2 ppcskel - a Free Software replacement for the Nintendo/BroadOn bootloader.
5 Copyright (C) 2009 Bernhard Urban <lewurm@gmx.net>
6 Copyright (C) 2009 Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
8 # This code is licensed to you under the terms of the GNU GPL, version 2;
9 # see file COPYING or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
12 #include "../../bootmii_ppc.h"
13 #include "../../hollywood.h"
14 #include "../../irq.h"
15 #include "../../string.h"
16 #include "../../malloc.h"
19 #include "../usbspec/usb11spec.h"
21 // macro for accessing u32 variables that need to be in little endian byte order;
22 // whenever you read or write from an u32 field that the ohci host controller
23 // will read or write from too, use this macro for access!
24 #define ACCESS_LE(dword) (u32)( (((dword) & 0xFF000000) >> 24) | \
25 (((dword) & 0x00FF0000) >> 8) | \
26 (((dword) & 0x0000FF00) << 8) | \
27 (((dword) & 0x000000FF) << 24) )
29 static struct ohci_hcca hcca_oh0;
31 static struct endpoint_descriptor *allocate_endpoint()
33 struct endpoint_descriptor *ep;
34 //memalign instead of calloc doesn't work here?! WTF
35 ep = (struct endpoint_descriptor *)memalign(sizeof(struct endpoint_descriptor), 16);
36 ep->flags = ACCESS_LE(OHCI_ENDPOINT_GENERAL_FORMAT);
37 ep->headp = ep->tailp = ep->nexted = ACCESS_LE(0);
41 static struct general_td *allocate_general_td(size_t bsize)
43 struct general_td *td;
44 td = (struct general_td *)memalign(sizeof(struct general_td), 16);
45 td->flags = ACCESS_LE(0);
47 td->nexttd = ACCESS_LE(virt_to_phys(td));
48 //td->nexttd = ACCESS_LE(0);
50 td->cbp = td->be = ACCESS_LE(0);
52 //td->cbp = ACCESS_LE(virt_to_phys(memalign(bsize, 16))); //memailgn required here?
53 td->cbp = ACCESS_LE(virt_to_phys(malloc(bsize)));
54 td->be = ACCESS_LE(ACCESS_LE(td->cbp) + bsize - 1);
59 static void control_quirk()
61 static struct endpoint_descriptor *ed = 0; /* empty ED */
62 static struct general_td *td = 0; /* dummy TD */
69 * Allocate and keep a special empty ED with just a dummy TD.
72 ed = allocate_endpoint();
76 td = allocate_general_td(0);
83 #define ED_MASK ((u32)~0x0f)
84 ed->tailp = ed->headp = ACCESS_LE(virt_to_phys((void*) ((u32)td & ED_MASK)));
85 ed->flags |= ACCESS_LE(OHCI_ENDPOINT_DIRECTION_OUT);
89 * The OHCI USB host controllers on the Nintendo Wii
90 * video game console stop working when new TDs are
91 * added to a scheduled control ED after a transfer has
92 * has taken place on it.
94 * Before scheduling any new control TD, we make the
95 * controller happy by always loading a special control ED
96 * with a single dummy TD and letting the controller attempt
98 * The controller won't do anything with it, as the special
99 * ED has no TDs, but it will keep the controller from failing
100 * on the next transfer.
102 head = read32(OHCI0_HC_CTRL_HEAD_ED);
104 printf("head: 0x%08X\n", head);
106 * Load the special empty ED and tell the controller to
107 * process the control list.
109 sync_after_write(ed, 16);
110 sync_after_write(td, 16);
111 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(ed));
113 status = read32(OHCI0_HC_CONTROL);
114 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
115 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
117 /* spin until the controller is done with the control list */
118 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
121 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
124 printf("current: 0x%08X\n", current);
126 /* restore the old control head and control settings */
127 write32(OHCI0_HC_CONTROL, status);
128 write32(OHCI0_HC_CTRL_HEAD_ED, head);
135 static void dbg_op_state()
137 switch (read32(OHCI0_HC_CONTROL) & OHCI_CTRL_HCFS) {
138 case OHCI_USB_SUSPEND:
139 printf("ohci-- OHCI_USB_SUSPEND\n");
142 printf("ohci-- OHCI_USB_RESET\n");
145 printf("ohci-- OHCI_USB_OPER\n");
147 case OHCI_USB_RESUME:
148 printf("ohci-- OHCI_USB_RESUME\n");
153 static void dbg_td_flag(u32 flag)
155 printf("**************** dbg_td_flag: 0x%08X ***************\n", flag);
156 printf("CC: %X\tshould be 0, see page 32 (ohci spec)\n", (flag>>28)&0xf);
157 printf("EC: %X\tsee page 20 (ohci spec)\n", (flag>>26)&3);
158 printf(" T: %X\n", (flag>>24)&3);
159 printf("DI: %X\n", (flag>>21)&7);
160 printf("DP: %X\n", (flag>>19)&3);
161 printf(" R: %X\n", (flag>>18)&1);
162 printf("********************************************************\n");
168 * Enqueue a transfer descriptor.
170 u8 hcdi_enqueue(usb_transfer_descriptor *td) {
171 control_quirk(); //required? YES! :O
173 static struct endpoint_descriptor dummyconfig;
174 dummyconfig.flags = ACCESS_LE(OHCI_ENDPOINT_GENERAL_FORMAT);
175 dummyconfig.headp = dummyconfig.tailp = dummyconfig.nexted = ACCESS_LE(0);
177 printf( "===========================\n"
178 "===========================\n");
179 sync_before_read(&hcca_oh0, 256);
180 printf("done head (nach sync): 0x%08X\n", ACCESS_LE(hcca_oh0.done_head));
181 printf("HCCA->frame_no: %d\nhcca->hccapad1: %d\n",
182 ((ACCESS_LE(hcca_oh0.frame_no) & 0xffff)>>16),
183 ACCESS_LE(hcca_oh0.frame_no)&0x0000ffff );
185 struct general_td *tmptd = allocate_general_td(td->actlen);
186 (void) memcpy((void*) (phys_to_virt(ACCESS_LE(tmptd->cbp))), td->buffer, td->actlen);
188 tmptd->flags &= ACCESS_LE(~OHCI_TD_DIRECTION_PID_MASK);
191 printf("pid_setup\n");
192 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_SETUP);
196 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_OUT);
200 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_IN);
203 tmptd->flags |= ACCESS_LE((td->togl) ? OHCI_TD_TOGGLE_1 : OHCI_TD_TOGGLE_0);
205 printf("tmptd hexdump (before) 0x%08X:\n", tmptd);
206 hexdump(tmptd, sizeof(struct general_td));
207 printf("tmptd->cbp hexdump (before) 0x%08X:\n", phys_to_virt(ACCESS_LE(tmptd->cbp)));
208 hexdump((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
210 sync_after_write(tmptd, sizeof(struct general_td));
211 sync_after_write((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
214 #define ED_MASK2 ~0 /*((u32)~0x0f) */
215 #define ED_MASK ((u32)~0x0f)
216 dummyconfig.headp = ACCESS_LE(virt_to_phys((void*) ((u32)tmptd & ED_MASK)));
218 dummyconfig.flags |= ACCESS_LE(OHCI_ENDPOINT_LOW_SPEED |
219 OHCI_ENDPOINT_SET_DEVICE_ADDRESS(td->devaddress) |
220 OHCI_ENDPOINT_SET_ENDPOINT_NUMBER(td->endpoint) |
221 OHCI_ENDPOINT_SET_MAX_PACKET_SIZE(td->maxp));
223 printf("dummyconfig hexdump (before) 0x%08X:\n", &dummyconfig);
224 hexdump((void*) &dummyconfig, 16);
226 sync_after_write(&dummyconfig, 16);
227 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(&dummyconfig));
229 printf("OHCI_CTRL_CLE: 0x%08X || ", read32(OHCI0_HC_CONTROL)&OHCI_CTRL_CLE);
230 printf("OHCI_CLF: 0x%08X\n", read32(OHCI0_HC_COMMAND_STATUS)&OHCI_CLF);
231 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
232 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
234 printf("+++++++++++++++++++++++++++++\n");
235 /* spin until the controller is done with the control list */
236 u32 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
237 printf("current: 0x%08X\n", current);
240 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
244 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
245 printf("current: 0x%08X\n", current);
246 printf("+++++++++++++++++++++++++++++\n");
249 sync_before_read(tmptd, sizeof(struct general_td));
250 printf("tmptd hexdump (after) 0x%08X:\n", tmptd);
251 hexdump(tmptd, sizeof(struct general_td));
252 dbg_td_flag(ACCESS_LE(tmptd->flags));
254 sync_before_read((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
255 printf("tmptd->cbp hexdump (after) 0x%08X:\n", phys_to_virt(ACCESS_LE(tmptd->cbp)));
256 hexdump((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
258 sync_before_read(&dummyconfig, 16);
259 printf("dummyconfig hexdump (after) 0x%08X:\n", &dummyconfig);
260 hexdump((void*) &dummyconfig, 16);
262 sync_before_read(&hcca_oh0, 256);
263 printf("done head (nach sync): 0x%08X\n", ACCESS_LE(hcca_oh0.done_head));
265 sync_before_read((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
266 (void) memcpy((void*) (td->buffer), phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
268 write32(OHCI0_HC_CONTROL, read32(OHCI0_HC_CONTROL)&~OHCI_CTRL_CLE);
269 dummyconfig.headp = dummyconfig.tailp = dummyconfig.nexted = ACCESS_LE(0);
270 //should be free'd after taking it from the done queue
271 //however, it fails?! WTF
276 free((void*) tmptd->cbp);
283 * Remove an transfer descriptor from transfer queue.
285 u8 hcdi_dequeue(usb_transfer_descriptor *td) {
291 printf("ohci-- init\n");
294 /* disable hc interrupts */
295 set32(OHCI0_HC_INT_DISABLE, OHCI_INTR_MIE);
297 /* save fmInterval and calculate FSMPS */
298 #define FSMP(fi) (0x7fff & ((6 * ((fi) - 210)) / 7))
299 #define FI 0x2edf /* 12000 bits per frame (-1) */
300 u32 fmint = read32(OHCI0_HC_FM_INTERVAL) & 0x3fff;
302 printf("ohci-- fminterval delta: %d\n", fmint - FI);
303 fmint |= FSMP (fmint) << 16;
305 /* enable interrupts of both usb host controllers */
306 set32(EHCI_CTL, EHCI_CTL_OH0INTE | EHCI_CTL_OH1INTE | 0xe0000);
309 write32(OHCI0_HC_COMMAND_STATUS, OHCI_HCR);
313 while ((read32(OHCI0_HC_COMMAND_STATUS) & OHCI_HCR) != 0) {
315 printf("ohci-- FAILED");
321 /* disable interrupts; 2ms timelimit here!
322 now we're in the SUSPEND state ... must go OPERATIONAL
323 within 2msec else HC enters RESUME */
325 u32 cookie = irq_kill();
327 /* Tell the controller where the control and bulk lists are
328 * The lists are empty now. */
329 write32(OHCI0_HC_CTRL_HEAD_ED, 0);
330 write32(OHCI0_HC_BULK_HEAD_ED, 0);
332 /* set hcca adress */
333 sync_after_write(&hcca_oh0, 256);
334 write32(OHCI0_HC_HCCA, virt_to_phys(&hcca_oh0));
336 /* set periodicstart */
338 u32 fmInterval = read32(OHCI0_HC_FM_INTERVAL) &0x3fff;
339 u32 fit = read32(OHCI0_HC_FM_INTERVAL) & FIT;
341 write32(OHCI0_HC_FM_INTERVAL, fmint | (fit ^ FIT));
342 write32(OHCI0_HC_PERIODIC_START, ((9*fmInterval)/10)&0x3fff);
345 if ((read32(OHCI0_HC_FM_INTERVAL) & 0x3fff0000) == 0 || !read32(OHCI0_HC_PERIODIC_START)) {
346 printf("ohci-- w00t, fail!! see ohci-hcd.c:669\n");
349 /* start HC operations */
350 write32(OHCI0_HC_CONTROL, OHCI_CONTROL_INIT | OHCI_USB_OPER);
352 /* wake on ConnectStatusChange, matching external hubs */
353 set32(OHCI0_HC_RH_STATUS, RH_HS_DRWE);
355 /* Choose the interrupts we care about now, others later on demand */
356 write32(OHCI0_HC_INT_STATUS, ~0);
357 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_INIT);
366 /* read interrupt status */
367 u32 flags = read32(OHCI0_HC_INT_STATUS);
369 /* when all bits are set to 1 some problem occured */
370 if (flags == 0xffffffff) {
371 printf("ohci-- Houston, we have a serious problem! :(\n");
375 /* only care about interrupts that are enabled */
376 flags &= read32(OHCI0_HC_INT_ENABLE);
380 printf("OHCI Interrupt occured: but not for you! WTF?!\n");
384 printf("OHCI Interrupt occured: ");
385 /* UnrecoverableError */
386 if (flags & OHCI_INTR_UE) {
387 printf("UnrecoverableError\n");
388 /* TODO: well, I don't know... nothing,
389 * because it won't happen anyway? ;-) */
392 /* RootHubStatusChange */
393 if (flags & OHCI_INTR_RHSC) {
394 printf("RootHubStatusChange\n");
395 /* TODO: set some next_statechange variable... */
396 u32 port1 = read32(OHCI0_HC_RH_PORT_STATUS_1);
397 u32 port2 = read32(OHCI0_HC_RH_PORT_STATUS_2);
398 printf("OHCI0_HC_RH_DESCRIPTOR_A:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_A));
399 printf("OHCI0_HC_RH_DESCRIPTOR_B:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_B));
400 printf("OHCI0_HC_RH_STATUS:\t\t0x%08X\n", read32(OHCI0_HC_RH_STATUS));
401 printf("OHCI0_HC_RH_PORT_STATUS_1:\t0x%08X\n", port1);
402 printf("OHCI0_HC_RH_PORT_STATUS_2:\t0x%08X\n", port2);
404 if((port1 & RH_PS_CCS) && (port1 & RH_PS_CSC)) {
407 /* clear CSC flag, set PES and start port reset (PRS) */
408 write32(OHCI0_HC_RH_PORT_STATUS_1, port1 | RH_PS_CSC | RH_PS_PES | RH_PS_PRS);
410 /* spin until port reset is complete */
411 port1 = read32(OHCI0_HC_RH_PORT_STATUS_1);
412 while(!(port1 & RH_PS_PRSC)) {
414 port1 = read32(OHCI0_HC_RH_PORT_STATUS_1);
417 (void) usb_add_device();
419 if((port2 & RH_PS_CCS) && (port2 & RH_PS_CSC)) {
422 /* clear CSC flag, set PES and start port reset (PRS) */
423 write32(OHCI0_HC_RH_PORT_STATUS_2, port2 | RH_PS_CSC | RH_PS_PES | RH_PS_PRS);
425 /* spin until port reset is complete */
426 port2 = read32(OHCI0_HC_RH_PORT_STATUS_2);
427 while(!(port2 & RH_PS_PRSC)) {
429 port2 = read32(OHCI0_HC_RH_PORT_STATUS_2);
432 (void) usb_add_device();
435 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD | OHCI_INTR_RHSC);
438 else if (flags & OHCI_INTR_RD) {
439 printf("ResumeDetected\n");
440 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD);
441 /* TODO: figure out what the linux kernel does here... */
444 /* WritebackDoneHead */
445 if (flags & OHCI_INTR_WDH) {
446 printf("WritebackDoneHead\n");
447 /* basically the linux irq handler reverse TDs to their urbs
448 * and set done_head to null.
449 * since we are polling atm, just should do the latter task.
450 * however, this won't work for now (i don't know why...)
454 sync_before_read(&hcca_oh0, 256);
455 hcca_oh0.done_head = 0;
456 sync_after_write(&hcca_oh0, 256);
460 /* TODO: handle any pending URB/ED unlinks... */
462 #define HC_IS_RUNNING() 1 /* dirty, i know... just a temporary solution */
463 if (HC_IS_RUNNING()) {
464 write32(OHCI0_HC_INT_STATUS, flags);
465 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_MIE);