DevOHCI.cpp@ 59688

Last change on this file since 59688 was 59687, checked in by vboxsync, 9 years ago
VUSB: Some structural cleanup (#1 Don't replicate the URB tagging for log enabled builds in every device emulation but move it to the roothub implementation )
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 214.3 KB

Line
1	/* $Id: DevOHCI.cpp 59687 2016-02-15 18:52:31Z vboxsync $ */
2	/** @file
3	* DevOHCI - Open Host Controller Interface for USB.
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/** @page pg_dev_ohci OHCI - Open Host Controller Interface Emulation.
19	*
20	* This component implements an OHCI USB controller. It is split roughly in
21	* to two main parts, the first part implements the register level
22	* specification of USB OHCI and the second part maintains the root hub (which
23	* is an integrated component of the device).
24	*
25	* The OHCI registers are used for the usual stuff like enabling and disabling
26	* interrupts. Since the USB time is divided in to 1ms frames and various
27	* interrupts may need to be triggered at frame boundary time, a timer-based
28	* approach was taken. Whenever the bus is enabled ohci->eof_timer will be set.
29	*
30	* The actual USB transfers are stored in main memory (along with endpoint and
31	* transfer descriptors). The ED's for all the control and bulk endpoints are
32	* found by consulting the HcControlHeadED and HcBulkHeadED registers
33	* respectively. Interrupt ED's are different, they are found by looking
34	* in the HCCA (another communication area in main memory).
35	*
36	* At the start of every frame (in function ohci_sof) we traverse all enabled
37	* ED lists and queue up as many transfers as possible. No attention is paid
38	* to control/bulk service ratios or bandwidth requirements since our USB
39	* could conceivably contain a dozen high speed busses so this would
40	* artificially limit the performance.
41	*
42	* Once we have a transfer ready to go (in function ohciServiceTd) we
43	* allocate an URB on the stack, fill in all the relevant fields and submit
44	* it using the VUSBIRhSubmitUrb function. The roothub device and the virtual
45	* USB core code (vusb.c) coordinates everything else from this point onwards.
46	*
47	* When the URB has been successfully handed to the lower level driver, our
48	* prepare callback gets called and we can remove the TD from the ED transfer
49	* list. This stops us queueing it twice while it completes.
50	* bird: no, we don't remove it because that confuses the guest! (=> crashes)
51	*
52	* Completed URBs are reaped at the end of every frame (in function
53	* ohci_frame_boundary). Our completion routine makes use of the ED and TD
54	* fields in the URB to store the physical addresses of the descriptors so
55	* that they may be modified in the roothub callbacks. Our completion
56	* routine (ohciRhXferComplete) carries out a number of tasks:
57	* -# Retires the TD associated with the transfer, setting the
58	* relevant error code etc.
59	* -# Updates done-queue interrupt timer and potentially causes
60	* a writeback of the done-queue.
61	* -# If the transfer was device-to-host, we copy the data in to
62	* the host memory.
63	*
64	* As for error handling OHCI allows for 3 retries before failing a transfer,
65	* an error count is stored in each transfer descriptor. A halt flag is also
66	* stored in the transfer descriptor. That allows for ED's to be disabled
67	* without stopping the bus and de-queuing them.
68	*
69	* When the bus is started and stopped we call VUSBIDevPowerOn/Off() on our
70	* roothub to indicate it's powering up and powering down. Whenever we power
71	* down, the USB core makes sure to synchronously complete all outstanding
72	* requests so that the OHCI is never seen in an inconsistent state by the
73	* guest OS (Transfers are not meant to be unlinked until they've actually
74	* completed, but we can't do that unless we work synchronously, so we just
75	* have to fake it).
76	* bird: we do work synchronously now, anything causes guest crashes.
77	*/
78
79
80	/*********************************************************************************************************************************
81	* Header Files *
82	*********************************************************************************************************************************/
83	#define LOG_GROUP LOG_GROUP_DEV_OHCI
84	#include <VBox/pci.h>
85	#include <VBox/vmm/pdm.h>
86	#include <VBox/vmm/mm.h>
87	#include <VBox/err.h>
88	#include <VBox/log.h>
89	#include <iprt/assert.h>
90	#include <iprt/string.h>
91	#include <iprt/asm.h>
92	#include <iprt/asm-math.h>
93	#include <iprt/semaphore.h>
94	#include <iprt/critsect.h>
95	#ifdef IN_RING3
96	# include <iprt/alloca.h>
97	# include <iprt/mem.h>
98	# include <iprt/thread.h>
99	# include <iprt/uuid.h>
100	#endif
101	#include <VBox/vusb.h>
102	#include "VBoxDD.h"
103
104
105	/*********************************************************************************************************************************
106	* Structures and Typedefs *
107	*********************************************************************************************************************************/
108	/** The saved state version. */
109	#define OHCI_SAVED_STATE_VERSION 5
110	// The saved state with support of 8 ports
111	#define OHCI_SAVED_STATE_VERSION_8PORTS 4
112	/** The saved state version used in 3.0 and earlier.
113	*
114	* @remarks Because of the SSMR3MemPut/Get laziness we ended up with an
115	* accidental format change between 2.0 and 2.1 that didn't get its own
116	* version number. It is therefore not possible to restore states from
117	* 2.0 and earlier with 2.1 and later. */
118	#define OHCI_SAVED_STATE_VERSION_MEM_HELL 3
119
120
121	/** Maximum supported number of Downstream Ports on the root hub. 15 ports
122	* is the maximum defined by the OHCI spec.
123	* If you change this you need to add more status register words to the 'opreg'
124	* array.
125	*/
126	#define OHCI_NDP_MAX 15
127
128	/** Default NDP, chosen to be compatible with everything. */
129	#define OHCI_NDP_DEFAULT 12
130
131	/* Macro to query the number of currently configured ports. */
132	#define OHCI_NDP_CFG(pohci) ((pohci)->RootHub.desc_a & OHCI_RHA_NDP)
133
134	/** Pointer to OHCI device data. */
135	typedef struct OHCI *POHCI;
136	/** Read-only pointer to the OHCI device data. */
137	typedef struct OHCI const *PCOHCI;
138
139
140	/**
141	* An OHCI root hub port.
142	*/
143	typedef struct OHCIHUBPORT
144	{
145	/** The port register. */
146	uint32_t fReg;
147	#if HC_ARCH_BITS == 64
148	uint32_t Alignment0; /*< Align the pointer correctly. /
149	#endif
150	/** The device attached to the port. */
151	R3PTRTYPE(PVUSBIDEVICE) pDev;
152	} OHCIHUBPORT;
153	#if HC_ARCH_BITS == 64
154	AssertCompile(sizeof(OHCIHUBPORT) == 16); /* saved state */
155	#endif
156	/** Pointer to an OHCI hub port. */
157	typedef OHCIHUBPORT *POHCIHUBPORT;
158
159	/**
160	* The OHCI root hub.
161	*
162	* @implements PDMIBASE
163	* @implements VUSBIROOTHUBPORT
164	* @implements PDMILEDPORTS
165	*/
166	typedef struct ohci_roothub
167	{
168	/** Pointer to the base interface of the VUSB RootHub. */
169	R3PTRTYPE(PPDMIBASE) pIBase;
170	/** Pointer to the connector interface of the VUSB RootHub. */
171	R3PTRTYPE(PVUSBIROOTHUBCONNECTOR) pIRhConn;
172	/** Pointer to the device interface of the VUSB RootHub. */
173	R3PTRTYPE(PVUSBIDEVICE) pIDev;
174	/** The base interface exposed to the roothub driver. */
175	PDMIBASE IBase;
176	/** The roothub port interface exposed to the roothub driver. */
177	VUSBIROOTHUBPORT IRhPort;
178
179	/** The LED. */
180	PDMLED Led;
181	/** The LED ports. */
182	PDMILEDPORTS ILeds;
183	/** Partner of ILeds. */
184	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
185
186	uint32_t status;
187	uint32_t desc_a;
188	uint32_t desc_b;
189	#if HC_ARCH_BITS == 64
190	uint32_t Alignment0; /*< Align aPorts on a 8 byte boundary. /
191	#endif
192	OHCIHUBPORT aPorts[OHCI_NDP_MAX];
193	R3PTRTYPE(POHCI) pOhci;
194	} OHCIROOTHUB;
195	#if HC_ARCH_BITS == 64
196	AssertCompile(sizeof(OHCIROOTHUB) == 392); /* saved state */
197	#endif
198	/** Pointer to the OHCI root hub. */
199	typedef OHCIROOTHUB *POHCIROOTHUB;
200
201
202	/**
203	* Data used for reattaching devices on a state load.
204	*/
205	typedef struct ohci_load {
206	/** Timer used once after state load to inform the guest about new devices.
207	* We do this to be sure the guest get any disconnect / reconnect on the
208	* same port. */
209	PTMTIMERR3 pTimer;
210	/** Number of detached devices. */
211	unsigned cDevs;
212	/** Array of devices which were detached. */
213	PVUSBIDEVICE apDevs[OHCI_NDP_MAX];
214	} OHCILOAD;
215	/** Pointer to an OHCILOAD structure. */
216	typedef OHCILOAD *POHCILOAD;
217
218
219	/**
220	* OHCI device data.
221	*/
222	typedef struct OHCI
223	{
224	/** The PCI device. */
225	PCIDEVICE PciDev;
226
227	/** Pointer to the device instance - R3 ptr. */
228	PPDMDEVINSR3 pDevInsR3;
229	/** The End-Of-Frame timer - R3 Ptr. */
230	PTMTIMERR3 pEndOfFrameTimerR3;
231
232	/** Pointer to the device instance - R0 ptr */
233	PPDMDEVINSR0 pDevInsR0;
234	/** The End-Of-Frame timer - R0 Ptr. */
235	PTMTIMERR0 pEndOfFrameTimerR0;
236
237	/** Pointer to the device instance - RC ptr. */
238	PPDMDEVINSRC pDevInsRC;
239	/** The End-Of-Frame timer - RC Ptr. */
240	PTMTIMERRC pEndOfFrameTimerRC;
241
242	/** Start of current frame. */
243	uint64_t SofTime;
244	/* done queue interrupt counter */
245	uint32_t dqic : 3;
246	/** frame number overflow. */
247	uint32_t fno : 1;
248	/** Address of the MMIO region assigned by PCI. */
249	RTGCPHYS32 MMIOBase;
250
251	/* Root hub device */
252	OHCIROOTHUB RootHub;
253
254	/* OHCI registers */
255
256	/** @name Control partition
257	* @{ */
258	/** HcControl. */
259	uint32_t ctl;
260	/** HcCommandStatus. */
261	uint32_t status;
262	/** HcInterruptStatus. */
263	uint32_t intr_status;
264	/** HcInterruptEnabled. */
265	uint32_t intr;
266	/** @} */
267
268	/** @name Memory pointer partition
269	* @{ */
270	/** HcHCCA. */
271	uint32_t hcca;
272	/** HcPeriodCurrentEd. */
273	uint32_t per_cur;
274	/** HcControlCurrentED. */
275	uint32_t ctrl_cur;
276	/** HcControlHeadED. */
277	uint32_t ctrl_head;
278	/** HcBlockCurrendED. */
279	uint32_t bulk_cur;
280	/** HcBlockHeadED. */
281	uint32_t bulk_head;
282	/** HcDoneHead. */
283	uint32_t done;
284	/** @} */
285
286	/** @name Frame counter partition
287	* @{ */
288	/** HcFmInterval.FSMPS - FSLargestDataPacket */
289	uint32_t fsmps : 15;
290	/** HcFmInterval.FIT - FrameItervalToggle */
291	uint32_t fit : 1;
292	/** HcFmInterval.FI - FrameInterval */
293	uint32_t fi : 14;
294	/** HcFmRemaining.FRT - toggle bit. */
295	uint32_t frt : 1;
296	/** HcFmNumber.
297	* @remark The register size is 16-bit, but for debugging and performance
298	* reasons we maintain a 32-bit counter. */
299	uint32_t HcFmNumber;
300	/** HcPeriodicStart */
301	uint32_t pstart;
302	/** @} */
303
304	/** The number of virtual time ticks per frame. */
305	uint64_t cTicksPerFrame;
306	/** The number of virtual time ticks per USB bus tick. */
307	uint64_t cTicksPerUsbTick;
308
309	/** Number of in-flight TDs. */
310	unsigned cInFlight;
311	unsigned Alignment0; /*< Align aInFlight on a 8 byte boundary. /
312	/** Array of in-flight TDs. */
313	struct ohci_td_in_flight
314	{
315	/** Address of the transport descriptor. */
316	uint32_t GCPhysTD;
317	/** Flag indicating an inactive (not-linked) URB. */
318	bool fInactive;
319	/** Pointer to the URB. */
320	R3PTRTYPE(PVUSBURB) pUrb;
321	} aInFlight[257];
322
323	#if HC_ARCH_BITS == 32
324	uint32_t Alignment1;
325	#endif
326
327	/** Number of in-done-queue TDs. */
328	unsigned cInDoneQueue;
329	/** Array of in-done-queue TDs. */
330	struct ohci_td_in_done_queue
331	{
332	/** Address of the transport descriptor. */
333	uint32_t GCPhysTD;
334	} aInDoneQueue[64];
335	/** When the tail of the done queue was added.
336	* Used to calculate the age of the done queue. */
337	uint32_t u32FmDoneQueueTail;
338	#if R3_ARCH_BITS == 32
339	/** Align pLoad, the stats and the struct size correctly. */
340	uint32_t Alignment2;
341	#endif
342	/** Pointer to state load data. */
343	R3PTRTYPE(POHCILOAD) pLoad;
344
345	/** Detected canceled isochronous URBs. */
346	STAMCOUNTER StatCanceledIsocUrbs;
347	/** Detected canceled general URBs. */
348	STAMCOUNTER StatCanceledGenUrbs;
349	/** Dropped URBs (endpoint halted, or URB canceled). */
350	STAMCOUNTER StatDroppedUrbs;
351	/** Profiling ohciFrameBoundaryTimer. */
352	STAMPROFILE StatTimer;
353
354	/** This member and all the following are not part of saved state. */
355	uint64_t SavedStateEnd;
356
357	/** VM timer frequency used for frame timer calculations. */
358	uint64_t u64TimerHz;
359	/** Number of USB work cycles with no transfers. */
360	uint32_t cIdleCycles;
361	/** Current frame timer rate (default 1000). */
362	uint32_t uFrameRate;
363	/** Idle detection flag; must be cleared at start of frame */
364	bool fIdle;
365	/** A flag indicating that the bulk list may have in-flight URBs. */
366	bool fBulkNeedsCleaning;
367
368	/** Whether RC/R0 is enabled. */
369	bool fRZEnabled;
370
371	uint32_t Alignment3; /*< Align size on a 8 byte boundary. /
372
373	/** Critical section synchronising interrupt handling. */
374	PDMCRITSECT CsIrq;
375
376	/** The framer thread. */
377	R3PTRTYPE(PPDMTHREAD) hThreadFrame;
378	/** Event semaphore to interact with the framer thread. */
379	R3PTRTYPE(RTSEMEVENTMULTI) hSemEventFrame;
380	/** Event semaphore to release the thread waiting for the framer thread to stop. */
381	R3PTRTYPE(RTSEMEVENTMULTI) hSemEventFrameStopped;
382	/** Flag whether the framer thread should processing frames. */
383	volatile bool fBusStarted;
384	/** Alignment. */
385	uint32_t Alignment5;
386	/** How long to wait until the next frame. */
387	uint64_t nsWait;
388	/** Critical section to synchronize the framer and URB completion handler. */
389	RTCRITSECT CritSect;
390
391	} OHCI;
392
393	/* Standard OHCI bus speed */
394	#define OHCI_DEFAULT_TIMER_FREQ 1000
395
396	/* Host Controller Communications Area */
397	#define OHCI_HCCA_NUM_INTR 32
398	#define OHCI_HCCA_OFS (OHCI_HCCA_NUM_INTR * sizeof(uint32_t))
399	struct ohci_hcca
400	{
401	uint16_t frame;
402	uint16_t pad;
403	uint32_t done;
404	};
405	AssertCompileSize(ohci_hcca, 8);
406
407	/** @name OHCI Endpoint Descriptor
408	* @{ */
409
410	#define ED_PTR_MASK (~(uint32_t)0xf)
411	#define ED_HWINFO_MPS 0x07ff0000
412	#define ED_HWINFO_ISO RT_BIT(15)
413	#define ED_HWINFO_SKIP RT_BIT(14)
414	#define ED_HWINFO_LOWSPEED RT_BIT(13)
415	#define ED_HWINFO_IN RT_BIT(12)
416	#define ED_HWINFO_OUT RT_BIT(11)
417	#define ED_HWINFO_DIR (RT_BIT(11) \| RT_BIT(12))
418	#define ED_HWINFO_ENDPOINT 0x780 /* 4 bits */
419	#define ED_HWINFO_ENDPOINT_SHIFT 7
420	#define ED_HWINFO_FUNCTION 0x7f /* 7 bits */
421	#define ED_HEAD_CARRY RT_BIT(1)
422	#define ED_HEAD_HALTED RT_BIT(0)
423
424	/**
425	* OHCI Endpoint Descriptor.
426	*/
427	typedef struct OHCIED
428	{
429	/** Flags and stuff. */
430	uint32_t hwinfo;
431	/** TailP - TD Queue Tail pointer. Bits 0-3 ignored / preserved. */
432	uint32_t TailP;
433	/** HeadP - TD Queue head pointer. Bit 0 - Halted, Bit 1 - toggleCarry. Bit 2&3 - 0. */
434	uint32_t HeadP;
435	/** NextED - Next Endpoint Descriptor. Bits 0-3 ignored / preserved. */
436	uint32_t NextED;
437	} OHCIED, *POHCIED;
438	typedef const OHCIED *PCOHCIED;
439	AssertCompileSize(OHCIED, 16);
440
441	/** @} */
442
443
444	/** @name Completion Codes
445	* @{ */
446	#define OHCI_CC_NO_ERROR (UINT32_C(0x00) << 28)
447	#define OHCI_CC_CRC (UINT32_C(0x01) << 28)
448	#define OHCI_CC_STALL (UINT32_C(0x04) << 28)
449	#define OHCI_CC_DEVICE_NOT_RESPONDING (UINT32_C(0x05) << 28)
450	#define OHCI_CC_DNR OHCI_CC_DEVICE_NOT_RESPONDING
451	#define OHCI_CC_PID_CHECK_FAILURE (UINT32_C(0x06) << 28)
452	#define OHCI_CC_UNEXPECTED_PID (UINT32_C(0x07) << 28)
453	#define OHCI_CC_DATA_OVERRUN (UINT32_C(0x08) << 28)
454	#define OHCI_CC_DATA_UNDERRUN (UINT32_C(0x09) << 28)
455	/* 0x0a..0x0b - reserved */
456	#define OHCI_CC_BUFFER_OVERRUN (UINT32_C(0x0c) << 28)
457	#define OHCI_CC_BUFFER_UNDERRUN (UINT32_C(0x0d) << 28)
458	#define OHCI_CC_NOT_ACCESSED_0 (UINT32_C(0x0e) << 28)
459	#define OHCI_CC_NOT_ACCESSED_1 (UINT32_C(0x0f) << 28)
460	/** @} */
461
462
463	/** @name OHCI General transfer descriptor
464	* @{ */
465
466	/** Error count (EC) shift. */
467	#define TD_ERRORS_SHIFT 26
468	/** Error count max. (One greater than what the EC field can hold.) */
469	#define TD_ERRORS_MAX 4
470
471	/** CC - Condition code mask. */
472	#define TD_HWINFO_CC (UINT32_C(0xf0000000))
473	#define TD_HWINFO_CC_SHIFT 28
474	/** EC - Error count. */
475	#define TD_HWINFO_ERRORS (RT_BIT(26) \| RT_BIT(27))
476	/** T - Data toggle. */
477	#define TD_HWINFO_TOGGLE (RT_BIT(24) \| RT_BIT(25))
478	#define TD_HWINFO_TOGGLE_HI (RT_BIT(25))
479	#define TD_HWINFO_TOGGLE_LO (RT_BIT(24))
480	/** DI - Delay interrupt. */
481	#define TD_HWINFO_DI (RT_BIT(21) \| RT_BIT(22) \| RT_BIT(23))
482	#define TD_HWINFO_IN (RT_BIT(20))
483	#define TD_HWINFO_OUT (RT_BIT(19))
484	/** DP - Direction / PID. */
485	#define TD_HWINFO_DIR (RT_BIT(19) \| RT_BIT(20))
486	/** R - Buffer rounding. */
487	#define TD_HWINFO_ROUNDING (RT_BIT(18))
488	/** Bits that are reserved / unknown. */
489	#define TD_HWINFO_UNKNOWN_MASK (UINT32_C(0x0003ffff))
490
491	/** SETUP - to endpoint. */
492	#define OHCI_TD_DIR_SETUP 0x0
493	/** OUT - to endpoint. */
494	#define OHCI_TD_DIR_OUT 0x1
495	/** IN - from endpoint. */
496	#define OHCI_TD_DIR_IN 0x2
497	/** Reserved. */
498	#define OHCI_TD_DIR_RESERVED 0x3
499
500	/**
501	* OHCI general transfer descriptor
502	*/
503	typedef struct OHCITD
504	{
505	uint32_t hwinfo;
506	/** CBP - Current Buffer Pointer. (32-bit physical address) */
507	uint32_t cbp;
508	/** NextTD - Link to the next transfer descriptor. (32-bit physical address, dword aligned) */
509	uint32_t NextTD;
510	/** BE - Buffer End (inclusive). (32-bit physical address) */
511	uint32_t be;
512	} OHCITD, *POHCITD;
513	typedef const OHCITD *PCOHCITD;
514	AssertCompileSize(OHCIED, 16);
515	/** @} */
516
517
518	/** @name OHCI isochronous transfer descriptor.
519	* @{ */
520	/** SF - Start frame number. */
521	#define ITD_HWINFO_SF 0xffff
522	/** DI - Delay interrupt. (TD_HWINFO_DI) */
523	#define ITD_HWINFO_DI (RT_BIT(21) \| RT_BIT(22) \| RT_BIT(23))
524	#define ITD_HWINFO_DI_SHIFT 21
525	/** FC - Frame count. */
526	#define ITD_HWINFO_FC (RT_BIT(24) \| RT_BIT(25) \| RT_BIT(26))
527	#define ITD_HWINFO_FC_SHIFT 24
528	/** CC - Condition code mask. (=TD_HWINFO_CC) */
529	#define ITD_HWINFO_CC UINT32_C(0xf0000000)
530	#define ITD_HWINFO_CC_SHIFT 28
531	/** The buffer page 0 mask (lower 12 bits are ignored). */
532	#define ITD_BP0_MASK UINT32_C(0xfffff000)
533
534	#define ITD_NUM_PSW 8
535	/** OFFSET - offset of the package into the buffer page.
536	* (Only valid when CC set to Not Accessed.)
537	*
538	* Note that the top bit of the OFFSET field is overlapping with the
539	* first bit in the CC field. This is ok because both 0xf and 0xe are
540	* defined as "Not Accessed".
541	*/
542	#define ITD_PSW_OFFSET 0x1fff
543	/** SIZE field mask for IN bound transfers.
544	* (Only valid when CC isn't Not Accessed.)*/
545	#define ITD_PSW_SIZE 0x07ff
546	/** CC field mask.
547	* USed to indicate the format of SIZE (Not Accessed -> OFFSET). */
548	#define ITD_PSW_CC 0xf000
549	#define ITD_PSW_CC_SHIFT 12
550
551	/**
552	* OHCI isochronous transfer descriptor.
553	*/
554	typedef struct OHCIITD
555	{
556	uint32_t HwInfo;
557	/** BP0 - Buffer Page 0. The lower 12 bits are ignored. */
558	uint32_t BP0;
559	/** NextTD - Link to the next transfer descriptor. (32-bit physical address, dword aligned) */
560	uint32_t NextTD;
561	/** BE - Buffer End (inclusive). (32-bit physical address) */
562	uint32_t BE;
563	/** (OffsetN/)PSWN - package status word array (0..7).
564	* The format varies depending on whether the package has been completed or not. */
565	uint16_t aPSW[ITD_NUM_PSW];
566	} OHCIITD, *POHCIITD;
567	typedef const OHCIITD *PCOHCIITD;
568	AssertCompileSize(OHCIITD, 32);
569	/** @} */
570
571	/**
572	* OHCI register operator.
573	*/
574	typedef struct ohci_opreg
575	{
576	const char *pszName;
577	int (pfnRead )(PCOHCI pThis, uint32_t iReg, uint32_t pu32Value);
578	int (*pfnWrite)(POHCI pThis, uint32_t iReg, uint32_t u32Value);
579	} OHCIOPREG;
580
581
582	/* OHCI Local stuff */
583	#define OHCI_CTL_CBSR ((1<<0)\|(1<<1))
584	#define OHCI_CTL_PLE (1<<2)
585	#define OHCI_CTL_IE (1<<3)
586	#define OHCI_CTL_CLE (1<<4)
587	#define OHCI_CTL_BLE (1<<5)
588	#define OHCI_CTL_HCFS ((1<<6)\|(1<<7))
589	#define OHCI_USB_RESET 0x00
590	#define OHCI_USB_RESUME 0x40
591	#define OHCI_USB_OPERATIONAL 0x80
592	#define OHCI_USB_SUSPEND 0xc0
593	#define OHCI_CTL_IR (1<<8)
594	#define OHCI_CTL_RWC (1<<9)
595	#define OHCI_CTL_RWE (1<<10)
596
597	#define OHCI_STATUS_HCR (1<<0)
598	#define OHCI_STATUS_CLF (1<<1)
599	#define OHCI_STATUS_BLF (1<<2)
600	#define OHCI_STATUS_OCR (1<<3)
601	#define OHCI_STATUS_SOC ((1<<6)\|(1<<7))
602
603	/** @name Interrupt Status and Enabled/Disabled Flags
604	* @{ */
605	/** SO - Scheduling overrun. */
606	#define OHCI_INTR_SCHEDULEING_OVERRUN RT_BIT(0)
607	/** WDH - HcDoneHead writeback. */
608	#define OHCI_INTR_WRITE_DONE_HEAD RT_BIT(1)
609	/** SF - Start of frame. */
610	#define OHCI_INTR_START_OF_FRAME RT_BIT(2)
611	/** RD - Resume detect. */
612	#define OHCI_INTR_RESUME_DETECT RT_BIT(3)
613	/** UE - Unrecoverable error. */
614	#define OHCI_INTR_UNRECOVERABLE_ERROR RT_BIT(4)
615	/** FNO - Frame number overflow. */
616	#define OHCI_INTR_FRAMENUMBER_OVERFLOW RT_BIT(5)
617	/** RHSC- Root hub status change. */
618	#define OHCI_INTR_ROOT_HUB_STATUS_CHANGE RT_BIT(6)
619	/** OC - Ownership change. */
620	#define OHCI_INTR_OWNERSHIP_CHANGE RT_BIT(30)
621	/** MIE - Master interrupt enable. */
622	#define OHCI_INTR_MASTER_INTERRUPT_ENABLED RT_BIT(31)
623	/** @} */
624
625	#define OHCI_HCCA_SIZE 0x100
626	#define OHCI_HCCA_MASK UINT32_C(0xffffff00)
627
628	#define OHCI_FMI_FI UINT32_C(0x00003fff)
629	#define OHCI_FMI_FSMPS UINT32_C(0x7fff0000)
630	#define OHCI_FMI_FSMPS_SHIFT 16
631	#define OHCI_FMI_FIT UINT32_C(0x80000000)
632	#define OHCI_FMI_FIT_SHIFT 31
633
634	#define OHCI_FR_RT RT_BIT_32(31)
635
636	#define OHCI_LS_THRESH 0x628
637
638	#define OHCI_RHA_NDP (0xff)
639	#define OHCI_RHA_PSM RT_BIT_32(8)
640	#define OHCI_RHA_NPS RT_BIT_32(9)
641	#define OHCI_RHA_DT RT_BIT_32(10)
642	#define OHCI_RHA_OCPM RT_BIT_32(11)
643	#define OHCI_RHA_NOCP RT_BIT_32(12)
644	#define OHCI_RHA_POTPGP UINT32_C(0xff000000)
645
646	#define OHCI_RHS_LPS RT_BIT_32(0)
647	#define OHCI_RHS_OCI RT_BIT_32(1)
648	#define OHCI_RHS_DRWE RT_BIT_32(15)
649	#define OHCI_RHS_LPSC RT_BIT_32(16)
650	#define OHCI_RHS_OCIC RT_BIT_32(17)
651	#define OHCI_RHS_CRWE RT_BIT_32(31)
652
653	/** @name HcRhPortStatus[n] - RH Port Status register (read).
654	* @{ */
655	/** CCS - CurrentConnectionStatus - 0 = no device, 1 = device. */
656	#define OHCI_PORT_CCS RT_BIT(0)
657	/** PES - PortEnableStatus. */
658	#define OHCI_PORT_PES RT_BIT(1)
659	/** PSS - PortSuspendStatus */
660	#define OHCI_PORT_PSS RT_BIT(2)
661	/** POCI- PortOverCurrentIndicator. */
662	#define OHCI_PORT_POCI RT_BIT(3)
663	/** PRS - PortResetStatus */
664	#define OHCI_PORT_PRS RT_BIT(4)
665	/** PPS - PortPowerStatus */
666	#define OHCI_PORT_PPS RT_BIT(8)
667	/** LSDA - LowSpeedDeviceAttached */
668	#define OHCI_PORT_LSDA RT_BIT(9)
669	/** CSC - ConnectStatusChange */
670	#define OHCI_PORT_CSC RT_BIT(16)
671	/** PESC - PortEnableStatusChange */
672	#define OHCI_PORT_PESC RT_BIT(17)
673	/** PSSC - PortSuspendStatusChange */
674	#define OHCI_PORT_PSSC RT_BIT(18)
675	/** OCIC - OverCurrentIndicatorChange */
676	#define OHCI_PORT_OCIC RT_BIT(19)
677	/** PRSC - PortResetStatusChange */
678	#define OHCI_PORT_PRSC RT_BIT(20)
679	/** @} */
680
681
682	/** @name HcRhPortStatus[n] - Root Hub Port Status Registers - read.
683	* @{ */
684	/** CCS - CurrentConnectStatus - 0 = no device, 1 = device. */
685	#define OHCI_PORT_R_CURRENT_CONNECT_STATUS RT_BIT(0)
686	/** PES - PortEnableStatus. */
687	#define OHCI_PORT_R_ENABLE_STATUS RT_BIT(1)
688	/** PSS - PortSuspendStatus */
689	#define OHCI_PORT_R_SUSPEND_STATUS RT_BIT(2)
690	/** POCI- PortOverCurrentIndicator. */
691	#define OHCI_PORT_R_OVER_CURRENT_INDICATOR RT_BIT(3)
692	/** PRS - PortResetStatus */
693	#define OHCI_PORT_R_RESET_STATUS RT_BIT(4)
694	/** PPS - PortPowerStatus */
695	#define OHCI_PORT_R_POWER_STATUS RT_BIT(8)
696	/** LSDA - LowSpeedDeviceAttached */
697	#define OHCI_PORT_R_LOW_SPEED_DEVICE_ATTACHED RT_BIT(9)
698	/** CSC - ConnectStatusChange */
699	#define OHCI_PORT_R_CONNECT_STATUS_CHANGE RT_BIT(16)
700	/** PESC - PortEnableStatusChange */
701	#define OHCI_PORT_R_ENABLE_STATUS_CHANGE RT_BIT(17)
702	/** PSSC - PortSuspendStatusChange */
703	#define OHCI_PORT_R_SUSPEND_STATUS_CHANGE RT_BIT(18)
704	/** OCIC - OverCurrentIndicatorChange */
705	#define OHCI_PORT_R_OVER_CURRENT_INDICATOR_CHANGE RT_BIT(19)
706	/** PRSC - PortResetStatusChange */
707	#define OHCI_PORT_R_RESET_STATUS_CHANGE RT_BIT(20)
708	/** @} */
709
710	/** @name HcRhPortStatus[n] - Root Hub Port Status Registers - write.
711	* @{ */
712	/** CCS - ClearPortEnable. */
713	#define OHCI_PORT_W_CLEAR_ENABLE RT_BIT(0)
714	/** PES - SetPortEnable. */
715	#define OHCI_PORT_W_SET_ENABLE RT_BIT(1)
716	/** PSS - SetPortSuspend */
717	#define OHCI_PORT_W_SET_SUSPEND RT_BIT(2)
718	/** POCI- ClearSuspendStatus. */
719	#define OHCI_PORT_W_CLEAR_SUSPEND_STATUS RT_BIT(3)
720	/** PRS - SetPortReset */
721	#define OHCI_PORT_W_SET_RESET RT_BIT(4)
722	/** PPS - SetPortPower */
723	#define OHCI_PORT_W_SET_POWER RT_BIT(8)
724	/** LSDA - ClearPortPower */
725	#define OHCI_PORT_W_CLEAR_POWER RT_BIT(9)
726	/** CSC - ClearConnectStatusChange */
727	#define OHCI_PORT_W_CLEAR_CSC RT_BIT(16)
728	/** PESC - PortEnableStatusChange */
729	#define OHCI_PORT_W_CLEAR_PESC RT_BIT(17)
730	/** PSSC - PortSuspendStatusChange */
731	#define OHCI_PORT_W_CLEAR_PSSC RT_BIT(18)
732	/** OCIC - OverCurrentIndicatorChange */
733	#define OHCI_PORT_W_CLEAR_OCIC RT_BIT(19)
734	/** PRSC - PortResetStatusChange */
735	#define OHCI_PORT_W_CLEAR_PRSC RT_BIT(20)
736	/** The mask of bit which are used to clear themselves. */
737	#define OHCI_PORT_W_CLEAR_CHANGE_MASK ( OHCI_PORT_W_CLEAR_CSC \| OHCI_PORT_W_CLEAR_PESC \| OHCI_PORT_W_CLEAR_PSSC \
738	\| OHCI_PORT_W_CLEAR_OCIC \| OHCI_PORT_W_CLEAR_PRSC)
739	/** @} */
740
741
742	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
743
744
745	/*********************************************************************************************************************************
746	* Global Variables *
747	*********************************************************************************************************************************/
748	#if defined(LOG_ENABLED) && defined(IN_RING3)
749	static bool g_fLogBulkEPs = false;
750	static bool g_fLogControlEPs = false;
751	static bool g_fLogInterruptEPs = false;
752	#endif
753	#ifdef IN_RING3
754	/**
755	* SSM descriptor table for the OHCI structure.
756	*/
757	static SSMFIELD const g_aOhciFields[] =
758	{
759	SSMFIELD_ENTRY( OHCI, SofTime),
760	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
761	SSMFIELD_ENTRY( OHCI, RootHub.status),
762	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
763	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
764	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
765	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
766	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
767	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
768	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
769	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
770	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
771	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
772	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[8].fReg),
773	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[9].fReg),
774	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[10].fReg),
775	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[11].fReg),
776	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[12].fReg),
777	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[13].fReg),
778	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[14].fReg),
779	SSMFIELD_ENTRY( OHCI, ctl),
780	SSMFIELD_ENTRY( OHCI, status),
781	SSMFIELD_ENTRY( OHCI, intr_status),
782	SSMFIELD_ENTRY( OHCI, intr),
783	SSMFIELD_ENTRY( OHCI, hcca),
784	SSMFIELD_ENTRY( OHCI, per_cur),
785	SSMFIELD_ENTRY( OHCI, ctrl_cur),
786	SSMFIELD_ENTRY( OHCI, ctrl_head),
787	SSMFIELD_ENTRY( OHCI, bulk_cur),
788	SSMFIELD_ENTRY( OHCI, bulk_head),
789	SSMFIELD_ENTRY( OHCI, done),
790	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
791	SSMFIELD_ENTRY( OHCI, HcFmNumber),
792	SSMFIELD_ENTRY( OHCI, pstart),
793	SSMFIELD_ENTRY_TERM()
794	};
795	#endif
796
797
798	/*********************************************************************************************************************************
799	* Internal Functions *
800	*********************************************************************************************************************************/
801	RT_C_DECLS_BEGIN
802	#ifdef IN_RING3
803	/* Update host controller state to reflect a device attach */
804	static void rhport_power(POHCIROOTHUB pRh, unsigned iPort, bool fPowerUp);
805	static void ohciBusResume(POHCI ohci, bool fHardware);
806	static void ohciBusStop(POHCI pThis);
807
808	static DECLCALLBACK(void) ohciRhXferCompletion(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb);
809	static DECLCALLBACK(bool) ohciRhXferError(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb);
810
811	static int ohci_in_flight_find(POHCI pThis, uint32_t GCPhysTD);
812	# if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
813	static int ohci_in_done_queue_find(POHCI pThis, uint32_t GCPhysTD);
814	# endif
815	static DECLCALLBACK(void) ohciR3LoadReattachDevices(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser);
816	#endif /* IN_RING3 */
817	RT_C_DECLS_END
818
819
820	/**
821	* Update PCI IRQ levels
822	*/
823	static void ohciUpdateInterruptLocked(POHCI ohci, const char *msg)
824	{
825	int level = 0;
826
827	if ( (ohci->intr & OHCI_INTR_MASTER_INTERRUPT_ENABLED)
828	&& (ohci->intr_status & ohci->intr)
829	&& !(ohci->ctl & OHCI_CTL_IR))
830	level = 1;
831
832	PDMDevHlpPCISetIrq(ohci->CTX_SUFF(pDevIns), 0, level);
833	if (level)
834	{
835	uint32_t val = ohci->intr_status & ohci->intr;
836	Log2(("ohci: Fired off interrupt %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d - %s\n",
837	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
838	(val >> 6) & 1, (val >> 30) & 1, msg)); NOREF(val); NOREF(msg);
839	}
840	}
841
842	/**
843	* Set an interrupt, use the wrapper ohciSetInterrupt.
844	*/
845	DECLINLINE(int) ohciSetInterruptInt(POHCI ohci, int rcBusy, uint32_t intr, const char *msg)
846	{
847	int rc = PDMCritSectEnter(&ohci->CsIrq, rcBusy);
848	if (rc != VINF_SUCCESS)
849	return rc;
850
851	if ( (ohci->intr_status & intr) != intr )
852	{
853	ohci->intr_status \|= intr;
854	ohciUpdateInterruptLocked(ohci, msg);
855	}
856
857	PDMCritSectLeave(&ohci->CsIrq);
858	return rc;
859	}
860
861	/**
862	* Set an interrupt wrapper macro for logging purposes.
863	*/
864	#define ohciSetInterrupt(ohci, a_rcBusy, intr) ohciSetInterruptInt(ohci, a_rcBusy, intr, #intr)
865	#define ohciR3SetInterrupt(ohci, intr) ohciSetInterruptInt(ohci, VERR_IGNORED, intr, #intr)
866
867	#ifdef IN_RING3
868
869	/* Carry out a hardware remote wakeup */
870	static void ohci_remote_wakeup(POHCI pThis)
871	{
872	if ((pThis->ctl & OHCI_CTL_HCFS) != OHCI_USB_SUSPEND)
873	return;
874	if (!(pThis->RootHub.status & OHCI_RHS_DRWE))
875	return;
876	ohciBusResume(pThis, true /* hardware */);
877	}
878
879
880	/**
881	* Query interface method for the roothub LUN.
882	*/
883	static DECLCALLBACK(void ) ohciRhQueryInterface(PPDMIBASE pInterface, const char pszIID)
884	{
885	POHCI pThis = RT_FROM_MEMBER(pInterface, OHCI, RootHub.IBase);
886	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->RootHub.IBase);
887	PDMIBASE_RETURN_INTERFACE(pszIID, VUSBIROOTHUBPORT, &pThis->RootHub.IRhPort);
888	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThis->RootHub.ILeds);
889	return NULL;
890	}
891
892	/**
893	* Gets the pointer to the status LED of a unit.
894	*
895	* @returns VBox status code.
896	* @param pInterface Pointer to the interface structure containing the called function pointer.
897	* @param iLUN The unit which status LED we desire.
898	* @param ppLed Where to store the LED pointer.
899	*/
900	static DECLCALLBACK(int) ohciRhQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
901	{
902	POHCI pThis = (POHCI)((uintptr_t)pInterface - RT_OFFSETOF(OHCI, RootHub.ILeds));
903	if (iLUN == 0)
904	{
905	*ppLed = &pThis->RootHub.Led;
906	return VINF_SUCCESS;
907	}
908	return VERR_PDM_LUN_NOT_FOUND;
909	}
910
911
912	/** Converts a OHCI.roothub.IRhPort pointer to a POHCI. */
913	#define VUSBIROOTHUBPORT_2_OHCI(pInterface) ((POHCI)( (uintptr_t)(pInterface) - RT_OFFSETOF(OHCI, RootHub.IRhPort) ))
914
915
916	/**
917	* Get the number of available ports in the hub.
918	*
919	* @returns The number of ports available.
920	* @param pInterface Pointer to this structure.
921	* @param pAvailable Bitmap indicating the available ports. Set bit == available port.
922	*/
923	static DECLCALLBACK(unsigned) ohciRhGetAvailablePorts(PVUSBIROOTHUBPORT pInterface, PVUSBPORTBITMAP pAvailable)
924	{
925	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
926	unsigned iPort;
927	unsigned cPorts = 0;
928
929	memset(pAvailable, 0, sizeof(*pAvailable));
930
931	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
932	for (iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++)
933	{
934	if (!pThis->RootHub.aPorts[iPort].pDev)
935	{
936	cPorts++;
937	ASMBitSet(pAvailable, iPort + 1);
938	}
939	}
940	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
941
942	return cPorts;
943	}
944
945
946	/**
947	* Gets the supported USB versions.
948	*
949	* @returns The mask of supported USB versions.
950	* @param pInterface Pointer to this structure.
951	*/
952	static DECLCALLBACK(uint32_t) ohciRhGetUSBVersions(PVUSBIROOTHUBPORT pInterface)
953	{
954	return VUSB_STDVER_11;
955	}
956
957
958	/**
959	* A device is being attached to a port in the roothub.
960	*
961	* @param pInterface Pointer to this structure.
962	* @param pDev Pointer to the device being attached.
963	* @param uPort The port number assigned to the device.
964	*/
965	static DECLCALLBACK(int) ohciRhAttach(PVUSBIROOTHUBPORT pInterface, PVUSBIDEVICE pDev, unsigned uPort)
966	{
967	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
968	LogFlow(("ohciRhAttach: pDev=%p uPort=%u\n", pDev, uPort));
969	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
970
971	/*
972	* Validate and adjust input.
973	*/
974	Assert(uPort >= 1 && uPort <= OHCI_NDP_CFG(pThis));
975	uPort--;
976	Assert(!pThis->RootHub.aPorts[uPort].pDev);
977	/* Only LS/FS devices can end up here. */
978	Assert(pDev->pfnGetSpeed(pDev) == VUSB_SPEED_LOW \|\| pDev->pfnGetSpeed(pDev) == VUSB_SPEED_FULL);
979
980	/*
981	* Attach it.
982	*/
983	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
984	pThis->RootHub.aPorts[uPort].pDev = pDev;
985	rhport_power(&pThis->RootHub, uPort, 1 /* power on */);
986
987	ohci_remote_wakeup(pThis);
988	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
989
990	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
991	return VINF_SUCCESS;
992	}
993
994
995	/**
996	* A device is being detached from a port in the roothub.
997	*
998	* @param pInterface Pointer to this structure.
999	* @param pDev Pointer to the device being detached.
1000	* @param uPort The port number assigned to the device.
1001	*/
1002	static DECLCALLBACK(void) ohciRhDetach(PVUSBIROOTHUBPORT pInterface, PVUSBIDEVICE pDev, unsigned uPort)
1003	{
1004	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
1005	LogFlow(("ohciRhDetach: pDev=%p uPort=%u\n", pDev, uPort));
1006	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
1007
1008	/*
1009	* Validate and adjust input.
1010	*/
1011	Assert(uPort >= 1 && uPort <= OHCI_NDP_CFG(pThis));
1012	uPort--;
1013	Assert(pThis->RootHub.aPorts[uPort].pDev == pDev);
1014
1015	/*
1016	* Detach it.
1017	*/
1018	pThis->RootHub.aPorts[uPort].pDev = NULL;
1019	if (pThis->RootHub.aPorts[uPort].fReg & OHCI_PORT_PES)
1020	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CONNECT_STATUS_CHANGE \| OHCI_PORT_PESC;
1021	else
1022	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CONNECT_STATUS_CHANGE;
1023
1024	ohci_remote_wakeup(pThis);
1025	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
1026
1027	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
1028	}
1029
1030
1031	#ifdef IN_RING3
1032	/**
1033	* One of the roothub devices has completed its reset operation.
1034	*
1035	* Currently, we don't think anything is required to be done here
1036	* so it's just a stub for forcing async resetting of the devices
1037	* during a root hub reset.
1038	*
1039	* @param pDev The root hub device.
1040	* @param rc The result of the operation.
1041	* @param pvUser Pointer to the controller.
1042	*/
1043	static DECLCALLBACK(void) ohciRhResetDoneOneDev(PVUSBIDEVICE pDev, int rc, void *pvUser)
1044	{
1045	LogRel(("OHCI: root hub reset completed with %Rrc\n", rc));
1046	NOREF(pDev); NOREF(rc); NOREF(pvUser);
1047	}
1048	#endif
1049
1050
1051	/**
1052	* Reset the root hub.
1053	*
1054	* @returns VBox status code.
1055	* @param pInterface Pointer to this structure.
1056	* @param fResetOnLinux This is used to indicate whether we're at VM reset time and
1057	* can do real resets or if we're at any other time where that
1058	* isn't such a good idea.
1059	* @remark Do NOT call VUSBIDevReset on the root hub in an async fashion!
1060	* @thread EMT
1061	*/
1062	static DECLCALLBACK(int) ohciRhReset(PVUSBIROOTHUBPORT pInterface, bool fResetOnLinux)
1063	{
1064	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
1065	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
1066
1067	pThis->RootHub.status = 0;
1068	pThis->RootHub.desc_a = OHCI_RHA_NPS \| OHCI_NDP_CFG(pThis); /* Preserve NDP value. */
1069	pThis->RootHub.desc_b = 0x0; /* Impl. specific */
1070
1071	/*
1072	* We're pending to _reattach_ the device without resetting them.
1073	* Except, during VM reset where we use the opportunity to do a proper
1074	* reset before the guest comes along and expect things.
1075	*
1076	* However, it's very very likely that we're not doing the right thing
1077	* here if coming from the guest (USB Reset state). The docs talks about
1078	* root hub resetting, however what exact behaviour in terms of root hub
1079	* status and changed bits, and HC interrupts aren't stated clearly. IF we
1080	* get trouble and see the guest doing "USB Resets" we will have to look
1081	* into this. For the time being we stick with simple.
1082	*/
1083	for (unsigned iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++)
1084	{
1085	if (pThis->RootHub.aPorts[iPort].pDev)
1086	{
1087	pThis->RootHub.aPorts[iPort].fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
1088	if (fResetOnLinux)
1089	{
1090	PVM pVM = PDMDevHlpGetVM(pThis->CTX_SUFF(pDevIns));
1091	VUSBIDevReset(pThis->RootHub.aPorts[iPort].pDev, fResetOnLinux, ohciRhResetDoneOneDev, pThis, pVM);
1092	}
1093	}
1094	else
1095	pThis->RootHub.aPorts[iPort].fReg = 0;
1096	}
1097
1098	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
1099	return VINF_SUCCESS;
1100	}
1101
1102
1103	/**
1104	* Does a software or hardware reset of the controller.
1105	*
1106	* This is called in response to setting HcCommandStatus.HCR, hardware reset,
1107	* and device construction.
1108	*
1109	* @param pThis The ohci instance data.
1110	* @param fNewMode The new mode of operation. This is UsbSuspend if it's a
1111	* software reset, and UsbReset if it's a hardware reset / cold boot.
1112	* @param fResetOnLinux Set if we can do a real reset of the devices attached to the root hub.
1113	* This is really a just a hack for the non-working linux device reset.
1114	* Linux has this feature called 'logical disconnect' if device reset fails
1115	* which prevents us from doing resets when the guest asks for it - the guest
1116	* will get confused when the device seems to be reconnected everytime it tries
1117	* to reset it. But if we're at hardware reset time, we can allow a device to
1118	* be 'reconnected' without upsetting the guest.
1119	*
1120	* @remark This hasn't got anything to do with software setting the mode to UsbReset.
1121	*/
1122	static void ohciDoReset(POHCI pThis, uint32_t fNewMode, bool fResetOnLinux)
1123	{
1124	Log(("ohci: %s reset%s\n", fNewMode == OHCI_USB_RESET ? "hardware" : "software",
1125	fResetOnLinux ? " (reset on linux)" : ""));
1126
1127	/* Stop the bus in any case, disabling walking the lists. */
1128	ohciBusStop(pThis);
1129
1130	/*
1131	* Cancel all outstanding URBs.
1132	*
1133	* We can't, and won't, deal with URBs until we're moved out of the
1134	* suspend/reset state. Also, a real HC isn't going to send anything
1135	* any more when a reset has been signaled.
1136	*/
1137	pThis->RootHub.pIRhConn->pfnCancelAllUrbs(pThis->RootHub.pIRhConn);
1138
1139	/*
1140	* Reset the hardware registers.
1141	*/
1142	if (fNewMode == OHCI_USB_RESET)
1143	pThis->ctl \|= OHCI_CTL_RWC; /* We're the firmware, set RemoteWakeupConnected. */
1144	else
1145	pThis->ctl &= OHCI_CTL_IR \| OHCI_CTL_RWC; /* IR and RWC are preserved on software reset. */
1146
1147	/* Clear the HCFS bits first to make setting the new state work. */
1148	pThis->ctl &= ~OHCI_CTL_HCFS;
1149	pThis->ctl \|= fNewMode;
1150	pThis->status = 0;
1151	pThis->intr_status = 0;
1152	pThis->intr = OHCI_INTR_MASTER_INTERRUPT_ENABLED; /* (We follow the text and the not reset value column,) */
1153
1154	pThis->hcca = 0;
1155	pThis->per_cur = 0;
1156	pThis->ctrl_head = pThis->ctrl_cur = 0;
1157	pThis->bulk_head = pThis->bulk_cur = 0;
1158	pThis->done = 0;
1159
1160	pThis->fsmps = 0x2778; /* To-Be-Defined, use the value linux sets...*/
1161	pThis->fit = 0;
1162	pThis->fi = 11999; /* (12MHz ticks, one frame is 1ms) */
1163	pThis->frt = 0;
1164	pThis->HcFmNumber = 0;
1165	pThis->pstart = 0;
1166
1167	pThis->dqic = 0x7;
1168	pThis->fno = 0;
1169
1170	/*
1171	* If this is a hardware reset, we will initialize the root hub too.
1172	* Software resets doesn't do this according to the specs.
1173	* (It's not possible to have device connected at the time of the
1174	* device construction, so nothing to worry about there.)
1175	*/
1176	if (fNewMode == OHCI_USB_RESET)
1177	VUSBIDevReset(pThis->RootHub.pIDev, fResetOnLinux, NULL, NULL, NULL);
1178	}
1179	#endif /* IN_RING3 */
1180
1181	/**
1182	* Reads physical memory.
1183	*/
1184	DECLINLINE(void) ohciPhysRead(POHCI pThis, uint32_t Addr, void *pvBuf, size_t cbBuf)
1185	{
1186	if (cbBuf)
1187	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), Addr, pvBuf, cbBuf);
1188	}
1189
1190	/**
1191	* Writes physical memory.
1192	*/
1193	DECLINLINE(void) ohciPhysWrite(POHCI pThis, uint32_t Addr, const void *pvBuf, size_t cbBuf)
1194	{
1195	if (cbBuf)
1196	PDMDevHlpPCIPhysWrite(pThis->CTX_SUFF(pDevIns), Addr, pvBuf, cbBuf);
1197	}
1198
1199	/**
1200	* Read an array of dwords from physical memory and correct endianness.
1201	*/
1202	DECLINLINE(void) ohciGetDWords(POHCI pThis, uint32_t Addr, uint32_t *pau32s, int c32s)
1203	{
1204	ohciPhysRead(pThis, Addr, pau32s, c32s * sizeof(uint32_t));
1205	#if BYTE_ORDER != LITTLE_ENDIAN
1206	for(int i = 0; i < c32s; i++)
1207	pau32s[i] = RT_H2LE_U32(pau32s[i]);
1208	#endif
1209	}
1210
1211	/**
1212	* Write an array of dwords from physical memory and correct endianness.
1213	*/
1214	DECLINLINE(void) ohciPutDWords(POHCI pThis, uint32_t Addr, const uint32_t *pau32s, int cu32s)
1215	{
1216	#if BYTE_ORDER == LITTLE_ENDIAN
1217	ohciPhysWrite(pThis, Addr, pau32s, cu32s << 2);
1218	#else
1219	for (int i = 0; i < c32s; i++, pau32s++, Addr += sizeof(*pau32s))
1220	{
1221	uint32_t u32Tmp = RT_H2LE_U32(*pau32s);
1222	ohciPhysWrite(pThis, Addr, (uint8_t *)&u32Tmp, sizeof(u32Tmp));
1223	}
1224	#endif
1225	}
1226
1227
1228	#ifdef IN_RING3
1229
1230	/**
1231	* Reads an OHCIED.
1232	*/
1233	DECLINLINE(void) ohciReadEd(POHCI pThis, uint32_t EdAddr, POHCIED pEd)
1234	{
1235	ohciGetDWords(pThis, EdAddr, (uint32_t )pEd, sizeof(pEd) >> 2);
1236	}
1237
1238	/**
1239	* Reads an OHCITD.
1240	*/
1241	DECLINLINE(void) ohciReadTd(POHCI pThis, uint32_t TdAddr, POHCITD pTd)
1242	{
1243	ohciGetDWords(pThis, TdAddr, (uint32_t )pTd, sizeof(pTd) >> 2);
1244	#ifdef LOG_ENABLED
1245	if (LogIs3Enabled())
1246	{
1247	uint32_t hichg;
1248	hichg = pTd->hwinfo;
1249	Log3(("ohciReadTd(,%#010x,): R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x UNK=%#x\n",
1250	TdAddr,
1251	(pTd->hwinfo >> 18) & 1,
1252	(pTd->hwinfo >> 19) & 3,
1253	(pTd->hwinfo >> 21) & 7,
1254	(pTd->hwinfo >> 24) & 3,
1255	(pTd->hwinfo >> 26) & 3,
1256	(pTd->hwinfo >> 28) &15,
1257	pTd->cbp,
1258	pTd->NextTD,
1259	pTd->be,
1260	pTd->hwinfo & TD_HWINFO_UNKNOWN_MASK));
1261	#if 0
1262	if (LogIs3Enabled())
1263	{
1264	/*
1265	* usbohci.sys (32-bit XP) allocates 0x80 bytes per TD:
1266	* 0x00-0x0f is the OHCI TD.
1267	* 0x10-0x1f for isochronous TDs
1268	* 0x20 is the physical address of this TD.
1269	* 0x24 is initialized with 0x64745948, probably a magic.
1270	* 0x28 is some kind of flags. the first bit begin the allocated / not allocated indicator.
1271	* 0x30 is a pointer to something. endpoint? interface? device?
1272	* 0x38 is initialized to 0xdeadface. but is changed into a pointer or something.
1273	* 0x40 looks like a pointer.
1274	* The rest is unknown and initialized with zeros.
1275	*/
1276	uint8_t abXpTd[0x80];
1277	ohciPhysRead(pThis, TdAddr, abXpTd, sizeof(abXpTd));
1278	Log3(("WinXpTd: alloc=%d PhysSelf=%RX32 s2=%RX32 magic=%RX32 s4=%RX32 s5=%RX32\n"
1279	"%.*Rhxd\n",
1280	abXpTd[28] & RT_BIT(0),
1281	((uint32_t )&abXpTd[0x20]), ((uint32_t )&abXpTd[0x30]),
1282	((uint32_t )&abXpTd[0x24]), ((uint32_t )&abXpTd[0x38]),
1283	((uint32_t )&abXpTd[0x40]),
1284	sizeof(abXpTd), &abXpTd[0]));
1285	}
1286	#endif
1287	}
1288	#endif
1289	}
1290
1291	/**
1292	* Reads an OHCIITD.
1293	*/
1294	DECLINLINE(void) ohciReadITd(POHCI pThis, uint32_t ITdAddr, POHCIITD pITd)
1295	{
1296	ohciGetDWords(pThis, ITdAddr, (uint32_t )pITd, sizeof(pITd) / sizeof(uint32_t));
1297	#ifdef LOG_ENABLED
1298	if (LogIs3Enabled())
1299	{
1300	Log3(("ohciReadITd(,%#010x,): SF=%#06x (%#RX32) DI=%#x FC=%d CC=%#x BP0=%#010x NextTD=%#010x BE=%#010x\n",
1301	ITdAddr,
1302	pITd->HwInfo & 0xffff, pThis->HcFmNumber,
1303	(pITd->HwInfo >> 21) & 7,
1304	(pITd->HwInfo >> 24) & 7,
1305	(pITd->HwInfo >> 28) &15,
1306	pITd->BP0,
1307	pITd->NextTD,
1308	pITd->BE));
1309	Log3(("psw0=%x:%03x psw1=%x:%03x psw2=%x:%03x psw3=%x:%03x psw4=%x:%03x psw5=%x:%03x psw6=%x:%03x psw7=%x:%03x\n",
1310	pITd->aPSW[0] >> 12, pITd->aPSW[0] & 0xfff,
1311	pITd->aPSW[1] >> 12, pITd->aPSW[1] & 0xfff,
1312	pITd->aPSW[2] >> 12, pITd->aPSW[2] & 0xfff,
1313	pITd->aPSW[3] >> 12, pITd->aPSW[3] & 0xfff,
1314	pITd->aPSW[4] >> 12, pITd->aPSW[4] & 0xfff,
1315	pITd->aPSW[5] >> 12, pITd->aPSW[5] & 0xfff,
1316	pITd->aPSW[6] >> 12, pITd->aPSW[6] & 0xfff,
1317	pITd->aPSW[7] >> 12, pITd->aPSW[7] & 0xfff));
1318	}
1319	#endif
1320	}
1321
1322
1323	/**
1324	* Writes an OHCIED.
1325	*/
1326	DECLINLINE(void) ohciWriteEd(POHCI pThis, uint32_t EdAddr, PCOHCIED pEd)
1327	{
1328	#ifdef LOG_ENABLED
1329	if (LogIs3Enabled())
1330	{
1331	OHCIED EdOld;
1332	uint32_t hichg;
1333
1334	ohciGetDWords(pThis, EdAddr, (uint32_t *)&EdOld, sizeof(EdOld) >> 2);
1335	hichg = EdOld.hwinfo ^ pEd->hwinfo;
1336	Log3(("ohciWriteEd(,%#010x,): %sFA=%#x %sEN=%#x %sD=%#x %sS=%d %sK=%d %sF=%d %sMPS=%#x %sTailP=%#010x %sHeadP=%#010x %sH=%d %sC=%d %sNextED=%#010x\n",
1337	EdAddr,
1338	(hichg >> 0) & 0x7f ? "*" : "", (pEd->hwinfo >> 0) & 0x7f,
1339	(hichg >> 7) & 0xf ? "*" : "", (pEd->hwinfo >> 7) & 0xf,
1340	(hichg >> 11) & 3 ? "*" : "", (pEd->hwinfo >> 11) & 3,
1341	(hichg >> 13) & 1 ? "*" : "", (pEd->hwinfo >> 13) & 1,
1342	(hichg >> 14) & 1 ? "*" : "", (pEd->hwinfo >> 14) & 1,
1343	(hichg >> 15) & 1 ? "*" : "", (pEd->hwinfo >> 15) & 1,
1344	(hichg >> 24) &0x3ff ? "*" : "", (pEd->hwinfo >> 16) &0x3ff,
1345	EdOld.TailP != pEd->TailP ? "*" : "", pEd->TailP,
1346	(EdOld.HeadP & ~3) != (pEd->HeadP & ~3) ? "*" : "", pEd->HeadP & ~3,
1347	(EdOld.HeadP ^ pEd->HeadP) & 1 ? "*" : "", pEd->HeadP & 1,
1348	(EdOld.HeadP ^ pEd->HeadP) & 2 ? "*" : "", (pEd->HeadP >> 1) & 1,
1349	EdOld.NextED != pEd->NextED ? "*" : "", pEd->NextED));
1350	}
1351	#endif
1352
1353	ohciPutDWords(pThis, EdAddr, (uint32_t )pEd, sizeof(pEd) >> 2);
1354	}
1355
1356
1357	/**
1358	* Writes an OHCITD.
1359	*/
1360	DECLINLINE(void) ohciWriteTd(POHCI pThis, uint32_t TdAddr, PCOHCITD pTd, const char *pszLogMsg)
1361	{
1362	#ifdef LOG_ENABLED
1363	if (LogIs3Enabled())
1364	{
1365	OHCITD TdOld;
1366	ohciGetDWords(pThis, TdAddr, (uint32_t *)&TdOld, sizeof(TdOld) >> 2);
1367	uint32_t hichg = TdOld.hwinfo ^ pTd->hwinfo;
1368	Log3(("ohciWriteTd(,%#010x,): %sR=%d %sDP=%d %sDI=%#x %sT=%d %sEC=%d %sCC=%#x %sCBP=%#010x %sNextTD=%#010x %sBE=%#010x (%s)\n",
1369	TdAddr,
1370	(hichg >> 18) & 1 ? "*" : "", (pTd->hwinfo >> 18) & 1,
1371	(hichg >> 19) & 3 ? "*" : "", (pTd->hwinfo >> 19) & 3,
1372	(hichg >> 21) & 7 ? "*" : "", (pTd->hwinfo >> 21) & 7,
1373	(hichg >> 24) & 3 ? "*" : "", (pTd->hwinfo >> 24) & 3,
1374	(hichg >> 26) & 3 ? "*" : "", (pTd->hwinfo >> 26) & 3,
1375	(hichg >> 28) &15 ? "*" : "", (pTd->hwinfo >> 28) &15,
1376	TdOld.cbp != pTd->cbp ? "*" : "", pTd->cbp,
1377	TdOld.NextTD != pTd->NextTD ? "*" : "", pTd->NextTD,
1378	TdOld.be != pTd->be ? "*" : "", pTd->be,
1379	pszLogMsg));
1380	}
1381	#endif
1382	ohciPutDWords(pThis, TdAddr, (uint32_t )pTd, sizeof(pTd) >> 2);
1383	}
1384
1385	/**
1386	* Writes an OHCIITD.
1387	*/
1388	DECLINLINE(void) ohciWriteITd(POHCI pThis, uint32_t ITdAddr, PCOHCIITD pITd, const char *pszLogMsg)
1389	{
1390	#ifdef LOG_ENABLED
1391	if (LogIs3Enabled())
1392	{
1393	OHCIITD ITdOld;
1394	ohciGetDWords(pThis, ITdAddr, (uint32_t *)&ITdOld, sizeof(ITdOld) / sizeof(uint32_t));
1395	uint32_t HIChg = ITdOld.HwInfo ^ pITd->HwInfo;
1396	Log3(("ohciWriteITd(,%#010x,): %sSF=%#x (now=%#RX32) %sDI=%#x %sFC=%d %sCC=%#x %sBP0=%#010x %sNextTD=%#010x %sBE=%#010x (%s)\n",
1397	ITdAddr,
1398	(HIChg & 0xffff) & 1 ? "*" : "", pITd->HwInfo & 0xffff, pThis->HcFmNumber,
1399	(HIChg >> 21) & 7 ? "*" : "", (pITd->HwInfo >> 21) & 7,
1400	(HIChg >> 24) & 7 ? "*" : "", (pITd->HwInfo >> 24) & 7,
1401	(HIChg >> 28) &15 ? "*" : "", (pITd->HwInfo >> 28) &15,
1402	ITdOld.BP0 != pITd->BP0 ? "*" : "", pITd->BP0,
1403	ITdOld.NextTD != pITd->NextTD ? "*" : "", pITd->NextTD,
1404	ITdOld.BE != pITd->BE ? "*" : "", pITd->BE,
1405	pszLogMsg));
1406	Log3(("psw0=%s%x:%s%03x psw1=%s%x:%s%03x psw2=%s%x:%s%03x psw3=%s%x:%s%03x psw4=%s%x:%s%03x psw5=%s%x:%s%03x psw6=%s%x:%s%03x psw7=%s%x:%s%03x\n",
1407	(ITdOld.aPSW[0] >> 12) != (pITd->aPSW[0] >> 12) ? "" : "", pITd->aPSW[0] >> 12, (ITdOld.aPSW[0] & 0xfff) != (pITd->aPSW[0] & 0xfff) ? "" : "", pITd->aPSW[0] & 0xfff,
1408	(ITdOld.aPSW[1] >> 12) != (pITd->aPSW[1] >> 12) ? "" : "", pITd->aPSW[1] >> 12, (ITdOld.aPSW[1] & 0xfff) != (pITd->aPSW[1] & 0xfff) ? "" : "", pITd->aPSW[1] & 0xfff,
1409	(ITdOld.aPSW[2] >> 12) != (pITd->aPSW[2] >> 12) ? "" : "", pITd->aPSW[2] >> 12, (ITdOld.aPSW[2] & 0xfff) != (pITd->aPSW[2] & 0xfff) ? "" : "", pITd->aPSW[2] & 0xfff,
1410	(ITdOld.aPSW[3] >> 12) != (pITd->aPSW[3] >> 12) ? "" : "", pITd->aPSW[3] >> 12, (ITdOld.aPSW[3] & 0xfff) != (pITd->aPSW[3] & 0xfff) ? "" : "", pITd->aPSW[3] & 0xfff,
1411	(ITdOld.aPSW[4] >> 12) != (pITd->aPSW[4] >> 12) ? "" : "", pITd->aPSW[4] >> 12, (ITdOld.aPSW[4] & 0xfff) != (pITd->aPSW[4] & 0xfff) ? "" : "", pITd->aPSW[4] & 0xfff,
1412	(ITdOld.aPSW[5] >> 12) != (pITd->aPSW[5] >> 12) ? "" : "", pITd->aPSW[5] >> 12, (ITdOld.aPSW[5] & 0xfff) != (pITd->aPSW[5] & 0xfff) ? "" : "", pITd->aPSW[5] & 0xfff,
1413	(ITdOld.aPSW[6] >> 12) != (pITd->aPSW[6] >> 12) ? "" : "", pITd->aPSW[6] >> 12, (ITdOld.aPSW[6] & 0xfff) != (pITd->aPSW[6] & 0xfff) ? "" : "", pITd->aPSW[6] & 0xfff,
1414	(ITdOld.aPSW[7] >> 12) != (pITd->aPSW[7] >> 12) ? "" : "", pITd->aPSW[7] >> 12, (ITdOld.aPSW[7] & 0xfff) != (pITd->aPSW[7] & 0xfff) ? "" : "", pITd->aPSW[7] & 0xfff));
1415	}
1416	#endif
1417	ohciPutDWords(pThis, ITdAddr, (uint32_t )pITd, sizeof(pITd) / sizeof(uint32_t));
1418	}
1419
1420
1421	#ifdef LOG_ENABLED
1422
1423	/**
1424	* Core TD queue dumper. LOG_ENABLED builds only.
1425	*/
1426	DECLINLINE(void) ohciDumpTdQueueCore(POHCI pThis, uint32_t GCPhysHead, uint32_t GCPhysTail, bool fFull)
1427	{
1428	uint32_t GCPhys = GCPhysHead;
1429	int cMax = 100;
1430	for (;;)
1431	{
1432	OHCITD Td;
1433	Log4(("%#010x%s%s", GCPhys,
1434	GCPhys && ohci_in_flight_find(pThis, GCPhys) >= 0 ? "~" : "",
1435	GCPhys && ohci_in_done_queue_find(pThis, GCPhys) >= 0 ? "^" : ""));
1436	if (GCPhys == 0 \|\| GCPhys == GCPhysTail)
1437	break;
1438
1439	/* can't use ohciReadTd() because of Log4. */
1440	ohciGetDWords(pThis, GCPhys, (uint32_t *)&Td, sizeof(Td) >> 2);
1441	if (fFull)
1442	Log4((" [R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x] -> ",
1443	(Td.hwinfo >> 18) & 1,
1444	(Td.hwinfo >> 19) & 3,
1445	(Td.hwinfo >> 21) & 7,
1446	(Td.hwinfo >> 24) & 3,
1447	(Td.hwinfo >> 26) & 3,
1448	(Td.hwinfo >> 28) &15,
1449	Td.cbp,
1450	Td.NextTD,
1451	Td.be));
1452	else
1453	Log4((" -> "));
1454	GCPhys = Td.NextTD & ED_PTR_MASK;
1455	Assert(GCPhys != GCPhysHead);
1456	Assert(cMax-- > 0); NOREF(cMax);
1457	}
1458	}
1459
1460	/**
1461	* Dumps a TD queue. LOG_ENABLED builds only.
1462	*/
1463	DECLINLINE(void) ohciDumpTdQueue(POHCI pThis, uint32_t GCPhysHead, const char *pszMsg)
1464	{
1465	if (pszMsg)
1466	Log4(("%s: ", pszMsg));
1467	ohciDumpTdQueueCore(pThis, GCPhysHead, 0, true);
1468	Log4(("\n"));
1469	}
1470
1471	/**
1472	* Core ITD queue dumper. LOG_ENABLED builds only.
1473	*/
1474	DECLINLINE(void) ohciDumpITdQueueCore(POHCI pThis, uint32_t GCPhysHead, uint32_t GCPhysTail, bool fFull)
1475	{
1476	uint32_t GCPhys = GCPhysHead;
1477	int cMax = 100;
1478	for (;;)
1479	{
1480	OHCIITD ITd;
1481	Log4(("%#010x%s%s", GCPhys,
1482	GCPhys && ohci_in_flight_find(pThis, GCPhys) >= 0 ? "~" : "",
1483	GCPhys && ohci_in_done_queue_find(pThis, GCPhys) >= 0 ? "^" : ""));
1484	if (GCPhys == 0 \|\| GCPhys == GCPhysTail)
1485	break;
1486
1487	/* can't use ohciReadTd() because of Log4. */
1488	ohciGetDWords(pThis, GCPhys, (uint32_t *)&ITd, sizeof(ITd) / sizeof(uint32_t));
1489	/*if (fFull)
1490	Log4((" [R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x] -> ",
1491	(Td.hwinfo >> 18) & 1,
1492	(Td.hwinfo >> 19) & 3,
1493	(Td.hwinfo >> 21) & 7,
1494	(Td.hwinfo >> 24) & 3,
1495	(Td.hwinfo >> 26) & 3,
1496	(Td.hwinfo >> 28) &15,
1497	Td.cbp,
1498	Td.NextTD,
1499	Td.be));
1500	else*/
1501	Log4((" -> "));
1502	GCPhys = ITd.NextTD & ED_PTR_MASK;
1503	Assert(GCPhys != GCPhysHead);
1504	Assert(cMax-- > 0); NOREF(cMax);
1505	}
1506	}
1507
1508	/**
1509	* Dumps a ED list. LOG_ENABLED builds only.
1510	*/
1511	DECLINLINE(void) ohciDumpEdList(POHCI pThis, uint32_t GCPhysHead, const char *pszMsg, bool fTDs)
1512	{
1513	uint32_t GCPhys = GCPhysHead;
1514	if (pszMsg)
1515	Log4(("%s:", pszMsg));
1516	for (;;)
1517	{
1518	OHCIED Ed;
1519
1520	/* ED */
1521	Log4((" %#010x={", GCPhys));
1522	if (!GCPhys)
1523	{
1524	Log4(("END}\n"));
1525	return;
1526	}
1527
1528	/* TDs */
1529	ohciReadEd(pThis, GCPhys, &Ed);
1530	if (Ed.hwinfo & ED_HWINFO_ISO)
1531	Log4(("[I]"));
1532	if ((Ed.HeadP & ED_HEAD_HALTED) \|\| (Ed.hwinfo & ED_HWINFO_SKIP))
1533	{
1534	if ((Ed.HeadP & ED_HEAD_HALTED) && (Ed.hwinfo & ED_HWINFO_SKIP))
1535	Log4(("SH}"));
1536	else if (Ed.hwinfo & ED_HWINFO_SKIP)
1537	Log4(("S-}"));
1538	else
1539	Log4(("-H}"));
1540	}
1541	else
1542	{
1543	if (Ed.hwinfo & ED_HWINFO_ISO)
1544	ohciDumpITdQueueCore(pThis, Ed.HeadP & ED_PTR_MASK, Ed.TailP & ED_PTR_MASK, false);
1545	else
1546	ohciDumpTdQueueCore(pThis, Ed.HeadP & ED_PTR_MASK, Ed.TailP & ED_PTR_MASK, false);
1547	Log4(("}"));
1548	}
1549
1550	/* next */
1551	GCPhys = Ed.NextED & ED_PTR_MASK;
1552	Assert(GCPhys != GCPhysHead);
1553	}
1554	Log4(("\n"));
1555	}
1556
1557	#endif /* LOG_ENABLED */
1558
1559
1560	DECLINLINE(int) ohci_in_flight_find_free(POHCI pThis, const int iStart)
1561	{
1562	unsigned i = iStart;
1563	while (i < RT_ELEMENTS(pThis->aInFlight))
1564	{
1565	if (pThis->aInFlight[i].GCPhysTD == 0)
1566	return i;
1567	i++;
1568	}
1569	i = iStart;
1570	while (i-- > 0)
1571	{
1572	if (pThis->aInFlight[i].GCPhysTD == 0)
1573	return i;
1574	}
1575	return -1;
1576	}
1577
1578
1579	/**
1580	* Record an in-flight TD.
1581	*
1582	* @param pThis OHCI instance data.
1583	* @param GCPhysTD Physical address of the TD.
1584	* @param pUrb The URB.
1585	*/
1586	static void ohci_in_flight_add(POHCI pThis, uint32_t GCPhysTD, PVUSBURB pUrb)
1587	{
1588	int i = ohci_in_flight_find_free(pThis, (GCPhysTD >> 4) % RT_ELEMENTS(pThis->aInFlight));
1589	if (i >= 0)
1590	{
1591	#ifdef LOG_ENABLED
1592	pUrb->Hci.u32FrameNo = pThis->HcFmNumber;
1593	#endif
1594	pThis->aInFlight[i].GCPhysTD = GCPhysTD;
1595	pThis->aInFlight[i].pUrb = pUrb;
1596	pThis->cInFlight++;
1597	return;
1598	}
1599	AssertMsgFailed(("Out of space cInFlight=%d!\n", pThis->cInFlight));
1600	}
1601
1602
1603	/**
1604	* Record in-flight TDs for an URB.
1605	*
1606	* @param pThis OHCI instance data.
1607	* @param pUrb The URB.
1608	*/
1609	static void ohci_in_flight_add_urb(POHCI pThis, PVUSBURB pUrb)
1610	{
1611	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
1612	ohci_in_flight_add(pThis, pUrb->Hci.paTds[iTd].TdAddr, pUrb);
1613	}
1614
1615
1616	/**
1617	* Finds a in-flight TD.
1618	*
1619	* @returns Index of the record.
1620	* @returns -1 if not found.
1621	* @param pThis OHCI instance data.
1622	* @param GCPhysTD Physical address of the TD.
1623	* @remark This has to be fast.
1624	*/
1625	static int ohci_in_flight_find(POHCI pThis, uint32_t GCPhysTD)
1626	{
1627	unsigned cLeft = pThis->cInFlight;
1628	unsigned i = (GCPhysTD >> 4) % RT_ELEMENTS(pThis->aInFlight);
1629	const int iLast = i;
1630	while (i < RT_ELEMENTS(pThis->aInFlight))
1631	{
1632	if (pThis->aInFlight[i].GCPhysTD == GCPhysTD)
1633	return i;
1634	if (pThis->aInFlight[i].GCPhysTD)
1635	if (cLeft-- <= 1)
1636	return -1;
1637	i++;
1638	}
1639	i = iLast;
1640	while (i-- > 0)
1641	{
1642	if (pThis->aInFlight[i].GCPhysTD == GCPhysTD)
1643	return i;
1644	if (pThis->aInFlight[i].GCPhysTD)
1645	if (cLeft-- <= 1)
1646	return -1;
1647	}
1648	return -1;
1649	}
1650
1651
1652	/**
1653	* Checks if a TD is in-flight.
1654	*
1655	* @returns true if in flight, false if not.
1656	* @param pThis OHCI instance data.
1657	* @param GCPhysTD Physical address of the TD.
1658	*/
1659	static bool ohciIsTdInFlight(POHCI pThis, uint32_t GCPhysTD)
1660	{
1661	return ohci_in_flight_find(pThis, GCPhysTD) >= 0;
1662	}
1663
1664	/**
1665	* Returns a URB associated with an in-flight TD, if any.
1666	*
1667	* @returns pointer to URB if TD is in flight.
1668	* @returns NULL if not in flight.
1669	* @param pThis OHCI instance data.
1670	* @param GCPhysTD Physical address of the TD.
1671	*/
1672	static PVUSBURB ohciTdInFlightUrb(POHCI pThis, uint32_t GCPhysTD)
1673	{
1674	int i;
1675
1676	i = ohci_in_flight_find(pThis, GCPhysTD);
1677	if ( i >= 0 )
1678	return pThis->aInFlight[i].pUrb;
1679	return NULL;
1680	}
1681
1682	/**
1683	* Removes a in-flight TD.
1684	*
1685	* @returns 0 if found. For logged builds this is the number of frames the TD has been in-flight.
1686	* @returns -1 if not found.
1687	* @param pThis OHCI instance data.
1688	* @param GCPhysTD Physical address of the TD.
1689	*/
1690	static int ohci_in_flight_remove(POHCI pThis, uint32_t GCPhysTD)
1691	{
1692	int i = ohci_in_flight_find(pThis, GCPhysTD);
1693	if (i >= 0)
1694	{
1695	#ifdef LOG_ENABLED
1696	const int cFramesInFlight = pThis->HcFmNumber - pThis->aInFlight[i].pUrb->Hci.u32FrameNo;
1697	#else
1698	const int cFramesInFlight = 0;
1699	#endif
1700	Log2(("ohci_in_flight_remove: reaping TD=%#010x %d frames (%#010x-%#010x)\n",
1701	GCPhysTD, cFramesInFlight, pThis->aInFlight[i].pUrb->Hci.u32FrameNo, pThis->HcFmNumber));
1702	pThis->aInFlight[i].GCPhysTD = 0;
1703	pThis->aInFlight[i].pUrb = NULL;
1704	pThis->cInFlight--;
1705	return cFramesInFlight;
1706	}
1707	AssertMsgFailed(("TD %#010x is not in flight\n", GCPhysTD));
1708	return -1;
1709	}
1710
1711
1712	/**
1713	* Removes all TDs associated with a URB from the in-flight tracking.
1714	*
1715	* @returns 0 if found. For logged builds this is the number of frames the TD has been in-flight.
1716	* @returns -1 if not found.
1717	* @param pThis OHCI instance data.
1718	* @param pUrb The URB.
1719	*/
1720	static int ohci_in_flight_remove_urb(POHCI pThis, PVUSBURB pUrb)
1721	{
1722	int cFramesInFlight = ohci_in_flight_remove(pThis, pUrb->Hci.paTds[0].TdAddr);
1723	if (pUrb->Hci.cTds > 1)
1724	{
1725	for (unsigned iTd = 1; iTd < pUrb->Hci.cTds; iTd++)
1726	if (ohci_in_flight_remove(pThis, pUrb->Hci.paTds[iTd].TdAddr) < 0)
1727	cFramesInFlight = -1;
1728	}
1729	return cFramesInFlight;
1730	}
1731
1732
1733	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
1734
1735	/**
1736	* Empties the in-done-queue.
1737	* @param pThis OHCI instance data.
1738	*/
1739	static void ohci_in_done_queue_zap(POHCI pThis)
1740	{
1741	pThis->cInDoneQueue = 0;
1742	}
1743
1744	/**
1745	* Finds a TD in the in-done-queue.
1746	* @returns >= 0 on success.
1747	* @returns -1 if not found.
1748	* @param pThis OHCI instance data.
1749	* @param GCPhysTD Physical address of the TD.
1750	*/
1751	static int ohci_in_done_queue_find(POHCI pThis, uint32_t GCPhysTD)
1752	{
1753	unsigned i = pThis->cInDoneQueue;
1754	while (i-- > 0)
1755	if (pThis->aInDoneQueue[i].GCPhysTD == GCPhysTD)
1756	return i;
1757	return -1;
1758	}
1759
1760	/**
1761	* Checks that the specified TD is not in the done queue.
1762	* @param pThis OHCI instance data.
1763	* @param GCPhysTD Physical address of the TD.
1764	*/
1765	static bool ohci_in_done_queue_check(POHCI pThis, uint32_t GCPhysTD)
1766	{
1767	int i = ohci_in_done_queue_find(pThis, GCPhysTD);
1768	#if 0
1769	/* This condition has been observed with the USB tablet emulation or with
1770	* a real USB mouse and an SMP XP guest. I am also not sure if this is
1771	* really a problem for us. The assertion checks that the guest doesn't
1772	* re-submit a TD which is still in the done queue. It seems to me that
1773	* this should only be a problem if we either keep track of TDs in the done
1774	* queue somewhere else as well (in which case we should also free those
1775	* references in time, and I can't see any code doing that) or if we
1776	* manipulate TDs in the done queue in some way that might fail if they are
1777	* re-submitted (can't see anything like that either).
1778	*/
1779	AssertMsg(i < 0, ("TD %#010x (i=%d)\n", GCPhysTD, i));
1780	#endif
1781	return i < 0;
1782	}
1783
1784
1785	# ifdef VBOX_STRICT
1786	/**
1787	* Adds a TD to the in-done-queue tracking, checking that it's not there already.
1788	* @param pThis OHCI instance data.
1789	* @param GCPhysTD Physical address of the TD.
1790	*/
1791	static void ohci_in_done_queue_add(POHCI pThis, uint32_t GCPhysTD)
1792	{
1793	Assert(pThis->cInDoneQueue + 1 <= RT_ELEMENTS(pThis->aInDoneQueue));
1794	if (ohci_in_done_queue_check(pThis, GCPhysTD))
1795	pThis->aInDoneQueue[pThis->cInDoneQueue++].GCPhysTD = GCPhysTD;
1796	}
1797	# endif /* VBOX_STRICT */
1798	#endif /* defined(VBOX_STRICT) \|\| defined(LOG_ENABLED) */
1799
1800
1801	/**
1802	* OHCI Transport Buffer - represents a OHCI Transport Descriptor (TD).
1803	* A TD may be split over max 2 pages.
1804	*/
1805	typedef struct OHCIBUF
1806	{
1807	/** Pages involved. */
1808	struct OHCIBUFVEC
1809	{
1810	/** The 32-bit physical address of this part. */
1811	uint32_t Addr;
1812	/** The length. */
1813	uint32_t cb;
1814	} aVecs[2];
1815	/** Number of valid entries in aVecs. */
1816	uint32_t cVecs;
1817	/** The total length. */
1818	uint32_t cbTotal;
1819	} OHCIBUF, *POHCIBUF;
1820
1821
1822	/**
1823	* Sets up a OHCI transport buffer.
1824	*
1825	* @param pBuf Ohci buffer.
1826	* @param cbp Current buffer pointer. 32-bit physical address.
1827	* @param be Last byte in buffer (BufferEnd). 32-bit physical address.
1828	*/
1829	static void ohciBufInit(POHCIBUF pBuf, uint32_t cbp, uint32_t be)
1830	{
1831	if (!cbp \|\| !be)
1832	{
1833	pBuf->cVecs = 0;
1834	pBuf->cbTotal = 0;
1835	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=0 EMPTY\n", cbp, be));
1836	}
1837	else if ((cbp & ~0xfff) == (be & ~0xfff))
1838	{
1839	pBuf->aVecs[0].Addr = cbp;
1840	pBuf->aVecs[0].cb = (be - cbp) + 1;
1841	pBuf->cVecs = 1;
1842	pBuf->cbTotal = pBuf->aVecs[0].cb;
1843	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=%u\n", cbp, be, pBuf->cbTotal));
1844	}
1845	else
1846	{
1847	pBuf->aVecs[0].Addr = cbp;
1848	pBuf->aVecs[0].cb = 0x1000 - (cbp & 0xfff);
1849	pBuf->aVecs[1].Addr = be & ~0xfff;
1850	pBuf->aVecs[1].cb = (be & 0xfff) + 1;
1851	pBuf->cVecs = 2;
1852	pBuf->cbTotal = pBuf->aVecs[0].cb + pBuf->aVecs[1].cb;
1853	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=%u PAGE FLIP\n", cbp, be, pBuf->cbTotal));
1854	}
1855	}
1856
1857	/**
1858	* Updates a OHCI transport buffer.
1859	*
1860	* This is called upon completion to adjust the sector lengths if
1861	* the total length has changed. (received less then we had space for
1862	* or a partial transfer.)
1863	*
1864	* @param pBuf The buffer to update. cbTotal contains the new total on input.
1865	* While the aVecs[*].cb members is updated upon return.
1866	*/
1867	static void ohciBufUpdate(POHCIBUF pBuf)
1868	{
1869	for (uint32_t i = 0, cbCur = 0; i < pBuf->cVecs; i++)
1870	{
1871	if (cbCur + pBuf->aVecs[i].cb > pBuf->cbTotal)
1872	{
1873	pBuf->aVecs[i].cb = pBuf->cbTotal - cbCur;
1874	pBuf->cVecs = i + 1;
1875	return;
1876	}
1877	cbCur += pBuf->aVecs[i].cb;
1878	}
1879	}
1880
1881
1882	/** A worker for ohciUnlinkTds(). */
1883	static bool ohciUnlinkIsochronousTdInList(POHCI pThis, uint32_t TdAddr, POHCIITD pITd, POHCIED pEd)
1884	{
1885	const uint32_t LastTdAddr = pEd->TailP & ED_PTR_MASK;
1886	Log(("ohciUnlinkIsocTdInList: Unlinking non-head ITD! TdAddr=%#010RX32 HeadTdAddr=%#010RX32 LastEdAddr=%#010RX32\n",
1887	TdAddr, pEd->HeadP & ED_PTR_MASK, LastTdAddr));
1888	AssertMsgReturn(LastTdAddr != TdAddr, ("TdAddr=%#010RX32\n", TdAddr), false);
1889
1890	uint32_t cMax = 256;
1891	uint32_t CurTdAddr = pEd->HeadP & ED_PTR_MASK;
1892	while ( CurTdAddr != LastTdAddr
1893	&& cMax-- > 0)
1894	{
1895	OHCIITD ITd;
1896	ohciReadITd(pThis, CurTdAddr, &ITd);
1897	if ((ITd.NextTD & ED_PTR_MASK) == TdAddr)
1898	{
1899	ITd.NextTD = (pITd->NextTD & ED_PTR_MASK) \| (ITd.NextTD & ~ED_PTR_MASK);
1900	ohciWriteITd(pThis, CurTdAddr, &ITd, "ohciUnlinkIsocTdInList");
1901	pITd->NextTD &= ~ED_PTR_MASK;
1902	return true;
1903	}
1904
1905	/* next */
1906	CurTdAddr = ITd.NextTD & ED_PTR_MASK;
1907	}
1908
1909	Log(("ohciUnlinkIsocTdInList: TdAddr=%#010RX32 wasn't found in the list!!! (cMax=%d)\n", TdAddr, cMax));
1910	return false;
1911	}
1912
1913
1914	/** A worker for ohciUnlinkTds(). */
1915	static bool ohciUnlinkGeneralTdInList(POHCI pThis, uint32_t TdAddr, POHCITD pTd, POHCIED pEd)
1916	{
1917	const uint32_t LastTdAddr = pEd->TailP & ED_PTR_MASK;
1918	Log(("ohciUnlinkGeneralTdInList: Unlinking non-head TD! TdAddr=%#010RX32 HeadTdAddr=%#010RX32 LastEdAddr=%#010RX32\n",
1919	TdAddr, pEd->HeadP & ED_PTR_MASK, LastTdAddr));
1920	AssertMsgReturn(LastTdAddr != TdAddr, ("TdAddr=%#010RX32\n", TdAddr), false);
1921
1922	uint32_t cMax = 256;
1923	uint32_t CurTdAddr = pEd->HeadP & ED_PTR_MASK;
1924	while ( CurTdAddr != LastTdAddr
1925	&& cMax-- > 0)
1926	{
1927	OHCITD Td;
1928	ohciReadTd(pThis, CurTdAddr, &Td);
1929	if ((Td.NextTD & ED_PTR_MASK) == TdAddr)
1930	{
1931	Td.NextTD = (pTd->NextTD & ED_PTR_MASK) \| (Td.NextTD & ~ED_PTR_MASK);
1932	ohciWriteTd(pThis, CurTdAddr, &Td, "ohciUnlinkGeneralTdInList");
1933	pTd->NextTD &= ~ED_PTR_MASK;
1934	return true;
1935	}
1936
1937	/* next */
1938	CurTdAddr = Td.NextTD & ED_PTR_MASK;
1939	}
1940
1941	Log(("ohciUnlinkGeneralTdInList: TdAddr=%#010RX32 wasn't found in the list!!! (cMax=%d)\n", TdAddr, cMax));
1942	return false;
1943	}
1944
1945
1946	/**
1947	* Unlinks the TDs that makes up the URB from the ED.
1948	*
1949	* @returns success indicator. true if successfully unlinked.
1950	* @returns false if the TD was not found in the list.
1951	*/
1952	static bool ohciUnlinkTds(POHCI pThis, PVUSBURB pUrb, POHCIED pEd)
1953	{
1954	/*
1955	* Don't unlink more than once.
1956	*/
1957	if (pUrb->Hci.fUnlinked)
1958	return true;
1959	pUrb->Hci.fUnlinked = true;
1960
1961	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
1962	{
1963	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
1964	{
1965	POHCIITD pITd = (POHCIITD)&pUrb->Hci.paTds[iTd].TdCopy[0];
1966	const uint32_t ITdAddr = pUrb->Hci.paTds[iTd].TdAddr;
1967
1968	/*
1969	* Unlink the TD from the ED list.
1970	* The normal case is that it's at the head of the list.
1971	*/
1972	Assert((ITdAddr & ED_PTR_MASK) == ITdAddr);
1973	if ((pEd->HeadP & ED_PTR_MASK) == ITdAddr)
1974	{
1975	pEd->HeadP = (pITd->NextTD & ED_PTR_MASK) \| (pEd->HeadP & ~ED_PTR_MASK);
1976	pITd->NextTD &= ~ED_PTR_MASK;
1977	}
1978	else
1979	{
1980	/*
1981	* It's probably somewhere in the list, not a unlikely situation with
1982	* the current isochronous code.
1983	*/
1984	if (!ohciUnlinkIsochronousTdInList(pThis, ITdAddr, pITd, pEd))
1985	return false;
1986	}
1987	}
1988	}
1989	else
1990	{
1991	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
1992	{
1993	POHCITD pTd = (POHCITD)&pUrb->Hci.paTds[iTd].TdCopy[0];
1994	const uint32_t TdAddr = pUrb->Hci.paTds[iTd].TdAddr;
1995
1996	/** @todo r=bird: Messing with the toggle flag in prepare is probably not correct
1997	* when we encounter a STALL error, 4.3.1.3.7.2: "If an endpoint returns a STALL
1998	* PID, the Host Controller retires the General TD with the ConditionCode set
1999	* to STALL and halts the endpoint. The CurrentBufferPointer, ErrorCount, and
2000	* dataToggle fields retain the values that they had at the start of the
2001	* transaction." */
2002
2003	/* update toggle and set data toggle carry */
2004	pTd->hwinfo &= ~TD_HWINFO_TOGGLE;
2005	if ( pTd->hwinfo & TD_HWINFO_TOGGLE_HI )
2006	{
2007	if ( !!(pTd->hwinfo & TD_HWINFO_TOGGLE_LO) ) /** @todo r=bird: is it just me or doesn't this make sense at all? */
2008	pTd->hwinfo \|= TD_HWINFO_TOGGLE_LO;
2009	else
2010	pTd->hwinfo &= ~TD_HWINFO_TOGGLE_LO;
2011	}
2012	else
2013	{
2014	if ( !!(pEd->HeadP & ED_HEAD_CARRY) ) /** @todo r=bird: is it just me or doesn't this make sense at all? */
2015	pEd->HeadP \|= ED_HEAD_CARRY;
2016	else
2017	pEd->HeadP &= ~ED_HEAD_CARRY;
2018	}
2019
2020	/*
2021	* Unlink the TD from the ED list.
2022	* The normal case is that it's at the head of the list.
2023	*/
2024	Assert((TdAddr & ED_PTR_MASK) == TdAddr);
2025	if ((pEd->HeadP & ED_PTR_MASK) == TdAddr)
2026	{
2027	pEd->HeadP = (pTd->NextTD & ED_PTR_MASK) \| (pEd->HeadP & ~ED_PTR_MASK);
2028	pTd->NextTD &= ~ED_PTR_MASK;
2029	}
2030	else
2031	{
2032	/*
2033	* The TD is probably somewhere in the list.
2034	*
2035	* This shouldn't ever happen unless there was a failure! Even on failure,
2036	* we can screw up the HCD state by picking out a TD from within the list
2037	* like this! If this turns out to be a problem, we have to find a better
2038	* solution. For now we'll hope the HCD handles it...
2039	*/
2040	if (!ohciUnlinkGeneralTdInList(pThis, TdAddr, pTd, pEd))
2041	return false;
2042	}
2043
2044	/*
2045	* Only unlink the first TD on error.
2046	* See comment in ohciRhXferCompleteGeneralURB().
2047	*/
2048	if (pUrb->enmStatus != VUSBSTATUS_OK)
2049	break;
2050	}
2051	}
2052
2053	return true;
2054	}
2055
2056
2057	/**
2058	* Checks that the transport descriptors associated with the URB
2059	* hasn't been changed in any way indicating that they may have been canceled.
2060	*
2061	* This rountine also updates the TD copies contained within the URB.
2062	*
2063	* @returns true if the URB has been canceled, otherwise false.
2064	* @param pThis The OHCI instance.
2065	* @param pUrb The URB in question.
2066	* @param pEd The ED pointer (optional).
2067	*/
2068	static bool ohciHasUrbBeenCanceled(POHCI pThis, PVUSBURB pUrb, PCOHCIED pEd)
2069	{
2070	if (!pUrb)
2071	return true;
2072
2073	/*
2074	* Make sure we've got an endpoint descriptor so we can
2075	* check for tail TDs.
2076	*/
2077	OHCIED Ed;
2078	if (!pEd)
2079	{
2080	ohciReadEd(pThis, pUrb->Hci.EdAddr, &Ed);
2081	pEd = &Ed;
2082	}
2083
2084	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2085	{
2086	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
2087	{
2088	union
2089	{
2090	OHCIITD ITd;
2091	uint32_t au32[8];
2092	} u;
2093	if ( (pUrb->Hci.paTds[iTd].TdAddr & ED_PTR_MASK)
2094	== (pEd->TailP & ED_PTR_MASK))
2095	{
2096	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled (tail)! [iso]\n",
2097	pUrb->pszDesc, iTd, pUrb->Hci.cTds, pUrb->Hci.paTds[iTd].TdAddr));
2098	STAM_COUNTER_INC(&pThis->StatCanceledIsocUrbs);
2099	return true;
2100	}
2101	ohciReadITd(pThis, pUrb->Hci.paTds[iTd].TdAddr, &u.ITd);
2102	if ( u.au32[0] != pUrb->Hci.paTds[iTd].TdCopy[0] /* hwinfo */
2103	\|\| u.au32[1] != pUrb->Hci.paTds[iTd].TdCopy[1] /* bp0 */
2104	\|\| u.au32[3] != pUrb->Hci.paTds[iTd].TdCopy[3] /* be */
2105	\|\| ( u.au32[2] != pUrb->Hci.paTds[iTd].TdCopy[2] /* NextTD */
2106	&& iTd + 1 < pUrb->Hci.cTds /* ignore the last one */)
2107	\|\| u.au32[4] != pUrb->Hci.paTds[iTd].TdCopy[4] /* psw0&1 */
2108	\|\| u.au32[5] != pUrb->Hci.paTds[iTd].TdCopy[5] /* psw2&3 */
2109	\|\| u.au32[6] != pUrb->Hci.paTds[iTd].TdCopy[6] /* psw4&5 */
2110	\|\| u.au32[7] != pUrb->Hci.paTds[iTd].TdCopy[7] /* psw6&7 */
2111	)
2112	{
2113	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled! [iso]\n",
2114	pUrb->pszDesc, iTd, pUrb->Hci.cTds, pUrb->Hci.paTds[iTd].TdAddr));
2115	Log2((" %.*Rhxs (cur)\n"
2116	"!= %.*Rhxs (copy)\n",
2117	sizeof(u.ITd), &u.ITd, sizeof(u.ITd), &pUrb->Hci.paTds[iTd].TdCopy[0]));
2118	STAM_COUNTER_INC(&pThis->StatCanceledIsocUrbs);
2119	return true;
2120	}
2121	pUrb->Hci.paTds[iTd].TdCopy[2] = u.au32[2];
2122	}
2123	}
2124	else
2125	{
2126	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
2127	{
2128	union
2129	{
2130	OHCITD Td;
2131	uint32_t au32[4];
2132	} u;
2133	if ( (pUrb->Hci.paTds[iTd].TdAddr & ED_PTR_MASK)
2134	== (pEd->TailP & ED_PTR_MASK))
2135	{
2136	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled (tail)!\n",
2137	pUrb->pszDesc, iTd, pUrb->Hci.cTds, pUrb->Hci.paTds[iTd].TdAddr));
2138	STAM_COUNTER_INC(&pThis->StatCanceledGenUrbs);
2139	return true;
2140	}
2141	ohciReadTd(pThis, pUrb->Hci.paTds[iTd].TdAddr, &u.Td);
2142	if ( u.au32[0] != pUrb->Hci.paTds[iTd].TdCopy[0] /* hwinfo */
2143	\|\| u.au32[1] != pUrb->Hci.paTds[iTd].TdCopy[1] /* cbp */
2144	\|\| u.au32[3] != pUrb->Hci.paTds[iTd].TdCopy[3] /* be */
2145	\|\| ( u.au32[2] != pUrb->Hci.paTds[iTd].TdCopy[2] /* NextTD */
2146	&& iTd + 1 < pUrb->Hci.cTds /* ignore the last one */)
2147	)
2148	{
2149	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled!\n",
2150	pUrb->pszDesc, iTd, pUrb->Hci.cTds, pUrb->Hci.paTds[iTd].TdAddr));
2151	Log2((" %.*Rhxs (cur)\n"
2152	"!= %.*Rhxs (copy)\n",
2153	sizeof(u.Td), &u.Td, sizeof(u.Td), &pUrb->Hci.paTds[iTd].TdCopy[0]));
2154	STAM_COUNTER_INC(&pThis->StatCanceledGenUrbs);
2155	return true;
2156	}
2157	pUrb->Hci.paTds[iTd].TdCopy[2] = u.au32[2];
2158	}
2159	}
2160	return false;
2161	}
2162
2163
2164	/**
2165	* Calculate frame timer variables given a frame rate (1,000 Hz is the full speed).
2166	*/
2167	static void ohciCalcTimerIntervals(POHCI pThis, uint32_t u32FrameRate)
2168	{
2169	Assert(u32FrameRate <= OHCI_DEFAULT_TIMER_FREQ);
2170
2171	pThis->cTicksPerFrame = pThis->u64TimerHz / u32FrameRate;
2172	if (!pThis->cTicksPerFrame)
2173	pThis->cTicksPerFrame = 1;
2174	pThis->cTicksPerUsbTick = pThis->u64TimerHz >= VUSB_BUS_HZ ? pThis->u64TimerHz / VUSB_BUS_HZ : 1;
2175	pThis->nsWait = RT_NS_1SEC / u32FrameRate;
2176	pThis->uFrameRate = u32FrameRate;
2177	}
2178
2179
2180	/**
2181	* Calculates the new frame rate based on the idle detection and number of idle
2182	* cycles.
2183	*
2184	* @returns nothing.
2185	* @param pThis The OHCI device data.
2186	*/
2187	static bool ohciFramerateCalcNew(POHCI pThis)
2188	{
2189	uint32_t uNewFrameRate = pThis->uFrameRate;
2190
2191	/*
2192	* Adjust the frame timer interval based on idle detection.
2193	*/
2194	if (pThis->fIdle)
2195	{
2196	pThis->cIdleCycles++;
2197	/* Set the new frame rate based on how long we've been idle. Tunable. */
2198	switch (pThis->cIdleCycles)
2199	{
2200	case 4: uNewFrameRate = 500; break; /* 2ms interval */
2201	case 16:uNewFrameRate = 125; break; /* 8ms interval */
2202	case 24:uNewFrameRate = 50; break; /* 20ms interval */
2203	default: break;
2204	}
2205	/* Avoid overflow. */
2206	if (pThis->cIdleCycles > 60000)
2207	pThis->cIdleCycles = 20000;
2208	}
2209	else
2210	{
2211	if (pThis->cIdleCycles)
2212	{
2213	pThis->cIdleCycles = 0;
2214	uNewFrameRate = OHCI_DEFAULT_TIMER_FREQ;
2215	}
2216	}
2217	if (uNewFrameRate != pThis->uFrameRate)
2218	{
2219	LogFlow(("Frame rate changed from %u to %u\n", pThis->uFrameRate, uNewFrameRate));
2220	ohciCalcTimerIntervals(pThis, uNewFrameRate);
2221	return true;
2222	}
2223	return false;
2224	}
2225
2226
2227	/**
2228	* Returns the OHCI_CC_* corresponding to the VUSB status code.
2229	*
2230	* @returns OHCI_CC_* value.
2231	* @param enmStatus The VUSB status code.
2232	*/
2233	static uint32_t ohciVUsbStatus2OhciStatus(VUSBSTATUS enmStatus)
2234	{
2235	switch (enmStatus)
2236	{
2237	case VUSBSTATUS_OK: return OHCI_CC_NO_ERROR;
2238	case VUSBSTATUS_STALL: return OHCI_CC_STALL;
2239	case VUSBSTATUS_CRC: return OHCI_CC_CRC;
2240	case VUSBSTATUS_DATA_UNDERRUN: return OHCI_CC_DATA_UNDERRUN;
2241	case VUSBSTATUS_DATA_OVERRUN: return OHCI_CC_DATA_OVERRUN;
2242	case VUSBSTATUS_DNR: return OHCI_CC_DNR;
2243	case VUSBSTATUS_NOT_ACCESSED: return OHCI_CC_NOT_ACCESSED_1;
2244	default:
2245	Log(("pUrb->enmStatus=%#x!!!\n", enmStatus));
2246	return OHCI_CC_DNR;
2247	}
2248	}
2249
2250	/**
2251	* Worker for ohciRhXferCompletion that handles the completion of
2252	* a URB made up of isochronous TDs.
2253	*
2254	* In general, all URBs should have status OK.
2255	*/
2256	static void ohciRhXferCompleteIsochronousURB(POHCI pThis, PVUSBURB pUrb, POHCIED pEd, int cFmAge)
2257	{
2258	/*
2259	* Copy the data back (if IN operation) and update the TDs.
2260	*/
2261	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
2262	{
2263	POHCIITD pITd = (POHCIITD)&pUrb->Hci.paTds[iTd].TdCopy[0];
2264	const uint32_t ITdAddr = pUrb->Hci.paTds[iTd].TdAddr;
2265	const unsigned cFrames = ((pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
2266	unsigned R = (pUrb->Hci.u32FrameNo & ITD_HWINFO_SF) - (pITd->HwInfo & ITD_HWINFO_SF);
2267	if (R >= 8)
2268	R = 0; /* submitted ahead of time. */
2269
2270	/*
2271	* Only one case of TD level condition code is document, so
2272	* just set NO_ERROR here to reduce number duplicate code.
2273	*/
2274	pITd->HwInfo &= ~TD_HWINFO_CC;
2275	AssertCompile(OHCI_CC_NO_ERROR == 0);
2276
2277	if (pUrb->enmStatus == VUSBSTATUS_OK)
2278	{
2279	/*
2280	* Update the frames and copy back the data.
2281	* We assume that we don't get incorrect lengths here.
2282	*/
2283	for (unsigned i = 0; i < cFrames; i++)
2284	{
2285	if ( i < R
2286	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_NOT_ACCESSED)
2287	{
2288	/* It should already be NotAccessed. */
2289	pITd->aPSW[i] \|= 0xe000; /* (Don't touch the 12th bit.) */
2290	continue;
2291	}
2292
2293	/* Update the PSW (save the offset first in case of a IN). */
2294	uint32_t off = pITd->aPSW[i] & ITD_PSW_OFFSET;
2295	pITd->aPSW[i] = ohciVUsbStatus2OhciStatus(pUrb->aIsocPkts[i - R].enmStatus)
2296	>> (TD_HWINFO_CC_SHIFT - ITD_PSW_CC_SHIFT);
2297
2298	if ( pUrb->enmDir == VUSBDIRECTION_IN
2299	&& ( pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_OK
2300	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_DATA_UNDERRUN
2301	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_DATA_OVERRUN))
2302	{
2303	/* Set the size. */
2304	const unsigned cb = pUrb->aIsocPkts[i - R].cb;
2305	pITd->aPSW[i] \|= cb & ITD_PSW_SIZE;
2306	/* Copy data. */
2307	if (cb)
2308	{
2309	uint8_t *pb = &pUrb->abData[pUrb->aIsocPkts[i - R].off];
2310	if (off + cb > 0x1000)
2311	{
2312	if (off < 0x1000)
2313	{
2314	/* both */
2315	const unsigned cb0 = 0x1000 - off;
2316	ohciPhysWrite(pThis, (pITd->BP0 & ITD_BP0_MASK) + off, pb, cb0);
2317	ohciPhysWrite(pThis, pITd->BE & ITD_BP0_MASK, pb + cb0, cb - cb0);
2318	}
2319	else /* only in the 2nd page */
2320	ohciPhysWrite(pThis, (pITd->BE & ITD_BP0_MASK) + (off & ITD_BP0_MASK), pb, cb);
2321	}
2322	else /* only in the 1st page */
2323	ohciPhysWrite(pThis, (pITd->BP0 & ITD_BP0_MASK) + off, pb, cb);
2324	Log5(("packet %d: off=%#x cb=%#x pb=%p (%#x)\n"
2325	"%.*Rhxd\n",
2326	i + R, off, cb, pb, pb - &pUrb->abData[0], cb, pb));
2327	//off += cb;
2328	}
2329	}
2330	}
2331
2332	/*
2333	* If the last package ended with a NotAccessed status, set ITD CC
2334	* to DataOverrun to indicate scheduling overrun.
2335	*/
2336	if (pUrb->aIsocPkts[pUrb->cIsocPkts - 1].enmStatus == VUSBSTATUS_NOT_ACCESSED)
2337	pITd->HwInfo \|= OHCI_CC_DATA_OVERRUN;
2338	}
2339	else
2340	{
2341	Log(("DevOHCI: Taking untested code path at line %d...\n", __LINE__));
2342	/*
2343	* Most status codes only applies to the individual packets.
2344	*
2345	* If we get a URB level error code of this kind, we'll distribute
2346	* it to all the packages unless some other status is available for
2347	* a package. This is a bit fuzzy, and we will get rid of this code
2348	* before long!
2349	*/
2350	//if (pUrb->enmStatus != VUSBSTATUS_DATA_OVERRUN)
2351	{
2352	const unsigned uCC = ohciVUsbStatus2OhciStatus(pUrb->enmStatus)
2353	>> (TD_HWINFO_CC_SHIFT - ITD_PSW_CC_SHIFT);
2354	for (unsigned i = 0; i < cFrames; i++)
2355	pITd->aPSW[i] = uCC;
2356	}
2357	//else
2358	// pITd->HwInfo \|= ohciVUsbStatus2OhciStatus(pUrb->enmStatus);
2359	}
2360
2361	/*
2362	* Update the done queue interrupt timer.
2363	*/
2364	uint32_t DoneInt = (pITd->HwInfo & ITD_HWINFO_DI) >> ITD_HWINFO_DI_SHIFT;
2365	if ((pITd->HwInfo & TD_HWINFO_CC) != OHCI_CC_NO_ERROR)
2366	DoneInt = 0; /* It's cleared on error. */
2367	if ( DoneInt != 0x7
2368	&& DoneInt < pThis->dqic)
2369	pThis->dqic = DoneInt;
2370
2371	/*
2372	* Move on to the done list and write back the modified TD.
2373	*/
2374	#ifdef LOG_ENABLED
2375	if (!pThis->done)
2376	pThis->u32FmDoneQueueTail = pThis->HcFmNumber;
2377	# ifdef VBOX_STRICT
2378	ohci_in_done_queue_add(pThis, ITdAddr);
2379	# endif
2380	#endif
2381	pITd->NextTD = pThis->done;
2382	pThis->done = ITdAddr;
2383
2384	Log(("%s: ohciRhXferCompleteIsochronousURB: ITdAddr=%#010x EdAddr=%#010x SF=%#x (%#x) CC=%#x FC=%d "
2385	"psw0=%x:%x psw1=%x:%x psw2=%x:%x psw3=%x:%x psw4=%x:%x psw5=%x:%x psw6=%x:%x psw7=%x:%x R=%d\n",
2386	pUrb->pszDesc, ITdAddr,
2387	pUrb->Hci.EdAddr,
2388	pITd->HwInfo & ITD_HWINFO_SF, pThis->HcFmNumber,
2389	(pITd->HwInfo & ITD_HWINFO_CC) >> ITD_HWINFO_CC_SHIFT,
2390	(pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT,
2391	pITd->aPSW[0] >> ITD_PSW_CC_SHIFT, pITd->aPSW[0] & ITD_PSW_SIZE,
2392	pITd->aPSW[1] >> ITD_PSW_CC_SHIFT, pITd->aPSW[1] & ITD_PSW_SIZE,
2393	pITd->aPSW[2] >> ITD_PSW_CC_SHIFT, pITd->aPSW[2] & ITD_PSW_SIZE,
2394	pITd->aPSW[3] >> ITD_PSW_CC_SHIFT, pITd->aPSW[3] & ITD_PSW_SIZE,
2395	pITd->aPSW[4] >> ITD_PSW_CC_SHIFT, pITd->aPSW[4] & ITD_PSW_SIZE,
2396	pITd->aPSW[5] >> ITD_PSW_CC_SHIFT, pITd->aPSW[5] & ITD_PSW_SIZE,
2397	pITd->aPSW[6] >> ITD_PSW_CC_SHIFT, pITd->aPSW[6] & ITD_PSW_SIZE,
2398	pITd->aPSW[7] >> ITD_PSW_CC_SHIFT, pITd->aPSW[7] & ITD_PSW_SIZE,
2399	R));
2400	ohciWriteITd(pThis, ITdAddr, pITd, "retired");
2401	}
2402	}
2403
2404
2405	/**
2406	* Worker for ohciRhXferCompletion that handles the completion of
2407	* a URB made up of general TDs.
2408	*/
2409	static void ohciRhXferCompleteGeneralURB(POHCI pThis, PVUSBURB pUrb, POHCIED pEd, int cFmAge)
2410	{
2411	/*
2412	* Copy the data back (if IN operation) and update the TDs.
2413	*/
2414	unsigned cbLeft = pUrb->cbData;
2415	uint8_t *pb = &pUrb->abData[0];
2416	for (unsigned iTd = 0; iTd < pUrb->Hci.cTds; iTd++)
2417	{
2418	POHCITD pTd = (POHCITD)&pUrb->Hci.paTds[iTd].TdCopy[0];
2419	const uint32_t TdAddr = pUrb->Hci.paTds[iTd].TdAddr;
2420
2421	/*
2422	* Setup a ohci transfer buffer and calc the new cbp value.
2423	*/
2424	OHCIBUF Buf;
2425	ohciBufInit(&Buf, pTd->cbp, pTd->be);
2426	uint32_t NewCbp;
2427	if (cbLeft >= Buf.cbTotal)
2428	NewCbp = 0;
2429	else
2430	{
2431	/* (len may have changed for short transfers) */
2432	Buf.cbTotal = cbLeft;
2433	ohciBufUpdate(&Buf);
2434	Assert(Buf.cVecs >= 1);
2435	NewCbp = Buf.aVecs[Buf.cVecs-1].Addr + Buf.aVecs[Buf.cVecs-1].cb;
2436	}
2437
2438	/*
2439	* Write back IN buffers.
2440	*/
2441	if ( pUrb->enmDir == VUSBDIRECTION_IN
2442	&& ( pUrb->enmStatus == VUSBSTATUS_OK
2443	\|\| pUrb->enmStatus == VUSBSTATUS_DATA_OVERRUN
2444	\|\| pUrb->enmStatus == VUSBSTATUS_DATA_UNDERRUN)
2445	&& Buf.cbTotal > 0)
2446	{
2447	Assert(Buf.cVecs > 0);
2448	ohciPhysWrite(pThis, Buf.aVecs[0].Addr, pb, Buf.aVecs[0].cb);
2449	if (Buf.cVecs > 1)
2450	ohciPhysWrite(pThis, Buf.aVecs[1].Addr, pb + Buf.aVecs[0].cb, Buf.aVecs[1].cb);
2451	}
2452
2453	/* advance the data buffer. */
2454	cbLeft -= Buf.cbTotal;
2455	pb += Buf.cbTotal;
2456
2457	/*
2458	* Set writeback field.
2459	*/
2460	/* zero out writeback fields for retirement */
2461	pTd->hwinfo &= ~TD_HWINFO_CC;
2462	/* always update the CurrentBufferPointer; essential for underrun/overrun errors */
2463	pTd->cbp = NewCbp;
2464
2465	if (pUrb->enmStatus == VUSBSTATUS_OK)
2466	{
2467	pTd->hwinfo &= ~TD_HWINFO_ERRORS;
2468
2469	/* update done queue interrupt timer */
2470	uint32_t DoneInt = (pTd->hwinfo & TD_HWINFO_DI) >> 21;
2471	if ( DoneInt != 0x7
2472	&& DoneInt < pThis->dqic)
2473	pThis->dqic = DoneInt;
2474	Log(("%s: ohciRhXferCompleteGeneralURB: ED=%#010x TD=%#010x Age=%d enmStatus=%d cbTotal=%#x NewCbp=%#010RX32 dqic=%d\n",
2475	pUrb->pszDesc, pUrb->Hci.EdAddr, TdAddr, cFmAge, pUrb->enmStatus, Buf.cbTotal, NewCbp, pThis->dqic));
2476	}
2477	else
2478	{
2479	Log(("%s: ohciRhXferCompleteGeneralURB: HALTED ED=%#010x TD=%#010x (age %d) pUrb->enmStatus=%d\n",
2480	pUrb->pszDesc, pUrb->Hci.EdAddr, TdAddr, cFmAge, pUrb->enmStatus));
2481	pEd->HeadP \|= ED_HEAD_HALTED;
2482	pThis->dqic = 0; /* "If the Transfer Descriptor is being retired with an error,
2483	* then the Done Queue Interrupt Counter is cleared as if the
2484	* InterruptDelay field were zero."
2485	*/
2486	switch (pUrb->enmStatus)
2487	{
2488	case VUSBSTATUS_STALL:
2489	pTd->hwinfo \|= OHCI_CC_STALL;
2490	break;
2491	case VUSBSTATUS_CRC:
2492	pTd->hwinfo \|= OHCI_CC_CRC;
2493	break;
2494	case VUSBSTATUS_DATA_UNDERRUN:
2495	pTd->hwinfo \|= OHCI_CC_DATA_UNDERRUN;
2496	break;
2497	case VUSBSTATUS_DATA_OVERRUN:
2498	pTd->hwinfo \|= OHCI_CC_DATA_OVERRUN;
2499	break;
2500	default: /* what the hell */
2501	Log(("pUrb->enmStatus=%#x!!!\n", pUrb->enmStatus));
2502	case VUSBSTATUS_DNR:
2503	pTd->hwinfo \|= OHCI_CC_DNR;
2504	break;
2505	}
2506	}
2507
2508	/*
2509	* Move on to the done list and write back the modified TD.
2510	*/
2511	#ifdef LOG_ENABLED
2512	if (!pThis->done)
2513	pThis->u32FmDoneQueueTail = pThis->HcFmNumber;
2514	# ifdef VBOX_STRICT
2515	ohci_in_done_queue_add(pThis, TdAddr);
2516	# endif
2517	#endif
2518	pTd->NextTD = pThis->done;
2519	pThis->done = TdAddr;
2520
2521	ohciWriteTd(pThis, TdAddr, pTd, "retired");
2522
2523	/*
2524	* If we've halted the endpoint, we stop here.
2525	* ohciUnlinkTds() will make sure we've only unliked the first TD.
2526	*
2527	* The reason for this is that while we can have more than one TD in a URB, real
2528	* OHCI hardware will only deal with one TD at the time and it's therefore incorrect
2529	* to retire TDs after the endpoint has been halted. Win2k will crash or enter infinite
2530	* kernel loop if we don't behave correctly. (See @bugref{1646}.)
2531	*/
2532	if (pEd->HeadP & ED_HEAD_HALTED)
2533	break;
2534	}
2535	}
2536
2537
2538	/**
2539	* Transfer completion callback routine.
2540	*
2541	* VUSB will call this when a transfer have been completed
2542	* in a one or another way.
2543	*
2544	* @param pInterface Pointer to OHCI::ROOTHUB::IRhPort.
2545	* @param pUrb Pointer to the URB in question.
2546	*/
2547	static DECLCALLBACK(void) ohciRhXferCompletion(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb)
2548	{
2549	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
2550	LogFlow(("%s: ohciRhXferCompletion: EdAddr=%#010RX32 cTds=%d TdAddr0=%#010RX32\n",
2551	pUrb->pszDesc, pUrb->Hci.EdAddr, pUrb->Hci.cTds, pUrb->Hci.paTds[0].TdAddr));
2552
2553	RTCritSectEnter(&pThis->CritSect);
2554	pThis->fIdle = false; /* Mark as active */
2555
2556	/* get the current end point descriptor. */
2557	OHCIED Ed;
2558	ohciReadEd(pThis, pUrb->Hci.EdAddr, &Ed);
2559
2560	/*
2561	* Check that the URB hasn't been canceled and then try unlink the TDs.
2562	*
2563	* We drop the URB if the ED is marked halted/skip ASSUMING that this
2564	* means the HCD has canceled the URB.
2565	*
2566	* If we succeed here (i.e. not dropping the URB), the TdCopy members will
2567	* be updated but not yet written. We will delay the writing till we're done
2568	* with the data copying, buffer pointer advancing and error handling.
2569	*/
2570	int cFmAge = ohci_in_flight_remove_urb(pThis, pUrb);
2571	if (pUrb->enmStatus == VUSBSTATUS_UNDO)
2572	{
2573	/* Leave the TD alone - the HCD doesn't want us talking to the device. */
2574	Log(("%s: ohciRhXferCompletion: CANCELED {ED=%#010x cTds=%d TD0=%#010x age %d}\n",
2575	pUrb->pszDesc, pUrb->Hci.EdAddr, pUrb->Hci.cTds, pUrb->Hci.paTds[0].TdAddr, cFmAge));
2576	STAM_COUNTER_INC(&pThis->StatDroppedUrbs);
2577	RTCritSectLeave(&pThis->CritSect);
2578	return;
2579	}
2580	bool fHasBeenCanceled = false;
2581	if ( (Ed.HeadP & ED_HEAD_HALTED)
2582	\|\| (Ed.hwinfo & ED_HWINFO_SKIP)
2583	\|\| cFmAge < 0
2584	\|\| (fHasBeenCanceled = ohciHasUrbBeenCanceled(pThis, pUrb, &Ed))
2585	\|\| !ohciUnlinkTds(pThis, pUrb, &Ed)
2586	)
2587	{
2588	Log(("%s: ohciRhXferCompletion: DROPPED {ED=%#010x cTds=%d TD0=%#010x age %d} because:%s%s%s%s%s!!!\n",
2589	pUrb->pszDesc, pUrb->Hci.EdAddr, pUrb->Hci.cTds, pUrb->Hci.paTds[0].TdAddr, cFmAge,
2590	(Ed.HeadP & ED_HEAD_HALTED) ? " ep halted" : "",
2591	(Ed.hwinfo & ED_HWINFO_SKIP) ? " ep skip" : "",
2592	(Ed.HeadP & ED_PTR_MASK) != pUrb->Hci.paTds[0].TdAddr ? " ep head-changed" : "",
2593	cFmAge < 0 ? " td not-in-flight" : "",
2594	fHasBeenCanceled ? " td canceled" : ""));
2595	NOREF(fHasBeenCanceled);
2596	STAM_COUNTER_INC(&pThis->StatDroppedUrbs);
2597	RTCritSectLeave(&pThis->CritSect);
2598	return;
2599	}
2600
2601	/*
2602	* Complete the TD updating and write the back.
2603	* When appropriate also copy data back to the guest memory.
2604	*/
2605	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2606	ohciRhXferCompleteIsochronousURB(pThis, pUrb, &Ed, cFmAge);
2607	else
2608	ohciRhXferCompleteGeneralURB(pThis, pUrb, &Ed, cFmAge);
2609
2610	/* finally write back the endpoint descriptor. */
2611	ohciWriteEd(pThis, pUrb->Hci.EdAddr, &Ed);
2612
2613	/* Calculate new frame rate and wakeup the framer thread if the rate was chnaged. */
2614	if (ohciFramerateCalcNew(pThis))
2615	RTSemEventMultiSignal(pThis->hSemEventFrame);
2616
2617	RTCritSectLeave(&pThis->CritSect);
2618	}
2619
2620
2621	/**
2622	* Handle transfer errors.
2623	*
2624	* VUSB calls this when a transfer attempt failed. This function will respond
2625	* indicating whether to retry or complete the URB with failure.
2626	*
2627	* @returns true if the URB should be retired.
2628	* @returns false if the URB should be retried.
2629	* @param pInterface Pointer to OHCI::ROOTHUB::IRhPort.
2630	* @param pUrb Pointer to the URB in question.
2631	*/
2632	static DECLCALLBACK(bool) ohciRhXferError(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb)
2633	{
2634	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
2635
2636	/*
2637	* Isochronous URBs can't be retried.
2638	*/
2639	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2640	return true;
2641
2642	/*
2643	* Don't retry on stall.
2644	*/
2645	if (pUrb->enmStatus == VUSBSTATUS_STALL)
2646	{
2647	Log2(("%s: ohciRhXferError: STALL, giving up.\n", pUrb->pszDesc));
2648	return true;
2649	}
2650
2651	RTCritSectEnter(&pThis->CritSect);
2652
2653	bool fRetire = false;
2654	/*
2655	* Check if the TDs still are valid.
2656	* This will make sure the TdCopy is up to date.
2657	*/
2658	const uint32_t TdAddr = pUrb->Hci.paTds[0].TdAddr;
2659	/** @todo IMPORTANT! we must check if the ED is still valid at this point!!! */
2660	if (ohciHasUrbBeenCanceled(pThis, pUrb, NULL))
2661	{
2662	Log(("%s: ohciRhXferError: TdAddr0=%#x canceled!\n", pUrb->pszDesc, TdAddr));
2663	fRetire = true;
2664	}
2665	else
2666	{
2667	/*
2668	* Get and update the error counter.
2669	*/
2670	POHCITD pTd = (POHCITD)&pUrb->Hci.paTds[0].TdCopy[0];
2671	unsigned cErrs = (pTd->hwinfo & TD_HWINFO_ERRORS) >> TD_ERRORS_SHIFT;
2672	pTd->hwinfo &= ~TD_HWINFO_ERRORS;
2673	cErrs++;
2674	pTd->hwinfo \|= (cErrs % TD_ERRORS_MAX) << TD_ERRORS_SHIFT;
2675	ohciWriteTd(pThis, TdAddr, pTd, "ohciRhXferError");
2676
2677	if (cErrs >= TD_ERRORS_MAX - 1)
2678	{
2679	Log2(("%s: ohciRhXferError: too many errors, giving up!\n", pUrb->pszDesc));
2680	fRetire = true;
2681	}
2682	else
2683	Log2(("%s: ohciRhXferError: cErrs=%d: retrying...\n", pUrb->pszDesc, cErrs));
2684	}
2685
2686	RTCritSectLeave(&pThis->CritSect);
2687	return fRetire;
2688	}
2689
2690
2691	/**
2692	* Service a general transport descriptor.
2693	*/
2694	static bool ohciServiceTd(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, uint32_t TdAddr, uint32_t pNextTdAddr, const char pszListName)
2695	{
2696	/*
2697	* Read the TD and setup the buffer data.
2698	*/
2699	OHCITD Td;
2700	ohciReadTd(pThis, TdAddr, &Td);
2701	OHCIBUF Buf;
2702	ohciBufInit(&Buf, Td.cbp, Td.be);
2703
2704	*pNextTdAddr = Td.NextTD & ED_PTR_MASK;
2705
2706	/*
2707	* Determine the direction.
2708	*/
2709	VUSBDIRECTION enmDir;
2710	switch (pEd->hwinfo & ED_HWINFO_DIR)
2711	{
2712	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2713	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2714	default:
2715	switch (Td.hwinfo & TD_HWINFO_DIR)
2716	{
2717	case TD_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2718	case TD_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2719	case 0: enmDir = VUSBDIRECTION_SETUP; break;
2720	default:
2721	Log(("ohciServiceTd: Invalid direction!!!! Td.hwinfo=%#x Ed.hwdinfo=%#x\n", Td.hwinfo, pEd->hwinfo));
2722	/* TODO: Do the correct thing here */
2723	return false;
2724	}
2725	break;
2726	}
2727
2728	pThis->fIdle = false; /* Mark as active */
2729
2730	/*
2731	* Allocate and initialize a new URB.
2732	*/
2733	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, enmType,
2734	enmDir, Buf.cbTotal, 1, NULL);
2735	if (!pUrb)
2736	return false; /* retry later... */
2737	Assert(pUrb->Hci.cTds == 1);
2738
2739	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
2740	pUrb->fShortNotOk = !(Td.hwinfo & TD_HWINFO_ROUNDING);
2741	pUrb->enmStatus = VUSBSTATUS_OK;
2742	pUrb->Hci.EdAddr = EdAddr;
2743	pUrb->Hci.fUnlinked = false;
2744	pUrb->Hci.paTds[0].TdAddr = TdAddr;
2745	pUrb->Hci.u32FrameNo = pThis->HcFmNumber;
2746	AssertCompile(sizeof(pUrb->Hci.paTds[0].TdCopy) >= sizeof(Td));
2747	memcpy(pUrb->Hci.paTds[0].TdCopy, &Td, sizeof(Td));
2748
2749	/* copy data if out bound transfer. */
2750	pUrb->cbData = Buf.cbTotal;
2751	if ( Buf.cbTotal
2752	&& Buf.cVecs > 0
2753	&& enmDir != VUSBDIRECTION_IN)
2754	{
2755	ohciPhysRead(pThis, Buf.aVecs[0].Addr, pUrb->abData, Buf.aVecs[0].cb);
2756	if (Buf.cVecs > 1)
2757	ohciPhysRead(pThis, Buf.aVecs[1].Addr, &pUrb->abData[Buf.aVecs[0].cb], Buf.aVecs[1].cb);
2758	}
2759
2760	/*
2761	* Submit the URB.
2762	*/
2763	ohci_in_flight_add(pThis, TdAddr, pUrb);
2764	Log(("%s: ohciServiceTd: submitting TdAddr=%#010x EdAddr=%#010x cbData=%#x\n",
2765	pUrb->pszDesc, TdAddr, EdAddr, pUrb->cbData));
2766
2767	RTCritSectLeave(&pThis->CritSect);
2768	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
2769	RTCritSectEnter(&pThis->CritSect);
2770	if (RT_SUCCESS(rc))
2771	return true;
2772
2773	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
2774	Log(("ohciServiceTd: failed submitting TdAddr=%#010x EdAddr=%#010x pUrb=%p!!\n",
2775	TdAddr, EdAddr, pUrb));
2776	ohci_in_flight_remove(pThis, TdAddr);
2777	return false;
2778	}
2779
2780
2781	/**
2782	* Service a the head TD of an endpoint.
2783	*/
2784	static bool ohciServiceHeadTd(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, const char *pszListName)
2785	{
2786	/*
2787	* Read the TD, after first checking if it's already in-flight.
2788	*/
2789	uint32_t TdAddr = pEd->HeadP & ED_PTR_MASK;
2790	if (ohciIsTdInFlight(pThis, TdAddr))
2791	return false;
2792	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
2793	ohci_in_done_queue_check(pThis, TdAddr);
2794	#endif
2795	return ohciServiceTd(pThis, enmType, pEd, EdAddr, TdAddr, &TdAddr, pszListName);
2796	}
2797
2798
2799	/**
2800	* Service one or more general transport descriptors (bulk or interrupt).
2801	*/
2802	static bool ohciServiceTdMultiple(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr,
2803	uint32_t TdAddr, uint32_t pNextTdAddr, const char pszListName)
2804	{
2805	/*
2806	* Read the TDs involved in this URB.
2807	*/
2808	struct OHCITDENTRY
2809	{
2810	/** The TD. */
2811	OHCITD Td;
2812	/** The associated OHCI buffer tracker. */
2813	OHCIBUF Buf;
2814	/** The TD address. */
2815	uint32_t TdAddr;
2816	/** Pointer to the next element in the chain (stack). */
2817	struct OHCITDENTRY *pNext;
2818	} Head;
2819
2820	/* read the head */
2821	ohciReadTd(pThis, TdAddr, &Head.Td);
2822	ohciBufInit(&Head.Buf, Head.Td.cbp, Head.Td.be);
2823	Head.TdAddr = TdAddr;
2824	Head.pNext = NULL;
2825
2826	/* combine with more TDs. */
2827	struct OHCITDENTRY *pTail = &Head;
2828	unsigned cbTotal = pTail->Buf.cbTotal;
2829	unsigned cTds = 1;
2830	while ( (pTail->Buf.cbTotal == 0x1000 \|\| pTail->Buf.cbTotal == 0x2000)
2831	&& !(pTail->Td.hwinfo & TD_HWINFO_ROUNDING) /* This isn't right for BSD, but let's not . /
2832	&& (pTail->Td.NextTD & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
2833	&& cTds < 128)
2834	{
2835	struct OHCITDENTRY pCur = (struct OHCITDENTRY )alloca(sizeof(*pCur));
2836
2837	pCur->pNext = NULL;
2838	pCur->TdAddr = pTail->Td.NextTD & ED_PTR_MASK;
2839	ohciReadTd(pThis, pCur->TdAddr, &pCur->Td);
2840	ohciBufInit(&pCur->Buf, pCur->Td.cbp, pCur->Td.be);
2841
2842	/* Don't combine if the direction doesn't match up. There can't actually be
2843	* a mismatch for bulk/interrupt EPs unless the guest is buggy.
2844	*/
2845	if ( (pCur->Td.hwinfo & (TD_HWINFO_DIR))
2846	!= (Head.Td.hwinfo & (TD_HWINFO_DIR)))
2847	break;
2848
2849	pTail->pNext = pCur;
2850	pTail = pCur;
2851	cbTotal += pCur->Buf.cbTotal;
2852	cTds++;
2853	}
2854
2855	/* calc next TD address */
2856	*pNextTdAddr = pTail->Td.NextTD & ED_PTR_MASK;
2857
2858	/*
2859	* Determine the direction.
2860	*/
2861	VUSBDIRECTION enmDir;
2862	switch (pEd->hwinfo & ED_HWINFO_DIR)
2863	{
2864	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2865	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2866	default:
2867	Log(("ohciServiceTdMultiple: WARNING! Ed.hwdinfo=%#x bulk or interrupt EP shouldn't rely on the TD for direction...\n", pEd->hwinfo));
2868	switch (Head.Td.hwinfo & TD_HWINFO_DIR)
2869	{
2870	case TD_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2871	case TD_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2872	default:
2873	Log(("ohciServiceTdMultiple: Invalid direction!!!! Head.Td.hwinfo=%#x Ed.hwdinfo=%#x\n", Head.Td.hwinfo, pEd->hwinfo));
2874	/* TODO: Do the correct thing here */
2875	return false;
2876	}
2877	break;
2878	}
2879
2880	pThis->fIdle = false; /* Mark as active */
2881
2882	/*
2883	* Allocate and initialize a new URB.
2884	*/
2885	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, enmType,
2886	enmDir, cbTotal, cTds, "ohciServiceTdMultiple");
2887	if (!pUrb)
2888	/* retry later... */
2889	return false;
2890	Assert(pUrb->Hci.cTds == cTds);
2891	Assert(pUrb->cbData == cbTotal);
2892
2893	pUrb->enmType = enmType;
2894	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
2895	pUrb->enmDir = enmDir;
2896	pUrb->fShortNotOk = !(pTail->Td.hwinfo & TD_HWINFO_ROUNDING);
2897	pUrb->enmStatus = VUSBSTATUS_OK;
2898	pUrb->Hci.EdAddr = EdAddr;
2899	pUrb->Hci.fUnlinked = false;
2900	pUrb->Hci.u32FrameNo = pThis->HcFmNumber;
2901
2902	/* Copy data and TD information. */
2903	unsigned iTd = 0;
2904	uint8_t *pb = &pUrb->abData[0];
2905	for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
2906	{
2907	/* data */
2908	if ( cbTotal
2909	&& enmDir != VUSBDIRECTION_IN
2910	&& pCur->Buf.cVecs > 0)
2911	{
2912	ohciPhysRead(pThis, pCur->Buf.aVecs[0].Addr, pb, pCur->Buf.aVecs[0].cb);
2913	if (pCur->Buf.cVecs > 1)
2914	ohciPhysRead(pThis, pCur->Buf.aVecs[1].Addr, pb + pCur->Buf.aVecs[0].cb, pCur->Buf.aVecs[1].cb);
2915	}
2916	pb += pCur->Buf.cbTotal;
2917
2918	/* TD info */
2919	pUrb->Hci.paTds[iTd].TdAddr = pCur->TdAddr;
2920	AssertCompile(sizeof(pUrb->Hci.paTds[iTd].TdCopy) >= sizeof(pCur->Td));
2921	memcpy(pUrb->Hci.paTds[iTd].TdCopy, &pCur->Td, sizeof(pCur->Td));
2922	}
2923
2924	/*
2925	* Submit the URB.
2926	*/
2927	ohci_in_flight_add_urb(pThis, pUrb);
2928	Log(("%s: ohciServiceTdMultiple: submitting cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x\n",
2929	pUrb->pszDesc, pUrb->cbData, EdAddr, cTds, TdAddr));
2930	RTCritSectLeave(&pThis->CritSect);
2931	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
2932	RTCritSectEnter(&pThis->CritSect);
2933	if (RT_SUCCESS(rc))
2934	return true;
2935
2936	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
2937	Log(("ohciServiceTdMultiple: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x - rc=%Rrc\n",
2938	pUrb, cbTotal, EdAddr, cTds, TdAddr, rc));
2939	for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
2940	ohci_in_flight_remove(pThis, pCur->TdAddr);
2941	return false;
2942	}
2943
2944
2945	/**
2946	* Service the head TD of an endpoint.
2947	*/
2948	static bool ohciServiceHeadTdMultiple(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, const char *pszListName)
2949	{
2950	/*
2951	* First, check that it's not already in-flight.
2952	*/
2953	uint32_t TdAddr = pEd->HeadP & ED_PTR_MASK;
2954	if (ohciIsTdInFlight(pThis, TdAddr))
2955	return false;
2956	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
2957	ohci_in_done_queue_check(pThis, TdAddr);
2958	#endif
2959	return ohciServiceTdMultiple(pThis, enmType, pEd, EdAddr, TdAddr, &TdAddr, pszListName);
2960	}
2961
2962
2963	/**
2964	* A worker for ohciServiceIsochronousEndpoint which unlinks a ITD
2965	* that belongs to the past.
2966	*/
2967	static bool ohciServiceIsochronousTdUnlink(POHCI pThis, POHCIITD pITd, uint32_t ITdAddr, uint32_t ITdAddrPrev,
2968	PVUSBURB pUrb, POHCIED pEd, uint32_t EdAddr)
2969	{
2970	LogFlow(("%s%sohciServiceIsochronousTdUnlink: Unlinking ITD: ITdAddr=%#010x EdAddr=%#010x ITdAddrPrev=%#010x\n",
2971	pUrb ? pUrb->pszDesc : "", pUrb ? ": " : "", ITdAddr, EdAddr, ITdAddrPrev));
2972
2973	/*
2974	* Do the unlinking.
2975	*/
2976	const uint32_t ITdAddrNext = pITd->NextTD & ED_PTR_MASK;
2977	if (ITdAddrPrev)
2978	{
2979	/* Get validate the previous TD */
2980	int iInFlightPrev = ohci_in_flight_find(pThis, ITdAddrPrev);
2981	AssertMsgReturn(iInFlightPrev >= 0, ("ITdAddr=%#RX32\n", ITdAddrPrev), false);
2982	PVUSBURB pUrbPrev = pThis->aInFlight[iInFlightPrev].pUrb;
2983	if (ohciHasUrbBeenCanceled(pThis, pUrbPrev, pEd)) /* ensures the copy is correct. */
2984	return false;
2985
2986	/* Update the copy and write it back. */
2987	POHCIITD pITdPrev = ((POHCIITD)pUrbPrev->Hci.paTds[0].TdCopy);
2988	pITdPrev->NextTD = (pITdPrev->NextTD & ~ED_PTR_MASK) \| ITdAddrNext;
2989	ohciWriteITd(pThis, ITdAddrPrev, pITdPrev, "ohciServiceIsochronousEndpoint");
2990	}
2991	else
2992	{
2993	/* It's the head node. update the copy from the caller and write it back. */
2994	pEd->HeadP = (pEd->HeadP & ~ED_PTR_MASK) \| ITdAddrNext;
2995	ohciWriteEd(pThis, EdAddr, pEd);
2996	}
2997
2998	/*
2999	* If it's in flight, just mark the URB as unlinked (there is only one ITD per URB atm).
3000	* Otherwise, retire it to the done queue with an error and cause a done line interrupt (?).
3001	*/
3002	if (pUrb)
3003	{
3004	pUrb->Hci.fUnlinked = true;
3005	if (ohciHasUrbBeenCanceled(pThis, pUrb, pEd)) /* ensures the copy is correct (paranoia). */
3006	return false;
3007
3008	POHCIITD pITdCopy = ((POHCIITD)pUrb->Hci.paTds[0].TdCopy);
3009	pITd->NextTD = pITdCopy->NextTD &= ~ED_PTR_MASK;
3010	}
3011	else
3012	{
3013	pITd->HwInfo &= ~ITD_HWINFO_CC;
3014	pITd->HwInfo \|= OHCI_CC_DATA_OVERRUN;
3015
3016	pITd->NextTD = pThis->done;
3017	pThis->done = ITdAddr;
3018
3019	pThis->dqic = 0;
3020	}
3021
3022	ohciWriteITd(pThis, ITdAddr, pITd, "ohciServiceIsochronousTdUnlink");
3023	return true;
3024	}
3025
3026
3027	/**
3028	* A worker for ohciServiceIsochronousEndpoint which submits the specified TD.
3029	*
3030	* @returns true on success.
3031	* @returns false on failure to submit.
3032	* @param R The start packet (frame) relative to the start of frame in HwInfo.
3033	*/
3034	static bool ohciServiceIsochronousTd(POHCI pThis, POHCIITD pITd, uint32_t ITdAddr, const unsigned R, PCOHCIED pEd, uint32_t EdAddr)
3035	{
3036	/*
3037	* Determine the endpoint direction.
3038	*/
3039	VUSBDIRECTION enmDir;
3040	switch (pEd->hwinfo & ED_HWINFO_DIR)
3041	{
3042	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
3043	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
3044	default:
3045	Log(("ohciServiceIsochronousTd: Invalid direction!!!! Ed.hwdinfo=%#x\n", pEd->hwinfo));
3046	/* Should probably raise an unrecoverable HC error here */
3047	return false;
3048	}
3049
3050	/*
3051	* Extract the packet sizes and calc the total URB size.
3052	*/
3053	struct
3054	{
3055	uint16_t cb;
3056	uint16_t off;
3057	} aPkts[ITD_NUM_PSW];
3058
3059	/* first entry (R) */
3060	uint32_t cbTotal = 0;
3061	if (((uint32_t)pITd->aPSW[R] >> ITD_PSW_CC_SHIFT) < (OHCI_CC_NOT_ACCESSED_0 >> TD_HWINFO_CC_SHIFT))
3062	Log(("ITdAddr=%RX32 PSW%d.CC=%#x < 'Not Accessed'!\n", ITdAddr, R, pITd->aPSW[R] >> ITD_PSW_CC_SHIFT)); /* => Unrecoverable Error*/
3063	uint16_t offPrev = aPkts[0].off = (pITd->aPSW[R] & ITD_PSW_OFFSET);
3064
3065	/* R+1..cFrames */
3066	const unsigned cFrames = ((pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
3067	for (unsigned iR = R + 1; iR < cFrames; iR++)
3068	{
3069	const uint16_t PSW = pITd->aPSW[iR];
3070	const uint16_t off = aPkts[iR - R].off = (PSW & ITD_PSW_OFFSET);
3071	cbTotal += aPkts[iR - R - 1].cb = off - offPrev;
3072	if (off < offPrev)
3073	Log(("ITdAddr=%RX32 PSW%d.offset=%#x < offPrev=%#x!\n", ITdAddr, iR, off, offPrev)); /* => Unrecoverable Error*/
3074	if (((uint32_t)PSW >> ITD_PSW_CC_SHIFT) < (OHCI_CC_NOT_ACCESSED_0 >> TD_HWINFO_CC_SHIFT))
3075	Log(("ITdAddr=%RX32 PSW%d.CC=%#x < 'Not Accessed'!\n", ITdAddr, iR, PSW >> ITD_PSW_CC_SHIFT)); /* => Unrecoverable Error*/
3076	offPrev = off;
3077	}
3078
3079	/* calc offEnd and figure out the size of the last packet. */
3080	const uint32_t offEnd = (pITd->BE & 0xfff)
3081	+ (((pITd->BE & ITD_BP0_MASK) != (pITd->BP0 & ITD_BP0_MASK)) << 12)
3082	+ 1 /* BE is inclusive */;
3083	if (offEnd < offPrev)
3084	Log(("ITdAddr=%RX32 offEnd=%#x < offPrev=%#x!\n", ITdAddr, offEnd, offPrev)); /* => Unrecoverable Error*/
3085	cbTotal += aPkts[cFrames - 1 - R].cb = offEnd - offPrev;
3086	Assert(cbTotal <= 0x2000);
3087
3088	pThis->fIdle = false; /* Mark as active */
3089
3090	/*
3091	* Allocate and initialize a new URB.
3092	*/
3093	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, VUSBXFERTYPE_ISOC,
3094	enmDir, cbTotal, 1, NULL);
3095	if (!pUrb)
3096	/* retry later... */
3097	return false;
3098
3099	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
3100	pUrb->fShortNotOk = false;
3101	pUrb->enmStatus = VUSBSTATUS_OK;
3102	pUrb->Hci.EdAddr = EdAddr;
3103	pUrb->Hci.fUnlinked = false;
3104	pUrb->Hci.u32FrameNo = pThis->HcFmNumber;
3105	pUrb->Hci.paTds[0].TdAddr = ITdAddr;
3106	AssertCompile(sizeof(pUrb->Hci.paTds[0].TdCopy) >= sizeof(*pITd));
3107	memcpy(pUrb->Hci.paTds[0].TdCopy, pITd, sizeof(*pITd));
3108	#if 0 /* color the data */
3109	memset(pUrb->abData, 0xfe, cbTotal);
3110	#endif
3111
3112	/* copy the data */
3113	if ( cbTotal
3114	&& enmDir != VUSBDIRECTION_IN)
3115	{
3116	const uint32_t off0 = pITd->aPSW[R] & ITD_PSW_OFFSET;
3117	if (off0 < 0x1000)
3118	{
3119	if (offEnd > 0x1000)
3120	{
3121	/* both pages. */
3122	const unsigned cb0 = 0x1000 - off0;
3123	ohciPhysRead(pThis, (pITd->BP0 & ITD_BP0_MASK) + off0, &pUrb->abData[0], cb0);
3124	ohciPhysRead(pThis, pITd->BE & ITD_BP0_MASK, &pUrb->abData[cb0], offEnd & 0xfff);
3125	}
3126	else /* a portion of the 1st page. */
3127	ohciPhysRead(pThis, (pITd->BP0 & ITD_BP0_MASK) + off0, pUrb->abData, offEnd - off0);
3128	}
3129	else /* a portion of the 2nd page. */
3130	ohciPhysRead(pThis, (pITd->BE & UINT32_C(0xfffff000)) + (off0 & 0xfff), pUrb->abData, cbTotal);
3131	}
3132
3133	/* setup the packets */
3134	pUrb->cIsocPkts = cFrames - R;
3135	unsigned off = 0;
3136	for (unsigned i = 0; i < pUrb->cIsocPkts; i++)
3137	{
3138	pUrb->aIsocPkts[i].enmStatus = VUSBSTATUS_NOT_ACCESSED;
3139	pUrb->aIsocPkts[i].off = off;
3140	off += pUrb->aIsocPkts[i].cb = aPkts[i].cb;
3141	}
3142	Assert(off == cbTotal);
3143
3144	/*
3145	* Submit the URB.
3146	*/
3147	ohci_in_flight_add_urb(pThis, pUrb);
3148	Log(("%s: ohciServiceIsochronousTd: submitting cbData=%#x cIsocPkts=%d EdAddr=%#010x TdAddr=%#010x SF=%#x (%#x)\n",
3149	pUrb->pszDesc, pUrb->cbData, pUrb->cIsocPkts, EdAddr, ITdAddr, pITd->HwInfo & ITD_HWINFO_SF, pThis->HcFmNumber));
3150	RTCritSectLeave(&pThis->CritSect);
3151	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
3152	RTCritSectEnter(&pThis->CritSect);
3153	if (RT_SUCCESS(rc))
3154	return true;
3155
3156	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
3157	Log(("ohciServiceIsochronousTd: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d ITdAddr0=%#010x - rc=%Rrc\n",
3158	pUrb, cbTotal, EdAddr, 1, ITdAddr, rc));
3159	ohci_in_flight_remove(pThis, ITdAddr);
3160	return false;
3161	}
3162
3163
3164	/**
3165	* Service an isochronous endpoint.
3166	*/
3167	static void ohciServiceIsochronousEndpoint(POHCI pThis, POHCIED pEd, uint32_t EdAddr)
3168	{
3169	/*
3170	* We currently process this as if the guest follows the interrupt end point chaining
3171	* hierarchy described in the documenation. This means that for an isochronous endpoint
3172	* with a 1 ms interval we expect to find in-flight TDs at the head of the list. We will
3173	* skip over all in-flight TDs which timeframe has been exceed. Those which aren't in
3174	* flight but which are too late will be retired (possibly out of order, but, we don't
3175	* care right now).
3176	*
3177	* When we reach a TD which still has a buffer which is due for take off, we will
3178	* stop iterating TDs. If it's in-flight, there isn't anything to be done. Otherwise
3179	* we will push it onto the runway for immediate take off. In this process we
3180	* might have to complete buffers which didn't make it on time, something which
3181	* complicates the kind of status info we need to keep around for the TD.
3182	*
3183	* Note: We're currently not making any attempt at reassembling ITDs into URBs.
3184	* However, this will become necessary because of EMT scheduling and guest
3185	* like linux using one TD for each frame (simple but inefficient for us).
3186	*/
3187	OHCIITD ITd;
3188	uint32_t ITdAddr = pEd->HeadP & ED_PTR_MASK;
3189	uint32_t ITdAddrPrev = 0;
3190	uint32_t u32NextFrame = UINT32_MAX;
3191	const uint16_t u16CurFrame = pThis->HcFmNumber;
3192	for (;;)
3193	{
3194	/* check for end-of-chain. */
3195	if ( ITdAddr == (pEd->TailP & ED_PTR_MASK)
3196	\|\| !ITdAddr)
3197	break;
3198
3199	/*
3200	* If isochronous endpoints are around, don't slow down the timer. Getting the timing right
3201	* is difficult enough as it is.
3202	*/
3203	pThis->fIdle = false;
3204
3205	/*
3206	* Read the current ITD and check what we're supposed to do about it.
3207	*/
3208	ohciReadITd(pThis, ITdAddr, &ITd);
3209	const uint32_t ITdAddrNext = ITd.NextTD & ED_PTR_MASK;
3210	const int16_t R = u16CurFrame - (uint16_t)(ITd.HwInfo & ITD_HWINFO_SF); /* 4.3.2.3 */
3211	const int16_t cFrames = ((ITd.HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
3212
3213	if (R < cFrames)
3214	{
3215	/*
3216	* It's inside the current or a future launch window.
3217	*
3218	* We will try maximize the TD in flight here to deal with EMT scheduling
3219	* issues and similar stuff which will screw up the time. So, we will only
3220	* stop submitting TD when we reach a gap (in time) or end of the list.
3221	*/
3222	if ( R < 0 /* (a future frame) */
3223	&& (uint16_t)u32NextFrame != (uint16_t)(ITd.HwInfo & ITD_HWINFO_SF))
3224	break;
3225	if (ohci_in_flight_find(pThis, ITdAddr) < 0)
3226	if (!ohciServiceIsochronousTd(pThis, &ITd, ITdAddr, R < 0 ? 0 : R, pEd, EdAddr))
3227	break;
3228
3229	ITdAddrPrev = ITdAddr;
3230	}
3231	else
3232	{
3233	#if 1
3234	/*
3235	* Ok, the launch window for this TD has passed.
3236	* If it's not in flight it should be retired with a DataOverrun status (TD).
3237	*
3238	* Don't remove in-flight TDs before they complete.
3239	* Windows will, upon the completion of another ITD it seems, check for if
3240	* any other TDs has been unlinked. If we unlink them before they really
3241	* complete all the packet status codes will be NotAccessed and Windows
3242	* will fail the URB with status USBD_STATUS_ISOCH_REQUEST_FAILED.
3243	*
3244	* I don't know if unlinking TDs out of order could cause similar problems,
3245	* time will show.
3246	*/
3247	int iInFlight = ohci_in_flight_find(pThis, ITdAddr);
3248	if (iInFlight >= 0)
3249	ITdAddrPrev = ITdAddr;
3250	else if (!ohciServiceIsochronousTdUnlink(pThis, &ITd, ITdAddr, ITdAddrPrev,
3251	NULL, pEd, EdAddr))
3252	{
3253	Log(("ohciServiceIsochronousEndpoint: Failed unlinking old ITD.\n"));
3254	break;
3255	}
3256	#else /* BAD IDEA: */
3257	/*
3258	* Ok, the launch window for this TD has passed.
3259	* If it's not in flight it should be retired with a DataOverrun status (TD).
3260	*
3261	* If it's in flight we will try unlink it from the list prematurely to
3262	* help the guest to move on and shorten the list we have to walk. We currently
3263	* are successful with the first URB but then it goes too slowly...
3264	*/
3265	int iInFlight = ohci_in_flight_find(pThis, ITdAddr);
3266	if (!ohciServiceIsochronousTdUnlink(pThis, &ITd, ITdAddr, ITdAddrPrev,
3267	iInFlight < 0 ? NULL : pThis->aInFlight[iInFlight].pUrb,
3268	pEd, EdAddr))
3269	{
3270	Log(("ohciServiceIsochronousEndpoint: Failed unlinking old ITD.\n"));
3271	break;
3272	}
3273	#endif
3274	}
3275
3276	/* advance to the next ITD */
3277	ITdAddr = ITdAddrNext;
3278	u32NextFrame = (ITd.HwInfo & ITD_HWINFO_SF) + cFrames;
3279	}
3280	}
3281
3282
3283	/**
3284	* Checks if a endpoints has TDs queued and is ready to have them processed.
3285	*
3286	* @returns true if it's ok to process TDs.
3287	* @param pEd The endpoint data.
3288	*/
3289	DECLINLINE(bool) ohciIsEdReady(PCOHCIED pEd)
3290	{
3291	return (pEd->HeadP & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
3292	&& !(pEd->HeadP & ED_HEAD_HALTED)
3293	&& !(pEd->hwinfo & ED_HWINFO_SKIP);
3294	}
3295
3296
3297	/**
3298	* Checks if an endpoint has TDs queued (not necessarily ready to have them processed).
3299	*
3300	* @returns true if endpoint may have TDs queued.
3301	* @param pEd The endpoint data.
3302	*/
3303	DECLINLINE(bool) ohciIsEdPresent(PCOHCIED pEd)
3304	{
3305	return (pEd->HeadP & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
3306	&& !(pEd->HeadP & ED_HEAD_HALTED);
3307	}
3308
3309
3310	/**
3311	* Services the bulk list.
3312	*
3313	* On the bulk list we must reassemble URBs from multiple TDs using heuristics
3314	* derived from USB tracing done in the guests and guest source code (when available).
3315	*/
3316	static void ohciServiceBulkList(POHCI pThis)
3317	{
3318	#ifdef LOG_ENABLED
3319	if (g_fLogBulkEPs)
3320	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk before", true);
3321	if (pThis->bulk_cur)
3322	Log(("ohciServiceBulkList: bulk_cur=%#010x before listprocessing!!! HCD have positioned us!!!\n", pThis->bulk_cur));
3323	#endif
3324
3325	/*
3326	* ", HC will start processing the Bulk list and will set BF [BulkListFilled] to 0"
3327	* - We've simplified and are always starting at the head of the list and working
3328	* our way thru to the end each time.
3329	*/
3330	pThis->status &= ~OHCI_STATUS_BLF;
3331	pThis->fBulkNeedsCleaning = false;
3332	pThis->bulk_cur = 0;
3333
3334	uint32_t EdAddr = pThis->bulk_head;
3335	while (EdAddr)
3336	{
3337	OHCIED Ed;
3338	ohciReadEd(pThis, EdAddr, &Ed);
3339	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3340	if (ohciIsEdReady(&Ed))
3341	{
3342	pThis->status \|= OHCI_STATUS_BLF;
3343	pThis->fBulkNeedsCleaning = true;
3344
3345	#if 1
3346	/*
3347
3348	* After we figured out that all the TDs submitted for dealing with MSD
3349	* read/write data really makes up on single URB, and that we must
3350	* reassemble these TDs into an URB before submitting it, there is no
3351	* longer any need for servicing anything other than the head URB
3352	* on a bulk endpoint.
3353	*/
3354	ohciServiceHeadTdMultiple(pThis, VUSBXFERTYPE_BULK, &Ed, EdAddr, "Bulk");
3355	#else
3356	/*
3357	* This alternative code was used before we started reassembling URBs from
3358	* multiple TDs. We keep it handy for debugging.
3359	*/
3360	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3361	if (!ohciIsTdInFlight(pThis, TdAddr))
3362	{
3363	do
3364	{
3365	if (!ohciServiceTdMultiple(pThis, VUSBXFERTYPE_BULK, &Ed, EdAddr, TdAddr, &TdAddr, "Bulk"))
3366	{
3367	LogFlow(("ohciServiceBulkList: ohciServiceTdMultiple -> false\n"));
3368	break;
3369	}
3370	if ( (TdAddr & ED_PTR_MASK) == (Ed.TailP & ED_PTR_MASK)
3371	\|\| !TdAddr /* paranoia */)
3372	{
3373	LogFlow(("ohciServiceBulkList: TdAddr=%#010RX32 Ed.TailP=%#010RX32\n", TdAddr, Ed.TailP));
3374	break;
3375	}
3376
3377	ohciReadEd(pThis, EdAddr, &Ed); /* It might have been updated on URB completion. */
3378	} while (ohciIsEdReady(&Ed));
3379	}
3380	#endif
3381	}
3382	else
3383	{
3384	if (Ed.hwinfo & ED_HWINFO_SKIP)
3385	{
3386	LogFlow(("ohciServiceBulkList: Ed=%#010RX32 Ed.TailP=%#010RX32 SKIP\n", EdAddr, Ed.TailP));
3387	/* If the ED is in 'skip' state, no transactions on it are allowed and we must
3388	* cancel outstanding URBs, if any.
3389	*/
3390	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3391	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3392	if (pUrb)
3393	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3394	}
3395	}
3396
3397	/* next end point */
3398	EdAddr = Ed.NextED & ED_PTR_MASK;
3399
3400	}
3401
3402	#ifdef LOG_ENABLED
3403	if (g_fLogBulkEPs)
3404	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk after ", true);
3405	#endif
3406	}
3407
3408	/**
3409	* Abort outstanding transfers on the bulk list.
3410	*
3411	* If the guest disabled bulk list processing, we must abort any outstanding transfers
3412	* (that is, cancel in-flight URBs associated with the list). This is required because
3413	* there may be outstanding read URBs that will never get a response from the device
3414	* and would block further communication.
3415	*/
3416	static void ohciUndoBulkList(POHCI pThis)
3417	{
3418	#ifdef LOG_ENABLED
3419	if (g_fLogBulkEPs)
3420	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk before", true);
3421	if (pThis->bulk_cur)
3422	Log(("ohciUndoBulkList: bulk_cur=%#010x before list processing!!! HCD has positioned us!!!\n", pThis->bulk_cur));
3423	#endif
3424
3425	/* This flag follows OHCI_STATUS_BLF, but BLF doesn't change when list processing is disabled. */
3426	pThis->fBulkNeedsCleaning = false;
3427
3428	uint32_t EdAddr = pThis->bulk_head;
3429	while (EdAddr)
3430	{
3431	OHCIED Ed;
3432	ohciReadEd(pThis, EdAddr, &Ed);
3433	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3434	if (ohciIsEdPresent(&Ed))
3435	{
3436	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3437	if (ohciIsTdInFlight(pThis, TdAddr))
3438	{
3439	LogFlow(("ohciUndoBulkList: Ed=%#010RX32 Ed.TailP=%#010RX32 UNDO\n", EdAddr, Ed.TailP));
3440	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3441	if (pUrb)
3442	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3443	}
3444	}
3445	/* next endpoint */
3446	EdAddr = Ed.NextED & ED_PTR_MASK;
3447	}
3448	}
3449
3450
3451	/**
3452	* Services the control list.
3453	*
3454	* The control list has complex URB assembling, but that's taken
3455	* care of at VUSB level (unlike the other transfer types).
3456	*/
3457	static void ohciServiceCtrlList(POHCI pThis)
3458	{
3459	#ifdef LOG_ENABLED
3460	if (g_fLogControlEPs)
3461	ohciDumpEdList(pThis, pThis->ctrl_head, "Ctrl before", true);
3462	if (pThis->ctrl_cur)
3463	Log(("ohciServiceCtrlList: ctrl_cur=%010x before list processing!!! HCD have positioned us!!!\n", pThis->ctrl_cur));
3464	#endif
3465
3466	/*
3467	* ", HC will start processing the list and will set ControlListFilled to 0"
3468	* - We've simplified and are always starting at the head of the list and working
3469	* our way thru to the end each time.
3470	*/
3471	pThis->status &= ~OHCI_STATUS_CLF;
3472	pThis->ctrl_cur = 0;
3473
3474	uint32_t EdAddr = pThis->ctrl_head;
3475	while (EdAddr)
3476	{
3477	OHCIED Ed;
3478	ohciReadEd(pThis, EdAddr, &Ed);
3479	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3480	if (ohciIsEdReady(&Ed))
3481	{
3482	#if 1
3483	/*
3484	* Control TDs depends on order and stage. Only one can be in-flight
3485	* at any given time. OTOH, some stages are completed immediately,
3486	* so we process the list until we've got a head which is in-flight
3487	* or reach the end of the list.
3488	*/
3489	do
3490	{
3491	if ( !ohciServiceHeadTd(pThis, VUSBXFERTYPE_CTRL, &Ed, EdAddr, "Control")
3492	\|\| ohciIsTdInFlight(pThis, Ed.HeadP & ED_PTR_MASK))
3493	{
3494	pThis->status \|= OHCI_STATUS_CLF;
3495	break;
3496	}
3497	ohciReadEd(pThis, EdAddr, &Ed); /* It might have been updated on URB completion. */
3498	} while (ohciIsEdReady(&Ed));
3499	#else
3500	/* Simplistic, for debugging. */
3501	ohciServiceHeadTd(pThis, VUSBXFERTYPE_CTRL, &Ed, EdAddr, "Control");
3502	pThis->status \|= OHCI_STATUS_CLF;
3503	#endif
3504	}
3505
3506	/* next end point */
3507	EdAddr = Ed.NextED & ED_PTR_MASK;
3508	}
3509
3510	#ifdef LOG_ENABLED
3511	if (g_fLogControlEPs)
3512	ohciDumpEdList(pThis, pThis->ctrl_head, "Ctrl after ", true);
3513	#endif
3514	}
3515
3516
3517	/**
3518	* Services the periodic list.
3519	*
3520	* On the interrupt portion of the periodic list we must reassemble URBs from multiple
3521	* TDs using heuristics derived from USB tracing done in the guests and guest source
3522	* code (when available).
3523	*/
3524	static void ohciServicePeriodicList(POHCI pThis)
3525	{
3526	/*
3527	* Read the list head from the HCCA.
3528	*/
3529	const unsigned iList = pThis->HcFmNumber % OHCI_HCCA_NUM_INTR;
3530	uint32_t EdAddr;
3531	ohciGetDWords(pThis, pThis->hcca + iList * sizeof(EdAddr), &EdAddr, 1);
3532
3533	#ifdef LOG_ENABLED
3534	const uint32_t EdAddrHead = EdAddr;
3535	if (g_fLogInterruptEPs)
3536	{
3537	char sz[48];
3538	RTStrPrintf(sz, sizeof(sz), "Int%02x before", iList);
3539	ohciDumpEdList(pThis, EdAddrHead, sz, true);
3540	}
3541	#endif
3542
3543	/*
3544	* Iterate the endpoint list.
3545	*/
3546	while (EdAddr)
3547	{
3548	OHCIED Ed;
3549	ohciReadEd(pThis, EdAddr, &Ed);
3550
3551	if (ohciIsEdReady(&Ed))
3552	{
3553	/*
3554	* "There is no separate head pointer of isochronous transfers. The first
3555	* isochronous Endpoint Descriptor simply links to the last interrupt
3556	* Endpoint Descriptor."
3557	*/
3558	if (!(Ed.hwinfo & ED_HWINFO_ISO))
3559	{
3560	/*
3561	* Presently we will only process the head URB on an interrupt endpoint.
3562	*/
3563	ohciServiceHeadTdMultiple(pThis, VUSBXFERTYPE_INTR, &Ed, EdAddr, "Periodic");
3564	}
3565	else if (pThis->ctl & OHCI_CTL_IE)
3566	{
3567	/*
3568	* Presently only the head ITD.
3569	*/
3570	ohciServiceIsochronousEndpoint(pThis, &Ed, EdAddr);
3571	}
3572	else
3573	break;
3574	}
3575	else
3576	{
3577	if (Ed.hwinfo & ED_HWINFO_SKIP)
3578	{
3579	LogFlow(("ohciServicePeriodicList: Ed=%#010RX32 Ed.TailP=%#010RX32 SKIP\n", EdAddr, Ed.TailP));
3580	/* If the ED is in 'skip' state, no transactions on it are allowed and we must
3581	* cancel outstanding URBs, if any.
3582	*/
3583	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3584	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3585	if (pUrb)
3586	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3587	}
3588	}
3589	/* next end point */
3590	EdAddr = Ed.NextED & ED_PTR_MASK;
3591	}
3592
3593	#ifdef LOG_ENABLED
3594	if (g_fLogInterruptEPs)
3595	{
3596	char sz[48];
3597	RTStrPrintf(sz, sizeof(sz), "Int%02x after ", iList);
3598	ohciDumpEdList(pThis, EdAddrHead, sz, true);
3599	}
3600	#endif
3601	}
3602
3603
3604	/**
3605	* Update the HCCA.
3606	*
3607	* @param pThis The OHCI instance data.
3608	*/
3609	static void ohciUpdateHCCA(POHCI pThis)
3610	{
3611	struct ohci_hcca hcca;
3612	ohciPhysRead(pThis, pThis->hcca + OHCI_HCCA_OFS, &hcca, sizeof(hcca));
3613
3614	hcca.frame = RT_H2LE_U16((uint16_t)pThis->HcFmNumber);
3615	hcca.pad = 0;
3616
3617	bool fWriteDoneHeadInterrupt = false;
3618	if ( pThis->dqic == 0
3619	&& (pThis->intr_status & OHCI_INTR_WRITE_DONE_HEAD) == 0)
3620	{
3621	uint32_t done = pThis->done;
3622
3623	if (pThis->intr_status & ~( OHCI_INTR_MASTER_INTERRUPT_ENABLED \| OHCI_INTR_OWNERSHIP_CHANGE
3624	\| OHCI_INTR_WRITE_DONE_HEAD) )
3625	done \|= 0x1;
3626
3627	hcca.done = RT_H2LE_U32(done);
3628	pThis->done = 0;
3629	pThis->dqic = 0x7;
3630
3631	Log(("ohci: Writeback Done (%#010x) on frame %#x (age %#x)\n", hcca.done,
3632	pThis->HcFmNumber, pThis->HcFmNumber - pThis->u32FmDoneQueueTail));
3633	#ifdef LOG_ENABLED
3634	ohciDumpTdQueue(pThis, hcca.done & ED_PTR_MASK, "DoneQueue");
3635	#endif
3636	Assert(RT_OFFSETOF(struct ohci_hcca, done) == 4);
3637	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
3638	ohci_in_done_queue_zap(pThis);
3639	#endif
3640	fWriteDoneHeadInterrupt = true;
3641	}
3642
3643	ohciPhysWrite(pThis, pThis->hcca + OHCI_HCCA_OFS, (uint8_t *)&hcca, sizeof(hcca));
3644	if (fWriteDoneHeadInterrupt)
3645	ohciR3SetInterrupt(pThis, OHCI_INTR_WRITE_DONE_HEAD);
3646	}
3647
3648
3649	/**
3650	* Go over the in-flight URB list and cancel any URBs that are no longer in use.
3651	* This occurs when the host removes EDs or TDs from the lists and we don't notice
3652	* the sKip bit. Such URBs must be promptly canceled, otherwise there is a risk
3653	* they might "steal" data destined for another URB.
3654	*/
3655	static void ohciCancelOrphanedURBs(POHCI pThis)
3656	{
3657	bool fValidHCCA = !( pThis->hcca >= OHCI_HCCA_MASK
3658	\|\| pThis->hcca < ~OHCI_HCCA_MASK);
3659	unsigned i, cLeft;
3660	int j;
3661	uint32_t EdAddr;
3662	PVUSBURB pUrb;
3663
3664	/* If the HCCA is not currently valid, or there are no in-flight URBs,
3665	* there's nothing to do.
3666	*/
3667	if (!fValidHCCA \|\| !pThis->cInFlight)
3668	return;
3669
3670	/* Initially mark all in-flight URBs as inactive. */
3671	for (i = 0, cLeft = pThis->cInFlight; cLeft && i < RT_ELEMENTS(pThis->aInFlight); i++)
3672	{
3673	if (pThis->aInFlight[i].pUrb)
3674	{
3675	pThis->aInFlight[i].fInactive = true;
3676	cLeft--;
3677	}
3678	}
3679	Assert(cLeft == 0);
3680
3681	/* Go over all bulk/control/interrupt endpoint lists; any URB found in these lists
3682	* is marked as active again.
3683	*/
3684	for (i = 0; i < OHCI_HCCA_NUM_INTR + 2; i++)
3685	{
3686	switch (i)
3687	{
3688	case OHCI_HCCA_NUM_INTR:
3689	EdAddr = pThis->bulk_head;
3690	break;
3691	case OHCI_HCCA_NUM_INTR + 1:
3692	EdAddr = pThis->ctrl_head;
3693	break;
3694	default:
3695	ohciGetDWords(pThis, pThis->hcca + i * sizeof(EdAddr), &EdAddr, 1);
3696	break;
3697	}
3698	while (EdAddr)
3699	{
3700	OHCIED Ed;
3701	OHCITD Td;
3702	ohciReadEd(pThis, EdAddr, &Ed);
3703	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3704	uint32_t TailP = Ed.TailP & ED_PTR_MASK;
3705	unsigned k = 0;
3706	if ( !(Ed.hwinfo & ED_HWINFO_SKIP)
3707	&& (TdAddr != TailP))
3708	{
3709	do
3710	{
3711	ohciReadTd(pThis, TdAddr, &Td);
3712	j = ohci_in_flight_find(pThis, TdAddr);
3713	if (j > -1)
3714	pThis->aInFlight[j].fInactive = false;
3715	TdAddr = Td.NextTD & ED_PTR_MASK;
3716	/* Failsafe for temporarily looped lists. */
3717	if (++k == 128)
3718	break;
3719	} while (TdAddr != (Ed.TailP & ED_PTR_MASK));
3720	}
3721	EdAddr = Ed.NextED & ED_PTR_MASK;
3722	}
3723	}
3724
3725	/* In-flight URBs still marked as inactive are not used anymore and need
3726	* to be canceled.
3727	*/
3728	for (i = 0, cLeft = pThis->cInFlight; cLeft && i < RT_ELEMENTS(pThis->aInFlight); i++)
3729	{
3730	if (pThis->aInFlight[i].pUrb)
3731	{
3732	cLeft--;
3733	pUrb = pThis->aInFlight[i].pUrb;
3734	if (pThis->aInFlight[i].fInactive
3735	&& pUrb->enmState == VUSBURBSTATE_IN_FLIGHT
3736	&& pUrb->enmType != VUSBXFERTYPE_CTRL)
3737	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3738	}
3739	}
3740	Assert(cLeft == 0);
3741	}
3742
3743	/**
3744	* Generate a Start-Of-Frame event, and set a timer for End-Of-Frame.
3745	*/
3746	static void ohciStartOfFrame(POHCI pThis)
3747	{
3748	#ifdef LOG_ENABLED
3749	const uint32_t status_old = pThis->status;
3750	#endif
3751
3752	/*
3753	* Update HcFmRemaining.FRT and update start of frame time.
3754	*/
3755	pThis->frt = pThis->fit;
3756	pThis->SofTime += pThis->cTicksPerFrame;
3757
3758	/*
3759	* Check that the HCCA address isn't bogus. Linux 2.4.x is known to start
3760	* the bus with a hcca of 0 to work around problem with a specific controller.
3761	*/
3762	bool fValidHCCA = !( pThis->hcca >= OHCI_HCCA_MASK
3763	\|\| pThis->hcca < ~OHCI_HCCA_MASK);
3764
3765	#if 1
3766	/*
3767	* Update the HCCA.
3768	* Should be done after SOF but before HC read first ED in this frame.
3769	*/
3770	if (fValidHCCA)
3771	ohciUpdateHCCA(pThis);
3772	#endif
3773
3774	/* "After writing to HCCA, HC will set SF in HcInterruptStatus" - guest isn't executing, so ignore the order! */
3775	ohciR3SetInterrupt(pThis, OHCI_INTR_START_OF_FRAME);
3776
3777	if (pThis->fno)
3778	{
3779	ohciR3SetInterrupt(pThis, OHCI_INTR_FRAMENUMBER_OVERFLOW);
3780	pThis->fno = 0;
3781	}
3782
3783	/* If the HCCA address is invalid, we're quitting here to avoid doing something which cannot be reported to the HCD. */
3784	if (!fValidHCCA)
3785	{
3786	Log(("ohciStartOfFrame: skipping hcca part because hcca=%RX32 (our 'valid' range: %RX32-%RX32)\n",
3787	pThis->hcca, ~OHCI_HCCA_MASK, OHCI_HCCA_MASK));
3788	return;
3789	}
3790
3791	/*
3792	* Periodic EPs.
3793	*/
3794	if (pThis->ctl & OHCI_CTL_PLE)
3795	ohciServicePeriodicList(pThis);
3796
3797	/*
3798	* Control EPs.
3799	*/
3800	if ( (pThis->ctl & OHCI_CTL_CLE)
3801	&& (pThis->status & OHCI_STATUS_CLF) )
3802	ohciServiceCtrlList(pThis);
3803
3804	/*
3805	* Bulk EPs.
3806	*/
3807	if ( (pThis->ctl & OHCI_CTL_BLE)
3808	&& (pThis->status & OHCI_STATUS_BLF))
3809	ohciServiceBulkList(pThis);
3810	else if ((pThis->status & OHCI_STATUS_BLF)
3811	&& pThis->fBulkNeedsCleaning)
3812	ohciUndoBulkList(pThis); /* If list disabled but not empty, abort endpoints. */
3813
3814	#if 0
3815	/*
3816	* Update the HCCA after processing the lists and everything. A bit experimental.
3817	*
3818	* ASSUME the guest won't be very upset if a TD is completed, retired and handed
3819	* back immediately. The idea is to be able to retire the data and/or status stages
3820	* of a control transfer together with the setup stage, thus saving a frame. This
3821	* behaviour is should be perfectly ok, since the setup (and maybe data) stages
3822	* have already taken at least one frame to complete.
3823	*
3824	* But, when implementing the first synchronous virtual USB devices, we'll have to
3825	* verify that the guest doesn't choke when having a TD returned in the same frame
3826	* as it was submitted.
3827	*/
3828	ohciUpdateHCCA(pThis);
3829	#endif
3830
3831	#ifdef LOG_ENABLED
3832	if (pThis->status ^ status_old)
3833	{
3834	uint32_t val = pThis->status;
3835	uint32_t chg = val ^ status_old; NOREF(chg);
3836	Log2(("ohciStartOfFrame: HcCommandStatus=%#010x: %sHCR=%d %sCLF=%d %sBLF=%d %sOCR=%d %sSOC=%d\n",
3837	val,
3838	chg & RT_BIT(0) ? "*" : "", val & 1,
3839	chg & RT_BIT(1) ? "*" : "", (val >> 1) & 1,
3840	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
3841	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
3842	chg & (3<<16)? "*" : "", (val >> 16) & 3));
3843	}
3844	#endif
3845
3846	/*
3847	* Adjust the frame timer interval based on idle detection.
3848	*/
3849	ohciFramerateCalcNew(pThis);
3850	}
3851
3852	/**
3853	* Updates the HcFmNumber and FNO registers.
3854	*/
3855	static void bump_frame_number(POHCI pThis)
3856	{
3857	const uint16_t u16OldFmNumber = pThis->HcFmNumber++;
3858	if ((u16OldFmNumber ^ pThis->HcFmNumber) & RT_BIT(15))
3859	pThis->fno = 1;
3860	}
3861
3862	static DECLCALLBACK(int) ohciR3ThreadFrame(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3863	{
3864	POHCI pThis = (POHCI)pThread->pvUser;
3865	uint64_t tsBeginServicing = 0;
3866	uint64_t cFramesProcessed = 0;
3867
3868	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3869	return VINF_SUCCESS;
3870
3871	tsBeginServicing = RTTimeNanoTS();
3872	cFramesProcessed = 0;
3873
3874	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3875	{
3876	while ( !ASMAtomicReadBool(&pThis->fBusStarted)
3877	&& pThread->enmState == PDMTHREADSTATE_RUNNING)
3878	{
3879	/* Signal the waiter that we are stopped now. */
3880	int rc = RTSemEventMultiSignal(pThis->hSemEventFrameStopped);
3881	AssertRC(rc);
3882	rc = RTSemEventMultiReset(pThis->hSemEventFrame);
3883	AssertRC(rc);
3884
3885	/*
3886	* We have to check that the Bus was not started and the thread state
3887	* did not change or otherwise we risk hanging here indefinitely
3888	* if the signaller set the event semaphore before we reset it.
3889	*/
3890	if (ASMAtomicReadBool(&pThis->fBusStarted) \|\| pThread->enmState != PDMTHREADSTATE_RUNNING)
3891	break;
3892
3893	rc = RTSemEventMultiWait(pThis->hSemEventFrame, RT_INDEFINITE_WAIT);
3894	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_TIMEOUT, ("%Rrc\n", rc), rc);
3895	tsBeginServicing = RTTimeNanoTS();
3896	cFramesProcessed = 0;
3897	}
3898
3899	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3900	break;
3901
3902	RTCritSectEnter(&pThis->CritSect);
3903
3904	/* Reset idle detection flag */
3905	pThis->fIdle = true;
3906
3907	/*
3908	* Process new frames until we reached the required amount of
3909	* frames for this service period. We might need to catch up
3910	* here and process multiple frames at once due to scheduling
3911	* preempting us. This is required because isochronous transfers
3912	* have a tight timing requirement.
3913	*/
3914	uint64_t tsNow = RTTimeNanoTS();
3915	uint64_t nsWait = 0;
3916	while (tsBeginServicing + (cFramesProcessed * RT_NS_1MS) < tsNow)
3917	{
3918	uint64_t tsNanoStart = RTTimeNanoTS();
3919	LogFlowFunc(("Starting new frame at ts %llu\n", tsNanoStart));
3920
3921	/* Frame boundary, so do EOF stuff here. */
3922	bump_frame_number(pThis);
3923	if ( (pThis->dqic != 0x7) && (pThis->dqic != 0))
3924	pThis->dqic--;
3925
3926	/* Clean up any URBs that have been removed. */
3927	ohciCancelOrphanedURBs(pThis);
3928
3929	/* Start the next frame. */
3930	ohciStartOfFrame(pThis);
3931	cFramesProcessed++;
3932
3933	tsNow = RTTimeNanoTS();
3934	uint64_t tsFrameNext = tsNanoStart + pThis->nsWait;
3935
3936	if (tsFrameNext > tsNow)
3937	{
3938	nsWait = tsFrameNext - tsNow;
3939	LogFlowFunc(("Current frame took %llu nano seconds to finish, we can wait %llu ns for the next frame\n", tsNow - tsNanoStart, nsWait));
3940	break;
3941	}
3942	else if (tsBeginServicing + (cFramesProcessed + 100) * RT_NS_1MS < tsNow)
3943	{
3944	/* If we lag to far behind stop trying to catch up. */
3945	LogRelMax(10, ("OHCI#%u: Lagging too far behind, not trying to catch up anymore. Expect glitches with USB devices\n",
3946	pThis->pDevInsR3->iInstance));
3947	tsBeginServicing = tsNow;
3948	cFramesProcessed = 0;
3949	}
3950	}
3951
3952	RTCritSectLeave(&pThis->CritSect);
3953
3954	/* Wait for the next round. */
3955	if (nsWait >= 500 * RT_NS_1US)
3956	{
3957	LogFlowFunc(("Going to sleep for at least %llu ns\n", nsWait));
3958	int rc = RTSemEventMultiWaitEx(pThis->hSemEventFrame, RTSEMWAIT_FLAGS_RELATIVE \| RTSEMWAIT_FLAGS_NANOSECS \| RTSEMWAIT_FLAGS_UNINTERRUPTIBLE,
3959	nsWait);
3960	AssertLogRelMsg(RT_SUCCESS(rc) \|\| rc == VERR_TIMEOUT, ("%Rrc\n", rc));
3961	RTSemEventMultiReset(pThis->hSemEventFrame);
3962	}
3963	}
3964
3965	return VINF_SUCCESS;
3966	}
3967
3968	/**
3969	* Unblock the framer thread so it can respond to a state change.
3970	*
3971	* @returns VBox status code.
3972	* @param pDevIns The device instance.
3973	* @param pThread The send thread.
3974	*/
3975	static DECLCALLBACK(int) ohciR3ThreadFrameWakeup(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3976	{
3977	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
3978	return RTSemEventMultiSignal(pThis->hSemEventFrame);
3979	}
3980
3981	/**
3982	* Do frame processing on frame boundary
3983	*/
3984	static DECLCALLBACK(void) ohciFrameBoundaryTimer(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser)
3985	{
3986	}
3987
3988	/**
3989	* Start sending SOF tokens across the USB bus, lists are processed in
3990	* next frame
3991	*/
3992	static void ohciBusStart(POHCI pThis)
3993	{
3994	VUSBIDevPowerOn(pThis->RootHub.pIDev);
3995	pThis->dqic = 0x7;
3996
3997	Log(("ohci: %s: Bus started\n", pThis->PciDev.name));
3998
3999	pThis->SofTime = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns));
4000	bool fBusActive = ASMAtomicXchgBool(&pThis->fBusStarted, true);
4001	if (!fBusActive)
4002	RTSemEventMultiSignal(pThis->hSemEventFrame);
4003	}
4004
4005	/**
4006	* Stop sending SOF tokens on the bus
4007	*/
4008	static void ohciBusStop(POHCI pThis)
4009	{
4010	bool fBusActive = ASMAtomicXchgBool(&pThis->fBusStarted, false);
4011	if (fBusActive)
4012	{
4013	int rc = RTSemEventMultiReset(pThis->hSemEventFrameStopped);
4014	AssertRC(rc);
4015
4016	/* Signal the frame thread to stop. */
4017	RTSemEventMultiSignal(pThis->hSemEventFrame);
4018
4019	/* Wait for signal from the thrad that it stopped. */
4020	rc = RTSemEventMultiWait(pThis->hSemEventFrameStopped, RT_INDEFINITE_WAIT);
4021	AssertRC(rc);
4022	}
4023	VUSBIDevPowerOff(pThis->RootHub.pIDev);
4024	}
4025
4026	/**
4027	* Move in to resume state
4028	*/
4029	static void ohciBusResume(POHCI pThis, bool fHardware)
4030	{
4031	pThis->ctl &= ~OHCI_CTL_HCFS;
4032	pThis->ctl \|= OHCI_USB_RESUME;
4033
4034	Log(("pThis: ohciBusResume fHardware=%RTbool RWE=%s\n",
4035	fHardware, (pThis->ctl & OHCI_CTL_RWE) ? "on" : "off"));
4036
4037	if (fHardware && (pThis->ctl & OHCI_CTL_RWE))
4038	ohciR3SetInterrupt(pThis, OHCI_INTR_RESUME_DETECT);
4039
4040	ohciBusStart(pThis);
4041	}
4042
4043
4044	/* Power a port up or down */
4045	static void rhport_power(POHCIROOTHUB pRh, unsigned iPort, bool fPowerUp)
4046	{
4047	POHCIHUBPORT pPort = &pRh->aPorts[iPort];
4048	bool fOldPPS = !!(pPort->fReg & OHCI_PORT_PPS);
4049	if (fPowerUp)
4050	{
4051	/* power up */
4052	if (pPort->pDev)
4053	pPort->fReg \|= OHCI_PORT_R_CURRENT_CONNECT_STATUS;
4054	if (pPort->fReg & OHCI_PORT_R_CURRENT_CONNECT_STATUS)
4055	pPort->fReg \|= OHCI_PORT_R_POWER_STATUS;
4056	if (pPort->pDev && !fOldPPS)
4057	VUSBIDevPowerOn(pPort->pDev);
4058	}
4059	else
4060	{
4061	/* power down */
4062	pPort->fReg &= ~( OHCI_PORT_R_POWER_STATUS
4063	\| OHCI_PORT_R_CURRENT_CONNECT_STATUS
4064	\| OHCI_PORT_R_SUSPEND_STATUS
4065	\| OHCI_PORT_R_RESET_STATUS);
4066	if (pPort->pDev && fOldPPS)
4067	VUSBIDevPowerOff(pPort->pDev);
4068	}
4069	}
4070
4071	#endif /* IN_RING3 */
4072
4073	/**
4074	* Read the HcRevision register.
4075	*/
4076	static int HcRevision_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4077	{
4078	Log2(("HcRevision_r() -> 0x10\n"));
4079	pu32Value = 0x10; / OHCI revision 1.0, no emulation. */
4080	return VINF_SUCCESS;
4081	}
4082
4083	/**
4084	* Write to the HcRevision register.
4085	*/
4086	static int HcRevision_w(POHCI pThis, uint32_t iReg, uint32_t u32Value)
4087	{
4088	Log2(("HcRevision_w(%#010x) - denied\n", u32Value));
4089	AssertMsgFailed(("Invalid operation!!! u32Value=%#010x\n", u32Value));
4090	return VINF_SUCCESS;
4091	}
4092
4093	/**
4094	* Read the HcControl register.
4095	*/
4096	static int HcControl_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4097	{
4098	uint32_t ctl = pThis->ctl;
4099	Log2(("HcControl_r -> %#010x - CBSR=%d PLE=%d IE=%d CLE=%d BLE=%d HCFS=%#x IR=%d RWC=%d RWE=%d\n",
4100	ctl, ctl & 3, (ctl >> 2) & 1, (ctl >> 3) & 1, (ctl >> 4) & 1, (ctl >> 5) & 1, (ctl >> 6) & 3, (ctl >> 8) & 1,
4101	(ctl >> 9) & 1, (ctl >> 10) & 1));
4102	*pu32Value = ctl;
4103	return VINF_SUCCESS;
4104	}
4105
4106	/**
4107	* Write the HcControl register.
4108	*/
4109	static int HcControl_w(POHCI pThis, uint32_t iReg, uint32_t val)
4110	{
4111	/* log it. */
4112	uint32_t chg = pThis->ctl ^ val; NOREF(chg);
4113	Log2(("HcControl_w(%#010x) => %sCBSR=%d %sPLE=%d %sIE=%d %sCLE=%d %sBLE=%d %sHCFS=%#x %sIR=%d %sRWC=%d %sRWE=%d\n",
4114	val,
4115	chg & 3 ? "*" : "", val & 3,
4116	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
4117	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
4118	chg & RT_BIT(4) ? "*" : "", (val >> 4) & 1,
4119	chg & RT_BIT(5) ? "*" : "", (val >> 5) & 1,
4120	chg & (3 << 6)? "*" : "", (val >> 6) & 3,
4121	chg & RT_BIT(8) ? "*" : "", (val >> 8) & 1,
4122	chg & RT_BIT(9) ? "*" : "", (val >> 9) & 1,
4123	chg & RT_BIT(10) ? "*" : "", (val >> 10) & 1));
4124	if (val & ~0x07ff)
4125	Log2(("Unknown bits %#x are set!!!\n", val & ~0x07ff));
4126
4127	/* see what changed and take action on that. */
4128	uint32_t old_state = pThis->ctl & OHCI_CTL_HCFS;
4129	uint32_t new_state = val & OHCI_CTL_HCFS;
4130
4131	#ifdef IN_RING3
4132	pThis->ctl = val;
4133	if (new_state != old_state)
4134	{
4135	switch (new_state)
4136	{
4137	case OHCI_USB_OPERATIONAL:
4138	LogRel(("OHCI: USB Operational\n"));
4139	ohciBusStart(pThis);
4140	break;
4141	case OHCI_USB_SUSPEND:
4142	ohciBusStop(pThis);
4143	LogRel(("OHCI: USB Suspended\n"));
4144	break;
4145	case OHCI_USB_RESUME:
4146	LogRel(("OHCI: USB Resume\n"));
4147	ohciBusResume(pThis, false /* not hardware */);
4148	break;
4149	case OHCI_USB_RESET:
4150	{
4151	LogRel(("OHCI: USB Reset\n"));
4152	ohciBusStop(pThis);
4153	/** @todo This should probably do a real reset, but we don't implement
4154	* that correctly in the roothub reset callback yet. check it's
4155	* comments and argument for more details. */
4156	VUSBIDevReset(pThis->RootHub.pIDev, false /* don't do a real reset */, NULL, NULL, NULL);
4157	break;
4158	}
4159	}
4160	}
4161	#else /* !IN_RING3 */
4162	if ( new_state != old_state )
4163	{
4164	Log2(("HcControl_w: state changed -> VINF_IOM_R3_MMIO_WRITE\n"));
4165	return VINF_IOM_R3_MMIO_WRITE;
4166	}
4167	pThis->ctl = val;
4168	#endif /* !IN_RING3 */
4169
4170	return VINF_SUCCESS;
4171	}
4172
4173	/**
4174	* Read the HcCommandStatus register.
4175	*/
4176	static int HcCommandStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4177	{
4178	uint32_t status = pThis->status;
4179	Log2(("HcCommandStatus_r() -> %#010x - HCR=%d CLF=%d BLF=%d OCR=%d SOC=%d\n",
4180	status, status & 1, (status >> 1) & 1, (status >> 2) & 1, (status >> 3) & 1, (status >> 16) & 3));
4181	*pu32Value = status;
4182	return VINF_SUCCESS;
4183	}
4184
4185	/**
4186	* Write to the HcCommandStatus register.
4187	*/
4188	static int HcCommandStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4189	{
4190	/* log */
4191	uint32_t chg = pThis->status ^ val; NOREF(chg);
4192	Log2(("HcCommandStatus_w(%#010x) => %sHCR=%d %sCLF=%d %sBLF=%d %sOCR=%d %sSOC=%d\n",
4193	val,
4194	chg & RT_BIT(0) ? "*" : "", val & 1,
4195	chg & RT_BIT(1) ? "*" : "", (val >> 1) & 1,
4196	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
4197	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
4198	chg & (3<<16)? "!!!":"", (pThis->status >> 16) & 3));
4199	if (val & ~0x0003000f)
4200	Log2(("Unknown bits %#x are set!!!\n", val & ~0x0003000f));
4201
4202	/* SOC is read-only */
4203	val = (val & ~OHCI_STATUS_SOC);
4204
4205	#ifdef IN_RING3
4206	/* "bits written as '0' remain unchanged in the register" */
4207	pThis->status \|= val;
4208	if (pThis->status & OHCI_STATUS_HCR)
4209	{
4210	LogRel(("OHCI: Software reset\n"));
4211	ohciDoReset(pThis, OHCI_USB_SUSPEND, false /* N/A */);
4212	}
4213	#else
4214	if ((pThis->status \| val) & OHCI_STATUS_HCR)
4215	{
4216	LogFlow(("HcCommandStatus_w: reset -> VINF_IOM_R3_MMIO_WRITE\n"));
4217	return VINF_IOM_R3_MMIO_WRITE;
4218	}
4219	pThis->status \|= val;
4220	#endif
4221	return VINF_SUCCESS;
4222	}
4223
4224	/**
4225	* Read the HcInterruptStatus register.
4226	*/
4227	static int HcInterruptStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4228	{
4229	uint32_t val = pThis->intr_status;
4230	Log2(("HcInterruptStatus_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d\n",
4231	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4232	(val >> 6) & 1, (val >> 30) & 1));
4233	*pu32Value = val;
4234	return VINF_SUCCESS;
4235	}
4236
4237	/**
4238	* Write to the HcInterruptStatus register.
4239	*/
4240	static int HcInterruptStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4241	{
4242	uint32_t res = pThis->intr_status & ~val;
4243	uint32_t chg = pThis->intr_status ^ res; NOREF(chg);
4244
4245	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4246	if (rc != VINF_SUCCESS)
4247	return rc;
4248
4249	Log2(("HcInterruptStatus_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d\n",
4250	val,
4251	chg & RT_BIT(0) ? "*" : "", res & 1,
4252	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4253	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4254	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4255	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4256	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4257	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4258	chg & RT_BIT(30)? "*" : "", (res >> 30) & 1));
4259	if ( (val & ~0xc000007f)
4260	&& val != 0xffffffff /* ignore clear-all-like requests from xp. */)
4261	Log2(("Unknown bits %#x are set!!!\n", val & ~0xc000007f));
4262
4263	/* "The Host Controller Driver may clear specific bits in this
4264	* register by writing '1' to bit positions to be cleared"
4265	*/
4266	pThis->intr_status &= ~val;
4267	ohciUpdateInterruptLocked(pThis, "HcInterruptStatus_w");
4268	PDMCritSectLeave(&pThis->CsIrq);
4269	return VINF_SUCCESS;
4270	}
4271
4272	/**
4273	* Read the HcInterruptEnable register
4274	*/
4275	static int HcInterruptEnable_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4276	{
4277	uint32_t val = pThis->intr;
4278	Log2(("HcInterruptEnable_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
4279	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4280	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1));
4281	*pu32Value = val;
4282	return VINF_SUCCESS;
4283	}
4284
4285	/**
4286	* Writes to the HcInterruptEnable register.
4287	*/
4288	static int HcInterruptEnable_w(POHCI pThis, uint32_t iReg, uint32_t val)
4289	{
4290	uint32_t res = pThis->intr \| val;
4291	uint32_t chg = pThis->intr ^ res; NOREF(chg);
4292
4293	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4294	if (rc != VINF_SUCCESS)
4295	return rc;
4296
4297	Log2(("HcInterruptEnable_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d %sMIE=%d\n",
4298	val,
4299	chg & RT_BIT(0) ? "*" : "", res & 1,
4300	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4301	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4302	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4303	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4304	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4305	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4306	chg & RT_BIT(30) ? "*" : "", (res >> 30) & 1,
4307	chg & RT_BIT(31) ? "*" : "", (res >> 31) & 1));
4308	if (val & ~0xc000007f)
4309	Log2(("Uknown bits %#x are set!!!\n", val & ~0xc000007f));
4310
4311	pThis->intr \|= val;
4312	ohciUpdateInterruptLocked(pThis, "HcInterruptEnable_w");
4313	PDMCritSectLeave(&pThis->CsIrq);
4314	return VINF_SUCCESS;
4315	}
4316
4317	/**
4318	* Reads the HcInterruptDisable register.
4319	*/
4320	static int HcInterruptDisable_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4321	{
4322	#if 1 /** @todo r=bird: "On read, the current value of the HcInterruptEnable register is returned." */
4323	uint32_t val = pThis->intr;
4324	#else /* old code. */
4325	uint32_t val = ~pThis->intr;
4326	#endif
4327	Log2(("HcInterruptDisable_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
4328	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4329	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1));
4330
4331	*pu32Value = val;
4332	return VINF_SUCCESS;
4333	}
4334
4335	/**
4336	* Writes to the HcInterruptDisable register.
4337	*/
4338	static int HcInterruptDisable_w(POHCI pThis, uint32_t iReg, uint32_t val)
4339	{
4340	uint32_t res = pThis->intr & ~val;
4341	uint32_t chg = pThis->intr ^ res; NOREF(chg);
4342
4343	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4344	if (rc != VINF_SUCCESS)
4345	return rc;
4346
4347	Log2(("HcInterruptDisable_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d %sMIE=%d\n",
4348	val,
4349	chg & RT_BIT(0) ? "*" : "", res & 1,
4350	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4351	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4352	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4353	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4354	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4355	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4356	chg & RT_BIT(30) ? "*" : "", (res >> 30) & 1,
4357	chg & RT_BIT(31) ? "*" : "", (res >> 31) & 1));
4358	/* Don't bitch about invalid bits here since it makes sense to disable
4359	* interrupts you don't know about. */
4360
4361	pThis->intr &= ~val;
4362	ohciUpdateInterruptLocked(pThis, "HcInterruptDisable_w");
4363	PDMCritSectLeave(&pThis->CsIrq);
4364	return VINF_SUCCESS;
4365	}
4366
4367	/**
4368	* Read the HcHCCA register (Host Controller Communications Area physical address).
4369	*/
4370	static int HcHCCA_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4371	{
4372	Log2(("HcHCCA_r() -> %#010x\n", pThis->hcca));
4373	*pu32Value = pThis->hcca;
4374	return VINF_SUCCESS;
4375	}
4376
4377	/**
4378	* Write to the HcHCCA register (Host Controller Communications Area physical address).
4379	*/
4380	static int HcHCCA_w(POHCI pThis, uint32_t iReg, uint32_t Value)
4381	{
4382	Log2(("HcHCCA_w(%#010x) - old=%#010x new=%#010x\n", Value, pThis->hcca, Value & OHCI_HCCA_MASK));
4383	pThis->hcca = Value & OHCI_HCCA_MASK;
4384	return VINF_SUCCESS;
4385	}
4386
4387	/**
4388	* Read the HcPeriodCurrentED register.
4389	*/
4390	static int HcPeriodCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4391	{
4392	Log2(("HcPeriodCurrentED_r() -> %#010x\n", pThis->per_cur));
4393	*pu32Value = pThis->per_cur;
4394	return VINF_SUCCESS;
4395	}
4396
4397	/**
4398	* Write to the HcPeriodCurrentED register.
4399	*/
4400	static int HcPeriodCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4401	{
4402	Log(("HcPeriodCurrentED_w(%#010x) - old=%#010x new=%#010x (This is a read only register, only the linux guys don't respect that!)\n",
4403	val, pThis->per_cur, val & ~7));
4404	//AssertMsgFailed(("HCD (Host Controller Driver) should not write to HcPeriodCurrentED! val=%#010x (old=%#010x)\n", val, pThis->per_cur));
4405	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4406	pThis->per_cur = val & ~7;
4407	return VINF_SUCCESS;
4408	}
4409
4410	/**
4411	* Read the HcControlHeadED register.
4412	*/
4413	static int HcControlHeadED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4414	{
4415	Log2(("HcControlHeadED_r() -> %#010x\n", pThis->ctrl_head));
4416	*pu32Value = pThis->ctrl_head;
4417	return VINF_SUCCESS;
4418	}
4419
4420	/**
4421	* Write to the HcControlHeadED register.
4422	*/
4423	static int HcControlHeadED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4424	{
4425	Log2(("HcControlHeadED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->ctrl_head, val & ~7));
4426	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4427	pThis->ctrl_head = val & ~7;
4428	return VINF_SUCCESS;
4429	}
4430
4431	/**
4432	* Read the HcControlCurrentED register.
4433	*/
4434	static int HcControlCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4435	{
4436	Log2(("HcControlCurrentED_r() -> %#010x\n", pThis->ctrl_cur));
4437	*pu32Value = pThis->ctrl_cur;
4438	return VINF_SUCCESS;
4439	}
4440
4441	/**
4442	* Write to the HcControlCurrentED register.
4443	*/
4444	static int HcControlCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4445	{
4446	Log2(("HcControlCurrentED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->ctrl_cur, val & ~7));
4447	AssertMsg(!(pThis->ctl & OHCI_CTL_CLE), ("Illegal write! HcControl.ControlListEnabled is set! val=%#010x\n", val));
4448	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4449	pThis->ctrl_cur = val & ~7;
4450	return VINF_SUCCESS;
4451	}
4452
4453	/**
4454	* Read the HcBulkHeadED register.
4455	*/
4456	static int HcBulkHeadED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4457	{
4458	Log2(("HcBulkHeadED_r() -> %#010x\n", pThis->bulk_head));
4459	*pu32Value = pThis->bulk_head;
4460	return VINF_SUCCESS;
4461	}
4462
4463	/**
4464	* Write to the HcBulkHeadED register.
4465	*/
4466	static int HcBulkHeadED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4467	{
4468	Log2(("HcBulkHeadED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->bulk_head, val & ~7));
4469	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4470	pThis->bulk_head = val & ~7; /** @todo The ATI OHCI controller on my machine enforces 16-byte address alignment. */
4471	return VINF_SUCCESS;
4472	}
4473
4474	/**
4475	* Read the HcBulkCurrentED register.
4476	*/
4477	static int HcBulkCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4478	{
4479	Log2(("HcBulkCurrentED_r() -> %#010x\n", pThis->bulk_cur));
4480	*pu32Value = pThis->bulk_cur;
4481	return VINF_SUCCESS;
4482	}
4483
4484	/**
4485	* Write to the HcBulkCurrentED register.
4486	*/
4487	static int HcBulkCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4488	{
4489	Log2(("HcBulkCurrentED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->bulk_cur, val & ~7));
4490	AssertMsg(!(pThis->ctl & OHCI_CTL_BLE), ("Illegal write! HcControl.BulkListEnabled is set! val=%#010x\n", val));
4491	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4492	pThis->bulk_cur = val & ~7;
4493	return VINF_SUCCESS;
4494	}
4495
4496
4497	/**
4498	* Read the HcDoneHead register.
4499	*/
4500	static int HcDoneHead_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4501	{
4502	Log2(("HcDoneHead_r() -> 0x%#08x\n", pThis->done));
4503	*pu32Value = pThis->done;
4504	return VINF_SUCCESS;
4505	}
4506
4507	/**
4508	* Write to the HcDoneHead register.
4509	*/
4510	static int HcDoneHead_w(POHCI pThis, uint32_t iReg, uint32_t val)
4511	{
4512	Log2(("HcDoneHead_w(0x%#08x) - denied!!!\n", val));
4513	/AssertMsgFailed(("Illegal operation!!! val=%#010x\n", val)); - OS/2 does this /
4514	return VINF_SUCCESS;
4515	}
4516
4517
4518	/**
4519	* Read the HcFmInterval (Fm=Frame) register.
4520	*/
4521	static int HcFmInterval_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4522	{
4523	uint32_t val = (pThis->fit << 31) \| (pThis->fsmps << 16) \| (pThis->fi);
4524	Log2(("HcFmInterval_r() -> 0x%#08x - FI=%d FSMPS=%d FIT=%d\n",
4525	val, val & 0x3fff, (val >> 16) & 0x7fff, val >> 31));
4526	*pu32Value = val;
4527	return VINF_SUCCESS;
4528	}
4529
4530	/**
4531	* Write to the HcFmInterval (Fm = Frame) register.
4532	*/
4533	static int HcFmInterval_w(POHCI pThis, uint32_t iReg, uint32_t val)
4534	{
4535	/* log */
4536	uint32_t chg = val ^ ((pThis->fit << 31) \| (pThis->fsmps << 16) \| pThis->fi); NOREF(chg);
4537	Log2(("HcFmInterval_w(%#010x) => %sFI=%d %sFSMPS=%d %sFIT=%d\n",
4538	val,
4539	chg & 0x00003fff ? "*" : "", val & 0x3fff,
4540	chg & 0x7fff0000 ? "*" : "", (val >> 16) & 0x7fff,
4541	chg >> 31 ? "*" : "", (val >> 31) & 1));
4542	if ( pThis->fi != (val & OHCI_FMI_FI) )
4543	{
4544	Log(("ohci: FrameInterval: %#010x -> %#010x\n", pThis->fi, val & OHCI_FMI_FI));
4545	AssertMsg(pThis->fit != ((val >> OHCI_FMI_FIT_SHIFT) & 1), ("HCD didn't toggle the FIT bit!!!\n"));
4546	}
4547
4548	/* update */
4549	pThis->fi = val & OHCI_FMI_FI;
4550	pThis->fit = (val & OHCI_FMI_FIT) >> OHCI_FMI_FIT_SHIFT;
4551	pThis->fsmps = (val & OHCI_FMI_FSMPS) >> OHCI_FMI_FSMPS_SHIFT;
4552	return VINF_SUCCESS;
4553	}
4554
4555	/**
4556	* Read the HcFmRemaining (Fm = Frame) register.
4557	*/
4558	static int HcFmRemaining_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4559	{
4560	uint32_t Value = pThis->frt << 31;
4561	if ((pThis->ctl & OHCI_CTL_HCFS) == OHCI_USB_OPERATIONAL)
4562	{
4563	/*
4564	* Being in USB operational state guarantees SofTime was set already.
4565	*/
4566	uint64_t tks = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns)) - pThis->SofTime;
4567	if (tks < pThis->cTicksPerFrame) /* avoid muldiv if possible */
4568	{
4569	uint16_t fr;
4570	tks = ASMMultU64ByU32DivByU32(1, tks, pThis->cTicksPerUsbTick);
4571	fr = (uint16_t)(pThis->fi - tks);
4572	Value \|= fr;
4573	}
4574	}
4575
4576	Log2(("HcFmRemaining_r() -> %#010x - FR=%d FRT=%d\n", Value, Value & 0x3fff, Value >> 31));
4577	*pu32Value = Value;
4578	return VINF_SUCCESS;
4579	}
4580
4581	/**
4582	* Write to the HcFmRemaining (Fm = Frame) register.
4583	*/
4584	static int HcFmRemaining_w(POHCI pThis, uint32_t iReg, uint32_t val)
4585	{
4586	Log2(("HcFmRemaining_w(%#010x) - denied\n", val));
4587	AssertMsgFailed(("Invalid operation!!! val=%#010x\n", val));
4588	return VINF_SUCCESS;
4589	}
4590
4591	/**
4592	* Read the HcFmNumber (Fm = Frame) register.
4593	*/
4594	static int HcFmNumber_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4595	{
4596	uint32_t val = (uint16_t)pThis->HcFmNumber;
4597	Log2(("HcFmNumber_r() -> %#010x - FN=%#x(%d) (32-bit=%#x(%d))\n", val, val, val, pThis->HcFmNumber, pThis->HcFmNumber));
4598	*pu32Value = val;
4599	return VINF_SUCCESS;
4600	}
4601
4602	/**
4603	* Write to the HcFmNumber (Fm = Frame) register.
4604	*/
4605	static int HcFmNumber_w(POHCI pThis, uint32_t iReg, uint32_t val)
4606	{
4607	Log2(("HcFmNumber_w(%#010x) - denied\n", val));
4608	AssertMsgFailed(("Invalid operation!!! val=%#010x\n", val));
4609	return VINF_SUCCESS;
4610	}
4611
4612	/**
4613	* Read the HcPeriodicStart register.
4614	* The register determines when in a frame to switch from control&bulk to periodic lists.
4615	*/
4616	static int HcPeriodicStart_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4617	{
4618	Log2(("HcPeriodicStart_r() -> %#010x - PS=%d\n", pThis->pstart, pThis->pstart & 0x3fff));
4619	*pu32Value = pThis->pstart;
4620	return VINF_SUCCESS;
4621	}
4622
4623	/**
4624	* Write to the HcPeriodicStart register.
4625	* The register determines when in a frame to switch from control&bulk to periodic lists.
4626	*/
4627	static int HcPeriodicStart_w(POHCI pThis, uint32_t iReg, uint32_t val)
4628	{
4629	Log2(("HcPeriodicStart_w(%#010x) => PS=%d\n", val, val & 0x3fff));
4630	if (val & ~0x3fff)
4631	Log2(("Unknown bits %#x are set!!!\n", val & ~0x3fff));
4632	pThis->pstart = val; /** @todo r=bird: should we support setting the other bits? */
4633	return VINF_SUCCESS;
4634	}
4635
4636	/**
4637	* Read the HcLSThreshold register.
4638	*/
4639	static int HcLSThreshold_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4640	{
4641	Log2(("HcLSThreshold_r() -> %#010x\n", OHCI_LS_THRESH));
4642	*pu32Value = OHCI_LS_THRESH;
4643	return VINF_SUCCESS;
4644	}
4645
4646	/**
4647	* Write to the HcLSThreshold register.
4648	*
4649	* Docs are inconsistent here:
4650	*
4651	* "Neither the Host Controller nor the Host Controller Driver are allowed to change this value."
4652	*
4653	* "This value is calculated by HCD with the consideration of transmission and setup overhead."
4654	*
4655	* The register is marked "R/W" the HCD column.
4656	*
4657	*/
4658	static int HcLSThreshold_w(POHCI pThis, uint32_t iReg, uint32_t val)
4659	{
4660	Log2(("HcLSThreshold_w(%#010x) => LST=0x%03x(%d)\n", val, val & 0x0fff, val & 0x0fff));
4661	AssertMsg(val == OHCI_LS_THRESH,
4662	("HCD tried to write bad LS threshold: 0x%x (see function header)\n", val));
4663	/** @todo the HCD can change this. */
4664	return VINF_SUCCESS;
4665	}
4666
4667	/**
4668	* Read the HcRhDescriptorA register.
4669	*/
4670	static int HcRhDescriptorA_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4671	{
4672	uint32_t val = pThis->RootHub.desc_a;
4673	#if 0 /* annoying */
4674	Log2(("HcRhDescriptorA_r() -> %#010x - NDP=%d PSM=%d NPS=%d DT=%d OCPM=%d NOCP=%d POTGT=%#x\n",
4675	val, val & 0xff, (val >> 8) & 1, (val >> 9) & 1, (val >> 10) & 1, (val >> 11) & 1,
4676	(val >> 12) & 1, (val >> 24) & 0xff));
4677	#endif
4678	*pu32Value = val;
4679	return VINF_SUCCESS;
4680	}
4681
4682	/**
4683	* Write to the HcRhDescriptorA register.
4684	*/
4685	static int HcRhDescriptorA_w(POHCI pThis, uint32_t iReg, uint32_t val)
4686	{
4687	uint32_t chg = val ^ pThis->RootHub.desc_a; NOREF(chg);
4688	Log2(("HcRhDescriptorA_w(%#010x) => %sNDP=%d %sPSM=%d %sNPS=%d %sDT=%d %sOCPM=%d %sNOCP=%d %sPOTGT=%#x - %sPowerSwitching Set%sPower\n",
4689	val,
4690	chg & 0xff ?"!!!": "", val & 0xff,
4691	(chg >> 8) & 1 ? "*" : "", (val >> 8) & 1,
4692	(chg >> 9) & 1 ? "*" : "", (val >> 9) & 1,
4693	(chg >> 10) & 1 ?"!!!": "", 0,
4694	(chg >> 11) & 1 ? "*" : "", (val >> 11) & 1,
4695	(chg >> 12) & 1 ? "*" : "", (val >> 12) & 1,
4696	(chg >> 24)&0xff? "*" : "", (val >> 24) & 0xff,
4697	val & OHCI_RHA_NPS ? "No" : "",
4698	val & OHCI_RHA_PSM ? "Port" : "Global"));
4699	if (val & ~0xff001fff)
4700	Log2(("Unknown bits %#x are set!!!\n", val & ~0xff001fff));
4701
4702
4703	if ((val & (OHCI_RHA_NDP \| OHCI_RHA_DT)) != OHCI_NDP_CFG(pThis))
4704	{
4705	Log(("ohci: %s: invalid write to NDP or DT in roothub descriptor A!!! val=0x%.8x\n",
4706	pThis->PciDev.name, val));
4707	val &= ~(OHCI_RHA_NDP \| OHCI_RHA_DT);
4708	val \|= OHCI_NDP_CFG(pThis);
4709	}
4710
4711	pThis->RootHub.desc_a = val;
4712	return VINF_SUCCESS;
4713	}
4714
4715	/**
4716	* Read the HcRhDescriptorB register.
4717	*/
4718	static int HcRhDescriptorB_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4719	{
4720	uint32_t val = pThis->RootHub.desc_b;
4721	Log2(("HcRhDescriptorB_r() -> %#010x - DR=0x%04x PPCM=0x%04x\n",
4722	val, val & 0xffff, val >> 16));
4723	*pu32Value = val;
4724	return VINF_SUCCESS;
4725	}
4726
4727	/**
4728	* Write to the HcRhDescriptorB register.
4729	*/
4730	static int HcRhDescriptorB_w(POHCI pThis, uint32_t iReg, uint32_t val)
4731	{
4732	uint32_t chg = pThis->RootHub.desc_b ^ val; NOREF(chg);
4733	Log2(("HcRhDescriptorB_w(%#010x) => %sDR=0x%04x %sPPCM=0x%04x\n",
4734	val,
4735	chg & 0xffff ? "!!!" : "", val & 0xffff,
4736	chg >> 16 ? "!!!" : "", val >> 16));
4737
4738	if ( pThis->RootHub.desc_b != val )
4739	Log(("ohci: %s: unsupported write to root descriptor B!!! 0x%.8x -> 0x%.8x\n",
4740	pThis->PciDev.name,
4741	pThis->RootHub.desc_b, val));
4742	pThis->RootHub.desc_b = val;
4743	return VINF_SUCCESS;
4744	}
4745
4746	/**
4747	* Read the HcRhStatus (Rh = Root Hub) register.
4748	*/
4749	static int HcRhStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4750	{
4751	uint32_t val = pThis->RootHub.status;
4752	if (val & (OHCI_RHS_LPSC \| OHCI_RHS_OCIC))
4753	Log2(("HcRhStatus_r() -> %#010x - LPS=%d OCI=%d DRWE=%d LPSC=%d OCIC=%d CRWE=%d\n",
4754	val, val & 1, (val >> 1) & 1, (val >> 15) & 1, (val >> 16) & 1, (val >> 17) & 1, (val >> 31) & 1));
4755	*pu32Value = val;
4756	return VINF_SUCCESS;
4757	}
4758
4759	/**
4760	* Write to the HcRhStatus (Rh = Root Hub) register.
4761	*/
4762	static int HcRhStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4763	{
4764	#ifdef IN_RING3
4765	/* log */
4766	uint32_t old = pThis->RootHub.status;
4767	uint32_t chg;
4768	if (val & ~0x80038003)
4769	Log2(("HcRhStatus_w: Unknown bits %#x are set!!!\n", val & ~0x80038003));
4770	if ( (val & OHCI_RHS_LPSC) && (val & OHCI_RHS_LPS) )
4771	Log2(("HcRhStatus_w: Warning both CGP and SGP are set! (Clear/Set Global Power)\n"));
4772	if ( (val & OHCI_RHS_DRWE) && (val & OHCI_RHS_CRWE) )
4773	Log2(("HcRhStatus_w: Warning both CRWE and SRWE are set! (Clear/Set Remote Wakeup Enable)\n"));
4774
4775
4776	/* write 1 to clear OCIC */
4777	if ( val & OHCI_RHS_OCIC )
4778	pThis->RootHub.status &= ~OHCI_RHS_OCIC;
4779
4780	/* SetGlobalPower */
4781	if ( val & OHCI_RHS_LPSC )
4782	{
4783	unsigned i;
4784	Log2(("ohci: %s: global power up\n", pThis->PciDev.name));
4785	for (i = 0; i < OHCI_NDP_CFG(pThis); i++)
4786	rhport_power(&pThis->RootHub, i, true /* power up */);
4787	}
4788
4789	/* ClearGlobalPower */
4790	if ( val & OHCI_RHS_LPS )
4791	{
4792	unsigned i;
4793	Log2(("ohci: %s: global power down\n", pThis->PciDev.name));
4794	for (i = 0; i < OHCI_NDP_CFG(pThis); i++)
4795	rhport_power(&pThis->RootHub, i, false /* power down */);
4796	}
4797
4798	if ( val & OHCI_RHS_DRWE )
4799	pThis->RootHub.status \|= OHCI_RHS_DRWE;
4800
4801	if ( val & OHCI_RHS_CRWE )
4802	pThis->RootHub.status &= ~OHCI_RHS_DRWE;
4803
4804	chg = pThis->RootHub.status ^ old;
4805	Log2(("HcRhStatus_w(%#010x) => %sCGP=%d %sOCI=%d %sSRWE=%d %sSGP=%d %sOCIC=%d %sCRWE=%d\n",
4806	val,
4807	chg & 1 ? "*" : "", val & 1,
4808	(chg >> 1) & 1 ?"!!!": "", (val >> 1) & 1,
4809	(chg >> 15) & 1 ? "*" : "", (val >> 15) & 1,
4810	(chg >> 16) & 1 ? "*" : "", (val >> 16) & 1,
4811	(chg >> 17) & 1 ? "*" : "", (val >> 17) & 1,
4812	(chg >> 31) & 1 ? "*" : "", (val >> 31) & 1));
4813	return VINF_SUCCESS;
4814	#else /* !IN_RING3 */
4815	return VINF_IOM_R3_MMIO_WRITE;
4816	#endif /* !IN_RING3 */
4817	}
4818
4819	/**
4820	* Read the HcRhPortStatus register of a port.
4821	*/
4822	static int HcRhPortStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4823	{
4824	const unsigned i = iReg - 21;
4825	uint32_t val = pThis->RootHub.aPorts[i].fReg \| OHCI_PORT_R_POWER_STATUS; /* PortPowerStatus: see todo on power in _w function. */
4826	if (val & OHCI_PORT_R_RESET_STATUS)
4827	{
4828	#ifdef IN_RING3
4829	RTThreadYield();
4830	#else
4831	Log2(("HcRhPortStatus_r: yield -> VINF_IOM_R3_MMIO_READ\n"));
4832	return VINF_IOM_R3_MMIO_READ;
4833	#endif
4834	}
4835	if (val & (OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_CSC \| OHCI_PORT_PESC \| OHCI_PORT_PSSC \| OHCI_PORT_OCIC \| OHCI_PORT_PRSC))
4836	Log2(("HcRhPortStatus_r(): port %u: -> %#010x - CCS=%d PES=%d PSS=%d POCI=%d RRS=%d PPS=%d LSDA=%d CSC=%d PESC=%d PSSC=%d OCIC=%d PRSC=%d\n",
4837	i, val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 8) & 1, (val >> 9) & 1,
4838	(val >> 16) & 1, (val >> 17) & 1, (val >> 18) & 1, (val >> 19) & 1, (val >> 20) & 1));
4839	*pu32Value = val;
4840	return VINF_SUCCESS;
4841	}
4842
4843	#ifdef IN_RING3
4844	/**
4845	* Completion callback for the vusb_dev_reset() operation.
4846	* @thread EMT.
4847	*/
4848	static DECLCALLBACK(void) uchi_port_reset_done(PVUSBIDEVICE pDev, int rc, void *pvUser)
4849	{
4850	POHCI pThis = (POHCI)pvUser;
4851
4852	/*
4853	* Find the port in question
4854	*/
4855	POHCIHUBPORT pPort = NULL;
4856	unsigned iPort;
4857	for (iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++) /* lazy bird */
4858	if (pThis->RootHub.aPorts[iPort].pDev == pDev)
4859	{
4860	pPort = &pThis->RootHub.aPorts[iPort];
4861	break;
4862	}
4863	if (!pPort)
4864	{
4865	Assert(pPort); /* sometimes happens because of @bugref{1510} */
4866	return;
4867	}
4868
4869	if (RT_SUCCESS(rc))
4870	{
4871	/*
4872	* Successful reset.
4873	*/
4874	Log2(("uchi_port_reset_done: Reset completed.\n"));
4875	pPort->fReg &= ~(OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_R_SUSPEND_STATUS \| OHCI_PORT_R_SUSPEND_STATUS_CHANGE);
4876	pPort->fReg \|= OHCI_PORT_R_ENABLE_STATUS \| OHCI_PORT_R_RESET_STATUS_CHANGE;
4877	}
4878	else
4879	{
4880	/* desperate measures. */
4881	if ( pPort->pDev
4882	&& VUSBIDevGetState(pPort->pDev) == VUSB_DEVICE_STATE_ATTACHED)
4883	{
4884	/*
4885	* Damn, something weird happened during reset. We'll pretend the user did an
4886	* incredible fast reconnect or something. (probably not gonna work)
4887	*/
4888	Log2(("uchi_port_reset_done: The reset failed (rc=%Rrc)!!! Pretending reconnect at the speed of light.\n", rc));
4889	pPort->fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
4890	}
4891	else
4892	{
4893	/*
4894	* The device have / will be disconnected.
4895	*/
4896	Log2(("uchi_port_reset_done: Disconnected (rc=%Rrc)!!!\n", rc));
4897	pPort->fReg &= ~(OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_R_SUSPEND_STATUS \| OHCI_PORT_R_SUSPEND_STATUS_CHANGE \| OHCI_PORT_R_RESET_STATUS_CHANGE);
4898	pPort->fReg \|= OHCI_PORT_R_CONNECT_STATUS_CHANGE;
4899	}
4900	}
4901
4902	/* Raise roothub status change interrupt. */
4903	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
4904	}
4905
4906	/**
4907	* Sets a flag in a port status register but only set it if a device is
4908	* connected, if not set ConnectStatusChange flag to force HCD to reevaluate
4909	* connect status.
4910	*
4911	* @returns true if device was connected and the flag was cleared.
4912	*/
4913	static bool rhport_set_if_connected(POHCIROOTHUB pRh, int iPort, uint32_t fValue)
4914	{
4915	/*
4916	* Writing a 0 has no effect
4917	*/
4918	if (fValue == 0)
4919	return false;
4920
4921	/*
4922	* If CurrentConnectStatus is cleared we set ConnectStatusChange.
4923	*/
4924	if (!(pRh->aPorts[iPort].fReg & OHCI_PORT_R_CURRENT_CONNECT_STATUS))
4925	{
4926	pRh->aPorts[iPort].fReg \|= OHCI_PORT_R_CONNECT_STATUS_CHANGE;
4927	ohciR3SetInterrupt(pRh->pOhci, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
4928	return false;
4929	}
4930
4931	bool fRc = !(pRh->aPorts[iPort].fReg & fValue);
4932
4933	/* set the bit */
4934	pRh->aPorts[iPort].fReg \|= fValue;
4935
4936	return fRc;
4937	}
4938	#endif /* IN_RING3 */
4939
4940	/**
4941	* Write to the HcRhPortStatus register of a port.
4942	*/
4943	static int HcRhPortStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4944	{
4945	#ifdef IN_RING3
4946	const unsigned i = iReg - 21;
4947	POHCIHUBPORT p = &pThis->RootHub.aPorts[i];
4948	uint32_t old_state = p->fReg;
4949
4950	#ifdef LOG_ENABLED
4951	/*
4952	* Log it.
4953	*/
4954	static const char *apszCmdNames[32] =
4955	{
4956	"ClearPortEnable", "SetPortEnable", "SetPortSuspend", "!!!ClearSuspendStatus",
4957	"SetPortReset", "!!!5", "!!!6", "!!!7",
4958	"SetPortPower", "ClearPortPower", "!!!10", "!!!11",
4959	"!!!12", "!!!13", "!!!14", "!!!15",
4960	"ClearCSC", "ClearPESC", "ClearPSSC", "ClearOCIC",
4961	"ClearPRSC", "!!!21", "!!!22", "!!!23",
4962	"!!!24", "!!!25", "!!!26", "!!!27",
4963	"!!!28", "!!!29", "!!!30", "!!!31"
4964	};
4965	Log2(("HcRhPortStatus_w(%#010x): port %u:", val, i));
4966	for (unsigned j = 0; j < RT_ELEMENTS(apszCmdNames); j++)
4967	if (val & (1 << j))
4968	Log2((" %s", apszCmdNames[j]));
4969	Log2(("\n"));
4970	#endif
4971
4972	/* Write to clear any of the change bits: CSC, PESC, PSSC, OCIC and PRSC */
4973	if (val & OHCI_PORT_W_CLEAR_CHANGE_MASK)
4974	p->fReg &= ~(val & OHCI_PORT_W_CLEAR_CHANGE_MASK);
4975
4976	if (val & OHCI_PORT_W_CLEAR_ENABLE)
4977	{
4978	p->fReg &= ~OHCI_PORT_R_ENABLE_STATUS;
4979	Log2(("HcRhPortStatus_w(): port %u: DISABLE\n", i));
4980	}
4981
4982	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_ENABLE))
4983	Log2(("HcRhPortStatus_w(): port %u: ENABLE\n", i));
4984
4985	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_SUSPEND))
4986	Log2(("HcRhPortStatus_w(): port %u: SUSPEND - not implemented correctly!!!\n", i));
4987
4988	if (val & OHCI_PORT_W_SET_RESET)
4989	{
4990	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_RESET))
4991	{
4992	PVM pVM = PDMDevHlpGetVM(pThis->CTX_SUFF(pDevIns));
4993	p->fReg &= ~OHCI_PORT_R_RESET_STATUS_CHANGE;
4994	VUSBIDevReset(p->pDev, false /* don't reset on linux */, uchi_port_reset_done, pThis, pVM);
4995	}
4996	else if (p->fReg & OHCI_PORT_R_RESET_STATUS)
4997	{
4998	/* the guest is getting impatient. */
4999	Log2(("HcRhPortStatus_w(): port %u: Impatient guest!\n", i));
5000	RTThreadYield();
5001	}
5002	}
5003
5004	if (!(pThis->RootHub.desc_a & OHCI_RHA_NPS))
5005	{
5006	/** @todo To implement per-device power-switching
5007	* we need to check PortPowerControlMask to make
5008	* sure it isn't gang powered
5009	*/
5010	if (val & OHCI_PORT_W_CLEAR_POWER)
5011	rhport_power(&pThis->RootHub, i, false /* power down */);
5012	if (val & OHCI_PORT_W_SET_POWER)
5013	rhport_power(&pThis->RootHub, i, true /* power up */);
5014	}
5015
5016	/** @todo r=frank: ClearSuspendStatus. Timing? */
5017	if (val & OHCI_PORT_W_CLEAR_SUSPEND_STATUS)
5018	{
5019	rhport_power(&pThis->RootHub, i, true /* power up */);
5020	pThis->RootHub.aPorts[i].fReg &= ~OHCI_PORT_R_SUSPEND_STATUS;
5021	pThis->RootHub.aPorts[i].fReg \|= OHCI_PORT_R_SUSPEND_STATUS_CHANGE;
5022	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
5023	}
5024
5025	if (p->fReg != old_state)
5026	{
5027	uint32_t res = p->fReg;
5028	uint32_t chg = res ^ old_state; NOREF(chg);
5029	Log2(("HcRhPortStatus_w(%#010x): port %u: => %sCCS=%d %sPES=%d %sPSS=%d %sPOCI=%d %sRRS=%d %sPPS=%d %sLSDA=%d %sCSC=%d %sPESC=%d %sPSSC=%d %sOCIC=%d %sPRSC=%d\n",
5030	val, i,
5031	chg & 1 ? "*" : "", res & 1,
5032	(chg >> 1) & 1 ? "*" : "", (res >> 1) & 1,
5033	(chg >> 2) & 1 ? "*" : "", (res >> 2) & 1,
5034	(chg >> 3) & 1 ? "*" : "", (res >> 3) & 1,
5035	(chg >> 4) & 1 ? "*" : "", (res >> 4) & 1,
5036	(chg >> 8) & 1 ? "*" : "", (res >> 8) & 1,
5037	(chg >> 9) & 1 ? "*" : "", (res >> 9) & 1,
5038	(chg >> 16) & 1 ? "*" : "", (res >> 16) & 1,
5039	(chg >> 17) & 1 ? "*" : "", (res >> 17) & 1,
5040	(chg >> 18) & 1 ? "*" : "", (res >> 18) & 1,
5041	(chg >> 19) & 1 ? "*" : "", (res >> 19) & 1,
5042	(chg >> 20) & 1 ? "*" : "", (res >> 20) & 1));
5043	}
5044	return VINF_SUCCESS;
5045	#else /* !IN_RING3 */
5046	return VINF_IOM_R3_MMIO_WRITE;
5047	#endif /* !IN_RING3 */
5048	}
5049
5050	/**
5051	* Register descriptor table
5052	*/
5053	static const OHCIOPREG g_aOpRegs[] =
5054	{
5055	{ "HcRevision", HcRevision_r, HcRevision_w }, /* 0 */
5056	{ "HcControl", HcControl_r, HcControl_w }, /* 1 */
5057	{ "HcCommandStatus", HcCommandStatus_r, HcCommandStatus_w }, /* 2 */
5058	{ "HcInterruptStatus", HcInterruptStatus_r, HcInterruptStatus_w }, /* 3 */
5059	{ "HcInterruptEnable", HcInterruptEnable_r, HcInterruptEnable_w }, /* 4 */
5060	{ "HcInterruptDisable", HcInterruptDisable_r, HcInterruptDisable_w }, /* 5 */
5061	{ "HcHCCA", HcHCCA_r, HcHCCA_w }, /* 6 */
5062	{ "HcPeriodCurrentED", HcPeriodCurrentED_r, HcPeriodCurrentED_w }, /* 7 */
5063	{ "HcControlHeadED", HcControlHeadED_r, HcControlHeadED_w }, /* 8 */
5064	{ "HcControlCurrentED", HcControlCurrentED_r, HcControlCurrentED_w }, /* 9 */
5065	{ "HcBulkHeadED", HcBulkHeadED_r, HcBulkHeadED_w }, /* 10 */
5066	{ "HcBulkCurrentED", HcBulkCurrentED_r, HcBulkCurrentED_w }, /* 11 */
5067	{ "HcDoneHead", HcDoneHead_r, HcDoneHead_w }, /* 12 */
5068	{ "HcFmInterval", HcFmInterval_r, HcFmInterval_w }, /* 13 */
5069	{ "HcFmRemaining", HcFmRemaining_r, HcFmRemaining_w }, /* 14 */
5070	{ "HcFmNumber", HcFmNumber_r, HcFmNumber_w }, /* 15 */
5071	{ "HcPeriodicStart", HcPeriodicStart_r, HcPeriodicStart_w }, /* 16 */
5072	{ "HcLSThreshold", HcLSThreshold_r, HcLSThreshold_w }, /* 17 */
5073	{ "HcRhDescriptorA", HcRhDescriptorA_r, HcRhDescriptorA_w }, /* 18 */
5074	{ "HcRhDescriptorB", HcRhDescriptorB_r, HcRhDescriptorB_w }, /* 19 */
5075	{ "HcRhStatus", HcRhStatus_r, HcRhStatus_w }, /* 20 */
5076
5077	/* The number of port status register depends on the definition
5078	* of OHCI_NDP_MAX macro
5079	*/
5080	{ "HcRhPortStatus[0]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 21 */
5081	{ "HcRhPortStatus[1]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 22 */
5082	{ "HcRhPortStatus[2]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 23 */
5083	{ "HcRhPortStatus[3]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 24 */
5084	{ "HcRhPortStatus[4]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 25 */
5085	{ "HcRhPortStatus[5]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 26 */
5086	{ "HcRhPortStatus[6]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 27 */
5087	{ "HcRhPortStatus[7]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 28 */
5088	{ "HcRhPortStatus[8]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 29 */
5089	{ "HcRhPortStatus[9]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 30 */
5090	{ "HcRhPortStatus[10]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 31 */
5091	{ "HcRhPortStatus[11]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 32 */
5092	{ "HcRhPortStatus[12]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 33 */
5093	{ "HcRhPortStatus[13]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 34 */
5094	{ "HcRhPortStatus[14]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 35 */
5095	};
5096
5097	/* Quick way to determine how many op regs are valid. Since at least one port must
5098	* be configured (and no more than 15), there will be between 22 and 36 registers.
5099	*/
5100	#define NUM_OP_REGS(pohci) (21 + OHCI_NDP_CFG(pohci))
5101
5102	AssertCompile(RT_ELEMENTS(g_aOpRegs) > 21);
5103	AssertCompile(RT_ELEMENTS(g_aOpRegs) <= 36);
5104
5105	/**
5106	* @callback_method_impl{FNIOMMMIOREAD}
5107	*/
5108	PDMBOTHCBDECL(int) ohciMmioRead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void pv, unsigned cb)
5109	{
5110	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5111
5112	/* Paranoia: Assert that IOMMMIO_FLAGS_READ_DWORD works. */
5113	AssertReturn(cb == sizeof(uint32_t), VERR_INTERNAL_ERROR_3);
5114	AssertReturn(!(GCPhysAddr & 0x3), VERR_INTERNAL_ERROR_4);
5115
5116	/*
5117	* Validate the register and call the read operator.
5118	*/
5119	int rc;
5120	const uint32_t iReg = (GCPhysAddr - pThis->MMIOBase) >> 2;
5121	if (iReg < NUM_OP_REGS(pThis))
5122	{
5123	const OHCIOPREG *pReg = &g_aOpRegs[iReg];
5124	rc = pReg->pfnRead(pThis, iReg, (uint32_t *)pv);
5125	}
5126	else
5127	{
5128	Log(("ohci: Trying to read register %u/%u!!!\n", iReg, NUM_OP_REGS(pThis)));
5129	rc = VINF_IOM_MMIO_UNUSED_FF;
5130	}
5131	return rc;
5132	}
5133
5134
5135	/**
5136	* @callback_method_impl{FNIOMMMIOWRITE}
5137	*/
5138	PDMBOTHCBDECL(int) ohciMmioWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void const pv, unsigned cb)
5139	{
5140	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5141
5142	/* Paranoia: Assert that IOMMMIO_FLAGS_WRITE_DWORD_ZEROED works. */
5143	AssertReturn(cb == sizeof(uint32_t), VERR_INTERNAL_ERROR_3);
5144	AssertReturn(!(GCPhysAddr & 0x3), VERR_INTERNAL_ERROR_4);
5145
5146	/*
5147	* Validate the register and call the read operator.
5148	*/
5149	int rc;
5150	const uint32_t iReg = (GCPhysAddr - pThis->MMIOBase) >> 2;
5151	if (iReg < NUM_OP_REGS(pThis))
5152	{
5153	const OHCIOPREG *pReg = &g_aOpRegs[iReg];
5154	rc = pReg->pfnWrite(pThis, iReg, (uint32_t const )pv);
5155	}
5156	else
5157	{
5158	Log(("ohci: Trying to write to register %u/%u!!!\n", iReg, NUM_OP_REGS(pThis)));
5159	rc = VINF_SUCCESS;
5160	}
5161	return rc;
5162	}
5163
5164	#ifdef IN_RING3
5165
5166	/**
5167	* @callback_method_impl{FNPCIIOREGIONMAP}
5168	*/
5169	static DECLCALLBACK(int) ohciR3Map(PPCIDEVICE pPciDev, int iRegion, RTGCPHYS GCPhysAddress, uint32_t cb, PCIADDRESSSPACE enmType)
5170	{
5171	POHCI pThis = (POHCI)pPciDev;
5172	int rc = PDMDevHlpMMIORegister(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb, NULL /pvUser/,
5173	IOMMMIO_FLAGS_READ_DWORD \| IOMMMIO_FLAGS_WRITE_DWORD_ZEROED
5174	\| IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_WRITE,
5175	ohciMmioWrite, ohciMmioRead, "USB OHCI");
5176	if (RT_FAILURE(rc))
5177	return rc;
5178
5179	if (pThis->fRZEnabled)
5180	{
5181	rc = PDMDevHlpMMIORegisterRC(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb,
5182	NIL_RTRCPTR /pvUser/, "ohciMmioWrite", "ohciMmioRead");
5183	if (RT_FAILURE(rc))
5184	return rc;
5185
5186	rc = PDMDevHlpMMIORegisterR0(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb,
5187	NIL_RTR0PTR /pvUser/, "ohciMmioWrite", "ohciMmioRead");
5188	if (RT_FAILURE(rc))
5189	return rc;
5190	}
5191
5192	pThis->MMIOBase = GCPhysAddress;
5193	return VINF_SUCCESS;
5194	}
5195
5196
5197	/**
5198	* Prepares for state saving.
5199	* All URBs needs to be canceled.
5200	*
5201	* @returns VBox status code.
5202	* @param pDevIns The device instance.
5203	* @param pSSM The handle to save the state to.
5204	*/
5205	static DECLCALLBACK(int) ohciR3SavePrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5206	{
5207	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5208	POHCIROOTHUB pRh = &pThis->RootHub;
5209	LogFlow(("ohciR3SavePrep: \n"));
5210
5211	/*
5212	* Detach all proxied devices.
5213	*/
5214	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
5215	/** @todo this won't work well when continuing after saving! */
5216	for (unsigned i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5217	{
5218	PVUSBIDEVICE pDev = pRh->aPorts[i].pDev;
5219	if (pDev)
5220	{
5221	if (!VUSBIDevIsSavedStateSupported(pDev))
5222	{
5223	VUSBIRhDetachDevice(pRh->pIRhConn, pDev);
5224	/*
5225	* Save the device pointers here so we can reattach them afterwards.
5226	* This will work fine even if the save fails since the Done handler is
5227	* called unconditionally if the Prep handler was called.
5228	*/
5229	pRh->aPorts[i].pDev = pDev;
5230	}
5231	}
5232	}
5233
5234	/*
5235	* If the bus was started set the timer. This is ugly but avoids changing the
5236	* saved state version for now so we can backport the changes to other branches.
5237	*/
5238	/** @todo: Do it properly for 4.4 by changing the saved state. */
5239	if (pThis->fBusStarted)
5240	{
5241	/* Calculate a new timer expiration so this saved state works with older releases. */
5242	uint64_t u64Expire = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns)) + pThis->cTicksPerFrame;
5243
5244	LogFlowFunc(("Bus is active, setting timer to %llu\n", u64Expire));
5245	int rc = TMTimerSet(pThis->pEndOfFrameTimerR3, u64Expire);
5246	AssertRC(rc);
5247	}
5248
5249	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
5250
5251	/*
5252	* Kill old load data which might be hanging around.
5253	*/
5254	if (pThis->pLoad)
5255	{
5256	TMR3TimerDestroy(pThis->pLoad->pTimer);
5257	MMR3HeapFree(pThis->pLoad);
5258	pThis->pLoad = NULL;
5259	}
5260	return VINF_SUCCESS;
5261	}
5262
5263
5264	/**
5265	* Saves the state of the OHCI device.
5266	*
5267	* @returns VBox status code.
5268	* @param pDevIns The device instance.
5269	* @param pSSM The handle to save the state to.
5270	*/
5271	static DECLCALLBACK(int) ohciR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5272	{
5273	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5274	LogFlow(("ohciR3SaveExec: \n"));
5275
5276	int rc = SSMR3PutStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &g_aOhciFields[0], NULL);
5277	if (RT_SUCCESS(rc))
5278	rc = TMR3TimerSave(pThis->CTX_SUFF(pEndOfFrameTimer), pSSM);
5279	return rc;
5280	}
5281
5282
5283	/**
5284	* Done state save operation.
5285	*
5286	* @returns VBox load code.
5287	* @param pDevIns Device instance of the device which registered the data unit.
5288	* @param pSSM SSM operation handle.
5289	*/
5290	static DECLCALLBACK(int) ohciR3SaveDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5291	{
5292	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5293	POHCIROOTHUB pRh = &pThis->RootHub;
5294	OHCIROOTHUB Rh;
5295	unsigned i;
5296	LogFlow(("ohciR3SaveDone: \n"));
5297
5298	/*
5299	* NULL the dev pointers.
5300	*/
5301	Rh = *pRh;
5302	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5303	{
5304	if ( pRh->aPorts[i].pDev
5305	&& !VUSBIDevIsSavedStateSupported(pRh->aPorts[i].pDev))
5306	pRh->aPorts[i].pDev = NULL;
5307	}
5308
5309	/*
5310	* Attach the devices.
5311	*/
5312	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5313	{
5314	PVUSBIDEVICE pDev = Rh.aPorts[i].pDev;
5315	if ( pDev
5316	&& !VUSBIDevIsSavedStateSupported(pDev))
5317	VUSBIRhAttachDevice(pRh->pIRhConn, pDev);
5318	}
5319
5320	return VINF_SUCCESS;
5321	}
5322
5323
5324	/**
5325	* Prepare loading the state of the OHCI device.
5326	* This must detach the devices currently attached and save
5327	* the up for reconnect after the state load have been completed
5328	*
5329	* @returns VBox status code.
5330	* @param pDevIns The device instance.
5331	* @param pSSM The handle to the saved state.
5332	* @param u32Version The data unit version number.
5333	*/
5334	static DECLCALLBACK(int) ohciR3LoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5335	{
5336	int rc = VINF_SUCCESS;
5337	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5338	LogFlow(("ohciR3LoadPrep:\n"));
5339	if (!pThis->pLoad)
5340	{
5341	POHCIROOTHUB pRh = &pThis->RootHub;
5342	OHCILOAD Load;
5343	unsigned i;
5344
5345	/*
5346	* Detach all devices which are present in this session. Save them in the load
5347	* structure so we can reattach them after restoring the guest.
5348	*/
5349	Load.pTimer = NULL;
5350	Load.cDevs = 0;
5351	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5352	{
5353	PVUSBIDEVICE pDev = pRh->aPorts[i].pDev;
5354	if ( pDev
5355	&& !VUSBIDevIsSavedStateSupported(pDev))
5356	{
5357	Load.apDevs[Load.cDevs++] = pDev;
5358	VUSBIRhDetachDevice(pRh->pIRhConn, pDev);
5359	Assert(!pRh->aPorts[i].pDev);
5360	}
5361	}
5362
5363	/*
5364	* Any devices to reattach, if so duplicate the Load struct.
5365	*/
5366	if (Load.cDevs)
5367	{
5368	pThis->pLoad = (POHCILOAD)PDMDevHlpMMHeapAlloc(pDevIns, sizeof(Load));
5369	if (!pThis->pLoad)
5370	return VERR_NO_MEMORY;
5371	*pThis->pLoad = Load;
5372	}
5373	}
5374	/* else: we ASSUME no device can be attached or detach in the period
5375	* between a state load and the pLoad stuff is processed. */
5376	return rc;
5377	}
5378
5379
5380	/**
5381	* Loads the state of the OHCI device.
5382	*
5383	* @returns VBox status code.
5384	* @param pDevIns The device instance.
5385	* @param pSSM The handle to the saved state.
5386	* @param uVersion The data unit version number.
5387	* @param uPass The data pass.
5388	*/
5389	static DECLCALLBACK(int) ohciR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
5390	{
5391	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5392	int rc;
5393	LogFlow(("ohciR3LoadExec:\n"));
5394	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
5395
5396	if (uVersion == OHCI_SAVED_STATE_VERSION)
5397	{
5398	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &g_aOhciFields[0], NULL);
5399	if (RT_FAILURE(rc))
5400	return rc;
5401	}
5402	else if (uVersion == OHCI_SAVED_STATE_VERSION_8PORTS)
5403	{
5404	static SSMFIELD const s_aOhciFields8Ports[] =
5405	{
5406	SSMFIELD_ENTRY( OHCI, SofTime),
5407	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
5408	SSMFIELD_ENTRY( OHCI, RootHub.status),
5409	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
5410	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
5411	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
5412	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
5413	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
5414	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
5415	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
5416	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
5417	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
5418	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
5419	SSMFIELD_ENTRY( OHCI, ctl),
5420	SSMFIELD_ENTRY( OHCI, status),
5421	SSMFIELD_ENTRY( OHCI, intr_status),
5422	SSMFIELD_ENTRY( OHCI, intr),
5423	SSMFIELD_ENTRY( OHCI, hcca),
5424	SSMFIELD_ENTRY( OHCI, per_cur),
5425	SSMFIELD_ENTRY( OHCI, ctrl_cur),
5426	SSMFIELD_ENTRY( OHCI, ctrl_head),
5427	SSMFIELD_ENTRY( OHCI, bulk_cur),
5428	SSMFIELD_ENTRY( OHCI, bulk_head),
5429	SSMFIELD_ENTRY( OHCI, done),
5430	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
5431	SSMFIELD_ENTRY( OHCI, HcFmNumber),
5432	SSMFIELD_ENTRY( OHCI, pstart),
5433	SSMFIELD_ENTRY_TERM()
5434	};
5435
5436	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &s_aOhciFields8Ports[0], NULL);
5437	if (RT_FAILURE(rc))
5438	return rc;
5439	}
5440	else if (uVersion == OHCI_SAVED_STATE_VERSION_MEM_HELL)
5441	{
5442	static SSMFIELD const s_aOhciFields22[] =
5443	{
5444	SSMFIELD_ENTRY_OLD( PciDev.config, 256), /* DevPCI restores this. */
5445	SSMFIELD_ENTRY_OLD( PciDev.Int, 224),
5446	SSMFIELD_ENTRY_OLD( PciDev.devfn, 4),
5447	SSMFIELD_ENTRY_OLD( PciDev.Alignment0, 4),
5448	SSMFIELD_ENTRY_OLD_HCPTR( PciDev.name),
5449	SSMFIELD_ENTRY_OLD_HCPTR( PciDev.pDevIns),
5450	SSMFIELD_ENTRY_OLD_HCPTR( pDevInsR3),
5451	SSMFIELD_ENTRY_OLD_HCPTR( pEndOfFrameTimerR3),
5452	SSMFIELD_ENTRY_OLD_HCPTR( pDevInsR0),
5453	SSMFIELD_ENTRY_OLD_HCPTR( pEndOfFrameTimerR0),
5454	SSMFIELD_ENTRY_OLD_RCPTR( pDevInsRC),
5455	SSMFIELD_ENTRY_OLD_RCPTR( pEndOfFrameTimerRC),
5456	SSMFIELD_ENTRY( OHCI, SofTime),
5457	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
5458	SSMFIELD_ENTRY_OLD( MMIOBase, 4), /* DevPCI implicitly restores this. */
5459	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIBase),
5460	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIRhConn),
5461	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIDev),
5462	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IBase.pfnQueryInterface),
5463	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnGetAvailablePorts),
5464	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnGetUSBVersions),
5465	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnAttach),
5466	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnDetach),
5467	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnReset),
5468	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnXferCompletion),
5469	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnXferError),
5470	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.Alignment),
5471	SSMFIELD_ENTRY_OLD( RootHub.Led, 16), /* No device restored. */
5472	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.ILeds.pfnQueryStatusLed),
5473	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pLedsConnector),
5474	SSMFIELD_ENTRY( OHCI, RootHub.status),
5475	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
5476	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
5477	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.Alignment0, 4),
5478	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
5479	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[0].Alignment0, 4),
5480	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[0].pDev),
5481	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
5482	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[1].Alignment0, 4),
5483	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[1].pDev),
5484	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
5485	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[2].Alignment0, 4),
5486	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[2].pDev),
5487	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
5488	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[3].Alignment0, 4),
5489	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[3].pDev),
5490	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
5491	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[4].Alignment0, 4),
5492	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[4].pDev),
5493	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
5494	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[5].Alignment0, 4),
5495	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[5].pDev),
5496	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
5497	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[6].Alignment0, 4),
5498	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[6].pDev),
5499	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
5500	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[7].Alignment0, 4),
5501	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[7].pDev),
5502	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pThis),
5503	SSMFIELD_ENTRY( OHCI, ctl),
5504	SSMFIELD_ENTRY( OHCI, status),
5505	SSMFIELD_ENTRY( OHCI, intr_status),
5506	SSMFIELD_ENTRY( OHCI, intr),
5507	SSMFIELD_ENTRY( OHCI, hcca),
5508	SSMFIELD_ENTRY( OHCI, per_cur),
5509	SSMFIELD_ENTRY( OHCI, ctrl_cur),
5510	SSMFIELD_ENTRY( OHCI, ctrl_head),
5511	SSMFIELD_ENTRY( OHCI, bulk_cur),
5512	SSMFIELD_ENTRY( OHCI, bulk_head),
5513	SSMFIELD_ENTRY( OHCI, done),
5514	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
5515	SSMFIELD_ENTRY( OHCI, HcFmNumber),
5516	SSMFIELD_ENTRY( OHCI, pstart),
5517	SSMFIELD_ENTRY_OLD( cTicksPerFrame, 8), /* done by the constructor */
5518	SSMFIELD_ENTRY_OLD( cTicksPerUsbTick, 8), /* ditto */
5519	SSMFIELD_ENTRY_OLD( cInFlight, 4), /* no in-flight stuff when saving. */
5520	SSMFIELD_ENTRY_OLD( Alignment1, 4),
5521	SSMFIELD_ENTRY_OLD( aInFlight, 257 * 8),
5522	SSMFIELD_ENTRY_OLD_PAD_HC64( aInFlight, 257 * 8),
5523	SSMFIELD_ENTRY_OLD( cInDoneQueue, 4), /* strict builds only, so don't bother. */
5524	SSMFIELD_ENTRY_OLD( aInDoneQueue, 4*64),
5525	SSMFIELD_ENTRY_OLD( u32FmDoneQueueTail, 4), /* logging only */
5526	SSMFIELD_ENTRY_OLD_PAD_HC32( Alignment2, 4),
5527	SSMFIELD_ENTRY_OLD_HCPTR( pLoad),
5528	SSMFIELD_ENTRY_OLD( StatCanceledIsocUrbs, 8),
5529	SSMFIELD_ENTRY_OLD( StatCanceledGenUrbs, 8),
5530	SSMFIELD_ENTRY_OLD( StatDroppedUrbs, 8),
5531	SSMFIELD_ENTRY_OLD( StatTimer, 32),
5532	SSMFIELD_ENTRY_TERM()
5533	};
5534
5535	/* deserialize the struct */
5536	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), SSMSTRUCT_FLAGS_NO_MARKERS /fFlags*/, &s_aOhciFields22[0], NULL);
5537	if (RT_FAILURE(rc))
5538	return rc;
5539
5540	/* check delimiter */
5541	uint32_t u32;
5542	rc = SSMR3GetU32(pSSM, &u32);
5543	if (RT_FAILURE(rc))
5544	return rc;
5545	AssertMsgReturn(u32 == ~0U, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
5546	}
5547	else
5548	AssertMsgFailedReturn(("%d\n", uVersion), VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION);
5549
5550	/*
5551	* Finally restore the timer.
5552	*/
5553	return TMR3TimerLoad(pThis->pEndOfFrameTimerR3, pSSM);
5554	}
5555
5556
5557	/**
5558	* Done state load operation.
5559	*
5560	* @returns VBox load code.
5561	* @param pDevIns Device instance of the device which registered the data unit.
5562	* @param pSSM SSM operation handle.
5563	*/
5564	static DECLCALLBACK(int) ohciR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5565	{
5566	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5567	LogFlow(("ohciR3LoadDone:\n"));
5568
5569	/*
5570	* Start a timer if we've got devices to reattach
5571	*/
5572	if (pThis->pLoad)
5573	{
5574	int rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ohciR3LoadReattachDevices, pThis,
5575	TMTIMER_FLAGS_NO_CRIT_SECT, "OHCI reattach devices on load",
5576	&pThis->pLoad->pTimer);
5577	if (RT_SUCCESS(rc))
5578	rc = TMTimerSetMillies(pThis->pLoad->pTimer, 250);
5579	return rc;
5580	}
5581
5582	return VINF_SUCCESS;
5583	}
5584
5585
5586	/**
5587	* Reattaches devices after a saved state load.
5588	*/
5589	static DECLCALLBACK(void) ohciR3LoadReattachDevices(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser)
5590	{
5591	POHCI pThis = (POHCI)pvUser;
5592	POHCILOAD pLoad = pThis->pLoad;
5593	POHCIROOTHUB pRh = &pThis->RootHub;
5594	LogFlow(("ohciR3LoadReattachDevices:\n"));
5595
5596	/*
5597	* Reattach devices.
5598	*/
5599	for (unsigned i = 0; i < pLoad->cDevs; i++)
5600	VUSBIRhAttachDevice(pRh->pIRhConn, pLoad->apDevs[i]);
5601
5602	/*
5603	* Cleanup.
5604	*/
5605	TMR3TimerDestroy(pTimer);
5606	MMR3HeapFree(pLoad);
5607	pThis->pLoad = NULL;
5608	}
5609
5610
5611	/**
5612	* Reset notification.
5613	*
5614	* @returns VBox status code.
5615	* @param pDevIns The device instance data.
5616	*/
5617	static DECLCALLBACK(void) ohciR3Reset(PPDMDEVINS pDevIns)
5618	{
5619	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5620	LogFlow(("ohciR3Reset:\n"));
5621
5622	/*
5623	* There is no distinction between cold boot, warm reboot and software reboots,
5624	* all of these are treated as cold boots. We are also doing the initialization
5625	* job of a BIOS or SMM driver.
5626	*
5627	* Important: Don't confuse UsbReset with hardware reset. Hardware reset is
5628	* just one way of getting into the UsbReset state.
5629	*/
5630	ohciDoReset(pThis, OHCI_USB_RESET, true /* reset devices */);
5631	}
5632
5633
5634	/**
5635	* Resume notification.
5636	*
5637	* @returns VBox status code.
5638	* @param pDevIns The device instance data.
5639	*/
5640	static DECLCALLBACK(void) ohciR3Resume(PPDMDEVINS pDevIns)
5641	{
5642	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5643	LogFlowFunc(("\n"));
5644
5645	/* Restart the frame thread if the timer is active. */
5646	if (TMTimerIsActive(pThis->pEndOfFrameTimerR3))
5647	{
5648	int rc = TMTimerStop(pThis->pEndOfFrameTimerR3);
5649	AssertRC(rc);
5650
5651	LogFlowFunc(("Bus was active, restart frame thread\n"));
5652	ASMAtomicXchgBool(&pThis->fBusStarted, true);
5653	RTSemEventMultiSignal(pThis->hSemEventFrame);
5654	}
5655	}
5656
5657
5658	/**
5659	* Info handler, device version. Dumps OHCI control registers.
5660	*
5661	* @param pDevIns Device instance which registered the info.
5662	* @param pHlp Callback functions for doing output.
5663	* @param pszArgs Argument string. Optional and specific to the handler.
5664	*/
5665	static DECLCALLBACK(void) ohciR3InfoRegs(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
5666	{
5667	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5668	uint32_t val, ctl, status;
5669
5670	/* Control register */
5671	ctl = pThis->ctl;
5672	pHlp->pfnPrintf(pHlp, "HcControl: %08x - CBSR=%d PLE=%d IE=%d CLE=%d BLE=%d HCFS=%#x IR=%d RWC=%d RWE=%d\n",
5673	ctl, ctl & 3, (ctl >> 2) & 1, (ctl >> 3) & 1, (ctl >> 4) & 1, (ctl >> 5) & 1, (ctl >> 6) & 3, (ctl >> 8) & 1,
5674	(ctl >> 9) & 1, (ctl >> 10) & 1);
5675
5676	/* Command status register */
5677	status = pThis->status;
5678	pHlp->pfnPrintf(pHlp, "HcCommandStatus: %08x - HCR=%d CLF=%d BLF=%d OCR=%d SOC=%d\n",
5679	status, status & 1, (status >> 1) & 1, (status >> 2) & 1, (status >> 3) & 1, (status >> 16) & 3);
5680
5681	/* Interrupt status register */
5682	val = pThis->intr_status;
5683	pHlp->pfnPrintf(pHlp, "HcInterruptStatus: %08x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d\n",
5684	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
5685	(val >> 6) & 1, (val >> 30) & 1);
5686
5687	/* Interrupt enable register */
5688	val = pThis->intr;
5689	pHlp->pfnPrintf(pHlp, "HcInterruptEnable: %08x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
5690	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
5691	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1);
5692
5693	/* HCCA address register */
5694	pHlp->pfnPrintf(pHlp, "HcHCCA: %08x\n", pThis->hcca);
5695
5696	/* Current periodic ED register */
5697	pHlp->pfnPrintf(pHlp, "HcPeriodCurrentED: %08x\n", pThis->per_cur);
5698
5699	/* Control ED registers */
5700	pHlp->pfnPrintf(pHlp, "HcControlHeadED: %08x\n", pThis->ctrl_head);
5701	pHlp->pfnPrintf(pHlp, "HcControlCurrentED: %08x\n", pThis->ctrl_cur);
5702
5703	/* Bulk ED registers */
5704	pHlp->pfnPrintf(pHlp, "HcBulkHeadED: %08x\n", pThis->bulk_head);
5705	pHlp->pfnPrintf(pHlp, "HcBulkCurrentED: %08x\n", pThis->bulk_cur);
5706
5707	/* Done head register */
5708	pHlp->pfnPrintf(pHlp, "HcDoneHead: %08x\n", pThis->done);
5709
5710	pHlp->pfnPrintf(pHlp, "\n");
5711	}
5712
5713
5714	/**
5715	* Relocate device instance data.
5716	*
5717	* @returns VBox status code.
5718	* @param pDevIns The device instance data.
5719	* @param offDelta The relocation delta.
5720	*/
5721	static DECLCALLBACK(void) ohciR3Relocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta)
5722	{
5723	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5724	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
5725	pThis->pEndOfFrameTimerRC = TMTimerRCPtr(pThis->pEndOfFrameTimerR3);
5726	}
5727
5728
5729	/**
5730	* Destruct a device instance.
5731	*
5732	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
5733	* resources can be freed correctly.
5734	*
5735	* @returns VBox status code.
5736	* @param pDevIns The device instance data.
5737	*/
5738	static DECLCALLBACK(int) ohciR3Destruct(PPDMDEVINS pDevIns)
5739	{
5740	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5741	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
5742
5743	/*
5744	* Destroy event sempahores.
5745	*/
5746	if (pThis->hSemEventFrame)
5747	RTSemEventMultiDestroy(pThis->hSemEventFrame);
5748	if (pThis->hSemEventFrameStopped)
5749	RTSemEventMultiDestroy(pThis->hSemEventFrameStopped);
5750	if (RTCritSectIsInitialized(&pThis->CritSect))
5751	RTCritSectDelete(&pThis->CritSect);
5752	PDMR3CritSectDelete(&pThis->CsIrq);
5753
5754	/*
5755	* Tear down the per endpoint in-flight tracking...
5756	*/
5757
5758	return VINF_SUCCESS;
5759	}
5760
5761
5762	/**
5763	* @interface_method_impl{PDMDEVREG,pfnConstruct,OHCI constructor}
5764	*/
5765	static DECLCALLBACK(int) ohciR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
5766	{
5767	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5768	uint32_t cPorts;
5769	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
5770
5771	/*
5772	* Init instance data.
5773	*/
5774	pThis->pDevInsR3 = pDevIns;
5775	pThis->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
5776	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
5777
5778	PCIDevSetVendorId (&pThis->PciDev, 0x106b);
5779	PCIDevSetDeviceId (&pThis->PciDev, 0x003f);
5780	PCIDevSetClassProg (&pThis->PciDev, 0x10); /* OHCI */
5781	PCIDevSetClassSub (&pThis->PciDev, 0x03);
5782	PCIDevSetClassBase (&pThis->PciDev, 0x0c);
5783	PCIDevSetInterruptPin (&pThis->PciDev, 0x01);
5784	#ifdef VBOX_WITH_MSI_DEVICES
5785	PCIDevSetStatus (&pThis->PciDev, VBOX_PCI_STATUS_CAP_LIST);
5786	PCIDevSetCapabilityList(&pThis->PciDev, 0x80);
5787	#endif
5788
5789	pThis->RootHub.pOhci = pThis;
5790	pThis->RootHub.IBase.pfnQueryInterface = ohciRhQueryInterface;
5791	pThis->RootHub.IRhPort.pfnGetAvailablePorts = ohciRhGetAvailablePorts;
5792	pThis->RootHub.IRhPort.pfnGetUSBVersions = ohciRhGetUSBVersions;
5793	pThis->RootHub.IRhPort.pfnAttach = ohciRhAttach;
5794	pThis->RootHub.IRhPort.pfnDetach = ohciRhDetach;
5795	pThis->RootHub.IRhPort.pfnReset = ohciRhReset;
5796	pThis->RootHub.IRhPort.pfnXferCompletion = ohciRhXferCompletion;
5797	pThis->RootHub.IRhPort.pfnXferError = ohciRhXferError;
5798
5799	/* USB LED */
5800	pThis->RootHub.Led.u32Magic = PDMLED_MAGIC;
5801	pThis->RootHub.ILeds.pfnQueryStatusLed = ohciRhQueryStatusLed;
5802
5803
5804	/*
5805	* Read configuration.
5806	*/
5807	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "RZEnabled", "");
5808	int rc = CFGMR3QueryBoolDef(pCfg, "RZEnabled", &pThis->fRZEnabled, true);
5809	AssertLogRelRCReturn(rc, rc);
5810
5811	/* Number of ports option. */
5812	rc = CFGMR3QueryU32Def(pCfg, "Ports", &cPorts, OHCI_NDP_DEFAULT);
5813	if (RT_FAILURE(rc))
5814	return PDMDEV_SET_ERROR(pDevIns, rc,
5815	N_("OHCI configuration error: failed to read Ports as integer"));
5816
5817	if (cPorts == 0 \|\| cPorts > OHCI_NDP_MAX)
5818	return PDMDevHlpVMSetError(pDevIns, VERR_INVALID_PARAMETER, RT_SRC_POS,
5819	N_("OHCI configuration error: Ports must be in range [%u,%u]"),
5820	1, OHCI_NDP_MAX);
5821
5822	/* Store the configured NDP; it will be used everywhere else from now on. */
5823	pThis->RootHub.desc_a = cPorts;
5824
5825	/*
5826	* Register PCI device and I/O region.
5827	*/
5828	rc = PDMDevHlpPCIRegister(pDevIns, &pThis->PciDev);
5829	if (RT_FAILURE(rc))
5830	return rc;
5831
5832	#ifdef VBOX_WITH_MSI_DEVICES
5833	PDMMSIREG MsiReg;
5834	RT_ZERO(MsiReg);
5835	MsiReg.cMsiVectors = 1;
5836	MsiReg.iMsiCapOffset = 0x80;
5837	MsiReg.iMsiNextOffset = 0x00;
5838	rc = PDMDevHlpPCIRegisterMsi(pDevIns, &MsiReg);
5839	if (RT_FAILURE(rc))
5840	{
5841	PCIDevSetCapabilityList(&pThis->PciDev, 0x0);
5842	/* That's OK, we can work without MSI */
5843	}
5844	#endif
5845
5846	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 0, 4096, PCI_ADDRESS_SPACE_MEM, ohciR3Map);
5847	if (RT_FAILURE(rc))
5848	return rc;
5849
5850	/*
5851	* Create the end-of-frame timer.
5852	*/
5853	rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ohciFrameBoundaryTimer, pThis,
5854	TMTIMER_FLAGS_DEFAULT_CRIT_SECT, "USB Frame Timer",
5855	&pThis->pEndOfFrameTimerR3);
5856	if (RT_FAILURE(rc))
5857	return rc;
5858	pThis->pEndOfFrameTimerR0 = TMTimerR0Ptr(pThis->pEndOfFrameTimerR3);
5859	pThis->pEndOfFrameTimerRC = TMTimerRCPtr(pThis->pEndOfFrameTimerR3);
5860
5861	/*
5862	* Register the saved state data unit.
5863	*/
5864	rc = PDMDevHlpSSMRegisterEx(pDevIns, OHCI_SAVED_STATE_VERSION, sizeof(*pThis), NULL,
5865	NULL, NULL, NULL,
5866	ohciR3SavePrep, ohciR3SaveExec, ohciR3SaveDone,
5867	ohciR3LoadPrep, ohciR3LoadExec, ohciR3LoadDone);
5868	if (RT_FAILURE(rc))
5869	return rc;
5870
5871	/*
5872	* Attach to the VBox USB RootHub Driver on LUN #0.
5873	*/
5874	rc = PDMDevHlpDriverAttach(pDevIns, 0, &pThis->RootHub.IBase, &pThis->RootHub.pIBase, "RootHub");
5875	if (RT_FAILURE(rc))
5876	{
5877	AssertMsgFailed(("Configuration error: No roothub driver attached to LUN #0!\n"));
5878	return rc;
5879	}
5880	pThis->RootHub.pIRhConn = PDMIBASE_QUERY_INTERFACE(pThis->RootHub.pIBase, VUSBIROOTHUBCONNECTOR);
5881	AssertMsgReturn(pThis->RootHub.pIRhConn,
5882	("Configuration error: The driver doesn't provide the VUSBIROOTHUBCONNECTOR interface!\n"),
5883	VERR_PDM_MISSING_INTERFACE);
5884	pThis->RootHub.pIDev = PDMIBASE_QUERY_INTERFACE(pThis->RootHub.pIBase, VUSBIDEVICE);
5885	AssertMsgReturn(pThis->RootHub.pIDev,
5886	("Configuration error: The driver doesn't provide the VUSBIDEVICE interface!\n"),
5887	VERR_PDM_MISSING_INTERFACE);
5888
5889	/*
5890	* Attach status driver (optional).
5891	*/
5892	PPDMIBASE pBase;
5893	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThis->RootHub.IBase, &pBase, "Status Port");
5894	if (RT_SUCCESS(rc))
5895	pThis->RootHub.pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
5896	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
5897	{
5898	AssertMsgFailed(("Failed to attach to status driver. rc=%Rrc\n", rc));
5899	return rc;
5900	}
5901
5902	/*
5903	* Calculate the timer intervals.
5904	* This assumes that the VM timer doesn't change frequency during the run.
5905	*/
5906	pThis->u64TimerHz = TMTimerGetFreq(pThis->CTX_SUFF(pEndOfFrameTimer));
5907	ohciCalcTimerIntervals(pThis, OHCI_DEFAULT_TIMER_FREQ);
5908	Log(("ohci: cTicksPerFrame=%RU64 cTicksPerUsbTick=%RU64\n",
5909	pThis->cTicksPerFrame, pThis->cTicksPerUsbTick));
5910
5911	pThis->fBusStarted = false;
5912
5913	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CsIrq, RT_SRC_POS, "OHCI#%uIrq", iInstance);
5914	if (RT_FAILURE(rc))
5915	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
5916	N_("EHCI: Failed to create critical section"));
5917
5918	rc = RTSemEventMultiCreate(&pThis->hSemEventFrame);
5919	AssertRCReturn(rc, rc);
5920
5921	rc = RTSemEventMultiCreate(&pThis->hSemEventFrameStopped);
5922	AssertRCReturn(rc, rc);
5923
5924	rc = RTCritSectInit(&pThis->CritSect);
5925	if (RT_FAILURE(rc))
5926	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
5927	N_("OHCI: Failed to create critical section"));
5928
5929	rc = PDMDevHlpThreadCreate(pDevIns, &pThis->hThreadFrame, pThis, ohciR3ThreadFrame,
5930	ohciR3ThreadFrameWakeup, 0, RTTHREADTYPE_TIMER, "OhciFramer");
5931	if (RT_FAILURE(rc))
5932	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
5933	N_("OHCI: Failed to create worker thread"));
5934
5935	/*
5936	* Do a hardware reset.
5937	*/
5938	ohciDoReset(pThis, OHCI_USB_RESET, false /* don't reset devices */);
5939
5940	#ifdef VBOX_WITH_STATISTICS
5941	/*
5942	* Register statistics.
5943	*/
5944	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCanceledIsocUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/CanceledIsocUrbs", STAMUNIT_OCCURENCES, "Detected canceled isochronous URBs.");
5945	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCanceledGenUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/CanceledGenUrbs", STAMUNIT_OCCURENCES, "Detected canceled general URBs.");
5946	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatDroppedUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/DroppedUrbs", STAMUNIT_OCCURENCES, "Dropped URBs (endpoint halted, or URB canceled).");
5947	#endif
5948
5949	/*
5950	* Register debugger info callbacks.
5951	*/
5952	PDMDevHlpDBGFInfoRegister(pDevIns, "ohci", "OHCI control registers.", ohciR3InfoRegs);
5953
5954	#if 0/def DEBUG_bird/
5955	// g_fLogInterruptEPs = true;
5956	g_fLogControlEPs = true;
5957	g_fLogBulkEPs = true;
5958	#endif
5959
5960	return VINF_SUCCESS;
5961	}
5962
5963
5964	const PDMDEVREG g_DeviceOHCI =
5965	{
5966	/* u32version */
5967	PDM_DEVREG_VERSION,
5968	/* szName */
5969	"usb-ohci",
5970	/* szRCMod */
5971	"VBoxDDRC.rc",
5972	/* szR0Mod */
5973	"VBoxDDR0.r0",
5974	/* pszDescription */
5975	"OHCI USB controller.\n",
5976	/* fFlags */
5977	PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RC \| PDM_DEVREG_FLAGS_R0,
5978	/* fClass */
5979	PDM_DEVREG_CLASS_BUS_USB,
5980	/* cMaxInstances */
5981	~0U,
5982	/* cbInstance */
5983	sizeof(OHCI),
5984	/* pfnConstruct */
5985	ohciR3Construct,
5986	/* pfnDestruct */
5987	ohciR3Destruct,
5988	/* pfnRelocate */
5989	ohciR3Relocate,
5990	/* pfnMemSetup */
5991	NULL,
5992	/* pfnPowerOn */
5993	NULL,
5994	/* pfnReset */
5995	ohciR3Reset,
5996	/* pfnSuspend */
5997	NULL,
5998	/* pfnResume */
5999	ohciR3Resume,
6000	/* pfnAttach */
6001	NULL,
6002	/* pfnDetach */
6003	NULL,
6004	/* pfnQueryInterface */
6005	NULL,
6006	/* pfnInitComplete */
6007	NULL,
6008	/* pfnPowerOff */
6009	NULL,
6010	/* pfnSoftReset */
6011	NULL,
6012	/* u32VersionEnd */
6013	PDM_DEVREG_VERSION
6014	};
6015
6016	#endif /* IN_RING3 */
6017	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/USB/DevOHCI.cpp@ 59688

Download in other formats: