cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

tusb6010.c (25826B)


      1/*
      2 * Texas Instruments TUSB6010 emulation.
      3 * Based on reverse-engineering of a linux driver.
      4 *
      5 * Copyright (C) 2008 Nokia Corporation
      6 * Written by Andrzej Zaborowski <andrew@openedhand.com>
      7 *
      8 * This program is free software; you can redistribute it and/or
      9 * modify it under the terms of the GNU General Public License as
     10 * published by the Free Software Foundation; either version 2 or
     11 * (at your option) version 3 of the License.
     12 *
     13 * This program is distributed in the hope that it will be useful,
     14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     16 * GNU General Public License for more details.
     17 *
     18 * You should have received a copy of the GNU General Public License along
     19 * with this program; if not, see <http://www.gnu.org/licenses/>.
     20 */
     21
     22#include "qemu/osdep.h"
     23#include "qemu/module.h"
     24#include "qemu/timer.h"
     25#include "hw/usb.h"
     26#include "hw/usb/hcd-musb.h"
     27#include "hw/arm/omap.h"
     28#include "hw/hw.h"
     29#include "hw/irq.h"
     30#include "hw/sysbus.h"
     31#include "qom/object.h"
     32
     33#define TYPE_TUSB6010 "tusb6010"
     34OBJECT_DECLARE_SIMPLE_TYPE(TUSBState, TUSB6010)
     35
     36struct TUSBState {
     37    SysBusDevice parent_obj;
     38
     39    MemoryRegion iomem[2];
     40    qemu_irq irq;
     41    MUSBState *musb;
     42    QEMUTimer *otg_timer;
     43    QEMUTimer *pwr_timer;
     44
     45    int power;
     46    uint32_t scratch;
     47    uint16_t test_reset;
     48    uint32_t prcm_config;
     49    uint32_t prcm_mngmt;
     50    uint16_t otg_status;
     51    uint32_t dev_config;
     52    int host_mode;
     53    uint32_t intr;
     54    uint32_t intr_ok;
     55    uint32_t mask;
     56    uint32_t usbip_intr;
     57    uint32_t usbip_mask;
     58    uint32_t gpio_intr;
     59    uint32_t gpio_mask;
     60    uint32_t gpio_config;
     61    uint32_t dma_intr;
     62    uint32_t dma_mask;
     63    uint32_t dma_map;
     64    uint32_t dma_config;
     65    uint32_t ep0_config;
     66    uint32_t rx_config[15];
     67    uint32_t tx_config[15];
     68    uint32_t wkup_mask;
     69    uint32_t pullup[2];
     70    uint32_t control_config;
     71    uint32_t otg_timer_val;
     72};
     73
     74#define TUSB_DEVCLOCK			60000000	/* 60 MHz */
     75
     76#define TUSB_VLYNQ_CTRL			0x004
     77
     78/* Mentor Graphics OTG core registers.  */
     79#define TUSB_BASE_OFFSET		0x400
     80
     81/* FIFO registers, 32-bit.  */
     82#define TUSB_FIFO_BASE			0x600
     83
     84/* Device System & Control registers, 32-bit.  */
     85#define TUSB_SYS_REG_BASE		0x800
     86
     87#define TUSB_DEV_CONF			(TUSB_SYS_REG_BASE + 0x000)
     88#define	TUSB_DEV_CONF_USB_HOST_MODE	(1 << 16)
     89#define	TUSB_DEV_CONF_PROD_TEST_MODE	(1 << 15)
     90#define	TUSB_DEV_CONF_SOFT_ID		(1 << 1)
     91#define	TUSB_DEV_CONF_ID_SEL		(1 << 0)
     92
     93#define TUSB_PHY_OTG_CTRL_ENABLE	(TUSB_SYS_REG_BASE + 0x004)
     94#define TUSB_PHY_OTG_CTRL		(TUSB_SYS_REG_BASE + 0x008)
     95#define	TUSB_PHY_OTG_CTRL_WRPROTECT	(0xa5 << 24)
     96#define	TUSB_PHY_OTG_CTRL_O_ID_PULLUP	(1 << 23)
     97#define	TUSB_PHY_OTG_CTRL_O_VBUS_DET_EN	(1 << 19)
     98#define	TUSB_PHY_OTG_CTRL_O_SESS_END_EN	(1 << 18)
     99#define	TUSB_PHY_OTG_CTRL_TESTM2	(1 << 17)
    100#define	TUSB_PHY_OTG_CTRL_TESTM1	(1 << 16)
    101#define	TUSB_PHY_OTG_CTRL_TESTM0	(1 << 15)
    102#define	TUSB_PHY_OTG_CTRL_TX_DATA2	(1 << 14)
    103#define	TUSB_PHY_OTG_CTRL_TX_GZ2	(1 << 13)
    104#define	TUSB_PHY_OTG_CTRL_TX_ENABLE2	(1 << 12)
    105#define	TUSB_PHY_OTG_CTRL_DM_PULLDOWN	(1 << 11)
    106#define	TUSB_PHY_OTG_CTRL_DP_PULLDOWN	(1 << 10)
    107#define	TUSB_PHY_OTG_CTRL_OSC_EN	(1 << 9)
    108#define	TUSB_PHY_OTG_CTRL_PHYREF_CLK(v)	(((v) & 3) << 7)
    109#define	TUSB_PHY_OTG_CTRL_PD		(1 << 6)
    110#define	TUSB_PHY_OTG_CTRL_PLL_ON	(1 << 5)
    111#define	TUSB_PHY_OTG_CTRL_EXT_RPU	(1 << 4)
    112#define	TUSB_PHY_OTG_CTRL_PWR_GOOD	(1 << 3)
    113#define	TUSB_PHY_OTG_CTRL_RESET		(1 << 2)
    114#define	TUSB_PHY_OTG_CTRL_SUSPENDM	(1 << 1)
    115#define	TUSB_PHY_OTG_CTRL_CLK_MODE	(1 << 0)
    116
    117/* OTG status register */
    118#define TUSB_DEV_OTG_STAT		(TUSB_SYS_REG_BASE + 0x00c)
    119#define	TUSB_DEV_OTG_STAT_PWR_CLK_GOOD	(1 << 8)
    120#define	TUSB_DEV_OTG_STAT_SESS_END	(1 << 7)
    121#define	TUSB_DEV_OTG_STAT_SESS_VALID	(1 << 6)
    122#define	TUSB_DEV_OTG_STAT_VBUS_VALID	(1 << 5)
    123#define	TUSB_DEV_OTG_STAT_VBUS_SENSE	(1 << 4)
    124#define	TUSB_DEV_OTG_STAT_ID_STATUS	(1 << 3)
    125#define	TUSB_DEV_OTG_STAT_HOST_DISCON	(1 << 2)
    126#define	TUSB_DEV_OTG_STAT_LINE_STATE	(3 << 0)
    127#define	TUSB_DEV_OTG_STAT_DP_ENABLE	(1 << 1)
    128#define	TUSB_DEV_OTG_STAT_DM_ENABLE	(1 << 0)
    129
    130#define TUSB_DEV_OTG_TIMER		(TUSB_SYS_REG_BASE + 0x010)
    131#define TUSB_DEV_OTG_TIMER_ENABLE	(1 << 31)
    132#define TUSB_DEV_OTG_TIMER_VAL(v)	((v) & 0x07ffffff)
    133#define TUSB_PRCM_REV			(TUSB_SYS_REG_BASE + 0x014)
    134
    135/* PRCM configuration register */
    136#define TUSB_PRCM_CONF			(TUSB_SYS_REG_BASE + 0x018)
    137#define	TUSB_PRCM_CONF_SFW_CPEN		(1 << 24)
    138#define	TUSB_PRCM_CONF_SYS_CLKSEL(v)	(((v) & 3) << 16)
    139
    140/* PRCM management register */
    141#define TUSB_PRCM_MNGMT			(TUSB_SYS_REG_BASE + 0x01c)
    142#define	TUSB_PRCM_MNGMT_SRP_FIX_TMR(v)	(((v) & 0xf) << 25)
    143#define	TUSB_PRCM_MNGMT_SRP_FIX_EN	(1 << 24)
    144#define	TUSB_PRCM_MNGMT_VBUS_VAL_TMR(v)	(((v) & 0xf) << 20)
    145#define	TUSB_PRCM_MNGMT_VBUS_VAL_FLT_EN	(1 << 19)
    146#define	TUSB_PRCM_MNGMT_DFT_CLK_DIS	(1 << 18)
    147#define	TUSB_PRCM_MNGMT_VLYNQ_CLK_DIS	(1 << 17)
    148#define	TUSB_PRCM_MNGMT_OTG_SESS_END_EN	(1 << 10)
    149#define	TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN	(1 << 9)
    150#define	TUSB_PRCM_MNGMT_OTG_ID_PULLUP	(1 << 8)
    151#define	TUSB_PRCM_MNGMT_15_SW_EN	(1 << 4)
    152#define	TUSB_PRCM_MNGMT_33_SW_EN	(1 << 3)
    153#define	TUSB_PRCM_MNGMT_5V_CPEN		(1 << 2)
    154#define	TUSB_PRCM_MNGMT_PM_IDLE		(1 << 1)
    155#define	TUSB_PRCM_MNGMT_DEV_IDLE	(1 << 0)
    156
    157/* Wake-up source clear and mask registers */
    158#define TUSB_PRCM_WAKEUP_SOURCE		(TUSB_SYS_REG_BASE + 0x020)
    159#define TUSB_PRCM_WAKEUP_CLEAR		(TUSB_SYS_REG_BASE + 0x028)
    160#define TUSB_PRCM_WAKEUP_MASK		(TUSB_SYS_REG_BASE + 0x02c)
    161#define	TUSB_PRCM_WAKEUP_RESERVED_BITS	(0xffffe << 13)
    162#define	TUSB_PRCM_WGPIO_7		(1 << 12)
    163#define	TUSB_PRCM_WGPIO_6		(1 << 11)
    164#define	TUSB_PRCM_WGPIO_5		(1 << 10)
    165#define	TUSB_PRCM_WGPIO_4		(1 << 9)
    166#define	TUSB_PRCM_WGPIO_3		(1 << 8)
    167#define	TUSB_PRCM_WGPIO_2		(1 << 7)
    168#define	TUSB_PRCM_WGPIO_1		(1 << 6)
    169#define	TUSB_PRCM_WGPIO_0		(1 << 5)
    170#define	TUSB_PRCM_WHOSTDISCON		(1 << 4)	/* Host disconnect */
    171#define	TUSB_PRCM_WBUS			(1 << 3)	/* USB bus resume */
    172#define	TUSB_PRCM_WNORCS		(1 << 2)	/* NOR chip select */
    173#define	TUSB_PRCM_WVBUS			(1 << 1)	/* OTG PHY VBUS */
    174#define	TUSB_PRCM_WID			(1 << 0)	/* OTG PHY ID detect */
    175
    176#define TUSB_PULLUP_1_CTRL		(TUSB_SYS_REG_BASE + 0x030)
    177#define TUSB_PULLUP_2_CTRL		(TUSB_SYS_REG_BASE + 0x034)
    178#define TUSB_INT_CTRL_REV		(TUSB_SYS_REG_BASE + 0x038)
    179#define TUSB_INT_CTRL_CONF		(TUSB_SYS_REG_BASE + 0x03c)
    180#define TUSB_USBIP_INT_SRC		(TUSB_SYS_REG_BASE + 0x040)
    181#define TUSB_USBIP_INT_SET		(TUSB_SYS_REG_BASE + 0x044)
    182#define TUSB_USBIP_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x048)
    183#define TUSB_USBIP_INT_MASK		(TUSB_SYS_REG_BASE + 0x04c)
    184#define TUSB_DMA_INT_SRC		(TUSB_SYS_REG_BASE + 0x050)
    185#define TUSB_DMA_INT_SET		(TUSB_SYS_REG_BASE + 0x054)
    186#define TUSB_DMA_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x058)
    187#define TUSB_DMA_INT_MASK		(TUSB_SYS_REG_BASE + 0x05c)
    188#define TUSB_GPIO_INT_SRC		(TUSB_SYS_REG_BASE + 0x060)
    189#define TUSB_GPIO_INT_SET		(TUSB_SYS_REG_BASE + 0x064)
    190#define TUSB_GPIO_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x068)
    191#define TUSB_GPIO_INT_MASK		(TUSB_SYS_REG_BASE + 0x06c)
    192
    193/* NOR flash interrupt source registers */
    194#define TUSB_INT_SRC			(TUSB_SYS_REG_BASE + 0x070)
    195#define TUSB_INT_SRC_SET		(TUSB_SYS_REG_BASE + 0x074)
    196#define TUSB_INT_SRC_CLEAR		(TUSB_SYS_REG_BASE + 0x078)
    197#define TUSB_INT_MASK			(TUSB_SYS_REG_BASE + 0x07c)
    198#define	TUSB_INT_SRC_TXRX_DMA_DONE	(1 << 24)
    199#define	TUSB_INT_SRC_USB_IP_CORE	(1 << 17)
    200#define	TUSB_INT_SRC_OTG_TIMEOUT	(1 << 16)
    201#define	TUSB_INT_SRC_VBUS_SENSE_CHNG	(1 << 15)
    202#define	TUSB_INT_SRC_ID_STATUS_CHNG	(1 << 14)
    203#define	TUSB_INT_SRC_DEV_WAKEUP		(1 << 13)
    204#define	TUSB_INT_SRC_DEV_READY		(1 << 12)
    205#define	TUSB_INT_SRC_USB_IP_TX		(1 << 9)
    206#define	TUSB_INT_SRC_USB_IP_RX		(1 << 8)
    207#define	TUSB_INT_SRC_USB_IP_VBUS_ERR	(1 << 7)
    208#define	TUSB_INT_SRC_USB_IP_VBUS_REQ	(1 << 6)
    209#define	TUSB_INT_SRC_USB_IP_DISCON	(1 << 5)
    210#define	TUSB_INT_SRC_USB_IP_CONN	(1 << 4)
    211#define	TUSB_INT_SRC_USB_IP_SOF		(1 << 3)
    212#define	TUSB_INT_SRC_USB_IP_RST_BABBLE	(1 << 2)
    213#define	TUSB_INT_SRC_USB_IP_RESUME	(1 << 1)
    214#define	TUSB_INT_SRC_USB_IP_SUSPEND	(1 << 0)
    215
    216#define TUSB_GPIO_REV			(TUSB_SYS_REG_BASE + 0x080)
    217#define TUSB_GPIO_CONF			(TUSB_SYS_REG_BASE + 0x084)
    218#define TUSB_DMA_CTRL_REV		(TUSB_SYS_REG_BASE + 0x100)
    219#define TUSB_DMA_REQ_CONF		(TUSB_SYS_REG_BASE + 0x104)
    220#define TUSB_EP0_CONF			(TUSB_SYS_REG_BASE + 0x108)
    221#define TUSB_EP_IN_SIZE			(TUSB_SYS_REG_BASE + 0x10c)
    222#define TUSB_DMA_EP_MAP			(TUSB_SYS_REG_BASE + 0x148)
    223#define TUSB_EP_OUT_SIZE		(TUSB_SYS_REG_BASE + 0x14c)
    224#define TUSB_EP_MAX_PACKET_SIZE_OFFSET	(TUSB_SYS_REG_BASE + 0x188)
    225#define TUSB_SCRATCH_PAD		(TUSB_SYS_REG_BASE + 0x1c4)
    226#define TUSB_WAIT_COUNT			(TUSB_SYS_REG_BASE + 0x1c8)
    227#define TUSB_PROD_TEST_RESET		(TUSB_SYS_REG_BASE + 0x1d8)
    228
    229#define TUSB_DIDR1_LO			(TUSB_SYS_REG_BASE + 0x1f8)
    230#define TUSB_DIDR1_HI			(TUSB_SYS_REG_BASE + 0x1fc)
    231
    232/* Device System & Control register bitfields */
    233#define TUSB_INT_CTRL_CONF_INT_RLCYC(v)	(((v) & 0x7) << 18)
    234#define TUSB_INT_CTRL_CONF_INT_POLARITY	(1 << 17)
    235#define TUSB_INT_CTRL_CONF_INT_MODE	(1 << 16)
    236#define TUSB_GPIO_CONF_DMAREQ(v)	(((v) & 0x3f) << 24)
    237#define TUSB_DMA_REQ_CONF_BURST_SIZE(v)	(((v) & 3) << 26)
    238#define TUSB_DMA_REQ_CONF_DMA_RQ_EN(v)	(((v) & 0x3f) << 20)
    239#define TUSB_DMA_REQ_CONF_DMA_RQ_ASR(v)	(((v) & 0xf) << 16)
    240#define TUSB_EP0_CONFIG_SW_EN		(1 << 8)
    241#define TUSB_EP0_CONFIG_DIR_TX		(1 << 7)
    242#define TUSB_EP0_CONFIG_XFR_SIZE(v)	((v) & 0x7f)
    243#define TUSB_EP_CONFIG_SW_EN		(1 << 31)
    244#define TUSB_EP_CONFIG_XFR_SIZE(v)	((v) & 0x7fffffff)
    245#define TUSB_PROD_TEST_RESET_VAL	0xa596
    246
    247static void tusb_intr_update(TUSBState *s)
    248{
    249    if (s->control_config & TUSB_INT_CTRL_CONF_INT_POLARITY)
    250        qemu_set_irq(s->irq, s->intr & ~s->mask & s->intr_ok);
    251    else
    252        qemu_set_irq(s->irq, (!(s->intr & ~s->mask)) & s->intr_ok);
    253}
    254
    255static void tusb_usbip_intr_update(TUSBState *s)
    256{
    257    /* TX interrupt in the MUSB */
    258    if (s->usbip_intr & 0x0000ffff & ~s->usbip_mask)
    259        s->intr |= TUSB_INT_SRC_USB_IP_TX;
    260    else
    261        s->intr &= ~TUSB_INT_SRC_USB_IP_TX;
    262
    263    /* RX interrupt in the MUSB */
    264    if (s->usbip_intr & 0xffff0000 & ~s->usbip_mask)
    265        s->intr |= TUSB_INT_SRC_USB_IP_RX;
    266    else
    267        s->intr &= ~TUSB_INT_SRC_USB_IP_RX;
    268
    269    /* XXX: What about TUSB_INT_SRC_USB_IP_CORE?  */
    270
    271    tusb_intr_update(s);
    272}
    273
    274static void tusb_dma_intr_update(TUSBState *s)
    275{
    276    if (s->dma_intr & ~s->dma_mask)
    277        s->intr |= TUSB_INT_SRC_TXRX_DMA_DONE;
    278    else
    279        s->intr &= ~TUSB_INT_SRC_TXRX_DMA_DONE;
    280
    281    tusb_intr_update(s);
    282}
    283
    284static void tusb_gpio_intr_update(TUSBState *s)
    285{
    286    /* TODO: How is this signalled?  */
    287}
    288
    289static uint32_t tusb_async_readb(void *opaque, hwaddr addr)
    290{
    291    TUSBState *s = (TUSBState *) opaque;
    292
    293    switch (addr & 0xfff) {
    294    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    295        return musb_read[0](s->musb, addr & 0x1ff);
    296
    297    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    298        return musb_read[0](s->musb, 0x20 + ((addr >> 3) & 0x3c));
    299    }
    300
    301    printf("%s: unknown register at %03x\n",
    302                    __func__, (int) (addr & 0xfff));
    303    return 0;
    304}
    305
    306static uint32_t tusb_async_readh(void *opaque, hwaddr addr)
    307{
    308    TUSBState *s = (TUSBState *) opaque;
    309
    310    switch (addr & 0xfff) {
    311    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    312        return musb_read[1](s->musb, addr & 0x1ff);
    313
    314    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    315        return musb_read[1](s->musb, 0x20 + ((addr >> 3) & 0x3c));
    316    }
    317
    318    printf("%s: unknown register at %03x\n",
    319                    __func__, (int) (addr & 0xfff));
    320    return 0;
    321}
    322
    323static uint32_t tusb_async_readw(void *opaque, hwaddr addr)
    324{
    325    TUSBState *s = (TUSBState *) opaque;
    326    int offset = addr & 0xfff;
    327    int epnum;
    328    uint32_t ret;
    329
    330    switch (offset) {
    331    case TUSB_DEV_CONF:
    332        return s->dev_config;
    333
    334    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    335        return musb_read[2](s->musb, offset & 0x1ff);
    336
    337    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    338        return musb_read[2](s->musb, 0x20 + ((addr >> 3) & 0x3c));
    339
    340    case TUSB_PHY_OTG_CTRL_ENABLE:
    341    case TUSB_PHY_OTG_CTRL:
    342        return 0x00;	/* TODO */
    343
    344    case TUSB_DEV_OTG_STAT:
    345        ret = s->otg_status;
    346#if 0
    347        if (!(s->prcm_mngmt & TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN))
    348            ret &= ~TUSB_DEV_OTG_STAT_VBUS_VALID;
    349#endif
    350        return ret;
    351    case TUSB_DEV_OTG_TIMER:
    352        return s->otg_timer_val;
    353
    354    case TUSB_PRCM_REV:
    355        return 0x20;
    356    case TUSB_PRCM_CONF:
    357        return s->prcm_config;
    358    case TUSB_PRCM_MNGMT:
    359        return s->prcm_mngmt;
    360    case TUSB_PRCM_WAKEUP_SOURCE:
    361    case TUSB_PRCM_WAKEUP_CLEAR:	/* TODO: What does this one return?  */
    362        return 0x00000000;
    363    case TUSB_PRCM_WAKEUP_MASK:
    364        return s->wkup_mask;
    365
    366    case TUSB_PULLUP_1_CTRL:
    367        return s->pullup[0];
    368    case TUSB_PULLUP_2_CTRL:
    369        return s->pullup[1];
    370
    371    case TUSB_INT_CTRL_REV:
    372        return 0x20;
    373    case TUSB_INT_CTRL_CONF:
    374        return s->control_config;
    375
    376    case TUSB_USBIP_INT_SRC:
    377    case TUSB_USBIP_INT_SET:	/* TODO: What do these two return?  */
    378    case TUSB_USBIP_INT_CLEAR:
    379        return s->usbip_intr;
    380    case TUSB_USBIP_INT_MASK:
    381        return s->usbip_mask;
    382
    383    case TUSB_DMA_INT_SRC:
    384    case TUSB_DMA_INT_SET:	/* TODO: What do these two return?  */
    385    case TUSB_DMA_INT_CLEAR:
    386        return s->dma_intr;
    387    case TUSB_DMA_INT_MASK:
    388        return s->dma_mask;
    389
    390    case TUSB_GPIO_INT_SRC:	/* TODO: What do these two return?  */
    391    case TUSB_GPIO_INT_SET:
    392    case TUSB_GPIO_INT_CLEAR:
    393        return s->gpio_intr;
    394    case TUSB_GPIO_INT_MASK:
    395        return s->gpio_mask;
    396
    397    case TUSB_INT_SRC:
    398    case TUSB_INT_SRC_SET:	/* TODO: What do these two return?  */
    399    case TUSB_INT_SRC_CLEAR:
    400        return s->intr;
    401    case TUSB_INT_MASK:
    402        return s->mask;
    403
    404    case TUSB_GPIO_REV:
    405        return 0x30;
    406    case TUSB_GPIO_CONF:
    407        return s->gpio_config;
    408
    409    case TUSB_DMA_CTRL_REV:
    410        return 0x30;
    411    case TUSB_DMA_REQ_CONF:
    412        return s->dma_config;
    413    case TUSB_EP0_CONF:
    414        return s->ep0_config;
    415    case TUSB_EP_IN_SIZE ... (TUSB_EP_IN_SIZE + 0x3b):
    416        epnum = (offset - TUSB_EP_IN_SIZE) >> 2;
    417        return s->tx_config[epnum];
    418    case TUSB_DMA_EP_MAP:
    419        return s->dma_map;
    420    case TUSB_EP_OUT_SIZE ... (TUSB_EP_OUT_SIZE + 0x3b):
    421        epnum = (offset - TUSB_EP_OUT_SIZE) >> 2;
    422        return s->rx_config[epnum];
    423    case TUSB_EP_MAX_PACKET_SIZE_OFFSET ...
    424            (TUSB_EP_MAX_PACKET_SIZE_OFFSET + 0x3b):
    425        return 0x00000000;	/* TODO */
    426    case TUSB_WAIT_COUNT:
    427        return 0x00;		/* TODO */
    428
    429    case TUSB_SCRATCH_PAD:
    430        return s->scratch;
    431
    432    case TUSB_PROD_TEST_RESET:
    433        return s->test_reset;
    434
    435    /* DIE IDs */
    436    case TUSB_DIDR1_LO:
    437        return 0xa9453c59;
    438    case TUSB_DIDR1_HI:
    439        return 0x54059adf;
    440    }
    441
    442    printf("%s: unknown register at %03x\n", __func__, offset);
    443    return 0;
    444}
    445
    446static void tusb_async_writeb(void *opaque, hwaddr addr,
    447                uint32_t value)
    448{
    449    TUSBState *s = (TUSBState *) opaque;
    450
    451    switch (addr & 0xfff) {
    452    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    453        musb_write[0](s->musb, addr & 0x1ff, value);
    454        break;
    455
    456    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    457        musb_write[0](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
    458        break;
    459
    460    default:
    461        printf("%s: unknown register at %03x\n",
    462                        __func__, (int) (addr & 0xfff));
    463        return;
    464    }
    465}
    466
    467static void tusb_async_writeh(void *opaque, hwaddr addr,
    468                uint32_t value)
    469{
    470    TUSBState *s = (TUSBState *) opaque;
    471
    472    switch (addr & 0xfff) {
    473    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    474        musb_write[1](s->musb, addr & 0x1ff, value);
    475        break;
    476
    477    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    478        musb_write[1](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
    479        break;
    480
    481    default:
    482        printf("%s: unknown register at %03x\n",
    483                        __func__, (int) (addr & 0xfff));
    484        return;
    485    }
    486}
    487
    488static void tusb_async_writew(void *opaque, hwaddr addr,
    489                uint32_t value)
    490{
    491    TUSBState *s = (TUSBState *) opaque;
    492    int offset = addr & 0xfff;
    493    int epnum;
    494
    495    switch (offset) {
    496    case TUSB_VLYNQ_CTRL:
    497        break;
    498
    499    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
    500        musb_write[2](s->musb, offset & 0x1ff, value);
    501        break;
    502
    503    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
    504        musb_write[2](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
    505        break;
    506
    507    case TUSB_DEV_CONF:
    508        s->dev_config = value;
    509        s->host_mode = (value & TUSB_DEV_CONF_USB_HOST_MODE);
    510        if (value & TUSB_DEV_CONF_PROD_TEST_MODE)
    511            hw_error("%s: Product Test mode not allowed\n", __func__);
    512        break;
    513
    514    case TUSB_PHY_OTG_CTRL_ENABLE:
    515    case TUSB_PHY_OTG_CTRL:
    516        return;		/* TODO */
    517    case TUSB_DEV_OTG_TIMER:
    518        s->otg_timer_val = value;
    519        if (value & TUSB_DEV_OTG_TIMER_ENABLE)
    520            timer_mod(s->otg_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
    521                            muldiv64(TUSB_DEV_OTG_TIMER_VAL(value),
    522                                     NANOSECONDS_PER_SECOND, TUSB_DEVCLOCK));
    523        else
    524            timer_del(s->otg_timer);
    525        break;
    526
    527    case TUSB_PRCM_CONF:
    528        s->prcm_config = value;
    529        break;
    530    case TUSB_PRCM_MNGMT:
    531        s->prcm_mngmt = value;
    532        break;
    533    case TUSB_PRCM_WAKEUP_CLEAR:
    534        break;
    535    case TUSB_PRCM_WAKEUP_MASK:
    536        s->wkup_mask = value;
    537        break;
    538
    539    case TUSB_PULLUP_1_CTRL:
    540        s->pullup[0] = value;
    541        break;
    542    case TUSB_PULLUP_2_CTRL:
    543        s->pullup[1] = value;
    544        break;
    545    case TUSB_INT_CTRL_CONF:
    546        s->control_config = value;
    547        tusb_intr_update(s);
    548        break;
    549
    550    case TUSB_USBIP_INT_SET:
    551        s->usbip_intr |= value;
    552        tusb_usbip_intr_update(s);
    553        break;
    554    case TUSB_USBIP_INT_CLEAR:
    555        s->usbip_intr &= ~value;
    556        tusb_usbip_intr_update(s);
    557        musb_core_intr_clear(s->musb, ~value);
    558        break;
    559    case TUSB_USBIP_INT_MASK:
    560        s->usbip_mask = value;
    561        tusb_usbip_intr_update(s);
    562        break;
    563
    564    case TUSB_DMA_INT_SET:
    565        s->dma_intr |= value;
    566        tusb_dma_intr_update(s);
    567        break;
    568    case TUSB_DMA_INT_CLEAR:
    569        s->dma_intr &= ~value;
    570        tusb_dma_intr_update(s);
    571        break;
    572    case TUSB_DMA_INT_MASK:
    573        s->dma_mask = value;
    574        tusb_dma_intr_update(s);
    575        break;
    576
    577    case TUSB_GPIO_INT_SET:
    578        s->gpio_intr |= value;
    579        tusb_gpio_intr_update(s);
    580        break;
    581    case TUSB_GPIO_INT_CLEAR:
    582        s->gpio_intr &= ~value;
    583        tusb_gpio_intr_update(s);
    584        break;
    585    case TUSB_GPIO_INT_MASK:
    586        s->gpio_mask = value;
    587        tusb_gpio_intr_update(s);
    588        break;
    589
    590    case TUSB_INT_SRC_SET:
    591        s->intr |= value;
    592        tusb_intr_update(s);
    593        break;
    594    case TUSB_INT_SRC_CLEAR:
    595        s->intr &= ~value;
    596        tusb_intr_update(s);
    597        break;
    598    case TUSB_INT_MASK:
    599        s->mask = value;
    600        tusb_intr_update(s);
    601        break;
    602
    603    case TUSB_GPIO_CONF:
    604        s->gpio_config = value;
    605        break;
    606    case TUSB_DMA_REQ_CONF:
    607        s->dma_config = value;
    608        break;
    609    case TUSB_EP0_CONF:
    610        s->ep0_config = value & 0x1ff;
    611        musb_set_size(s->musb, 0, TUSB_EP0_CONFIG_XFR_SIZE(value),
    612                        value & TUSB_EP0_CONFIG_DIR_TX);
    613        break;
    614    case TUSB_EP_IN_SIZE ... (TUSB_EP_IN_SIZE + 0x3b):
    615        epnum = (offset - TUSB_EP_IN_SIZE) >> 2;
    616        s->tx_config[epnum] = value;
    617        musb_set_size(s->musb, epnum + 1, TUSB_EP_CONFIG_XFR_SIZE(value), 1);
    618        break;
    619    case TUSB_DMA_EP_MAP:
    620        s->dma_map = value;
    621        break;
    622    case TUSB_EP_OUT_SIZE ... (TUSB_EP_OUT_SIZE + 0x3b):
    623        epnum = (offset - TUSB_EP_OUT_SIZE) >> 2;
    624        s->rx_config[epnum] = value;
    625        musb_set_size(s->musb, epnum + 1, TUSB_EP_CONFIG_XFR_SIZE(value), 0);
    626        break;
    627    case TUSB_EP_MAX_PACKET_SIZE_OFFSET ...
    628            (TUSB_EP_MAX_PACKET_SIZE_OFFSET + 0x3b):
    629        return;		/* TODO */
    630    case TUSB_WAIT_COUNT:
    631        return;		/* TODO */
    632
    633    case TUSB_SCRATCH_PAD:
    634        s->scratch = value;
    635        break;
    636
    637    case TUSB_PROD_TEST_RESET:
    638        s->test_reset = value;
    639        break;
    640
    641    default:
    642        printf("%s: unknown register at %03x\n", __func__, offset);
    643        return;
    644    }
    645}
    646
    647static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)
    648{
    649    switch (size) {
    650    case 1:
    651        return tusb_async_readb(opaque, addr);
    652    case 2:
    653        return tusb_async_readh(opaque, addr);
    654    case 4:
    655        return tusb_async_readw(opaque, addr);
    656    default:
    657        g_assert_not_reached();
    658    }
    659}
    660
    661static void tusb_async_writefn(void *opaque, hwaddr addr,
    662                               uint64_t value, unsigned size)
    663{
    664    switch (size) {
    665    case 1:
    666        tusb_async_writeb(opaque, addr, value);
    667        break;
    668    case 2:
    669        tusb_async_writeh(opaque, addr, value);
    670        break;
    671    case 4:
    672        tusb_async_writew(opaque, addr, value);
    673        break;
    674    default:
    675        g_assert_not_reached();
    676    }
    677}
    678
    679static const MemoryRegionOps tusb_async_ops = {
    680    .read = tusb_async_readfn,
    681    .write = tusb_async_writefn,
    682    .valid.min_access_size = 1,
    683    .valid.max_access_size = 4,
    684    .endianness = DEVICE_NATIVE_ENDIAN,
    685};
    686
    687static void tusb_otg_tick(void *opaque)
    688{
    689    TUSBState *s = (TUSBState *) opaque;
    690
    691    s->otg_timer_val = 0;
    692    s->intr |= TUSB_INT_SRC_OTG_TIMEOUT;
    693    tusb_intr_update(s);
    694}
    695
    696static void tusb_power_tick(void *opaque)
    697{
    698    TUSBState *s = (TUSBState *) opaque;
    699
    700    if (s->power) {
    701        s->intr_ok = ~0;
    702        tusb_intr_update(s);
    703    }
    704}
    705
    706static void tusb_musb_core_intr(void *opaque, int source, int level)
    707{
    708    TUSBState *s = (TUSBState *) opaque;
    709    uint16_t otg_status = s->otg_status;
    710
    711    switch (source) {
    712    case musb_set_vbus:
    713        if (level)
    714            otg_status |= TUSB_DEV_OTG_STAT_VBUS_VALID;
    715        else
    716            otg_status &= ~TUSB_DEV_OTG_STAT_VBUS_VALID;
    717
    718        /* XXX: only if TUSB_PHY_OTG_CTRL_OTG_VBUS_DET_EN set?  */
    719        /* XXX: only if TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN set?  */
    720        if (s->otg_status != otg_status) {
    721            s->otg_status = otg_status;
    722            s->intr |= TUSB_INT_SRC_VBUS_SENSE_CHNG;
    723            tusb_intr_update(s);
    724        }
    725        break;
    726
    727    case musb_set_session:
    728        /* XXX: only if TUSB_PHY_OTG_CTRL_OTG_SESS_END_EN set?  */
    729        /* XXX: only if TUSB_PRCM_MNGMT_OTG_SESS_END_EN set?  */
    730        if (level) {
    731            s->otg_status |= TUSB_DEV_OTG_STAT_SESS_VALID;
    732            s->otg_status &= ~TUSB_DEV_OTG_STAT_SESS_END;
    733        } else {
    734            s->otg_status &= ~TUSB_DEV_OTG_STAT_SESS_VALID;
    735            s->otg_status |= TUSB_DEV_OTG_STAT_SESS_END;
    736        }
    737
    738        /* XXX: some IRQ or anything?  */
    739        break;
    740
    741    case musb_irq_tx:
    742    case musb_irq_rx:
    743        s->usbip_intr = musb_core_intr_get(s->musb);
    744        /* Fall through.  */
    745    default:
    746        if (level)
    747            s->intr |= 1 << source;
    748        else
    749            s->intr &= ~(1 << source);
    750        tusb_intr_update(s);
    751        break;
    752    }
    753}
    754
    755static void tusb6010_power(TUSBState *s, int on)
    756{
    757    if (!on) {
    758        s->power = 0;
    759    } else if (!s->power && on) {
    760        s->power = 1;
    761        /* Pull the interrupt down after TUSB6010 comes up.  */
    762        s->intr_ok = 0;
    763        tusb_intr_update(s);
    764        timer_mod(s->pwr_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
    765                  NANOSECONDS_PER_SECOND / 2);
    766    }
    767}
    768
    769static void tusb6010_irq(void *opaque, int source, int level)
    770{
    771    if (source) {
    772        tusb_musb_core_intr(opaque, source - 1, level);
    773    } else {
    774        tusb6010_power(opaque, level);
    775    }
    776}
    777
    778static void tusb6010_reset(DeviceState *dev)
    779{
    780    TUSBState *s = TUSB6010(dev);
    781    int i;
    782
    783    s->test_reset = TUSB_PROD_TEST_RESET_VAL;
    784    s->host_mode = 0;
    785    s->dev_config = 0;
    786    s->otg_status = 0;	/* !TUSB_DEV_OTG_STAT_ID_STATUS means host mode */
    787    s->power = 0;
    788    s->mask = 0xffffffff;
    789    s->intr = 0x00000000;
    790    s->otg_timer_val = 0;
    791    s->scratch = 0;
    792    s->prcm_config = 0;
    793    s->prcm_mngmt = 0;
    794    s->intr_ok = 0;
    795    s->usbip_intr = 0;
    796    s->usbip_mask = 0;
    797    s->gpio_intr = 0;
    798    s->gpio_mask = 0;
    799    s->gpio_config = 0;
    800    s->dma_intr = 0;
    801    s->dma_mask = 0;
    802    s->dma_map = 0;
    803    s->dma_config = 0;
    804    s->ep0_config = 0;
    805    s->wkup_mask = 0;
    806    s->pullup[0] = s->pullup[1] = 0;
    807    s->control_config = 0;
    808    for (i = 0; i < 15; i++) {
    809        s->rx_config[i] = s->tx_config[i] = 0;
    810    }
    811    musb_reset(s->musb);
    812}
    813
    814static void tusb6010_realize(DeviceState *dev, Error **errp)
    815{
    816    TUSBState *s = TUSB6010(dev);
    817    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    818
    819    s->otg_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, tusb_otg_tick, s);
    820    s->pwr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, tusb_power_tick, s);
    821    memory_region_init_io(&s->iomem[1], OBJECT(s), &tusb_async_ops, s,
    822                          "tusb-async", UINT32_MAX);
    823    sysbus_init_mmio(sbd, &s->iomem[0]);
    824    sysbus_init_mmio(sbd, &s->iomem[1]);
    825    sysbus_init_irq(sbd, &s->irq);
    826    qdev_init_gpio_in(dev, tusb6010_irq, musb_irq_max + 1);
    827    s->musb = musb_init(dev, 1);
    828}
    829
    830static void tusb6010_class_init(ObjectClass *klass, void *data)
    831{
    832    DeviceClass *dc = DEVICE_CLASS(klass);
    833
    834    dc->realize = tusb6010_realize;
    835    dc->reset = tusb6010_reset;
    836}
    837
    838static const TypeInfo tusb6010_info = {
    839    .name          = TYPE_TUSB6010,
    840    .parent        = TYPE_SYS_BUS_DEVICE,
    841    .instance_size = sizeof(TUSBState),
    842    .class_init    = tusb6010_class_init,
    843};
    844
    845static void tusb6010_register_types(void)
    846{
    847    type_register_static(&tusb6010_info);
    848}
    849
    850type_init(tusb6010_register_types)