![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to usb-uhci.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu / hw|
Return to usb-uhci.c CVS log | Up to [Qemu by Fabrice Bellard] / qemu / hw |
1.1 root 1: /*
2: * USB UHCI controller emulation
1.1.1.5 root 3: *
1.1 root 4: * Copyright (c) 2005 Fabrice Bellard
1.1.1.5 root 5: *
1.1.1.6 root 6: * Copyright (c) 2008 Max Krasnyansky
7: * Magor rewrite of the UHCI data structures parser and frame processor
8: * Support for fully async operation and multiple outstanding transactions
9: *
1.1 root 10: * Permission is hereby granted, free of charge, to any person obtaining a copy
11: * of this software and associated documentation files (the "Software"), to deal
12: * in the Software without restriction, including without limitation the rights
13: * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14: * copies of the Software, and to permit persons to whom the Software is
15: * furnished to do so, subject to the following conditions:
16: *
17: * The above copyright notice and this permission notice shall be included in
18: * all copies or substantial portions of the Software.
19: *
20: * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21: * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22: * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23: * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24: * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25: * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26: * THE SOFTWARE.
27: */
1.1.1.5 root 28: #include "hw.h"
29: #include "usb.h"
30: #include "pci.h"
31: #include "qemu-timer.h"
1.1 root 32:
33: //#define DEBUG
1.1.1.6 root 34: //#define DEBUG_DUMP_DATA
1.1 root 35:
1.1.1.5 root 36: #define UHCI_CMD_FGR (1 << 4)
37: #define UHCI_CMD_EGSM (1 << 3)
1.1 root 38: #define UHCI_CMD_GRESET (1 << 2)
39: #define UHCI_CMD_HCRESET (1 << 1)
40: #define UHCI_CMD_RS (1 << 0)
41:
42: #define UHCI_STS_HCHALTED (1 << 5)
43: #define UHCI_STS_HCPERR (1 << 4)
44: #define UHCI_STS_HSERR (1 << 3)
45: #define UHCI_STS_RD (1 << 2)
46: #define UHCI_STS_USBERR (1 << 1)
47: #define UHCI_STS_USBINT (1 << 0)
48:
49: #define TD_CTRL_SPD (1 << 29)
50: #define TD_CTRL_ERROR_SHIFT 27
51: #define TD_CTRL_IOS (1 << 25)
52: #define TD_CTRL_IOC (1 << 24)
53: #define TD_CTRL_ACTIVE (1 << 23)
54: #define TD_CTRL_STALL (1 << 22)
55: #define TD_CTRL_BABBLE (1 << 20)
56: #define TD_CTRL_NAK (1 << 19)
57: #define TD_CTRL_TIMEOUT (1 << 18)
58:
59: #define UHCI_PORT_RESET (1 << 9)
60: #define UHCI_PORT_LSDA (1 << 8)
61: #define UHCI_PORT_ENC (1 << 3)
62: #define UHCI_PORT_EN (1 << 2)
63: #define UHCI_PORT_CSC (1 << 1)
64: #define UHCI_PORT_CCS (1 << 0)
65:
66: #define FRAME_TIMER_FREQ 1000
67:
68: #define FRAME_MAX_LOOPS 100
69:
70: #define NB_PORTS 2
71:
1.1.1.6 root 72: #ifdef DEBUG
73: #define dprintf printf
74:
1.1.1.7 ! root 75: static const char *pid2str(int pid)
1.1.1.6 root 76: {
77: switch (pid) {
78: case USB_TOKEN_SETUP: return "SETUP";
79: case USB_TOKEN_IN: return "IN";
80: case USB_TOKEN_OUT: return "OUT";
81: }
82: return "?";
83: }
84:
85: #else
86: #define dprintf(...)
87: #endif
88:
89: #ifdef DEBUG_DUMP_DATA
90: static void dump_data(const uint8_t *data, int len)
91: {
92: int i;
93:
94: printf("uhci: data: ");
95: for(i = 0; i < len; i++)
96: printf(" %02x", data[i]);
97: printf("\n");
98: }
99: #else
100: static void dump_data(const uint8_t *data, int len) {}
101: #endif
102:
103: /*
104: * Pending async transaction.
105: * 'packet' must be the first field because completion
106: * handler does "(UHCIAsync *) pkt" cast.
107: */
108: typedef struct UHCIAsync {
109: USBPacket packet;
110: struct UHCIAsync *next;
111: uint32_t td;
112: uint32_t token;
113: int8_t valid;
114: uint8_t done;
115: uint8_t buffer[2048];
116: } UHCIAsync;
117:
1.1 root 118: typedef struct UHCIPort {
119: USBPort port;
120: uint16_t ctrl;
121: } UHCIPort;
122:
123: typedef struct UHCIState {
124: PCIDevice dev;
125: uint16_t cmd; /* cmd register */
126: uint16_t status;
127: uint16_t intr; /* interrupt enable register */
128: uint16_t frnum; /* frame number */
129: uint32_t fl_base_addr; /* frame list base address */
130: uint8_t sof_timing;
131: uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
132: QEMUTimer *frame_timer;
133: UHCIPort ports[NB_PORTS];
1.1.1.4 root 134:
135: /* Interrupts that should be raised at the end of the current frame. */
136: uint32_t pending_int_mask;
1.1.1.6 root 137:
138: /* Active packets */
139: UHCIAsync *async_pending;
140: UHCIAsync *async_pool;
1.1 root 141: } UHCIState;
142:
143: typedef struct UHCI_TD {
144: uint32_t link;
145: uint32_t ctrl; /* see TD_CTRL_xxx */
146: uint32_t token;
147: uint32_t buffer;
148: } UHCI_TD;
149:
150: typedef struct UHCI_QH {
151: uint32_t link;
152: uint32_t el_link;
153: } UHCI_QH;
154:
1.1.1.6 root 155: static UHCIAsync *uhci_async_alloc(UHCIState *s)
156: {
157: UHCIAsync *async = qemu_malloc(sizeof(UHCIAsync));
158:
159: memset(&async->packet, 0, sizeof(async->packet));
160: async->valid = 0;
161: async->td = 0;
162: async->token = 0;
163: async->done = 0;
164: async->next = NULL;
165:
166: return async;
167: }
168:
169: static void uhci_async_free(UHCIState *s, UHCIAsync *async)
170: {
171: qemu_free(async);
172: }
173:
174: static void uhci_async_link(UHCIState *s, UHCIAsync *async)
175: {
176: async->next = s->async_pending;
177: s->async_pending = async;
178: }
179:
180: static void uhci_async_unlink(UHCIState *s, UHCIAsync *async)
181: {
182: UHCIAsync *curr = s->async_pending;
183: UHCIAsync **prev = &s->async_pending;
184:
185: while (curr) {
186: if (curr == async) {
187: *prev = curr->next;
188: return;
189: }
190:
191: prev = &curr->next;
192: curr = curr->next;
193: }
194: }
195:
196: static void uhci_async_cancel(UHCIState *s, UHCIAsync *async)
197: {
198: dprintf("uhci: cancel td 0x%x token 0x%x done %u\n",
199: async->td, async->token, async->done);
200:
201: if (!async->done)
202: usb_cancel_packet(&async->packet);
203: uhci_async_free(s, async);
204: }
205:
206: /*
207: * Mark all outstanding async packets as invalid.
208: * This is used for canceling them when TDs are removed by the HCD.
209: */
210: static UHCIAsync *uhci_async_validate_begin(UHCIState *s)
211: {
212: UHCIAsync *async = s->async_pending;
213:
214: while (async) {
215: async->valid--;
216: async = async->next;
217: }
218: return NULL;
219: }
220:
221: /*
222: * Cancel async packets that are no longer valid
223: */
224: static void uhci_async_validate_end(UHCIState *s)
225: {
226: UHCIAsync *curr = s->async_pending;
227: UHCIAsync **prev = &s->async_pending;
228: UHCIAsync *next;
229:
230: while (curr) {
231: if (curr->valid > 0) {
232: prev = &curr->next;
233: curr = curr->next;
234: continue;
235: }
236:
237: next = curr->next;
238:
239: /* Unlink */
240: *prev = next;
241:
242: uhci_async_cancel(s, curr);
243:
244: curr = next;
245: }
246: }
247:
248: static void uhci_async_cancel_all(UHCIState *s)
249: {
250: UHCIAsync *curr = s->async_pending;
251: UHCIAsync *next;
252:
253: while (curr) {
254: next = curr->next;
255:
256: uhci_async_cancel(s, curr);
257:
258: curr = next;
259: }
260:
261: s->async_pending = NULL;
262: }
263:
264: static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, uint32_t token)
265: {
266: UHCIAsync *async = s->async_pending;
267: UHCIAsync *match = NULL;
268: int count = 0;
269:
270: /*
271: * We're looking for the best match here. ie both td addr and token.
272: * Otherwise we return last good match. ie just token.
273: * It's ok to match just token because it identifies the transaction
274: * rather well, token includes: device addr, endpoint, size, etc.
275: *
276: * Also since we queue async transactions in reverse order by returning
277: * last good match we restores the order.
278: *
279: * It's expected that we wont have a ton of outstanding transactions.
280: * If we ever do we'd want to optimize this algorithm.
281: */
282:
283: while (async) {
284: if (async->token == token) {
285: /* Good match */
286: match = async;
287:
288: if (async->td == addr) {
289: /* Best match */
290: break;
291: }
292: }
293:
294: async = async->next;
295: count++;
296: }
297:
298: if (count > 64)
299: fprintf(stderr, "uhci: warning lots of async transactions\n");
300:
301: return match;
302: }
303:
1.1 root 304: static void uhci_attach(USBPort *port1, USBDevice *dev);
305:
306: static void uhci_update_irq(UHCIState *s)
307: {
308: int level;
309: if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
310: ((s->status2 & 2) && (s->intr & (1 << 3))) ||
311: ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
312: ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
313: (s->status & UHCI_STS_HSERR) ||
314: (s->status & UHCI_STS_HCPERR)) {
315: level = 1;
316: } else {
317: level = 0;
318: }
1.1.1.5 root 319: qemu_set_irq(s->dev.irq[3], level);
1.1 root 320: }
321:
1.1.1.7 ! root 322: static void uhci_reset(void *opaque)
1.1 root 323: {
1.1.1.7 ! root 324: UHCIState *s = opaque;
1.1 root 325: uint8_t *pci_conf;
326: int i;
327: UHCIPort *port;
328:
1.1.1.6 root 329: dprintf("uhci: full reset\n");
330:
1.1 root 331: pci_conf = s->dev.config;
332:
333: pci_conf[0x6a] = 0x01; /* usb clock */
334: pci_conf[0x6b] = 0x00;
335: s->cmd = 0;
336: s->status = 0;
337: s->status2 = 0;
338: s->intr = 0;
339: s->fl_base_addr = 0;
340: s->sof_timing = 64;
1.1.1.6 root 341:
1.1 root 342: for(i = 0; i < NB_PORTS; i++) {
343: port = &s->ports[i];
344: port->ctrl = 0x0080;
345: if (port->port.dev)
346: uhci_attach(&port->port, port->port.dev);
347: }
1.1.1.6 root 348:
349: uhci_async_cancel_all(s);
1.1 root 350: }
351:
1.1.1.5 root 352: static void uhci_save(QEMUFile *f, void *opaque)
353: {
354: UHCIState *s = opaque;
355: uint8_t num_ports = NB_PORTS;
356: int i;
357:
1.1.1.6 root 358: uhci_async_cancel_all(s);
359:
1.1.1.5 root 360: pci_device_save(&s->dev, f);
361:
362: qemu_put_8s(f, &num_ports);
363: for (i = 0; i < num_ports; ++i)
364: qemu_put_be16s(f, &s->ports[i].ctrl);
365: qemu_put_be16s(f, &s->cmd);
366: qemu_put_be16s(f, &s->status);
367: qemu_put_be16s(f, &s->intr);
368: qemu_put_be16s(f, &s->frnum);
369: qemu_put_be32s(f, &s->fl_base_addr);
370: qemu_put_8s(f, &s->sof_timing);
371: qemu_put_8s(f, &s->status2);
372: qemu_put_timer(f, s->frame_timer);
373: }
374:
375: static int uhci_load(QEMUFile *f, void *opaque, int version_id)
376: {
377: UHCIState *s = opaque;
378: uint8_t num_ports;
379: int i, ret;
380:
381: if (version_id > 1)
382: return -EINVAL;
383:
384: ret = pci_device_load(&s->dev, f);
385: if (ret < 0)
386: return ret;
387:
388: qemu_get_8s(f, &num_ports);
389: if (num_ports != NB_PORTS)
390: return -EINVAL;
391:
392: for (i = 0; i < num_ports; ++i)
393: qemu_get_be16s(f, &s->ports[i].ctrl);
394: qemu_get_be16s(f, &s->cmd);
395: qemu_get_be16s(f, &s->status);
396: qemu_get_be16s(f, &s->intr);
397: qemu_get_be16s(f, &s->frnum);
398: qemu_get_be32s(f, &s->fl_base_addr);
399: qemu_get_8s(f, &s->sof_timing);
400: qemu_get_8s(f, &s->status2);
401: qemu_get_timer(f, s->frame_timer);
402:
403: return 0;
404: }
405:
1.1 root 406: static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
407: {
408: UHCIState *s = opaque;
1.1.1.5 root 409:
1.1 root 410: addr &= 0x1f;
411: switch(addr) {
412: case 0x0c:
413: s->sof_timing = val;
414: break;
415: }
416: }
417:
418: static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
419: {
420: UHCIState *s = opaque;
421: uint32_t val;
422:
423: addr &= 0x1f;
424: switch(addr) {
425: case 0x0c:
426: val = s->sof_timing;
1.1.1.2 root 427: break;
1.1 root 428: default:
429: val = 0xff;
430: break;
431: }
432: return val;
433: }
434:
435: static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
436: {
437: UHCIState *s = opaque;
1.1.1.5 root 438:
1.1 root 439: addr &= 0x1f;
1.1.1.6 root 440: dprintf("uhci: writew port=0x%04x val=0x%04x\n", addr, val);
441:
1.1 root 442: switch(addr) {
443: case 0x00:
444: if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
445: /* start frame processing */
446: qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
1.1.1.2 root 447: s->status &= ~UHCI_STS_HCHALTED;
448: } else if (!(val & UHCI_CMD_RS)) {
449: s->status |= UHCI_STS_HCHALTED;
1.1 root 450: }
451: if (val & UHCI_CMD_GRESET) {
452: UHCIPort *port;
453: USBDevice *dev;
454: int i;
455:
456: /* send reset on the USB bus */
457: for(i = 0; i < NB_PORTS; i++) {
458: port = &s->ports[i];
459: dev = port->port.dev;
460: if (dev) {
1.1.1.4 root 461: usb_send_msg(dev, USB_MSG_RESET);
1.1 root 462: }
463: }
464: uhci_reset(s);
465: return;
466: }
467: if (val & UHCI_CMD_HCRESET) {
468: uhci_reset(s);
469: return;
470: }
471: s->cmd = val;
472: break;
473: case 0x02:
474: s->status &= ~val;
475: /* XXX: the chip spec is not coherent, so we add a hidden
476: register to distinguish between IOC and SPD */
477: if (val & UHCI_STS_USBINT)
478: s->status2 = 0;
479: uhci_update_irq(s);
480: break;
481: case 0x04:
482: s->intr = val;
483: uhci_update_irq(s);
484: break;
485: case 0x06:
486: if (s->status & UHCI_STS_HCHALTED)
487: s->frnum = val & 0x7ff;
488: break;
489: case 0x10 ... 0x1f:
490: {
491: UHCIPort *port;
492: USBDevice *dev;
493: int n;
494:
495: n = (addr >> 1) & 7;
496: if (n >= NB_PORTS)
497: return;
498: port = &s->ports[n];
499: dev = port->port.dev;
500: if (dev) {
501: /* port reset */
1.1.1.5 root 502: if ( (val & UHCI_PORT_RESET) &&
1.1 root 503: !(port->ctrl & UHCI_PORT_RESET) ) {
1.1.1.4 root 504: usb_send_msg(dev, USB_MSG_RESET);
1.1 root 505: }
506: }
507: port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
508: /* some bits are reset when a '1' is written to them */
509: port->ctrl &= ~(val & 0x000a);
510: }
511: break;
512: }
513: }
514:
515: static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
516: {
517: UHCIState *s = opaque;
518: uint32_t val;
519:
520: addr &= 0x1f;
521: switch(addr) {
522: case 0x00:
523: val = s->cmd;
524: break;
525: case 0x02:
526: val = s->status;
527: break;
528: case 0x04:
529: val = s->intr;
530: break;
531: case 0x06:
532: val = s->frnum;
533: break;
534: case 0x10 ... 0x1f:
535: {
536: UHCIPort *port;
537: int n;
538: n = (addr >> 1) & 7;
1.1.1.5 root 539: if (n >= NB_PORTS)
1.1 root 540: goto read_default;
541: port = &s->ports[n];
542: val = port->ctrl;
543: }
544: break;
545: default:
546: read_default:
547: val = 0xff7f; /* disabled port */
548: break;
549: }
1.1.1.6 root 550:
551: dprintf("uhci: readw port=0x%04x val=0x%04x\n", addr, val);
552:
1.1 root 553: return val;
554: }
555:
556: static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
557: {
558: UHCIState *s = opaque;
559:
560: addr &= 0x1f;
1.1.1.6 root 561: dprintf("uhci: writel port=0x%04x val=0x%08x\n", addr, val);
562:
1.1 root 563: switch(addr) {
564: case 0x08:
565: s->fl_base_addr = val & ~0xfff;
566: break;
567: }
568: }
569:
570: static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
571: {
572: UHCIState *s = opaque;
573: uint32_t val;
574:
575: addr &= 0x1f;
576: switch(addr) {
577: case 0x08:
578: val = s->fl_base_addr;
579: break;
580: default:
581: val = 0xffffffff;
582: break;
583: }
584: return val;
585: }
586:
1.1.1.5 root 587: /* signal resume if controller suspended */
588: static void uhci_resume (void *opaque)
589: {
590: UHCIState *s = (UHCIState *)opaque;
591:
592: if (!s)
593: return;
594:
595: if (s->cmd & UHCI_CMD_EGSM) {
596: s->cmd |= UHCI_CMD_FGR;
597: s->status |= UHCI_STS_RD;
598: uhci_update_irq(s);
599: }
600: }
601:
1.1 root 602: static void uhci_attach(USBPort *port1, USBDevice *dev)
603: {
604: UHCIState *s = port1->opaque;
605: UHCIPort *port = &s->ports[port1->index];
606:
607: if (dev) {
608: if (port->port.dev) {
609: usb_attach(port1, NULL);
610: }
611: /* set connect status */
1.1.1.3 root 612: port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
613:
1.1 root 614: /* update speed */
615: if (dev->speed == USB_SPEED_LOW)
616: port->ctrl |= UHCI_PORT_LSDA;
617: else
618: port->ctrl &= ~UHCI_PORT_LSDA;
1.1.1.5 root 619:
620: uhci_resume(s);
621:
1.1 root 622: port->port.dev = dev;
623: /* send the attach message */
1.1.1.4 root 624: usb_send_msg(dev, USB_MSG_ATTACH);
1.1 root 625: } else {
626: /* set connect status */
1.1.1.3 root 627: if (port->ctrl & UHCI_PORT_CCS) {
628: port->ctrl &= ~UHCI_PORT_CCS;
629: port->ctrl |= UHCI_PORT_CSC;
1.1 root 630: }
631: /* disable port */
632: if (port->ctrl & UHCI_PORT_EN) {
633: port->ctrl &= ~UHCI_PORT_EN;
634: port->ctrl |= UHCI_PORT_ENC;
635: }
1.1.1.5 root 636:
637: uhci_resume(s);
638:
1.1 root 639: dev = port->port.dev;
640: if (dev) {
641: /* send the detach message */
1.1.1.4 root 642: usb_send_msg(dev, USB_MSG_DETACH);
1.1 root 643: }
644: port->port.dev = NULL;
645: }
646: }
647:
1.1.1.4 root 648: static int uhci_broadcast_packet(UHCIState *s, USBPacket *p)
1.1 root 649: {
650: int i, ret;
651:
1.1.1.6 root 652: dprintf("uhci: packet enter. pid %s addr 0x%02x ep %d len %d\n",
653: pid2str(p->pid), p->devaddr, p->devep, p->len);
654: if (p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_SETUP)
655: dump_data(p->data, p->len);
656:
657: ret = USB_RET_NODEV;
658: for (i = 0; i < NB_PORTS && ret == USB_RET_NODEV; i++) {
659: UHCIPort *port = &s->ports[i];
660: USBDevice *dev = port->port.dev;
661:
662: if (dev && (port->ctrl & UHCI_PORT_EN))
1.1.1.4 root 663: ret = dev->handle_packet(dev, p);
1.1 root 664: }
1.1.1.6 root 665:
666: dprintf("uhci: packet exit. ret %d len %d\n", ret, p->len);
667: if (p->pid == USB_TOKEN_IN && ret > 0)
668: dump_data(p->data, ret);
669:
670: return ret;
1.1 root 671: }
672:
1.1.1.6 root 673: static void uhci_async_complete(USBPacket * packet, void *opaque);
674: static void uhci_process_frame(UHCIState *s);
1.1.1.4 root 675:
1.1 root 676: /* return -1 if fatal error (frame must be stopped)
677: 0 if TD successful
678: 1 if TD unsuccessful or inactive
679: */
1.1.1.6 root 680: static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
1.1 root 681: {
1.1.1.6 root 682: int len = 0, max_len, err, ret;
1.1 root 683: uint8_t pid;
684:
1.1.1.6 root 685: max_len = ((td->token >> 21) + 1) & 0x7ff;
686: pid = td->token & 0xff;
687:
688: ret = async->packet.len;
689:
690: if (td->ctrl & TD_CTRL_IOC)
1.1 root 691: *int_mask |= 0x01;
1.1.1.5 root 692:
1.1.1.6 root 693: if (td->ctrl & TD_CTRL_IOS)
694: td->ctrl &= ~TD_CTRL_ACTIVE;
1.1 root 695:
1.1.1.6 root 696: if (ret < 0)
697: goto out;
1.1.1.5 root 698:
1.1.1.6 root 699: len = async->packet.len;
700: td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
701:
702: /* The NAK bit may have been set by a previous frame, so clear it
703: here. The docs are somewhat unclear, but win2k relies on this
704: behavior. */
705: td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
706:
707: if (pid == USB_TOKEN_IN) {
708: if (len > max_len) {
1.1.1.4 root 709: len = max_len;
1.1.1.6 root 710: ret = USB_RET_BABBLE;
711: goto out;
1.1.1.4 root 712: }
1.1.1.5 root 713:
1.1.1.6 root 714: if (len > 0) {
715: /* write the data back */
716: cpu_physical_memory_write(td->buffer, async->buffer, len);
717: }
718:
719: if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
1.1 root 720: *int_mask |= 0x02;
721: /* short packet: do not update QH */
1.1.1.6 root 722: dprintf("uhci: short packet. td 0x%x token 0x%x\n", async->td, async->token);
1.1 root 723: return 1;
724: }
1.1.1.6 root 725: }
726:
727: /* success */
728: return 0;
729:
730: out:
731: switch(ret) {
732: case USB_RET_STALL:
733: td->ctrl |= TD_CTRL_STALL;
734: td->ctrl &= ~TD_CTRL_ACTIVE;
735: return 1;
736:
737: case USB_RET_BABBLE:
738: td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
739: td->ctrl &= ~TD_CTRL_ACTIVE;
740: /* frame interrupted */
741: return -1;
742:
743: case USB_RET_NAK:
744: td->ctrl |= TD_CTRL_NAK;
745: if (pid == USB_TOKEN_SETUP)
746: break;
747: return 1;
748:
749: case USB_RET_NODEV:
750: default:
751: break;
752: }
753:
754: /* Retry the TD if error count is not zero */
755:
756: td->ctrl |= TD_CTRL_TIMEOUT;
757: err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
758: if (err != 0) {
759: err--;
760: if (err == 0) {
1.1 root 761: td->ctrl &= ~TD_CTRL_ACTIVE;
1.1.1.6 root 762: s->status |= UHCI_STS_USBERR;
763: uhci_update_irq(s);
1.1 root 764: }
765: }
1.1.1.6 root 766: td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
767: (err << TD_CTRL_ERROR_SHIFT);
768: return 1;
1.1 root 769: }
770:
1.1.1.6 root 771: static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td, uint32_t *int_mask)
772: {
773: UHCIAsync *async;
774: int len = 0, max_len;
775: uint8_t pid;
776:
777: /* Is active ? */
778: if (!(td->ctrl & TD_CTRL_ACTIVE))
779: return 1;
780:
781: async = uhci_async_find_td(s, addr, td->token);
782: if (async) {
783: /* Already submitted */
784: async->valid = 32;
785:
786: if (!async->done)
787: return 1;
788:
789: uhci_async_unlink(s, async);
790: goto done;
791: }
792:
793: /* Allocate new packet */
794: async = uhci_async_alloc(s);
795: if (!async)
796: return 1;
797:
798: async->valid = 10;
799: async->td = addr;
800: async->token = td->token;
801:
802: max_len = ((td->token >> 21) + 1) & 0x7ff;
803: pid = td->token & 0xff;
804:
805: async->packet.pid = pid;
806: async->packet.devaddr = (td->token >> 8) & 0x7f;
807: async->packet.devep = (td->token >> 15) & 0xf;
808: async->packet.data = async->buffer;
809: async->packet.len = max_len;
810: async->packet.complete_cb = uhci_async_complete;
811: async->packet.complete_opaque = s;
812:
813: switch(pid) {
814: case USB_TOKEN_OUT:
815: case USB_TOKEN_SETUP:
816: cpu_physical_memory_read(td->buffer, async->buffer, max_len);
817: len = uhci_broadcast_packet(s, &async->packet);
818: if (len >= 0)
819: len = max_len;
820: break;
821:
822: case USB_TOKEN_IN:
823: len = uhci_broadcast_packet(s, &async->packet);
824: break;
825:
826: default:
827: /* invalid pid : frame interrupted */
828: uhci_async_free(s, async);
829: s->status |= UHCI_STS_HCPERR;
830: uhci_update_irq(s);
831: return -1;
832: }
833:
834: if (len == USB_RET_ASYNC) {
835: uhci_async_link(s, async);
836: return 2;
837: }
838:
839: async->packet.len = len;
840:
841: done:
842: len = uhci_complete_td(s, td, async, int_mask);
843: uhci_async_free(s, async);
844: return len;
845: }
846:
847: static void uhci_async_complete(USBPacket *packet, void *opaque)
1.1.1.4 root 848: {
849: UHCIState *s = opaque;
1.1.1.6 root 850: UHCIAsync *async = (UHCIAsync *) packet;
851:
852: dprintf("uhci: async complete. td 0x%x token 0x%x\n", async->td, async->token);
853:
854: async->done = 1;
855:
856: uhci_process_frame(s);
857: }
858:
859: static int is_valid(uint32_t link)
860: {
861: return (link & 1) == 0;
862: }
863:
864: static int is_qh(uint32_t link)
865: {
866: return (link & 2) != 0;
867: }
868:
869: static int depth_first(uint32_t link)
870: {
871: return (link & 4) != 0;
872: }
873:
874: /* QH DB used for detecting QH loops */
875: #define UHCI_MAX_QUEUES 128
876: typedef struct {
877: uint32_t addr[UHCI_MAX_QUEUES];
878: int count;
879: } QhDb;
880:
881: static void qhdb_reset(QhDb *db)
882: {
883: db->count = 0;
884: }
885:
886: /* Add QH to DB. Returns 1 if already present or DB is full. */
887: static int qhdb_insert(QhDb *db, uint32_t addr)
888: {
889: int i;
890: for (i = 0; i < db->count; i++)
891: if (db->addr[i] == addr)
892: return 1;
893:
894: if (db->count >= UHCI_MAX_QUEUES)
895: return 1;
896:
897: db->addr[db->count++] = addr;
898: return 0;
899: }
900:
901: static void uhci_process_frame(UHCIState *s)
902: {
903: uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
904: uint32_t curr_qh;
905: int cnt, ret;
1.1.1.4 root 906: UHCI_TD td;
1.1.1.6 root 907: UHCI_QH qh;
908: QhDb qhdb;
909:
910: frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
911:
912: dprintf("uhci: processing frame %d addr 0x%x\n" , s->frnum, frame_addr);
913:
914: cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
915: le32_to_cpus(&link);
916:
917: int_mask = 0;
918: curr_qh = 0;
919:
920: qhdb_reset(&qhdb);
921:
922: for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
923: if (is_qh(link)) {
924: /* QH */
925:
926: if (qhdb_insert(&qhdb, link)) {
927: /*
928: * We're going in circles. Which is not a bug because
929: * HCD is allowed to do that as part of the BW management.
930: * In our case though it makes no sense to spin here. Sync transations
931: * are already done, and async completion handler will re-process
932: * the frame when something is ready.
933: */
934: dprintf("uhci: detected loop. qh 0x%x\n", link);
935: break;
936: }
937:
938: cpu_physical_memory_read(link & ~0xf, (uint8_t *) &qh, sizeof(qh));
939: le32_to_cpus(&qh.link);
940: le32_to_cpus(&qh.el_link);
941:
942: dprintf("uhci: QH 0x%x load. link 0x%x elink 0x%x\n",
943: link, qh.link, qh.el_link);
1.1.1.4 root 944:
1.1.1.6 root 945: if (!is_valid(qh.el_link)) {
946: /* QH w/o elements */
947: curr_qh = 0;
948: link = qh.link;
949: } else {
950: /* QH with elements */
951: curr_qh = link;
952: link = qh.el_link;
953: }
954: continue;
955: }
1.1.1.5 root 956:
1.1.1.6 root 957: /* TD */
958: cpu_physical_memory_read(link & ~0xf, (uint8_t *) &td, sizeof(td));
1.1.1.5 root 959: le32_to_cpus(&td.link);
960: le32_to_cpus(&td.ctrl);
961: le32_to_cpus(&td.token);
962: le32_to_cpus(&td.buffer);
963:
1.1.1.6 root 964: dprintf("uhci: TD 0x%x load. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
965: link, td.link, td.ctrl, td.token, curr_qh);
966:
967: old_td_ctrl = td.ctrl;
968: ret = uhci_handle_td(s, link, &td, &int_mask);
1.1.1.5 root 969: if (old_td_ctrl != td.ctrl) {
1.1.1.6 root 970: /* update the status bits of the TD */
1.1.1.5 root 971: val = cpu_to_le32(td.ctrl);
972: cpu_physical_memory_write((link & ~0xf) + 4,
1.1.1.6 root 973: (const uint8_t *)&val, sizeof(val));
1.1.1.5 root 974: }
1.1.1.6 root 975:
976: if (ret < 0) {
977: /* interrupted frame */
978: break;
1.1.1.5 root 979: }
980:
1.1.1.6 root 981: if (ret == 2 || ret == 1) {
982: dprintf("uhci: TD 0x%x %s. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
983: link, ret == 2 ? "pend" : "skip",
984: td.link, td.ctrl, td.token, curr_qh);
1.1.1.5 root 985:
1.1.1.6 root 986: link = curr_qh ? qh.link : td.link;
987: continue;
988: }
989:
990: /* completed TD */
991:
992: dprintf("uhci: TD 0x%x done. link 0x%x ctrl 0x%x token 0x%x qh 0x%x\n",
993: link, td.link, td.ctrl, td.token, curr_qh);
994:
995: link = td.link;
996:
997: if (curr_qh) {
998: /* update QH element link */
999: qh.el_link = link;
1.1.1.4 root 1000: val = cpu_to_le32(qh.el_link);
1.1.1.6 root 1001: cpu_physical_memory_write((curr_qh & ~0xf) + 4,
1002: (const uint8_t *)&val, sizeof(val));
1003:
1004: if (!depth_first(link)) {
1005: /* done with this QH */
1006:
1007: dprintf("uhci: QH 0x%x done. link 0x%x elink 0x%x\n",
1008: curr_qh, qh.link, qh.el_link);
1009:
1010: curr_qh = 0;
1011: link = qh.link;
1012: }
1.1.1.4 root 1013: }
1.1.1.6 root 1014:
1015: /* go to the next entry */
1.1.1.4 root 1016: }
1.1.1.6 root 1017:
1018: s->pending_int_mask = int_mask;
1.1.1.4 root 1019: }
1020:
1.1 root 1021: static void uhci_frame_timer(void *opaque)
1022: {
1023: UHCIState *s = opaque;
1024: int64_t expire_time;
1025:
1026: if (!(s->cmd & UHCI_CMD_RS)) {
1.1.1.6 root 1027: /* Full stop */
1.1 root 1028: qemu_del_timer(s->frame_timer);
1.1.1.2 root 1029: /* set hchalted bit in status - UHCI11D 2.1.2 */
1030: s->status |= UHCI_STS_HCHALTED;
1.1.1.6 root 1031:
1032: dprintf("uhci: halted\n");
1.1 root 1033: return;
1034: }
1.1.1.6 root 1035:
1036: /* Complete the previous frame */
1.1.1.4 root 1037: if (s->pending_int_mask) {
1038: s->status2 |= s->pending_int_mask;
1.1.1.6 root 1039: s->status |= UHCI_STS_USBINT;
1.1.1.4 root 1040: uhci_update_irq(s);
1041: }
1.1.1.5 root 1042:
1.1.1.6 root 1043: /* Start new frame */
1044: s->frnum = (s->frnum + 1) & 0x7ff;
1045:
1046: dprintf("uhci: new frame #%u\n" , s->frnum);
1047:
1048: uhci_async_validate_begin(s);
1049:
1050: uhci_process_frame(s);
1051:
1052: uhci_async_validate_end(s);
1.1.1.5 root 1053:
1.1 root 1054: /* prepare the timer for the next frame */
1.1.1.5 root 1055: expire_time = qemu_get_clock(vm_clock) +
1.1 root 1056: (ticks_per_sec / FRAME_TIMER_FREQ);
1057: qemu_mod_timer(s->frame_timer, expire_time);
1058: }
1059:
1.1.1.5 root 1060: static void uhci_map(PCIDevice *pci_dev, int region_num,
1.1 root 1061: uint32_t addr, uint32_t size, int type)
1062: {
1063: UHCIState *s = (UHCIState *)pci_dev;
1064:
1065: register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
1066: register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
1067: register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
1068: register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
1069: register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
1070: register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
1071: }
1072:
1.1.1.5 root 1073: void usb_uhci_piix3_init(PCIBus *bus, int devfn)
1.1 root 1074: {
1075: UHCIState *s;
1076: uint8_t *pci_conf;
1077: int i;
1078:
1079: s = (UHCIState *)pci_register_device(bus,
1080: "USB-UHCI", sizeof(UHCIState),
1.1.1.3 root 1081: devfn, NULL, NULL);
1.1 root 1082: pci_conf = s->dev.config;
1.1.1.6 root 1083: pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1084: pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_2);
1.1 root 1085: pci_conf[0x08] = 0x01; // revision number
1086: pci_conf[0x09] = 0x00;
1.1.1.6 root 1087: pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1.1.1.7 ! root 1088: pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1.1 root 1089: pci_conf[0x3d] = 4; // interrupt pin 3
1.1.1.2 root 1090: pci_conf[0x60] = 0x10; // release number
1.1.1.5 root 1091:
1092: for(i = 0; i < NB_PORTS; i++) {
1093: qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1094: }
1095: s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1096:
1.1.1.7 ! root 1097: qemu_register_reset(uhci_reset, s);
1.1.1.5 root 1098: uhci_reset(s);
1099:
1100: /* Use region 4 for consistency with real hardware. BSD guests seem
1101: to rely on this. */
1.1.1.7 ! root 1102: pci_register_bar(&s->dev, 4, 0x20,
1.1.1.5 root 1103: PCI_ADDRESS_SPACE_IO, uhci_map);
1.1.1.6 root 1104:
1105: register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1.1.1.5 root 1106: }
1107:
1108: void usb_uhci_piix4_init(PCIBus *bus, int devfn)
1109: {
1110: UHCIState *s;
1111: uint8_t *pci_conf;
1112: int i;
1113:
1114: s = (UHCIState *)pci_register_device(bus,
1115: "USB-UHCI", sizeof(UHCIState),
1116: devfn, NULL, NULL);
1117: pci_conf = s->dev.config;
1.1.1.6 root 1118: pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
1119: pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB_2);
1.1.1.5 root 1120: pci_conf[0x08] = 0x01; // revision number
1121: pci_conf[0x09] = 0x00;
1.1.1.6 root 1122: pci_config_set_class(pci_conf, PCI_CLASS_SERIAL_USB);
1.1.1.7 ! root 1123: pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
1.1.1.5 root 1124: pci_conf[0x3d] = 4; // interrupt pin 3
1125: pci_conf[0x60] = 0x10; // release number
1126:
1.1 root 1127: for(i = 0; i < NB_PORTS; i++) {
1.1.1.3 root 1128: qemu_register_usb_port(&s->ports[i].port, s, i, uhci_attach);
1.1 root 1129: }
1130: s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
1131:
1.1.1.7 ! root 1132: qemu_register_reset(uhci_reset, s);
1.1 root 1133: uhci_reset(s);
1134:
1.1.1.2 root 1135: /* Use region 4 for consistency with real hardware. BSD guests seem
1136: to rely on this. */
1.1.1.7 ! root 1137: pci_register_bar(&s->dev, 4, 0x20,
1.1 root 1138: PCI_ADDRESS_SPACE_IO, uhci_map);
1.1.1.6 root 1139:
1140: register_savevm("uhci", 0, 1, uhci_save, uhci_load, s);
1.1 root 1141: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.