hw/tusb6010.c

/*
 * Texas Instruments TUSB6010 emulation.
 * Based on reverse-engineering of a linux driver.
 *
 * Copyright (C) 2008 Nokia Corporation
 * Written by Andrzej Zaborowski <andrew@openedhand.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 or
 * (at your option) version 3 of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
#include "qemu-common.h"
#include "qemu-timer.h"
#include "usb.h"
#include "omap.h"
#include "irq.h"
#include "devices.h"

struct TUSBState {
    int iomemtype[2];
    qemu_irq irq;
    MUSBState *musb;
    QEMUTimer *otg_timer;
    QEMUTimer *pwr_timer;

    int power;
    uint32_t scratch;
    uint16_t test_reset;
    uint32_t prcm_config;
    uint32_t prcm_mngmt;
    uint16_t otg_status;
    uint32_t dev_config;
    int host_mode;
    uint32_t intr;
    uint32_t intr_ok;
    uint32_t mask;
    uint32_t usbip_intr;
    uint32_t usbip_mask;
    uint32_t gpio_intr;
    uint32_t gpio_mask;
    uint32_t gpio_config;
    uint32_t dma_intr;
    uint32_t dma_mask;
    uint32_t dma_map;
    uint32_t dma_config;
    uint32_t ep0_config;
    uint32_t rx_config[15];
    uint32_t tx_config[15];
    uint32_t wkup_mask;
    uint32_t pullup[2];
    uint32_t control_config;
    uint32_t otg_timer_val;
};

#define TUSB_DEVCLOCK			60000000	/* 60 MHz */

#define TUSB_VLYNQ_CTRL			0x004

/* Mentor Graphics OTG core registers.  */
#define TUSB_BASE_OFFSET		0x400

/* FIFO registers, 32-bit.  */
#define TUSB_FIFO_BASE			0x600

/* Device System & Control registers, 32-bit.  */
#define TUSB_SYS_REG_BASE		0x800

#define TUSB_DEV_CONF			(TUSB_SYS_REG_BASE + 0x000)
#define	TUSB_DEV_CONF_USB_HOST_MODE	(1 << 16)
#define	TUSB_DEV_CONF_PROD_TEST_MODE	(1 << 15)
#define	TUSB_DEV_CONF_SOFT_ID		(1 << 1)
#define	TUSB_DEV_CONF_ID_SEL		(1 << 0)

#define TUSB_PHY_OTG_CTRL_ENABLE	(TUSB_SYS_REG_BASE + 0x004)
#define TUSB_PHY_OTG_CTRL		(TUSB_SYS_REG_BASE + 0x008)
#define	TUSB_PHY_OTG_CTRL_WRPROTECT	(0xa5 << 24)
#define	TUSB_PHY_OTG_CTRL_O_ID_PULLUP	(1 << 23)
#define	TUSB_PHY_OTG_CTRL_O_VBUS_DET_EN	(1 << 19)
#define	TUSB_PHY_OTG_CTRL_O_SESS_END_EN	(1 << 18)
#define	TUSB_PHY_OTG_CTRL_TESTM2	(1 << 17)
#define	TUSB_PHY_OTG_CTRL_TESTM1	(1 << 16)
#define	TUSB_PHY_OTG_CTRL_TESTM0	(1 << 15)
#define	TUSB_PHY_OTG_CTRL_TX_DATA2	(1 << 14)
#define	TUSB_PHY_OTG_CTRL_TX_GZ2	(1 << 13)
#define	TUSB_PHY_OTG_CTRL_TX_ENABLE2	(1 << 12)
#define	TUSB_PHY_OTG_CTRL_DM_PULLDOWN	(1 << 11)
#define	TUSB_PHY_OTG_CTRL_DP_PULLDOWN	(1 << 10)
#define	TUSB_PHY_OTG_CTRL_OSC_EN	(1 << 9)
#define	TUSB_PHY_OTG_CTRL_PHYREF_CLK(v)	(((v) & 3) << 7)
#define	TUSB_PHY_OTG_CTRL_PD		(1 << 6)
#define	TUSB_PHY_OTG_CTRL_PLL_ON	(1 << 5)
#define	TUSB_PHY_OTG_CTRL_EXT_RPU	(1 << 4)
#define	TUSB_PHY_OTG_CTRL_PWR_GOOD	(1 << 3)
#define	TUSB_PHY_OTG_CTRL_RESET		(1 << 2)
#define	TUSB_PHY_OTG_CTRL_SUSPENDM	(1 << 1)
#define	TUSB_PHY_OTG_CTRL_CLK_MODE	(1 << 0)

/* OTG status register */
#define TUSB_DEV_OTG_STAT		(TUSB_SYS_REG_BASE + 0x00c)
#define	TUSB_DEV_OTG_STAT_PWR_CLK_GOOD	(1 << 8)
#define	TUSB_DEV_OTG_STAT_SESS_END	(1 << 7)
#define	TUSB_DEV_OTG_STAT_SESS_VALID	(1 << 6)
#define	TUSB_DEV_OTG_STAT_VBUS_VALID	(1 << 5)
#define	TUSB_DEV_OTG_STAT_VBUS_SENSE	(1 << 4)
#define	TUSB_DEV_OTG_STAT_ID_STATUS	(1 << 3)
#define	TUSB_DEV_OTG_STAT_HOST_DISCON	(1 << 2)
#define	TUSB_DEV_OTG_STAT_LINE_STATE	(3 << 0)
#define	TUSB_DEV_OTG_STAT_DP_ENABLE	(1 << 1)
#define	TUSB_DEV_OTG_STAT_DM_ENABLE	(1 << 0)

#define TUSB_DEV_OTG_TIMER		(TUSB_SYS_REG_BASE + 0x010)
#define TUSB_DEV_OTG_TIMER_ENABLE	(1 << 31)
#define TUSB_DEV_OTG_TIMER_VAL(v)	((v) & 0x07ffffff)
#define TUSB_PRCM_REV			(TUSB_SYS_REG_BASE + 0x014)

/* PRCM configuration register */
#define TUSB_PRCM_CONF			(TUSB_SYS_REG_BASE + 0x018)
#define	TUSB_PRCM_CONF_SFW_CPEN		(1 << 24)
#define	TUSB_PRCM_CONF_SYS_CLKSEL(v)	(((v) & 3) << 16)

/* PRCM management register */
#define TUSB_PRCM_MNGMT			(TUSB_SYS_REG_BASE + 0x01c)
#define	TUSB_PRCM_MNGMT_SRP_FIX_TMR(v)	(((v) & 0xf) << 25)
#define	TUSB_PRCM_MNGMT_SRP_FIX_EN	(1 << 24)
#define	TUSB_PRCM_MNGMT_VBUS_VAL_TMR(v)	(((v) & 0xf) << 20)
#define	TUSB_PRCM_MNGMT_VBUS_VAL_FLT_EN	(1 << 19)
#define	TUSB_PRCM_MNGMT_DFT_CLK_DIS	(1 << 18)
#define	TUSB_PRCM_MNGMT_VLYNQ_CLK_DIS	(1 << 17)
#define	TUSB_PRCM_MNGMT_OTG_SESS_END_EN	(1 << 10)
#define	TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN	(1 << 9)
#define	TUSB_PRCM_MNGMT_OTG_ID_PULLUP	(1 << 8)
#define	TUSB_PRCM_MNGMT_15_SW_EN	(1 << 4)
#define	TUSB_PRCM_MNGMT_33_SW_EN	(1 << 3)
#define	TUSB_PRCM_MNGMT_5V_CPEN		(1 << 2)
#define	TUSB_PRCM_MNGMT_PM_IDLE		(1 << 1)
#define	TUSB_PRCM_MNGMT_DEV_IDLE	(1 << 0)

/* Wake-up source clear and mask registers */
#define TUSB_PRCM_WAKEUP_SOURCE		(TUSB_SYS_REG_BASE + 0x020)
#define TUSB_PRCM_WAKEUP_CLEAR		(TUSB_SYS_REG_BASE + 0x028)
#define TUSB_PRCM_WAKEUP_MASK		(TUSB_SYS_REG_BASE + 0x02c)
#define	TUSB_PRCM_WAKEUP_RESERVED_BITS	(0xffffe << 13)
#define	TUSB_PRCM_WGPIO_7		(1 << 12)
#define	TUSB_PRCM_WGPIO_6		(1 << 11)
#define	TUSB_PRCM_WGPIO_5		(1 << 10)
#define	TUSB_PRCM_WGPIO_4		(1 << 9)
#define	TUSB_PRCM_WGPIO_3		(1 << 8)
#define	TUSB_PRCM_WGPIO_2		(1 << 7)
#define	TUSB_PRCM_WGPIO_1		(1 << 6)
#define	TUSB_PRCM_WGPIO_0		(1 << 5)
#define	TUSB_PRCM_WHOSTDISCON		(1 << 4)	/* Host disconnect */
#define	TUSB_PRCM_WBUS			(1 << 3)	/* USB bus resume */
#define	TUSB_PRCM_WNORCS		(1 << 2)	/* NOR chip select */
#define	TUSB_PRCM_WVBUS			(1 << 1)	/* OTG PHY VBUS */
#define	TUSB_PRCM_WID			(1 << 0)	/* OTG PHY ID detect */

#define TUSB_PULLUP_1_CTRL		(TUSB_SYS_REG_BASE + 0x030)
#define TUSB_PULLUP_2_CTRL		(TUSB_SYS_REG_BASE + 0x034)
#define TUSB_INT_CTRL_REV		(TUSB_SYS_REG_BASE + 0x038)
#define TUSB_INT_CTRL_CONF		(TUSB_SYS_REG_BASE + 0x03c)
#define TUSB_USBIP_INT_SRC		(TUSB_SYS_REG_BASE + 0x040)
#define TUSB_USBIP_INT_SET		(TUSB_SYS_REG_BASE + 0x044)
#define TUSB_USBIP_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x048)
#define TUSB_USBIP_INT_MASK		(TUSB_SYS_REG_BASE + 0x04c)
#define TUSB_DMA_INT_SRC		(TUSB_SYS_REG_BASE + 0x050)
#define TUSB_DMA_INT_SET		(TUSB_SYS_REG_BASE + 0x054)
#define TUSB_DMA_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x058)
#define TUSB_DMA_INT_MASK		(TUSB_SYS_REG_BASE + 0x05c)
#define TUSB_GPIO_INT_SRC		(TUSB_SYS_REG_BASE + 0x060)
#define TUSB_GPIO_INT_SET		(TUSB_SYS_REG_BASE + 0x064)
#define TUSB_GPIO_INT_CLEAR		(TUSB_SYS_REG_BASE + 0x068)
#define TUSB_GPIO_INT_MASK		(TUSB_SYS_REG_BASE + 0x06c)

/* NOR flash interrupt source registers */
#define TUSB_INT_SRC			(TUSB_SYS_REG_BASE + 0x070)
#define TUSB_INT_SRC_SET		(TUSB_SYS_REG_BASE + 0x074)
#define TUSB_INT_SRC_CLEAR		(TUSB_SYS_REG_BASE + 0x078)
#define TUSB_INT_MASK			(TUSB_SYS_REG_BASE + 0x07c)
#define	TUSB_INT_SRC_TXRX_DMA_DONE	(1 << 24)
#define	TUSB_INT_SRC_USB_IP_CORE	(1 << 17)
#define	TUSB_INT_SRC_OTG_TIMEOUT	(1 << 16)
#define	TUSB_INT_SRC_VBUS_SENSE_CHNG	(1 << 15)
#define	TUSB_INT_SRC_ID_STATUS_CHNG	(1 << 14)
#define	TUSB_INT_SRC_DEV_WAKEUP		(1 << 13)
#define	TUSB_INT_SRC_DEV_READY		(1 << 12)
#define	TUSB_INT_SRC_USB_IP_TX		(1 << 9)
#define	TUSB_INT_SRC_USB_IP_RX		(1 << 8)
#define	TUSB_INT_SRC_USB_IP_VBUS_ERR	(1 << 7)
#define	TUSB_INT_SRC_USB_IP_VBUS_REQ	(1 << 6)
#define	TUSB_INT_SRC_USB_IP_DISCON	(1 << 5)
#define	TUSB_INT_SRC_USB_IP_CONN	(1 << 4)
#define	TUSB_INT_SRC_USB_IP_SOF		(1 << 3)
#define	TUSB_INT_SRC_USB_IP_RST_BABBLE	(1 << 2)
#define	TUSB_INT_SRC_USB_IP_RESUME	(1 << 1)
#define	TUSB_INT_SRC_USB_IP_SUSPEND	(1 << 0)

#define TUSB_GPIO_REV			(TUSB_SYS_REG_BASE + 0x080)
#define TUSB_GPIO_CONF			(TUSB_SYS_REG_BASE + 0x084)
#define TUSB_DMA_CTRL_REV		(TUSB_SYS_REG_BASE + 0x100)
#define TUSB_DMA_REQ_CONF		(TUSB_SYS_REG_BASE + 0x104)
#define TUSB_EP0_CONF			(TUSB_SYS_REG_BASE + 0x108)
#define TUSB_EP_IN_SIZE			(TUSB_SYS_REG_BASE + 0x10c)
#define TUSB_DMA_EP_MAP			(TUSB_SYS_REG_BASE + 0x148)
#define TUSB_EP_OUT_SIZE		(TUSB_SYS_REG_BASE + 0x14c)
#define TUSB_EP_MAX_PACKET_SIZE_OFFSET	(TUSB_SYS_REG_BASE + 0x188)
#define TUSB_SCRATCH_PAD		(TUSB_SYS_REG_BASE + 0x1c4)
#define TUSB_WAIT_COUNT			(TUSB_SYS_REG_BASE + 0x1c8)
#define TUSB_PROD_TEST_RESET		(TUSB_SYS_REG_BASE + 0x1d8)

#define TUSB_DIDR1_LO			(TUSB_SYS_REG_BASE + 0x1f8)
#define TUSB_DIDR1_HI			(TUSB_SYS_REG_BASE + 0x1fc)

/* Device System & Control register bitfields */
#define TUSB_INT_CTRL_CONF_INT_RLCYC(v)	(((v) & 0x7) << 18)
#define TUSB_INT_CTRL_CONF_INT_POLARITY	(1 << 17)
#define TUSB_INT_CTRL_CONF_INT_MODE	(1 << 16)
#define TUSB_GPIO_CONF_DMAREQ(v)	(((v) & 0x3f) << 24)
#define TUSB_DMA_REQ_CONF_BURST_SIZE(v)	(((v) & 3) << 26)
#define TUSB_DMA_REQ_CONF_DMA_RQ_EN(v)	(((v) & 0x3f) << 20)
#define TUSB_DMA_REQ_CONF_DMA_RQ_ASR(v)	(((v) & 0xf) << 16)
#define TUSB_EP0_CONFIG_SW_EN		(1 << 8)
#define TUSB_EP0_CONFIG_DIR_TX		(1 << 7)
#define TUSB_EP0_CONFIG_XFR_SIZE(v)	((v) & 0x7f)
#define TUSB_EP_CONFIG_SW_EN		(1 << 31)
#define TUSB_EP_CONFIG_XFR_SIZE(v)	((v) & 0x7fffffff)
#define TUSB_PROD_TEST_RESET_VAL	0xa596

int tusb6010_sync_io(TUSBState *s)
{
    return s->iomemtype[0];
}

int tusb6010_async_io(TUSBState *s)
{
    return s->iomemtype[1];
}

static void tusb_intr_update(TUSBState *s)
{
    if (s->control_config & TUSB_INT_CTRL_CONF_INT_POLARITY)
        qemu_set_irq(s->irq, s->intr & ~s->mask & s->intr_ok);
    else
        qemu_set_irq(s->irq, (!(s->intr & ~s->mask)) & s->intr_ok);
}

static void tusb_usbip_intr_update(TUSBState *s)
{
    /* TX interrupt in the MUSB */
    if (s->usbip_intr & 0x0000ffff & ~s->usbip_mask)
        s->intr |= TUSB_INT_SRC_USB_IP_TX;
    else
        s->intr &= ~TUSB_INT_SRC_USB_IP_TX;

    /* RX interrupt in the MUSB */
    if (s->usbip_intr & 0xffff0000 & ~s->usbip_mask)
        s->intr |= TUSB_INT_SRC_USB_IP_RX;
    else
        s->intr &= ~TUSB_INT_SRC_USB_IP_RX;

    /* XXX: What about TUSB_INT_SRC_USB_IP_CORE?  */

    tusb_intr_update(s);
}

static void tusb_dma_intr_update(TUSBState *s)
{
    if (s->dma_intr & ~s->dma_mask)
        s->intr |= TUSB_INT_SRC_TXRX_DMA_DONE;
    else
        s->intr &= ~TUSB_INT_SRC_TXRX_DMA_DONE;

    tusb_intr_update(s);
}

static void tusb_gpio_intr_update(TUSBState *s)
{
    /* TODO: How is this signalled?  */
}

extern CPUReadMemoryFunc *musb_read[];
extern CPUWriteMemoryFunc *musb_write[];

static uint32_t tusb_async_readb(void *opaque, target_phys_addr_t addr)
{
    TUSBState *s = (TUSBState *) opaque;

    switch (addr & 0xfff) {
    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        return musb_read[0](s->musb, addr & 0x1ff);

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        return musb_read[0](s->musb, 0x20 + ((addr >> 3) & 0x3c));
    }

    printf("%s: unknown register at %03x\n",
                    __FUNCTION__, (int) (addr & 0xfff));
    return 0;
}

static uint32_t tusb_async_readh(void *opaque, target_phys_addr_t addr)
{
    TUSBState *s = (TUSBState *) opaque;

    switch (addr & 0xfff) {
    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        return musb_read[1](s->musb, addr & 0x1ff);

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        return musb_read[1](s->musb, 0x20 + ((addr >> 3) & 0x3c));
    }

    printf("%s: unknown register at %03x\n",
                    __FUNCTION__, (int) (addr & 0xfff));
    return 0;
}

static uint32_t tusb_async_readw(void *opaque, target_phys_addr_t addr)
{
    TUSBState *s = (TUSBState *) opaque;
    int offset = addr & 0xfff;
    int epnum;
    uint32_t ret;

    switch (offset) {
    case TUSB_DEV_CONF:
        return s->dev_config;

    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        return musb_read[2](s->musb, offset & 0x1ff);

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        return musb_read[2](s->musb, 0x20 + ((addr >> 3) & 0x3c));

    case TUSB_PHY_OTG_CTRL_ENABLE:
    case TUSB_PHY_OTG_CTRL:
        return 0x00;	/* TODO */

    case TUSB_DEV_OTG_STAT:
        ret = s->otg_status;
#if 0
        if (!(s->prcm_mngmt & TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN))
            ret &= ~TUSB_DEV_OTG_STAT_VBUS_VALID;
#endif
        return ret;
    case TUSB_DEV_OTG_TIMER:
        return s->otg_timer_val;

    case TUSB_PRCM_REV:
        return 0x20;
    case TUSB_PRCM_CONF:
        return s->prcm_config;
    case TUSB_PRCM_MNGMT:
        return s->prcm_mngmt;
    case TUSB_PRCM_WAKEUP_SOURCE:
    case TUSB_PRCM_WAKEUP_CLEAR:	/* TODO: What does this one return?  */
        return 0x00000000;
    case TUSB_PRCM_WAKEUP_MASK:
        return s->wkup_mask;

    case TUSB_PULLUP_1_CTRL:
        return s->pullup[0];
    case TUSB_PULLUP_2_CTRL:
        return s->pullup[1];

    case TUSB_INT_CTRL_REV:
        return 0x20;
    case TUSB_INT_CTRL_CONF:
        return s->control_config;

    case TUSB_USBIP_INT_SRC:
    case TUSB_USBIP_INT_SET:	/* TODO: What do these two return?  */
    case TUSB_USBIP_INT_CLEAR:
        return s->usbip_intr;
    case TUSB_USBIP_INT_MASK:
        return s->usbip_mask;

    case TUSB_DMA_INT_SRC:
    case TUSB_DMA_INT_SET:	/* TODO: What do these two return?  */
    case TUSB_DMA_INT_CLEAR:
        return s->dma_intr;
    case TUSB_DMA_INT_MASK:
        return s->dma_mask;

    case TUSB_GPIO_INT_SRC:	/* TODO: What do these two return?  */
    case TUSB_GPIO_INT_SET:
    case TUSB_GPIO_INT_CLEAR:
        return s->gpio_intr;
    case TUSB_GPIO_INT_MASK:
        return s->gpio_mask;

    case TUSB_INT_SRC:
    case TUSB_INT_SRC_SET:	/* TODO: What do these two return?  */
    case TUSB_INT_SRC_CLEAR:
        return s->intr;
    case TUSB_INT_MASK:
        return s->mask;

    case TUSB_GPIO_REV:
        return 0x30;
    case TUSB_GPIO_CONF:
        return s->gpio_config;

    case TUSB_DMA_CTRL_REV:
        return 0x30;
    case TUSB_DMA_REQ_CONF:
        return s->dma_config;
    case TUSB_EP0_CONF:
        return s->ep0_config;
    case TUSB_EP_IN_SIZE ... (TUSB_EP_IN_SIZE + 0x3b):
        epnum = (offset - TUSB_EP_IN_SIZE) >> 2;
        return s->tx_config[epnum];
    case TUSB_DMA_EP_MAP:
        return s->dma_map;
    case TUSB_EP_OUT_SIZE ... (TUSB_EP_OUT_SIZE + 0x3b):
        epnum = (offset - TUSB_EP_OUT_SIZE) >> 2;
        return s->rx_config[epnum];
    case TUSB_EP_MAX_PACKET_SIZE_OFFSET ...
            (TUSB_EP_MAX_PACKET_SIZE_OFFSET + 0x3b):
        epnum = (offset - TUSB_EP_MAX_PACKET_SIZE_OFFSET) >> 2;
        return 0x00000000;	/* TODO */
    case TUSB_WAIT_COUNT:
        return 0x00;		/* TODO */

    case TUSB_SCRATCH_PAD:
        return s->scratch;

    case TUSB_PROD_TEST_RESET:
        return s->test_reset;

    /* DIE IDs */
    case TUSB_DIDR1_LO:
        return 0xa9453c59;
    case TUSB_DIDR1_HI:
        return 0x54059adf;
    }

    printf("%s: unknown register at %03x\n", __FUNCTION__, offset);
    return 0;
}

static void tusb_async_writeb(void *opaque, target_phys_addr_t addr,
                uint32_t value)
{
    TUSBState *s = (TUSBState *) opaque;

    switch (addr & 0xfff) {
    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        musb_write[0](s->musb, addr & 0x1ff, value);
        break;

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        musb_write[0](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
        break;

    default:
        printf("%s: unknown register at %03x\n",
                        __FUNCTION__, (int) (addr & 0xfff));
        return;
    }
}

static void tusb_async_writeh(void *opaque, target_phys_addr_t addr,
                uint32_t value)
{
    TUSBState *s = (TUSBState *) opaque;

    switch (addr & 0xfff) {
    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        musb_write[1](s->musb, addr & 0x1ff, value);
        break;

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        musb_write[1](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
        break;

    default:
        printf("%s: unknown register at %03x\n",
                        __FUNCTION__, (int) (addr & 0xfff));
        return;
    }
}

static void tusb_async_writew(void *opaque, target_phys_addr_t addr,
                uint32_t value)
{
    TUSBState *s = (TUSBState *) opaque;
    int offset = addr & 0xfff;
    int epnum;

    switch (offset) {
    case TUSB_VLYNQ_CTRL:
        break;

    case TUSB_BASE_OFFSET ... (TUSB_BASE_OFFSET | 0x1ff):
        musb_write[2](s->musb, offset & 0x1ff, value);
        break;

    case TUSB_FIFO_BASE ... (TUSB_FIFO_BASE | 0x1ff):
        musb_write[2](s->musb, 0x20 + ((addr >> 3) & 0x3c), value);
        break;

    case TUSB_DEV_CONF:
        s->dev_config = value;
        s->host_mode = (value & TUSB_DEV_CONF_USB_HOST_MODE);
        if (value & TUSB_DEV_CONF_PROD_TEST_MODE)
            hw_error("%s: Product Test mode not allowed\n", __FUNCTION__);
        break;

    case TUSB_PHY_OTG_CTRL_ENABLE:
    case TUSB_PHY_OTG_CTRL:
        return;		/* TODO */
    case TUSB_DEV_OTG_TIMER:
        s->otg_timer_val = value;
        if (value & TUSB_DEV_OTG_TIMER_ENABLE)
            qemu_mod_timer(s->otg_timer, qemu_get_clock(vm_clock) +
                            muldiv64(TUSB_DEV_OTG_TIMER_VAL(value),
                                    ticks_per_sec, TUSB_DEVCLOCK));
        else
            qemu_del_timer(s->otg_timer);
        break;

    case TUSB_PRCM_CONF:
        s->prcm_config = value;
        break;
    case TUSB_PRCM_MNGMT:
        s->prcm_mngmt = value;
        break;
    case TUSB_PRCM_WAKEUP_CLEAR:
        break;
    case TUSB_PRCM_WAKEUP_MASK:
        s->wkup_mask = value;
        break;

    case TUSB_PULLUP_1_CTRL:
        s->pullup[0] = value;
        break;
    case TUSB_PULLUP_2_CTRL:
        s->pullup[1] = value;
        break;
    case TUSB_INT_CTRL_CONF:
        s->control_config = value;
        tusb_intr_update(s);
        break;

    case TUSB_USBIP_INT_SET:
        s->usbip_intr |= value;
        tusb_usbip_intr_update(s);
        break;
    case TUSB_USBIP_INT_CLEAR:
        s->usbip_intr &= ~value;
        tusb_usbip_intr_update(s);
        musb_core_intr_clear(s->musb, ~value);
        break;
    case TUSB_USBIP_INT_MASK:
        s->usbip_mask = value;
        tusb_usbip_intr_update(s);
        break;

    case TUSB_DMA_INT_SET:
        s->dma_intr |= value;
        tusb_dma_intr_update(s);
        break;
    case TUSB_DMA_INT_CLEAR:
        s->dma_intr &= ~value;
        tusb_dma_intr_update(s);
        break;
    case TUSB_DMA_INT_MASK:
        s->dma_mask = value;
        tusb_dma_intr_update(s);
        break;

    case TUSB_GPIO_INT_SET:
        s->gpio_intr |= value;
        tusb_gpio_intr_update(s);
        break;
    case TUSB_GPIO_INT_CLEAR:
        s->gpio_intr &= ~value;
        tusb_gpio_intr_update(s);
        break;
    case TUSB_GPIO_INT_MASK:
        s->gpio_mask = value;
        tusb_gpio_intr_update(s);
        break;

    case TUSB_INT_SRC_SET:
        s->intr |= value;
        tusb_intr_update(s);
        break;
    case TUSB_INT_SRC_CLEAR:
        s->intr &= ~value;
        tusb_intr_update(s);
        break;
    case TUSB_INT_MASK:
        s->mask = value;
        tusb_intr_update(s);
        break;

    case TUSB_GPIO_CONF:
        s->gpio_config = value;
        break;
    case TUSB_DMA_REQ_CONF:
        s->dma_config = value;
        break;
    case TUSB_EP0_CONF:
        s->ep0_config = value & 0x1ff;
        musb_set_size(s->musb, 0, TUSB_EP0_CONFIG_XFR_SIZE(value),
                        value & TUSB_EP0_CONFIG_DIR_TX);
        break;
    case TUSB_EP_IN_SIZE ... (TUSB_EP_IN_SIZE + 0x3b):
        epnum = (offset - TUSB_EP_IN_SIZE) >> 2;
        s->tx_config[epnum] = value;
        musb_set_size(s->musb, epnum + 1, TUSB_EP_CONFIG_XFR_SIZE(value), 1);
        break;
    case TUSB_DMA_EP_MAP:
        s->dma_map = value;
        break;
    case TUSB_EP_OUT_SIZE ... (TUSB_EP_OUT_SIZE + 0x3b):
        epnum = (offset - TUSB_EP_OUT_SIZE) >> 2;
        s->rx_config[epnum] = value;
        musb_set_size(s->musb, epnum + 1, TUSB_EP_CONFIG_XFR_SIZE(value), 0);
        break;
    case TUSB_EP_MAX_PACKET_SIZE_OFFSET ...
            (TUSB_EP_MAX_PACKET_SIZE_OFFSET + 0x3b):
        epnum = (offset - TUSB_EP_MAX_PACKET_SIZE_OFFSET) >> 2;
        return;		/* TODO */
    case TUSB_WAIT_COUNT:
        return;		/* TODO */

    case TUSB_SCRATCH_PAD:
        s->scratch = value;
        break;

    case TUSB_PROD_TEST_RESET:
        s->test_reset = value;
        break;

    default:
        printf("%s: unknown register at %03x\n", __FUNCTION__, offset);
        return;
    }
}

static CPUReadMemoryFunc *tusb_async_readfn[] = {
    tusb_async_readb,
    tusb_async_readh,
    tusb_async_readw,
};

static CPUWriteMemoryFunc *tusb_async_writefn[] = {
    tusb_async_writeb,
    tusb_async_writeh,
    tusb_async_writew,
};

static void tusb_otg_tick(void *opaque)
{
    TUSBState *s = (TUSBState *) opaque;

    s->otg_timer_val = 0;
    s->intr |= TUSB_INT_SRC_OTG_TIMEOUT;
    tusb_intr_update(s);
}

static void tusb_power_tick(void *opaque)
{
    TUSBState *s = (TUSBState *) opaque;

    if (s->power) {
        s->intr_ok = ~0;
        tusb_intr_update(s);
    }
}

static void tusb_musb_core_intr(void *opaque, int source, int level)
{
    TUSBState *s = (TUSBState *) opaque;
    uint16_t otg_status = s->otg_status;

    switch (source) {
    case musb_set_vbus:
        if (level)
            otg_status |= TUSB_DEV_OTG_STAT_VBUS_VALID;
        else
            otg_status &= ~TUSB_DEV_OTG_STAT_VBUS_VALID;

        /* XXX: only if TUSB_PHY_OTG_CTRL_OTG_VBUS_DET_EN set?  */
        /* XXX: only if TUSB_PRCM_MNGMT_OTG_VBUS_DET_EN set?  */
        if (s->otg_status != otg_status) {
            s->otg_status = otg_status;
            s->intr |= TUSB_INT_SRC_VBUS_SENSE_CHNG;
            tusb_intr_update(s);
        }
        break;

    case musb_set_session:
        /* XXX: only if TUSB_PHY_OTG_CTRL_OTG_SESS_END_EN set?  */
        /* XXX: only if TUSB_PRCM_MNGMT_OTG_SESS_END_EN set?  */
        if (level) {
            s->otg_status |= TUSB_DEV_OTG_STAT_SESS_VALID;
            s->otg_status &= ~TUSB_DEV_OTG_STAT_SESS_END;
        } else {
            s->otg_status &= ~TUSB_DEV_OTG_STAT_SESS_VALID;
            s->otg_status |= TUSB_DEV_OTG_STAT_SESS_END;
        }

        /* XXX: some IRQ or anything?  */
        break;

    case musb_irq_tx:
    case musb_irq_rx:
        s->usbip_intr = musb_core_intr_get(s->musb);
        /* Fall through.  */
    default:
        if (level)
            s->intr |= 1 << source;
        else
            s->intr &= ~(1 << source);
        tusb_intr_update(s);
        break;
    }
}

TUSBState *tusb6010_init(qemu_irq intr)
{
    TUSBState *s = qemu_mallocz(sizeof(*s));

    s->test_reset = TUSB_PROD_TEST_RESET_VAL;
    s->host_mode = 0;
    s->dev_config = 0;
    s->otg_status = 0;	/* !TUSB_DEV_OTG_STAT_ID_STATUS means host mode */
    s->power = 0;
    s->mask = 0xffffffff;
    s->intr = 0x00000000;
    s->otg_timer_val = 0;
    s->iomemtype[1] = cpu_register_io_memory(tusb_async_readfn,
                    tusb_async_writefn, s);
    s->irq = intr;
    s->otg_timer = qemu_new_timer(vm_clock, tusb_otg_tick, s);
    s->pwr_timer = qemu_new_timer(vm_clock, tusb_power_tick, s);
    s->musb = musb_init(qemu_allocate_irqs(tusb_musb_core_intr, s,
                            __musb_irq_max));

    return s;
}

void tusb6010_power(TUSBState *s, int on)
{
    if (!on)
        s->power = 0;
    else if (!s->power && on) {
        s->power = 1;

        /* Pull the interrupt down after TUSB6010 comes up.  */
        s->intr_ok = 0;
        tusb_intr_update(s);
        qemu_mod_timer(s->pwr_timer,
                        qemu_get_clock(vm_clock) + ticks_per_sec / 2);
    }
}