[PATCH v3 02/12] hw/usb/aspeed-udc: Finish an EP0 IN transfer at the status stage

[Jamin Lin <jamin_lin@aspeedtech.com>]

In a control IN transfer, the data goes from the device to the host.
At the end, the host sends an empty OUT packet to the device. The
driver gets an OUT ACK interrupt for it.

The model sent the OUT ACK as soon as the driver set RX_RDY in
EP0_CTRL. This could happen before the IN data was sent. Real hardware
sends it only after all the IN data. This can break an IN transfer of
more than one packet.

Send the OUT ACK only after all the IN data is sent, and complete the
packet then. In a control OUT transfer, the data goes from the host to
the device. After all the OUT data is received, send no more OUT ACK.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 include/hw/usb/aspeed-udc.h |  1 +
 hw/usb/aspeed-udc.c         | 19 +++++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
index 42916c0bd6..1cfef6dba9 100644
--- a/include/hw/usb/aspeed-udc.h
+++ b/include/hw/usb/aspeed-udc.h
@@ -84,6 +84,7 @@ struct AspeedUDCState {
     uint32_t ep0_setup_len;
     uint32_t ep0_offset;
     uint8_t *ep0_data;
+    bool ep0_in_done;
     bool ep0_dir_in;
 };
 
diff --git a/hw/usb/aspeed-udc.c b/hw/usb/aspeed-udc.c
index 355512822b..6a5d05ce1f 100644
--- a/hw/usb/aspeed-udc.c
+++ b/hw/usb/aspeed-udc.c
@@ -209,10 +209,10 @@ static void aspeed_udc_ep0_tx_ready(AspeedUDCState *s, uint32_t val)
         return;
     }
     s->ep0_offset += n;
-    aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_IN_ACK_MASK);
     if (txlen < ASPEED_UDC_EP0_MAXPKT || s->ep0_offset >= s->ep0_setup_len) {
-        aspeed_udc_ep0_complete(s, s->ep0_offset);
+        s->ep0_in_done = true;
     }
+    aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_IN_ACK_MASK);
 }
 
 static void aspeed_udc_ep0_rx_ready(AspeedUDCState *s)
@@ -222,14 +222,24 @@ static void aspeed_udc_ep0_rx_ready(AspeedUDCState *s)
     uint32_t n;
 
     if (s->ep0_dir_in) {
-        /* Status stage OUT (zero length) for an IN transfer */
-        aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_OUT_ACK_MASK);
+        /*
+         * Status stage OUT (zero length) for an IN transfer.
+         * Send the OUT ACK only after all the IN data is sent.
+         */
+        if (s->ep0_packet && s->ep0_in_done) {
+            aspeed_udc_raise_isr(s, R_UDC_ISR_EP0_OUT_ACK_MASK);
+            aspeed_udc_ep0_complete(s, s->ep0_offset);
+        }
         return;
     }
     /* no control transfer is waiting: nothing to receive */
     if (!s->ep0_packet) {
         return;
     }
+    /* All the OUT data is received. Do not send another OUT ACK. */
+    if (s->ep0_offset >= s->ep0_setup_len) {
+        return;
+    }
 
     /* OUT data stage: hand host data to the guest gadget driver */
     n = MIN(s->ep0_setup_len - s->ep0_offset, ASPEED_UDC_EP0_MAXPKT);
@@ -975,6 +985,7 @@ static void aspeed_udc_gadget_handle_control(USBDevice *udev, USBPacket *p,
     s->ep0_setup_len = length;
     s->ep0_offset = 0;
     s->ep0_dir_in = (type & USB_DIR_IN);
+    s->ep0_in_done = false;
 
     trace_aspeed_udc_ep0_setup(type, req, value, index, length,
                                s->ep0_dir_in, udev->addr);
-- 
2.43.0