2
* USB UHCI controller emulation
4
* Copyright (c) 2005 Fabrice Bellard
6
* Copyright (c) 2008 Max Krasnyansky
7
* Magor rewrite of the UHCI data structures parser and frame processor
8
* Support for fully async operation and multiple outstanding transactions
10
* Permission is hereby granted, free of charge, to any person obtaining a copy
11
* of this software and associated documentation files (the "Software"), to deal
12
* in the Software without restriction, including without limitation the rights
13
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
* copies of the Software, and to permit persons to whom the Software is
15
* furnished to do so, subject to the following conditions:
17
* The above copyright notice and this permission notice shall be included in
18
* all copies or substantial portions of the Software.
20
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
31
#include "qemu-timer.h"
35
//#define DEBUG_DUMP_DATA
37
#define UHCI_CMD_FGR (1 << 4)
38
#define UHCI_CMD_EGSM (1 << 3)
39
#define UHCI_CMD_GRESET (1 << 2)
40
#define UHCI_CMD_HCRESET (1 << 1)
41
#define UHCI_CMD_RS (1 << 0)
43
#define UHCI_STS_HCHALTED (1 << 5)
44
#define UHCI_STS_HCPERR (1 << 4)
45
#define UHCI_STS_HSERR (1 << 3)
46
#define UHCI_STS_RD (1 << 2)
47
#define UHCI_STS_USBERR (1 << 1)
48
#define UHCI_STS_USBINT (1 << 0)
50
#define TD_CTRL_SPD (1 << 29)
51
#define TD_CTRL_ERROR_SHIFT 27
52
#define TD_CTRL_IOS (1 << 25)
53
#define TD_CTRL_IOC (1 << 24)
54
#define TD_CTRL_ACTIVE (1 << 23)
55
#define TD_CTRL_STALL (1 << 22)
56
#define TD_CTRL_BABBLE (1 << 20)
57
#define TD_CTRL_NAK (1 << 19)
58
#define TD_CTRL_TIMEOUT (1 << 18)
60
#define UHCI_PORT_SUSPEND (1 << 12)
61
#define UHCI_PORT_RESET (1 << 9)
62
#define UHCI_PORT_LSDA (1 << 8)
63
#define UHCI_PORT_RD (1 << 6)
64
#define UHCI_PORT_ENC (1 << 3)
65
#define UHCI_PORT_EN (1 << 2)
66
#define UHCI_PORT_CSC (1 << 1)
67
#define UHCI_PORT_CCS (1 << 0)
69
#define UHCI_PORT_READ_ONLY (0x1bb)
70
#define UHCI_PORT_WRITE_CLEAR (UHCI_PORT_CSC | UHCI_PORT_ENC)
72
#define FRAME_TIMER_FREQ 1000
74
#define FRAME_MAX_LOOPS 100
79
#define DPRINTF printf
81
static const char *pid2str(int pid)
84
case USB_TOKEN_SETUP: return "SETUP";
85
case USB_TOKEN_IN: return "IN";
86
case USB_TOKEN_OUT: return "OUT";
95
#ifdef DEBUG_DUMP_DATA
96
static void dump_data(const uint8_t *data, int len)
100
printf("uhci: data: ");
101
for(i = 0; i < len; i++)
102
printf(" %02x", data[i]);
106
static void dump_data(const uint8_t *data, int len) {}
109
typedef struct UHCIState UHCIState;
112
* Pending async transaction.
113
* 'packet' must be the first field because completion
114
* handler does "(UHCIAsync *) pkt" cast.
116
typedef struct UHCIAsync {
119
QTAILQ_ENTRY(UHCIAsync) next;
125
uint8_t buffer[2048];
128
typedef struct UHCIPort {
135
USBBus bus; /* Note unused when we're a companion controller */
136
uint16_t cmd; /* cmd register */
138
uint16_t intr; /* interrupt enable register */
139
uint16_t frnum; /* frame number */
140
uint32_t fl_base_addr; /* frame list base address */
142
uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
144
QEMUTimer *frame_timer;
145
UHCIPort ports[NB_PORTS];
147
/* Interrupts that should be raised at the end of the current frame. */
148
uint32_t pending_int_mask;
151
QTAILQ_HEAD(,UHCIAsync) async_pending;
152
uint8_t num_ports_vmstate;
159
typedef struct UHCI_TD {
161
uint32_t ctrl; /* see TD_CTRL_xxx */
166
typedef struct UHCI_QH {
171
static UHCIAsync *uhci_async_alloc(UHCIState *s)
173
UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
175
memset(&async->packet, 0, sizeof(async->packet));
186
static void uhci_async_free(UHCIState *s, UHCIAsync *async)
191
static void uhci_async_link(UHCIState *s, UHCIAsync *async)
193
QTAILQ_INSERT_HEAD(&s->async_pending, async, next);
196
static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
198
QTAILQ_REMOVE(&s->async_pending, async, next);
201
static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
203
DPRINTF("uhci: cancel td 0x%x token 0x%x done %u\n",
204
async->td, async->token, async->done);
207
usb_cancel_packet(&async->packet);
208
uhci_async_free(s, async);
212
* Mark all outstanding async packets as invalid.
213
* This is used for canceling them when TDs are removed by the HCD.
215
static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
219
QTAILQ_FOREACH(async, &s->async_pending, next) {
226
* Cancel async packets that are no longer valid
228
static void uhci_async_validate_end(UHCIState *s)
232
QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
233
if (curr->valid > 0) {
236
uhci_async_unlink(s, curr);
237
uhci_async_cancel(s, curr);
241
static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
245
QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
246
if (curr->packet.owner != dev) {
249
uhci_async_unlink(s, curr);
250
uhci_async_cancel(s, curr);
254
static void uhci_async_cancel_all(UHCIState *s)
258
QTAILQ_FOREACH_SAFE(curr, &s->async_pending, next, n) {
259
uhci_async_unlink(s, curr);
260
uhci_async_cancel(s, curr);
264
static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
267
UHCIAsync *match = NULL;
271
* We're looking for the best match here. ie both td addr and token.
272
* Otherwise we return last good match. ie just token.
273
* It's ok to match just token because it identifies the transaction
274
* rather well, token includes: device addr, endpoint, size, etc.
276
* Also since we queue async transactions in reverse order by returning
277
* last good match we restores the order.
279
* It's expected that we wont have a ton of outstanding transactions.
280
* If we ever do we'd want to optimize this algorithm.
283
QTAILQ_FOREACH(async, &s->async_pending, next) {
284
if (async->token == token) {
288
if (async->td == addr) {
297
fprintf(stderr, "uhci: warning lots of async transactions\n");
302
static void uhci_update_irq(UHCIState *s)
305
if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
306
((s->status2 & 2) && (s->intr & (1 << 3))) ||
307
((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
308
((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
309
(s->status & UHCI_STS_HSERR) ||
310
(s->status & UHCI_STS_HCPERR)) {
315
qemu_set_irq(s->dev.irq[3], level);
318
static void uhci_reset(void *opaque)
320
UHCIState *s = opaque;
325
DPRINTF("uhci: full reset\n");
327
pci_conf = s->dev.config;
329
pci_conf[0x6a] = 0x01; /* usb clock */
330
pci_conf[0x6b] = 0x00;
338
for(i = 0; i < NB_PORTS; i++) {
341
if (port->port.dev) {
342
usb_attach(&port->port, port->port.dev);
346
uhci_async_cancel_all(s);
349
static void uhci_pre_save(void *opaque)
351
UHCIState *s = opaque;
353
uhci_async_cancel_all(s);
356
static const VMStateDescription vmstate_uhci_port = {
359
.minimum_version_id = 1,
360
.minimum_version_id_old = 1,
361
.fields = (VMStateField []) {
362
VMSTATE_UINT16(ctrl, UHCIPort),
363
VMSTATE_END_OF_LIST()
367
static const VMStateDescription vmstate_uhci = {
370
.minimum_version_id = 1,
371
.minimum_version_id_old = 1,
372
.pre_save = uhci_pre_save,
373
.fields = (VMStateField []) {
374
VMSTATE_PCI_DEVICE(dev, UHCIState),
375
VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
376
VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
377
vmstate_uhci_port, UHCIPort),
378
VMSTATE_UINT16(cmd, UHCIState),
379
VMSTATE_UINT16(status, UHCIState),
380
VMSTATE_UINT16(intr, UHCIState),
381
VMSTATE_UINT16(frnum, UHCIState),
382
VMSTATE_UINT32(fl_base_addr, UHCIState),
383
VMSTATE_UINT8(sof_timing, UHCIState),
384
VMSTATE_UINT8(status2, UHCIState),
385
VMSTATE_TIMER(frame_timer, UHCIState),
386
VMSTATE_INT64_V(expire_time, UHCIState, 2),
387
VMSTATE_END_OF_LIST()
391
static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
393
UHCIState *s = opaque;
403
static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
405
UHCIState *s = opaque;
420
static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
422
UHCIState *s = opaque;
425
DPRINTF("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
429
if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
430
/* start frame processing */
431
s->expire_time = qemu_get_clock_ns(vm_clock) +
432
(get_ticks_per_sec() / FRAME_TIMER_FREQ);
433
qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
434
s->status &= ~UHCI_STS_HCHALTED;
435
} else if (!(val & UHCI_CMD_RS)) {
436
s->status |= UHCI_STS_HCHALTED;
438
if (val & UHCI_CMD_GRESET) {
443
/* send reset on the USB bus */
444
for(i = 0; i < NB_PORTS; i++) {
446
dev = port->port.dev;
448
usb_send_msg(dev, USB_MSG_RESET);
454
if (val & UHCI_CMD_HCRESET) {
462
/* XXX: the chip spec is not coherent, so we add a hidden
463
register to distinguish between IOC and SPD */
464
if (val & UHCI_STS_USBINT)
473
if (s->status & UHCI_STS_HCHALTED)
474
s->frnum = val & 0x7ff;
486
dev = port->port.dev;
489
if ( (val & UHCI_PORT_RESET) &&
490
!(port->ctrl & UHCI_PORT_RESET) ) {
491
usb_send_msg(dev, USB_MSG_RESET);
494
port->ctrl &= UHCI_PORT_READ_ONLY;
495
port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
496
/* some bits are reset when a '1' is written to them */
497
port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
503
static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
505
UHCIState *s = opaque;
535
val = 0xff7f; /* disabled port */
539
DPRINTF("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
544
static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
546
UHCIState *s = opaque;
549
DPRINTF("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
553
s->fl_base_addr = val & ~0xfff;
558
static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
560
UHCIState *s = opaque;
566
val = s->fl_base_addr;
575
/* signal resume if controller suspended */
576
static void uhci_resume (void *opaque)
578
UHCIState *s = (UHCIState *)opaque;
583
if (s->cmd & UHCI_CMD_EGSM) {
584
s->cmd |= UHCI_CMD_FGR;
585
s->status |= UHCI_STS_RD;
590
static void uhci_attach(USBPort *port1)
592
UHCIState *s = port1->opaque;
593
UHCIPort *port = &s->ports[port1->index];
595
/* set connect status */
596
port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
599
if (port->port.dev->speed == USB_SPEED_LOW) {
600
port->ctrl |= UHCI_PORT_LSDA;
602
port->ctrl &= ~UHCI_PORT_LSDA;
608
static void uhci_detach(USBPort *port1)
610
UHCIState *s = port1->opaque;
611
UHCIPort *port = &s->ports[port1->index];
613
uhci_async_cancel_device(s, port1->dev);
615
/* set connect status */
616
if (port->ctrl & UHCI_PORT_CCS) {
617
port->ctrl &= ~UHCI_PORT_CCS;
618
port->ctrl |= UHCI_PORT_CSC;
621
if (port->ctrl & UHCI_PORT_EN) {
622
port->ctrl &= ~UHCI_PORT_EN;
623
port->ctrl |= UHCI_PORT_ENC;
629
static void uhci_child_detach(USBPort *port1, USBDevice *child)
631
UHCIState *s = port1->opaque;
633
uhci_async_cancel_device(s, child);
636
static void uhci_wakeup(USBPort *port1)
638
UHCIState *s = port1->opaque;
639
UHCIPort *port = &s->ports[port1->index];
641
if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
642
port->ctrl |= UHCI_PORT_RD;
647
static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
651
DPRINTF("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
652
pid2str(p->pid), p->devaddr, p->devep, p->len);
653
if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
654
dump_data(p->data, p->len);
657
for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
658
UHCIPort *port = &s->ports[i];
659
USBDevice *dev = port->port.dev;
661
if (dev && (port->ctrl & UHCI_PORT_EN))
662
ret = usb_handle_packet(dev, p);
665
DPRINTF("uhci: packet exit. ret %d len %d\n", ret, p->len);
666
if (p->pid == USB_TOKEN_IN && ret > 0)
667
dump_data(p->data, ret);
672
static void uhci_async_complete(USBPort *port, USBPacket *packet);
673
static void uhci_process_frame(UHCIState *s);
675
/* return -1 if fatal error (frame must be stopped)
677
1 if TD unsuccessful or inactive
679
static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
681
int len = 0, max_len, err, ret;
684
max_len = ((td->token >> 21) + 1) & 0x7ff;
685
pid = td->token & 0xff;
687
ret = async->packet.len;
689
if (td->ctrl & TD_CTRL_IOS)
690
td->ctrl &= ~TD_CTRL_ACTIVE;
695
len = async->packet.len;
696
td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
698
/* The NAK bit may have been set by a previous frame, so clear it
699
here. The docs are somewhat unclear, but win2k relies on this
701
td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
702
if (td->ctrl & TD_CTRL_IOC)
705
if (pid == USB_TOKEN_IN) {
707
ret = USB_RET_BABBLE;
712
/* write the data back */
713
cpu_physical_memory_write(td->buffer, async->buffer, len);
716
if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
718
/* short packet: do not update QH */
719
DPRINTF("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
730
td->ctrl |= TD_CTRL_STALL;
731
td->ctrl &= ~TD_CTRL_ACTIVE;
732
s->status |= UHCI_STS_USBERR;
733
if (td->ctrl & TD_CTRL_IOC) {
740
td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
741
td->ctrl &= ~TD_CTRL_ACTIVE;
742
s->status |= UHCI_STS_USBERR;
743
if (td->ctrl & TD_CTRL_IOC) {
747
/* frame interrupted */
751
td->ctrl |= TD_CTRL_NAK;
752
if (pid == USB_TOKEN_SETUP)
761
/* Retry the TD if error count is not zero */
763
td->ctrl |= TD_CTRL_TIMEOUT;
764
err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
768
td->ctrl &= ~TD_CTRL_ACTIVE;
769
s->status |= UHCI_STS_USBERR;
770
if (td->ctrl & TD_CTRL_IOC)
775
td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
776
(err << TD_CTRL_ERROR_SHIFT);
780
static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
783
int len = 0, max_len;
788
if (!(td->ctrl & TD_CTRL_ACTIVE))
791
/* token field is not unique for isochronous requests,
792
* so use the destination buffer
794
if (td->ctrl & TD_CTRL_IOS) {
802
async = uhci_async_find_td(s, addr, token);
804
/* Already submitted */
810
uhci_async_unlink(s, async);
814
/* Allocate new packet */
815
async = uhci_async_alloc(s);
819
/* valid needs to be large enough to handle 10 frame delay
820
* for initial isochronous requests
824
async->token = token;
827
max_len = ((td->token >> 21) + 1) & 0x7ff;
828
pid = td->token & 0xff;
830
async->packet.pid = pid;
831
async->packet.devaddr = (td->token >> 8) & 0x7f;
832
async->packet.devep = (td->token >> 15) & 0xf;
833
async->packet.data = async->buffer;
834
async->packet.len = max_len;
838
case USB_TOKEN_SETUP:
839
cpu_physical_memory_read(td->buffer, async->buffer, max_len);
840
len = uhci_broadcast_packet(s, &async->packet);
846
len = uhci_broadcast_packet(s, &async->packet);
850
/* invalid pid : frame interrupted */
851
uhci_async_free(s, async);
852
s->status |= UHCI_STS_HCPERR;
857
if (len == USB_RET_ASYNC) {
858
uhci_async_link(s, async);
862
async->packet.len = len;
865
len = uhci_complete_td(s, td, async, int_mask);
866
uhci_async_free(s, async);
870
static void uhci_async_complete(USBPort *port, USBPacket *packet)
872
UHCIAsync *async = container_of(packet, UHCIAsync, packet);
873
UHCIState *s = async->uhci;
875
DPRINTF("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
879
uint32_t link = async->td;
880
uint32_t int_mask = 0, val;
882
cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
883
le32_to_cpus(&td.link);
884
le32_to_cpus(&td.ctrl);
885
le32_to_cpus(&td.token);
886
le32_to_cpus(&td.buffer);
888
uhci_async_unlink(s, async);
889
uhci_complete_td(s, &td, async, &int_mask);
890
s->pending_int_mask |= int_mask;
892
/* update the status bits of the TD */
893
val = cpu_to_le32(td.ctrl);
894
cpu_physical_memory_write((link & ~0xf) + 4,
895
(const uint8_t *)&val, sizeof(val));
896
uhci_async_free(s, async);
899
uhci_process_frame(s);
903
static int is_valid(uint32_t link)
905
return (link & 1) == 0;
908
static int is_qh(uint32_t link)
910
return (link & 2) != 0;
913
static int depth_first(uint32_t link)
915
return (link & 4) != 0;
918
/* QH DB used for detecting QH loops */
919
#define UHCI_MAX_QUEUES 128
921
uint32_t addr[UHCI_MAX_QUEUES];
925
static void qhdb_reset(QhDb *db)
930
/* Add QH to DB. Returns 1 if already present or DB is full. */
931
static int qhdb_insert(QhDb *db, uint32_t addr)
934
for (i = 0; i < db->count; i++)
935
if (db->addr[i] == addr)
938
if (db->count >= UHCI_MAX_QUEUES)
941
db->addr[db->count++] = addr;
945
static void uhci_process_frame(UHCIState *s)
947
uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
954
frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
956
DPRINTF("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
958
cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
966
for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
970
if (qhdb_insert(&qhdb, link)) {
972
* We're going in circles. Which is not a bug because
973
* HCD is allowed to do that as part of the BW management.
974
* In our case though it makes no sense to spin here. Sync transations
975
* are already done, and async completion handler will re-process
976
* the frame when something is ready.
978
DPRINTF("uhci: detected loop. qh 0x%x\n", link);
982
cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
983
le32_to_cpus(&qh.link);
984
le32_to_cpus(&qh.el_link);
986
DPRINTF("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
987
link, qh.link, qh.el_link);
989
if (!is_valid(qh.el_link)) {
990
/* QH w/o elements */
994
/* QH with elements */
1002
cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
1003
le32_to_cpus(&td.link);
1004
le32_to_cpus(&td.ctrl);
1005
le32_to_cpus(&td.token);
1006
le32_to_cpus(&td.buffer);
1008
DPRINTF("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1009
link, td.link, td.ctrl, td.token, curr_qh);
1011
old_td_ctrl = td.ctrl;
1012
ret = uhci_handle_td(s, link, &td, &int_mask);
1013
if (old_td_ctrl != td.ctrl) {
1014
/* update the status bits of the TD */
1015
val = cpu_to_le32(td.ctrl);
1016
cpu_physical_memory_write((link & ~0xf) + 4,
1017
(const uint8_t *)&val, sizeof(val));
1021
/* interrupted frame */
1025
if (ret == 2 || ret == 1) {
1026
DPRINTF("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1027
link, ret == 2 ? "pend" : "skip",
1028
td.link, td.ctrl, td.token, curr_qh);
1030
link = curr_qh ? qh.link : td.link;
1036
DPRINTF("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
1037
link, td.link, td.ctrl, td.token, curr_qh);
1042
/* update QH element link */
1044
val = cpu_to_le32(qh.el_link);
1045
cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1046
(const uint8_t *)&val, sizeof(val));
1048
if (!depth_first(link)) {
1049
/* done with this QH */
1051
DPRINTF("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1052
curr_qh, qh.link, qh.el_link);
1059
/* go to the next entry */
1062
s->pending_int_mask |= int_mask;
1065
static void uhci_frame_timer(void *opaque)
1067
UHCIState *s = opaque;
1069
/* prepare the timer for the next frame */
1070
s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1072
if (!(s->cmd & UHCI_CMD_RS)) {
1074
qemu_del_timer(s->frame_timer);
1075
/* set hchalted bit in status - UHCI11D 2.1.2 */
1076
s->status |= UHCI_STS_HCHALTED;
1078
DPRINTF("uhci: halted\n");
1082
/* Complete the previous frame */
1083
if (s->pending_int_mask) {
1084
s->status2 |= s->pending_int_mask;
1085
s->status |= UHCI_STS_USBINT;
1088
s->pending_int_mask = 0;
1090
/* Start new frame */
1091
s->frnum = (s->frnum + 1) & 0x7ff;
1093
DPRINTF("uhci: new frame #%u\n" , s->frnum);
1095
uhci_async_validate_begin(s);
1097
uhci_process_frame(s);
1099
uhci_async_validate_end(s);
1101
qemu_mod_timer(s->frame_timer, s->expire_time);
1104
static void uhci_map(PCIDevice *pci_dev, int region_num,
1105
pcibus_t addr, pcibus_t size, int type)
1107
UHCIState *s = (UHCIState *)pci_dev;
1109
register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1110
register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1111
register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1112
register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1113
register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1114
register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1117
static USBPortOps uhci_port_ops = {
1118
.attach = uhci_attach,
1119
.detach = uhci_detach,
1120
.child_detach = uhci_child_detach,
1121
.wakeup = uhci_wakeup,
1122
.complete = uhci_async_complete,
1125
static USBBusOps uhci_bus_ops = {
1128
static int usb_uhci_common_initfn(PCIDevice *dev)
1130
UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1131
uint8_t *pci_conf = s->dev.config;
1134
pci_conf[PCI_CLASS_PROG] = 0x00;
1135
/* TODO: reset value should be 0. */
1136
pci_conf[PCI_INTERRUPT_PIN] = 4; // interrupt pin 3
1137
pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1140
USBPort *ports[NB_PORTS];
1141
for(i = 0; i < NB_PORTS; i++) {
1142
ports[i] = &s->ports[i].port;
1144
if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1145
s->firstport, s, &uhci_port_ops,
1146
USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1150
usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1151
for (i = 0; i < NB_PORTS; i++) {
1152
usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1153
USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1156
s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1157
s->num_ports_vmstate = NB_PORTS;
1158
QTAILQ_INIT(&s->async_pending);
1160
qemu_register_reset(uhci_reset, s);
1162
/* Use region 4 for consistency with real hardware. BSD guests seem
1164
pci_register_bar(&s->dev, 4, 0x20,
1165
PCI_BASE_ADDRESS_SPACE_IO, uhci_map);
1170
static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1172
UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1173
uint8_t *pci_conf = s->dev.config;
1175
/* USB misc control 1/2 */
1176
pci_set_long(pci_conf + 0x40,0x00001000);
1178
pci_set_long(pci_conf + 0x80,0x00020001);
1179
/* USB legacy support */
1180
pci_set_long(pci_conf + 0xc0,0x00002000);
1182
return usb_uhci_common_initfn(dev);
1185
static Property uhci_properties[] = {
1186
DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1187
DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1188
DEFINE_PROP_END_OF_LIST(),
1191
static PCIDeviceInfo uhci_info[] = {
1193
.qdev.name = "piix3-usb-uhci",
1194
.qdev.size = sizeof(UHCIState),
1195
.qdev.vmsd = &vmstate_uhci,
1196
.init = usb_uhci_common_initfn,
1197
.vendor_id = PCI_VENDOR_ID_INTEL,
1198
.device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1200
.class_id = PCI_CLASS_SERIAL_USB,
1201
.qdev.props = uhci_properties,
1203
.qdev.name = "piix4-usb-uhci",
1204
.qdev.size = sizeof(UHCIState),
1205
.qdev.vmsd = &vmstate_uhci,
1206
.init = usb_uhci_common_initfn,
1207
.vendor_id = PCI_VENDOR_ID_INTEL,
1208
.device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1210
.class_id = PCI_CLASS_SERIAL_USB,
1211
.qdev.props = uhci_properties,
1213
.qdev.name = "vt82c686b-usb-uhci",
1214
.qdev.size = sizeof(UHCIState),
1215
.qdev.vmsd = &vmstate_uhci,
1216
.init = usb_uhci_vt82c686b_initfn,
1217
.vendor_id = PCI_VENDOR_ID_VIA,
1218
.device_id = PCI_DEVICE_ID_VIA_UHCI,
1220
.class_id = PCI_CLASS_SERIAL_USB,
1221
.qdev.props = uhci_properties,
1223
.qdev.name = "ich9-usb-uhci1",
1224
.qdev.size = sizeof(UHCIState),
1225
.qdev.vmsd = &vmstate_uhci,
1226
.init = usb_uhci_common_initfn,
1227
.vendor_id = PCI_VENDOR_ID_INTEL,
1228
.device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1230
.class_id = PCI_CLASS_SERIAL_USB,
1231
.qdev.props = uhci_properties,
1233
.qdev.name = "ich9-usb-uhci2",
1234
.qdev.size = sizeof(UHCIState),
1235
.qdev.vmsd = &vmstate_uhci,
1236
.init = usb_uhci_common_initfn,
1237
.vendor_id = PCI_VENDOR_ID_INTEL,
1238
.device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1240
.class_id = PCI_CLASS_SERIAL_USB,
1241
.qdev.props = uhci_properties,
1243
.qdev.name = "ich9-usb-uhci3",
1244
.qdev.size = sizeof(UHCIState),
1245
.qdev.vmsd = &vmstate_uhci,
1246
.init = usb_uhci_common_initfn,
1247
.vendor_id = PCI_VENDOR_ID_INTEL,
1248
.device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1250
.class_id = PCI_CLASS_SERIAL_USB,
1251
.qdev.props = uhci_properties,
1257
static void uhci_register(void)
1259
pci_qdev_register_many(uhci_info);
1261
device_init(uhci_register);
1263
void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1265
pci_create_simple(bus, devfn, "piix3-usb-uhci");
1268
void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1270
pci_create_simple(bus, devfn, "piix4-usb-uhci");
1273
void usb_uhci_vt82c686b_init(PCIBus *bus, int devfn)
1275
pci_create_simple(bus, devfn, "vt82c686b-usb-uhci");