1 /* 2 * "Inventra" High-speed Dual-Role Controller (MUSB-HDRC), Mentor Graphics, 3 * USB2.0 OTG compliant core used in various chips. 4 * 5 * Copyright (C) 2008 Nokia Corporation 6 * Written by Andrzej Zaborowski <andrew@openedhand.com> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation; either version 2 or 11 * (at your option) version 3 of the License. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License along 19 * with this program; if not, see <http://www.gnu.org/licenses/>. 20 * 21 * Only host-mode and non-DMA accesses are currently supported. 22 */ 23 #include "qemu-common.h" 24 #include "qemu/timer.h" 25 #include "hw/usb.h" 26 #include "hw/irq.h" 27 #include "hw/hw.h" 28 29 /* Common USB registers */ 30 #define MUSB_HDRC_FADDR 0x00 /* 8-bit */ 31 #define MUSB_HDRC_POWER 0x01 /* 8-bit */ 32 33 #define MUSB_HDRC_INTRTX 0x02 /* 16-bit */ 34 #define MUSB_HDRC_INTRRX 0x04 35 #define MUSB_HDRC_INTRTXE 0x06 36 #define MUSB_HDRC_INTRRXE 0x08 37 #define MUSB_HDRC_INTRUSB 0x0a /* 8 bit */ 38 #define MUSB_HDRC_INTRUSBE 0x0b /* 8 bit */ 39 #define MUSB_HDRC_FRAME 0x0c /* 16-bit */ 40 #define MUSB_HDRC_INDEX 0x0e /* 8 bit */ 41 #define MUSB_HDRC_TESTMODE 0x0f /* 8 bit */ 42 43 /* Per-EP registers in indexed mode */ 44 #define MUSB_HDRC_EP_IDX 0x10 /* 8-bit */ 45 46 /* EP FIFOs */ 47 #define MUSB_HDRC_FIFO 0x20 48 49 /* Additional Control Registers */ 50 #define MUSB_HDRC_DEVCTL 0x60 /* 8 bit */ 51 52 /* These are indexed */ 53 #define MUSB_HDRC_TXFIFOSZ 0x62 /* 8 bit (see masks) */ 54 #define MUSB_HDRC_RXFIFOSZ 0x63 /* 8 bit (see masks) */ 55 #define MUSB_HDRC_TXFIFOADDR 0x64 /* 16 bit offset shifted right 3 */ 56 #define MUSB_HDRC_RXFIFOADDR 0x66 /* 16 bit offset shifted right 3 */ 57 58 /* Some more registers */ 59 #define MUSB_HDRC_VCTRL 0x68 /* 8 bit */ 60 #define MUSB_HDRC_HWVERS 0x6c /* 8 bit */ 61 62 /* Added in HDRC 1.9(?) & MHDRC 1.4 */ 63 /* ULPI pass-through */ 64 #define MUSB_HDRC_ULPI_VBUSCTL 0x70 65 #define MUSB_HDRC_ULPI_REGDATA 0x74 66 #define MUSB_HDRC_ULPI_REGADDR 0x75 67 #define MUSB_HDRC_ULPI_REGCTL 0x76 68 69 /* Extended config & PHY control */ 70 #define MUSB_HDRC_ENDCOUNT 0x78 /* 8 bit */ 71 #define MUSB_HDRC_DMARAMCFG 0x79 /* 8 bit */ 72 #define MUSB_HDRC_PHYWAIT 0x7a /* 8 bit */ 73 #define MUSB_HDRC_PHYVPLEN 0x7b /* 8 bit */ 74 #define MUSB_HDRC_HS_EOF1 0x7c /* 8 bit, units of 546.1 us */ 75 #define MUSB_HDRC_FS_EOF1 0x7d /* 8 bit, units of 533.3 ns */ 76 #define MUSB_HDRC_LS_EOF1 0x7e /* 8 bit, units of 1.067 us */ 77 78 /* Per-EP BUSCTL registers */ 79 #define MUSB_HDRC_BUSCTL 0x80 80 81 /* Per-EP registers in flat mode */ 82 #define MUSB_HDRC_EP 0x100 83 84 /* offsets to registers in flat model */ 85 #define MUSB_HDRC_TXMAXP 0x00 /* 16 bit apparently */ 86 #define MUSB_HDRC_TXCSR 0x02 /* 16 bit apparently */ 87 #define MUSB_HDRC_CSR0 MUSB_HDRC_TXCSR /* re-used for EP0 */ 88 #define MUSB_HDRC_RXMAXP 0x04 /* 16 bit apparently */ 89 #define MUSB_HDRC_RXCSR 0x06 /* 16 bit apparently */ 90 #define MUSB_HDRC_RXCOUNT 0x08 /* 16 bit apparently */ 91 #define MUSB_HDRC_COUNT0 MUSB_HDRC_RXCOUNT /* re-used for EP0 */ 92 #define MUSB_HDRC_TXTYPE 0x0a /* 8 bit apparently */ 93 #define MUSB_HDRC_TYPE0 MUSB_HDRC_TXTYPE /* re-used for EP0 */ 94 #define MUSB_HDRC_TXINTERVAL 0x0b /* 8 bit apparently */ 95 #define MUSB_HDRC_NAKLIMIT0 MUSB_HDRC_TXINTERVAL /* re-used for EP0 */ 96 #define MUSB_HDRC_RXTYPE 0x0c /* 8 bit apparently */ 97 #define MUSB_HDRC_RXINTERVAL 0x0d /* 8 bit apparently */ 98 #define MUSB_HDRC_FIFOSIZE 0x0f /* 8 bit apparently */ 99 #define MUSB_HDRC_CONFIGDATA MGC_O_HDRC_FIFOSIZE /* re-used for EP0 */ 100 101 /* "Bus control" registers */ 102 #define MUSB_HDRC_TXFUNCADDR 0x00 103 #define MUSB_HDRC_TXHUBADDR 0x02 104 #define MUSB_HDRC_TXHUBPORT 0x03 105 106 #define MUSB_HDRC_RXFUNCADDR 0x04 107 #define MUSB_HDRC_RXHUBADDR 0x06 108 #define MUSB_HDRC_RXHUBPORT 0x07 109 110 /* 111 * MUSBHDRC Register bit masks 112 */ 113 114 /* POWER */ 115 #define MGC_M_POWER_ISOUPDATE 0x80 116 #define MGC_M_POWER_SOFTCONN 0x40 117 #define MGC_M_POWER_HSENAB 0x20 118 #define MGC_M_POWER_HSMODE 0x10 119 #define MGC_M_POWER_RESET 0x08 120 #define MGC_M_POWER_RESUME 0x04 121 #define MGC_M_POWER_SUSPENDM 0x02 122 #define MGC_M_POWER_ENSUSPEND 0x01 123 124 /* INTRUSB */ 125 #define MGC_M_INTR_SUSPEND 0x01 126 #define MGC_M_INTR_RESUME 0x02 127 #define MGC_M_INTR_RESET 0x04 128 #define MGC_M_INTR_BABBLE 0x04 129 #define MGC_M_INTR_SOF 0x08 130 #define MGC_M_INTR_CONNECT 0x10 131 #define MGC_M_INTR_DISCONNECT 0x20 132 #define MGC_M_INTR_SESSREQ 0x40 133 #define MGC_M_INTR_VBUSERROR 0x80 /* FOR SESSION END */ 134 #define MGC_M_INTR_EP0 0x01 /* FOR EP0 INTERRUPT */ 135 136 /* DEVCTL */ 137 #define MGC_M_DEVCTL_BDEVICE 0x80 138 #define MGC_M_DEVCTL_FSDEV 0x40 139 #define MGC_M_DEVCTL_LSDEV 0x20 140 #define MGC_M_DEVCTL_VBUS 0x18 141 #define MGC_S_DEVCTL_VBUS 3 142 #define MGC_M_DEVCTL_HM 0x04 143 #define MGC_M_DEVCTL_HR 0x02 144 #define MGC_M_DEVCTL_SESSION 0x01 145 146 /* TESTMODE */ 147 #define MGC_M_TEST_FORCE_HOST 0x80 148 #define MGC_M_TEST_FIFO_ACCESS 0x40 149 #define MGC_M_TEST_FORCE_FS 0x20 150 #define MGC_M_TEST_FORCE_HS 0x10 151 #define MGC_M_TEST_PACKET 0x08 152 #define MGC_M_TEST_K 0x04 153 #define MGC_M_TEST_J 0x02 154 #define MGC_M_TEST_SE0_NAK 0x01 155 156 /* CSR0 */ 157 #define MGC_M_CSR0_FLUSHFIFO 0x0100 158 #define MGC_M_CSR0_TXPKTRDY 0x0002 159 #define MGC_M_CSR0_RXPKTRDY 0x0001 160 161 /* CSR0 in Peripheral mode */ 162 #define MGC_M_CSR0_P_SVDSETUPEND 0x0080 163 #define MGC_M_CSR0_P_SVDRXPKTRDY 0x0040 164 #define MGC_M_CSR0_P_SENDSTALL 0x0020 165 #define MGC_M_CSR0_P_SETUPEND 0x0010 166 #define MGC_M_CSR0_P_DATAEND 0x0008 167 #define MGC_M_CSR0_P_SENTSTALL 0x0004 168 169 /* CSR0 in Host mode */ 170 #define MGC_M_CSR0_H_NO_PING 0x0800 171 #define MGC_M_CSR0_H_WR_DATATOGGLE 0x0400 /* set to allow setting: */ 172 #define MGC_M_CSR0_H_DATATOGGLE 0x0200 /* data toggle control */ 173 #define MGC_M_CSR0_H_NAKTIMEOUT 0x0080 174 #define MGC_M_CSR0_H_STATUSPKT 0x0040 175 #define MGC_M_CSR0_H_REQPKT 0x0020 176 #define MGC_M_CSR0_H_ERROR 0x0010 177 #define MGC_M_CSR0_H_SETUPPKT 0x0008 178 #define MGC_M_CSR0_H_RXSTALL 0x0004 179 180 /* CONFIGDATA */ 181 #define MGC_M_CONFIGDATA_MPRXE 0x80 /* auto bulk pkt combining */ 182 #define MGC_M_CONFIGDATA_MPTXE 0x40 /* auto bulk pkt splitting */ 183 #define MGC_M_CONFIGDATA_BIGENDIAN 0x20 184 #define MGC_M_CONFIGDATA_HBRXE 0x10 /* HB-ISO for RX */ 185 #define MGC_M_CONFIGDATA_HBTXE 0x08 /* HB-ISO for TX */ 186 #define MGC_M_CONFIGDATA_DYNFIFO 0x04 /* dynamic FIFO sizing */ 187 #define MGC_M_CONFIGDATA_SOFTCONE 0x02 /* SoftConnect */ 188 #define MGC_M_CONFIGDATA_UTMIDW 0x01 /* Width, 0 => 8b, 1 => 16b */ 189 190 /* TXCSR in Peripheral and Host mode */ 191 #define MGC_M_TXCSR_AUTOSET 0x8000 192 #define MGC_M_TXCSR_ISO 0x4000 193 #define MGC_M_TXCSR_MODE 0x2000 194 #define MGC_M_TXCSR_DMAENAB 0x1000 195 #define MGC_M_TXCSR_FRCDATATOG 0x0800 196 #define MGC_M_TXCSR_DMAMODE 0x0400 197 #define MGC_M_TXCSR_CLRDATATOG 0x0040 198 #define MGC_M_TXCSR_FLUSHFIFO 0x0008 199 #define MGC_M_TXCSR_FIFONOTEMPTY 0x0002 200 #define MGC_M_TXCSR_TXPKTRDY 0x0001 201 202 /* TXCSR in Peripheral mode */ 203 #define MGC_M_TXCSR_P_INCOMPTX 0x0080 204 #define MGC_M_TXCSR_P_SENTSTALL 0x0020 205 #define MGC_M_TXCSR_P_SENDSTALL 0x0010 206 #define MGC_M_TXCSR_P_UNDERRUN 0x0004 207 208 /* TXCSR in Host mode */ 209 #define MGC_M_TXCSR_H_WR_DATATOGGLE 0x0200 210 #define MGC_M_TXCSR_H_DATATOGGLE 0x0100 211 #define MGC_M_TXCSR_H_NAKTIMEOUT 0x0080 212 #define MGC_M_TXCSR_H_RXSTALL 0x0020 213 #define MGC_M_TXCSR_H_ERROR 0x0004 214 215 /* RXCSR in Peripheral and Host mode */ 216 #define MGC_M_RXCSR_AUTOCLEAR 0x8000 217 #define MGC_M_RXCSR_DMAENAB 0x2000 218 #define MGC_M_RXCSR_DISNYET 0x1000 219 #define MGC_M_RXCSR_DMAMODE 0x0800 220 #define MGC_M_RXCSR_INCOMPRX 0x0100 221 #define MGC_M_RXCSR_CLRDATATOG 0x0080 222 #define MGC_M_RXCSR_FLUSHFIFO 0x0010 223 #define MGC_M_RXCSR_DATAERROR 0x0008 224 #define MGC_M_RXCSR_FIFOFULL 0x0002 225 #define MGC_M_RXCSR_RXPKTRDY 0x0001 226 227 /* RXCSR in Peripheral mode */ 228 #define MGC_M_RXCSR_P_ISO 0x4000 229 #define MGC_M_RXCSR_P_SENTSTALL 0x0040 230 #define MGC_M_RXCSR_P_SENDSTALL 0x0020 231 #define MGC_M_RXCSR_P_OVERRUN 0x0004 232 233 /* RXCSR in Host mode */ 234 #define MGC_M_RXCSR_H_AUTOREQ 0x4000 235 #define MGC_M_RXCSR_H_WR_DATATOGGLE 0x0400 236 #define MGC_M_RXCSR_H_DATATOGGLE 0x0200 237 #define MGC_M_RXCSR_H_RXSTALL 0x0040 238 #define MGC_M_RXCSR_H_REQPKT 0x0020 239 #define MGC_M_RXCSR_H_ERROR 0x0004 240 241 /* HUBADDR */ 242 #define MGC_M_HUBADDR_MULTI_TT 0x80 243 244 /* ULPI: Added in HDRC 1.9(?) & MHDRC 1.4 */ 245 #define MGC_M_ULPI_VBCTL_USEEXTVBUSIND 0x02 246 #define MGC_M_ULPI_VBCTL_USEEXTVBUS 0x01 247 #define MGC_M_ULPI_REGCTL_INT_ENABLE 0x08 248 #define MGC_M_ULPI_REGCTL_READNOTWRITE 0x04 249 #define MGC_M_ULPI_REGCTL_COMPLETE 0x02 250 #define MGC_M_ULPI_REGCTL_REG 0x01 251 252 /* #define MUSB_DEBUG */ 253 254 #ifdef MUSB_DEBUG 255 #define TRACE(fmt,...) fprintf(stderr, "%s@%d: " fmt "\n", __FUNCTION__, \ 256 __LINE__, ##__VA_ARGS__) 257 #else 258 #define TRACE(...) 259 #endif 260 261 262 static void musb_attach(USBPort *port); 263 static void musb_detach(USBPort *port); 264 static void musb_child_detach(USBPort *port, USBDevice *child); 265 static void musb_schedule_cb(USBPort *port, USBPacket *p); 266 static void musb_async_cancel_device(MUSBState *s, USBDevice *dev); 267 268 static USBPortOps musb_port_ops = { 269 .attach = musb_attach, 270 .detach = musb_detach, 271 .child_detach = musb_child_detach, 272 .complete = musb_schedule_cb, 273 }; 274 275 static USBBusOps musb_bus_ops = { 276 }; 277 278 typedef struct MUSBPacket MUSBPacket; 279 typedef struct MUSBEndPoint MUSBEndPoint; 280 281 struct MUSBPacket { 282 USBPacket p; 283 MUSBEndPoint *ep; 284 int dir; 285 }; 286 287 struct MUSBEndPoint { 288 uint16_t faddr[2]; 289 uint8_t haddr[2]; 290 uint8_t hport[2]; 291 uint16_t csr[2]; 292 uint16_t maxp[2]; 293 uint16_t rxcount; 294 uint8_t type[2]; 295 uint8_t interval[2]; 296 uint8_t config; 297 uint8_t fifosize; 298 int timeout[2]; /* Always in microframes */ 299 300 uint8_t *buf[2]; 301 int fifolen[2]; 302 int fifostart[2]; 303 int fifoaddr[2]; 304 MUSBPacket packey[2]; 305 int status[2]; 306 int ext_size[2]; 307 308 /* For callbacks' use */ 309 int epnum; 310 int interrupt[2]; 311 MUSBState *musb; 312 USBCallback *delayed_cb[2]; 313 QEMUTimer *intv_timer[2]; 314 }; 315 316 struct MUSBState { 317 qemu_irq irqs[musb_irq_max]; 318 USBBus bus; 319 USBPort port; 320 321 int idx; 322 uint8_t devctl; 323 uint8_t power; 324 uint8_t faddr; 325 326 uint8_t intr; 327 uint8_t mask; 328 uint16_t tx_intr; 329 uint16_t tx_mask; 330 uint16_t rx_intr; 331 uint16_t rx_mask; 332 333 int setup_len; 334 int session; 335 336 uint8_t buf[0x8000]; 337 338 /* Duplicating the world since 2008!... probably we should have 32 339 * logical, single endpoints instead. */ 340 MUSBEndPoint ep[16]; 341 }; 342 343 void musb_reset(MUSBState *s) 344 { 345 int i; 346 347 s->faddr = 0x00; 348 s->devctl = 0; 349 s->power = MGC_M_POWER_HSENAB; 350 s->tx_intr = 0x0000; 351 s->rx_intr = 0x0000; 352 s->tx_mask = 0xffff; 353 s->rx_mask = 0xffff; 354 s->intr = 0x00; 355 s->mask = 0x06; 356 s->idx = 0; 357 358 s->setup_len = 0; 359 s->session = 0; 360 memset(s->buf, 0, sizeof(s->buf)); 361 362 /* TODO: _DW */ 363 s->ep[0].config = MGC_M_CONFIGDATA_SOFTCONE | MGC_M_CONFIGDATA_DYNFIFO; 364 for (i = 0; i < 16; i ++) { 365 s->ep[i].fifosize = 64; 366 s->ep[i].maxp[0] = 0x40; 367 s->ep[i].maxp[1] = 0x40; 368 s->ep[i].musb = s; 369 s->ep[i].epnum = i; 370 usb_packet_init(&s->ep[i].packey[0].p); 371 usb_packet_init(&s->ep[i].packey[1].p); 372 } 373 } 374 375 struct MUSBState *musb_init(DeviceState *parent_device, int gpio_base) 376 { 377 MUSBState *s = g_malloc0(sizeof(*s)); 378 int i; 379 380 for (i = 0; i < musb_irq_max; i++) { 381 s->irqs[i] = qdev_get_gpio_in(parent_device, gpio_base + i); 382 } 383 384 musb_reset(s); 385 386 usb_bus_new(&s->bus, sizeof(s->bus), &musb_bus_ops, parent_device); 387 usb_register_port(&s->bus, &s->port, s, 0, &musb_port_ops, 388 USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL); 389 390 return s; 391 } 392 393 static void musb_vbus_set(MUSBState *s, int level) 394 { 395 if (level) 396 s->devctl |= 3 << MGC_S_DEVCTL_VBUS; 397 else 398 s->devctl &= ~MGC_M_DEVCTL_VBUS; 399 400 qemu_set_irq(s->irqs[musb_set_vbus], level); 401 } 402 403 static void musb_intr_set(MUSBState *s, int line, int level) 404 { 405 if (!level) { 406 s->intr &= ~(1 << line); 407 qemu_irq_lower(s->irqs[line]); 408 } else if (s->mask & (1 << line)) { 409 s->intr |= 1 << line; 410 qemu_irq_raise(s->irqs[line]); 411 } 412 } 413 414 static void musb_tx_intr_set(MUSBState *s, int line, int level) 415 { 416 if (!level) { 417 s->tx_intr &= ~(1 << line); 418 if (!s->tx_intr) 419 qemu_irq_lower(s->irqs[musb_irq_tx]); 420 } else if (s->tx_mask & (1 << line)) { 421 s->tx_intr |= 1 << line; 422 qemu_irq_raise(s->irqs[musb_irq_tx]); 423 } 424 } 425 426 static void musb_rx_intr_set(MUSBState *s, int line, int level) 427 { 428 if (line) { 429 if (!level) { 430 s->rx_intr &= ~(1 << line); 431 if (!s->rx_intr) 432 qemu_irq_lower(s->irqs[musb_irq_rx]); 433 } else if (s->rx_mask & (1 << line)) { 434 s->rx_intr |= 1 << line; 435 qemu_irq_raise(s->irqs[musb_irq_rx]); 436 } 437 } else 438 musb_tx_intr_set(s, line, level); 439 } 440 441 uint32_t musb_core_intr_get(MUSBState *s) 442 { 443 return (s->rx_intr << 15) | s->tx_intr; 444 } 445 446 void musb_core_intr_clear(MUSBState *s, uint32_t mask) 447 { 448 if (s->rx_intr) { 449 s->rx_intr &= mask >> 15; 450 if (!s->rx_intr) 451 qemu_irq_lower(s->irqs[musb_irq_rx]); 452 } 453 454 if (s->tx_intr) { 455 s->tx_intr &= mask & 0xffff; 456 if (!s->tx_intr) 457 qemu_irq_lower(s->irqs[musb_irq_tx]); 458 } 459 } 460 461 void musb_set_size(MUSBState *s, int epnum, int size, int is_tx) 462 { 463 s->ep[epnum].ext_size[!is_tx] = size; 464 s->ep[epnum].fifostart[0] = 0; 465 s->ep[epnum].fifostart[1] = 0; 466 s->ep[epnum].fifolen[0] = 0; 467 s->ep[epnum].fifolen[1] = 0; 468 } 469 470 static void musb_session_update(MUSBState *s, int prev_dev, int prev_sess) 471 { 472 int detect_prev = prev_dev && prev_sess; 473 int detect = !!s->port.dev && s->session; 474 475 if (detect && !detect_prev) { 476 /* Let's skip the ID pin sense and VBUS sense formalities and 477 * and signal a successful SRP directly. This should work at least 478 * for the Linux driver stack. */ 479 musb_intr_set(s, musb_irq_connect, 1); 480 481 if (s->port.dev->speed == USB_SPEED_LOW) { 482 s->devctl &= ~MGC_M_DEVCTL_FSDEV; 483 s->devctl |= MGC_M_DEVCTL_LSDEV; 484 } else { 485 s->devctl |= MGC_M_DEVCTL_FSDEV; 486 s->devctl &= ~MGC_M_DEVCTL_LSDEV; 487 } 488 489 /* A-mode? */ 490 s->devctl &= ~MGC_M_DEVCTL_BDEVICE; 491 492 /* Host-mode bit? */ 493 s->devctl |= MGC_M_DEVCTL_HM; 494 #if 1 495 musb_vbus_set(s, 1); 496 #endif 497 } else if (!detect && detect_prev) { 498 #if 1 499 musb_vbus_set(s, 0); 500 #endif 501 } 502 } 503 504 /* Attach or detach a device on our only port. */ 505 static void musb_attach(USBPort *port) 506 { 507 MUSBState *s = (MUSBState *) port->opaque; 508 509 musb_intr_set(s, musb_irq_vbus_request, 1); 510 musb_session_update(s, 0, s->session); 511 } 512 513 static void musb_detach(USBPort *port) 514 { 515 MUSBState *s = (MUSBState *) port->opaque; 516 517 musb_async_cancel_device(s, port->dev); 518 519 musb_intr_set(s, musb_irq_disconnect, 1); 520 musb_session_update(s, 1, s->session); 521 } 522 523 static void musb_child_detach(USBPort *port, USBDevice *child) 524 { 525 MUSBState *s = (MUSBState *) port->opaque; 526 527 musb_async_cancel_device(s, child); 528 } 529 530 static void musb_cb_tick0(void *opaque) 531 { 532 MUSBEndPoint *ep = (MUSBEndPoint *) opaque; 533 534 ep->delayed_cb[0](&ep->packey[0].p, opaque); 535 } 536 537 static void musb_cb_tick1(void *opaque) 538 { 539 MUSBEndPoint *ep = (MUSBEndPoint *) opaque; 540 541 ep->delayed_cb[1](&ep->packey[1].p, opaque); 542 } 543 544 #define musb_cb_tick (dir ? musb_cb_tick1 : musb_cb_tick0) 545 546 static void musb_schedule_cb(USBPort *port, USBPacket *packey) 547 { 548 MUSBPacket *p = container_of(packey, MUSBPacket, p); 549 MUSBEndPoint *ep = p->ep; 550 int dir = p->dir; 551 int timeout = 0; 552 553 if (ep->status[dir] == USB_RET_NAK) 554 timeout = ep->timeout[dir]; 555 else if (ep->interrupt[dir]) 556 timeout = 8; 557 else { 558 musb_cb_tick(ep); 559 return; 560 } 561 562 if (!ep->intv_timer[dir]) 563 ep->intv_timer[dir] = timer_new_ns(QEMU_CLOCK_VIRTUAL, musb_cb_tick, ep); 564 565 timer_mod(ep->intv_timer[dir], qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 566 muldiv64(timeout, get_ticks_per_sec(), 8000)); 567 } 568 569 static int musb_timeout(int ttype, int speed, int val) 570 { 571 #if 1 572 return val << 3; 573 #endif 574 575 switch (ttype) { 576 case USB_ENDPOINT_XFER_CONTROL: 577 if (val < 2) 578 return 0; 579 else if (speed == USB_SPEED_HIGH) 580 return 1 << (val - 1); 581 else 582 return 8 << (val - 1); 583 584 case USB_ENDPOINT_XFER_INT: 585 if (speed == USB_SPEED_HIGH) 586 if (val < 2) 587 return 0; 588 else 589 return 1 << (val - 1); 590 else 591 return val << 3; 592 593 case USB_ENDPOINT_XFER_BULK: 594 case USB_ENDPOINT_XFER_ISOC: 595 if (val < 2) 596 return 0; 597 else if (speed == USB_SPEED_HIGH) 598 return 1 << (val - 1); 599 else 600 return 8 << (val - 1); 601 /* TODO: what with low-speed Bulk and Isochronous? */ 602 } 603 604 hw_error("bad interval\n"); 605 } 606 607 static void musb_packet(MUSBState *s, MUSBEndPoint *ep, 608 int epnum, int pid, int len, USBCallback cb, int dir) 609 { 610 USBDevice *dev; 611 USBEndpoint *uep; 612 int idx = epnum && dir; 613 int id; 614 int ttype; 615 616 /* ep->type[0,1] contains: 617 * in bits 7:6 the speed (0 - invalid, 1 - high, 2 - full, 3 - slow) 618 * in bits 5:4 the transfer type (BULK / INT) 619 * in bits 3:0 the EP num 620 */ 621 ttype = epnum ? (ep->type[idx] >> 4) & 3 : 0; 622 623 ep->timeout[dir] = musb_timeout(ttype, 624 ep->type[idx] >> 6, ep->interval[idx]); 625 ep->interrupt[dir] = ttype == USB_ENDPOINT_XFER_INT; 626 ep->delayed_cb[dir] = cb; 627 628 /* A wild guess on the FADDR semantics... */ 629 dev = usb_find_device(&s->port, ep->faddr[idx]); 630 uep = usb_ep_get(dev, pid, ep->type[idx] & 0xf); 631 id = pid; 632 if (uep) { 633 id |= (dev->addr << 16) | (uep->nr << 8); 634 } 635 usb_packet_setup(&ep->packey[dir].p, pid, uep, 0, id, false, true); 636 usb_packet_addbuf(&ep->packey[dir].p, ep->buf[idx], len); 637 ep->packey[dir].ep = ep; 638 ep->packey[dir].dir = dir; 639 640 usb_handle_packet(dev, &ep->packey[dir].p); 641 642 if (ep->packey[dir].p.status == USB_RET_ASYNC) { 643 usb_device_flush_ep_queue(dev, uep); 644 ep->status[dir] = len; 645 return; 646 } 647 648 if (ep->packey[dir].p.status == USB_RET_SUCCESS) { 649 ep->status[dir] = ep->packey[dir].p.actual_length; 650 } else { 651 ep->status[dir] = ep->packey[dir].p.status; 652 } 653 musb_schedule_cb(&s->port, &ep->packey[dir].p); 654 } 655 656 static void musb_tx_packet_complete(USBPacket *packey, void *opaque) 657 { 658 /* Unfortunately we can't use packey->devep because that's the remote 659 * endpoint number and may be different than our local. */ 660 MUSBEndPoint *ep = (MUSBEndPoint *) opaque; 661 int epnum = ep->epnum; 662 MUSBState *s = ep->musb; 663 664 ep->fifostart[0] = 0; 665 ep->fifolen[0] = 0; 666 #ifdef CLEAR_NAK 667 if (ep->status[0] != USB_RET_NAK) { 668 #endif 669 if (epnum) 670 ep->csr[0] &= ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY); 671 else 672 ep->csr[0] &= ~MGC_M_CSR0_TXPKTRDY; 673 #ifdef CLEAR_NAK 674 } 675 #endif 676 677 /* Clear all of the error bits first */ 678 if (epnum) 679 ep->csr[0] &= ~(MGC_M_TXCSR_H_ERROR | MGC_M_TXCSR_H_RXSTALL | 680 MGC_M_TXCSR_H_NAKTIMEOUT); 681 else 682 ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL | 683 MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING); 684 685 if (ep->status[0] == USB_RET_STALL) { 686 /* Command not supported by target! */ 687 ep->status[0] = 0; 688 689 if (epnum) 690 ep->csr[0] |= MGC_M_TXCSR_H_RXSTALL; 691 else 692 ep->csr[0] |= MGC_M_CSR0_H_RXSTALL; 693 } 694 695 if (ep->status[0] == USB_RET_NAK) { 696 ep->status[0] = 0; 697 698 /* NAK timeouts are only generated in Bulk transfers and 699 * Data-errors in Isochronous. */ 700 if (ep->interrupt[0]) { 701 return; 702 } 703 704 if (epnum) 705 ep->csr[0] |= MGC_M_TXCSR_H_NAKTIMEOUT; 706 else 707 ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT; 708 } 709 710 if (ep->status[0] < 0) { 711 if (ep->status[0] == USB_RET_BABBLE) 712 musb_intr_set(s, musb_irq_rst_babble, 1); 713 714 /* Pretend we've tried three times already and failed (in 715 * case of USB_TOKEN_SETUP). */ 716 if (epnum) 717 ep->csr[0] |= MGC_M_TXCSR_H_ERROR; 718 else 719 ep->csr[0] |= MGC_M_CSR0_H_ERROR; 720 721 musb_tx_intr_set(s, epnum, 1); 722 return; 723 } 724 /* TODO: check len for over/underruns of an OUT packet? */ 725 726 #ifdef SETUPLEN_HACK 727 if (!epnum && ep->packey[0].pid == USB_TOKEN_SETUP) 728 s->setup_len = ep->packey[0].data[6]; 729 #endif 730 731 /* In DMA mode: if no error, assert DMA request for this EP, 732 * and skip the interrupt. */ 733 musb_tx_intr_set(s, epnum, 1); 734 } 735 736 static void musb_rx_packet_complete(USBPacket *packey, void *opaque) 737 { 738 /* Unfortunately we can't use packey->devep because that's the remote 739 * endpoint number and may be different than our local. */ 740 MUSBEndPoint *ep = (MUSBEndPoint *) opaque; 741 int epnum = ep->epnum; 742 MUSBState *s = ep->musb; 743 744 ep->fifostart[1] = 0; 745 ep->fifolen[1] = 0; 746 747 #ifdef CLEAR_NAK 748 if (ep->status[1] != USB_RET_NAK) { 749 #endif 750 ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT; 751 if (!epnum) 752 ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT; 753 #ifdef CLEAR_NAK 754 } 755 #endif 756 757 /* Clear all of the imaginable error bits first */ 758 ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL | 759 MGC_M_RXCSR_DATAERROR); 760 if (!epnum) 761 ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL | 762 MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING); 763 764 if (ep->status[1] == USB_RET_STALL) { 765 ep->status[1] = 0; 766 767 ep->csr[1] |= MGC_M_RXCSR_H_RXSTALL; 768 if (!epnum) 769 ep->csr[0] |= MGC_M_CSR0_H_RXSTALL; 770 } 771 772 if (ep->status[1] == USB_RET_NAK) { 773 ep->status[1] = 0; 774 775 /* NAK timeouts are only generated in Bulk transfers and 776 * Data-errors in Isochronous. */ 777 if (ep->interrupt[1]) { 778 musb_packet(s, ep, epnum, USB_TOKEN_IN, 779 packey->iov.size, musb_rx_packet_complete, 1); 780 return; 781 } 782 783 ep->csr[1] |= MGC_M_RXCSR_DATAERROR; 784 if (!epnum) 785 ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT; 786 } 787 788 if (ep->status[1] < 0) { 789 if (ep->status[1] == USB_RET_BABBLE) { 790 musb_intr_set(s, musb_irq_rst_babble, 1); 791 return; 792 } 793 794 /* Pretend we've tried three times already and failed (in 795 * case of a control transfer). */ 796 ep->csr[1] |= MGC_M_RXCSR_H_ERROR; 797 if (!epnum) 798 ep->csr[0] |= MGC_M_CSR0_H_ERROR; 799 800 musb_rx_intr_set(s, epnum, 1); 801 return; 802 } 803 /* TODO: check len for over/underruns of an OUT packet? */ 804 /* TODO: perhaps make use of e->ext_size[1] here. */ 805 806 if (!(ep->csr[1] & (MGC_M_RXCSR_H_RXSTALL | MGC_M_RXCSR_DATAERROR))) { 807 ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY; 808 if (!epnum) 809 ep->csr[0] |= MGC_M_CSR0_RXPKTRDY; 810 811 ep->rxcount = ep->status[1]; /* XXX: MIN(packey->len, ep->maxp[1]); */ 812 /* In DMA mode: assert DMA request for this EP */ 813 } 814 815 /* Only if DMA has not been asserted */ 816 musb_rx_intr_set(s, epnum, 1); 817 } 818 819 static void musb_async_cancel_device(MUSBState *s, USBDevice *dev) 820 { 821 int ep, dir; 822 823 for (ep = 0; ep < 16; ep++) { 824 for (dir = 0; dir < 2; dir++) { 825 if (!usb_packet_is_inflight(&s->ep[ep].packey[dir].p) || 826 s->ep[ep].packey[dir].p.ep->dev != dev) { 827 continue; 828 } 829 usb_cancel_packet(&s->ep[ep].packey[dir].p); 830 /* status updates needed here? */ 831 } 832 } 833 } 834 835 static void musb_tx_rdy(MUSBState *s, int epnum) 836 { 837 MUSBEndPoint *ep = s->ep + epnum; 838 int pid; 839 int total, valid = 0; 840 TRACE("start %d, len %d", ep->fifostart[0], ep->fifolen[0] ); 841 ep->fifostart[0] += ep->fifolen[0]; 842 ep->fifolen[0] = 0; 843 844 /* XXX: how's the total size of the packet retrieved exactly in 845 * the generic case? */ 846 total = ep->maxp[0] & 0x3ff; 847 848 if (ep->ext_size[0]) { 849 total = ep->ext_size[0]; 850 ep->ext_size[0] = 0; 851 valid = 1; 852 } 853 854 /* If the packet is not fully ready yet, wait for a next segment. */ 855 if (epnum && (ep->fifostart[0]) < total) 856 return; 857 858 if (!valid) 859 total = ep->fifostart[0]; 860 861 pid = USB_TOKEN_OUT; 862 if (!epnum && (ep->csr[0] & MGC_M_CSR0_H_SETUPPKT)) { 863 pid = USB_TOKEN_SETUP; 864 if (total != 8) { 865 TRACE("illegal SETUPPKT length of %i bytes", total); 866 } 867 /* Controller should retry SETUP packets three times on errors 868 * but it doesn't make sense for us to do that. */ 869 } 870 871 musb_packet(s, ep, epnum, pid, total, musb_tx_packet_complete, 0); 872 } 873 874 static void musb_rx_req(MUSBState *s, int epnum) 875 { 876 MUSBEndPoint *ep = s->ep + epnum; 877 int total; 878 879 /* If we already have a packet, which didn't fit into the 880 * 64 bytes of the FIFO, only move the FIFO start and return. (Obsolete) */ 881 if (ep->packey[1].p.pid == USB_TOKEN_IN && ep->status[1] >= 0 && 882 (ep->fifostart[1]) + ep->rxcount < 883 ep->packey[1].p.iov.size) { 884 TRACE("0x%08x, %d", ep->fifostart[1], ep->rxcount ); 885 ep->fifostart[1] += ep->rxcount; 886 ep->fifolen[1] = 0; 887 888 ep->rxcount = MIN(ep->packey[0].p.iov.size - (ep->fifostart[1]), 889 ep->maxp[1]); 890 891 ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT; 892 if (!epnum) 893 ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT; 894 895 /* Clear all of the error bits first */ 896 ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL | 897 MGC_M_RXCSR_DATAERROR); 898 if (!epnum) 899 ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL | 900 MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING); 901 902 ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY; 903 if (!epnum) 904 ep->csr[0] |= MGC_M_CSR0_RXPKTRDY; 905 musb_rx_intr_set(s, epnum, 1); 906 return; 907 } 908 909 /* The driver sets maxp[1] to 64 or less because it knows the hardware 910 * FIFO is this deep. Bigger packets get split in 911 * usb_generic_handle_packet but we can also do the splitting locally 912 * for performance. It turns out we can also have a bigger FIFO and 913 * ignore the limit set in ep->maxp[1]. The Linux MUSB driver deals 914 * OK with single packets of even 32KB and we avoid splitting, however 915 * usb_msd.c sometimes sends a packet bigger than what Linux expects 916 * (e.g. 8192 bytes instead of 4096) and we get an OVERRUN. Splitting 917 * hides this overrun from Linux. Up to 4096 everything is fine 918 * though. Currently this is disabled. 919 * 920 * XXX: mind ep->fifosize. */ 921 total = MIN(ep->maxp[1] & 0x3ff, sizeof(s->buf)); 922 923 #ifdef SETUPLEN_HACK 924 /* Why should *we* do that instead of Linux? */ 925 if (!epnum) { 926 if (ep->packey[0].p.devaddr == 2) { 927 total = MIN(s->setup_len, 8); 928 } else { 929 total = MIN(s->setup_len, 64); 930 } 931 s->setup_len -= total; 932 } 933 #endif 934 935 musb_packet(s, ep, epnum, USB_TOKEN_IN, total, musb_rx_packet_complete, 1); 936 } 937 938 static uint8_t musb_read_fifo(MUSBEndPoint *ep) 939 { 940 uint8_t value; 941 if (ep->fifolen[1] >= 64) { 942 /* We have a FIFO underrun */ 943 TRACE("EP%d FIFO is now empty, stop reading", ep->epnum); 944 return 0x00000000; 945 } 946 /* In DMA mode clear RXPKTRDY and set REQPKT automatically 947 * (if AUTOREQ is set) */ 948 949 ep->csr[1] &= ~MGC_M_RXCSR_FIFOFULL; 950 value=ep->buf[1][ep->fifostart[1] + ep->fifolen[1] ++]; 951 TRACE("EP%d 0x%02x, %d", ep->epnum, value, ep->fifolen[1] ); 952 return value; 953 } 954 955 static void musb_write_fifo(MUSBEndPoint *ep, uint8_t value) 956 { 957 TRACE("EP%d = %02x", ep->epnum, value); 958 if (ep->fifolen[0] >= 64) { 959 /* We have a FIFO overrun */ 960 TRACE("EP%d FIFO exceeded 64 bytes, stop feeding data", ep->epnum); 961 return; 962 } 963 964 ep->buf[0][ep->fifostart[0] + ep->fifolen[0] ++] = value; 965 ep->csr[0] |= MGC_M_TXCSR_FIFONOTEMPTY; 966 } 967 968 static void musb_ep_frame_cancel(MUSBEndPoint *ep, int dir) 969 { 970 if (ep->intv_timer[dir]) 971 timer_del(ep->intv_timer[dir]); 972 } 973 974 /* Bus control */ 975 static uint8_t musb_busctl_readb(void *opaque, int ep, int addr) 976 { 977 MUSBState *s = (MUSBState *) opaque; 978 979 switch (addr) { 980 /* For USB2.0 HS hubs only */ 981 case MUSB_HDRC_TXHUBADDR: 982 return s->ep[ep].haddr[0]; 983 case MUSB_HDRC_TXHUBPORT: 984 return s->ep[ep].hport[0]; 985 case MUSB_HDRC_RXHUBADDR: 986 return s->ep[ep].haddr[1]; 987 case MUSB_HDRC_RXHUBPORT: 988 return s->ep[ep].hport[1]; 989 990 default: 991 TRACE("unknown register 0x%02x", addr); 992 return 0x00; 993 }; 994 } 995 996 static void musb_busctl_writeb(void *opaque, int ep, int addr, uint8_t value) 997 { 998 MUSBState *s = (MUSBState *) opaque; 999 1000 switch (addr) { 1001 case MUSB_HDRC_TXFUNCADDR: 1002 s->ep[ep].faddr[0] = value; 1003 break; 1004 case MUSB_HDRC_RXFUNCADDR: 1005 s->ep[ep].faddr[1] = value; 1006 break; 1007 case MUSB_HDRC_TXHUBADDR: 1008 s->ep[ep].haddr[0] = value; 1009 break; 1010 case MUSB_HDRC_TXHUBPORT: 1011 s->ep[ep].hport[0] = value; 1012 break; 1013 case MUSB_HDRC_RXHUBADDR: 1014 s->ep[ep].haddr[1] = value; 1015 break; 1016 case MUSB_HDRC_RXHUBPORT: 1017 s->ep[ep].hport[1] = value; 1018 break; 1019 1020 default: 1021 TRACE("unknown register 0x%02x", addr); 1022 break; 1023 }; 1024 } 1025 1026 static uint16_t musb_busctl_readh(void *opaque, int ep, int addr) 1027 { 1028 MUSBState *s = (MUSBState *) opaque; 1029 1030 switch (addr) { 1031 case MUSB_HDRC_TXFUNCADDR: 1032 return s->ep[ep].faddr[0]; 1033 case MUSB_HDRC_RXFUNCADDR: 1034 return s->ep[ep].faddr[1]; 1035 1036 default: 1037 return musb_busctl_readb(s, ep, addr) | 1038 (musb_busctl_readb(s, ep, addr | 1) << 8); 1039 }; 1040 } 1041 1042 static void musb_busctl_writeh(void *opaque, int ep, int addr, uint16_t value) 1043 { 1044 MUSBState *s = (MUSBState *) opaque; 1045 1046 switch (addr) { 1047 case MUSB_HDRC_TXFUNCADDR: 1048 s->ep[ep].faddr[0] = value; 1049 break; 1050 case MUSB_HDRC_RXFUNCADDR: 1051 s->ep[ep].faddr[1] = value; 1052 break; 1053 1054 default: 1055 musb_busctl_writeb(s, ep, addr, value & 0xff); 1056 musb_busctl_writeb(s, ep, addr | 1, value >> 8); 1057 }; 1058 } 1059 1060 /* Endpoint control */ 1061 static uint8_t musb_ep_readb(void *opaque, int ep, int addr) 1062 { 1063 MUSBState *s = (MUSBState *) opaque; 1064 1065 switch (addr) { 1066 case MUSB_HDRC_TXTYPE: 1067 return s->ep[ep].type[0]; 1068 case MUSB_HDRC_TXINTERVAL: 1069 return s->ep[ep].interval[0]; 1070 case MUSB_HDRC_RXTYPE: 1071 return s->ep[ep].type[1]; 1072 case MUSB_HDRC_RXINTERVAL: 1073 return s->ep[ep].interval[1]; 1074 case (MUSB_HDRC_FIFOSIZE & ~1): 1075 return 0x00; 1076 case MUSB_HDRC_FIFOSIZE: 1077 return ep ? s->ep[ep].fifosize : s->ep[ep].config; 1078 case MUSB_HDRC_RXCOUNT: 1079 return s->ep[ep].rxcount; 1080 1081 default: 1082 TRACE("unknown register 0x%02x", addr); 1083 return 0x00; 1084 }; 1085 } 1086 1087 static void musb_ep_writeb(void *opaque, int ep, int addr, uint8_t value) 1088 { 1089 MUSBState *s = (MUSBState *) opaque; 1090 1091 switch (addr) { 1092 case MUSB_HDRC_TXTYPE: 1093 s->ep[ep].type[0] = value; 1094 break; 1095 case MUSB_HDRC_TXINTERVAL: 1096 s->ep[ep].interval[0] = value; 1097 musb_ep_frame_cancel(&s->ep[ep], 0); 1098 break; 1099 case MUSB_HDRC_RXTYPE: 1100 s->ep[ep].type[1] = value; 1101 break; 1102 case MUSB_HDRC_RXINTERVAL: 1103 s->ep[ep].interval[1] = value; 1104 musb_ep_frame_cancel(&s->ep[ep], 1); 1105 break; 1106 case (MUSB_HDRC_FIFOSIZE & ~1): 1107 break; 1108 case MUSB_HDRC_FIFOSIZE: 1109 TRACE("somebody messes with fifosize (now %i bytes)", value); 1110 s->ep[ep].fifosize = value; 1111 break; 1112 default: 1113 TRACE("unknown register 0x%02x", addr); 1114 break; 1115 }; 1116 } 1117 1118 static uint16_t musb_ep_readh(void *opaque, int ep, int addr) 1119 { 1120 MUSBState *s = (MUSBState *) opaque; 1121 uint16_t ret; 1122 1123 switch (addr) { 1124 case MUSB_HDRC_TXMAXP: 1125 return s->ep[ep].maxp[0]; 1126 case MUSB_HDRC_TXCSR: 1127 return s->ep[ep].csr[0]; 1128 case MUSB_HDRC_RXMAXP: 1129 return s->ep[ep].maxp[1]; 1130 case MUSB_HDRC_RXCSR: 1131 ret = s->ep[ep].csr[1]; 1132 1133 /* TODO: This and other bits probably depend on 1134 * ep->csr[1] & MGC_M_RXCSR_AUTOCLEAR. */ 1135 if (s->ep[ep].csr[1] & MGC_M_RXCSR_AUTOCLEAR) 1136 s->ep[ep].csr[1] &= ~MGC_M_RXCSR_RXPKTRDY; 1137 1138 return ret; 1139 case MUSB_HDRC_RXCOUNT: 1140 return s->ep[ep].rxcount; 1141 1142 default: 1143 return musb_ep_readb(s, ep, addr) | 1144 (musb_ep_readb(s, ep, addr | 1) << 8); 1145 }; 1146 } 1147 1148 static void musb_ep_writeh(void *opaque, int ep, int addr, uint16_t value) 1149 { 1150 MUSBState *s = (MUSBState *) opaque; 1151 1152 switch (addr) { 1153 case MUSB_HDRC_TXMAXP: 1154 s->ep[ep].maxp[0] = value; 1155 break; 1156 case MUSB_HDRC_TXCSR: 1157 if (ep) { 1158 s->ep[ep].csr[0] &= value & 0xa6; 1159 s->ep[ep].csr[0] |= value & 0xff59; 1160 } else { 1161 s->ep[ep].csr[0] &= value & 0x85; 1162 s->ep[ep].csr[0] |= value & 0xf7a; 1163 } 1164 1165 musb_ep_frame_cancel(&s->ep[ep], 0); 1166 1167 if ((ep && (value & MGC_M_TXCSR_FLUSHFIFO)) || 1168 (!ep && (value & MGC_M_CSR0_FLUSHFIFO))) { 1169 s->ep[ep].fifolen[0] = 0; 1170 s->ep[ep].fifostart[0] = 0; 1171 if (ep) 1172 s->ep[ep].csr[0] &= 1173 ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY); 1174 else 1175 s->ep[ep].csr[0] &= 1176 ~(MGC_M_CSR0_TXPKTRDY | MGC_M_CSR0_RXPKTRDY); 1177 } 1178 if ( 1179 (ep && 1180 #ifdef CLEAR_NAK 1181 (value & MGC_M_TXCSR_TXPKTRDY) && 1182 !(value & MGC_M_TXCSR_H_NAKTIMEOUT)) || 1183 #else 1184 (value & MGC_M_TXCSR_TXPKTRDY)) || 1185 #endif 1186 (!ep && 1187 #ifdef CLEAR_NAK 1188 (value & MGC_M_CSR0_TXPKTRDY) && 1189 !(value & MGC_M_CSR0_H_NAKTIMEOUT))) 1190 #else 1191 (value & MGC_M_CSR0_TXPKTRDY))) 1192 #endif 1193 musb_tx_rdy(s, ep); 1194 if (!ep && 1195 (value & MGC_M_CSR0_H_REQPKT) && 1196 #ifdef CLEAR_NAK 1197 !(value & (MGC_M_CSR0_H_NAKTIMEOUT | 1198 MGC_M_CSR0_RXPKTRDY))) 1199 #else 1200 !(value & MGC_M_CSR0_RXPKTRDY)) 1201 #endif 1202 musb_rx_req(s, ep); 1203 break; 1204 1205 case MUSB_HDRC_RXMAXP: 1206 s->ep[ep].maxp[1] = value; 1207 break; 1208 case MUSB_HDRC_RXCSR: 1209 /* (DMA mode only) */ 1210 if ( 1211 (value & MGC_M_RXCSR_H_AUTOREQ) && 1212 !(value & MGC_M_RXCSR_RXPKTRDY) && 1213 (s->ep[ep].csr[1] & MGC_M_RXCSR_RXPKTRDY)) 1214 value |= MGC_M_RXCSR_H_REQPKT; 1215 1216 s->ep[ep].csr[1] &= 0x102 | (value & 0x4d); 1217 s->ep[ep].csr[1] |= value & 0xfeb0; 1218 1219 musb_ep_frame_cancel(&s->ep[ep], 1); 1220 1221 if (value & MGC_M_RXCSR_FLUSHFIFO) { 1222 s->ep[ep].fifolen[1] = 0; 1223 s->ep[ep].fifostart[1] = 0; 1224 s->ep[ep].csr[1] &= ~(MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY); 1225 /* If double buffering and we have two packets ready, flush 1226 * only the first one and set up the fifo at the second packet. */ 1227 } 1228 #ifdef CLEAR_NAK 1229 if ((value & MGC_M_RXCSR_H_REQPKT) && !(value & MGC_M_RXCSR_DATAERROR)) 1230 #else 1231 if (value & MGC_M_RXCSR_H_REQPKT) 1232 #endif 1233 musb_rx_req(s, ep); 1234 break; 1235 case MUSB_HDRC_RXCOUNT: 1236 s->ep[ep].rxcount = value; 1237 break; 1238 1239 default: 1240 musb_ep_writeb(s, ep, addr, value & 0xff); 1241 musb_ep_writeb(s, ep, addr | 1, value >> 8); 1242 }; 1243 } 1244 1245 /* Generic control */ 1246 static uint32_t musb_readb(void *opaque, hwaddr addr) 1247 { 1248 MUSBState *s = (MUSBState *) opaque; 1249 int ep, i; 1250 uint8_t ret; 1251 1252 switch (addr) { 1253 case MUSB_HDRC_FADDR: 1254 return s->faddr; 1255 case MUSB_HDRC_POWER: 1256 return s->power; 1257 case MUSB_HDRC_INTRUSB: 1258 ret = s->intr; 1259 for (i = 0; i < sizeof(ret) * 8; i ++) 1260 if (ret & (1 << i)) 1261 musb_intr_set(s, i, 0); 1262 return ret; 1263 case MUSB_HDRC_INTRUSBE: 1264 return s->mask; 1265 case MUSB_HDRC_INDEX: 1266 return s->idx; 1267 case MUSB_HDRC_TESTMODE: 1268 return 0x00; 1269 1270 case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf): 1271 return musb_ep_readb(s, s->idx, addr & 0xf); 1272 1273 case MUSB_HDRC_DEVCTL: 1274 return s->devctl; 1275 1276 case MUSB_HDRC_TXFIFOSZ: 1277 case MUSB_HDRC_RXFIFOSZ: 1278 case MUSB_HDRC_VCTRL: 1279 /* TODO */ 1280 return 0x00; 1281 1282 case MUSB_HDRC_HWVERS: 1283 return (1 << 10) | 400; 1284 1285 case (MUSB_HDRC_VCTRL | 1): 1286 case (MUSB_HDRC_HWVERS | 1): 1287 case (MUSB_HDRC_DEVCTL | 1): 1288 return 0x00; 1289 1290 case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f): 1291 ep = (addr >> 3) & 0xf; 1292 return musb_busctl_readb(s, ep, addr & 0x7); 1293 1294 case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff): 1295 ep = (addr >> 4) & 0xf; 1296 return musb_ep_readb(s, ep, addr & 0xf); 1297 1298 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1299 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1300 return musb_read_fifo(s->ep + ep); 1301 1302 default: 1303 TRACE("unknown register 0x%02x", (int) addr); 1304 return 0x00; 1305 }; 1306 } 1307 1308 static void musb_writeb(void *opaque, hwaddr addr, uint32_t value) 1309 { 1310 MUSBState *s = (MUSBState *) opaque; 1311 int ep; 1312 1313 switch (addr) { 1314 case MUSB_HDRC_FADDR: 1315 s->faddr = value & 0x7f; 1316 break; 1317 case MUSB_HDRC_POWER: 1318 s->power = (value & 0xef) | (s->power & 0x10); 1319 /* MGC_M_POWER_RESET is also read-only in Peripheral Mode */ 1320 if ((value & MGC_M_POWER_RESET) && s->port.dev) { 1321 usb_device_reset(s->port.dev); 1322 /* Negotiate high-speed operation if MGC_M_POWER_HSENAB is set. */ 1323 if ((value & MGC_M_POWER_HSENAB) && 1324 s->port.dev->speed == USB_SPEED_HIGH) 1325 s->power |= MGC_M_POWER_HSMODE; /* Success */ 1326 /* Restart frame counting. */ 1327 } 1328 if (value & MGC_M_POWER_SUSPENDM) { 1329 /* When all transfers finish, suspend and if MGC_M_POWER_ENSUSPEND 1330 * is set, also go into low power mode. Frame counting stops. */ 1331 /* XXX: Cleared when the interrupt register is read */ 1332 } 1333 if (value & MGC_M_POWER_RESUME) { 1334 /* Wait 20ms and signal resuming on the bus. Frame counting 1335 * restarts. */ 1336 } 1337 break; 1338 case MUSB_HDRC_INTRUSB: 1339 break; 1340 case MUSB_HDRC_INTRUSBE: 1341 s->mask = value & 0xff; 1342 break; 1343 case MUSB_HDRC_INDEX: 1344 s->idx = value & 0xf; 1345 break; 1346 case MUSB_HDRC_TESTMODE: 1347 break; 1348 1349 case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf): 1350 musb_ep_writeb(s, s->idx, addr & 0xf, value); 1351 break; 1352 1353 case MUSB_HDRC_DEVCTL: 1354 s->session = !!(value & MGC_M_DEVCTL_SESSION); 1355 musb_session_update(s, 1356 !!s->port.dev, 1357 !!(s->devctl & MGC_M_DEVCTL_SESSION)); 1358 1359 /* It seems this is the only R/W bit in this register? */ 1360 s->devctl &= ~MGC_M_DEVCTL_SESSION; 1361 s->devctl |= value & MGC_M_DEVCTL_SESSION; 1362 break; 1363 1364 case MUSB_HDRC_TXFIFOSZ: 1365 case MUSB_HDRC_RXFIFOSZ: 1366 case MUSB_HDRC_VCTRL: 1367 /* TODO */ 1368 break; 1369 1370 case (MUSB_HDRC_VCTRL | 1): 1371 case (MUSB_HDRC_DEVCTL | 1): 1372 break; 1373 1374 case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f): 1375 ep = (addr >> 3) & 0xf; 1376 musb_busctl_writeb(s, ep, addr & 0x7, value); 1377 break; 1378 1379 case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff): 1380 ep = (addr >> 4) & 0xf; 1381 musb_ep_writeb(s, ep, addr & 0xf, value); 1382 break; 1383 1384 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1385 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1386 musb_write_fifo(s->ep + ep, value & 0xff); 1387 break; 1388 1389 default: 1390 TRACE("unknown register 0x%02x", (int) addr); 1391 break; 1392 }; 1393 } 1394 1395 static uint32_t musb_readh(void *opaque, hwaddr addr) 1396 { 1397 MUSBState *s = (MUSBState *) opaque; 1398 int ep, i; 1399 uint16_t ret; 1400 1401 switch (addr) { 1402 case MUSB_HDRC_INTRTX: 1403 ret = s->tx_intr; 1404 /* Auto clear */ 1405 for (i = 0; i < sizeof(ret) * 8; i ++) 1406 if (ret & (1 << i)) 1407 musb_tx_intr_set(s, i, 0); 1408 return ret; 1409 case MUSB_HDRC_INTRRX: 1410 ret = s->rx_intr; 1411 /* Auto clear */ 1412 for (i = 0; i < sizeof(ret) * 8; i ++) 1413 if (ret & (1 << i)) 1414 musb_rx_intr_set(s, i, 0); 1415 return ret; 1416 case MUSB_HDRC_INTRTXE: 1417 return s->tx_mask; 1418 case MUSB_HDRC_INTRRXE: 1419 return s->rx_mask; 1420 1421 case MUSB_HDRC_FRAME: 1422 /* TODO */ 1423 return 0x0000; 1424 case MUSB_HDRC_TXFIFOADDR: 1425 return s->ep[s->idx].fifoaddr[0]; 1426 case MUSB_HDRC_RXFIFOADDR: 1427 return s->ep[s->idx].fifoaddr[1]; 1428 1429 case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf): 1430 return musb_ep_readh(s, s->idx, addr & 0xf); 1431 1432 case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f): 1433 ep = (addr >> 3) & 0xf; 1434 return musb_busctl_readh(s, ep, addr & 0x7); 1435 1436 case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff): 1437 ep = (addr >> 4) & 0xf; 1438 return musb_ep_readh(s, ep, addr & 0xf); 1439 1440 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1441 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1442 return (musb_read_fifo(s->ep + ep) | musb_read_fifo(s->ep + ep) << 8); 1443 1444 default: 1445 return musb_readb(s, addr) | (musb_readb(s, addr | 1) << 8); 1446 }; 1447 } 1448 1449 static void musb_writeh(void *opaque, hwaddr addr, uint32_t value) 1450 { 1451 MUSBState *s = (MUSBState *) opaque; 1452 int ep; 1453 1454 switch (addr) { 1455 case MUSB_HDRC_INTRTXE: 1456 s->tx_mask = value; 1457 /* XXX: the masks seem to apply on the raising edge like with 1458 * edge-triggered interrupts, thus no need to update. I may be 1459 * wrong though. */ 1460 break; 1461 case MUSB_HDRC_INTRRXE: 1462 s->rx_mask = value; 1463 break; 1464 1465 case MUSB_HDRC_FRAME: 1466 /* TODO */ 1467 break; 1468 case MUSB_HDRC_TXFIFOADDR: 1469 s->ep[s->idx].fifoaddr[0] = value; 1470 s->ep[s->idx].buf[0] = 1471 s->buf + ((value << 3) & 0x7ff ); 1472 break; 1473 case MUSB_HDRC_RXFIFOADDR: 1474 s->ep[s->idx].fifoaddr[1] = value; 1475 s->ep[s->idx].buf[1] = 1476 s->buf + ((value << 3) & 0x7ff); 1477 break; 1478 1479 case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf): 1480 musb_ep_writeh(s, s->idx, addr & 0xf, value); 1481 break; 1482 1483 case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f): 1484 ep = (addr >> 3) & 0xf; 1485 musb_busctl_writeh(s, ep, addr & 0x7, value); 1486 break; 1487 1488 case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff): 1489 ep = (addr >> 4) & 0xf; 1490 musb_ep_writeh(s, ep, addr & 0xf, value); 1491 break; 1492 1493 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1494 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1495 musb_write_fifo(s->ep + ep, value & 0xff); 1496 musb_write_fifo(s->ep + ep, (value >> 8) & 0xff); 1497 break; 1498 1499 default: 1500 musb_writeb(s, addr, value & 0xff); 1501 musb_writeb(s, addr | 1, value >> 8); 1502 }; 1503 } 1504 1505 static uint32_t musb_readw(void *opaque, hwaddr addr) 1506 { 1507 MUSBState *s = (MUSBState *) opaque; 1508 int ep; 1509 1510 switch (addr) { 1511 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1512 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1513 return ( musb_read_fifo(s->ep + ep) | 1514 musb_read_fifo(s->ep + ep) << 8 | 1515 musb_read_fifo(s->ep + ep) << 16 | 1516 musb_read_fifo(s->ep + ep) << 24 ); 1517 default: 1518 TRACE("unknown register 0x%02x", (int) addr); 1519 return 0x00000000; 1520 }; 1521 } 1522 1523 static void musb_writew(void *opaque, hwaddr addr, uint32_t value) 1524 { 1525 MUSBState *s = (MUSBState *) opaque; 1526 int ep; 1527 1528 switch (addr) { 1529 case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f): 1530 ep = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf; 1531 musb_write_fifo(s->ep + ep, value & 0xff); 1532 musb_write_fifo(s->ep + ep, (value >> 8 ) & 0xff); 1533 musb_write_fifo(s->ep + ep, (value >> 16) & 0xff); 1534 musb_write_fifo(s->ep + ep, (value >> 24) & 0xff); 1535 break; 1536 default: 1537 TRACE("unknown register 0x%02x", (int) addr); 1538 break; 1539 }; 1540 } 1541 1542 CPUReadMemoryFunc * const musb_read[] = { 1543 musb_readb, 1544 musb_readh, 1545 musb_readw, 1546 }; 1547 1548 CPUWriteMemoryFunc * const musb_write[] = { 1549 musb_writeb, 1550 musb_writeh, 1551 musb_writew, 1552 }; 1553