qemu/hw/usb/hcd-ohci.c
<<
>>
Prefs
   1/*
   2 * QEMU USB OHCI Emulation
   3 * Copyright (c) 2004 Gianni Tedesco
   4 * Copyright (c) 2006 CodeSourcery
   5 * Copyright (c) 2006 Openedhand Ltd.
   6 *
   7 * This library is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU Lesser General Public
   9 * License as published by the Free Software Foundation; either
  10 * version 2 of the License, or (at your option) any later version.
  11 *
  12 * This library is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 * Lesser General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU Lesser General Public
  18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19 *
  20 * TODO:
  21 *  o Isochronous transfers
  22 *  o Allocate bandwidth in frames properly
  23 *  o Disable timers when nothing needs to be done, or remove timer usage
  24 *    all together.
  25 *  o BIOS work to boot from USB storage
  26*/
  27
  28#include "qemu/osdep.h"
  29#include "hw/irq.h"
  30#include "qapi/error.h"
  31#include "qemu/module.h"
  32#include "qemu/timer.h"
  33#include "hw/usb.h"
  34#include "migration/vmstate.h"
  35#include "hw/sysbus.h"
  36#include "hw/qdev-dma.h"
  37#include "hw/qdev-properties.h"
  38#include "trace.h"
  39#include "hcd-ohci.h"
  40
  41/* This causes frames to occur 1000x slower */
  42//#define OHCI_TIME_WARP 1
  43
  44#define ED_LINK_LIMIT 32
  45
  46static int64_t usb_frame_time;
  47static int64_t usb_bit_time;
  48
  49/* Host Controller Communications Area */
  50struct ohci_hcca {
  51    uint32_t intr[32];
  52    uint16_t frame, pad;
  53    uint32_t done;
  54};
  55#define HCCA_WRITEBACK_OFFSET   offsetof(struct ohci_hcca, frame)
  56#define HCCA_WRITEBACK_SIZE     8 /* frame, pad, done */
  57
  58#define ED_WBACK_OFFSET offsetof(struct ohci_ed, head)
  59#define ED_WBACK_SIZE   4
  60
  61static void ohci_async_cancel_device(OHCIState *ohci, USBDevice *dev);
  62
  63/* Bitfields for the first word of an Endpoint Desciptor.  */
  64#define OHCI_ED_FA_SHIFT  0
  65#define OHCI_ED_FA_MASK   (0x7f<<OHCI_ED_FA_SHIFT)
  66#define OHCI_ED_EN_SHIFT  7
  67#define OHCI_ED_EN_MASK   (0xf<<OHCI_ED_EN_SHIFT)
  68#define OHCI_ED_D_SHIFT   11
  69#define OHCI_ED_D_MASK    (3<<OHCI_ED_D_SHIFT)
  70#define OHCI_ED_S         (1<<13)
  71#define OHCI_ED_K         (1<<14)
  72#define OHCI_ED_F         (1<<15)
  73#define OHCI_ED_MPS_SHIFT 16
  74#define OHCI_ED_MPS_MASK  (0x7ff<<OHCI_ED_MPS_SHIFT)
  75
  76/* Flags in the head field of an Endpoint Desciptor.  */
  77#define OHCI_ED_H         1
  78#define OHCI_ED_C         2
  79
  80/* Bitfields for the first word of a Transfer Desciptor.  */
  81#define OHCI_TD_R         (1<<18)
  82#define OHCI_TD_DP_SHIFT  19
  83#define OHCI_TD_DP_MASK   (3<<OHCI_TD_DP_SHIFT)
  84#define OHCI_TD_DI_SHIFT  21
  85#define OHCI_TD_DI_MASK   (7<<OHCI_TD_DI_SHIFT)
  86#define OHCI_TD_T0        (1<<24)
  87#define OHCI_TD_T1        (1<<25)
  88#define OHCI_TD_EC_SHIFT  26
  89#define OHCI_TD_EC_MASK   (3<<OHCI_TD_EC_SHIFT)
  90#define OHCI_TD_CC_SHIFT  28
  91#define OHCI_TD_CC_MASK   (0xf<<OHCI_TD_CC_SHIFT)
  92
  93/* Bitfields for the first word of an Isochronous Transfer Desciptor.  */
  94/* CC & DI - same as in the General Transfer Desciptor */
  95#define OHCI_TD_SF_SHIFT  0
  96#define OHCI_TD_SF_MASK   (0xffff<<OHCI_TD_SF_SHIFT)
  97#define OHCI_TD_FC_SHIFT  24
  98#define OHCI_TD_FC_MASK   (7<<OHCI_TD_FC_SHIFT)
  99
 100/* Isochronous Transfer Desciptor - Offset / PacketStatusWord */
 101#define OHCI_TD_PSW_CC_SHIFT 12
 102#define OHCI_TD_PSW_CC_MASK  (0xf<<OHCI_TD_PSW_CC_SHIFT)
 103#define OHCI_TD_PSW_SIZE_SHIFT 0
 104#define OHCI_TD_PSW_SIZE_MASK  (0xfff<<OHCI_TD_PSW_SIZE_SHIFT)
 105
 106#define OHCI_PAGE_MASK    0xfffff000
 107#define OHCI_OFFSET_MASK  0xfff
 108
 109#define OHCI_DPTR_MASK    0xfffffff0
 110
 111#define OHCI_BM(val, field) \
 112  (((val) & OHCI_##field##_MASK) >> OHCI_##field##_SHIFT)
 113
 114#define OHCI_SET_BM(val, field, newval) do { \
 115    val &= ~OHCI_##field##_MASK; \
 116    val |= ((newval) << OHCI_##field##_SHIFT) & OHCI_##field##_MASK; \
 117    } while(0)
 118
 119/* endpoint descriptor */
 120struct ohci_ed {
 121    uint32_t flags;
 122    uint32_t tail;
 123    uint32_t head;
 124    uint32_t next;
 125};
 126
 127/* General transfer descriptor */
 128struct ohci_td {
 129    uint32_t flags;
 130    uint32_t cbp;
 131    uint32_t next;
 132    uint32_t be;
 133};
 134
 135/* Isochronous transfer descriptor */
 136struct ohci_iso_td {
 137    uint32_t flags;
 138    uint32_t bp;
 139    uint32_t next;
 140    uint32_t be;
 141    uint16_t offset[8];
 142};
 143
 144#define USB_HZ                      12000000
 145
 146/* OHCI Local stuff */
 147#define OHCI_CTL_CBSR         ((1<<0)|(1<<1))
 148#define OHCI_CTL_PLE          (1<<2)
 149#define OHCI_CTL_IE           (1<<3)
 150#define OHCI_CTL_CLE          (1<<4)
 151#define OHCI_CTL_BLE          (1<<5)
 152#define OHCI_CTL_HCFS         ((1<<6)|(1<<7))
 153#define  OHCI_USB_RESET       0x00
 154#define  OHCI_USB_RESUME      0x40
 155#define  OHCI_USB_OPERATIONAL 0x80
 156#define  OHCI_USB_SUSPEND     0xc0
 157#define OHCI_CTL_IR           (1<<8)
 158#define OHCI_CTL_RWC          (1<<9)
 159#define OHCI_CTL_RWE          (1<<10)
 160
 161#define OHCI_STATUS_HCR       (1<<0)
 162#define OHCI_STATUS_CLF       (1<<1)
 163#define OHCI_STATUS_BLF       (1<<2)
 164#define OHCI_STATUS_OCR       (1<<3)
 165#define OHCI_STATUS_SOC       ((1<<6)|(1<<7))
 166
 167#define OHCI_INTR_SO          (1U<<0) /* Scheduling overrun */
 168#define OHCI_INTR_WD          (1U<<1) /* HcDoneHead writeback */
 169#define OHCI_INTR_SF          (1U<<2) /* Start of frame */
 170#define OHCI_INTR_RD          (1U<<3) /* Resume detect */
 171#define OHCI_INTR_UE          (1U<<4) /* Unrecoverable error */
 172#define OHCI_INTR_FNO         (1U<<5) /* Frame number overflow */
 173#define OHCI_INTR_RHSC        (1U<<6) /* Root hub status change */
 174#define OHCI_INTR_OC          (1U<<30) /* Ownership change */
 175#define OHCI_INTR_MIE         (1U<<31) /* Master Interrupt Enable */
 176
 177#define OHCI_HCCA_SIZE        0x100
 178#define OHCI_HCCA_MASK        0xffffff00
 179
 180#define OHCI_EDPTR_MASK       0xfffffff0
 181
 182#define OHCI_FMI_FI           0x00003fff
 183#define OHCI_FMI_FSMPS        0xffff0000
 184#define OHCI_FMI_FIT          0x80000000
 185
 186#define OHCI_FR_RT            (1U<<31)
 187
 188#define OHCI_LS_THRESH        0x628
 189
 190#define OHCI_RHA_RW_MASK      0x00000000 /* Mask of supported features.  */
 191#define OHCI_RHA_PSM          (1<<8)
 192#define OHCI_RHA_NPS          (1<<9)
 193#define OHCI_RHA_DT           (1<<10)
 194#define OHCI_RHA_OCPM         (1<<11)
 195#define OHCI_RHA_NOCP         (1<<12)
 196#define OHCI_RHA_POTPGT_MASK  0xff000000
 197
 198#define OHCI_RHS_LPS          (1U<<0)
 199#define OHCI_RHS_OCI          (1U<<1)
 200#define OHCI_RHS_DRWE         (1U<<15)
 201#define OHCI_RHS_LPSC         (1U<<16)
 202#define OHCI_RHS_OCIC         (1U<<17)
 203#define OHCI_RHS_CRWE         (1U<<31)
 204
 205#define OHCI_PORT_CCS         (1<<0)
 206#define OHCI_PORT_PES         (1<<1)
 207#define OHCI_PORT_PSS         (1<<2)
 208#define OHCI_PORT_POCI        (1<<3)
 209#define OHCI_PORT_PRS         (1<<4)
 210#define OHCI_PORT_PPS         (1<<8)
 211#define OHCI_PORT_LSDA        (1<<9)
 212#define OHCI_PORT_CSC         (1<<16)
 213#define OHCI_PORT_PESC        (1<<17)
 214#define OHCI_PORT_PSSC        (1<<18)
 215#define OHCI_PORT_OCIC        (1<<19)
 216#define OHCI_PORT_PRSC        (1<<20)
 217#define OHCI_PORT_WTC         (OHCI_PORT_CSC|OHCI_PORT_PESC|OHCI_PORT_PSSC \
 218                               |OHCI_PORT_OCIC|OHCI_PORT_PRSC)
 219
 220#define OHCI_TD_DIR_SETUP     0x0
 221#define OHCI_TD_DIR_OUT       0x1
 222#define OHCI_TD_DIR_IN        0x2
 223#define OHCI_TD_DIR_RESERVED  0x3
 224
 225#define OHCI_CC_NOERROR             0x0
 226#define OHCI_CC_CRC                 0x1
 227#define OHCI_CC_BITSTUFFING         0x2
 228#define OHCI_CC_DATATOGGLEMISMATCH  0x3
 229#define OHCI_CC_STALL               0x4
 230#define OHCI_CC_DEVICENOTRESPONDING 0x5
 231#define OHCI_CC_PIDCHECKFAILURE     0x6
 232#define OHCI_CC_UNDEXPETEDPID       0x7
 233#define OHCI_CC_DATAOVERRUN         0x8
 234#define OHCI_CC_DATAUNDERRUN        0x9
 235#define OHCI_CC_BUFFEROVERRUN       0xc
 236#define OHCI_CC_BUFFERUNDERRUN      0xd
 237
 238#define OHCI_HRESET_FSBIR       (1 << 0)
 239
 240static void ohci_die(OHCIState *ohci)
 241{
 242    ohci->ohci_die(ohci);
 243}
 244
 245/* Update IRQ levels */
 246static inline void ohci_intr_update(OHCIState *ohci)
 247{
 248    int level = 0;
 249
 250    if ((ohci->intr & OHCI_INTR_MIE) &&
 251        (ohci->intr_status & ohci->intr))
 252        level = 1;
 253
 254    qemu_set_irq(ohci->irq, level);
 255}
 256
 257/* Set an interrupt */
 258static inline void ohci_set_interrupt(OHCIState *ohci, uint32_t intr)
 259{
 260    ohci->intr_status |= intr;
 261    ohci_intr_update(ohci);
 262}
 263
 264/* Attach or detach a device on a root hub port.  */
 265static void ohci_attach(USBPort *port1)
 266{
 267    OHCIState *s = port1->opaque;
 268    OHCIPort *port = &s->rhport[port1->index];
 269    uint32_t old_state = port->ctrl;
 270
 271    /* set connect status */
 272    port->ctrl |= OHCI_PORT_CCS | OHCI_PORT_CSC;
 273
 274    /* update speed */
 275    if (port->port.dev->speed == USB_SPEED_LOW) {
 276        port->ctrl |= OHCI_PORT_LSDA;
 277    } else {
 278        port->ctrl &= ~OHCI_PORT_LSDA;
 279    }
 280
 281    /* notify of remote-wakeup */
 282    if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND) {
 283        ohci_set_interrupt(s, OHCI_INTR_RD);
 284    }
 285
 286    trace_usb_ohci_port_attach(port1->index);
 287
 288    if (old_state != port->ctrl) {
 289        ohci_set_interrupt(s, OHCI_INTR_RHSC);
 290    }
 291}
 292
 293static void ohci_detach(USBPort *port1)
 294{
 295    OHCIState *s = port1->opaque;
 296    OHCIPort *port = &s->rhport[port1->index];
 297    uint32_t old_state = port->ctrl;
 298
 299    ohci_async_cancel_device(s, port1->dev);
 300
 301    /* set connect status */
 302    if (port->ctrl & OHCI_PORT_CCS) {
 303        port->ctrl &= ~OHCI_PORT_CCS;
 304        port->ctrl |= OHCI_PORT_CSC;
 305    }
 306    /* disable port */
 307    if (port->ctrl & OHCI_PORT_PES) {
 308        port->ctrl &= ~OHCI_PORT_PES;
 309        port->ctrl |= OHCI_PORT_PESC;
 310    }
 311    trace_usb_ohci_port_detach(port1->index);
 312
 313    if (old_state != port->ctrl) {
 314        ohci_set_interrupt(s, OHCI_INTR_RHSC);
 315    }
 316}
 317
 318static void ohci_wakeup(USBPort *port1)
 319{
 320    OHCIState *s = port1->opaque;
 321    OHCIPort *port = &s->rhport[port1->index];
 322    uint32_t intr = 0;
 323    if (port->ctrl & OHCI_PORT_PSS) {
 324        trace_usb_ohci_port_wakeup(port1->index);
 325        port->ctrl |= OHCI_PORT_PSSC;
 326        port->ctrl &= ~OHCI_PORT_PSS;
 327        intr = OHCI_INTR_RHSC;
 328    }
 329    /* Note that the controller can be suspended even if this port is not */
 330    if ((s->ctl & OHCI_CTL_HCFS) == OHCI_USB_SUSPEND) {
 331        trace_usb_ohci_remote_wakeup(s->name);
 332        /* This is the one state transition the controller can do by itself */
 333        s->ctl &= ~OHCI_CTL_HCFS;
 334        s->ctl |= OHCI_USB_RESUME;
 335        /* In suspend mode only ResumeDetected is possible, not RHSC:
 336         * see the OHCI spec 5.1.2.3.
 337         */
 338        intr = OHCI_INTR_RD;
 339    }
 340    ohci_set_interrupt(s, intr);
 341}
 342
 343static void ohci_child_detach(USBPort *port1, USBDevice *child)
 344{
 345    OHCIState *s = port1->opaque;
 346
 347    ohci_async_cancel_device(s, child);
 348}
 349
 350static USBDevice *ohci_find_device(OHCIState *ohci, uint8_t addr)
 351{
 352    USBDevice *dev;
 353    int i;
 354
 355    for (i = 0; i < ohci->num_ports; i++) {
 356        if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0) {
 357            continue;
 358        }
 359        dev = usb_find_device(&ohci->rhport[i].port, addr);
 360        if (dev != NULL) {
 361            return dev;
 362        }
 363    }
 364    return NULL;
 365}
 366
 367void ohci_stop_endpoints(OHCIState *ohci)
 368{
 369    USBDevice *dev;
 370    int i, j;
 371
 372    for (i = 0; i < ohci->num_ports; i++) {
 373        dev = ohci->rhport[i].port.dev;
 374        if (dev && dev->attached) {
 375            usb_device_ep_stopped(dev, &dev->ep_ctl);
 376            for (j = 0; j < USB_MAX_ENDPOINTS; j++) {
 377                usb_device_ep_stopped(dev, &dev->ep_in[j]);
 378                usb_device_ep_stopped(dev, &dev->ep_out[j]);
 379            }
 380        }
 381    }
 382}
 383
 384static void ohci_roothub_reset(OHCIState *ohci)
 385{
 386    OHCIPort *port;
 387    int i;
 388
 389    ohci_bus_stop(ohci);
 390    ohci->rhdesc_a = OHCI_RHA_NPS | ohci->num_ports;
 391    ohci->rhdesc_b = 0x0; /* Impl. specific */
 392    ohci->rhstatus = 0;
 393
 394    for (i = 0; i < ohci->num_ports; i++) {
 395        port = &ohci->rhport[i];
 396        port->ctrl = 0;
 397        if (port->port.dev && port->port.dev->attached) {
 398            usb_port_reset(&port->port);
 399        }
 400    }
 401    if (ohci->async_td) {
 402        usb_cancel_packet(&ohci->usb_packet);
 403        ohci->async_td = 0;
 404    }
 405    ohci_stop_endpoints(ohci);
 406}
 407
 408/* Reset the controller */
 409static void ohci_soft_reset(OHCIState *ohci)
 410{
 411    trace_usb_ohci_reset(ohci->name);
 412
 413    ohci_bus_stop(ohci);
 414    ohci->ctl = (ohci->ctl & OHCI_CTL_IR) | OHCI_USB_SUSPEND;
 415    ohci->old_ctl = 0;
 416    ohci->status = 0;
 417    ohci->intr_status = 0;
 418    ohci->intr = OHCI_INTR_MIE;
 419
 420    ohci->hcca = 0;
 421    ohci->ctrl_head = ohci->ctrl_cur = 0;
 422    ohci->bulk_head = ohci->bulk_cur = 0;
 423    ohci->per_cur = 0;
 424    ohci->done = 0;
 425    ohci->done_count = 7;
 426
 427    /* FSMPS is marked TBD in OCHI 1.0, what gives ffs?
 428     * I took the value linux sets ...
 429     */
 430    ohci->fsmps = 0x2778;
 431    ohci->fi = 0x2edf;
 432    ohci->fit = 0;
 433    ohci->frt = 0;
 434    ohci->frame_number = 0;
 435    ohci->pstart = 0;
 436    ohci->lst = OHCI_LS_THRESH;
 437}
 438
 439void ohci_hard_reset(OHCIState *ohci)
 440{
 441    ohci_soft_reset(ohci);
 442    ohci->ctl = 0;
 443    ohci_roothub_reset(ohci);
 444}
 445
 446/* Get an array of dwords from main memory */
 447static inline int get_dwords(OHCIState *ohci,
 448                             dma_addr_t addr, uint32_t *buf, int num)
 449{
 450    int i;
 451
 452    addr += ohci->localmem_base;
 453
 454    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 455        if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
 456            return -1;
 457        }
 458        *buf = le32_to_cpu(*buf);
 459    }
 460
 461    return 0;
 462}
 463
 464/* Put an array of dwords in to main memory */
 465static inline int put_dwords(OHCIState *ohci,
 466                             dma_addr_t addr, uint32_t *buf, int num)
 467{
 468    int i;
 469
 470    addr += ohci->localmem_base;
 471
 472    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 473        uint32_t tmp = cpu_to_le32(*buf);
 474        if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
 475            return -1;
 476        }
 477    }
 478
 479    return 0;
 480}
 481
 482/* Get an array of words from main memory */
 483static inline int get_words(OHCIState *ohci,
 484                            dma_addr_t addr, uint16_t *buf, int num)
 485{
 486    int i;
 487
 488    addr += ohci->localmem_base;
 489
 490    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 491        if (dma_memory_read(ohci->as, addr, buf, sizeof(*buf))) {
 492            return -1;
 493        }
 494        *buf = le16_to_cpu(*buf);
 495    }
 496
 497    return 0;
 498}
 499
 500/* Put an array of words in to main memory */
 501static inline int put_words(OHCIState *ohci,
 502                            dma_addr_t addr, uint16_t *buf, int num)
 503{
 504    int i;
 505
 506    addr += ohci->localmem_base;
 507
 508    for (i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {
 509        uint16_t tmp = cpu_to_le16(*buf);
 510        if (dma_memory_write(ohci->as, addr, &tmp, sizeof(tmp))) {
 511            return -1;
 512        }
 513    }
 514
 515    return 0;
 516}
 517
 518static inline int ohci_read_ed(OHCIState *ohci,
 519                               dma_addr_t addr, struct ohci_ed *ed)
 520{
 521    return get_dwords(ohci, addr, (uint32_t *)ed, sizeof(*ed) >> 2);
 522}
 523
 524static inline int ohci_read_td(OHCIState *ohci,
 525                               dma_addr_t addr, struct ohci_td *td)
 526{
 527    return get_dwords(ohci, addr, (uint32_t *)td, sizeof(*td) >> 2);
 528}
 529
 530static inline int ohci_read_iso_td(OHCIState *ohci,
 531                                   dma_addr_t addr, struct ohci_iso_td *td)
 532{
 533    return get_dwords(ohci, addr, (uint32_t *)td, 4) ||
 534           get_words(ohci, addr + 16, td->offset, 8);
 535}
 536
 537static inline int ohci_read_hcca(OHCIState *ohci,
 538                                 dma_addr_t addr, struct ohci_hcca *hcca)
 539{
 540    return dma_memory_read(ohci->as, addr + ohci->localmem_base,
 541                           hcca, sizeof(*hcca));
 542}
 543
 544static inline int ohci_put_ed(OHCIState *ohci,
 545                              dma_addr_t addr, struct ohci_ed *ed)
 546{
 547    /* ed->tail is under control of the HCD.
 548     * Since just ed->head is changed by HC, just write back this
 549     */
 550
 551    return put_dwords(ohci, addr + ED_WBACK_OFFSET,
 552                      (uint32_t *)((char *)ed + ED_WBACK_OFFSET),
 553                      ED_WBACK_SIZE >> 2);
 554}
 555
 556static inline int ohci_put_td(OHCIState *ohci,
 557                              dma_addr_t addr, struct ohci_td *td)
 558{
 559    return put_dwords(ohci, addr, (uint32_t *)td, sizeof(*td) >> 2);
 560}
 561
 562static inline int ohci_put_iso_td(OHCIState *ohci,
 563                                  dma_addr_t addr, struct ohci_iso_td *td)
 564{
 565    return put_dwords(ohci, addr, (uint32_t *)td, 4) ||
 566           put_words(ohci, addr + 16, td->offset, 8);
 567}
 568
 569static inline int ohci_put_hcca(OHCIState *ohci,
 570                                dma_addr_t addr, struct ohci_hcca *hcca)
 571{
 572    return dma_memory_write(ohci->as,
 573                            addr + ohci->localmem_base + HCCA_WRITEBACK_OFFSET,
 574                            (char *)hcca + HCCA_WRITEBACK_OFFSET,
 575                            HCCA_WRITEBACK_SIZE);
 576}
 577
 578/* Read/Write the contents of a TD from/to main memory.  */
 579static int ohci_copy_td(OHCIState *ohci, struct ohci_td *td,
 580                        uint8_t *buf, int len, DMADirection dir)
 581{
 582    dma_addr_t ptr, n;
 583
 584    ptr = td->cbp;
 585    n = 0x1000 - (ptr & 0xfff);
 586    if (n > len)
 587        n = len;
 588
 589    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
 590        return -1;
 591    }
 592    if (n == len) {
 593        return 0;
 594    }
 595    ptr = td->be & ~0xfffu;
 596    buf += n;
 597    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
 598                      len - n, dir)) {
 599        return -1;
 600    }
 601    return 0;
 602}
 603
 604/* Read/Write the contents of an ISO TD from/to main memory.  */
 605static int ohci_copy_iso_td(OHCIState *ohci,
 606                            uint32_t start_addr, uint32_t end_addr,
 607                            uint8_t *buf, int len, DMADirection dir)
 608{
 609    dma_addr_t ptr, n;
 610
 611    ptr = start_addr;
 612    n = 0x1000 - (ptr & 0xfff);
 613    if (n > len)
 614        n = len;
 615
 616    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf, n, dir)) {
 617        return -1;
 618    }
 619    if (n == len) {
 620        return 0;
 621    }
 622    ptr = end_addr & ~0xfffu;
 623    buf += n;
 624    if (dma_memory_rw(ohci->as, ptr + ohci->localmem_base, buf,
 625                      len - n, dir)) {
 626        return -1;
 627    }
 628    return 0;
 629}
 630
 631static void ohci_process_lists(OHCIState *ohci, int completion);
 632
 633static void ohci_async_complete_packet(USBPort *port, USBPacket *packet)
 634{
 635    OHCIState *ohci = container_of(packet, OHCIState, usb_packet);
 636
 637    trace_usb_ohci_async_complete();
 638    ohci->async_complete = true;
 639    ohci_process_lists(ohci, 1);
 640}
 641
 642#define USUB(a, b) ((int16_t)((uint16_t)(a) - (uint16_t)(b)))
 643
 644static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
 645                               int completion)
 646{
 647    int dir;
 648    size_t len = 0;
 649    const char *str = NULL;
 650    int pid;
 651    int ret;
 652    int i;
 653    USBDevice *dev;
 654    USBEndpoint *ep;
 655    struct ohci_iso_td iso_td;
 656    uint32_t addr;
 657    uint16_t starting_frame;
 658    int16_t relative_frame_number;
 659    int frame_count;
 660    uint32_t start_offset, next_offset, end_offset = 0;
 661    uint32_t start_addr, end_addr;
 662
 663    addr = ed->head & OHCI_DPTR_MASK;
 664
 665    if (ohci_read_iso_td(ohci, addr, &iso_td)) {
 666        trace_usb_ohci_iso_td_read_failed(addr);
 667        ohci_die(ohci);
 668        return 1;
 669    }
 670
 671    starting_frame = OHCI_BM(iso_td.flags, TD_SF);
 672    frame_count = OHCI_BM(iso_td.flags, TD_FC);
 673    relative_frame_number = USUB(ohci->frame_number, starting_frame); 
 674
 675    trace_usb_ohci_iso_td_head(
 676           ed->head & OHCI_DPTR_MASK, ed->tail & OHCI_DPTR_MASK,
 677           iso_td.flags, iso_td.bp, iso_td.next, iso_td.be,
 678           ohci->frame_number, starting_frame,
 679           frame_count, relative_frame_number);
 680    trace_usb_ohci_iso_td_head_offset(
 681           iso_td.offset[0], iso_td.offset[1],
 682           iso_td.offset[2], iso_td.offset[3],
 683           iso_td.offset[4], iso_td.offset[5],
 684           iso_td.offset[6], iso_td.offset[7]);
 685
 686    if (relative_frame_number < 0) {
 687        trace_usb_ohci_iso_td_relative_frame_number_neg(relative_frame_number);
 688        return 1;
 689    } else if (relative_frame_number > frame_count) {
 690        /* ISO TD expired - retire the TD to the Done Queue and continue with
 691           the next ISO TD of the same ED */
 692        trace_usb_ohci_iso_td_relative_frame_number_big(relative_frame_number,
 693                                                        frame_count);
 694        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
 695        ed->head &= ~OHCI_DPTR_MASK;
 696        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 697        iso_td.next = ohci->done;
 698        ohci->done = addr;
 699        i = OHCI_BM(iso_td.flags, TD_DI);
 700        if (i < ohci->done_count)
 701            ohci->done_count = i;
 702        if (ohci_put_iso_td(ohci, addr, &iso_td)) {
 703            ohci_die(ohci);
 704            return 1;
 705        }
 706        return 0;
 707    }
 708
 709    dir = OHCI_BM(ed->flags, ED_D);
 710    switch (dir) {
 711    case OHCI_TD_DIR_IN:
 712        str = "in";
 713        pid = USB_TOKEN_IN;
 714        break;
 715    case OHCI_TD_DIR_OUT:
 716        str = "out";
 717        pid = USB_TOKEN_OUT;
 718        break;
 719    case OHCI_TD_DIR_SETUP:
 720        str = "setup";
 721        pid = USB_TOKEN_SETUP;
 722        break;
 723    default:
 724        trace_usb_ohci_iso_td_bad_direction(dir);
 725        return 1;
 726    }
 727
 728    if (!iso_td.bp || !iso_td.be) {
 729        trace_usb_ohci_iso_td_bad_bp_be(iso_td.bp, iso_td.be);
 730        return 1;
 731    }
 732
 733    start_offset = iso_td.offset[relative_frame_number];
 734    next_offset = iso_td.offset[relative_frame_number + 1];
 735
 736    if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) || 
 737        ((relative_frame_number < frame_count) && 
 738         !(OHCI_BM(next_offset, TD_PSW_CC) & 0xe))) {
 739        trace_usb_ohci_iso_td_bad_cc_not_accessed(start_offset, next_offset);
 740        return 1;
 741    }
 742
 743    if ((relative_frame_number < frame_count) && (start_offset > next_offset)) {
 744        trace_usb_ohci_iso_td_bad_cc_overrun(start_offset, next_offset);
 745        return 1;
 746    }
 747
 748    if ((start_offset & 0x1000) == 0) {
 749        start_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 750            (start_offset & OHCI_OFFSET_MASK);
 751    } else {
 752        start_addr = (iso_td.be & OHCI_PAGE_MASK) |
 753            (start_offset & OHCI_OFFSET_MASK);
 754    }
 755
 756    if (relative_frame_number < frame_count) {
 757        end_offset = next_offset - 1;
 758        if ((end_offset & 0x1000) == 0) {
 759            end_addr = (iso_td.bp & OHCI_PAGE_MASK) |
 760                (end_offset & OHCI_OFFSET_MASK);
 761        } else {
 762            end_addr = (iso_td.be & OHCI_PAGE_MASK) |
 763                (end_offset & OHCI_OFFSET_MASK);
 764        }
 765    } else {
 766        /* Last packet in the ISO TD */
 767        end_addr = iso_td.be;
 768    }
 769
 770    if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
 771        len = (end_addr & OHCI_OFFSET_MASK) + 0x1001
 772            - (start_addr & OHCI_OFFSET_MASK);
 773    } else {
 774        len = end_addr - start_addr + 1;
 775    }
 776
 777    if (len && dir != OHCI_TD_DIR_IN) {
 778        if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, len,
 779                             DMA_DIRECTION_TO_DEVICE)) {
 780            ohci_die(ohci);
 781            return 1;
 782        }
 783    }
 784
 785    if (!completion) {
 786        bool int_req = relative_frame_number == frame_count &&
 787                       OHCI_BM(iso_td.flags, TD_DI) == 0;
 788        dev = ohci_find_device(ohci, OHCI_BM(ed->flags, ED_FA));
 789        if (dev == NULL) {
 790            trace_usb_ohci_td_dev_error();
 791            return 1;
 792        }
 793        ep = usb_ep_get(dev, pid, OHCI_BM(ed->flags, ED_EN));
 794        usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, false, int_req);
 795        usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, len);
 796        usb_handle_packet(dev, &ohci->usb_packet);
 797        if (ohci->usb_packet.status == USB_RET_ASYNC) {
 798            usb_device_flush_ep_queue(dev, ep);
 799            return 1;
 800        }
 801    }
 802    if (ohci->usb_packet.status == USB_RET_SUCCESS) {
 803        ret = ohci->usb_packet.actual_length;
 804    } else {
 805        ret = ohci->usb_packet.status;
 806    }
 807
 808    trace_usb_ohci_iso_td_so(start_offset, end_offset, start_addr, end_addr,
 809                             str, len, ret);
 810
 811    /* Writeback */
 812    if (dir == OHCI_TD_DIR_IN && ret >= 0 && ret <= len) {
 813        /* IN transfer succeeded */
 814        if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, ret,
 815                             DMA_DIRECTION_FROM_DEVICE)) {
 816            ohci_die(ohci);
 817            return 1;
 818        }
 819        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 820                    OHCI_CC_NOERROR);
 821        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, ret);
 822    } else if (dir == OHCI_TD_DIR_OUT && ret == len) {
 823        /* OUT transfer succeeded */
 824        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 825                    OHCI_CC_NOERROR);
 826        OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE, 0);
 827    } else {
 828        if (ret > (ssize_t) len) {
 829            trace_usb_ohci_iso_td_data_overrun(ret, len);
 830            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 831                        OHCI_CC_DATAOVERRUN);
 832            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 833                        len);
 834        } else if (ret >= 0) {
 835            trace_usb_ohci_iso_td_data_underrun(ret);
 836            OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 837                        OHCI_CC_DATAUNDERRUN);
 838        } else {
 839            switch (ret) {
 840            case USB_RET_IOERROR:
 841            case USB_RET_NODEV:
 842                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 843                            OHCI_CC_DEVICENOTRESPONDING);
 844                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 845                            0);
 846                break;
 847            case USB_RET_NAK:
 848            case USB_RET_STALL:
 849                trace_usb_ohci_iso_td_nak(ret);
 850                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 851                            OHCI_CC_STALL);
 852                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_SIZE,
 853                            0);
 854                break;
 855            default:
 856                trace_usb_ohci_iso_td_bad_response(ret);
 857                OHCI_SET_BM(iso_td.offset[relative_frame_number], TD_PSW_CC,
 858                            OHCI_CC_UNDEXPETEDPID);
 859                break;
 860            }
 861        }
 862    }
 863
 864    if (relative_frame_number == frame_count) {
 865        /* Last data packet of ISO TD - retire the TD to the Done Queue */
 866        OHCI_SET_BM(iso_td.flags, TD_CC, OHCI_CC_NOERROR);
 867        ed->head &= ~OHCI_DPTR_MASK;
 868        ed->head |= (iso_td.next & OHCI_DPTR_MASK);
 869        iso_td.next = ohci->done;
 870        ohci->done = addr;
 871        i = OHCI_BM(iso_td.flags, TD_DI);
 872        if (i < ohci->done_count)
 873            ohci->done_count = i;
 874    }
 875    if (ohci_put_iso_td(ohci, addr, &iso_td)) {
 876        ohci_die(ohci);
 877    }
 878    return 1;
 879}
 880
 881static void ohci_td_pkt(const char *msg, const uint8_t *buf, size_t len)
 882{
 883    bool print16;
 884    bool printall;
 885    const int width = 16;
 886    int i;
 887    char tmp[3 * width + 1];
 888    char *p = tmp;
 889
 890    print16 = !!trace_event_get_state_backends(TRACE_USB_OHCI_TD_PKT_SHORT);
 891    printall = !!trace_event_get_state_backends(TRACE_USB_OHCI_TD_PKT_FULL);
 892
 893    if (!printall && !print16) {
 894        return;
 895    }
 896
 897    for (i = 0; ; i++) {
 898        if (i && (!(i % width) || (i == len))) {
 899            if (!printall) {
 900                trace_usb_ohci_td_pkt_short(msg, tmp);
 901                break;
 902            }
 903            trace_usb_ohci_td_pkt_full(msg, tmp);
 904            p = tmp;
 905            *p = 0;
 906        }
 907        if (i == len) {
 908            break;
 909        }
 910
 911        p += sprintf(p, " %.2x", buf[i]);
 912    }
 913}
 914
 915/* Service a transport descriptor.
 916   Returns nonzero to terminate processing of this endpoint.  */
 917
 918static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
 919{
 920    int dir;
 921    size_t len = 0, pktlen = 0;
 922    const char *str = NULL;
 923    int pid;
 924    int ret;
 925    int i;
 926    USBDevice *dev;
 927    USBEndpoint *ep;
 928    struct ohci_td td;
 929    uint32_t addr;
 930    int flag_r;
 931    int completion;
 932
 933    addr = ed->head & OHCI_DPTR_MASK;
 934    /* See if this TD has already been submitted to the device.  */
 935    completion = (addr == ohci->async_td);
 936    if (completion && !ohci->async_complete) {
 937        trace_usb_ohci_td_skip_async();
 938        return 1;
 939    }
 940    if (ohci_read_td(ohci, addr, &td)) {
 941        trace_usb_ohci_td_read_error(addr);
 942        ohci_die(ohci);
 943        return 1;
 944    }
 945
 946    dir = OHCI_BM(ed->flags, ED_D);
 947    switch (dir) {
 948    case OHCI_TD_DIR_OUT:
 949    case OHCI_TD_DIR_IN:
 950        /* Same value.  */
 951        break;
 952    default:
 953        dir = OHCI_BM(td.flags, TD_DP);
 954        break;
 955    }
 956
 957    switch (dir) {
 958    case OHCI_TD_DIR_IN:
 959        str = "in";
 960        pid = USB_TOKEN_IN;
 961        break;
 962    case OHCI_TD_DIR_OUT:
 963        str = "out";
 964        pid = USB_TOKEN_OUT;
 965        break;
 966    case OHCI_TD_DIR_SETUP:
 967        str = "setup";
 968        pid = USB_TOKEN_SETUP;
 969        break;
 970    default:
 971        trace_usb_ohci_td_bad_direction(dir);
 972        return 1;
 973    }
 974    if (td.cbp && td.be) {
 975        if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) {
 976            len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff);
 977        } else {
 978            len = (td.be - td.cbp) + 1;
 979        }
 980
 981        pktlen = len;
 982        if (len && dir != OHCI_TD_DIR_IN) {
 983            /* The endpoint may not allow us to transfer it all now */
 984            pktlen = (ed->flags & OHCI_ED_MPS_MASK) >> OHCI_ED_MPS_SHIFT;
 985            if (pktlen > len) {
 986                pktlen = len;
 987            }
 988            if (!completion) {
 989                if (ohci_copy_td(ohci, &td, ohci->usb_buf, pktlen,
 990                                 DMA_DIRECTION_TO_DEVICE)) {
 991                    ohci_die(ohci);
 992                }
 993            }
 994        }
 995    }
 996
 997    flag_r = (td.flags & OHCI_TD_R) != 0;
 998    trace_usb_ohci_td_pkt_hdr(addr, (int64_t)pktlen, (int64_t)len, str,
 999                              flag_r, td.cbp, td.be);
1000    ohci_td_pkt("OUT", ohci->usb_buf, pktlen);
1001
1002    if (completion) {
1003        ohci->async_td = 0;
1004        ohci->async_complete = false;
1005    } else {
1006        if (ohci->async_td) {
1007            /* ??? The hardware should allow one active packet per
1008               endpoint.  We only allow one active packet per controller.
1009               This should be sufficient as long as devices respond in a
1010               timely manner.
1011            */
1012            trace_usb_ohci_td_too_many_pending();
1013            return 1;
1014        }
1015        dev = ohci_find_device(ohci, OHCI_BM(ed->flags, ED_FA));
1016        if (dev == NULL) {
1017            trace_usb_ohci_td_dev_error();
1018            return 1;
1019        }
1020        ep = usb_ep_get(dev, pid, OHCI_BM(ed->flags, ED_EN));
1021        usb_packet_setup(&ohci->usb_packet, pid, ep, 0, addr, !flag_r,
1022                         OHCI_BM(td.flags, TD_DI) == 0);
1023        usb_packet_addbuf(&ohci->usb_packet, ohci->usb_buf, pktlen);
1024        usb_handle_packet(dev, &ohci->usb_packet);
1025        trace_usb_ohci_td_packet_status(ohci->usb_packet.status);
1026
1027        if (ohci->usb_packet.status == USB_RET_ASYNC) {
1028            usb_device_flush_ep_queue(dev, ep);
1029            ohci->async_td = addr;
1030            return 1;
1031        }
1032    }
1033    if (ohci->usb_packet.status == USB_RET_SUCCESS) {
1034        ret = ohci->usb_packet.actual_length;
1035    } else {
1036        ret = ohci->usb_packet.status;
1037    }
1038
1039    if (ret >= 0) {
1040        if (dir == OHCI_TD_DIR_IN) {
1041            if (ohci_copy_td(ohci, &td, ohci->usb_buf, ret,
1042                             DMA_DIRECTION_FROM_DEVICE)) {
1043                ohci_die(ohci);
1044            }
1045            ohci_td_pkt("IN", ohci->usb_buf, pktlen);
1046        } else {
1047            ret = pktlen;
1048        }
1049    }
1050
1051    /* Writeback */
1052    if (ret == pktlen || (dir == OHCI_TD_DIR_IN && ret >= 0 && flag_r)) {
1053        /* Transmission succeeded.  */
1054        if (ret == len) {
1055            td.cbp = 0;
1056        } else {
1057            if ((td.cbp & 0xfff) + ret > 0xfff) {
1058                td.cbp = (td.be & ~0xfff) + ((td.cbp + ret) & 0xfff);
1059            } else {
1060                td.cbp += ret;
1061            }
1062        }
1063        td.flags |= OHCI_TD_T1;
1064        td.flags ^= OHCI_TD_T0;
1065        OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_NOERROR);
1066        OHCI_SET_BM(td.flags, TD_EC, 0);
1067
1068        if ((dir != OHCI_TD_DIR_IN) && (ret != len)) {
1069            /* Partial packet transfer: TD not ready to retire yet */
1070            goto exit_no_retire;
1071        }
1072
1073        /* Setting ED_C is part of the TD retirement process */
1074        ed->head &= ~OHCI_ED_C;
1075        if (td.flags & OHCI_TD_T0)
1076            ed->head |= OHCI_ED_C;
1077    } else {
1078        if (ret >= 0) {
1079            trace_usb_ohci_td_underrun();
1080            OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAUNDERRUN);
1081        } else {
1082            switch (ret) {
1083            case USB_RET_IOERROR:
1084            case USB_RET_NODEV:
1085                trace_usb_ohci_td_dev_error();
1086                OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DEVICENOTRESPONDING);
1087                break;
1088            case USB_RET_NAK:
1089                trace_usb_ohci_td_nak();
1090                return 1;
1091            case USB_RET_STALL:
1092                trace_usb_ohci_td_stall();
1093                OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_STALL);
1094                break;
1095            case USB_RET_BABBLE:
1096                trace_usb_ohci_td_babble();
1097                OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAOVERRUN);
1098                break;
1099            default:
1100                trace_usb_ohci_td_bad_device_response(ret);
1101                OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_UNDEXPETEDPID);
1102                OHCI_SET_BM(td.flags, TD_EC, 3);
1103                break;
1104            }
1105            /* An error occured so we have to clear the interrupt counter. See
1106             * spec at 6.4.4 on page 104 */
1107            ohci->done_count = 0;
1108        }
1109        ed->head |= OHCI_ED_H;
1110    }
1111
1112    /* Retire this TD */
1113    ed->head &= ~OHCI_DPTR_MASK;
1114    ed->head |= td.next & OHCI_DPTR_MASK;
1115    td.next = ohci->done;
1116    ohci->done = addr;
1117    i = OHCI_BM(td.flags, TD_DI);
1118    if (i < ohci->done_count)
1119        ohci->done_count = i;
1120exit_no_retire:
1121    if (ohci_put_td(ohci, addr, &td)) {
1122        ohci_die(ohci);
1123        return 1;
1124    }
1125    return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR;
1126}
1127
1128/* Service an endpoint list.  Returns nonzero if active TD were found.  */
1129static int ohci_service_ed_list(OHCIState *ohci, uint32_t head, int completion)
1130{
1131    struct ohci_ed ed;
1132    uint32_t next_ed;
1133    uint32_t cur;
1134    int active;
1135    uint32_t link_cnt = 0;
1136    active = 0;
1137
1138    if (head == 0)
1139        return 0;
1140
1141    for (cur = head; cur && link_cnt++ < ED_LINK_LIMIT; cur = next_ed) {
1142        if (ohci_read_ed(ohci, cur, &ed)) {
1143            trace_usb_ohci_ed_read_error(cur);
1144            ohci_die(ohci);
1145            return 0;
1146        }
1147
1148        next_ed = ed.next & OHCI_DPTR_MASK;
1149
1150        if ((ed.head & OHCI_ED_H) || (ed.flags & OHCI_ED_K)) {
1151            uint32_t addr;
1152            /* Cancel pending packets for ED that have been paused.  */
1153            addr = ed.head & OHCI_DPTR_MASK;
1154            if (ohci->async_td && addr == ohci->async_td) {
1155                usb_cancel_packet(&ohci->usb_packet);
1156                ohci->async_td = 0;
1157                usb_device_ep_stopped(ohci->usb_packet.ep->dev,
1158                                      ohci->usb_packet.ep);
1159            }
1160            continue;
1161        }
1162
1163        while ((ed.head & OHCI_DPTR_MASK) != ed.tail) {
1164            trace_usb_ohci_ed_pkt(cur, (ed.head & OHCI_ED_H) != 0,
1165                    (ed.head & OHCI_ED_C) != 0, ed.head & OHCI_DPTR_MASK,
1166                    ed.tail & OHCI_DPTR_MASK, ed.next & OHCI_DPTR_MASK);
1167            trace_usb_ohci_ed_pkt_flags(
1168                    OHCI_BM(ed.flags, ED_FA), OHCI_BM(ed.flags, ED_EN),
1169                    OHCI_BM(ed.flags, ED_D), (ed.flags & OHCI_ED_S)!= 0,
1170                    (ed.flags & OHCI_ED_K) != 0, (ed.flags & OHCI_ED_F) != 0,
1171                    OHCI_BM(ed.flags, ED_MPS));
1172
1173            active = 1;
1174
1175            if ((ed.flags & OHCI_ED_F) == 0) {
1176                if (ohci_service_td(ohci, &ed))
1177                    break;
1178            } else {
1179                /* Handle isochronous endpoints */
1180                if (ohci_service_iso_td(ohci, &ed, completion))
1181                    break;
1182            }
1183        }
1184
1185        if (ohci_put_ed(ohci, cur, &ed)) {
1186            ohci_die(ohci);
1187            return 0;
1188        }
1189    }
1190
1191    return active;
1192}
1193
1194/* set a timer for EOF */
1195static void ohci_eof_timer(OHCIState *ohci)
1196{
1197    timer_mod(ohci->eof_timer, ohci->sof_time + usb_frame_time);
1198}
1199/* Set a timer for EOF and generate a SOF event */
1200static void ohci_sof(OHCIState *ohci)
1201{
1202    ohci->sof_time += usb_frame_time;
1203    ohci_eof_timer(ohci);
1204    ohci_set_interrupt(ohci, OHCI_INTR_SF);
1205}
1206
1207/* Process Control and Bulk lists.  */
1208static void ohci_process_lists(OHCIState *ohci, int completion)
1209{
1210    if ((ohci->ctl & OHCI_CTL_CLE) && (ohci->status & OHCI_STATUS_CLF)) {
1211        if (ohci->ctrl_cur && ohci->ctrl_cur != ohci->ctrl_head) {
1212            trace_usb_ohci_process_lists(ohci->ctrl_head, ohci->ctrl_cur);
1213        }
1214        if (!ohci_service_ed_list(ohci, ohci->ctrl_head, completion)) {
1215            ohci->ctrl_cur = 0;
1216            ohci->status &= ~OHCI_STATUS_CLF;
1217        }
1218    }
1219
1220    if ((ohci->ctl & OHCI_CTL_BLE) && (ohci->status & OHCI_STATUS_BLF)) {
1221        if (!ohci_service_ed_list(ohci, ohci->bulk_head, completion)) {
1222            ohci->bulk_cur = 0;
1223            ohci->status &= ~OHCI_STATUS_BLF;
1224        }
1225    }
1226}
1227
1228/* Do frame processing on frame boundary */
1229static void ohci_frame_boundary(void *opaque)
1230{
1231    OHCIState *ohci = opaque;
1232    struct ohci_hcca hcca;
1233
1234    if (ohci_read_hcca(ohci, ohci->hcca, &hcca)) {
1235        trace_usb_ohci_hcca_read_error(ohci->hcca);
1236        ohci_die(ohci);
1237        return;
1238    }
1239
1240    /* Process all the lists at the end of the frame */
1241    if (ohci->ctl & OHCI_CTL_PLE) {
1242        int n;
1243
1244        n = ohci->frame_number & 0x1f;
1245        ohci_service_ed_list(ohci, le32_to_cpu(hcca.intr[n]), 0);
1246    }
1247
1248    /* Cancel all pending packets if either of the lists has been disabled.  */
1249    if (ohci->old_ctl & (~ohci->ctl) & (OHCI_CTL_BLE | OHCI_CTL_CLE)) {
1250        if (ohci->async_td) {
1251            usb_cancel_packet(&ohci->usb_packet);
1252            ohci->async_td = 0;
1253        }
1254        ohci_stop_endpoints(ohci);
1255    }
1256    ohci->old_ctl = ohci->ctl;
1257    ohci_process_lists(ohci, 0);
1258
1259    /* Stop if UnrecoverableError happened or ohci_sof will crash */
1260    if (ohci->intr_status & OHCI_INTR_UE) {
1261        return;
1262    }
1263
1264    /* Frame boundary, so do EOF stuf here */
1265    ohci->frt = ohci->fit;
1266
1267    /* Increment frame number and take care of endianness. */
1268    ohci->frame_number = (ohci->frame_number + 1) & 0xffff;
1269    hcca.frame = cpu_to_le16(ohci->frame_number);
1270
1271    if (ohci->done_count == 0 && !(ohci->intr_status & OHCI_INTR_WD)) {
1272        if (!ohci->done)
1273            abort();
1274        if (ohci->intr & ohci->intr_status)
1275            ohci->done |= 1;
1276        hcca.done = cpu_to_le32(ohci->done);
1277        ohci->done = 0;
1278        ohci->done_count = 7;
1279        ohci_set_interrupt(ohci, OHCI_INTR_WD);
1280    }
1281
1282    if (ohci->done_count != 7 && ohci->done_count != 0)
1283        ohci->done_count--;
1284
1285    /* Do SOF stuff here */
1286    ohci_sof(ohci);
1287
1288    /* Writeback HCCA */
1289    if (ohci_put_hcca(ohci, ohci->hcca, &hcca)) {
1290        ohci_die(ohci);
1291    }
1292}
1293
1294/* Start sending SOF tokens across the USB bus, lists are processed in
1295 * next frame
1296 */
1297static int ohci_bus_start(OHCIState *ohci)
1298{
1299    trace_usb_ohci_start(ohci->name);
1300
1301    /* Delay the first SOF event by one frame time as
1302     * linux driver is not ready to receive it and
1303     * can meet some race conditions
1304     */
1305
1306    ohci->sof_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1307    ohci_eof_timer(ohci);
1308
1309    return 1;
1310}
1311
1312/* Stop sending SOF tokens on the bus */
1313void ohci_bus_stop(OHCIState *ohci)
1314{
1315    trace_usb_ohci_stop(ohci->name);
1316    timer_del(ohci->eof_timer);
1317}
1318
1319/* Sets a flag in a port status register but only set it if the port is
1320 * connected, if not set ConnectStatusChange flag. If flag is enabled
1321 * return 1.
1322 */
1323static int ohci_port_set_if_connected(OHCIState *ohci, int i, uint32_t val)
1324{
1325    int ret = 1;
1326
1327    /* writing a 0 has no effect */
1328    if (val == 0)
1329        return 0;
1330
1331    /* If CurrentConnectStatus is cleared we set
1332     * ConnectStatusChange
1333     */
1334    if (!(ohci->rhport[i].ctrl & OHCI_PORT_CCS)) {
1335        ohci->rhport[i].ctrl |= OHCI_PORT_CSC;
1336        if (ohci->rhstatus & OHCI_RHS_DRWE) {
1337            /* TODO: CSC is a wakeup event */
1338        }
1339        return 0;
1340    }
1341
1342    if (ohci->rhport[i].ctrl & val)
1343        ret = 0;
1344
1345    /* set the bit */
1346    ohci->rhport[i].ctrl |= val;
1347
1348    return ret;
1349}
1350
1351/* Set the frame interval - frame interval toggle is manipulated by the hcd only */
1352static void ohci_set_frame_interval(OHCIState *ohci, uint16_t val)
1353{
1354    val &= OHCI_FMI_FI;
1355
1356    if (val != ohci->fi) {
1357        trace_usb_ohci_set_frame_interval(ohci->name, ohci->fi, ohci->fi);
1358    }
1359
1360    ohci->fi = val;
1361}
1362
1363static void ohci_port_power(OHCIState *ohci, int i, int p)
1364{
1365    if (p) {
1366        ohci->rhport[i].ctrl |= OHCI_PORT_PPS;
1367    } else {
1368        ohci->rhport[i].ctrl &= ~(OHCI_PORT_PPS|
1369                    OHCI_PORT_CCS|
1370                    OHCI_PORT_PSS|
1371                    OHCI_PORT_PRS);
1372    }
1373}
1374
1375/* Set HcControlRegister */
1376static void ohci_set_ctl(OHCIState *ohci, uint32_t val)
1377{
1378    uint32_t old_state;
1379    uint32_t new_state;
1380
1381    old_state = ohci->ctl & OHCI_CTL_HCFS;
1382    ohci->ctl = val;
1383    new_state = ohci->ctl & OHCI_CTL_HCFS;
1384
1385    /* no state change */
1386    if (old_state == new_state)
1387        return;
1388
1389    trace_usb_ohci_set_ctl(ohci->name, new_state);
1390    switch (new_state) {
1391    case OHCI_USB_OPERATIONAL:
1392        ohci_bus_start(ohci);
1393        break;
1394    case OHCI_USB_SUSPEND:
1395        ohci_bus_stop(ohci);
1396        /* clear pending SF otherwise linux driver loops in ohci_irq() */
1397        ohci->intr_status &= ~OHCI_INTR_SF;
1398        ohci_intr_update(ohci);
1399        break;
1400    case OHCI_USB_RESUME:
1401        trace_usb_ohci_resume(ohci->name);
1402        break;
1403    case OHCI_USB_RESET:
1404        ohci_roothub_reset(ohci);
1405        break;
1406    }
1407}
1408
1409static uint32_t ohci_get_frame_remaining(OHCIState *ohci)
1410{
1411    uint16_t fr;
1412    int64_t tks;
1413
1414    if ((ohci->ctl & OHCI_CTL_HCFS) != OHCI_USB_OPERATIONAL)
1415        return (ohci->frt << 31);
1416
1417    /* Being in USB operational state guarnatees sof_time was
1418     * set already.
1419     */
1420    tks = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - ohci->sof_time;
1421    if (tks < 0) {
1422        tks = 0;
1423    }
1424
1425    /* avoid muldiv if possible */
1426    if (tks >= usb_frame_time)
1427        return (ohci->frt << 31);
1428
1429    tks = tks / usb_bit_time;
1430    fr = (uint16_t)(ohci->fi - tks);
1431
1432    return (ohci->frt << 31) | fr;
1433}
1434
1435
1436/* Set root hub status */
1437static void ohci_set_hub_status(OHCIState *ohci, uint32_t val)
1438{
1439    uint32_t old_state;
1440
1441    old_state = ohci->rhstatus;
1442
1443    /* write 1 to clear OCIC */
1444    if (val & OHCI_RHS_OCIC)
1445        ohci->rhstatus &= ~OHCI_RHS_OCIC;
1446
1447    if (val & OHCI_RHS_LPS) {
1448        int i;
1449
1450        for (i = 0; i < ohci->num_ports; i++)
1451            ohci_port_power(ohci, i, 0);
1452        trace_usb_ohci_hub_power_down();
1453    }
1454
1455    if (val & OHCI_RHS_LPSC) {
1456        int i;
1457
1458        for (i = 0; i < ohci->num_ports; i++)
1459            ohci_port_power(ohci, i, 1);
1460        trace_usb_ohci_hub_power_up();
1461    }
1462
1463    if (val & OHCI_RHS_DRWE)
1464        ohci->rhstatus |= OHCI_RHS_DRWE;
1465
1466    if (val & OHCI_RHS_CRWE)
1467        ohci->rhstatus &= ~OHCI_RHS_DRWE;
1468
1469    if (old_state != ohci->rhstatus)
1470        ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1471}
1472
1473/* Set root hub port status */
1474static void ohci_port_set_status(OHCIState *ohci, int portnum, uint32_t val)
1475{
1476    uint32_t old_state;
1477    OHCIPort *port;
1478
1479    port = &ohci->rhport[portnum];
1480    old_state = port->ctrl;
1481
1482    /* Write to clear CSC, PESC, PSSC, OCIC, PRSC */
1483    if (val & OHCI_PORT_WTC)
1484        port->ctrl &= ~(val & OHCI_PORT_WTC);
1485
1486    if (val & OHCI_PORT_CCS)
1487        port->ctrl &= ~OHCI_PORT_PES;
1488
1489    ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PES);
1490
1491    if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PSS)) {
1492        trace_usb_ohci_port_suspend(portnum);
1493    }
1494
1495    if (ohci_port_set_if_connected(ohci, portnum, val & OHCI_PORT_PRS)) {
1496        trace_usb_ohci_port_reset(portnum);
1497        usb_device_reset(port->port.dev);
1498        port->ctrl &= ~OHCI_PORT_PRS;
1499        /* ??? Should this also set OHCI_PORT_PESC.  */
1500        port->ctrl |= OHCI_PORT_PES | OHCI_PORT_PRSC;
1501    }
1502
1503    /* Invert order here to ensure in ambiguous case, device is
1504     * powered up...
1505     */
1506    if (val & OHCI_PORT_LSDA)
1507        ohci_port_power(ohci, portnum, 0);
1508    if (val & OHCI_PORT_PPS)
1509        ohci_port_power(ohci, portnum, 1);
1510
1511    if (old_state != port->ctrl)
1512        ohci_set_interrupt(ohci, OHCI_INTR_RHSC);
1513}
1514
1515static uint64_t ohci_mem_read(void *opaque,
1516                              hwaddr addr,
1517                              unsigned size)
1518{
1519    OHCIState *ohci = opaque;
1520    uint32_t retval;
1521
1522    /* Only aligned reads are allowed on OHCI */
1523    if (addr & 3) {
1524        trace_usb_ohci_mem_read_unaligned(addr);
1525        return 0xffffffff;
1526    } else if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1527        /* HcRhPortStatus */
1528        retval = ohci->rhport[(addr - 0x54) >> 2].ctrl | OHCI_PORT_PPS;
1529    } else {
1530        switch (addr >> 2) {
1531        case 0: /* HcRevision */
1532            retval = 0x10;
1533            break;
1534
1535        case 1: /* HcControl */
1536            retval = ohci->ctl;
1537            break;
1538
1539        case 2: /* HcCommandStatus */
1540            retval = ohci->status;
1541            break;
1542
1543        case 3: /* HcInterruptStatus */
1544            retval = ohci->intr_status;
1545            break;
1546
1547        case 4: /* HcInterruptEnable */
1548        case 5: /* HcInterruptDisable */
1549            retval = ohci->intr;
1550            break;
1551
1552        case 6: /* HcHCCA */
1553            retval = ohci->hcca;
1554            break;
1555
1556        case 7: /* HcPeriodCurrentED */
1557            retval = ohci->per_cur;
1558            break;
1559
1560        case 8: /* HcControlHeadED */
1561            retval = ohci->ctrl_head;
1562            break;
1563
1564        case 9: /* HcControlCurrentED */
1565            retval = ohci->ctrl_cur;
1566            break;
1567
1568        case 10: /* HcBulkHeadED */
1569            retval = ohci->bulk_head;
1570            break;
1571
1572        case 11: /* HcBulkCurrentED */
1573            retval = ohci->bulk_cur;
1574            break;
1575
1576        case 12: /* HcDoneHead */
1577            retval = ohci->done;
1578            break;
1579
1580        case 13: /* HcFmInterretval */
1581            retval = (ohci->fit << 31) | (ohci->fsmps << 16) | (ohci->fi);
1582            break;
1583
1584        case 14: /* HcFmRemaining */
1585            retval = ohci_get_frame_remaining(ohci);
1586            break;
1587
1588        case 15: /* HcFmNumber */
1589            retval = ohci->frame_number;
1590            break;
1591
1592        case 16: /* HcPeriodicStart */
1593            retval = ohci->pstart;
1594            break;
1595
1596        case 17: /* HcLSThreshold */
1597            retval = ohci->lst;
1598            break;
1599
1600        case 18: /* HcRhDescriptorA */
1601            retval = ohci->rhdesc_a;
1602            break;
1603
1604        case 19: /* HcRhDescriptorB */
1605            retval = ohci->rhdesc_b;
1606            break;
1607
1608        case 20: /* HcRhStatus */
1609            retval = ohci->rhstatus;
1610            break;
1611
1612        /* PXA27x specific registers */
1613        case 24: /* HcStatus */
1614            retval = ohci->hstatus & ohci->hmask;
1615            break;
1616
1617        case 25: /* HcHReset */
1618            retval = ohci->hreset;
1619            break;
1620
1621        case 26: /* HcHInterruptEnable */
1622            retval = ohci->hmask;
1623            break;
1624
1625        case 27: /* HcHInterruptTest */
1626            retval = ohci->htest;
1627            break;
1628
1629        default:
1630            trace_usb_ohci_mem_read_bad_offset(addr);
1631            retval = 0xffffffff;
1632        }
1633    }
1634
1635    return retval;
1636}
1637
1638static void ohci_mem_write(void *opaque,
1639                           hwaddr addr,
1640                           uint64_t val,
1641                           unsigned size)
1642{
1643    OHCIState *ohci = opaque;
1644
1645    /* Only aligned reads are allowed on OHCI */
1646    if (addr & 3) {
1647        trace_usb_ohci_mem_write_unaligned(addr);
1648        return;
1649    }
1650
1651    if (addr >= 0x54 && addr < 0x54 + ohci->num_ports * 4) {
1652        /* HcRhPortStatus */
1653        ohci_port_set_status(ohci, (addr - 0x54) >> 2, val);
1654        return;
1655    }
1656
1657    switch (addr >> 2) {
1658    case 1: /* HcControl */
1659        ohci_set_ctl(ohci, val);
1660        break;
1661
1662    case 2: /* HcCommandStatus */
1663        /* SOC is read-only */
1664        val = (val & ~OHCI_STATUS_SOC);
1665
1666        /* Bits written as '0' remain unchanged in the register */
1667        ohci->status |= val;
1668
1669        if (ohci->status & OHCI_STATUS_HCR)
1670            ohci_soft_reset(ohci);
1671        break;
1672
1673    case 3: /* HcInterruptStatus */
1674        ohci->intr_status &= ~val;
1675        ohci_intr_update(ohci);
1676        break;
1677
1678    case 4: /* HcInterruptEnable */
1679        ohci->intr |= val;
1680        ohci_intr_update(ohci);
1681        break;
1682
1683    case 5: /* HcInterruptDisable */
1684        ohci->intr &= ~val;
1685        ohci_intr_update(ohci);
1686        break;
1687
1688    case 6: /* HcHCCA */
1689        ohci->hcca = val & OHCI_HCCA_MASK;
1690        break;
1691
1692    case 7: /* HcPeriodCurrentED */
1693        /* Ignore writes to this read-only register, Linux does them */
1694        break;
1695
1696    case 8: /* HcControlHeadED */
1697        ohci->ctrl_head = val & OHCI_EDPTR_MASK;
1698        break;
1699
1700    case 9: /* HcControlCurrentED */
1701        ohci->ctrl_cur = val & OHCI_EDPTR_MASK;
1702        break;
1703
1704    case 10: /* HcBulkHeadED */
1705        ohci->bulk_head = val & OHCI_EDPTR_MASK;
1706        break;
1707
1708    case 11: /* HcBulkCurrentED */
1709        ohci->bulk_cur = val & OHCI_EDPTR_MASK;
1710        break;
1711
1712    case 13: /* HcFmInterval */
1713        ohci->fsmps = (val & OHCI_FMI_FSMPS) >> 16;
1714        ohci->fit = (val & OHCI_FMI_FIT) >> 31;
1715        ohci_set_frame_interval(ohci, val);
1716        break;
1717
1718    case 15: /* HcFmNumber */
1719        break;
1720
1721    case 16: /* HcPeriodicStart */
1722        ohci->pstart = val & 0xffff;
1723        break;
1724
1725    case 17: /* HcLSThreshold */
1726        ohci->lst = val & 0xffff;
1727        break;
1728
1729    case 18: /* HcRhDescriptorA */
1730        ohci->rhdesc_a &= ~OHCI_RHA_RW_MASK;
1731        ohci->rhdesc_a |= val & OHCI_RHA_RW_MASK;
1732        break;
1733
1734    case 19: /* HcRhDescriptorB */
1735        break;
1736
1737    case 20: /* HcRhStatus */
1738        ohci_set_hub_status(ohci, val);
1739        break;
1740
1741    /* PXA27x specific registers */
1742    case 24: /* HcStatus */
1743        ohci->hstatus &= ~(val & ohci->hmask);
1744        break;
1745
1746    case 25: /* HcHReset */
1747        ohci->hreset = val & ~OHCI_HRESET_FSBIR;
1748        if (val & OHCI_HRESET_FSBIR)
1749            ohci_hard_reset(ohci);
1750        break;
1751
1752    case 26: /* HcHInterruptEnable */
1753        ohci->hmask = val;
1754        break;
1755
1756    case 27: /* HcHInterruptTest */
1757        ohci->htest = val;
1758        break;
1759
1760    default:
1761        trace_usb_ohci_mem_write_bad_offset(addr);
1762        break;
1763    }
1764}
1765
1766static void ohci_async_cancel_device(OHCIState *ohci, USBDevice *dev)
1767{
1768    if (ohci->async_td &&
1769        usb_packet_is_inflight(&ohci->usb_packet) &&
1770        ohci->usb_packet.ep->dev == dev) {
1771        usb_cancel_packet(&ohci->usb_packet);
1772        ohci->async_td = 0;
1773    }
1774}
1775
1776static const MemoryRegionOps ohci_mem_ops = {
1777    .read = ohci_mem_read,
1778    .write = ohci_mem_write,
1779    .endianness = DEVICE_LITTLE_ENDIAN,
1780};
1781
1782static USBPortOps ohci_port_ops = {
1783    .attach = ohci_attach,
1784    .detach = ohci_detach,
1785    .child_detach = ohci_child_detach,
1786    .wakeup = ohci_wakeup,
1787    .complete = ohci_async_complete_packet,
1788};
1789
1790static USBBusOps ohci_bus_ops = {
1791};
1792
1793void usb_ohci_init(OHCIState *ohci, DeviceState *dev, uint32_t num_ports,
1794                   dma_addr_t localmem_base, char *masterbus,
1795                   uint32_t firstport, AddressSpace *as,
1796                   void (*ohci_die_fn)(struct OHCIState *), Error **errp)
1797{
1798    Error *err = NULL;
1799    int i;
1800
1801    ohci->as = as;
1802    ohci->ohci_die = ohci_die_fn;
1803
1804    if (num_ports > OHCI_MAX_PORTS) {
1805        error_setg(errp, "OHCI num-ports=%u is too big (limit is %u ports)",
1806                   num_ports, OHCI_MAX_PORTS);
1807        return;
1808    }
1809
1810    if (usb_frame_time == 0) {
1811#ifdef OHCI_TIME_WARP
1812        usb_frame_time = NANOSECONDS_PER_SECOND;
1813        usb_bit_time = NANOSECONDS_PER_SECOND / (USB_HZ / 1000);
1814#else
1815        usb_frame_time = NANOSECONDS_PER_SECOND / 1000;
1816        if (NANOSECONDS_PER_SECOND >= USB_HZ) {
1817            usb_bit_time = NANOSECONDS_PER_SECOND / USB_HZ;
1818        } else {
1819            usb_bit_time = 1;
1820        }
1821#endif
1822        trace_usb_ohci_init_time(usb_frame_time, usb_bit_time);
1823    }
1824
1825    ohci->num_ports = num_ports;
1826    if (masterbus) {
1827        USBPort *ports[OHCI_MAX_PORTS];
1828        for(i = 0; i < num_ports; i++) {
1829            ports[i] = &ohci->rhport[i].port;
1830        }
1831        usb_register_companion(masterbus, ports, num_ports,
1832                               firstport, ohci, &ohci_port_ops,
1833                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL,
1834                               &err);
1835        if (err) {
1836            error_propagate(errp, err);
1837            return;
1838        }
1839    } else {
1840        usb_bus_new(&ohci->bus, sizeof(ohci->bus), &ohci_bus_ops, dev);
1841        for (i = 0; i < num_ports; i++) {
1842            usb_register_port(&ohci->bus, &ohci->rhport[i].port,
1843                              ohci, i, &ohci_port_ops,
1844                              USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1845        }
1846    }
1847
1848    memory_region_init_io(&ohci->mem, OBJECT(dev), &ohci_mem_ops,
1849                          ohci, "ohci", 256);
1850    ohci->localmem_base = localmem_base;
1851
1852    ohci->name = object_get_typename(OBJECT(dev));
1853    usb_packet_init(&ohci->usb_packet);
1854
1855    ohci->async_td = 0;
1856
1857    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
1858                                   ohci_frame_boundary, ohci);
1859}
1860
1861/**
1862 * A typical OHCI will stop operating and set itself into error state
1863 * (which can be queried by MMIO) to signal that it got an error.
1864 */
1865void ohci_sysbus_die(struct OHCIState *ohci)
1866{
1867    trace_usb_ohci_die();
1868
1869    ohci_set_interrupt(ohci, OHCI_INTR_UE);
1870    ohci_bus_stop(ohci);
1871}
1872
1873static void ohci_realize_pxa(DeviceState *dev, Error **errp)
1874{
1875    OHCISysBusState *s = SYSBUS_OHCI(dev);
1876    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1877    Error *err = NULL;
1878
1879    usb_ohci_init(&s->ohci, dev, s->num_ports, s->dma_offset,
1880                  s->masterbus, s->firstport,
1881                  &address_space_memory, ohci_sysbus_die, &err);
1882    if (err) {
1883        error_propagate(errp, err);
1884        return;
1885    }
1886    sysbus_init_irq(sbd, &s->ohci.irq);
1887    sysbus_init_mmio(sbd, &s->ohci.mem);
1888}
1889
1890static void usb_ohci_reset_sysbus(DeviceState *dev)
1891{
1892    OHCISysBusState *s = SYSBUS_OHCI(dev);
1893    OHCIState *ohci = &s->ohci;
1894
1895    ohci_hard_reset(ohci);
1896}
1897
1898static const VMStateDescription vmstate_ohci_state_port = {
1899    .name = "ohci-core/port",
1900    .version_id = 1,
1901    .minimum_version_id = 1,
1902    .fields = (VMStateField[]) {
1903        VMSTATE_UINT32(ctrl, OHCIPort),
1904        VMSTATE_END_OF_LIST()
1905    },
1906};
1907
1908static bool ohci_eof_timer_needed(void *opaque)
1909{
1910    OHCIState *ohci = opaque;
1911
1912    return timer_pending(ohci->eof_timer);
1913}
1914
1915static const VMStateDescription vmstate_ohci_eof_timer = {
1916    .name = "ohci-core/eof-timer",
1917    .version_id = 1,
1918    .minimum_version_id = 1,
1919    .needed = ohci_eof_timer_needed,
1920    .fields = (VMStateField[]) {
1921        VMSTATE_TIMER_PTR(eof_timer, OHCIState),
1922        VMSTATE_END_OF_LIST()
1923    },
1924};
1925
1926const VMStateDescription vmstate_ohci_state = {
1927    .name = "ohci-core",
1928    .version_id = 1,
1929    .minimum_version_id = 1,
1930    .fields = (VMStateField[]) {
1931        VMSTATE_INT64(sof_time, OHCIState),
1932        VMSTATE_UINT32(ctl, OHCIState),
1933        VMSTATE_UINT32(status, OHCIState),
1934        VMSTATE_UINT32(intr_status, OHCIState),
1935        VMSTATE_UINT32(intr, OHCIState),
1936        VMSTATE_UINT32(hcca, OHCIState),
1937        VMSTATE_UINT32(ctrl_head, OHCIState),
1938        VMSTATE_UINT32(ctrl_cur, OHCIState),
1939        VMSTATE_UINT32(bulk_head, OHCIState),
1940        VMSTATE_UINT32(bulk_cur, OHCIState),
1941        VMSTATE_UINT32(per_cur, OHCIState),
1942        VMSTATE_UINT32(done, OHCIState),
1943        VMSTATE_INT32(done_count, OHCIState),
1944        VMSTATE_UINT16(fsmps, OHCIState),
1945        VMSTATE_UINT8(fit, OHCIState),
1946        VMSTATE_UINT16(fi, OHCIState),
1947        VMSTATE_UINT8(frt, OHCIState),
1948        VMSTATE_UINT16(frame_number, OHCIState),
1949        VMSTATE_UINT16(padding, OHCIState),
1950        VMSTATE_UINT32(pstart, OHCIState),
1951        VMSTATE_UINT32(lst, OHCIState),
1952        VMSTATE_UINT32(rhdesc_a, OHCIState),
1953        VMSTATE_UINT32(rhdesc_b, OHCIState),
1954        VMSTATE_UINT32(rhstatus, OHCIState),
1955        VMSTATE_STRUCT_ARRAY(rhport, OHCIState, OHCI_MAX_PORTS, 0,
1956                             vmstate_ohci_state_port, OHCIPort),
1957        VMSTATE_UINT32(hstatus, OHCIState),
1958        VMSTATE_UINT32(hmask, OHCIState),
1959        VMSTATE_UINT32(hreset, OHCIState),
1960        VMSTATE_UINT32(htest, OHCIState),
1961        VMSTATE_UINT32(old_ctl, OHCIState),
1962        VMSTATE_UINT8_ARRAY(usb_buf, OHCIState, 8192),
1963        VMSTATE_UINT32(async_td, OHCIState),
1964        VMSTATE_BOOL(async_complete, OHCIState),
1965        VMSTATE_END_OF_LIST()
1966    },
1967    .subsections = (const VMStateDescription*[]) {
1968        &vmstate_ohci_eof_timer,
1969        NULL
1970    }
1971};
1972
1973static Property ohci_sysbus_properties[] = {
1974    DEFINE_PROP_STRING("masterbus", OHCISysBusState, masterbus),
1975    DEFINE_PROP_UINT32("num-ports", OHCISysBusState, num_ports, 3),
1976    DEFINE_PROP_UINT32("firstport", OHCISysBusState, firstport, 0),
1977    DEFINE_PROP_DMAADDR("dma-offset", OHCISysBusState, dma_offset, 0),
1978    DEFINE_PROP_END_OF_LIST(),
1979};
1980
1981static void ohci_sysbus_class_init(ObjectClass *klass, void *data)
1982{
1983    DeviceClass *dc = DEVICE_CLASS(klass);
1984
1985    dc->realize = ohci_realize_pxa;
1986    set_bit(DEVICE_CATEGORY_USB, dc->categories);
1987    dc->desc = "OHCI USB Controller";
1988    device_class_set_props(dc, ohci_sysbus_properties);
1989    dc->reset = usb_ohci_reset_sysbus;
1990}
1991
1992static const TypeInfo ohci_sysbus_info = {
1993    .name          = TYPE_SYSBUS_OHCI,
1994    .parent        = TYPE_SYS_BUS_DEVICE,
1995    .instance_size = sizeof(OHCISysBusState),
1996    .class_init    = ohci_sysbus_class_init,
1997};
1998
1999static void ohci_register_types(void)
2000{
2001    type_register_static(&ohci_sysbus_info);
2002}
2003
2004type_init(ohci_register_types)
2005