2 * USB UHCI controller emulation
4 * Copyright (c) 2005 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 //#define DEBUG_PACKET
29 #define UHCI_CMD_GRESET (1 << 2)
30 #define UHCI_CMD_HCRESET (1 << 1)
31 #define UHCI_CMD_RS (1 << 0)
33 #define UHCI_STS_HCHALTED (1 << 5)
34 #define UHCI_STS_HCPERR (1 << 4)
35 #define UHCI_STS_HSERR (1 << 3)
36 #define UHCI_STS_RD (1 << 2)
37 #define UHCI_STS_USBERR (1 << 1)
38 #define UHCI_STS_USBINT (1 << 0)
40 #define TD_CTRL_SPD (1 << 29)
41 #define TD_CTRL_ERROR_SHIFT 27
42 #define TD_CTRL_IOS (1 << 25)
43 #define TD_CTRL_IOC (1 << 24)
44 #define TD_CTRL_ACTIVE (1 << 23)
45 #define TD_CTRL_STALL (1 << 22)
46 #define TD_CTRL_BABBLE (1 << 20)
47 #define TD_CTRL_NAK (1 << 19)
48 #define TD_CTRL_TIMEOUT (1 << 18)
50 #define UHCI_PORT_RESET (1 << 9)
51 #define UHCI_PORT_LSDA (1 << 8)
52 #define UHCI_PORT_ENC (1 << 3)
53 #define UHCI_PORT_EN (1 << 2)
54 #define UHCI_PORT_CSC (1 << 1)
55 #define UHCI_PORT_CCS (1 << 0)
57 #define FRAME_TIMER_FREQ 1000
59 #define FRAME_MAX_LOOPS 100
63 typedef struct UHCIPort {
68 typedef struct UHCIState {
70 uint16_t cmd; /* cmd register */
72 uint16_t intr; /* interrupt enable register */
73 uint16_t frnum; /* frame number */
74 uint32_t fl_base_addr; /* frame list base address */
76 uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
77 QEMUTimer *frame_timer;
78 UHCIPort ports[NB_PORTS];
81 typedef struct UHCI_TD {
83 uint32_t ctrl; /* see TD_CTRL_xxx */
88 typedef struct UHCI_QH {
93 static void uhci_attach(USBPort *port1, USBDevice *dev);
95 static void uhci_update_irq(UHCIState *s)
98 if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
99 ((s->status2 & 2) && (s->intr & (1 << 3))) ||
100 ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
101 ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
102 (s->status & UHCI_STS_HSERR) ||
103 (s->status & UHCI_STS_HCPERR)) {
108 pci_set_irq(&s->dev, 3, level);
111 static void uhci_reset(UHCIState *s)
117 pci_conf = s->dev.config;
119 pci_conf[0x6a] = 0x01; /* usb clock */
120 pci_conf[0x6b] = 0x00;
127 for(i = 0; i < NB_PORTS; i++) {
131 uhci_attach(&port->port, port->port.dev);
135 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
137 UHCIState *s = opaque;
147 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
149 UHCIState *s = opaque;
163 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
165 UHCIState *s = opaque;
169 printf("uhci writew port=0x%04x val=0x%04x\n", addr, val);
173 if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
174 /* start frame processing */
175 qemu_mod_timer(s->frame_timer, qemu_get_clock(vm_clock));
177 if (val & UHCI_CMD_GRESET) {
182 /* send reset on the USB bus */
183 for(i = 0; i < NB_PORTS; i++) {
185 dev = port->port.dev;
187 dev->handle_packet(dev,
188 USB_MSG_RESET, 0, 0, NULL, 0);
194 if (val & UHCI_CMD_HCRESET) {
202 /* XXX: the chip spec is not coherent, so we add a hidden
203 register to distinguish between IOC and SPD */
204 if (val & UHCI_STS_USBINT)
213 if (s->status & UHCI_STS_HCHALTED)
214 s->frnum = val & 0x7ff;
226 dev = port->port.dev;
229 if ( (val & UHCI_PORT_RESET) &&
230 !(port->ctrl & UHCI_PORT_RESET) ) {
231 dev->handle_packet(dev,
232 USB_MSG_RESET, 0, 0, NULL, 0);
235 port->ctrl = (port->ctrl & 0x01fb) | (val & ~0x01fb);
236 /* some bits are reset when a '1' is written to them */
237 port->ctrl &= ~(val & 0x000a);
243 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
245 UHCIState *s = opaque;
275 val = 0xff7f; /* disabled port */
279 printf("uhci readw port=0x%04x val=0x%04x\n", addr, val);
284 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
286 UHCIState *s = opaque;
290 printf("uhci writel port=0x%04x val=0x%08x\n", addr, val);
294 s->fl_base_addr = val & ~0xfff;
299 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
301 UHCIState *s = opaque;
307 val = s->fl_base_addr;
316 static void uhci_attach(USBPort *port1, USBDevice *dev)
318 UHCIState *s = port1->opaque;
319 UHCIPort *port = &s->ports[port1->index];
322 if (port->port.dev) {
323 usb_attach(port1, NULL);
325 /* set connect status */
326 if (!(port->ctrl & UHCI_PORT_CCS)) {
327 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
330 if (dev->speed == USB_SPEED_LOW)
331 port->ctrl |= UHCI_PORT_LSDA;
333 port->ctrl &= ~UHCI_PORT_LSDA;
334 port->port.dev = dev;
335 /* send the attach message */
336 dev->handle_packet(dev,
337 USB_MSG_ATTACH, 0, 0, NULL, 0);
339 /* set connect status */
340 if (!(port->ctrl & UHCI_PORT_CCS)) {
341 port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
344 if (port->ctrl & UHCI_PORT_EN) {
345 port->ctrl &= ~UHCI_PORT_EN;
346 port->ctrl |= UHCI_PORT_ENC;
348 dev = port->port.dev;
350 /* send the detach message */
351 dev->handle_packet(dev,
352 USB_MSG_DETACH, 0, 0, NULL, 0);
354 port->port.dev = NULL;
358 static int uhci_broadcast_packet(UHCIState *s, uint8_t pid,
359 uint8_t devaddr, uint8_t devep,
360 uint8_t *data, int len)
370 case USB_TOKEN_SETUP: pidstr = "SETUP"; break;
371 case USB_TOKEN_IN: pidstr = "IN"; break;
372 case USB_TOKEN_OUT: pidstr = "OUT"; break;
373 default: pidstr = "?"; break;
375 printf("frame %d: pid=%s addr=0x%02x ep=%d len=%d\n",
376 s->frnum, pidstr, devaddr, devep, len);
377 if (pid != USB_TOKEN_IN) {
378 printf(" data_out=");
379 for(i = 0; i < len; i++) {
380 printf(" %02x", data[i]);
386 for(i = 0; i < NB_PORTS; i++) {
388 dev = port->port.dev;
389 if (dev && (port->ctrl & UHCI_PORT_EN)) {
390 ret = dev->handle_packet(dev, pid,
393 if (ret != USB_RET_NODEV) {
396 printf(" ret=%d ", ret);
397 if (pid == USB_TOKEN_IN && ret > 0) {
399 for(i = 0; i < ret; i++) {
400 printf(" %02x", data[i]);
410 return USB_RET_NODEV;
413 /* return -1 if fatal error (frame must be stopped)
415 1 if TD unsuccessful or inactive
417 static int uhci_handle_td(UHCIState *s, UHCI_TD *td, int *int_mask)
421 int len, max_len, err, ret;
423 if (td->ctrl & TD_CTRL_IOC) {
427 if (!(td->ctrl & TD_CTRL_ACTIVE))
431 max_len = ((td->token >> 21) + 1) & 0x7ff;
432 pid = td->token & 0xff;
435 case USB_TOKEN_SETUP:
436 cpu_physical_memory_read(td->buffer, buf, max_len);
437 ret = uhci_broadcast_packet(s, pid,
438 (td->token >> 8) & 0x7f,
439 (td->token >> 15) & 0xf,
444 ret = uhci_broadcast_packet(s, pid,
445 (td->token >> 8) & 0x7f,
446 (td->token >> 15) & 0xf,
452 ret = USB_RET_BABBLE;
455 /* write the data back */
456 cpu_physical_memory_write(td->buffer, buf, len);
463 /* invalid pid : frame interrupted */
464 s->status |= UHCI_STS_HCPERR;
468 if (td->ctrl & TD_CTRL_IOS)
469 td->ctrl &= ~TD_CTRL_ACTIVE;
471 td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
472 td->ctrl &= ~TD_CTRL_ACTIVE;
473 if (pid == USB_TOKEN_IN &&
474 (td->ctrl & TD_CTRL_SPD) &&
477 /* short packet: do not update QH */
488 td->ctrl |= TD_CTRL_TIMEOUT;
489 err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
493 td->ctrl &= ~TD_CTRL_ACTIVE;
494 s->status |= UHCI_STS_USBERR;
498 td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
499 (err << TD_CTRL_ERROR_SHIFT);
502 td->ctrl |= TD_CTRL_NAK;
503 if (pid == USB_TOKEN_SETUP)
507 td->ctrl |= TD_CTRL_STALL;
508 td->ctrl &= ~TD_CTRL_ACTIVE;
511 td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
512 td->ctrl &= ~TD_CTRL_ACTIVE;
513 /* frame interrupted */
519 static void uhci_frame_timer(void *opaque)
521 UHCIState *s = opaque;
523 uint32_t frame_addr, link, old_td_ctrl, val;
524 int int_mask, cnt, ret;
528 if (!(s->cmd & UHCI_CMD_RS)) {
529 qemu_del_timer(s->frame_timer);
532 frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
533 cpu_physical_memory_read(frame_addr, (uint8_t *)&link, 4);
536 cnt = FRAME_MAX_LOOPS;
537 while ((link & 1) == 0) {
543 cpu_physical_memory_read(link & ~0xf, (uint8_t *)&qh, sizeof(qh));
544 le32_to_cpus(&qh.link);
545 le32_to_cpus(&qh.el_link);
547 if (qh.el_link & 1) {
548 /* no element : go to next entry */
550 } else if (qh.el_link & 2) {
557 cpu_physical_memory_read(qh.el_link & ~0xf,
558 (uint8_t *)&td, sizeof(td));
559 le32_to_cpus(&td.link);
560 le32_to_cpus(&td.ctrl);
561 le32_to_cpus(&td.token);
562 le32_to_cpus(&td.buffer);
563 old_td_ctrl = td.ctrl;
564 ret = uhci_handle_td(s, &td, &int_mask);
565 /* update the status bits of the TD */
566 if (old_td_ctrl != td.ctrl) {
567 val = cpu_to_le32(td.ctrl);
568 cpu_physical_memory_write((qh.el_link & ~0xf) + 4,
569 (const uint8_t *)&val,
573 break; /* interrupted frame */
575 /* update qh element link */
576 qh.el_link = td.link;
577 val = cpu_to_le32(qh.el_link);
578 cpu_physical_memory_write((link & ~0xf) + 4,
579 (const uint8_t *)&val,
581 if (qh.el_link & 4) {
586 /* go to next entry */
591 cpu_physical_memory_read(link & ~0xf, (uint8_t *)&td, sizeof(td));
592 le32_to_cpus(&td.link);
593 le32_to_cpus(&td.ctrl);
594 le32_to_cpus(&td.token);
595 le32_to_cpus(&td.buffer);
596 old_td_ctrl = td.ctrl;
597 ret = uhci_handle_td(s, &td, &int_mask);
598 /* update the status bits of the TD */
599 if (old_td_ctrl != td.ctrl) {
600 val = cpu_to_le32(td.ctrl);
601 cpu_physical_memory_write((link & ~0xf) + 4,
602 (const uint8_t *)&val,
606 break; /* interrupted frame */
610 s->frnum = (s->frnum + 1) & 0x7ff;
612 s->status2 |= int_mask;
613 s->status |= UHCI_STS_USBINT;
616 /* prepare the timer for the next frame */
617 expire_time = qemu_get_clock(vm_clock) +
618 (ticks_per_sec / FRAME_TIMER_FREQ);
619 qemu_mod_timer(s->frame_timer, expire_time);
622 static void uhci_map(PCIDevice *pci_dev, int region_num,
623 uint32_t addr, uint32_t size, int type)
625 UHCIState *s = (UHCIState *)pci_dev;
627 register_ioport_write(addr, 32, 2, uhci_ioport_writew, s);
628 register_ioport_read(addr, 32, 2, uhci_ioport_readw, s);
629 register_ioport_write(addr, 32, 4, uhci_ioport_writel, s);
630 register_ioport_read(addr, 32, 4, uhci_ioport_readl, s);
631 register_ioport_write(addr, 32, 1, uhci_ioport_writeb, s);
632 register_ioport_read(addr, 32, 1, uhci_ioport_readb, s);
635 void usb_uhci_init(PCIBus *bus, USBPort **usb_ports)
642 s = (UHCIState *)pci_register_device(bus,
643 "USB-UHCI", sizeof(UHCIState),
644 ((PCIDevice *)piix3_state)->devfn + 2,
646 pci_conf = s->dev.config;
647 pci_conf[0x00] = 0x86;
648 pci_conf[0x01] = 0x80;
649 pci_conf[0x02] = 0x20;
650 pci_conf[0x03] = 0x70;
651 pci_conf[0x08] = 0x01; // revision number
652 pci_conf[0x09] = 0x00;
653 pci_conf[0x0a] = 0x03;
654 pci_conf[0x0b] = 0x0c;
655 pci_conf[0x0e] = 0x00; // header_type
656 pci_conf[0x3d] = 4; // interrupt pin 3
658 for(i = 0; i < NB_PORTS; i++) {
660 port->port.opaque = s;
661 port->port.index = i;
662 port->port.attach = uhci_attach;
663 usb_ports[i] = &port->port;
665 s->frame_timer = qemu_new_timer(vm_clock, uhci_frame_timer, s);
669 pci_register_io_region(&s->dev, 0, 0x20,
670 PCI_ADDRESS_SPACE_IO, uhci_map);