cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

hcd-uhci.c (38313B)


      1/*
      2 * USB UHCI controller emulation
      3 *
      4 * Copyright (c) 2005 Fabrice Bellard
      5 *
      6 * Copyright (c) 2008 Max Krasnyansky
      7 *     Magor rewrite of the UHCI data structures parser and frame processor
      8 *     Support for fully async operation and multiple outstanding transactions
      9 *
     10 * Permission is hereby granted, free of charge, to any person obtaining a copy
     11 * of this software and associated documentation files (the "Software"), to deal
     12 * in the Software without restriction, including without limitation the rights
     13 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     14 * copies of the Software, and to permit persons to whom the Software is
     15 * furnished to do so, subject to the following conditions:
     16 *
     17 * The above copyright notice and this permission notice shall be included in
     18 * all copies or substantial portions of the Software.
     19 *
     20 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     21 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     22 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     23 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     24 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     25 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     26 * THE SOFTWARE.
     27 */
     28
     29#include "qemu/osdep.h"
     30#include "hw/usb.h"
     31#include "hw/usb/uhci-regs.h"
     32#include "migration/vmstate.h"
     33#include "hw/pci/pci.h"
     34#include "hw/qdev-properties.h"
     35#include "qapi/error.h"
     36#include "qemu/timer.h"
     37#include "qemu/iov.h"
     38#include "sysemu/dma.h"
     39#include "trace.h"
     40#include "qemu/main-loop.h"
     41#include "qemu/module.h"
     42#include "qom/object.h"
     43#include "hcd-uhci.h"
     44
     45#define FRAME_TIMER_FREQ 1000
     46
     47#define FRAME_MAX_LOOPS  256
     48
     49/* Must be large enough to handle 10 frame delay for initial isoc requests */
     50#define QH_VALID         32
     51
     52#define MAX_FRAMES_PER_TICK    (QH_VALID / 2)
     53
     54enum {
     55    TD_RESULT_STOP_FRAME = 10,
     56    TD_RESULT_COMPLETE,
     57    TD_RESULT_NEXT_QH,
     58    TD_RESULT_ASYNC_START,
     59    TD_RESULT_ASYNC_CONT,
     60};
     61
     62typedef struct UHCIState UHCIState;
     63typedef struct UHCIAsync UHCIAsync;
     64typedef struct UHCIPCIDeviceClass UHCIPCIDeviceClass;
     65
     66struct UHCIPCIDeviceClass {
     67    PCIDeviceClass parent_class;
     68    UHCIInfo       info;
     69};
     70
     71/* 
     72 * Pending async transaction.
     73 * 'packet' must be the first field because completion
     74 * handler does "(UHCIAsync *) pkt" cast.
     75 */
     76
     77struct UHCIAsync {
     78    USBPacket packet;
     79    uint8_t   static_buf[64]; /* 64 bytes is enough, except for isoc packets */
     80    uint8_t   *buf;
     81    UHCIQueue *queue;
     82    QTAILQ_ENTRY(UHCIAsync) next;
     83    uint32_t  td_addr;
     84    uint8_t   done;
     85};
     86
     87struct UHCIQueue {
     88    uint32_t  qh_addr;
     89    uint32_t  token;
     90    UHCIState *uhci;
     91    USBEndpoint *ep;
     92    QTAILQ_ENTRY(UHCIQueue) next;
     93    QTAILQ_HEAD(, UHCIAsync) asyncs;
     94    int8_t    valid;
     95};
     96
     97typedef struct UHCI_TD {
     98    uint32_t link;
     99    uint32_t ctrl; /* see TD_CTRL_xxx */
    100    uint32_t token;
    101    uint32_t buffer;
    102} UHCI_TD;
    103
    104typedef struct UHCI_QH {
    105    uint32_t link;
    106    uint32_t el_link;
    107} UHCI_QH;
    108
    109static void uhci_async_cancel(UHCIAsync *async);
    110static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
    111static void uhci_resume(void *opaque);
    112
    113static inline int32_t uhci_queue_token(UHCI_TD *td)
    114{
    115    if ((td->token & (0xf << 15)) == 0) {
    116        /* ctrl ep, cover ep and dev, not pid! */
    117        return td->token & 0x7ff00;
    118    } else {
    119        /* covers ep, dev, pid -> identifies the endpoint */
    120        return td->token & 0x7ffff;
    121    }
    122}
    123
    124static UHCIQueue *uhci_queue_new(UHCIState *s, uint32_t qh_addr, UHCI_TD *td,
    125                                 USBEndpoint *ep)
    126{
    127    UHCIQueue *queue;
    128
    129    queue = g_new0(UHCIQueue, 1);
    130    queue->uhci = s;
    131    queue->qh_addr = qh_addr;
    132    queue->token = uhci_queue_token(td);
    133    queue->ep = ep;
    134    QTAILQ_INIT(&queue->asyncs);
    135    QTAILQ_INSERT_HEAD(&s->queues, queue, next);
    136    queue->valid = QH_VALID;
    137    trace_usb_uhci_queue_add(queue->token);
    138    return queue;
    139}
    140
    141static void uhci_queue_free(UHCIQueue *queue, const char *reason)
    142{
    143    UHCIState *s = queue->uhci;
    144    UHCIAsync *async;
    145
    146    while (!QTAILQ_EMPTY(&queue->asyncs)) {
    147        async = QTAILQ_FIRST(&queue->asyncs);
    148        uhci_async_cancel(async);
    149    }
    150    usb_device_ep_stopped(queue->ep->dev, queue->ep);
    151
    152    trace_usb_uhci_queue_del(queue->token, reason);
    153    QTAILQ_REMOVE(&s->queues, queue, next);
    154    g_free(queue);
    155}
    156
    157static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
    158{
    159    uint32_t token = uhci_queue_token(td);
    160    UHCIQueue *queue;
    161
    162    QTAILQ_FOREACH(queue, &s->queues, next) {
    163        if (queue->token == token) {
    164            return queue;
    165        }
    166    }
    167    return NULL;
    168}
    169
    170static bool uhci_queue_verify(UHCIQueue *queue, uint32_t qh_addr, UHCI_TD *td,
    171                              uint32_t td_addr, bool queuing)
    172{
    173    UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
    174    uint32_t queue_token_addr = (queue->token >> 8) & 0x7f;
    175
    176    return queue->qh_addr == qh_addr &&
    177           queue->token == uhci_queue_token(td) &&
    178           queue_token_addr == queue->ep->dev->addr &&
    179           (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
    180            first->td_addr == td_addr);
    181}
    182
    183static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t td_addr)
    184{
    185    UHCIAsync *async = g_new0(UHCIAsync, 1);
    186
    187    async->queue = queue;
    188    async->td_addr = td_addr;
    189    usb_packet_init(&async->packet);
    190    trace_usb_uhci_packet_add(async->queue->token, async->td_addr);
    191
    192    return async;
    193}
    194
    195static void uhci_async_free(UHCIAsync *async)
    196{
    197    trace_usb_uhci_packet_del(async->queue->token, async->td_addr);
    198    usb_packet_cleanup(&async->packet);
    199    if (async->buf != async->static_buf) {
    200        g_free(async->buf);
    201    }
    202    g_free(async);
    203}
    204
    205static void uhci_async_link(UHCIAsync *async)
    206{
    207    UHCIQueue *queue = async->queue;
    208    QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
    209    trace_usb_uhci_packet_link_async(async->queue->token, async->td_addr);
    210}
    211
    212static void uhci_async_unlink(UHCIAsync *async)
    213{
    214    UHCIQueue *queue = async->queue;
    215    QTAILQ_REMOVE(&queue->asyncs, async, next);
    216    trace_usb_uhci_packet_unlink_async(async->queue->token, async->td_addr);
    217}
    218
    219static void uhci_async_cancel(UHCIAsync *async)
    220{
    221    uhci_async_unlink(async);
    222    trace_usb_uhci_packet_cancel(async->queue->token, async->td_addr,
    223                                 async->done);
    224    if (!async->done)
    225        usb_cancel_packet(&async->packet);
    226    uhci_async_free(async);
    227}
    228
    229/*
    230 * Mark all outstanding async packets as invalid.
    231 * This is used for canceling them when TDs are removed by the HCD.
    232 */
    233static void uhci_async_validate_begin(UHCIState *s)
    234{
    235    UHCIQueue *queue;
    236
    237    QTAILQ_FOREACH(queue, &s->queues, next) {
    238        queue->valid--;
    239    }
    240}
    241
    242/*
    243 * Cancel async packets that are no longer valid
    244 */
    245static void uhci_async_validate_end(UHCIState *s)
    246{
    247    UHCIQueue *queue, *n;
    248
    249    QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
    250        if (!queue->valid) {
    251            uhci_queue_free(queue, "validate-end");
    252        }
    253    }
    254}
    255
    256static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
    257{
    258    UHCIQueue *queue, *n;
    259
    260    QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
    261        if (queue->ep->dev == dev) {
    262            uhci_queue_free(queue, "cancel-device");
    263        }
    264    }
    265}
    266
    267static void uhci_async_cancel_all(UHCIState *s)
    268{
    269    UHCIQueue *queue, *nq;
    270
    271    QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
    272        uhci_queue_free(queue, "cancel-all");
    273    }
    274}
    275
    276static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
    277{
    278    UHCIQueue *queue;
    279    UHCIAsync *async;
    280
    281    QTAILQ_FOREACH(queue, &s->queues, next) {
    282        QTAILQ_FOREACH(async, &queue->asyncs, next) {
    283            if (async->td_addr == td_addr) {
    284                return async;
    285            }
    286        }
    287    }
    288    return NULL;
    289}
    290
    291static void uhci_update_irq(UHCIState *s)
    292{
    293    int level;
    294    if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
    295        ((s->status2 & 2) && (s->intr & (1 << 3))) ||
    296        ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
    297        ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
    298        (s->status & UHCI_STS_HSERR) ||
    299        (s->status & UHCI_STS_HCPERR)) {
    300        level = 1;
    301    } else {
    302        level = 0;
    303    }
    304    pci_set_irq(&s->dev, level);
    305}
    306
    307static void uhci_reset(DeviceState *dev)
    308{
    309    PCIDevice *d = PCI_DEVICE(dev);
    310    UHCIState *s = UHCI(d);
    311    uint8_t *pci_conf;
    312    int i;
    313    UHCIPort *port;
    314
    315    trace_usb_uhci_reset();
    316
    317    pci_conf = s->dev.config;
    318
    319    pci_conf[0x6a] = 0x01; /* usb clock */
    320    pci_conf[0x6b] = 0x00;
    321    s->cmd = 0;
    322    s->status = UHCI_STS_HCHALTED;
    323    s->status2 = 0;
    324    s->intr = 0;
    325    s->fl_base_addr = 0;
    326    s->sof_timing = 64;
    327
    328    for(i = 0; i < NB_PORTS; i++) {
    329        port = &s->ports[i];
    330        port->ctrl = 0x0080;
    331        if (port->port.dev && port->port.dev->attached) {
    332            usb_port_reset(&port->port);
    333        }
    334    }
    335
    336    uhci_async_cancel_all(s);
    337    qemu_bh_cancel(s->bh);
    338    uhci_update_irq(s);
    339}
    340
    341static const VMStateDescription vmstate_uhci_port = {
    342    .name = "uhci port",
    343    .version_id = 1,
    344    .minimum_version_id = 1,
    345    .fields = (VMStateField[]) {
    346        VMSTATE_UINT16(ctrl, UHCIPort),
    347        VMSTATE_END_OF_LIST()
    348    }
    349};
    350
    351static int uhci_post_load(void *opaque, int version_id)
    352{
    353    UHCIState *s = opaque;
    354
    355    if (version_id < 2) {
    356        s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
    357            (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ);
    358    }
    359    return 0;
    360}
    361
    362static const VMStateDescription vmstate_uhci = {
    363    .name = "uhci",
    364    .version_id = 3,
    365    .minimum_version_id = 1,
    366    .post_load = uhci_post_load,
    367    .fields = (VMStateField[]) {
    368        VMSTATE_PCI_DEVICE(dev, UHCIState),
    369        VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState, NULL),
    370        VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
    371                             vmstate_uhci_port, UHCIPort),
    372        VMSTATE_UINT16(cmd, UHCIState),
    373        VMSTATE_UINT16(status, UHCIState),
    374        VMSTATE_UINT16(intr, UHCIState),
    375        VMSTATE_UINT16(frnum, UHCIState),
    376        VMSTATE_UINT32(fl_base_addr, UHCIState),
    377        VMSTATE_UINT8(sof_timing, UHCIState),
    378        VMSTATE_UINT8(status2, UHCIState),
    379        VMSTATE_TIMER_PTR(frame_timer, UHCIState),
    380        VMSTATE_INT64_V(expire_time, UHCIState, 2),
    381        VMSTATE_UINT32_V(pending_int_mask, UHCIState, 3),
    382        VMSTATE_END_OF_LIST()
    383    }
    384};
    385
    386static void uhci_port_write(void *opaque, hwaddr addr,
    387                            uint64_t val, unsigned size)
    388{
    389    UHCIState *s = opaque;
    390
    391    trace_usb_uhci_mmio_writew(addr, val);
    392
    393    switch(addr) {
    394    case 0x00:
    395        if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
    396            /* start frame processing */
    397            trace_usb_uhci_schedule_start();
    398            s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
    399                (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ);
    400            timer_mod(s->frame_timer, s->expire_time);
    401            s->status &= ~UHCI_STS_HCHALTED;
    402        } else if (!(val & UHCI_CMD_RS)) {
    403            s->status |= UHCI_STS_HCHALTED;
    404        }
    405        if (val & UHCI_CMD_GRESET) {
    406            UHCIPort *port;
    407            int i;
    408
    409            /* send reset on the USB bus */
    410            for(i = 0; i < NB_PORTS; i++) {
    411                port = &s->ports[i];
    412                usb_device_reset(port->port.dev);
    413            }
    414            uhci_reset(DEVICE(s));
    415            return;
    416        }
    417        if (val & UHCI_CMD_HCRESET) {
    418            uhci_reset(DEVICE(s));
    419            return;
    420        }
    421        s->cmd = val;
    422        if (val & UHCI_CMD_EGSM) {
    423            if ((s->ports[0].ctrl & UHCI_PORT_RD) ||
    424                (s->ports[1].ctrl & UHCI_PORT_RD)) {
    425                uhci_resume(s);
    426            }
    427        }
    428        break;
    429    case 0x02:
    430        s->status &= ~val;
    431        /* XXX: the chip spec is not coherent, so we add a hidden
    432           register to distinguish between IOC and SPD */
    433        if (val & UHCI_STS_USBINT)
    434            s->status2 = 0;
    435        uhci_update_irq(s);
    436        break;
    437    case 0x04:
    438        s->intr = val;
    439        uhci_update_irq(s);
    440        break;
    441    case 0x06:
    442        if (s->status & UHCI_STS_HCHALTED)
    443            s->frnum = val & 0x7ff;
    444        break;
    445    case 0x08:
    446        s->fl_base_addr &= 0xffff0000;
    447        s->fl_base_addr |= val & ~0xfff;
    448        break;
    449    case 0x0a:
    450        s->fl_base_addr &= 0x0000ffff;
    451        s->fl_base_addr |= (val << 16);
    452        break;
    453    case 0x0c:
    454        s->sof_timing = val & 0xff;
    455        break;
    456    case 0x10 ... 0x1f:
    457        {
    458            UHCIPort *port;
    459            USBDevice *dev;
    460            int n;
    461
    462            n = (addr >> 1) & 7;
    463            if (n >= NB_PORTS)
    464                return;
    465            port = &s->ports[n];
    466            dev = port->port.dev;
    467            if (dev && dev->attached) {
    468                /* port reset */
    469                if ( (val & UHCI_PORT_RESET) &&
    470                     !(port->ctrl & UHCI_PORT_RESET) ) {
    471                    usb_device_reset(dev);
    472                }
    473            }
    474            port->ctrl &= UHCI_PORT_READ_ONLY;
    475            /* enabled may only be set if a device is connected */
    476            if (!(port->ctrl & UHCI_PORT_CCS)) {
    477                val &= ~UHCI_PORT_EN;
    478            }
    479            port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
    480            /* some bits are reset when a '1' is written to them */
    481            port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
    482        }
    483        break;
    484    }
    485}
    486
    487static uint64_t uhci_port_read(void *opaque, hwaddr addr, unsigned size)
    488{
    489    UHCIState *s = opaque;
    490    uint32_t val;
    491
    492    switch(addr) {
    493    case 0x00:
    494        val = s->cmd;
    495        break;
    496    case 0x02:
    497        val = s->status;
    498        break;
    499    case 0x04:
    500        val = s->intr;
    501        break;
    502    case 0x06:
    503        val = s->frnum;
    504        break;
    505    case 0x08:
    506        val = s->fl_base_addr & 0xffff;
    507        break;
    508    case 0x0a:
    509        val = (s->fl_base_addr >> 16) & 0xffff;
    510        break;
    511    case 0x0c:
    512        val = s->sof_timing;
    513        break;
    514    case 0x10 ... 0x1f:
    515        {
    516            UHCIPort *port;
    517            int n;
    518            n = (addr >> 1) & 7;
    519            if (n >= NB_PORTS)
    520                goto read_default;
    521            port = &s->ports[n];
    522            val = port->ctrl;
    523        }
    524        break;
    525    default:
    526    read_default:
    527        val = 0xff7f; /* disabled port */
    528        break;
    529    }
    530
    531    trace_usb_uhci_mmio_readw(addr, val);
    532
    533    return val;
    534}
    535
    536/* signal resume if controller suspended */
    537static void uhci_resume (void *opaque)
    538{
    539    UHCIState *s = (UHCIState *)opaque;
    540
    541    if (!s)
    542        return;
    543
    544    if (s->cmd & UHCI_CMD_EGSM) {
    545        s->cmd |= UHCI_CMD_FGR;
    546        s->status |= UHCI_STS_RD;
    547        uhci_update_irq(s);
    548    }
    549}
    550
    551static void uhci_attach(USBPort *port1)
    552{
    553    UHCIState *s = port1->opaque;
    554    UHCIPort *port = &s->ports[port1->index];
    555
    556    /* set connect status */
    557    port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
    558
    559    /* update speed */
    560    if (port->port.dev->speed == USB_SPEED_LOW) {
    561        port->ctrl |= UHCI_PORT_LSDA;
    562    } else {
    563        port->ctrl &= ~UHCI_PORT_LSDA;
    564    }
    565
    566    uhci_resume(s);
    567}
    568
    569static void uhci_detach(USBPort *port1)
    570{
    571    UHCIState *s = port1->opaque;
    572    UHCIPort *port = &s->ports[port1->index];
    573
    574    uhci_async_cancel_device(s, port1->dev);
    575
    576    /* set connect status */
    577    if (port->ctrl & UHCI_PORT_CCS) {
    578        port->ctrl &= ~UHCI_PORT_CCS;
    579        port->ctrl |= UHCI_PORT_CSC;
    580    }
    581    /* disable port */
    582    if (port->ctrl & UHCI_PORT_EN) {
    583        port->ctrl &= ~UHCI_PORT_EN;
    584        port->ctrl |= UHCI_PORT_ENC;
    585    }
    586
    587    uhci_resume(s);
    588}
    589
    590static void uhci_child_detach(USBPort *port1, USBDevice *child)
    591{
    592    UHCIState *s = port1->opaque;
    593
    594    uhci_async_cancel_device(s, child);
    595}
    596
    597static void uhci_wakeup(USBPort *port1)
    598{
    599    UHCIState *s = port1->opaque;
    600    UHCIPort *port = &s->ports[port1->index];
    601
    602    if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
    603        port->ctrl |= UHCI_PORT_RD;
    604        uhci_resume(s);
    605    }
    606}
    607
    608static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
    609{
    610    USBDevice *dev;
    611    int i;
    612
    613    for (i = 0; i < NB_PORTS; i++) {
    614        UHCIPort *port = &s->ports[i];
    615        if (!(port->ctrl & UHCI_PORT_EN)) {
    616            continue;
    617        }
    618        dev = usb_find_device(&port->port, addr);
    619        if (dev != NULL) {
    620            return dev;
    621        }
    622    }
    623    return NULL;
    624}
    625
    626static void uhci_read_td(UHCIState *s, UHCI_TD *td, uint32_t link)
    627{
    628    pci_dma_read(&s->dev, link & ~0xf, td, sizeof(*td));
    629    le32_to_cpus(&td->link);
    630    le32_to_cpus(&td->ctrl);
    631    le32_to_cpus(&td->token);
    632    le32_to_cpus(&td->buffer);
    633}
    634
    635static int uhci_handle_td_error(UHCIState *s, UHCI_TD *td, uint32_t td_addr,
    636                                int status, uint32_t *int_mask)
    637{
    638    uint32_t queue_token = uhci_queue_token(td);
    639    int ret;
    640
    641    switch (status) {
    642    case USB_RET_NAK:
    643        td->ctrl |= TD_CTRL_NAK;
    644        return TD_RESULT_NEXT_QH;
    645
    646    case USB_RET_STALL:
    647        td->ctrl |= TD_CTRL_STALL;
    648        trace_usb_uhci_packet_complete_stall(queue_token, td_addr);
    649        ret = TD_RESULT_NEXT_QH;
    650        break;
    651
    652    case USB_RET_BABBLE:
    653        td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
    654        /* frame interrupted */
    655        trace_usb_uhci_packet_complete_babble(queue_token, td_addr);
    656        ret = TD_RESULT_STOP_FRAME;
    657        break;
    658
    659    case USB_RET_IOERROR:
    660    case USB_RET_NODEV:
    661    default:
    662        td->ctrl |= TD_CTRL_TIMEOUT;
    663        td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
    664        trace_usb_uhci_packet_complete_error(queue_token, td_addr);
    665        ret = TD_RESULT_NEXT_QH;
    666        break;
    667    }
    668
    669    td->ctrl &= ~TD_CTRL_ACTIVE;
    670    s->status |= UHCI_STS_USBERR;
    671    if (td->ctrl & TD_CTRL_IOC) {
    672        *int_mask |= 0x01;
    673    }
    674    uhci_update_irq(s);
    675    return ret;
    676}
    677
    678static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
    679{
    680    int len = 0, max_len;
    681    uint8_t pid;
    682
    683    max_len = ((td->token >> 21) + 1) & 0x7ff;
    684    pid = td->token & 0xff;
    685
    686    if (td->ctrl & TD_CTRL_IOS)
    687        td->ctrl &= ~TD_CTRL_ACTIVE;
    688
    689    if (async->packet.status != USB_RET_SUCCESS) {
    690        return uhci_handle_td_error(s, td, async->td_addr,
    691                                    async->packet.status, int_mask);
    692    }
    693
    694    len = async->packet.actual_length;
    695    td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
    696
    697    /* The NAK bit may have been set by a previous frame, so clear it
    698       here.  The docs are somewhat unclear, but win2k relies on this
    699       behavior.  */
    700    td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
    701    if (td->ctrl & TD_CTRL_IOC)
    702        *int_mask |= 0x01;
    703
    704    if (pid == USB_TOKEN_IN) {
    705        pci_dma_write(&s->dev, td->buffer, async->buf, len);
    706        if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
    707            *int_mask |= 0x02;
    708            /* short packet: do not update QH */
    709            trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
    710                                                     async->td_addr);
    711            return TD_RESULT_NEXT_QH;
    712        }
    713    }
    714
    715    /* success */
    716    trace_usb_uhci_packet_complete_success(async->queue->token,
    717                                           async->td_addr);
    718    return TD_RESULT_COMPLETE;
    719}
    720
    721static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
    722                          UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
    723{
    724    int ret, max_len;
    725    bool spd;
    726    bool queuing = (q != NULL);
    727    uint8_t pid = td->token & 0xff;
    728    UHCIAsync *async;
    729
    730    async = uhci_async_find_td(s, td_addr);
    731    if (async) {
    732        if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
    733            assert(q == NULL || q == async->queue);
    734            q = async->queue;
    735        } else {
    736            uhci_queue_free(async->queue, "guest re-used pending td");
    737            async = NULL;
    738        }
    739    }
    740
    741    if (q == NULL) {
    742        q = uhci_queue_find(s, td);
    743        if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
    744            uhci_queue_free(q, "guest re-used qh");
    745            q = NULL;
    746        }
    747    }
    748
    749    if (q) {
    750        q->valid = QH_VALID;
    751    }
    752
    753    /* Is active ? */
    754    if (!(td->ctrl & TD_CTRL_ACTIVE)) {
    755        if (async) {
    756            /* Guest marked a pending td non-active, cancel the queue */
    757            uhci_queue_free(async->queue, "pending td non-active");
    758        }
    759        /*
    760         * ehci11d spec page 22: "Even if the Active bit in the TD is already
    761         * cleared when the TD is fetched ... an IOC interrupt is generated"
    762         */
    763        if (td->ctrl & TD_CTRL_IOC) {
    764                *int_mask |= 0x01;
    765        }
    766        return TD_RESULT_NEXT_QH;
    767    }
    768
    769    switch (pid) {
    770    case USB_TOKEN_OUT:
    771    case USB_TOKEN_SETUP:
    772    case USB_TOKEN_IN:
    773        break;
    774    default:
    775        /* invalid pid : frame interrupted */
    776        s->status |= UHCI_STS_HCPERR;
    777        s->cmd &= ~UHCI_CMD_RS;
    778        uhci_update_irq(s);
    779        return TD_RESULT_STOP_FRAME;
    780    }
    781
    782    if (async) {
    783        if (queuing) {
    784            /* we are busy filling the queue, we are not prepared
    785               to consume completed packages then, just leave them
    786               in async state */
    787            return TD_RESULT_ASYNC_CONT;
    788        }
    789        if (!async->done) {
    790            UHCI_TD last_td;
    791            UHCIAsync *last = QTAILQ_LAST(&async->queue->asyncs);
    792            /*
    793             * While we are waiting for the current td to complete, the guest
    794             * may have added more tds to the queue. Note we re-read the td
    795             * rather then caching it, as we want to see guest made changes!
    796             */
    797            uhci_read_td(s, &last_td, last->td_addr);
    798            uhci_queue_fill(async->queue, &last_td);
    799
    800            return TD_RESULT_ASYNC_CONT;
    801        }
    802        uhci_async_unlink(async);
    803        goto done;
    804    }
    805
    806    if (s->completions_only) {
    807        return TD_RESULT_ASYNC_CONT;
    808    }
    809
    810    /* Allocate new packet */
    811    if (q == NULL) {
    812        USBDevice *dev;
    813        USBEndpoint *ep;
    814
    815        dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
    816        if (dev == NULL) {
    817            return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
    818                                        int_mask);
    819        }
    820        ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
    821        q = uhci_queue_new(s, qh_addr, td, ep);
    822    }
    823    async = uhci_async_alloc(q, td_addr);
    824
    825    max_len = ((td->token >> 21) + 1) & 0x7ff;
    826    spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
    827    usb_packet_setup(&async->packet, pid, q->ep, 0, td_addr, spd,
    828                     (td->ctrl & TD_CTRL_IOC) != 0);
    829    if (max_len <= sizeof(async->static_buf)) {
    830        async->buf = async->static_buf;
    831    } else {
    832        async->buf = g_malloc(max_len);
    833    }
    834    usb_packet_addbuf(&async->packet, async->buf, max_len);
    835
    836    switch(pid) {
    837    case USB_TOKEN_OUT:
    838    case USB_TOKEN_SETUP:
    839        pci_dma_read(&s->dev, td->buffer, async->buf, max_len);
    840        usb_handle_packet(q->ep->dev, &async->packet);
    841        if (async->packet.status == USB_RET_SUCCESS) {
    842            async->packet.actual_length = max_len;
    843        }
    844        break;
    845
    846    case USB_TOKEN_IN:
    847        usb_handle_packet(q->ep->dev, &async->packet);
    848        break;
    849
    850    default:
    851        abort(); /* Never to execute */
    852    }
    853
    854    if (async->packet.status == USB_RET_ASYNC) {
    855        uhci_async_link(async);
    856        if (!queuing) {
    857            uhci_queue_fill(q, td);
    858        }
    859        return TD_RESULT_ASYNC_START;
    860    }
    861
    862done:
    863    ret = uhci_complete_td(s, td, async, int_mask);
    864    uhci_async_free(async);
    865    return ret;
    866}
    867
    868static void uhci_async_complete(USBPort *port, USBPacket *packet)
    869{
    870    UHCIAsync *async = container_of(packet, UHCIAsync, packet);
    871    UHCIState *s = async->queue->uhci;
    872
    873    if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
    874        uhci_async_cancel(async);
    875        return;
    876    }
    877
    878    async->done = 1;
    879    /* Force processing of this packet *now*, needed for migration */
    880    s->completions_only = true;
    881    qemu_bh_schedule(s->bh);
    882}
    883
    884static int is_valid(uint32_t link)
    885{
    886    return (link & 1) == 0;
    887}
    888
    889static int is_qh(uint32_t link)
    890{
    891    return (link & 2) != 0;
    892}
    893
    894static int depth_first(uint32_t link)
    895{
    896    return (link & 4) != 0;
    897}
    898
    899/* QH DB used for detecting QH loops */
    900#define UHCI_MAX_QUEUES 128
    901typedef struct {
    902    uint32_t addr[UHCI_MAX_QUEUES];
    903    int      count;
    904} QhDb;
    905
    906static void qhdb_reset(QhDb *db)
    907{
    908    db->count = 0;
    909}
    910
    911/* Add QH to DB. Returns 1 if already present or DB is full. */
    912static int qhdb_insert(QhDb *db, uint32_t addr)
    913{
    914    int i;
    915    for (i = 0; i < db->count; i++)
    916        if (db->addr[i] == addr)
    917            return 1;
    918
    919    if (db->count >= UHCI_MAX_QUEUES)
    920        return 1;
    921
    922    db->addr[db->count++] = addr;
    923    return 0;
    924}
    925
    926static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td)
    927{
    928    uint32_t int_mask = 0;
    929    uint32_t plink = td->link;
    930    UHCI_TD ptd;
    931    int ret;
    932
    933    while (is_valid(plink)) {
    934        uhci_read_td(q->uhci, &ptd, plink);
    935        if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
    936            break;
    937        }
    938        if (uhci_queue_token(&ptd) != q->token) {
    939            break;
    940        }
    941        trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
    942        ret = uhci_handle_td(q->uhci, q, q->qh_addr, &ptd, plink, &int_mask);
    943        if (ret == TD_RESULT_ASYNC_CONT) {
    944            break;
    945        }
    946        assert(ret == TD_RESULT_ASYNC_START);
    947        assert(int_mask == 0);
    948        plink = ptd.link;
    949    }
    950    usb_device_flush_ep_queue(q->ep->dev, q->ep);
    951}
    952
    953static void uhci_process_frame(UHCIState *s)
    954{
    955    uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
    956    uint32_t curr_qh, td_count = 0;
    957    int cnt, ret;
    958    UHCI_TD td;
    959    UHCI_QH qh;
    960    QhDb qhdb;
    961
    962    frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
    963
    964    pci_dma_read(&s->dev, frame_addr, &link, 4);
    965    le32_to_cpus(&link);
    966
    967    int_mask = 0;
    968    curr_qh  = 0;
    969
    970    qhdb_reset(&qhdb);
    971
    972    for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
    973        if (!s->completions_only && s->frame_bytes >= s->frame_bandwidth) {
    974            /* We've reached the usb 1.1 bandwidth, which is
    975               1280 bytes/frame, stop processing */
    976            trace_usb_uhci_frame_stop_bandwidth();
    977            break;
    978        }
    979        if (is_qh(link)) {
    980            /* QH */
    981            trace_usb_uhci_qh_load(link & ~0xf);
    982
    983            if (qhdb_insert(&qhdb, link)) {
    984                /*
    985                 * We're going in circles. Which is not a bug because
    986                 * HCD is allowed to do that as part of the BW management.
    987                 *
    988                 * Stop processing here if no transaction has been done
    989                 * since we've been here last time.
    990                 */
    991                if (td_count == 0) {
    992                    trace_usb_uhci_frame_loop_stop_idle();
    993                    break;
    994                } else {
    995                    trace_usb_uhci_frame_loop_continue();
    996                    td_count = 0;
    997                    qhdb_reset(&qhdb);
    998                    qhdb_insert(&qhdb, link);
    999                }
   1000            }
   1001
   1002            pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
   1003            le32_to_cpus(&qh.link);
   1004            le32_to_cpus(&qh.el_link);
   1005
   1006            if (!is_valid(qh.el_link)) {
   1007                /* QH w/o elements */
   1008                curr_qh = 0;
   1009                link = qh.link;
   1010            } else {
   1011                /* QH with elements */
   1012                curr_qh = link;
   1013                link = qh.el_link;
   1014            }
   1015            continue;
   1016        }
   1017
   1018        /* TD */
   1019        uhci_read_td(s, &td, link);
   1020        trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
   1021
   1022        old_td_ctrl = td.ctrl;
   1023        ret = uhci_handle_td(s, NULL, curr_qh, &td, link, &int_mask);
   1024        if (old_td_ctrl != td.ctrl) {
   1025            /* update the status bits of the TD */
   1026            val = cpu_to_le32(td.ctrl);
   1027            pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
   1028        }
   1029
   1030        switch (ret) {
   1031        case TD_RESULT_STOP_FRAME: /* interrupted frame */
   1032            goto out;
   1033
   1034        case TD_RESULT_NEXT_QH:
   1035        case TD_RESULT_ASYNC_CONT:
   1036            trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
   1037            link = curr_qh ? qh.link : td.link;
   1038            continue;
   1039
   1040        case TD_RESULT_ASYNC_START:
   1041            trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
   1042            link = curr_qh ? qh.link : td.link;
   1043            continue;
   1044
   1045        case TD_RESULT_COMPLETE:
   1046            trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
   1047            link = td.link;
   1048            td_count++;
   1049            s->frame_bytes += (td.ctrl & 0x7ff) + 1;
   1050
   1051            if (curr_qh) {
   1052                /* update QH element link */
   1053                qh.el_link = link;
   1054                val = cpu_to_le32(qh.el_link);
   1055                pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
   1056
   1057                if (!depth_first(link)) {
   1058                    /* done with this QH */
   1059                    curr_qh = 0;
   1060                    link    = qh.link;
   1061                }
   1062            }
   1063            break;
   1064
   1065        default:
   1066            assert(!"unknown return code");
   1067        }
   1068
   1069        /* go to the next entry */
   1070    }
   1071
   1072out:
   1073    s->pending_int_mask |= int_mask;
   1074}
   1075
   1076static void uhci_bh(void *opaque)
   1077{
   1078    UHCIState *s = opaque;
   1079    uhci_process_frame(s);
   1080}
   1081
   1082static void uhci_frame_timer(void *opaque)
   1083{
   1084    UHCIState *s = opaque;
   1085    uint64_t t_now, t_last_run;
   1086    int i, frames;
   1087    const uint64_t frame_t = NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ;
   1088
   1089    s->completions_only = false;
   1090    qemu_bh_cancel(s->bh);
   1091
   1092    if (!(s->cmd & UHCI_CMD_RS)) {
   1093        /* Full stop */
   1094        trace_usb_uhci_schedule_stop();
   1095        timer_del(s->frame_timer);
   1096        uhci_async_cancel_all(s);
   1097        /* set hchalted bit in status - UHCI11D 2.1.2 */
   1098        s->status |= UHCI_STS_HCHALTED;
   1099        return;
   1100    }
   1101
   1102    /* We still store expire_time in our state, for migration */
   1103    t_last_run = s->expire_time - frame_t;
   1104    t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
   1105
   1106    /* Process up to MAX_FRAMES_PER_TICK frames */
   1107    frames = (t_now - t_last_run) / frame_t;
   1108    if (frames > s->maxframes) {
   1109        int skipped = frames - s->maxframes;
   1110        s->expire_time += skipped * frame_t;
   1111        s->frnum = (s->frnum + skipped) & 0x7ff;
   1112        frames -= skipped;
   1113    }
   1114    if (frames > MAX_FRAMES_PER_TICK) {
   1115        frames = MAX_FRAMES_PER_TICK;
   1116    }
   1117
   1118    for (i = 0; i < frames; i++) {
   1119        s->frame_bytes = 0;
   1120        trace_usb_uhci_frame_start(s->frnum);
   1121        uhci_async_validate_begin(s);
   1122        uhci_process_frame(s);
   1123        uhci_async_validate_end(s);
   1124        /* The spec says frnum is the frame currently being processed, and
   1125         * the guest must look at frnum - 1 on interrupt, so inc frnum now */
   1126        s->frnum = (s->frnum + 1) & 0x7ff;
   1127        s->expire_time += frame_t;
   1128    }
   1129
   1130    /* Complete the previous frame(s) */
   1131    if (s->pending_int_mask) {
   1132        s->status2 |= s->pending_int_mask;
   1133        s->status  |= UHCI_STS_USBINT;
   1134        uhci_update_irq(s);
   1135    }
   1136    s->pending_int_mask = 0;
   1137
   1138    timer_mod(s->frame_timer, t_now + frame_t);
   1139}
   1140
   1141static const MemoryRegionOps uhci_ioport_ops = {
   1142    .read  = uhci_port_read,
   1143    .write = uhci_port_write,
   1144    .valid.min_access_size = 1,
   1145    .valid.max_access_size = 4,
   1146    .impl.min_access_size = 2,
   1147    .impl.max_access_size = 2,
   1148    .endianness = DEVICE_LITTLE_ENDIAN,
   1149};
   1150
   1151static USBPortOps uhci_port_ops = {
   1152    .attach = uhci_attach,
   1153    .detach = uhci_detach,
   1154    .child_detach = uhci_child_detach,
   1155    .wakeup = uhci_wakeup,
   1156    .complete = uhci_async_complete,
   1157};
   1158
   1159static USBBusOps uhci_bus_ops = {
   1160};
   1161
   1162void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
   1163{
   1164    Error *err = NULL;
   1165    PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
   1166    UHCIPCIDeviceClass *u = container_of(pc, UHCIPCIDeviceClass, parent_class);
   1167    UHCIState *s = UHCI(dev);
   1168    uint8_t *pci_conf = s->dev.config;
   1169    int i;
   1170
   1171    pci_conf[PCI_CLASS_PROG] = 0x00;
   1172    /* TODO: reset value should be 0. */
   1173    pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
   1174
   1175    pci_config_set_interrupt_pin(pci_conf, u->info.irq_pin + 1);
   1176
   1177    if (s->masterbus) {
   1178        USBPort *ports[NB_PORTS];
   1179        for(i = 0; i < NB_PORTS; i++) {
   1180            ports[i] = &s->ports[i].port;
   1181        }
   1182        usb_register_companion(s->masterbus, ports, NB_PORTS,
   1183                               s->firstport, s, &uhci_port_ops,
   1184                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL,
   1185                               &err);
   1186        if (err) {
   1187            error_propagate(errp, err);
   1188            return;
   1189        }
   1190    } else {
   1191        usb_bus_new(&s->bus, sizeof(s->bus), &uhci_bus_ops, DEVICE(dev));
   1192        for (i = 0; i < NB_PORTS; i++) {
   1193            usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
   1194                              USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
   1195        }
   1196    }
   1197    s->bh = qemu_bh_new(uhci_bh, s);
   1198    s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, uhci_frame_timer, s);
   1199    s->num_ports_vmstate = NB_PORTS;
   1200    QTAILQ_INIT(&s->queues);
   1201
   1202    memory_region_init_io(&s->io_bar, OBJECT(s), &uhci_ioport_ops, s,
   1203                          "uhci", 0x20);
   1204
   1205    /* Use region 4 for consistency with real hardware.  BSD guests seem
   1206       to rely on this.  */
   1207    pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
   1208}
   1209
   1210static void usb_uhci_exit(PCIDevice *dev)
   1211{
   1212    UHCIState *s = UHCI(dev);
   1213
   1214    trace_usb_uhci_exit();
   1215
   1216    if (s->frame_timer) {
   1217        timer_free(s->frame_timer);
   1218        s->frame_timer = NULL;
   1219    }
   1220
   1221    if (s->bh) {
   1222        qemu_bh_delete(s->bh);
   1223    }
   1224
   1225    uhci_async_cancel_all(s);
   1226
   1227    if (!s->masterbus) {
   1228        usb_bus_release(&s->bus);
   1229    }
   1230}
   1231
   1232static Property uhci_properties_companion[] = {
   1233    DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
   1234    DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
   1235    DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
   1236    DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
   1237    DEFINE_PROP_END_OF_LIST(),
   1238};
   1239static Property uhci_properties_standalone[] = {
   1240    DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
   1241    DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
   1242    DEFINE_PROP_END_OF_LIST(),
   1243};
   1244
   1245static void uhci_class_init(ObjectClass *klass, void *data)
   1246{
   1247    DeviceClass *dc = DEVICE_CLASS(klass);
   1248    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
   1249
   1250    k->class_id  = PCI_CLASS_SERIAL_USB;
   1251    dc->vmsd = &vmstate_uhci;
   1252    dc->reset = uhci_reset;
   1253    set_bit(DEVICE_CATEGORY_USB, dc->categories);
   1254}
   1255
   1256static const TypeInfo uhci_pci_type_info = {
   1257    .name = TYPE_UHCI,
   1258    .parent = TYPE_PCI_DEVICE,
   1259    .instance_size = sizeof(UHCIState),
   1260    .class_size    = sizeof(UHCIPCIDeviceClass),
   1261    .abstract = true,
   1262    .class_init = uhci_class_init,
   1263    .interfaces = (InterfaceInfo[]) {
   1264        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
   1265        { },
   1266    },
   1267};
   1268
   1269void uhci_data_class_init(ObjectClass *klass, void *data)
   1270{
   1271    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
   1272    DeviceClass *dc = DEVICE_CLASS(klass);
   1273    UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);
   1274    UHCIInfo *info = data;
   1275
   1276    k->realize = info->realize ? info->realize : usb_uhci_common_realize;
   1277    k->exit = info->unplug ? usb_uhci_exit : NULL;
   1278    k->vendor_id = info->vendor_id;
   1279    k->device_id = info->device_id;
   1280    k->revision  = info->revision;
   1281    if (!info->unplug) {
   1282        /* uhci controllers in companion setups can't be hotplugged */
   1283        dc->hotpluggable = false;
   1284        device_class_set_props(dc, uhci_properties_companion);
   1285    } else {
   1286        device_class_set_props(dc, uhci_properties_standalone);
   1287    }
   1288    u->info = *info;
   1289}
   1290
   1291static UHCIInfo uhci_info[] = {
   1292    {
   1293        .name       = "piix3-usb-uhci",
   1294        .vendor_id = PCI_VENDOR_ID_INTEL,
   1295        .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
   1296        .revision  = 0x01,
   1297        .irq_pin   = 3,
   1298        .unplug    = true,
   1299    },{
   1300        .name      = "piix4-usb-uhci",
   1301        .vendor_id = PCI_VENDOR_ID_INTEL,
   1302        .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
   1303        .revision  = 0x01,
   1304        .irq_pin   = 3,
   1305        .unplug    = true,
   1306    },{
   1307        .name      = "ich9-usb-uhci1", /* 00:1d.0 */
   1308        .vendor_id = PCI_VENDOR_ID_INTEL,
   1309        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
   1310        .revision  = 0x03,
   1311        .irq_pin   = 0,
   1312        .unplug    = false,
   1313    },{
   1314        .name      = "ich9-usb-uhci2", /* 00:1d.1 */
   1315        .vendor_id = PCI_VENDOR_ID_INTEL,
   1316        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
   1317        .revision  = 0x03,
   1318        .irq_pin   = 1,
   1319        .unplug    = false,
   1320    },{
   1321        .name      = "ich9-usb-uhci3", /* 00:1d.2 */
   1322        .vendor_id = PCI_VENDOR_ID_INTEL,
   1323        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
   1324        .revision  = 0x03,
   1325        .irq_pin   = 2,
   1326        .unplug    = false,
   1327    },{
   1328        .name      = "ich9-usb-uhci4", /* 00:1a.0 */
   1329        .vendor_id = PCI_VENDOR_ID_INTEL,
   1330        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI4,
   1331        .revision  = 0x03,
   1332        .irq_pin   = 0,
   1333        .unplug    = false,
   1334    },{
   1335        .name      = "ich9-usb-uhci5", /* 00:1a.1 */
   1336        .vendor_id = PCI_VENDOR_ID_INTEL,
   1337        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI5,
   1338        .revision  = 0x03,
   1339        .irq_pin   = 1,
   1340        .unplug    = false,
   1341    },{
   1342        .name      = "ich9-usb-uhci6", /* 00:1a.2 */
   1343        .vendor_id = PCI_VENDOR_ID_INTEL,
   1344        .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI6,
   1345        .revision  = 0x03,
   1346        .irq_pin   = 2,
   1347        .unplug    = false,
   1348    }
   1349};
   1350
   1351static void uhci_register_types(void)
   1352{
   1353    TypeInfo uhci_type_info = {
   1354        .parent        = TYPE_UHCI,
   1355        .class_init    = uhci_data_class_init,
   1356    };
   1357    int i;
   1358
   1359    type_register_static(&uhci_pci_type_info);
   1360
   1361    for (i = 0; i < ARRAY_SIZE(uhci_info); i++) {
   1362        uhci_type_info.name = uhci_info[i].name;
   1363        uhci_type_info.class_data = uhci_info + i;
   1364        type_register(&uhci_type_info);
   1365    }
   1366}
   1367
   1368type_init(uhci_register_types)