962
    for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
963
        if (is_qh(link)) {
964
            /* QH */
965

    
966
            if (qhdb_insert(&qhdb, link)) {
967
                /*
968
                 * We're going in circles. Which is not a bug because
969
                 * HCD is allowed to do that as part of the BW management. 
970
                 * In our case though it makes no sense to spin here. Sync transations 
971
                 * are already done, and async completion handler will re-process 
972
                 * the frame when something is ready.
973
                 */
974
                DPRINTF("uhci: detected loop. qh 0x%x\n", link);
975
                break;
976
            }
977

    
978
            cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
979
            le32_to_cpus(&qh.link);
980
            le32_to_cpus(&qh.el_link);
981

    
982
            DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
983
                    link, qh.link, qh.el_link);
984

    
985
            if (!is_valid(qh.el_link)) {
986
                /* QH w/o elements */
987
                curr_qh = 0;
988
                link = qh.link;
989
            } else {
990
                /* QH with elements */
991
                    curr_qh = link;
992
                    link = qh.el_link;
993
            }
994
            continue;
995
        }
996

    
997
        /* TD */
998
        cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
999
        le32_to_cpus(&td.link);
1000
        le32_to_cpus(&td.ctrl);
1001
        le32_to_cpus(&td.token);
1002
        le32_to_cpus(&td.buffer);
1003

    
1004
        DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 
1005
                link, td.link, td.ctrl, td.token, curr_qh);
1006

    
1007
        old_td_ctrl = td.ctrl;
1008
        ret = uhci_handle_td(s, link, &td, &int_mask);
1009
        if (old_td_ctrl != td.ctrl) {
1010
            /* update the status bits of the TD */
1011
            val = cpu_to_le32(td.ctrl);
1012
            cpu_physical_memory_write((link & ~0xf) + 4,
1013
                                      (const uint8_t *)&val, sizeof(val));
1014
        }
1015

    
1016
        if (ret < 0) {
1017
            /* interrupted frame */
1018
            break;
1019
        }
1020

    
1021
        if (ret == 2 || ret == 1) {
1022
            DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1023
                    link, ret == 2 ? "pend" : "skip",
1024
                    td.link, td.ctrl, td.token, curr_qh);
1025

    
1026
            link = curr_qh ? qh.link : td.link;
1027
            continue;
1028
        }
1029

    
1030
        /* completed TD */
1031

    
1032
        DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 
1033
                link, td.link, td.ctrl, td.token, curr_qh);
1034

    
1035
        link = td.link;
1036

    
1037
        if (curr_qh) {
1038
            /* update QH element link */
1039
            qh.el_link = link;
1040
            val = cpu_to_le32(qh.el_link);
1041
            cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1042
                                          (const uint8_t *)&val, sizeof(val));
1043

    
1044
            if (!depth_first(link)) {
1045
               /* done with this QH */
1046

    
1047
               DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1048
                       curr_qh, qh.link, qh.el_link);
1049

    
1050
               curr_qh = 0;
1051
               link    = qh.link;
1052
            }
1053
        }
1054

    
1055
        /* go to the next entry */
1056
    }
1057

    
1058
    s->pending_int_mask |= int_mask;
1059
}
1060

    
1061
static void uhci_frame_timer(void *opaque)
1062
{
1063
    UHCIState *s = opaque;
1064

    
1065
    /* prepare the timer for the next frame */
1066
    s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1067

    
1068
    if (!(s->cmd & UHCI_CMD_RS)) {
1069
        /* Full stop */
1070
        qemu_del_timer(s->frame_timer);
1071
        /* set hchalted bit in status - UHCI11D 2.1.2 */
1072
        s->status |= UHCI_STS_HCHALTED;
1073

    
1074
        DPRINTF("uhci: halted\n");
1075
        return;
1076
    }
1077

    
1078
    /* Complete the previous frame */
1079
    if (s->pending_int_mask) {
1080
        s->status2 |= s->pending_int_mask;
1081
        s->status  |= UHCI_STS_USBINT;
1082
        uhci_update_irq(s);
1083
    }
1084
    s->pending_int_mask = 0;
1085

    
1086
    /* Start new frame */
1087
    s->frnum = (s->frnum + 1) & 0x7ff;
1088

    
1089
    DPRINTF("uhci: new frame #%u\n" , s->frnum);
1090

    
1091
    uhci_async_validate_begin(s);
1092

    
1093
    uhci_process_frame(s);
1094

    
1095
    uhci_async_validate_end(s);
1096

    
1097
    qemu_mod_timer(s->frame_timer, s->expire_time);
1098
}
1099

    
1100
static const MemoryRegionPortio uhci_portio[] = {
1101
    { 0, 32, 2, .write = uhci_ioport_writew, },
1102
    { 0, 32, 2, .read = uhci_ioport_readw, },
1103
    { 0, 32, 4, .write = uhci_ioport_writel, },
1104
    { 0, 32, 4, .read = uhci_ioport_readl, },
1105
    { 0, 32, 1, .write = uhci_ioport_writeb, },
1106
    { 0, 32, 1, .read = uhci_ioport_readb, },
1107
    PORTIO_END_OF_LIST()
1108
};
1109

    
1110
static const MemoryRegionOps uhci_ioport_ops = {
1111
    .old_portio = uhci_portio,
1112
};
1113

    
1114
static USBPortOps uhci_port_ops = {
1115
    .attach = uhci_attach,
1116
    .detach = uhci_detach,
1117
    .child_detach = uhci_child_detach,
1118
    .wakeup = uhci_wakeup,
1119
    .complete = uhci_async_complete,
1120
};
1121

    
1122
static USBBusOps uhci_bus_ops = {
1123
};
1124

    
1125
static int usb_uhci_common_initfn(PCIDevice *dev)
1126
{
1127
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1128
    uint8_t *pci_conf = s->dev.config;
1129
    int i;
1130

    
1131
    pci_conf[PCI_CLASS_PROG] = 0x00;
1132
    /* TODO: reset value should be 0. */
1133
    pci_conf[PCI_INTERRUPT_PIN] = 4; // interrupt pin 3
1134
    pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1135

    
1136
    if (s->masterbus) {
1137
        USBPort *ports[NB_PORTS];
1138
        for(i = 0; i < NB_PORTS; i++) {
1139
            ports[i] = &s->ports[i].port;
1140
        }
1141
        if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1142
                s->firstport, s, &uhci_port_ops,
1143
                USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1144
            return -1;
1145
        }
1146
    } else {
1147
        usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1148
        for (i = 0; i < NB_PORTS; i++) {
1149
            usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1150
                              USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1151
        }
1152
    }
1153
    s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1154
    s->num_ports_vmstate = NB_PORTS;
1155
    QTAILQ_INIT(&s->async_pending);
1156

    
1157
    qemu_register_reset(uhci_reset, s);
1158

    
1159
    memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1160
    /* Use region 4 for consistency with real hardware.  BSD guests seem
1161
       to rely on this.  */
1162
    pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1163

    
1164
    return 0;
1165
}
1166

    
1167
static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1168
{
1169
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1170
    uint8_t *pci_conf = s->dev.config;
1171

    
1172
    /* USB misc control 1/2 */
1173
    pci_set_long(pci_conf + 0x40,0x00001000);
1174
    /* PM capability */
1175
    pci_set_long(pci_conf + 0x80,0x00020001);
1176
    /* USB legacy support  */
1177
    pci_set_long(pci_conf + 0xc0,0x00002000);
1178

    
1179
    return usb_uhci_common_initfn(dev);
1180
}
1181

    
1182
static int usb_uhci_exit(PCIDevice *dev)
1183
{
1184
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1185

    
1186
    memory_region_destroy(&s->io_bar);
1187
    return 0;
1188
}
1189

    
1190
static Property uhci_properties[] = {
1191
    DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1192
    DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1193
    DEFINE_PROP_END_OF_LIST(),
1194
};
1195

    
1196
static PCIDeviceInfo uhci_info[] = {
1197
    {
1198
        .qdev.name    = "piix3-usb-uhci",
1199
        .qdev.size    = sizeof(UHCIState),
1200
        .qdev.vmsd    = &vmstate_uhci,
1201
        .init         = usb_uhci_common_initfn,
1202
        .exit         = usb_uhci_exit,
1203
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1204
        .device_id    = PCI_DEVICE_ID_INTEL_82371SB_2,
1205
        .revision     = 0x01,
1206
        .class_id     = PCI_CLASS_SERIAL_USB,
1207
        .qdev.props   = uhci_properties,
1208
    },{
1209
        .qdev.name    = "piix4-usb-uhci",
1210
        .qdev.size    = sizeof(UHCIState),
1211
        .qdev.vmsd    = &vmstate_uhci,
1212
        .init         = usb_uhci_common_initfn,
1213
        .exit         = usb_uhci_exit,
1214
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1215
        .device_id    = PCI_DEVICE_ID_INTEL_82371AB_2,
1216
        .revision     = 0x01,
1217
        .class_id     = PCI_CLASS_SERIAL_USB,
1218
        .qdev.props   = uhci_properties,
1219
    },{
1220
        .qdev.name    = "vt82c686b-usb-uhci",
1221
        .qdev.size    = sizeof(UHCIState),
1222
        .qdev.vmsd    = &vmstate_uhci,
1223
        .init         = usb_uhci_vt82c686b_initfn,
1224
        .exit         = usb_uhci_exit,
1225
        .vendor_id    = PCI_VENDOR_ID_VIA,
1226
        .device_id    = PCI_DEVICE_ID_VIA_UHCI,
1227
        .revision     = 0x01,
1228
        .class_id     = PCI_CLASS_SERIAL_USB,
1229
        .qdev.props   = uhci_properties,
1230
    },{
1231
        .qdev.name    = "ich9-usb-uhci1",
1232
        .qdev.size    = sizeof(UHCIState),
1233
        .qdev.vmsd    = &vmstate_uhci,
1234
        .init         = usb_uhci_common_initfn,
1235
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1236
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1237
        .revision     = 0x03,
1238
        .class_id     = PCI_CLASS_SERIAL_USB,
1239
        .qdev.props   = uhci_properties,
1240
    },{
1241
        .qdev.name    = "ich9-usb-uhci2",
1242
        .qdev.size    = sizeof(UHCIState),
1243
        .qdev.vmsd    = &vmstate_uhci,
1244
        .init         = usb_uhci_common_initfn,
1245
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1246
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1247
        .revision     = 0x03,
1248
        .class_id     = PCI_CLASS_SERIAL_USB,
1249
        .qdev.props   = uhci_properties,
1250
    },{
1251
        .qdev.name    = "ich9-usb-uhci3",
1252
        .qdev.size    = sizeof(UHCIState),
1253
        .qdev.vmsd    = &vmstate_uhci,
1254
        .init         = usb_uhci_common_initfn,
1255
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1256
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1257
        .revision     = 0x03,
1258
        .class_id     = PCI_CLASS_SERIAL_USB,
1259
        .qdev.props   = uhci_properties,
1260
    },{
1261
        /* end of list */
1262
    }
1263
};
1264

    
1265
static void uhci_register(void)
1266
{
1267
    pci_qdev_register_many(uhci_info);
1268
}
1269
device_init(uhci_register);
1270

    
1271
void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1272
{
1273
    pci_create_simple(bus, devfn, "piix3-usb-uhci");
1274
}
1275

    
1276
void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1277
{
1278
    pci_create_simple(bus, devfn, "piix4-usb-uhci");
1279
}
1280

    
1281
void usb_uhci_vt82c686b_init(PCIBus *bus, int devfn)
1282
{
1283
    pci_create_simple(bus, devfn, "vt82c686b-usb-uhci");
1284
}