Statistics
| Branch: | Revision:

root / hw / usb-uhci.c @ 9fe2fd67

History | View | Annotate | Download (33.1 kB)

1
/*
2
 * USB UHCI controller emulation
3
 *
4
 * Copyright (c) 2005 Fabrice Bellard
5
 *
6
 * Copyright (c) 2008 Max Krasnyansky
7
 *     Magor rewrite of the UHCI data structures parser and frame processor
8
 *     Support for fully async operation and multiple outstanding transactions
9
 *
10
 * Permission is hereby granted, free of charge, to any person obtaining a copy
11
 * of this software and associated documentation files (the "Software"), to deal
12
 * in the Software without restriction, including without limitation the rights
13
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
 * copies of the Software, and to permit persons to whom the Software is
15
 * furnished to do so, subject to the following conditions:
16
 *
17
 * The above copyright notice and this permission notice shall be included in
18
 * all copies or substantial portions of the Software.
19
 *
20
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26
 * THE SOFTWARE.
27
 */
28
#include "hw.h"
29
#include "usb.h"
30
#include "pci.h"
31
#include "qemu-timer.h"
32
#include "usb-uhci.h"
33
#include "iov.h"
34
#include "dma.h"
35

    
36
//#define DEBUG
37
//#define DEBUG_DUMP_DATA
38

    
39
#define UHCI_CMD_FGR      (1 << 4)
40
#define UHCI_CMD_EGSM     (1 << 3)
41
#define UHCI_CMD_GRESET   (1 << 2)
42
#define UHCI_CMD_HCRESET  (1 << 1)
43
#define UHCI_CMD_RS       (1 << 0)
44

    
45
#define UHCI_STS_HCHALTED (1 << 5)
46
#define UHCI_STS_HCPERR   (1 << 4)
47
#define UHCI_STS_HSERR    (1 << 3)
48
#define UHCI_STS_RD       (1 << 2)
49
#define UHCI_STS_USBERR   (1 << 1)
50
#define UHCI_STS_USBINT   (1 << 0)
51

    
52
#define TD_CTRL_SPD     (1 << 29)
53
#define TD_CTRL_ERROR_SHIFT  27
54
#define TD_CTRL_IOS     (1 << 25)
55
#define TD_CTRL_IOC     (1 << 24)
56
#define TD_CTRL_ACTIVE  (1 << 23)
57
#define TD_CTRL_STALL   (1 << 22)
58
#define TD_CTRL_BABBLE  (1 << 20)
59
#define TD_CTRL_NAK     (1 << 19)
60
#define TD_CTRL_TIMEOUT (1 << 18)
61

    
62
#define UHCI_PORT_SUSPEND (1 << 12)
63
#define UHCI_PORT_RESET (1 << 9)
64
#define UHCI_PORT_LSDA  (1 << 8)
65
#define UHCI_PORT_RD    (1 << 6)
66
#define UHCI_PORT_ENC   (1 << 3)
67
#define UHCI_PORT_EN    (1 << 2)
68
#define UHCI_PORT_CSC   (1 << 1)
69
#define UHCI_PORT_CCS   (1 << 0)
70

    
71
#define UHCI_PORT_READ_ONLY    (0x1bb)
72
#define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
73

    
74
#define FRAME_TIMER_FREQ 1000
75

    
76
#define FRAME_MAX_LOOPS  100
77

    
78
#define NB_PORTS 2
79

    
80
#ifdef DEBUG
81
#define DPRINTF printf
82

    
83
static const char *pid2str(int pid)
84
{
85
    switch (pid) {
86
    case USB_TOKEN_SETUP: return "SETUP";
87
    case USB_TOKEN_IN:    return "IN";
88
    case USB_TOKEN_OUT:   return "OUT";
89
    }
90
    return "?";
91
}
92

    
93
#else
94
#define DPRINTF(...)
95
#endif
96

    
97
#ifdef DEBUG_DUMP_DATA
98
static void dump_data(USBPacket *p, int ret)
99
{
100
    iov_hexdump(p->iov.iov, p->iov.niov, stderr, "uhci", ret);
101
}
102
#else
103
static void dump_data(USBPacket *p, int ret) {}
104
#endif
105

    
106
typedef struct UHCIState UHCIState;
107

    
108
/* 
109
 * Pending async transaction.
110
 * 'packet' must be the first field because completion
111
 * handler does "(UHCIAsync *) pkt" cast.
112
 */
113
typedef struct UHCIAsync {
114
    USBPacket packet;
115
    QEMUSGList sgl;
116
    UHCIState *uhci;
117
    QTAILQ_ENTRY(UHCIAsync) next;
118
    uint32_t  td;
119
    uint32_t  token;
120
    int8_t    valid;
121
    uint8_t   isoc;
122
    uint8_t   done;
123
} UHCIAsync;
124

    
125
typedef struct UHCIPort {
126
    USBPort port;
127
    uint16_t ctrl;
128
} UHCIPort;
129

    
130
struct UHCIState {
131
    PCIDevice dev;
132
    MemoryRegion io_bar;
133
    USBBus bus; /* Note unused when we're a companion controller */
134
    uint16_t cmd; /* cmd register */
135
    uint16_t status;
136
    uint16_t intr; /* interrupt enable register */
137
    uint16_t frnum; /* frame number */
138
    uint32_t fl_base_addr; /* frame list base address */
139
    uint8_t sof_timing;
140
    uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
141
    int64_t expire_time;
142
    QEMUTimer *frame_timer;
143
    UHCIPort ports[NB_PORTS];
144

    
145
    /* Interrupts that should be raised at the end of the current frame.  */
146
    uint32_t pending_int_mask;
147

    
148
    /* Active packets */
149
    QTAILQ_HEAD(,UHCIAsync) async_pending;
150
    uint8_t num_ports_vmstate;
151

    
152
    /* Properties */
153
    char *masterbus;
154
    uint32_t firstport;
155
};
156

    
157
typedef struct UHCI_TD {
158
    uint32_t link;
159
    uint32_t ctrl; /* see TD_CTRL_xxx */
160
    uint32_t token;
161
    uint32_t buffer;
162
} UHCI_TD;
163

    
164
typedef struct UHCI_QH {
165
    uint32_t link;
166
    uint32_t el_link;
167
} UHCI_QH;
168

    
169
static UHCIAsync *uhci_async_alloc(UHCIState *s)
170
{
171
    UHCIAsync *async = g_malloc(sizeof(UHCIAsync));
172

    
173
    memset(&async->packet, 0, sizeof(async->packet));
174
    async->uhci  = s;
175
    async->valid = 0;
176
    async->td    = 0;
177
    async->token = 0;
178
    async->done  = 0;
179
    async->isoc  = 0;
180
    usb_packet_init(&async->packet);
181
    pci_dma_sglist_init(&async->sgl, &s->dev, 1);
182

    
183
    return async;
184
}
185

    
186
static void uhci_async_free(UHCIState *s, UHCIAsync *async)
187
{
188
    usb_packet_cleanup(&async->packet);
189
    qemu_sglist_destroy(&async->sgl);
190
    g_free(async);
191
}
192

    
193
static void uhci_async_link(UHCIState *s, UHCIAsync *async)
194
{
195
    QTAILQ_INSERT_HEAD(&s->async_pending, async, next);
196
}
197

    
198
static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
199
{
200
    QTAILQ_REMOVE(&s->async_pending, async, next);
201
}
202

    
203
static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
204
{
205
    DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
206
           async->td, async->token, async->done);
207

    
208
    if (!async->done)
209
        usb_cancel_packet(&async->packet);
210
    uhci_async_free(s, async);
211
}
212

    
213
/*
214
 * Mark all outstanding async packets as invalid.
215
 * This is used for canceling them when TDs are removed by the HCD.
216
 */
217
static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
218
{
219
    UHCIAsync *async;
220

    
221
    QTAILQ_FOREACH(async, &s->async_pending, next) {
222
        async->valid--;
223
    }
224
    return NULL;
225
}
226

    
227
/*
228
 * Cancel async packets that are no longer valid
229
 */
230
static void uhci_async_validate_end(UHCIState *s)
231
{
232
    UHCIAsync *curr, *n;
233

    
234
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
235
        if (curr->valid > 0) {
236
            continue;
237
        }
238
        uhci_async_unlink(s, curr);
239
        uhci_async_cancel(s, curr);
240
    }
241
}
242

    
243
static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
244
{
245
    UHCIAsync *curr, *n;
246

    
247
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
248
        if (curr->packet.owner != dev) {
249
            continue;
250
        }
251
        uhci_async_unlink(s, curr);
252
        uhci_async_cancel(s, curr);
253
    }
254
}
255

    
256
static void uhci_async_cancel_all(UHCIState *s)
257
{
258
    UHCIAsync *curr, *n;
259

    
260
    QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
261
        uhci_async_unlink(s, curr);
262
        uhci_async_cancel(s, curr);
263
    }
264
}
265

    
266
static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
267
{
268
    UHCIAsync *async;
269
    UHCIAsync *match = NULL;
270
    int count = 0;
271

    
272
    /*
273
     * We're looking for the best match here. ie both td addr and token.
274
     * Otherwise we return last good match. ie just token.
275
     * It's ok to match just token because it identifies the transaction
276
     * rather well, token includes: device addr, endpoint, size, etc.
277
     *
278
     * Also since we queue async transactions in reverse order by returning
279
     * last good match we restores the order.
280
     *
281
     * It's expected that we wont have a ton of outstanding transactions.
282
     * If we ever do we'd want to optimize this algorithm.
283
     */
284

    
285
    QTAILQ_FOREACH(async, &s->async_pending, next) {
286
        if (async->token == token) {
287
            /* Good match */
288
            match = async;
289

    
290
            if (async->td == addr) {
291
                /* Best match */
292
                break;
293
            }
294
        }
295
        count++;
296
    }
297

    
298
    if (count > 64)
299
        fprintf(stderr, "uhci: warning lots of async transactions\n");
300

    
301
    return match;
302
}
303

    
304
static void uhci_update_irq(UHCIState *s)
305
{
306
    int level;
307
    if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
308
        ((s->status2 & 2) && (s->intr & (1 << 3))) ||
309
        ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
310
        ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
311
        (s->status & UHCI_STS_HSERR) ||
312
        (s->status & UHCI_STS_HCPERR)) {
313
        level = 1;
314
    } else {
315
        level = 0;
316
    }
317
    qemu_set_irq(s->dev.irq[3], level);
318
}
319

    
320
static void uhci_reset(void *opaque)
321
{
322
    UHCIState *s = opaque;
323
    uint8_t *pci_conf;
324
    int i;
325
    UHCIPort *port;
326

    
327
    DPRINTF("uhci: full reset\n");
328

    
329
    pci_conf = s->dev.config;
330

    
331
    pci_conf[0x6a] = 0x01; /* usb clock */
332
    pci_conf[0x6b] = 0x00;
333
    s->cmd = 0;
334
    s->status = 0;
335
    s->status2 = 0;
336
    s->intr = 0;
337
    s->fl_base_addr = 0;
338
    s->sof_timing = 64;
339

    
340
    for(i = 0; i < NB_PORTS; i++) {
341
        port = &s->ports[i];
342
        port->ctrl = 0x0080;
343
        if (port->port.dev && port->port.dev->attached) {
344
            usb_reset(&port->port);
345
        }
346
    }
347

    
348
    uhci_async_cancel_all(s);
349
}
350

    
351
static void uhci_pre_save(void *opaque)
352
{
353
    UHCIState *s = opaque;
354

    
355
    uhci_async_cancel_all(s);
356
}
357

    
358
static const VMStateDescription vmstate_uhci_port = {
359
    .name = "uhci port",
360
    .version_id = 1,
361
    .minimum_version_id = 1,
362
    .minimum_version_id_old = 1,
363
    .fields      = (VMStateField []) {
364
        VMSTATE_UINT16(ctrl, UHCIPort),
365
        VMSTATE_END_OF_LIST()
366
    }
367
};
368

    
369
static const VMStateDescription vmstate_uhci = {
370
    .name = "uhci",
371
    .version_id = 2,
372
    .minimum_version_id = 1,
373
    .minimum_version_id_old = 1,
374
    .pre_save = uhci_pre_save,
375
    .fields      = (VMStateField []) {
376
        VMSTATE_PCI_DEVICE(dev, UHCIState),
377
        VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
378
        VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
379
                             vmstate_uhci_port, UHCIPort),
380
        VMSTATE_UINT16(cmd, UHCIState),
381
        VMSTATE_UINT16(status, UHCIState),
382
        VMSTATE_UINT16(intr, UHCIState),
383
        VMSTATE_UINT16(frnum, UHCIState),
384
        VMSTATE_UINT32(fl_base_addr, UHCIState),
385
        VMSTATE_UINT8(sof_timing, UHCIState),
386
        VMSTATE_UINT8(status2, UHCIState),
387
        VMSTATE_TIMER(frame_timer, UHCIState),
388
        VMSTATE_INT64_V(expire_time, UHCIState, 2),
389
        VMSTATE_END_OF_LIST()
390
    }
391
};
392

    
393
static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
394
{
395
    UHCIState *s = opaque;
396

    
397
    addr &= 0x1f;
398
    switch(addr) {
399
    case 0x0c:
400
        s->sof_timing = val;
401
        break;
402
    }
403
}
404

    
405
static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
406
{
407
    UHCIState *s = opaque;
408
    uint32_t val;
409

    
410
    addr &= 0x1f;
411
    switch(addr) {
412
    case 0x0c:
413
        val = s->sof_timing;
414
        break;
415
    default:
416
        val = 0xff;
417
        break;
418
    }
419
    return val;
420
}
421

    
422
static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
423
{
424
    UHCIState *s = opaque;
425

    
426
    addr &= 0x1f;
427
    DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
428

    
429
    switch(addr) {
430
    case 0x00:
431
        if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
432
            /* start frame processing */
433
            s->expire_time = qemu_get_clock_ns(vm_clock) +
434
                (get_ticks_per_sec() / FRAME_TIMER_FREQ);
435
            qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
436
            s->status &= ~UHCI_STS_HCHALTED;
437
        } else if (!(val & UHCI_CMD_RS)) {
438
            s->status |= UHCI_STS_HCHALTED;
439
        }
440
        if (val & UHCI_CMD_GRESET) {
441
            UHCIPort *port;
442
            USBDevice *dev;
443
            int i;
444

    
445
            /* send reset on the USB bus */
446
            for(i = 0; i < NB_PORTS; i++) {
447
                port = &s->ports[i];
448
                dev = port->port.dev;
449
                if (dev && dev->attached) {
450
                    usb_send_msg(dev, USB_MSG_RESET);
451
                }
452
            }
453
            uhci_reset(s);
454
            return;
455
        }
456
        if (val & UHCI_CMD_HCRESET) {
457
            uhci_reset(s);
458
            return;
459
        }
460
        s->cmd = val;
461
        break;
462
    case 0x02:
463
        s->status &= ~val;
464
        /* XXX: the chip spec is not coherent, so we add a hidden
465
           register to distinguish between IOC and SPD */
466
        if (val & UHCI_STS_USBINT)
467
            s->status2 = 0;
468
        uhci_update_irq(s);
469
        break;
470
    case 0x04:
471
        s->intr = val;
472
        uhci_update_irq(s);
473
        break;
474
    case 0x06:
475
        if (s->status & UHCI_STS_HCHALTED)
476
            s->frnum = val & 0x7ff;
477
        break;
478
    case 0x10 ... 0x1f:
479
        {
480
            UHCIPort *port;
481
            USBDevice *dev;
482
            int n;
483

    
484
            n = (addr >> 1) & 7;
485
            if (n >= NB_PORTS)
486
                return;
487
            port = &s->ports[n];
488
            dev = port->port.dev;
489
            if (dev && dev->attached) {
490
                /* port reset */
491
                if ( (val & UHCI_PORT_RESET) &&
492
                     !(port->ctrl & UHCI_PORT_RESET) ) {
493
                    usb_send_msg(dev, USB_MSG_RESET);
494
                }
495
            }
496
            port->ctrl &= UHCI_PORT_READ_ONLY;
497
            port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
498
            /* some bits are reset when a '1' is written to them */
499
            port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
500
        }
501
        break;
502
    }
503
}
504

    
505
static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
506
{
507
    UHCIState *s = opaque;
508
    uint32_t val;
509

    
510
    addr &= 0x1f;
511
    switch(addr) {
512
    case 0x00:
513
        val = s->cmd;
514
        break;
515
    case 0x02:
516
        val = s->status;
517
        break;
518
    case 0x04:
519
        val = s->intr;
520
        break;
521
    case 0x06:
522
        val = s->frnum;
523
        break;
524
    case 0x10 ... 0x1f:
525
        {
526
            UHCIPort *port;
527
            int n;
528
            n = (addr >> 1) & 7;
529
            if (n >= NB_PORTS)
530
                goto read_default;
531
            port = &s->ports[n];
532
            val = port->ctrl;
533
        }
534
        break;
535
    default:
536
    read_default:
537
        val = 0xff7f; /* disabled port */
538
        break;
539
    }
540

    
541
    DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
542

    
543
    return val;
544
}
545

    
546
static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
547
{
548
    UHCIState *s = opaque;
549

    
550
    addr &= 0x1f;
551
    DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
552

    
553
    switch(addr) {
554
    case 0x08:
555
        s->fl_base_addr = val & ~0xfff;
556
        break;
557
    }
558
}
559

    
560
static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
561
{
562
    UHCIState *s = opaque;
563
    uint32_t val;
564

    
565
    addr &= 0x1f;
566
    switch(addr) {
567
    case 0x08:
568
        val = s->fl_base_addr;
569
        break;
570
    default:
571
        val = 0xffffffff;
572
        break;
573
    }
574
    return val;
575
}
576

    
577
/* signal resume if controller suspended */
578
static void uhci_resume (void *opaque)
579
{
580
    UHCIState *s = (UHCIState *)opaque;
581

    
582
    if (!s)
583
        return;
584

    
585
    if (s->cmd & UHCI_CMD_EGSM) {
586
        s->cmd |= UHCI_CMD_FGR;
587
        s->status |= UHCI_STS_RD;
588
        uhci_update_irq(s);
589
    }
590
}
591

    
592
static void uhci_attach(USBPort *port1)
593
{
594
    UHCIState *s = port1->opaque;
595
    UHCIPort *port = &s->ports[port1->index];
596

    
597
    /* set connect status */
598
    port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
599

    
600
    /* update speed */
601
    if (port->port.dev->speed == USB_SPEED_LOW) {
602
        port->ctrl |= UHCI_PORT_LSDA;
603
    } else {
604
        port->ctrl &= ~UHCI_PORT_LSDA;
605
    }
606

    
607
    uhci_resume(s);
608
}
609

    
610
static void uhci_detach(USBPort *port1)
611
{
612
    UHCIState *s = port1->opaque;
613
    UHCIPort *port = &s->ports[port1->index];
614

    
615
    uhci_async_cancel_device(s, port1->dev);
616

    
617
    /* set connect status */
618
    if (port->ctrl & UHCI_PORT_CCS) {
619
        port->ctrl &= ~UHCI_PORT_CCS;
620
        port->ctrl |= UHCI_PORT_CSC;
621
    }
622
    /* disable port */
623
    if (port->ctrl & UHCI_PORT_EN) {
624
        port->ctrl &= ~UHCI_PORT_EN;
625
        port->ctrl |= UHCI_PORT_ENC;
626
    }
627

    
628
    uhci_resume(s);
629
}
630

    
631
static void uhci_child_detach(USBPort *port1, USBDevice *child)
632
{
633
    UHCIState *s = port1->opaque;
634

    
635
    uhci_async_cancel_device(s, child);
636
}
637

    
638
static void uhci_wakeup(USBPort *port1)
639
{
640
    UHCIState *s = port1->opaque;
641
    UHCIPort *port = &s->ports[port1->index];
642

    
643
    if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
644
        port->ctrl |= UHCI_PORT_RD;
645
        uhci_resume(s);
646
    }
647
}
648

    
649
static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
650
{
651
    int i, ret;
652

    
653
    DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %zd\n",
654
           pid2str(p->pid), p->devaddr, p->devep, p->iov.size);
655
    if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
656
        dump_data(p, 0);
657

    
658
    ret = USB_RET_NODEV;
659
    for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
660
        UHCIPort *port = &s->ports[i];
661
        USBDevice *dev = port->port.dev;
662

    
663
        if (dev && dev->attached && (port->ctrl & UHCI_PORT_EN)) {
664
            ret = usb_handle_packet(dev, p);
665
        }
666
    }
667

    
668
    DPRINTF("uhci: packet exit. ret %d len %zd\n", ret, p->iov.size);
669
    if (p->pid == USB_TOKEN_IN && ret > 0)
670
        dump_data(p, ret);
671

    
672
    return ret;
673
}
674

    
675
static void uhci_async_complete(USBPort *port, USBPacket *packet);
676
static void uhci_process_frame(UHCIState *s);
677

    
678
/* return -1 if fatal error (frame must be stopped)
679
          0 if TD successful
680
          1 if TD unsuccessful or inactive
681
*/
682
static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
683
{
684
    int len = 0, max_len, err, ret;
685
    uint8_t pid;
686

    
687
    max_len = ((td->token >> 21) + 1) & 0x7ff;
688
    pid = td->token & 0xff;
689

    
690
    ret = async->packet.result;
691

    
692
    if (td->ctrl & TD_CTRL_IOS)
693
        td->ctrl &= ~TD_CTRL_ACTIVE;
694

    
695
    if (ret < 0)
696
        goto out;
697

    
698
    len = async->packet.result;
699
    td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
700

    
701
    /* The NAK bit may have been set by a previous frame, so clear it
702
       here.  The docs are somewhat unclear, but win2k relies on this
703
       behavior.  */
704
    td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
705
    if (td->ctrl & TD_CTRL_IOC)
706
        *int_mask |= 0x01;
707

    
708
    if (pid == USB_TOKEN_IN) {
709
        if (len > max_len) {
710
            ret = USB_RET_BABBLE;
711
            goto out;
712
        }
713

    
714
        if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
715
            *int_mask |= 0x02;
716
            /* short packet: do not update QH */
717
            DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
718
            return 1;
719
        }
720
    }
721

    
722
    /* success */
723
    return 0;
724

    
725
out:
726
    switch(ret) {
727
    case USB_RET_STALL:
728
        td->ctrl |= TD_CTRL_STALL;
729
        td->ctrl &= ~TD_CTRL_ACTIVE;
730
        s->status |= UHCI_STS_USBERR;
731
        if (td->ctrl & TD_CTRL_IOC) {
732
            *int_mask |= 0x01;
733
        }
734
        uhci_update_irq(s);
735
        return 1;
736

    
737
    case USB_RET_BABBLE:
738
        td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
739
        td->ctrl &= ~TD_CTRL_ACTIVE;
740
        s->status |= UHCI_STS_USBERR;
741
        if (td->ctrl & TD_CTRL_IOC) {
742
            *int_mask |= 0x01;
743
        }
744
        uhci_update_irq(s);
745
        /* frame interrupted */
746
        return -1;
747

    
748
    case USB_RET_NAK:
749
        td->ctrl |= TD_CTRL_NAK;
750
        if (pid == USB_TOKEN_SETUP)
751
            break;
752
        return 1;
753

    
754
    case USB_RET_NODEV:
755
    default:
756
        break;
757
    }
758

    
759
    /* Retry the TD if error count is not zero */
760

    
761
    td->ctrl |= TD_CTRL_TIMEOUT;
762
    err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
763
    if (err != 0) {
764
        err--;
765
        if (err == 0) {
766
            td->ctrl &= ~TD_CTRL_ACTIVE;
767
            s->status |= UHCI_STS_USBERR;
768
            if (td->ctrl & TD_CTRL_IOC)
769
                *int_mask |= 0x01;
770
            uhci_update_irq(s);
771
        }
772
    }
773
    td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
774
        (err << TD_CTRL_ERROR_SHIFT);
775
    return 1;
776
}
777

    
778
static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
779
{
780
    UHCIAsync *async;
781
    int len = 0, max_len;
782
    uint8_t pid, isoc;
783
    uint32_t token;
784

    
785
    /* Is active ? */
786
    if (!(td->ctrl & TD_CTRL_ACTIVE))
787
        return 1;
788

    
789
    /* token field is not unique for isochronous requests,
790
     * so use the destination buffer 
791
     */
792
    if (td->ctrl & TD_CTRL_IOS) {
793
        token = td->buffer;
794
        isoc = 1;
795
    } else {
796
        token = td->token;
797
        isoc = 0;
798
    }
799

    
800
    async = uhci_async_find_td(s, addr, token);
801
    if (async) {
802
        /* Already submitted */
803
        async->valid = 32;
804

    
805
        if (!async->done)
806
            return 1;
807

    
808
        uhci_async_unlink(s, async);
809
        goto done;
810
    }
811

    
812
    /* Allocate new packet */
813
    async = uhci_async_alloc(s);
814
    if (!async)
815
        return 1;
816

    
817
    /* valid needs to be large enough to handle 10 frame delay
818
     * for initial isochronous requests
819
     */
820
    async->valid = 32;
821
    async->td    = addr;
822
    async->token = token;
823
    async->isoc  = isoc;
824

    
825
    max_len = ((td->token >> 21) + 1) & 0x7ff;
826
    pid = td->token & 0xff;
827

    
828
    usb_packet_setup(&async->packet, pid, (td->token >> 8) & 0x7f,
829
                     (td->token >> 15) & 0xf);
830
    qemu_sglist_add(&async->sgl, td->buffer, max_len);
831
    usb_packet_map(&async->packet, &async->sgl);
832

    
833
    switch(pid) {
834
    case USB_TOKEN_OUT:
835
    case USB_TOKEN_SETUP:
836
        len = uhci_broadcast_packet(s, &async->packet);
837
        if (len >= 0)
838
            len = max_len;
839
        break;
840

    
841
    case USB_TOKEN_IN:
842
        len = uhci_broadcast_packet(s, &async->packet);
843
        break;
844

    
845
    default:
846
        /* invalid pid : frame interrupted */
847
        uhci_async_free(s, async);
848
        s->status |= UHCI_STS_HCPERR;
849
        uhci_update_irq(s);
850
        return -1;
851
    }
852
 
853
    if (len == USB_RET_ASYNC) {
854
        uhci_async_link(s, async);
855
        return 2;
856
    }
857

    
858
    async->packet.result = len;
859

    
860
done:
861
    len = uhci_complete_td(s, td, async, int_mask);
862
    usb_packet_unmap(&async->packet);
863
    uhci_async_free(s, async);
864
    return len;
865
}
866

    
867
static void uhci_async_complete(USBPort *port, USBPacket *packet)
868
{
869
    UHCIAsync *async = container_of(packet, UHCIAsync, packet);
870
    UHCIState *s = async->uhci;
871

    
872
    DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
873

    
874
    if (async->isoc) {
875
        UHCI_TD td;
876
        uint32_t link = async->td;
877
        uint32_t int_mask = 0, val;
878

    
879
        pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
880
        le32_to_cpus(&td.link);
881
        le32_to_cpus(&td.ctrl);
882
        le32_to_cpus(&td.token);
883
        le32_to_cpus(&td.buffer);
884

    
885
        uhci_async_unlink(s, async);
886
        uhci_complete_td(s, &td, async, &int_mask);
887
        s->pending_int_mask |= int_mask;
888

    
889
        /* update the status bits of the TD */
890
        val = cpu_to_le32(td.ctrl);
891
        pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
892
        uhci_async_free(s, async);
893
    } else {
894
        async->done = 1;
895
        uhci_process_frame(s);
896
    }
897
}
898

    
899
static int is_valid(uint32_t link)
900
{
901
    return (link & 1) == 0;
902
}
903

    
904
static int is_qh(uint32_t link)
905
{
906
    return (link & 2) != 0;
907
}
908

    
909
static int depth_first(uint32_t link)
910
{
911
    return (link & 4) != 0;
912
}
913

    
914
/* QH DB used for detecting QH loops */
915
#define UHCI_MAX_QUEUES 128
916
typedef struct {
917
    uint32_t addr[UHCI_MAX_QUEUES];
918
    int      count;
919
} QhDb;
920

    
921
static void qhdb_reset(QhDb *db)
922
{
923
    db->count = 0;
924
}
925

    
926
/* Add QH to DB. Returns 1 if already present or DB is full. */
927
static int qhdb_insert(QhDb *db, uint32_t addr)
928
{
929
    int i;
930
    for (i = 0; i < db->count; i++)
931
        if (db->addr[i] == addr)
932
            return 1;
933

    
934
    if (db->count >= UHCI_MAX_QUEUES)
935
        return 1;
936

    
937
    db->addr[db->count++] = addr;
938
    return 0;
939
}
940

    
941
static void uhci_process_frame(UHCIState *s)
942
{
943
    uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
944
    uint32_t curr_qh;
945
    int cnt, ret;
946
    UHCI_TD td;
947
    UHCI_QH qh;
948
    QhDb qhdb;
949

    
950
    frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
951

    
952
    DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
953

    
954
    pci_dma_read(&s->dev, frame_addr, &link, 4);
955
    le32_to_cpus(&link);
956

    
957
    int_mask = 0;
958
    curr_qh  = 0;
959

    
960
    qhdb_reset(&qhdb);
961

    
962
    for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
963
        if (is_qh(link)) {
964
            /* QH */
965

    
966
            if (qhdb_insert(&qhdb, link)) {
967
                /*
968
                 * We're going in circles. Which is not a bug because
969
                 * HCD is allowed to do that as part of the BW management. 
970
                 * In our case though it makes no sense to spin here. Sync transations 
971
                 * are already done, and async completion handler will re-process 
972
                 * the frame when something is ready.
973
                 */
974
                DPRINTF("uhci: detected loop. qh 0x%x\n", link);
975
                break;
976
            }
977

    
978
            pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
979
            le32_to_cpus(&qh.link);
980
            le32_to_cpus(&qh.el_link);
981

    
982
            DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
983
                    link, qh.link, qh.el_link);
984

    
985
            if (!is_valid(qh.el_link)) {
986
                /* QH w/o elements */
987
                curr_qh = 0;
988
                link = qh.link;
989
            } else {
990
                /* QH with elements */
991
                    curr_qh = link;
992
                    link = qh.el_link;
993
            }
994
            continue;
995
        }
996

    
997
        /* TD */
998
        pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
999
        le32_to_cpus(&td.link);
1000
        le32_to_cpus(&td.ctrl);
1001
        le32_to_cpus(&td.token);
1002
        le32_to_cpus(&td.buffer);
1003

    
1004
        DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 
1005
                link, td.link, td.ctrl, td.token, curr_qh);
1006

    
1007
        old_td_ctrl = td.ctrl;
1008
        ret = uhci_handle_td(s, link, &td, &int_mask);
1009
        if (old_td_ctrl != td.ctrl) {
1010
            /* update the status bits of the TD */
1011
            val = cpu_to_le32(td.ctrl);
1012
            pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1013
        }
1014

    
1015
        if (ret < 0) {
1016
            /* interrupted frame */
1017
            break;
1018
        }
1019

    
1020
        if (ret == 2 || ret == 1) {
1021
            DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1022
                    link, ret == 2 ? "pend" : "skip",
1023
                    td.link, td.ctrl, td.token, curr_qh);
1024

    
1025
            link = curr_qh ? qh.link : td.link;
1026
            continue;
1027
        }
1028

    
1029
        /* completed TD */
1030

    
1031
        DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 
1032
                link, td.link, td.ctrl, td.token, curr_qh);
1033

    
1034
        link = td.link;
1035

    
1036
        if (curr_qh) {
1037
            /* update QH element link */
1038
            qh.el_link = link;
1039
            val = cpu_to_le32(qh.el_link);
1040
            pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1041

    
1042
            if (!depth_first(link)) {
1043
               /* done with this QH */
1044

    
1045
               DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1046
                       curr_qh, qh.link, qh.el_link);
1047

    
1048
               curr_qh = 0;
1049
               link    = qh.link;
1050
            }
1051
        }
1052

    
1053
        /* go to the next entry */
1054
    }
1055

    
1056
    s->pending_int_mask |= int_mask;
1057
}
1058

    
1059
static void uhci_frame_timer(void *opaque)
1060
{
1061
    UHCIState *s = opaque;
1062

    
1063
    /* prepare the timer for the next frame */
1064
    s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1065

    
1066
    if (!(s->cmd & UHCI_CMD_RS)) {
1067
        /* Full stop */
1068
        qemu_del_timer(s->frame_timer);
1069
        /* set hchalted bit in status - UHCI11D 2.1.2 */
1070
        s->status |= UHCI_STS_HCHALTED;
1071

    
1072
        DPRINTF("uhci: halted\n");
1073
        return;
1074
    }
1075

    
1076
    /* Complete the previous frame */
1077
    if (s->pending_int_mask) {
1078
        s->status2 |= s->pending_int_mask;
1079
        s->status  |= UHCI_STS_USBINT;
1080
        uhci_update_irq(s);
1081
    }
1082
    s->pending_int_mask = 0;
1083

    
1084
    /* Start new frame */
1085
    s->frnum = (s->frnum + 1) & 0x7ff;
1086

    
1087
    DPRINTF("uhci: new frame #%u\n" , s->frnum);
1088

    
1089
    uhci_async_validate_begin(s);
1090

    
1091
    uhci_process_frame(s);
1092

    
1093
    uhci_async_validate_end(s);
1094

    
1095
    qemu_mod_timer(s->frame_timer, s->expire_time);
1096
}
1097

    
1098
static const MemoryRegionPortio uhci_portio[] = {
1099
    { 0, 32, 2, .write = uhci_ioport_writew, },
1100
    { 0, 32, 2, .read = uhci_ioport_readw, },
1101
    { 0, 32, 4, .write = uhci_ioport_writel, },
1102
    { 0, 32, 4, .read = uhci_ioport_readl, },
1103
    { 0, 32, 1, .write = uhci_ioport_writeb, },
1104
    { 0, 32, 1, .read = uhci_ioport_readb, },
1105
    PORTIO_END_OF_LIST()
1106
};
1107

    
1108
static const MemoryRegionOps uhci_ioport_ops = {
1109
    .old_portio = uhci_portio,
1110
};
1111

    
1112
static USBPortOps uhci_port_ops = {
1113
    .attach = uhci_attach,
1114
    .detach = uhci_detach,
1115
    .child_detach = uhci_child_detach,
1116
    .wakeup = uhci_wakeup,
1117
    .complete = uhci_async_complete,
1118
};
1119

    
1120
static USBBusOps uhci_bus_ops = {
1121
};
1122

    
1123
static int usb_uhci_common_initfn(PCIDevice *dev)
1124
{
1125
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1126
    uint8_t *pci_conf = s->dev.config;
1127
    int i;
1128

    
1129
    pci_conf[PCI_CLASS_PROG] = 0x00;
1130
    /* TODO: reset value should be 0. */
1131
    pci_conf[PCI_INTERRUPT_PIN] = 4; /* interrupt pin D */
1132
    pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1133

    
1134
    if (s->masterbus) {
1135
        USBPort *ports[NB_PORTS];
1136
        for(i = 0; i < NB_PORTS; i++) {
1137
            ports[i] = &s->ports[i].port;
1138
        }
1139
        if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1140
                s->firstport, s, &uhci_port_ops,
1141
                USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1142
            return -1;
1143
        }
1144
    } else {
1145
        usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1146
        for (i = 0; i < NB_PORTS; i++) {
1147
            usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1148
                              USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1149
        }
1150
    }
1151
    s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1152
    s->num_ports_vmstate = NB_PORTS;
1153
    QTAILQ_INIT(&s->async_pending);
1154

    
1155
    qemu_register_reset(uhci_reset, s);
1156

    
1157
    memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1158
    /* Use region 4 for consistency with real hardware.  BSD guests seem
1159
       to rely on this.  */
1160
    pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1161

    
1162
    return 0;
1163
}
1164

    
1165
static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1166
{
1167
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1168
    uint8_t *pci_conf = s->dev.config;
1169

    
1170
    /* USB misc control 1/2 */
1171
    pci_set_long(pci_conf + 0x40,0x00001000);
1172
    /* PM capability */
1173
    pci_set_long(pci_conf + 0x80,0x00020001);
1174
    /* USB legacy support  */
1175
    pci_set_long(pci_conf + 0xc0,0x00002000);
1176

    
1177
    return usb_uhci_common_initfn(dev);
1178
}
1179

    
1180
static int usb_uhci_exit(PCIDevice *dev)
1181
{
1182
    UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1183

    
1184
    memory_region_destroy(&s->io_bar);
1185
    return 0;
1186
}
1187

    
1188
static Property uhci_properties[] = {
1189
    DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1190
    DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1191
    DEFINE_PROP_END_OF_LIST(),
1192
};
1193

    
1194
static PCIDeviceInfo uhci_info[] = {
1195
    {
1196
        .qdev.name    = "piix3-usb-uhci",
1197
        .qdev.size    = sizeof(UHCIState),
1198
        .qdev.vmsd    = &vmstate_uhci,
1199
        .init         = usb_uhci_common_initfn,
1200
        .exit         = usb_uhci_exit,
1201
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1202
        .device_id    = PCI_DEVICE_ID_INTEL_82371SB_2,
1203
        .revision     = 0x01,
1204
        .class_id     = PCI_CLASS_SERIAL_USB,
1205
        .qdev.props   = uhci_properties,
1206
    },{
1207
        .qdev.name    = "piix4-usb-uhci",
1208
        .qdev.size    = sizeof(UHCIState),
1209
        .qdev.vmsd    = &vmstate_uhci,
1210
        .init         = usb_uhci_common_initfn,
1211
        .exit         = usb_uhci_exit,
1212
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1213
        .device_id    = PCI_DEVICE_ID_INTEL_82371AB_2,
1214
        .revision     = 0x01,
1215
        .class_id     = PCI_CLASS_SERIAL_USB,
1216
        .qdev.props   = uhci_properties,
1217
    },{
1218
        .qdev.name    = "vt82c686b-usb-uhci",
1219
        .qdev.size    = sizeof(UHCIState),
1220
        .qdev.vmsd    = &vmstate_uhci,
1221
        .init         = usb_uhci_vt82c686b_initfn,
1222
        .exit         = usb_uhci_exit,
1223
        .vendor_id    = PCI_VENDOR_ID_VIA,
1224
        .device_id    = PCI_DEVICE_ID_VIA_UHCI,
1225
        .revision     = 0x01,
1226
        .class_id     = PCI_CLASS_SERIAL_USB,
1227
        .qdev.props   = uhci_properties,
1228
    },{
1229
        .qdev.name    = "ich9-usb-uhci1",
1230
        .qdev.size    = sizeof(UHCIState),
1231
        .qdev.vmsd    = &vmstate_uhci,
1232
        .init         = usb_uhci_common_initfn,
1233
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1234
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1235
        .revision     = 0x03,
1236
        .class_id     = PCI_CLASS_SERIAL_USB,
1237
        .qdev.props   = uhci_properties,
1238
    },{
1239
        .qdev.name    = "ich9-usb-uhci2",
1240
        .qdev.size    = sizeof(UHCIState),
1241
        .qdev.vmsd    = &vmstate_uhci,
1242
        .init         = usb_uhci_common_initfn,
1243
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1244
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1245
        .revision     = 0x03,
1246
        .class_id     = PCI_CLASS_SERIAL_USB,
1247
        .qdev.props   = uhci_properties,
1248
    },{
1249
        .qdev.name    = "ich9-usb-uhci3",
1250
        .qdev.size    = sizeof(UHCIState),
1251
        .qdev.vmsd    = &vmstate_uhci,
1252
        .init         = usb_uhci_common_initfn,
1253
        .vendor_id    = PCI_VENDOR_ID_INTEL,
1254
        .device_id    = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1255
        .revision     = 0x03,
1256
        .class_id     = PCI_CLASS_SERIAL_USB,
1257
        .qdev.props   = uhci_properties,
1258
    },{
1259
        /* end of list */
1260
    }
1261
};
1262

    
1263
static void uhci_register(void)
1264
{
1265
    pci_qdev_register_many(uhci_info);
1266
}
1267
device_init(uhci_register);
1268

    
1269
void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1270
{
1271
    pci_create_simple(bus, devfn, "piix3-usb-uhci");
1272
}
1273

    
1274
void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1275
{
1276
    pci_create_simple(bus, devfn, "piix4-usb-uhci");
1277
}
1278

    
1279
void usb_uhci_vt82c686b_init(PCIBus *bus, int devfn)
1280
{
1281
    pci_create_simple(bus, devfn, "vt82c686b-usb-uhci");
1282
}