2 ppcskel - a Free Software replacement for the Nintendo/BroadOn bootloader.
5 Copyright (C) 2009 Bernhard Urban <lewurm@gmx.net>
6 Copyright (C) 2009 Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
8 # This code is licensed to you under the terms of the GNU GPL, version 2;
9 # see file COPYING or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
12 #include "../../bootmii_ppc.h"
13 #include "../../hollywood.h"
14 #include "../../irq.h"
15 #include "../../string.h"
16 #include "../../malloc.h"
19 #include "../usbspec/usb11spec.h"
21 /* macro for accessing u32 variables that need to be in little endian byte order;
23 * whenever you read or write from an u32 field that the ohci host controller
24 * will read or write from too, use this macro for access!
26 #define LE(dword) (u32)( (((dword) & 0xFF000000) >> 24) | \
27 (((dword) & 0x00FF0000) >> 8) | \
28 (((dword) & 0x0000FF00) << 8) | \
29 (((dword) & 0x000000FF) << 24) )
31 static struct endpoint_descriptor *allocate_endpoint();
32 static struct general_td *allocate_general_td();
33 static void control_quirk();
34 static void dbg_op_state();
35 //static void dbg_td_flag(u32 flag);
36 static void configure_ports(u8 from_init);
37 static void setup_port(u32 reg, u8 from_init);
39 static struct ohci_hcca hcca_oh0;
42 static struct endpoint_descriptor *allocate_endpoint()
44 struct endpoint_descriptor *ep;
45 ep = (struct endpoint_descriptor *)memalign(16, sizeof(struct endpoint_descriptor));
46 memset(ep, 0, sizeof(struct endpoint_descriptor));
47 ep->flags = LE(OHCI_ENDPOINT_GENERAL_FORMAT);
48 ep->headp = ep->tailp = ep->nexted = LE(0);
52 static struct general_td *allocate_general_td()
54 struct general_td *td;
55 td = (struct general_td *)memalign(16, sizeof(struct general_td));
56 memset(td, 0, sizeof(struct general_td));
59 td->cbp = td->be = LE(0);
63 static void control_quirk()
65 static struct endpoint_descriptor *ed = 0; /* empty ED */
66 static struct general_td *td = 0; /* dummy TD */
73 * Allocate and keep a special empty ED with just a dummy TD.
76 ed = allocate_endpoint();
80 td = allocate_general_td(0);
87 ed->tailp = ed->headp = LE(virt_to_phys((void*) ((u32)td & OHCI_ENDPOINT_HEAD_MASK)));
88 ed->flags |= LE(OHCI_ENDPOINT_DIRECTION_OUT);
92 * The OHCI USB host controllers on the Nintendo Wii
93 * video game console stop working when new TDs are
94 * added to a scheduled control ED after a transfer has
95 * has taken place on it.
97 * Before scheduling any new control TD, we make the
98 * controller happy by always loading a special control ED
99 * with a single dummy TD and letting the controller attempt
101 * The controller won't do anything with it, as the special
102 * ED has no TDs, but it will keep the controller from failing
103 * on the next transfer.
105 head = read32(OHCI0_HC_CTRL_HEAD_ED);
107 printf("head: 0x%08X\n", head);
109 * Load the special empty ED and tell the controller to
110 * process the control list.
112 sync_after_write(ed, 16);
113 sync_after_write(td, 16);
114 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(ed));
116 status = read32(OHCI0_HC_CONTROL);
117 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
118 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
120 /* spin until the controller is done with the control list */
121 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
124 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
127 printf("current: 0x%08X\n", current);
129 /* restore the old control head and control settings */
130 write32(OHCI0_HC_CONTROL, status);
131 write32(OHCI0_HC_CTRL_HEAD_ED, head);
138 static void dbg_op_state()
140 switch (read32(OHCI0_HC_CONTROL) & OHCI_CTRL_HCFS) {
141 case OHCI_USB_SUSPEND:
142 printf("ohci-- OHCI_USB_SUSPEND\n");
145 printf("ohci-- OHCI_USB_RESET\n");
148 printf("ohci-- OHCI_USB_OPER\n");
150 case OHCI_USB_RESUME:
151 printf("ohci-- OHCI_USB_RESUME\n");
157 static void dbg_td_flag(u32 flag)
159 printf("**************** dbg_td_flag: 0x%08X ***************\n", flag);
160 printf("CC: %X\tshould be 0, see page 32 (ohci spec)\n", (flag>>28)&0xf);
161 printf("EC: %X\tsee page 20 (ohci spec)\n", (flag>>26)&3);
162 printf(" T: %X\n", (flag>>24)&3);
163 printf("DI: %X\n", (flag>>21)&7);
164 printf("DP: %X\n", (flag>>19)&3);
165 printf(" R: %X\n", (flag>>18)&1);
166 printf("********************************************************\n");
170 static void general_td_fill(struct general_td *dest, const usb_transfer_descriptor *src)
172 dest->cbp = LE(virt_to_phys(src->buffer));
174 /* save virtual address here */
175 dest->bufaddr = (u32) src->buffer;
177 dest->be = src->actlen ? LE(LE(dest->cbp) + src->actlen - 1) : LE(0);
178 dest->buflen = src->actlen;
180 dest->flags &= LE(~OHCI_TD_DIRECTION_PID_MASK);
183 printf("pid_setup\n");
184 dest->flags |= LE(OHCI_TD_DIRECTION_PID_SETUP);
185 dest->flags |= LE(OHCI_TD_TOGGLE_0);
186 dest->flags |= LE(OHCI_TD_BUFFER_ROUNDING);
190 dest->flags |= LE(OHCI_TD_DIRECTION_PID_OUT);
191 dest->flags |= LE(OHCI_TD_BUFFER_ROUNDING);
194 * TODO: just temporary solution! (consider it with len?)
195 * there can be also regular PID_OUT pakets
197 dest->flags |= LE(OHCI_TD_TOGGLE_1);
201 dest->flags |= LE(OHCI_TD_DIRECTION_PID_IN);
202 dest->flags |= LE(OHCI_TD_BUFFER_ROUNDING);
204 * let the endpoint do the togglestuff!
205 * TODO: just temporary solution!
206 * there can be also inregular PID_IN pakets (@Status Stage)
208 dest->flags |= LE(OHCI_TD_TOGGLE_CARRY);
210 /* should be done by HC!
211 * first pid_in start with DATA0 */
213 dummyconfig.headp = LE( src->togl ?
214 LE(dummyconfig.headp) | OHCI_ENDPOINT_TOGGLE_CARRY :
215 LE(dummyconfig.headp) & ~OHCI_ENDPOINT_TOGGLE_CARRY);
219 dest->flags |= LE(OHCI_TD_SET_DELAY_INTERRUPT(7));
222 static void dump_address(void *addr, u32 size, const char* str)
224 printf("%s hexdump (%d) @ 0x%08X:\n", str, size, addr);
228 struct endpoint_descriptor *edhead = 0;
231 printf("<^> <^> <^> hcdi_fire(start)\n");
233 control_quirk(); //required? YES! :O ... erm... or no? :/ ... in fact I have no idea
234 write32(OHCI0_HC_CTRL_HEAD_ED, virt_to_phys(edhead));
237 sync_after_write(edhead, sizeof(struct endpoint_descriptor));
238 dump_address(edhead, sizeof(struct endpoint_descriptor), "edhead(before)");
240 struct general_td *x = phys_to_virt(LE(edhead->headp) & OHCI_ENDPOINT_HEAD_MASK);
241 printf("STRUCT LEN: %d\n", sizeof(struct general_td));
242 while(virt_to_phys(x)) {
243 sync_after_write(x, sizeof(struct general_td));
244 dump_address(x, sizeof(struct general_td), "x(before)");
247 sync_after_write((void*) x->cbp, x->buflen);
248 dump_address((void*) phys_to_virt(LE(x->cbp)), x->buflen, "x->cbp(before)");
250 x = phys_to_virt(LE(x->nexttd));
253 /* trigger control list */
254 set32(OHCI0_HC_CONTROL, OHCI_CTRL_CLE);
255 write32(OHCI0_HC_COMMAND_STATUS, OHCI_CLF);
257 //don't use this quirk stuff here!?
260 while(!read32(OHCI0_HC_CTRL_CURRENT_ED)) {
262 while(read32(OHCI0_HC_CTRL_CURRENT_ED));
263 printf("+++++++++++++++++++++++++++++\n");
264 printf("wait: %d\n", wait);
267 while(!read32(OHCI0_HC_CTRL_CURRENT_ED)) {
270 u32 current = read32(OHCI0_HC_CTRL_CURRENT_ED);
271 printf("current: 0x%08X\n", current);
272 printf("+++++++++++++++++++++++++++++\n");
276 sync_before_read(&hcca_oh0, sizeof(hcca_oh0));
277 struct general_td *n = phys_to_virt(LE(hcca_oh0.done_head) & ~1);
278 printf("done_head: 0x%08X\n", n);
280 struct general_td *prev = 0, *next = 0;
281 /* reverse done queue */
282 while(virt_to_phys(n)) {
283 printf("n: 0x%08X\n", n);
284 printf("next: 0x%08X\n", next);
285 printf("prev: 0x%08X\n", prev);
288 sync_before_read((void*) n, sizeof(struct general_td));
290 n = (struct general_td*) phys_to_virt(LE(next->nexttd));
291 next->nexttd = (u32) prev;
297 while(virt_to_phys(n)) {
301 dump_address(n, sizeof(struct general_td), "n(after)");
303 sync_before_read((void*) n->bufaddr, n->buflen);
304 dump_address((void*) n->bufaddr, n->buflen, "n->bufaddr(after)");
305 dbg_td_flag(LE(n->flags));
306 n = prev = (struct general_td*) n->nexttd;
308 hcca_oh0.done_head = 0;
309 sync_after_write(&hcca_oh0, sizeof(hcca_oh0));
312 write32(OHCI0_HC_CONTROL, read32(OHCI0_HC_CONTROL)&~OHCI_CTRL_CLE);
317 printf("<^> <^> <^> hcdi_fire(end)\n");
321 * Enqueue a transfer descriptor.
323 u8 hcdi_enqueue(const usb_transfer_descriptor *td) {
324 printf("*()*()*()*()*()*()*() hcdi_enqueue(start)\n");
326 edhead = allocate_endpoint();
327 edhead->flags = LE(OHCI_ENDPOINT_GENERAL_FORMAT);
328 edhead->headp = edhead->tailp = edhead->nexted = LE(0);
329 edhead->flags |= LE(OHCI_ENDPOINT_LOW_SPEED |
330 OHCI_ENDPOINT_SET_DEVICE_ADDRESS(td->devaddress) |
331 OHCI_ENDPOINT_SET_ENDPOINT_NUMBER(td->endpoint) |
332 OHCI_ENDPOINT_SET_MAX_PACKET_SIZE(td->maxp));
335 struct general_td *tdhw = allocate_general_td();
336 general_td_fill(tdhw, td);
340 edhead->headp = LE(virt_to_phys((void*) ((u32)tdhw & OHCI_ENDPOINT_HEAD_MASK)));
343 /* headp in endpoint already exists
346 struct general_td *n = (struct general_td*) phys_to_virt(LE(edhead->headp) & OHCI_ENDPOINT_HEAD_MASK);
347 while(LE(n->nexttd)) {
348 n = phys_to_virt(LE(n->nexttd));
350 n->nexttd = LE(virt_to_phys((void*) ((u32)tdhw & OHCI_ENDPOINT_HEAD_MASK)));
351 printf("n: 0x%08X\n", n);
352 printf("n->nexttd: 0x%08X\n", phys_to_virt(LE(n->nexttd)));
355 printf("*()*()*()*()*()*()*() hcdi_enqueue(end)\n");
361 * Remove an transfer descriptor from transfer queue.
363 u8 hcdi_dequeue(usb_transfer_descriptor *td) {
369 printf("ohci-- init\n");
372 /* disable hc interrupts */
373 set32(OHCI0_HC_INT_DISABLE, OHCI_INTR_MIE);
375 /* save fmInterval and calculate FSMPS */
376 #define FSMP(fi) (0x7fff & ((6 * ((fi) - 210)) / 7))
377 #define FI 0x2edf /* 12000 bits per frame (-1) */
378 u32 fmint = read32(OHCI0_HC_FM_INTERVAL) & 0x3fff;
380 printf("ohci-- fminterval delta: %d\n", fmint - FI);
381 fmint |= FSMP (fmint) << 16;
383 /* enable interrupts of both usb host controllers */
384 set32(EHCI_CTL, EHCI_CTL_OH0INTE | EHCI_CTL_OH1INTE | 0xe0000);
387 write32(OHCI0_HC_COMMAND_STATUS, OHCI_HCR);
391 while ((read32(OHCI0_HC_COMMAND_STATUS) & OHCI_HCR) != 0) {
393 printf("ohci-- FAILED");
399 /* disable interrupts; 2ms timelimit here!
400 now we're in the SUSPEND state ... must go OPERATIONAL
401 within 2msec else HC enters RESUME */
403 u32 cookie = irq_kill();
405 /* Tell the controller where the control and bulk lists are
406 * The lists are empty now. */
407 write32(OHCI0_HC_CTRL_HEAD_ED, 0);
408 write32(OHCI0_HC_BULK_HEAD_ED, 0);
410 /* set hcca adress */
411 sync_after_write(&hcca_oh0, 256);
412 write32(OHCI0_HC_HCCA, virt_to_phys(&hcca_oh0));
414 /* set periodicstart */
416 u32 fmInterval = read32(OHCI0_HC_FM_INTERVAL) &0x3fff;
417 u32 fit = read32(OHCI0_HC_FM_INTERVAL) & FIT;
419 write32(OHCI0_HC_FM_INTERVAL, fmint | (fit ^ FIT));
420 write32(OHCI0_HC_PERIODIC_START, ((9*fmInterval)/10)&0x3fff);
423 if ((read32(OHCI0_HC_FM_INTERVAL) & 0x3fff0000) == 0 || !read32(OHCI0_HC_PERIODIC_START)) {
424 printf("ohci-- w00t, fail!! see ohci-hcd.c:669\n");
427 /* start HC operations */
428 write32(OHCI0_HC_CONTROL, OHCI_CONTROL_INIT | OHCI_USB_OPER);
430 /* wake on ConnectStatusChange, matching external hubs */
431 write32(OHCI0_HC_RH_STATUS, /*RH_HS_DRWE |*/ RH_HS_LPSC);
433 /* Choose the interrupts we care about now, others later on demand */
434 write32(OHCI0_HC_INT_STATUS, ~0);
435 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_INIT);
438 wait_ms ((read32(OHCI0_HC_RH_DESCRIPTOR_A) >> 23) & 0x1fe);
440 configure_ports((u8)1);
446 static void configure_ports(u8 from_init)
448 printf("OHCI0_HC_RH_DESCRIPTOR_A:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_A));
449 printf("OHCI0_HC_RH_DESCRIPTOR_B:\t0x%08X\n", read32(OHCI0_HC_RH_DESCRIPTOR_B));
450 printf("OHCI0_HC_RH_STATUS:\t\t0x%08X\n", read32(OHCI0_HC_RH_STATUS));
451 printf("OHCI0_HC_RH_PORT_STATUS_1:\t0x%08X\n", read32(OHCI0_HC_RH_PORT_STATUS_1));
452 printf("OHCI0_HC_RH_PORT_STATUS_2:\t0x%08X\n", read32(OHCI0_HC_RH_PORT_STATUS_2));
454 setup_port(OHCI0_HC_RH_PORT_STATUS_1, from_init);
455 setup_port(OHCI0_HC_RH_PORT_STATUS_2, from_init);
456 printf("configure_ports done\n");
459 static void setup_port(u32 reg, u8 from_init)
461 u32 port = read32(reg);
462 if((port & RH_PS_CCS) && ((port & RH_PS_CSC) || from_init)) {
463 write32(reg, RH_PS_CSC);
467 /* clear CSC flag, set PES and start port reset (PRS) */
468 write32(reg, RH_PS_PES);
469 while(!(read32(reg) & RH_PS_PES)) {
474 write32(reg, RH_PS_PRS);
476 /* spin until port reset is complete */
477 while(!(read32(reg) & RH_PS_PRSC)); // hint: it may stuck here
478 printf("loop done\n");
480 (void) usb_add_device();
486 /* read interrupt status */
487 u32 flags = read32(OHCI0_HC_INT_STATUS);
489 /* when all bits are set to 1 some problem occured */
490 if (flags == 0xffffffff) {
491 printf("ohci-- Houston, we have a serious problem! :(\n");
495 /* only care about interrupts that are enabled */
496 flags &= read32(OHCI0_HC_INT_ENABLE);
500 printf("OHCI Interrupt occured: but not for you! WTF?!\n");
504 printf("OHCI Interrupt occured: ");
505 /* UnrecoverableError */
506 if (flags & OHCI_INTR_UE) {
507 printf("UnrecoverableError\n");
508 /* TODO: well, I don't know... nothing,
509 * because it won't happen anyway? ;-) */
512 /* RootHubStatusChange */
513 if (flags & OHCI_INTR_RHSC) {
514 printf("RootHubStatusChange\n");
515 /* TODO: set some next_statechange variable... */
517 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD | OHCI_INTR_RHSC);
520 else if (flags & OHCI_INTR_RD) {
521 printf("ResumeDetected\n");
522 write32(OHCI0_HC_INT_STATUS, OHCI_INTR_RD);
523 /* TODO: figure out what the linux kernel does here... */
526 /* WritebackDoneHead */
527 if (flags & OHCI_INTR_WDH) {
528 printf("WritebackDoneHead\n");
529 /* basically the linux irq handler reverse TDs to their urbs
530 * and set done_head to null.
531 * since we are polling atm, just should do the latter task.
532 * however, this won't work for now (i don't know why...)
536 sync_before_read(&hcca_oh0, 256);
537 hcca_oh0.done_head = 0;
538 sync_after_write(&hcca_oh0, 256);
542 /* TODO: handle any pending URB/ED unlinks... */
544 #define HC_IS_RUNNING() 1 /* dirty, i know... just a temporary solution */
545 if (HC_IS_RUNNING()) {
546 write32(OHCI0_HC_INT_STATUS, flags);
547 write32(OHCI0_HC_INT_ENABLE, OHCI_INTR_MIE);
553 sync_before_read(&hcca_oh0, 256);
554 printf("***** frame_no: %d *****\n", LE(hcca_oh0.frame_no));