[Solved] OHCI Controller Never Responds

[BrightLight]

The title says it all. I'm trying to implement OHCI SETUP transfers, which my USB layer uses to detect attached devices. However, the OHCI always times out, without any relevant error or anything. In Bochs, the OHCI activity indicator never lights up, so I guess the OHCI somehow doesn't execute the descriptors at all.
To reset the OHCI, I set the "reset" bit in the Command/Status register and poll it until it clears. Then, I reset and enable all ports on the root hub, by setting the "port reset" bit, polling it until it clears, and then setting the "port enable" bit.

My EDs and TDs look correct.

Code: Select all

ED @ 0x0181A000:
00202000
F0000000
0181A010
00000000

TD1 @ 0x0181A010:
02000000
0000F8E8
0181A020
0000F8EF

TD2 @ 0x0181A020:
03100000
0000F8F0
0181A030
0000F901

TD3 @ 0x0181A030:
02080000
00000000
F0000000
00000000

I tell the device to execute the descriptors like this:

Code: Select all

	; disable control list execution
	mov edi, [.mmio]
	mov eax, [edi+OHCI_CONTROL]
	and eax, not OHCI_CONTROL_EXECUTE_CONTROL
	mov [edi+OHCI_CONTROL], eax

	; clear the communications area
	mov edi, [ohci_comm]
	mov eax, 0
	mov ecx, 256
	rep stosb

	; send the address of the communications area
	mov eax, [ohci_comm]
	call virtual_to_physical
	mov edi, [.mmio]
	mov [edi+OHCI_COMM], eax

	; send the address of the ED
	mov edi, [.mmio]
	mov eax, [.descriptors_phys]
	mov [edi+OHCI_CONTROL_HEAD_ED], eax

	mov eax, 0
	mov [edi+OHCI_CONTROL_CURRENT_ED], eax

	; control list filled
	mov edi, [.mmio]
	mov eax, [edi+OHCI_COMMAND]
	or eax, OHCI_COMMAND_CONTROL_FILLED
	mov [edi+OHCI_COMMAND], eax

	; enable execution
	mov edi, [.mmio]
	mov eax, [edi+OHCI_CONTROL]
	or eax, OHCI_CONTROL_EXECUTE_CONTROL
	mov ebx, 2		; operational mode
	shl ebx, 6
	or eax, ebx
	mov [edi+OHCI_CONTROL], eax

I then poll the controller, waiting for any error bits to set, or ED's "head TD" field to be equal to the "tail TD" field, but the "head TD" field is never changed, and no errors are set either, and the ED's completion code stays zero, and the controller is apparently not even doing anything. Is there something I am missing here?

EDIT: I managed to get it working in QEMU. I forgot to set the controller's operational mode in the control register. However, in Bochs, it is still the same, with no sign of it working at all. I've updated the code snipped shown above.

[BenLunt]

Hi,

Sorry, I don't have much time to look at your code at the moment. Possibly later.

However, I wrote the OHCI emulation in Bochs to have many BX_DEBUG messages. Just as Bochs starts, click on the config button and navigate through the debug message enable items until you get to the OHCI, finally enabling that module. This should print many messages to the log file, hopefully giving you some insight on what is going on.

Better yet, if you have the capabilities to compile the Bochs emulator, you can go and enable these manually, entering other BX_DEBUG (BX_INFO) messages as you please. I haven't got the latest code from the main trunk in some time. Maybe it is about time I update my end to be current with the Bochs trunk.

Anyway, try the BX_DEBUG output above and see what happens. If I get some time, possibly tomorrow, you can send me an URL to download the image file so that I can have a look too.

Thanks,
Ben

[SpyderTL]

I'm assuming that you don't have a companion EHCI controller.

Check the PCI configuration space for the controller and make sure it has access to MMIO memory.

[BrightLight]

Just as Bochs starts, click on the config button and navigate through the debug message enable items until you get to the OHCI, finally enabling that module. This should print many messages to the log file, hopefully giving you some insight on what is going on.

It only shows PCI accesses - it doesn't show any errors or any transfer being done on the OHCI itself. I'll add more messages to Bochs' OHCI code, and recompile it. Thanks.

Check the PCI configuration space for the controller and make sure it has access to MMIO memory.

I enable MMIO and bus mastering before even doing anything to the OHCI -- before even mapping its registers in the virtual address space.

EDIT: This is the register access logs, and it looks correct:

Code: Select all

00025628589i[OHCI  ] register write to  address 0xC0000008 (HCCommandStatus   ):  0x00000008 (len=4)
00025668180i[OHCI  ] register write to  address 0xC0000008 (HCCommandStatus   ):  0x00000001 (len=4)
00025672172i[OHCI  ] register write to  address 0xC0000014 (HCInterruptDisable):  0xC000007F (len=4)
00025672172i[OHCI  ] register write to  address 0xC000000C (HCInterruptStatus ):  0x0000007F (len=4)
00025672172i[OHCI  ] register write to  address 0xC0000004 (HCControl         ):  0x000000C0 (len=4)
00025712209i[OHCI  ] register write to  address 0xC0000050 (HCRhStatus        ):  0x00010000 (len=4)
00025792259i[OHCI  ] register write to  address 0xC0000054 (HCRhPortStatus0   ):  0x00000100 (len=4)
00025832290i[OHCI  ] register write to  address 0xC0000054 (HCRhPortStatus0   ):  0x00000010 (len=4)
00025832290i[OHCI  ] register write to  address 0xC0000054 (HCRhPortStatus0   ):  0x00000002 (len=4)
00025852307i[OHCI  ] register write to  address 0xC0000058 (HCRhPortStatus1   ):  0x00000100 (len=4)
00025892331i[OHCI  ] register write to  address 0xC0000058 (HCRhPortStatus1   ):  0x00000010 (len=4)
00025892331i[OHCI  ] register write to  address 0xC0000058 (HCRhPortStatus1   ):  0x00000002 (len=4)
00025912351i[OHCI  ] register write to  address 0xC0000004 (HCControl         ):  0x000000C0 (len=4)

That is resetting the OHCI; this is the SETUP transfer:

Code: Select all

00025912669i[OHCI  ] register write to  address 0xC0000004 (HCControl         ):  0x000000C0 (len=4)
00025912948i[OHCI  ] register write to  address 0xC0000018 (HCHCCA            ):  0x0182C000 (len=4)
00025912948i[OHCI  ] register write to  address 0xC0000020 (HCControlHeadED   ):  0x01824000 (len=4)
00025912948i[OHCI  ] register write to  address 0xC0000024 (HCControlCurrentED):  0x00000000 (len=4)
00025912948i[OHCI  ] register write to  address 0xC0000008 (HCCommandStatus   ):  0x00000002 (len=4)
00025912948i[OHCI  ] register write to  address 0xC0000004 (HCControl         ):  0x000000D0 (len=4)

[BrightLight]

I solved it. The problem was that when I try to set the OHCI operational state to "operating" (i.e. value 2 in a 2-bit field), I was simply ORing without ANDing first. And so the final value was written 3, which is the "suspend" state. And common sense says the controller isn't going to execute anything while it's in the suspend state.
Thanks, Ben. The Bochs log helped me find this error.