================================================================
USB transport — the DWC3 controller behind every off-device path
================================================================

Every way of talking to this device from a host over the USB-C port — EDL /
Sahara + Firehose, fastboot, ADB/MTP, the EUD debugger, and OTG host — uses a
**single** USB controller: the Synopsys DWC3 in its Qualcomm wrapper. This page
documents that controller and its PHYs as hardware, and how one dual-role port is
shared across the boot modes. The mode-*entry* logic and the EUD/charger specifics
already live elsewhere and are cross-referenced, not repeated:
:doc:`/edl/entry` (EUD, DDI, charger→EDL), :doc:`/edl/firehose`,
:doc:`/abl/fastboot`, :doc:`/soc/pmic` (SMB5 charger / Type-C).

Controller
==========

``ssusb@a600000`` — ``qcom,dwc-usb3-msm`` (the Qualcomm wrapper), ``core_base``
**``0xa600000``** size ``0x200000``, wrapping the IP core:

``dwc3@a600000`` — ``snps,dwc3``, reg ``0xa600000`` size ``0xe000``, IRQ ``0x85``.

Key properties:

- **``dr_mode = "drd"``** — dual-role: the same port acts as USB **device
  (gadget)** for EDL/fastboot/ADB or as **host** for OTG, chosen at runtime from
  Type-C role detection (below).
- **``maximum-speed = "super-speed"``** (USB 3, with ``usb3-u1u2-disable`` and the
  DWC3 LPM erratum quirks set).
- **Power/isolation:** ``USB3_GDSC`` power domain; DMA goes through the apps-SMMU
  stream ``<0x17 0x540>`` (:doc:`/boot/base-dtb`); ``qcom,iommu-dma = "atomic"``.
- **Wake-up:** ``qcom,use-pdc-interrupts`` with ``dp_hs_phy_irq`` /
  ``dm_hs_phy_irq`` / ``ss_phy_irq`` / ``pwr_event_irq`` — the PHY wake lines are
  routed through the **PDC**, i.e. armed by the AOP for wake-from-suspend
  (:doc:`/soc/aop`).
- **Accelerated pipes:** ``qcom,usbbam@a704000`` (``qcom,usb-bam-msm``, USB BAM),
  FIFO base ``0x146a6000`` (in the on-chip IMEM band, :doc:`/boot/base-dtb`).
- Clocks from GCC (``core``/``iface``/``bus_aggr``/``utmi``/``sleep``) plus the XO;
  ``core-clk-rate`` ``0x7f28155`` (≈133 MHz).

PHYs
====

Two PHYs sit under the controller — one per USB speed, the SuperSpeed one shared
with DisplayPort:

.. list-table::
   :header-rows: 1
   :widths: 22 20 58

   * - PHY
     - Base
     - Notes
   * - ``qusb@88e3000`` (``qcom,qusb2phy-v2``)
     - ``0x88e3000``
     - **High-Speed** (USB2, UTMI). Register tuning ``qusb-phy-init-seq``; PHY
       trim ``efuse_addr = 0x780268`` (3 bits @ pos 0x19). Also exposes
       ``eud_enable_reg`` at ``0x88e2000`` — the hook the **EUD** debugger uses to
       take over the D+/D- lines (:doc:`/edl/entry`).
   * - ``ssphy@88e8000`` (``qcom,usb-ssphy-qmp-dp-combo``)
     - ``0x88e8000``
     - **SuperSpeed** QMP PHY, **combined with DisplayPort** — the SS lanes carry
       USB3 or DP alt-mode over the Type-C connector.

The HS PHY is what a host sees first (USB2 enumeration is what EDL/Sahara,
fastboot and charger APSD all use); the SS PHY only comes up for USB3/DP.

Role and attach detection
=========================

Because the controller is ``drd``, something must tell it device-vs-host and when
a cable is present. That comes from the PMIC over an ``extcon`` link:

- ``qcom,typec@1500`` — Type-C CC / role detection (``typec-cc-state-change``,
  ``typec-attach-detach``, ``typec-try-snk-src-detect`` …). Determines gadget vs.
  host and orientation.
- ``qcom,usb@1300`` + the ``qcom,qpnp-smb5`` charger — USB-in presence and
  charger APSD on D+/D- (``usbin-plugin``, ``usbin-src-change``); ``dpdm-supply``
  ties the charger's D+/D- sensing to the HS PHY. This is the same block that
  drives charger-type detection at boot (:doc:`/soc/pmic`,
  :doc:`/boot/keys`, :doc:`/edl/entry`).

One controller, many boot roles
===============================

The same DWC3 gadget is re-used by each stage; only the *software* on top differs:

.. list-table::
   :header-rows: 1
   :widths: 26 20 54

   * - Role
     - Owner / stage
     - Reference
   * - EDL — Sahara + Firehose
     - PBL / XBL (9008 gadget)
     - :doc:`/edl/entry`, :doc:`/edl/firehose`
   * - fastboot
     - ABL (gadget)
     - :doc:`/abl/fastboot`
   * - ADB / MTP
     - kernel + userspace gadget
     - (userspace; out of scope)
   * - EUD (T32 debug)
     - XBL/DXE + ``msm-eud@88e0000``
     - :doc:`/edl/entry`
   * - OTG host
     - kernel host stack
     - ``dr_mode = "drd"`` above

So a bootloader replacement that needs a host link (its own fastboot-like
loader, or to be flashed) inherits exactly this hardware: bring up the QUSB2 HS
PHY, drive the DWC3 core as a gadget, and rely on the Type-C/charger block for
attach — the PHYs are already trained by XBL at hand-off (:doc:`/boot/below-uefi`),
and EDL remains the PBL-level fallback independent of all of it.

Provenance
==========

:Source: ``artifacts/boot_a/board.dts`` — ``ssusb@a600000`` / ``dwc3@a600000`` /
   ``qcom,usbbam@a704000`` (controller, ``dr_mode``, speed, SMMU/GDSC/PDC, BAM),
   ``qusb@88e3000`` and ``ssphy@88e8000`` (PHYs, EUD-enable and efuse regs), and
   the PMIC ``usb@1300`` / ``typec@1500`` nodes.
:Method: Device-tree node reading; addresses/IRQs/register-names quoted directly.
   No code executed.
:Cross-refs: :doc:`/edl/entry` (EUD/DDI/charger→EDL), :doc:`/edl/firehose`
   (Sahara/Firehose over this gadget), :doc:`/abl/fastboot` (fastboot gadget),
   :doc:`/soc/pmic` (SMB5 charger / Type-C), :doc:`/boot/base-dtb` (apps-SMMU),
   :doc:`/boot/below-uefi` (PHY state at hand-off), :doc:`/soc/aop` (PDC USB wake).