usb: move complete callback to port ops
[qemu.git] / hw / usb-uhci.c
1 /*
2 * USB UHCI controller emulation
3 *
4 * Copyright (c) 2005 Fabrice Bellard
5 *
6 * Copyright (c) 2008 Max Krasnyansky
7 * Magor rewrite of the UHCI data structures parser and frame processor
8 * Support for fully async operation and multiple outstanding transactions
9 *
10 * Permission is hereby granted, free of charge, to any person obtaining a copy
11 * of this software and associated documentation files (the "Software"), to deal
12 * in the Software without restriction, including without limitation the rights
13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14 * copies of the Software, and to permit persons to whom the Software is
15 * furnished to do so, subject to the following conditions:
16 *
17 * The above copyright notice and this permission notice shall be included in
18 * all copies or substantial portions of the Software.
19 *
20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 * THE SOFTWARE.
27 */
28 #include "hw.h"
29 #include "usb.h"
30 #include "pci.h"
31 #include "qemu-timer.h"
32 #include "usb-uhci.h"
33
34 //#define DEBUG
35 //#define DEBUG_DUMP_DATA
36
37 #define UHCI_CMD_FGR (1 << 4)
38 #define UHCI_CMD_EGSM (1 << 3)
39 #define UHCI_CMD_GRESET (1 << 2)
40 #define UHCI_CMD_HCRESET (1 << 1)
41 #define UHCI_CMD_RS (1 << 0)
42
43 #define UHCI_STS_HCHALTED (1 << 5)
44 #define UHCI_STS_HCPERR (1 << 4)
45 #define UHCI_STS_HSERR (1 << 3)
46 #define UHCI_STS_RD (1 << 2)
47 #define UHCI_STS_USBERR (1 << 1)
48 #define UHCI_STS_USBINT (1 << 0)
49
50 #define TD_CTRL_SPD (1 << 29)
51 #define TD_CTRL_ERROR_SHIFT 27
52 #define TD_CTRL_IOS (1 << 25)
53 #define TD_CTRL_IOC (1 << 24)
54 #define TD_CTRL_ACTIVE (1 << 23)
55 #define TD_CTRL_STALL (1 << 22)
56 #define TD_CTRL_BABBLE (1 << 20)
57 #define TD_CTRL_NAK (1 << 19)
58 #define TD_CTRL_TIMEOUT (1 << 18)
59
60 #define UHCI_PORT_SUSPEND (1 << 12)
61 #define UHCI_PORT_RESET (1 << 9)
62 #define UHCI_PORT_LSDA (1 << 8)
63 #define UHCI_PORT_RD (1 << 6)
64 #define UHCI_PORT_ENC (1 << 3)
65 #define UHCI_PORT_EN (1 << 2)
66 #define UHCI_PORT_CSC (1 << 1)
67 #define UHCI_PORT_CCS (1 << 0)
68
69 #define UHCI_PORT_READ_ONLY (0x1bb)
70 #define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
71
72 #define FRAME_TIMER_FREQ 1000
73
74 #define FRAME_MAX_LOOPS 100
75
76 #define NB_PORTS 2
77
78 #ifdef DEBUG
79 #define DPRINTF printf
80
81 static const char *pid2str(int pid)
82 {
83 switch (pid) {
84 case USB_TOKEN_SETUP: return "SETUP";
85 case USB_TOKEN_IN: return "IN";
86 case USB_TOKEN_OUT: return "OUT";
87 }
88 return "?";
89 }
90
91 #else
92 #define DPRINTF(...)
93 #endif
94
95 #ifdef DEBUG_DUMP_DATA
96 static void dump_data(const uint8_t *data, int len)
97 {
98 int i;
99
100 printf("uhci: data: ");
101 for(i = 0; i < len; i++)
102 printf(" %02x", data[i]);
103 printf("\n");
104 }
105 #else
106 static void dump_data(const uint8_t *data, int len) {}
107 #endif
108
109 typedef struct UHCIState UHCIState;
110
111 /*
112 * Pending async transaction.
113 * 'packet' must be the first field because completion
114 * handler does "(UHCIAsync *) pkt" cast.
115 */
116 typedef struct UHCIAsync {
117 USBPacket packet;
118 UHCIState *uhci;
119 QTAILQ_ENTRY(UHCIAsync) next;
120 uint32_t td;
121 uint32_t token;
122 int8_t valid;
123 uint8_t isoc;
124 uint8_t done;
125 uint8_t buffer[2048];
126 } UHCIAsync;
127
128 typedef struct UHCIPort {
129 USBPort port;
130 uint16_t ctrl;
131 } UHCIPort;
132
133 struct UHCIState {
134 PCIDevice dev;
135 USBBus bus;
136 uint16_t cmd; /* cmd register */
137 uint16_t status;
138 uint16_t intr; /* interrupt enable register */
139 uint16_t frnum; /* frame number */
140 uint32_t fl_base_addr; /* frame list base address */
141 uint8_t sof_timing;
142 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
143 int64_t expire_time;
144 QEMUTimer *frame_timer;
145 UHCIPort ports[NB_PORTS];
146
147 /* Interrupts that should be raised at the end of the current frame. */
148 uint32_t pending_int_mask;
149
150 /* Active packets */
151 QTAILQ_HEAD(,UHCIAsync) async_pending;
152 uint8_t num_ports_vmstate;
153 };
154
155 typedef struct UHCI_TD {
156 uint32_t link;
157 uint32_t ctrl; /* see TD_CTRL_xxx */
158 uint32_t token;
159 uint32_t buffer;
160 } UHCI_TD;
161
162 typedef struct UHCI_QH {
163 uint32_t link;
164 uint32_t el_link;
165 } UHCI_QH;
166
167 static UHCIAsync *uhci_async_alloc(UHCIState *s)
168 {
169 UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
170
171 memset(&async->packet, 0, sizeof(async->packet));
172 async->uhci = s;
173 async->valid = 0;
174 async->td = 0;
175 async->token = 0;
176 async->done = 0;
177 async->isoc = 0;
178
179 return async;
180 }
181
182 static void uhci_async_free(UHCIState *s, UHCIAsync *async)
183 {
184 qemu_free(async);
185 }
186
187 static void uhci_async_link(UHCIState *s, UHCIAsync *async)
188 {
189 QTAILQ_INSERT_HEAD(&s->async_pending, async, next);
190 }
191
192 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
193 {
194 QTAILQ_REMOVE(&s->async_pending, async, next);
195 }
196
197 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
198 {
199 DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
200 async->td, async->token, async->done);
201
202 if (!async->done)
203 usb_cancel_packet(&async->packet);
204 uhci_async_free(s, async);
205 }
206
207 /*
208 * Mark all outstanding async packets as invalid.
209 * This is used for canceling them when TDs are removed by the HCD.
210 */
211 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
212 {
213 UHCIAsync *async;
214
215 QTAILQ_FOREACH(async, &s->async_pending, next) {
216 async->valid--;
217 }
218 return NULL;
219 }
220
221 /*
222 * Cancel async packets that are no longer valid
223 */
224 static void uhci_async_validate_end(UHCIState *s)
225 {
226 UHCIAsync *curr, *n;
227
228 QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
229 if (curr->valid > 0) {
230 continue;
231 }
232 uhci_async_unlink(s, curr);
233 uhci_async_cancel(s, curr);
234 }
235 }
236
237 static void uhci_async_cancel_all(UHCIState *s)
238 {
239 UHCIAsync *curr, *n;
240
241 QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
242 uhci_async_unlink(s, curr);
243 uhci_async_cancel(s, curr);
244 }
245 }
246
247 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
248 {
249 UHCIAsync *async;
250 UHCIAsync *match = NULL;
251 int count = 0;
252
253 /*
254 * We're looking for the best match here. ie both td addr and token.
255 * Otherwise we return last good match. ie just token.
256 * It's ok to match just token because it identifies the transaction
257 * rather well, token includes: device addr, endpoint, size, etc.
258 *
259 * Also since we queue async transactions in reverse order by returning
260 * last good match we restores the order.
261 *
262 * It's expected that we wont have a ton of outstanding transactions.
263 * If we ever do we'd want to optimize this algorithm.
264 */
265
266 QTAILQ_FOREACH(async, &s->async_pending, next) {
267 if (async->token == token) {
268 /* Good match */
269 match = async;
270
271 if (async->td == addr) {
272 /* Best match */
273 break;
274 }
275 }
276 count++;
277 }
278
279 if (count > 64)
280 fprintf(stderr, "uhci: warning lots of async transactions\n");
281
282 return match;
283 }
284
285 static void uhci_update_irq(UHCIState *s)
286 {
287 int level;
288 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
289 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
290 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
291 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
292 (s->status & UHCI_STS_HSERR) ||
293 (s->status & UHCI_STS_HCPERR)) {
294 level = 1;
295 } else {
296 level = 0;
297 }
298 qemu_set_irq(s->dev.irq[3], level);
299 }
300
301 static void uhci_reset(void *opaque)
302 {
303 UHCIState *s = opaque;
304 uint8_t *pci_conf;
305 int i;
306 UHCIPort *port;
307
308 DPRINTF("uhci: full reset\n");
309
310 pci_conf = s->dev.config;
311
312 pci_conf[0x6a] = 0x01; /* usb clock */
313 pci_conf[0x6b] = 0x00;
314 s->cmd = 0;
315 s->status = 0;
316 s->status2 = 0;
317 s->intr = 0;
318 s->fl_base_addr = 0;
319 s->sof_timing = 64;
320
321 for(i = 0; i < NB_PORTS; i++) {
322 port = &s->ports[i];
323 port->ctrl = 0x0080;
324 if (port->port.dev) {
325 usb_attach(&port->port, port->port.dev);
326 }
327 }
328
329 uhci_async_cancel_all(s);
330 }
331
332 static void uhci_pre_save(void *opaque)
333 {
334 UHCIState *s = opaque;
335
336 uhci_async_cancel_all(s);
337 }
338
339 static const VMStateDescription vmstate_uhci_port = {
340 .name = "uhci port",
341 .version_id = 1,
342 .minimum_version_id = 1,
343 .minimum_version_id_old = 1,
344 .fields = (VMStateField []) {
345 VMSTATE_UINT16(ctrl, UHCIPort),
346 VMSTATE_END_OF_LIST()
347 }
348 };
349
350 static const VMStateDescription vmstate_uhci = {
351 .name = "uhci",
352 .version_id = 2,
353 .minimum_version_id = 1,
354 .minimum_version_id_old = 1,
355 .pre_save = uhci_pre_save,
356 .fields = (VMStateField []) {
357 VMSTATE_PCI_DEVICE(dev, UHCIState),
358 VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
359 VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
360 vmstate_uhci_port, UHCIPort),
361 VMSTATE_UINT16(cmd, UHCIState),
362 VMSTATE_UINT16(status, UHCIState),
363 VMSTATE_UINT16(intr, UHCIState),
364 VMSTATE_UINT16(frnum, UHCIState),
365 VMSTATE_UINT32(fl_base_addr, UHCIState),
366 VMSTATE_UINT8(sof_timing, UHCIState),
367 VMSTATE_UINT8(status2, UHCIState),
368 VMSTATE_TIMER(frame_timer, UHCIState),
369 VMSTATE_INT64_V(expire_time, UHCIState, 2),
370 VMSTATE_END_OF_LIST()
371 }
372 };
373
374 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
375 {
376 UHCIState *s = opaque;
377
378 addr &= 0x1f;
379 switch(addr) {
380 case 0x0c:
381 s->sof_timing = val;
382 break;
383 }
384 }
385
386 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
387 {
388 UHCIState *s = opaque;
389 uint32_t val;
390
391 addr &= 0x1f;
392 switch(addr) {
393 case 0x0c:
394 val = s->sof_timing;
395 break;
396 default:
397 val = 0xff;
398 break;
399 }
400 return val;
401 }
402
403 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
404 {
405 UHCIState *s = opaque;
406
407 addr &= 0x1f;
408 DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
409
410 switch(addr) {
411 case 0x00:
412 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
413 /* start frame processing */
414 qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
415 s->status &= ~UHCI_STS_HCHALTED;
416 } else if (!(val & UHCI_CMD_RS)) {
417 s->status |= UHCI_STS_HCHALTED;
418 }
419 if (val & UHCI_CMD_GRESET) {
420 UHCIPort *port;
421 USBDevice *dev;
422 int i;
423
424 /* send reset on the USB bus */
425 for(i = 0; i < NB_PORTS; i++) {
426 port = &s->ports[i];
427 dev = port->port.dev;
428 if (dev) {
429 usb_send_msg(dev, USB_MSG_RESET);
430 }
431 }
432 uhci_reset(s);
433 return;
434 }
435 if (val & UHCI_CMD_HCRESET) {
436 uhci_reset(s);
437 return;
438 }
439 s->cmd = val;
440 break;
441 case 0x02:
442 s->status &= ~val;
443 /* XXX: the chip spec is not coherent, so we add a hidden
444 register to distinguish between IOC and SPD */
445 if (val & UHCI_STS_USBINT)
446 s->status2 = 0;
447 uhci_update_irq(s);
448 break;
449 case 0x04:
450 s->intr = val;
451 uhci_update_irq(s);
452 break;
453 case 0x06:
454 if (s->status & UHCI_STS_HCHALTED)
455 s->frnum = val & 0x7ff;
456 break;
457 case 0x10 ... 0x1f:
458 {
459 UHCIPort *port;
460 USBDevice *dev;
461 int n;
462
463 n = (addr >> 1) & 7;
464 if (n >= NB_PORTS)
465 return;
466 port = &s->ports[n];
467 dev = port->port.dev;
468 if (dev) {
469 /* port reset */
470 if ( (val & UHCI_PORT_RESET) &&
471 !(port->ctrl & UHCI_PORT_RESET) ) {
472 usb_send_msg(dev, USB_MSG_RESET);
473 }
474 }
475 port->ctrl &= UHCI_PORT_READ_ONLY;
476 port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
477 /* some bits are reset when a '1' is written to them */
478 port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
479 }
480 break;
481 }
482 }
483
484 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
485 {
486 UHCIState *s = opaque;
487 uint32_t val;
488
489 addr &= 0x1f;
490 switch(addr) {
491 case 0x00:
492 val = s->cmd;
493 break;
494 case 0x02:
495 val = s->status;
496 break;
497 case 0x04:
498 val = s->intr;
499 break;
500 case 0x06:
501 val = s->frnum;
502 break;
503 case 0x10 ... 0x1f:
504 {
505 UHCIPort *port;
506 int n;
507 n = (addr >> 1) & 7;
508 if (n >= NB_PORTS)
509 goto read_default;
510 port = &s->ports[n];
511 val = port->ctrl;
512 }
513 break;
514 default:
515 read_default:
516 val = 0xff7f; /* disabled port */
517 break;
518 }
519
520 DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
521
522 return val;
523 }
524
525 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
526 {
527 UHCIState *s = opaque;
528
529 addr &= 0x1f;
530 DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
531
532 switch(addr) {
533 case 0x08:
534 s->fl_base_addr = val & ~0xfff;
535 break;
536 }
537 }
538
539 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
540 {
541 UHCIState *s = opaque;
542 uint32_t val;
543
544 addr &= 0x1f;
545 switch(addr) {
546 case 0x08:
547 val = s->fl_base_addr;
548 break;
549 default:
550 val = 0xffffffff;
551 break;
552 }
553 return val;
554 }
555
556 /* signal resume if controller suspended */
557 static void uhci_resume (void *opaque)
558 {
559 UHCIState *s = (UHCIState *)opaque;
560
561 if (!s)
562 return;
563
564 if (s->cmd & UHCI_CMD_EGSM) {
565 s->cmd |= UHCI_CMD_FGR;
566 s->status |= UHCI_STS_RD;
567 uhci_update_irq(s);
568 }
569 }
570
571 static void uhci_attach(USBPort *port1)
572 {
573 UHCIState *s = port1->opaque;
574 UHCIPort *port = &s->ports[port1->index];
575
576 /* set connect status */
577 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
578
579 /* update speed */
580 if (port->port.dev->speed == USB_SPEED_LOW) {
581 port->ctrl |= UHCI_PORT_LSDA;
582 } else {
583 port->ctrl &= ~UHCI_PORT_LSDA;
584 }
585
586 uhci_resume(s);
587 }
588
589 static void uhci_detach(USBPort *port1)
590 {
591 UHCIState *s = port1->opaque;
592 UHCIPort *port = &s->ports[port1->index];
593
594 /* set connect status */
595 if (port->ctrl & UHCI_PORT_CCS) {
596 port->ctrl &= ~UHCI_PORT_CCS;
597 port->ctrl |= UHCI_PORT_CSC;
598 }
599 /* disable port */
600 if (port->ctrl & UHCI_PORT_EN) {
601 port->ctrl &= ~UHCI_PORT_EN;
602 port->ctrl |= UHCI_PORT_ENC;
603 }
604
605 uhci_resume(s);
606 }
607
608 static void uhci_wakeup(USBDevice *dev)
609 {
610 USBBus *bus = usb_bus_from_device(dev);
611 UHCIState *s = container_of(bus, UHCIState, bus);
612 UHCIPort *port = s->ports + dev->port->index;
613
614 if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
615 port->ctrl |= UHCI_PORT_RD;
616 uhci_resume(s);
617 }
618 }
619
620 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
621 {
622 int i, ret;
623
624 DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
625 pid2str(p->pid), p->devaddr, p->devep, p->len);
626 if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
627 dump_data(p->data, p->len);
628
629 ret = USB_RET_NODEV;
630 for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
631 UHCIPort *port = &s->ports[i];
632 USBDevice *dev = port->port.dev;
633
634 if (dev && (port->ctrl & UHCI_PORT_EN))
635 ret = dev->info->handle_packet(dev, p);
636 }
637
638 DPRINTF("uhci: packet exit. ret %d len %d\n", ret, p->len);
639 if (p->pid == USB_TOKEN_IN && ret > 0)
640 dump_data(p->data, ret);
641
642 return ret;
643 }
644
645 static void uhci_async_complete(USBDevice *dev, USBPacket *packet);
646 static void uhci_process_frame(UHCIState *s);
647
648 /* return -1 if fatal error (frame must be stopped)
649 0 if TD successful
650 1 if TD unsuccessful or inactive
651 */
652 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
653 {
654 int len = 0, max_len, err, ret;
655 uint8_t pid;
656
657 max_len = ((td->token >> 21) + 1) & 0x7ff;
658 pid = td->token & 0xff;
659
660 ret = async->packet.len;
661
662 if (td->ctrl & TD_CTRL_IOS)
663 td->ctrl &= ~TD_CTRL_ACTIVE;
664
665 if (ret < 0)
666 goto out;
667
668 len = async->packet.len;
669 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
670
671 /* The NAK bit may have been set by a previous frame, so clear it
672 here. The docs are somewhat unclear, but win2k relies on this
673 behavior. */
674 td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
675 if (td->ctrl & TD_CTRL_IOC)
676 *int_mask |= 0x01;
677
678 if (pid == USB_TOKEN_IN) {
679 if (len > max_len) {
680 ret = USB_RET_BABBLE;
681 goto out;
682 }
683
684 if (len > 0) {
685 /* write the data back */
686 cpu_physical_memory_write(td->buffer, async->buffer, len);
687 }
688
689 if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
690 *int_mask |= 0x02;
691 /* short packet: do not update QH */
692 DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
693 return 1;
694 }
695 }
696
697 /* success */
698 return 0;
699
700 out:
701 switch(ret) {
702 case USB_RET_STALL:
703 td->ctrl |= TD_CTRL_STALL;
704 td->ctrl &= ~TD_CTRL_ACTIVE;
705 return 1;
706
707 case USB_RET_BABBLE:
708 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
709 td->ctrl &= ~TD_CTRL_ACTIVE;
710 /* frame interrupted */
711 return -1;
712
713 case USB_RET_NAK:
714 td->ctrl |= TD_CTRL_NAK;
715 if (pid == USB_TOKEN_SETUP)
716 break;
717 return 1;
718
719 case USB_RET_NODEV:
720 default:
721 break;
722 }
723
724 /* Retry the TD if error count is not zero */
725
726 td->ctrl |= TD_CTRL_TIMEOUT;
727 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
728 if (err != 0) {
729 err--;
730 if (err == 0) {
731 td->ctrl &= ~TD_CTRL_ACTIVE;
732 s->status |= UHCI_STS_USBERR;
733 if (td->ctrl & TD_CTRL_IOC)
734 *int_mask |= 0x01;
735 uhci_update_irq(s);
736 }
737 }
738 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
739 (err << TD_CTRL_ERROR_SHIFT);
740 return 1;
741 }
742
743 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
744 {
745 UHCIAsync *async;
746 int len = 0, max_len;
747 uint8_t pid, isoc;
748 uint32_t token;
749
750 /* Is active ? */
751 if (!(td->ctrl & TD_CTRL_ACTIVE))
752 return 1;
753
754 /* token field is not unique for isochronous requests,
755 * so use the destination buffer
756 */
757 if (td->ctrl & TD_CTRL_IOS) {
758 token = td->buffer;
759 isoc = 1;
760 } else {
761 token = td->token;
762 isoc = 0;
763 }
764
765 async = uhci_async_find_td(s, addr, token);
766 if (async) {
767 /* Already submitted */
768 async->valid = 32;
769
770 if (!async->done)
771 return 1;
772
773 uhci_async_unlink(s, async);
774 goto done;
775 }
776
777 /* Allocate new packet */
778 async = uhci_async_alloc(s);
779 if (!async)
780 return 1;
781
782 /* valid needs to be large enough to handle 10 frame delay
783 * for initial isochronous requests
784 */
785 async->valid = 32;
786 async->td = addr;
787 async->token = token;
788 async->isoc = isoc;
789
790 max_len = ((td->token >> 21) + 1) & 0x7ff;
791 pid = td->token & 0xff;
792
793 async->packet.pid = pid;
794 async->packet.devaddr = (td->token >> 8) & 0x7f;
795 async->packet.devep = (td->token >> 15) & 0xf;
796 async->packet.data = async->buffer;
797 async->packet.len = max_len;
798
799 switch(pid) {
800 case USB_TOKEN_OUT:
801 case USB_TOKEN_SETUP:
802 cpu_physical_memory_read(td->buffer, async->buffer, max_len);
803 len = uhci_broadcast_packet(s, &async->packet);
804 if (len >= 0)
805 len = max_len;
806 break;
807
808 case USB_TOKEN_IN:
809 len = uhci_broadcast_packet(s, &async->packet);
810 break;
811
812 default:
813 /* invalid pid : frame interrupted */
814 uhci_async_free(s, async);
815 s->status |= UHCI_STS_HCPERR;
816 uhci_update_irq(s);
817 return -1;
818 }
819
820 if (len == USB_RET_ASYNC) {
821 uhci_async_link(s, async);
822 return 2;
823 }
824
825 async->packet.len = len;
826
827 done:
828 len = uhci_complete_td(s, td, async, int_mask);
829 uhci_async_free(s, async);
830 return len;
831 }
832
833 static void uhci_async_complete(USBDevice *dev, USBPacket *packet)
834 {
835 UHCIAsync *async = container_of(packet, UHCIAsync, packet);
836 UHCIState *s = async->uhci;
837
838 DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
839
840 if (async->isoc) {
841 UHCI_TD td;
842 uint32_t link = async->td;
843 uint32_t int_mask = 0, val;
844
845 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
846 le32_to_cpus(&td.link);
847 le32_to_cpus(&td.ctrl);
848 le32_to_cpus(&td.token);
849 le32_to_cpus(&td.buffer);
850
851 uhci_async_unlink(s, async);
852 uhci_complete_td(s, &td, async, &int_mask);
853 s->pending_int_mask |= int_mask;
854
855 /* update the status bits of the TD */
856 val = cpu_to_le32(td.ctrl);
857 cpu_physical_memory_write((link & ~0xf) + 4,
858 (const uint8_t *)&val, sizeof(val));
859 uhci_async_free(s, async);
860 } else {
861 async->done = 1;
862 uhci_process_frame(s);
863 }
864 }
865
866 static int is_valid(uint32_t link)
867 {
868 return (link & 1) == 0;
869 }
870
871 static int is_qh(uint32_t link)
872 {
873 return (link & 2) != 0;
874 }
875
876 static int depth_first(uint32_t link)
877 {
878 return (link & 4) != 0;
879 }
880
881 /* QH DB used for detecting QH loops */
882 #define UHCI_MAX_QUEUES 128
883 typedef struct {
884 uint32_t addr[UHCI_MAX_QUEUES];
885 int count;
886 } QhDb;
887
888 static void qhdb_reset(QhDb *db)
889 {
890 db->count = 0;
891 }
892
893 /* Add QH to DB. Returns 1 if already present or DB is full. */
894 static int qhdb_insert(QhDb *db, uint32_t addr)
895 {
896 int i;
897 for (i = 0; i < db->count; i++)
898 if (db->addr[i] == addr)
899 return 1;
900
901 if (db->count >= UHCI_MAX_QUEUES)
902 return 1;
903
904 db->addr[db->count++] = addr;
905 return 0;
906 }
907
908 static void uhci_process_frame(UHCIState *s)
909 {
910 uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
911 uint32_t curr_qh;
912 int cnt, ret;
913 UHCI_TD td;
914 UHCI_QH qh;
915 QhDb qhdb;
916
917 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
918
919 DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
920
921 cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
922 le32_to_cpus(&link);
923
924 int_mask = 0;
925 curr_qh = 0;
926
927 qhdb_reset(&qhdb);
928
929 for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
930 if (is_qh(link)) {
931 /* QH */
932
933 if (qhdb_insert(&qhdb, link)) {
934 /*
935 * We're going in circles. Which is not a bug because
936 * HCD is allowed to do that as part of the BW management.
937 * In our case though it makes no sense to spin here. Sync transations
938 * are already done, and async completion handler will re-process
939 * the frame when something is ready.
940 */
941 DPRINTF("uhci: detected loop. qh 0x%x\n", link);
942 break;
943 }
944
945 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
946 le32_to_cpus(&qh.link);
947 le32_to_cpus(&qh.el_link);
948
949 DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
950 link, qh.link, qh.el_link);
951
952 if (!is_valid(qh.el_link)) {
953 /* QH w/o elements */
954 curr_qh = 0;
955 link = qh.link;
956 } else {
957 /* QH with elements */
958 curr_qh = link;
959 link = qh.el_link;
960 }
961 continue;
962 }
963
964 /* TD */
965 cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
966 le32_to_cpus(&td.link);
967 le32_to_cpus(&td.ctrl);
968 le32_to_cpus(&td.token);
969 le32_to_cpus(&td.buffer);
970
971 DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
972 link, td.link, td.ctrl, td.token, curr_qh);
973
974 old_td_ctrl = td.ctrl;
975 ret = uhci_handle_td(s, link, &td, &int_mask);
976 if (old_td_ctrl != td.ctrl) {
977 /* update the status bits of the TD */
978 val = cpu_to_le32(td.ctrl);
979 cpu_physical_memory_write((link & ~0xf) + 4,
980 (const uint8_t *)&val, sizeof(val));
981 }
982
983 if (ret < 0) {
984 /* interrupted frame */
985 break;
986 }
987
988 if (ret == 2 || ret == 1) {
989 DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
990 link, ret == 2 ? "pend" : "skip",
991 td.link, td.ctrl, td.token, curr_qh);
992
993 link = curr_qh ? qh.link : td.link;
994 continue;
995 }
996
997 /* completed TD */
998
999 DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1000 link, td.link, td.ctrl, td.token, curr_qh);
1001
1002 link = td.link;
1003
1004 if (curr_qh) {
1005 /* update QH element link */
1006 qh.el_link = link;
1007 val = cpu_to_le32(qh.el_link);
1008 cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1009 (const uint8_t *)&val, sizeof(val));
1010
1011 if (!depth_first(link)) {
1012 /* done with this QH */
1013
1014 DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1015 curr_qh, qh.link, qh.el_link);
1016
1017 curr_qh = 0;
1018 link = qh.link;
1019 }
1020 }
1021
1022 /* go to the next entry */
1023 }
1024
1025 s->pending_int_mask |= int_mask;
1026 }
1027
1028 static void uhci_frame_timer(void *opaque)
1029 {
1030 UHCIState *s = opaque;
1031
1032 /* prepare the timer for the next frame */
1033 s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1034
1035 if (!(s->cmd & UHCI_CMD_RS)) {
1036 /* Full stop */
1037 qemu_del_timer(s->frame_timer);
1038 /* set hchalted bit in status - UHCI11D 2.1.2 */
1039 s->status |= UHCI_STS_HCHALTED;
1040
1041 DPRINTF("uhci: halted\n");
1042 return;
1043 }
1044
1045 /* Complete the previous frame */
1046 if (s->pending_int_mask) {
1047 s->status2 |= s->pending_int_mask;
1048 s->status |= UHCI_STS_USBINT;
1049 uhci_update_irq(s);
1050 }
1051 s->pending_int_mask = 0;
1052
1053 /* Start new frame */
1054 s->frnum = (s->frnum + 1) & 0x7ff;
1055
1056 DPRINTF("uhci: new frame #%u\n" , s->frnum);
1057
1058 uhci_async_validate_begin(s);
1059
1060 uhci_process_frame(s);
1061
1062 uhci_async_validate_end(s);
1063
1064 qemu_mod_timer(s->frame_timer, s->expire_time);
1065 }
1066
1067 static void uhci_map(PCIDevice *pci_dev, int region_num,
1068 pcibus_t addr, pcibus_t size, int type)
1069 {
1070 UHCIState *s = (UHCIState *)pci_dev;
1071
1072 register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1073 register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1074 register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1075 register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1076 register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1077 register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1078 }
1079
1080 static USBPortOps uhci_port_ops = {
1081 .attach = uhci_attach,
1082 .detach = uhci_detach,
1083 .wakeup = uhci_wakeup,
1084 .complete = uhci_async_complete,
1085 };
1086
1087 static int usb_uhci_common_initfn(UHCIState *s)
1088 {
1089 uint8_t *pci_conf = s->dev.config;
1090 int i;
1091
1092 pci_conf[PCI_REVISION_ID] = 0x01; // revision number
1093 pci_conf[PCI_CLASS_PROG] = 0x00;
1094 pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1095 /* TODO: reset value should be 0. */
1096 pci_conf[PCI_INTERRUPT_PIN] = 4; // interrupt pin 3
1097 pci_conf[0x60] = 0x10; // release number
1098
1099 usb_bus_new(&s->bus, &s->dev.qdev);
1100 for(i = 0; i < NB_PORTS; i++) {
1101 usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1102 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1103 usb_port_location(&s->ports[i].port, NULL, i+1);
1104 }
1105 s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1106 s->expire_time = qemu_get_clock_ns(vm_clock) +
1107 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1108 s->num_ports_vmstate = NB_PORTS;
1109 QTAILQ_INIT(&s->async_pending);
1110
1111 qemu_register_reset(uhci_reset, s);
1112
1113 /* Use region 4 for consistency with real hardware. BSD guests seem
1114 to rely on this. */
1115 pci_register_bar(&s->dev, 4, 0x20,
1116 PCI_BASE_ADDRESS_SPACE_IO, uhci_map);
1117
1118 return 0;
1119 }
1120
1121 static int usb_uhci_piix3_initfn(PCIDevice *dev)
1122 {
1123 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1124 uint8_t *pci_conf = s->dev.config;
1125
1126 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1127 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
1128 return usb_uhci_common_initfn(s);
1129 }
1130
1131 static int usb_uhci_piix4_initfn(PCIDevice *dev)
1132 {
1133 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1134 uint8_t *pci_conf = s->dev.config;
1135
1136 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1137 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
1138 return usb_uhci_common_initfn(s);
1139 }
1140
1141 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1142 {
1143 UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1144 uint8_t *pci_conf = s->dev.config;
1145
1146 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_VIA);
1147 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_VIA_UHCI);
1148
1149 /* USB misc control 1/2 */
1150 pci_set_long(pci_conf + 0x40,0x00001000);
1151 /* PM capability */
1152 pci_set_long(pci_conf + 0x80,0x00020001);
1153 /* USB legacy support */
1154 pci_set_long(pci_conf + 0xc0,0x00002000);
1155
1156 return usb_uhci_common_initfn(s);
1157 }
1158
1159 static PCIDeviceInfo uhci_info[] = {
1160 {
1161 .qdev.name = "piix3-usb-uhci",
1162 .qdev.size = sizeof(UHCIState),
1163 .qdev.vmsd = &vmstate_uhci,
1164 .init = usb_uhci_piix3_initfn,
1165 },{
1166 .qdev.name = "piix4-usb-uhci",
1167 .qdev.size = sizeof(UHCIState),
1168 .qdev.vmsd = &vmstate_uhci,
1169 .init = usb_uhci_piix4_initfn,
1170 },{
1171 .qdev.name = "vt82c686b-usb-uhci",
1172 .qdev.size = sizeof(UHCIState),
1173 .qdev.vmsd = &vmstate_uhci,
1174 .init = usb_uhci_vt82c686b_initfn,
1175 },{
1176 /* end of list */
1177 }
1178 };
1179
1180 static void uhci_register(void)
1181 {
1182 pci_qdev_register_many(uhci_info);
1183 }
1184 device_init(uhci_register);
1185
1186 void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1187 {
1188 pci_create_simple(bus, devfn, "piix3-usb-uhci");
1189 }
1190
1191 void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1192 {
1193 pci_create_simple(bus, devfn, "piix4-usb-uhci");
1194 }
1195
1196 void usb_uhci_vt82c686b_init(PCIBus *bus, int devfn)
1197 {
1198 pci_create_simple(bus, devfn, "vt82c686b-usb-uhci");
1199 }