hw/usb-uhci.c

   1 /*
   2  * USB UHCI controller emulation
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  *
   6  * Copyright (c) 2008 Max Krasnyansky
   7  *     Magor rewrite of the UHCI data structures parser and frame processor
   8  *     Support for fully async operation and multiple outstanding transactions
   9  *
  10  * Permission is hereby granted, free of charge, to any person obtaining a copy
  11  * of this software and associated documentation files (the "Software"), to deal
  12  * in the Software without restriction, including without limitation the rights
  13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14  * copies of the Software, and to permit persons to whom the Software is
  15  * furnished to do so, subject to the following conditions:
  16  *
  17  * The above copyright notice and this permission notice shall be included in
  18  * all copies or substantial portions of the Software.
  19  *
  20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  26  * THE SOFTWARE.
  27  */
  28 #include "hw.h"
  29 #include "usb.h"
  30 #include "pci.h"
  31 #include "qemu-timer.h"
  32
  33 //#define DEBUG
  34 //#define DEBUG_DUMP_DATA
  35
  36 #define UHCI_CMD_FGR      (1 << 4)
  37 #define UHCI_CMD_EGSM     (1 << 3)
  38 #define UHCI_CMD_GRESET   (1 << 2)
  39 #define UHCI_CMD_HCRESET  (1 << 1)
  40 #define UHCI_CMD_RS       (1 << 0)
  41
  42 #define UHCI_STS_HCHALTED (1 << 5)
  43 #define UHCI_STS_HCPERR   (1 << 4)
  44 #define UHCI_STS_HSERR    (1 << 3)
  45 #define UHCI_STS_RD       (1 << 2)
  46 #define UHCI_STS_USBERR   (1 << 1)
  47 #define UHCI_STS_USBINT   (1 << 0)
  48
  49 #define TD_CTRL_SPD     (1 << 29)
  50 #define TD_CTRL_ERROR_SHIFT  27
  51 #define TD_CTRL_IOS     (1 << 25)
  52 #define TD_CTRL_IOC     (1 << 24)
  53 #define TD_CTRL_ACTIVE  (1 << 23)
  54 #define TD_CTRL_STALL   (1 << 22)
  55 #define TD_CTRL_BABBLE  (1 << 20)
  56 #define TD_CTRL_NAK     (1 << 19)
  57 #define TD_CTRL_TIMEOUT (1 << 18)
  58
  59 #define UHCI_PORT_RESET (1 << 9)
  60 #define UHCI_PORT_LSDA  (1 << 8)
  61 #define UHCI_PORT_ENC   (1 << 3)
  62 #define UHCI_PORT_EN    (1 << 2)
  63 #define UHCI_PORT_CSC   (1 << 1)
  64 #define UHCI_PORT_CCS   (1 << 0)
  65
  66 #define FRAME_TIMER_FREQ 1000
  67
  68 #define FRAME_MAX_LOOPS  100
  69
  70 #define NB_PORTS 2
  71
  72 #ifdef DEBUG
  73 #define dprintf printf
  74
  75 static const char *pid2str(int pid)
  76 {
  77     switch (pid) {
  78     case USB_TOKEN_SETUP: return "SETUP";
  79     case USB_TOKEN_IN:    return "IN";
  80     case USB_TOKEN_OUT:   return "OUT";
  81     }
  82     return "?";
  83 }
  84
  85 #else
  86 #define dprintf(...)
  87 #endif
  88
  89 #ifdef DEBUG_DUMP_DATA
  90 static void dump_data(const uint8_t *data, int len)
  91 {
  92     int i;
  93
  94     printf("uhci: data: ");
  95     for(i = 0; i < len; i++)
  96         printf(" %02x", data[i]);
  97     printf("\n");
  98 }
  99 #else
 100 static void dump_data(const uint8_t *data, int len) {}
 101 #endif
 102
 103 /*
 104  * Pending async transaction.
 105  * 'packet' must be the first field because completion
 106  * handler does "(UHCIAsync *) pkt" cast.
 107  */
 108 typedef struct UHCIAsync {
 109     USBPacket packet;
 110     struct UHCIAsync *next;
 111     uint32_t  td;
 112     uint32_t  token;
 113     int8_t    valid;
 114     uint8_t   done;
 115     uint8_t   buffer[2048];
 116 } UHCIAsync;
 117
 118 typedef struct UHCIPort {
 119     USBPort port;
 120     uint16_t ctrl;
 121 } UHCIPort;
 122
 123 typedef struct UHCIState {
 124     PCIDevice dev;
 125     uint16_t cmd; /* cmd register */
 126     uint16_t status;
 127     uint16_t intr; /* interrupt enable register */
 128     uint16_t frnum; /* frame number */
 129     uint32_t fl_base_addr; /* frame list base address */
 130     uint8_t sof_timing;
 131     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
 132     QEMUTimer *frame_timer;
 133     UHCIPort ports[NB_PORTS];
 134
 135     /* Interrupts that should be raised at the end of the current frame.  */
 136     uint32_t pending_int_mask;
 137
 138     /* Active packets */
 139     UHCIAsync *async_pending;
 140     UHCIAsync *async_pool;
 141 } UHCIState;
 142
 143 typedef struct UHCI_TD {
 144     uint32_t link;
 145     uint32_t ctrl; /* see TD_CTRL_xxx */
 146     uint32_t token;
 147     uint32_t buffer;
 148 } UHCI_TD;
 149
 150 typedef struct UHCI_QH {
 151     uint32_t link;
 152     uint32_t el_link;
 153 } UHCI_QH;
 154
 155 static UHCIAsync *uhci_async_alloc(UHCIState *s)
 156 {
 157     UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
 158
 159     memset(&async->packet, 0, sizeof(async->packet));
 160     async->valid = 0;
 161     async->td    = 0;
 162     async->token = 0;
 163     async->done  = 0;
 164     async->next  = NULL;
 165
 166     return async;
 167 }
 168
 169 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
 170 {
 171     qemu_free(async);
 172 }
 173
 174 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
 175 {
 176     async->next = s->async_pending;
 177     s->async_pending = async;
 178 }
 179
 180 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
 181 {
 182     UHCIAsync *curr = s->async_pending;
 183     UHCIAsync **prev = &s->async_pending;
 184
 185     while (curr) {
 186         if (curr == async) {
 187             *prev = curr->next;
 188             return;
 189         }
 190
 191         prev = &curr->next;
 192         curr = curr->next;
 193     }
 194 }
 195
 196 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
 197 {
 198     dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",
 199            async->td, async->token, async->done);
 200
 201     if (!async->done)
 202         usb_cancel_packet(&async->packet);
 203     uhci_async_free(s, async);
 204 }
 205
 206 /*
 207  * Mark all outstanding async packets as invalid.
 208  * This is used for canceling them when TDs are removed by the HCD.
 209  */
 210 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
 211 {
 212     UHCIAsync *async = s->async_pending;
 213
 214     while (async) {
 215         async->valid--;
 216         async = async->next;
 217     }
 218     return NULL;
 219 }
 220
 221 /*
 222  * Cancel async packets that are no longer valid
 223  */
 224 static void uhci_async_validate_end(UHCIState *s)
 225 {
 226     UHCIAsync *curr = s->async_pending;
 227     UHCIAsync **prev = &s->async_pending;
 228     UHCIAsync *next;
 229
 230     while (curr) {
 231         if (curr->valid > 0) {
 232             prev = &curr->next;
 233             curr = curr->next;
 234             continue;
 235         }
 236
 237         next = curr->next;
 238
 239         /* Unlink */
 240         *prev = next;
 241
 242         uhci_async_cancel(s, curr);
 243
 244         curr = next;
 245     }
 246 }
 247
 248 static void uhci_async_cancel_all(UHCIState *s)
 249 {
 250     UHCIAsync *curr = s->async_pending;
 251     UHCIAsync *next;
 252
 253     while (curr) {
 254         next = curr->next;
 255
 256         uhci_async_cancel(s, curr);
 257
 258         curr = next;
 259     }
 260
 261     s->async_pending = NULL;
 262 }
 263
 264 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
 265 {
 266     UHCIAsync *async = s->async_pending;
 267     UHCIAsync *match = NULL;
 268     int count = 0;
 269
 270     /*
 271      * We're looking for the best match here. ie both td addr and token.
 272      * Otherwise we return last good match. ie just token.
 273      * It's ok to match just token because it identifies the transaction
 274      * rather well, token includes: device addr, endpoint, size, etc.
 275      *
 276      * Also since we queue async transactions in reverse order by returning
 277      * last good match we restores the order.
 278      *
 279      * It's expected that we wont have a ton of outstanding transactions.
 280      * If we ever do we'd want to optimize this algorithm.
 281      */
 282
 283     while (async) {
 284         if (async->token == token) {
 285             /* Good match */
 286             match = async;
 287
 288             if (async->td == addr) {
 289                 /* Best match */
 290                 break;
 291             }
 292         }
 293
 294         async = async->next;
 295         count++;
 296     }
 297
 298     if (count > 64)
 299         fprintf(stderr, "uhci: warning lots of async transactions\n");
 300
 301     return match;
 302 }
 303
 304 static void uhci_attach(USBPort *port1, USBDevice *dev);
 305
 306 static void uhci_update_irq(UHCIState *s)
 307 {
 308     int level;
 309     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
 310         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
 311         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
 312         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
 313         (s->status & UHCI_STS_HSERR) ||
 314         (s->status & UHCI_STS_HCPERR)) {
 315         level = 1;
 316     } else {
 317         level = 0;
 318     }
 319     qemu_set_irq(s->dev.irq[3], level);
 320 }
 321
 322 static void uhci_reset(void *opaque)
 323 {
 324     UHCIState *s = opaque;
 325     uint8_t *pci_conf;
 326     int i;
 327     UHCIPort *port;
 328
 329     dprintf("uhci: full reset\n");
 330
 331     pci_conf = s->dev.config;
 332
 333     pci_conf[0x6a] = 0x01; /* usb clock */
 334     pci_conf[0x6b] = 0x00;
 335     s->cmd = 0;
 336     s->status = 0;
 337     s->status2 = 0;
 338     s->intr = 0;
 339     s->fl_base_addr = 0;
 340     s->sof_timing = 64;
 341
 342     for(i = 0; i < NB_PORTS; i++) {
 343         port = &s->ports[i];
 344         port->ctrl = 0x0080;
 345         if (port->port.dev)
 346             uhci_attach(&port->port, port->port.dev);
 347     }
 348
 349     uhci_async_cancel_all(s);
 350 }
 351
 352 static void uhci_save(QEMUFile *f, void *opaque)
 353 {
 354     UHCIState *s = opaque;
 355     uint8_t num_ports = NB_PORTS;
 356     int i;
 357
 358     uhci_async_cancel_all(s);
 359
 360     pci_device_save(&s->dev, f);
 361
 362     qemu_put_8s(f, &num_ports);
 363     for (i = 0; i < num_ports; ++i)
 364         qemu_put_be16s(f, &s->ports[i].ctrl);
 365     qemu_put_be16s(f, &s->cmd);
 366     qemu_put_be16s(f, &s->status);
 367     qemu_put_be16s(f, &s->intr);
 368     qemu_put_be16s(f, &s->frnum);
 369     qemu_put_be32s(f, &s->fl_base_addr);
 370     qemu_put_8s(f, &s->sof_timing);
 371     qemu_put_8s(f, &s->status2);
 372     qemu_put_timer(f, s->frame_timer);
 373 }
 374
 375 static int uhci_load(QEMUFile *f, void *opaque, int version_id)
 376 {
 377     UHCIState *s = opaque;
 378     uint8_t num_ports;
 379     int i, ret;
 380
 381     if (version_id > 1)
 382         return -EINVAL;
 383
 384     ret = pci_device_load(&s->dev, f);
 385     if (ret < 0)
 386         return ret;
 387
 388     qemu_get_8s(f, &num_ports);
 389     if (num_ports != NB_PORTS)
 390         return -EINVAL;
 391
 392     for (i = 0; i < num_ports; ++i)
 393         qemu_get_be16s(f, &s->ports[i].ctrl);
 394     qemu_get_be16s(f, &s->cmd);
 395     qemu_get_be16s(f, &s->status);
 396     qemu_get_be16s(f, &s->intr);
 397     qemu_get_be16s(f, &s->frnum);
 398     qemu_get_be32s(f, &s->fl_base_addr);
 399     qemu_get_8s(f, &s->sof_timing);
 400     qemu_get_8s(f, &s->status2);
 401     qemu_get_timer(f, s->frame_timer);
 402
 403     return 0;
 404 }
 405
 406 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
 407 {
 408     UHCIState *s = opaque;
 409
 410     addr &= 0x1f;
 411     switch(addr) {
 412     case 0x0c:
 413         s->sof_timing = val;
 414         break;
 415     }
 416 }
 417
 418 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
 419 {
 420     UHCIState *s = opaque;
 421     uint32_t val;
 422
 423     addr &= 0x1f;
 424     switch(addr) {
 425     case 0x0c:
 426         val = s->sof_timing;
 427         break;
 428     default:
 429         val = 0xff;
 430         break;
 431     }
 432     return val;
 433 }
 434
 435 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 436 {
 437     UHCIState *s = opaque;
 438
 439     addr &= 0x1f;
 440     dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
 441
 442     switch(addr) {
 443     case 0x00:
 444         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
 445             /* start frame processing */
 446             qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
 447             s->status &= ~UHCI_STS_HCHALTED;
 448         } else if (!(val & UHCI_CMD_RS)) {
 449             s->status |= UHCI_STS_HCHALTED;
 450         }
 451         if (val & UHCI_CMD_GRESET) {
 452             UHCIPort *port;
 453             USBDevice *dev;
 454             int i;
 455
 456             /* send reset on the USB bus */
 457             for(i = 0; i < NB_PORTS; i++) {
 458                 port = &s->ports[i];
 459                 dev = port->port.dev;
 460                 if (dev) {
 461                     usb_send_msg(dev, USB_MSG_RESET);
 462                 }
 463             }
 464             uhci_reset(s);
 465             return;
 466         }
 467         if (val & UHCI_CMD_HCRESET) {
 468             uhci_reset(s);
 469             return;
 470         }
 471         s->cmd = val;
 472         break;
 473     case 0x02:
 474         s->status &= ~val;
 475         /* XXX: the chip spec is not coherent, so we add a hidden
 476            register to distinguish between IOC and SPD */
 477         if (val & UHCI_STS_USBINT)
 478             s->status2 = 0;
 479         uhci_update_irq(s);
 480         break;
 481     case 0x04:
 482         s->intr = val;
 483         uhci_update_irq(s);
 484         break;
 485     case 0x06:
 486         if (s->status & UHCI_STS_HCHALTED)
 487             s->frnum = val & 0x7ff;
 488         break;
 489     case 0x10 ... 0x1f:
 490         {
 491             UHCIPort *port;
 492             USBDevice *dev;
 493             int n;
 494
 495             n = (addr >> 1) & 7;
 496             if (n >= NB_PORTS)
 497                 return;
 498             port = &s->ports[n];
 499             dev = port->port.dev;
 500             if (dev) {
 501                 /* port reset */
 502                 if ( (val & UHCI_PORT_RESET) &&
 503                      !(port->ctrl & UHCI_PORT_RESET) ) {
 504                     usb_send_msg(dev, USB_MSG_RESET);
 505                 }
 506             }
 507             port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
 508             /* some bits are reset when a '1' is written to them */
 509             port->ctrl &= ~(val & 0x000a);
 510         }
 511         break;
 512     }
 513 }
 514
 515 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
 516 {
 517     UHCIState *s = opaque;
 518     uint32_t val;
 519
 520     addr &= 0x1f;
 521     switch(addr) {
 522     case 0x00:
 523         val = s->cmd;
 524         break;
 525     case 0x02:
 526         val = s->status;
 527         break;
 528     case 0x04:
 529         val = s->intr;
 530         break;
 531     case 0x06:
 532         val = s->frnum;
 533         break;
 534     case 0x10 ... 0x1f:
 535         {
 536             UHCIPort *port;
 537             int n;
 538             n = (addr >> 1) & 7;
 539             if (n >= NB_PORTS)
 540                 goto read_default;
 541             port = &s->ports[n];
 542             val = port->ctrl;
 543         }
 544         break;
 545     default:
 546     read_default:
 547         val = 0xff7f; /* disabled port */
 548         break;
 549     }
 550
 551     dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
 552
 553     return val;
 554 }
 555
 556 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
 557 {
 558     UHCIState *s = opaque;
 559
 560     addr &= 0x1f;
 561     dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
 562
 563     switch(addr) {
 564     case 0x08:
 565         s->fl_base_addr = val & ~0xfff;
 566         break;
 567     }
 568 }
 569
 570 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
 571 {
 572     UHCIState *s = opaque;
 573     uint32_t val;
 574
 575     addr &= 0x1f;
 576     switch(addr) {
 577     case 0x08:
 578         val = s->fl_base_addr;
 579         break;
 580     default:
 581         val = 0xffffffff;
 582         break;
 583     }
 584     return val;
 585 }
 586
 587 /* signal resume if controller suspended */
 588 static void uhci_resume (void *opaque)
 589 {
 590     UHCIState *s = (UHCIState *)opaque;
 591
 592     if (!s)
 593         return;
 594
 595     if (s->cmd & UHCI_CMD_EGSM) {
 596         s->cmd |= UHCI_CMD_FGR;
 597         s->status |= UHCI_STS_RD;
 598         uhci_update_irq(s);
 599     }
 600 }
 601
 602 static void uhci_attach(USBPort *port1, USBDevice *dev)
 603 {
 604     UHCIState *s = port1->opaque;
 605     UHCIPort *port = &s->ports[port1->index];
 606
 607     if (dev) {
 608         if (port->port.dev) {
 609             usb_attach(port1, NULL);
 610         }
 611         /* set connect status */
 612         port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
 613
 614         /* update speed */
 615         if (dev->speed == USB_SPEED_LOW)
 616             port->ctrl |= UHCI_PORT_LSDA;
 617         else
 618             port->ctrl &= ~UHCI_PORT_LSDA;
 619
 620         uhci_resume(s);
 621
 622         port->port.dev = dev;
 623         /* send the attach message */
 624         usb_send_msg(dev, USB_MSG_ATTACH);
 625     } else {
 626         /* set connect status */
 627         if (port->ctrl & UHCI_PORT_CCS) {
 628             port->ctrl &= ~UHCI_PORT_CCS;
 629             port->ctrl |= UHCI_PORT_CSC;
 630         }
 631         /* disable port */
 632         if (port->ctrl & UHCI_PORT_EN) {
 633             port->ctrl &= ~UHCI_PORT_EN;
 634             port->ctrl |= UHCI_PORT_ENC;
 635         }
 636
 637         uhci_resume(s);
 638
 639         dev = port->port.dev;
 640         if (dev) {
 641             /* send the detach message */
 642             usb_send_msg(dev, USB_MSG_DETACH);
 643         }
 644         port->port.dev = NULL;
 645     }
 646 }
 647
 648 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
 649 {
 650     int i, ret;
 651
 652     dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
 653            pid2str(p->pid), p->devaddr, p->devep, p->len);
 654     if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
 655         dump_data(p->data, p->len);
 656
 657     ret = USB_RET_NODEV;
 658     for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
 659         UHCIPort *port = &s->ports[i];
 660         USBDevice *dev = port->port.dev;
 661
 662         if (dev && (port->ctrl & UHCI_PORT_EN))
 663             ret = dev->handle_packet(dev, p);
 664     }
 665
 666     dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);
 667     if (p->pid == USB_TOKEN_IN && ret > 0)
 668         dump_data(p->data, ret);
 669
 670     return ret;
 671 }
 672
 673 static void uhci_async_complete(USBPacket * packet, void *opaque);
 674 static void uhci_process_frame(UHCIState *s);
 675
 676 /* return -1 if fatal error (frame must be stopped)
 677           0 if TD successful
 678           1 if TD unsuccessful or inactive
 679 */
 680 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
 681 {
 682     int len = 0, max_len, err, ret;
 683     uint8_t pid;
 684
 685     max_len = ((td->token >> 21) + 1) & 0x7ff;
 686     pid = td->token & 0xff;
 687
 688     ret = async->packet.len;
 689
 690     if (td->ctrl & TD_CTRL_IOC)
 691         *int_mask |= 0x01;
 692
 693     if (td->ctrl & TD_CTRL_IOS)
 694         td->ctrl &= ~TD_CTRL_ACTIVE;
 695
 696     if (ret < 0)
 697         goto out;
 698
 699     len = async->packet.len;
 700     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
 701
 702     /* The NAK bit may have been set by a previous frame, so clear it
 703        here.  The docs are somewhat unclear, but win2k relies on this
 704        behavior.  */
 705     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
 706
 707     if (pid == USB_TOKEN_IN) {
 708         if (len > max_len) {
 709             len = max_len;
 710             ret = USB_RET_BABBLE;
 711             goto out;
 712         }
 713
 714         if (len > 0) {
 715             /* write the data back */
 716             cpu_physical_memory_write(td->buffer, async->buffer, len);
 717         }
 718
 719         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
 720             *int_mask |= 0x02;
 721             /* short packet: do not update QH */
 722             dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
 723             return 1;
 724         }
 725     }
 726
 727     /* success */
 728     return 0;
 729
 730 out:
 731     switch(ret) {
 732     case USB_RET_STALL:
 733         td->ctrl |= TD_CTRL_STALL;
 734         td->ctrl &= ~TD_CTRL_ACTIVE;
 735         return 1;
 736
 737     case USB_RET_BABBLE:
 738         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
 739         td->ctrl &= ~TD_CTRL_ACTIVE;
 740         /* frame interrupted */
 741         return -1;
 742
 743     case USB_RET_NAK:
 744         td->ctrl |= TD_CTRL_NAK;
 745         if (pid == USB_TOKEN_SETUP)
 746             break;
 747         return 1;
 748
 749     case USB_RET_NODEV:
 750     default:
 751         break;
 752     }
 753
 754     /* Retry the TD if error count is not zero */
 755
 756     td->ctrl |= TD_CTRL_TIMEOUT;
 757     err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
 758     if (err != 0) {
 759         err--;
 760         if (err == 0) {
 761             td->ctrl &= ~TD_CTRL_ACTIVE;
 762             s->status |= UHCI_STS_USBERR;
 763             uhci_update_irq(s);
 764         }
 765     }
 766     td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
 767         (err << TD_CTRL_ERROR_SHIFT);
 768     return 1;
 769 }
 770
 771 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
 772 {
 773     UHCIAsync *async;
 774     int len = 0, max_len;
 775     uint8_t pid;
 776
 777     /* Is active ? */
 778     if (!(td->ctrl & TD_CTRL_ACTIVE))
 779         return 1;
 780
 781     async = uhci_async_find_td(s, addr, td->token);
 782     if (async) {
 783         /* Already submitted */
 784         async->valid = 32;
 785
 786         if (!async->done)
 787             return 1;
 788
 789         uhci_async_unlink(s, async);
 790         goto done;
 791     }
 792
 793     /* Allocate new packet */
 794     async = uhci_async_alloc(s);
 795     if (!async)
 796         return 1;
 797
 798     async->valid = 10;
 799     async->td    = addr;
 800     async->token = td->token;
 801
 802     max_len = ((td->token >> 21) + 1) & 0x7ff;
 803     pid = td->token & 0xff;
 804
 805     async->packet.pid     = pid;
 806     async->packet.devaddr = (td->token >> 8) & 0x7f;
 807     async->packet.devep   = (td->token >> 15) & 0xf;
 808     async->packet.data    = async->buffer;
 809     async->packet.len     = max_len;
 810     async->packet.complete_cb     = uhci_async_complete;
 811     async->packet.complete_opaque = s;
 812
 813     switch(pid) {
 814     case USB_TOKEN_OUT:
 815     case USB_TOKEN_SETUP:
 816         cpu_physical_memory_read(td->buffer, async->buffer, max_len);
 817         len = uhci_broadcast_packet(s, &async->packet);
 818         if (len >= 0)
 819             len = max_len;
 820         break;
 821
 822     case USB_TOKEN_IN:
 823         len = uhci_broadcast_packet(s, &async->packet);
 824         break;
 825
 826     default:
 827         /* invalid pid : frame interrupted */
 828         uhci_async_free(s, async);
 829         s->status |= UHCI_STS_HCPERR;
 830         uhci_update_irq(s);
 831         return -1;
 832     }
 833
 834     if (len == USB_RET_ASYNC) {
 835         uhci_async_link(s, async);
 836         return 2;
 837     }
 838
 839     async->packet.len = len;
 840
 841 done:
 842     len = uhci_complete_td(s, td, async, int_mask);
 843     uhci_async_free(s, async);
 844     return len;
 845 }
 846
 847 static void uhci_async_complete(USBPacket *packet, void *opaque)
 848 {
 849     UHCIState *s = opaque;
 850     UHCIAsync *async = (UHCIAsync *) packet;
 851
 852     dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
 853
 854     async->done = 1;
 855
 856     uhci_process_frame(s);
 857 }
 858
 859 static int is_valid(uint32_t link)
 860 {
 861     return (link & 1) == 0;
 862 }
 863
 864 static int is_qh(uint32_t link)
 865 {
 866     return (link & 2) != 0;
 867 }
 868
 869 static int depth_first(uint32_t link)
 870 {
 871     return (link & 4) != 0;
 872 }
 873
 874 /* QH DB used for detecting QH loops */
 875 #define UHCI_MAX_QUEUES 128
 876 typedef struct {
 877     uint32_t addr[UHCI_MAX_QUEUES];
 878     int      count;
 879 } QhDb;
 880
 881 static void qhdb_reset(QhDb *db)
 882 {
 883     db->count = 0;
 884 }
 885
 886 /* Add QH to DB. Returns 1 if already present or DB is full. */
 887 static int qhdb_insert(QhDb *db, uint32_t addr)
 888 {
 889     int i;
 890     for (i = 0; i < db->count; i++)
 891         if (db->addr[i] == addr)
 892             return 1;
 893
 894     if (db->count >= UHCI_MAX_QUEUES)
 895         return 1;
 896
 897     db->addr[db->count++] = addr;
 898     return 0;
 899 }
 900
 901 static void uhci_process_frame(UHCIState *s)
 902 {
 903     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
 904     uint32_t curr_qh;
 905     int cnt, ret;
 906     UHCI_TD td;
 907     UHCI_QH qh;
 908     QhDb qhdb;
 909
 910     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
 911
 912     dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
 913
 914     cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
 915     le32_to_cpus(&link);
 916
 917     int_mask = 0;
 918     curr_qh  = 0;
 919
 920     qhdb_reset(&qhdb);
 921
 922     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
 923         if (is_qh(link)) {
 924             /* QH */
 925
 926             if (qhdb_insert(&qhdb, link)) {
 927                 /*
 928                  * We're going in circles. Which is not a bug because
 929                  * HCD is allowed to do that as part of the BW management.
 930                  * In our case though it makes no sense to spin here. Sync transations
 931                  * are already done, and async completion handler will re-process
 932                  * the frame when something is ready.
 933                  */
 934                 dprintf("uhci: detected loop. qh 0x%x\n", link);
 935                 break;
 936             }
 937
 938             cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
 939             le32_to_cpus(&qh.link);
 940             le32_to_cpus(&qh.el_link);
 941
 942             dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
 943                     link, qh.link, qh.el_link);
 944
 945             if (!is_valid(qh.el_link)) {
 946                 /* QH w/o elements */
 947                 curr_qh = 0;
 948                 link = qh.link;
 949             } else {
 950                 /* QH with elements */
 951                 curr_qh = link;
 952                 link = qh.el_link;
 953             }
 954             continue;
 955         }
 956
 957         /* TD */
 958         cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
 959         le32_to_cpus(&td.link);
 960         le32_to_cpus(&td.ctrl);
 961         le32_to_cpus(&td.token);
 962         le32_to_cpus(&td.buffer);
 963
 964         dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 965                 link, td.link, td.ctrl, td.token, curr_qh);
 966
 967         old_td_ctrl = td.ctrl;
 968         ret = uhci_handle_td(s, link, &td, &int_mask);
 969         if (old_td_ctrl != td.ctrl) {
 970             /* update the status bits of the TD */
 971             val = cpu_to_le32(td.ctrl);
 972             cpu_physical_memory_write((link & ~0xf) + 4,
 973                                       (const uint8_t *)&val, sizeof(val));
 974         }
 975
 976         if (ret < 0) {
 977             /* interrupted frame */
 978             break;
 979         }
 980
 981         if (ret == 2 || ret == 1) {
 982             dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 983                     link, ret == 2 ? "pend" : "skip",
 984                     td.link, td.ctrl, td.token, curr_qh);
 985
 986             link = curr_qh ? qh.link : td.link;
 987             continue;
 988         }
 989
 990         /* completed TD */
 991
 992         dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
 993                 link, td.link, td.ctrl, td.token, curr_qh);
 994
 995         link = td.link;
 996
 997         if (curr_qh) {
 998             /* update QH element link */
 999             qh.el_link = link;
1000             val = cpu_to_le32(qh.el_link);
1001             cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1002                                           (const uint8_t *)&val, sizeof(val));
1003
1004             if (!depth_first(link)) {
1005                /* done with this QH */
1006
1007                dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1008                        curr_qh, qh.link, qh.el_link);
1009
1010                curr_qh = 0;
1011                link    = qh.link;
1012             }
1013         }
1014
1015         /* go to the next entry */
1016     }
1017
1018     s->pending_int_mask = int_mask;
1019 }
1020
1021 static void uhci_frame_timer(void *opaque)
1022 {
1023     UHCIState *s = opaque;
1024     int64_t expire_time;
1025
1026     if (!(s->cmd & UHCI_CMD_RS)) {
1027         /* Full stop */
1028         qemu_del_timer(s->frame_timer);
1029         /* set hchalted bit in status - UHCI11D 2.1.2 */
1030         s->status |= UHCI_STS_HCHALTED;
1031
1032         dprintf("uhci: halted\n");
1033         return;
1034     }
1035
1036     /* Complete the previous frame */
1037     if (s->pending_int_mask) {
1038         s->status2 |= s->pending_int_mask;
1039         s->status  |= UHCI_STS_USBINT;
1040         uhci_update_irq(s);
1041     }
1042
1043     /* Start new frame */
1044     s->frnum = (s->frnum + 1) & 0x7ff;
1045
1046     dprintf("uhci: new frame #%u\n" , s->frnum);
1047
1048     uhci_async_validate_begin(s);
1049
1050     uhci_process_frame(s);
1051
1052     uhci_async_validate_end(s);
1053
1054     /* prepare the timer for the next frame */
1055     expire_time = qemu_get_clock(vm_clock) +
1056         (ticks_per_sec / FRAME_TIMER_FREQ);
1057     qemu_mod_timer(s->frame_timer, expire_time);
1058 }
1059
1060 static void uhci_map(PCIDevice *pci_dev, int region_num,
1061                     uint32_t addr, uint32_t size, int type)
1062 {
1063     UHCIState *s = (UHCIState *)pci_dev;
1064
1065     register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1066     register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1067     register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1068     register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1069     register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1070     register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1071 }
1072
1073 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1074 {
1075     UHCIState *s;
1076     uint8_t *pci_conf;
1077     int i;
1078
1079     s = (UHCIState *)pci_register_device(bus,
1080                                         "USB-UHCI", sizeof(UHCIState),
1081                                         devfn, NULL, NULL);
1082     pci_conf = s->dev.config;
1083     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1084     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
1085     pci_conf[0x08] = 0x01; // revision number
1086     pci_conf[0x09] = 0x00;
1087     pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1088     pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1089     pci_conf[0x3d] = 4; // interrupt pin 3
1090     pci_conf[0x60] = 0x10; // release number
1091
1092     for(i = 0; i < NB_PORTS; i++) {
1093         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1094     }
1095     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1096
1097     qemu_register_reset(uhci_reset, s);
1098     uhci_reset(s);
1099
1100     /* Use region 4 for consistency with real hardware.  BSD guests seem
1101        to rely on this.  */
1102     pci_register_bar(&s->dev, 4, 0x20,
1103                            PCI_ADDRESS_SPACE_IO, uhci_map);
1104
1105     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1106 }
1107
1108 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1109 {
1110     UHCIState *s;
1111     uint8_t *pci_conf;
1112     int i;
1113
1114     s = (UHCIState *)pci_register_device(bus,
1115                                         "USB-UHCI", sizeof(UHCIState),
1116                                         devfn, NULL, NULL);
1117     pci_conf = s->dev.config;
1118     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1119     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
1120     pci_conf[0x08] = 0x01; // revision number
1121     pci_conf[0x09] = 0x00;
1122     pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1123     pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1124     pci_conf[0x3d] = 4; // interrupt pin 3
1125     pci_conf[0x60] = 0x10; // release number
1126
1127     for(i = 0; i < NB_PORTS; i++) {
1128         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1129     }
1130     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1131
1132     qemu_register_reset(uhci_reset, s);
1133     uhci_reset(s);
1134
1135     /* Use region 4 for consistency with real hardware.  BSD guests seem
1136        to rely on this.  */
1137     pci_register_bar(&s->dev, 4, 0x20,
1138                            PCI_ADDRESS_SPACE_IO, uhci_map);
1139
1140     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1141 }