xref: /openbmc/qemu/hw/usb/hcd-uhci.c (revision 4fabffc11234d0587a213418574095e036110cd2)
1 /*
2  * USB UHCI controller emulation
3  *
4  * Copyright (c) 2005 Fabrice Bellard
5  *
6  * Copyright (c) 2008 Max Krasnyansky
7  *     Magor rewrite of the UHCI data structures parser and frame processor
8  *     Support for fully async operation and multiple outstanding transactions
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 #include "hw/hw.h"
29 #include "hw/usb.h"
30 #include "hw/pci.h"
31 #include "qemu-timer.h"
32 #include "iov.h"
33 #include "dma.h"
34 #include "trace.h"
35 
36 //#define DEBUG
37 //#define DEBUG_DUMP_DATA
38 
39 #define UHCI_CMD_FGR      (1 << 4)
40 #define UHCI_CMD_EGSM     (1 << 3)
41 #define UHCI_CMD_GRESET   (1 << 2)
42 #define UHCI_CMD_HCRESET  (1 << 1)
43 #define UHCI_CMD_RS       (1 << 0)
44 
45 #define UHCI_STS_HCHALTED (1 << 5)
46 #define UHCI_STS_HCPERR   (1 << 4)
47 #define UHCI_STS_HSERR    (1 << 3)
48 #define UHCI_STS_RD       (1 << 2)
49 #define UHCI_STS_USBERR   (1 << 1)
50 #define UHCI_STS_USBINT   (1 << 0)
51 
52 #define TD_CTRL_SPD     (1 << 29)
53 #define TD_CTRL_ERROR_SHIFT  27
54 #define TD_CTRL_IOS     (1 << 25)
55 #define TD_CTRL_IOC     (1 << 24)
56 #define TD_CTRL_ACTIVE  (1 << 23)
57 #define TD_CTRL_STALL   (1 << 22)
58 #define TD_CTRL_BABBLE  (1 << 20)
59 #define TD_CTRL_NAK     (1 << 19)
60 #define TD_CTRL_TIMEOUT (1 << 18)
61 
62 #define UHCI_PORT_SUSPEND (1 << 12)
63 #define UHCI_PORT_RESET (1 << 9)
64 #define UHCI_PORT_LSDA  (1 << 8)
65 #define UHCI_PORT_RD    (1 << 6)
66 #define UHCI_PORT_ENC   (1 << 3)
67 #define UHCI_PORT_EN    (1 << 2)
68 #define UHCI_PORT_CSC   (1 << 1)
69 #define UHCI_PORT_CCS   (1 << 0)
70 
71 #define UHCI_PORT_READ_ONLY    (0x1bb)
72 #define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
73 
74 #define FRAME_TIMER_FREQ 1000
75 
76 #define FRAME_MAX_LOOPS  256
77 
78 #define NB_PORTS 2
79 
80 enum {
81     TD_RESULT_STOP_FRAME = 10,
82     TD_RESULT_COMPLETE,
83     TD_RESULT_NEXT_QH,
84     TD_RESULT_ASYNC_START,
85     TD_RESULT_ASYNC_CONT,
86 };
87 
88 typedef struct UHCIState UHCIState;
89 typedef struct UHCIAsync UHCIAsync;
90 typedef struct UHCIQueue UHCIQueue;
91 
92 /*
93  * Pending async transaction.
94  * 'packet' must be the first field because completion
95  * handler does "(UHCIAsync *) pkt" cast.
96  */
97 
98 struct UHCIAsync {
99     USBPacket packet;
100     QEMUSGList sgl;
101     UHCIQueue *queue;
102     QTAILQ_ENTRY(UHCIAsync) next;
103     uint32_t  td;
104     uint8_t   isoc;
105     uint8_t   done;
106 };
107 
108 struct UHCIQueue {
109     uint32_t  token;
110     UHCIState *uhci;
111     QTAILQ_ENTRY(UHCIQueue) next;
112     QTAILQ_HEAD(, UHCIAsync) asyncs;
113     int8_t    valid;
114 };
115 
116 typedef struct UHCIPort {
117     USBPort port;
118     uint16_t ctrl;
119 } UHCIPort;
120 
121 struct UHCIState {
122     PCIDevice dev;
123     MemoryRegion io_bar;
124     USBBus bus; /* Note unused when we're a companion controller */
125     uint16_t cmd; /* cmd register */
126     uint16_t status;
127     uint16_t intr; /* interrupt enable register */
128     uint16_t frnum; /* frame number */
129     uint32_t fl_base_addr; /* frame list base address */
130     uint8_t sof_timing;
131     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
132     int64_t expire_time;
133     QEMUTimer *frame_timer;
134     UHCIPort ports[NB_PORTS];
135 
136     /* Interrupts that should be raised at the end of the current frame.  */
137     uint32_t pending_int_mask;
138 
139     /* Active packets */
140     QTAILQ_HEAD(, UHCIQueue) queues;
141     uint8_t num_ports_vmstate;
142 
143     /* Properties */
144     char *masterbus;
145     uint32_t firstport;
146 };
147 
148 typedef struct UHCI_TD {
149     uint32_t link;
150     uint32_t ctrl; /* see TD_CTRL_xxx */
151     uint32_t token;
152     uint32_t buffer;
153 } UHCI_TD;
154 
155 typedef struct UHCI_QH {
156     uint32_t link;
157     uint32_t el_link;
158 } UHCI_QH;
159 
160 static inline int32_t uhci_queue_token(UHCI_TD *td)
161 {
162     /* covers ep, dev, pid -> identifies the endpoint */
163     return td->token & 0x7ffff;
164 }
165 
166 static UHCIQueue *uhci_queue_get(UHCIState *s, UHCI_TD *td)
167 {
168     uint32_t token = uhci_queue_token(td);
169     UHCIQueue *queue;
170 
171     QTAILQ_FOREACH(queue, &s->queues, next) {
172         if (queue->token == token) {
173             return queue;
174         }
175     }
176 
177     queue = g_new0(UHCIQueue, 1);
178     queue->uhci = s;
179     queue->token = token;
180     QTAILQ_INIT(&queue->asyncs);
181     QTAILQ_INSERT_HEAD(&s->queues, queue, next);
182     trace_usb_uhci_queue_add(queue->token);
183     return queue;
184 }
185 
186 static void uhci_queue_free(UHCIQueue *queue)
187 {
188     UHCIState *s = queue->uhci;
189 
190     trace_usb_uhci_queue_del(queue->token);
191     QTAILQ_REMOVE(&s->queues, queue, next);
192     g_free(queue);
193 }
194 
195 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t addr)
196 {
197     UHCIAsync *async = g_new0(UHCIAsync, 1);
198 
199     async->queue = queue;
200     async->td = addr;
201     usb_packet_init(&async->packet);
202     pci_dma_sglist_init(&async->sgl, &queue->uhci->dev, 1);
203     trace_usb_uhci_packet_add(async->queue->token, async->td);
204 
205     return async;
206 }
207 
208 static void uhci_async_free(UHCIAsync *async)
209 {
210     trace_usb_uhci_packet_del(async->queue->token, async->td);
211     usb_packet_cleanup(&async->packet);
212     qemu_sglist_destroy(&async->sgl);
213     g_free(async);
214 }
215 
216 static void uhci_async_link(UHCIAsync *async)
217 {
218     UHCIQueue *queue = async->queue;
219     QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
220     trace_usb_uhci_packet_link_async(async->queue->token, async->td);
221 }
222 
223 static void uhci_async_unlink(UHCIAsync *async)
224 {
225     UHCIQueue *queue = async->queue;
226     QTAILQ_REMOVE(&queue->asyncs, async, next);
227     trace_usb_uhci_packet_unlink_async(async->queue->token, async->td);
228 }
229 
230 static void uhci_async_cancel(UHCIAsync *async)
231 {
232     trace_usb_uhci_packet_cancel(async->queue->token, async->td, async->done);
233     if (!async->done)
234         usb_cancel_packet(&async->packet);
235     uhci_async_free(async);
236 }
237 
238 /*
239  * Mark all outstanding async packets as invalid.
240  * This is used for canceling them when TDs are removed by the HCD.
241  */
242 static void uhci_async_validate_begin(UHCIState *s)
243 {
244     UHCIQueue *queue;
245 
246     QTAILQ_FOREACH(queue, &s->queues, next) {
247         queue->valid--;
248     }
249 }
250 
251 /*
252  * Cancel async packets that are no longer valid
253  */
254 static void uhci_async_validate_end(UHCIState *s)
255 {
256     UHCIQueue *queue, *n;
257     UHCIAsync *async;
258 
259     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
260         if (queue->valid > 0) {
261             continue;
262         }
263         while (!QTAILQ_EMPTY(&queue->asyncs)) {
264             async = QTAILQ_FIRST(&queue->asyncs);
265             uhci_async_unlink(async);
266             uhci_async_cancel(async);
267         }
268         uhci_queue_free(queue);
269     }
270 }
271 
272 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
273 {
274     UHCIQueue *queue;
275     UHCIAsync *curr, *n;
276 
277     QTAILQ_FOREACH(queue, &s->queues, next) {
278         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
279             if (!usb_packet_is_inflight(&curr->packet) ||
280                 curr->packet.ep->dev != dev) {
281                 continue;
282             }
283             uhci_async_unlink(curr);
284             uhci_async_cancel(curr);
285         }
286     }
287 }
288 
289 static void uhci_async_cancel_all(UHCIState *s)
290 {
291     UHCIQueue *queue;
292     UHCIAsync *curr, *n;
293 
294     QTAILQ_FOREACH(queue, &s->queues, next) {
295         QTAILQ_FOREACH_SAFE(curr, &queue->asyncs, next, n) {
296             uhci_async_unlink(curr);
297             uhci_async_cancel(curr);
298         }
299         uhci_queue_free(queue);
300     }
301 }
302 
303 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t addr, UHCI_TD *td)
304 {
305     uint32_t token = uhci_queue_token(td);
306     UHCIQueue *queue;
307     UHCIAsync *async;
308 
309     QTAILQ_FOREACH(queue, &s->queues, next) {
310         if (queue->token == token) {
311             break;
312         }
313     }
314     if (queue == NULL) {
315         return NULL;
316     }
317 
318     QTAILQ_FOREACH(async, &queue->asyncs, next) {
319         if (async->td == addr) {
320             return async;
321         }
322     }
323 
324     return NULL;
325 }
326 
327 static void uhci_update_irq(UHCIState *s)
328 {
329     int level;
330     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
331         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
332         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
333         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
334         (s->status & UHCI_STS_HSERR) ||
335         (s->status & UHCI_STS_HCPERR)) {
336         level = 1;
337     } else {
338         level = 0;
339     }
340     qemu_set_irq(s->dev.irq[3], level);
341 }
342 
343 static void uhci_reset(void *opaque)
344 {
345     UHCIState *s = opaque;
346     uint8_t *pci_conf;
347     int i;
348     UHCIPort *port;
349 
350     trace_usb_uhci_reset();
351 
352     pci_conf = s->dev.config;
353 
354     pci_conf[0x6a] = 0x01; /* usb clock */
355     pci_conf[0x6b] = 0x00;
356     s->cmd = 0;
357     s->status = 0;
358     s->status2 = 0;
359     s->intr = 0;
360     s->fl_base_addr = 0;
361     s->sof_timing = 64;
362 
363     for(i = 0; i < NB_PORTS; i++) {
364         port = &s->ports[i];
365         port->ctrl = 0x0080;
366         if (port->port.dev && port->port.dev->attached) {
367             usb_port_reset(&port->port);
368         }
369     }
370 
371     uhci_async_cancel_all(s);
372 }
373 
374 static void uhci_pre_save(void *opaque)
375 {
376     UHCIState *s = opaque;
377 
378     uhci_async_cancel_all(s);
379 }
380 
381 static const VMStateDescription vmstate_uhci_port = {
382     .name = "uhci port",
383     .version_id = 1,
384     .minimum_version_id = 1,
385     .minimum_version_id_old = 1,
386     .fields      = (VMStateField []) {
387         VMSTATE_UINT16(ctrl, UHCIPort),
388         VMSTATE_END_OF_LIST()
389     }
390 };
391 
392 static const VMStateDescription vmstate_uhci = {
393     .name = "uhci",
394     .version_id = 2,
395     .minimum_version_id = 1,
396     .minimum_version_id_old = 1,
397     .pre_save = uhci_pre_save,
398     .fields      = (VMStateField []) {
399         VMSTATE_PCI_DEVICE(dev, UHCIState),
400         VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
401         VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
402                              vmstate_uhci_port, UHCIPort),
403         VMSTATE_UINT16(cmd, UHCIState),
404         VMSTATE_UINT16(status, UHCIState),
405         VMSTATE_UINT16(intr, UHCIState),
406         VMSTATE_UINT16(frnum, UHCIState),
407         VMSTATE_UINT32(fl_base_addr, UHCIState),
408         VMSTATE_UINT8(sof_timing, UHCIState),
409         VMSTATE_UINT8(status2, UHCIState),
410         VMSTATE_TIMER(frame_timer, UHCIState),
411         VMSTATE_INT64_V(expire_time, UHCIState, 2),
412         VMSTATE_END_OF_LIST()
413     }
414 };
415 
416 static void uhci_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
417 {
418     UHCIState *s = opaque;
419 
420     addr &= 0x1f;
421     switch(addr) {
422     case 0x0c:
423         s->sof_timing = val;
424         break;
425     }
426 }
427 
428 static uint32_t uhci_ioport_readb(void *opaque, uint32_t addr)
429 {
430     UHCIState *s = opaque;
431     uint32_t val;
432 
433     addr &= 0x1f;
434     switch(addr) {
435     case 0x0c:
436         val = s->sof_timing;
437         break;
438     default:
439         val = 0xff;
440         break;
441     }
442     return val;
443 }
444 
445 static void uhci_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
446 {
447     UHCIState *s = opaque;
448 
449     addr &= 0x1f;
450     trace_usb_uhci_mmio_writew(addr, val);
451 
452     switch(addr) {
453     case 0x00:
454         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
455             /* start frame processing */
456             trace_usb_uhci_schedule_start();
457             s->expire_time = qemu_get_clock_ns(vm_clock) +
458                 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
459             qemu_mod_timer(s->frame_timer, qemu_get_clock_ns(vm_clock));
460             s->status &= ~UHCI_STS_HCHALTED;
461         } else if (!(val & UHCI_CMD_RS)) {
462             s->status |= UHCI_STS_HCHALTED;
463         }
464         if (val & UHCI_CMD_GRESET) {
465             UHCIPort *port;
466             int i;
467 
468             /* send reset on the USB bus */
469             for(i = 0; i < NB_PORTS; i++) {
470                 port = &s->ports[i];
471                 usb_device_reset(port->port.dev);
472             }
473             uhci_reset(s);
474             return;
475         }
476         if (val & UHCI_CMD_HCRESET) {
477             uhci_reset(s);
478             return;
479         }
480         s->cmd = val;
481         break;
482     case 0x02:
483         s->status &= ~val;
484         /* XXX: the chip spec is not coherent, so we add a hidden
485            register to distinguish between IOC and SPD */
486         if (val & UHCI_STS_USBINT)
487             s->status2 = 0;
488         uhci_update_irq(s);
489         break;
490     case 0x04:
491         s->intr = val;
492         uhci_update_irq(s);
493         break;
494     case 0x06:
495         if (s->status & UHCI_STS_HCHALTED)
496             s->frnum = val & 0x7ff;
497         break;
498     case 0x10 ... 0x1f:
499         {
500             UHCIPort *port;
501             USBDevice *dev;
502             int n;
503 
504             n = (addr >> 1) & 7;
505             if (n >= NB_PORTS)
506                 return;
507             port = &s->ports[n];
508             dev = port->port.dev;
509             if (dev && dev->attached) {
510                 /* port reset */
511                 if ( (val & UHCI_PORT_RESET) &&
512                      !(port->ctrl & UHCI_PORT_RESET) ) {
513                     usb_device_reset(dev);
514                 }
515             }
516             port->ctrl &= UHCI_PORT_READ_ONLY;
517             port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
518             /* some bits are reset when a '1' is written to them */
519             port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
520         }
521         break;
522     }
523 }
524 
525 static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)
526 {
527     UHCIState *s = opaque;
528     uint32_t val;
529 
530     addr &= 0x1f;
531     switch(addr) {
532     case 0x00:
533         val = s->cmd;
534         break;
535     case 0x02:
536         val = s->status;
537         break;
538     case 0x04:
539         val = s->intr;
540         break;
541     case 0x06:
542         val = s->frnum;
543         break;
544     case 0x10 ... 0x1f:
545         {
546             UHCIPort *port;
547             int n;
548             n = (addr >> 1) & 7;
549             if (n >= NB_PORTS)
550                 goto read_default;
551             port = &s->ports[n];
552             val = port->ctrl;
553         }
554         break;
555     default:
556     read_default:
557         val = 0xff7f; /* disabled port */
558         break;
559     }
560 
561     trace_usb_uhci_mmio_readw(addr, val);
562 
563     return val;
564 }
565 
566 static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
567 {
568     UHCIState *s = opaque;
569 
570     addr &= 0x1f;
571     trace_usb_uhci_mmio_writel(addr, val);
572 
573     switch(addr) {
574     case 0x08:
575         s->fl_base_addr = val & ~0xfff;
576         break;
577     }
578 }
579 
580 static uint32_t uhci_ioport_readl(void *opaque, uint32_t addr)
581 {
582     UHCIState *s = opaque;
583     uint32_t val;
584 
585     addr &= 0x1f;
586     switch(addr) {
587     case 0x08:
588         val = s->fl_base_addr;
589         break;
590     default:
591         val = 0xffffffff;
592         break;
593     }
594     trace_usb_uhci_mmio_readl(addr, val);
595     return val;
596 }
597 
598 /* signal resume if controller suspended */
599 static void uhci_resume (void *opaque)
600 {
601     UHCIState *s = (UHCIState *)opaque;
602 
603     if (!s)
604         return;
605 
606     if (s->cmd & UHCI_CMD_EGSM) {
607         s->cmd |= UHCI_CMD_FGR;
608         s->status |= UHCI_STS_RD;
609         uhci_update_irq(s);
610     }
611 }
612 
613 static void uhci_attach(USBPort *port1)
614 {
615     UHCIState *s = port1->opaque;
616     UHCIPort *port = &s->ports[port1->index];
617 
618     /* set connect status */
619     port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
620 
621     /* update speed */
622     if (port->port.dev->speed == USB_SPEED_LOW) {
623         port->ctrl |= UHCI_PORT_LSDA;
624     } else {
625         port->ctrl &= ~UHCI_PORT_LSDA;
626     }
627 
628     uhci_resume(s);
629 }
630 
631 static void uhci_detach(USBPort *port1)
632 {
633     UHCIState *s = port1->opaque;
634     UHCIPort *port = &s->ports[port1->index];
635 
636     uhci_async_cancel_device(s, port1->dev);
637 
638     /* set connect status */
639     if (port->ctrl & UHCI_PORT_CCS) {
640         port->ctrl &= ~UHCI_PORT_CCS;
641         port->ctrl |= UHCI_PORT_CSC;
642     }
643     /* disable port */
644     if (port->ctrl & UHCI_PORT_EN) {
645         port->ctrl &= ~UHCI_PORT_EN;
646         port->ctrl |= UHCI_PORT_ENC;
647     }
648 
649     uhci_resume(s);
650 }
651 
652 static void uhci_child_detach(USBPort *port1, USBDevice *child)
653 {
654     UHCIState *s = port1->opaque;
655 
656     uhci_async_cancel_device(s, child);
657 }
658 
659 static void uhci_wakeup(USBPort *port1)
660 {
661     UHCIState *s = port1->opaque;
662     UHCIPort *port = &s->ports[port1->index];
663 
664     if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
665         port->ctrl |= UHCI_PORT_RD;
666         uhci_resume(s);
667     }
668 }
669 
670 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
671 {
672     USBDevice *dev;
673     int i;
674 
675     for (i = 0; i < NB_PORTS; i++) {
676         UHCIPort *port = &s->ports[i];
677         if (!(port->ctrl & UHCI_PORT_EN)) {
678             continue;
679         }
680         dev = usb_find_device(&port->port, addr);
681         if (dev != NULL) {
682             return dev;
683         }
684     }
685     return NULL;
686 }
687 
688 static void uhci_async_complete(USBPort *port, USBPacket *packet);
689 static void uhci_process_frame(UHCIState *s);
690 
691 /* return -1 if fatal error (frame must be stopped)
692           0 if TD successful
693           1 if TD unsuccessful or inactive
694 */
695 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
696 {
697     int len = 0, max_len, err, ret;
698     uint8_t pid;
699 
700     max_len = ((td->token >> 21) + 1) & 0x7ff;
701     pid = td->token & 0xff;
702 
703     ret = async->packet.result;
704 
705     if (td->ctrl & TD_CTRL_IOS)
706         td->ctrl &= ~TD_CTRL_ACTIVE;
707 
708     if (ret < 0)
709         goto out;
710 
711     len = async->packet.result;
712     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
713 
714     /* The NAK bit may have been set by a previous frame, so clear it
715        here.  The docs are somewhat unclear, but win2k relies on this
716        behavior.  */
717     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
718     if (td->ctrl & TD_CTRL_IOC)
719         *int_mask |= 0x01;
720 
721     if (pid == USB_TOKEN_IN) {
722         if (len > max_len) {
723             ret = USB_RET_BABBLE;
724             goto out;
725         }
726 
727         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
728             *int_mask |= 0x02;
729             /* short packet: do not update QH */
730             trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
731                                                     async->td);
732             return TD_RESULT_NEXT_QH;
733         }
734     }
735 
736     /* success */
737     trace_usb_uhci_packet_complete_success(async->queue->token, async->td);
738     return TD_RESULT_COMPLETE;
739 
740 out:
741     switch(ret) {
742     case USB_RET_STALL:
743         td->ctrl |= TD_CTRL_STALL;
744         td->ctrl &= ~TD_CTRL_ACTIVE;
745         s->status |= UHCI_STS_USBERR;
746         if (td->ctrl & TD_CTRL_IOC) {
747             *int_mask |= 0x01;
748         }
749         uhci_update_irq(s);
750         trace_usb_uhci_packet_complete_stall(async->queue->token, async->td);
751         return TD_RESULT_NEXT_QH;
752 
753     case USB_RET_BABBLE:
754         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
755         td->ctrl &= ~TD_CTRL_ACTIVE;
756         s->status |= UHCI_STS_USBERR;
757         if (td->ctrl & TD_CTRL_IOC) {
758             *int_mask |= 0x01;
759         }
760         uhci_update_irq(s);
761         /* frame interrupted */
762         trace_usb_uhci_packet_complete_babble(async->queue->token, async->td);
763         return TD_RESULT_STOP_FRAME;
764 
765     case USB_RET_NAK:
766         td->ctrl |= TD_CTRL_NAK;
767         if (pid == USB_TOKEN_SETUP)
768             break;
769         return TD_RESULT_NEXT_QH;
770 
771     case USB_RET_IOERROR:
772     case USB_RET_NODEV:
773     default:
774 	break;
775     }
776 
777     /* Retry the TD if error count is not zero */
778 
779     td->ctrl |= TD_CTRL_TIMEOUT;
780     err = (td->ctrl >> TD_CTRL_ERROR_SHIFT) & 3;
781     if (err != 0) {
782         err--;
783         if (err == 0) {
784             td->ctrl &= ~TD_CTRL_ACTIVE;
785             s->status |= UHCI_STS_USBERR;
786             if (td->ctrl & TD_CTRL_IOC)
787                 *int_mask |= 0x01;
788             uhci_update_irq(s);
789             trace_usb_uhci_packet_complete_error(async->queue->token,
790                                                  async->td);
791         }
792     }
793     td->ctrl = (td->ctrl & ~(3 << TD_CTRL_ERROR_SHIFT)) |
794         (err << TD_CTRL_ERROR_SHIFT);
795     return TD_RESULT_NEXT_QH;
796 }
797 
798 static int uhci_handle_td(UHCIState *s, uint32_t addr, UHCI_TD *td,
799                           uint32_t *int_mask, bool queuing)
800 {
801     UHCIAsync *async;
802     int len = 0, max_len;
803     uint8_t pid;
804     USBDevice *dev;
805     USBEndpoint *ep;
806 
807     /* Is active ? */
808     if (!(td->ctrl & TD_CTRL_ACTIVE))
809         return TD_RESULT_NEXT_QH;
810 
811     async = uhci_async_find_td(s, addr, td);
812     if (async) {
813         /* Already submitted */
814         async->queue->valid = 32;
815 
816         if (!async->done)
817             return TD_RESULT_ASYNC_CONT;
818         if (queuing) {
819             /* we are busy filling the queue, we are not prepared
820                to consume completed packages then, just leave them
821                in async state */
822             return TD_RESULT_ASYNC_CONT;
823         }
824 
825         uhci_async_unlink(async);
826         goto done;
827     }
828 
829     /* Allocate new packet */
830     async = uhci_async_alloc(uhci_queue_get(s, td), addr);
831 
832     /* valid needs to be large enough to handle 10 frame delay
833      * for initial isochronous requests
834      */
835     async->queue->valid = 32;
836     async->isoc  = td->ctrl & TD_CTRL_IOS;
837 
838     max_len = ((td->token >> 21) + 1) & 0x7ff;
839     pid = td->token & 0xff;
840 
841     dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
842     ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
843     usb_packet_setup(&async->packet, pid, ep);
844     qemu_sglist_add(&async->sgl, td->buffer, max_len);
845     usb_packet_map(&async->packet, &async->sgl);
846 
847     switch(pid) {
848     case USB_TOKEN_OUT:
849     case USB_TOKEN_SETUP:
850         len = usb_handle_packet(dev, &async->packet);
851         if (len >= 0)
852             len = max_len;
853         break;
854 
855     case USB_TOKEN_IN:
856         len = usb_handle_packet(dev, &async->packet);
857         break;
858 
859     default:
860         /* invalid pid : frame interrupted */
861         uhci_async_free(async);
862         s->status |= UHCI_STS_HCPERR;
863         uhci_update_irq(s);
864         return TD_RESULT_STOP_FRAME;
865     }
866 
867     if (len == USB_RET_ASYNC) {
868         uhci_async_link(async);
869         return TD_RESULT_ASYNC_START;
870     }
871 
872     async->packet.result = len;
873 
874 done:
875     len = uhci_complete_td(s, td, async, int_mask);
876     usb_packet_unmap(&async->packet);
877     uhci_async_free(async);
878     return len;
879 }
880 
881 static void uhci_async_complete(USBPort *port, USBPacket *packet)
882 {
883     UHCIAsync *async = container_of(packet, UHCIAsync, packet);
884     UHCIState *s = async->queue->uhci;
885 
886     if (async->isoc) {
887         UHCI_TD td;
888         uint32_t link = async->td;
889         uint32_t int_mask = 0, val;
890 
891         pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
892         le32_to_cpus(&td.link);
893         le32_to_cpus(&td.ctrl);
894         le32_to_cpus(&td.token);
895         le32_to_cpus(&td.buffer);
896 
897         uhci_async_unlink(async);
898         uhci_complete_td(s, &td, async, &int_mask);
899         s->pending_int_mask |= int_mask;
900 
901         /* update the status bits of the TD */
902         val = cpu_to_le32(td.ctrl);
903         pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
904         uhci_async_free(async);
905     } else {
906         async->done = 1;
907         uhci_process_frame(s);
908     }
909 }
910 
911 static int is_valid(uint32_t link)
912 {
913     return (link & 1) == 0;
914 }
915 
916 static int is_qh(uint32_t link)
917 {
918     return (link & 2) != 0;
919 }
920 
921 static int depth_first(uint32_t link)
922 {
923     return (link & 4) != 0;
924 }
925 
926 /* QH DB used for detecting QH loops */
927 #define UHCI_MAX_QUEUES 128
928 typedef struct {
929     uint32_t addr[UHCI_MAX_QUEUES];
930     int      count;
931 } QhDb;
932 
933 static void qhdb_reset(QhDb *db)
934 {
935     db->count = 0;
936 }
937 
938 /* Add QH to DB. Returns 1 if already present or DB is full. */
939 static int qhdb_insert(QhDb *db, uint32_t addr)
940 {
941     int i;
942     for (i = 0; i < db->count; i++)
943         if (db->addr[i] == addr)
944             return 1;
945 
946     if (db->count >= UHCI_MAX_QUEUES)
947         return 1;
948 
949     db->addr[db->count++] = addr;
950     return 0;
951 }
952 
953 static void uhci_fill_queue(UHCIState *s, UHCI_TD *td)
954 {
955     uint32_t int_mask = 0;
956     uint32_t plink = td->link;
957     uint32_t token = uhci_queue_token(td);
958     UHCI_TD ptd;
959     int ret;
960 
961     while (is_valid(plink)) {
962         pci_dma_read(&s->dev, plink & ~0xf, &ptd, sizeof(ptd));
963         le32_to_cpus(&ptd.link);
964         le32_to_cpus(&ptd.ctrl);
965         le32_to_cpus(&ptd.token);
966         le32_to_cpus(&ptd.buffer);
967         if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
968             break;
969         }
970         if (uhci_queue_token(&ptd) != token) {
971             break;
972         }
973         trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
974         ret = uhci_handle_td(s, plink, &ptd, &int_mask, true);
975         if (ret == TD_RESULT_ASYNC_CONT) {
976             break;
977         }
978         assert(ret == TD_RESULT_ASYNC_START);
979         assert(int_mask == 0);
980         plink = ptd.link;
981     }
982 }
983 
984 static void uhci_process_frame(UHCIState *s)
985 {
986     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
987     uint32_t curr_qh, td_count = 0, bytes_count = 0;
988     int cnt, ret;
989     UHCI_TD td;
990     UHCI_QH qh;
991     QhDb qhdb;
992 
993     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
994 
995     pci_dma_read(&s->dev, frame_addr, &link, 4);
996     le32_to_cpus(&link);
997 
998     int_mask = 0;
999     curr_qh  = 0;
1000 
1001     qhdb_reset(&qhdb);
1002 
1003     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1004         if (is_qh(link)) {
1005             /* QH */
1006             trace_usb_uhci_qh_load(link & ~0xf);
1007 
1008             if (qhdb_insert(&qhdb, link)) {
1009                 /*
1010                  * We're going in circles. Which is not a bug because
1011                  * HCD is allowed to do that as part of the BW management.
1012                  *
1013                  * Stop processing here if
1014                  *  (a) no transaction has been done since we've been
1015                  *      here last time, or
1016                  *  (b) we've reached the usb 1.1 bandwidth, which is
1017                  *      1280 bytes/frame.
1018                  */
1019                 if (td_count == 0) {
1020                     trace_usb_uhci_frame_loop_stop_idle();
1021                     break;
1022                 } else if (bytes_count >= 1280) {
1023                     trace_usb_uhci_frame_loop_stop_bandwidth();
1024                     break;
1025                 } else {
1026                     trace_usb_uhci_frame_loop_continue();
1027                     td_count = 0;
1028                     qhdb_reset(&qhdb);
1029                     qhdb_insert(&qhdb, link);
1030                 }
1031             }
1032 
1033             pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1034             le32_to_cpus(&qh.link);
1035             le32_to_cpus(&qh.el_link);
1036 
1037             if (!is_valid(qh.el_link)) {
1038                 /* QH w/o elements */
1039                 curr_qh = 0;
1040                 link = qh.link;
1041             } else {
1042                 /* QH with elements */
1043             	curr_qh = link;
1044             	link = qh.el_link;
1045             }
1046             continue;
1047         }
1048 
1049         /* TD */
1050         pci_dma_read(&s->dev, link & ~0xf, &td, sizeof(td));
1051         le32_to_cpus(&td.link);
1052         le32_to_cpus(&td.ctrl);
1053         le32_to_cpus(&td.token);
1054         le32_to_cpus(&td.buffer);
1055         trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1056 
1057         old_td_ctrl = td.ctrl;
1058         ret = uhci_handle_td(s, link, &td, &int_mask, false);
1059         if (old_td_ctrl != td.ctrl) {
1060             /* update the status bits of the TD */
1061             val = cpu_to_le32(td.ctrl);
1062             pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1063         }
1064 
1065         switch (ret) {
1066         case TD_RESULT_STOP_FRAME: /* interrupted frame */
1067             goto out;
1068 
1069         case TD_RESULT_NEXT_QH:
1070         case TD_RESULT_ASYNC_CONT:
1071             trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1072             link = curr_qh ? qh.link : td.link;
1073             continue;
1074 
1075         case TD_RESULT_ASYNC_START:
1076             trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1077             if (is_valid(td.link)) {
1078                 uhci_fill_queue(s, &td);
1079             }
1080             link = curr_qh ? qh.link : td.link;
1081             continue;
1082 
1083         case TD_RESULT_COMPLETE:
1084             trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1085             link = td.link;
1086             td_count++;
1087             bytes_count += (td.ctrl & 0x7ff) + 1;
1088 
1089             if (curr_qh) {
1090                 /* update QH element link */
1091                 qh.el_link = link;
1092                 val = cpu_to_le32(qh.el_link);
1093                 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1094 
1095                 if (!depth_first(link)) {
1096                     /* done with this QH */
1097                     curr_qh = 0;
1098                     link    = qh.link;
1099                 }
1100             }
1101             break;
1102 
1103         default:
1104             assert(!"unknown return code");
1105         }
1106 
1107         /* go to the next entry */
1108     }
1109 
1110 out:
1111     s->pending_int_mask |= int_mask;
1112 }
1113 
1114 static void uhci_frame_timer(void *opaque)
1115 {
1116     UHCIState *s = opaque;
1117 
1118     /* prepare the timer for the next frame */
1119     s->expire_time += (get_ticks_per_sec() / FRAME_TIMER_FREQ);
1120 
1121     if (!(s->cmd & UHCI_CMD_RS)) {
1122         /* Full stop */
1123         trace_usb_uhci_schedule_stop();
1124         qemu_del_timer(s->frame_timer);
1125         uhci_async_cancel_all(s);
1126         /* set hchalted bit in status - UHCI11D 2.1.2 */
1127         s->status |= UHCI_STS_HCHALTED;
1128         return;
1129     }
1130 
1131     /* Complete the previous frame */
1132     if (s->pending_int_mask) {
1133         s->status2 |= s->pending_int_mask;
1134         s->status  |= UHCI_STS_USBINT;
1135         uhci_update_irq(s);
1136     }
1137     s->pending_int_mask = 0;
1138 
1139     /* Start new frame */
1140     s->frnum = (s->frnum + 1) & 0x7ff;
1141 
1142     trace_usb_uhci_frame_start(s->frnum);
1143 
1144     uhci_async_validate_begin(s);
1145 
1146     uhci_process_frame(s);
1147 
1148     uhci_async_validate_end(s);
1149 
1150     qemu_mod_timer(s->frame_timer, s->expire_time);
1151 }
1152 
1153 static const MemoryRegionPortio uhci_portio[] = {
1154     { 0, 32, 2, .write = uhci_ioport_writew, },
1155     { 0, 32, 2, .read = uhci_ioport_readw, },
1156     { 0, 32, 4, .write = uhci_ioport_writel, },
1157     { 0, 32, 4, .read = uhci_ioport_readl, },
1158     { 0, 32, 1, .write = uhci_ioport_writeb, },
1159     { 0, 32, 1, .read = uhci_ioport_readb, },
1160     PORTIO_END_OF_LIST()
1161 };
1162 
1163 static const MemoryRegionOps uhci_ioport_ops = {
1164     .old_portio = uhci_portio,
1165 };
1166 
1167 static USBPortOps uhci_port_ops = {
1168     .attach = uhci_attach,
1169     .detach = uhci_detach,
1170     .child_detach = uhci_child_detach,
1171     .wakeup = uhci_wakeup,
1172     .complete = uhci_async_complete,
1173 };
1174 
1175 static USBBusOps uhci_bus_ops = {
1176 };
1177 
1178 static int usb_uhci_common_initfn(PCIDevice *dev)
1179 {
1180     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1181     uint8_t *pci_conf = s->dev.config;
1182     int i;
1183 
1184     pci_conf[PCI_CLASS_PROG] = 0x00;
1185     /* TODO: reset value should be 0. */
1186     pci_conf[PCI_INTERRUPT_PIN] = 4; /* interrupt pin D */
1187     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1188 
1189     if (s->masterbus) {
1190         USBPort *ports[NB_PORTS];
1191         for(i = 0; i < NB_PORTS; i++) {
1192             ports[i] = &s->ports[i].port;
1193         }
1194         if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1195                 s->firstport, s, &uhci_port_ops,
1196                 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1197             return -1;
1198         }
1199     } else {
1200         usb_bus_new(&s->bus, &uhci_bus_ops, &s->dev.qdev);
1201         for (i = 0; i < NB_PORTS; i++) {
1202             usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1203                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1204         }
1205     }
1206     s->frame_timer = qemu_new_timer_ns(vm_clock, uhci_frame_timer, s);
1207     s->num_ports_vmstate = NB_PORTS;
1208     QTAILQ_INIT(&s->queues);
1209 
1210     qemu_register_reset(uhci_reset, s);
1211 
1212     memory_region_init_io(&s->io_bar, &uhci_ioport_ops, s, "uhci", 0x20);
1213     /* Use region 4 for consistency with real hardware.  BSD guests seem
1214        to rely on this.  */
1215     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1216 
1217     return 0;
1218 }
1219 
1220 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1221 {
1222     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1223     uint8_t *pci_conf = s->dev.config;
1224 
1225     /* USB misc control 1/2 */
1226     pci_set_long(pci_conf + 0x40,0x00001000);
1227     /* PM capability */
1228     pci_set_long(pci_conf + 0x80,0x00020001);
1229     /* USB legacy support  */
1230     pci_set_long(pci_conf + 0xc0,0x00002000);
1231 
1232     return usb_uhci_common_initfn(dev);
1233 }
1234 
1235 static int usb_uhci_exit(PCIDevice *dev)
1236 {
1237     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1238 
1239     memory_region_destroy(&s->io_bar);
1240     return 0;
1241 }
1242 
1243 static Property uhci_properties[] = {
1244     DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1245     DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1246     DEFINE_PROP_END_OF_LIST(),
1247 };
1248 
1249 static void piix3_uhci_class_init(ObjectClass *klass, void *data)
1250 {
1251     DeviceClass *dc = DEVICE_CLASS(klass);
1252     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1253 
1254     k->init = usb_uhci_common_initfn;
1255     k->exit = usb_uhci_exit;
1256     k->vendor_id = PCI_VENDOR_ID_INTEL;
1257     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_2;
1258     k->revision = 0x01;
1259     k->class_id = PCI_CLASS_SERIAL_USB;
1260     dc->vmsd = &vmstate_uhci;
1261     dc->props = uhci_properties;
1262 }
1263 
1264 static TypeInfo piix3_uhci_info = {
1265     .name          = "piix3-usb-uhci",
1266     .parent        = TYPE_PCI_DEVICE,
1267     .instance_size = sizeof(UHCIState),
1268     .class_init    = piix3_uhci_class_init,
1269 };
1270 
1271 static void piix4_uhci_class_init(ObjectClass *klass, void *data)
1272 {
1273     DeviceClass *dc = DEVICE_CLASS(klass);
1274     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1275 
1276     k->init = usb_uhci_common_initfn;
1277     k->exit = usb_uhci_exit;
1278     k->vendor_id = PCI_VENDOR_ID_INTEL;
1279     k->device_id = PCI_DEVICE_ID_INTEL_82371AB_2;
1280     k->revision = 0x01;
1281     k->class_id = PCI_CLASS_SERIAL_USB;
1282     dc->vmsd = &vmstate_uhci;
1283     dc->props = uhci_properties;
1284 }
1285 
1286 static TypeInfo piix4_uhci_info = {
1287     .name          = "piix4-usb-uhci",
1288     .parent        = TYPE_PCI_DEVICE,
1289     .instance_size = sizeof(UHCIState),
1290     .class_init    = piix4_uhci_class_init,
1291 };
1292 
1293 static void vt82c686b_uhci_class_init(ObjectClass *klass, void *data)
1294 {
1295     DeviceClass *dc = DEVICE_CLASS(klass);
1296     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1297 
1298     k->init = usb_uhci_vt82c686b_initfn;
1299     k->exit = usb_uhci_exit;
1300     k->vendor_id = PCI_VENDOR_ID_VIA;
1301     k->device_id = PCI_DEVICE_ID_VIA_UHCI;
1302     k->revision = 0x01;
1303     k->class_id = PCI_CLASS_SERIAL_USB;
1304     dc->vmsd = &vmstate_uhci;
1305     dc->props = uhci_properties;
1306 }
1307 
1308 static TypeInfo vt82c686b_uhci_info = {
1309     .name          = "vt82c686b-usb-uhci",
1310     .parent        = TYPE_PCI_DEVICE,
1311     .instance_size = sizeof(UHCIState),
1312     .class_init    = vt82c686b_uhci_class_init,
1313 };
1314 
1315 static void ich9_uhci1_class_init(ObjectClass *klass, void *data)
1316 {
1317     DeviceClass *dc = DEVICE_CLASS(klass);
1318     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1319 
1320     k->init = usb_uhci_common_initfn;
1321     k->vendor_id = PCI_VENDOR_ID_INTEL;
1322     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1;
1323     k->revision = 0x03;
1324     k->class_id = PCI_CLASS_SERIAL_USB;
1325     dc->vmsd = &vmstate_uhci;
1326     dc->props = uhci_properties;
1327 }
1328 
1329 static TypeInfo ich9_uhci1_info = {
1330     .name          = "ich9-usb-uhci1",
1331     .parent        = TYPE_PCI_DEVICE,
1332     .instance_size = sizeof(UHCIState),
1333     .class_init    = ich9_uhci1_class_init,
1334 };
1335 
1336 static void ich9_uhci2_class_init(ObjectClass *klass, void *data)
1337 {
1338     DeviceClass *dc = DEVICE_CLASS(klass);
1339     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1340 
1341     k->init = usb_uhci_common_initfn;
1342     k->vendor_id = PCI_VENDOR_ID_INTEL;
1343     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2;
1344     k->revision = 0x03;
1345     k->class_id = PCI_CLASS_SERIAL_USB;
1346     dc->vmsd = &vmstate_uhci;
1347     dc->props = uhci_properties;
1348 }
1349 
1350 static TypeInfo ich9_uhci2_info = {
1351     .name          = "ich9-usb-uhci2",
1352     .parent        = TYPE_PCI_DEVICE,
1353     .instance_size = sizeof(UHCIState),
1354     .class_init    = ich9_uhci2_class_init,
1355 };
1356 
1357 static void ich9_uhci3_class_init(ObjectClass *klass, void *data)
1358 {
1359     DeviceClass *dc = DEVICE_CLASS(klass);
1360     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1361 
1362     k->init = usb_uhci_common_initfn;
1363     k->vendor_id = PCI_VENDOR_ID_INTEL;
1364     k->device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3;
1365     k->revision = 0x03;
1366     k->class_id = PCI_CLASS_SERIAL_USB;
1367     dc->vmsd = &vmstate_uhci;
1368     dc->props = uhci_properties;
1369 }
1370 
1371 static TypeInfo ich9_uhci3_info = {
1372     .name          = "ich9-usb-uhci3",
1373     .parent        = TYPE_PCI_DEVICE,
1374     .instance_size = sizeof(UHCIState),
1375     .class_init    = ich9_uhci3_class_init,
1376 };
1377 
1378 static void uhci_register_types(void)
1379 {
1380     type_register_static(&piix3_uhci_info);
1381     type_register_static(&piix4_uhci_info);
1382     type_register_static(&vt82c686b_uhci_info);
1383     type_register_static(&ich9_uhci1_info);
1384     type_register_static(&ich9_uhci2_info);
1385     type_register_static(&ich9_uhci3_info);
1386 }
1387 
1388 type_init(uhci_register_types)
1389