DevOHCI.cpp@ 62506

Last change on this file since 62506 was 62502, checked in by vboxsync, 8 years ago
(C) 2016
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 216.1 KB

Line
1	/* $Id: DevOHCI.cpp 62502 2016-07-22 19:09:14Z vboxsync $ */
2	/** @file
3	* DevOHCI - Open Host Controller Interface for USB.
4	*/
5
6	/*
7	* Copyright (C) 2006-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/** @page pg_dev_ohci OHCI - Open Host Controller Interface Emulation.
19	*
20	* This component implements an OHCI USB controller. It is split roughly in
21	* to two main parts, the first part implements the register level
22	* specification of USB OHCI and the second part maintains the root hub (which
23	* is an integrated component of the device).
24	*
25	* The OHCI registers are used for the usual stuff like enabling and disabling
26	* interrupts. Since the USB time is divided in to 1ms frames and various
27	* interrupts may need to be triggered at frame boundary time, a timer-based
28	* approach was taken. Whenever the bus is enabled ohci->eof_timer will be set.
29	*
30	* The actual USB transfers are stored in main memory (along with endpoint and
31	* transfer descriptors). The ED's for all the control and bulk endpoints are
32	* found by consulting the HcControlHeadED and HcBulkHeadED registers
33	* respectively. Interrupt ED's are different, they are found by looking
34	* in the HCCA (another communication area in main memory).
35	*
36	* At the start of every frame (in function ohci_sof) we traverse all enabled
37	* ED lists and queue up as many transfers as possible. No attention is paid
38	* to control/bulk service ratios or bandwidth requirements since our USB
39	* could conceivably contain a dozen high speed busses so this would
40	* artificially limit the performance.
41	*
42	* Once we have a transfer ready to go (in function ohciServiceTd) we
43	* allocate an URB on the stack, fill in all the relevant fields and submit
44	* it using the VUSBIRhSubmitUrb function. The roothub device and the virtual
45	* USB core code (vusb.c) coordinates everything else from this point onwards.
46	*
47	* When the URB has been successfully handed to the lower level driver, our
48	* prepare callback gets called and we can remove the TD from the ED transfer
49	* list. This stops us queueing it twice while it completes.
50	* bird: no, we don't remove it because that confuses the guest! (=> crashes)
51	*
52	* Completed URBs are reaped at the end of every frame (in function
53	* ohci_frame_boundary). Our completion routine makes use of the ED and TD
54	* fields in the URB to store the physical addresses of the descriptors so
55	* that they may be modified in the roothub callbacks. Our completion
56	* routine (ohciRhXferComplete) carries out a number of tasks:
57	* -# Retires the TD associated with the transfer, setting the
58	* relevant error code etc.
59	* -# Updates done-queue interrupt timer and potentially causes
60	* a writeback of the done-queue.
61	* -# If the transfer was device-to-host, we copy the data in to
62	* the host memory.
63	*
64	* As for error handling OHCI allows for 3 retries before failing a transfer,
65	* an error count is stored in each transfer descriptor. A halt flag is also
66	* stored in the transfer descriptor. That allows for ED's to be disabled
67	* without stopping the bus and de-queuing them.
68	*
69	* When the bus is started and stopped we call VUSBIDevPowerOn/Off() on our
70	* roothub to indicate it's powering up and powering down. Whenever we power
71	* down, the USB core makes sure to synchronously complete all outstanding
72	* requests so that the OHCI is never seen in an inconsistent state by the
73	* guest OS (Transfers are not meant to be unlinked until they've actually
74	* completed, but we can't do that unless we work synchronously, so we just
75	* have to fake it).
76	* bird: we do work synchronously now, anything causes guest crashes.
77	*/
78
79
80	/*********************************************************************************************************************************
81	* Header Files *
82	*********************************************************************************************************************************/
83	#define LOG_GROUP LOG_GROUP_DEV_OHCI
84	#include <VBox/pci.h>
85	#include <VBox/vmm/pdm.h>
86	#include <VBox/vmm/mm.h>
87	#include <VBox/err.h>
88	#include <VBox/log.h>
89	#include <iprt/assert.h>
90	#include <iprt/string.h>
91	#include <iprt/asm.h>
92	#include <iprt/asm-math.h>
93	#include <iprt/semaphore.h>
94	#include <iprt/critsect.h>
95	#include <iprt/param.h>
96	#ifdef IN_RING3
97	# include <iprt/alloca.h>
98	# include <iprt/mem.h>
99	# include <iprt/thread.h>
100	# include <iprt/uuid.h>
101	#endif
102	#include <VBox/vusb.h>
103	#include "VBoxDD.h"
104
105
106	#define VBOX_WITH_OHCI_PHYS_READ_CACHE
107	//#define VBOX_WITH_OHCI_PHYS_READ_STATS
108
109
110	/*********************************************************************************************************************************
111	* Structures and Typedefs *
112	*********************************************************************************************************************************/
113	/** The saved state version. */
114	#define OHCI_SAVED_STATE_VERSION 5
115	// The saved state with support of 8 ports
116	#define OHCI_SAVED_STATE_VERSION_8PORTS 4
117	/** The saved state version used in 3.0 and earlier.
118	*
119	* @remarks Because of the SSMR3MemPut/Get laziness we ended up with an
120	* accidental format change between 2.0 and 2.1 that didn't get its own
121	* version number. It is therefore not possible to restore states from
122	* 2.0 and earlier with 2.1 and later. */
123	#define OHCI_SAVED_STATE_VERSION_MEM_HELL 3
124
125
126	/** Maximum supported number of Downstream Ports on the root hub. 15 ports
127	* is the maximum defined by the OHCI spec.
128	* If you change this you need to add more status register words to the 'opreg'
129	* array.
130	*/
131	#define OHCI_NDP_MAX 15
132
133	/** Default NDP, chosen to be compatible with everything. */
134	#define OHCI_NDP_DEFAULT 12
135
136	/* Macro to query the number of currently configured ports. */
137	#define OHCI_NDP_CFG(pohci) ((pohci)->RootHub.desc_a & OHCI_RHA_NDP)
138
139	/** Pointer to OHCI device data. */
140	typedef struct OHCI *POHCI;
141	/** Read-only pointer to the OHCI device data. */
142	typedef struct OHCI const *PCOHCI;
143
144	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
145	/**
146	* Host controller transfer descriptor data.
147	*/
148	typedef struct VUSBURBHCITDINT
149	{
150	/** Type of TD. */
151	uint32_t TdType;
152	/** The address of the */
153	RTGCPHYS32 TdAddr;
154	/** A copy of the TD. */
155	uint32_t TdCopy[16];
156	} VUSBURBHCITDINT;
157
158	/**
159	* The host controller data associated with each URB.
160	*/
161	typedef struct VUSBURBHCIINT
162	{
163	/** The endpoint descriptor address. */
164	RTGCPHYS32 EdAddr;
165	/** Number of Tds in the array. */
166	uint32_t cTds;
167	/** When this URB was created.
168	* (Used for isochronous frames and for logging.) */
169	uint32_t u32FrameNo;
170	/** Flag indicating that the TDs have been unlinked. */
171	bool fUnlinked;
172	} VUSBURBHCIINT;
173	#endif
174
175	/**
176	* An OHCI root hub port.
177	*/
178	typedef struct OHCIHUBPORT
179	{
180	/** The port register. */
181	uint32_t fReg;
182	#if HC_ARCH_BITS == 64
183	uint32_t Alignment0; /*< Align the pointer correctly. /
184	#endif
185	/** The device attached to the port. */
186	R3PTRTYPE(PVUSBIDEVICE) pDev;
187	} OHCIHUBPORT;
188	#if HC_ARCH_BITS == 64
189	AssertCompile(sizeof(OHCIHUBPORT) == 16); /* saved state */
190	#endif
191	/** Pointer to an OHCI hub port. */
192	typedef OHCIHUBPORT *POHCIHUBPORT;
193
194	/**
195	* The OHCI root hub.
196	*
197	* @implements PDMIBASE
198	* @implements VUSBIROOTHUBPORT
199	* @implements PDMILEDPORTS
200	*/
201	typedef struct ohci_roothub
202	{
203	/** Pointer to the base interface of the VUSB RootHub. */
204	R3PTRTYPE(PPDMIBASE) pIBase;
205	/** Pointer to the connector interface of the VUSB RootHub. */
206	R3PTRTYPE(PVUSBIROOTHUBCONNECTOR) pIRhConn;
207	/** Pointer to the device interface of the VUSB RootHub. */
208	R3PTRTYPE(PVUSBIDEVICE) pIDev;
209	/** The base interface exposed to the roothub driver. */
210	PDMIBASE IBase;
211	/** The roothub port interface exposed to the roothub driver. */
212	VUSBIROOTHUBPORT IRhPort;
213
214	/** The LED. */
215	PDMLED Led;
216	/** The LED ports. */
217	PDMILEDPORTS ILeds;
218	/** Partner of ILeds. */
219	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
220
221	uint32_t status;
222	uint32_t desc_a;
223	uint32_t desc_b;
224	#if HC_ARCH_BITS == 64
225	uint32_t Alignment0; /*< Align aPorts on a 8 byte boundary. /
226	#endif
227	OHCIHUBPORT aPorts[OHCI_NDP_MAX];
228	R3PTRTYPE(POHCI) pOhci;
229	} OHCIROOTHUB;
230	/** Pointer to the OHCI root hub. */
231	typedef OHCIROOTHUB *POHCIROOTHUB;
232
233
234	/**
235	* Data used for reattaching devices on a state load.
236	*/
237	typedef struct ohci_load {
238	/** Timer used once after state load to inform the guest about new devices.
239	* We do this to be sure the guest get any disconnect / reconnect on the
240	* same port. */
241	PTMTIMERR3 pTimer;
242	/** Number of detached devices. */
243	unsigned cDevs;
244	/** Array of devices which were detached. */
245	PVUSBIDEVICE apDevs[OHCI_NDP_MAX];
246	} OHCILOAD;
247	/** Pointer to an OHCILOAD structure. */
248	typedef OHCILOAD *POHCILOAD;
249
250	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
251	typedef struct OHCIPAGECACHE
252	{
253	/** Last read physical page address. */
254	RTGCPHYS GCPhysReadCacheAddr;
255	/** Copy of last read physical page. */
256	uint8_t au8PhysReadCache[PAGE_SIZE];
257	} OHCIPAGECACHE, *POHCIPAGECACHE;
258	#endif
259
260	/**
261	* OHCI device data.
262	*/
263	typedef struct OHCI
264	{
265	/** The PCI device. */
266	PCIDEVICE PciDev;
267
268	/** Pointer to the device instance - R3 ptr. */
269	PPDMDEVINSR3 pDevInsR3;
270	/** The End-Of-Frame timer - R3 Ptr. */
271	PTMTIMERR3 pEndOfFrameTimerR3;
272
273	/** Pointer to the device instance - R0 ptr */
274	PPDMDEVINSR0 pDevInsR0;
275	/** The End-Of-Frame timer - R0 Ptr. */
276	PTMTIMERR0 pEndOfFrameTimerR0;
277
278	/** Pointer to the device instance - RC ptr. */
279	PPDMDEVINSRC pDevInsRC;
280	/** The End-Of-Frame timer - RC Ptr. */
281	PTMTIMERRC pEndOfFrameTimerRC;
282
283	/** Start of current frame. */
284	uint64_t SofTime;
285	/* done queue interrupt counter */
286	uint32_t dqic : 3;
287	/** frame number overflow. */
288	uint32_t fno : 1;
289	/** Address of the MMIO region assigned by PCI. */
290	RTGCPHYS32 MMIOBase;
291
292	/* Root hub device */
293	OHCIROOTHUB RootHub;
294
295	/* OHCI registers */
296
297	/** @name Control partition
298	* @{ */
299	/** HcControl. */
300	uint32_t ctl;
301	/** HcCommandStatus. */
302	uint32_t status;
303	/** HcInterruptStatus. */
304	uint32_t intr_status;
305	/** HcInterruptEnabled. */
306	uint32_t intr;
307	/** @} */
308
309	/** @name Memory pointer partition
310	* @{ */
311	/** HcHCCA. */
312	uint32_t hcca;
313	/** HcPeriodCurrentEd. */
314	uint32_t per_cur;
315	/** HcControlCurrentED. */
316	uint32_t ctrl_cur;
317	/** HcControlHeadED. */
318	uint32_t ctrl_head;
319	/** HcBlockCurrendED. */
320	uint32_t bulk_cur;
321	/** HcBlockHeadED. */
322	uint32_t bulk_head;
323	/** HcDoneHead. */
324	uint32_t done;
325	/** @} */
326
327	/** @name Frame counter partition
328	* @{ */
329	/** HcFmInterval.FSMPS - FSLargestDataPacket */
330	uint32_t fsmps : 15;
331	/** HcFmInterval.FIT - FrameItervalToggle */
332	uint32_t fit : 1;
333	/** HcFmInterval.FI - FrameInterval */
334	uint32_t fi : 14;
335	/** HcFmRemaining.FRT - toggle bit. */
336	uint32_t frt : 1;
337	/** HcFmNumber.
338	* @remark The register size is 16-bit, but for debugging and performance
339	* reasons we maintain a 32-bit counter. */
340	uint32_t HcFmNumber;
341	/** HcPeriodicStart */
342	uint32_t pstart;
343	/** @} */
344
345	/** The number of virtual time ticks per frame. */
346	uint64_t cTicksPerFrame;
347	/** The number of virtual time ticks per USB bus tick. */
348	uint64_t cTicksPerUsbTick;
349
350	/** Number of in-flight TDs. */
351	unsigned cInFlight;
352	unsigned Alignment0; /*< Align aInFlight on a 8 byte boundary. /
353	/** Array of in-flight TDs. */
354	struct ohci_td_in_flight
355	{
356	/** Address of the transport descriptor. */
357	uint32_t GCPhysTD;
358	/** Flag indicating an inactive (not-linked) URB. */
359	bool fInactive;
360	/** Pointer to the URB. */
361	R3PTRTYPE(PVUSBURB) pUrb;
362	} aInFlight[257];
363
364	#if HC_ARCH_BITS == 32
365	uint32_t Alignment1;
366	#endif
367
368	/** Number of in-done-queue TDs. */
369	unsigned cInDoneQueue;
370	/** Array of in-done-queue TDs. */
371	struct ohci_td_in_done_queue
372	{
373	/** Address of the transport descriptor. */
374	uint32_t GCPhysTD;
375	} aInDoneQueue[64];
376	/** When the tail of the done queue was added.
377	* Used to calculate the age of the done queue. */
378	uint32_t u32FmDoneQueueTail;
379	#if R3_ARCH_BITS == 32
380	/** Align pLoad, the stats and the struct size correctly. */
381	uint32_t Alignment2;
382	#endif
383	/** Pointer to state load data. */
384	R3PTRTYPE(POHCILOAD) pLoad;
385
386	/** Detected canceled isochronous URBs. */
387	STAMCOUNTER StatCanceledIsocUrbs;
388	/** Detected canceled general URBs. */
389	STAMCOUNTER StatCanceledGenUrbs;
390	/** Dropped URBs (endpoint halted, or URB canceled). */
391	STAMCOUNTER StatDroppedUrbs;
392	/** Profiling ohciFrameBoundaryTimer. */
393	STAMPROFILE StatTimer;
394
395	/** This member and all the following are not part of saved state. */
396	uint64_t SavedStateEnd;
397
398	/** VM timer frequency used for frame timer calculations. */
399	uint64_t u64TimerHz;
400	/** Idle detection flag; must be cleared at start of frame */
401	bool fIdle;
402	/** A flag indicating that the bulk list may have in-flight URBs. */
403	bool fBulkNeedsCleaning;
404
405	/** Whether RC/R0 is enabled. */
406	bool fRZEnabled;
407
408	uint32_t Alignment3; /*< Align size on a 8 byte boundary. /
409
410	/** Critical section synchronising interrupt handling. */
411	PDMCRITSECT CsIrq;
412	/** Critical section to synchronize the framer and URB completion handler. */
413	RTCRITSECT CritSect;
414	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
415	/** Last read physical page for caching ED reads in the framer thread. */
416	R3PTRTYPE(POHCIPAGECACHE) pCacheED;
417	/** Last read physical page for caching TD reads in the framer thread. */
418	R3PTRTYPE(POHCIPAGECACHE) pCacheTD;
419	#endif
420
421	} OHCI;
422
423	/* Standard OHCI bus speed */
424	#define OHCI_DEFAULT_TIMER_FREQ 1000
425
426	/* Host Controller Communications Area */
427	#define OHCI_HCCA_NUM_INTR 32
428	#define OHCI_HCCA_OFS (OHCI_HCCA_NUM_INTR * sizeof(uint32_t))
429	struct ohci_hcca
430	{
431	uint16_t frame;
432	uint16_t pad;
433	uint32_t done;
434	};
435	AssertCompileSize(ohci_hcca, 8);
436
437	/** @name OHCI Endpoint Descriptor
438	* @{ */
439
440	#define ED_PTR_MASK (~(uint32_t)0xf)
441	#define ED_HWINFO_MPS 0x07ff0000
442	#define ED_HWINFO_ISO RT_BIT(15)
443	#define ED_HWINFO_SKIP RT_BIT(14)
444	#define ED_HWINFO_LOWSPEED RT_BIT(13)
445	#define ED_HWINFO_IN RT_BIT(12)
446	#define ED_HWINFO_OUT RT_BIT(11)
447	#define ED_HWINFO_DIR (RT_BIT(11) \| RT_BIT(12))
448	#define ED_HWINFO_ENDPOINT 0x780 /* 4 bits */
449	#define ED_HWINFO_ENDPOINT_SHIFT 7
450	#define ED_HWINFO_FUNCTION 0x7f /* 7 bits */
451	#define ED_HEAD_CARRY RT_BIT(1)
452	#define ED_HEAD_HALTED RT_BIT(0)
453
454	/**
455	* OHCI Endpoint Descriptor.
456	*/
457	typedef struct OHCIED
458	{
459	/** Flags and stuff. */
460	uint32_t hwinfo;
461	/** TailP - TD Queue Tail pointer. Bits 0-3 ignored / preserved. */
462	uint32_t TailP;
463	/** HeadP - TD Queue head pointer. Bit 0 - Halted, Bit 1 - toggleCarry. Bit 2&3 - 0. */
464	uint32_t HeadP;
465	/** NextED - Next Endpoint Descriptor. Bits 0-3 ignored / preserved. */
466	uint32_t NextED;
467	} OHCIED, *POHCIED;
468	typedef const OHCIED *PCOHCIED;
469	AssertCompileSize(OHCIED, 16);
470
471	/** @} */
472
473
474	/** @name Completion Codes
475	* @{ */
476	#define OHCI_CC_NO_ERROR (UINT32_C(0x00) << 28)
477	#define OHCI_CC_CRC (UINT32_C(0x01) << 28)
478	#define OHCI_CC_STALL (UINT32_C(0x04) << 28)
479	#define OHCI_CC_DEVICE_NOT_RESPONDING (UINT32_C(0x05) << 28)
480	#define OHCI_CC_DNR OHCI_CC_DEVICE_NOT_RESPONDING
481	#define OHCI_CC_PID_CHECK_FAILURE (UINT32_C(0x06) << 28)
482	#define OHCI_CC_UNEXPECTED_PID (UINT32_C(0x07) << 28)
483	#define OHCI_CC_DATA_OVERRUN (UINT32_C(0x08) << 28)
484	#define OHCI_CC_DATA_UNDERRUN (UINT32_C(0x09) << 28)
485	/* 0x0a..0x0b - reserved */
486	#define OHCI_CC_BUFFER_OVERRUN (UINT32_C(0x0c) << 28)
487	#define OHCI_CC_BUFFER_UNDERRUN (UINT32_C(0x0d) << 28)
488	#define OHCI_CC_NOT_ACCESSED_0 (UINT32_C(0x0e) << 28)
489	#define OHCI_CC_NOT_ACCESSED_1 (UINT32_C(0x0f) << 28)
490	/** @} */
491
492
493	/** @name OHCI General transfer descriptor
494	* @{ */
495
496	/** Error count (EC) shift. */
497	#define TD_ERRORS_SHIFT 26
498	/** Error count max. (One greater than what the EC field can hold.) */
499	#define TD_ERRORS_MAX 4
500
501	/** CC - Condition code mask. */
502	#define TD_HWINFO_CC (UINT32_C(0xf0000000))
503	#define TD_HWINFO_CC_SHIFT 28
504	/** EC - Error count. */
505	#define TD_HWINFO_ERRORS (RT_BIT(26) \| RT_BIT(27))
506	/** T - Data toggle. */
507	#define TD_HWINFO_TOGGLE (RT_BIT(24) \| RT_BIT(25))
508	#define TD_HWINFO_TOGGLE_HI (RT_BIT(25))
509	#define TD_HWINFO_TOGGLE_LO (RT_BIT(24))
510	/** DI - Delay interrupt. */
511	#define TD_HWINFO_DI (RT_BIT(21) \| RT_BIT(22) \| RT_BIT(23))
512	#define TD_HWINFO_IN (RT_BIT(20))
513	#define TD_HWINFO_OUT (RT_BIT(19))
514	/** DP - Direction / PID. */
515	#define TD_HWINFO_DIR (RT_BIT(19) \| RT_BIT(20))
516	/** R - Buffer rounding. */
517	#define TD_HWINFO_ROUNDING (RT_BIT(18))
518	/** Bits that are reserved / unknown. */
519	#define TD_HWINFO_UNKNOWN_MASK (UINT32_C(0x0003ffff))
520
521	/** SETUP - to endpoint. */
522	#define OHCI_TD_DIR_SETUP 0x0
523	/** OUT - to endpoint. */
524	#define OHCI_TD_DIR_OUT 0x1
525	/** IN - from endpoint. */
526	#define OHCI_TD_DIR_IN 0x2
527	/** Reserved. */
528	#define OHCI_TD_DIR_RESERVED 0x3
529
530	/**
531	* OHCI general transfer descriptor
532	*/
533	typedef struct OHCITD
534	{
535	uint32_t hwinfo;
536	/** CBP - Current Buffer Pointer. (32-bit physical address) */
537	uint32_t cbp;
538	/** NextTD - Link to the next transfer descriptor. (32-bit physical address, dword aligned) */
539	uint32_t NextTD;
540	/** BE - Buffer End (inclusive). (32-bit physical address) */
541	uint32_t be;
542	} OHCITD, *POHCITD;
543	typedef const OHCITD *PCOHCITD;
544	AssertCompileSize(OHCIED, 16);
545	/** @} */
546
547
548	/** @name OHCI isochronous transfer descriptor.
549	* @{ */
550	/** SF - Start frame number. */
551	#define ITD_HWINFO_SF 0xffff
552	/** DI - Delay interrupt. (TD_HWINFO_DI) */
553	#define ITD_HWINFO_DI (RT_BIT(21) \| RT_BIT(22) \| RT_BIT(23))
554	#define ITD_HWINFO_DI_SHIFT 21
555	/** FC - Frame count. */
556	#define ITD_HWINFO_FC (RT_BIT(24) \| RT_BIT(25) \| RT_BIT(26))
557	#define ITD_HWINFO_FC_SHIFT 24
558	/** CC - Condition code mask. (=TD_HWINFO_CC) */
559	#define ITD_HWINFO_CC UINT32_C(0xf0000000)
560	#define ITD_HWINFO_CC_SHIFT 28
561	/** The buffer page 0 mask (lower 12 bits are ignored). */
562	#define ITD_BP0_MASK UINT32_C(0xfffff000)
563
564	#define ITD_NUM_PSW 8
565	/** OFFSET - offset of the package into the buffer page.
566	* (Only valid when CC set to Not Accessed.)
567	*
568	* Note that the top bit of the OFFSET field is overlapping with the
569	* first bit in the CC field. This is ok because both 0xf and 0xe are
570	* defined as "Not Accessed".
571	*/
572	#define ITD_PSW_OFFSET 0x1fff
573	/** SIZE field mask for IN bound transfers.
574	* (Only valid when CC isn't Not Accessed.)*/
575	#define ITD_PSW_SIZE 0x07ff
576	/** CC field mask.
577	* USed to indicate the format of SIZE (Not Accessed -> OFFSET). */
578	#define ITD_PSW_CC 0xf000
579	#define ITD_PSW_CC_SHIFT 12
580
581	/**
582	* OHCI isochronous transfer descriptor.
583	*/
584	typedef struct OHCIITD
585	{
586	uint32_t HwInfo;
587	/** BP0 - Buffer Page 0. The lower 12 bits are ignored. */
588	uint32_t BP0;
589	/** NextTD - Link to the next transfer descriptor. (32-bit physical address, dword aligned) */
590	uint32_t NextTD;
591	/** BE - Buffer End (inclusive). (32-bit physical address) */
592	uint32_t BE;
593	/** (OffsetN/)PSWN - package status word array (0..7).
594	* The format varies depending on whether the package has been completed or not. */
595	uint16_t aPSW[ITD_NUM_PSW];
596	} OHCIITD, *POHCIITD;
597	typedef const OHCIITD *PCOHCIITD;
598	AssertCompileSize(OHCIITD, 32);
599	/** @} */
600
601	/**
602	* OHCI register operator.
603	*/
604	typedef struct ohci_opreg
605	{
606	const char *pszName;
607	int (pfnRead )(PCOHCI pThis, uint32_t iReg, uint32_t pu32Value);
608	int (*pfnWrite)(POHCI pThis, uint32_t iReg, uint32_t u32Value);
609	} OHCIOPREG;
610
611
612	/* OHCI Local stuff */
613	#define OHCI_CTL_CBSR ((1<<0)\|(1<<1))
614	#define OHCI_CTL_PLE (1<<2)
615	#define OHCI_CTL_IE (1<<3)
616	#define OHCI_CTL_CLE (1<<4)
617	#define OHCI_CTL_BLE (1<<5)
618	#define OHCI_CTL_HCFS ((1<<6)\|(1<<7))
619	#define OHCI_USB_RESET 0x00
620	#define OHCI_USB_RESUME 0x40
621	#define OHCI_USB_OPERATIONAL 0x80
622	#define OHCI_USB_SUSPEND 0xc0
623	#define OHCI_CTL_IR (1<<8)
624	#define OHCI_CTL_RWC (1<<9)
625	#define OHCI_CTL_RWE (1<<10)
626
627	#define OHCI_STATUS_HCR (1<<0)
628	#define OHCI_STATUS_CLF (1<<1)
629	#define OHCI_STATUS_BLF (1<<2)
630	#define OHCI_STATUS_OCR (1<<3)
631	#define OHCI_STATUS_SOC ((1<<6)\|(1<<7))
632
633	/** @name Interrupt Status and Enabled/Disabled Flags
634	* @{ */
635	/** SO - Scheduling overrun. */
636	#define OHCI_INTR_SCHEDULEING_OVERRUN RT_BIT(0)
637	/** WDH - HcDoneHead writeback. */
638	#define OHCI_INTR_WRITE_DONE_HEAD RT_BIT(1)
639	/** SF - Start of frame. */
640	#define OHCI_INTR_START_OF_FRAME RT_BIT(2)
641	/** RD - Resume detect. */
642	#define OHCI_INTR_RESUME_DETECT RT_BIT(3)
643	/** UE - Unrecoverable error. */
644	#define OHCI_INTR_UNRECOVERABLE_ERROR RT_BIT(4)
645	/** FNO - Frame number overflow. */
646	#define OHCI_INTR_FRAMENUMBER_OVERFLOW RT_BIT(5)
647	/** RHSC- Root hub status change. */
648	#define OHCI_INTR_ROOT_HUB_STATUS_CHANGE RT_BIT(6)
649	/** OC - Ownership change. */
650	#define OHCI_INTR_OWNERSHIP_CHANGE RT_BIT(30)
651	/** MIE - Master interrupt enable. */
652	#define OHCI_INTR_MASTER_INTERRUPT_ENABLED RT_BIT(31)
653	/** @} */
654
655	#define OHCI_HCCA_SIZE 0x100
656	#define OHCI_HCCA_MASK UINT32_C(0xffffff00)
657
658	#define OHCI_FMI_FI UINT32_C(0x00003fff)
659	#define OHCI_FMI_FSMPS UINT32_C(0x7fff0000)
660	#define OHCI_FMI_FSMPS_SHIFT 16
661	#define OHCI_FMI_FIT UINT32_C(0x80000000)
662	#define OHCI_FMI_FIT_SHIFT 31
663
664	#define OHCI_FR_RT RT_BIT_32(31)
665
666	#define OHCI_LS_THRESH 0x628
667
668	#define OHCI_RHA_NDP (0xff)
669	#define OHCI_RHA_PSM RT_BIT_32(8)
670	#define OHCI_RHA_NPS RT_BIT_32(9)
671	#define OHCI_RHA_DT RT_BIT_32(10)
672	#define OHCI_RHA_OCPM RT_BIT_32(11)
673	#define OHCI_RHA_NOCP RT_BIT_32(12)
674	#define OHCI_RHA_POTPGP UINT32_C(0xff000000)
675
676	#define OHCI_RHS_LPS RT_BIT_32(0)
677	#define OHCI_RHS_OCI RT_BIT_32(1)
678	#define OHCI_RHS_DRWE RT_BIT_32(15)
679	#define OHCI_RHS_LPSC RT_BIT_32(16)
680	#define OHCI_RHS_OCIC RT_BIT_32(17)
681	#define OHCI_RHS_CRWE RT_BIT_32(31)
682
683	/** @name HcRhPortStatus[n] - RH Port Status register (read).
684	* @{ */
685	/** CCS - CurrentConnectionStatus - 0 = no device, 1 = device. */
686	#define OHCI_PORT_CCS RT_BIT(0)
687	/** PES - PortEnableStatus. */
688	#define OHCI_PORT_PES RT_BIT(1)
689	/** PSS - PortSuspendStatus */
690	#define OHCI_PORT_PSS RT_BIT(2)
691	/** POCI- PortOverCurrentIndicator. */
692	#define OHCI_PORT_POCI RT_BIT(3)
693	/** PRS - PortResetStatus */
694	#define OHCI_PORT_PRS RT_BIT(4)
695	/** PPS - PortPowerStatus */
696	#define OHCI_PORT_PPS RT_BIT(8)
697	/** LSDA - LowSpeedDeviceAttached */
698	#define OHCI_PORT_LSDA RT_BIT(9)
699	/** CSC - ConnectStatusChange */
700	#define OHCI_PORT_CSC RT_BIT(16)
701	/** PESC - PortEnableStatusChange */
702	#define OHCI_PORT_PESC RT_BIT(17)
703	/** PSSC - PortSuspendStatusChange */
704	#define OHCI_PORT_PSSC RT_BIT(18)
705	/** OCIC - OverCurrentIndicatorChange */
706	#define OHCI_PORT_OCIC RT_BIT(19)
707	/** PRSC - PortResetStatusChange */
708	#define OHCI_PORT_PRSC RT_BIT(20)
709	/** @} */
710
711
712	/** @name HcRhPortStatus[n] - Root Hub Port Status Registers - read.
713	* @{ */
714	/** CCS - CurrentConnectStatus - 0 = no device, 1 = device. */
715	#define OHCI_PORT_R_CURRENT_CONNECT_STATUS RT_BIT(0)
716	/** PES - PortEnableStatus. */
717	#define OHCI_PORT_R_ENABLE_STATUS RT_BIT(1)
718	/** PSS - PortSuspendStatus */
719	#define OHCI_PORT_R_SUSPEND_STATUS RT_BIT(2)
720	/** POCI- PortOverCurrentIndicator. */
721	#define OHCI_PORT_R_OVER_CURRENT_INDICATOR RT_BIT(3)
722	/** PRS - PortResetStatus */
723	#define OHCI_PORT_R_RESET_STATUS RT_BIT(4)
724	/** PPS - PortPowerStatus */
725	#define OHCI_PORT_R_POWER_STATUS RT_BIT(8)
726	/** LSDA - LowSpeedDeviceAttached */
727	#define OHCI_PORT_R_LOW_SPEED_DEVICE_ATTACHED RT_BIT(9)
728	/** CSC - ConnectStatusChange */
729	#define OHCI_PORT_R_CONNECT_STATUS_CHANGE RT_BIT(16)
730	/** PESC - PortEnableStatusChange */
731	#define OHCI_PORT_R_ENABLE_STATUS_CHANGE RT_BIT(17)
732	/** PSSC - PortSuspendStatusChange */
733	#define OHCI_PORT_R_SUSPEND_STATUS_CHANGE RT_BIT(18)
734	/** OCIC - OverCurrentIndicatorChange */
735	#define OHCI_PORT_R_OVER_CURRENT_INDICATOR_CHANGE RT_BIT(19)
736	/** PRSC - PortResetStatusChange */
737	#define OHCI_PORT_R_RESET_STATUS_CHANGE RT_BIT(20)
738	/** @} */
739
740	/** @name HcRhPortStatus[n] - Root Hub Port Status Registers - write.
741	* @{ */
742	/** CCS - ClearPortEnable. */
743	#define OHCI_PORT_W_CLEAR_ENABLE RT_BIT(0)
744	/** PES - SetPortEnable. */
745	#define OHCI_PORT_W_SET_ENABLE RT_BIT(1)
746	/** PSS - SetPortSuspend */
747	#define OHCI_PORT_W_SET_SUSPEND RT_BIT(2)
748	/** POCI- ClearSuspendStatus. */
749	#define OHCI_PORT_W_CLEAR_SUSPEND_STATUS RT_BIT(3)
750	/** PRS - SetPortReset */
751	#define OHCI_PORT_W_SET_RESET RT_BIT(4)
752	/** PPS - SetPortPower */
753	#define OHCI_PORT_W_SET_POWER RT_BIT(8)
754	/** LSDA - ClearPortPower */
755	#define OHCI_PORT_W_CLEAR_POWER RT_BIT(9)
756	/** CSC - ClearConnectStatusChange */
757	#define OHCI_PORT_W_CLEAR_CSC RT_BIT(16)
758	/** PESC - PortEnableStatusChange */
759	#define OHCI_PORT_W_CLEAR_PESC RT_BIT(17)
760	/** PSSC - PortSuspendStatusChange */
761	#define OHCI_PORT_W_CLEAR_PSSC RT_BIT(18)
762	/** OCIC - OverCurrentIndicatorChange */
763	#define OHCI_PORT_W_CLEAR_OCIC RT_BIT(19)
764	/** PRSC - PortResetStatusChange */
765	#define OHCI_PORT_W_CLEAR_PRSC RT_BIT(20)
766	/** The mask of bit which are used to clear themselves. */
767	#define OHCI_PORT_W_CLEAR_CHANGE_MASK ( OHCI_PORT_W_CLEAR_CSC \| OHCI_PORT_W_CLEAR_PESC \| OHCI_PORT_W_CLEAR_PSSC \
768	\| OHCI_PORT_W_CLEAR_OCIC \| OHCI_PORT_W_CLEAR_PRSC)
769	/** @} */
770
771
772	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
773
774
775	/*********************************************************************************************************************************
776	* Global Variables *
777	*********************************************************************************************************************************/
778	#if defined(LOG_ENABLED) && defined(IN_RING3)
779	static bool g_fLogBulkEPs = false;
780	static bool g_fLogControlEPs = false;
781	static bool g_fLogInterruptEPs = false;
782	#endif
783	#ifdef IN_RING3
784	/**
785	* SSM descriptor table for the OHCI structure.
786	*/
787	static SSMFIELD const g_aOhciFields[] =
788	{
789	SSMFIELD_ENTRY( OHCI, SofTime),
790	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
791	SSMFIELD_ENTRY( OHCI, RootHub.status),
792	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
793	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
794	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
795	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
796	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
797	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
798	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
799	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
800	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
801	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
802	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[8].fReg),
803	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[9].fReg),
804	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[10].fReg),
805	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[11].fReg),
806	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[12].fReg),
807	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[13].fReg),
808	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[14].fReg),
809	SSMFIELD_ENTRY( OHCI, ctl),
810	SSMFIELD_ENTRY( OHCI, status),
811	SSMFIELD_ENTRY( OHCI, intr_status),
812	SSMFIELD_ENTRY( OHCI, intr),
813	SSMFIELD_ENTRY( OHCI, hcca),
814	SSMFIELD_ENTRY( OHCI, per_cur),
815	SSMFIELD_ENTRY( OHCI, ctrl_cur),
816	SSMFIELD_ENTRY( OHCI, ctrl_head),
817	SSMFIELD_ENTRY( OHCI, bulk_cur),
818	SSMFIELD_ENTRY( OHCI, bulk_head),
819	SSMFIELD_ENTRY( OHCI, done),
820	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
821	SSMFIELD_ENTRY( OHCI, HcFmNumber),
822	SSMFIELD_ENTRY( OHCI, pstart),
823	SSMFIELD_ENTRY_TERM()
824	};
825	#endif
826
827
828	/*********************************************************************************************************************************
829	* Internal Functions *
830	*********************************************************************************************************************************/
831	RT_C_DECLS_BEGIN
832	#ifdef IN_RING3
833	/* Update host controller state to reflect a device attach */
834	static void rhport_power(POHCIROOTHUB pRh, unsigned iPort, bool fPowerUp);
835	static void ohciBusResume(POHCI ohci, bool fHardware);
836	static void ohciBusStop(POHCI pThis);
837	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
838	static void ohciPhysReadCacheClear(POHCIPAGECACHE pPageCache);
839	#endif
840
841	static DECLCALLBACK(void) ohciRhXferCompletion(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb);
842	static DECLCALLBACK(bool) ohciRhXferError(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb);
843
844	static int ohci_in_flight_find(POHCI pThis, uint32_t GCPhysTD);
845	# if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
846	static int ohci_in_done_queue_find(POHCI pThis, uint32_t GCPhysTD);
847	# endif
848	static DECLCALLBACK(void) ohciR3LoadReattachDevices(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser);
849	#endif /* IN_RING3 */
850	RT_C_DECLS_END
851
852
853	/**
854	* Update PCI IRQ levels
855	*/
856	static void ohciUpdateInterruptLocked(POHCI ohci, const char *msg)
857	{
858	int level = 0;
859
860	if ( (ohci->intr & OHCI_INTR_MASTER_INTERRUPT_ENABLED)
861	&& (ohci->intr_status & ohci->intr)
862	&& !(ohci->ctl & OHCI_CTL_IR))
863	level = 1;
864
865	PDMDevHlpPCISetIrq(ohci->CTX_SUFF(pDevIns), 0, level);
866	if (level)
867	{
868	uint32_t val = ohci->intr_status & ohci->intr;
869	Log2(("ohci: Fired off interrupt %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d - %s\n",
870	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
871	(val >> 6) & 1, (val >> 30) & 1, msg)); NOREF(val); NOREF(msg);
872	}
873	}
874
875	/**
876	* Set an interrupt, use the wrapper ohciSetInterrupt.
877	*/
878	DECLINLINE(int) ohciSetInterruptInt(POHCI ohci, int rcBusy, uint32_t intr, const char *msg)
879	{
880	int rc = PDMCritSectEnter(&ohci->CsIrq, rcBusy);
881	if (rc != VINF_SUCCESS)
882	return rc;
883
884	if ( (ohci->intr_status & intr) != intr )
885	{
886	ohci->intr_status \|= intr;
887	ohciUpdateInterruptLocked(ohci, msg);
888	}
889
890	PDMCritSectLeave(&ohci->CsIrq);
891	return rc;
892	}
893
894	/**
895	* Set an interrupt wrapper macro for logging purposes.
896	*/
897	#define ohciSetInterrupt(ohci, a_rcBusy, intr) ohciSetInterruptInt(ohci, a_rcBusy, intr, #intr)
898	#define ohciR3SetInterrupt(ohci, intr) ohciSetInterruptInt(ohci, VERR_IGNORED, intr, #intr)
899
900	#ifdef IN_RING3
901
902	/* Carry out a hardware remote wakeup */
903	static void ohci_remote_wakeup(POHCI pThis)
904	{
905	if ((pThis->ctl & OHCI_CTL_HCFS) != OHCI_USB_SUSPEND)
906	return;
907	if (!(pThis->RootHub.status & OHCI_RHS_DRWE))
908	return;
909	ohciBusResume(pThis, true /* hardware */);
910	}
911
912
913	/**
914	* Query interface method for the roothub LUN.
915	*/
916	static DECLCALLBACK(void ) ohciRhQueryInterface(PPDMIBASE pInterface, const char pszIID)
917	{
918	POHCI pThis = RT_FROM_MEMBER(pInterface, OHCI, RootHub.IBase);
919	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->RootHub.IBase);
920	PDMIBASE_RETURN_INTERFACE(pszIID, VUSBIROOTHUBPORT, &pThis->RootHub.IRhPort);
921	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThis->RootHub.ILeds);
922	return NULL;
923	}
924
925	/**
926	* Gets the pointer to the status LED of a unit.
927	*
928	* @returns VBox status code.
929	* @param pInterface Pointer to the interface structure containing the called function pointer.
930	* @param iLUN The unit which status LED we desire.
931	* @param ppLed Where to store the LED pointer.
932	*/
933	static DECLCALLBACK(int) ohciRhQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
934	{
935	POHCI pThis = (POHCI)((uintptr_t)pInterface - RT_OFFSETOF(OHCI, RootHub.ILeds));
936	if (iLUN == 0)
937	{
938	*ppLed = &pThis->RootHub.Led;
939	return VINF_SUCCESS;
940	}
941	return VERR_PDM_LUN_NOT_FOUND;
942	}
943
944
945	/** Converts a OHCI.roothub.IRhPort pointer to a POHCI. */
946	#define VUSBIROOTHUBPORT_2_OHCI(pInterface) ((POHCI)( (uintptr_t)(pInterface) - RT_OFFSETOF(OHCI, RootHub.IRhPort) ))
947
948
949	/**
950	* Get the number of available ports in the hub.
951	*
952	* @returns The number of ports available.
953	* @param pInterface Pointer to this structure.
954	* @param pAvailable Bitmap indicating the available ports. Set bit == available port.
955	*/
956	static DECLCALLBACK(unsigned) ohciRhGetAvailablePorts(PVUSBIROOTHUBPORT pInterface, PVUSBPORTBITMAP pAvailable)
957	{
958	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
959	unsigned iPort;
960	unsigned cPorts = 0;
961
962	memset(pAvailable, 0, sizeof(*pAvailable));
963
964	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
965	for (iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++)
966	{
967	if (!pThis->RootHub.aPorts[iPort].pDev)
968	{
969	cPorts++;
970	ASMBitSet(pAvailable, iPort + 1);
971	}
972	}
973	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
974
975	return cPorts;
976	}
977
978
979	/**
980	* Gets the supported USB versions.
981	*
982	* @returns The mask of supported USB versions.
983	* @param pInterface Pointer to this structure.
984	*/
985	static DECLCALLBACK(uint32_t) ohciRhGetUSBVersions(PVUSBIROOTHUBPORT pInterface)
986	{
987	return VUSB_STDVER_11;
988	}
989
990
991	/**
992	* A device is being attached to a port in the roothub.
993	*
994	* @param pInterface Pointer to this structure.
995	* @param pDev Pointer to the device being attached.
996	* @param uPort The port number assigned to the device.
997	*/
998	static DECLCALLBACK(int) ohciRhAttach(PVUSBIROOTHUBPORT pInterface, PVUSBIDEVICE pDev, unsigned uPort)
999	{
1000	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
1001	LogFlow(("ohciRhAttach: pDev=%p uPort=%u\n", pDev, uPort));
1002	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
1003
1004	/*
1005	* Validate and adjust input.
1006	*/
1007	Assert(uPort >= 1 && uPort <= OHCI_NDP_CFG(pThis));
1008	uPort--;
1009	Assert(!pThis->RootHub.aPorts[uPort].pDev);
1010	/* Only LS/FS devices can end up here. */
1011	Assert(pDev->pfnGetSpeed(pDev) == VUSB_SPEED_LOW \|\| pDev->pfnGetSpeed(pDev) == VUSB_SPEED_FULL);
1012
1013	/*
1014	* Attach it.
1015	*/
1016	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
1017	pThis->RootHub.aPorts[uPort].pDev = pDev;
1018	rhport_power(&pThis->RootHub, uPort, 1 /* power on */);
1019
1020	ohci_remote_wakeup(pThis);
1021	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
1022
1023	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
1024	return VINF_SUCCESS;
1025	}
1026
1027
1028	/**
1029	* A device is being detached from a port in the roothub.
1030	*
1031	* @param pInterface Pointer to this structure.
1032	* @param pDev Pointer to the device being detached.
1033	* @param uPort The port number assigned to the device.
1034	*/
1035	static DECLCALLBACK(void) ohciRhDetach(PVUSBIROOTHUBPORT pInterface, PVUSBIDEVICE pDev, unsigned uPort)
1036	{
1037	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
1038	LogFlow(("ohciRhDetach: pDev=%p uPort=%u\n", pDev, uPort));
1039	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
1040
1041	/*
1042	* Validate and adjust input.
1043	*/
1044	Assert(uPort >= 1 && uPort <= OHCI_NDP_CFG(pThis));
1045	uPort--;
1046	Assert(pThis->RootHub.aPorts[uPort].pDev == pDev);
1047
1048	/*
1049	* Detach it.
1050	*/
1051	pThis->RootHub.aPorts[uPort].pDev = NULL;
1052	if (pThis->RootHub.aPorts[uPort].fReg & OHCI_PORT_PES)
1053	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CONNECT_STATUS_CHANGE \| OHCI_PORT_PESC;
1054	else
1055	pThis->RootHub.aPorts[uPort].fReg = OHCI_PORT_R_CONNECT_STATUS_CHANGE;
1056
1057	ohci_remote_wakeup(pThis);
1058	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
1059
1060	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
1061	}
1062
1063
1064	#ifdef IN_RING3
1065	/**
1066	* One of the roothub devices has completed its reset operation.
1067	*
1068	* Currently, we don't think anything is required to be done here
1069	* so it's just a stub for forcing async resetting of the devices
1070	* during a root hub reset.
1071	*
1072	* @param pDev The root hub device.
1073	* @param rc The result of the operation.
1074	* @param pvUser Pointer to the controller.
1075	*/
1076	static DECLCALLBACK(void) ohciRhResetDoneOneDev(PVUSBIDEVICE pDev, int rc, void *pvUser)
1077	{
1078	LogRel(("OHCI: root hub reset completed with %Rrc\n", rc));
1079	NOREF(pDev); NOREF(rc); NOREF(pvUser);
1080	}
1081	#endif
1082
1083
1084	/**
1085	* Reset the root hub.
1086	*
1087	* @returns VBox status code.
1088	* @param pInterface Pointer to this structure.
1089	* @param fResetOnLinux This is used to indicate whether we're at VM reset time and
1090	* can do real resets or if we're at any other time where that
1091	* isn't such a good idea.
1092	* @remark Do NOT call VUSBIDevReset on the root hub in an async fashion!
1093	* @thread EMT
1094	*/
1095	static DECLCALLBACK(int) ohciRhReset(PVUSBIROOTHUBPORT pInterface, bool fResetOnLinux)
1096	{
1097	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
1098	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
1099
1100	pThis->RootHub.status = 0;
1101	pThis->RootHub.desc_a = OHCI_RHA_NPS \| OHCI_NDP_CFG(pThis); /* Preserve NDP value. */
1102	pThis->RootHub.desc_b = 0x0; /* Impl. specific */
1103
1104	/*
1105	* We're pending to _reattach_ the device without resetting them.
1106	* Except, during VM reset where we use the opportunity to do a proper
1107	* reset before the guest comes along and expect things.
1108	*
1109	* However, it's very very likely that we're not doing the right thing
1110	* here if coming from the guest (USB Reset state). The docs talks about
1111	* root hub resetting, however what exact behaviour in terms of root hub
1112	* status and changed bits, and HC interrupts aren't stated clearly. IF we
1113	* get trouble and see the guest doing "USB Resets" we will have to look
1114	* into this. For the time being we stick with simple.
1115	*/
1116	for (unsigned iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++)
1117	{
1118	if (pThis->RootHub.aPorts[iPort].pDev)
1119	{
1120	pThis->RootHub.aPorts[iPort].fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
1121	if (fResetOnLinux)
1122	{
1123	PVM pVM = PDMDevHlpGetVM(pThis->CTX_SUFF(pDevIns));
1124	VUSBIDevReset(pThis->RootHub.aPorts[iPort].pDev, fResetOnLinux, ohciRhResetDoneOneDev, pThis, pVM);
1125	}
1126	}
1127	else
1128	pThis->RootHub.aPorts[iPort].fReg = 0;
1129	}
1130
1131	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
1132	return VINF_SUCCESS;
1133	}
1134
1135
1136	/**
1137	* Does a software or hardware reset of the controller.
1138	*
1139	* This is called in response to setting HcCommandStatus.HCR, hardware reset,
1140	* and device construction.
1141	*
1142	* @param pThis The ohci instance data.
1143	* @param fNewMode The new mode of operation. This is UsbSuspend if it's a
1144	* software reset, and UsbReset if it's a hardware reset / cold boot.
1145	* @param fResetOnLinux Set if we can do a real reset of the devices attached to the root hub.
1146	* This is really a just a hack for the non-working linux device reset.
1147	* Linux has this feature called 'logical disconnect' if device reset fails
1148	* which prevents us from doing resets when the guest asks for it - the guest
1149	* will get confused when the device seems to be reconnected everytime it tries
1150	* to reset it. But if we're at hardware reset time, we can allow a device to
1151	* be 'reconnected' without upsetting the guest.
1152	*
1153	* @remark This hasn't got anything to do with software setting the mode to UsbReset.
1154	*/
1155	static void ohciDoReset(POHCI pThis, uint32_t fNewMode, bool fResetOnLinux)
1156	{
1157	Log(("ohci: %s reset%s\n", fNewMode == OHCI_USB_RESET ? "hardware" : "software",
1158	fResetOnLinux ? " (reset on linux)" : ""));
1159
1160	/* Stop the bus in any case, disabling walking the lists. */
1161	ohciBusStop(pThis);
1162
1163	/*
1164	* Cancel all outstanding URBs.
1165	*
1166	* We can't, and won't, deal with URBs until we're moved out of the
1167	* suspend/reset state. Also, a real HC isn't going to send anything
1168	* any more when a reset has been signaled.
1169	*/
1170	pThis->RootHub.pIRhConn->pfnCancelAllUrbs(pThis->RootHub.pIRhConn);
1171
1172	/*
1173	* Reset the hardware registers.
1174	*/
1175	if (fNewMode == OHCI_USB_RESET)
1176	pThis->ctl \|= OHCI_CTL_RWC; /* We're the firmware, set RemoteWakeupConnected. */
1177	else
1178	pThis->ctl &= OHCI_CTL_IR \| OHCI_CTL_RWC; /* IR and RWC are preserved on software reset. */
1179
1180	/* Clear the HCFS bits first to make setting the new state work. */
1181	pThis->ctl &= ~OHCI_CTL_HCFS;
1182	pThis->ctl \|= fNewMode;
1183	pThis->status = 0;
1184	pThis->intr_status = 0;
1185	pThis->intr = OHCI_INTR_MASTER_INTERRUPT_ENABLED; /* (We follow the text and the not reset value column,) */
1186
1187	pThis->hcca = 0;
1188	pThis->per_cur = 0;
1189	pThis->ctrl_head = pThis->ctrl_cur = 0;
1190	pThis->bulk_head = pThis->bulk_cur = 0;
1191	pThis->done = 0;
1192
1193	pThis->fsmps = 0x2778; /* To-Be-Defined, use the value linux sets...*/
1194	pThis->fit = 0;
1195	pThis->fi = 11999; /* (12MHz ticks, one frame is 1ms) */
1196	pThis->frt = 0;
1197	pThis->HcFmNumber = 0;
1198	pThis->pstart = 0;
1199
1200	pThis->dqic = 0x7;
1201	pThis->fno = 0;
1202
1203	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
1204	ohciPhysReadCacheClear(pThis->pCacheED);
1205	ohciPhysReadCacheClear(pThis->pCacheTD);
1206	#endif
1207
1208	/*
1209	* If this is a hardware reset, we will initialize the root hub too.
1210	* Software resets doesn't do this according to the specs.
1211	* (It's not possible to have device connected at the time of the
1212	* device construction, so nothing to worry about there.)
1213	*/
1214	if (fNewMode == OHCI_USB_RESET)
1215	VUSBIDevReset(pThis->RootHub.pIDev, fResetOnLinux, NULL, NULL, NULL);
1216	}
1217	#endif /* IN_RING3 */
1218
1219	/**
1220	* Reads physical memory.
1221	*/
1222	DECLINLINE(void) ohciPhysRead(POHCI pThis, uint32_t Addr, void *pvBuf, size_t cbBuf)
1223	{
1224	if (cbBuf)
1225	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), Addr, pvBuf, cbBuf);
1226	}
1227
1228	/**
1229	* Writes physical memory.
1230	*/
1231	DECLINLINE(void) ohciPhysWrite(POHCI pThis, uint32_t Addr, const void *pvBuf, size_t cbBuf)
1232	{
1233	if (cbBuf)
1234	PDMDevHlpPCIPhysWrite(pThis->CTX_SUFF(pDevIns), Addr, pvBuf, cbBuf);
1235	}
1236
1237	/**
1238	* Read an array of dwords from physical memory and correct endianness.
1239	*/
1240	DECLINLINE(void) ohciGetDWords(POHCI pThis, uint32_t Addr, uint32_t *pau32s, int c32s)
1241	{
1242	ohciPhysRead(pThis, Addr, pau32s, c32s * sizeof(uint32_t));
1243	#if BYTE_ORDER != LITTLE_ENDIAN
1244	for(int i = 0; i < c32s; i++)
1245	pau32s[i] = RT_H2LE_U32(pau32s[i]);
1246	#endif
1247	}
1248
1249	/**
1250	* Write an array of dwords from physical memory and correct endianness.
1251	*/
1252	DECLINLINE(void) ohciPutDWords(POHCI pThis, uint32_t Addr, const uint32_t *pau32s, int cu32s)
1253	{
1254	#if BYTE_ORDER == LITTLE_ENDIAN
1255	ohciPhysWrite(pThis, Addr, pau32s, cu32s << 2);
1256	#else
1257	for (int i = 0; i < c32s; i++, pau32s++, Addr += sizeof(*pau32s))
1258	{
1259	uint32_t u32Tmp = RT_H2LE_U32(*pau32s);
1260	ohciPhysWrite(pThis, Addr, (uint8_t *)&u32Tmp, sizeof(u32Tmp));
1261	}
1262	#endif
1263	}
1264
1265
1266	#ifdef IN_RING3
1267
1268	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1269	struct DescReadStats
1270	{
1271	uint32_t cReads;
1272	uint32_t cPageChange;
1273	uint32_t cMinReadsPerPage;
1274	uint32_t cMaxReadsPerPage;
1275
1276	uint32_t cReadsLastPage;
1277	uint32_t u32LastPageAddr;
1278	};
1279
1280	struct PhysReadStats
1281	{
1282	struct DescReadStats ed;
1283	struct DescReadStats td;
1284	struct DescReadStats all;
1285
1286	uint32_t cCrossReads;
1287	uint32_t cCacheReads;
1288	uint32_t cPageReads;
1289	};
1290
1291	static struct PhysReadStats physReadStats;
1292
1293	static void descReadStatsReset(struct DescReadStats *p)
1294	{
1295	p->cReads = 0;
1296	p->cPageChange = 0;
1297	p->cMinReadsPerPage = UINT32_MAX;
1298	p->cMaxReadsPerPage = 0;
1299
1300	p->cReadsLastPage = 0;
1301	p->u32LastPageAddr = 0;
1302	}
1303
1304	static void physReadStatsReset(struct PhysReadStats *p)
1305	{
1306	descReadStatsReset(&p->ed);
1307	descReadStatsReset(&p->td);
1308	descReadStatsReset(&p->all);
1309
1310	p->cCrossReads = 0;
1311	p->cCacheReads = 0;
1312	p->cPageReads = 0;
1313	}
1314
1315	static void physReadStatsUpdateDesc(struct DescReadStats *p, uint32_t u32Addr)
1316	{
1317	const uint32_t u32PageAddr = u32Addr & ~UINT32_C(0xFFF);
1318
1319	++p->cReads;
1320
1321	if (p->u32LastPageAddr == 0)
1322	{
1323	/* First call. */
1324	++p->cReadsLastPage;
1325	p->u32LastPageAddr = u32PageAddr;
1326	}
1327	else if (u32PageAddr != p->u32LastPageAddr)
1328	{
1329	/* New page. */
1330	++p->cPageChange;
1331
1332	p->cMinReadsPerPage = RT_MIN(p->cMinReadsPerPage, p->cReadsLastPage);
1333	p->cMaxReadsPerPage = RT_MAX(p->cMaxReadsPerPage, p->cReadsLastPage);;
1334
1335	p->cReadsLastPage = 1;
1336	p->u32LastPageAddr = u32PageAddr;
1337	}
1338	else
1339	{
1340	/* Read on the same page. */
1341	++p->cReadsLastPage;
1342	}
1343	}
1344
1345	static void physReadStatsPrint(struct PhysReadStats *p)
1346	{
1347	p->ed.cMinReadsPerPage = RT_MIN(p->ed.cMinReadsPerPage, p->ed.cReadsLastPage);
1348	p->ed.cMaxReadsPerPage = RT_MAX(p->ed.cMaxReadsPerPage, p->ed.cReadsLastPage);;
1349
1350	p->td.cMinReadsPerPage = RT_MIN(p->td.cMinReadsPerPage, p->td.cReadsLastPage);
1351	p->td.cMaxReadsPerPage = RT_MAX(p->td.cMaxReadsPerPage, p->td.cReadsLastPage);;
1352
1353	p->all.cMinReadsPerPage = RT_MIN(p->all.cMinReadsPerPage, p->all.cReadsLastPage);
1354	p->all.cMaxReadsPerPage = RT_MAX(p->all.cMaxReadsPerPage, p->all.cReadsLastPage);;
1355
1356	LogRel(("PHYSREAD:\n"
1357	" ED: %d, %d, %d/%d\n"
1358	" TD: %d, %d, %d/%d\n"
1359	" ALL: %d, %d, %d/%d\n"
1360	" C: %d, %d, %d\n"
1361	"",
1362	p->ed.cReads, p->ed.cPageChange, p->ed.cMinReadsPerPage, p->ed.cMaxReadsPerPage,
1363	p->td.cReads, p->td.cPageChange, p->td.cMinReadsPerPage, p->td.cMaxReadsPerPage,
1364	p->all.cReads, p->all.cPageChange, p->all.cMinReadsPerPage, p->all.cMaxReadsPerPage,
1365	p->cCrossReads, p->cCacheReads, p->cPageReads
1366	));
1367
1368	physReadStatsReset(p);
1369	}
1370	#endif /* VBOX_WITH_OHCI_PHYS_READ_STATS */
1371
1372	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
1373	static POHCIPAGECACHE ohciPhysReadCacheAlloc(void)
1374	{
1375	return (POHCIPAGECACHE)RTMemAlloc(sizeof(OHCIPAGECACHE));
1376	}
1377
1378	static void ohciPhysReadCacheFree(POHCIPAGECACHE pPageCache)
1379	{
1380	RTMemFree(pPageCache);
1381	}
1382
1383	static void ohciPhysReadCacheClear(POHCIPAGECACHE pPageCache)
1384	{
1385	pPageCache->GCPhysReadCacheAddr = NIL_RTGCPHYS;
1386	}
1387
1388	static void ohciPhysReadCacheRead(POHCI pThis, POHCIPAGECACHE pPageCache, RTGCPHYS GCPhys, void *pvBuf, size_t cbBuf)
1389	{
1390	const RTGCPHYS PageAddr = PAGE_ADDRESS(GCPhys);
1391
1392	if (PageAddr == PAGE_ADDRESS(GCPhys + cbBuf))
1393	{
1394	if (PageAddr != pPageCache->GCPhysReadCacheAddr)
1395	{
1396	PDMDevHlpPhysRead(pThis->pDevInsR3, PageAddr,
1397	pPageCache->au8PhysReadCache, sizeof(pPageCache->au8PhysReadCache));
1398	pPageCache->GCPhysReadCacheAddr = PageAddr;
1399	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1400	++physReadStats.cPageReads;
1401	#endif
1402	}
1403
1404	memcpy(pvBuf, &pPageCache->au8PhysReadCache[GCPhys & PAGE_OFFSET_MASK], cbBuf);
1405	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1406	++physReadStats.cCacheReads;
1407	#endif
1408	}
1409	else
1410	{
1411	PDMDevHlpPhysRead(pThis->pDevInsR3, GCPhys, pvBuf, cbBuf);
1412	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1413	++physReadStats.cCrossReads;
1414	#endif
1415	}
1416	}
1417
1418	static void ohciReadEdCached(POHCI pThis, uint32_t EdAddr, POHCIED pEd)
1419	{
1420	ohciPhysReadCacheRead(pThis, pThis->pCacheED, EdAddr, pEd, sizeof(*pEd));
1421	}
1422
1423	static void ohciReadTdCached(POHCI pThis, uint32_t TdAddr, POHCITD pTd)
1424	{
1425	ohciPhysReadCacheRead(pThis, pThis->pCacheTD, TdAddr, pTd, sizeof(*pTd));
1426	}
1427	#endif /* VBOX_WITH_OHCI_PHYS_READ_CACHE */
1428
1429	/**
1430	* Reads an OHCIED.
1431	*/
1432	DECLINLINE(void) ohciReadEd(POHCI pThis, uint32_t EdAddr, POHCIED pEd)
1433	{
1434	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1435	physReadStatsUpdateDesc(&physReadStats.ed, EdAddr);
1436	physReadStatsUpdateDesc(&physReadStats.all, EdAddr);
1437	#endif
1438	ohciGetDWords(pThis, EdAddr, (uint32_t )pEd, sizeof(pEd) >> 2);
1439	}
1440
1441	/**
1442	* Reads an OHCITD.
1443	*/
1444	DECLINLINE(void) ohciReadTd(POHCI pThis, uint32_t TdAddr, POHCITD pTd)
1445	{
1446	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
1447	physReadStatsUpdateDesc(&physReadStats.td, TdAddr);
1448	physReadStatsUpdateDesc(&physReadStats.all, TdAddr);
1449	#endif
1450	ohciGetDWords(pThis, TdAddr, (uint32_t )pTd, sizeof(pTd) >> 2);
1451	#ifdef LOG_ENABLED
1452	if (LogIs3Enabled())
1453	{
1454	uint32_t hichg;
1455	hichg = pTd->hwinfo;
1456	Log3(("ohciReadTd(,%#010x,): R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x UNK=%#x\n",
1457	TdAddr,
1458	(pTd->hwinfo >> 18) & 1,
1459	(pTd->hwinfo >> 19) & 3,
1460	(pTd->hwinfo >> 21) & 7,
1461	(pTd->hwinfo >> 24) & 3,
1462	(pTd->hwinfo >> 26) & 3,
1463	(pTd->hwinfo >> 28) &15,
1464	pTd->cbp,
1465	pTd->NextTD,
1466	pTd->be,
1467	pTd->hwinfo & TD_HWINFO_UNKNOWN_MASK));
1468	#if 0
1469	if (LogIs3Enabled())
1470	{
1471	/*
1472	* usbohci.sys (32-bit XP) allocates 0x80 bytes per TD:
1473	* 0x00-0x0f is the OHCI TD.
1474	* 0x10-0x1f for isochronous TDs
1475	* 0x20 is the physical address of this TD.
1476	* 0x24 is initialized with 0x64745948, probably a magic.
1477	* 0x28 is some kind of flags. the first bit begin the allocated / not allocated indicator.
1478	* 0x30 is a pointer to something. endpoint? interface? device?
1479	* 0x38 is initialized to 0xdeadface. but is changed into a pointer or something.
1480	* 0x40 looks like a pointer.
1481	* The rest is unknown and initialized with zeros.
1482	*/
1483	uint8_t abXpTd[0x80];
1484	ohciPhysRead(pThis, TdAddr, abXpTd, sizeof(abXpTd));
1485	Log3(("WinXpTd: alloc=%d PhysSelf=%RX32 s2=%RX32 magic=%RX32 s4=%RX32 s5=%RX32\n"
1486	"%.*Rhxd\n",
1487	abXpTd[28] & RT_BIT(0),
1488	((uint32_t )&abXpTd[0x20]), ((uint32_t )&abXpTd[0x30]),
1489	((uint32_t )&abXpTd[0x24]), ((uint32_t )&abXpTd[0x38]),
1490	((uint32_t )&abXpTd[0x40]),
1491	sizeof(abXpTd), &abXpTd[0]));
1492	}
1493	#endif
1494	}
1495	#endif
1496	}
1497
1498	/**
1499	* Reads an OHCIITD.
1500	*/
1501	DECLINLINE(void) ohciReadITd(POHCI pThis, uint32_t ITdAddr, POHCIITD pITd)
1502	{
1503	ohciGetDWords(pThis, ITdAddr, (uint32_t )pITd, sizeof(pITd) / sizeof(uint32_t));
1504	#ifdef LOG_ENABLED
1505	if (LogIs3Enabled())
1506	{
1507	Log3(("ohciReadITd(,%#010x,): SF=%#06x (%#RX32) DI=%#x FC=%d CC=%#x BP0=%#010x NextTD=%#010x BE=%#010x\n",
1508	ITdAddr,
1509	pITd->HwInfo & 0xffff, pThis->HcFmNumber,
1510	(pITd->HwInfo >> 21) & 7,
1511	(pITd->HwInfo >> 24) & 7,
1512	(pITd->HwInfo >> 28) &15,
1513	pITd->BP0,
1514	pITd->NextTD,
1515	pITd->BE));
1516	Log3(("psw0=%x:%03x psw1=%x:%03x psw2=%x:%03x psw3=%x:%03x psw4=%x:%03x psw5=%x:%03x psw6=%x:%03x psw7=%x:%03x\n",
1517	pITd->aPSW[0] >> 12, pITd->aPSW[0] & 0xfff,
1518	pITd->aPSW[1] >> 12, pITd->aPSW[1] & 0xfff,
1519	pITd->aPSW[2] >> 12, pITd->aPSW[2] & 0xfff,
1520	pITd->aPSW[3] >> 12, pITd->aPSW[3] & 0xfff,
1521	pITd->aPSW[4] >> 12, pITd->aPSW[4] & 0xfff,
1522	pITd->aPSW[5] >> 12, pITd->aPSW[5] & 0xfff,
1523	pITd->aPSW[6] >> 12, pITd->aPSW[6] & 0xfff,
1524	pITd->aPSW[7] >> 12, pITd->aPSW[7] & 0xfff));
1525	}
1526	#endif
1527	}
1528
1529
1530	/**
1531	* Writes an OHCIED.
1532	*/
1533	DECLINLINE(void) ohciWriteEd(POHCI pThis, uint32_t EdAddr, PCOHCIED pEd)
1534	{
1535	#ifdef LOG_ENABLED
1536	if (LogIs3Enabled())
1537	{
1538	OHCIED EdOld;
1539	uint32_t hichg;
1540
1541	ohciGetDWords(pThis, EdAddr, (uint32_t *)&EdOld, sizeof(EdOld) >> 2);
1542	hichg = EdOld.hwinfo ^ pEd->hwinfo;
1543	Log3(("ohciWriteEd(,%#010x,): %sFA=%#x %sEN=%#x %sD=%#x %sS=%d %sK=%d %sF=%d %sMPS=%#x %sTailP=%#010x %sHeadP=%#010x %sH=%d %sC=%d %sNextED=%#010x\n",
1544	EdAddr,
1545	(hichg >> 0) & 0x7f ? "*" : "", (pEd->hwinfo >> 0) & 0x7f,
1546	(hichg >> 7) & 0xf ? "*" : "", (pEd->hwinfo >> 7) & 0xf,
1547	(hichg >> 11) & 3 ? "*" : "", (pEd->hwinfo >> 11) & 3,
1548	(hichg >> 13) & 1 ? "*" : "", (pEd->hwinfo >> 13) & 1,
1549	(hichg >> 14) & 1 ? "*" : "", (pEd->hwinfo >> 14) & 1,
1550	(hichg >> 15) & 1 ? "*" : "", (pEd->hwinfo >> 15) & 1,
1551	(hichg >> 24) &0x3ff ? "*" : "", (pEd->hwinfo >> 16) &0x3ff,
1552	EdOld.TailP != pEd->TailP ? "*" : "", pEd->TailP,
1553	(EdOld.HeadP & ~3) != (pEd->HeadP & ~3) ? "*" : "", pEd->HeadP & ~3,
1554	(EdOld.HeadP ^ pEd->HeadP) & 1 ? "*" : "", pEd->HeadP & 1,
1555	(EdOld.HeadP ^ pEd->HeadP) & 2 ? "*" : "", (pEd->HeadP >> 1) & 1,
1556	EdOld.NextED != pEd->NextED ? "*" : "", pEd->NextED));
1557	}
1558	#endif
1559
1560	ohciPutDWords(pThis, EdAddr, (uint32_t )pEd, sizeof(pEd) >> 2);
1561	}
1562
1563
1564	/**
1565	* Writes an OHCITD.
1566	*/
1567	DECLINLINE(void) ohciWriteTd(POHCI pThis, uint32_t TdAddr, PCOHCITD pTd, const char *pszLogMsg)
1568	{
1569	#ifdef LOG_ENABLED
1570	if (LogIs3Enabled())
1571	{
1572	OHCITD TdOld;
1573	ohciGetDWords(pThis, TdAddr, (uint32_t *)&TdOld, sizeof(TdOld) >> 2);
1574	uint32_t hichg = TdOld.hwinfo ^ pTd->hwinfo;
1575	Log3(("ohciWriteTd(,%#010x,): %sR=%d %sDP=%d %sDI=%#x %sT=%d %sEC=%d %sCC=%#x %sCBP=%#010x %sNextTD=%#010x %sBE=%#010x (%s)\n",
1576	TdAddr,
1577	(hichg >> 18) & 1 ? "*" : "", (pTd->hwinfo >> 18) & 1,
1578	(hichg >> 19) & 3 ? "*" : "", (pTd->hwinfo >> 19) & 3,
1579	(hichg >> 21) & 7 ? "*" : "", (pTd->hwinfo >> 21) & 7,
1580	(hichg >> 24) & 3 ? "*" : "", (pTd->hwinfo >> 24) & 3,
1581	(hichg >> 26) & 3 ? "*" : "", (pTd->hwinfo >> 26) & 3,
1582	(hichg >> 28) &15 ? "*" : "", (pTd->hwinfo >> 28) &15,
1583	TdOld.cbp != pTd->cbp ? "*" : "", pTd->cbp,
1584	TdOld.NextTD != pTd->NextTD ? "*" : "", pTd->NextTD,
1585	TdOld.be != pTd->be ? "*" : "", pTd->be,
1586	pszLogMsg));
1587	}
1588	#endif
1589	ohciPutDWords(pThis, TdAddr, (uint32_t )pTd, sizeof(pTd) >> 2);
1590	}
1591
1592	/**
1593	* Writes an OHCIITD.
1594	*/
1595	DECLINLINE(void) ohciWriteITd(POHCI pThis, uint32_t ITdAddr, PCOHCIITD pITd, const char *pszLogMsg)
1596	{
1597	#ifdef LOG_ENABLED
1598	if (LogIs3Enabled())
1599	{
1600	OHCIITD ITdOld;
1601	ohciGetDWords(pThis, ITdAddr, (uint32_t *)&ITdOld, sizeof(ITdOld) / sizeof(uint32_t));
1602	uint32_t HIChg = ITdOld.HwInfo ^ pITd->HwInfo;
1603	Log3(("ohciWriteITd(,%#010x,): %sSF=%#x (now=%#RX32) %sDI=%#x %sFC=%d %sCC=%#x %sBP0=%#010x %sNextTD=%#010x %sBE=%#010x (%s)\n",
1604	ITdAddr,
1605	(HIChg & 0xffff) & 1 ? "*" : "", pITd->HwInfo & 0xffff, pThis->HcFmNumber,
1606	(HIChg >> 21) & 7 ? "*" : "", (pITd->HwInfo >> 21) & 7,
1607	(HIChg >> 24) & 7 ? "*" : "", (pITd->HwInfo >> 24) & 7,
1608	(HIChg >> 28) &15 ? "*" : "", (pITd->HwInfo >> 28) &15,
1609	ITdOld.BP0 != pITd->BP0 ? "*" : "", pITd->BP0,
1610	ITdOld.NextTD != pITd->NextTD ? "*" : "", pITd->NextTD,
1611	ITdOld.BE != pITd->BE ? "*" : "", pITd->BE,
1612	pszLogMsg));
1613	Log3(("psw0=%s%x:%s%03x psw1=%s%x:%s%03x psw2=%s%x:%s%03x psw3=%s%x:%s%03x psw4=%s%x:%s%03x psw5=%s%x:%s%03x psw6=%s%x:%s%03x psw7=%s%x:%s%03x\n",
1614	(ITdOld.aPSW[0] >> 12) != (pITd->aPSW[0] >> 12) ? "" : "", pITd->aPSW[0] >> 12, (ITdOld.aPSW[0] & 0xfff) != (pITd->aPSW[0] & 0xfff) ? "" : "", pITd->aPSW[0] & 0xfff,
1615	(ITdOld.aPSW[1] >> 12) != (pITd->aPSW[1] >> 12) ? "" : "", pITd->aPSW[1] >> 12, (ITdOld.aPSW[1] & 0xfff) != (pITd->aPSW[1] & 0xfff) ? "" : "", pITd->aPSW[1] & 0xfff,
1616	(ITdOld.aPSW[2] >> 12) != (pITd->aPSW[2] >> 12) ? "" : "", pITd->aPSW[2] >> 12, (ITdOld.aPSW[2] & 0xfff) != (pITd->aPSW[2] & 0xfff) ? "" : "", pITd->aPSW[2] & 0xfff,
1617	(ITdOld.aPSW[3] >> 12) != (pITd->aPSW[3] >> 12) ? "" : "", pITd->aPSW[3] >> 12, (ITdOld.aPSW[3] & 0xfff) != (pITd->aPSW[3] & 0xfff) ? "" : "", pITd->aPSW[3] & 0xfff,
1618	(ITdOld.aPSW[4] >> 12) != (pITd->aPSW[4] >> 12) ? "" : "", pITd->aPSW[4] >> 12, (ITdOld.aPSW[4] & 0xfff) != (pITd->aPSW[4] & 0xfff) ? "" : "", pITd->aPSW[4] & 0xfff,
1619	(ITdOld.aPSW[5] >> 12) != (pITd->aPSW[5] >> 12) ? "" : "", pITd->aPSW[5] >> 12, (ITdOld.aPSW[5] & 0xfff) != (pITd->aPSW[5] & 0xfff) ? "" : "", pITd->aPSW[5] & 0xfff,
1620	(ITdOld.aPSW[6] >> 12) != (pITd->aPSW[6] >> 12) ? "" : "", pITd->aPSW[6] >> 12, (ITdOld.aPSW[6] & 0xfff) != (pITd->aPSW[6] & 0xfff) ? "" : "", pITd->aPSW[6] & 0xfff,
1621	(ITdOld.aPSW[7] >> 12) != (pITd->aPSW[7] >> 12) ? "" : "", pITd->aPSW[7] >> 12, (ITdOld.aPSW[7] & 0xfff) != (pITd->aPSW[7] & 0xfff) ? "" : "", pITd->aPSW[7] & 0xfff));
1622	}
1623	#endif
1624	ohciPutDWords(pThis, ITdAddr, (uint32_t )pITd, sizeof(pITd) / sizeof(uint32_t));
1625	}
1626
1627
1628	#ifdef LOG_ENABLED
1629
1630	/**
1631	* Core TD queue dumper. LOG_ENABLED builds only.
1632	*/
1633	DECLINLINE(void) ohciDumpTdQueueCore(POHCI pThis, uint32_t GCPhysHead, uint32_t GCPhysTail, bool fFull)
1634	{
1635	uint32_t GCPhys = GCPhysHead;
1636	int cMax = 100;
1637	for (;;)
1638	{
1639	OHCITD Td;
1640	Log4(("%#010x%s%s", GCPhys,
1641	GCPhys && ohci_in_flight_find(pThis, GCPhys) >= 0 ? "~" : "",
1642	GCPhys && ohci_in_done_queue_find(pThis, GCPhys) >= 0 ? "^" : ""));
1643	if (GCPhys == 0 \|\| GCPhys == GCPhysTail)
1644	break;
1645
1646	/* can't use ohciReadTd() because of Log4. */
1647	ohciGetDWords(pThis, GCPhys, (uint32_t *)&Td, sizeof(Td) >> 2);
1648	if (fFull)
1649	Log4((" [R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x] -> ",
1650	(Td.hwinfo >> 18) & 1,
1651	(Td.hwinfo >> 19) & 3,
1652	(Td.hwinfo >> 21) & 7,
1653	(Td.hwinfo >> 24) & 3,
1654	(Td.hwinfo >> 26) & 3,
1655	(Td.hwinfo >> 28) &15,
1656	Td.cbp,
1657	Td.NextTD,
1658	Td.be));
1659	else
1660	Log4((" -> "));
1661	GCPhys = Td.NextTD & ED_PTR_MASK;
1662	Assert(GCPhys != GCPhysHead);
1663	Assert(cMax-- > 0); NOREF(cMax);
1664	}
1665	}
1666
1667	/**
1668	* Dumps a TD queue. LOG_ENABLED builds only.
1669	*/
1670	DECLINLINE(void) ohciDumpTdQueue(POHCI pThis, uint32_t GCPhysHead, const char *pszMsg)
1671	{
1672	if (pszMsg)
1673	Log4(("%s: ", pszMsg));
1674	ohciDumpTdQueueCore(pThis, GCPhysHead, 0, true);
1675	Log4(("\n"));
1676	}
1677
1678	/**
1679	* Core ITD queue dumper. LOG_ENABLED builds only.
1680	*/
1681	DECLINLINE(void) ohciDumpITdQueueCore(POHCI pThis, uint32_t GCPhysHead, uint32_t GCPhysTail, bool fFull)
1682	{
1683	uint32_t GCPhys = GCPhysHead;
1684	int cMax = 100;
1685	for (;;)
1686	{
1687	OHCIITD ITd;
1688	Log4(("%#010x%s%s", GCPhys,
1689	GCPhys && ohci_in_flight_find(pThis, GCPhys) >= 0 ? "~" : "",
1690	GCPhys && ohci_in_done_queue_find(pThis, GCPhys) >= 0 ? "^" : ""));
1691	if (GCPhys == 0 \|\| GCPhys == GCPhysTail)
1692	break;
1693
1694	/* can't use ohciReadTd() because of Log4. */
1695	ohciGetDWords(pThis, GCPhys, (uint32_t *)&ITd, sizeof(ITd) / sizeof(uint32_t));
1696	/*if (fFull)
1697	Log4((" [R=%d DP=%d DI=%d T=%d EC=%d CC=%#x CBP=%#010x NextTD=%#010x BE=%#010x] -> ",
1698	(Td.hwinfo >> 18) & 1,
1699	(Td.hwinfo >> 19) & 3,
1700	(Td.hwinfo >> 21) & 7,
1701	(Td.hwinfo >> 24) & 3,
1702	(Td.hwinfo >> 26) & 3,
1703	(Td.hwinfo >> 28) &15,
1704	Td.cbp,
1705	Td.NextTD,
1706	Td.be));
1707	else*/
1708	Log4((" -> "));
1709	GCPhys = ITd.NextTD & ED_PTR_MASK;
1710	Assert(GCPhys != GCPhysHead);
1711	Assert(cMax-- > 0); NOREF(cMax);
1712	}
1713	}
1714
1715	/**
1716	* Dumps a ED list. LOG_ENABLED builds only.
1717	*/
1718	DECLINLINE(void) ohciDumpEdList(POHCI pThis, uint32_t GCPhysHead, const char *pszMsg, bool fTDs)
1719	{
1720	uint32_t GCPhys = GCPhysHead;
1721	if (pszMsg)
1722	Log4(("%s:", pszMsg));
1723	for (;;)
1724	{
1725	OHCIED Ed;
1726
1727	/* ED */
1728	Log4((" %#010x={", GCPhys));
1729	if (!GCPhys)
1730	{
1731	Log4(("END}\n"));
1732	return;
1733	}
1734
1735	/* TDs */
1736	ohciReadEd(pThis, GCPhys, &Ed);
1737	if (Ed.hwinfo & ED_HWINFO_ISO)
1738	Log4(("[I]"));
1739	if ((Ed.HeadP & ED_HEAD_HALTED) \|\| (Ed.hwinfo & ED_HWINFO_SKIP))
1740	{
1741	if ((Ed.HeadP & ED_HEAD_HALTED) && (Ed.hwinfo & ED_HWINFO_SKIP))
1742	Log4(("SH}"));
1743	else if (Ed.hwinfo & ED_HWINFO_SKIP)
1744	Log4(("S-}"));
1745	else
1746	Log4(("-H}"));
1747	}
1748	else
1749	{
1750	if (Ed.hwinfo & ED_HWINFO_ISO)
1751	ohciDumpITdQueueCore(pThis, Ed.HeadP & ED_PTR_MASK, Ed.TailP & ED_PTR_MASK, false);
1752	else
1753	ohciDumpTdQueueCore(pThis, Ed.HeadP & ED_PTR_MASK, Ed.TailP & ED_PTR_MASK, false);
1754	Log4(("}"));
1755	}
1756
1757	/* next */
1758	GCPhys = Ed.NextED & ED_PTR_MASK;
1759	Assert(GCPhys != GCPhysHead);
1760	}
1761	Log4(("\n"));
1762	}
1763
1764	#endif /* LOG_ENABLED */
1765
1766
1767	DECLINLINE(int) ohci_in_flight_find_free(POHCI pThis, const int iStart)
1768	{
1769	unsigned i = iStart;
1770	while (i < RT_ELEMENTS(pThis->aInFlight))
1771	{
1772	if (pThis->aInFlight[i].GCPhysTD == 0)
1773	return i;
1774	i++;
1775	}
1776	i = iStart;
1777	while (i-- > 0)
1778	{
1779	if (pThis->aInFlight[i].GCPhysTD == 0)
1780	return i;
1781	}
1782	return -1;
1783	}
1784
1785
1786	/**
1787	* Record an in-flight TD.
1788	*
1789	* @param pThis OHCI instance data.
1790	* @param GCPhysTD Physical address of the TD.
1791	* @param pUrb The URB.
1792	*/
1793	static void ohci_in_flight_add(POHCI pThis, uint32_t GCPhysTD, PVUSBURB pUrb)
1794	{
1795	int i = ohci_in_flight_find_free(pThis, (GCPhysTD >> 4) % RT_ELEMENTS(pThis->aInFlight));
1796	if (i >= 0)
1797	{
1798	#ifdef LOG_ENABLED
1799	pUrb->pHci->u32FrameNo = pThis->HcFmNumber;
1800	#endif
1801	pThis->aInFlight[i].GCPhysTD = GCPhysTD;
1802	pThis->aInFlight[i].pUrb = pUrb;
1803	pThis->cInFlight++;
1804	return;
1805	}
1806	AssertMsgFailed(("Out of space cInFlight=%d!\n", pThis->cInFlight));
1807	}
1808
1809
1810	/**
1811	* Record in-flight TDs for an URB.
1812	*
1813	* @param pThis OHCI instance data.
1814	* @param pUrb The URB.
1815	*/
1816	static void ohci_in_flight_add_urb(POHCI pThis, PVUSBURB pUrb)
1817	{
1818	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
1819	ohci_in_flight_add(pThis, pUrb->paTds[iTd].TdAddr, pUrb);
1820	}
1821
1822
1823	/**
1824	* Finds a in-flight TD.
1825	*
1826	* @returns Index of the record.
1827	* @returns -1 if not found.
1828	* @param pThis OHCI instance data.
1829	* @param GCPhysTD Physical address of the TD.
1830	* @remark This has to be fast.
1831	*/
1832	static int ohci_in_flight_find(POHCI pThis, uint32_t GCPhysTD)
1833	{
1834	unsigned cLeft = pThis->cInFlight;
1835	unsigned i = (GCPhysTD >> 4) % RT_ELEMENTS(pThis->aInFlight);
1836	const int iLast = i;
1837	while (i < RT_ELEMENTS(pThis->aInFlight))
1838	{
1839	if (pThis->aInFlight[i].GCPhysTD == GCPhysTD)
1840	return i;
1841	if (pThis->aInFlight[i].GCPhysTD)
1842	if (cLeft-- <= 1)
1843	return -1;
1844	i++;
1845	}
1846	i = iLast;
1847	while (i-- > 0)
1848	{
1849	if (pThis->aInFlight[i].GCPhysTD == GCPhysTD)
1850	return i;
1851	if (pThis->aInFlight[i].GCPhysTD)
1852	if (cLeft-- <= 1)
1853	return -1;
1854	}
1855	return -1;
1856	}
1857
1858
1859	/**
1860	* Checks if a TD is in-flight.
1861	*
1862	* @returns true if in flight, false if not.
1863	* @param pThis OHCI instance data.
1864	* @param GCPhysTD Physical address of the TD.
1865	*/
1866	static bool ohciIsTdInFlight(POHCI pThis, uint32_t GCPhysTD)
1867	{
1868	return ohci_in_flight_find(pThis, GCPhysTD) >= 0;
1869	}
1870
1871	/**
1872	* Returns a URB associated with an in-flight TD, if any.
1873	*
1874	* @returns pointer to URB if TD is in flight.
1875	* @returns NULL if not in flight.
1876	* @param pThis OHCI instance data.
1877	* @param GCPhysTD Physical address of the TD.
1878	*/
1879	static PVUSBURB ohciTdInFlightUrb(POHCI pThis, uint32_t GCPhysTD)
1880	{
1881	int i;
1882
1883	i = ohci_in_flight_find(pThis, GCPhysTD);
1884	if ( i >= 0 )
1885	return pThis->aInFlight[i].pUrb;
1886	return NULL;
1887	}
1888
1889	/**
1890	* Removes a in-flight TD.
1891	*
1892	* @returns 0 if found. For logged builds this is the number of frames the TD has been in-flight.
1893	* @returns -1 if not found.
1894	* @param pThis OHCI instance data.
1895	* @param GCPhysTD Physical address of the TD.
1896	*/
1897	static int ohci_in_flight_remove(POHCI pThis, uint32_t GCPhysTD)
1898	{
1899	int i = ohci_in_flight_find(pThis, GCPhysTD);
1900	if (i >= 0)
1901	{
1902	#ifdef LOG_ENABLED
1903	const int cFramesInFlight = pThis->HcFmNumber - pThis->aInFlight[i].pUrb->pHci->u32FrameNo;
1904	#else
1905	const int cFramesInFlight = 0;
1906	#endif
1907	Log2(("ohci_in_flight_remove: reaping TD=%#010x %d frames (%#010x-%#010x)\n",
1908	GCPhysTD, cFramesInFlight, pThis->aInFlight[i].pUrb->pHci->u32FrameNo, pThis->HcFmNumber));
1909	pThis->aInFlight[i].GCPhysTD = 0;
1910	pThis->aInFlight[i].pUrb = NULL;
1911	pThis->cInFlight--;
1912	return cFramesInFlight;
1913	}
1914	AssertMsgFailed(("TD %#010x is not in flight\n", GCPhysTD));
1915	return -1;
1916	}
1917
1918
1919	/**
1920	* Removes all TDs associated with a URB from the in-flight tracking.
1921	*
1922	* @returns 0 if found. For logged builds this is the number of frames the TD has been in-flight.
1923	* @returns -1 if not found.
1924	* @param pThis OHCI instance data.
1925	* @param pUrb The URB.
1926	*/
1927	static int ohci_in_flight_remove_urb(POHCI pThis, PVUSBURB pUrb)
1928	{
1929	int cFramesInFlight = ohci_in_flight_remove(pThis, pUrb->paTds[0].TdAddr);
1930	if (pUrb->pHci->cTds > 1)
1931	{
1932	for (unsigned iTd = 1; iTd < pUrb->pHci->cTds; iTd++)
1933	if (ohci_in_flight_remove(pThis, pUrb->paTds[iTd].TdAddr) < 0)
1934	cFramesInFlight = -1;
1935	}
1936	return cFramesInFlight;
1937	}
1938
1939
1940	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
1941
1942	/**
1943	* Empties the in-done-queue.
1944	* @param pThis OHCI instance data.
1945	*/
1946	static void ohci_in_done_queue_zap(POHCI pThis)
1947	{
1948	pThis->cInDoneQueue = 0;
1949	}
1950
1951	/**
1952	* Finds a TD in the in-done-queue.
1953	* @returns >= 0 on success.
1954	* @returns -1 if not found.
1955	* @param pThis OHCI instance data.
1956	* @param GCPhysTD Physical address of the TD.
1957	*/
1958	static int ohci_in_done_queue_find(POHCI pThis, uint32_t GCPhysTD)
1959	{
1960	unsigned i = pThis->cInDoneQueue;
1961	while (i-- > 0)
1962	if (pThis->aInDoneQueue[i].GCPhysTD == GCPhysTD)
1963	return i;
1964	return -1;
1965	}
1966
1967	/**
1968	* Checks that the specified TD is not in the done queue.
1969	* @param pThis OHCI instance data.
1970	* @param GCPhysTD Physical address of the TD.
1971	*/
1972	static bool ohci_in_done_queue_check(POHCI pThis, uint32_t GCPhysTD)
1973	{
1974	int i = ohci_in_done_queue_find(pThis, GCPhysTD);
1975	#if 0
1976	/* This condition has been observed with the USB tablet emulation or with
1977	* a real USB mouse and an SMP XP guest. I am also not sure if this is
1978	* really a problem for us. The assertion checks that the guest doesn't
1979	* re-submit a TD which is still in the done queue. It seems to me that
1980	* this should only be a problem if we either keep track of TDs in the done
1981	* queue somewhere else as well (in which case we should also free those
1982	* references in time, and I can't see any code doing that) or if we
1983	* manipulate TDs in the done queue in some way that might fail if they are
1984	* re-submitted (can't see anything like that either).
1985	*/
1986	AssertMsg(i < 0, ("TD %#010x (i=%d)\n", GCPhysTD, i));
1987	#endif
1988	return i < 0;
1989	}
1990
1991
1992	# ifdef VBOX_STRICT
1993	/**
1994	* Adds a TD to the in-done-queue tracking, checking that it's not there already.
1995	* @param pThis OHCI instance data.
1996	* @param GCPhysTD Physical address of the TD.
1997	*/
1998	static void ohci_in_done_queue_add(POHCI pThis, uint32_t GCPhysTD)
1999	{
2000	Assert(pThis->cInDoneQueue + 1 <= RT_ELEMENTS(pThis->aInDoneQueue));
2001	if (ohci_in_done_queue_check(pThis, GCPhysTD))
2002	pThis->aInDoneQueue[pThis->cInDoneQueue++].GCPhysTD = GCPhysTD;
2003	}
2004	# endif /* VBOX_STRICT */
2005	#endif /* defined(VBOX_STRICT) \|\| defined(LOG_ENABLED) */
2006
2007
2008	/**
2009	* OHCI Transport Buffer - represents a OHCI Transport Descriptor (TD).
2010	* A TD may be split over max 2 pages.
2011	*/
2012	typedef struct OHCIBUF
2013	{
2014	/** Pages involved. */
2015	struct OHCIBUFVEC
2016	{
2017	/** The 32-bit physical address of this part. */
2018	uint32_t Addr;
2019	/** The length. */
2020	uint32_t cb;
2021	} aVecs[2];
2022	/** Number of valid entries in aVecs. */
2023	uint32_t cVecs;
2024	/** The total length. */
2025	uint32_t cbTotal;
2026	} OHCIBUF, *POHCIBUF;
2027
2028
2029	/**
2030	* Sets up a OHCI transport buffer.
2031	*
2032	* @param pBuf Ohci buffer.
2033	* @param cbp Current buffer pointer. 32-bit physical address.
2034	* @param be Last byte in buffer (BufferEnd). 32-bit physical address.
2035	*/
2036	static void ohciBufInit(POHCIBUF pBuf, uint32_t cbp, uint32_t be)
2037	{
2038	if (!cbp \|\| !be)
2039	{
2040	pBuf->cVecs = 0;
2041	pBuf->cbTotal = 0;
2042	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=0 EMPTY\n", cbp, be));
2043	}
2044	else if ((cbp & ~0xfff) == (be & ~0xfff))
2045	{
2046	pBuf->aVecs[0].Addr = cbp;
2047	pBuf->aVecs[0].cb = (be - cbp) + 1;
2048	pBuf->cVecs = 1;
2049	pBuf->cbTotal = pBuf->aVecs[0].cb;
2050	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=%u\n", cbp, be, pBuf->cbTotal));
2051	}
2052	else
2053	{
2054	pBuf->aVecs[0].Addr = cbp;
2055	pBuf->aVecs[0].cb = 0x1000 - (cbp & 0xfff);
2056	pBuf->aVecs[1].Addr = be & ~0xfff;
2057	pBuf->aVecs[1].cb = (be & 0xfff) + 1;
2058	pBuf->cVecs = 2;
2059	pBuf->cbTotal = pBuf->aVecs[0].cb + pBuf->aVecs[1].cb;
2060	Log2(("ohci: cbp=%#010x be=%#010x cbTotal=%u PAGE FLIP\n", cbp, be, pBuf->cbTotal));
2061	}
2062	}
2063
2064	/**
2065	* Updates a OHCI transport buffer.
2066	*
2067	* This is called upon completion to adjust the sector lengths if
2068	* the total length has changed. (received less then we had space for
2069	* or a partial transfer.)
2070	*
2071	* @param pBuf The buffer to update. cbTotal contains the new total on input.
2072	* While the aVecs[*].cb members is updated upon return.
2073	*/
2074	static void ohciBufUpdate(POHCIBUF pBuf)
2075	{
2076	for (uint32_t i = 0, cbCur = 0; i < pBuf->cVecs; i++)
2077	{
2078	if (cbCur + pBuf->aVecs[i].cb > pBuf->cbTotal)
2079	{
2080	pBuf->aVecs[i].cb = pBuf->cbTotal - cbCur;
2081	pBuf->cVecs = i + 1;
2082	return;
2083	}
2084	cbCur += pBuf->aVecs[i].cb;
2085	}
2086	}
2087
2088
2089	/** A worker for ohciUnlinkTds(). */
2090	static bool ohciUnlinkIsochronousTdInList(POHCI pThis, uint32_t TdAddr, POHCIITD pITd, POHCIED pEd)
2091	{
2092	const uint32_t LastTdAddr = pEd->TailP & ED_PTR_MASK;
2093	Log(("ohciUnlinkIsocTdInList: Unlinking non-head ITD! TdAddr=%#010RX32 HeadTdAddr=%#010RX32 LastEdAddr=%#010RX32\n",
2094	TdAddr, pEd->HeadP & ED_PTR_MASK, LastTdAddr));
2095	AssertMsgReturn(LastTdAddr != TdAddr, ("TdAddr=%#010RX32\n", TdAddr), false);
2096
2097	uint32_t cMax = 256;
2098	uint32_t CurTdAddr = pEd->HeadP & ED_PTR_MASK;
2099	while ( CurTdAddr != LastTdAddr
2100	&& cMax-- > 0)
2101	{
2102	OHCIITD ITd;
2103	ohciReadITd(pThis, CurTdAddr, &ITd);
2104	if ((ITd.NextTD & ED_PTR_MASK) == TdAddr)
2105	{
2106	ITd.NextTD = (pITd->NextTD & ED_PTR_MASK) \| (ITd.NextTD & ~ED_PTR_MASK);
2107	ohciWriteITd(pThis, CurTdAddr, &ITd, "ohciUnlinkIsocTdInList");
2108	pITd->NextTD &= ~ED_PTR_MASK;
2109	return true;
2110	}
2111
2112	/* next */
2113	CurTdAddr = ITd.NextTD & ED_PTR_MASK;
2114	}
2115
2116	Log(("ohciUnlinkIsocTdInList: TdAddr=%#010RX32 wasn't found in the list!!! (cMax=%d)\n", TdAddr, cMax));
2117	return false;
2118	}
2119
2120
2121	/** A worker for ohciUnlinkTds(). */
2122	static bool ohciUnlinkGeneralTdInList(POHCI pThis, uint32_t TdAddr, POHCITD pTd, POHCIED pEd)
2123	{
2124	const uint32_t LastTdAddr = pEd->TailP & ED_PTR_MASK;
2125	Log(("ohciUnlinkGeneralTdInList: Unlinking non-head TD! TdAddr=%#010RX32 HeadTdAddr=%#010RX32 LastEdAddr=%#010RX32\n",
2126	TdAddr, pEd->HeadP & ED_PTR_MASK, LastTdAddr));
2127	AssertMsgReturn(LastTdAddr != TdAddr, ("TdAddr=%#010RX32\n", TdAddr), false);
2128
2129	uint32_t cMax = 256;
2130	uint32_t CurTdAddr = pEd->HeadP & ED_PTR_MASK;
2131	while ( CurTdAddr != LastTdAddr
2132	&& cMax-- > 0)
2133	{
2134	OHCITD Td;
2135	ohciReadTd(pThis, CurTdAddr, &Td);
2136	if ((Td.NextTD & ED_PTR_MASK) == TdAddr)
2137	{
2138	Td.NextTD = (pTd->NextTD & ED_PTR_MASK) \| (Td.NextTD & ~ED_PTR_MASK);
2139	ohciWriteTd(pThis, CurTdAddr, &Td, "ohciUnlinkGeneralTdInList");
2140	pTd->NextTD &= ~ED_PTR_MASK;
2141	return true;
2142	}
2143
2144	/* next */
2145	CurTdAddr = Td.NextTD & ED_PTR_MASK;
2146	}
2147
2148	Log(("ohciUnlinkGeneralTdInList: TdAddr=%#010RX32 wasn't found in the list!!! (cMax=%d)\n", TdAddr, cMax));
2149	return false;
2150	}
2151
2152
2153	/**
2154	* Unlinks the TDs that makes up the URB from the ED.
2155	*
2156	* @returns success indicator. true if successfully unlinked.
2157	* @returns false if the TD was not found in the list.
2158	*/
2159	static bool ohciUnlinkTds(POHCI pThis, PVUSBURB pUrb, POHCIED pEd)
2160	{
2161	/*
2162	* Don't unlink more than once.
2163	*/
2164	if (pUrb->pHci->fUnlinked)
2165	return true;
2166	pUrb->pHci->fUnlinked = true;
2167
2168	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2169	{
2170	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2171	{
2172	POHCIITD pITd = (POHCIITD)&pUrb->paTds[iTd].TdCopy[0];
2173	const uint32_t ITdAddr = pUrb->paTds[iTd].TdAddr;
2174
2175	/*
2176	* Unlink the TD from the ED list.
2177	* The normal case is that it's at the head of the list.
2178	*/
2179	Assert((ITdAddr & ED_PTR_MASK) == ITdAddr);
2180	if ((pEd->HeadP & ED_PTR_MASK) == ITdAddr)
2181	{
2182	pEd->HeadP = (pITd->NextTD & ED_PTR_MASK) \| (pEd->HeadP & ~ED_PTR_MASK);
2183	pITd->NextTD &= ~ED_PTR_MASK;
2184	}
2185	else
2186	{
2187	/*
2188	* It's probably somewhere in the list, not a unlikely situation with
2189	* the current isochronous code.
2190	*/
2191	if (!ohciUnlinkIsochronousTdInList(pThis, ITdAddr, pITd, pEd))
2192	return false;
2193	}
2194	}
2195	}
2196	else
2197	{
2198	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2199	{
2200	POHCITD pTd = (POHCITD)&pUrb->paTds[iTd].TdCopy[0];
2201	const uint32_t TdAddr = pUrb->paTds[iTd].TdAddr;
2202
2203	/** @todo r=bird: Messing with the toggle flag in prepare is probably not correct
2204	* when we encounter a STALL error, 4.3.1.3.7.2: "If an endpoint returns a STALL
2205	* PID, the Host Controller retires the General TD with the ConditionCode set
2206	* to STALL and halts the endpoint. The CurrentBufferPointer, ErrorCount, and
2207	* dataToggle fields retain the values that they had at the start of the
2208	* transaction." */
2209
2210	/* update toggle and set data toggle carry */
2211	pTd->hwinfo &= ~TD_HWINFO_TOGGLE;
2212	if ( pTd->hwinfo & TD_HWINFO_TOGGLE_HI )
2213	{
2214	if ( !!(pTd->hwinfo & TD_HWINFO_TOGGLE_LO) ) /** @todo r=bird: is it just me or doesn't this make sense at all? */
2215	pTd->hwinfo \|= TD_HWINFO_TOGGLE_LO;
2216	else
2217	pTd->hwinfo &= ~TD_HWINFO_TOGGLE_LO;
2218	}
2219	else
2220	{
2221	if ( !!(pEd->HeadP & ED_HEAD_CARRY) ) /** @todo r=bird: is it just me or doesn't this make sense at all? */
2222	pEd->HeadP \|= ED_HEAD_CARRY;
2223	else
2224	pEd->HeadP &= ~ED_HEAD_CARRY;
2225	}
2226
2227	/*
2228	* Unlink the TD from the ED list.
2229	* The normal case is that it's at the head of the list.
2230	*/
2231	Assert((TdAddr & ED_PTR_MASK) == TdAddr);
2232	if ((pEd->HeadP & ED_PTR_MASK) == TdAddr)
2233	{
2234	pEd->HeadP = (pTd->NextTD & ED_PTR_MASK) \| (pEd->HeadP & ~ED_PTR_MASK);
2235	pTd->NextTD &= ~ED_PTR_MASK;
2236	}
2237	else
2238	{
2239	/*
2240	* The TD is probably somewhere in the list.
2241	*
2242	* This shouldn't ever happen unless there was a failure! Even on failure,
2243	* we can screw up the HCD state by picking out a TD from within the list
2244	* like this! If this turns out to be a problem, we have to find a better
2245	* solution. For now we'll hope the HCD handles it...
2246	*/
2247	if (!ohciUnlinkGeneralTdInList(pThis, TdAddr, pTd, pEd))
2248	return false;
2249	}
2250
2251	/*
2252	* Only unlink the first TD on error.
2253	* See comment in ohciRhXferCompleteGeneralURB().
2254	*/
2255	if (pUrb->enmStatus != VUSBSTATUS_OK)
2256	break;
2257	}
2258	}
2259
2260	return true;
2261	}
2262
2263
2264	/**
2265	* Checks that the transport descriptors associated with the URB
2266	* hasn't been changed in any way indicating that they may have been canceled.
2267	*
2268	* This rountine also updates the TD copies contained within the URB.
2269	*
2270	* @returns true if the URB has been canceled, otherwise false.
2271	* @param pThis The OHCI instance.
2272	* @param pUrb The URB in question.
2273	* @param pEd The ED pointer (optional).
2274	*/
2275	static bool ohciHasUrbBeenCanceled(POHCI pThis, PVUSBURB pUrb, PCOHCIED pEd)
2276	{
2277	if (!pUrb)
2278	return true;
2279
2280	/*
2281	* Make sure we've got an endpoint descriptor so we can
2282	* check for tail TDs.
2283	*/
2284	OHCIED Ed;
2285	if (!pEd)
2286	{
2287	ohciReadEd(pThis, pUrb->pHci->EdAddr, &Ed);
2288	pEd = &Ed;
2289	}
2290
2291	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2292	{
2293	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2294	{
2295	union
2296	{
2297	OHCIITD ITd;
2298	uint32_t au32[8];
2299	} u;
2300	if ( (pUrb->paTds[iTd].TdAddr & ED_PTR_MASK)
2301	== (pEd->TailP & ED_PTR_MASK))
2302	{
2303	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled (tail)! [iso]\n",
2304	pUrb->pszDesc, iTd, pUrb->pHci->cTds, pUrb->paTds[iTd].TdAddr));
2305	STAM_COUNTER_INC(&pThis->StatCanceledIsocUrbs);
2306	return true;
2307	}
2308	ohciReadITd(pThis, pUrb->paTds[iTd].TdAddr, &u.ITd);
2309	if ( u.au32[0] != pUrb->paTds[iTd].TdCopy[0] /* hwinfo */
2310	\|\| u.au32[1] != pUrb->paTds[iTd].TdCopy[1] /* bp0 */
2311	\|\| u.au32[3] != pUrb->paTds[iTd].TdCopy[3] /* be */
2312	\|\| ( u.au32[2] != pUrb->paTds[iTd].TdCopy[2] /* NextTD */
2313	&& iTd + 1 < pUrb->pHci->cTds /* ignore the last one */)
2314	\|\| u.au32[4] != pUrb->paTds[iTd].TdCopy[4] /* psw0&1 */
2315	\|\| u.au32[5] != pUrb->paTds[iTd].TdCopy[5] /* psw2&3 */
2316	\|\| u.au32[6] != pUrb->paTds[iTd].TdCopy[6] /* psw4&5 */
2317	\|\| u.au32[7] != pUrb->paTds[iTd].TdCopy[7] /* psw6&7 */
2318	)
2319	{
2320	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled! [iso]\n",
2321	pUrb->pszDesc, iTd, pUrb->pHci->cTds, pUrb->paTds[iTd].TdAddr));
2322	Log2((" %.*Rhxs (cur)\n"
2323	"!= %.*Rhxs (copy)\n",
2324	sizeof(u.ITd), &u.ITd, sizeof(u.ITd), &pUrb->paTds[iTd].TdCopy[0]));
2325	STAM_COUNTER_INC(&pThis->StatCanceledIsocUrbs);
2326	return true;
2327	}
2328	pUrb->paTds[iTd].TdCopy[2] = u.au32[2];
2329	}
2330	}
2331	else
2332	{
2333	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2334	{
2335	union
2336	{
2337	OHCITD Td;
2338	uint32_t au32[4];
2339	} u;
2340	if ( (pUrb->paTds[iTd].TdAddr & ED_PTR_MASK)
2341	== (pEd->TailP & ED_PTR_MASK))
2342	{
2343	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled (tail)!\n",
2344	pUrb->pszDesc, iTd, pUrb->pHci->cTds, pUrb->paTds[iTd].TdAddr));
2345	STAM_COUNTER_INC(&pThis->StatCanceledGenUrbs);
2346	return true;
2347	}
2348	ohciReadTd(pThis, pUrb->paTds[iTd].TdAddr, &u.Td);
2349	if ( u.au32[0] != pUrb->paTds[iTd].TdCopy[0] /* hwinfo */
2350	\|\| u.au32[1] != pUrb->paTds[iTd].TdCopy[1] /* cbp */
2351	\|\| u.au32[3] != pUrb->paTds[iTd].TdCopy[3] /* be */
2352	\|\| ( u.au32[2] != pUrb->paTds[iTd].TdCopy[2] /* NextTD */
2353	&& iTd + 1 < pUrb->pHci->cTds /* ignore the last one */)
2354	)
2355	{
2356	Log(("%s: ohciHasUrbBeenCanceled: iTd=%d cTds=%d TdAddr=%#010RX32 canceled!\n",
2357	pUrb->pszDesc, iTd, pUrb->pHci->cTds, pUrb->paTds[iTd].TdAddr));
2358	Log2((" %.*Rhxs (cur)\n"
2359	"!= %.*Rhxs (copy)\n",
2360	sizeof(u.Td), &u.Td, sizeof(u.Td), &pUrb->paTds[iTd].TdCopy[0]));
2361	STAM_COUNTER_INC(&pThis->StatCanceledGenUrbs);
2362	return true;
2363	}
2364	pUrb->paTds[iTd].TdCopy[2] = u.au32[2];
2365	}
2366	}
2367	return false;
2368	}
2369
2370
2371	/**
2372	* Returns the OHCI_CC_* corresponding to the VUSB status code.
2373	*
2374	* @returns OHCI_CC_* value.
2375	* @param enmStatus The VUSB status code.
2376	*/
2377	static uint32_t ohciVUsbStatus2OhciStatus(VUSBSTATUS enmStatus)
2378	{
2379	switch (enmStatus)
2380	{
2381	case VUSBSTATUS_OK: return OHCI_CC_NO_ERROR;
2382	case VUSBSTATUS_STALL: return OHCI_CC_STALL;
2383	case VUSBSTATUS_CRC: return OHCI_CC_CRC;
2384	case VUSBSTATUS_DATA_UNDERRUN: return OHCI_CC_DATA_UNDERRUN;
2385	case VUSBSTATUS_DATA_OVERRUN: return OHCI_CC_DATA_OVERRUN;
2386	case VUSBSTATUS_DNR: return OHCI_CC_DNR;
2387	case VUSBSTATUS_NOT_ACCESSED: return OHCI_CC_NOT_ACCESSED_1;
2388	default:
2389	Log(("pUrb->enmStatus=%#x!!!\n", enmStatus));
2390	return OHCI_CC_DNR;
2391	}
2392	}
2393
2394	/**
2395	* Worker for ohciRhXferCompletion that handles the completion of
2396	* a URB made up of isochronous TDs.
2397	*
2398	* In general, all URBs should have status OK.
2399	*/
2400	static void ohciRhXferCompleteIsochronousURB(POHCI pThis, PVUSBURB pUrb, POHCIED pEd, int cFmAge)
2401	{
2402	/*
2403	* Copy the data back (if IN operation) and update the TDs.
2404	*/
2405	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2406	{
2407	POHCIITD pITd = (POHCIITD)&pUrb->paTds[iTd].TdCopy[0];
2408	const uint32_t ITdAddr = pUrb->paTds[iTd].TdAddr;
2409	const unsigned cFrames = ((pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
2410	unsigned R = (pUrb->pHci->u32FrameNo & ITD_HWINFO_SF) - (pITd->HwInfo & ITD_HWINFO_SF);
2411	if (R >= 8)
2412	R = 0; /* submitted ahead of time. */
2413
2414	/*
2415	* Only one case of TD level condition code is document, so
2416	* just set NO_ERROR here to reduce number duplicate code.
2417	*/
2418	pITd->HwInfo &= ~TD_HWINFO_CC;
2419	AssertCompile(OHCI_CC_NO_ERROR == 0);
2420
2421	if (pUrb->enmStatus == VUSBSTATUS_OK)
2422	{
2423	/*
2424	* Update the frames and copy back the data.
2425	* We assume that we don't get incorrect lengths here.
2426	*/
2427	for (unsigned i = 0; i < cFrames; i++)
2428	{
2429	if ( i < R
2430	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_NOT_ACCESSED)
2431	{
2432	/* It should already be NotAccessed. */
2433	pITd->aPSW[i] \|= 0xe000; /* (Don't touch the 12th bit.) */
2434	continue;
2435	}
2436
2437	/* Update the PSW (save the offset first in case of a IN). */
2438	uint32_t off = pITd->aPSW[i] & ITD_PSW_OFFSET;
2439	pITd->aPSW[i] = ohciVUsbStatus2OhciStatus(pUrb->aIsocPkts[i - R].enmStatus)
2440	>> (TD_HWINFO_CC_SHIFT - ITD_PSW_CC_SHIFT);
2441
2442	if ( pUrb->enmDir == VUSBDIRECTION_IN
2443	&& ( pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_OK
2444	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_DATA_UNDERRUN
2445	\|\| pUrb->aIsocPkts[i - R].enmStatus == VUSBSTATUS_DATA_OVERRUN))
2446	{
2447	/* Set the size. */
2448	const unsigned cb = pUrb->aIsocPkts[i - R].cb;
2449	pITd->aPSW[i] \|= cb & ITD_PSW_SIZE;
2450	/* Copy data. */
2451	if (cb)
2452	{
2453	uint8_t *pb = &pUrb->abData[pUrb->aIsocPkts[i - R].off];
2454	if (off + cb > 0x1000)
2455	{
2456	if (off < 0x1000)
2457	{
2458	/* both */
2459	const unsigned cb0 = 0x1000 - off;
2460	ohciPhysWrite(pThis, (pITd->BP0 & ITD_BP0_MASK) + off, pb, cb0);
2461	ohciPhysWrite(pThis, pITd->BE & ITD_BP0_MASK, pb + cb0, cb - cb0);
2462	}
2463	else /* only in the 2nd page */
2464	ohciPhysWrite(pThis, (pITd->BE & ITD_BP0_MASK) + (off & ITD_BP0_MASK), pb, cb);
2465	}
2466	else /* only in the 1st page */
2467	ohciPhysWrite(pThis, (pITd->BP0 & ITD_BP0_MASK) + off, pb, cb);
2468	Log5(("packet %d: off=%#x cb=%#x pb=%p (%#x)\n"
2469	"%.*Rhxd\n",
2470	i + R, off, cb, pb, pb - &pUrb->abData[0], cb, pb));
2471	//off += cb;
2472	}
2473	}
2474	}
2475
2476	/*
2477	* If the last package ended with a NotAccessed status, set ITD CC
2478	* to DataOverrun to indicate scheduling overrun.
2479	*/
2480	if (pUrb->aIsocPkts[pUrb->cIsocPkts - 1].enmStatus == VUSBSTATUS_NOT_ACCESSED)
2481	pITd->HwInfo \|= OHCI_CC_DATA_OVERRUN;
2482	}
2483	else
2484	{
2485	Log(("DevOHCI: Taking untested code path at line %d...\n", __LINE__));
2486	/*
2487	* Most status codes only applies to the individual packets.
2488	*
2489	* If we get a URB level error code of this kind, we'll distribute
2490	* it to all the packages unless some other status is available for
2491	* a package. This is a bit fuzzy, and we will get rid of this code
2492	* before long!
2493	*/
2494	//if (pUrb->enmStatus != VUSBSTATUS_DATA_OVERRUN)
2495	{
2496	const unsigned uCC = ohciVUsbStatus2OhciStatus(pUrb->enmStatus)
2497	>> (TD_HWINFO_CC_SHIFT - ITD_PSW_CC_SHIFT);
2498	for (unsigned i = 0; i < cFrames; i++)
2499	pITd->aPSW[i] = uCC;
2500	}
2501	//else
2502	// pITd->HwInfo \|= ohciVUsbStatus2OhciStatus(pUrb->enmStatus);
2503	}
2504
2505	/*
2506	* Update the done queue interrupt timer.
2507	*/
2508	uint32_t DoneInt = (pITd->HwInfo & ITD_HWINFO_DI) >> ITD_HWINFO_DI_SHIFT;
2509	if ((pITd->HwInfo & TD_HWINFO_CC) != OHCI_CC_NO_ERROR)
2510	DoneInt = 0; /* It's cleared on error. */
2511	if ( DoneInt != 0x7
2512	&& DoneInt < pThis->dqic)
2513	pThis->dqic = DoneInt;
2514
2515	/*
2516	* Move on to the done list and write back the modified TD.
2517	*/
2518	#ifdef LOG_ENABLED
2519	if (!pThis->done)
2520	pThis->u32FmDoneQueueTail = pThis->HcFmNumber;
2521	# ifdef VBOX_STRICT
2522	ohci_in_done_queue_add(pThis, ITdAddr);
2523	# endif
2524	#endif
2525	pITd->NextTD = pThis->done;
2526	pThis->done = ITdAddr;
2527
2528	Log(("%s: ohciRhXferCompleteIsochronousURB: ITdAddr=%#010x EdAddr=%#010x SF=%#x (%#x) CC=%#x FC=%d "
2529	"psw0=%x:%x psw1=%x:%x psw2=%x:%x psw3=%x:%x psw4=%x:%x psw5=%x:%x psw6=%x:%x psw7=%x:%x R=%d\n",
2530	pUrb->pszDesc, ITdAddr,
2531	pUrb->pHci->EdAddr,
2532	pITd->HwInfo & ITD_HWINFO_SF, pThis->HcFmNumber,
2533	(pITd->HwInfo & ITD_HWINFO_CC) >> ITD_HWINFO_CC_SHIFT,
2534	(pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT,
2535	pITd->aPSW[0] >> ITD_PSW_CC_SHIFT, pITd->aPSW[0] & ITD_PSW_SIZE,
2536	pITd->aPSW[1] >> ITD_PSW_CC_SHIFT, pITd->aPSW[1] & ITD_PSW_SIZE,
2537	pITd->aPSW[2] >> ITD_PSW_CC_SHIFT, pITd->aPSW[2] & ITD_PSW_SIZE,
2538	pITd->aPSW[3] >> ITD_PSW_CC_SHIFT, pITd->aPSW[3] & ITD_PSW_SIZE,
2539	pITd->aPSW[4] >> ITD_PSW_CC_SHIFT, pITd->aPSW[4] & ITD_PSW_SIZE,
2540	pITd->aPSW[5] >> ITD_PSW_CC_SHIFT, pITd->aPSW[5] & ITD_PSW_SIZE,
2541	pITd->aPSW[6] >> ITD_PSW_CC_SHIFT, pITd->aPSW[6] & ITD_PSW_SIZE,
2542	pITd->aPSW[7] >> ITD_PSW_CC_SHIFT, pITd->aPSW[7] & ITD_PSW_SIZE,
2543	R));
2544	ohciWriteITd(pThis, ITdAddr, pITd, "retired");
2545	}
2546	}
2547
2548
2549	/**
2550	* Worker for ohciRhXferCompletion that handles the completion of
2551	* a URB made up of general TDs.
2552	*/
2553	static void ohciRhXferCompleteGeneralURB(POHCI pThis, PVUSBURB pUrb, POHCIED pEd, int cFmAge)
2554	{
2555	/*
2556	* Copy the data back (if IN operation) and update the TDs.
2557	*/
2558	unsigned cbLeft = pUrb->cbData;
2559	uint8_t *pb = &pUrb->abData[0];
2560	for (unsigned iTd = 0; iTd < pUrb->pHci->cTds; iTd++)
2561	{
2562	POHCITD pTd = (POHCITD)&pUrb->paTds[iTd].TdCopy[0];
2563	const uint32_t TdAddr = pUrb->paTds[iTd].TdAddr;
2564
2565	/*
2566	* Setup a ohci transfer buffer and calc the new cbp value.
2567	*/
2568	OHCIBUF Buf;
2569	ohciBufInit(&Buf, pTd->cbp, pTd->be);
2570	uint32_t NewCbp;
2571	if (cbLeft >= Buf.cbTotal)
2572	NewCbp = 0;
2573	else
2574	{
2575	/* (len may have changed for short transfers) */
2576	Buf.cbTotal = cbLeft;
2577	ohciBufUpdate(&Buf);
2578	Assert(Buf.cVecs >= 1);
2579	NewCbp = Buf.aVecs[Buf.cVecs-1].Addr + Buf.aVecs[Buf.cVecs-1].cb;
2580	}
2581
2582	/*
2583	* Write back IN buffers.
2584	*/
2585	if ( pUrb->enmDir == VUSBDIRECTION_IN
2586	&& ( pUrb->enmStatus == VUSBSTATUS_OK
2587	\|\| pUrb->enmStatus == VUSBSTATUS_DATA_OVERRUN
2588	\|\| pUrb->enmStatus == VUSBSTATUS_DATA_UNDERRUN)
2589	&& Buf.cbTotal > 0)
2590	{
2591	Assert(Buf.cVecs > 0);
2592	ohciPhysWrite(pThis, Buf.aVecs[0].Addr, pb, Buf.aVecs[0].cb);
2593	if (Buf.cVecs > 1)
2594	ohciPhysWrite(pThis, Buf.aVecs[1].Addr, pb + Buf.aVecs[0].cb, Buf.aVecs[1].cb);
2595	}
2596
2597	/* advance the data buffer. */
2598	cbLeft -= Buf.cbTotal;
2599	pb += Buf.cbTotal;
2600
2601	/*
2602	* Set writeback field.
2603	*/
2604	/* zero out writeback fields for retirement */
2605	pTd->hwinfo &= ~TD_HWINFO_CC;
2606	/* always update the CurrentBufferPointer; essential for underrun/overrun errors */
2607	pTd->cbp = NewCbp;
2608
2609	if (pUrb->enmStatus == VUSBSTATUS_OK)
2610	{
2611	pTd->hwinfo &= ~TD_HWINFO_ERRORS;
2612
2613	/* update done queue interrupt timer */
2614	uint32_t DoneInt = (pTd->hwinfo & TD_HWINFO_DI) >> 21;
2615	if ( DoneInt != 0x7
2616	&& DoneInt < pThis->dqic)
2617	pThis->dqic = DoneInt;
2618	Log(("%s: ohciRhXferCompleteGeneralURB: ED=%#010x TD=%#010x Age=%d enmStatus=%d cbTotal=%#x NewCbp=%#010RX32 dqic=%d\n",
2619	pUrb->pszDesc, pUrb->pHci->EdAddr, TdAddr, cFmAge, pUrb->enmStatus, Buf.cbTotal, NewCbp, pThis->dqic));
2620	}
2621	else
2622	{
2623	Log(("%s: ohciRhXferCompleteGeneralURB: HALTED ED=%#010x TD=%#010x (age %d) pUrb->enmStatus=%d\n",
2624	pUrb->pszDesc, pUrb->pHci->EdAddr, TdAddr, cFmAge, pUrb->enmStatus));
2625	pEd->HeadP \|= ED_HEAD_HALTED;
2626	pThis->dqic = 0; /* "If the Transfer Descriptor is being retired with an error,
2627	* then the Done Queue Interrupt Counter is cleared as if the
2628	* InterruptDelay field were zero."
2629	*/
2630	switch (pUrb->enmStatus)
2631	{
2632	case VUSBSTATUS_STALL:
2633	pTd->hwinfo \|= OHCI_CC_STALL;
2634	break;
2635	case VUSBSTATUS_CRC:
2636	pTd->hwinfo \|= OHCI_CC_CRC;
2637	break;
2638	case VUSBSTATUS_DATA_UNDERRUN:
2639	pTd->hwinfo \|= OHCI_CC_DATA_UNDERRUN;
2640	break;
2641	case VUSBSTATUS_DATA_OVERRUN:
2642	pTd->hwinfo \|= OHCI_CC_DATA_OVERRUN;
2643	break;
2644	default: /* what the hell */
2645	Log(("pUrb->enmStatus=%#x!!!\n", pUrb->enmStatus));
2646	case VUSBSTATUS_DNR:
2647	pTd->hwinfo \|= OHCI_CC_DNR;
2648	break;
2649	}
2650	}
2651
2652	/*
2653	* Move on to the done list and write back the modified TD.
2654	*/
2655	#ifdef LOG_ENABLED
2656	if (!pThis->done)
2657	pThis->u32FmDoneQueueTail = pThis->HcFmNumber;
2658	# ifdef VBOX_STRICT
2659	ohci_in_done_queue_add(pThis, TdAddr);
2660	# endif
2661	#endif
2662	pTd->NextTD = pThis->done;
2663	pThis->done = TdAddr;
2664
2665	ohciWriteTd(pThis, TdAddr, pTd, "retired");
2666
2667	/*
2668	* If we've halted the endpoint, we stop here.
2669	* ohciUnlinkTds() will make sure we've only unliked the first TD.
2670	*
2671	* The reason for this is that while we can have more than one TD in a URB, real
2672	* OHCI hardware will only deal with one TD at the time and it's therefore incorrect
2673	* to retire TDs after the endpoint has been halted. Win2k will crash or enter infinite
2674	* kernel loop if we don't behave correctly. (See @bugref{1646}.)
2675	*/
2676	if (pEd->HeadP & ED_HEAD_HALTED)
2677	break;
2678	}
2679	}
2680
2681
2682	/**
2683	* Transfer completion callback routine.
2684	*
2685	* VUSB will call this when a transfer have been completed
2686	* in a one or another way.
2687	*
2688	* @param pInterface Pointer to OHCI::ROOTHUB::IRhPort.
2689	* @param pUrb Pointer to the URB in question.
2690	*/
2691	static DECLCALLBACK(void) ohciRhXferCompletion(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb)
2692	{
2693	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
2694	LogFlow(("%s: ohciRhXferCompletion: EdAddr=%#010RX32 cTds=%d TdAddr0=%#010RX32\n",
2695	pUrb->pszDesc, pUrb->pHci->EdAddr, pUrb->pHci->cTds, pUrb->paTds[0].TdAddr));
2696
2697	RTCritSectEnter(&pThis->CritSect);
2698	pThis->fIdle = false; /* Mark as active */
2699
2700	/* get the current end point descriptor. */
2701	OHCIED Ed;
2702	ohciReadEd(pThis, pUrb->pHci->EdAddr, &Ed);
2703
2704	/*
2705	* Check that the URB hasn't been canceled and then try unlink the TDs.
2706	*
2707	* We drop the URB if the ED is marked halted/skip ASSUMING that this
2708	* means the HCD has canceled the URB.
2709	*
2710	* If we succeed here (i.e. not dropping the URB), the TdCopy members will
2711	* be updated but not yet written. We will delay the writing till we're done
2712	* with the data copying, buffer pointer advancing and error handling.
2713	*/
2714	int cFmAge = ohci_in_flight_remove_urb(pThis, pUrb);
2715	if (pUrb->enmStatus == VUSBSTATUS_UNDO)
2716	{
2717	/* Leave the TD alone - the HCD doesn't want us talking to the device. */
2718	Log(("%s: ohciRhXferCompletion: CANCELED {ED=%#010x cTds=%d TD0=%#010x age %d}\n",
2719	pUrb->pszDesc, pUrb->pHci->EdAddr, pUrb->pHci->cTds, pUrb->paTds[0].TdAddr, cFmAge));
2720	STAM_COUNTER_INC(&pThis->StatDroppedUrbs);
2721	RTCritSectLeave(&pThis->CritSect);
2722	return;
2723	}
2724	bool fHasBeenCanceled = false;
2725	if ( (Ed.HeadP & ED_HEAD_HALTED)
2726	\|\| (Ed.hwinfo & ED_HWINFO_SKIP)
2727	\|\| cFmAge < 0
2728	\|\| (fHasBeenCanceled = ohciHasUrbBeenCanceled(pThis, pUrb, &Ed))
2729	\|\| !ohciUnlinkTds(pThis, pUrb, &Ed)
2730	)
2731	{
2732	Log(("%s: ohciRhXferCompletion: DROPPED {ED=%#010x cTds=%d TD0=%#010x age %d} because:%s%s%s%s%s!!!\n",
2733	pUrb->pszDesc, pUrb->pHci->EdAddr, pUrb->pHci->cTds, pUrb->paTds[0].TdAddr, cFmAge,
2734	(Ed.HeadP & ED_HEAD_HALTED) ? " ep halted" : "",
2735	(Ed.hwinfo & ED_HWINFO_SKIP) ? " ep skip" : "",
2736	(Ed.HeadP & ED_PTR_MASK) != pUrb->paTds[0].TdAddr ? " ep head-changed" : "",
2737	cFmAge < 0 ? " td not-in-flight" : "",
2738	fHasBeenCanceled ? " td canceled" : ""));
2739	NOREF(fHasBeenCanceled);
2740	STAM_COUNTER_INC(&pThis->StatDroppedUrbs);
2741	RTCritSectLeave(&pThis->CritSect);
2742	return;
2743	}
2744
2745	/*
2746	* Complete the TD updating and write the back.
2747	* When appropriate also copy data back to the guest memory.
2748	*/
2749	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2750	ohciRhXferCompleteIsochronousURB(pThis, pUrb, &Ed, cFmAge);
2751	else
2752	ohciRhXferCompleteGeneralURB(pThis, pUrb, &Ed, cFmAge);
2753
2754	/* finally write back the endpoint descriptor. */
2755	ohciWriteEd(pThis, pUrb->pHci->EdAddr, &Ed);
2756
2757	RTCritSectLeave(&pThis->CritSect);
2758	}
2759
2760
2761	/**
2762	* Handle transfer errors.
2763	*
2764	* VUSB calls this when a transfer attempt failed. This function will respond
2765	* indicating whether to retry or complete the URB with failure.
2766	*
2767	* @returns true if the URB should be retired.
2768	* @returns false if the URB should be retried.
2769	* @param pInterface Pointer to OHCI::ROOTHUB::IRhPort.
2770	* @param pUrb Pointer to the URB in question.
2771	*/
2772	static DECLCALLBACK(bool) ohciRhXferError(PVUSBIROOTHUBPORT pInterface, PVUSBURB pUrb)
2773	{
2774	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
2775
2776	/*
2777	* Isochronous URBs can't be retried.
2778	*/
2779	if (pUrb->enmType == VUSBXFERTYPE_ISOC)
2780	return true;
2781
2782	/*
2783	* Don't retry on stall.
2784	*/
2785	if (pUrb->enmStatus == VUSBSTATUS_STALL)
2786	{
2787	Log2(("%s: ohciRhXferError: STALL, giving up.\n", pUrb->pszDesc));
2788	return true;
2789	}
2790
2791	RTCritSectEnter(&pThis->CritSect);
2792
2793	bool fRetire = false;
2794	/*
2795	* Check if the TDs still are valid.
2796	* This will make sure the TdCopy is up to date.
2797	*/
2798	const uint32_t TdAddr = pUrb->paTds[0].TdAddr;
2799	/** @todo IMPORTANT! we must check if the ED is still valid at this point!!! */
2800	if (ohciHasUrbBeenCanceled(pThis, pUrb, NULL))
2801	{
2802	Log(("%s: ohciRhXferError: TdAddr0=%#x canceled!\n", pUrb->pszDesc, TdAddr));
2803	fRetire = true;
2804	}
2805	else
2806	{
2807	/*
2808	* Get and update the error counter.
2809	*/
2810	POHCITD pTd = (POHCITD)&pUrb->paTds[0].TdCopy[0];
2811	unsigned cErrs = (pTd->hwinfo & TD_HWINFO_ERRORS) >> TD_ERRORS_SHIFT;
2812	pTd->hwinfo &= ~TD_HWINFO_ERRORS;
2813	cErrs++;
2814	pTd->hwinfo \|= (cErrs % TD_ERRORS_MAX) << TD_ERRORS_SHIFT;
2815	ohciWriteTd(pThis, TdAddr, pTd, "ohciRhXferError");
2816
2817	if (cErrs >= TD_ERRORS_MAX - 1)
2818	{
2819	Log2(("%s: ohciRhXferError: too many errors, giving up!\n", pUrb->pszDesc));
2820	fRetire = true;
2821	}
2822	else
2823	Log2(("%s: ohciRhXferError: cErrs=%d: retrying...\n", pUrb->pszDesc, cErrs));
2824	}
2825
2826	RTCritSectLeave(&pThis->CritSect);
2827	return fRetire;
2828	}
2829
2830
2831	/**
2832	* Service a general transport descriptor.
2833	*/
2834	static bool ohciServiceTd(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, uint32_t TdAddr, uint32_t pNextTdAddr, const char pszListName)
2835	{
2836	/*
2837	* Read the TD and setup the buffer data.
2838	*/
2839	OHCITD Td;
2840	ohciReadTd(pThis, TdAddr, &Td);
2841	OHCIBUF Buf;
2842	ohciBufInit(&Buf, Td.cbp, Td.be);
2843
2844	*pNextTdAddr = Td.NextTD & ED_PTR_MASK;
2845
2846	/*
2847	* Determine the direction.
2848	*/
2849	VUSBDIRECTION enmDir;
2850	switch (pEd->hwinfo & ED_HWINFO_DIR)
2851	{
2852	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2853	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2854	default:
2855	switch (Td.hwinfo & TD_HWINFO_DIR)
2856	{
2857	case TD_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
2858	case TD_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
2859	case 0: enmDir = VUSBDIRECTION_SETUP; break;
2860	default:
2861	Log(("ohciServiceTd: Invalid direction!!!! Td.hwinfo=%#x Ed.hwdinfo=%#x\n", Td.hwinfo, pEd->hwinfo));
2862	/* TODO: Do the correct thing here */
2863	return false;
2864	}
2865	break;
2866	}
2867
2868	pThis->fIdle = false; /* Mark as active */
2869
2870	/*
2871	* Allocate and initialize a new URB.
2872	*/
2873	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, NULL,
2874	enmType, enmDir, Buf.cbTotal, 1, NULL);
2875	if (!pUrb)
2876	return false; /* retry later... */
2877
2878	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
2879	pUrb->fShortNotOk = !(Td.hwinfo & TD_HWINFO_ROUNDING);
2880	pUrb->enmStatus = VUSBSTATUS_OK;
2881	pUrb->pHci->EdAddr = EdAddr;
2882	pUrb->pHci->fUnlinked = false;
2883	pUrb->pHci->cTds = 1;
2884	pUrb->paTds[0].TdAddr = TdAddr;
2885	pUrb->pHci->u32FrameNo = pThis->HcFmNumber;
2886	AssertCompile(sizeof(pUrb->paTds[0].TdCopy) >= sizeof(Td));
2887	memcpy(pUrb->paTds[0].TdCopy, &Td, sizeof(Td));
2888
2889	/* copy data if out bound transfer. */
2890	pUrb->cbData = Buf.cbTotal;
2891	if ( Buf.cbTotal
2892	&& Buf.cVecs > 0
2893	&& enmDir != VUSBDIRECTION_IN)
2894	{
2895	ohciPhysRead(pThis, Buf.aVecs[0].Addr, pUrb->abData, Buf.aVecs[0].cb);
2896	if (Buf.cVecs > 1)
2897	ohciPhysRead(pThis, Buf.aVecs[1].Addr, &pUrb->abData[Buf.aVecs[0].cb], Buf.aVecs[1].cb);
2898	}
2899
2900	/*
2901	* Submit the URB.
2902	*/
2903	ohci_in_flight_add(pThis, TdAddr, pUrb);
2904	Log(("%s: ohciServiceTd: submitting TdAddr=%#010x EdAddr=%#010x cbData=%#x\n",
2905	pUrb->pszDesc, TdAddr, EdAddr, pUrb->cbData));
2906
2907	RTCritSectLeave(&pThis->CritSect);
2908	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
2909	RTCritSectEnter(&pThis->CritSect);
2910	if (RT_SUCCESS(rc))
2911	return true;
2912
2913	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
2914	Log(("ohciServiceTd: failed submitting TdAddr=%#010x EdAddr=%#010x pUrb=%p!!\n",
2915	TdAddr, EdAddr, pUrb));
2916	ohci_in_flight_remove(pThis, TdAddr);
2917	return false;
2918	}
2919
2920
2921	/**
2922	* Service a the head TD of an endpoint.
2923	*/
2924	static bool ohciServiceHeadTd(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, const char *pszListName)
2925	{
2926	/*
2927	* Read the TD, after first checking if it's already in-flight.
2928	*/
2929	uint32_t TdAddr = pEd->HeadP & ED_PTR_MASK;
2930	if (ohciIsTdInFlight(pThis, TdAddr))
2931	return false;
2932	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
2933	ohci_in_done_queue_check(pThis, TdAddr);
2934	#endif
2935	return ohciServiceTd(pThis, enmType, pEd, EdAddr, TdAddr, &TdAddr, pszListName);
2936	}
2937
2938
2939	/**
2940	* Service one or more general transport descriptors (bulk or interrupt).
2941	*/
2942	static bool ohciServiceTdMultiple(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr,
2943	uint32_t TdAddr, uint32_t pNextTdAddr, const char pszListName)
2944	{
2945	/*
2946	* Read the TDs involved in this URB.
2947	*/
2948	struct OHCITDENTRY
2949	{
2950	/** The TD. */
2951	OHCITD Td;
2952	/** The associated OHCI buffer tracker. */
2953	OHCIBUF Buf;
2954	/** The TD address. */
2955	uint32_t TdAddr;
2956	/** Pointer to the next element in the chain (stack). */
2957	struct OHCITDENTRY *pNext;
2958	} Head;
2959
2960	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
2961	ohciPhysReadCacheClear(pThis->pCacheTD);
2962	#endif
2963
2964	/* read the head */
2965	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
2966	ohciReadTdCached(pThis, TdAddr, &Head.Td);
2967	#else
2968	ohciReadTd(pThis, TdAddr, &Head.Td);
2969	#endif
2970	ohciBufInit(&Head.Buf, Head.Td.cbp, Head.Td.be);
2971	Head.TdAddr = TdAddr;
2972	Head.pNext = NULL;
2973
2974	/* combine with more TDs. */
2975	struct OHCITDENTRY *pTail = &Head;
2976	unsigned cbTotal = pTail->Buf.cbTotal;
2977	unsigned cTds = 1;
2978	while ( (pTail->Buf.cbTotal == 0x1000 \|\| pTail->Buf.cbTotal == 0x2000)
2979	&& !(pTail->Td.hwinfo & TD_HWINFO_ROUNDING) /* This isn't right for BSD, but let's not . /
2980	&& (pTail->Td.NextTD & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
2981	&& cTds < 128)
2982	{
2983	struct OHCITDENTRY pCur = (struct OHCITDENTRY )alloca(sizeof(*pCur));
2984
2985	pCur->pNext = NULL;
2986	pCur->TdAddr = pTail->Td.NextTD & ED_PTR_MASK;
2987	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
2988	ohciReadTdCached(pThis, pCur->TdAddr, &pCur->Td);
2989	#else
2990	ohciReadTd(pThis, pCur->TdAddr, &pCur->Td);
2991	#endif
2992	ohciBufInit(&pCur->Buf, pCur->Td.cbp, pCur->Td.be);
2993
2994	/* Don't combine if the direction doesn't match up. There can't actually be
2995	* a mismatch for bulk/interrupt EPs unless the guest is buggy.
2996	*/
2997	if ( (pCur->Td.hwinfo & (TD_HWINFO_DIR))
2998	!= (Head.Td.hwinfo & (TD_HWINFO_DIR)))
2999	break;
3000
3001	pTail->pNext = pCur;
3002	pTail = pCur;
3003	cbTotal += pCur->Buf.cbTotal;
3004	cTds++;
3005	}
3006
3007	/* calc next TD address */
3008	*pNextTdAddr = pTail->Td.NextTD & ED_PTR_MASK;
3009
3010	/*
3011	* Determine the direction.
3012	*/
3013	VUSBDIRECTION enmDir;
3014	switch (pEd->hwinfo & ED_HWINFO_DIR)
3015	{
3016	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
3017	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
3018	default:
3019	Log(("ohciServiceTdMultiple: WARNING! Ed.hwdinfo=%#x bulk or interrupt EP shouldn't rely on the TD for direction...\n", pEd->hwinfo));
3020	switch (Head.Td.hwinfo & TD_HWINFO_DIR)
3021	{
3022	case TD_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
3023	case TD_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
3024	default:
3025	Log(("ohciServiceTdMultiple: Invalid direction!!!! Head.Td.hwinfo=%#x Ed.hwdinfo=%#x\n", Head.Td.hwinfo, pEd->hwinfo));
3026	/* TODO: Do the correct thing here */
3027	return false;
3028	}
3029	break;
3030	}
3031
3032	pThis->fIdle = false; /* Mark as active */
3033
3034	/*
3035	* Allocate and initialize a new URB.
3036	*/
3037	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, NULL,
3038	enmType, enmDir, cbTotal, cTds, "ohciServiceTdMultiple");
3039	if (!pUrb)
3040	/* retry later... */
3041	return false;
3042	Assert(pUrb->cbData == cbTotal);
3043
3044	pUrb->enmType = enmType;
3045	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
3046	pUrb->enmDir = enmDir;
3047	pUrb->fShortNotOk = !(pTail->Td.hwinfo & TD_HWINFO_ROUNDING);
3048	pUrb->enmStatus = VUSBSTATUS_OK;
3049	pUrb->pHci->cTds = cTds;
3050	pUrb->pHci->EdAddr = EdAddr;
3051	pUrb->pHci->fUnlinked = false;
3052	pUrb->pHci->u32FrameNo = pThis->HcFmNumber;
3053
3054	/* Copy data and TD information. */
3055	unsigned iTd = 0;
3056	uint8_t *pb = &pUrb->abData[0];
3057	for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
3058	{
3059	/* data */
3060	if ( cbTotal
3061	&& enmDir != VUSBDIRECTION_IN
3062	&& pCur->Buf.cVecs > 0)
3063	{
3064	ohciPhysRead(pThis, pCur->Buf.aVecs[0].Addr, pb, pCur->Buf.aVecs[0].cb);
3065	if (pCur->Buf.cVecs > 1)
3066	ohciPhysRead(pThis, pCur->Buf.aVecs[1].Addr, pb + pCur->Buf.aVecs[0].cb, pCur->Buf.aVecs[1].cb);
3067	}
3068	pb += pCur->Buf.cbTotal;
3069
3070	/* TD info */
3071	pUrb->paTds[iTd].TdAddr = pCur->TdAddr;
3072	AssertCompile(sizeof(pUrb->paTds[iTd].TdCopy) >= sizeof(pCur->Td));
3073	memcpy(pUrb->paTds[iTd].TdCopy, &pCur->Td, sizeof(pCur->Td));
3074	}
3075
3076	/*
3077	* Submit the URB.
3078	*/
3079	ohci_in_flight_add_urb(pThis, pUrb);
3080	Log(("%s: ohciServiceTdMultiple: submitting cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x\n",
3081	pUrb->pszDesc, pUrb->cbData, EdAddr, cTds, TdAddr));
3082	RTCritSectLeave(&pThis->CritSect);
3083	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
3084	RTCritSectEnter(&pThis->CritSect);
3085	if (RT_SUCCESS(rc))
3086	return true;
3087
3088	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
3089	Log(("ohciServiceTdMultiple: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d TdAddr0=%#010x - rc=%Rrc\n",
3090	pUrb, cbTotal, EdAddr, cTds, TdAddr, rc));
3091	for (struct OHCITDENTRY *pCur = &Head; pCur; pCur = pCur->pNext, iTd++)
3092	ohci_in_flight_remove(pThis, pCur->TdAddr);
3093	return false;
3094	}
3095
3096
3097	/**
3098	* Service the head TD of an endpoint.
3099	*/
3100	static bool ohciServiceHeadTdMultiple(POHCI pThis, VUSBXFERTYPE enmType, PCOHCIED pEd, uint32_t EdAddr, const char *pszListName)
3101	{
3102	/*
3103	* First, check that it's not already in-flight.
3104	*/
3105	uint32_t TdAddr = pEd->HeadP & ED_PTR_MASK;
3106	if (ohciIsTdInFlight(pThis, TdAddr))
3107	return false;
3108	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
3109	ohci_in_done_queue_check(pThis, TdAddr);
3110	#endif
3111	return ohciServiceTdMultiple(pThis, enmType, pEd, EdAddr, TdAddr, &TdAddr, pszListName);
3112	}
3113
3114
3115	/**
3116	* A worker for ohciServiceIsochronousEndpoint which unlinks a ITD
3117	* that belongs to the past.
3118	*/
3119	static bool ohciServiceIsochronousTdUnlink(POHCI pThis, POHCIITD pITd, uint32_t ITdAddr, uint32_t ITdAddrPrev,
3120	PVUSBURB pUrb, POHCIED pEd, uint32_t EdAddr)
3121	{
3122	LogFlow(("%s%sohciServiceIsochronousTdUnlink: Unlinking ITD: ITdAddr=%#010x EdAddr=%#010x ITdAddrPrev=%#010x\n",
3123	pUrb ? pUrb->pszDesc : "", pUrb ? ": " : "", ITdAddr, EdAddr, ITdAddrPrev));
3124
3125	/*
3126	* Do the unlinking.
3127	*/
3128	const uint32_t ITdAddrNext = pITd->NextTD & ED_PTR_MASK;
3129	if (ITdAddrPrev)
3130	{
3131	/* Get validate the previous TD */
3132	int iInFlightPrev = ohci_in_flight_find(pThis, ITdAddrPrev);
3133	AssertMsgReturn(iInFlightPrev >= 0, ("ITdAddr=%#RX32\n", ITdAddrPrev), false);
3134	PVUSBURB pUrbPrev = pThis->aInFlight[iInFlightPrev].pUrb;
3135	if (ohciHasUrbBeenCanceled(pThis, pUrbPrev, pEd)) /* ensures the copy is correct. */
3136	return false;
3137
3138	/* Update the copy and write it back. */
3139	POHCIITD pITdPrev = ((POHCIITD)pUrbPrev->paTds[0].TdCopy);
3140	pITdPrev->NextTD = (pITdPrev->NextTD & ~ED_PTR_MASK) \| ITdAddrNext;
3141	ohciWriteITd(pThis, ITdAddrPrev, pITdPrev, "ohciServiceIsochronousEndpoint");
3142	}
3143	else
3144	{
3145	/* It's the head node. update the copy from the caller and write it back. */
3146	pEd->HeadP = (pEd->HeadP & ~ED_PTR_MASK) \| ITdAddrNext;
3147	ohciWriteEd(pThis, EdAddr, pEd);
3148	}
3149
3150	/*
3151	* If it's in flight, just mark the URB as unlinked (there is only one ITD per URB atm).
3152	* Otherwise, retire it to the done queue with an error and cause a done line interrupt (?).
3153	*/
3154	if (pUrb)
3155	{
3156	pUrb->pHci->fUnlinked = true;
3157	if (ohciHasUrbBeenCanceled(pThis, pUrb, pEd)) /* ensures the copy is correct (paranoia). */
3158	return false;
3159
3160	POHCIITD pITdCopy = ((POHCIITD)pUrb->paTds[0].TdCopy);
3161	pITd->NextTD = pITdCopy->NextTD &= ~ED_PTR_MASK;
3162	}
3163	else
3164	{
3165	pITd->HwInfo &= ~ITD_HWINFO_CC;
3166	pITd->HwInfo \|= OHCI_CC_DATA_OVERRUN;
3167
3168	pITd->NextTD = pThis->done;
3169	pThis->done = ITdAddr;
3170
3171	pThis->dqic = 0;
3172	}
3173
3174	ohciWriteITd(pThis, ITdAddr, pITd, "ohciServiceIsochronousTdUnlink");
3175	return true;
3176	}
3177
3178
3179	/**
3180	* A worker for ohciServiceIsochronousEndpoint which submits the specified TD.
3181	*
3182	* @returns true on success.
3183	* @returns false on failure to submit.
3184	* @param R The start packet (frame) relative to the start of frame in HwInfo.
3185	*/
3186	static bool ohciServiceIsochronousTd(POHCI pThis, POHCIITD pITd, uint32_t ITdAddr, const unsigned R, PCOHCIED pEd, uint32_t EdAddr)
3187	{
3188	/*
3189	* Determine the endpoint direction.
3190	*/
3191	VUSBDIRECTION enmDir;
3192	switch (pEd->hwinfo & ED_HWINFO_DIR)
3193	{
3194	case ED_HWINFO_OUT: enmDir = VUSBDIRECTION_OUT; break;
3195	case ED_HWINFO_IN: enmDir = VUSBDIRECTION_IN; break;
3196	default:
3197	Log(("ohciServiceIsochronousTd: Invalid direction!!!! Ed.hwdinfo=%#x\n", pEd->hwinfo));
3198	/* Should probably raise an unrecoverable HC error here */
3199	return false;
3200	}
3201
3202	/*
3203	* Extract the packet sizes and calc the total URB size.
3204	*/
3205	struct
3206	{
3207	uint16_t cb;
3208	uint16_t off;
3209	} aPkts[ITD_NUM_PSW];
3210
3211	/* first entry (R) */
3212	uint32_t cbTotal = 0;
3213	if (((uint32_t)pITd->aPSW[R] >> ITD_PSW_CC_SHIFT) < (OHCI_CC_NOT_ACCESSED_0 >> TD_HWINFO_CC_SHIFT))
3214	Log(("ITdAddr=%RX32 PSW%d.CC=%#x < 'Not Accessed'!\n", ITdAddr, R, pITd->aPSW[R] >> ITD_PSW_CC_SHIFT)); /* => Unrecoverable Error*/
3215	uint16_t offPrev = aPkts[0].off = (pITd->aPSW[R] & ITD_PSW_OFFSET);
3216
3217	/* R+1..cFrames */
3218	const unsigned cFrames = ((pITd->HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
3219	for (unsigned iR = R + 1; iR < cFrames; iR++)
3220	{
3221	const uint16_t PSW = pITd->aPSW[iR];
3222	const uint16_t off = aPkts[iR - R].off = (PSW & ITD_PSW_OFFSET);
3223	cbTotal += aPkts[iR - R - 1].cb = off - offPrev;
3224	if (off < offPrev)
3225	Log(("ITdAddr=%RX32 PSW%d.offset=%#x < offPrev=%#x!\n", ITdAddr, iR, off, offPrev)); /* => Unrecoverable Error*/
3226	if (((uint32_t)PSW >> ITD_PSW_CC_SHIFT) < (OHCI_CC_NOT_ACCESSED_0 >> TD_HWINFO_CC_SHIFT))
3227	Log(("ITdAddr=%RX32 PSW%d.CC=%#x < 'Not Accessed'!\n", ITdAddr, iR, PSW >> ITD_PSW_CC_SHIFT)); /* => Unrecoverable Error*/
3228	offPrev = off;
3229	}
3230
3231	/* calc offEnd and figure out the size of the last packet. */
3232	const uint32_t offEnd = (pITd->BE & 0xfff)
3233	+ (((pITd->BE & ITD_BP0_MASK) != (pITd->BP0 & ITD_BP0_MASK)) << 12)
3234	+ 1 /* BE is inclusive */;
3235	if (offEnd < offPrev)
3236	Log(("ITdAddr=%RX32 offEnd=%#x < offPrev=%#x!\n", ITdAddr, offEnd, offPrev)); /* => Unrecoverable Error*/
3237	cbTotal += aPkts[cFrames - 1 - R].cb = offEnd - offPrev;
3238	Assert(cbTotal <= 0x2000);
3239
3240	pThis->fIdle = false; /* Mark as active */
3241
3242	/*
3243	* Allocate and initialize a new URB.
3244	*/
3245	PVUSBURB pUrb = VUSBIRhNewUrb(pThis->RootHub.pIRhConn, pEd->hwinfo & ED_HWINFO_FUNCTION, NULL,
3246	VUSBXFERTYPE_ISOC, enmDir, cbTotal, 1, NULL);
3247	if (!pUrb)
3248	/* retry later... */
3249	return false;
3250
3251	pUrb->EndPt = (pEd->hwinfo & ED_HWINFO_ENDPOINT) >> ED_HWINFO_ENDPOINT_SHIFT;
3252	pUrb->fShortNotOk = false;
3253	pUrb->enmStatus = VUSBSTATUS_OK;
3254	pUrb->pHci->EdAddr = EdAddr;
3255	pUrb->pHci->cTds = 1;
3256	pUrb->pHci->fUnlinked = false;
3257	pUrb->pHci->u32FrameNo = pThis->HcFmNumber;
3258	pUrb->paTds[0].TdAddr = ITdAddr;
3259	AssertCompile(sizeof(pUrb->paTds[0].TdCopy) >= sizeof(*pITd));
3260	memcpy(pUrb->paTds[0].TdCopy, pITd, sizeof(*pITd));
3261	#if 0 /* color the data */
3262	memset(pUrb->abData, 0xfe, cbTotal);
3263	#endif
3264
3265	/* copy the data */
3266	if ( cbTotal
3267	&& enmDir != VUSBDIRECTION_IN)
3268	{
3269	const uint32_t off0 = pITd->aPSW[R] & ITD_PSW_OFFSET;
3270	if (off0 < 0x1000)
3271	{
3272	if (offEnd > 0x1000)
3273	{
3274	/* both pages. */
3275	const unsigned cb0 = 0x1000 - off0;
3276	ohciPhysRead(pThis, (pITd->BP0 & ITD_BP0_MASK) + off0, &pUrb->abData[0], cb0);
3277	ohciPhysRead(pThis, pITd->BE & ITD_BP0_MASK, &pUrb->abData[cb0], offEnd & 0xfff);
3278	}
3279	else /* a portion of the 1st page. */
3280	ohciPhysRead(pThis, (pITd->BP0 & ITD_BP0_MASK) + off0, pUrb->abData, offEnd - off0);
3281	}
3282	else /* a portion of the 2nd page. */
3283	ohciPhysRead(pThis, (pITd->BE & UINT32_C(0xfffff000)) + (off0 & 0xfff), pUrb->abData, cbTotal);
3284	}
3285
3286	/* setup the packets */
3287	pUrb->cIsocPkts = cFrames - R;
3288	unsigned off = 0;
3289	for (unsigned i = 0; i < pUrb->cIsocPkts; i++)
3290	{
3291	pUrb->aIsocPkts[i].enmStatus = VUSBSTATUS_NOT_ACCESSED;
3292	pUrb->aIsocPkts[i].off = off;
3293	off += pUrb->aIsocPkts[i].cb = aPkts[i].cb;
3294	}
3295	Assert(off == cbTotal);
3296
3297	/*
3298	* Submit the URB.
3299	*/
3300	ohci_in_flight_add_urb(pThis, pUrb);
3301	Log(("%s: ohciServiceIsochronousTd: submitting cbData=%#x cIsocPkts=%d EdAddr=%#010x TdAddr=%#010x SF=%#x (%#x)\n",
3302	pUrb->pszDesc, pUrb->cbData, pUrb->cIsocPkts, EdAddr, ITdAddr, pITd->HwInfo & ITD_HWINFO_SF, pThis->HcFmNumber));
3303	RTCritSectLeave(&pThis->CritSect);
3304	int rc = VUSBIRhSubmitUrb(pThis->RootHub.pIRhConn, pUrb, &pThis->RootHub.Led);
3305	RTCritSectEnter(&pThis->CritSect);
3306	if (RT_SUCCESS(rc))
3307	return true;
3308
3309	/* Failure cleanup. Can happen if we're still resetting the device or out of resources. */
3310	Log(("ohciServiceIsochronousTd: failed submitting pUrb=%p cbData=%#x EdAddr=%#010x cTds=%d ITdAddr0=%#010x - rc=%Rrc\n",
3311	pUrb, cbTotal, EdAddr, 1, ITdAddr, rc));
3312	ohci_in_flight_remove(pThis, ITdAddr);
3313	return false;
3314	}
3315
3316
3317	/**
3318	* Service an isochronous endpoint.
3319	*/
3320	static void ohciServiceIsochronousEndpoint(POHCI pThis, POHCIED pEd, uint32_t EdAddr)
3321	{
3322	/*
3323	* We currently process this as if the guest follows the interrupt end point chaining
3324	* hierarchy described in the documenation. This means that for an isochronous endpoint
3325	* with a 1 ms interval we expect to find in-flight TDs at the head of the list. We will
3326	* skip over all in-flight TDs which timeframe has been exceed. Those which aren't in
3327	* flight but which are too late will be retired (possibly out of order, but, we don't
3328	* care right now).
3329	*
3330	* When we reach a TD which still has a buffer which is due for take off, we will
3331	* stop iterating TDs. If it's in-flight, there isn't anything to be done. Otherwise
3332	* we will push it onto the runway for immediate take off. In this process we
3333	* might have to complete buffers which didn't make it on time, something which
3334	* complicates the kind of status info we need to keep around for the TD.
3335	*
3336	* Note: We're currently not making any attempt at reassembling ITDs into URBs.
3337	* However, this will become necessary because of EMT scheduling and guest
3338	* like linux using one TD for each frame (simple but inefficient for us).
3339	*/
3340	OHCIITD ITd;
3341	uint32_t ITdAddr = pEd->HeadP & ED_PTR_MASK;
3342	uint32_t ITdAddrPrev = 0;
3343	uint32_t u32NextFrame = UINT32_MAX;
3344	const uint16_t u16CurFrame = pThis->HcFmNumber;
3345	for (;;)
3346	{
3347	/* check for end-of-chain. */
3348	if ( ITdAddr == (pEd->TailP & ED_PTR_MASK)
3349	\|\| !ITdAddr)
3350	break;
3351
3352	/*
3353	* If isochronous endpoints are around, don't slow down the timer. Getting the timing right
3354	* is difficult enough as it is.
3355	*/
3356	pThis->fIdle = false;
3357
3358	/*
3359	* Read the current ITD and check what we're supposed to do about it.
3360	*/
3361	ohciReadITd(pThis, ITdAddr, &ITd);
3362	const uint32_t ITdAddrNext = ITd.NextTD & ED_PTR_MASK;
3363	const int16_t R = u16CurFrame - (uint16_t)(ITd.HwInfo & ITD_HWINFO_SF); /* 4.3.2.3 */
3364	const int16_t cFrames = ((ITd.HwInfo & ITD_HWINFO_FC) >> ITD_HWINFO_FC_SHIFT) + 1;
3365
3366	if (R < cFrames)
3367	{
3368	/*
3369	* It's inside the current or a future launch window.
3370	*
3371	* We will try maximize the TD in flight here to deal with EMT scheduling
3372	* issues and similar stuff which will screw up the time. So, we will only
3373	* stop submitting TD when we reach a gap (in time) or end of the list.
3374	*/
3375	if ( R < 0 /* (a future frame) */
3376	&& (uint16_t)u32NextFrame != (uint16_t)(ITd.HwInfo & ITD_HWINFO_SF))
3377	break;
3378	if (ohci_in_flight_find(pThis, ITdAddr) < 0)
3379	if (!ohciServiceIsochronousTd(pThis, &ITd, ITdAddr, R < 0 ? 0 : R, pEd, EdAddr))
3380	break;
3381
3382	ITdAddrPrev = ITdAddr;
3383	}
3384	else
3385	{
3386	#if 1
3387	/*
3388	* Ok, the launch window for this TD has passed.
3389	* If it's not in flight it should be retired with a DataOverrun status (TD).
3390	*
3391	* Don't remove in-flight TDs before they complete.
3392	* Windows will, upon the completion of another ITD it seems, check for if
3393	* any other TDs has been unlinked. If we unlink them before they really
3394	* complete all the packet status codes will be NotAccessed and Windows
3395	* will fail the URB with status USBD_STATUS_ISOCH_REQUEST_FAILED.
3396	*
3397	* I don't know if unlinking TDs out of order could cause similar problems,
3398	* time will show.
3399	*/
3400	int iInFlight = ohci_in_flight_find(pThis, ITdAddr);
3401	if (iInFlight >= 0)
3402	ITdAddrPrev = ITdAddr;
3403	else if (!ohciServiceIsochronousTdUnlink(pThis, &ITd, ITdAddr, ITdAddrPrev,
3404	NULL, pEd, EdAddr))
3405	{
3406	Log(("ohciServiceIsochronousEndpoint: Failed unlinking old ITD.\n"));
3407	break;
3408	}
3409	#else /* BAD IDEA: */
3410	/*
3411	* Ok, the launch window for this TD has passed.
3412	* If it's not in flight it should be retired with a DataOverrun status (TD).
3413	*
3414	* If it's in flight we will try unlink it from the list prematurely to
3415	* help the guest to move on and shorten the list we have to walk. We currently
3416	* are successful with the first URB but then it goes too slowly...
3417	*/
3418	int iInFlight = ohci_in_flight_find(pThis, ITdAddr);
3419	if (!ohciServiceIsochronousTdUnlink(pThis, &ITd, ITdAddr, ITdAddrPrev,
3420	iInFlight < 0 ? NULL : pThis->aInFlight[iInFlight].pUrb,
3421	pEd, EdAddr))
3422	{
3423	Log(("ohciServiceIsochronousEndpoint: Failed unlinking old ITD.\n"));
3424	break;
3425	}
3426	#endif
3427	}
3428
3429	/* advance to the next ITD */
3430	ITdAddr = ITdAddrNext;
3431	u32NextFrame = (ITd.HwInfo & ITD_HWINFO_SF) + cFrames;
3432	}
3433	}
3434
3435
3436	/**
3437	* Checks if a endpoints has TDs queued and is ready to have them processed.
3438	*
3439	* @returns true if it's ok to process TDs.
3440	* @param pEd The endpoint data.
3441	*/
3442	DECLINLINE(bool) ohciIsEdReady(PCOHCIED pEd)
3443	{
3444	return (pEd->HeadP & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
3445	&& !(pEd->HeadP & ED_HEAD_HALTED)
3446	&& !(pEd->hwinfo & ED_HWINFO_SKIP);
3447	}
3448
3449
3450	/**
3451	* Checks if an endpoint has TDs queued (not necessarily ready to have them processed).
3452	*
3453	* @returns true if endpoint may have TDs queued.
3454	* @param pEd The endpoint data.
3455	*/
3456	DECLINLINE(bool) ohciIsEdPresent(PCOHCIED pEd)
3457	{
3458	return (pEd->HeadP & ED_PTR_MASK) != (pEd->TailP & ED_PTR_MASK)
3459	&& !(pEd->HeadP & ED_HEAD_HALTED);
3460	}
3461
3462
3463	/**
3464	* Services the bulk list.
3465	*
3466	* On the bulk list we must reassemble URBs from multiple TDs using heuristics
3467	* derived from USB tracing done in the guests and guest source code (when available).
3468	*/
3469	static void ohciServiceBulkList(POHCI pThis)
3470	{
3471	#ifdef LOG_ENABLED
3472	if (g_fLogBulkEPs)
3473	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk before", true);
3474	if (pThis->bulk_cur)
3475	Log(("ohciServiceBulkList: bulk_cur=%#010x before listprocessing!!! HCD have positioned us!!!\n", pThis->bulk_cur));
3476	#endif
3477
3478	/*
3479	* ", HC will start processing the Bulk list and will set BF [BulkListFilled] to 0"
3480	* - We've simplified and are always starting at the head of the list and working
3481	* our way thru to the end each time.
3482	*/
3483	pThis->status &= ~OHCI_STATUS_BLF;
3484	pThis->fBulkNeedsCleaning = false;
3485	pThis->bulk_cur = 0;
3486
3487	uint32_t EdAddr = pThis->bulk_head;
3488	while (EdAddr)
3489	{
3490	OHCIED Ed;
3491	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3492	ohciReadEdCached(pThis, EdAddr, &Ed);
3493	#else
3494	ohciReadEd(pThis, EdAddr, &Ed);
3495	#endif
3496	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3497	if (ohciIsEdReady(&Ed))
3498	{
3499	pThis->status \|= OHCI_STATUS_BLF;
3500	pThis->fBulkNeedsCleaning = true;
3501
3502	#if 1
3503	/*
3504
3505	* After we figured out that all the TDs submitted for dealing with MSD
3506	* read/write data really makes up on single URB, and that we must
3507	* reassemble these TDs into an URB before submitting it, there is no
3508	* longer any need for servicing anything other than the head URB
3509	* on a bulk endpoint.
3510	*/
3511	ohciServiceHeadTdMultiple(pThis, VUSBXFERTYPE_BULK, &Ed, EdAddr, "Bulk");
3512	#else
3513	/*
3514	* This alternative code was used before we started reassembling URBs from
3515	* multiple TDs. We keep it handy for debugging.
3516	*/
3517	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3518	if (!ohciIsTdInFlight(pThis, TdAddr))
3519	{
3520	do
3521	{
3522	if (!ohciServiceTdMultiple(pThis, VUSBXFERTYPE_BULK, &Ed, EdAddr, TdAddr, &TdAddr, "Bulk"))
3523	{
3524	LogFlow(("ohciServiceBulkList: ohciServiceTdMultiple -> false\n"));
3525	break;
3526	}
3527	if ( (TdAddr & ED_PTR_MASK) == (Ed.TailP & ED_PTR_MASK)
3528	\|\| !TdAddr /* paranoia */)
3529	{
3530	LogFlow(("ohciServiceBulkList: TdAddr=%#010RX32 Ed.TailP=%#010RX32\n", TdAddr, Ed.TailP));
3531	break;
3532	}
3533
3534	ohciReadEd(pThis, EdAddr, &Ed); /* It might have been updated on URB completion. */
3535	} while (ohciIsEdReady(&Ed));
3536	}
3537	#endif
3538	}
3539	else
3540	{
3541	if (Ed.hwinfo & ED_HWINFO_SKIP)
3542	{
3543	LogFlow(("ohciServiceBulkList: Ed=%#010RX32 Ed.TailP=%#010RX32 SKIP\n", EdAddr, Ed.TailP));
3544	/* If the ED is in 'skip' state, no transactions on it are allowed and we must
3545	* cancel outstanding URBs, if any.
3546	*/
3547	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3548	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3549	if (pUrb)
3550	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3551	}
3552	}
3553
3554	/* next end point */
3555	EdAddr = Ed.NextED & ED_PTR_MASK;
3556
3557	}
3558
3559	#ifdef LOG_ENABLED
3560	if (g_fLogBulkEPs)
3561	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk after ", true);
3562	#endif
3563	}
3564
3565	/**
3566	* Abort outstanding transfers on the bulk list.
3567	*
3568	* If the guest disabled bulk list processing, we must abort any outstanding transfers
3569	* (that is, cancel in-flight URBs associated with the list). This is required because
3570	* there may be outstanding read URBs that will never get a response from the device
3571	* and would block further communication.
3572	*/
3573	static void ohciUndoBulkList(POHCI pThis)
3574	{
3575	#ifdef LOG_ENABLED
3576	if (g_fLogBulkEPs)
3577	ohciDumpEdList(pThis, pThis->bulk_head, "Bulk before", true);
3578	if (pThis->bulk_cur)
3579	Log(("ohciUndoBulkList: bulk_cur=%#010x before list processing!!! HCD has positioned us!!!\n", pThis->bulk_cur));
3580	#endif
3581
3582	/* This flag follows OHCI_STATUS_BLF, but BLF doesn't change when list processing is disabled. */
3583	pThis->fBulkNeedsCleaning = false;
3584
3585	uint32_t EdAddr = pThis->bulk_head;
3586	while (EdAddr)
3587	{
3588	OHCIED Ed;
3589	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3590	ohciReadEdCached(pThis, EdAddr, &Ed);
3591	#else
3592	ohciReadEd(pThis, EdAddr, &Ed);
3593	#endif
3594	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3595	if (ohciIsEdPresent(&Ed))
3596	{
3597	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3598	if (ohciIsTdInFlight(pThis, TdAddr))
3599	{
3600	LogFlow(("ohciUndoBulkList: Ed=%#010RX32 Ed.TailP=%#010RX32 UNDO\n", EdAddr, Ed.TailP));
3601	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3602	if (pUrb)
3603	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3604	}
3605	}
3606	/* next endpoint */
3607	EdAddr = Ed.NextED & ED_PTR_MASK;
3608	}
3609	}
3610
3611
3612	/**
3613	* Services the control list.
3614	*
3615	* The control list has complex URB assembling, but that's taken
3616	* care of at VUSB level (unlike the other transfer types).
3617	*/
3618	static void ohciServiceCtrlList(POHCI pThis)
3619	{
3620	#ifdef LOG_ENABLED
3621	if (g_fLogControlEPs)
3622	ohciDumpEdList(pThis, pThis->ctrl_head, "Ctrl before", true);
3623	if (pThis->ctrl_cur)
3624	Log(("ohciServiceCtrlList: ctrl_cur=%010x before list processing!!! HCD have positioned us!!!\n", pThis->ctrl_cur));
3625	#endif
3626
3627	/*
3628	* ", HC will start processing the list and will set ControlListFilled to 0"
3629	* - We've simplified and are always starting at the head of the list and working
3630	* our way thru to the end each time.
3631	*/
3632	pThis->status &= ~OHCI_STATUS_CLF;
3633	pThis->ctrl_cur = 0;
3634
3635	uint32_t EdAddr = pThis->ctrl_head;
3636	while (EdAddr)
3637	{
3638	OHCIED Ed;
3639	ohciReadEd(pThis, EdAddr, &Ed);
3640	Assert(!(Ed.hwinfo & ED_HWINFO_ISO)); /* the guest is screwing us */
3641	if (ohciIsEdReady(&Ed))
3642	{
3643	#if 1
3644	/*
3645	* Control TDs depends on order and stage. Only one can be in-flight
3646	* at any given time. OTOH, some stages are completed immediately,
3647	* so we process the list until we've got a head which is in-flight
3648	* or reach the end of the list.
3649	*/
3650	do
3651	{
3652	if ( !ohciServiceHeadTd(pThis, VUSBXFERTYPE_CTRL, &Ed, EdAddr, "Control")
3653	\|\| ohciIsTdInFlight(pThis, Ed.HeadP & ED_PTR_MASK))
3654	{
3655	pThis->status \|= OHCI_STATUS_CLF;
3656	break;
3657	}
3658	ohciReadEd(pThis, EdAddr, &Ed); /* It might have been updated on URB completion. */
3659	} while (ohciIsEdReady(&Ed));
3660	#else
3661	/* Simplistic, for debugging. */
3662	ohciServiceHeadTd(pThis, VUSBXFERTYPE_CTRL, &Ed, EdAddr, "Control");
3663	pThis->status \|= OHCI_STATUS_CLF;
3664	#endif
3665	}
3666
3667	/* next end point */
3668	EdAddr = Ed.NextED & ED_PTR_MASK;
3669	}
3670
3671	#ifdef LOG_ENABLED
3672	if (g_fLogControlEPs)
3673	ohciDumpEdList(pThis, pThis->ctrl_head, "Ctrl after ", true);
3674	#endif
3675	}
3676
3677
3678	/**
3679	* Services the periodic list.
3680	*
3681	* On the interrupt portion of the periodic list we must reassemble URBs from multiple
3682	* TDs using heuristics derived from USB tracing done in the guests and guest source
3683	* code (when available).
3684	*/
3685	static void ohciServicePeriodicList(POHCI pThis)
3686	{
3687	/*
3688	* Read the list head from the HCCA.
3689	*/
3690	const unsigned iList = pThis->HcFmNumber % OHCI_HCCA_NUM_INTR;
3691	uint32_t EdAddr;
3692	ohciGetDWords(pThis, pThis->hcca + iList * sizeof(EdAddr), &EdAddr, 1);
3693
3694	#ifdef LOG_ENABLED
3695	const uint32_t EdAddrHead = EdAddr;
3696	if (g_fLogInterruptEPs)
3697	{
3698	char sz[48];
3699	RTStrPrintf(sz, sizeof(sz), "Int%02x before", iList);
3700	ohciDumpEdList(pThis, EdAddrHead, sz, true);
3701	}
3702	#endif
3703
3704	/*
3705	* Iterate the endpoint list.
3706	*/
3707	while (EdAddr)
3708	{
3709	OHCIED Ed;
3710	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3711	ohciReadEdCached(pThis, EdAddr, &Ed);
3712	#else
3713	ohciReadEd(pThis, EdAddr, &Ed);
3714	#endif
3715
3716	if (ohciIsEdReady(&Ed))
3717	{
3718	/*
3719	* "There is no separate head pointer of isochronous transfers. The first
3720	* isochronous Endpoint Descriptor simply links to the last interrupt
3721	* Endpoint Descriptor."
3722	*/
3723	if (!(Ed.hwinfo & ED_HWINFO_ISO))
3724	{
3725	/*
3726	* Presently we will only process the head URB on an interrupt endpoint.
3727	*/
3728	ohciServiceHeadTdMultiple(pThis, VUSBXFERTYPE_INTR, &Ed, EdAddr, "Periodic");
3729	}
3730	else if (pThis->ctl & OHCI_CTL_IE)
3731	{
3732	/*
3733	* Presently only the head ITD.
3734	*/
3735	ohciServiceIsochronousEndpoint(pThis, &Ed, EdAddr);
3736	}
3737	else
3738	break;
3739	}
3740	else
3741	{
3742	if (Ed.hwinfo & ED_HWINFO_SKIP)
3743	{
3744	LogFlow(("ohciServicePeriodicList: Ed=%#010RX32 Ed.TailP=%#010RX32 SKIP\n", EdAddr, Ed.TailP));
3745	/* If the ED is in 'skip' state, no transactions on it are allowed and we must
3746	* cancel outstanding URBs, if any.
3747	*/
3748	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3749	PVUSBURB pUrb = ohciTdInFlightUrb(pThis, TdAddr);
3750	if (pUrb)
3751	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3752	}
3753	}
3754	/* next end point */
3755	EdAddr = Ed.NextED & ED_PTR_MASK;
3756	}
3757
3758	#ifdef LOG_ENABLED
3759	if (g_fLogInterruptEPs)
3760	{
3761	char sz[48];
3762	RTStrPrintf(sz, sizeof(sz), "Int%02x after ", iList);
3763	ohciDumpEdList(pThis, EdAddrHead, sz, true);
3764	}
3765	#endif
3766	}
3767
3768
3769	/**
3770	* Update the HCCA.
3771	*
3772	* @param pThis The OHCI instance data.
3773	*/
3774	static void ohciUpdateHCCA(POHCI pThis)
3775	{
3776	struct ohci_hcca hcca;
3777	ohciPhysRead(pThis, pThis->hcca + OHCI_HCCA_OFS, &hcca, sizeof(hcca));
3778
3779	hcca.frame = RT_H2LE_U16((uint16_t)pThis->HcFmNumber);
3780	hcca.pad = 0;
3781
3782	bool fWriteDoneHeadInterrupt = false;
3783	if ( pThis->dqic == 0
3784	&& (pThis->intr_status & OHCI_INTR_WRITE_DONE_HEAD) == 0)
3785	{
3786	uint32_t done = pThis->done;
3787
3788	if (pThis->intr_status & ~( OHCI_INTR_MASTER_INTERRUPT_ENABLED \| OHCI_INTR_OWNERSHIP_CHANGE
3789	\| OHCI_INTR_WRITE_DONE_HEAD) )
3790	done \|= 0x1;
3791
3792	hcca.done = RT_H2LE_U32(done);
3793	pThis->done = 0;
3794	pThis->dqic = 0x7;
3795
3796	Log(("ohci: Writeback Done (%#010x) on frame %#x (age %#x)\n", hcca.done,
3797	pThis->HcFmNumber, pThis->HcFmNumber - pThis->u32FmDoneQueueTail));
3798	#ifdef LOG_ENABLED
3799	ohciDumpTdQueue(pThis, hcca.done & ED_PTR_MASK, "DoneQueue");
3800	#endif
3801	Assert(RT_OFFSETOF(struct ohci_hcca, done) == 4);
3802	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
3803	ohci_in_done_queue_zap(pThis);
3804	#endif
3805	fWriteDoneHeadInterrupt = true;
3806	}
3807
3808	ohciPhysWrite(pThis, pThis->hcca + OHCI_HCCA_OFS, (uint8_t *)&hcca, sizeof(hcca));
3809	if (fWriteDoneHeadInterrupt)
3810	ohciR3SetInterrupt(pThis, OHCI_INTR_WRITE_DONE_HEAD);
3811	}
3812
3813
3814	/**
3815	* Go over the in-flight URB list and cancel any URBs that are no longer in use.
3816	* This occurs when the host removes EDs or TDs from the lists and we don't notice
3817	* the sKip bit. Such URBs must be promptly canceled, otherwise there is a risk
3818	* they might "steal" data destined for another URB.
3819	*/
3820	static void ohciCancelOrphanedURBs(POHCI pThis)
3821	{
3822	bool fValidHCCA = !( pThis->hcca >= OHCI_HCCA_MASK
3823	\|\| pThis->hcca < ~OHCI_HCCA_MASK);
3824	unsigned i, cLeft;
3825	int j;
3826	uint32_t EdAddr;
3827	PVUSBURB pUrb;
3828
3829	/* If the HCCA is not currently valid, or there are no in-flight URBs,
3830	* there's nothing to do.
3831	*/
3832	if (!fValidHCCA \|\| !pThis->cInFlight)
3833	return;
3834
3835	/* Initially mark all in-flight URBs as inactive. */
3836	for (i = 0, cLeft = pThis->cInFlight; cLeft && i < RT_ELEMENTS(pThis->aInFlight); i++)
3837	{
3838	if (pThis->aInFlight[i].pUrb)
3839	{
3840	pThis->aInFlight[i].fInactive = true;
3841	cLeft--;
3842	}
3843	}
3844	Assert(cLeft == 0);
3845
3846	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3847	/* Get hcca data to minimize calls to ohciGetDWords/PDMDevHlpPhysRead. */
3848	uint32_t au32HCCA[OHCI_HCCA_NUM_INTR];
3849	ohciGetDWords(pThis, pThis->hcca, au32HCCA, OHCI_HCCA_NUM_INTR);
3850	#endif
3851
3852	/* Go over all bulk/control/interrupt endpoint lists; any URB found in these lists
3853	* is marked as active again.
3854	*/
3855	for (i = 0; i < OHCI_HCCA_NUM_INTR + 2; i++)
3856	{
3857	switch (i)
3858	{
3859	case OHCI_HCCA_NUM_INTR:
3860	EdAddr = pThis->bulk_head;
3861	break;
3862	case OHCI_HCCA_NUM_INTR + 1:
3863	EdAddr = pThis->ctrl_head;
3864	break;
3865	default:
3866	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3867	EdAddr = au32HCCA[i];
3868	#else
3869	ohciGetDWords(pThis, pThis->hcca + i * sizeof(EdAddr), &EdAddr, 1);
3870	#endif
3871	break;
3872	}
3873	while (EdAddr)
3874	{
3875	OHCIED Ed;
3876	OHCITD Td;
3877	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3878	ohciReadEdCached(pThis, EdAddr, &Ed);
3879	#else
3880	ohciReadEd(pThis, EdAddr, &Ed);
3881	#endif
3882	uint32_t TdAddr = Ed.HeadP & ED_PTR_MASK;
3883	uint32_t TailP = Ed.TailP & ED_PTR_MASK;
3884	unsigned k = 0;
3885	if ( !(Ed.hwinfo & ED_HWINFO_SKIP)
3886	&& (TdAddr != TailP))
3887	{
3888	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3889	ohciPhysReadCacheClear(pThis->pCacheTD);
3890	#endif
3891	do
3892	{
3893	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
3894	ohciReadTdCached(pThis, TdAddr, &Td);
3895	#else
3896	ohciReadTd(pThis, TdAddr, &Td);
3897	#endif
3898	j = ohci_in_flight_find(pThis, TdAddr);
3899	if (j > -1)
3900	pThis->aInFlight[j].fInactive = false;
3901	TdAddr = Td.NextTD & ED_PTR_MASK;
3902	/* See #8125.
3903	* Sometimes the ED is changed by the guest between ohciReadEd above and here.
3904	* Then the code reads TD pointed by the new TailP, which is not allowed.
3905	* Luckily Windows guests have Td.NextTD = 0 in the tail TD.
3906	* Also having a real TD at 0 is very unlikely.
3907	* So do not continue.
3908	*/
3909	if (TdAddr == 0)
3910	break;
3911	/* Failsafe for temporarily looped lists. */
3912	if (++k == 128)
3913	break;
3914	} while (TdAddr != (Ed.TailP & ED_PTR_MASK));
3915	}
3916	EdAddr = Ed.NextED & ED_PTR_MASK;
3917	}
3918	}
3919
3920	/* In-flight URBs still marked as inactive are not used anymore and need
3921	* to be canceled.
3922	*/
3923	for (i = 0, cLeft = pThis->cInFlight; cLeft && i < RT_ELEMENTS(pThis->aInFlight); i++)
3924	{
3925	if (pThis->aInFlight[i].pUrb)
3926	{
3927	cLeft--;
3928	pUrb = pThis->aInFlight[i].pUrb;
3929	if (pThis->aInFlight[i].fInactive
3930	&& pUrb->enmState == VUSBURBSTATE_IN_FLIGHT
3931	&& pUrb->enmType != VUSBXFERTYPE_CTRL)
3932	pThis->RootHub.pIRhConn->pfnCancelUrbsEp(pThis->RootHub.pIRhConn, pUrb);
3933	}
3934	}
3935	Assert(cLeft == 0);
3936	}
3937
3938	/**
3939	* Generate a Start-Of-Frame event, and set a timer for End-Of-Frame.
3940	*/
3941	static void ohciStartOfFrame(POHCI pThis)
3942	{
3943	#ifdef LOG_ENABLED
3944	const uint32_t status_old = pThis->status;
3945	#endif
3946
3947	/*
3948	* Update HcFmRemaining.FRT and update start of frame time.
3949	*/
3950	pThis->frt = pThis->fit;
3951	pThis->SofTime += pThis->cTicksPerFrame;
3952
3953	/*
3954	* Check that the HCCA address isn't bogus. Linux 2.4.x is known to start
3955	* the bus with a hcca of 0 to work around problem with a specific controller.
3956	*/
3957	bool fValidHCCA = !( pThis->hcca >= OHCI_HCCA_MASK
3958	\|\| pThis->hcca < ~OHCI_HCCA_MASK);
3959
3960	#if 1
3961	/*
3962	* Update the HCCA.
3963	* Should be done after SOF but before HC read first ED in this frame.
3964	*/
3965	if (fValidHCCA)
3966	ohciUpdateHCCA(pThis);
3967	#endif
3968
3969	/* "After writing to HCCA, HC will set SF in HcInterruptStatus" - guest isn't executing, so ignore the order! */
3970	ohciR3SetInterrupt(pThis, OHCI_INTR_START_OF_FRAME);
3971
3972	if (pThis->fno)
3973	{
3974	ohciR3SetInterrupt(pThis, OHCI_INTR_FRAMENUMBER_OVERFLOW);
3975	pThis->fno = 0;
3976	}
3977
3978	/* If the HCCA address is invalid, we're quitting here to avoid doing something which cannot be reported to the HCD. */
3979	if (!fValidHCCA)
3980	{
3981	Log(("ohciStartOfFrame: skipping hcca part because hcca=%RX32 (our 'valid' range: %RX32-%RX32)\n",
3982	pThis->hcca, ~OHCI_HCCA_MASK, OHCI_HCCA_MASK));
3983	return;
3984	}
3985
3986	/*
3987	* Periodic EPs.
3988	*/
3989	if (pThis->ctl & OHCI_CTL_PLE)
3990	ohciServicePeriodicList(pThis);
3991
3992	/*
3993	* Control EPs.
3994	*/
3995	if ( (pThis->ctl & OHCI_CTL_CLE)
3996	&& (pThis->status & OHCI_STATUS_CLF) )
3997	ohciServiceCtrlList(pThis);
3998
3999	/*
4000	* Bulk EPs.
4001	*/
4002	if ( (pThis->ctl & OHCI_CTL_BLE)
4003	&& (pThis->status & OHCI_STATUS_BLF))
4004	ohciServiceBulkList(pThis);
4005	else if ((pThis->status & OHCI_STATUS_BLF)
4006	&& pThis->fBulkNeedsCleaning)
4007	ohciUndoBulkList(pThis); /* If list disabled but not empty, abort endpoints. */
4008
4009	#if 0
4010	/*
4011	* Update the HCCA after processing the lists and everything. A bit experimental.
4012	*
4013	* ASSUME the guest won't be very upset if a TD is completed, retired and handed
4014	* back immediately. The idea is to be able to retire the data and/or status stages
4015	* of a control transfer together with the setup stage, thus saving a frame. This
4016	* behaviour is should be perfectly ok, since the setup (and maybe data) stages
4017	* have already taken at least one frame to complete.
4018	*
4019	* But, when implementing the first synchronous virtual USB devices, we'll have to
4020	* verify that the guest doesn't choke when having a TD returned in the same frame
4021	* as it was submitted.
4022	*/
4023	ohciUpdateHCCA(pThis);
4024	#endif
4025
4026	#ifdef LOG_ENABLED
4027	if (pThis->status ^ status_old)
4028	{
4029	uint32_t val = pThis->status;
4030	uint32_t chg = val ^ status_old; NOREF(chg);
4031	Log2(("ohciStartOfFrame: HcCommandStatus=%#010x: %sHCR=%d %sCLF=%d %sBLF=%d %sOCR=%d %sSOC=%d\n",
4032	val,
4033	chg & RT_BIT(0) ? "*" : "", val & 1,
4034	chg & RT_BIT(1) ? "*" : "", (val >> 1) & 1,
4035	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
4036	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
4037	chg & (3<<16)? "*" : "", (val >> 16) & 3));
4038	}
4039	#endif
4040	}
4041
4042	/**
4043	* Updates the HcFmNumber and FNO registers.
4044	*/
4045	static void bump_frame_number(POHCI pThis)
4046	{
4047	const uint16_t u16OldFmNumber = pThis->HcFmNumber++;
4048	if ((u16OldFmNumber ^ pThis->HcFmNumber) & RT_BIT(15))
4049	pThis->fno = 1;
4050	}
4051
4052	/**
4053	* Callback for periodic frame processing.
4054	*/
4055	static DECLCALLBACK(bool) ohciR3StartFrame(PVUSBIROOTHUBPORT pInterface, uint32_t u32FrameNo)
4056	{
4057	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
4058
4059	RTCritSectEnter(&pThis->CritSect);
4060
4061	/* Reset idle detection flag */
4062	pThis->fIdle = true;
4063
4064	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
4065	physReadStatsReset(&physReadStats);
4066	#endif
4067
4068	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
4069	ohciPhysReadCacheClear(pThis->pCacheED);
4070	ohciPhysReadCacheClear(pThis->pCacheTD);
4071	#endif
4072
4073	/* Frame boundary, so do EOF stuff here. */
4074	bump_frame_number(pThis);
4075	if ( (pThis->dqic != 0x7) && (pThis->dqic != 0))
4076	pThis->dqic--;
4077
4078	/* Clean up any URBs that have been removed. */
4079	ohciCancelOrphanedURBs(pThis);
4080
4081	/* Start the next frame. */
4082	ohciStartOfFrame(pThis);
4083
4084	#ifdef VBOX_WITH_OHCI_PHYS_READ_STATS
4085	physReadStatsPrint(&physReadStats);
4086	#endif
4087
4088	RTCritSectLeave(&pThis->CritSect);
4089
4090	return pThis->fIdle;
4091	}
4092
4093	/**
4094	* @copydoc VUSBIROOTHUBPORT::pfnFramerateChanged.
4095	*/
4096	static DECLCALLBACK(void) ohciR3FrameRateChanged(PVUSBIROOTHUBPORT pInterface, uint32_t u32FrameRate)
4097	{
4098	POHCI pThis = VUSBIROOTHUBPORT_2_OHCI(pInterface);
4099
4100	Assert(u32FrameRate <= OHCI_DEFAULT_TIMER_FREQ);
4101
4102	pThis->cTicksPerFrame = pThis->u64TimerHz / u32FrameRate;
4103	if (!pThis->cTicksPerFrame)
4104	pThis->cTicksPerFrame = 1;
4105	pThis->cTicksPerUsbTick = pThis->u64TimerHz >= VUSB_BUS_HZ ? pThis->u64TimerHz / VUSB_BUS_HZ : 1;
4106	}
4107
4108	/**
4109	* Do frame processing on frame boundary
4110	*/
4111	static DECLCALLBACK(void) ohciFrameBoundaryTimer(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser)
4112	{
4113	}
4114
4115	/**
4116	* Start sending SOF tokens across the USB bus, lists are processed in
4117	* next frame
4118	*/
4119	static void ohciBusStart(POHCI pThis)
4120	{
4121	VUSBIDevPowerOn(pThis->RootHub.pIDev);
4122	pThis->dqic = 0x7;
4123
4124	Log(("ohci: %s: Bus started\n", pThis->PciDev.name));
4125
4126	pThis->SofTime = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns));
4127	int rc = pThis->RootHub.pIRhConn->pfnSetPeriodicFrameProcessing(pThis->RootHub.pIRhConn, OHCI_DEFAULT_TIMER_FREQ);
4128	AssertRC(rc);
4129	}
4130
4131	/**
4132	* Stop sending SOF tokens on the bus
4133	*/
4134	static void ohciBusStop(POHCI pThis)
4135	{
4136	int rc = pThis->RootHub.pIRhConn->pfnSetPeriodicFrameProcessing(pThis->RootHub.pIRhConn, 0);
4137	AssertRC(rc);
4138	VUSBIDevPowerOff(pThis->RootHub.pIDev);
4139	}
4140
4141	/**
4142	* Move in to resume state
4143	*/
4144	static void ohciBusResume(POHCI pThis, bool fHardware)
4145	{
4146	pThis->ctl &= ~OHCI_CTL_HCFS;
4147	pThis->ctl \|= OHCI_USB_RESUME;
4148
4149	Log(("pThis: ohciBusResume fHardware=%RTbool RWE=%s\n",
4150	fHardware, (pThis->ctl & OHCI_CTL_RWE) ? "on" : "off"));
4151
4152	if (fHardware && (pThis->ctl & OHCI_CTL_RWE))
4153	ohciR3SetInterrupt(pThis, OHCI_INTR_RESUME_DETECT);
4154
4155	ohciBusStart(pThis);
4156	}
4157
4158
4159	/* Power a port up or down */
4160	static void rhport_power(POHCIROOTHUB pRh, unsigned iPort, bool fPowerUp)
4161	{
4162	POHCIHUBPORT pPort = &pRh->aPorts[iPort];
4163	bool fOldPPS = !!(pPort->fReg & OHCI_PORT_PPS);
4164	if (fPowerUp)
4165	{
4166	/* power up */
4167	if (pPort->pDev)
4168	pPort->fReg \|= OHCI_PORT_R_CURRENT_CONNECT_STATUS;
4169	if (pPort->fReg & OHCI_PORT_R_CURRENT_CONNECT_STATUS)
4170	pPort->fReg \|= OHCI_PORT_R_POWER_STATUS;
4171	if (pPort->pDev && !fOldPPS)
4172	VUSBIDevPowerOn(pPort->pDev);
4173	}
4174	else
4175	{
4176	/* power down */
4177	pPort->fReg &= ~( OHCI_PORT_R_POWER_STATUS
4178	\| OHCI_PORT_R_CURRENT_CONNECT_STATUS
4179	\| OHCI_PORT_R_SUSPEND_STATUS
4180	\| OHCI_PORT_R_RESET_STATUS);
4181	if (pPort->pDev && fOldPPS)
4182	VUSBIDevPowerOff(pPort->pDev);
4183	}
4184	}
4185
4186	#endif /* IN_RING3 */
4187
4188	/**
4189	* Read the HcRevision register.
4190	*/
4191	static int HcRevision_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4192	{
4193	Log2(("HcRevision_r() -> 0x10\n"));
4194	pu32Value = 0x10; / OHCI revision 1.0, no emulation. */
4195	return VINF_SUCCESS;
4196	}
4197
4198	/**
4199	* Write to the HcRevision register.
4200	*/
4201	static int HcRevision_w(POHCI pThis, uint32_t iReg, uint32_t u32Value)
4202	{
4203	Log2(("HcRevision_w(%#010x) - denied\n", u32Value));
4204	AssertMsgFailed(("Invalid operation!!! u32Value=%#010x\n", u32Value));
4205	return VINF_SUCCESS;
4206	}
4207
4208	/**
4209	* Read the HcControl register.
4210	*/
4211	static int HcControl_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4212	{
4213	uint32_t ctl = pThis->ctl;
4214	Log2(("HcControl_r -> %#010x - CBSR=%d PLE=%d IE=%d CLE=%d BLE=%d HCFS=%#x IR=%d RWC=%d RWE=%d\n",
4215	ctl, ctl & 3, (ctl >> 2) & 1, (ctl >> 3) & 1, (ctl >> 4) & 1, (ctl >> 5) & 1, (ctl >> 6) & 3, (ctl >> 8) & 1,
4216	(ctl >> 9) & 1, (ctl >> 10) & 1));
4217	*pu32Value = ctl;
4218	return VINF_SUCCESS;
4219	}
4220
4221	/**
4222	* Write the HcControl register.
4223	*/
4224	static int HcControl_w(POHCI pThis, uint32_t iReg, uint32_t val)
4225	{
4226	/* log it. */
4227	uint32_t chg = pThis->ctl ^ val; NOREF(chg);
4228	Log2(("HcControl_w(%#010x) => %sCBSR=%d %sPLE=%d %sIE=%d %sCLE=%d %sBLE=%d %sHCFS=%#x %sIR=%d %sRWC=%d %sRWE=%d\n",
4229	val,
4230	chg & 3 ? "*" : "", val & 3,
4231	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
4232	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
4233	chg & RT_BIT(4) ? "*" : "", (val >> 4) & 1,
4234	chg & RT_BIT(5) ? "*" : "", (val >> 5) & 1,
4235	chg & (3 << 6)? "*" : "", (val >> 6) & 3,
4236	chg & RT_BIT(8) ? "*" : "", (val >> 8) & 1,
4237	chg & RT_BIT(9) ? "*" : "", (val >> 9) & 1,
4238	chg & RT_BIT(10) ? "*" : "", (val >> 10) & 1));
4239	if (val & ~0x07ff)
4240	Log2(("Unknown bits %#x are set!!!\n", val & ~0x07ff));
4241
4242	/* see what changed and take action on that. */
4243	uint32_t old_state = pThis->ctl & OHCI_CTL_HCFS;
4244	uint32_t new_state = val & OHCI_CTL_HCFS;
4245
4246	#ifdef IN_RING3
4247	pThis->ctl = val;
4248	if (new_state != old_state)
4249	{
4250	switch (new_state)
4251	{
4252	case OHCI_USB_OPERATIONAL:
4253	LogRel(("OHCI: USB Operational\n"));
4254	ohciBusStart(pThis);
4255	break;
4256	case OHCI_USB_SUSPEND:
4257	ohciBusStop(pThis);
4258	LogRel(("OHCI: USB Suspended\n"));
4259	break;
4260	case OHCI_USB_RESUME:
4261	LogRel(("OHCI: USB Resume\n"));
4262	ohciBusResume(pThis, false /* not hardware */);
4263	break;
4264	case OHCI_USB_RESET:
4265	{
4266	LogRel(("OHCI: USB Reset\n"));
4267	ohciBusStop(pThis);
4268	/** @todo This should probably do a real reset, but we don't implement
4269	* that correctly in the roothub reset callback yet. check it's
4270	* comments and argument for more details. */
4271	VUSBIDevReset(pThis->RootHub.pIDev, false /* don't do a real reset */, NULL, NULL, NULL);
4272	break;
4273	}
4274	}
4275	}
4276	#else /* !IN_RING3 */
4277	if ( new_state != old_state )
4278	{
4279	Log2(("HcControl_w: state changed -> VINF_IOM_R3_MMIO_WRITE\n"));
4280	return VINF_IOM_R3_MMIO_WRITE;
4281	}
4282	pThis->ctl = val;
4283	#endif /* !IN_RING3 */
4284
4285	return VINF_SUCCESS;
4286	}
4287
4288	/**
4289	* Read the HcCommandStatus register.
4290	*/
4291	static int HcCommandStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4292	{
4293	uint32_t status = pThis->status;
4294	Log2(("HcCommandStatus_r() -> %#010x - HCR=%d CLF=%d BLF=%d OCR=%d SOC=%d\n",
4295	status, status & 1, (status >> 1) & 1, (status >> 2) & 1, (status >> 3) & 1, (status >> 16) & 3));
4296	*pu32Value = status;
4297	return VINF_SUCCESS;
4298	}
4299
4300	/**
4301	* Write to the HcCommandStatus register.
4302	*/
4303	static int HcCommandStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4304	{
4305	/* log */
4306	uint32_t chg = pThis->status ^ val; NOREF(chg);
4307	Log2(("HcCommandStatus_w(%#010x) => %sHCR=%d %sCLF=%d %sBLF=%d %sOCR=%d %sSOC=%d\n",
4308	val,
4309	chg & RT_BIT(0) ? "*" : "", val & 1,
4310	chg & RT_BIT(1) ? "*" : "", (val >> 1) & 1,
4311	chg & RT_BIT(2) ? "*" : "", (val >> 2) & 1,
4312	chg & RT_BIT(3) ? "*" : "", (val >> 3) & 1,
4313	chg & (3<<16)? "!!!":"", (pThis->status >> 16) & 3));
4314	if (val & ~0x0003000f)
4315	Log2(("Unknown bits %#x are set!!!\n", val & ~0x0003000f));
4316
4317	/* SOC is read-only */
4318	val = (val & ~OHCI_STATUS_SOC);
4319
4320	#ifdef IN_RING3
4321	/* "bits written as '0' remain unchanged in the register" */
4322	pThis->status \|= val;
4323	if (pThis->status & OHCI_STATUS_HCR)
4324	{
4325	LogRel(("OHCI: Software reset\n"));
4326	ohciDoReset(pThis, OHCI_USB_SUSPEND, false /* N/A */);
4327	}
4328	#else
4329	if ((pThis->status \| val) & OHCI_STATUS_HCR)
4330	{
4331	LogFlow(("HcCommandStatus_w: reset -> VINF_IOM_R3_MMIO_WRITE\n"));
4332	return VINF_IOM_R3_MMIO_WRITE;
4333	}
4334	pThis->status \|= val;
4335	#endif
4336	return VINF_SUCCESS;
4337	}
4338
4339	/**
4340	* Read the HcInterruptStatus register.
4341	*/
4342	static int HcInterruptStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4343	{
4344	uint32_t val = pThis->intr_status;
4345	Log2(("HcInterruptStatus_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d\n",
4346	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4347	(val >> 6) & 1, (val >> 30) & 1));
4348	*pu32Value = val;
4349	return VINF_SUCCESS;
4350	}
4351
4352	/**
4353	* Write to the HcInterruptStatus register.
4354	*/
4355	static int HcInterruptStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4356	{
4357	uint32_t res = pThis->intr_status & ~val;
4358	uint32_t chg = pThis->intr_status ^ res; NOREF(chg);
4359
4360	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4361	if (rc != VINF_SUCCESS)
4362	return rc;
4363
4364	Log2(("HcInterruptStatus_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d\n",
4365	val,
4366	chg & RT_BIT(0) ? "*" : "", res & 1,
4367	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4368	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4369	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4370	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4371	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4372	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4373	chg & RT_BIT(30)? "*" : "", (res >> 30) & 1));
4374	if ( (val & ~0xc000007f)
4375	&& val != 0xffffffff /* ignore clear-all-like requests from xp. */)
4376	Log2(("Unknown bits %#x are set!!!\n", val & ~0xc000007f));
4377
4378	/* "The Host Controller Driver may clear specific bits in this
4379	* register by writing '1' to bit positions to be cleared"
4380	*/
4381	pThis->intr_status &= ~val;
4382	ohciUpdateInterruptLocked(pThis, "HcInterruptStatus_w");
4383	PDMCritSectLeave(&pThis->CsIrq);
4384	return VINF_SUCCESS;
4385	}
4386
4387	/**
4388	* Read the HcInterruptEnable register
4389	*/
4390	static int HcInterruptEnable_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4391	{
4392	uint32_t val = pThis->intr;
4393	Log2(("HcInterruptEnable_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
4394	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4395	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1));
4396	*pu32Value = val;
4397	return VINF_SUCCESS;
4398	}
4399
4400	/**
4401	* Writes to the HcInterruptEnable register.
4402	*/
4403	static int HcInterruptEnable_w(POHCI pThis, uint32_t iReg, uint32_t val)
4404	{
4405	uint32_t res = pThis->intr \| val;
4406	uint32_t chg = pThis->intr ^ res; NOREF(chg);
4407
4408	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4409	if (rc != VINF_SUCCESS)
4410	return rc;
4411
4412	Log2(("HcInterruptEnable_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d %sMIE=%d\n",
4413	val,
4414	chg & RT_BIT(0) ? "*" : "", res & 1,
4415	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4416	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4417	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4418	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4419	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4420	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4421	chg & RT_BIT(30) ? "*" : "", (res >> 30) & 1,
4422	chg & RT_BIT(31) ? "*" : "", (res >> 31) & 1));
4423	if (val & ~0xc000007f)
4424	Log2(("Uknown bits %#x are set!!!\n", val & ~0xc000007f));
4425
4426	pThis->intr \|= val;
4427	ohciUpdateInterruptLocked(pThis, "HcInterruptEnable_w");
4428	PDMCritSectLeave(&pThis->CsIrq);
4429	return VINF_SUCCESS;
4430	}
4431
4432	/**
4433	* Reads the HcInterruptDisable register.
4434	*/
4435	static int HcInterruptDisable_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4436	{
4437	#if 1 /** @todo r=bird: "On read, the current value of the HcInterruptEnable register is returned." */
4438	uint32_t val = pThis->intr;
4439	#else /* old code. */
4440	uint32_t val = ~pThis->intr;
4441	#endif
4442	Log2(("HcInterruptDisable_r() -> %#010x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
4443	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
4444	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1));
4445
4446	*pu32Value = val;
4447	return VINF_SUCCESS;
4448	}
4449
4450	/**
4451	* Writes to the HcInterruptDisable register.
4452	*/
4453	static int HcInterruptDisable_w(POHCI pThis, uint32_t iReg, uint32_t val)
4454	{
4455	uint32_t res = pThis->intr & ~val;
4456	uint32_t chg = pThis->intr ^ res; NOREF(chg);
4457
4458	int rc = PDMCritSectEnter(&pThis->CsIrq, VINF_IOM_R3_MMIO_WRITE);
4459	if (rc != VINF_SUCCESS)
4460	return rc;
4461
4462	Log2(("HcInterruptDisable_w(%#010x) => %sSO=%d %sWDH=%d %sSF=%d %sRD=%d %sUE=%d %sFNO=%d %sRHSC=%d %sOC=%d %sMIE=%d\n",
4463	val,
4464	chg & RT_BIT(0) ? "*" : "", res & 1,
4465	chg & RT_BIT(1) ? "*" : "", (res >> 1) & 1,
4466	chg & RT_BIT(2) ? "*" : "", (res >> 2) & 1,
4467	chg & RT_BIT(3) ? "*" : "", (res >> 3) & 1,
4468	chg & RT_BIT(4) ? "*" : "", (res >> 4) & 1,
4469	chg & RT_BIT(5) ? "*" : "", (res >> 5) & 1,
4470	chg & RT_BIT(6) ? "*" : "", (res >> 6) & 1,
4471	chg & RT_BIT(30) ? "*" : "", (res >> 30) & 1,
4472	chg & RT_BIT(31) ? "*" : "", (res >> 31) & 1));
4473	/* Don't bitch about invalid bits here since it makes sense to disable
4474	* interrupts you don't know about. */
4475
4476	pThis->intr &= ~val;
4477	ohciUpdateInterruptLocked(pThis, "HcInterruptDisable_w");
4478	PDMCritSectLeave(&pThis->CsIrq);
4479	return VINF_SUCCESS;
4480	}
4481
4482	/**
4483	* Read the HcHCCA register (Host Controller Communications Area physical address).
4484	*/
4485	static int HcHCCA_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4486	{
4487	Log2(("HcHCCA_r() -> %#010x\n", pThis->hcca));
4488	*pu32Value = pThis->hcca;
4489	return VINF_SUCCESS;
4490	}
4491
4492	/**
4493	* Write to the HcHCCA register (Host Controller Communications Area physical address).
4494	*/
4495	static int HcHCCA_w(POHCI pThis, uint32_t iReg, uint32_t Value)
4496	{
4497	Log2(("HcHCCA_w(%#010x) - old=%#010x new=%#010x\n", Value, pThis->hcca, Value & OHCI_HCCA_MASK));
4498	pThis->hcca = Value & OHCI_HCCA_MASK;
4499	return VINF_SUCCESS;
4500	}
4501
4502	/**
4503	* Read the HcPeriodCurrentED register.
4504	*/
4505	static int HcPeriodCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4506	{
4507	Log2(("HcPeriodCurrentED_r() -> %#010x\n", pThis->per_cur));
4508	*pu32Value = pThis->per_cur;
4509	return VINF_SUCCESS;
4510	}
4511
4512	/**
4513	* Write to the HcPeriodCurrentED register.
4514	*/
4515	static int HcPeriodCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4516	{
4517	Log(("HcPeriodCurrentED_w(%#010x) - old=%#010x new=%#010x (This is a read only register, only the linux guys don't respect that!)\n",
4518	val, pThis->per_cur, val & ~7));
4519	//AssertMsgFailed(("HCD (Host Controller Driver) should not write to HcPeriodCurrentED! val=%#010x (old=%#010x)\n", val, pThis->per_cur));
4520	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4521	pThis->per_cur = val & ~7;
4522	return VINF_SUCCESS;
4523	}
4524
4525	/**
4526	* Read the HcControlHeadED register.
4527	*/
4528	static int HcControlHeadED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4529	{
4530	Log2(("HcControlHeadED_r() -> %#010x\n", pThis->ctrl_head));
4531	*pu32Value = pThis->ctrl_head;
4532	return VINF_SUCCESS;
4533	}
4534
4535	/**
4536	* Write to the HcControlHeadED register.
4537	*/
4538	static int HcControlHeadED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4539	{
4540	Log2(("HcControlHeadED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->ctrl_head, val & ~7));
4541	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4542	pThis->ctrl_head = val & ~7;
4543	return VINF_SUCCESS;
4544	}
4545
4546	/**
4547	* Read the HcControlCurrentED register.
4548	*/
4549	static int HcControlCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4550	{
4551	Log2(("HcControlCurrentED_r() -> %#010x\n", pThis->ctrl_cur));
4552	*pu32Value = pThis->ctrl_cur;
4553	return VINF_SUCCESS;
4554	}
4555
4556	/**
4557	* Write to the HcControlCurrentED register.
4558	*/
4559	static int HcControlCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4560	{
4561	Log2(("HcControlCurrentED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->ctrl_cur, val & ~7));
4562	AssertMsg(!(pThis->ctl & OHCI_CTL_CLE), ("Illegal write! HcControl.ControlListEnabled is set! val=%#010x\n", val));
4563	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4564	pThis->ctrl_cur = val & ~7;
4565	return VINF_SUCCESS;
4566	}
4567
4568	/**
4569	* Read the HcBulkHeadED register.
4570	*/
4571	static int HcBulkHeadED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4572	{
4573	Log2(("HcBulkHeadED_r() -> %#010x\n", pThis->bulk_head));
4574	*pu32Value = pThis->bulk_head;
4575	return VINF_SUCCESS;
4576	}
4577
4578	/**
4579	* Write to the HcBulkHeadED register.
4580	*/
4581	static int HcBulkHeadED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4582	{
4583	Log2(("HcBulkHeadED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->bulk_head, val & ~7));
4584	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4585	pThis->bulk_head = val & ~7; /** @todo The ATI OHCI controller on my machine enforces 16-byte address alignment. */
4586	return VINF_SUCCESS;
4587	}
4588
4589	/**
4590	* Read the HcBulkCurrentED register.
4591	*/
4592	static int HcBulkCurrentED_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4593	{
4594	Log2(("HcBulkCurrentED_r() -> %#010x\n", pThis->bulk_cur));
4595	*pu32Value = pThis->bulk_cur;
4596	return VINF_SUCCESS;
4597	}
4598
4599	/**
4600	* Write to the HcBulkCurrentED register.
4601	*/
4602	static int HcBulkCurrentED_w(POHCI pThis, uint32_t iReg, uint32_t val)
4603	{
4604	Log2(("HcBulkCurrentED_w(%#010x) - old=%#010x new=%#010x\n", val, pThis->bulk_cur, val & ~7));
4605	AssertMsg(!(pThis->ctl & OHCI_CTL_BLE), ("Illegal write! HcControl.BulkListEnabled is set! val=%#010x\n", val));
4606	AssertMsg(!(val & 7), ("Invalid alignment, val=%#010x\n", val));
4607	pThis->bulk_cur = val & ~7;
4608	return VINF_SUCCESS;
4609	}
4610
4611
4612	/**
4613	* Read the HcDoneHead register.
4614	*/
4615	static int HcDoneHead_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4616	{
4617	Log2(("HcDoneHead_r() -> 0x%#08x\n", pThis->done));
4618	*pu32Value = pThis->done;
4619	return VINF_SUCCESS;
4620	}
4621
4622	/**
4623	* Write to the HcDoneHead register.
4624	*/
4625	static int HcDoneHead_w(POHCI pThis, uint32_t iReg, uint32_t val)
4626	{
4627	Log2(("HcDoneHead_w(0x%#08x) - denied!!!\n", val));
4628	/AssertMsgFailed(("Illegal operation!!! val=%#010x\n", val)); - OS/2 does this /
4629	return VINF_SUCCESS;
4630	}
4631
4632
4633	/**
4634	* Read the HcFmInterval (Fm=Frame) register.
4635	*/
4636	static int HcFmInterval_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4637	{
4638	uint32_t val = (pThis->fit << 31) \| (pThis->fsmps << 16) \| (pThis->fi);
4639	Log2(("HcFmInterval_r() -> 0x%#08x - FI=%d FSMPS=%d FIT=%d\n",
4640	val, val & 0x3fff, (val >> 16) & 0x7fff, val >> 31));
4641	*pu32Value = val;
4642	return VINF_SUCCESS;
4643	}
4644
4645	/**
4646	* Write to the HcFmInterval (Fm = Frame) register.
4647	*/
4648	static int HcFmInterval_w(POHCI pThis, uint32_t iReg, uint32_t val)
4649	{
4650	/* log */
4651	uint32_t chg = val ^ ((pThis->fit << 31) \| (pThis->fsmps << 16) \| pThis->fi); NOREF(chg);
4652	Log2(("HcFmInterval_w(%#010x) => %sFI=%d %sFSMPS=%d %sFIT=%d\n",
4653	val,
4654	chg & 0x00003fff ? "*" : "", val & 0x3fff,
4655	chg & 0x7fff0000 ? "*" : "", (val >> 16) & 0x7fff,
4656	chg >> 31 ? "*" : "", (val >> 31) & 1));
4657	if ( pThis->fi != (val & OHCI_FMI_FI) )
4658	{
4659	Log(("ohci: FrameInterval: %#010x -> %#010x\n", pThis->fi, val & OHCI_FMI_FI));
4660	AssertMsg(pThis->fit != ((val >> OHCI_FMI_FIT_SHIFT) & 1), ("HCD didn't toggle the FIT bit!!!\n"));
4661	}
4662
4663	/* update */
4664	pThis->fi = val & OHCI_FMI_FI;
4665	pThis->fit = (val & OHCI_FMI_FIT) >> OHCI_FMI_FIT_SHIFT;
4666	pThis->fsmps = (val & OHCI_FMI_FSMPS) >> OHCI_FMI_FSMPS_SHIFT;
4667	return VINF_SUCCESS;
4668	}
4669
4670	/**
4671	* Read the HcFmRemaining (Fm = Frame) register.
4672	*/
4673	static int HcFmRemaining_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4674	{
4675	uint32_t Value = pThis->frt << 31;
4676	if ((pThis->ctl & OHCI_CTL_HCFS) == OHCI_USB_OPERATIONAL)
4677	{
4678	/*
4679	* Being in USB operational state guarantees SofTime was set already.
4680	*/
4681	uint64_t tks = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns)) - pThis->SofTime;
4682	if (tks < pThis->cTicksPerFrame) /* avoid muldiv if possible */
4683	{
4684	uint16_t fr;
4685	tks = ASMMultU64ByU32DivByU32(1, tks, pThis->cTicksPerUsbTick);
4686	fr = (uint16_t)(pThis->fi - tks);
4687	Value \|= fr;
4688	}
4689	}
4690
4691	Log2(("HcFmRemaining_r() -> %#010x - FR=%d FRT=%d\n", Value, Value & 0x3fff, Value >> 31));
4692	*pu32Value = Value;
4693	return VINF_SUCCESS;
4694	}
4695
4696	/**
4697	* Write to the HcFmRemaining (Fm = Frame) register.
4698	*/
4699	static int HcFmRemaining_w(POHCI pThis, uint32_t iReg, uint32_t val)
4700	{
4701	Log2(("HcFmRemaining_w(%#010x) - denied\n", val));
4702	AssertMsgFailed(("Invalid operation!!! val=%#010x\n", val));
4703	return VINF_SUCCESS;
4704	}
4705
4706	/**
4707	* Read the HcFmNumber (Fm = Frame) register.
4708	*/
4709	static int HcFmNumber_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4710	{
4711	uint32_t val = (uint16_t)pThis->HcFmNumber;
4712	Log2(("HcFmNumber_r() -> %#010x - FN=%#x(%d) (32-bit=%#x(%d))\n", val, val, val, pThis->HcFmNumber, pThis->HcFmNumber));
4713	*pu32Value = val;
4714	return VINF_SUCCESS;
4715	}
4716
4717	/**
4718	* Write to the HcFmNumber (Fm = Frame) register.
4719	*/
4720	static int HcFmNumber_w(POHCI pThis, uint32_t iReg, uint32_t val)
4721	{
4722	Log2(("HcFmNumber_w(%#010x) - denied\n", val));
4723	AssertMsgFailed(("Invalid operation!!! val=%#010x\n", val));
4724	return VINF_SUCCESS;
4725	}
4726
4727	/**
4728	* Read the HcPeriodicStart register.
4729	* The register determines when in a frame to switch from control&bulk to periodic lists.
4730	*/
4731	static int HcPeriodicStart_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4732	{
4733	Log2(("HcPeriodicStart_r() -> %#010x - PS=%d\n", pThis->pstart, pThis->pstart & 0x3fff));
4734	*pu32Value = pThis->pstart;
4735	return VINF_SUCCESS;
4736	}
4737
4738	/**
4739	* Write to the HcPeriodicStart register.
4740	* The register determines when in a frame to switch from control&bulk to periodic lists.
4741	*/
4742	static int HcPeriodicStart_w(POHCI pThis, uint32_t iReg, uint32_t val)
4743	{
4744	Log2(("HcPeriodicStart_w(%#010x) => PS=%d\n", val, val & 0x3fff));
4745	if (val & ~0x3fff)
4746	Log2(("Unknown bits %#x are set!!!\n", val & ~0x3fff));
4747	pThis->pstart = val; /** @todo r=bird: should we support setting the other bits? */
4748	return VINF_SUCCESS;
4749	}
4750
4751	/**
4752	* Read the HcLSThreshold register.
4753	*/
4754	static int HcLSThreshold_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4755	{
4756	Log2(("HcLSThreshold_r() -> %#010x\n", OHCI_LS_THRESH));
4757	*pu32Value = OHCI_LS_THRESH;
4758	return VINF_SUCCESS;
4759	}
4760
4761	/**
4762	* Write to the HcLSThreshold register.
4763	*
4764	* Docs are inconsistent here:
4765	*
4766	* "Neither the Host Controller nor the Host Controller Driver are allowed to change this value."
4767	*
4768	* "This value is calculated by HCD with the consideration of transmission and setup overhead."
4769	*
4770	* The register is marked "R/W" the HCD column.
4771	*
4772	*/
4773	static int HcLSThreshold_w(POHCI pThis, uint32_t iReg, uint32_t val)
4774	{
4775	Log2(("HcLSThreshold_w(%#010x) => LST=0x%03x(%d)\n", val, val & 0x0fff, val & 0x0fff));
4776	AssertMsg(val == OHCI_LS_THRESH,
4777	("HCD tried to write bad LS threshold: 0x%x (see function header)\n", val));
4778	/** @todo the HCD can change this. */
4779	return VINF_SUCCESS;
4780	}
4781
4782	/**
4783	* Read the HcRhDescriptorA register.
4784	*/
4785	static int HcRhDescriptorA_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4786	{
4787	uint32_t val = pThis->RootHub.desc_a;
4788	#if 0 /* annoying */
4789	Log2(("HcRhDescriptorA_r() -> %#010x - NDP=%d PSM=%d NPS=%d DT=%d OCPM=%d NOCP=%d POTGT=%#x\n",
4790	val, val & 0xff, (val >> 8) & 1, (val >> 9) & 1, (val >> 10) & 1, (val >> 11) & 1,
4791	(val >> 12) & 1, (val >> 24) & 0xff));
4792	#endif
4793	*pu32Value = val;
4794	return VINF_SUCCESS;
4795	}
4796
4797	/**
4798	* Write to the HcRhDescriptorA register.
4799	*/
4800	static int HcRhDescriptorA_w(POHCI pThis, uint32_t iReg, uint32_t val)
4801	{
4802	uint32_t chg = val ^ pThis->RootHub.desc_a; NOREF(chg);
4803	Log2(("HcRhDescriptorA_w(%#010x) => %sNDP=%d %sPSM=%d %sNPS=%d %sDT=%d %sOCPM=%d %sNOCP=%d %sPOTGT=%#x - %sPowerSwitching Set%sPower\n",
4804	val,
4805	chg & 0xff ?"!!!": "", val & 0xff,
4806	(chg >> 8) & 1 ? "*" : "", (val >> 8) & 1,
4807	(chg >> 9) & 1 ? "*" : "", (val >> 9) & 1,
4808	(chg >> 10) & 1 ?"!!!": "", 0,
4809	(chg >> 11) & 1 ? "*" : "", (val >> 11) & 1,
4810	(chg >> 12) & 1 ? "*" : "", (val >> 12) & 1,
4811	(chg >> 24)&0xff? "*" : "", (val >> 24) & 0xff,
4812	val & OHCI_RHA_NPS ? "No" : "",
4813	val & OHCI_RHA_PSM ? "Port" : "Global"));
4814	if (val & ~0xff001fff)
4815	Log2(("Unknown bits %#x are set!!!\n", val & ~0xff001fff));
4816
4817
4818	if ((val & (OHCI_RHA_NDP \| OHCI_RHA_DT)) != OHCI_NDP_CFG(pThis))
4819	{
4820	Log(("ohci: %s: invalid write to NDP or DT in roothub descriptor A!!! val=0x%.8x\n",
4821	pThis->PciDev.name, val));
4822	val &= ~(OHCI_RHA_NDP \| OHCI_RHA_DT);
4823	val \|= OHCI_NDP_CFG(pThis);
4824	}
4825
4826	pThis->RootHub.desc_a = val;
4827	return VINF_SUCCESS;
4828	}
4829
4830	/**
4831	* Read the HcRhDescriptorB register.
4832	*/
4833	static int HcRhDescriptorB_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4834	{
4835	uint32_t val = pThis->RootHub.desc_b;
4836	Log2(("HcRhDescriptorB_r() -> %#010x - DR=0x%04x PPCM=0x%04x\n",
4837	val, val & 0xffff, val >> 16));
4838	*pu32Value = val;
4839	return VINF_SUCCESS;
4840	}
4841
4842	/**
4843	* Write to the HcRhDescriptorB register.
4844	*/
4845	static int HcRhDescriptorB_w(POHCI pThis, uint32_t iReg, uint32_t val)
4846	{
4847	uint32_t chg = pThis->RootHub.desc_b ^ val; NOREF(chg);
4848	Log2(("HcRhDescriptorB_w(%#010x) => %sDR=0x%04x %sPPCM=0x%04x\n",
4849	val,
4850	chg & 0xffff ? "!!!" : "", val & 0xffff,
4851	chg >> 16 ? "!!!" : "", val >> 16));
4852
4853	if ( pThis->RootHub.desc_b != val )
4854	Log(("ohci: %s: unsupported write to root descriptor B!!! 0x%.8x -> 0x%.8x\n",
4855	pThis->PciDev.name,
4856	pThis->RootHub.desc_b, val));
4857	pThis->RootHub.desc_b = val;
4858	return VINF_SUCCESS;
4859	}
4860
4861	/**
4862	* Read the HcRhStatus (Rh = Root Hub) register.
4863	*/
4864	static int HcRhStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4865	{
4866	uint32_t val = pThis->RootHub.status;
4867	if (val & (OHCI_RHS_LPSC \| OHCI_RHS_OCIC))
4868	Log2(("HcRhStatus_r() -> %#010x - LPS=%d OCI=%d DRWE=%d LPSC=%d OCIC=%d CRWE=%d\n",
4869	val, val & 1, (val >> 1) & 1, (val >> 15) & 1, (val >> 16) & 1, (val >> 17) & 1, (val >> 31) & 1));
4870	*pu32Value = val;
4871	return VINF_SUCCESS;
4872	}
4873
4874	/**
4875	* Write to the HcRhStatus (Rh = Root Hub) register.
4876	*/
4877	static int HcRhStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
4878	{
4879	#ifdef IN_RING3
4880	/* log */
4881	uint32_t old = pThis->RootHub.status;
4882	uint32_t chg;
4883	if (val & ~0x80038003)
4884	Log2(("HcRhStatus_w: Unknown bits %#x are set!!!\n", val & ~0x80038003));
4885	if ( (val & OHCI_RHS_LPSC) && (val & OHCI_RHS_LPS) )
4886	Log2(("HcRhStatus_w: Warning both CGP and SGP are set! (Clear/Set Global Power)\n"));
4887	if ( (val & OHCI_RHS_DRWE) && (val & OHCI_RHS_CRWE) )
4888	Log2(("HcRhStatus_w: Warning both CRWE and SRWE are set! (Clear/Set Remote Wakeup Enable)\n"));
4889
4890
4891	/* write 1 to clear OCIC */
4892	if ( val & OHCI_RHS_OCIC )
4893	pThis->RootHub.status &= ~OHCI_RHS_OCIC;
4894
4895	/* SetGlobalPower */
4896	if ( val & OHCI_RHS_LPSC )
4897	{
4898	unsigned i;
4899	Log2(("ohci: %s: global power up\n", pThis->PciDev.name));
4900	for (i = 0; i < OHCI_NDP_CFG(pThis); i++)
4901	rhport_power(&pThis->RootHub, i, true /* power up */);
4902	}
4903
4904	/* ClearGlobalPower */
4905	if ( val & OHCI_RHS_LPS )
4906	{
4907	unsigned i;
4908	Log2(("ohci: %s: global power down\n", pThis->PciDev.name));
4909	for (i = 0; i < OHCI_NDP_CFG(pThis); i++)
4910	rhport_power(&pThis->RootHub, i, false /* power down */);
4911	}
4912
4913	if ( val & OHCI_RHS_DRWE )
4914	pThis->RootHub.status \|= OHCI_RHS_DRWE;
4915
4916	if ( val & OHCI_RHS_CRWE )
4917	pThis->RootHub.status &= ~OHCI_RHS_DRWE;
4918
4919	chg = pThis->RootHub.status ^ old;
4920	Log2(("HcRhStatus_w(%#010x) => %sCGP=%d %sOCI=%d %sSRWE=%d %sSGP=%d %sOCIC=%d %sCRWE=%d\n",
4921	val,
4922	chg & 1 ? "*" : "", val & 1,
4923	(chg >> 1) & 1 ?"!!!": "", (val >> 1) & 1,
4924	(chg >> 15) & 1 ? "*" : "", (val >> 15) & 1,
4925	(chg >> 16) & 1 ? "*" : "", (val >> 16) & 1,
4926	(chg >> 17) & 1 ? "*" : "", (val >> 17) & 1,
4927	(chg >> 31) & 1 ? "*" : "", (val >> 31) & 1));
4928	return VINF_SUCCESS;
4929	#else /* !IN_RING3 */
4930	return VINF_IOM_R3_MMIO_WRITE;
4931	#endif /* !IN_RING3 */
4932	}
4933
4934	/**
4935	* Read the HcRhPortStatus register of a port.
4936	*/
4937	static int HcRhPortStatus_r(PCOHCI pThis, uint32_t iReg, uint32_t *pu32Value)
4938	{
4939	const unsigned i = iReg - 21;
4940	uint32_t val = pThis->RootHub.aPorts[i].fReg \| OHCI_PORT_R_POWER_STATUS; /* PortPowerStatus: see todo on power in _w function. */
4941	if (val & OHCI_PORT_R_RESET_STATUS)
4942	{
4943	#ifdef IN_RING3
4944	RTThreadYield();
4945	#else
4946	Log2(("HcRhPortStatus_r: yield -> VINF_IOM_R3_MMIO_READ\n"));
4947	return VINF_IOM_R3_MMIO_READ;
4948	#endif
4949	}
4950	if (val & (OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_CSC \| OHCI_PORT_PESC \| OHCI_PORT_PSSC \| OHCI_PORT_OCIC \| OHCI_PORT_PRSC))
4951	Log2(("HcRhPortStatus_r(): port %u: -> %#010x - CCS=%d PES=%d PSS=%d POCI=%d RRS=%d PPS=%d LSDA=%d CSC=%d PESC=%d PSSC=%d OCIC=%d PRSC=%d\n",
4952	i, val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 8) & 1, (val >> 9) & 1,
4953	(val >> 16) & 1, (val >> 17) & 1, (val >> 18) & 1, (val >> 19) & 1, (val >> 20) & 1));
4954	*pu32Value = val;
4955	return VINF_SUCCESS;
4956	}
4957
4958	#ifdef IN_RING3
4959	/**
4960	* Completion callback for the vusb_dev_reset() operation.
4961	* @thread EMT.
4962	*/
4963	static DECLCALLBACK(void) uchi_port_reset_done(PVUSBIDEVICE pDev, int rc, void *pvUser)
4964	{
4965	POHCI pThis = (POHCI)pvUser;
4966
4967	/*
4968	* Find the port in question
4969	*/
4970	POHCIHUBPORT pPort = NULL;
4971	unsigned iPort;
4972	for (iPort = 0; iPort < OHCI_NDP_CFG(pThis); iPort++) /* lazy bird */
4973	if (pThis->RootHub.aPorts[iPort].pDev == pDev)
4974	{
4975	pPort = &pThis->RootHub.aPorts[iPort];
4976	break;
4977	}
4978	if (!pPort)
4979	{
4980	Assert(pPort); /* sometimes happens because of @bugref{1510} */
4981	return;
4982	}
4983
4984	if (RT_SUCCESS(rc))
4985	{
4986	/*
4987	* Successful reset.
4988	*/
4989	Log2(("uchi_port_reset_done: Reset completed.\n"));
4990	pPort->fReg &= ~(OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_R_SUSPEND_STATUS \| OHCI_PORT_R_SUSPEND_STATUS_CHANGE);
4991	pPort->fReg \|= OHCI_PORT_R_ENABLE_STATUS \| OHCI_PORT_R_RESET_STATUS_CHANGE;
4992	}
4993	else
4994	{
4995	/* desperate measures. */
4996	if ( pPort->pDev
4997	&& VUSBIDevGetState(pPort->pDev) == VUSB_DEVICE_STATE_ATTACHED)
4998	{
4999	/*
5000	* Damn, something weird happened during reset. We'll pretend the user did an
5001	* incredible fast reconnect or something. (probably not gonna work)
5002	*/
5003	Log2(("uchi_port_reset_done: The reset failed (rc=%Rrc)!!! Pretending reconnect at the speed of light.\n", rc));
5004	pPort->fReg = OHCI_PORT_R_CURRENT_CONNECT_STATUS \| OHCI_PORT_R_CONNECT_STATUS_CHANGE;
5005	}
5006	else
5007	{
5008	/*
5009	* The device have / will be disconnected.
5010	*/
5011	Log2(("uchi_port_reset_done: Disconnected (rc=%Rrc)!!!\n", rc));
5012	pPort->fReg &= ~(OHCI_PORT_R_RESET_STATUS \| OHCI_PORT_R_SUSPEND_STATUS \| OHCI_PORT_R_SUSPEND_STATUS_CHANGE \| OHCI_PORT_R_RESET_STATUS_CHANGE);
5013	pPort->fReg \|= OHCI_PORT_R_CONNECT_STATUS_CHANGE;
5014	}
5015	}
5016
5017	/* Raise roothub status change interrupt. */
5018	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
5019	}
5020
5021	/**
5022	* Sets a flag in a port status register but only set it if a device is
5023	* connected, if not set ConnectStatusChange flag to force HCD to reevaluate
5024	* connect status.
5025	*
5026	* @returns true if device was connected and the flag was cleared.
5027	*/
5028	static bool rhport_set_if_connected(POHCIROOTHUB pRh, int iPort, uint32_t fValue)
5029	{
5030	/*
5031	* Writing a 0 has no effect
5032	*/
5033	if (fValue == 0)
5034	return false;
5035
5036	/*
5037	* If CurrentConnectStatus is cleared we set ConnectStatusChange.
5038	*/
5039	if (!(pRh->aPorts[iPort].fReg & OHCI_PORT_R_CURRENT_CONNECT_STATUS))
5040	{
5041	pRh->aPorts[iPort].fReg \|= OHCI_PORT_R_CONNECT_STATUS_CHANGE;
5042	ohciR3SetInterrupt(pRh->pOhci, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
5043	return false;
5044	}
5045
5046	bool fRc = !(pRh->aPorts[iPort].fReg & fValue);
5047
5048	/* set the bit */
5049	pRh->aPorts[iPort].fReg \|= fValue;
5050
5051	return fRc;
5052	}
5053	#endif /* IN_RING3 */
5054
5055	/**
5056	* Write to the HcRhPortStatus register of a port.
5057	*/
5058	static int HcRhPortStatus_w(POHCI pThis, uint32_t iReg, uint32_t val)
5059	{
5060	#ifdef IN_RING3
5061	const unsigned i = iReg - 21;
5062	POHCIHUBPORT p = &pThis->RootHub.aPorts[i];
5063	uint32_t old_state = p->fReg;
5064
5065	#ifdef LOG_ENABLED
5066	/*
5067	* Log it.
5068	*/
5069	static const char *apszCmdNames[32] =
5070	{
5071	"ClearPortEnable", "SetPortEnable", "SetPortSuspend", "!!!ClearSuspendStatus",
5072	"SetPortReset", "!!!5", "!!!6", "!!!7",
5073	"SetPortPower", "ClearPortPower", "!!!10", "!!!11",
5074	"!!!12", "!!!13", "!!!14", "!!!15",
5075	"ClearCSC", "ClearPESC", "ClearPSSC", "ClearOCIC",
5076	"ClearPRSC", "!!!21", "!!!22", "!!!23",
5077	"!!!24", "!!!25", "!!!26", "!!!27",
5078	"!!!28", "!!!29", "!!!30", "!!!31"
5079	};
5080	Log2(("HcRhPortStatus_w(%#010x): port %u:", val, i));
5081	for (unsigned j = 0; j < RT_ELEMENTS(apszCmdNames); j++)
5082	if (val & (1 << j))
5083	Log2((" %s", apszCmdNames[j]));
5084	Log2(("\n"));
5085	#endif
5086
5087	/* Write to clear any of the change bits: CSC, PESC, PSSC, OCIC and PRSC */
5088	if (val & OHCI_PORT_W_CLEAR_CHANGE_MASK)
5089	p->fReg &= ~(val & OHCI_PORT_W_CLEAR_CHANGE_MASK);
5090
5091	if (val & OHCI_PORT_W_CLEAR_ENABLE)
5092	{
5093	p->fReg &= ~OHCI_PORT_R_ENABLE_STATUS;
5094	Log2(("HcRhPortStatus_w(): port %u: DISABLE\n", i));
5095	}
5096
5097	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_ENABLE))
5098	Log2(("HcRhPortStatus_w(): port %u: ENABLE\n", i));
5099
5100	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_SUSPEND))
5101	Log2(("HcRhPortStatus_w(): port %u: SUSPEND - not implemented correctly!!!\n", i));
5102
5103	if (val & OHCI_PORT_W_SET_RESET)
5104	{
5105	if (rhport_set_if_connected(&pThis->RootHub, i, val & OHCI_PORT_W_SET_RESET))
5106	{
5107	PVM pVM = PDMDevHlpGetVM(pThis->CTX_SUFF(pDevIns));
5108	p->fReg &= ~OHCI_PORT_R_RESET_STATUS_CHANGE;
5109	VUSBIDevReset(p->pDev, false /* don't reset on linux */, uchi_port_reset_done, pThis, pVM);
5110	}
5111	else if (p->fReg & OHCI_PORT_R_RESET_STATUS)
5112	{
5113	/* the guest is getting impatient. */
5114	Log2(("HcRhPortStatus_w(): port %u: Impatient guest!\n", i));
5115	RTThreadYield();
5116	}
5117	}
5118
5119	if (!(pThis->RootHub.desc_a & OHCI_RHA_NPS))
5120	{
5121	/** @todo To implement per-device power-switching
5122	* we need to check PortPowerControlMask to make
5123	* sure it isn't gang powered
5124	*/
5125	if (val & OHCI_PORT_W_CLEAR_POWER)
5126	rhport_power(&pThis->RootHub, i, false /* power down */);
5127	if (val & OHCI_PORT_W_SET_POWER)
5128	rhport_power(&pThis->RootHub, i, true /* power up */);
5129	}
5130
5131	/** @todo r=frank: ClearSuspendStatus. Timing? */
5132	if (val & OHCI_PORT_W_CLEAR_SUSPEND_STATUS)
5133	{
5134	rhport_power(&pThis->RootHub, i, true /* power up */);
5135	pThis->RootHub.aPorts[i].fReg &= ~OHCI_PORT_R_SUSPEND_STATUS;
5136	pThis->RootHub.aPorts[i].fReg \|= OHCI_PORT_R_SUSPEND_STATUS_CHANGE;
5137	ohciR3SetInterrupt(pThis, OHCI_INTR_ROOT_HUB_STATUS_CHANGE);
5138	}
5139
5140	if (p->fReg != old_state)
5141	{
5142	uint32_t res = p->fReg;
5143	uint32_t chg = res ^ old_state; NOREF(chg);
5144	Log2(("HcRhPortStatus_w(%#010x): port %u: => %sCCS=%d %sPES=%d %sPSS=%d %sPOCI=%d %sRRS=%d %sPPS=%d %sLSDA=%d %sCSC=%d %sPESC=%d %sPSSC=%d %sOCIC=%d %sPRSC=%d\n",
5145	val, i,
5146	chg & 1 ? "*" : "", res & 1,
5147	(chg >> 1) & 1 ? "*" : "", (res >> 1) & 1,
5148	(chg >> 2) & 1 ? "*" : "", (res >> 2) & 1,
5149	(chg >> 3) & 1 ? "*" : "", (res >> 3) & 1,
5150	(chg >> 4) & 1 ? "*" : "", (res >> 4) & 1,
5151	(chg >> 8) & 1 ? "*" : "", (res >> 8) & 1,
5152	(chg >> 9) & 1 ? "*" : "", (res >> 9) & 1,
5153	(chg >> 16) & 1 ? "*" : "", (res >> 16) & 1,
5154	(chg >> 17) & 1 ? "*" : "", (res >> 17) & 1,
5155	(chg >> 18) & 1 ? "*" : "", (res >> 18) & 1,
5156	(chg >> 19) & 1 ? "*" : "", (res >> 19) & 1,
5157	(chg >> 20) & 1 ? "*" : "", (res >> 20) & 1));
5158	}
5159	return VINF_SUCCESS;
5160	#else /* !IN_RING3 */
5161	return VINF_IOM_R3_MMIO_WRITE;
5162	#endif /* !IN_RING3 */
5163	}
5164
5165	/**
5166	* Register descriptor table
5167	*/
5168	static const OHCIOPREG g_aOpRegs[] =
5169	{
5170	{ "HcRevision", HcRevision_r, HcRevision_w }, /* 0 */
5171	{ "HcControl", HcControl_r, HcControl_w }, /* 1 */
5172	{ "HcCommandStatus", HcCommandStatus_r, HcCommandStatus_w }, /* 2 */
5173	{ "HcInterruptStatus", HcInterruptStatus_r, HcInterruptStatus_w }, /* 3 */
5174	{ "HcInterruptEnable", HcInterruptEnable_r, HcInterruptEnable_w }, /* 4 */
5175	{ "HcInterruptDisable", HcInterruptDisable_r, HcInterruptDisable_w }, /* 5 */
5176	{ "HcHCCA", HcHCCA_r, HcHCCA_w }, /* 6 */
5177	{ "HcPeriodCurrentED", HcPeriodCurrentED_r, HcPeriodCurrentED_w }, /* 7 */
5178	{ "HcControlHeadED", HcControlHeadED_r, HcControlHeadED_w }, /* 8 */
5179	{ "HcControlCurrentED", HcControlCurrentED_r, HcControlCurrentED_w }, /* 9 */
5180	{ "HcBulkHeadED", HcBulkHeadED_r, HcBulkHeadED_w }, /* 10 */
5181	{ "HcBulkCurrentED", HcBulkCurrentED_r, HcBulkCurrentED_w }, /* 11 */
5182	{ "HcDoneHead", HcDoneHead_r, HcDoneHead_w }, /* 12 */
5183	{ "HcFmInterval", HcFmInterval_r, HcFmInterval_w }, /* 13 */
5184	{ "HcFmRemaining", HcFmRemaining_r, HcFmRemaining_w }, /* 14 */
5185	{ "HcFmNumber", HcFmNumber_r, HcFmNumber_w }, /* 15 */
5186	{ "HcPeriodicStart", HcPeriodicStart_r, HcPeriodicStart_w }, /* 16 */
5187	{ "HcLSThreshold", HcLSThreshold_r, HcLSThreshold_w }, /* 17 */
5188	{ "HcRhDescriptorA", HcRhDescriptorA_r, HcRhDescriptorA_w }, /* 18 */
5189	{ "HcRhDescriptorB", HcRhDescriptorB_r, HcRhDescriptorB_w }, /* 19 */
5190	{ "HcRhStatus", HcRhStatus_r, HcRhStatus_w }, /* 20 */
5191
5192	/* The number of port status register depends on the definition
5193	* of OHCI_NDP_MAX macro
5194	*/
5195	{ "HcRhPortStatus[0]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 21 */
5196	{ "HcRhPortStatus[1]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 22 */
5197	{ "HcRhPortStatus[2]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 23 */
5198	{ "HcRhPortStatus[3]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 24 */
5199	{ "HcRhPortStatus[4]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 25 */
5200	{ "HcRhPortStatus[5]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 26 */
5201	{ "HcRhPortStatus[6]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 27 */
5202	{ "HcRhPortStatus[7]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 28 */
5203	{ "HcRhPortStatus[8]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 29 */
5204	{ "HcRhPortStatus[9]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 30 */
5205	{ "HcRhPortStatus[10]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 31 */
5206	{ "HcRhPortStatus[11]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 32 */
5207	{ "HcRhPortStatus[12]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 33 */
5208	{ "HcRhPortStatus[13]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 34 */
5209	{ "HcRhPortStatus[14]", HcRhPortStatus_r, HcRhPortStatus_w }, /* 35 */
5210	};
5211
5212	/* Quick way to determine how many op regs are valid. Since at least one port must
5213	* be configured (and no more than 15), there will be between 22 and 36 registers.
5214	*/
5215	#define NUM_OP_REGS(pohci) (21 + OHCI_NDP_CFG(pohci))
5216
5217	AssertCompile(RT_ELEMENTS(g_aOpRegs) > 21);
5218	AssertCompile(RT_ELEMENTS(g_aOpRegs) <= 36);
5219
5220	/**
5221	* @callback_method_impl{FNIOMMMIOREAD}
5222	*/
5223	PDMBOTHCBDECL(int) ohciMmioRead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void pv, unsigned cb)
5224	{
5225	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5226
5227	/* Paranoia: Assert that IOMMMIO_FLAGS_READ_DWORD works. */
5228	AssertReturn(cb == sizeof(uint32_t), VERR_INTERNAL_ERROR_3);
5229	AssertReturn(!(GCPhysAddr & 0x3), VERR_INTERNAL_ERROR_4);
5230
5231	/*
5232	* Validate the register and call the read operator.
5233	*/
5234	int rc;
5235	const uint32_t iReg = (GCPhysAddr - pThis->MMIOBase) >> 2;
5236	if (iReg < NUM_OP_REGS(pThis))
5237	{
5238	const OHCIOPREG *pReg = &g_aOpRegs[iReg];
5239	rc = pReg->pfnRead(pThis, iReg, (uint32_t *)pv);
5240	}
5241	else
5242	{
5243	Log(("ohci: Trying to read register %u/%u!!!\n", iReg, NUM_OP_REGS(pThis)));
5244	rc = VINF_IOM_MMIO_UNUSED_FF;
5245	}
5246	return rc;
5247	}
5248
5249
5250	/**
5251	* @callback_method_impl{FNIOMMMIOWRITE}
5252	*/
5253	PDMBOTHCBDECL(int) ohciMmioWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void const pv, unsigned cb)
5254	{
5255	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5256
5257	/* Paranoia: Assert that IOMMMIO_FLAGS_WRITE_DWORD_ZEROED works. */
5258	AssertReturn(cb == sizeof(uint32_t), VERR_INTERNAL_ERROR_3);
5259	AssertReturn(!(GCPhysAddr & 0x3), VERR_INTERNAL_ERROR_4);
5260
5261	/*
5262	* Validate the register and call the read operator.
5263	*/
5264	int rc;
5265	const uint32_t iReg = (GCPhysAddr - pThis->MMIOBase) >> 2;
5266	if (iReg < NUM_OP_REGS(pThis))
5267	{
5268	const OHCIOPREG *pReg = &g_aOpRegs[iReg];
5269	rc = pReg->pfnWrite(pThis, iReg, (uint32_t const )pv);
5270	}
5271	else
5272	{
5273	Log(("ohci: Trying to write to register %u/%u!!!\n", iReg, NUM_OP_REGS(pThis)));
5274	rc = VINF_SUCCESS;
5275	}
5276	return rc;
5277	}
5278
5279	#ifdef IN_RING3
5280
5281	/**
5282	* @callback_method_impl{FNPCIIOREGIONMAP}
5283	*/
5284	static DECLCALLBACK(int) ohciR3Map(PPCIDEVICE pPciDev, int iRegion, RTGCPHYS GCPhysAddress, uint32_t cb, PCIADDRESSSPACE enmType)
5285	{
5286	POHCI pThis = (POHCI)pPciDev;
5287	int rc = PDMDevHlpMMIORegister(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb, NULL /pvUser/,
5288	IOMMMIO_FLAGS_READ_DWORD \| IOMMMIO_FLAGS_WRITE_DWORD_ZEROED
5289	\| IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_WRITE,
5290	ohciMmioWrite, ohciMmioRead, "USB OHCI");
5291	if (RT_FAILURE(rc))
5292	return rc;
5293
5294	if (pThis->fRZEnabled)
5295	{
5296	rc = PDMDevHlpMMIORegisterRC(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb,
5297	NIL_RTRCPTR /pvUser/, "ohciMmioWrite", "ohciMmioRead");
5298	if (RT_FAILURE(rc))
5299	return rc;
5300
5301	rc = PDMDevHlpMMIORegisterR0(pThis->CTX_SUFF(pDevIns), GCPhysAddress, cb,
5302	NIL_RTR0PTR /pvUser/, "ohciMmioWrite", "ohciMmioRead");
5303	if (RT_FAILURE(rc))
5304	return rc;
5305	}
5306
5307	pThis->MMIOBase = GCPhysAddress;
5308	return VINF_SUCCESS;
5309	}
5310
5311
5312	/**
5313	* Prepares for state saving.
5314	* All URBs needs to be canceled.
5315	*
5316	* @returns VBox status code.
5317	* @param pDevIns The device instance.
5318	* @param pSSM The handle to save the state to.
5319	*/
5320	static DECLCALLBACK(int) ohciR3SavePrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5321	{
5322	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5323	POHCIROOTHUB pRh = &pThis->RootHub;
5324	LogFlow(("ohciR3SavePrep: \n"));
5325
5326	/*
5327	* Detach all proxied devices.
5328	*/
5329	PDMCritSectEnter(pThis->pDevInsR3->pCritSectRoR3, VERR_IGNORED);
5330	/** @todo this won't work well when continuing after saving! */
5331	for (unsigned i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5332	{
5333	PVUSBIDEVICE pDev = pRh->aPorts[i].pDev;
5334	if (pDev)
5335	{
5336	if (!VUSBIDevIsSavedStateSupported(pDev))
5337	{
5338	VUSBIRhDetachDevice(pRh->pIRhConn, pDev);
5339	/*
5340	* Save the device pointers here so we can reattach them afterwards.
5341	* This will work fine even if the save fails since the Done handler is
5342	* called unconditionally if the Prep handler was called.
5343	*/
5344	pRh->aPorts[i].pDev = pDev;
5345	}
5346	}
5347	}
5348
5349	/*
5350	* If the bus was started set the timer. This is ugly but avoids changing the
5351	* saved state version for now so we can backport the changes to other branches.
5352	*/
5353	/** @todo: Do it properly for 4.4 by changing the saved state. */
5354	if (VUSBIRhGetPeriodicFrameRate(pRh->pIRhConn) != 0)
5355	{
5356	/* Calculate a new timer expiration so this saved state works with older releases. */
5357	uint64_t u64Expire = PDMDevHlpTMTimeVirtGet(pThis->CTX_SUFF(pDevIns)) + pThis->cTicksPerFrame;
5358
5359	LogFlowFunc(("Bus is active, setting timer to %llu\n", u64Expire));
5360	int rc = TMTimerSet(pThis->pEndOfFrameTimerR3, u64Expire);
5361	AssertRC(rc);
5362	}
5363
5364	PDMCritSectLeave(pThis->pDevInsR3->pCritSectRoR3);
5365
5366	/*
5367	* Kill old load data which might be hanging around.
5368	*/
5369	if (pThis->pLoad)
5370	{
5371	TMR3TimerDestroy(pThis->pLoad->pTimer);
5372	MMR3HeapFree(pThis->pLoad);
5373	pThis->pLoad = NULL;
5374	}
5375	return VINF_SUCCESS;
5376	}
5377
5378
5379	/**
5380	* Saves the state of the OHCI device.
5381	*
5382	* @returns VBox status code.
5383	* @param pDevIns The device instance.
5384	* @param pSSM The handle to save the state to.
5385	*/
5386	static DECLCALLBACK(int) ohciR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5387	{
5388	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5389	LogFlow(("ohciR3SaveExec: \n"));
5390
5391	int rc = SSMR3PutStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &g_aOhciFields[0], NULL);
5392	if (RT_SUCCESS(rc))
5393	rc = TMR3TimerSave(pThis->CTX_SUFF(pEndOfFrameTimer), pSSM);
5394	return rc;
5395	}
5396
5397
5398	/**
5399	* Done state save operation.
5400	*
5401	* @returns VBox load code.
5402	* @param pDevIns Device instance of the device which registered the data unit.
5403	* @param pSSM SSM operation handle.
5404	*/
5405	static DECLCALLBACK(int) ohciR3SaveDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5406	{
5407	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5408	POHCIROOTHUB pRh = &pThis->RootHub;
5409	OHCIROOTHUB Rh;
5410	unsigned i;
5411	LogFlow(("ohciR3SaveDone: \n"));
5412
5413	/*
5414	* NULL the dev pointers.
5415	*/
5416	Rh = *pRh;
5417	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5418	{
5419	if ( pRh->aPorts[i].pDev
5420	&& !VUSBIDevIsSavedStateSupported(pRh->aPorts[i].pDev))
5421	pRh->aPorts[i].pDev = NULL;
5422	}
5423
5424	/*
5425	* Attach the devices.
5426	*/
5427	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5428	{
5429	PVUSBIDEVICE pDev = Rh.aPorts[i].pDev;
5430	if ( pDev
5431	&& !VUSBIDevIsSavedStateSupported(pDev))
5432	VUSBIRhAttachDevice(pRh->pIRhConn, pDev);
5433	}
5434
5435	return VINF_SUCCESS;
5436	}
5437
5438
5439	/**
5440	* Prepare loading the state of the OHCI device.
5441	* This must detach the devices currently attached and save
5442	* the up for reconnect after the state load have been completed
5443	*
5444	* @returns VBox status code.
5445	* @param pDevIns The device instance.
5446	* @param pSSM The handle to the saved state.
5447	* @param u32Version The data unit version number.
5448	*/
5449	static DECLCALLBACK(int) ohciR3LoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5450	{
5451	int rc = VINF_SUCCESS;
5452	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5453	LogFlow(("ohciR3LoadPrep:\n"));
5454	if (!pThis->pLoad)
5455	{
5456	POHCIROOTHUB pRh = &pThis->RootHub;
5457	OHCILOAD Load;
5458	unsigned i;
5459
5460	/*
5461	* Detach all devices which are present in this session. Save them in the load
5462	* structure so we can reattach them after restoring the guest.
5463	*/
5464	Load.pTimer = NULL;
5465	Load.cDevs = 0;
5466	for (i = 0; i < RT_ELEMENTS(pRh->aPorts); i++)
5467	{
5468	PVUSBIDEVICE pDev = pRh->aPorts[i].pDev;
5469	if ( pDev
5470	&& !VUSBIDevIsSavedStateSupported(pDev))
5471	{
5472	Load.apDevs[Load.cDevs++] = pDev;
5473	VUSBIRhDetachDevice(pRh->pIRhConn, pDev);
5474	Assert(!pRh->aPorts[i].pDev);
5475	}
5476	}
5477
5478	/*
5479	* Any devices to reattach, if so duplicate the Load struct.
5480	*/
5481	if (Load.cDevs)
5482	{
5483	pThis->pLoad = (POHCILOAD)PDMDevHlpMMHeapAlloc(pDevIns, sizeof(Load));
5484	if (!pThis->pLoad)
5485	return VERR_NO_MEMORY;
5486	*pThis->pLoad = Load;
5487	}
5488	}
5489	/* else: we ASSUME no device can be attached or detach in the period
5490	* between a state load and the pLoad stuff is processed. */
5491	return rc;
5492	}
5493
5494
5495	/**
5496	* Loads the state of the OHCI device.
5497	*
5498	* @returns VBox status code.
5499	* @param pDevIns The device instance.
5500	* @param pSSM The handle to the saved state.
5501	* @param uVersion The data unit version number.
5502	* @param uPass The data pass.
5503	*/
5504	static DECLCALLBACK(int) ohciR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
5505	{
5506	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5507	int rc;
5508	LogFlow(("ohciR3LoadExec:\n"));
5509	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
5510
5511	if (uVersion == OHCI_SAVED_STATE_VERSION)
5512	{
5513	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &g_aOhciFields[0], NULL);
5514	if (RT_FAILURE(rc))
5515	return rc;
5516	}
5517	else if (uVersion == OHCI_SAVED_STATE_VERSION_8PORTS)
5518	{
5519	static SSMFIELD const s_aOhciFields8Ports[] =
5520	{
5521	SSMFIELD_ENTRY( OHCI, SofTime),
5522	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
5523	SSMFIELD_ENTRY( OHCI, RootHub.status),
5524	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
5525	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
5526	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
5527	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
5528	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
5529	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
5530	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
5531	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
5532	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
5533	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
5534	SSMFIELD_ENTRY( OHCI, ctl),
5535	SSMFIELD_ENTRY( OHCI, status),
5536	SSMFIELD_ENTRY( OHCI, intr_status),
5537	SSMFIELD_ENTRY( OHCI, intr),
5538	SSMFIELD_ENTRY( OHCI, hcca),
5539	SSMFIELD_ENTRY( OHCI, per_cur),
5540	SSMFIELD_ENTRY( OHCI, ctrl_cur),
5541	SSMFIELD_ENTRY( OHCI, ctrl_head),
5542	SSMFIELD_ENTRY( OHCI, bulk_cur),
5543	SSMFIELD_ENTRY( OHCI, bulk_head),
5544	SSMFIELD_ENTRY( OHCI, done),
5545	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
5546	SSMFIELD_ENTRY( OHCI, HcFmNumber),
5547	SSMFIELD_ENTRY( OHCI, pstart),
5548	SSMFIELD_ENTRY_TERM()
5549	};
5550
5551	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), 0 /fFlags*/, &s_aOhciFields8Ports[0], NULL);
5552	if (RT_FAILURE(rc))
5553	return rc;
5554	}
5555	else if (uVersion == OHCI_SAVED_STATE_VERSION_MEM_HELL)
5556	{
5557	static SSMFIELD const s_aOhciFields22[] =
5558	{
5559	SSMFIELD_ENTRY_OLD( PciDev.config, 256), /* DevPCI restores this. */
5560	SSMFIELD_ENTRY_OLD( PciDev.Int, 224),
5561	SSMFIELD_ENTRY_OLD( PciDev.devfn, 4),
5562	SSMFIELD_ENTRY_OLD( PciDev.Alignment0, 4),
5563	SSMFIELD_ENTRY_OLD_HCPTR( PciDev.name),
5564	SSMFIELD_ENTRY_OLD_HCPTR( PciDev.pDevIns),
5565	SSMFIELD_ENTRY_OLD_HCPTR( pDevInsR3),
5566	SSMFIELD_ENTRY_OLD_HCPTR( pEndOfFrameTimerR3),
5567	SSMFIELD_ENTRY_OLD_HCPTR( pDevInsR0),
5568	SSMFIELD_ENTRY_OLD_HCPTR( pEndOfFrameTimerR0),
5569	SSMFIELD_ENTRY_OLD_RCPTR( pDevInsRC),
5570	SSMFIELD_ENTRY_OLD_RCPTR( pEndOfFrameTimerRC),
5571	SSMFIELD_ENTRY( OHCI, SofTime),
5572	SSMFIELD_ENTRY_CUSTOM( dpic+fno, RT_OFFSETOF(OHCI, SofTime) + RT_SIZEOFMEMB(OHCI, SofTime), 4),
5573	SSMFIELD_ENTRY_OLD( MMIOBase, 4), /* DevPCI implicitly restores this. */
5574	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIBase),
5575	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIRhConn),
5576	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pIDev),
5577	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IBase.pfnQueryInterface),
5578	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnGetAvailablePorts),
5579	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnGetUSBVersions),
5580	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnAttach),
5581	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnDetach),
5582	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnReset),
5583	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnXferCompletion),
5584	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.pfnXferError),
5585	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.IRhPort.Alignment),
5586	SSMFIELD_ENTRY_OLD( RootHub.Led, 16), /* No device restored. */
5587	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.ILeds.pfnQueryStatusLed),
5588	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pLedsConnector),
5589	SSMFIELD_ENTRY( OHCI, RootHub.status),
5590	SSMFIELD_ENTRY( OHCI, RootHub.desc_a),
5591	SSMFIELD_ENTRY( OHCI, RootHub.desc_b),
5592	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.Alignment0, 4),
5593	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[0].fReg),
5594	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[0].Alignment0, 4),
5595	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[0].pDev),
5596	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[1].fReg),
5597	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[1].Alignment0, 4),
5598	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[1].pDev),
5599	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[2].fReg),
5600	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[2].Alignment0, 4),
5601	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[2].pDev),
5602	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[3].fReg),
5603	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[3].Alignment0, 4),
5604	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[3].pDev),
5605	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[4].fReg),
5606	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[4].Alignment0, 4),
5607	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[4].pDev),
5608	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[5].fReg),
5609	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[5].Alignment0, 4),
5610	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[5].pDev),
5611	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[6].fReg),
5612	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[6].Alignment0, 4),
5613	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[6].pDev),
5614	SSMFIELD_ENTRY( OHCI, RootHub.aPorts[7].fReg),
5615	SSMFIELD_ENTRY_OLD_PAD_HC64( RootHub.aPorts[7].Alignment0, 4),
5616	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.aPorts[7].pDev),
5617	SSMFIELD_ENTRY_OLD_HCPTR( RootHub.pThis),
5618	SSMFIELD_ENTRY( OHCI, ctl),
5619	SSMFIELD_ENTRY( OHCI, status),
5620	SSMFIELD_ENTRY( OHCI, intr_status),
5621	SSMFIELD_ENTRY( OHCI, intr),
5622	SSMFIELD_ENTRY( OHCI, hcca),
5623	SSMFIELD_ENTRY( OHCI, per_cur),
5624	SSMFIELD_ENTRY( OHCI, ctrl_cur),
5625	SSMFIELD_ENTRY( OHCI, ctrl_head),
5626	SSMFIELD_ENTRY( OHCI, bulk_cur),
5627	SSMFIELD_ENTRY( OHCI, bulk_head),
5628	SSMFIELD_ENTRY( OHCI, done),
5629	SSMFIELD_ENTRY_CUSTOM( fsmps+fit+fi+frt, RT_OFFSETOF(OHCI, done) + RT_SIZEOFMEMB(OHCI, done), 4),
5630	SSMFIELD_ENTRY( OHCI, HcFmNumber),
5631	SSMFIELD_ENTRY( OHCI, pstart),
5632	SSMFIELD_ENTRY_OLD( cTicksPerFrame, 8), /* done by the constructor */
5633	SSMFIELD_ENTRY_OLD( cTicksPerUsbTick, 8), /* ditto */
5634	SSMFIELD_ENTRY_OLD( cInFlight, 4), /* no in-flight stuff when saving. */
5635	SSMFIELD_ENTRY_OLD( Alignment1, 4),
5636	SSMFIELD_ENTRY_OLD( aInFlight, 257 * 8),
5637	SSMFIELD_ENTRY_OLD_PAD_HC64( aInFlight, 257 * 8),
5638	SSMFIELD_ENTRY_OLD( cInDoneQueue, 4), /* strict builds only, so don't bother. */
5639	SSMFIELD_ENTRY_OLD( aInDoneQueue, 4*64),
5640	SSMFIELD_ENTRY_OLD( u32FmDoneQueueTail, 4), /* logging only */
5641	SSMFIELD_ENTRY_OLD_PAD_HC32( Alignment2, 4),
5642	SSMFIELD_ENTRY_OLD_HCPTR( pLoad),
5643	SSMFIELD_ENTRY_OLD( StatCanceledIsocUrbs, 8),
5644	SSMFIELD_ENTRY_OLD( StatCanceledGenUrbs, 8),
5645	SSMFIELD_ENTRY_OLD( StatDroppedUrbs, 8),
5646	SSMFIELD_ENTRY_OLD( StatTimer, 32),
5647	SSMFIELD_ENTRY_TERM()
5648	};
5649
5650	/* deserialize the struct */
5651	rc = SSMR3GetStructEx(pSSM, pThis, sizeof(pThis), SSMSTRUCT_FLAGS_NO_MARKERS /fFlags*/, &s_aOhciFields22[0], NULL);
5652	if (RT_FAILURE(rc))
5653	return rc;
5654
5655	/* check delimiter */
5656	uint32_t u32;
5657	rc = SSMR3GetU32(pSSM, &u32);
5658	if (RT_FAILURE(rc))
5659	return rc;
5660	AssertMsgReturn(u32 == ~0U, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
5661	}
5662	else
5663	AssertMsgFailedReturn(("%d\n", uVersion), VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION);
5664
5665	/*
5666	* Finally restore the timer.
5667	*/
5668	return TMR3TimerLoad(pThis->pEndOfFrameTimerR3, pSSM);
5669	}
5670
5671
5672	/**
5673	* Done state load operation.
5674	*
5675	* @returns VBox load code.
5676	* @param pDevIns Device instance of the device which registered the data unit.
5677	* @param pSSM SSM operation handle.
5678	*/
5679	static DECLCALLBACK(int) ohciR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
5680	{
5681	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5682	LogFlow(("ohciR3LoadDone:\n"));
5683
5684	/*
5685	* Start a timer if we've got devices to reattach
5686	*/
5687	if (pThis->pLoad)
5688	{
5689	int rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ohciR3LoadReattachDevices, pThis,
5690	TMTIMER_FLAGS_NO_CRIT_SECT, "OHCI reattach devices on load",
5691	&pThis->pLoad->pTimer);
5692	if (RT_SUCCESS(rc))
5693	rc = TMTimerSetMillies(pThis->pLoad->pTimer, 250);
5694	return rc;
5695	}
5696
5697	return VINF_SUCCESS;
5698	}
5699
5700
5701	/**
5702	* Reattaches devices after a saved state load.
5703	*/
5704	static DECLCALLBACK(void) ohciR3LoadReattachDevices(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser)
5705	{
5706	POHCI pThis = (POHCI)pvUser;
5707	POHCILOAD pLoad = pThis->pLoad;
5708	POHCIROOTHUB pRh = &pThis->RootHub;
5709	LogFlow(("ohciR3LoadReattachDevices:\n"));
5710
5711	/*
5712	* Reattach devices.
5713	*/
5714	for (unsigned i = 0; i < pLoad->cDevs; i++)
5715	VUSBIRhAttachDevice(pRh->pIRhConn, pLoad->apDevs[i]);
5716
5717	/*
5718	* Cleanup.
5719	*/
5720	TMR3TimerDestroy(pTimer);
5721	MMR3HeapFree(pLoad);
5722	pThis->pLoad = NULL;
5723	}
5724
5725
5726	/**
5727	* Reset notification.
5728	*
5729	* @returns VBox status code.
5730	* @param pDevIns The device instance data.
5731	*/
5732	static DECLCALLBACK(void) ohciR3Reset(PPDMDEVINS pDevIns)
5733	{
5734	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5735	LogFlow(("ohciR3Reset:\n"));
5736
5737	/*
5738	* There is no distinction between cold boot, warm reboot and software reboots,
5739	* all of these are treated as cold boots. We are also doing the initialization
5740	* job of a BIOS or SMM driver.
5741	*
5742	* Important: Don't confuse UsbReset with hardware reset. Hardware reset is
5743	* just one way of getting into the UsbReset state.
5744	*/
5745	ohciDoReset(pThis, OHCI_USB_RESET, true /* reset devices */);
5746	}
5747
5748
5749	/**
5750	* Resume notification.
5751	*
5752	* @returns VBox status code.
5753	* @param pDevIns The device instance data.
5754	*/
5755	static DECLCALLBACK(void) ohciR3Resume(PPDMDEVINS pDevIns)
5756	{
5757	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5758	LogFlowFunc(("\n"));
5759
5760	/* Restart the frame thread if the timer is active. */
5761	if (TMTimerIsActive(pThis->pEndOfFrameTimerR3))
5762	{
5763	int rc = TMTimerStop(pThis->pEndOfFrameTimerR3);
5764	AssertRC(rc);
5765
5766	LogFlowFunc(("Bus was active, enable periodic frame processing\n"));
5767	rc = pThis->RootHub.pIRhConn->pfnSetPeriodicFrameProcessing(pThis->RootHub.pIRhConn, OHCI_DEFAULT_TIMER_FREQ);
5768	AssertRC(rc);
5769	}
5770	}
5771
5772
5773	/**
5774	* Info handler, device version. Dumps OHCI control registers.
5775	*
5776	* @param pDevIns Device instance which registered the info.
5777	* @param pHlp Callback functions for doing output.
5778	* @param pszArgs Argument string. Optional and specific to the handler.
5779	*/
5780	static DECLCALLBACK(void) ohciR3InfoRegs(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
5781	{
5782	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5783	uint32_t val, ctl, status;
5784
5785	/* Control register */
5786	ctl = pThis->ctl;
5787	pHlp->pfnPrintf(pHlp, "HcControl: %08x - CBSR=%d PLE=%d IE=%d CLE=%d BLE=%d HCFS=%#x IR=%d RWC=%d RWE=%d\n",
5788	ctl, ctl & 3, (ctl >> 2) & 1, (ctl >> 3) & 1, (ctl >> 4) & 1, (ctl >> 5) & 1, (ctl >> 6) & 3, (ctl >> 8) & 1,
5789	(ctl >> 9) & 1, (ctl >> 10) & 1);
5790
5791	/* Command status register */
5792	status = pThis->status;
5793	pHlp->pfnPrintf(pHlp, "HcCommandStatus: %08x - HCR=%d CLF=%d BLF=%d OCR=%d SOC=%d\n",
5794	status, status & 1, (status >> 1) & 1, (status >> 2) & 1, (status >> 3) & 1, (status >> 16) & 3);
5795
5796	/* Interrupt status register */
5797	val = pThis->intr_status;
5798	pHlp->pfnPrintf(pHlp, "HcInterruptStatus: %08x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d\n",
5799	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
5800	(val >> 6) & 1, (val >> 30) & 1);
5801
5802	/* Interrupt enable register */
5803	val = pThis->intr;
5804	pHlp->pfnPrintf(pHlp, "HcInterruptEnable: %08x - SO=%d WDH=%d SF=%d RD=%d UE=%d FNO=%d RHSC=%d OC=%d MIE=%d\n",
5805	val, val & 1, (val >> 1) & 1, (val >> 2) & 1, (val >> 3) & 1, (val >> 4) & 1, (val >> 5) & 1,
5806	(val >> 6) & 1, (val >> 30) & 1, (val >> 31) & 1);
5807
5808	/* HCCA address register */
5809	pHlp->pfnPrintf(pHlp, "HcHCCA: %08x\n", pThis->hcca);
5810
5811	/* Current periodic ED register */
5812	pHlp->pfnPrintf(pHlp, "HcPeriodCurrentED: %08x\n", pThis->per_cur);
5813
5814	/* Control ED registers */
5815	pHlp->pfnPrintf(pHlp, "HcControlHeadED: %08x\n", pThis->ctrl_head);
5816	pHlp->pfnPrintf(pHlp, "HcControlCurrentED: %08x\n", pThis->ctrl_cur);
5817
5818	/* Bulk ED registers */
5819	pHlp->pfnPrintf(pHlp, "HcBulkHeadED: %08x\n", pThis->bulk_head);
5820	pHlp->pfnPrintf(pHlp, "HcBulkCurrentED: %08x\n", pThis->bulk_cur);
5821
5822	/* Done head register */
5823	pHlp->pfnPrintf(pHlp, "HcDoneHead: %08x\n", pThis->done);
5824
5825	pHlp->pfnPrintf(pHlp, "\n");
5826	}
5827
5828
5829	/**
5830	* Relocate device instance data.
5831	*
5832	* @returns VBox status code.
5833	* @param pDevIns The device instance data.
5834	* @param offDelta The relocation delta.
5835	*/
5836	static DECLCALLBACK(void) ohciR3Relocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta)
5837	{
5838	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5839	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
5840	pThis->pEndOfFrameTimerRC = TMTimerRCPtr(pThis->pEndOfFrameTimerR3);
5841	}
5842
5843
5844	/**
5845	* Destruct a device instance.
5846	*
5847	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
5848	* resources can be freed correctly.
5849	*
5850	* @returns VBox status code.
5851	* @param pDevIns The device instance data.
5852	*/
5853	static DECLCALLBACK(int) ohciR3Destruct(PPDMDEVINS pDevIns)
5854	{
5855	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5856	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
5857
5858	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
5859	ohciPhysReadCacheFree(pThis->pCacheED);
5860	pThis->pCacheED = NULL;
5861	ohciPhysReadCacheFree(pThis->pCacheTD);
5862	pThis->pCacheTD = NULL;
5863	#endif
5864
5865	if (RTCritSectIsInitialized(&pThis->CritSect))
5866	RTCritSectDelete(&pThis->CritSect);
5867	PDMR3CritSectDelete(&pThis->CsIrq);
5868
5869	/*
5870	* Tear down the per endpoint in-flight tracking...
5871	*/
5872
5873	return VINF_SUCCESS;
5874	}
5875
5876
5877	/**
5878	* @interface_method_impl{PDMDEVREG,pfnConstruct,OHCI constructor}
5879	*/
5880	static DECLCALLBACK(int) ohciR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
5881	{
5882	POHCI pThis = PDMINS_2_DATA(pDevIns, POHCI);
5883	uint32_t cPorts;
5884	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
5885
5886	/*
5887	* Init instance data.
5888	*/
5889	pThis->pDevInsR3 = pDevIns;
5890	pThis->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
5891	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
5892
5893	PCIDevSetVendorId (&pThis->PciDev, 0x106b);
5894	PCIDevSetDeviceId (&pThis->PciDev, 0x003f);
5895	PCIDevSetClassProg (&pThis->PciDev, 0x10); /* OHCI */
5896	PCIDevSetClassSub (&pThis->PciDev, 0x03);
5897	PCIDevSetClassBase (&pThis->PciDev, 0x0c);
5898	PCIDevSetInterruptPin (&pThis->PciDev, 0x01);
5899	#ifdef VBOX_WITH_MSI_DEVICES
5900	PCIDevSetStatus (&pThis->PciDev, VBOX_PCI_STATUS_CAP_LIST);
5901	PCIDevSetCapabilityList(&pThis->PciDev, 0x80);
5902	#endif
5903
5904	pThis->RootHub.pOhci = pThis;
5905	pThis->RootHub.IBase.pfnQueryInterface = ohciRhQueryInterface;
5906	pThis->RootHub.IRhPort.pfnGetAvailablePorts = ohciRhGetAvailablePorts;
5907	pThis->RootHub.IRhPort.pfnGetUSBVersions = ohciRhGetUSBVersions;
5908	pThis->RootHub.IRhPort.pfnAttach = ohciRhAttach;
5909	pThis->RootHub.IRhPort.pfnDetach = ohciRhDetach;
5910	pThis->RootHub.IRhPort.pfnReset = ohciRhReset;
5911	pThis->RootHub.IRhPort.pfnXferCompletion = ohciRhXferCompletion;
5912	pThis->RootHub.IRhPort.pfnXferError = ohciRhXferError;
5913	pThis->RootHub.IRhPort.pfnStartFrame = ohciR3StartFrame;
5914	pThis->RootHub.IRhPort.pfnFrameRateChanged = ohciR3FrameRateChanged;
5915
5916	/* USB LED */
5917	pThis->RootHub.Led.u32Magic = PDMLED_MAGIC;
5918	pThis->RootHub.ILeds.pfnQueryStatusLed = ohciRhQueryStatusLed;
5919
5920
5921	/*
5922	* Read configuration.
5923	*/
5924	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "RZEnabled", "");
5925	int rc = CFGMR3QueryBoolDef(pCfg, "RZEnabled", &pThis->fRZEnabled, true);
5926	AssertLogRelRCReturn(rc, rc);
5927
5928	/* Number of ports option. */
5929	rc = CFGMR3QueryU32Def(pCfg, "Ports", &cPorts, OHCI_NDP_DEFAULT);
5930	if (RT_FAILURE(rc))
5931	return PDMDEV_SET_ERROR(pDevIns, rc,
5932	N_("OHCI configuration error: failed to read Ports as integer"));
5933
5934	if (cPorts == 0 \|\| cPorts > OHCI_NDP_MAX)
5935	return PDMDevHlpVMSetError(pDevIns, VERR_INVALID_PARAMETER, RT_SRC_POS,
5936	N_("OHCI configuration error: Ports must be in range [%u,%u]"),
5937	1, OHCI_NDP_MAX);
5938
5939	/* Store the configured NDP; it will be used everywhere else from now on. */
5940	pThis->RootHub.desc_a = cPorts;
5941
5942	/*
5943	* Register PCI device and I/O region.
5944	*/
5945	rc = PDMDevHlpPCIRegister(pDevIns, &pThis->PciDev);
5946	if (RT_FAILURE(rc))
5947	return rc;
5948
5949	#ifdef VBOX_WITH_MSI_DEVICES
5950	PDMMSIREG MsiReg;
5951	RT_ZERO(MsiReg);
5952	MsiReg.cMsiVectors = 1;
5953	MsiReg.iMsiCapOffset = 0x80;
5954	MsiReg.iMsiNextOffset = 0x00;
5955	rc = PDMDevHlpPCIRegisterMsi(pDevIns, &MsiReg);
5956	if (RT_FAILURE(rc))
5957	{
5958	PCIDevSetCapabilityList(&pThis->PciDev, 0x0);
5959	/* That's OK, we can work without MSI */
5960	}
5961	#endif
5962
5963	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 0, 4096, PCI_ADDRESS_SPACE_MEM, ohciR3Map);
5964	if (RT_FAILURE(rc))
5965	return rc;
5966
5967	/*
5968	* Create the end-of-frame timer.
5969	*/
5970	rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, ohciFrameBoundaryTimer, pThis,
5971	TMTIMER_FLAGS_DEFAULT_CRIT_SECT, "USB Frame Timer",
5972	&pThis->pEndOfFrameTimerR3);
5973	if (RT_FAILURE(rc))
5974	return rc;
5975	pThis->pEndOfFrameTimerR0 = TMTimerR0Ptr(pThis->pEndOfFrameTimerR3);
5976	pThis->pEndOfFrameTimerRC = TMTimerRCPtr(pThis->pEndOfFrameTimerR3);
5977
5978	/*
5979	* Register the saved state data unit.
5980	*/
5981	rc = PDMDevHlpSSMRegisterEx(pDevIns, OHCI_SAVED_STATE_VERSION, sizeof(*pThis), NULL,
5982	NULL, NULL, NULL,
5983	ohciR3SavePrep, ohciR3SaveExec, ohciR3SaveDone,
5984	ohciR3LoadPrep, ohciR3LoadExec, ohciR3LoadDone);
5985	if (RT_FAILURE(rc))
5986	return rc;
5987
5988	/*
5989	* Attach to the VBox USB RootHub Driver on LUN #0.
5990	*/
5991	rc = PDMDevHlpDriverAttach(pDevIns, 0, &pThis->RootHub.IBase, &pThis->RootHub.pIBase, "RootHub");
5992	if (RT_FAILURE(rc))
5993	{
5994	AssertMsgFailed(("Configuration error: No roothub driver attached to LUN #0!\n"));
5995	return rc;
5996	}
5997	pThis->RootHub.pIRhConn = PDMIBASE_QUERY_INTERFACE(pThis->RootHub.pIBase, VUSBIROOTHUBCONNECTOR);
5998	AssertMsgReturn(pThis->RootHub.pIRhConn,
5999	("Configuration error: The driver doesn't provide the VUSBIROOTHUBCONNECTOR interface!\n"),
6000	VERR_PDM_MISSING_INTERFACE);
6001	pThis->RootHub.pIDev = PDMIBASE_QUERY_INTERFACE(pThis->RootHub.pIBase, VUSBIDEVICE);
6002	AssertMsgReturn(pThis->RootHub.pIDev,
6003	("Configuration error: The driver doesn't provide the VUSBIDEVICE interface!\n"),
6004	VERR_PDM_MISSING_INTERFACE);
6005
6006	/*
6007	* Attach status driver (optional).
6008	*/
6009	PPDMIBASE pBase;
6010	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThis->RootHub.IBase, &pBase, "Status Port");
6011	if (RT_SUCCESS(rc))
6012	pThis->RootHub.pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
6013	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
6014	{
6015	AssertMsgFailed(("Failed to attach to status driver. rc=%Rrc\n", rc));
6016	return rc;
6017	}
6018
6019	/* Set URB parameters. */
6020	rc = VUSBIRhSetUrbParams(pThis->RootHub.pIRhConn, sizeof(VUSBURBHCIINT), sizeof(VUSBURBHCITDINT));
6021	if (RT_FAILURE(rc))
6022	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
6023	N_("OHCI: Failed to set URB parameters"));
6024
6025	/*
6026	* Calculate the timer intervals.
6027	* This assumes that the VM timer doesn't change frequency during the run.
6028	*/
6029	pThis->u64TimerHz = TMTimerGetFreq(pThis->CTX_SUFF(pEndOfFrameTimer));
6030
6031	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CsIrq, RT_SRC_POS, "OHCI#%uIrq", iInstance);
6032	if (RT_FAILURE(rc))
6033	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
6034	N_("OHCI: Failed to create critical section"));
6035
6036	rc = RTCritSectInit(&pThis->CritSect);
6037	if (RT_FAILURE(rc))
6038	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
6039	N_("OHCI: Failed to create critical section"));
6040
6041	#ifdef VBOX_WITH_OHCI_PHYS_READ_CACHE
6042	pThis->pCacheED = ohciPhysReadCacheAlloc();
6043	pThis->pCacheTD = ohciPhysReadCacheAlloc();
6044	if (pThis->pCacheED == NULL \|\| pThis->pCacheTD == NULL)
6045	return PDMDevHlpVMSetError(pDevIns, VERR_NO_MEMORY, RT_SRC_POS,
6046	N_("OHCI: Failed to allocate PhysRead cache"));
6047	#endif
6048
6049	/*
6050	* Do a hardware reset.
6051	*/
6052	ohciDoReset(pThis, OHCI_USB_RESET, false /* don't reset devices */);
6053
6054	#ifdef VBOX_WITH_STATISTICS
6055	/*
6056	* Register statistics.
6057	*/
6058	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCanceledIsocUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/CanceledIsocUrbs", STAMUNIT_OCCURENCES, "Detected canceled isochronous URBs.");
6059	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCanceledGenUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/CanceledGenUrbs", STAMUNIT_OCCURENCES, "Detected canceled general URBs.");
6060	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatDroppedUrbs, STAMTYPE_COUNTER, "/Devices/OHCI/DroppedUrbs", STAMUNIT_OCCURENCES, "Dropped URBs (endpoint halted, or URB canceled).");
6061	#endif
6062
6063	/*
6064	* Register debugger info callbacks.
6065	*/
6066	PDMDevHlpDBGFInfoRegister(pDevIns, "ohci", "OHCI control registers.", ohciR3InfoRegs);
6067
6068	#if 0/def DEBUG_bird/
6069	// g_fLogInterruptEPs = true;
6070	g_fLogControlEPs = true;
6071	g_fLogBulkEPs = true;
6072	#endif
6073
6074	return VINF_SUCCESS;
6075	}
6076
6077
6078	const PDMDEVREG g_DeviceOHCI =
6079	{
6080	/* u32version */
6081	PDM_DEVREG_VERSION,
6082	/* szName */
6083	"usb-ohci",
6084	/* szRCMod */
6085	"VBoxDDRC.rc",
6086	/* szR0Mod */
6087	"VBoxDDR0.r0",
6088	/* pszDescription */
6089	"OHCI USB controller.\n",
6090	/* fFlags */
6091	PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RC \| PDM_DEVREG_FLAGS_R0,
6092	/* fClass */
6093	PDM_DEVREG_CLASS_BUS_USB,
6094	/* cMaxInstances */
6095	~0U,
6096	/* cbInstance */
6097	sizeof(OHCI),
6098	/* pfnConstruct */
6099	ohciR3Construct,
6100	/* pfnDestruct */
6101	ohciR3Destruct,
6102	/* pfnRelocate */
6103	ohciR3Relocate,
6104	/* pfnMemSetup */
6105	NULL,
6106	/* pfnPowerOn */
6107	NULL,
6108	/* pfnReset */
6109	ohciR3Reset,
6110	/* pfnSuspend */
6111	NULL,
6112	/* pfnResume */
6113	ohciR3Resume,
6114	/* pfnAttach */
6115	NULL,
6116	/* pfnDetach */
6117	NULL,
6118	/* pfnQueryInterface */
6119	NULL,
6120	/* pfnInitComplete */
6121	NULL,
6122	/* pfnPowerOff */
6123	NULL,
6124	/* pfnSoftReset */
6125	NULL,
6126	/* u32VersionEnd */
6127	PDM_DEVREG_VERSION
6128	};
6129
6130	#endif /* IN_RING3 */
6131	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/USB/DevOHCI.cpp@ 62506

Download in other formats: