2 ppcskel - a Free Software replacement for the Nintendo/BroadOn bootloader.
5 Copyright (C) 2009 Bernhard Urban <lewurm@gmx.net>
6 Copyright (C) 2009 Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
8 # This code is licensed to you under the terms of the GNU GPL, version 2;
9 # see file COPYING or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
12 #include "../../bootmii_ppc.h"
13 #include "../../hollywood.h"
14 #include "../../irq.h"
15 #include "../../string.h"
16 #include "../../malloc.h"
19 #include "../usbspec/usb11spec.h"
21 // macro for accessing u32 variables that need to be in little endian byte order;
22 // whenever you read or write from an u32 field that the ohci host controller
23 // will read or write from too, use this macro for access!
24 #define ACCESS_LE(dword) (u32)( (((dword) & 0xFF000000) >> 24) | \
25 (((dword) & 0x00FF0000) >> 8) | \
26 (((dword) & 0x0000FF00) << 8) | \
27 (((dword) & 0x000000FF) << 24) )
29 static struct endpoint_descriptor *allocate_endpoint();
30 static struct general_td *allocate_general_td(size_t);
31 static void control_quirk();
32 static void dbg_op_state();
33 static void dbg_td_flag(u32 flag);
34 static void configure_ports(u8 from_init);
35 static void setup_port(u32 reg, u8 from_init);
37 static struct ohci_hcca hcca_oh0;
40 static struct endpoint_descriptor *allocate_endpoint()
42 struct endpoint_descriptor *ep;
43 ep = (struct endpoint_descriptor *)memalign(16, sizeof(struct endpoint_descriptor));
44 ep->flags = ACCESS_LE(OHCI_ENDPOINT_GENERAL_FORMAT);
45 ep->headp = ep->tailp = ep->nexted = ACCESS_LE(0);
49 static struct general_td *allocate_general_td(size_t bsize)
51 struct general_td *td;
52 td = (struct general_td *)memalign(16, sizeof(struct general_td));
53 td->flags = ACCESS_LE(0);
55 td->nexttd = ACCESS_LE(virt_to_phys(td));
56 //td->nexttd = ACCESS_LE(0);
58 td->cbp = td->be = ACCESS_LE(0);
61 //td->cbp = ACCESS_LE(virt_to_phys(memalign(4096, bsize))); //memailgn required here?
62 td->cbp = ACCESS_LE(virt_to_phys(malloc(bsize)));
63 memset(phys_to_virt(ACCESS_LE(td->cbp)), 0, bsize);
64 td->be = ACCESS_LE(ACCESS_LE(td->cbp) + bsize - 1);
69 static void control_quirk()
71 static struct endpoint_descriptor *ed = 0; /* empty ED */
72 static struct general_td *td = 0; /* dummy TD */
79 * Allocate and keep a special empty ED with just a dummy TD.
82 ed = allocate_endpoint();
86 td = allocate_general_td(0);
93 #define ED_MASK ((u32)~0x0f)
94 ed->tailp = ed->headp = ACCESS_LE(virt_to_phys((void*) ((u32)td & ED_MASK)));
95 ed->flags |= ACCESS_LE(OHCI_ENDPOINT_DIRECTION_OUT);
99 * The OHCI USB host controllers on the Nintendo Wii
100 * video game console stop working when new TDs are
101 * added to a scheduled control ED after a transfer has
102 * has taken place on it.
104 * Before scheduling any new control TD, we make the
105 * controller happy by always loading a special control ED
106 * with a single dummy TD and letting the controller attempt
108 * The controller won't do anything with it, as the special
109 * ED has no TDs, but it will keep the controller from failing
110 * on the next transfer.
112 head = read32(OHCI0_HC_CTRL_HEAD_ED);
114 printf("head: 0x%08X\n", head);
116 * Load the special empty ED and tell the controller to
117 * process the control list.
119 sync_after_write(ed, 16);
120 sync_after_write(td, 16);
121 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(ed));
123 status = read32(OHCI0_HC_CONTROL);
124 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
125 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
127 /* spin until the controller is done with the control list */
128 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
131 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
134 printf("current: 0x%08X\n", current);
136 /* restore the old control head and control settings */
137 write32(OHCI0_HC_CONTROL, status);
138 write32(OHCI0_HC_CTRL_HEAD_ED, head);
145 static void dbg_op_state()
147 switch (read32(OHCI0_HC_CONTROL) & OHCI_CTRL_HCFS) {
148 case OHCI_USB_SUSPEND:
149 printf("ohci-- OHCI_USB_SUSPEND\n");
152 printf("ohci-- OHCI_USB_RESET\n");
155 printf("ohci-- OHCI_USB_OPER\n");
157 case OHCI_USB_RESUME:
158 printf("ohci-- OHCI_USB_RESUME\n");
163 static void dbg_td_flag(u32 flag)
165 printf("**************** dbg_td_flag: 0x%08X ***************\n", flag);
166 printf("CC: %X\tshould be 0, see page 32 (ohci spec)\n", (flag>>28)&0xf);
167 printf("EC: %X\tsee page 20 (ohci spec)\n", (flag>>26)&3);
168 printf(" T: %X\n", (flag>>24)&3);
169 printf("DI: %X\n", (flag>>21)&7);
170 printf("DP: %X\n", (flag>>19)&3);
171 printf(" R: %X\n", (flag>>18)&1);
172 printf("********************************************************\n");
178 * Enqueue a transfer descriptor.
181 u8 hcdi_enqueue(usb_transfer_descriptor *td) {
182 printf( "===========================\n"
183 "===========================\n");
184 control_quirk(); //required? YES! :O ... erm... or no? :/ ... in fact I have no idea
187 static struct endpoint_descriptor dummyconfig;
190 memset(&dummyconfig, 0, 16);
191 dummyconfig.flags = ACCESS_LE(OHCI_ENDPOINT_GENERAL_FORMAT);
192 dummyconfig.headp = dummyconfig.tailp = dummyconfig.nexted = ACCESS_LE(0);
193 dummyconfig.flags |= ACCESS_LE(OHCI_ENDPOINT_LOW_SPEED |
194 OHCI_ENDPOINT_SET_DEVICE_ADDRESS(td->devaddress) |
195 OHCI_ENDPOINT_SET_ENDPOINT_NUMBER(td->endpoint) |
196 OHCI_ENDPOINT_SET_MAX_PACKET_SIZE(td->maxp));
197 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(&dummyconfig));
199 sync_before_read(&dummyconfig, 16);
200 dummyconfig.flags |= ACCESS_LE(OHCI_ENDPOINT_SKIP);
201 printf("HALTED set?: %d\n", ACCESS_LE(dummyconfig.headp)&OHCI_ENDPOINT_HALTED);
202 sync_after_write(&dummyconfig, 16);
205 dummyconfig.headp = ACCESS_LE(0);
206 sync_after_write(&dummyconfig, 16);
209 sync_before_read(&hcca_oh0, 256);
210 printf("done head (nach sync): 0x%08X\n", ACCESS_LE(hcca_oh0.done_head));
211 printf("HCCA->frame_no: %d\nhcca->hccapad1: %d\n",
212 ((ACCESS_LE(hcca_oh0.frame_no) & 0xffff)>>16),
213 ACCESS_LE(hcca_oh0.frame_no)&0x0000ffff );
215 struct general_td *tmptd = allocate_general_td(td->actlen);
216 (void) memcpy((void*) (phys_to_virt(ACCESS_LE(tmptd->cbp))), td->buffer, td->actlen);
218 tmptd->flags &= ACCESS_LE(~OHCI_TD_DIRECTION_PID_MASK);
221 printf("pid_setup\n");
222 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_SETUP);
223 tmptd->flags |= ACCESS_LE(OHCI_TD_TOGGLE_0);
227 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_OUT);
228 tmptd->flags |= ACCESS_LE(OHCI_TD_TOGGLE_1);
232 tmptd->flags |= ACCESS_LE(OHCI_TD_DIRECTION_PID_IN);
233 /* let the endpoint do the togglestuff! */
234 tmptd->flags |= ACCESS_LE(OHCI_TD_TOGGLE_CARRY);
236 /* should be done by HC!
237 * first pid_in start with DATA0 */
239 dummyconfig.headp = ACCESS_LE( td->togl ?
240 ACCESS_LE(dummyconfig.headp) | OHCI_ENDPOINT_TOGGLE_CARRY :
241 ACCESS_LE(dummyconfig.headp) & ~OHCI_ENDPOINT_TOGGLE_CARRY);
245 tmptd->flags |= ACCESS_LE(OHCI_TD_SET_DELAY_INTERRUPT(7) | OHCI_TD_BUFFER_ROUNDING);
247 printf("tmptd hexdump (before) 0x%08X:\n", tmptd);
248 hexdump(tmptd, sizeof(struct general_td));
249 //save buffer adress here; HC may change tmptd->cbp
250 tmptdbuffer = (u32) phys_to_virt(ACCESS_LE(tmptd->cbp));
251 printf("tmptd->cbp hexdump (before) 0x%08X:\n", phys_to_virt(ACCESS_LE(tmptd->cbp)));
252 hexdump((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
254 sync_after_write(tmptd, sizeof(struct general_td));
255 sync_after_write((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
258 #define ED_MASK ((u32)~0x0f)
259 dummyconfig.flags &= ACCESS_LE(~OHCI_ENDPOINT_SKIP);
260 dummyconfig.headp |= ACCESS_LE(virt_to_phys((void*) ((u32)tmptd & ED_MASK)));
262 printf("dummyconfig hexdump (before) 0x%08X:\n", &dummyconfig);
263 hexdump((void*) &dummyconfig, 16);
265 sync_after_write(&dummyconfig, 16);
267 printf("OHCI_CTRL_CLE: 0x%08X || ", read32(OHCI0_HC_CONTROL)&OHCI_CTRL_CLE);
268 printf("OHCI_CLF: 0x%08X\n", read32(OHCI0_HC_COMMAND_STATUS)&OHCI_CLF);
269 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
270 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
272 //printf("+++++++++++++++++++++++++++++\n");
273 /* spin until the controller is done with the control list */
274 //printf("current: 0x%08X\n", current);
276 //don't use this quirk stuff here!
278 while(!read32(OHCI0_HC_CTRL_CURRENT_ED)) {
283 u32 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
284 printf("current: 0x%08X\n", current);
285 printf("+++++++++++++++++++++++++++++\n");
288 sync_before_read(tmptd, sizeof(struct general_td));
289 printf("tmptd hexdump (after) 0x%08X:\n", tmptd);
290 hexdump(tmptd, sizeof(struct general_td));
291 dbg_td_flag(ACCESS_LE(tmptd->flags));
293 sync_before_read((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
294 printf("tmptd->cbp hexdump (after) 0x%08X:\n", phys_to_virt(ACCESS_LE(tmptd->cbp)));
295 hexdump((void*) phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
297 sync_before_read(&dummyconfig, 16);
298 printf("dummyconfig hexdump (after) 0x%08X:\n", &dummyconfig);
299 hexdump((void*) &dummyconfig, 16);
301 sync_before_read(&hcca_oh0, 256);
302 printf("done head (nach sync): 0x%08X\n", ACCESS_LE(hcca_oh0.done_head));
304 struct general_td* donetd = phys_to_virt(ACCESS_LE(hcca_oh0.done_head)&~1);
305 sync_before_read(donetd, 16);
306 printf("done head hexdump: 0x%08X\n", donetd);
307 hexdump((void*) donetd, 16);
311 sync_before_read((void*) tmptdbuffer, td->actlen);
312 newlen = (u32)phys_to_virt(ACCESS_LE(tmptd->cbp)) - tmptdbuffer;
313 printf("WOOOOT newlen: %d\n", newlen);
314 hexdump((void*) tmptdbuffer, newlen);
315 printf("OLD length: %d\n", td->actlen);
316 hexdump((void*) tmptdbuffer, td->actlen);
319 sync_before_read((void*) (phys_to_virt(ACCESS_LE(tmptd->cbp))-newlen), td->actlen);
320 printf("td->buffer: 0x%08X\np2v(A_L(tmptd->cbp: 0x%08X\ntd->actlen: %d\n", (void*) (td->buffer), phys_to_virt(ACCESS_LE(tmptd->cbp)), td->actlen);
321 (void) memcpy((void*) (td->buffer), (void*) tmptdbuffer, td->actlen);
323 write32(OHCI0_HC_CONTROL, read32(OHCI0_HC_CONTROL)&~OHCI_CTRL_CLE);
326 * TD should be free'd after taking it from the done queue.
327 * but we are very very dirty and do it anyway :p
330 /* only when a buffer is allocated */
333 free((void*)tmptdbuffer);
340 * Remove an transfer descriptor from transfer queue.
342 u8 hcdi_dequeue(usb_transfer_descriptor *td) {
348 printf("ohci-- init\n");
351 /* disable hc interrupts */
352 set32(OHCI0_HC_INT_DISABLE, OHCI_INTR_MIE);
354 /* save fmInterval and calculate FSMPS */
355 #define FSMP(fi) (0x7fff & ((6 * ((fi) - 210)) / 7))
356 #define FI 0x2edf /* 12000 bits per frame (-1) */
357 u32 fmint = read32(OHCI0_HC_FM_INTERVAL) & 0x3fff;
359 printf("ohci-- fminterval delta: %d\n", fmint - FI);
360 fmint |= FSMP (fmint) << 16;
362 /* enable interrupts of both usb host controllers */
363 set32(EHCI_CTL, EHCI_CTL_OH0INTE | EHCI_CTL_OH1INTE | 0xe0000);
366 write32(OHCI0_HC_COMMAND_STATUS, OHCI_HCR);
370 while ((read32(OHCI0_HC_COMMAND_STATUS) & OHCI_HCR) != 0) {
372 printf("ohci-- FAILED");
378 /* disable interrupts; 2ms timelimit here!
379 now we're in the SUSPEND state ... must go OPERATIONAL
380 within 2msec else HC enters RESUME */
382 u32 cookie = irq_kill();
384 /* Tell the controller where the control and bulk lists are
385 * The lists are empty now. */
386 write32(OHCI0_HC_CTRL_HEAD_ED, 0);
387 write32(OHCI0_HC_BULK_HEAD_ED, 0);
389 /* set hcca adress */
390 sync_after_write(&hcca_oh0, 256);
391 write32(OHCI0_HC_HCCA, virt_to_phys(&hcca_oh0));
393 /* set periodicstart */
395 u32 fmInterval = read32(OHCI0_HC_FM_INTERVAL) &0x3fff;
396 u32 fit = read32(OHCI0_HC_FM_INTERVAL) & FIT;
398 write32(OHCI0_HC_FM_INTERVAL, fmint | (fit ^ FIT));
399 write32(OHCI0_HC_PERIODIC_START, ((9*fmInterval)/10)&0x3fff);
402 if ((read32(OHCI0_HC_FM_INTERVAL) & 0x3fff0000) == 0 || !read32(OHCI0_HC_PERIODIC_START)) {
403 printf("ohci-- w00t, fail!! see ohci-hcd.c:669\n");
406 /* start HC operations */
407 write32(OHCI0_HC_CONTROL, OHCI_CONTROL_INIT | OHCI_USB_OPER);
409 /* wake on ConnectStatusChange, matching external hubs */
410 write32(OHCI0_HC_RH_STATUS, /*RH_HS_DRWE |*/ RH_HS_LPSC);
412 /* Choose the interrupts we care about now, others later on demand */
413 write32(OHCI0_HC_INT_STATUS, ~0);
414 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_INIT);
417 wait_ms ((read32(OHCI0_HC_RH_DESCRIPTOR_A) >> 23) & 0x1fe);
419 configure_ports((u8)1);
425 static void configure_ports(u8 from_init)
427 printf("OHCI0_HC_RH_DESCRIPTOR_A:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_A));
428 printf("OHCI0_HC_RH_DESCRIPTOR_B:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_B));
429 printf("OHCI0_HC_RH_STATUS:\t\t0x%08X\n", read32(OHCI0_HC_RH_STATUS));
430 printf("OHCI0_HC_RH_PORT_STATUS_1:\t0x%08X\n", read32(OHCI0_HC_RH_PORT_STATUS_1));
431 printf("OHCI0_HC_RH_PORT_STATUS_2:\t0x%08X\n", read32(OHCI0_HC_RH_PORT_STATUS_2));
433 setup_port(OHCI0_HC_RH_PORT_STATUS_1, from_init);
434 setup_port(OHCI0_HC_RH_PORT_STATUS_2, from_init);
435 printf("configure_ports done\n");
438 static void setup_port(u32 reg, u8 from_init)
440 u32 port = read32(reg);
441 if((port & RH_PS_CCS) && ((port & RH_PS_CSC) || from_init)) {
442 write32(reg, RH_PS_CSC);
446 /* clear CSC flag, set PES and start port reset (PRS) */
447 write32(reg, RH_PS_PES);
448 while(!(read32(reg) & RH_PS_PES)) {
453 write32(reg, RH_PS_PRS);
455 /* spin until port reset is complete */
456 while(!(read32(reg) & RH_PS_PRSC)); // hint: it may stuck here
457 printf("loop done\n");
461 (void) usb_add_device();
467 /* read interrupt status */
468 u32 flags = read32(OHCI0_HC_INT_STATUS);
470 /* when all bits are set to 1 some problem occured */
471 if (flags == 0xffffffff) {
472 printf("ohci-- Houston, we have a serious problem! :(\n");
476 /* only care about interrupts that are enabled */
477 flags &= read32(OHCI0_HC_INT_ENABLE);
481 printf("OHCI Interrupt occured: but not for you! WTF?!\n");
485 printf("OHCI Interrupt occured: ");
486 /* UnrecoverableError */
487 if (flags & OHCI_INTR_UE) {
488 printf("UnrecoverableError\n");
489 /* TODO: well, I don't know... nothing,
490 * because it won't happen anyway? ;-) */
493 /* RootHubStatusChange */
494 if (flags & OHCI_INTR_RHSC) {
495 printf("RootHubStatusChange\n");
496 /* TODO: set some next_statechange variable... */
498 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD | OHCI_INTR_RHSC);
501 else if (flags & OHCI_INTR_RD) {
502 printf("ResumeDetected\n");
503 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD);
504 /* TODO: figure out what the linux kernel does here... */
507 /* WritebackDoneHead */
508 if (flags & OHCI_INTR_WDH) {
509 printf("WritebackDoneHead\n");
510 /* basically the linux irq handler reverse TDs to their urbs
511 * and set done_head to null.
512 * since we are polling atm, just should do the latter task.
513 * however, this won't work for now (i don't know why...)
517 sync_before_read(&hcca_oh0, 256);
518 hcca_oh0.done_head = 0;
519 sync_after_write(&hcca_oh0, 256);
523 /* TODO: handle any pending URB/ED unlinks... */
525 #define HC_IS_RUNNING() 1 /* dirty, i know... just a temporary solution */
526 if (HC_IS_RUNNING()) {
527 write32(OHCI0_HC_INT_STATUS, flags);
528 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_MIE);
534 sync_before_read(&hcca_oh0, 256);
535 printf("***** frame_no: %d *****\n", ACCESS_LE(hcca_oh0.frame_no));