xref: /openbmc/qemu/hw/usb/hcd-uhci.c (revision 5accc840)
1 /*
2  * USB UHCI controller emulation
3  *
4  * Copyright (c) 2005 Fabrice Bellard
5  *
6  * Copyright (c) 2008 Max Krasnyansky
7  *     Magor rewrite of the UHCI data structures parser and frame processor
8  *     Support for fully async operation and multiple outstanding transactions
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 #include "hw/hw.h"
29 #include "hw/usb.h"
30 #include "hw/pci/pci.h"
31 #include "qemu/timer.h"
32 #include "qemu/iov.h"
33 #include "sysemu/dma.h"
34 #include "trace.h"
35 #include "qemu/main-loop.h"
36 
37 //#define DEBUG
38 //#define DEBUG_DUMP_DATA
39 
40 #define UHCI_CMD_FGR      (1 << 4)
41 #define UHCI_CMD_EGSM     (1 << 3)
42 #define UHCI_CMD_GRESET   (1 << 2)
43 #define UHCI_CMD_HCRESET  (1 << 1)
44 #define UHCI_CMD_RS       (1 << 0)
45 
46 #define UHCI_STS_HCHALTED (1 << 5)
47 #define UHCI_STS_HCPERR   (1 << 4)
48 #define UHCI_STS_HSERR    (1 << 3)
49 #define UHCI_STS_RD       (1 << 2)
50 #define UHCI_STS_USBERR   (1 << 1)
51 #define UHCI_STS_USBINT   (1 << 0)
52 
53 #define TD_CTRL_SPD     (1 << 29)
54 #define TD_CTRL_ERROR_SHIFT  27
55 #define TD_CTRL_IOS     (1 << 25)
56 #define TD_CTRL_IOC     (1 << 24)
57 #define TD_CTRL_ACTIVE  (1 << 23)
58 #define TD_CTRL_STALL   (1 << 22)
59 #define TD_CTRL_BABBLE  (1 << 20)
60 #define TD_CTRL_NAK     (1 << 19)
61 #define TD_CTRL_TIMEOUT (1 << 18)
62 
63 #define UHCI_PORT_SUSPEND (1 << 12)
64 #define UHCI_PORT_RESET (1 << 9)
65 #define UHCI_PORT_LSDA  (1 << 8)
66 #define UHCI_PORT_RD    (1 << 6)
67 #define UHCI_PORT_ENC   (1 << 3)
68 #define UHCI_PORT_EN    (1 << 2)
69 #define UHCI_PORT_CSC   (1 << 1)
70 #define UHCI_PORT_CCS   (1 << 0)
71 
72 #define UHCI_PORT_READ_ONLY    (0x1bb)
73 #define UHCI_PORT_WRITE_CLEAR  (UHCI_PORT_CSC | UHCI_PORT_ENC)
74 
75 #define FRAME_TIMER_FREQ 1000
76 
77 #define FRAME_MAX_LOOPS  256
78 
79 /* Must be large enough to handle 10 frame delay for initial isoc requests */
80 #define QH_VALID         32
81 
82 #define MAX_FRAMES_PER_TICK    (QH_VALID / 2)
83 
84 #define NB_PORTS 2
85 
86 enum {
87     TD_RESULT_STOP_FRAME = 10,
88     TD_RESULT_COMPLETE,
89     TD_RESULT_NEXT_QH,
90     TD_RESULT_ASYNC_START,
91     TD_RESULT_ASYNC_CONT,
92 };
93 
94 typedef struct UHCIState UHCIState;
95 typedef struct UHCIAsync UHCIAsync;
96 typedef struct UHCIQueue UHCIQueue;
97 typedef struct UHCIInfo UHCIInfo;
98 typedef struct UHCIPCIDeviceClass UHCIPCIDeviceClass;
99 
100 struct UHCIInfo {
101     const char *name;
102     uint16_t   vendor_id;
103     uint16_t   device_id;
104     uint8_t    revision;
105     uint8_t    irq_pin;
106     int        (*initfn)(PCIDevice *dev);
107     bool       unplug;
108 };
109 
110 struct UHCIPCIDeviceClass {
111     PCIDeviceClass parent_class;
112     UHCIInfo       info;
113 };
114 
115 /*
116  * Pending async transaction.
117  * 'packet' must be the first field because completion
118  * handler does "(UHCIAsync *) pkt" cast.
119  */
120 
121 struct UHCIAsync {
122     USBPacket packet;
123     uint8_t   static_buf[64]; /* 64 bytes is enough, except for isoc packets */
124     uint8_t   *buf;
125     UHCIQueue *queue;
126     QTAILQ_ENTRY(UHCIAsync) next;
127     uint32_t  td_addr;
128     uint8_t   done;
129 };
130 
131 struct UHCIQueue {
132     uint32_t  qh_addr;
133     uint32_t  token;
134     UHCIState *uhci;
135     USBEndpoint *ep;
136     QTAILQ_ENTRY(UHCIQueue) next;
137     QTAILQ_HEAD(asyncs_head, UHCIAsync) asyncs;
138     int8_t    valid;
139 };
140 
141 typedef struct UHCIPort {
142     USBPort port;
143     uint16_t ctrl;
144 } UHCIPort;
145 
146 struct UHCIState {
147     PCIDevice dev;
148     MemoryRegion io_bar;
149     USBBus bus; /* Note unused when we're a companion controller */
150     uint16_t cmd; /* cmd register */
151     uint16_t status;
152     uint16_t intr; /* interrupt enable register */
153     uint16_t frnum; /* frame number */
154     uint32_t fl_base_addr; /* frame list base address */
155     uint8_t sof_timing;
156     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
157     int64_t expire_time;
158     QEMUTimer *frame_timer;
159     QEMUBH *bh;
160     uint32_t frame_bytes;
161     uint32_t frame_bandwidth;
162     bool completions_only;
163     UHCIPort ports[NB_PORTS];
164 
165     /* Interrupts that should be raised at the end of the current frame.  */
166     uint32_t pending_int_mask;
167     int irq_pin;
168 
169     /* Active packets */
170     QTAILQ_HEAD(, UHCIQueue) queues;
171     uint8_t num_ports_vmstate;
172 
173     /* Properties */
174     char *masterbus;
175     uint32_t firstport;
176     uint32_t maxframes;
177 };
178 
179 typedef struct UHCI_TD {
180     uint32_t link;
181     uint32_t ctrl; /* see TD_CTRL_xxx */
182     uint32_t token;
183     uint32_t buffer;
184 } UHCI_TD;
185 
186 typedef struct UHCI_QH {
187     uint32_t link;
188     uint32_t el_link;
189 } UHCI_QH;
190 
191 static void uhci_async_cancel(UHCIAsync *async);
192 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
193 static void uhci_resume(void *opaque);
194 
195 static inline int32_t uhci_queue_token(UHCI_TD *td)
196 {
197     if ((td->token & (0xf << 15)) == 0) {
198         /* ctrl ep, cover ep and dev, not pid! */
199         return td->token & 0x7ff00;
200     } else {
201         /* covers ep, dev, pid -> identifies the endpoint */
202         return td->token & 0x7ffff;
203     }
204 }
205 
206 static UHCIQueue *uhci_queue_new(UHCIState *s, uint32_t qh_addr, UHCI_TD *td,
207                                  USBEndpoint *ep)
208 {
209     UHCIQueue *queue;
210 
211     queue = g_new0(UHCIQueue, 1);
212     queue->uhci = s;
213     queue->qh_addr = qh_addr;
214     queue->token = uhci_queue_token(td);
215     queue->ep = ep;
216     QTAILQ_INIT(&queue->asyncs);
217     QTAILQ_INSERT_HEAD(&s->queues, queue, next);
218     queue->valid = QH_VALID;
219     trace_usb_uhci_queue_add(queue->token);
220     return queue;
221 }
222 
223 static void uhci_queue_free(UHCIQueue *queue, const char *reason)
224 {
225     UHCIState *s = queue->uhci;
226     UHCIAsync *async;
227 
228     while (!QTAILQ_EMPTY(&queue->asyncs)) {
229         async = QTAILQ_FIRST(&queue->asyncs);
230         uhci_async_cancel(async);
231     }
232     usb_device_ep_stopped(queue->ep->dev, queue->ep);
233 
234     trace_usb_uhci_queue_del(queue->token, reason);
235     QTAILQ_REMOVE(&s->queues, queue, next);
236     g_free(queue);
237 }
238 
239 static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
240 {
241     uint32_t token = uhci_queue_token(td);
242     UHCIQueue *queue;
243 
244     QTAILQ_FOREACH(queue, &s->queues, next) {
245         if (queue->token == token) {
246             return queue;
247         }
248     }
249     return NULL;
250 }
251 
252 static bool uhci_queue_verify(UHCIQueue *queue, uint32_t qh_addr, UHCI_TD *td,
253                               uint32_t td_addr, bool queuing)
254 {
255     UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
256 
257     return queue->qh_addr == qh_addr &&
258            queue->token == uhci_queue_token(td) &&
259            (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
260             first->td_addr == td_addr);
261 }
262 
263 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t td_addr)
264 {
265     UHCIAsync *async = g_new0(UHCIAsync, 1);
266 
267     async->queue = queue;
268     async->td_addr = td_addr;
269     usb_packet_init(&async->packet);
270     trace_usb_uhci_packet_add(async->queue->token, async->td_addr);
271 
272     return async;
273 }
274 
275 static void uhci_async_free(UHCIAsync *async)
276 {
277     trace_usb_uhci_packet_del(async->queue->token, async->td_addr);
278     usb_packet_cleanup(&async->packet);
279     if (async->buf != async->static_buf) {
280         g_free(async->buf);
281     }
282     g_free(async);
283 }
284 
285 static void uhci_async_link(UHCIAsync *async)
286 {
287     UHCIQueue *queue = async->queue;
288     QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
289     trace_usb_uhci_packet_link_async(async->queue->token, async->td_addr);
290 }
291 
292 static void uhci_async_unlink(UHCIAsync *async)
293 {
294     UHCIQueue *queue = async->queue;
295     QTAILQ_REMOVE(&queue->asyncs, async, next);
296     trace_usb_uhci_packet_unlink_async(async->queue->token, async->td_addr);
297 }
298 
299 static void uhci_async_cancel(UHCIAsync *async)
300 {
301     uhci_async_unlink(async);
302     trace_usb_uhci_packet_cancel(async->queue->token, async->td_addr,
303                                  async->done);
304     if (!async->done)
305         usb_cancel_packet(&async->packet);
306     uhci_async_free(async);
307 }
308 
309 /*
310  * Mark all outstanding async packets as invalid.
311  * This is used for canceling them when TDs are removed by the HCD.
312  */
313 static void uhci_async_validate_begin(UHCIState *s)
314 {
315     UHCIQueue *queue;
316 
317     QTAILQ_FOREACH(queue, &s->queues, next) {
318         queue->valid--;
319     }
320 }
321 
322 /*
323  * Cancel async packets that are no longer valid
324  */
325 static void uhci_async_validate_end(UHCIState *s)
326 {
327     UHCIQueue *queue, *n;
328 
329     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
330         if (!queue->valid) {
331             uhci_queue_free(queue, "validate-end");
332         }
333     }
334 }
335 
336 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
337 {
338     UHCIQueue *queue, *n;
339 
340     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
341         if (queue->ep->dev == dev) {
342             uhci_queue_free(queue, "cancel-device");
343         }
344     }
345 }
346 
347 static void uhci_async_cancel_all(UHCIState *s)
348 {
349     UHCIQueue *queue, *nq;
350 
351     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
352         uhci_queue_free(queue, "cancel-all");
353     }
354 }
355 
356 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
357 {
358     UHCIQueue *queue;
359     UHCIAsync *async;
360 
361     QTAILQ_FOREACH(queue, &s->queues, next) {
362         QTAILQ_FOREACH(async, &queue->asyncs, next) {
363             if (async->td_addr == td_addr) {
364                 return async;
365             }
366         }
367     }
368     return NULL;
369 }
370 
371 static void uhci_update_irq(UHCIState *s)
372 {
373     int level;
374     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
375         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
376         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
377         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
378         (s->status & UHCI_STS_HSERR) ||
379         (s->status & UHCI_STS_HCPERR)) {
380         level = 1;
381     } else {
382         level = 0;
383     }
384     qemu_set_irq(s->dev.irq[s->irq_pin], level);
385 }
386 
387 static void uhci_reset(void *opaque)
388 {
389     UHCIState *s = opaque;
390     uint8_t *pci_conf;
391     int i;
392     UHCIPort *port;
393 
394     trace_usb_uhci_reset();
395 
396     pci_conf = s->dev.config;
397 
398     pci_conf[0x6a] = 0x01; /* usb clock */
399     pci_conf[0x6b] = 0x00;
400     s->cmd = 0;
401     s->status = 0;
402     s->status2 = 0;
403     s->intr = 0;
404     s->fl_base_addr = 0;
405     s->sof_timing = 64;
406 
407     for(i = 0; i < NB_PORTS; i++) {
408         port = &s->ports[i];
409         port->ctrl = 0x0080;
410         if (port->port.dev && port->port.dev->attached) {
411             usb_port_reset(&port->port);
412         }
413     }
414 
415     uhci_async_cancel_all(s);
416     qemu_bh_cancel(s->bh);
417     uhci_update_irq(s);
418 }
419 
420 static const VMStateDescription vmstate_uhci_port = {
421     .name = "uhci port",
422     .version_id = 1,
423     .minimum_version_id = 1,
424     .minimum_version_id_old = 1,
425     .fields      = (VMStateField []) {
426         VMSTATE_UINT16(ctrl, UHCIPort),
427         VMSTATE_END_OF_LIST()
428     }
429 };
430 
431 static int uhci_post_load(void *opaque, int version_id)
432 {
433     UHCIState *s = opaque;
434 
435     if (version_id < 2) {
436         s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
437             (get_ticks_per_sec() / FRAME_TIMER_FREQ);
438     }
439     return 0;
440 }
441 
442 static const VMStateDescription vmstate_uhci = {
443     .name = "uhci",
444     .version_id = 3,
445     .minimum_version_id = 1,
446     .minimum_version_id_old = 1,
447     .post_load = uhci_post_load,
448     .fields      = (VMStateField []) {
449         VMSTATE_PCI_DEVICE(dev, UHCIState),
450         VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState),
451         VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
452                              vmstate_uhci_port, UHCIPort),
453         VMSTATE_UINT16(cmd, UHCIState),
454         VMSTATE_UINT16(status, UHCIState),
455         VMSTATE_UINT16(intr, UHCIState),
456         VMSTATE_UINT16(frnum, UHCIState),
457         VMSTATE_UINT32(fl_base_addr, UHCIState),
458         VMSTATE_UINT8(sof_timing, UHCIState),
459         VMSTATE_UINT8(status2, UHCIState),
460         VMSTATE_TIMER(frame_timer, UHCIState),
461         VMSTATE_INT64_V(expire_time, UHCIState, 2),
462         VMSTATE_UINT32_V(pending_int_mask, UHCIState, 3),
463         VMSTATE_END_OF_LIST()
464     }
465 };
466 
467 static void uhci_port_write(void *opaque, hwaddr addr,
468                             uint64_t val, unsigned size)
469 {
470     UHCIState *s = opaque;
471 
472     trace_usb_uhci_mmio_writew(addr, val);
473 
474     switch(addr) {
475     case 0x00:
476         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
477             /* start frame processing */
478             trace_usb_uhci_schedule_start();
479             s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
480                 (get_ticks_per_sec() / FRAME_TIMER_FREQ);
481             timer_mod(s->frame_timer, s->expire_time);
482             s->status &= ~UHCI_STS_HCHALTED;
483         } else if (!(val & UHCI_CMD_RS)) {
484             s->status |= UHCI_STS_HCHALTED;
485         }
486         if (val & UHCI_CMD_GRESET) {
487             UHCIPort *port;
488             int i;
489 
490             /* send reset on the USB bus */
491             for(i = 0; i < NB_PORTS; i++) {
492                 port = &s->ports[i];
493                 usb_device_reset(port->port.dev);
494             }
495             uhci_reset(s);
496             return;
497         }
498         if (val & UHCI_CMD_HCRESET) {
499             uhci_reset(s);
500             return;
501         }
502         s->cmd = val;
503         if (val & UHCI_CMD_EGSM) {
504             if ((s->ports[0].ctrl & UHCI_PORT_RD) ||
505                 (s->ports[1].ctrl & UHCI_PORT_RD)) {
506                 uhci_resume(s);
507             }
508         }
509         break;
510     case 0x02:
511         s->status &= ~val;
512         /* XXX: the chip spec is not coherent, so we add a hidden
513            register to distinguish between IOC and SPD */
514         if (val & UHCI_STS_USBINT)
515             s->status2 = 0;
516         uhci_update_irq(s);
517         break;
518     case 0x04:
519         s->intr = val;
520         uhci_update_irq(s);
521         break;
522     case 0x06:
523         if (s->status & UHCI_STS_HCHALTED)
524             s->frnum = val & 0x7ff;
525         break;
526     case 0x08:
527         s->fl_base_addr &= 0xffff0000;
528         s->fl_base_addr |= val & ~0xfff;
529         break;
530     case 0x0a:
531         s->fl_base_addr &= 0x0000ffff;
532         s->fl_base_addr |= (val << 16);
533         break;
534     case 0x0c:
535         s->sof_timing = val & 0xff;
536         break;
537     case 0x10 ... 0x1f:
538         {
539             UHCIPort *port;
540             USBDevice *dev;
541             int n;
542 
543             n = (addr >> 1) & 7;
544             if (n >= NB_PORTS)
545                 return;
546             port = &s->ports[n];
547             dev = port->port.dev;
548             if (dev && dev->attached) {
549                 /* port reset */
550                 if ( (val & UHCI_PORT_RESET) &&
551                      !(port->ctrl & UHCI_PORT_RESET) ) {
552                     usb_device_reset(dev);
553                 }
554             }
555             port->ctrl &= UHCI_PORT_READ_ONLY;
556             /* enabled may only be set if a device is connected */
557             if (!(port->ctrl & UHCI_PORT_CCS)) {
558                 val &= ~UHCI_PORT_EN;
559             }
560             port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
561             /* some bits are reset when a '1' is written to them */
562             port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
563         }
564         break;
565     }
566 }
567 
568 static uint64_t uhci_port_read(void *opaque, hwaddr addr, unsigned size)
569 {
570     UHCIState *s = opaque;
571     uint32_t val;
572 
573     switch(addr) {
574     case 0x00:
575         val = s->cmd;
576         break;
577     case 0x02:
578         val = s->status;
579         break;
580     case 0x04:
581         val = s->intr;
582         break;
583     case 0x06:
584         val = s->frnum;
585         break;
586     case 0x08:
587         val = s->fl_base_addr & 0xffff;
588         break;
589     case 0x0a:
590         val = (s->fl_base_addr >> 16) & 0xffff;
591         break;
592     case 0x0c:
593         val = s->sof_timing;
594         break;
595     case 0x10 ... 0x1f:
596         {
597             UHCIPort *port;
598             int n;
599             n = (addr >> 1) & 7;
600             if (n >= NB_PORTS)
601                 goto read_default;
602             port = &s->ports[n];
603             val = port->ctrl;
604         }
605         break;
606     default:
607     read_default:
608         val = 0xff7f; /* disabled port */
609         break;
610     }
611 
612     trace_usb_uhci_mmio_readw(addr, val);
613 
614     return val;
615 }
616 
617 /* signal resume if controller suspended */
618 static void uhci_resume (void *opaque)
619 {
620     UHCIState *s = (UHCIState *)opaque;
621 
622     if (!s)
623         return;
624 
625     if (s->cmd & UHCI_CMD_EGSM) {
626         s->cmd |= UHCI_CMD_FGR;
627         s->status |= UHCI_STS_RD;
628         uhci_update_irq(s);
629     }
630 }
631 
632 static void uhci_attach(USBPort *port1)
633 {
634     UHCIState *s = port1->opaque;
635     UHCIPort *port = &s->ports[port1->index];
636 
637     /* set connect status */
638     port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
639 
640     /* update speed */
641     if (port->port.dev->speed == USB_SPEED_LOW) {
642         port->ctrl |= UHCI_PORT_LSDA;
643     } else {
644         port->ctrl &= ~UHCI_PORT_LSDA;
645     }
646 
647     uhci_resume(s);
648 }
649 
650 static void uhci_detach(USBPort *port1)
651 {
652     UHCIState *s = port1->opaque;
653     UHCIPort *port = &s->ports[port1->index];
654 
655     uhci_async_cancel_device(s, port1->dev);
656 
657     /* set connect status */
658     if (port->ctrl & UHCI_PORT_CCS) {
659         port->ctrl &= ~UHCI_PORT_CCS;
660         port->ctrl |= UHCI_PORT_CSC;
661     }
662     /* disable port */
663     if (port->ctrl & UHCI_PORT_EN) {
664         port->ctrl &= ~UHCI_PORT_EN;
665         port->ctrl |= UHCI_PORT_ENC;
666     }
667 
668     uhci_resume(s);
669 }
670 
671 static void uhci_child_detach(USBPort *port1, USBDevice *child)
672 {
673     UHCIState *s = port1->opaque;
674 
675     uhci_async_cancel_device(s, child);
676 }
677 
678 static void uhci_wakeup(USBPort *port1)
679 {
680     UHCIState *s = port1->opaque;
681     UHCIPort *port = &s->ports[port1->index];
682 
683     if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
684         port->ctrl |= UHCI_PORT_RD;
685         uhci_resume(s);
686     }
687 }
688 
689 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
690 {
691     USBDevice *dev;
692     int i;
693 
694     for (i = 0; i < NB_PORTS; i++) {
695         UHCIPort *port = &s->ports[i];
696         if (!(port->ctrl & UHCI_PORT_EN)) {
697             continue;
698         }
699         dev = usb_find_device(&port->port, addr);
700         if (dev != NULL) {
701             return dev;
702         }
703     }
704     return NULL;
705 }
706 
707 static void uhci_read_td(UHCIState *s, UHCI_TD *td, uint32_t link)
708 {
709     pci_dma_read(&s->dev, link & ~0xf, td, sizeof(*td));
710     le32_to_cpus(&td->link);
711     le32_to_cpus(&td->ctrl);
712     le32_to_cpus(&td->token);
713     le32_to_cpus(&td->buffer);
714 }
715 
716 static int uhci_handle_td_error(UHCIState *s, UHCI_TD *td, uint32_t td_addr,
717                                 int status, uint32_t *int_mask)
718 {
719     uint32_t queue_token = uhci_queue_token(td);
720     int ret;
721 
722     switch (status) {
723     case USB_RET_NAK:
724         td->ctrl |= TD_CTRL_NAK;
725         return TD_RESULT_NEXT_QH;
726 
727     case USB_RET_STALL:
728         td->ctrl |= TD_CTRL_STALL;
729         trace_usb_uhci_packet_complete_stall(queue_token, td_addr);
730         ret = TD_RESULT_NEXT_QH;
731         break;
732 
733     case USB_RET_BABBLE:
734         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
735         /* frame interrupted */
736         trace_usb_uhci_packet_complete_babble(queue_token, td_addr);
737         ret = TD_RESULT_STOP_FRAME;
738         break;
739 
740     case USB_RET_IOERROR:
741     case USB_RET_NODEV:
742     default:
743         td->ctrl |= TD_CTRL_TIMEOUT;
744         td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
745         trace_usb_uhci_packet_complete_error(queue_token, td_addr);
746         ret = TD_RESULT_NEXT_QH;
747         break;
748     }
749 
750     td->ctrl &= ~TD_CTRL_ACTIVE;
751     s->status |= UHCI_STS_USBERR;
752     if (td->ctrl & TD_CTRL_IOC) {
753         *int_mask |= 0x01;
754     }
755     uhci_update_irq(s);
756     return ret;
757 }
758 
759 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
760 {
761     int len = 0, max_len;
762     uint8_t pid;
763 
764     max_len = ((td->token >> 21) + 1) & 0x7ff;
765     pid = td->token & 0xff;
766 
767     if (td->ctrl & TD_CTRL_IOS)
768         td->ctrl &= ~TD_CTRL_ACTIVE;
769 
770     if (async->packet.status != USB_RET_SUCCESS) {
771         return uhci_handle_td_error(s, td, async->td_addr,
772                                     async->packet.status, int_mask);
773     }
774 
775     len = async->packet.actual_length;
776     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
777 
778     /* The NAK bit may have been set by a previous frame, so clear it
779        here.  The docs are somewhat unclear, but win2k relies on this
780        behavior.  */
781     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
782     if (td->ctrl & TD_CTRL_IOC)
783         *int_mask |= 0x01;
784 
785     if (pid == USB_TOKEN_IN) {
786         pci_dma_write(&s->dev, td->buffer, async->buf, len);
787         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
788             *int_mask |= 0x02;
789             /* short packet: do not update QH */
790             trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
791                                                      async->td_addr);
792             return TD_RESULT_NEXT_QH;
793         }
794     }
795 
796     /* success */
797     trace_usb_uhci_packet_complete_success(async->queue->token,
798                                            async->td_addr);
799     return TD_RESULT_COMPLETE;
800 }
801 
802 static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
803                           UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
804 {
805     int ret, max_len;
806     bool spd;
807     bool queuing = (q != NULL);
808     uint8_t pid = td->token & 0xff;
809     UHCIAsync *async = uhci_async_find_td(s, td_addr);
810 
811     if (async) {
812         if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
813             assert(q == NULL || q == async->queue);
814             q = async->queue;
815         } else {
816             uhci_queue_free(async->queue, "guest re-used pending td");
817             async = NULL;
818         }
819     }
820 
821     if (q == NULL) {
822         q = uhci_queue_find(s, td);
823         if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
824             uhci_queue_free(q, "guest re-used qh");
825             q = NULL;
826         }
827     }
828 
829     if (q) {
830         q->valid = QH_VALID;
831     }
832 
833     /* Is active ? */
834     if (!(td->ctrl & TD_CTRL_ACTIVE)) {
835         if (async) {
836             /* Guest marked a pending td non-active, cancel the queue */
837             uhci_queue_free(async->queue, "pending td non-active");
838         }
839         /*
840          * ehci11d spec page 22: "Even if the Active bit in the TD is already
841          * cleared when the TD is fetched ... an IOC interrupt is generated"
842          */
843         if (td->ctrl & TD_CTRL_IOC) {
844                 *int_mask |= 0x01;
845         }
846         return TD_RESULT_NEXT_QH;
847     }
848 
849     if (async) {
850         if (queuing) {
851             /* we are busy filling the queue, we are not prepared
852                to consume completed packages then, just leave them
853                in async state */
854             return TD_RESULT_ASYNC_CONT;
855         }
856         if (!async->done) {
857             UHCI_TD last_td;
858             UHCIAsync *last = QTAILQ_LAST(&async->queue->asyncs, asyncs_head);
859             /*
860              * While we are waiting for the current td to complete, the guest
861              * may have added more tds to the queue. Note we re-read the td
862              * rather then caching it, as we want to see guest made changes!
863              */
864             uhci_read_td(s, &last_td, last->td_addr);
865             uhci_queue_fill(async->queue, &last_td);
866 
867             return TD_RESULT_ASYNC_CONT;
868         }
869         uhci_async_unlink(async);
870         goto done;
871     }
872 
873     if (s->completions_only) {
874         return TD_RESULT_ASYNC_CONT;
875     }
876 
877     /* Allocate new packet */
878     if (q == NULL) {
879         USBDevice *dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
880         USBEndpoint *ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
881 
882         if (ep == NULL) {
883             return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
884                                         int_mask);
885         }
886         q = uhci_queue_new(s, qh_addr, td, ep);
887     }
888     async = uhci_async_alloc(q, td_addr);
889 
890     max_len = ((td->token >> 21) + 1) & 0x7ff;
891     spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
892     usb_packet_setup(&async->packet, pid, q->ep, 0, td_addr, spd,
893                      (td->ctrl & TD_CTRL_IOC) != 0);
894     if (max_len <= sizeof(async->static_buf)) {
895         async->buf = async->static_buf;
896     } else {
897         async->buf = g_malloc(max_len);
898     }
899     usb_packet_addbuf(&async->packet, async->buf, max_len);
900 
901     switch(pid) {
902     case USB_TOKEN_OUT:
903     case USB_TOKEN_SETUP:
904         pci_dma_read(&s->dev, td->buffer, async->buf, max_len);
905         usb_handle_packet(q->ep->dev, &async->packet);
906         if (async->packet.status == USB_RET_SUCCESS) {
907             async->packet.actual_length = max_len;
908         }
909         break;
910 
911     case USB_TOKEN_IN:
912         usb_handle_packet(q->ep->dev, &async->packet);
913         break;
914 
915     default:
916         /* invalid pid : frame interrupted */
917         uhci_async_free(async);
918         s->status |= UHCI_STS_HCPERR;
919         uhci_update_irq(s);
920         return TD_RESULT_STOP_FRAME;
921     }
922 
923     if (async->packet.status == USB_RET_ASYNC) {
924         uhci_async_link(async);
925         if (!queuing) {
926             uhci_queue_fill(q, td);
927         }
928         return TD_RESULT_ASYNC_START;
929     }
930 
931 done:
932     ret = uhci_complete_td(s, td, async, int_mask);
933     uhci_async_free(async);
934     return ret;
935 }
936 
937 static void uhci_async_complete(USBPort *port, USBPacket *packet)
938 {
939     UHCIAsync *async = container_of(packet, UHCIAsync, packet);
940     UHCIState *s = async->queue->uhci;
941 
942     if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
943         uhci_async_cancel(async);
944         return;
945     }
946 
947     async->done = 1;
948     /* Force processing of this packet *now*, needed for migration */
949     s->completions_only = true;
950     qemu_bh_schedule(s->bh);
951 }
952 
953 static int is_valid(uint32_t link)
954 {
955     return (link & 1) == 0;
956 }
957 
958 static int is_qh(uint32_t link)
959 {
960     return (link & 2) != 0;
961 }
962 
963 static int depth_first(uint32_t link)
964 {
965     return (link & 4) != 0;
966 }
967 
968 /* QH DB used for detecting QH loops */
969 #define UHCI_MAX_QUEUES 128
970 typedef struct {
971     uint32_t addr[UHCI_MAX_QUEUES];
972     int      count;
973 } QhDb;
974 
975 static void qhdb_reset(QhDb *db)
976 {
977     db->count = 0;
978 }
979 
980 /* Add QH to DB. Returns 1 if already present or DB is full. */
981 static int qhdb_insert(QhDb *db, uint32_t addr)
982 {
983     int i;
984     for (i = 0; i < db->count; i++)
985         if (db->addr[i] == addr)
986             return 1;
987 
988     if (db->count >= UHCI_MAX_QUEUES)
989         return 1;
990 
991     db->addr[db->count++] = addr;
992     return 0;
993 }
994 
995 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td)
996 {
997     uint32_t int_mask = 0;
998     uint32_t plink = td->link;
999     UHCI_TD ptd;
1000     int ret;
1001 
1002     while (is_valid(plink)) {
1003         uhci_read_td(q->uhci, &ptd, plink);
1004         if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
1005             break;
1006         }
1007         if (uhci_queue_token(&ptd) != q->token) {
1008             break;
1009         }
1010         trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
1011         ret = uhci_handle_td(q->uhci, q, q->qh_addr, &ptd, plink, &int_mask);
1012         if (ret == TD_RESULT_ASYNC_CONT) {
1013             break;
1014         }
1015         assert(ret == TD_RESULT_ASYNC_START);
1016         assert(int_mask == 0);
1017         plink = ptd.link;
1018     }
1019     usb_device_flush_ep_queue(q->ep->dev, q->ep);
1020 }
1021 
1022 static void uhci_process_frame(UHCIState *s)
1023 {
1024     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
1025     uint32_t curr_qh, td_count = 0;
1026     int cnt, ret;
1027     UHCI_TD td;
1028     UHCI_QH qh;
1029     QhDb qhdb;
1030 
1031     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
1032 
1033     pci_dma_read(&s->dev, frame_addr, &link, 4);
1034     le32_to_cpus(&link);
1035 
1036     int_mask = 0;
1037     curr_qh  = 0;
1038 
1039     qhdb_reset(&qhdb);
1040 
1041     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1042         if (!s->completions_only && s->frame_bytes >= s->frame_bandwidth) {
1043             /* We've reached the usb 1.1 bandwidth, which is
1044                1280 bytes/frame, stop processing */
1045             trace_usb_uhci_frame_stop_bandwidth();
1046             break;
1047         }
1048         if (is_qh(link)) {
1049             /* QH */
1050             trace_usb_uhci_qh_load(link & ~0xf);
1051 
1052             if (qhdb_insert(&qhdb, link)) {
1053                 /*
1054                  * We're going in circles. Which is not a bug because
1055                  * HCD is allowed to do that as part of the BW management.
1056                  *
1057                  * Stop processing here if no transaction has been done
1058                  * since we've been here last time.
1059                  */
1060                 if (td_count == 0) {
1061                     trace_usb_uhci_frame_loop_stop_idle();
1062                     break;
1063                 } else {
1064                     trace_usb_uhci_frame_loop_continue();
1065                     td_count = 0;
1066                     qhdb_reset(&qhdb);
1067                     qhdb_insert(&qhdb, link);
1068                 }
1069             }
1070 
1071             pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1072             le32_to_cpus(&qh.link);
1073             le32_to_cpus(&qh.el_link);
1074 
1075             if (!is_valid(qh.el_link)) {
1076                 /* QH w/o elements */
1077                 curr_qh = 0;
1078                 link = qh.link;
1079             } else {
1080                 /* QH with elements */
1081             	curr_qh = link;
1082             	link = qh.el_link;
1083             }
1084             continue;
1085         }
1086 
1087         /* TD */
1088         uhci_read_td(s, &td, link);
1089         trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1090 
1091         old_td_ctrl = td.ctrl;
1092         ret = uhci_handle_td(s, NULL, curr_qh, &td, link, &int_mask);
1093         if (old_td_ctrl != td.ctrl) {
1094             /* update the status bits of the TD */
1095             val = cpu_to_le32(td.ctrl);
1096             pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1097         }
1098 
1099         switch (ret) {
1100         case TD_RESULT_STOP_FRAME: /* interrupted frame */
1101             goto out;
1102 
1103         case TD_RESULT_NEXT_QH:
1104         case TD_RESULT_ASYNC_CONT:
1105             trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1106             link = curr_qh ? qh.link : td.link;
1107             continue;
1108 
1109         case TD_RESULT_ASYNC_START:
1110             trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1111             link = curr_qh ? qh.link : td.link;
1112             continue;
1113 
1114         case TD_RESULT_COMPLETE:
1115             trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1116             link = td.link;
1117             td_count++;
1118             s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1119 
1120             if (curr_qh) {
1121                 /* update QH element link */
1122                 qh.el_link = link;
1123                 val = cpu_to_le32(qh.el_link);
1124                 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1125 
1126                 if (!depth_first(link)) {
1127                     /* done with this QH */
1128                     curr_qh = 0;
1129                     link    = qh.link;
1130                 }
1131             }
1132             break;
1133 
1134         default:
1135             assert(!"unknown return code");
1136         }
1137 
1138         /* go to the next entry */
1139     }
1140 
1141 out:
1142     s->pending_int_mask |= int_mask;
1143 }
1144 
1145 static void uhci_bh(void *opaque)
1146 {
1147     UHCIState *s = opaque;
1148     uhci_process_frame(s);
1149 }
1150 
1151 static void uhci_frame_timer(void *opaque)
1152 {
1153     UHCIState *s = opaque;
1154     uint64_t t_now, t_last_run;
1155     int i, frames;
1156     const uint64_t frame_t = get_ticks_per_sec() / FRAME_TIMER_FREQ;
1157 
1158     s->completions_only = false;
1159     qemu_bh_cancel(s->bh);
1160 
1161     if (!(s->cmd & UHCI_CMD_RS)) {
1162         /* Full stop */
1163         trace_usb_uhci_schedule_stop();
1164         timer_del(s->frame_timer);
1165         uhci_async_cancel_all(s);
1166         /* set hchalted bit in status - UHCI11D 2.1.2 */
1167         s->status |= UHCI_STS_HCHALTED;
1168         return;
1169     }
1170 
1171     /* We still store expire_time in our state, for migration */
1172     t_last_run = s->expire_time - frame_t;
1173     t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1174 
1175     /* Process up to MAX_FRAMES_PER_TICK frames */
1176     frames = (t_now - t_last_run) / frame_t;
1177     if (frames > s->maxframes) {
1178         int skipped = frames - s->maxframes;
1179         s->expire_time += skipped * frame_t;
1180         s->frnum = (s->frnum + skipped) & 0x7ff;
1181         frames -= skipped;
1182     }
1183     if (frames > MAX_FRAMES_PER_TICK) {
1184         frames = MAX_FRAMES_PER_TICK;
1185     }
1186 
1187     for (i = 0; i < frames; i++) {
1188         s->frame_bytes = 0;
1189         trace_usb_uhci_frame_start(s->frnum);
1190         uhci_async_validate_begin(s);
1191         uhci_process_frame(s);
1192         uhci_async_validate_end(s);
1193         /* The spec says frnum is the frame currently being processed, and
1194          * the guest must look at frnum - 1 on interrupt, so inc frnum now */
1195         s->frnum = (s->frnum + 1) & 0x7ff;
1196         s->expire_time += frame_t;
1197     }
1198 
1199     /* Complete the previous frame(s) */
1200     if (s->pending_int_mask) {
1201         s->status2 |= s->pending_int_mask;
1202         s->status  |= UHCI_STS_USBINT;
1203         uhci_update_irq(s);
1204     }
1205     s->pending_int_mask = 0;
1206 
1207     timer_mod(s->frame_timer, t_now + frame_t);
1208 }
1209 
1210 static const MemoryRegionOps uhci_ioport_ops = {
1211     .read  = uhci_port_read,
1212     .write = uhci_port_write,
1213     .valid.min_access_size = 1,
1214     .valid.max_access_size = 4,
1215     .impl.min_access_size = 2,
1216     .impl.max_access_size = 2,
1217     .endianness = DEVICE_LITTLE_ENDIAN,
1218 };
1219 
1220 static USBPortOps uhci_port_ops = {
1221     .attach = uhci_attach,
1222     .detach = uhci_detach,
1223     .child_detach = uhci_child_detach,
1224     .wakeup = uhci_wakeup,
1225     .complete = uhci_async_complete,
1226 };
1227 
1228 static USBBusOps uhci_bus_ops = {
1229 };
1230 
1231 static int usb_uhci_common_initfn(PCIDevice *dev)
1232 {
1233     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
1234     UHCIPCIDeviceClass *u = container_of(pc, UHCIPCIDeviceClass, parent_class);
1235     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1236     uint8_t *pci_conf = s->dev.config;
1237     int i;
1238 
1239     pci_conf[PCI_CLASS_PROG] = 0x00;
1240     /* TODO: reset value should be 0. */
1241     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1242 
1243     s->irq_pin = u->info.irq_pin;
1244     pci_config_set_interrupt_pin(pci_conf, s->irq_pin + 1);
1245 
1246     if (s->masterbus) {
1247         USBPort *ports[NB_PORTS];
1248         for(i = 0; i < NB_PORTS; i++) {
1249             ports[i] = &s->ports[i].port;
1250         }
1251         if (usb_register_companion(s->masterbus, ports, NB_PORTS,
1252                 s->firstport, s, &uhci_port_ops,
1253                 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL) != 0) {
1254             return -1;
1255         }
1256     } else {
1257         usb_bus_new(&s->bus, sizeof(s->bus), &uhci_bus_ops, DEVICE(dev));
1258         for (i = 0; i < NB_PORTS; i++) {
1259             usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1260                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1261         }
1262     }
1263     s->bh = qemu_bh_new(uhci_bh, s);
1264     s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, uhci_frame_timer, s);
1265     s->num_ports_vmstate = NB_PORTS;
1266     QTAILQ_INIT(&s->queues);
1267 
1268     qemu_register_reset(uhci_reset, s);
1269 
1270     memory_region_init_io(&s->io_bar, OBJECT(s), &uhci_ioport_ops, s,
1271                           "uhci", 0x20);
1272 
1273     /* Use region 4 for consistency with real hardware.  BSD guests seem
1274        to rely on this.  */
1275     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1276 
1277     return 0;
1278 }
1279 
1280 static int usb_uhci_vt82c686b_initfn(PCIDevice *dev)
1281 {
1282     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1283     uint8_t *pci_conf = s->dev.config;
1284 
1285     /* USB misc control 1/2 */
1286     pci_set_long(pci_conf + 0x40,0x00001000);
1287     /* PM capability */
1288     pci_set_long(pci_conf + 0x80,0x00020001);
1289     /* USB legacy support  */
1290     pci_set_long(pci_conf + 0xc0,0x00002000);
1291 
1292     return usb_uhci_common_initfn(dev);
1293 }
1294 
1295 static void usb_uhci_exit(PCIDevice *dev)
1296 {
1297     UHCIState *s = DO_UPCAST(UHCIState, dev, dev);
1298 
1299     memory_region_destroy(&s->io_bar);
1300 }
1301 
1302 static Property uhci_properties[] = {
1303     DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1304     DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1305     DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1306     DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
1307     DEFINE_PROP_END_OF_LIST(),
1308 };
1309 
1310 static void uhci_class_init(ObjectClass *klass, void *data)
1311 {
1312     DeviceClass *dc = DEVICE_CLASS(klass);
1313     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1314     UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);
1315     UHCIInfo *info = data;
1316 
1317     k->init = info->initfn ? info->initfn : usb_uhci_common_initfn;
1318     k->exit = info->unplug ? usb_uhci_exit : NULL;
1319     k->vendor_id = info->vendor_id;
1320     k->device_id = info->device_id;
1321     k->revision  = info->revision;
1322     k->class_id  = PCI_CLASS_SERIAL_USB;
1323     k->no_hotplug = 1;
1324     dc->vmsd = &vmstate_uhci;
1325     dc->props = uhci_properties;
1326     set_bit(DEVICE_CATEGORY_USB, dc->categories);
1327     u->info = *info;
1328 }
1329 
1330 static UHCIInfo uhci_info[] = {
1331     {
1332         .name       = "piix3-usb-uhci",
1333         .vendor_id = PCI_VENDOR_ID_INTEL,
1334         .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1335         .revision  = 0x01,
1336         .irq_pin   = 3,
1337         .unplug    = true,
1338     },{
1339         .name      = "piix4-usb-uhci",
1340         .vendor_id = PCI_VENDOR_ID_INTEL,
1341         .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1342         .revision  = 0x01,
1343         .irq_pin   = 3,
1344         .unplug    = true,
1345     },{
1346         .name      = "vt82c686b-usb-uhci",
1347         .vendor_id = PCI_VENDOR_ID_VIA,
1348         .device_id = PCI_DEVICE_ID_VIA_UHCI,
1349         .revision  = 0x01,
1350         .irq_pin   = 3,
1351         .initfn    = usb_uhci_vt82c686b_initfn,
1352         .unplug    = true,
1353     },{
1354         .name      = "ich9-usb-uhci1", /* 00:1d.0 */
1355         .vendor_id = PCI_VENDOR_ID_INTEL,
1356         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1357         .revision  = 0x03,
1358         .irq_pin   = 0,
1359         .unplug    = false,
1360     },{
1361         .name      = "ich9-usb-uhci2", /* 00:1d.1 */
1362         .vendor_id = PCI_VENDOR_ID_INTEL,
1363         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1364         .revision  = 0x03,
1365         .irq_pin   = 1,
1366         .unplug    = false,
1367     },{
1368         .name      = "ich9-usb-uhci3", /* 00:1d.2 */
1369         .vendor_id = PCI_VENDOR_ID_INTEL,
1370         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1371         .revision  = 0x03,
1372         .irq_pin   = 2,
1373         .unplug    = false,
1374     },{
1375         .name      = "ich9-usb-uhci4", /* 00:1a.0 */
1376         .vendor_id = PCI_VENDOR_ID_INTEL,
1377         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI4,
1378         .revision  = 0x03,
1379         .irq_pin   = 0,
1380         .unplug    = false,
1381     },{
1382         .name      = "ich9-usb-uhci5", /* 00:1a.1 */
1383         .vendor_id = PCI_VENDOR_ID_INTEL,
1384         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI5,
1385         .revision  = 0x03,
1386         .irq_pin   = 1,
1387         .unplug    = false,
1388     },{
1389         .name      = "ich9-usb-uhci6", /* 00:1a.2 */
1390         .vendor_id = PCI_VENDOR_ID_INTEL,
1391         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI6,
1392         .revision  = 0x03,
1393         .irq_pin   = 2,
1394         .unplug    = false,
1395     }
1396 };
1397 
1398 static void uhci_register_types(void)
1399 {
1400     TypeInfo uhci_type_info = {
1401         .parent        = TYPE_PCI_DEVICE,
1402         .instance_size = sizeof(UHCIState),
1403         .class_size    = sizeof(UHCIPCIDeviceClass),
1404         .class_init    = uhci_class_init,
1405     };
1406     int i;
1407 
1408     for (i = 0; i < ARRAY_SIZE(uhci_info); i++) {
1409         uhci_type_info.name = uhci_info[i].name;
1410         uhci_type_info.class_data = uhci_info + i;
1411         type_register(&uhci_type_info);
1412     }
1413 }
1414 
1415 type_init(uhci_register_types)
1416