xref: /qemu/hw/usb/hcd-uhci.c (revision db1015e92e04835c9eb50c29625fe566d1202dbd)
1 /*
2  * USB UHCI controller emulation
3  *
4  * Copyright (c) 2005 Fabrice Bellard
5  *
6  * Copyright (c) 2008 Max Krasnyansky
7  *     Magor rewrite of the UHCI data structures parser and frame processor
8  *     Support for fully async operation and multiple outstanding transactions
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 
29 #include "qemu/osdep.h"
30 #include "hw/usb.h"
31 #include "hw/usb/uhci-regs.h"
32 #include "migration/vmstate.h"
33 #include "hw/pci/pci.h"
34 #include "hw/qdev-properties.h"
35 #include "qapi/error.h"
36 #include "qemu/timer.h"
37 #include "qemu/iov.h"
38 #include "sysemu/dma.h"
39 #include "trace.h"
40 #include "qemu/main-loop.h"
41 #include "qemu/module.h"
42 #include "qom/object.h"
43 
44 #define FRAME_TIMER_FREQ 1000
45 
46 #define FRAME_MAX_LOOPS  256
47 
48 /* Must be large enough to handle 10 frame delay for initial isoc requests */
49 #define QH_VALID         32
50 
51 #define MAX_FRAMES_PER_TICK    (QH_VALID / 2)
52 
53 #define NB_PORTS 2
54 
55 enum {
56     TD_RESULT_STOP_FRAME = 10,
57     TD_RESULT_COMPLETE,
58     TD_RESULT_NEXT_QH,
59     TD_RESULT_ASYNC_START,
60     TD_RESULT_ASYNC_CONT,
61 };
62 
63 typedef struct UHCIState UHCIState;
64 typedef struct UHCIAsync UHCIAsync;
65 typedef struct UHCIQueue UHCIQueue;
66 typedef struct UHCIInfo UHCIInfo;
67 typedef struct UHCIPCIDeviceClass UHCIPCIDeviceClass;
68 
69 struct UHCIInfo {
70     const char *name;
71     uint16_t   vendor_id;
72     uint16_t   device_id;
73     uint8_t    revision;
74     uint8_t    irq_pin;
75     void       (*realize)(PCIDevice *dev, Error **errp);
76     bool       unplug;
77 };
78 
79 struct UHCIPCIDeviceClass {
80     PCIDeviceClass parent_class;
81     UHCIInfo       info;
82 };
83 
84 /*
85  * Pending async transaction.
86  * 'packet' must be the first field because completion
87  * handler does "(UHCIAsync *) pkt" cast.
88  */
89 
90 struct UHCIAsync {
91     USBPacket packet;
92     uint8_t   static_buf[64]; /* 64 bytes is enough, except for isoc packets */
93     uint8_t   *buf;
94     UHCIQueue *queue;
95     QTAILQ_ENTRY(UHCIAsync) next;
96     uint32_t  td_addr;
97     uint8_t   done;
98 };
99 
100 struct UHCIQueue {
101     uint32_t  qh_addr;
102     uint32_t  token;
103     UHCIState *uhci;
104     USBEndpoint *ep;
105     QTAILQ_ENTRY(UHCIQueue) next;
106     QTAILQ_HEAD(, UHCIAsync) asyncs;
107     int8_t    valid;
108 };
109 
110 typedef struct UHCIPort {
111     USBPort port;
112     uint16_t ctrl;
113 } UHCIPort;
114 
115 struct UHCIState {
116     PCIDevice dev;
117     MemoryRegion io_bar;
118     USBBus bus; /* Note unused when we're a companion controller */
119     uint16_t cmd; /* cmd register */
120     uint16_t status;
121     uint16_t intr; /* interrupt enable register */
122     uint16_t frnum; /* frame number */
123     uint32_t fl_base_addr; /* frame list base address */
124     uint8_t sof_timing;
125     uint8_t status2; /* bit 0 and 1 are used to generate UHCI_STS_USBINT */
126     int64_t expire_time;
127     QEMUTimer *frame_timer;
128     QEMUBH *bh;
129     uint32_t frame_bytes;
130     uint32_t frame_bandwidth;
131     bool completions_only;
132     UHCIPort ports[NB_PORTS];
133 
134     /* Interrupts that should be raised at the end of the current frame.  */
135     uint32_t pending_int_mask;
136 
137     /* Active packets */
138     QTAILQ_HEAD(, UHCIQueue) queues;
139     uint8_t num_ports_vmstate;
140 
141     /* Properties */
142     char *masterbus;
143     uint32_t firstport;
144     uint32_t maxframes;
145 };
146 
147 typedef struct UHCI_TD {
148     uint32_t link;
149     uint32_t ctrl; /* see TD_CTRL_xxx */
150     uint32_t token;
151     uint32_t buffer;
152 } UHCI_TD;
153 
154 typedef struct UHCI_QH {
155     uint32_t link;
156     uint32_t el_link;
157 } UHCI_QH;
158 
159 static void uhci_async_cancel(UHCIAsync *async);
160 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
161 static void uhci_resume(void *opaque);
162 
163 #define TYPE_UHCI "pci-uhci-usb"
164 #define UHCI(obj) OBJECT_CHECK(UHCIState, (obj), TYPE_UHCI)
165 
166 static inline int32_t uhci_queue_token(UHCI_TD *td)
167 {
168     if ((td->token & (0xf << 15)) == 0) {
169         /* ctrl ep, cover ep and dev, not pid! */
170         return td->token & 0x7ff00;
171     } else {
172         /* covers ep, dev, pid -> identifies the endpoint */
173         return td->token & 0x7ffff;
174     }
175 }
176 
177 static UHCIQueue *uhci_queue_new(UHCIState *s, uint32_t qh_addr, UHCI_TD *td,
178                                  USBEndpoint *ep)
179 {
180     UHCIQueue *queue;
181 
182     queue = g_new0(UHCIQueue, 1);
183     queue->uhci = s;
184     queue->qh_addr = qh_addr;
185     queue->token = uhci_queue_token(td);
186     queue->ep = ep;
187     QTAILQ_INIT(&queue->asyncs);
188     QTAILQ_INSERT_HEAD(&s->queues, queue, next);
189     queue->valid = QH_VALID;
190     trace_usb_uhci_queue_add(queue->token);
191     return queue;
192 }
193 
194 static void uhci_queue_free(UHCIQueue *queue, const char *reason)
195 {
196     UHCIState *s = queue->uhci;
197     UHCIAsync *async;
198 
199     while (!QTAILQ_EMPTY(&queue->asyncs)) {
200         async = QTAILQ_FIRST(&queue->asyncs);
201         uhci_async_cancel(async);
202     }
203     usb_device_ep_stopped(queue->ep->dev, queue->ep);
204 
205     trace_usb_uhci_queue_del(queue->token, reason);
206     QTAILQ_REMOVE(&s->queues, queue, next);
207     g_free(queue);
208 }
209 
210 static UHCIQueue *uhci_queue_find(UHCIState *s, UHCI_TD *td)
211 {
212     uint32_t token = uhci_queue_token(td);
213     UHCIQueue *queue;
214 
215     QTAILQ_FOREACH(queue, &s->queues, next) {
216         if (queue->token == token) {
217             return queue;
218         }
219     }
220     return NULL;
221 }
222 
223 static bool uhci_queue_verify(UHCIQueue *queue, uint32_t qh_addr, UHCI_TD *td,
224                               uint32_t td_addr, bool queuing)
225 {
226     UHCIAsync *first = QTAILQ_FIRST(&queue->asyncs);
227     uint32_t queue_token_addr = (queue->token >> 8) & 0x7f;
228 
229     return queue->qh_addr == qh_addr &&
230            queue->token == uhci_queue_token(td) &&
231            queue_token_addr == queue->ep->dev->addr &&
232            (queuing || !(td->ctrl & TD_CTRL_ACTIVE) || first == NULL ||
233             first->td_addr == td_addr);
234 }
235 
236 static UHCIAsync *uhci_async_alloc(UHCIQueue *queue, uint32_t td_addr)
237 {
238     UHCIAsync *async = g_new0(UHCIAsync, 1);
239 
240     async->queue = queue;
241     async->td_addr = td_addr;
242     usb_packet_init(&async->packet);
243     trace_usb_uhci_packet_add(async->queue->token, async->td_addr);
244 
245     return async;
246 }
247 
248 static void uhci_async_free(UHCIAsync *async)
249 {
250     trace_usb_uhci_packet_del(async->queue->token, async->td_addr);
251     usb_packet_cleanup(&async->packet);
252     if (async->buf != async->static_buf) {
253         g_free(async->buf);
254     }
255     g_free(async);
256 }
257 
258 static void uhci_async_link(UHCIAsync *async)
259 {
260     UHCIQueue *queue = async->queue;
261     QTAILQ_INSERT_TAIL(&queue->asyncs, async, next);
262     trace_usb_uhci_packet_link_async(async->queue->token, async->td_addr);
263 }
264 
265 static void uhci_async_unlink(UHCIAsync *async)
266 {
267     UHCIQueue *queue = async->queue;
268     QTAILQ_REMOVE(&queue->asyncs, async, next);
269     trace_usb_uhci_packet_unlink_async(async->queue->token, async->td_addr);
270 }
271 
272 static void uhci_async_cancel(UHCIAsync *async)
273 {
274     uhci_async_unlink(async);
275     trace_usb_uhci_packet_cancel(async->queue->token, async->td_addr,
276                                  async->done);
277     if (!async->done)
278         usb_cancel_packet(&async->packet);
279     uhci_async_free(async);
280 }
281 
282 /*
283  * Mark all outstanding async packets as invalid.
284  * This is used for canceling them when TDs are removed by the HCD.
285  */
286 static void uhci_async_validate_begin(UHCIState *s)
287 {
288     UHCIQueue *queue;
289 
290     QTAILQ_FOREACH(queue, &s->queues, next) {
291         queue->valid--;
292     }
293 }
294 
295 /*
296  * Cancel async packets that are no longer valid
297  */
298 static void uhci_async_validate_end(UHCIState *s)
299 {
300     UHCIQueue *queue, *n;
301 
302     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
303         if (!queue->valid) {
304             uhci_queue_free(queue, "validate-end");
305         }
306     }
307 }
308 
309 static void uhci_async_cancel_device(UHCIState *s, USBDevice *dev)
310 {
311     UHCIQueue *queue, *n;
312 
313     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, n) {
314         if (queue->ep->dev == dev) {
315             uhci_queue_free(queue, "cancel-device");
316         }
317     }
318 }
319 
320 static void uhci_async_cancel_all(UHCIState *s)
321 {
322     UHCIQueue *queue, *nq;
323 
324     QTAILQ_FOREACH_SAFE(queue, &s->queues, next, nq) {
325         uhci_queue_free(queue, "cancel-all");
326     }
327 }
328 
329 static UHCIAsync *uhci_async_find_td(UHCIState *s, uint32_t td_addr)
330 {
331     UHCIQueue *queue;
332     UHCIAsync *async;
333 
334     QTAILQ_FOREACH(queue, &s->queues, next) {
335         QTAILQ_FOREACH(async, &queue->asyncs, next) {
336             if (async->td_addr == td_addr) {
337                 return async;
338             }
339         }
340     }
341     return NULL;
342 }
343 
344 static void uhci_update_irq(UHCIState *s)
345 {
346     int level;
347     if (((s->status2 & 1) && (s->intr & (1 << 2))) ||
348         ((s->status2 & 2) && (s->intr & (1 << 3))) ||
349         ((s->status & UHCI_STS_USBERR) && (s->intr & (1 << 0))) ||
350         ((s->status & UHCI_STS_RD) && (s->intr & (1 << 1))) ||
351         (s->status & UHCI_STS_HSERR) ||
352         (s->status & UHCI_STS_HCPERR)) {
353         level = 1;
354     } else {
355         level = 0;
356     }
357     pci_set_irq(&s->dev, level);
358 }
359 
360 static void uhci_reset(DeviceState *dev)
361 {
362     PCIDevice *d = PCI_DEVICE(dev);
363     UHCIState *s = UHCI(d);
364     uint8_t *pci_conf;
365     int i;
366     UHCIPort *port;
367 
368     trace_usb_uhci_reset();
369 
370     pci_conf = s->dev.config;
371 
372     pci_conf[0x6a] = 0x01; /* usb clock */
373     pci_conf[0x6b] = 0x00;
374     s->cmd = 0;
375     s->status = UHCI_STS_HCHALTED;
376     s->status2 = 0;
377     s->intr = 0;
378     s->fl_base_addr = 0;
379     s->sof_timing = 64;
380 
381     for(i = 0; i < NB_PORTS; i++) {
382         port = &s->ports[i];
383         port->ctrl = 0x0080;
384         if (port->port.dev && port->port.dev->attached) {
385             usb_port_reset(&port->port);
386         }
387     }
388 
389     uhci_async_cancel_all(s);
390     qemu_bh_cancel(s->bh);
391     uhci_update_irq(s);
392 }
393 
394 static const VMStateDescription vmstate_uhci_port = {
395     .name = "uhci port",
396     .version_id = 1,
397     .minimum_version_id = 1,
398     .fields = (VMStateField[]) {
399         VMSTATE_UINT16(ctrl, UHCIPort),
400         VMSTATE_END_OF_LIST()
401     }
402 };
403 
404 static int uhci_post_load(void *opaque, int version_id)
405 {
406     UHCIState *s = opaque;
407 
408     if (version_id < 2) {
409         s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
410             (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ);
411     }
412     return 0;
413 }
414 
415 static const VMStateDescription vmstate_uhci = {
416     .name = "uhci",
417     .version_id = 3,
418     .minimum_version_id = 1,
419     .post_load = uhci_post_load,
420     .fields = (VMStateField[]) {
421         VMSTATE_PCI_DEVICE(dev, UHCIState),
422         VMSTATE_UINT8_EQUAL(num_ports_vmstate, UHCIState, NULL),
423         VMSTATE_STRUCT_ARRAY(ports, UHCIState, NB_PORTS, 1,
424                              vmstate_uhci_port, UHCIPort),
425         VMSTATE_UINT16(cmd, UHCIState),
426         VMSTATE_UINT16(status, UHCIState),
427         VMSTATE_UINT16(intr, UHCIState),
428         VMSTATE_UINT16(frnum, UHCIState),
429         VMSTATE_UINT32(fl_base_addr, UHCIState),
430         VMSTATE_UINT8(sof_timing, UHCIState),
431         VMSTATE_UINT8(status2, UHCIState),
432         VMSTATE_TIMER_PTR(frame_timer, UHCIState),
433         VMSTATE_INT64_V(expire_time, UHCIState, 2),
434         VMSTATE_UINT32_V(pending_int_mask, UHCIState, 3),
435         VMSTATE_END_OF_LIST()
436     }
437 };
438 
439 static void uhci_port_write(void *opaque, hwaddr addr,
440                             uint64_t val, unsigned size)
441 {
442     UHCIState *s = opaque;
443 
444     trace_usb_uhci_mmio_writew(addr, val);
445 
446     switch(addr) {
447     case 0x00:
448         if ((val & UHCI_CMD_RS) && !(s->cmd & UHCI_CMD_RS)) {
449             /* start frame processing */
450             trace_usb_uhci_schedule_start();
451             s->expire_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
452                 (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ);
453             timer_mod(s->frame_timer, s->expire_time);
454             s->status &= ~UHCI_STS_HCHALTED;
455         } else if (!(val & UHCI_CMD_RS)) {
456             s->status |= UHCI_STS_HCHALTED;
457         }
458         if (val & UHCI_CMD_GRESET) {
459             UHCIPort *port;
460             int i;
461 
462             /* send reset on the USB bus */
463             for(i = 0; i < NB_PORTS; i++) {
464                 port = &s->ports[i];
465                 usb_device_reset(port->port.dev);
466             }
467             uhci_reset(DEVICE(s));
468             return;
469         }
470         if (val & UHCI_CMD_HCRESET) {
471             uhci_reset(DEVICE(s));
472             return;
473         }
474         s->cmd = val;
475         if (val & UHCI_CMD_EGSM) {
476             if ((s->ports[0].ctrl & UHCI_PORT_RD) ||
477                 (s->ports[1].ctrl & UHCI_PORT_RD)) {
478                 uhci_resume(s);
479             }
480         }
481         break;
482     case 0x02:
483         s->status &= ~val;
484         /* XXX: the chip spec is not coherent, so we add a hidden
485            register to distinguish between IOC and SPD */
486         if (val & UHCI_STS_USBINT)
487             s->status2 = 0;
488         uhci_update_irq(s);
489         break;
490     case 0x04:
491         s->intr = val;
492         uhci_update_irq(s);
493         break;
494     case 0x06:
495         if (s->status & UHCI_STS_HCHALTED)
496             s->frnum = val & 0x7ff;
497         break;
498     case 0x08:
499         s->fl_base_addr &= 0xffff0000;
500         s->fl_base_addr |= val & ~0xfff;
501         break;
502     case 0x0a:
503         s->fl_base_addr &= 0x0000ffff;
504         s->fl_base_addr |= (val << 16);
505         break;
506     case 0x0c:
507         s->sof_timing = val & 0xff;
508         break;
509     case 0x10 ... 0x1f:
510         {
511             UHCIPort *port;
512             USBDevice *dev;
513             int n;
514 
515             n = (addr >> 1) & 7;
516             if (n >= NB_PORTS)
517                 return;
518             port = &s->ports[n];
519             dev = port->port.dev;
520             if (dev && dev->attached) {
521                 /* port reset */
522                 if ( (val & UHCI_PORT_RESET) &&
523                      !(port->ctrl & UHCI_PORT_RESET) ) {
524                     usb_device_reset(dev);
525                 }
526             }
527             port->ctrl &= UHCI_PORT_READ_ONLY;
528             /* enabled may only be set if a device is connected */
529             if (!(port->ctrl & UHCI_PORT_CCS)) {
530                 val &= ~UHCI_PORT_EN;
531             }
532             port->ctrl |= (val & ~UHCI_PORT_READ_ONLY);
533             /* some bits are reset when a '1' is written to them */
534             port->ctrl &= ~(val & UHCI_PORT_WRITE_CLEAR);
535         }
536         break;
537     }
538 }
539 
540 static uint64_t uhci_port_read(void *opaque, hwaddr addr, unsigned size)
541 {
542     UHCIState *s = opaque;
543     uint32_t val;
544 
545     switch(addr) {
546     case 0x00:
547         val = s->cmd;
548         break;
549     case 0x02:
550         val = s->status;
551         break;
552     case 0x04:
553         val = s->intr;
554         break;
555     case 0x06:
556         val = s->frnum;
557         break;
558     case 0x08:
559         val = s->fl_base_addr & 0xffff;
560         break;
561     case 0x0a:
562         val = (s->fl_base_addr >> 16) & 0xffff;
563         break;
564     case 0x0c:
565         val = s->sof_timing;
566         break;
567     case 0x10 ... 0x1f:
568         {
569             UHCIPort *port;
570             int n;
571             n = (addr >> 1) & 7;
572             if (n >= NB_PORTS)
573                 goto read_default;
574             port = &s->ports[n];
575             val = port->ctrl;
576         }
577         break;
578     default:
579     read_default:
580         val = 0xff7f; /* disabled port */
581         break;
582     }
583 
584     trace_usb_uhci_mmio_readw(addr, val);
585 
586     return val;
587 }
588 
589 /* signal resume if controller suspended */
590 static void uhci_resume (void *opaque)
591 {
592     UHCIState *s = (UHCIState *)opaque;
593 
594     if (!s)
595         return;
596 
597     if (s->cmd & UHCI_CMD_EGSM) {
598         s->cmd |= UHCI_CMD_FGR;
599         s->status |= UHCI_STS_RD;
600         uhci_update_irq(s);
601     }
602 }
603 
604 static void uhci_attach(USBPort *port1)
605 {
606     UHCIState *s = port1->opaque;
607     UHCIPort *port = &s->ports[port1->index];
608 
609     /* set connect status */
610     port->ctrl |= UHCI_PORT_CCS | UHCI_PORT_CSC;
611 
612     /* update speed */
613     if (port->port.dev->speed == USB_SPEED_LOW) {
614         port->ctrl |= UHCI_PORT_LSDA;
615     } else {
616         port->ctrl &= ~UHCI_PORT_LSDA;
617     }
618 
619     uhci_resume(s);
620 }
621 
622 static void uhci_detach(USBPort *port1)
623 {
624     UHCIState *s = port1->opaque;
625     UHCIPort *port = &s->ports[port1->index];
626 
627     uhci_async_cancel_device(s, port1->dev);
628 
629     /* set connect status */
630     if (port->ctrl & UHCI_PORT_CCS) {
631         port->ctrl &= ~UHCI_PORT_CCS;
632         port->ctrl |= UHCI_PORT_CSC;
633     }
634     /* disable port */
635     if (port->ctrl & UHCI_PORT_EN) {
636         port->ctrl &= ~UHCI_PORT_EN;
637         port->ctrl |= UHCI_PORT_ENC;
638     }
639 
640     uhci_resume(s);
641 }
642 
643 static void uhci_child_detach(USBPort *port1, USBDevice *child)
644 {
645     UHCIState *s = port1->opaque;
646 
647     uhci_async_cancel_device(s, child);
648 }
649 
650 static void uhci_wakeup(USBPort *port1)
651 {
652     UHCIState *s = port1->opaque;
653     UHCIPort *port = &s->ports[port1->index];
654 
655     if (port->ctrl & UHCI_PORT_SUSPEND && !(port->ctrl & UHCI_PORT_RD)) {
656         port->ctrl |= UHCI_PORT_RD;
657         uhci_resume(s);
658     }
659 }
660 
661 static USBDevice *uhci_find_device(UHCIState *s, uint8_t addr)
662 {
663     USBDevice *dev;
664     int i;
665 
666     for (i = 0; i < NB_PORTS; i++) {
667         UHCIPort *port = &s->ports[i];
668         if (!(port->ctrl & UHCI_PORT_EN)) {
669             continue;
670         }
671         dev = usb_find_device(&port->port, addr);
672         if (dev != NULL) {
673             return dev;
674         }
675     }
676     return NULL;
677 }
678 
679 static void uhci_read_td(UHCIState *s, UHCI_TD *td, uint32_t link)
680 {
681     pci_dma_read(&s->dev, link & ~0xf, td, sizeof(*td));
682     le32_to_cpus(&td->link);
683     le32_to_cpus(&td->ctrl);
684     le32_to_cpus(&td->token);
685     le32_to_cpus(&td->buffer);
686 }
687 
688 static int uhci_handle_td_error(UHCIState *s, UHCI_TD *td, uint32_t td_addr,
689                                 int status, uint32_t *int_mask)
690 {
691     uint32_t queue_token = uhci_queue_token(td);
692     int ret;
693 
694     switch (status) {
695     case USB_RET_NAK:
696         td->ctrl |= TD_CTRL_NAK;
697         return TD_RESULT_NEXT_QH;
698 
699     case USB_RET_STALL:
700         td->ctrl |= TD_CTRL_STALL;
701         trace_usb_uhci_packet_complete_stall(queue_token, td_addr);
702         ret = TD_RESULT_NEXT_QH;
703         break;
704 
705     case USB_RET_BABBLE:
706         td->ctrl |= TD_CTRL_BABBLE | TD_CTRL_STALL;
707         /* frame interrupted */
708         trace_usb_uhci_packet_complete_babble(queue_token, td_addr);
709         ret = TD_RESULT_STOP_FRAME;
710         break;
711 
712     case USB_RET_IOERROR:
713     case USB_RET_NODEV:
714     default:
715         td->ctrl |= TD_CTRL_TIMEOUT;
716         td->ctrl &= ~(3 << TD_CTRL_ERROR_SHIFT);
717         trace_usb_uhci_packet_complete_error(queue_token, td_addr);
718         ret = TD_RESULT_NEXT_QH;
719         break;
720     }
721 
722     td->ctrl &= ~TD_CTRL_ACTIVE;
723     s->status |= UHCI_STS_USBERR;
724     if (td->ctrl & TD_CTRL_IOC) {
725         *int_mask |= 0x01;
726     }
727     uhci_update_irq(s);
728     return ret;
729 }
730 
731 static int uhci_complete_td(UHCIState *s, UHCI_TD *td, UHCIAsync *async, uint32_t *int_mask)
732 {
733     int len = 0, max_len;
734     uint8_t pid;
735 
736     max_len = ((td->token >> 21) + 1) & 0x7ff;
737     pid = td->token & 0xff;
738 
739     if (td->ctrl & TD_CTRL_IOS)
740         td->ctrl &= ~TD_CTRL_ACTIVE;
741 
742     if (async->packet.status != USB_RET_SUCCESS) {
743         return uhci_handle_td_error(s, td, async->td_addr,
744                                     async->packet.status, int_mask);
745     }
746 
747     len = async->packet.actual_length;
748     td->ctrl = (td->ctrl & ~0x7ff) | ((len - 1) & 0x7ff);
749 
750     /* The NAK bit may have been set by a previous frame, so clear it
751        here.  The docs are somewhat unclear, but win2k relies on this
752        behavior.  */
753     td->ctrl &= ~(TD_CTRL_ACTIVE | TD_CTRL_NAK);
754     if (td->ctrl & TD_CTRL_IOC)
755         *int_mask |= 0x01;
756 
757     if (pid == USB_TOKEN_IN) {
758         pci_dma_write(&s->dev, td->buffer, async->buf, len);
759         if ((td->ctrl & TD_CTRL_SPD) && len < max_len) {
760             *int_mask |= 0x02;
761             /* short packet: do not update QH */
762             trace_usb_uhci_packet_complete_shortxfer(async->queue->token,
763                                                      async->td_addr);
764             return TD_RESULT_NEXT_QH;
765         }
766     }
767 
768     /* success */
769     trace_usb_uhci_packet_complete_success(async->queue->token,
770                                            async->td_addr);
771     return TD_RESULT_COMPLETE;
772 }
773 
774 static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
775                           UHCI_TD *td, uint32_t td_addr, uint32_t *int_mask)
776 {
777     int ret, max_len;
778     bool spd;
779     bool queuing = (q != NULL);
780     uint8_t pid = td->token & 0xff;
781     UHCIAsync *async;
782 
783     async = uhci_async_find_td(s, td_addr);
784     if (async) {
785         if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
786             assert(q == NULL || q == async->queue);
787             q = async->queue;
788         } else {
789             uhci_queue_free(async->queue, "guest re-used pending td");
790             async = NULL;
791         }
792     }
793 
794     if (q == NULL) {
795         q = uhci_queue_find(s, td);
796         if (q && !uhci_queue_verify(q, qh_addr, td, td_addr, queuing)) {
797             uhci_queue_free(q, "guest re-used qh");
798             q = NULL;
799         }
800     }
801 
802     if (q) {
803         q->valid = QH_VALID;
804     }
805 
806     /* Is active ? */
807     if (!(td->ctrl & TD_CTRL_ACTIVE)) {
808         if (async) {
809             /* Guest marked a pending td non-active, cancel the queue */
810             uhci_queue_free(async->queue, "pending td non-active");
811         }
812         /*
813          * ehci11d spec page 22: "Even if the Active bit in the TD is already
814          * cleared when the TD is fetched ... an IOC interrupt is generated"
815          */
816         if (td->ctrl & TD_CTRL_IOC) {
817                 *int_mask |= 0x01;
818         }
819         return TD_RESULT_NEXT_QH;
820     }
821 
822     switch (pid) {
823     case USB_TOKEN_OUT:
824     case USB_TOKEN_SETUP:
825     case USB_TOKEN_IN:
826         break;
827     default:
828         /* invalid pid : frame interrupted */
829         s->status |= UHCI_STS_HCPERR;
830         s->cmd &= ~UHCI_CMD_RS;
831         uhci_update_irq(s);
832         return TD_RESULT_STOP_FRAME;
833     }
834 
835     if (async) {
836         if (queuing) {
837             /* we are busy filling the queue, we are not prepared
838                to consume completed packages then, just leave them
839                in async state */
840             return TD_RESULT_ASYNC_CONT;
841         }
842         if (!async->done) {
843             UHCI_TD last_td;
844             UHCIAsync *last = QTAILQ_LAST(&async->queue->asyncs);
845             /*
846              * While we are waiting for the current td to complete, the guest
847              * may have added more tds to the queue. Note we re-read the td
848              * rather then caching it, as we want to see guest made changes!
849              */
850             uhci_read_td(s, &last_td, last->td_addr);
851             uhci_queue_fill(async->queue, &last_td);
852 
853             return TD_RESULT_ASYNC_CONT;
854         }
855         uhci_async_unlink(async);
856         goto done;
857     }
858 
859     if (s->completions_only) {
860         return TD_RESULT_ASYNC_CONT;
861     }
862 
863     /* Allocate new packet */
864     if (q == NULL) {
865         USBDevice *dev;
866         USBEndpoint *ep;
867 
868         dev = uhci_find_device(s, (td->token >> 8) & 0x7f);
869         if (dev == NULL) {
870             return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
871                                         int_mask);
872         }
873         ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
874         q = uhci_queue_new(s, qh_addr, td, ep);
875     }
876     async = uhci_async_alloc(q, td_addr);
877 
878     max_len = ((td->token >> 21) + 1) & 0x7ff;
879     spd = (pid == USB_TOKEN_IN && (td->ctrl & TD_CTRL_SPD) != 0);
880     usb_packet_setup(&async->packet, pid, q->ep, 0, td_addr, spd,
881                      (td->ctrl & TD_CTRL_IOC) != 0);
882     if (max_len <= sizeof(async->static_buf)) {
883         async->buf = async->static_buf;
884     } else {
885         async->buf = g_malloc(max_len);
886     }
887     usb_packet_addbuf(&async->packet, async->buf, max_len);
888 
889     switch(pid) {
890     case USB_TOKEN_OUT:
891     case USB_TOKEN_SETUP:
892         pci_dma_read(&s->dev, td->buffer, async->buf, max_len);
893         usb_handle_packet(q->ep->dev, &async->packet);
894         if (async->packet.status == USB_RET_SUCCESS) {
895             async->packet.actual_length = max_len;
896         }
897         break;
898 
899     case USB_TOKEN_IN:
900         usb_handle_packet(q->ep->dev, &async->packet);
901         break;
902 
903     default:
904         abort(); /* Never to execute */
905     }
906 
907     if (async->packet.status == USB_RET_ASYNC) {
908         uhci_async_link(async);
909         if (!queuing) {
910             uhci_queue_fill(q, td);
911         }
912         return TD_RESULT_ASYNC_START;
913     }
914 
915 done:
916     ret = uhci_complete_td(s, td, async, int_mask);
917     uhci_async_free(async);
918     return ret;
919 }
920 
921 static void uhci_async_complete(USBPort *port, USBPacket *packet)
922 {
923     UHCIAsync *async = container_of(packet, UHCIAsync, packet);
924     UHCIState *s = async->queue->uhci;
925 
926     if (packet->status == USB_RET_REMOVE_FROM_QUEUE) {
927         uhci_async_cancel(async);
928         return;
929     }
930 
931     async->done = 1;
932     /* Force processing of this packet *now*, needed for migration */
933     s->completions_only = true;
934     qemu_bh_schedule(s->bh);
935 }
936 
937 static int is_valid(uint32_t link)
938 {
939     return (link & 1) == 0;
940 }
941 
942 static int is_qh(uint32_t link)
943 {
944     return (link & 2) != 0;
945 }
946 
947 static int depth_first(uint32_t link)
948 {
949     return (link & 4) != 0;
950 }
951 
952 /* QH DB used for detecting QH loops */
953 #define UHCI_MAX_QUEUES 128
954 typedef struct {
955     uint32_t addr[UHCI_MAX_QUEUES];
956     int      count;
957 } QhDb;
958 
959 static void qhdb_reset(QhDb *db)
960 {
961     db->count = 0;
962 }
963 
964 /* Add QH to DB. Returns 1 if already present or DB is full. */
965 static int qhdb_insert(QhDb *db, uint32_t addr)
966 {
967     int i;
968     for (i = 0; i < db->count; i++)
969         if (db->addr[i] == addr)
970             return 1;
971 
972     if (db->count >= UHCI_MAX_QUEUES)
973         return 1;
974 
975     db->addr[db->count++] = addr;
976     return 0;
977 }
978 
979 static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td)
980 {
981     uint32_t int_mask = 0;
982     uint32_t plink = td->link;
983     UHCI_TD ptd;
984     int ret;
985 
986     while (is_valid(plink)) {
987         uhci_read_td(q->uhci, &ptd, plink);
988         if (!(ptd.ctrl & TD_CTRL_ACTIVE)) {
989             break;
990         }
991         if (uhci_queue_token(&ptd) != q->token) {
992             break;
993         }
994         trace_usb_uhci_td_queue(plink & ~0xf, ptd.ctrl, ptd.token);
995         ret = uhci_handle_td(q->uhci, q, q->qh_addr, &ptd, plink, &int_mask);
996         if (ret == TD_RESULT_ASYNC_CONT) {
997             break;
998         }
999         assert(ret == TD_RESULT_ASYNC_START);
1000         assert(int_mask == 0);
1001         plink = ptd.link;
1002     }
1003     usb_device_flush_ep_queue(q->ep->dev, q->ep);
1004 }
1005 
1006 static void uhci_process_frame(UHCIState *s)
1007 {
1008     uint32_t frame_addr, link, old_td_ctrl, val, int_mask;
1009     uint32_t curr_qh, td_count = 0;
1010     int cnt, ret;
1011     UHCI_TD td;
1012     UHCI_QH qh;
1013     QhDb qhdb;
1014 
1015     frame_addr = s->fl_base_addr + ((s->frnum & 0x3ff) << 2);
1016 
1017     pci_dma_read(&s->dev, frame_addr, &link, 4);
1018     le32_to_cpus(&link);
1019 
1020     int_mask = 0;
1021     curr_qh  = 0;
1022 
1023     qhdb_reset(&qhdb);
1024 
1025     for (cnt = FRAME_MAX_LOOPS; is_valid(link) && cnt; cnt--) {
1026         if (!s->completions_only && s->frame_bytes >= s->frame_bandwidth) {
1027             /* We've reached the usb 1.1 bandwidth, which is
1028                1280 bytes/frame, stop processing */
1029             trace_usb_uhci_frame_stop_bandwidth();
1030             break;
1031         }
1032         if (is_qh(link)) {
1033             /* QH */
1034             trace_usb_uhci_qh_load(link & ~0xf);
1035 
1036             if (qhdb_insert(&qhdb, link)) {
1037                 /*
1038                  * We're going in circles. Which is not a bug because
1039                  * HCD is allowed to do that as part of the BW management.
1040                  *
1041                  * Stop processing here if no transaction has been done
1042                  * since we've been here last time.
1043                  */
1044                 if (td_count == 0) {
1045                     trace_usb_uhci_frame_loop_stop_idle();
1046                     break;
1047                 } else {
1048                     trace_usb_uhci_frame_loop_continue();
1049                     td_count = 0;
1050                     qhdb_reset(&qhdb);
1051                     qhdb_insert(&qhdb, link);
1052                 }
1053             }
1054 
1055             pci_dma_read(&s->dev, link & ~0xf, &qh, sizeof(qh));
1056             le32_to_cpus(&qh.link);
1057             le32_to_cpus(&qh.el_link);
1058 
1059             if (!is_valid(qh.el_link)) {
1060                 /* QH w/o elements */
1061                 curr_qh = 0;
1062                 link = qh.link;
1063             } else {
1064                 /* QH with elements */
1065                 curr_qh = link;
1066                 link = qh.el_link;
1067             }
1068             continue;
1069         }
1070 
1071         /* TD */
1072         uhci_read_td(s, &td, link);
1073         trace_usb_uhci_td_load(curr_qh & ~0xf, link & ~0xf, td.ctrl, td.token);
1074 
1075         old_td_ctrl = td.ctrl;
1076         ret = uhci_handle_td(s, NULL, curr_qh, &td, link, &int_mask);
1077         if (old_td_ctrl != td.ctrl) {
1078             /* update the status bits of the TD */
1079             val = cpu_to_le32(td.ctrl);
1080             pci_dma_write(&s->dev, (link & ~0xf) + 4, &val, sizeof(val));
1081         }
1082 
1083         switch (ret) {
1084         case TD_RESULT_STOP_FRAME: /* interrupted frame */
1085             goto out;
1086 
1087         case TD_RESULT_NEXT_QH:
1088         case TD_RESULT_ASYNC_CONT:
1089             trace_usb_uhci_td_nextqh(curr_qh & ~0xf, link & ~0xf);
1090             link = curr_qh ? qh.link : td.link;
1091             continue;
1092 
1093         case TD_RESULT_ASYNC_START:
1094             trace_usb_uhci_td_async(curr_qh & ~0xf, link & ~0xf);
1095             link = curr_qh ? qh.link : td.link;
1096             continue;
1097 
1098         case TD_RESULT_COMPLETE:
1099             trace_usb_uhci_td_complete(curr_qh & ~0xf, link & ~0xf);
1100             link = td.link;
1101             td_count++;
1102             s->frame_bytes += (td.ctrl & 0x7ff) + 1;
1103 
1104             if (curr_qh) {
1105                 /* update QH element link */
1106                 qh.el_link = link;
1107                 val = cpu_to_le32(qh.el_link);
1108                 pci_dma_write(&s->dev, (curr_qh & ~0xf) + 4, &val, sizeof(val));
1109 
1110                 if (!depth_first(link)) {
1111                     /* done with this QH */
1112                     curr_qh = 0;
1113                     link    = qh.link;
1114                 }
1115             }
1116             break;
1117 
1118         default:
1119             assert(!"unknown return code");
1120         }
1121 
1122         /* go to the next entry */
1123     }
1124 
1125 out:
1126     s->pending_int_mask |= int_mask;
1127 }
1128 
1129 static void uhci_bh(void *opaque)
1130 {
1131     UHCIState *s = opaque;
1132     uhci_process_frame(s);
1133 }
1134 
1135 static void uhci_frame_timer(void *opaque)
1136 {
1137     UHCIState *s = opaque;
1138     uint64_t t_now, t_last_run;
1139     int i, frames;
1140     const uint64_t frame_t = NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ;
1141 
1142     s->completions_only = false;
1143     qemu_bh_cancel(s->bh);
1144 
1145     if (!(s->cmd & UHCI_CMD_RS)) {
1146         /* Full stop */
1147         trace_usb_uhci_schedule_stop();
1148         timer_del(s->frame_timer);
1149         uhci_async_cancel_all(s);
1150         /* set hchalted bit in status - UHCI11D 2.1.2 */
1151         s->status |= UHCI_STS_HCHALTED;
1152         return;
1153     }
1154 
1155     /* We still store expire_time in our state, for migration */
1156     t_last_run = s->expire_time - frame_t;
1157     t_now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1158 
1159     /* Process up to MAX_FRAMES_PER_TICK frames */
1160     frames = (t_now - t_last_run) / frame_t;
1161     if (frames > s->maxframes) {
1162         int skipped = frames - s->maxframes;
1163         s->expire_time += skipped * frame_t;
1164         s->frnum = (s->frnum + skipped) & 0x7ff;
1165         frames -= skipped;
1166     }
1167     if (frames > MAX_FRAMES_PER_TICK) {
1168         frames = MAX_FRAMES_PER_TICK;
1169     }
1170 
1171     for (i = 0; i < frames; i++) {
1172         s->frame_bytes = 0;
1173         trace_usb_uhci_frame_start(s->frnum);
1174         uhci_async_validate_begin(s);
1175         uhci_process_frame(s);
1176         uhci_async_validate_end(s);
1177         /* The spec says frnum is the frame currently being processed, and
1178          * the guest must look at frnum - 1 on interrupt, so inc frnum now */
1179         s->frnum = (s->frnum + 1) & 0x7ff;
1180         s->expire_time += frame_t;
1181     }
1182 
1183     /* Complete the previous frame(s) */
1184     if (s->pending_int_mask) {
1185         s->status2 |= s->pending_int_mask;
1186         s->status  |= UHCI_STS_USBINT;
1187         uhci_update_irq(s);
1188     }
1189     s->pending_int_mask = 0;
1190 
1191     timer_mod(s->frame_timer, t_now + frame_t);
1192 }
1193 
1194 static const MemoryRegionOps uhci_ioport_ops = {
1195     .read  = uhci_port_read,
1196     .write = uhci_port_write,
1197     .valid.min_access_size = 1,
1198     .valid.max_access_size = 4,
1199     .impl.min_access_size = 2,
1200     .impl.max_access_size = 2,
1201     .endianness = DEVICE_LITTLE_ENDIAN,
1202 };
1203 
1204 static USBPortOps uhci_port_ops = {
1205     .attach = uhci_attach,
1206     .detach = uhci_detach,
1207     .child_detach = uhci_child_detach,
1208     .wakeup = uhci_wakeup,
1209     .complete = uhci_async_complete,
1210 };
1211 
1212 static USBBusOps uhci_bus_ops = {
1213 };
1214 
1215 static void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
1216 {
1217     Error *err = NULL;
1218     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
1219     UHCIPCIDeviceClass *u = container_of(pc, UHCIPCIDeviceClass, parent_class);
1220     UHCIState *s = UHCI(dev);
1221     uint8_t *pci_conf = s->dev.config;
1222     int i;
1223 
1224     pci_conf[PCI_CLASS_PROG] = 0x00;
1225     /* TODO: reset value should be 0. */
1226     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
1227 
1228     pci_config_set_interrupt_pin(pci_conf, u->info.irq_pin + 1);
1229 
1230     if (s->masterbus) {
1231         USBPort *ports[NB_PORTS];
1232         for(i = 0; i < NB_PORTS; i++) {
1233             ports[i] = &s->ports[i].port;
1234         }
1235         usb_register_companion(s->masterbus, ports, NB_PORTS,
1236                                s->firstport, s, &uhci_port_ops,
1237                                USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL,
1238                                &err);
1239         if (err) {
1240             error_propagate(errp, err);
1241             return;
1242         }
1243     } else {
1244         usb_bus_new(&s->bus, sizeof(s->bus), &uhci_bus_ops, DEVICE(dev));
1245         for (i = 0; i < NB_PORTS; i++) {
1246             usb_register_port(&s->bus, &s->ports[i].port, s, i, &uhci_port_ops,
1247                               USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);
1248         }
1249     }
1250     s->bh = qemu_bh_new(uhci_bh, s);
1251     s->frame_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, uhci_frame_timer, s);
1252     s->num_ports_vmstate = NB_PORTS;
1253     QTAILQ_INIT(&s->queues);
1254 
1255     memory_region_init_io(&s->io_bar, OBJECT(s), &uhci_ioport_ops, s,
1256                           "uhci", 0x20);
1257 
1258     /* Use region 4 for consistency with real hardware.  BSD guests seem
1259        to rely on this.  */
1260     pci_register_bar(&s->dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &s->io_bar);
1261 }
1262 
1263 static void usb_uhci_vt82c686b_realize(PCIDevice *dev, Error **errp)
1264 {
1265     UHCIState *s = UHCI(dev);
1266     uint8_t *pci_conf = s->dev.config;
1267 
1268     /* USB misc control 1/2 */
1269     pci_set_long(pci_conf + 0x40,0x00001000);
1270     /* PM capability */
1271     pci_set_long(pci_conf + 0x80,0x00020001);
1272     /* USB legacy support  */
1273     pci_set_long(pci_conf + 0xc0,0x00002000);
1274 
1275     usb_uhci_common_realize(dev, errp);
1276 }
1277 
1278 static void usb_uhci_exit(PCIDevice *dev)
1279 {
1280     UHCIState *s = UHCI(dev);
1281 
1282     trace_usb_uhci_exit();
1283 
1284     if (s->frame_timer) {
1285         timer_del(s->frame_timer);
1286         timer_free(s->frame_timer);
1287         s->frame_timer = NULL;
1288     }
1289 
1290     if (s->bh) {
1291         qemu_bh_delete(s->bh);
1292     }
1293 
1294     uhci_async_cancel_all(s);
1295 
1296     if (!s->masterbus) {
1297         usb_bus_release(&s->bus);
1298     }
1299 }
1300 
1301 static Property uhci_properties_companion[] = {
1302     DEFINE_PROP_STRING("masterbus", UHCIState, masterbus),
1303     DEFINE_PROP_UINT32("firstport", UHCIState, firstport, 0),
1304     DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1305     DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
1306     DEFINE_PROP_END_OF_LIST(),
1307 };
1308 static Property uhci_properties_standalone[] = {
1309     DEFINE_PROP_UINT32("bandwidth", UHCIState, frame_bandwidth, 1280),
1310     DEFINE_PROP_UINT32("maxframes", UHCIState, maxframes, 128),
1311     DEFINE_PROP_END_OF_LIST(),
1312 };
1313 
1314 static void uhci_class_init(ObjectClass *klass, void *data)
1315 {
1316     DeviceClass *dc = DEVICE_CLASS(klass);
1317     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1318 
1319     k->class_id  = PCI_CLASS_SERIAL_USB;
1320     dc->vmsd = &vmstate_uhci;
1321     dc->reset = uhci_reset;
1322     set_bit(DEVICE_CATEGORY_USB, dc->categories);
1323 }
1324 
1325 static const TypeInfo uhci_pci_type_info = {
1326     .name = TYPE_UHCI,
1327     .parent = TYPE_PCI_DEVICE,
1328     .instance_size = sizeof(UHCIState),
1329     .class_size    = sizeof(UHCIPCIDeviceClass),
1330     .abstract = true,
1331     .class_init = uhci_class_init,
1332     .interfaces = (InterfaceInfo[]) {
1333         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1334         { },
1335     },
1336 };
1337 
1338 static void uhci_data_class_init(ObjectClass *klass, void *data)
1339 {
1340     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1341     DeviceClass *dc = DEVICE_CLASS(klass);
1342     UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);
1343     UHCIInfo *info = data;
1344 
1345     k->realize = info->realize ? info->realize : usb_uhci_common_realize;
1346     k->exit = info->unplug ? usb_uhci_exit : NULL;
1347     k->vendor_id = info->vendor_id;
1348     k->device_id = info->device_id;
1349     k->revision  = info->revision;
1350     if (!info->unplug) {
1351         /* uhci controllers in companion setups can't be hotplugged */
1352         dc->hotpluggable = false;
1353         device_class_set_props(dc, uhci_properties_companion);
1354     } else {
1355         device_class_set_props(dc, uhci_properties_standalone);
1356     }
1357     u->info = *info;
1358 }
1359 
1360 static UHCIInfo uhci_info[] = {
1361     {
1362         .name       = "piix3-usb-uhci",
1363         .vendor_id = PCI_VENDOR_ID_INTEL,
1364         .device_id = PCI_DEVICE_ID_INTEL_82371SB_2,
1365         .revision  = 0x01,
1366         .irq_pin   = 3,
1367         .unplug    = true,
1368     },{
1369         .name      = "piix4-usb-uhci",
1370         .vendor_id = PCI_VENDOR_ID_INTEL,
1371         .device_id = PCI_DEVICE_ID_INTEL_82371AB_2,
1372         .revision  = 0x01,
1373         .irq_pin   = 3,
1374         .unplug    = true,
1375     },{
1376         .name      = "vt82c686b-usb-uhci",
1377         .vendor_id = PCI_VENDOR_ID_VIA,
1378         .device_id = PCI_DEVICE_ID_VIA_UHCI,
1379         .revision  = 0x01,
1380         .irq_pin   = 3,
1381         .realize   = usb_uhci_vt82c686b_realize,
1382         .unplug    = true,
1383     },{
1384         .name      = "ich9-usb-uhci1", /* 00:1d.0 */
1385         .vendor_id = PCI_VENDOR_ID_INTEL,
1386         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI1,
1387         .revision  = 0x03,
1388         .irq_pin   = 0,
1389         .unplug    = false,
1390     },{
1391         .name      = "ich9-usb-uhci2", /* 00:1d.1 */
1392         .vendor_id = PCI_VENDOR_ID_INTEL,
1393         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI2,
1394         .revision  = 0x03,
1395         .irq_pin   = 1,
1396         .unplug    = false,
1397     },{
1398         .name      = "ich9-usb-uhci3", /* 00:1d.2 */
1399         .vendor_id = PCI_VENDOR_ID_INTEL,
1400         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI3,
1401         .revision  = 0x03,
1402         .irq_pin   = 2,
1403         .unplug    = false,
1404     },{
1405         .name      = "ich9-usb-uhci4", /* 00:1a.0 */
1406         .vendor_id = PCI_VENDOR_ID_INTEL,
1407         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI4,
1408         .revision  = 0x03,
1409         .irq_pin   = 0,
1410         .unplug    = false,
1411     },{
1412         .name      = "ich9-usb-uhci5", /* 00:1a.1 */
1413         .vendor_id = PCI_VENDOR_ID_INTEL,
1414         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI5,
1415         .revision  = 0x03,
1416         .irq_pin   = 1,
1417         .unplug    = false,
1418     },{
1419         .name      = "ich9-usb-uhci6", /* 00:1a.2 */
1420         .vendor_id = PCI_VENDOR_ID_INTEL,
1421         .device_id = PCI_DEVICE_ID_INTEL_82801I_UHCI6,
1422         .revision  = 0x03,
1423         .irq_pin   = 2,
1424         .unplug    = false,
1425     }
1426 };
1427 
1428 static void uhci_register_types(void)
1429 {
1430     TypeInfo uhci_type_info = {
1431         .parent        = TYPE_UHCI,
1432         .class_init    = uhci_data_class_init,
1433     };
1434     int i;
1435 
1436     type_register_static(&uhci_pci_type_info);
1437 
1438     for (i = 0; i < ARRAY_SIZE(uhci_info); i++) {
1439         uhci_type_info.name = uhci_info[i].name;
1440         uhci_type_info.class_data = uhci_info + i;
1441         type_register(&uhci_type_info);
1442     }
1443 }
1444 
1445 type_init(uhci_register_types)
1446