xref: /openbmc/qemu/hw/usb/hcd-uhci.c (revision 40507377261250fe19e441300788c77b748688cb)
1 /*
2  * USB UHCI controller emulation
3  *
4  * Copyright (c) 2005 Fabrice Bellard
5  *
6  * Copyright (c) 2008 Max Krasnyansky
7  *     Magor rewrite of the UHCI data structures parser and frame processor
8  *     Support for fully async operation and multiple outstanding transactions
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 #include "hw/hw.h"
29 #include "hw/usb.h"
30 #include "hw/pci.h"
31 #include "qemu-timer.h"
32 #include "iov.h"
33 #include "dma.h"
34 #include "trace.h"
35 
36 //#define DEBUG
37 //#define DEBUG_DUMP_DATA
38 
39 #define UHCI_CMD_FGR      (1 << 4)
40 #define UHCI_CMD_EGSM     (1 << 3)
41 #define UHCI_CMD_GRESET   (1 << 2)
42 #define UHCI_CMD_HCRESET  (1 << 1)
43 #define UHCI_CMD_RS       (1 << 0)
44 
45 #define UHCI_STS_HCHALTED (1 << 5)
46 #define UHCI_STS_HCPERR   (1 << 4)
47 #define UHCI_STS_HSERR    (1 << 3)
48 #define UHCI_STS_RD       (1 << 2)
49 #define UHCI_STS_USBERR   (1 << 1)
50 #define UHCI_STS_USBINT   (1 << 0)
51 
52 #define TD_CTRL_SPD     (1 << 29)
53 #define TD_CTRL_ERROR_SHIFT  27
54 #define TD_CTRL_IOS     (1 << 25)
55 #define TD_CTRL_IOC     (1 << 24)
56 #define TD_CTRL_ACTIVE  (1 << 23)
57 #define TD_CTRL_STALL   (1 << 22)
58 #define TD_CTRL_BABBLE  (1 << 20)
59 #define TD_CTRL_NAK     (1 << 19)
60 #define TD_CTRL_TIMEOUT (1 << 18)
61 
62 #define UHCI_PORT_SUSPEND (1 << 12)
63 #define UHCI_PORT_RESET (1 << 9)
64 #define UHCI_PORT_LSDA  (1 << 8)
65 #define UHCI_PORT_RD    (1 << 6)
66 #define UHCI_PORT_ENC   (1 << 3)
67 #define UHCI_PORT_EN    (1 << 2)
68 #define UHCI_PORT_CSC   (1 << 1)
69 #define UHCI_PORT_CCS   (1 << 0)
70 
71 #define UHCI_PORT_READ_ONLY    (0x1bb)
72 #define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
73 
74 #define FRAME_TIMER_FREQ 1000
75 
76 #define FRAME_MAX_LOOPS  256
77 
78 #define NB_PORTS 2
79 
80 enum {
81     TD_RESULT_STOP_FRAME = 10,
82     TD_RESULT_COMPLETE,
83     TD_RESULT_NEXT_QH,
84     TD_RESULT_ASYNC_START,
85     TD_RESULT_ASYNC_CONT,
86 };
87 
88 typedef struct UHCIState UHCIState;
89 typedef struct UHCIAsync UHCIAsync;
90 typedef struct UHCIQueue UHCIQueue;
91 
92 /*
93  * Pending async transaction.
94  * 'packet' must be the first field because completion
95  * handler does "(UHCIAsync *) pkt" cast.
96  */
97 
98 struct UHCIAsync {
99     USBPacket packet;
100     QEMUSGList sgl;
101     UHCIQueue *queue;
102     QTAILQ_ENTRY(UHCIAsync) next;
103     uint32_t  td;
104     uint8_t   done;
105 };
106 
107 struct UHCIQueue {
108     uint32_t  token;
109     UHCIState *uhci;
110     QTAILQ_ENTRY(UHCIQueue) next;
111     QTAILQ_HEAD(, UHCIAsync) asyncs;
112     int8_t    valid;
113 };
114 
115 typedef struct UHCIPort {
116     USBPort port;
117     uint16_t ctrl;
118 } UHCIPort;
119 
120 struct UHCIState {
121     PCIDevice dev;
122     MemoryRegion io_bar;
123     USBBus bus; /* Note unused when we're a companion controller */
124     uint16_t cmd; /* cmd register */
125     uint16_t status;
126     uint16_t intr; /* interrupt enable register */
127     uint16_t frnum; /* frame number */
128     uint32_t fl_base_addr; /* frame list base address */
129     uint8_t sof_timing;
130     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
131     int64_t expire_time;
132     QEMUTimer *frame_timer;
133     QEMUBH *bh;
134     uint32_t frame_bytes;
135     uint32_t frame_bandwidth;
136     UHCIPort ports[NB_PORTS];
137 
138     /* Interrupts that should be raised at the end of the current frame.  */
139     uint32_t pending_int_mask;
140     int irq_pin;
141 
142     /* Active packets */
143     QTAILQ_HEAD(, UHCIQueue) queues;
144     uint8_t num_ports_vmstate;
145 
146     /* Properties */
147     char *masterbus;
148     uint32_t firstport;
149 };
150 
151 typedef struct UHCI_TD {
152     uint32_t link;
153     uint32_t ctrl; /* see TD_CTRL_xxx */
154     uint32_t token;
155     uint32_t buffer;
156 } UHCI_TD;
157 
158 typedef struct UHCI_QH {
159     uint32_t link;
160     uint32_t el_link;
161 } UHCI_QH;
162 
163 static void uhci_async_cancel(UHCIAsync *async);
164 
165 static inline int32_t uhci_queue_token(UHCI_TD *td)
166 {
167     /* covers ep, dev, pid -> identifies the endpoint */
168     return td->token & 0x7ffff;
169 }
170 
171 static UHCIQueue *uhci_queue_get(UHCIState *s, UHCI_TD *td)
172 {
173     uint32_t token = uhci_queue_token(td);
174     UHCIQueue *queue;
175 
176     QTAILQ_FOREACH(queue, &s->queues, next) {
177         if (queue->token == token) {
178             return queue;
179         }
180     }
181 
182     queue = g_new0(UHCIQueue, 1);
183     queue->uhci = s;
184     queue->token = token;
185     QTAILQ_INIT(&queue->asyncs);
186     QTAILQ_INSERT_HEAD(&s->queues, queue, next);
187     trace_usb_uhci_queue_add(queue->token);
188     return queue;
189 }
190 
191 static void uhci_queue_free(UHCIQueue *queue)
192 {
193     UHCIState *s = queue->uhci;
194     UHCIAsync *async;
195 
196     while (!QTAILQ_EMPTY(&queue->asyncs)) {
197         async = QTAILQ_FIRST(&queue->asyncs);
198         uhci_async_cancel(async);
199     }
200 
201     trace_usb_uhci_queue_del(queue->token);
202     QTAILQ_REMOVE(&s->queues, queue, next);
203     g_free(queue);
204 }
205 
206 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t addr)
207 {
208     UHCIAsync *async = g_new0(UHCIAsync, 1);
209 
210     async->queue = queue;
211     async->td = addr;
212     usb_packet_init(&async->packet);
213     pci_dma_sglist_init(&async->sgl, &queue->uhci->dev, 1);
214     trace_usb_uhci_packet_add(async->queue->token, async->td);
215 
216     return async;
217 }
218 
219 static void uhci_async_free(UHCIAsync *async)
220 {
221     trace_usb_uhci_packet_del(async->queue->token, async->td);
222     usb_packet_cleanup(&async->packet);
223     qemu_sglist_destroy(&async->sgl);
224     g_free(async);
225 }
226 
227 static void uhci_async_link(UHCIAsync *async)
228 {
229     UHCIQueue *queue = async->queue;
230     QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
231     trace_usb_uhci_packet_link_async(async->queue->token, async->td);
232 }
233 
234 static void uhci_async_unlink(UHCIAsync *async)
235 {
236     UHCIQueue *queue = async->queue;
237     QTAILQ_REMOVE(&queue->asyncs, async, next);
238     trace_usb_uhci_packet_unlink_async(async->queue->token, async->td);
239 }
240 
241 static void uhci_async_cancel(UHCIAsync *async)
242 {
243     uhci_async_unlink(async);
244     trace_usb_uhci_packet_cancel(async->queue->token, async->td, async->done);
245     if (!async->done)
246         usb_cancel_packet(&async->packet);
247     usb_packet_unmap(&async->packet, &async->sgl);
248     uhci_async_free(async);
249 }
250 
251 /*
252  * Mark all outstanding async packets as invalid.
253  * This is used for canceling them when TDs are removed by the HCD.
254  */
255 static void uhci_async_validate_begin(UHCIState *s)
256 {
257     UHCIQueue *queue;
258 
259     QTAILQ_FOREACH(queue, &s->queues, next) {
260         queue->valid--;
261     }
262 }
263 
264 /*
265  * Cancel async packets that are no longer valid
266  */
267 static void uhci_async_validate_end(UHCIState *s)
268 {
269     UHCIQueue *queue, *n;
270 
271     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
272         if (!queue->valid) {
273             uhci_queue_free(queue);
274         }
275     }
276 }
277 
278 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
279 {
280     UHCIQueue *queue;
281     UHCIAsync *curr, *n;
282 
283     QTAILQ_FOREACH(queue, &s->queues, next) {
284         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
285             if (!usb_packet_is_inflight(&curr->packet) ||
286                 curr->packet.ep->dev != dev) {
287                 continue;
288             }
289             uhci_async_cancel(curr);
290         }
291     }
292 }
293 
294 static void uhci_async_cancel_all(UHCIState *s)
295 {
296     UHCIQueue *queue, *nq;
297 
298     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
299         uhci_queue_free(queue);
300     }
301 }
302 
303 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, UHCI_TD *td)
304 {
305     uint32_t token = uhci_queue_token(td);
306     UHCIQueue *queue;
307     UHCIAsync *async;
308 
309     QTAILQ_FOREACH(queue, &s->queues, next) {
310         if (queue->token == token) {
311             break;
312         }
313     }
314     if (queue == NULL) {
315         return NULL;
316     }
317 
318     QTAILQ_FOREACH(async, &queue->asyncs, next) {
319         if (async->td == addr) {
320             return async;
321         }
322     }
323 
324     return NULL;
325 }
326 
327 static void uhci_update_irq(UHCIState *s)
328 {
329     int level;
330     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
331         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
332         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
333         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
334         (s->status & UHCI_STS_HSERR) ||
335         (s->status & UHCI_STS_HCPERR)) {
336         level = 1;
337     } else {
338         level = 0;
339     }
340     qemu_set_irq(s->dev.irq[s->irq_pin], level);
341 }
342 
343 static void uhci_reset(void *opaque)
344 {
345     UHCIState *s = opaque;
346     uint8_t *pci_conf;
347     int i;
348     UHCIPort *port;
349 
350     trace_usb_uhci_reset();
351 
352     pci_conf = s->dev.config;
353 
354     pci_conf[0x6a] = 0x01; /* usb clock */
355     pci_conf[0x6b] = 0x00;
356     s->cmd = 0;
357     s->status = 0;
358     s->status2 = 0;
359     s->intr = 0;
360     s->fl_base_addr = 0;
361     s->sof_timing = 64;
362 
363     for(i = 0; i < NB_PORTS; i++) {
364         port = &s->ports[i];
365         port->ctrl = 0x0080;
366         if (port->port.dev && port->port.dev->attached) {
367             usb_port_reset(&port->port);
368         }
369     }
370 
371     uhci_async_cancel_all(s);
372     qemu_bh_cancel(s->bh);
373     uhci_update_irq(s);
374 }
375 
376 static const VMStateDescription vmstate_uhci_port = {
377     .name = "uhci port",
378     .version_id = 1,
379     .minimum_version_id = 1,
380     .minimum_version_id_old = 1,
381     .fields      = (VMStateField []) {
382         VMSTATE_UINT16(ctrl, UHCIPort),
383         VMSTATE_END_OF_LIST()
384     }
385 };
386 
387 static int uhci_post_load(void *opaque, int version_id)
388 {
389     UHCIState *s = opaque;
390 
391     if (version_id < 2) {
392         s->expire_time = qemu_get_clock_ns(vm_clock) +
393             (get_ticks_per_sec() / FRAME_TIMER_FREQ);
394     }
395     return 0;
396 }
397 
398 static const VMStateDescription vmstate_uhci = {
399     .name = "uhci",
400     .version_id = 2,
401     .minimum_version_id = 1,
402     .minimum_version_id_old = 1,
403     .post_load = uhci_post_load,
404     .fields      = (VMStateField []) {
405         VMSTATE_PCI_DEVICE(dev, UHCIState),
406         VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
407         VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
408                              vmstate_uhci_port, UHCIPort),
409         VMSTATE_UINT16(cmd, UHCIState),
410         VMSTATE_UINT16(status, UHCIState),
411         VMSTATE_UINT16(intr, UHCIState),
412         VMSTATE_UINT16(frnum, UHCIState),
413         VMSTATE_UINT32(fl_base_addr, UHCIState),
414         VMSTATE_UINT8(sof_timing, UHCIState),
415         VMSTATE_UINT8(status2, UHCIState),
416         VMSTATE_TIMER(frame_timer, UHCIState),
417         VMSTATE_INT64_V(expire_time, UHCIState, 2),
418         VMSTATE_END_OF_LIST()
419     }
420 };
421 
422 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
423 {
424     UHCIState *s = opaque;
425 
426     addr &= 0x1f;
427     switch(addr) {
428     case 0x0c:
429         s->sof_timing = val;
430         break;
431     }
432 }
433 
434 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
435 {
436     UHCIState *s = opaque;
437     uint32_t val;
438 
439     addr &= 0x1f;
440     switch(addr) {
441     case 0x0c:
442         val = s->sof_timing;
443         break;
444     default:
445         val = 0xff;
446         break;
447     }
448     return val;
449 }
450 
451 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
452 {
453     UHCIState *s = opaque;
454 
455     addr &= 0x1f;
456     trace_usb_uhci_mmio_writew(addr, val);
457 
458     switch(addr) {
459     case 0x00:
460         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
461             /* start frame processing */
462             trace_usb_uhci_schedule_start();
463             s->expire_time = qemu_get_clock_ns(vm_clock) +
464                 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
465             qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
466             s->status &= ~UHCI_STS_HCHALTED;
467         } else if (!(val & UHCI_CMD_RS)) {
468             s->status |= UHCI_STS_HCHALTED;
469         }
470         if (val & UHCI_CMD_GRESET) {
471             UHCIPort *port;
472             int i;
473 
474             /* send reset on the USB bus */
475             for(i = 0; i < NB_PORTS; i++) {
476                 port = &s->ports[i];
477                 usb_device_reset(port->port.dev);
478             }
479             uhci_reset(s);
480             return;
481         }
482         if (val & UHCI_CMD_HCRESET) {
483             uhci_reset(s);
484             return;
485         }
486         s->cmd = val;
487         break;
488     case 0x02:
489         s->status &= ~val;
490         /* XXX: the chip spec is not coherent, so we add a hidden
491            register to distinguish between IOC and SPD */
492         if (val & UHCI_STS_USBINT)
493             s->status2 = 0;
494         uhci_update_irq(s);
495         break;
496     case 0x04:
497         s->intr = val;
498         uhci_update_irq(s);
499         break;
500     case 0x06:
501         if (s->status & UHCI_STS_HCHALTED)
502             s->frnum = val & 0x7ff;
503         break;
504     case 0x10 ... 0x1f:
505         {
506             UHCIPort *port;
507             USBDevice *dev;
508             int n;
509 
510             n = (addr >> 1) & 7;
511             if (n >= NB_PORTS)
512                 return;
513             port = &s->ports[n];
514             dev = port->port.dev;
515             if (dev && dev->attached) {
516                 /* port reset */
517                 if ( (val & UHCI_PORT_RESET) &&
518                      !(port->ctrl & UHCI_PORT_RESET) ) {
519                     usb_device_reset(dev);
520                 }
521             }
522             port->ctrl &= UHCI_PORT_READ_ONLY;
523             port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
524             /* some bits are reset when a '1' is written to them */
525             port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
526         }
527         break;
528     }
529 }
530 
531 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
532 {
533     UHCIState *s = opaque;
534     uint32_t val;
535 
536     addr &= 0x1f;
537     switch(addr) {
538     case 0x00:
539         val = s->cmd;
540         break;
541     case 0x02:
542         val = s->status;
543         break;
544     case 0x04:
545         val = s->intr;
546         break;
547     case 0x06:
548         val = s->frnum;
549         break;
550     case 0x10 ... 0x1f:
551         {
552             UHCIPort *port;
553             int n;
554             n = (addr >> 1) & 7;
555             if (n >= NB_PORTS)
556                 goto read_default;
557             port = &s->ports[n];
558             val = port->ctrl;
559         }
560         break;
561     default:
562     read_default:
563         val = 0xff7f; /* disabled port */
564         break;
565     }
566 
567     trace_usb_uhci_mmio_readw(addr, val);
568 
569     return val;
570 }
571 
572 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
573 {
574     UHCIState *s = opaque;
575 
576     addr &= 0x1f;
577     trace_usb_uhci_mmio_writel(addr, val);
578 
579     switch(addr) {
580     case 0x08:
581         s->fl_base_addr = val & ~0xfff;
582         break;
583     }
584 }
585 
586 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
587 {
588     UHCIState *s = opaque;
589     uint32_t val;
590 
591     addr &= 0x1f;
592     switch(addr) {
593     case 0x08:
594         val = s->fl_base_addr;
595         break;
596     default:
597         val = 0xffffffff;
598         break;
599     }
600     trace_usb_uhci_mmio_readl(addr, val);
601     return val;
602 }
603 
604 /* signal resume if controller suspended */
605 static void uhci_resume (void *opaque)
606 {
607     UHCIState *s = (UHCIState *)opaque;
608 
609     if (!s)
610         return;
611 
612     if (s->cmd & UHCI_CMD_EGSM) {
613         s->cmd |= UHCI_CMD_FGR;
614         s->status |= UHCI_STS_RD;
615         uhci_update_irq(s);
616     }
617 }
618 
619 static void uhci_attach(USBPort *port1)
620 {
621     UHCIState *s = port1->opaque;
622     UHCIPort *port = &s->ports[port1->index];
623 
624     /* set connect status */
625     port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
626 
627     /* update speed */
628     if (port->port.dev->speed == USB_SPEED_LOW) {
629         port->ctrl |= UHCI_PORT_LSDA;
630     } else {
631         port->ctrl &= ~UHCI_PORT_LSDA;
632     }
633 
634     uhci_resume(s);
635 }
636 
637 static void uhci_detach(USBPort *port1)
638 {
639     UHCIState *s = port1->opaque;
640     UHCIPort *port = &s->ports[port1->index];
641 
642     uhci_async_cancel_device(s, port1->dev);
643 
644     /* set connect status */
645     if (port->ctrl & UHCI_PORT_CCS) {
646         port->ctrl &= ~UHCI_PORT_CCS;
647         port->ctrl |= UHCI_PORT_CSC;
648     }
649     /* disable port */
650     if (port->ctrl & UHCI_PORT_EN) {
651         port->ctrl &= ~UHCI_PORT_EN;
652         port->ctrl |= UHCI_PORT_ENC;
653     }
654 
655     uhci_resume(s);
656 }
657 
658 static void uhci_child_detach(USBPort *port1, USBDevice *child)
659 {
660     UHCIState *s = port1->opaque;
661 
662     uhci_async_cancel_device(s, child);
663 }
664 
665 static void uhci_wakeup(USBPort *port1)
666 {
667     UHCIState *s = port1->opaque;
668     UHCIPort *port = &s->ports[port1->index];
669 
670     if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
671         port->ctrl |= UHCI_PORT_RD;
672         uhci_resume(s);
673     }
674 }
675 
676 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
677 {
678     USBDevice *dev;
679     int i;
680 
681     for (i = 0; i < NB_PORTS; i++) {
682         UHCIPort *port = &s->ports[i];
683         if (!(port->ctrl & UHCI_PORT_EN)) {
684             continue;
685         }
686         dev = usb_find_device(&port->port, addr);
687         if (dev != NULL) {
688             return dev;
689         }
690     }
691     return NULL;
692 }
693 
694 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
695 {
696     int len = 0, max_len, err, ret;
697     uint8_t pid;
698 
699     max_len = ((td->token >> 21) + 1) & 0x7ff;
700     pid = td->token & 0xff;
701 
702     ret = async->packet.result;
703 
704     if (td->ctrl & TD_CTRL_IOS)
705         td->ctrl &= ~TD_CTRL_ACTIVE;
706 
707     if (ret < 0)
708         goto out;
709 
710     len = async->packet.result;
711     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
712 
713     /* The NAK bit may have been set by a previous frame, so clear it
714        here.  The docs are somewhat unclear, but win2k relies on this
715        behavior.  */
716     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
717     if (td->ctrl & TD_CTRL_IOC)
718         *int_mask |= 0x01;
719 
720     if (pid == USB_TOKEN_IN) {
721         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
722             *int_mask |= 0x02;
723             /* short packet: do not update QH */
724             trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
725                                                     async->td);
726             return TD_RESULT_NEXT_QH;
727         }
728     }
729 
730     /* success */
731     trace_usb_uhci_packet_complete_success(async->queue->token, async->td);
732     return TD_RESULT_COMPLETE;
733 
734 out:
735     switch(ret) {
736     case USB_RET_NAK:
737         td->ctrl |= TD_CTRL_NAK;
738         return TD_RESULT_NEXT_QH;
739 
740     case USB_RET_STALL:
741         td->ctrl |= TD_CTRL_STALL;
742         trace_usb_uhci_packet_complete_stall(async->queue->token, async->td);
743         err = TD_RESULT_NEXT_QH;
744         break;
745 
746     case USB_RET_BABBLE:
747         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
748         /* frame interrupted */
749         trace_usb_uhci_packet_complete_babble(async->queue->token, async->td);
750         err = TD_RESULT_STOP_FRAME;
751         break;
752 
753     case USB_RET_IOERROR:
754     case USB_RET_NODEV:
755     default:
756         td->ctrl |= TD_CTRL_TIMEOUT;
757         td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
758         trace_usb_uhci_packet_complete_error(async->queue->token, async->td);
759         err = TD_RESULT_NEXT_QH;
760         break;
761     }
762 
763     td->ctrl &= ~TD_CTRL_ACTIVE;
764     s->status |= UHCI_STS_USBERR;
765     if (td->ctrl & TD_CTRL_IOC) {
766         *int_mask |= 0x01;
767     }
768     uhci_update_irq(s);
769     return err;
770 }
771 
772 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td,
773                           uint32_t *int_mask, bool queuing,
774                           struct USBEndpoint **ep_ret)
775 {
776     UHCIAsync *async;
777     int len = 0, max_len;
778     uint8_t pid;
779     bool spd;
780     USBDevice *dev;
781     USBEndpoint *ep;
782 
783     /* Is active ? */
784     if (!(td->ctrl & TD_CTRL_ACTIVE)) {
785         /*
786          * ehci11d spec page 22: "Even if the Active bit in the TD is already
787          * cleared when the TD is fetched ... an IOC interrupt is generated"
788          */
789         if (td->ctrl & TD_CTRL_IOC) {
790                 *int_mask |= 0x01;
791         }
792         return TD_RESULT_NEXT_QH;
793     }
794 
795     async = uhci_async_find_td(s, addr, td);
796     if (async) {
797         /* Already submitted */
798         async->queue->valid = 32;
799 
800         if (!async->done)
801             return TD_RESULT_ASYNC_CONT;
802         if (queuing) {
803             /* we are busy filling the queue, we are not prepared
804                to consume completed packages then, just leave them
805                in async state */
806             return TD_RESULT_ASYNC_CONT;
807         }
808 
809         uhci_async_unlink(async);
810         goto done;
811     }
812 
813     /* Allocate new packet */
814     async = uhci_async_alloc(uhci_queue_get(s, td), addr);
815 
816     /* valid needs to be large enough to handle 10 frame delay
817      * for initial isochronous requests
818      */
819     async->queue->valid = 32;
820 
821     max_len = ((td->token >> 21) + 1) & 0x7ff;
822     pid = td->token & 0xff;
823     spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
824 
825     dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
826     ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
827     if (ep_ret) {
828         *ep_ret = ep;
829     }
830     usb_packet_setup(&async->packet, pid, ep, addr, spd,
831                      (td->ctrl & TD_CTRL_IOC) != 0);
832     qemu_sglist_add(&async->sgl, td->buffer, max_len);
833     usb_packet_map(&async->packet, &async->sgl);
834 
835     switch(pid) {
836     case USB_TOKEN_OUT:
837     case USB_TOKEN_SETUP:
838         len = usb_handle_packet(dev, &async->packet);
839         if (len >= 0)
840             len = max_len;
841         break;
842 
843     case USB_TOKEN_IN:
844         len = usb_handle_packet(dev, &async->packet);
845         break;
846 
847     default:
848         /* invalid pid : frame interrupted */
849         usb_packet_unmap(&async->packet, &async->sgl);
850         uhci_async_free(async);
851         s->status |= UHCI_STS_HCPERR;
852         uhci_update_irq(s);
853         return TD_RESULT_STOP_FRAME;
854     }
855 
856     if (len == USB_RET_ASYNC) {
857         uhci_async_link(async);
858         return TD_RESULT_ASYNC_START;
859     }
860 
861     async->packet.result = len;
862 
863 done:
864     len = uhci_complete_td(s, td, async, int_mask);
865     usb_packet_unmap(&async->packet, &async->sgl);
866     uhci_async_free(async);
867     return len;
868 }
869 
870 static void uhci_async_complete(USBPort *port, USBPacket *packet)
871 {
872     UHCIAsync *async = container_of(packet, UHCIAsync, packet);
873     UHCIState *s = async->queue->uhci;
874 
875     if (packet->result == USB_RET_REMOVE_FROM_QUEUE) {
876         uhci_async_unlink(async);
877         uhci_async_cancel(async);
878         return;
879     }
880 
881     async->done = 1;
882     if (s->frame_bytes < s->frame_bandwidth) {
883         qemu_bh_schedule(s->bh);
884     }
885 }
886 
887 static int is_valid(uint32_t link)
888 {
889     return (link & 1) == 0;
890 }
891 
892 static int is_qh(uint32_t link)
893 {
894     return (link & 2) != 0;
895 }
896 
897 static int depth_first(uint32_t link)
898 {
899     return (link & 4) != 0;
900 }
901 
902 /* QH DB used for detecting QH loops */
903 #define UHCI_MAX_QUEUES 128
904 typedef struct {
905     uint32_t addr[UHCI_MAX_QUEUES];
906     int      count;
907 } QhDb;
908 
909 static void qhdb_reset(QhDb *db)
910 {
911     db->count = 0;
912 }
913 
914 /* Add QH to DB. Returns 1 if already present or DB is full. */
915 static int qhdb_insert(QhDb *db, uint32_t addr)
916 {
917     int i;
918     for (i = 0; i < db->count; i++)
919         if (db->addr[i] == addr)
920             return 1;
921 
922     if (db->count >= UHCI_MAX_QUEUES)
923         return 1;
924 
925     db->addr[db->count++] = addr;
926     return 0;
927 }
928 
929 static void uhci_fill_queue(UHCIState *s, UHCI_TD *td, struct USBEndpoint *ep)
930 {
931     uint32_t int_mask = 0;
932     uint32_t plink = td->link;
933     uint32_t token = uhci_queue_token(td);
934     UHCI_TD ptd;
935     int ret;
936 
937     while (is_valid(plink)) {
938         pci_dma_read(&s->dev, plink & ~0xf, &ptd, sizeof(ptd));
939         le32_to_cpus(&ptd.link);
940         le32_to_cpus(&ptd.ctrl);
941         le32_to_cpus(&ptd.token);
942         le32_to_cpus(&ptd.buffer);
943         if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
944             break;
945         }
946         if (uhci_queue_token(&ptd) != token) {
947             break;
948         }
949         trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
950         ret = uhci_handle_td(s, plink, &ptd, &int_mask, true, NULL);
951         if (ret == TD_RESULT_ASYNC_CONT) {
952             break;
953         }
954         assert(ret == TD_RESULT_ASYNC_START);
955         assert(int_mask == 0);
956         plink = ptd.link;
957     }
958     usb_device_flush_ep_queue(ep->dev, ep);
959 }
960 
961 static void uhci_process_frame(UHCIState *s)
962 {
963     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
964     uint32_t curr_qh, td_count = 0;
965     struct USBEndpoint *curr_ep;
966     int cnt, ret;
967     UHCI_TD td;
968     UHCI_QH qh;
969     QhDb qhdb;
970 
971     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
972 
973     pci_dma_read(&s->dev, frame_addr, &link, 4);
974     le32_to_cpus(&link);
975 
976     int_mask = 0;
977     curr_qh  = 0;
978 
979     qhdb_reset(&qhdb);
980 
981     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
982         if (s->frame_bytes >= s->frame_bandwidth) {
983             /* We've reached the usb 1.1 bandwidth, which is
984                1280 bytes/frame, stop processing */
985             trace_usb_uhci_frame_stop_bandwidth();
986             break;
987         }
988         if (is_qh(link)) {
989             /* QH */
990             trace_usb_uhci_qh_load(link & ~0xf);
991 
992             if (qhdb_insert(&qhdb, link)) {
993                 /*
994                  * We're going in circles. Which is not a bug because
995                  * HCD is allowed to do that as part of the BW management.
996                  *
997                  * Stop processing here if no transaction has been done
998                  * since we've been here last time.
999                  */
1000                 if (td_count == 0) {
1001                     trace_usb_uhci_frame_loop_stop_idle();
1002                     break;
1003                 } else {
1004                     trace_usb_uhci_frame_loop_continue();
1005                     td_count = 0;
1006                     qhdb_reset(&qhdb);
1007                     qhdb_insert(&qhdb, link);
1008                 }
1009             }
1010 
1011             pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1012             le32_to_cpus(&qh.link);
1013             le32_to_cpus(&qh.el_link);
1014 
1015             if (!is_valid(qh.el_link)) {
1016                 /* QH w/o elements */
1017                 curr_qh = 0;
1018                 link = qh.link;
1019             } else {
1020                 /* QH with elements */
1021             	curr_qh = link;
1022             	link = qh.el_link;
1023             }
1024             continue;
1025         }
1026 
1027         /* TD */
1028         pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
1029         le32_to_cpus(&td.link);
1030         le32_to_cpus(&td.ctrl);
1031         le32_to_cpus(&td.token);
1032         le32_to_cpus(&td.buffer);
1033         trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1034 
1035         old_td_ctrl = td.ctrl;
1036         ret = uhci_handle_td(s, link, &td, &int_mask, false, &curr_ep);
1037         if (old_td_ctrl != td.ctrl) {
1038             /* update the status bits of the TD */
1039             val = cpu_to_le32(td.ctrl);
1040             pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1041         }
1042 
1043         switch (ret) {
1044         case TD_RESULT_STOP_FRAME: /* interrupted frame */
1045             goto out;
1046 
1047         case TD_RESULT_NEXT_QH:
1048         case TD_RESULT_ASYNC_CONT:
1049             trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1050             link = curr_qh ? qh.link : td.link;
1051             continue;
1052 
1053         case TD_RESULT_ASYNC_START:
1054             trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1055             uhci_fill_queue(s, &td, curr_ep);
1056             link = curr_qh ? qh.link : td.link;
1057             continue;
1058 
1059         case TD_RESULT_COMPLETE:
1060             trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1061             link = td.link;
1062             td_count++;
1063             s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1064 
1065             if (curr_qh) {
1066                 /* update QH element link */
1067                 qh.el_link = link;
1068                 val = cpu_to_le32(qh.el_link);
1069                 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1070 
1071                 if (!depth_first(link)) {
1072                     /* done with this QH */
1073                     curr_qh = 0;
1074                     link    = qh.link;
1075                 }
1076             }
1077             break;
1078 
1079         default:
1080             assert(!"unknown return code");
1081         }
1082 
1083         /* go to the next entry */
1084     }
1085 
1086 out:
1087     s->pending_int_mask |= int_mask;
1088 }
1089 
1090 static void uhci_bh(void *opaque)
1091 {
1092     UHCIState *s = opaque;
1093     uhci_process_frame(s);
1094 }
1095 
1096 static void uhci_frame_timer(void *opaque)
1097 {
1098     UHCIState *s = opaque;
1099 
1100     /* prepare the timer for the next frame */
1101     s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1102     s->frame_bytes = 0;
1103     qemu_bh_cancel(s->bh);
1104 
1105     if (!(s->cmd & UHCI_CMD_RS)) {
1106         /* Full stop */
1107         trace_usb_uhci_schedule_stop();
1108         qemu_del_timer(s->frame_timer);
1109         uhci_async_cancel_all(s);
1110         /* set hchalted bit in status - UHCI11D 2.1.2 */
1111         s->status |= UHCI_STS_HCHALTED;
1112         return;
1113     }
1114 
1115     /* Complete the previous frame */
1116     if (s->pending_int_mask) {
1117         s->status2 |= s->pending_int_mask;
1118         s->status  |= UHCI_STS_USBINT;
1119         uhci_update_irq(s);
1120     }
1121     s->pending_int_mask = 0;
1122 
1123     /* Start new frame */
1124     s->frnum = (s->frnum + 1) & 0x7ff;
1125 
1126     trace_usb_uhci_frame_start(s->frnum);
1127 
1128     uhci_async_validate_begin(s);
1129 
1130     uhci_process_frame(s);
1131 
1132     uhci_async_validate_end(s);
1133 
1134     qemu_mod_timer(s->frame_timer, s->expire_time);
1135 }
1136 
1137 static const MemoryRegionPortio uhci_portio[] = {
1138     { 0, 32, 2, .write = uhci_ioport_writew, },
1139     { 0, 32, 2, .read = uhci_ioport_readw, },
1140     { 0, 32, 4, .write = uhci_ioport_writel, },
1141     { 0, 32, 4, .read = uhci_ioport_readl, },
1142     { 0, 32, 1, .write = uhci_ioport_writeb, },
1143     { 0, 32, 1, .read = uhci_ioport_readb, },
1144     PORTIO_END_OF_LIST()
1145 };
1146 
1147 static const MemoryRegionOps uhci_ioport_ops = {
1148     .old_portio = uhci_portio,
1149 };
1150 
1151 static USBPortOps uhci_port_ops = {
1152     .attach = uhci_attach,
1153     .detach = uhci_detach,
1154     .child_detach = uhci_child_detach,
1155     .wakeup = uhci_wakeup,
1156     .complete = uhci_async_complete,
1157 };
1158 
1159 static USBBusOps uhci_bus_ops = {
1160 };
1161 
1162 static int usb_uhci_common_initfn(PCIDevice *dev)
1163 {
1164     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
1165     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1166     uint8_t *pci_conf = s->dev.config;
1167     int i;
1168 
1169     pci_conf[PCI_CLASS_PROG] = 0x00;
1170     /* TODO: reset value should be 0. */
1171     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1172 
1173     switch (pc->device_id) {
1174     case PCI_DEVICE_ID_INTEL_82801I_UHCI1:
1175         s->irq_pin = 0;  /* A */
1176         break;
1177     case PCI_DEVICE_ID_INTEL_82801I_UHCI2:
1178         s->irq_pin = 1;  /* B */
1179         break;
1180     case PCI_DEVICE_ID_INTEL_82801I_UHCI3:
1181         s->irq_pin = 2;  /* C */
1182         break;
1183     default:
1184         s->irq_pin = 3;  /* D */
1185         break;
1186     }
1187     pci_config_set_interrupt_pin(pci_conf, s->irq_pin + 1);
1188 
1189     if (s->masterbus) {
1190         USBPort *ports[NB_PORTS];
1191         for(i = 0; i < NB_PORTS; i++) {
1192             ports[i] = &s->ports[i].port;
1193         }
1194         if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1195                 s->firstport, s, &uhci_port_ops,
1196                 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1197             return -1;
1198         }
1199     } else {
1200         usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1201         for (i = 0; i < NB_PORTS; i++) {
1202             usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1203                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1204         }
1205     }
1206     s->bh = qemu_bh_new(uhci_bh, s);
1207     s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1208     s->num_ports_vmstate = NB_PORTS;
1209     QTAILQ_INIT(&s->queues);
1210 
1211     qemu_register_reset(uhci_reset, s);
1212 
1213     memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1214     /* Use region 4 for consistency with real hardware.  BSD guests seem
1215        to rely on this.  */
1216     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1217 
1218     return 0;
1219 }
1220 
1221 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1222 {
1223     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1224     uint8_t *pci_conf = s->dev.config;
1225 
1226     /* USB misc control 1/2 */
1227     pci_set_long(pci_conf + 0x40,0x00001000);
1228     /* PM capability */
1229     pci_set_long(pci_conf + 0x80,0x00020001);
1230     /* USB legacy support  */
1231     pci_set_long(pci_conf + 0xc0,0x00002000);
1232 
1233     return usb_uhci_common_initfn(dev);
1234 }
1235 
1236 static void usb_uhci_exit(PCIDevice *dev)
1237 {
1238     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1239 
1240     memory_region_destroy(&s->io_bar);
1241 }
1242 
1243 static Property uhci_properties[] = {
1244     DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1245     DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1246     DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1247     DEFINE_PROP_END_OF_LIST(),
1248 };
1249 
1250 static void piix3_uhci_class_init(ObjectClass *klass, void *data)
1251 {
1252     DeviceClass *dc = DEVICE_CLASS(klass);
1253     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1254 
1255     k->init = usb_uhci_common_initfn;
1256     k->exit = usb_uhci_exit;
1257     k->vendor_id = PCI_VENDOR_ID_INTEL;
1258     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_2;
1259     k->revision = 0x01;
1260     k->class_id = PCI_CLASS_SERIAL_USB;
1261     dc->vmsd = &vmstate_uhci;
1262     dc->props = uhci_properties;
1263 }
1264 
1265 static TypeInfo piix3_uhci_info = {
1266     .name          = "piix3-usb-uhci",
1267     .parent        = TYPE_PCI_DEVICE,
1268     .instance_size = sizeof(UHCIState),
1269     .class_init    = piix3_uhci_class_init,
1270 };
1271 
1272 static void piix4_uhci_class_init(ObjectClass *klass, void *data)
1273 {
1274     DeviceClass *dc = DEVICE_CLASS(klass);
1275     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1276 
1277     k->init = usb_uhci_common_initfn;
1278     k->exit = usb_uhci_exit;
1279     k->vendor_id = PCI_VENDOR_ID_INTEL;
1280     k->device_id = PCI_DEVICE_ID_INTEL_82371AB_2;
1281     k->revision = 0x01;
1282     k->class_id = PCI_CLASS_SERIAL_USB;
1283     dc->vmsd = &vmstate_uhci;
1284     dc->props = uhci_properties;
1285 }
1286 
1287 static TypeInfo piix4_uhci_info = {
1288     .name          = "piix4-usb-uhci",
1289     .parent        = TYPE_PCI_DEVICE,
1290     .instance_size = sizeof(UHCIState),
1291     .class_init    = piix4_uhci_class_init,
1292 };
1293 
1294 static void vt82c686b_uhci_class_init(ObjectClass *klass, void *data)
1295 {
1296     DeviceClass *dc = DEVICE_CLASS(klass);
1297     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1298 
1299     k->init = usb_uhci_vt82c686b_initfn;
1300     k->exit = usb_uhci_exit;
1301     k->vendor_id = PCI_VENDOR_ID_VIA;
1302     k->device_id = PCI_DEVICE_ID_VIA_UHCI;
1303     k->revision = 0x01;
1304     k->class_id = PCI_CLASS_SERIAL_USB;
1305     dc->vmsd = &vmstate_uhci;
1306     dc->props = uhci_properties;
1307 }
1308 
1309 static TypeInfo vt82c686b_uhci_info = {
1310     .name          = "vt82c686b-usb-uhci",
1311     .parent        = TYPE_PCI_DEVICE,
1312     .instance_size = sizeof(UHCIState),
1313     .class_init    = vt82c686b_uhci_class_init,
1314 };
1315 
1316 static void ich9_uhci1_class_init(ObjectClass *klass, void *data)
1317 {
1318     DeviceClass *dc = DEVICE_CLASS(klass);
1319     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1320 
1321     k->init = usb_uhci_common_initfn;
1322     k->vendor_id = PCI_VENDOR_ID_INTEL;
1323     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1;
1324     k->revision = 0x03;
1325     k->class_id = PCI_CLASS_SERIAL_USB;
1326     dc->vmsd = &vmstate_uhci;
1327     dc->props = uhci_properties;
1328 }
1329 
1330 static TypeInfo ich9_uhci1_info = {
1331     .name          = "ich9-usb-uhci1",
1332     .parent        = TYPE_PCI_DEVICE,
1333     .instance_size = sizeof(UHCIState),
1334     .class_init    = ich9_uhci1_class_init,
1335 };
1336 
1337 static void ich9_uhci2_class_init(ObjectClass *klass, void *data)
1338 {
1339     DeviceClass *dc = DEVICE_CLASS(klass);
1340     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1341 
1342     k->init = usb_uhci_common_initfn;
1343     k->vendor_id = PCI_VENDOR_ID_INTEL;
1344     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2;
1345     k->revision = 0x03;
1346     k->class_id = PCI_CLASS_SERIAL_USB;
1347     dc->vmsd = &vmstate_uhci;
1348     dc->props = uhci_properties;
1349 }
1350 
1351 static TypeInfo ich9_uhci2_info = {
1352     .name          = "ich9-usb-uhci2",
1353     .parent        = TYPE_PCI_DEVICE,
1354     .instance_size = sizeof(UHCIState),
1355     .class_init    = ich9_uhci2_class_init,
1356 };
1357 
1358 static void ich9_uhci3_class_init(ObjectClass *klass, void *data)
1359 {
1360     DeviceClass *dc = DEVICE_CLASS(klass);
1361     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1362 
1363     k->init = usb_uhci_common_initfn;
1364     k->vendor_id = PCI_VENDOR_ID_INTEL;
1365     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3;
1366     k->revision = 0x03;
1367     k->class_id = PCI_CLASS_SERIAL_USB;
1368     dc->vmsd = &vmstate_uhci;
1369     dc->props = uhci_properties;
1370 }
1371 
1372 static TypeInfo ich9_uhci3_info = {
1373     .name          = "ich9-usb-uhci3",
1374     .parent        = TYPE_PCI_DEVICE,
1375     .instance_size = sizeof(UHCIState),
1376     .class_init    = ich9_uhci3_class_init,
1377 };
1378 
1379 static void uhci_register_types(void)
1380 {
1381     type_register_static(&piix3_uhci_info);
1382     type_register_static(&piix4_uhci_info);
1383     type_register_static(&vt82c686b_uhci_info);
1384     type_register_static(&ich9_uhci1_info);
1385     type_register_static(&ich9_uhci2_info);
1386     type_register_static(&ich9_uhci3_info);
1387 }
1388 
1389 type_init(uhci_register_types)
1390