1 /*

     2  * USB UHCI controller emulation

     3  *

     4  * Copyright (c) 2005 Fabrice Bellard

     5  *

     6  * Copyright (c) 2008 Max Krasnyansky

     7  *     Magor rewrite of the UHCI data structures parser and frame processor

     8  *     Support for fully async operation and multiple outstanding transactions

     9  *

    10  * Permission is hereby granted, free of charge, to any person obtaining a copy

    11  * of this software and associated documentation files (the "Software"), to deal

    12  * in the Software without restriction, including without limitation the rights

    13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

    14  * copies of the Software, and to permit persons to whom the Software is

    15  * furnished to do so, subject to the following conditions:

    16  *

    17  * The above copyright notice and this permission notice shall be included in

    18  * all copies or substantial portions of the Software.

    19  *

    20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

    21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

    22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

    23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

    24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

    25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

    26  * THE SOFTWARE.

    27  */

    28 #include "hw.h"

    29 #include "usb.h"

    30 #include "pci.h"

    31 #include "qemu-timer.h"

    32 

    33 //#define DEBUG

    34 //#define DEBUG_DUMP_DATA

    35 

    36 #define UHCI_CMD_FGR      (1 << 4)

    37 #define UHCI_CMD_EGSM     (1 << 3)

    38 #define UHCI_CMD_GRESET   (1 << 2)

    39 #define UHCI_CMD_HCRESET  (1 << 1)

    40 #define UHCI_CMD_RS       (1 << 0)

    41 

    42 #define UHCI_STS_HCHALTED (1 << 5)

    43 #define UHCI_STS_HCPERR   (1 << 4)

    44 #define UHCI_STS_HSERR    (1 << 3)

    45 #define UHCI_STS_RD       (1 << 2)

    46 #define UHCI_STS_USBERR   (1 << 1)

    47 #define UHCI_STS_USBINT   (1 << 0)

    48 

    49 #define TD_CTRL_SPD     (1 << 29)

    50 #define TD_CTRL_ERROR_SHIFT  27

    51 #define TD_CTRL_IOS     (1 << 25)

    52 #define TD_CTRL_IOC     (1 << 24)

    53 #define TD_CTRL_ACTIVE  (1 << 23)

    54 #define TD_CTRL_STALL   (1 << 22)

    55 #define TD_CTRL_BABBLE  (1 << 20)

    56 #define TD_CTRL_NAK     (1 << 19)

    57 #define TD_CTRL_TIMEOUT (1 << 18)

    58 

    59 #define UHCI_PORT_RESET (1 << 9)

    60 #define UHCI_PORT_LSDA  (1 << 8)

    61 #define UHCI_PORT_ENC   (1 << 3)

    62 #define UHCI_PORT_EN    (1 << 2)

    63 #define UHCI_PORT_CSC   (1 << 1)

    64 #define UHCI_PORT_CCS   (1 << 0)

    65 

    66 #define FRAME_TIMER_FREQ 1000

    67 

    68 #define FRAME_MAX_LOOPS  100

    69 

    70 #define NB_PORTS 2

    71 

    72 #ifdef DEBUG

    73 #define dprintf printf

    74 

    75 const char *pid2str(int pid)

    76 {

    77     switch (pid) {

    78     case USB_TOKEN_SETUP: return "SETUP";

    79     case USB_TOKEN_IN:    return "IN";

    80     case USB_TOKEN_OUT:   return "OUT";

    81     }

    82     return "?";

    83 }

    84 

    85 #else

    86 #define dprintf(...)

    87 #endif

    88 

    89 #ifdef DEBUG_DUMP_DATA

    90 static void dump_data(const uint8_t *data, int len)

    91 {

    92     int i;

    93 

    94     printf("uhci: data: ");

    95     for(i = 0; i < len; i++)

    96         printf(" %02x", data[i]);

    97     printf("\n");

    98 }

    99 #else

   100 static void dump_data(const uint8_t *data, int len) {}

   101 #endif

   102 

   103 /* 

   104  * Pending async transaction.

   105  * 'packet' must be the first field because completion

   106  * handler does "(UHCIAsync *) pkt" cast.

   107  */

   108 typedef struct UHCIAsync {

   109     USBPacket packet;

   110     struct UHCIAsync *next;

   111     uint32_t  td;

   112     uint32_t  token;

   113     int8_t    valid;

   114     uint8_t   done;

   115     uint8_t   buffer[2048];

   116 } UHCIAsync;

   117 

   118 typedef struct UHCIPort {

   119     USBPort port;

   120     uint16_t ctrl;

   121 } UHCIPort;

   122 

   123 typedef struct UHCIState {

   124     PCIDevice dev;

   125     uint16_t cmd; /* cmd register */

   126     uint16_t status;

   127     uint16_t intr; /* interrupt enable register */

   128     uint16_t frnum; /* frame number */

   129     uint32_t fl_base_addr; /* frame list base address */

   130     uint8_t sof_timing;

   131     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */

   132     QEMUTimer *frame_timer;

   133     UHCIPort ports[NB_PORTS];

   134 

   135     /* Interrupts that should be raised at the end of the current frame.  */

   136     uint32_t pending_int_mask;

   137 

   138     /* Active packets */

   139     UHCIAsync *async_pending;

   140     UHCIAsync *async_pool;

   141 } UHCIState;

   142 

   143 typedef struct UHCI_TD {

   144     uint32_t link;

   145     uint32_t ctrl; /* see TD_CTRL_xxx */

   146     uint32_t token;

   147     uint32_t buffer;

   148 } UHCI_TD;

   149 

   150 typedef struct UHCI_QH {

   151     uint32_t link;

   152     uint32_t el_link;

   153 } UHCI_QH;

   154 

   155 static UHCIAsync *uhci_async_alloc(UHCIState *s)

   156 {

   157     UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));

   158     if (async) {

   159         memset(&async->packet, 0, sizeof(async->packet));

   160         async->valid = 0;

   161         async->td    = 0;

   162         async->token = 0;

   163         async->done  = 0;

   164         async->next  = NULL;

   165     }

   166 

   167     return async;

   168 }

   169 

   170 static void uhci_async_free(UHCIState *s, UHCIAsync *async)

   171 {

   172     qemu_free(async);

   173 }

   174 

   175 static void uhci_async_link(UHCIState *s, UHCIAsync *async)

   176 {

   177     async->next = s->async_pending;

   178     s->async_pending = async;

   179 }

   180 

   181 static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)

   182 {

   183     UHCIAsync *curr = s->async_pending;

   184     UHCIAsync **prev = &s->async_pending;

   185 

   186     while (curr) {

   187 	if (curr == async) {

   188             *prev = curr->next;

   189             return;

   190         }

   191 

   192         prev = &curr->next;

   193         curr = curr->next;

   194     }

   195 }

   196 

   197 static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)

   198 {

   199     dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",

   200            async->td, async->token, async->done);

   201 

   202     if (!async->done)

   203         usb_cancel_packet(&async->packet);

   204     uhci_async_free(s, async);

   205 }

   206 

   207 /*

   208  * Mark all outstanding async packets as invalid.

   209  * This is used for canceling them when TDs are removed by the HCD.

   210  */

   211 static UHCIAsync *uhci_async_validate_begin(UHCIState *s)

   212 {

   213     UHCIAsync *async = s->async_pending;

   214 

   215     while (async) {

   216         async->valid--;

   217         async = async->next;

   218     }

   219     return NULL;

   220 }

   221 

   222 /*

   223  * Cancel async packets that are no longer valid

   224  */

   225 static void uhci_async_validate_end(UHCIState *s)

   226 {

   227     UHCIAsync *curr = s->async_pending;

   228     UHCIAsync **prev = &s->async_pending;

   229     UHCIAsync *next;

   230 

   231     while (curr) {

   232         if (curr->valid > 0) {

   233             prev = &curr->next;

   234             curr = curr->next;

   235             continue;

   236         }

   237 

   238         next = curr->next;

   239 

   240         /* Unlink */

   241         *prev = next;

   242 

   243         uhci_async_cancel(s, curr);

   244 

   245         curr = next;

   246     }

   247 }

   248 

   249 static void uhci_async_cancel_all(UHCIState *s)

   250 {

   251     UHCIAsync *curr = s->async_pending;

   252     UHCIAsync *next;

   253 

   254     while (curr) {

   255         next = curr->next;

   256 

   257         uhci_async_cancel(s, curr);

   258 

   259         curr = next;

   260     }

   261 

   262     s->async_pending = NULL;

   263 }

   264 

   265 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)

   266 {

   267     UHCIAsync *async = s->async_pending;

   268     UHCIAsync *match = NULL;

   269     int count = 0;

   270 

   271     /*

   272      * We're looking for the best match here. ie both td addr and token.

   273      * Otherwise we return last good match. ie just token.

   274      * It's ok to match just token because it identifies the transaction

   275      * rather well, token includes: device addr, endpoint, size, etc.

   276      *

   277      * Also since we queue async transactions in reverse order by returning

   278      * last good match we restores the order.

   279      *

   280      * It's expected that we wont have a ton of outstanding transactions.

   281      * If we ever do we'd want to optimize this algorithm.

   282      */

   283 

   284     while (async) {

   285         if (async->token == token) {

   286             /* Good match */

   287             match = async;

   288 

   289             if (async->td == addr) {

   290                 /* Best match */

   291                 break;

   292             }

   293         }

   294 

   295         async = async->next;

   296         count++;

   297     }

   298 

   299     if (count > 64)

   300 	fprintf(stderr, "uhci: warning lots of async transactions\n");

   301 

   302     return match;

   303 }

   304 

   305 static void uhci_attach(USBPort *port1, USBDevice *dev);

   306 

   307 static void uhci_update_irq(UHCIState *s)

   308 {

   309     int level;

   310     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||

   311         ((s->status2 & 2) && (s->intr & (1 << 3))) ||

   312         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||

   313         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||

   314         (s->status & UHCI_STS_HSERR) ||

   315         (s->status & UHCI_STS_HCPERR)) {

   316         level = 1;

   317     } else {

   318         level = 0;

   319     }

   320     qemu_set_irq(s->dev.irq[3], level);

   321 }

   322 

   323 static void uhci_reset(UHCIState *s)

   324 {

   325     uint8_t *pci_conf;

   326     int i;

   327     UHCIPort *port;

   328 

   329     dprintf("uhci: full reset\n");

   330 

   331     pci_conf = s->dev.config;

   332 

   333     pci_conf[0x6a] = 0x01; /* usb clock */

   334     pci_conf[0x6b] = 0x00;

   335     s->cmd = 0;

   336     s->status = 0;

   337     s->status2 = 0;

   338     s->intr = 0;

   339     s->fl_base_addr = 0;

   340     s->sof_timing = 64;

   341 

   342     for(i = 0; i < NB_PORTS; i++) {

   343         port = &s->ports[i];

   344         port->ctrl = 0x0080;

   345         if (port->port.dev)

   346             uhci_attach(&port->port, port->port.dev);

   347     }

   348 

   349     uhci_async_cancel_all(s);

   350 }

   351 

   352 static void uhci_save(QEMUFile *f, void *opaque)

   353 {

   354     UHCIState *s = opaque;

   355     uint8_t num_ports = NB_PORTS;

   356     int i;

   357 

   358     uhci_async_cancel_all(s);

   359 

   360     pci_device_save(&s->dev, f);

   361 

   362     qemu_put_8s(f, &num_ports);

   363     for (i = 0; i < num_ports; ++i)

   364         qemu_put_be16s(f, &s->ports[i].ctrl);

   365     qemu_put_be16s(f, &s->cmd);

   366     qemu_put_be16s(f, &s->status);

   367     qemu_put_be16s(f, &s->intr);

   368     qemu_put_be16s(f, &s->frnum);

   369     qemu_put_be32s(f, &s->fl_base_addr);

   370     qemu_put_8s(f, &s->sof_timing);

   371     qemu_put_8s(f, &s->status2);

   372     qemu_put_timer(f, s->frame_timer);

   373 }

   374 

   375 static int uhci_load(QEMUFile *f, void *opaque, int version_id)

   376 {

   377     UHCIState *s = opaque;

   378     uint8_t num_ports;

   379     int i, ret;

   380 

   381     if (version_id > 1)

   382         return -EINVAL;

   383 

   384     ret = pci_device_load(&s->dev, f);

   385     if (ret < 0)

   386         return ret;

   387 

   388     qemu_get_8s(f, &num_ports);

   389     if (num_ports != NB_PORTS)

   390         return -EINVAL;

   391 

   392     for (i = 0; i < num_ports; ++i)

   393         qemu_get_be16s(f, &s->ports[i].ctrl);

   394     qemu_get_be16s(f, &s->cmd);

   395     qemu_get_be16s(f, &s->status);

   396     qemu_get_be16s(f, &s->intr);

   397     qemu_get_be16s(f, &s->frnum);

   398     qemu_get_be32s(f, &s->fl_base_addr);

   399     qemu_get_8s(f, &s->sof_timing);

   400     qemu_get_8s(f, &s->status2);

   401     qemu_get_timer(f, s->frame_timer);

   402 

   403     return 0;

   404 }

   405 

   406 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)

   407 {

   408     UHCIState *s = opaque;

   409 

   410     addr &= 0x1f;

   411     switch(addr) {

   412     case 0x0c:

   413         s->sof_timing = val;

   414         break;

   415     }

   416 }

   417 

   418 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)

   419 {

   420     UHCIState *s = opaque;

   421     uint32_t val;

   422 

   423     addr &= 0x1f;

   424     switch(addr) {

   425     case 0x0c:

   426         val = s->sof_timing;

   427         break;

   428     default:

   429         val = 0xff;

   430         break;

   431     }

   432     return val;

   433 }

   434 

   435 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)

   436 {

   437     UHCIState *s = opaque;

   438 

   439     addr &= 0x1f;

   440     dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);

   441 

   442     switch(addr) {

   443     case 0x00:

   444         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {

   445             /* start frame processing */

   446             qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));

   447             s->status &= ~UHCI_STS_HCHALTED;

   448         } else if (!(val & UHCI_CMD_RS)) {

   449             s->status |= UHCI_STS_HCHALTED;

   450         }

   451         if (val & UHCI_CMD_GRESET) {

   452             UHCIPort *port;

   453             USBDevice *dev;

   454             int i;

   455 

   456             /* send reset on the USB bus */

   457             for(i = 0; i < NB_PORTS; i++) {

   458                 port = &s->ports[i];

   459                 dev = port->port.dev;

   460                 if (dev) {

   461                     usb_send_msg(dev, USB_MSG_RESET);

   462                 }

   463             }

   464             uhci_reset(s);

   465             return;

   466         }

   467         if (val & UHCI_CMD_HCRESET) {

   468             uhci_reset(s);

   469             return;

   470         }

   471         s->cmd = val;

   472         break;

   473     case 0x02:

   474         s->status &= ~val;

   475         /* XXX: the chip spec is not coherent, so we add a hidden

   476            register to distinguish between IOC and SPD */

   477         if (val & UHCI_STS_USBINT)

   478             s->status2 = 0;

   479         uhci_update_irq(s);

   480         break;

   481     case 0x04:

   482         s->intr = val;

   483         uhci_update_irq(s);

   484         break;

   485     case 0x06:

   486         if (s->status & UHCI_STS_HCHALTED)

   487             s->frnum = val & 0x7ff;

   488         break;

   489     case 0x10 ... 0x1f:

   490         {

   491             UHCIPort *port;

   492             USBDevice *dev;

   493             int n;

   494 

   495             n = (addr >> 1) & 7;

   496             if (n >= NB_PORTS)

   497                 return;

   498             port = &s->ports[n];

   499             dev = port->port.dev;

   500             if (dev) {

   501                 /* port reset */

   502                 if ( (val & UHCI_PORT_RESET) &&

   503                      !(port->ctrl & UHCI_PORT_RESET) ) {

   504                     usb_send_msg(dev, USB_MSG_RESET);

   505                 }

   506             }

   507             port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);

   508             /* some bits are reset when a '1' is written to them */

   509             port->ctrl &= ~(val & 0x000a);

   510         }

   511         break;

   512     }

   513 }

   514 

   515 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)

   516 {

   517     UHCIState *s = opaque;

   518     uint32_t val;

   519 

   520     addr &= 0x1f;

   521     switch(addr) {

   522     case 0x00:

   523         val = s->cmd;

   524         break;

   525     case 0x02:

   526         val = s->status;

   527         break;

   528     case 0x04:

   529         val = s->intr;

   530         break;

   531     case 0x06:

   532         val = s->frnum;

   533         break;

   534     case 0x10 ... 0x1f:

   535         {

   536             UHCIPort *port;

   537             int n;

   538             n = (addr >> 1) & 7;

   539             if (n >= NB_PORTS)

   540                 goto read_default;

   541             port = &s->ports[n];

   542             val = port->ctrl;

   543         }

   544         break;

   545     default:

   546     read_default:

   547         val = 0xff7f; /* disabled port */

   548         break;

   549     }

   550 

   551     dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);

   552 

   553     return val;

   554 }

   555 

   556 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)

   557 {

   558     UHCIState *s = opaque;

   559 

   560     addr &= 0x1f;

   561     dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);

   562 

   563     switch(addr) {

   564     case 0x08:

   565         s->fl_base_addr = val & ~0xfff;

   566         break;

   567     }

   568 }

   569 

   570 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)

   571 {

   572     UHCIState *s = opaque;

   573     uint32_t val;

   574 

   575     addr &= 0x1f;

   576     switch(addr) {

   577     case 0x08:

   578         val = s->fl_base_addr;

   579         break;

   580     default:

   581         val = 0xffffffff;

   582         break;

   583     }

   584     return val;

   585 }

   586 

   587 /* signal resume if controller suspended */

   588 static void uhci_resume (void *opaque)

   589 {

   590     UHCIState *s = (UHCIState *)opaque;

   591 

   592     if (!s)

   593         return;

   594 

   595     if (s->cmd & UHCI_CMD_EGSM) {

   596         s->cmd |= UHCI_CMD_FGR;

   597         s->status |= UHCI_STS_RD;

   598         uhci_update_irq(s);

   599     }

   600 }

   601 

   602 static void uhci_attach(USBPort *port1, USBDevice *dev)

   603 {

   604     UHCIState *s = port1->opaque;

   605     UHCIPort *port = &s->ports[port1->index];

   606 

   607     if (dev) {

   608         if (port->port.dev) {

   609             usb_attach(port1, NULL);

   610         }

   611         /* set connect status */

   612         port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;

   613 

   614         /* update speed */

   615         if (dev->speed == USB_SPEED_LOW)

   616             port->ctrl |= UHCI_PORT_LSDA;

   617         else

   618             port->ctrl &= ~UHCI_PORT_LSDA;

   619 

   620         uhci_resume(s);

   621 

   622         port->port.dev = dev;

   623         /* send the attach message */

   624         usb_send_msg(dev, USB_MSG_ATTACH);

   625     } else {

   626         /* set connect status */

   627         if (port->ctrl & UHCI_PORT_CCS) {

   628             port->ctrl &= ~UHCI_PORT_CCS;

   629             port->ctrl |= UHCI_PORT_CSC;

   630         }

   631         /* disable port */

   632         if (port->ctrl & UHCI_PORT_EN) {

   633             port->ctrl &= ~UHCI_PORT_EN;

   634             port->ctrl |= UHCI_PORT_ENC;

   635         }

   636 

   637         uhci_resume(s);

   638 

   639         dev = port->port.dev;

   640         if (dev) {

   641             /* send the detach message */

   642             usb_send_msg(dev, USB_MSG_DETACH);

   643         }

   644         port->port.dev = NULL;

   645     }

   646 }

   647 

   648 static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)

   649 {

   650     int i, ret;

   651 

   652     dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",

   653            pid2str(p->pid), p->devaddr, p->devep, p->len);

   654     if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)

   655         dump_data(p->data, p->len);

   656 

   657     ret = USB_RET_NODEV;

   658     for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {

   659         UHCIPort *port = &s->ports[i];

   660         USBDevice *dev = port->port.dev;

   661 

   662         if (dev && (port->ctrl & UHCI_PORT_EN))

   663             ret = dev->handle_packet(dev, p);

   664     }

   665 

   666     dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);

   667     if (p->pid == USB_TOKEN_IN && ret > 0)

   668         dump_data(p->data, ret);

   669 

   670     return ret;

   671 }

   672 

   673 static void uhci_async_complete(USBPacket * packet, void *opaque);

   674 static void uhci_process_frame(UHCIState *s);

   675 

   676 /* return -1 if fatal error (frame must be stopped)

   677           0 if TD successful

   678           1 if TD unsuccessful or inactive

   679 */

   680 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)

   681 {

   682     int len = 0, max_len, err, ret;

   683     uint8_t pid;

   684 

   685     max_len = ((td->token >> 21) + 1) & 0x7ff;

   686     pid = td->token & 0xff;

   687 

   688     ret = async->packet.len;

   689 

   690     if (td->ctrl & TD_CTRL_IOC)

   691         *int_mask |= 0x01;

   692 

   693     if (td->ctrl & TD_CTRL_IOS)

   694         td->ctrl &= ~TD_CTRL_ACTIVE;

   695 

   696     if (ret < 0)

   697         goto out;

   698 

   699     len = async->packet.len;

   700     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);

   701 

   702     /* The NAK bit may have been set by a previous frame, so clear it

   703        here.  The docs are somewhat unclear, but win2k relies on this

   704        behavior.  */

   705     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);

   706 

   707     if (pid == USB_TOKEN_IN) {

   708         if (len > max_len) {

   709             len = max_len;

   710             ret = USB_RET_BABBLE;

   711             goto out;

   712         }

   713 

   714         if (len > 0) {

   715             /* write the data back */

   716             cpu_physical_memory_write(td->buffer, async->buffer, len);

   717         }

   718 

   719         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {

   720             *int_mask |= 0x02;

   721             /* short packet: do not update QH */

   722             dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);

   723             return 1;

   724         }

   725     }

   726 

   727     /* success */

   728     return 0;

   729 

   730 out:

   731     switch(ret) {

   732     case USB_RET_STALL:

   733         td->ctrl |= TD_CTRL_STALL;

   734         td->ctrl &= ~TD_CTRL_ACTIVE;

   735         return 1;

   736 

   737     case USB_RET_BABBLE:

   738         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;

   739         td->ctrl &= ~TD_CTRL_ACTIVE;

   740         /* frame interrupted */

   741         return -1;

   742 

   743     case USB_RET_NAK:

   744         td->ctrl |= TD_CTRL_NAK;

   745         if (pid == USB_TOKEN_SETUP)

   746             break;

   747 	return 1;

   748 

   749     case USB_RET_NODEV:

   750     default:

   751 	break;

   752     }

   753 

   754     /* Retry the TD if error count is not zero */

   755 

   756     td->ctrl |= TD_CTRL_TIMEOUT;

   757     err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;

   758     if (err != 0) {

   759         err--;

   760         if (err == 0) {

   761             td->ctrl &= ~TD_CTRL_ACTIVE;

   762             s->status |= UHCI_STS_USBERR;

   763             uhci_update_irq(s);

   764         }

   765     }

   766     td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |

   767         (err << TD_CTRL_ERROR_SHIFT);

   768     return 1;

   769 }

   770 

   771 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)

   772 {

   773     UHCIAsync *async;

   774     int len = 0, max_len;

   775     uint8_t pid;

   776 

   777     /* Is active ? */

   778     if (!(td->ctrl & TD_CTRL_ACTIVE))

   779         return 1;

   780 

   781     async = uhci_async_find_td(s, addr, td->token);

   782     if (async) {

   783         /* Already submitted */

   784         async->valid = 32;

   785 

   786         if (!async->done)

   787             return 1;

   788 

   789         uhci_async_unlink(s, async);

   790         goto done;

   791     }

   792 

   793     /* Allocate new packet */

   794     async = uhci_async_alloc(s);

   795     if (!async)

   796         return 1;

   797 

   798     async->valid = 10;

   799     async->td    = addr;

   800     async->token = td->token;

   801 

   802     max_len = ((td->token >> 21) + 1) & 0x7ff;

   803     pid = td->token & 0xff;

   804 

   805     async->packet.pid     = pid;

   806     async->packet.devaddr = (td->token >> 8) & 0x7f;

   807     async->packet.devep   = (td->token >> 15) & 0xf;

   808     async->packet.data    = async->buffer;

   809     async->packet.len     = max_len;

   810     async->packet.complete_cb     = uhci_async_complete;

   811     async->packet.complete_opaque = s;

   812 

   813     switch(pid) {

   814     case USB_TOKEN_OUT:

   815     case USB_TOKEN_SETUP:

   816         cpu_physical_memory_read(td->buffer, async->buffer, max_len);

   817         len = uhci_broadcast_packet(s, &async->packet);

   818         if (len >= 0)

   819             len = max_len;

   820         break;

   821 

   822     case USB_TOKEN_IN:

   823         len = uhci_broadcast_packet(s, &async->packet);

   824         break;

   825 

   826     default:

   827         /* invalid pid : frame interrupted */

   828         uhci_async_free(s, async);

   829         s->status |= UHCI_STS_HCPERR;

   830         uhci_update_irq(s);

   831         return -1;

   832     }

   833  

   834     if (len == USB_RET_ASYNC) {

   835         uhci_async_link(s, async);

   836         return 2;

   837     }

   838 

   839     async->packet.len = len;

   840 

   841 done:

   842     len = uhci_complete_td(s, td, async, int_mask);

   843     uhci_async_free(s, async);

   844     return len;

   845 }

   846 

   847 static void uhci_async_complete(USBPacket *packet, void *opaque)

   848 {

   849     UHCIState *s = opaque;

   850     UHCIAsync *async = (UHCIAsync *) packet;

   851 

   852     dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);

   853 

   854     async->done = 1;

   855 

   856     uhci_process_frame(s);

   857 }

   858 

   859 static int is_valid(uint32_t link)

   860 {

   861     return (link & 1) == 0;

   862 }

   863 

   864 static int is_qh(uint32_t link)

   865 {

   866     return (link & 2) != 0;

   867 }

   868 

   869 static int depth_first(uint32_t link)

   870 {

   871     return (link & 4) != 0;

   872 }

   873 

   874 /* QH DB used for detecting QH loops */

   875 #define UHCI_MAX_QUEUES 128

   876 typedef struct {

   877     uint32_t addr[UHCI_MAX_QUEUES];

   878     int      count;

   879 } QhDb;

   880 

   881 static void qhdb_reset(QhDb *db)

   882 {

   883     db->count = 0;

   884 }

   885 

   886 /* Add QH to DB. Returns 1 if already present or DB is full. */

   887 static int qhdb_insert(QhDb *db, uint32_t addr)

   888 {

   889     int i;

   890     for (i = 0; i < db->count; i++)

   891         if (db->addr[i] == addr)

   892             return 1;

   893 

   894     if (db->count >= UHCI_MAX_QUEUES)

   895         return 1;

   896 

   897     db->addr[db->count++] = addr;

   898     return 0;

   899 }

   900 

   901 static void uhci_process_frame(UHCIState *s)

   902 {

   903     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;

   904     uint32_t curr_qh;

   905     int cnt, ret;

   906     UHCI_TD td;

   907     UHCI_QH qh;

   908     QhDb qhdb;

   909 

   910     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);

   911 

   912     dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);

   913 

   914     cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);

   915     le32_to_cpus(&link);

   916 

   917     int_mask = 0;

   918     curr_qh  = 0;

   919 

   920     qhdb_reset(&qhdb);

   921 

   922     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {

   923         if (is_qh(link)) {

   924             /* QH */

   925 

   926             if (qhdb_insert(&qhdb, link)) {

   927                 /*

   928                  * We're going in circles. Which is not a bug because

   929                  * HCD is allowed to do that as part of the BW management. 

   930                  * In our case though it makes no sense to spin here. Sync transations 

   931                  * are already done, and async completion handler will re-process 

   932                  * the frame when something is ready.

   933                  */

   934                 dprintf("uhci: detected loop. qh 0x%x\n", link);

   935                 break;

   936             }

   937 

   938             cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));

   939             le32_to_cpus(&qh.link);

   940             le32_to_cpus(&qh.el_link);

   941 

   942             dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",

   943                     link, qh.link, qh.el_link);

   944 

   945             if (!is_valid(qh.el_link)) {

   946                 /* QH w/o elements */

   947                 curr_qh = 0;

   948                 link = qh.link;

   949             } else {

   950                 /* QH with elements */

   951             	curr_qh = link;

   952             	link = qh.el_link;

   953             }

   954             continue;

   955         }

   956 

   957         /* TD */

   958         cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));

   959         le32_to_cpus(&td.link);

   960         le32_to_cpus(&td.ctrl);

   961         le32_to_cpus(&td.token);

   962         le32_to_cpus(&td.buffer);

   963 

   964         dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 

   965                 link, td.link, td.ctrl, td.token, curr_qh);

   966 

   967         old_td_ctrl = td.ctrl;

   968         ret = uhci_handle_td(s, link, &td, &int_mask);

   969         if (old_td_ctrl != td.ctrl) {

   970             /* update the status bits of the TD */

   971             val = cpu_to_le32(td.ctrl);

   972             cpu_physical_memory_write((link & ~0xf) + 4,

   973                                       (const uint8_t *)&val, sizeof(val));

   974         }

   975 

   976         if (ret < 0) {

   977             /* interrupted frame */

   978             break;

   979         }

   980 

   981         if (ret == 2 || ret == 1) {

   982             dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",

   983                     link, ret == 2 ? "pend" : "skip",

   984                     td.link, td.ctrl, td.token, curr_qh);

   985 

   986             link = curr_qh ? qh.link : td.link;

   987             continue;

   988         }

   989 

   990         /* completed TD */

   991 

   992         dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n", 

   993                 link, td.link, td.ctrl, td.token, curr_qh);

   994 

   995         link = td.link;

   996 

   997         if (curr_qh) {

   998 	    /* update QH element link */

   999             qh.el_link = link;

  1000             val = cpu_to_le32(qh.el_link);

  1001             cpu_physical_memory_write((curr_qh & ~0xf) + 4,

  1002                                           (const uint8_t *)&val, sizeof(val));

  1003 

  1004             if (!depth_first(link)) {

  1005                /* done with this QH */

  1006 

  1007                dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",

  1008                        curr_qh, qh.link, qh.el_link);

  1009 

  1010                curr_qh = 0;

  1011                link    = qh.link;

  1012             }

  1013         }

  1014 

  1015         /* go to the next entry */

  1016     }

  1017 

  1018     s->pending_int_mask = int_mask;

  1019 }

  1020 

  1021 static void uhci_frame_timer(void *opaque)

  1022 {

  1023     UHCIState *s = opaque;

  1024     int64_t expire_time;

  1025 

  1026     if (!(s->cmd & UHCI_CMD_RS)) {

  1027         /* Full stop */

  1028         qemu_del_timer(s->frame_timer);

  1029         /* set hchalted bit in status - UHCI11D 2.1.2 */

  1030         s->status |= UHCI_STS_HCHALTED;

  1031 

  1032         dprintf("uhci: halted\n");

  1033         return;

  1034     }

  1035 

  1036     /* Complete the previous frame */

  1037     if (s->pending_int_mask) {

  1038         s->status2 |= s->pending_int_mask;

  1039         s->status  |= UHCI_STS_USBINT;

  1040         uhci_update_irq(s);

  1041     }

  1042 

  1043     /* Start new frame */

  1044     s->frnum = (s->frnum + 1) & 0x7ff;

  1045 

  1046     dprintf("uhci: new frame #%u\n" , s->frnum);

  1047 

  1048     uhci_async_validate_begin(s);

  1049 

  1050     uhci_process_frame(s);

  1051 

  1052     uhci_async_validate_end(s);

  1053 

  1054     /* prepare the timer for the next frame */

  1055     expire_time = qemu_get_clock(vm_clock) +

  1056         (ticks_per_sec / FRAME_TIMER_FREQ);

  1057     qemu_mod_timer(s->frame_timer, expire_time);

  1058 }

  1059 

  1060 static void uhci_map(PCIDevice *pci_dev, int region_num,

  1061                     uint32_t addr, uint32_t size, int type)

  1062 {

  1063     UHCIState *s = (UHCIState *)pci_dev;

  1064 

  1065     register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);

  1066     register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);

  1067     register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);

  1068     register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);

  1069     register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);

  1070     register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);

  1071 }

  1072 

  1073 void usb_uhci_piix3_init(PCIBus *bus, int devfn)

  1074 {

  1075     UHCIState *s;

  1076     uint8_t *pci_conf;

  1077     int i;

  1078 

  1079     s = (UHCIState *)pci_register_device(bus,

  1080                                         "USB-UHCI", sizeof(UHCIState),

  1081                                         devfn, NULL, NULL);

  1082     pci_conf = s->dev.config;

  1083     pci_conf[0x00] = 0x86;

  1084     pci_conf[0x01] = 0x80;

  1085     pci_conf[0x02] = 0x20;

  1086     pci_conf[0x03] = 0x70;

  1087     pci_conf[0x08] = 0x01; // revision number

  1088     pci_conf[0x09] = 0x00;

  1089     pci_conf[0x0a] = 0x03;

  1090     pci_conf[0x0b] = 0x0c;

  1091     pci_conf[0x0e] = 0x00; // header_type

  1092     pci_conf[0x3d] = 4; // interrupt pin 3

  1093     pci_conf[0x60] = 0x10; // release number

  1094 

  1095     for(i = 0; i < NB_PORTS; i++) {

  1096         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);

  1097     }

  1098     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);

  1099 

  1100     uhci_reset(s);

  1101 

  1102     /* Use region 4 for consistency with real hardware.  BSD guests seem

  1103        to rely on this.  */

  1104     pci_register_io_region(&s->dev, 4, 0x20,

  1105                            PCI_ADDRESS_SPACE_IO, uhci_map);

  1106 

  1107     register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);

  1108 }

  1109 

  1110 void usb_uhci_piix4_init(PCIBus *bus, int devfn)

  1111 {

  1112     UHCIState *s;

  1113     uint8_t *pci_conf;

  1114     int i;

  1115 

  1116     s = (UHCIState *)pci_register_device(bus,

  1117                                         "USB-UHCI", sizeof(UHCIState),

  1118                                         devfn, NULL, NULL);

  1119     pci_conf = s->dev.config;

  1120     pci_conf[0x00] = 0x86;

  1121     pci_conf[0x01] = 0x80;

  1122     pci_conf[0x02] = 0x12;

  1123     pci_conf[0x03] = 0x71;

  1124     pci_conf[0x08] = 0x01; // revision number

  1125     pci_conf[0x09] = 0x00;

  1126     pci_conf[0x0a] = 0x03;

  1127     pci_conf[0x0b] = 0x0c;

  1128     pci_conf[0x0e] = 0x00; // header_type

  1129     pci_conf[0x3d] = 4; // interrupt pin 3

  1130     pci_conf[0x60] = 0x10; // release number

  1131 

  1132     for(i = 0; i < NB_PORTS; i++) {

  1133         qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);

  1134     }

  1135     s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);