1 /*

     2  * "Inventra" High-speed Dual-Role Controller (MUSB-HDRC), Mentor Graphics,

     3  * USB2.0 OTG compliant core used in various chips.

     4  *

     5  * Copyright (C) 2008 Nokia Corporation

     6  * Written by Andrzej Zaborowski <andrew@openedhand.com>

     7  *

     8  * This program is free software; you can redistribute it and/or

     9  * modify it under the terms of the GNU General Public License as

    10  * published by the Free Software Foundation; either version 2 or

    11  * (at your option) version 3 of the License.

    12  *

    13  * This program is distributed in the hope that it will be useful,

    14  * but WITHOUT ANY WARRANTY; without even the implied warranty of

    15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

    16  * GNU General Public License for more details.

    17  *

    18  * You should have received a copy of the GNU General Public License

    19  * along with this program; if not, write to the Free Software

    20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,

    21  * MA 02111-1307 USA

    22  *

    23  * Only host-mode and non-DMA accesses are currently supported.

    24  */

    25 #include "qemu-common.h"

    26 #include "qemu-timer.h"

    27 #include "usb.h"

    28 #include "irq.h"

    29 

    30 /* Common USB registers */

    31 #define MUSB_HDRC_FADDR		0x00	/* 8-bit */

    32 #define MUSB_HDRC_POWER		0x01	/* 8-bit */

    33 

    34 #define MUSB_HDRC_INTRTX	0x02	/* 16-bit */

    35 #define MUSB_HDRC_INTRRX	0x04

    36 #define MUSB_HDRC_INTRTXE	0x06  

    37 #define MUSB_HDRC_INTRRXE	0x08  

    38 #define MUSB_HDRC_INTRUSB	0x0a	/* 8 bit */

    39 #define MUSB_HDRC_INTRUSBE	0x0b	/* 8 bit */

    40 #define MUSB_HDRC_FRAME		0x0c	/* 16-bit */

    41 #define MUSB_HDRC_INDEX		0x0e	/* 8 bit */

    42 #define MUSB_HDRC_TESTMODE	0x0f	/* 8 bit */

    43 

    44 /* Per-EP registers in indexed mode */

    45 #define MUSB_HDRC_EP_IDX	0x10	/* 8-bit */

    46 

    47 /* EP FIFOs */

    48 #define MUSB_HDRC_FIFO		0x20

    49 

    50 /* Additional Control Registers */

    51 #define	MUSB_HDRC_DEVCTL	0x60	/* 8 bit */

    52 

    53 /* These are indexed */

    54 #define MUSB_HDRC_TXFIFOSZ	0x62	/* 8 bit (see masks) */

    55 #define MUSB_HDRC_RXFIFOSZ	0x63	/* 8 bit (see masks) */

    56 #define MUSB_HDRC_TXFIFOADDR	0x64	/* 16 bit offset shifted right 3 */

    57 #define MUSB_HDRC_RXFIFOADDR	0x66	/* 16 bit offset shifted right 3 */

    58 

    59 /* Some more registers */

    60 #define MUSB_HDRC_VCTRL		0x68	/* 8 bit */

    61 #define MUSB_HDRC_HWVERS	0x6c	/* 8 bit */

    62 

    63 /* Added in HDRC 1.9(?) & MHDRC 1.4 */

    64 /* ULPI pass-through */

    65 #define MUSB_HDRC_ULPI_VBUSCTL	0x70

    66 #define MUSB_HDRC_ULPI_REGDATA	0x74

    67 #define MUSB_HDRC_ULPI_REGADDR	0x75

    68 #define MUSB_HDRC_ULPI_REGCTL	0x76

    69 

    70 /* Extended config & PHY control */

    71 #define MUSB_HDRC_ENDCOUNT	0x78	/* 8 bit */

    72 #define MUSB_HDRC_DMARAMCFG	0x79	/* 8 bit */

    73 #define MUSB_HDRC_PHYWAIT	0x7a	/* 8 bit */

    74 #define MUSB_HDRC_PHYVPLEN	0x7b	/* 8 bit */

    75 #define MUSB_HDRC_HS_EOF1	0x7c	/* 8 bit, units of 546.1 us */

    76 #define MUSB_HDRC_FS_EOF1	0x7d	/* 8 bit, units of 533.3 ns */

    77 #define MUSB_HDRC_LS_EOF1	0x7e	/* 8 bit, units of 1.067 us */

    78 

    79 /* Per-EP BUSCTL registers */

    80 #define MUSB_HDRC_BUSCTL	0x80

    81 

    82 /* Per-EP registers in flat mode */

    83 #define MUSB_HDRC_EP		0x100

    84 

    85 /* offsets to registers in flat model */

    86 #define MUSB_HDRC_TXMAXP	0x00	/* 16 bit apparently */

    87 #define MUSB_HDRC_TXCSR		0x02	/* 16 bit apparently */

    88 #define MUSB_HDRC_CSR0		MUSB_HDRC_TXCSR		/* re-used for EP0 */

    89 #define MUSB_HDRC_RXMAXP	0x04	/* 16 bit apparently */

    90 #define MUSB_HDRC_RXCSR		0x06	/* 16 bit apparently */

    91 #define MUSB_HDRC_RXCOUNT	0x08	/* 16 bit apparently */

    92 #define MUSB_HDRC_COUNT0	MUSB_HDRC_RXCOUNT	/* re-used for EP0 */

    93 #define MUSB_HDRC_TXTYPE	0x0a	/* 8 bit apparently */

    94 #define MUSB_HDRC_TYPE0		MUSB_HDRC_TXTYPE	/* re-used for EP0 */

    95 #define MUSB_HDRC_TXINTERVAL	0x0b	/* 8 bit apparently */

    96 #define MUSB_HDRC_NAKLIMIT0	MUSB_HDRC_TXINTERVAL	/* re-used for EP0 */

    97 #define MUSB_HDRC_RXTYPE	0x0c	/* 8 bit apparently */

    98 #define MUSB_HDRC_RXINTERVAL	0x0d	/* 8 bit apparently */

    99 #define MUSB_HDRC_FIFOSIZE	0x0f	/* 8 bit apparently */

   100 #define MUSB_HDRC_CONFIGDATA	MGC_O_HDRC_FIFOSIZE	/* re-used for EP0 */

   101 

   102 /* "Bus control" registers */

   103 #define MUSB_HDRC_TXFUNCADDR	0x00

   104 #define MUSB_HDRC_TXHUBADDR	0x02

   105 #define MUSB_HDRC_TXHUBPORT	0x03

   106 

   107 #define MUSB_HDRC_RXFUNCADDR	0x04

   108 #define MUSB_HDRC_RXHUBADDR	0x06

   109 #define MUSB_HDRC_RXHUBPORT	0x07

   110 

   111 /*

   112  * MUSBHDRC Register bit masks

   113  */

   114 

   115 /* POWER */

   116 #define MGC_M_POWER_ISOUPDATE		0x80 

   117 #define	MGC_M_POWER_SOFTCONN		0x40

   118 #define	MGC_M_POWER_HSENAB		0x20

   119 #define	MGC_M_POWER_HSMODE		0x10

   120 #define MGC_M_POWER_RESET		0x08

   121 #define MGC_M_POWER_RESUME		0x04

   122 #define MGC_M_POWER_SUSPENDM		0x02

   123 #define MGC_M_POWER_ENSUSPEND		0x01

   124 

   125 /* INTRUSB */

   126 #define MGC_M_INTR_SUSPEND		0x01

   127 #define MGC_M_INTR_RESUME		0x02

   128 #define MGC_M_INTR_RESET		0x04

   129 #define MGC_M_INTR_BABBLE		0x04

   130 #define MGC_M_INTR_SOF			0x08 

   131 #define MGC_M_INTR_CONNECT		0x10

   132 #define MGC_M_INTR_DISCONNECT		0x20

   133 #define MGC_M_INTR_SESSREQ		0x40

   134 #define MGC_M_INTR_VBUSERROR		0x80	/* FOR SESSION END */

   135 #define MGC_M_INTR_EP0			0x01	/* FOR EP0 INTERRUPT */

   136 

   137 /* DEVCTL */

   138 #define MGC_M_DEVCTL_BDEVICE		0x80   

   139 #define MGC_M_DEVCTL_FSDEV		0x40

   140 #define MGC_M_DEVCTL_LSDEV		0x20

   141 #define MGC_M_DEVCTL_VBUS		0x18

   142 #define MGC_S_DEVCTL_VBUS		3

   143 #define MGC_M_DEVCTL_HM			0x04

   144 #define MGC_M_DEVCTL_HR			0x02

   145 #define MGC_M_DEVCTL_SESSION		0x01

   146 

   147 /* TESTMODE */

   148 #define MGC_M_TEST_FORCE_HOST		0x80

   149 #define MGC_M_TEST_FIFO_ACCESS		0x40

   150 #define MGC_M_TEST_FORCE_FS		0x20

   151 #define MGC_M_TEST_FORCE_HS		0x10

   152 #define MGC_M_TEST_PACKET		0x08

   153 #define MGC_M_TEST_K			0x04

   154 #define MGC_M_TEST_J			0x02

   155 #define MGC_M_TEST_SE0_NAK		0x01

   156 

   157 /* CSR0 */

   158 #define	MGC_M_CSR0_FLUSHFIFO		0x0100

   159 #define MGC_M_CSR0_TXPKTRDY		0x0002

   160 #define MGC_M_CSR0_RXPKTRDY		0x0001

   161 

   162 /* CSR0 in Peripheral mode */

   163 #define MGC_M_CSR0_P_SVDSETUPEND	0x0080

   164 #define MGC_M_CSR0_P_SVDRXPKTRDY	0x0040

   165 #define MGC_M_CSR0_P_SENDSTALL		0x0020

   166 #define MGC_M_CSR0_P_SETUPEND		0x0010

   167 #define MGC_M_CSR0_P_DATAEND		0x0008

   168 #define MGC_M_CSR0_P_SENTSTALL		0x0004

   169 

   170 /* CSR0 in Host mode */

   171 #define MGC_M_CSR0_H_NO_PING		0x0800

   172 #define MGC_M_CSR0_H_WR_DATATOGGLE	0x0400	/* set to allow setting: */

   173 #define MGC_M_CSR0_H_DATATOGGLE		0x0200	/* data toggle control */

   174 #define	MGC_M_CSR0_H_NAKTIMEOUT		0x0080

   175 #define MGC_M_CSR0_H_STATUSPKT		0x0040

   176 #define MGC_M_CSR0_H_REQPKT		0x0020

   177 #define MGC_M_CSR0_H_ERROR		0x0010

   178 #define MGC_M_CSR0_H_SETUPPKT		0x0008

   179 #define MGC_M_CSR0_H_RXSTALL		0x0004

   180 

   181 /* CONFIGDATA */

   182 #define MGC_M_CONFIGDATA_MPRXE		0x80	/* auto bulk pkt combining */

   183 #define MGC_M_CONFIGDATA_MPTXE		0x40	/* auto bulk pkt splitting */

   184 #define MGC_M_CONFIGDATA_BIGENDIAN	0x20

   185 #define MGC_M_CONFIGDATA_HBRXE		0x10	/* HB-ISO for RX */

   186 #define MGC_M_CONFIGDATA_HBTXE		0x08	/* HB-ISO for TX */

   187 #define MGC_M_CONFIGDATA_DYNFIFO	0x04	/* dynamic FIFO sizing */

   188 #define MGC_M_CONFIGDATA_SOFTCONE	0x02	/* SoftConnect */

   189 #define MGC_M_CONFIGDATA_UTMIDW		0x01	/* Width, 0 => 8b, 1 => 16b */

   190 

   191 /* TXCSR in Peripheral and Host mode */

   192 #define MGC_M_TXCSR_AUTOSET		0x8000

   193 #define MGC_M_TXCSR_ISO			0x4000

   194 #define MGC_M_TXCSR_MODE		0x2000

   195 #define MGC_M_TXCSR_DMAENAB		0x1000

   196 #define MGC_M_TXCSR_FRCDATATOG		0x0800

   197 #define MGC_M_TXCSR_DMAMODE		0x0400

   198 #define MGC_M_TXCSR_CLRDATATOG		0x0040

   199 #define MGC_M_TXCSR_FLUSHFIFO		0x0008

   200 #define MGC_M_TXCSR_FIFONOTEMPTY	0x0002

   201 #define MGC_M_TXCSR_TXPKTRDY		0x0001

   202 

   203 /* TXCSR in Peripheral mode */

   204 #define MGC_M_TXCSR_P_INCOMPTX		0x0080

   205 #define MGC_M_TXCSR_P_SENTSTALL		0x0020

   206 #define MGC_M_TXCSR_P_SENDSTALL		0x0010

   207 #define MGC_M_TXCSR_P_UNDERRUN		0x0004

   208 

   209 /* TXCSR in Host mode */

   210 #define MGC_M_TXCSR_H_WR_DATATOGGLE	0x0200

   211 #define MGC_M_TXCSR_H_DATATOGGLE	0x0100

   212 #define MGC_M_TXCSR_H_NAKTIMEOUT	0x0080

   213 #define MGC_M_TXCSR_H_RXSTALL		0x0020

   214 #define MGC_M_TXCSR_H_ERROR		0x0004

   215 

   216 /* RXCSR in Peripheral and Host mode */

   217 #define MGC_M_RXCSR_AUTOCLEAR		0x8000

   218 #define MGC_M_RXCSR_DMAENAB		0x2000

   219 #define MGC_M_RXCSR_DISNYET		0x1000

   220 #define MGC_M_RXCSR_DMAMODE		0x0800

   221 #define MGC_M_RXCSR_INCOMPRX		0x0100

   222 #define MGC_M_RXCSR_CLRDATATOG		0x0080

   223 #define MGC_M_RXCSR_FLUSHFIFO		0x0010

   224 #define MGC_M_RXCSR_DATAERROR		0x0008

   225 #define MGC_M_RXCSR_FIFOFULL		0x0002

   226 #define MGC_M_RXCSR_RXPKTRDY		0x0001

   227 

   228 /* RXCSR in Peripheral mode */

   229 #define MGC_M_RXCSR_P_ISO		0x4000

   230 #define MGC_M_RXCSR_P_SENTSTALL		0x0040

   231 #define MGC_M_RXCSR_P_SENDSTALL		0x0020

   232 #define MGC_M_RXCSR_P_OVERRUN		0x0004

   233 

   234 /* RXCSR in Host mode */

   235 #define MGC_M_RXCSR_H_AUTOREQ		0x4000

   236 #define MGC_M_RXCSR_H_WR_DATATOGGLE	0x0400

   237 #define MGC_M_RXCSR_H_DATATOGGLE	0x0200

   238 #define MGC_M_RXCSR_H_RXSTALL		0x0040

   239 #define MGC_M_RXCSR_H_REQPKT		0x0020

   240 #define MGC_M_RXCSR_H_ERROR		0x0004

   241 

   242 /* HUBADDR */

   243 #define MGC_M_HUBADDR_MULTI_TT		0x80

   244 

   245 /* ULPI: Added in HDRC 1.9(?) & MHDRC 1.4 */

   246 #define MGC_M_ULPI_VBCTL_USEEXTVBUSIND	0x02

   247 #define MGC_M_ULPI_VBCTL_USEEXTVBUS	0x01

   248 #define MGC_M_ULPI_REGCTL_INT_ENABLE	0x08

   249 #define MGC_M_ULPI_REGCTL_READNOTWRITE	0x04

   250 #define MGC_M_ULPI_REGCTL_COMPLETE	0x02

   251 #define MGC_M_ULPI_REGCTL_REG		0x01

   252 

   253 static void musb_attach(USBPort *port, USBDevice *dev);

   254 

   255 struct musb_s {

   256     qemu_irq *irqs;

   257     USBPort port;

   258 

   259     int idx;

   260     uint8_t devctl;

   261     uint8_t power;

   262     uint8_t faddr;

   263 

   264     uint8_t intr;

   265     uint8_t mask;

   266     uint16_t tx_intr;

   267     uint16_t tx_mask;

   268     uint16_t rx_intr;

   269     uint16_t rx_mask;

   270 

   271     int setup_len;

   272     int session;

   273 

   274     uint32_t buf[0x2000];

   275 

   276     struct musb_ep_s {

   277         uint16_t faddr[2];

   278         uint8_t haddr[2];

   279         uint8_t hport[2];

   280         uint16_t csr[2];

   281         uint16_t maxp[2];

   282         uint16_t rxcount;

   283         uint8_t type[2];

   284         uint8_t interval[2];

   285         uint8_t config;

   286         uint8_t fifosize;

   287         int timeout[2];	/* Always in microframes */

   288 

   289         uint32_t *buf[2];

   290         int fifolen[2];

   291         int fifostart[2];

   292         int fifoaddr[2];

   293         USBPacket packey[2];

   294         int status[2];

   295         int ext_size[2];

   296 

   297         /* For callbacks' use */

   298         int epnum;

   299         int interrupt[2];

   300         struct musb_s *musb;

   301         USBCallback *delayed_cb[2];

   302         QEMUTimer *intv_timer[2];

   303         /* Duplicating the world since 2008!...  probably we should have 32

   304          * logical, single endpoints instead.  */

   305     } ep[16];

   306 } *musb_init(qemu_irq *irqs)

   307 {

   308     struct musb_s *s = qemu_mallocz(sizeof(*s));

   309     int i;

   310 

   311     s->irqs = irqs;

   312 

   313     s->faddr = 0x00;

   314     s->power = MGC_M_POWER_HSENAB;

   315     s->tx_intr = 0x0000;

   316     s->rx_intr = 0x0000;

   317     s->tx_mask = 0xffff;

   318     s->rx_mask = 0xffff;

   319     s->intr = 0x00;

   320     s->mask = 0x06;

   321     s->idx = 0;

   322 

   323     /* TODO: _DW */

   324     s->ep[0].config = MGC_M_CONFIGDATA_SOFTCONE | MGC_M_CONFIGDATA_DYNFIFO;

   325     for (i = 0; i < 16; i ++) {

   326         s->ep[i].fifosize = 64;

   327         s->ep[i].maxp[0] = 0x40;

   328         s->ep[i].maxp[1] = 0x40;

   329         s->ep[i].musb = s;

   330         s->ep[i].epnum = i;

   331     }

   332 

   333     qemu_register_usb_port(&s->port, s, 0, musb_attach);

   334 

   335     return s;

   336 }

   337 

   338 static void musb_vbus_set(struct musb_s *s, int level)

   339 {

   340     if (level)

   341         s->devctl |= 3 << MGC_S_DEVCTL_VBUS;

   342     else

   343         s->devctl &= ~MGC_M_DEVCTL_VBUS;

   344 

   345     qemu_set_irq(s->irqs[musb_set_vbus], level);

   346 }

   347 

   348 static void musb_intr_set(struct musb_s *s, int line, int level)

   349 {

   350     if (!level) {

   351         s->intr &= ~(1 << line);

   352         qemu_irq_lower(s->irqs[line]);

   353     } else if (s->mask & (1 << line)) {

   354         s->intr |= 1 << line;

   355         qemu_irq_raise(s->irqs[line]);

   356     }

   357 }

   358 

   359 static void musb_tx_intr_set(struct musb_s *s, int line, int level)

   360 {

   361     if (!level) {

   362         s->tx_intr &= ~(1 << line);

   363         if (!s->tx_intr)

   364             qemu_irq_lower(s->irqs[musb_irq_tx]);

   365     } else if (s->tx_mask & (1 << line)) {

   366         s->tx_intr |= 1 << line;

   367         qemu_irq_raise(s->irqs[musb_irq_tx]);

   368     }

   369 }

   370 

   371 static void musb_rx_intr_set(struct musb_s *s, int line, int level)

   372 {

   373     if (line) {

   374         if (!level) {

   375             s->rx_intr &= ~(1 << line);

   376             if (!s->rx_intr)

   377                 qemu_irq_lower(s->irqs[musb_irq_rx]);

   378         } else if (s->rx_mask & (1 << line)) {

   379             s->rx_intr |= 1 << line;

   380             qemu_irq_raise(s->irqs[musb_irq_rx]);

   381         }

   382     } else

   383         musb_tx_intr_set(s, line, level);

   384 }

   385 

   386 uint32_t musb_core_intr_get(struct musb_s *s)

   387 {

   388     return (s->rx_intr << 15) | s->tx_intr;

   389 }

   390 

   391 void musb_core_intr_clear(struct musb_s *s, uint32_t mask)

   392 {

   393     if (s->rx_intr) {

   394         s->rx_intr &= mask >> 15;

   395         if (!s->rx_intr)

   396             qemu_irq_lower(s->irqs[musb_irq_rx]);

   397     }

   398 

   399     if (s->tx_intr) {

   400         s->tx_intr &= mask & 0xffff;

   401         if (!s->tx_intr)

   402             qemu_irq_lower(s->irqs[musb_irq_tx]);

   403     }

   404 }

   405 

   406 void musb_set_size(struct musb_s *s, int epnum, int size, int is_tx)

   407 {

   408     s->ep[epnum].ext_size[!is_tx] = size;

   409     s->ep[epnum].fifostart[0] = 0;

   410     s->ep[epnum].fifostart[1] = 0;

   411     s->ep[epnum].fifolen[0] = 0;

   412     s->ep[epnum].fifolen[1] = 0;

   413 }

   414 

   415 static void musb_session_update(struct musb_s *s, int prev_dev, int prev_sess)

   416 {

   417     int detect_prev = prev_dev && prev_sess;

   418     int detect = !!s->port.dev && s->session;

   419 

   420     if (detect && !detect_prev) {

   421         /* Let's skip the ID pin sense and VBUS sense formalities and

   422          * and signal a successful SRP directly.  This should work at least

   423          * for the Linux driver stack.  */

   424         musb_intr_set(s, musb_irq_connect, 1);

   425 

   426         if (s->port.dev->speed == USB_SPEED_LOW) {

   427             s->devctl &= ~MGC_M_DEVCTL_FSDEV;

   428             s->devctl |= MGC_M_DEVCTL_LSDEV;

   429         } else {

   430             s->devctl |= MGC_M_DEVCTL_FSDEV;

   431             s->devctl &= ~MGC_M_DEVCTL_LSDEV;

   432         }

   433 

   434         /* A-mode?  */

   435         s->devctl &= ~MGC_M_DEVCTL_BDEVICE;

   436 

   437         /* Host-mode bit?  */

   438         s->devctl |= MGC_M_DEVCTL_HM;

   439 #if 1

   440         musb_vbus_set(s, 1);

   441 #endif

   442     } else if (!detect && detect_prev) {

   443 #if 1

   444         musb_vbus_set(s, 0);

   445 #endif

   446     }

   447 }

   448 

   449 /* Attach or detach a device on our only port.  */

   450 static void musb_attach(USBPort *port, USBDevice *dev)

   451 {

   452     struct musb_s *s = (struct musb_s *) port->opaque;

   453     USBDevice *curr;

   454 

   455     port = &s->port;

   456     curr = port->dev;

   457 

   458     if (dev) {

   459         if (curr) {

   460             usb_attach(port, NULL);

   461             /* TODO: signal some interrupts */

   462         }

   463 

   464         musb_intr_set(s, musb_irq_vbus_request, 1);

   465 

   466         /* Send the attach message to device */

   467         usb_send_msg(dev, USB_MSG_ATTACH);

   468     } else if (curr) {

   469         /* Send the detach message */

   470         usb_send_msg(curr, USB_MSG_DETACH);

   471 

   472         musb_intr_set(s, musb_irq_disconnect, 1);

   473     }

   474 

   475     port->dev = dev;

   476 

   477     musb_session_update(s, !!curr, s->session);

   478 }

   479 

   480 static inline void musb_cb_tick0(void *opaque)

   481 {

   482     struct musb_ep_s *ep = (struct musb_ep_s *) opaque;

   483 

   484     ep->delayed_cb[0](&ep->packey[0], opaque);

   485 }

   486 

   487 static inline void musb_cb_tick1(void *opaque)

   488 {

   489     struct musb_ep_s *ep = (struct musb_ep_s *) opaque;

   490 

   491     ep->delayed_cb[1](&ep->packey[1], opaque);

   492 }

   493 

   494 #define musb_cb_tick	(dir ? musb_cb_tick1 : musb_cb_tick0)

   495 

   496 static inline void musb_schedule_cb(USBPacket *packey, void *opaque, int dir)

   497 {

   498     struct musb_ep_s *ep = (struct musb_ep_s *) opaque;

   499     int timeout = 0;

   500 

   501     if (ep->status[dir] == USB_RET_NAK)

   502         timeout = ep->timeout[dir];

   503     else if (ep->interrupt[dir])

   504         timeout = 8;

   505     else

   506         return musb_cb_tick(opaque);

   507 

   508     if (!ep->intv_timer[dir])

   509         ep->intv_timer[dir] = qemu_new_timer(vm_clock, musb_cb_tick, opaque);

   510 

   511     qemu_mod_timer(ep->intv_timer[dir], qemu_get_clock(vm_clock) +

   512                     muldiv64(timeout, ticks_per_sec, 8000));

   513 }

   514 

   515 static void musb_schedule0_cb(USBPacket *packey, void *opaque)

   516 {

   517     return musb_schedule_cb(packey, opaque, 0);

   518 }

   519 

   520 static void musb_schedule1_cb(USBPacket *packey, void *opaque)

   521 {

   522     return musb_schedule_cb(packey, opaque, 1);

   523 }

   524 

   525 static int musb_timeout(int ttype, int speed, int val)

   526 {

   527 #if 1

   528     return val << 3;

   529 #endif

   530 

   531     switch (ttype) {

   532     case USB_ENDPOINT_XFER_CONTROL:

   533         if (val < 2)

   534             return 0;

   535         else if (speed == USB_SPEED_HIGH)

   536             return 1 << (val - 1);

   537         else

   538             return 8 << (val - 1);

   539 

   540     case USB_ENDPOINT_XFER_INT:

   541         if (speed == USB_SPEED_HIGH)

   542             if (val < 2)

   543                 return 0;

   544             else

   545                 return 1 << (val - 1);

   546         else

   547             return val << 3;

   548 

   549     case USB_ENDPOINT_XFER_BULK:

   550     case USB_ENDPOINT_XFER_ISOC:

   551         if (val < 2)

   552             return 0;

   553         else if (speed == USB_SPEED_HIGH)

   554             return 1 << (val - 1);

   555         else

   556             return 8 << (val - 1);

   557         /* TODO: what with low-speed Bulk and Isochronous?  */

   558     }

   559 

   560     cpu_abort(cpu_single_env, "bad interval\n");

   561 }

   562 

   563 static inline void musb_packet(struct musb_s *s, struct musb_ep_s *ep,

   564                 int epnum, int pid, int len, USBCallback cb, int dir)

   565 {

   566     int ret;

   567     int idx = epnum && dir;

   568     int ttype;

   569 

   570     /* ep->type[0,1] contains:

   571      * in bits 7:6 the speed (0 - invalid, 1 - high, 2 - full, 3 - slow)

   572      * in bits 5:4 the transfer type (BULK / INT)

   573      * in bits 3:0 the EP num

   574      */

   575     ttype = epnum ? (ep->type[idx] >> 4) & 3 : 0;

   576 

   577     ep->timeout[dir] = musb_timeout(ttype,

   578                     ep->type[idx] >> 6, ep->interval[idx]);

   579     ep->interrupt[dir] = ttype == USB_ENDPOINT_XFER_INT;

   580     ep->delayed_cb[dir] = cb;

   581     cb = dir ? musb_schedule1_cb : musb_schedule0_cb;

   582 

   583     ep->packey[dir].pid = pid;

   584     /* A wild guess on the FADDR semantics... */

   585     ep->packey[dir].devaddr = ep->faddr[idx];

   586     ep->packey[dir].devep = ep->type[idx] & 0xf;

   587     ep->packey[dir].data = (void *) ep->buf[idx];

   588     ep->packey[dir].len = len;

   589     ep->packey[dir].complete_cb = cb;

   590     ep->packey[dir].complete_opaque = ep;

   591 

   592     if (s->port.dev)

   593         ret = s->port.dev->handle_packet(s->port.dev, &ep->packey[dir]);

   594     else

   595         ret = USB_RET_NODEV;

   596 

   597     if (ret == USB_RET_ASYNC) {

   598         ep->status[dir] = len;

   599         return;

   600     }

   601 

   602     ep->status[dir] = ret;

   603     usb_packet_complete(&ep->packey[dir]);

   604 }

   605 

   606 static void musb_tx_packet_complete(USBPacket *packey, void *opaque)

   607 {

   608     /* Unfortunately we can't use packey->devep because that's the remote

   609      * endpoint number and may be different than our local.  */

   610     struct musb_ep_s *ep = (struct musb_ep_s *) opaque;

   611     int epnum = ep->epnum;

   612     struct musb_s *s = ep->musb;

   613 

   614     ep->fifostart[0] = 0;

   615     ep->fifolen[0] = 0;

   616 #ifdef CLEAR_NAK

   617     if (ep->status[0] != USB_RET_NAK) {

   618 #endif

   619         if (epnum)

   620             ep->csr[0] &= ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY);

   621         else

   622             ep->csr[0] &= ~MGC_M_CSR0_TXPKTRDY;

   623 #ifdef CLEAR_NAK

   624     }

   625 #endif

   626 

   627     /* Clear all of the error bits first */

   628     if (epnum)

   629         ep->csr[0] &= ~(MGC_M_TXCSR_H_ERROR | MGC_M_TXCSR_H_RXSTALL |

   630                         MGC_M_TXCSR_H_NAKTIMEOUT);

   631     else

   632         ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |

   633                         MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);

   634 

   635     if (ep->status[0] == USB_RET_STALL) {

   636         /* Command not supported by target! */

   637         ep->status[0] = 0;

   638 

   639         if (epnum)

   640             ep->csr[0] |= MGC_M_TXCSR_H_RXSTALL;

   641         else

   642             ep->csr[0] |= MGC_M_CSR0_H_RXSTALL;

   643     }

   644 

   645     if (ep->status[0] == USB_RET_NAK) {

   646         ep->status[0] = 0;

   647 

   648         /* NAK timeouts are only generated in Bulk transfers and

   649          * Data-errors in Isochronous.  */

   650         if (ep->interrupt[0]) {

   651             return;

   652         }

   653 

   654         if (epnum)

   655             ep->csr[0] |= MGC_M_TXCSR_H_NAKTIMEOUT;

   656         else

   657             ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT;

   658     }

   659 

   660     if (ep->status[0] < 0) {

   661         if (ep->status[0] == USB_RET_BABBLE)

   662             musb_intr_set(s, musb_irq_rst_babble, 1);

   663 

   664         /* Pretend we've tried three times already and failed (in

   665          * case of USB_TOKEN_SETUP).  */

   666         if (epnum)

   667             ep->csr[0] |= MGC_M_TXCSR_H_ERROR;

   668         else

   669             ep->csr[0] |= MGC_M_CSR0_H_ERROR;

   670 

   671         musb_tx_intr_set(s, epnum, 1);

   672         return;

   673     }

   674     /* TODO: check len for over/underruns of an OUT packet?  */

   675 

   676 #ifdef SETUPLEN_HACK

   677     if (!epnum && ep->packey[0].pid == USB_TOKEN_SETUP)

   678         s->setup_len = ep->packey[0].data[6];

   679 #endif

   680 

   681     /* In DMA mode: if no error, assert DMA request for this EP,

   682      * and skip the interrupt.  */

   683     musb_tx_intr_set(s, epnum, 1);

   684 }

   685 

   686 static void musb_rx_packet_complete(USBPacket *packey, void *opaque)

   687 {

   688     /* Unfortunately we can't use packey->devep because that's the remote

   689      * endpoint number and may be different than our local.  */

   690     struct musb_ep_s *ep = (struct musb_ep_s *) opaque;

   691     int epnum = ep->epnum;

   692     struct musb_s *s = ep->musb;

   693 

   694     ep->fifostart[1] = 0;

   695     ep->fifolen[1] = 0;

   696 

   697 #ifdef CLEAR_NAK

   698     if (ep->status[1] != USB_RET_NAK) {

   699 #endif

   700         ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT;

   701         if (!epnum)

   702             ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT;

   703 #ifdef CLEAR_NAK

   704     }

   705 #endif

   706 

   707     /* Clear all of the imaginable error bits first */

   708     ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL |

   709                     MGC_M_RXCSR_DATAERROR);

   710     if (!epnum)

   711         ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |

   712                         MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);

   713 

   714     if (ep->status[1] == USB_RET_STALL) {

   715         ep->status[1] = 0;

   716         packey->len = 0;

   717 

   718         ep->csr[1] |= MGC_M_RXCSR_H_RXSTALL;

   719         if (!epnum)

   720             ep->csr[0] |= MGC_M_CSR0_H_RXSTALL;

   721     }

   722 

   723     if (ep->status[1] == USB_RET_NAK) {

   724         ep->status[1] = 0;

   725 

   726         /* NAK timeouts are only generated in Bulk transfers and

   727          * Data-errors in Isochronous.  */

   728         if (ep->interrupt[1])

   729             return musb_packet(s, ep, epnum, USB_TOKEN_IN,

   730                             packey->len, musb_rx_packet_complete, 1);

   731 

   732         ep->csr[1] |= MGC_M_RXCSR_DATAERROR;

   733         if (!epnum)

   734             ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT;

   735     }

   736 

   737     if (ep->status[1] < 0) {

   738         if (ep->status[1] == USB_RET_BABBLE) {

   739             musb_intr_set(s, musb_irq_rst_babble, 1);

   740             return;

   741         }

   742 

   743         /* Pretend we've tried three times already and failed (in

   744          * case of a control transfer).  */

   745         ep->csr[1] |= MGC_M_RXCSR_H_ERROR;

   746         if (!epnum)

   747             ep->csr[0] |= MGC_M_CSR0_H_ERROR;

   748 

   749         musb_rx_intr_set(s, epnum, 1);

   750         return;

   751     }

   752     /* TODO: check len for over/underruns of an OUT packet?  */

   753     /* TODO: perhaps make use of e->ext_size[1] here.  */

   754 

   755     packey->len = ep->status[1];

   756 

   757     if (!(ep->csr[1] & (MGC_M_RXCSR_H_RXSTALL | MGC_M_RXCSR_DATAERROR))) {

   758         ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY;

   759         if (!epnum)

   760             ep->csr[0] |= MGC_M_CSR0_RXPKTRDY;

   761 

   762         ep->rxcount = packey->len; /* XXX: MIN(packey->len, ep->maxp[1]); */

   763         /* In DMA mode: assert DMA request for this EP */

   764     }

   765 

   766     /* Only if DMA has not been asserted */

   767     musb_rx_intr_set(s, epnum, 1);

   768 }

   769 

   770 static void musb_tx_rdy(struct musb_s *s, int epnum)

   771 {

   772     struct musb_ep_s *ep = s->ep + epnum;

   773     int pid;

   774     int total, valid = 0;

   775 

   776     ep->fifostart[0] += ep->fifolen[0];

   777     ep->fifolen[0] = 0;

   778 

   779     /* XXX: how's the total size of the packet retrieved exactly in

   780      * the generic case?  */

   781     total = ep->maxp[0] & 0x3ff;

   782 

   783     if (ep->ext_size[0]) {

   784         total = ep->ext_size[0];

   785         ep->ext_size[0] = 0;

   786         valid = 1;

   787     }

   788 

   789     /* If the packet is not fully ready yet, wait for a next segment.  */

   790     if (epnum && (ep->fifostart[0] << 2) < total)

   791         return;

   792 

   793     if (!valid)

   794         total = ep->fifostart[0] << 2;

   795 

   796     pid = USB_TOKEN_OUT;

   797     if (!epnum && (ep->csr[0] & MGC_M_CSR0_H_SETUPPKT)) {

   798         pid = USB_TOKEN_SETUP;

   799         if (total != 8)

   800             printf("%s: illegal SETUPPKT length of %i bytes\n",

   801                             __FUNCTION__, total);

   802         /* Controller should retry SETUP packets three times on errors

   803          * but it doesn't make sense for us to do that.  */

   804     }

   805 

   806     return musb_packet(s, ep, epnum, pid,

   807                     total, musb_tx_packet_complete, 0);

   808 }

   809 

   810 static void musb_rx_req(struct musb_s *s, int epnum)

   811 {

   812     struct musb_ep_s *ep = s->ep + epnum;

   813     int total;

   814 

   815     /* If we already have a packet, which didn't fit into the

   816      * 64 bytes of the FIFO, only move the FIFO start and return. (Obsolete) */

   817     if (ep->packey[1].pid == USB_TOKEN_IN && ep->status[1] >= 0 &&

   818                     (ep->fifostart[1] << 2) + ep->rxcount <

   819                     ep->packey[1].len) {

   820         ep->fifostart[1] += ep->rxcount >> 2;

   821         ep->fifolen[1] = 0;

   822 

   823         ep->rxcount = MIN(ep->packey[0].len - (ep->fifostart[1] << 2),

   824                         ep->maxp[1]);

   825 

   826         ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT;

   827         if (!epnum)

   828             ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT;

   829 

   830         /* Clear all of the error bits first */

   831         ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL |

   832                         MGC_M_RXCSR_DATAERROR);

   833         if (!epnum)

   834             ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |

   835                             MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);

   836 

   837         ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY;

   838         if (!epnum)

   839             ep->csr[0] |= MGC_M_CSR0_RXPKTRDY;

   840         musb_rx_intr_set(s, epnum, 1);

   841         return;

   842     }

   843 

   844     /* The driver sets maxp[1] to 64 or less because it knows the hardware

   845      * FIFO is this deep.  Bigger packets get split in

   846      * usb_generic_handle_packet but we can also do the splitting locally

   847      * for performance.  It turns out we can also have a bigger FIFO and

   848      * ignore the limit set in ep->maxp[1].  The Linux MUSB driver deals

   849      * OK with single packets of even 32KB and we avoid splitting, however

   850      * usb_msd.c sometimes sends a packet bigger than what Linux expects

   851      * (e.g. 8192 bytes instead of 4096) and we get an OVERRUN.  Splitting

   852      * hides this overrun from Linux.  Up to 4096 everything is fine

   853      * though.  Currently this is disabled.

   854      *

   855      * XXX: mind ep->fifosize.  */

   856     total = MIN(ep->maxp[1] & 0x3ff, sizeof(s->buf));

   857 

   858 #ifdef SETUPLEN_HACK

   859     /* Why should *we* do that instead of Linux?  */

   860     if (!epnum) {

   861         if (ep->packey[0].devaddr == 2)

   862             total = MIN(s->setup_len, 8);

   863         else

   864             total = MIN(s->setup_len, 64);

   865         s->setup_len -= total;

   866     }

   867 #endif

   868 

   869     return musb_packet(s, ep, epnum, USB_TOKEN_IN,

   870                     total, musb_rx_packet_complete, 1);

   871 }

   872 

   873 static void musb_ep_frame_cancel(struct musb_ep_s *ep, int dir)

   874 {

   875     if (ep->intv_timer[dir])

   876         qemu_del_timer(ep->intv_timer[dir]);

   877 }

   878 

   879 /* Bus control */

   880 static uint8_t musb_busctl_readb(void *opaque, int ep, int addr)

   881 {

   882     struct musb_s *s = (struct musb_s *) opaque;

   883 

   884     switch (addr) {

   885     /* For USB2.0 HS hubs only */

   886     case MUSB_HDRC_TXHUBADDR:

   887         return s->ep[ep].haddr[0];

   888     case MUSB_HDRC_TXHUBPORT:

   889         return s->ep[ep].hport[0];

   890     case MUSB_HDRC_RXHUBADDR:

   891         return s->ep[ep].haddr[1];

   892     case MUSB_HDRC_RXHUBPORT:

   893         return s->ep[ep].hport[1];

   894 

   895     default:

   896         printf("%s: unknown register at %02x\n", __FUNCTION__, addr);

   897         return 0x00;

   898     };

   899 }

   900 

   901 static void musb_busctl_writeb(void *opaque, int ep, int addr, uint8_t value)

   902 {

   903     struct musb_s *s = (struct musb_s *) opaque;

   904 

   905     switch (addr) {

   906     case MUSB_HDRC_TXHUBADDR:

   907         s->ep[ep].haddr[0] = value;

   908         break;

   909     case MUSB_HDRC_TXHUBPORT:

   910         s->ep[ep].hport[0] = value;

   911         break;

   912     case MUSB_HDRC_RXHUBADDR:

   913         s->ep[ep].haddr[1] = value;

   914         break;

   915     case MUSB_HDRC_RXHUBPORT:

   916         s->ep[ep].hport[1] = value;

   917         break;

   918 

   919     default:

   920         printf("%s: unknown register at %02x\n", __FUNCTION__, addr);

   921     };

   922 }

   923 

   924 static uint16_t musb_busctl_readh(void *opaque, int ep, int addr)

   925 {

   926     struct musb_s *s = (struct musb_s *) opaque;

   927 

   928     switch (addr) {

   929     case MUSB_HDRC_TXFUNCADDR:

   930         return s->ep[ep].faddr[0];

   931     case MUSB_HDRC_RXFUNCADDR:

   932         return s->ep[ep].faddr[1];

   933 

   934     default:

   935         return musb_busctl_readb(s, ep, addr) |

   936                 (musb_busctl_readb(s, ep, addr | 1) << 8);

   937     };

   938 }

   939 

   940 static void musb_busctl_writeh(void *opaque, int ep, int addr, uint16_t value)

   941 {

   942     struct musb_s *s = (struct musb_s *) opaque;

   943 

   944     switch (addr) {

   945     case MUSB_HDRC_TXFUNCADDR:

   946         s->ep[ep].faddr[0] = value;

   947         break;

   948     case MUSB_HDRC_RXFUNCADDR:

   949         s->ep[ep].faddr[1] = value;

   950         break;

   951 

   952     default:

   953         musb_busctl_writeb(s, ep, addr, value & 0xff);

   954         musb_busctl_writeb(s, ep, addr | 1, value >> 8);

   955     };

   956 }

   957 

   958 /* Endpoint control */

   959 static uint8_t musb_ep_readb(void *opaque, int ep, int addr)

   960 {

   961     struct musb_s *s = (struct musb_s *) opaque;

   962 

   963     switch (addr) {

   964     case MUSB_HDRC_TXTYPE:

   965         return s->ep[ep].type[0];

   966     case MUSB_HDRC_TXINTERVAL:

   967         return s->ep[ep].interval[0];

   968     case MUSB_HDRC_RXTYPE:

   969         return s->ep[ep].type[1];

   970     case MUSB_HDRC_RXINTERVAL:

   971         return s->ep[ep].interval[1];

   972     case (MUSB_HDRC_FIFOSIZE & ~1):

   973         return 0x00;

   974     case MUSB_HDRC_FIFOSIZE:

   975         return ep ? s->ep[ep].fifosize : s->ep[ep].config;

   976 

   977     default:

   978         printf("%s: unknown register at %02x\n", __FUNCTION__, addr);

   979         return 0x00;

   980     };

   981 }

   982 

   983 static void musb_ep_writeb(void *opaque, int ep, int addr, uint8_t value)

   984 {

   985     struct musb_s *s = (struct musb_s *) opaque;

   986 

   987     switch (addr) {

   988     case MUSB_HDRC_TXTYPE:

   989         s->ep[ep].type[0] = value;

   990         break;

   991     case MUSB_HDRC_TXINTERVAL:

   992         s->ep[ep].interval[0] = value;

   993         musb_ep_frame_cancel(&s->ep[ep], 0);

   994         break;

   995     case MUSB_HDRC_RXTYPE:

   996         s->ep[ep].type[1] = value;

   997         break;

   998     case MUSB_HDRC_RXINTERVAL:

   999         s->ep[ep].interval[1] = value;

  1000         musb_ep_frame_cancel(&s->ep[ep], 1);

  1001         break;

  1002     case (MUSB_HDRC_FIFOSIZE & ~1):

  1003         break;

  1004     case MUSB_HDRC_FIFOSIZE:

  1005         printf("%s: somebody messes with fifosize (now %i bytes)\n",

  1006                         __FUNCTION__, value);

  1007         s->ep[ep].fifosize = value;

  1008         break;

  1009 

  1010     default:

  1011         printf("%s: unknown register at %02x\n", __FUNCTION__, addr);

  1012     };

  1013 }

  1014 

  1015 static uint16_t musb_ep_readh(void *opaque, int ep, int addr)

  1016 {

  1017     struct musb_s *s = (struct musb_s *) opaque;

  1018     uint16_t ret;

  1019 

  1020     switch (addr) {

  1021     case MUSB_HDRC_TXMAXP:

  1022         return s->ep[ep].maxp[0];

  1023     case MUSB_HDRC_TXCSR:

  1024         return s->ep[ep].csr[0];

  1025     case MUSB_HDRC_RXMAXP:

  1026         return s->ep[ep].maxp[1];

  1027     case MUSB_HDRC_RXCSR:

  1028         ret = s->ep[ep].csr[1];

  1029 

  1030         /* TODO: This and other bits probably depend on

  1031          * ep->csr[1] & MGC_M_RXCSR_AUTOCLEAR.  */

  1032         if (s->ep[ep].csr[1] & MGC_M_RXCSR_AUTOCLEAR)

  1033             s->ep[ep].csr[1] &= ~MGC_M_RXCSR_RXPKTRDY;

  1034 

  1035         return ret;

  1036     case MUSB_HDRC_RXCOUNT:

  1037         return s->ep[ep].rxcount;

  1038 

  1039     default:

  1040         return musb_ep_readb(s, ep, addr) |

  1041                 (musb_ep_readb(s, ep, addr | 1) << 8);

  1042     };

  1043 }

  1044 

  1045 static void musb_ep_writeh(void *opaque, int ep, int addr, uint16_t value)

  1046 {

  1047     struct musb_s *s = (struct musb_s *) opaque;

  1048 

  1049     switch (addr) {

  1050     case MUSB_HDRC_TXMAXP:

  1051         s->ep[ep].maxp[0] = value;

  1052         break;

  1053     case MUSB_HDRC_TXCSR:

  1054         if (ep) {

  1055             s->ep[ep].csr[0] &= value & 0xa6;

  1056             s->ep[ep].csr[0] |= value & 0xff59;

  1057         } else {

  1058             s->ep[ep].csr[0] &= value & 0x85;

  1059             s->ep[ep].csr[0] |= value & 0xf7a;

  1060         }

  1061 

  1062         musb_ep_frame_cancel(&s->ep[ep], 0);

  1063 

  1064         if ((ep && (value & MGC_M_TXCSR_FLUSHFIFO)) ||

  1065                         (!ep && (value & MGC_M_CSR0_FLUSHFIFO))) {

  1066             s->ep[ep].fifolen[0] = 0;

  1067             s->ep[ep].fifostart[0] = 0;

  1068             if (ep)

  1069                 s->ep[ep].csr[0] &=

  1070                         ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY);

  1071             else

  1072                 s->ep[ep].csr[0] &=

  1073                         ~(MGC_M_CSR0_TXPKTRDY | MGC_M_CSR0_RXPKTRDY);

  1074         }

  1075         if (

  1076                         (ep &&

  1077 #ifdef CLEAR_NAK

  1078                          (value & MGC_M_TXCSR_TXPKTRDY) &&

  1079                          !(value & MGC_M_TXCSR_H_NAKTIMEOUT)) ||

  1080 #else

  1081                          (value & MGC_M_TXCSR_TXPKTRDY)) ||

  1082 #endif

  1083                         (!ep &&

  1084 #ifdef CLEAR_NAK

  1085                          (value & MGC_M_CSR0_TXPKTRDY) &&

  1086                          !(value & MGC_M_CSR0_H_NAKTIMEOUT)))

  1087 #else

  1088                          (value & MGC_M_CSR0_TXPKTRDY)))

  1089 #endif

  1090             musb_tx_rdy(s, ep);

  1091         if (!ep &&

  1092                         (value & MGC_M_CSR0_H_REQPKT) &&

  1093 #ifdef CLEAR_NAK

  1094                         !(value & (MGC_M_CSR0_H_NAKTIMEOUT |

  1095                                         MGC_M_CSR0_RXPKTRDY)))

  1096 #else

  1097                         !(value & MGC_M_CSR0_RXPKTRDY))

  1098 #endif

  1099             musb_rx_req(s, ep);

  1100         break;

  1101 

  1102     case MUSB_HDRC_RXMAXP:

  1103         s->ep[ep].maxp[1] = value;

  1104         break;

  1105     case MUSB_HDRC_RXCSR:

  1106         /* (DMA mode only) */

  1107         if (

  1108                 (value & MGC_M_RXCSR_H_AUTOREQ) &&

  1109                 !(value & MGC_M_RXCSR_RXPKTRDY) &&

  1110                 (s->ep[ep].csr[1] & MGC_M_RXCSR_RXPKTRDY))

  1111             value |= MGC_M_RXCSR_H_REQPKT;

  1112 

  1113         s->ep[ep].csr[1] &= 0x102 | (value & 0x4d);

  1114         s->ep[ep].csr[1] |= value & 0xfeb0;

  1115 

  1116         musb_ep_frame_cancel(&s->ep[ep], 1);

  1117 

  1118         if (value & MGC_M_RXCSR_FLUSHFIFO) {

  1119             s->ep[ep].fifolen[1] = 0;

  1120             s->ep[ep].fifostart[1] = 0;

  1121             s->ep[ep].csr[1] &= ~(MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY);

  1122             /* If double buffering and we have two packets ready, flush

  1123              * only the first one and set up the fifo at the second packet.  */

  1124         }

  1125 #ifdef CLEAR_NAK

  1126         if ((value & MGC_M_RXCSR_H_REQPKT) && !(value & MGC_M_RXCSR_DATAERROR))

  1127 #else

  1128         if (value & MGC_M_RXCSR_H_REQPKT)

  1129 #endif

  1130             musb_rx_req(s, ep);

  1131         break;

  1132     case MUSB_HDRC_RXCOUNT:

  1133         s->ep[ep].rxcount = value;

  1134         break;

  1135