Statistics
| Branch: | Revision:

root / hw / usb-musb.c @ fad6cb1a

History | View | Annotate | Download (41.6 kB)

1
/*
2
 * "Inventra" High-speed Dual-Role Controller (MUSB-HDRC), Mentor Graphics,
3
 * USB2.0 OTG compliant core used in various chips.
4
 *
5
 * Copyright (C) 2008 Nokia Corporation
6
 * Written by Andrzej Zaborowski <andrew@openedhand.com>
7
 *
8
 * This program is free software; you can redistribute it and/or
9
 * modify it under the terms of the GNU General Public License as
10
 * published by the Free Software Foundation; either version 2 or
11
 * (at your option) version 3 of the License.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU General Public License along
19
 * with this program; if not, write to the Free Software Foundation, Inc.,
20
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21
 *
22
 * Only host-mode and non-DMA accesses are currently supported.
23
 */
24
#include "qemu-common.h"
25
#include "qemu-timer.h"
26
#include "usb.h"
27
#include "irq.h"
28

    
29
/* Common USB registers */
30
#define MUSB_HDRC_FADDR                0x00        /* 8-bit */
31
#define MUSB_HDRC_POWER                0x01        /* 8-bit */
32

    
33
#define MUSB_HDRC_INTRTX        0x02        /* 16-bit */
34
#define MUSB_HDRC_INTRRX        0x04
35
#define MUSB_HDRC_INTRTXE        0x06  
36
#define MUSB_HDRC_INTRRXE        0x08  
37
#define MUSB_HDRC_INTRUSB        0x0a        /* 8 bit */
38
#define MUSB_HDRC_INTRUSBE        0x0b        /* 8 bit */
39
#define MUSB_HDRC_FRAME                0x0c        /* 16-bit */
40
#define MUSB_HDRC_INDEX                0x0e        /* 8 bit */
41
#define MUSB_HDRC_TESTMODE        0x0f        /* 8 bit */
42

    
43
/* Per-EP registers in indexed mode */
44
#define MUSB_HDRC_EP_IDX        0x10        /* 8-bit */
45

    
46
/* EP FIFOs */
47
#define MUSB_HDRC_FIFO                0x20
48

    
49
/* Additional Control Registers */
50
#define        MUSB_HDRC_DEVCTL        0x60        /* 8 bit */
51

    
52
/* These are indexed */
53
#define MUSB_HDRC_TXFIFOSZ        0x62        /* 8 bit (see masks) */
54
#define MUSB_HDRC_RXFIFOSZ        0x63        /* 8 bit (see masks) */
55
#define MUSB_HDRC_TXFIFOADDR        0x64        /* 16 bit offset shifted right 3 */
56
#define MUSB_HDRC_RXFIFOADDR        0x66        /* 16 bit offset shifted right 3 */
57

    
58
/* Some more registers */
59
#define MUSB_HDRC_VCTRL                0x68        /* 8 bit */
60
#define MUSB_HDRC_HWVERS        0x6c        /* 8 bit */
61

    
62
/* Added in HDRC 1.9(?) & MHDRC 1.4 */
63
/* ULPI pass-through */
64
#define MUSB_HDRC_ULPI_VBUSCTL        0x70
65
#define MUSB_HDRC_ULPI_REGDATA        0x74
66
#define MUSB_HDRC_ULPI_REGADDR        0x75
67
#define MUSB_HDRC_ULPI_REGCTL        0x76
68

    
69
/* Extended config & PHY control */
70
#define MUSB_HDRC_ENDCOUNT        0x78        /* 8 bit */
71
#define MUSB_HDRC_DMARAMCFG        0x79        /* 8 bit */
72
#define MUSB_HDRC_PHYWAIT        0x7a        /* 8 bit */
73
#define MUSB_HDRC_PHYVPLEN        0x7b        /* 8 bit */
74
#define MUSB_HDRC_HS_EOF1        0x7c        /* 8 bit, units of 546.1 us */
75
#define MUSB_HDRC_FS_EOF1        0x7d        /* 8 bit, units of 533.3 ns */
76
#define MUSB_HDRC_LS_EOF1        0x7e        /* 8 bit, units of 1.067 us */
77

    
78
/* Per-EP BUSCTL registers */
79
#define MUSB_HDRC_BUSCTL        0x80
80

    
81
/* Per-EP registers in flat mode */
82
#define MUSB_HDRC_EP                0x100
83

    
84
/* offsets to registers in flat model */
85
#define MUSB_HDRC_TXMAXP        0x00        /* 16 bit apparently */
86
#define MUSB_HDRC_TXCSR                0x02        /* 16 bit apparently */
87
#define MUSB_HDRC_CSR0                MUSB_HDRC_TXCSR                /* re-used for EP0 */
88
#define MUSB_HDRC_RXMAXP        0x04        /* 16 bit apparently */
89
#define MUSB_HDRC_RXCSR                0x06        /* 16 bit apparently */
90
#define MUSB_HDRC_RXCOUNT        0x08        /* 16 bit apparently */
91
#define MUSB_HDRC_COUNT0        MUSB_HDRC_RXCOUNT        /* re-used for EP0 */
92
#define MUSB_HDRC_TXTYPE        0x0a        /* 8 bit apparently */
93
#define MUSB_HDRC_TYPE0                MUSB_HDRC_TXTYPE        /* re-used for EP0 */
94
#define MUSB_HDRC_TXINTERVAL        0x0b        /* 8 bit apparently */
95
#define MUSB_HDRC_NAKLIMIT0        MUSB_HDRC_TXINTERVAL        /* re-used for EP0 */
96
#define MUSB_HDRC_RXTYPE        0x0c        /* 8 bit apparently */
97
#define MUSB_HDRC_RXINTERVAL        0x0d        /* 8 bit apparently */
98
#define MUSB_HDRC_FIFOSIZE        0x0f        /* 8 bit apparently */
99
#define MUSB_HDRC_CONFIGDATA        MGC_O_HDRC_FIFOSIZE        /* re-used for EP0 */
100

    
101
/* "Bus control" registers */
102
#define MUSB_HDRC_TXFUNCADDR        0x00
103
#define MUSB_HDRC_TXHUBADDR        0x02
104
#define MUSB_HDRC_TXHUBPORT        0x03
105

    
106
#define MUSB_HDRC_RXFUNCADDR        0x04
107
#define MUSB_HDRC_RXHUBADDR        0x06
108
#define MUSB_HDRC_RXHUBPORT        0x07
109

    
110
/*
111
 * MUSBHDRC Register bit masks
112
 */
113

    
114
/* POWER */
115
#define MGC_M_POWER_ISOUPDATE                0x80 
116
#define        MGC_M_POWER_SOFTCONN                0x40
117
#define        MGC_M_POWER_HSENAB                0x20
118
#define        MGC_M_POWER_HSMODE                0x10
119
#define MGC_M_POWER_RESET                0x08
120
#define MGC_M_POWER_RESUME                0x04
121
#define MGC_M_POWER_SUSPENDM                0x02
122
#define MGC_M_POWER_ENSUSPEND                0x01
123

    
124
/* INTRUSB */
125
#define MGC_M_INTR_SUSPEND                0x01
126
#define MGC_M_INTR_RESUME                0x02
127
#define MGC_M_INTR_RESET                0x04
128
#define MGC_M_INTR_BABBLE                0x04
129
#define MGC_M_INTR_SOF                        0x08 
130
#define MGC_M_INTR_CONNECT                0x10
131
#define MGC_M_INTR_DISCONNECT                0x20
132
#define MGC_M_INTR_SESSREQ                0x40
133
#define MGC_M_INTR_VBUSERROR                0x80        /* FOR SESSION END */
134
#define MGC_M_INTR_EP0                        0x01        /* FOR EP0 INTERRUPT */
135

    
136
/* DEVCTL */
137
#define MGC_M_DEVCTL_BDEVICE                0x80   
138
#define MGC_M_DEVCTL_FSDEV                0x40
139
#define MGC_M_DEVCTL_LSDEV                0x20
140
#define MGC_M_DEVCTL_VBUS                0x18
141
#define MGC_S_DEVCTL_VBUS                3
142
#define MGC_M_DEVCTL_HM                        0x04
143
#define MGC_M_DEVCTL_HR                        0x02
144
#define MGC_M_DEVCTL_SESSION                0x01
145

    
146
/* TESTMODE */
147
#define MGC_M_TEST_FORCE_HOST                0x80
148
#define MGC_M_TEST_FIFO_ACCESS                0x40
149
#define MGC_M_TEST_FORCE_FS                0x20
150
#define MGC_M_TEST_FORCE_HS                0x10
151
#define MGC_M_TEST_PACKET                0x08
152
#define MGC_M_TEST_K                        0x04
153
#define MGC_M_TEST_J                        0x02
154
#define MGC_M_TEST_SE0_NAK                0x01
155

    
156
/* CSR0 */
157
#define        MGC_M_CSR0_FLUSHFIFO                0x0100
158
#define MGC_M_CSR0_TXPKTRDY                0x0002
159
#define MGC_M_CSR0_RXPKTRDY                0x0001
160

    
161
/* CSR0 in Peripheral mode */
162
#define MGC_M_CSR0_P_SVDSETUPEND        0x0080
163
#define MGC_M_CSR0_P_SVDRXPKTRDY        0x0040
164
#define MGC_M_CSR0_P_SENDSTALL                0x0020
165
#define MGC_M_CSR0_P_SETUPEND                0x0010
166
#define MGC_M_CSR0_P_DATAEND                0x0008
167
#define MGC_M_CSR0_P_SENTSTALL                0x0004
168

    
169
/* CSR0 in Host mode */
170
#define MGC_M_CSR0_H_NO_PING                0x0800
171
#define MGC_M_CSR0_H_WR_DATATOGGLE        0x0400        /* set to allow setting: */
172
#define MGC_M_CSR0_H_DATATOGGLE                0x0200        /* data toggle control */
173
#define        MGC_M_CSR0_H_NAKTIMEOUT                0x0080
174
#define MGC_M_CSR0_H_STATUSPKT                0x0040
175
#define MGC_M_CSR0_H_REQPKT                0x0020
176
#define MGC_M_CSR0_H_ERROR                0x0010
177
#define MGC_M_CSR0_H_SETUPPKT                0x0008
178
#define MGC_M_CSR0_H_RXSTALL                0x0004
179

    
180
/* CONFIGDATA */
181
#define MGC_M_CONFIGDATA_MPRXE                0x80        /* auto bulk pkt combining */
182
#define MGC_M_CONFIGDATA_MPTXE                0x40        /* auto bulk pkt splitting */
183
#define MGC_M_CONFIGDATA_BIGENDIAN        0x20
184
#define MGC_M_CONFIGDATA_HBRXE                0x10        /* HB-ISO for RX */
185
#define MGC_M_CONFIGDATA_HBTXE                0x08        /* HB-ISO for TX */
186
#define MGC_M_CONFIGDATA_DYNFIFO        0x04        /* dynamic FIFO sizing */
187
#define MGC_M_CONFIGDATA_SOFTCONE        0x02        /* SoftConnect */
188
#define MGC_M_CONFIGDATA_UTMIDW                0x01        /* Width, 0 => 8b, 1 => 16b */
189

    
190
/* TXCSR in Peripheral and Host mode */
191
#define MGC_M_TXCSR_AUTOSET                0x8000
192
#define MGC_M_TXCSR_ISO                        0x4000
193
#define MGC_M_TXCSR_MODE                0x2000
194
#define MGC_M_TXCSR_DMAENAB                0x1000
195
#define MGC_M_TXCSR_FRCDATATOG                0x0800
196
#define MGC_M_TXCSR_DMAMODE                0x0400
197
#define MGC_M_TXCSR_CLRDATATOG                0x0040
198
#define MGC_M_TXCSR_FLUSHFIFO                0x0008
199
#define MGC_M_TXCSR_FIFONOTEMPTY        0x0002
200
#define MGC_M_TXCSR_TXPKTRDY                0x0001
201

    
202
/* TXCSR in Peripheral mode */
203
#define MGC_M_TXCSR_P_INCOMPTX                0x0080
204
#define MGC_M_TXCSR_P_SENTSTALL                0x0020
205
#define MGC_M_TXCSR_P_SENDSTALL                0x0010
206
#define MGC_M_TXCSR_P_UNDERRUN                0x0004
207

    
208
/* TXCSR in Host mode */
209
#define MGC_M_TXCSR_H_WR_DATATOGGLE        0x0200
210
#define MGC_M_TXCSR_H_DATATOGGLE        0x0100
211
#define MGC_M_TXCSR_H_NAKTIMEOUT        0x0080
212
#define MGC_M_TXCSR_H_RXSTALL                0x0020
213
#define MGC_M_TXCSR_H_ERROR                0x0004
214

    
215
/* RXCSR in Peripheral and Host mode */
216
#define MGC_M_RXCSR_AUTOCLEAR                0x8000
217
#define MGC_M_RXCSR_DMAENAB                0x2000
218
#define MGC_M_RXCSR_DISNYET                0x1000
219
#define MGC_M_RXCSR_DMAMODE                0x0800
220
#define MGC_M_RXCSR_INCOMPRX                0x0100
221
#define MGC_M_RXCSR_CLRDATATOG                0x0080
222
#define MGC_M_RXCSR_FLUSHFIFO                0x0010
223
#define MGC_M_RXCSR_DATAERROR                0x0008
224
#define MGC_M_RXCSR_FIFOFULL                0x0002
225
#define MGC_M_RXCSR_RXPKTRDY                0x0001
226

    
227
/* RXCSR in Peripheral mode */
228
#define MGC_M_RXCSR_P_ISO                0x4000
229
#define MGC_M_RXCSR_P_SENTSTALL                0x0040
230
#define MGC_M_RXCSR_P_SENDSTALL                0x0020
231
#define MGC_M_RXCSR_P_OVERRUN                0x0004
232

    
233
/* RXCSR in Host mode */
234
#define MGC_M_RXCSR_H_AUTOREQ                0x4000
235
#define MGC_M_RXCSR_H_WR_DATATOGGLE        0x0400
236
#define MGC_M_RXCSR_H_DATATOGGLE        0x0200
237
#define MGC_M_RXCSR_H_RXSTALL                0x0040
238
#define MGC_M_RXCSR_H_REQPKT                0x0020
239
#define MGC_M_RXCSR_H_ERROR                0x0004
240

    
241
/* HUBADDR */
242
#define MGC_M_HUBADDR_MULTI_TT                0x80
243

    
244
/* ULPI: Added in HDRC 1.9(?) & MHDRC 1.4 */
245
#define MGC_M_ULPI_VBCTL_USEEXTVBUSIND        0x02
246
#define MGC_M_ULPI_VBCTL_USEEXTVBUS        0x01
247
#define MGC_M_ULPI_REGCTL_INT_ENABLE        0x08
248
#define MGC_M_ULPI_REGCTL_READNOTWRITE        0x04
249
#define MGC_M_ULPI_REGCTL_COMPLETE        0x02
250
#define MGC_M_ULPI_REGCTL_REG                0x01
251

    
252
static void musb_attach(USBPort *port, USBDevice *dev);
253

    
254
struct musb_s {
255
    qemu_irq *irqs;
256
    USBPort port;
257

    
258
    int idx;
259
    uint8_t devctl;
260
    uint8_t power;
261
    uint8_t faddr;
262

    
263
    uint8_t intr;
264
    uint8_t mask;
265
    uint16_t tx_intr;
266
    uint16_t tx_mask;
267
    uint16_t rx_intr;
268
    uint16_t rx_mask;
269

    
270
    int setup_len;
271
    int session;
272

    
273
    uint32_t buf[0x2000];
274

    
275
    struct musb_ep_s {
276
        uint16_t faddr[2];
277
        uint8_t haddr[2];
278
        uint8_t hport[2];
279
        uint16_t csr[2];
280
        uint16_t maxp[2];
281
        uint16_t rxcount;
282
        uint8_t type[2];
283
        uint8_t interval[2];
284
        uint8_t config;
285
        uint8_t fifosize;
286
        int timeout[2];        /* Always in microframes */
287

    
288
        uint32_t *buf[2];
289
        int fifolen[2];
290
        int fifostart[2];
291
        int fifoaddr[2];
292
        USBPacket packey[2];
293
        int status[2];
294
        int ext_size[2];
295

    
296
        /* For callbacks' use */
297
        int epnum;
298
        int interrupt[2];
299
        struct musb_s *musb;
300
        USBCallback *delayed_cb[2];
301
        QEMUTimer *intv_timer[2];
302
        /* Duplicating the world since 2008!...  probably we should have 32
303
         * logical, single endpoints instead.  */
304
    } ep[16];
305
} *musb_init(qemu_irq *irqs)
306
{
307
    struct musb_s *s = qemu_mallocz(sizeof(*s));
308
    int i;
309

    
310
    s->irqs = irqs;
311

    
312
    s->faddr = 0x00;
313
    s->power = MGC_M_POWER_HSENAB;
314
    s->tx_intr = 0x0000;
315
    s->rx_intr = 0x0000;
316
    s->tx_mask = 0xffff;
317
    s->rx_mask = 0xffff;
318
    s->intr = 0x00;
319
    s->mask = 0x06;
320
    s->idx = 0;
321

    
322
    /* TODO: _DW */
323
    s->ep[0].config = MGC_M_CONFIGDATA_SOFTCONE | MGC_M_CONFIGDATA_DYNFIFO;
324
    for (i = 0; i < 16; i ++) {
325
        s->ep[i].fifosize = 64;
326
        s->ep[i].maxp[0] = 0x40;
327
        s->ep[i].maxp[1] = 0x40;
328
        s->ep[i].musb = s;
329
        s->ep[i].epnum = i;
330
    }
331

    
332
    qemu_register_usb_port(&s->port, s, 0, musb_attach);
333

    
334
    return s;
335
}
336

    
337
static void musb_vbus_set(struct musb_s *s, int level)
338
{
339
    if (level)
340
        s->devctl |= 3 << MGC_S_DEVCTL_VBUS;
341
    else
342
        s->devctl &= ~MGC_M_DEVCTL_VBUS;
343

    
344
    qemu_set_irq(s->irqs[musb_set_vbus], level);
345
}
346

    
347
static void musb_intr_set(struct musb_s *s, int line, int level)
348
{
349
    if (!level) {
350
        s->intr &= ~(1 << line);
351
        qemu_irq_lower(s->irqs[line]);
352
    } else if (s->mask & (1 << line)) {
353
        s->intr |= 1 << line;
354
        qemu_irq_raise(s->irqs[line]);
355
    }
356
}
357

    
358
static void musb_tx_intr_set(struct musb_s *s, int line, int level)
359
{
360
    if (!level) {
361
        s->tx_intr &= ~(1 << line);
362
        if (!s->tx_intr)
363
            qemu_irq_lower(s->irqs[musb_irq_tx]);
364
    } else if (s->tx_mask & (1 << line)) {
365
        s->tx_intr |= 1 << line;
366
        qemu_irq_raise(s->irqs[musb_irq_tx]);
367
    }
368
}
369

    
370
static void musb_rx_intr_set(struct musb_s *s, int line, int level)
371
{
372
    if (line) {
373
        if (!level) {
374
            s->rx_intr &= ~(1 << line);
375
            if (!s->rx_intr)
376
                qemu_irq_lower(s->irqs[musb_irq_rx]);
377
        } else if (s->rx_mask & (1 << line)) {
378
            s->rx_intr |= 1 << line;
379
            qemu_irq_raise(s->irqs[musb_irq_rx]);
380
        }
381
    } else
382
        musb_tx_intr_set(s, line, level);
383
}
384

    
385
uint32_t musb_core_intr_get(struct musb_s *s)
386
{
387
    return (s->rx_intr << 15) | s->tx_intr;
388
}
389

    
390
void musb_core_intr_clear(struct musb_s *s, uint32_t mask)
391
{
392
    if (s->rx_intr) {
393
        s->rx_intr &= mask >> 15;
394
        if (!s->rx_intr)
395
            qemu_irq_lower(s->irqs[musb_irq_rx]);
396
    }
397

    
398
    if (s->tx_intr) {
399
        s->tx_intr &= mask & 0xffff;
400
        if (!s->tx_intr)
401
            qemu_irq_lower(s->irqs[musb_irq_tx]);
402
    }
403
}
404

    
405
void musb_set_size(struct musb_s *s, int epnum, int size, int is_tx)
406
{
407
    s->ep[epnum].ext_size[!is_tx] = size;
408
    s->ep[epnum].fifostart[0] = 0;
409
    s->ep[epnum].fifostart[1] = 0;
410
    s->ep[epnum].fifolen[0] = 0;
411
    s->ep[epnum].fifolen[1] = 0;
412
}
413

    
414
static void musb_session_update(struct musb_s *s, int prev_dev, int prev_sess)
415
{
416
    int detect_prev = prev_dev && prev_sess;
417
    int detect = !!s->port.dev && s->session;
418

    
419
    if (detect && !detect_prev) {
420
        /* Let's skip the ID pin sense and VBUS sense formalities and
421
         * and signal a successful SRP directly.  This should work at least
422
         * for the Linux driver stack.  */
423
        musb_intr_set(s, musb_irq_connect, 1);
424

    
425
        if (s->port.dev->speed == USB_SPEED_LOW) {
426
            s->devctl &= ~MGC_M_DEVCTL_FSDEV;
427
            s->devctl |= MGC_M_DEVCTL_LSDEV;
428
        } else {
429
            s->devctl |= MGC_M_DEVCTL_FSDEV;
430
            s->devctl &= ~MGC_M_DEVCTL_LSDEV;
431
        }
432

    
433
        /* A-mode?  */
434
        s->devctl &= ~MGC_M_DEVCTL_BDEVICE;
435

    
436
        /* Host-mode bit?  */
437
        s->devctl |= MGC_M_DEVCTL_HM;
438
#if 1
439
        musb_vbus_set(s, 1);
440
#endif
441
    } else if (!detect && detect_prev) {
442
#if 1
443
        musb_vbus_set(s, 0);
444
#endif
445
    }
446
}
447

    
448
/* Attach or detach a device on our only port.  */
449
static void musb_attach(USBPort *port, USBDevice *dev)
450
{
451
    struct musb_s *s = (struct musb_s *) port->opaque;
452
    USBDevice *curr;
453

    
454
    port = &s->port;
455
    curr = port->dev;
456

    
457
    if (dev) {
458
        if (curr) {
459
            usb_attach(port, NULL);
460
            /* TODO: signal some interrupts */
461
        }
462

    
463
        musb_intr_set(s, musb_irq_vbus_request, 1);
464

    
465
        /* Send the attach message to device */
466
        usb_send_msg(dev, USB_MSG_ATTACH);
467
    } else if (curr) {
468
        /* Send the detach message */
469
        usb_send_msg(curr, USB_MSG_DETACH);
470

    
471
        musb_intr_set(s, musb_irq_disconnect, 1);
472
    }
473

    
474
    port->dev = dev;
475

    
476
    musb_session_update(s, !!curr, s->session);
477
}
478

    
479
static inline void musb_cb_tick0(void *opaque)
480
{
481
    struct musb_ep_s *ep = (struct musb_ep_s *) opaque;
482

    
483
    ep->delayed_cb[0](&ep->packey[0], opaque);
484
}
485

    
486
static inline void musb_cb_tick1(void *opaque)
487
{
488
    struct musb_ep_s *ep = (struct musb_ep_s *) opaque;
489

    
490
    ep->delayed_cb[1](&ep->packey[1], opaque);
491
}
492

    
493
#define musb_cb_tick        (dir ? musb_cb_tick1 : musb_cb_tick0)
494

    
495
static inline void musb_schedule_cb(USBPacket *packey, void *opaque, int dir)
496
{
497
    struct musb_ep_s *ep = (struct musb_ep_s *) opaque;
498
    int timeout = 0;
499

    
500
    if (ep->status[dir] == USB_RET_NAK)
501
        timeout = ep->timeout[dir];
502
    else if (ep->interrupt[dir])
503
        timeout = 8;
504
    else
505
        return musb_cb_tick(opaque);
506

    
507
    if (!ep->intv_timer[dir])
508
        ep->intv_timer[dir] = qemu_new_timer(vm_clock, musb_cb_tick, opaque);
509

    
510
    qemu_mod_timer(ep->intv_timer[dir], qemu_get_clock(vm_clock) +
511
                    muldiv64(timeout, ticks_per_sec, 8000));
512
}
513

    
514
static void musb_schedule0_cb(USBPacket *packey, void *opaque)
515
{
516
    return musb_schedule_cb(packey, opaque, 0);
517
}
518

    
519
static void musb_schedule1_cb(USBPacket *packey, void *opaque)
520
{
521
    return musb_schedule_cb(packey, opaque, 1);
522
}
523

    
524
static int musb_timeout(int ttype, int speed, int val)
525
{
526
#if 1
527
    return val << 3;
528
#endif
529

    
530
    switch (ttype) {
531
    case USB_ENDPOINT_XFER_CONTROL:
532
        if (val < 2)
533
            return 0;
534
        else if (speed == USB_SPEED_HIGH)
535
            return 1 << (val - 1);
536
        else
537
            return 8 << (val - 1);
538

    
539
    case USB_ENDPOINT_XFER_INT:
540
        if (speed == USB_SPEED_HIGH)
541
            if (val < 2)
542
                return 0;
543
            else
544
                return 1 << (val - 1);
545
        else
546
            return val << 3;
547

    
548
    case USB_ENDPOINT_XFER_BULK:
549
    case USB_ENDPOINT_XFER_ISOC:
550
        if (val < 2)
551
            return 0;
552
        else if (speed == USB_SPEED_HIGH)
553
            return 1 << (val - 1);
554
        else
555
            return 8 << (val - 1);
556
        /* TODO: what with low-speed Bulk and Isochronous?  */
557
    }
558

    
559
    cpu_abort(cpu_single_env, "bad interval\n");
560
}
561

    
562
static inline void musb_packet(struct musb_s *s, struct musb_ep_s *ep,
563
                int epnum, int pid, int len, USBCallback cb, int dir)
564
{
565
    int ret;
566
    int idx = epnum && dir;
567
    int ttype;
568

    
569
    /* ep->type[0,1] contains:
570
     * in bits 7:6 the speed (0 - invalid, 1 - high, 2 - full, 3 - slow)
571
     * in bits 5:4 the transfer type (BULK / INT)
572
     * in bits 3:0 the EP num
573
     */
574
    ttype = epnum ? (ep->type[idx] >> 4) & 3 : 0;
575

    
576
    ep->timeout[dir] = musb_timeout(ttype,
577
                    ep->type[idx] >> 6, ep->interval[idx]);
578
    ep->interrupt[dir] = ttype == USB_ENDPOINT_XFER_INT;
579
    ep->delayed_cb[dir] = cb;
580
    cb = dir ? musb_schedule1_cb : musb_schedule0_cb;
581

    
582
    ep->packey[dir].pid = pid;
583
    /* A wild guess on the FADDR semantics... */
584
    ep->packey[dir].devaddr = ep->faddr[idx];
585
    ep->packey[dir].devep = ep->type[idx] & 0xf;
586
    ep->packey[dir].data = (void *) ep->buf[idx];
587
    ep->packey[dir].len = len;
588
    ep->packey[dir].complete_cb = cb;
589
    ep->packey[dir].complete_opaque = ep;
590

    
591
    if (s->port.dev)
592
        ret = s->port.dev->handle_packet(s->port.dev, &ep->packey[dir]);
593
    else
594
        ret = USB_RET_NODEV;
595

    
596
    if (ret == USB_RET_ASYNC) {
597
        ep->status[dir] = len;
598
        return;
599
    }
600

    
601
    ep->status[dir] = ret;
602
    usb_packet_complete(&ep->packey[dir]);
603
}
604

    
605
static void musb_tx_packet_complete(USBPacket *packey, void *opaque)
606
{
607
    /* Unfortunately we can't use packey->devep because that's the remote
608
     * endpoint number and may be different than our local.  */
609
    struct musb_ep_s *ep = (struct musb_ep_s *) opaque;
610
    int epnum = ep->epnum;
611
    struct musb_s *s = ep->musb;
612

    
613
    ep->fifostart[0] = 0;
614
    ep->fifolen[0] = 0;
615
#ifdef CLEAR_NAK
616
    if (ep->status[0] != USB_RET_NAK) {
617
#endif
618
        if (epnum)
619
            ep->csr[0] &= ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY);
620
        else
621
            ep->csr[0] &= ~MGC_M_CSR0_TXPKTRDY;
622
#ifdef CLEAR_NAK
623
    }
624
#endif
625

    
626
    /* Clear all of the error bits first */
627
    if (epnum)
628
        ep->csr[0] &= ~(MGC_M_TXCSR_H_ERROR | MGC_M_TXCSR_H_RXSTALL |
629
                        MGC_M_TXCSR_H_NAKTIMEOUT);
630
    else
631
        ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |
632
                        MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);
633

    
634
    if (ep->status[0] == USB_RET_STALL) {
635
        /* Command not supported by target! */
636
        ep->status[0] = 0;
637

    
638
        if (epnum)
639
            ep->csr[0] |= MGC_M_TXCSR_H_RXSTALL;
640
        else
641
            ep->csr[0] |= MGC_M_CSR0_H_RXSTALL;
642
    }
643

    
644
    if (ep->status[0] == USB_RET_NAK) {
645
        ep->status[0] = 0;
646

    
647
        /* NAK timeouts are only generated in Bulk transfers and
648
         * Data-errors in Isochronous.  */
649
        if (ep->interrupt[0]) {
650
            return;
651
        }
652

    
653
        if (epnum)
654
            ep->csr[0] |= MGC_M_TXCSR_H_NAKTIMEOUT;
655
        else
656
            ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT;
657
    }
658

    
659
    if (ep->status[0] < 0) {
660
        if (ep->status[0] == USB_RET_BABBLE)
661
            musb_intr_set(s, musb_irq_rst_babble, 1);
662

    
663
        /* Pretend we've tried three times already and failed (in
664
         * case of USB_TOKEN_SETUP).  */
665
        if (epnum)
666
            ep->csr[0] |= MGC_M_TXCSR_H_ERROR;
667
        else
668
            ep->csr[0] |= MGC_M_CSR0_H_ERROR;
669

    
670
        musb_tx_intr_set(s, epnum, 1);
671
        return;
672
    }
673
    /* TODO: check len for over/underruns of an OUT packet?  */
674

    
675
#ifdef SETUPLEN_HACK
676
    if (!epnum && ep->packey[0].pid == USB_TOKEN_SETUP)
677
        s->setup_len = ep->packey[0].data[6];
678
#endif
679

    
680
    /* In DMA mode: if no error, assert DMA request for this EP,
681
     * and skip the interrupt.  */
682
    musb_tx_intr_set(s, epnum, 1);
683
}
684

    
685
static void musb_rx_packet_complete(USBPacket *packey, void *opaque)
686
{
687
    /* Unfortunately we can't use packey->devep because that's the remote
688
     * endpoint number and may be different than our local.  */
689
    struct musb_ep_s *ep = (struct musb_ep_s *) opaque;
690
    int epnum = ep->epnum;
691
    struct musb_s *s = ep->musb;
692

    
693
    ep->fifostart[1] = 0;
694
    ep->fifolen[1] = 0;
695

    
696
#ifdef CLEAR_NAK
697
    if (ep->status[1] != USB_RET_NAK) {
698
#endif
699
        ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT;
700
        if (!epnum)
701
            ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT;
702
#ifdef CLEAR_NAK
703
    }
704
#endif
705

    
706
    /* Clear all of the imaginable error bits first */
707
    ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL |
708
                    MGC_M_RXCSR_DATAERROR);
709
    if (!epnum)
710
        ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |
711
                        MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);
712

    
713
    if (ep->status[1] == USB_RET_STALL) {
714
        ep->status[1] = 0;
715
        packey->len = 0;
716

    
717
        ep->csr[1] |= MGC_M_RXCSR_H_RXSTALL;
718
        if (!epnum)
719
            ep->csr[0] |= MGC_M_CSR0_H_RXSTALL;
720
    }
721

    
722
    if (ep->status[1] == USB_RET_NAK) {
723
        ep->status[1] = 0;
724

    
725
        /* NAK timeouts are only generated in Bulk transfers and
726
         * Data-errors in Isochronous.  */
727
        if (ep->interrupt[1])
728
            return musb_packet(s, ep, epnum, USB_TOKEN_IN,
729
                            packey->len, musb_rx_packet_complete, 1);
730

    
731
        ep->csr[1] |= MGC_M_RXCSR_DATAERROR;
732
        if (!epnum)
733
            ep->csr[0] |= MGC_M_CSR0_H_NAKTIMEOUT;
734
    }
735

    
736
    if (ep->status[1] < 0) {
737
        if (ep->status[1] == USB_RET_BABBLE) {
738
            musb_intr_set(s, musb_irq_rst_babble, 1);
739
            return;
740
        }
741

    
742
        /* Pretend we've tried three times already and failed (in
743
         * case of a control transfer).  */
744
        ep->csr[1] |= MGC_M_RXCSR_H_ERROR;
745
        if (!epnum)
746
            ep->csr[0] |= MGC_M_CSR0_H_ERROR;
747

    
748
        musb_rx_intr_set(s, epnum, 1);
749
        return;
750
    }
751
    /* TODO: check len for over/underruns of an OUT packet?  */
752
    /* TODO: perhaps make use of e->ext_size[1] here.  */
753

    
754
    packey->len = ep->status[1];
755

    
756
    if (!(ep->csr[1] & (MGC_M_RXCSR_H_RXSTALL | MGC_M_RXCSR_DATAERROR))) {
757
        ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY;
758
        if (!epnum)
759
            ep->csr[0] |= MGC_M_CSR0_RXPKTRDY;
760

    
761
        ep->rxcount = packey->len; /* XXX: MIN(packey->len, ep->maxp[1]); */
762
        /* In DMA mode: assert DMA request for this EP */
763
    }
764

    
765
    /* Only if DMA has not been asserted */
766
    musb_rx_intr_set(s, epnum, 1);
767
}
768

    
769
static void musb_tx_rdy(struct musb_s *s, int epnum)
770
{
771
    struct musb_ep_s *ep = s->ep + epnum;
772
    int pid;
773
    int total, valid = 0;
774

    
775
    ep->fifostart[0] += ep->fifolen[0];
776
    ep->fifolen[0] = 0;
777

    
778
    /* XXX: how's the total size of the packet retrieved exactly in
779
     * the generic case?  */
780
    total = ep->maxp[0] & 0x3ff;
781

    
782
    if (ep->ext_size[0]) {
783
        total = ep->ext_size[0];
784
        ep->ext_size[0] = 0;
785
        valid = 1;
786
    }
787

    
788
    /* If the packet is not fully ready yet, wait for a next segment.  */
789
    if (epnum && (ep->fifostart[0] << 2) < total)
790
        return;
791

    
792
    if (!valid)
793
        total = ep->fifostart[0] << 2;
794

    
795
    pid = USB_TOKEN_OUT;
796
    if (!epnum && (ep->csr[0] & MGC_M_CSR0_H_SETUPPKT)) {
797
        pid = USB_TOKEN_SETUP;
798
        if (total != 8)
799
            printf("%s: illegal SETUPPKT length of %i bytes\n",
800
                            __FUNCTION__, total);
801
        /* Controller should retry SETUP packets three times on errors
802
         * but it doesn't make sense for us to do that.  */
803
    }
804

    
805
    return musb_packet(s, ep, epnum, pid,
806
                    total, musb_tx_packet_complete, 0);
807
}
808

    
809
static void musb_rx_req(struct musb_s *s, int epnum)
810
{
811
    struct musb_ep_s *ep = s->ep + epnum;
812
    int total;
813

    
814
    /* If we already have a packet, which didn't fit into the
815
     * 64 bytes of the FIFO, only move the FIFO start and return. (Obsolete) */
816
    if (ep->packey[1].pid == USB_TOKEN_IN && ep->status[1] >= 0 &&
817
                    (ep->fifostart[1] << 2) + ep->rxcount <
818
                    ep->packey[1].len) {
819
        ep->fifostart[1] += ep->rxcount >> 2;
820
        ep->fifolen[1] = 0;
821

    
822
        ep->rxcount = MIN(ep->packey[0].len - (ep->fifostart[1] << 2),
823
                        ep->maxp[1]);
824

    
825
        ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT;
826
        if (!epnum)
827
            ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT;
828

    
829
        /* Clear all of the error bits first */
830
        ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL |
831
                        MGC_M_RXCSR_DATAERROR);
832
        if (!epnum)
833
            ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL |
834
                            MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING);
835

    
836
        ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY;
837
        if (!epnum)
838
            ep->csr[0] |= MGC_M_CSR0_RXPKTRDY;
839
        musb_rx_intr_set(s, epnum, 1);
840
        return;
841
    }
842

    
843
    /* The driver sets maxp[1] to 64 or less because it knows the hardware
844
     * FIFO is this deep.  Bigger packets get split in
845
     * usb_generic_handle_packet but we can also do the splitting locally
846
     * for performance.  It turns out we can also have a bigger FIFO and
847
     * ignore the limit set in ep->maxp[1].  The Linux MUSB driver deals
848
     * OK with single packets of even 32KB and we avoid splitting, however
849
     * usb_msd.c sometimes sends a packet bigger than what Linux expects
850
     * (e.g. 8192 bytes instead of 4096) and we get an OVERRUN.  Splitting
851
     * hides this overrun from Linux.  Up to 4096 everything is fine
852
     * though.  Currently this is disabled.
853
     *
854
     * XXX: mind ep->fifosize.  */
855
    total = MIN(ep->maxp[1] & 0x3ff, sizeof(s->buf));
856

    
857
#ifdef SETUPLEN_HACK
858
    /* Why should *we* do that instead of Linux?  */
859
    if (!epnum) {
860
        if (ep->packey[0].devaddr == 2)
861
            total = MIN(s->setup_len, 8);
862
        else
863
            total = MIN(s->setup_len, 64);
864
        s->setup_len -= total;
865
    }
866
#endif
867

    
868
    return musb_packet(s, ep, epnum, USB_TOKEN_IN,
869
                    total, musb_rx_packet_complete, 1);
870
}
871

    
872
static void musb_ep_frame_cancel(struct musb_ep_s *ep, int dir)
873
{
874
    if (ep->intv_timer[dir])
875
        qemu_del_timer(ep->intv_timer[dir]);
876
}
877

    
878
/* Bus control */
879
static uint8_t musb_busctl_readb(void *opaque, int ep, int addr)
880
{
881
    struct musb_s *s = (struct musb_s *) opaque;
882

    
883
    switch (addr) {
884
    /* For USB2.0 HS hubs only */
885
    case MUSB_HDRC_TXHUBADDR:
886
        return s->ep[ep].haddr[0];
887
    case MUSB_HDRC_TXHUBPORT:
888
        return s->ep[ep].hport[0];
889
    case MUSB_HDRC_RXHUBADDR:
890
        return s->ep[ep].haddr[1];
891
    case MUSB_HDRC_RXHUBPORT:
892
        return s->ep[ep].hport[1];
893

    
894
    default:
895
        printf("%s: unknown register at %02x\n", __FUNCTION__, addr);
896
        return 0x00;
897
    };
898
}
899

    
900
static void musb_busctl_writeb(void *opaque, int ep, int addr, uint8_t value)
901
{
902
    struct musb_s *s = (struct musb_s *) opaque;
903

    
904
    switch (addr) {
905
    case MUSB_HDRC_TXHUBADDR:
906
        s->ep[ep].haddr[0] = value;
907
        break;
908
    case MUSB_HDRC_TXHUBPORT:
909
        s->ep[ep].hport[0] = value;
910
        break;
911
    case MUSB_HDRC_RXHUBADDR:
912
        s->ep[ep].haddr[1] = value;
913
        break;
914
    case MUSB_HDRC_RXHUBPORT:
915
        s->ep[ep].hport[1] = value;
916
        break;
917

    
918
    default:
919
        printf("%s: unknown register at %02x\n", __FUNCTION__, addr);
920
    };
921
}
922

    
923
static uint16_t musb_busctl_readh(void *opaque, int ep, int addr)
924
{
925
    struct musb_s *s = (struct musb_s *) opaque;
926

    
927
    switch (addr) {
928
    case MUSB_HDRC_TXFUNCADDR:
929
        return s->ep[ep].faddr[0];
930
    case MUSB_HDRC_RXFUNCADDR:
931
        return s->ep[ep].faddr[1];
932

    
933
    default:
934
        return musb_busctl_readb(s, ep, addr) |
935
                (musb_busctl_readb(s, ep, addr | 1) << 8);
936
    };
937
}
938

    
939
static void musb_busctl_writeh(void *opaque, int ep, int addr, uint16_t value)
940
{
941
    struct musb_s *s = (struct musb_s *) opaque;
942

    
943
    switch (addr) {
944
    case MUSB_HDRC_TXFUNCADDR:
945
        s->ep[ep].faddr[0] = value;
946
        break;
947
    case MUSB_HDRC_RXFUNCADDR:
948
        s->ep[ep].faddr[1] = value;
949
        break;
950

    
951
    default:
952
        musb_busctl_writeb(s, ep, addr, value & 0xff);
953
        musb_busctl_writeb(s, ep, addr | 1, value >> 8);
954
    };
955
}
956

    
957
/* Endpoint control */
958
static uint8_t musb_ep_readb(void *opaque, int ep, int addr)
959
{
960
    struct musb_s *s = (struct musb_s *) opaque;
961

    
962
    switch (addr) {
963
    case MUSB_HDRC_TXTYPE:
964
        return s->ep[ep].type[0];
965
    case MUSB_HDRC_TXINTERVAL:
966
        return s->ep[ep].interval[0];
967
    case MUSB_HDRC_RXTYPE:
968
        return s->ep[ep].type[1];
969
    case MUSB_HDRC_RXINTERVAL:
970
        return s->ep[ep].interval[1];
971
    case (MUSB_HDRC_FIFOSIZE & ~1):
972
        return 0x00;
973
    case MUSB_HDRC_FIFOSIZE:
974
        return ep ? s->ep[ep].fifosize : s->ep[ep].config;
975

    
976
    default:
977
        printf("%s: unknown register at %02x\n", __FUNCTION__, addr);
978
        return 0x00;
979
    };
980
}
981

    
982
static void musb_ep_writeb(void *opaque, int ep, int addr, uint8_t value)
983
{
984
    struct musb_s *s = (struct musb_s *) opaque;
985

    
986
    switch (addr) {
987
    case MUSB_HDRC_TXTYPE:
988
        s->ep[ep].type[0] = value;
989
        break;
990
    case MUSB_HDRC_TXINTERVAL:
991
        s->ep[ep].interval[0] = value;
992
        musb_ep_frame_cancel(&s->ep[ep], 0);
993
        break;
994
    case MUSB_HDRC_RXTYPE:
995
        s->ep[ep].type[1] = value;
996
        break;
997
    case MUSB_HDRC_RXINTERVAL:
998
        s->ep[ep].interval[1] = value;
999
        musb_ep_frame_cancel(&s->ep[ep], 1);
1000
        break;
1001
    case (MUSB_HDRC_FIFOSIZE & ~1):
1002
        break;
1003
    case MUSB_HDRC_FIFOSIZE:
1004
        printf("%s: somebody messes with fifosize (now %i bytes)\n",
1005
                        __FUNCTION__, value);
1006
        s->ep[ep].fifosize = value;
1007
        break;
1008

    
1009
    default:
1010
        printf("%s: unknown register at %02x\n", __FUNCTION__, addr);
1011
    };
1012
}
1013

    
1014
static uint16_t musb_ep_readh(void *opaque, int ep, int addr)
1015
{
1016
    struct musb_s *s = (struct musb_s *) opaque;
1017
    uint16_t ret;
1018

    
1019
    switch (addr) {
1020
    case MUSB_HDRC_TXMAXP:
1021
        return s->ep[ep].maxp[0];
1022
    case MUSB_HDRC_TXCSR:
1023
        return s->ep[ep].csr[0];
1024
    case MUSB_HDRC_RXMAXP:
1025
        return s->ep[ep].maxp[1];
1026
    case MUSB_HDRC_RXCSR:
1027
        ret = s->ep[ep].csr[1];
1028

    
1029
        /* TODO: This and other bits probably depend on
1030
         * ep->csr[1] & MGC_M_RXCSR_AUTOCLEAR.  */
1031
        if (s->ep[ep].csr[1] & MGC_M_RXCSR_AUTOCLEAR)
1032
            s->ep[ep].csr[1] &= ~MGC_M_RXCSR_RXPKTRDY;
1033

    
1034
        return ret;
1035
    case MUSB_HDRC_RXCOUNT:
1036
        return s->ep[ep].rxcount;
1037

    
1038
    default:
1039
        return musb_ep_readb(s, ep, addr) |
1040
                (musb_ep_readb(s, ep, addr | 1) << 8);
1041
    };
1042
}
1043

    
1044
static void musb_ep_writeh(void *opaque, int ep, int addr, uint16_t value)
1045
{
1046
    struct musb_s *s = (struct musb_s *) opaque;
1047

    
1048
    switch (addr) {
1049
    case MUSB_HDRC_TXMAXP:
1050
        s->ep[ep].maxp[0] = value;
1051
        break;
1052
    case MUSB_HDRC_TXCSR:
1053
        if (ep) {
1054
            s->ep[ep].csr[0] &= value & 0xa6;
1055
            s->ep[ep].csr[0] |= value & 0xff59;
1056
        } else {
1057
            s->ep[ep].csr[0] &= value & 0x85;
1058
            s->ep[ep].csr[0] |= value & 0xf7a;
1059
        }
1060

    
1061
        musb_ep_frame_cancel(&s->ep[ep], 0);
1062

    
1063
        if ((ep && (value & MGC_M_TXCSR_FLUSHFIFO)) ||
1064
                        (!ep && (value & MGC_M_CSR0_FLUSHFIFO))) {
1065
            s->ep[ep].fifolen[0] = 0;
1066
            s->ep[ep].fifostart[0] = 0;
1067
            if (ep)
1068
                s->ep[ep].csr[0] &=
1069
                        ~(MGC_M_TXCSR_FIFONOTEMPTY | MGC_M_TXCSR_TXPKTRDY);
1070
            else
1071
                s->ep[ep].csr[0] &=
1072
                        ~(MGC_M_CSR0_TXPKTRDY | MGC_M_CSR0_RXPKTRDY);
1073
        }
1074
        if (
1075
                        (ep &&
1076
#ifdef CLEAR_NAK
1077
                         (value & MGC_M_TXCSR_TXPKTRDY) &&
1078
                         !(value & MGC_M_TXCSR_H_NAKTIMEOUT)) ||
1079
#else
1080
                         (value & MGC_M_TXCSR_TXPKTRDY)) ||
1081
#endif
1082
                        (!ep &&
1083
#ifdef CLEAR_NAK
1084
                         (value & MGC_M_CSR0_TXPKTRDY) &&
1085
                         !(value & MGC_M_CSR0_H_NAKTIMEOUT)))
1086
#else
1087
                         (value & MGC_M_CSR0_TXPKTRDY)))
1088
#endif
1089
            musb_tx_rdy(s, ep);
1090
        if (!ep &&
1091
                        (value & MGC_M_CSR0_H_REQPKT) &&
1092
#ifdef CLEAR_NAK
1093
                        !(value & (MGC_M_CSR0_H_NAKTIMEOUT |
1094
                                        MGC_M_CSR0_RXPKTRDY)))
1095
#else
1096
                        !(value & MGC_M_CSR0_RXPKTRDY))
1097
#endif
1098
            musb_rx_req(s, ep);
1099
        break;
1100

    
1101
    case MUSB_HDRC_RXMAXP:
1102
        s->ep[ep].maxp[1] = value;
1103
        break;
1104
    case MUSB_HDRC_RXCSR:
1105
        /* (DMA mode only) */
1106
        if (
1107
                (value & MGC_M_RXCSR_H_AUTOREQ) &&
1108
                !(value & MGC_M_RXCSR_RXPKTRDY) &&
1109
                (s->ep[ep].csr[1] & MGC_M_RXCSR_RXPKTRDY))
1110
            value |= MGC_M_RXCSR_H_REQPKT;
1111

    
1112
        s->ep[ep].csr[1] &= 0x102 | (value & 0x4d);
1113
        s->ep[ep].csr[1] |= value & 0xfeb0;
1114

    
1115
        musb_ep_frame_cancel(&s->ep[ep], 1);
1116

    
1117
        if (value & MGC_M_RXCSR_FLUSHFIFO) {
1118
            s->ep[ep].fifolen[1] = 0;
1119
            s->ep[ep].fifostart[1] = 0;
1120
            s->ep[ep].csr[1] &= ~(MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY);
1121
            /* If double buffering and we have two packets ready, flush
1122
             * only the first one and set up the fifo at the second packet.  */
1123
        }
1124
#ifdef CLEAR_NAK
1125
        if ((value & MGC_M_RXCSR_H_REQPKT) && !(value & MGC_M_RXCSR_DATAERROR))
1126
#else
1127
        if (value & MGC_M_RXCSR_H_REQPKT)
1128
#endif
1129
            musb_rx_req(s, ep);
1130
        break;
1131
    case MUSB_HDRC_RXCOUNT:
1132
        s->ep[ep].rxcount = value;
1133
        break;
1134

    
1135
    default:
1136
        musb_ep_writeb(s, ep, addr, value & 0xff);
1137
        musb_ep_writeb(s, ep, addr | 1, value >> 8);
1138
    };
1139
}
1140

    
1141
/* Generic control */
1142
static uint32_t musb_readb(void *opaque, target_phys_addr_t addr)
1143
{
1144
    struct musb_s *s = (struct musb_s *) opaque;
1145
    int ep, i;
1146
    uint8_t ret;
1147

    
1148
    switch (addr) {
1149
    case MUSB_HDRC_FADDR:
1150
        return s->faddr;
1151
    case MUSB_HDRC_POWER:
1152
        return s->power;
1153
    case MUSB_HDRC_INTRUSB:
1154
        ret = s->intr;
1155
        for (i = 0; i < sizeof(ret) * 8; i ++)
1156
            if (ret & (1 << i))
1157
                musb_intr_set(s, i, 0);
1158
        return ret;
1159
    case MUSB_HDRC_INTRUSBE:
1160
        return s->mask;
1161
    case MUSB_HDRC_INDEX:
1162
        return s->idx;
1163
    case MUSB_HDRC_TESTMODE:
1164
        return 0x00;
1165

    
1166
    case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf):
1167
        return musb_ep_readb(s, s->idx, addr & 0xf);
1168

    
1169
    case MUSB_HDRC_DEVCTL:
1170
        return s->devctl;
1171

    
1172
    case MUSB_HDRC_TXFIFOSZ:
1173
    case MUSB_HDRC_RXFIFOSZ:
1174
    case MUSB_HDRC_VCTRL:
1175
        /* TODO */
1176
        return 0x00;
1177

    
1178
    case MUSB_HDRC_HWVERS:
1179
        return (1 << 10) | 400;
1180

    
1181
    case (MUSB_HDRC_VCTRL | 1):
1182
    case (MUSB_HDRC_HWVERS | 1):
1183
    case (MUSB_HDRC_DEVCTL | 1):
1184
        return 0x00;
1185

    
1186
    case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f):
1187
        ep = (addr >> 3) & 0xf;
1188
        return musb_busctl_readb(s, ep, addr & 0x7);
1189

    
1190
    case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff):
1191
        ep = (addr >> 4) & 0xf;
1192
        return musb_ep_readb(s, ep, addr & 0xf);
1193

    
1194
    default:
1195
        printf("%s: unknown register at %02x\n", __FUNCTION__, (int) addr);
1196
        return 0x00;
1197
    };
1198
}
1199

    
1200
static void musb_writeb(void *opaque, target_phys_addr_t addr, uint32_t value)
1201
{
1202
    struct musb_s *s = (struct musb_s *) opaque;
1203
    int ep;
1204

    
1205
    switch (addr) {
1206
    case MUSB_HDRC_FADDR:
1207
        s->faddr = value & 0x7f;
1208
        break;
1209
    case MUSB_HDRC_POWER:
1210
        s->power = (value & 0xef) | (s->power & 0x10);
1211
        /* MGC_M_POWER_RESET is also read-only in Peripheral Mode */
1212
        if ((value & MGC_M_POWER_RESET) && s->port.dev) {
1213
            usb_send_msg(s->port.dev, USB_MSG_RESET);
1214
            /* Negotiate high-speed operation if MGC_M_POWER_HSENAB is set.  */
1215
            if ((value & MGC_M_POWER_HSENAB) &&
1216
                            s->port.dev->speed == USB_SPEED_HIGH)
1217
                s->power |= MGC_M_POWER_HSMODE;        /* Success */
1218
            /* Restart frame counting.  */
1219
        }
1220
        if (value & MGC_M_POWER_SUSPENDM) {
1221
            /* When all transfers finish, suspend and if MGC_M_POWER_ENSUSPEND
1222
             * is set, also go into low power mode.  Frame counting stops.  */
1223
            /* XXX: Cleared when the interrupt register is read */
1224
        }
1225
        if (value & MGC_M_POWER_RESUME) {
1226
            /* Wait 20ms and signal resuming on the bus.  Frame counting
1227
             * restarts.  */
1228
        }
1229
        break;
1230
    case MUSB_HDRC_INTRUSB:
1231
        break;
1232
    case MUSB_HDRC_INTRUSBE:
1233
        s->mask = value & 0xff;
1234
        break;
1235
    case MUSB_HDRC_INDEX:
1236
        s->idx = value & 0xf;
1237
        break;
1238
    case MUSB_HDRC_TESTMODE:
1239
        break;
1240

    
1241
    case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf):
1242
        musb_ep_writeb(s, s->idx, addr & 0xf, value);
1243
        break;
1244

    
1245
    case MUSB_HDRC_DEVCTL:
1246
        s->session = !!(value & MGC_M_DEVCTL_SESSION);
1247
        musb_session_update(s,
1248
                        !!s->port.dev,
1249
                        !!(s->devctl & MGC_M_DEVCTL_SESSION));
1250

    
1251
        /* It seems this is the only R/W bit in this register?  */
1252
        s->devctl &= ~MGC_M_DEVCTL_SESSION;
1253
        s->devctl |= value & MGC_M_DEVCTL_SESSION;
1254
        break;
1255

    
1256
    case MUSB_HDRC_TXFIFOSZ:
1257
    case MUSB_HDRC_RXFIFOSZ:
1258
    case MUSB_HDRC_VCTRL:
1259
        /* TODO */
1260
        break;
1261

    
1262
    case (MUSB_HDRC_VCTRL | 1):
1263
    case (MUSB_HDRC_DEVCTL | 1):
1264
        break;
1265

    
1266
    case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f):
1267
        ep = (addr >> 3) & 0xf;
1268
        musb_busctl_writeb(s, ep, addr & 0x7, value);
1269
        break;
1270

    
1271
    case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff):
1272
        ep = (addr >> 4) & 0xf;
1273
        musb_ep_writeb(s, ep, addr & 0xf, value);
1274
        break;
1275

    
1276
    default:
1277
        printf("%s: unknown register at %02x\n", __FUNCTION__, (int) addr);
1278
    };
1279
}
1280

    
1281
static uint32_t musb_readh(void *opaque, target_phys_addr_t addr)
1282
{
1283
    struct musb_s *s = (struct musb_s *) opaque;
1284
    int ep, i;
1285
    uint16_t ret;
1286

    
1287
    switch (addr) {
1288
    case MUSB_HDRC_INTRTX:
1289
        ret = s->tx_intr;
1290
        /* Auto clear */
1291
        for (i = 0; i < sizeof(ret) * 8; i ++)
1292
            if (ret & (1 << i))
1293
                musb_tx_intr_set(s, i, 0);
1294
        return ret;
1295
    case MUSB_HDRC_INTRRX:
1296
        ret = s->rx_intr;
1297
        /* Auto clear */
1298
        for (i = 0; i < sizeof(ret) * 8; i ++)
1299
            if (ret & (1 << i))
1300
                musb_rx_intr_set(s, i, 0);
1301
        return ret;
1302
    case MUSB_HDRC_INTRTXE:
1303
        return s->tx_mask;
1304
    case MUSB_HDRC_INTRRXE:
1305
        return s->rx_mask;
1306

    
1307
    case MUSB_HDRC_FRAME:
1308
        /* TODO */
1309
        return 0x0000;
1310
    case MUSB_HDRC_TXFIFOADDR:
1311
        return s->ep[s->idx].fifoaddr[0];
1312
    case MUSB_HDRC_RXFIFOADDR:
1313
        return s->ep[s->idx].fifoaddr[1];
1314

    
1315
    case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf):
1316
        return musb_ep_readh(s, s->idx, addr & 0xf);
1317

    
1318
    case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f):
1319
        ep = (addr >> 3) & 0xf;
1320
        return musb_busctl_readh(s, ep, addr & 0x7);
1321

    
1322
    case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff):
1323
        ep = (addr >> 4) & 0xf;
1324
        return musb_ep_readh(s, ep, addr & 0xf);
1325

    
1326
    default:
1327
        return musb_readb(s, addr) | (musb_readb(s, addr | 1) << 8);
1328
    };
1329
}
1330

    
1331
static void musb_writeh(void *opaque, target_phys_addr_t addr, uint32_t value)
1332
{
1333
    struct musb_s *s = (struct musb_s *) opaque;
1334
    int ep;
1335

    
1336
    switch (addr) {
1337
    case MUSB_HDRC_INTRTXE:
1338
        s->tx_mask = value;
1339
        /* XXX: the masks seem to apply on the raising edge like with
1340
         * edge-triggered interrupts, thus no need to update.  I may be
1341
         * wrong though.  */
1342
        break;
1343
    case MUSB_HDRC_INTRRXE:
1344
        s->rx_mask = value;
1345
        break;
1346

    
1347
    case MUSB_HDRC_FRAME:
1348
        /* TODO */
1349
        break;
1350
    case MUSB_HDRC_TXFIFOADDR:
1351
        s->ep[s->idx].fifoaddr[0] = value;
1352
        s->ep[s->idx].buf[0] =
1353
                s->buf + ((value << 1) & (sizeof(s->buf) / 4 - 1));
1354
        break;
1355
    case MUSB_HDRC_RXFIFOADDR:
1356
        s->ep[s->idx].fifoaddr[1] = value;
1357
        s->ep[s->idx].buf[1] =
1358
                s->buf + ((value << 1) & (sizeof(s->buf) / 4 - 1));
1359
        break;
1360

    
1361
    case MUSB_HDRC_EP_IDX ... (MUSB_HDRC_EP_IDX + 0xf):
1362
        musb_ep_writeh(s, s->idx, addr & 0xf, value);
1363
        break;
1364

    
1365
    case MUSB_HDRC_BUSCTL ... (MUSB_HDRC_BUSCTL + 0x7f):
1366
        ep = (addr >> 3) & 0xf;
1367
        musb_busctl_writeh(s, ep, addr & 0x7, value);
1368
        break;
1369

    
1370
    case MUSB_HDRC_EP ... (MUSB_HDRC_EP + 0xff):
1371
        ep = (addr >> 4) & 0xf;
1372
        musb_ep_writeh(s, ep, addr & 0xf, value);
1373
        break;
1374

    
1375
    default:
1376
        musb_writeb(s, addr, value & 0xff);
1377
        musb_writeb(s, addr | 1, value >> 8);
1378
    };
1379
}
1380

    
1381
static uint32_t musb_readw(void *opaque, target_phys_addr_t addr)
1382
{
1383
    struct musb_s *s = (struct musb_s *) opaque;
1384
    struct musb_ep_s *ep;
1385
    int epnum;
1386

    
1387
    switch (addr) {
1388
    case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f):
1389
        epnum = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf;
1390
        ep = s->ep + epnum;
1391

    
1392
        if (ep->fifolen[1] >= 16) {
1393
            /* We have a FIFO underrun */
1394
            printf("%s: EP%i FIFO is now empty, stop reading\n",
1395
                            __FUNCTION__, epnum);
1396
            return 0x00000000;
1397
        }
1398
        /* In DMA mode clear RXPKTRDY and set REQPKT automatically
1399
         * (if AUTOREQ is set) */
1400

    
1401
        ep->csr[1] &= ~MGC_M_RXCSR_FIFOFULL;
1402
        return ep->buf[1][ep->fifostart[1] + ep->fifolen[1] ++];
1403

    
1404
    default:
1405
        printf("%s: unknown register at %02x\n", __FUNCTION__, (int) addr);
1406
        return 0x00000000;
1407
    };
1408
}
1409

    
1410
static void musb_writew(void *opaque, target_phys_addr_t addr, uint32_t value)
1411
{
1412
    struct musb_s *s = (struct musb_s *) opaque;
1413
    struct musb_ep_s *ep;
1414
    int epnum;
1415

    
1416
    switch (addr) {
1417
    case MUSB_HDRC_FIFO ... (MUSB_HDRC_FIFO + 0x3f):
1418
        epnum = ((addr - MUSB_HDRC_FIFO) >> 2) & 0xf;
1419
        ep = s->ep + epnum;
1420

    
1421
        if (ep->fifolen[0] >= 16) {
1422
            /* We have a FIFO overrun */
1423
            printf("%s: EP%i FIFO exceeded 64 bytes, stop feeding data\n",
1424
                            __FUNCTION__, epnum);
1425
            break;
1426
        }
1427

    
1428
        ep->buf[0][ep->fifostart[0] + ep->fifolen[0] ++] = value;
1429
        if (epnum)
1430
            ep->csr[0] |= MGC_M_TXCSR_FIFONOTEMPTY;
1431
        break;
1432

    
1433
    default:
1434
        printf("%s: unknown register at %02x\n", __FUNCTION__, (int) addr);
1435
    };
1436
}
1437

    
1438
CPUReadMemoryFunc *musb_read[] = {
1439
    musb_readb,
1440
    musb_readh,
1441
    musb_readw,
1442
};
1443

    
1444
CPUWriteMemoryFunc *musb_write[] = {
1445
    musb_writeb,
1446
    musb_writeh,
1447
    musb_writew,
1448
};