diff mbox

[U-Boot,v5,2/2] qi_lb60: add software usbboot support

Message ID 1350007160-16383-3-git-send-email-xiangfu@openmobilefree.net
State Changes Requested
Delegated to: Daniel Schwierzeck
Headers show

Commit Message

Xiangfu Liu Oct. 12, 2012, 1:59 a.m. UTC
From: Xiangfu <xiangfu@openmobilefree.net>

  JZ4740 CPU have a internal ROM have such kind of code, that make
  JZ4740 can boot from USB

  usbboot.S can downloads user program from the USB port to internal
  SRAM and branches to the internal SRAM to execute the program

Signed-off-by: Xiangfu <xiangfu@openmobilefree.net>
---
 board/qi/qi_lb60/qi_lb60-spl.c |   20 +
 board/qi/qi_lb60/usbboot.S     |  838 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 858 insertions(+)
 create mode 100644 board/qi/qi_lb60/usbboot.S

Comments

Marek Vasut Oct. 13, 2012, 3:01 a.m. UTC | #1
Dear xiangfu@openmobilefree.net,

> From: Xiangfu <xiangfu@openmobilefree.net>
> 
>   JZ4740 CPU have a internal ROM have such kind of code, that make
>   JZ4740 can boot from USB
> 
>   usbboot.S can downloads user program from the USB port to internal
>   SRAM and branches to the internal SRAM to execute the program
> 
> Signed-off-by: Xiangfu <xiangfu@openmobilefree.net>
> ---
>  board/qi/qi_lb60/qi_lb60-spl.c |   20 +
>  board/qi/qi_lb60/usbboot.S     |  838
> ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 858
> insertions(+)
>  create mode 100644 board/qi/qi_lb60/usbboot.S
> 
[...]

UGH. Simply ... UGH.

Can that assembler blob not be rewritten into C ?

Best regards,
Marek Vasut
Xiangfu Liu Oct. 13, 2012, 12:20 p.m. UTC | #2
Hi Marek

This file was wrote by Ingenic people. I don't have time to convert it to
C(I am not very good in mips assembler). the .S file implement basic USB
stack.  this C code (
http://projects.qi-hardware.com/index.php/p/xburst-tools/source/tree/master/xbboot)
implement the host app. the host app source code even clear then the
original Ingenic document. so feel free to send patch.

Xiangfu

On Sat, Oct 13, 2012 at 11:01 AM, Marek Vasut <marex@denx.de> wrote:

> Dear xiangfu@openmobilefree.net,
>
> > From: Xiangfu <xiangfu@openmobilefree.net>
> >
> >   JZ4740 CPU have a internal ROM have such kind of code, that make
> >   JZ4740 can boot from USB
> >
> >   usbboot.S can downloads user program from the USB port to internal
> >   SRAM and branches to the internal SRAM to execute the program
> >
> > Signed-off-by: Xiangfu <xiangfu@openmobilefree.net>
> > ---
> >  board/qi/qi_lb60/qi_lb60-spl.c |   20 +
> >  board/qi/qi_lb60/usbboot.S     |  838
> > ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 858
> > insertions(+)
> >  create mode 100644 board/qi/qi_lb60/usbboot.S
> >
> [...]
>
> UGH. Simply ... UGH.
>
> Can that assembler blob not be rewritten into C ?
>
> Best regards,
> Marek Vasut
>
Marek Vasut Oct. 13, 2012, 12:23 p.m. UTC | #3
Dear xiangfu liu,

> Hi Marek
> 
> This file was wrote by Ingenic people. I don't have time to convert it to
> C(I am not very good in mips assembler). the .S file implement basic USB
> stack.

We already do have an USB stack.

> this C code (
> http://projects.qi-hardware.com/index.php/p/xburst-tools/source/tree/master
> /xbboot) implement the host app. the host app source code even clear then
> the original Ingenic document. so feel free to send patch.

Sorry, but it is my duty as a USB custodian to NAK patches which try to 
circumvent the constant effort to keep the code clean. Obviously, implementing 
yet another USB stack is violation of this.

> Xiangfu
> 
> On Sat, Oct 13, 2012 at 11:01 AM, Marek Vasut <marex@denx.de> wrote:
> > Dear xiangfu@openmobilefree.net,
> > 
> > > From: Xiangfu <xiangfu@openmobilefree.net>
> > > 
> > >   JZ4740 CPU have a internal ROM have such kind of code, that make
> > >   JZ4740 can boot from USB
> > >   
> > >   usbboot.S can downloads user program from the USB port to internal
> > >   SRAM and branches to the internal SRAM to execute the program
> > > 
> > > Signed-off-by: Xiangfu <xiangfu@openmobilefree.net>
> > > ---
> > > 
> > >  board/qi/qi_lb60/qi_lb60-spl.c |   20 +
> > >  board/qi/qi_lb60/usbboot.S     |  838
> > > 
> > > ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 858
> > > insertions(+)
> > > 
> > >  create mode 100644 board/qi/qi_lb60/usbboot.S
> > 
> > [...]
> > 
> > UGH. Simply ... UGH.
> > 
> > Can that assembler blob not be rewritten into C ?
> > 
> > Best regards,
> > Marek Vasut

Best regards,
Marek Vasut
Xiangfu Liu Oct. 13, 2012, 12:46 p.m. UTC | #4
Hi Marek

On Sat, Oct 13, 2012 at 8:23 PM, Marek Vasut <marex@denx.de> wrote:

> Dear xiangfu liu,
>
> > Hi Marek
> >
> > This file was wrote by Ingenic people. I don't have time to convert it to
> > C(I am not very good in mips assembler). the .S file implement basic USB
> > stack.
>
> We already do have an USB stack.
>

This usbboot.S implement a very base usb-client protocol and it implement a
jz4740 hardware feature. (jz4740 have a hard-code rom inside cpu. that have
the same feature, they named it 'boot from usb'). so this usbboot.S is for
implement the same feature in a software way. and I think this usbboot.S can
move to 'arch/mips/cpu/xburst/spl/jz4740_usbboot.s' in future. and I don't
think
it will impact with other usb code in u-boot.


>
> > this C code (
> >
> http://projects.qi-hardware.com/index.php/p/xburst-tools/source/tree/master
> > /xbboot) implement the host app. the host app source code even clear then
> > the original Ingenic document. so feel free to send patch.
>
> Sorry, but it is my duty as a USB custodian to NAK patches which try to
> circumvent the constant effort to keep the code clean. Obviously,
> implementing
> yet another USB stack is violation of this.
>

Yes. I understand your duty. and keep a project code clean is not easy.
thanks for
feedback. (I never look into u-boot usb code. don't have much experience on
u-boot
usb structure. :)

All the best
Xiangfu
Marek Vasut Oct. 13, 2012, 12:52 p.m. UTC | #5
Dear xiangfu liu,

> Hi Marek
> 
> On Sat, Oct 13, 2012 at 8:23 PM, Marek Vasut <marex@denx.de> wrote:
> > Dear xiangfu liu,
> > 
> > > Hi Marek
> > > 
> > > This file was wrote by Ingenic people. I don't have time to convert it
> > > to C(I am not very good in mips assembler). the .S file implement
> > > basic USB stack.
> > 
> > We already do have an USB stack.
> 
> This usbboot.S implement a very base usb-client protocol and it implement a
> jz4740 hardware feature.

We have that too -- see drivers/usb/gadget/

> (jz4740 have a hard-code rom inside cpu. that have
> the same feature, they named it 'boot from usb'). so this usbboot.S is for
> implement the same feature in a software way.

Won't DFU work then?

> and I think this usbboot.S
> can move to 'arch/mips/cpu/xburst/spl/jz4740_usbboot.s' in future. and I
> don't think
> it will impact with other usb code in u-boot.

That's even worse, the USB code shall be in drivers/usb/

> > > this C code (
> > 
> > http://projects.qi-hardware.com/index.php/p/xburst-tools/source/tree/mast
> > er
> > 
> > > /xbboot) implement the host app. the host app source code even clear
> > > then the original Ingenic document. so feel free to send patch.
> > 
> > Sorry, but it is my duty as a USB custodian to NAK patches which try to
> > circumvent the constant effort to keep the code clean. Obviously,
> > implementing
> > yet another USB stack is violation of this.
> 
> Yes. I understand your duty. and keep a project code clean is not easy.
> thanks for
> feedback. (I never look into u-boot usb code. don't have much experience on
> u-boot
> usb structure. :)
> 
> All the best
> Xiangfu

Best regards,
Marek Vasut
Xiangfu Liu Oct. 13, 2012, 1:11 p.m. UTC | #6
On 10/13/2012 08:52 PM, Marek Vasut wrote:
> Dear xiangfu liu,
> 
>> > Hi Marek
>> > 
>> > On Sat, Oct 13, 2012 at 8:23 PM, Marek Vasut <marex@denx.de> wrote:
>>> > > Dear xiangfu liu,
>>> > > 
>>>> > > > Hi Marek
>>>> > > > 
>>>> > > > This file was wrote by Ingenic people. I don't have time to convert it
>>>> > > > to C(I am not very good in mips assembler). the .S file implement
>>>> > > > basic USB stack.
>>> > > 
>>> > > We already do have an USB stack.
>> > 
>> > This usbboot.S implement a very base usb-client protocol and it implement a
>> > jz4740 hardware feature.
> We have that too -- see drivers/usb/gadget/

Hi Marek

I will look into this issue later, try to integrate this jz4740 feature with 
u-boot usb structure. but I am not sure that if I can finish this fast. wait my
patches on jz4740 software usb boot. :)

> 
>> > (jz4740 have a hard-code rom inside cpu. that have
>> > the same feature, they named it 'boot from usb'). so this usbboot.S is for
>> > implement the same feature in a software way.
> Won't DFU work then?
> 

I know this DFU. but it will different with the hardware-feature.

Thanks again for feedback.
Xiangfu
diff mbox

Patch

diff --git a/board/qi/qi_lb60/qi_lb60-spl.c b/board/qi/qi_lb60/qi_lb60-spl.c
index 3fe3fa3..aea459c 100644
--- a/board/qi/qi_lb60/qi_lb60-spl.c
+++ b/board/qi/qi_lb60/qi_lb60-spl.c
@@ -12,6 +12,24 @@ 
 #include <asm/io.h>
 #include <asm/jz4740.h>
 
+#define KEY_U_OUT       (32 * 2 + 16)
+#define KEY_U_IN        (32 * 3 + 19)
+
+extern void usb_boot(void);
+
+static void check_usb_boot(void)
+{
+	__gpio_as_input(KEY_U_IN);
+	__gpio_enable_pull(KEY_U_IN);
+	__gpio_as_output(KEY_U_OUT);
+	__gpio_clear_pin(KEY_U_OUT);
+
+	if (!__gpio_get_pin(KEY_U_IN)) {
+		puts("[U] pressed, goto USBBOOT mode\n");
+		usb_boot();
+	}
+}
+
 void nand_spl_boot(void)
 {
 	__gpio_as_sdram_16bit_4720();
@@ -23,6 +41,8 @@  void nand_spl_boot(void)
 	pll_init();
 	sdram_init();
 
+	check_usb_boot();
+
 	nand_init();
 
 	puts("\nQi LB60 SPL: Starting U-Boot ...\n");
diff --git a/board/qi/qi_lb60/usbboot.S b/board/qi/qi_lb60/usbboot.S
new file mode 100644
index 0000000..c872266
--- /dev/null
+++ b/board/qi/qi_lb60/usbboot.S
@@ -0,0 +1,838 @@ 
+/*
+ *  for jz4740 usb boot
+ *
+ *  Copyright (c) 2009 Author: <jlwei@ingenic.cn>
+ *
+ * See file CREDITS for list of people who contributed to this
+ * project.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+    .set noreorder
+    .globl usb_boot
+    .text
+
+/*
+ * Both NAND and USB boot load data to D-Cache first, then transfer
+ * data from D-Cache to I-Cache, and jump to execute the code in I-Cache.
+ * So init caches first and then dispatch to a proper boot routine.
+ */
+
+.macro load_addr reg addr
+	li \reg, 0x80000000
+	addiu \reg, \reg, \addr
+	la $2, usbboot_begin
+	subu \reg, \reg, $2
+.endm
+
+usb_boot:
+	/* Initialize PLL: set ICLK to 84MHz and HCLK to 42MHz. */
+	la	$9, 0xB0000000		/* CPCCR: Clock Control Register */
+	la	$8, 0x42041110		/* I:S:M:P=1:2:2:2 */
+	sw	$8, 0($9)
+
+	la	$9, 0xB0000010		/* CPPCR: PLL Control Register */
+	la	$8, 0x06000120		/* M=12 N=0 D=0 CLK=12*(M+2)/(N+2) */
+	sw	$8, 0($9)
+
+	mtc0	$0, $26		/* CP0_ERRCTL, restore WST reset state */
+	nop
+
+	mtc0	$0, $16			/* CP0_CONFIG */
+	nop
+
+	/* Relocate code to beginning of the ram */
+
+	la $2, usbboot_begin
+	la $3, usbboot_end
+	li $4, 0x80000000
+
+1:
+	lw $5, 0($2)
+	sw $5, 0($4)
+	addiu $2, $2, 4
+	bne $2, $3, 1b
+	addiu $4, $4, 4
+
+	li $2, 0x80000000
+	ori $3, $2, 0
+	addiu $3, $3, usbboot_end
+	la $4, usbboot_begin
+	subu $3, $3, $4
+
+
+2:
+	cache	0x0, 0($2)		/* Index_Invalidate_I */
+	cache	0x1, 0($2)		/* Index_Writeback_Inv_D */
+	addiu	$2, $2, 32
+	subu $4, $3, $2
+	bgtz	$4, 2b
+	nop
+
+	load_addr $3, usb_boot_return
+
+	jr $3
+
+usbboot_begin:
+
+init_caches:
+	li	$2, 3			/* cacheable for kseg0 access */
+	mtc0	$2, $16			/* CP0_CONFIG */
+	nop
+
+	li	$2, 0x20000000		/* enable idx-store-data cache insn */
+	mtc0	$2, $26			/* CP0_ERRCTL */
+
+	ori	$2, $28, 0		/* start address */
+	ori	$3, $2, 0x3fe0		/* end address, total 16KB */
+	mtc0	$0, $28, 0		/* CP0_TAGLO */
+	mtc0	$0, $28, 1		/* CP0_DATALO */
+cache_clear_a_line:
+	cache	0x8, 0($2)		/* Index_Store_Tag_I */
+	cache	0x9, 0($2)		/* Index_Store_Tag_D */
+	bne	$2, $3, cache_clear_a_line
+	addiu	$2, $2, 32		/* increment CACHE_LINE_SIZE */
+
+	ori	$2, $28, 0		/* start address */
+	ori	$3, $2, 0x3fe0		/* end address, total 16KB */
+	la	$4, 0x1ffff000		/* physical address and 4KB page mask */
+cache_alloc_a_line:
+	and	$5, $2, $4
+	ori	$5, $5, 1		/* V bit of the physical tag */
+	mtc0	$5, $28, 0		/* CP0_TAGLO */
+	cache	0x8, 0($2)		/* Index_Store_Tag_I */
+	cache	0x9, 0($2)		/* Index_Store_Tag_D */
+	bne	$2, $3, cache_alloc_a_line
+	addiu	$2, $2, 32		/* increment CACHE_LINE_SIZE */
+
+	nop
+	nop
+	nop
+	/*
+	 * Transfer data from dcache to icache, then jump to icache.
+	 * Input parameters:
+	 * $19: data length in bytes
+	 * $20: jump target address
+	 */
+xfer_d2i:
+
+	ori	$8, $20, 0
+	addu	$9, $8, $19		/* total 16KB */
+
+1:
+	cache	0x0, 0($8)		/* Index_Invalidate_I */
+	cache	0x1, 0($8)		/* Index_Writeback_Inv_D */
+	bne	$8, $9, 1b
+	addiu	$8, $8, 32
+
+	/* flush write-buffer */
+	sync
+
+	/* Invalidate BTB */
+	mfc0	$8, $16, 7		/* CP0_CONFIG */
+	nop
+	ori	$8, 2
+	mtc0	$8, $16, 7
+	nop
+
+	/* Overwrite config to disable ram initalisation */
+	li $2, 0xff
+	sb $2, 20($20)
+
+	jalr	$20
+	nop
+
+icache_return:
+	/* User code can return to here after executing itself in
+	  icache, by jumping to $31. */
+	b	usb_boot_return
+	nop
+
+
+usb_boot_return:
+	/* Enable the USB PHY */
+	la	$9, 0xB0000024		/* CPM_SCR */
+	lw	$8, 0($9)
+	ori	$8, 0x40		/* USBPHY_ENABLE */
+	sw	$8, 0($9)
+
+	/* Initialize USB registers */
+	la	$27, 0xb3040000	/* USB registers base address */
+
+	sb	$0, 0x0b($27)	/* INTRUSBE: disable common USB interrupts */
+	sh	$0, 0x06($27)	/* INTRINE: disable EPIN interrutps */
+	sh	$0, 0x08($27)	/* INTROUTE: disable EPOUT interrutps */
+
+	li	$9, 0x61
+	sb	$9, 0x01($27)	/* POWER: HSENAB | SUSPENDM | SOFTCONN */
+
+	/* Initialize USB states */
+	li	$22, 0			/* set EP0 to IDLE state */
+	li	$23, 1			/* no data stage */
+
+	/* Main loop of polling the usb commands */
+usb_command_loop:
+	lbu	$9, 0x0a($27)		/* read INTRUSB */
+	andi	$9, 0x04		/* check USB_INTR_RESET */
+	beqz	$9, check_intr_ep0in
+	nop
+
+ 	/* 1. Handle USB reset interrupt */
+handle_reset_intr:
+	lbu	$9, 0x01($27)		/* read POWER */
+	andi	$9, 0x10		/* test HS_MODE */
+	bnez	$9, _usb_set_maxpktsize
+	li	$9, 512			/* max packet size of HS mode */
+	li	$9, 64			/* max packet size of FS mode */
+
+_usb_set_maxpktsize:
+	li	$8, 1
+	sb	$8, 0x0e($27)		/* set INDEX 1 */
+
+	sh	$9, 0x10($27)		/* INMAXP */
+	sb	$0, 0x13($27)		/* INCSRH */
+	sh	$9, 0x14($27)		/* OUTMAXP */
+	sb	$0, 0x17($27)		/* OUTCSRH */
+
+_usb_flush_fifo:
+	li	$8, 0x48		/* INCSR_CDT && INCSR_FF */
+	sb	$8, 0x12($27)		/* INCSR */
+	li	$8, 0x90		/* OUTCSR_CDT && OUTCSR_FF */
+	sb	$8, 0x16($27)		/* OUTCSR */
+
+	li	$22, 0			/* set EP0 to IDLE state */
+	li	$23, 1			/* no data stage */
+
+	/* 2. Check and handle EP0 interrupt */
+check_intr_ep0in:
+	lhu	$10, 0x02($27)		/* read INTRIN */
+	andi	$9, $10, 0x1		/* check EP0 interrupt */
+	beqz	$9, check_intr_ep1in
+	nop
+
+handle_ep0_intr:
+	sb	$0, 0x0e($27)		/* set INDEX 0 */
+	lbu	$11, 0x12($27)		/* read CSR0 */
+
+	andi	$9, $11, 0x04		/* check SENTSTALL */
+	beqz	$9, _ep0_setupend
+	nop
+
+_ep0_sentstall:
+	andi	$9, $11, 0xdb
+	sb	$9, 0x12($27)		/* clear SENDSTALL and SENTSTALL */
+	li	$22, 0			/* set EP0 to IDLE state */
+
+_ep0_setupend:
+	andi	$9, $11, 0x10		/* check SETUPEND */
+	beqz	$9, ep0_idle_state
+	nop
+
+	ori	$9, $11, 0x80
+	sb	$9, 0x12($27)		/* set SVDSETUPEND */
+	li	$22, 0			/* set EP0 to IDLE state */
+
+ep0_idle_state:
+	bnez	$22, ep0_tx_state
+	nop
+
+	/* 2.1 Handle EP0 IDLE state interrupt */
+	andi	$9, $11, 0x01		/* check OUTPKTRDY */
+	beqz	$9, check_intr_ep1in
+	nop
+
+	/* Read 8-bytes setup packet from the FIFO */
+	lw	$25, 0x20($27)		/* first word of setup packet */
+	lw	$26, 0x20($27)		/* second word of setup packet */
+
+	andi	$9, $25, 0x60		/* bRequestType & USB_TYPE_MASK */
+	beqz	$9, _ep0_std_req
+	nop
+
+	/* 2.1.1 Vendor-specific setup request */
+_ep0_vend_req:
+	li	$22, 0			/* set EP0 to IDLE state */
+	li	$23, 1			/* NoData = 1 */
+
+	andi	$9, $25, 0xff00		/* check bRequest */
+	srl	$9, $9, 8
+	beqz	$9, __ep0_get_cpu_info
+	sub	$8, $9, 0x1
+	beqz	$8, __ep0_set_data_address
+	sub	$8, $9, 0x2
+	beqz	$8, __ep0_set_data_length
+	sub	$8, $9, 0x3
+	beqz	$8, __ep0_flush_caches
+	sub	$8, $9, 0x4
+	beqz	$8, __ep0_prog_start1
+	sub	$8, $9, 0x5
+	beqz	$8, __ep0_prog_start2
+	nop
+	b	_ep0_idle_state_fini	/* invalid request */
+	nop
+
+__ep0_get_cpu_info:
+	load_addr $20, cpu_info_data	/* data pointer to transfer */
+	li	$21, 8			/* bytes left to transfer */
+	li	$22, 1			/* set EP0 to TX state */
+	li	$23, 0			/* NoData = 0 */
+
+	b	_ep0_idle_state_fini
+	nop
+
+__ep0_set_data_address:
+	li	$9, 0xffff0000
+	and	$9, $25, $9
+	andi	$8, $26, 0xffff
+	or	$20, $9, $8		/* data address of next transfer */
+
+	b	_ep0_idle_state_fini
+	nop
+
+__ep0_set_data_length:
+	li	$9, 0xffff0000
+	and	$9, $25, $9
+	andi	$8, $26, 0xffff
+	or	$21, $9, $8		/* data length of next transfer */
+
+	li	$9, 0x48		/* SVDOUTPKTRDY and DATAEND */
+	sb	$9, 0x12($27)		/* CSR0 */
+
+	/* We must write packet to FIFO before EP1-IN interrupt here. */
+	b	handle_epin1_intr
+	nop
+
+__ep0_flush_caches:
+	/* Flush dcache and invalidate icache. */
+	li	$8, 0x80000000
+	addi	$9, $8, 0x3fe0		/* total 16KB */
+
+1:
+	cache	0x0, 0($8)		/* Index_Invalidate_I */
+	cache	0x1, 0($8)		/* Index_Writeback_Inv_D */
+	bne	$8, $9, 1b
+	addiu	$8, $8, 32
+
+	/* flush write-buffer */
+	sync
+
+	/* Invalidate BTB */
+	mfc0	$8, $16, 7		/* CP0_CONFIG */
+	nop
+	ori	$8, 2
+	mtc0	$8, $16, 7
+	nop
+
+	b	_ep0_idle_state_fini
+	nop
+
+__ep0_prog_start1:
+	li	$9, 0x48		/* SVDOUTPKTRDY and DATAEND */
+	sb	$9, 0x12($27)		/* CSR0 */
+
+	li	$9, 0xffff0000
+	and	$9, $25, $9
+	andi	$8, $26, 0xffff
+	or	$20, $9, $8		/* target address */
+
+	b	xfer_d2i
+	li	$19, 0x2000		/* 16KB data length */
+
+__ep0_prog_start2:
+	li	$9, 0x48		/* SVDOUTPKTRDY and DATAEND */
+	sb	$9, 0x12($27)		/* CSR0 */
+
+	li	$9, 0xffff0000
+	and	$9, $25, $9
+	andi	$8, $26, 0xffff
+	or	$20, $9, $8		/* target address */
+
+	jalr	$20		/* jump, and place the return address in $31 */
+	nop
+
+__ep0_prog_start2_return:
+/* User code can return to here after executing itself, by jumping to $31 */
+	b	usb_boot_return
+	nop
+
+	/* 2.1.2 Standard setup request */
+_ep0_std_req:
+	andi	$12, $25, 0xff00	/* check bRequest */
+	srl	$12, $12, 8
+	sub	$9, $12, 0x05		/* check USB_REQ_SET_ADDRESS */
+	bnez	$9, __ep0_req_set_config
+	nop
+
+	/* Handle USB_REQ_SET_ADDRESS */
+__ep0_req_set_addr:
+	srl	$9, $25, 16		/* get wValue */
+	sb	$9, 0x0($27)		/* set FADDR */
+	li	$23, 1			/* NoData = 1 */
+	b	_ep0_idle_state_fini
+	nop
+
+__ep0_req_set_config:
+	sub	$9, $12, 0x09		/* check USB_REQ_SET_CONFIGURATION */
+	bnez	$9, __ep0_req_get_desc
+	nop
+
+	/* Handle USB_REQ_SET_CONFIGURATION */
+	li	$23, 1			/* NoData = 1 */
+	b	_ep0_idle_state_fini
+	nop
+
+__ep0_req_get_desc:
+	sub	$9, $12, 0x06		/* check USB_REQ_GET_DESCRIPTOR */
+	bnez	$9, _ep0_idle_state_fini
+	li	$23, 1			/* NoData = 1 */
+
+	/* Handle USB_REQ_GET_DESCRIPTOR */
+	li	$23, 0			/* NoData = 0 */
+
+	srl	$9, $25, 24		/* wValue >> 8 */
+	sub	$8, $9, 0x01		/* check USB_DT_DEVICE */
+	beqz	$8, ___ep0_get_dev_desc
+	srl	$21, $26, 16		/* get wLength */
+	sub	$8, $9, 0x02		/* check USB_DT_CONFIG */
+	beqz	$8, ___ep0_get_conf_desc
+	sub	$8, $9, 0x03		/* check USB_DT_STRING */
+	beqz	$8, ___ep0_get_string_desc
+	sub	$8, $9, 0x06		/* check USB_DT_DEVICE_QUALIFIER */
+	beqz	$8, ___ep0_get_dev_qualifier
+	nop
+	b	_ep0_idle_state_fini
+	nop
+
+___ep0_get_dev_desc:
+	load_addr	$20, device_desc	/* data pointer */
+	li	$22, 1			/* set EP0 to TX state */
+	sub	$8, $21, 18
+	blez	$8, _ep0_idle_state_fini /* wLength <= 18 */
+	nop
+	li	$21, 18			/* max length of device_desc */
+	b	_ep0_idle_state_fini
+	nop
+
+___ep0_get_dev_qualifier:
+	load_addr	$20, dev_qualifier	/* data pointer */
+	li	$22, 1			/* set EP0 to TX state */
+	sub	$8, $21, 10
+	blez	$8, _ep0_idle_state_fini /* wLength <= 10 */
+	nop
+	li	$21, 10			/* max length of dev_qualifier */
+	b	_ep0_idle_state_fini
+	nop
+
+___ep0_get_conf_desc:
+	load_addr	$20, config_desc_fs	/* data pointer of FS mode */
+	lbu	$8, 0x01($27)		/* read POWER */
+	andi	$8, 0x10		/* test HS_MODE */
+	beqz	$8, ___ep0_get_conf_desc2
+	nop
+	load_addr $20, config_desc_hs	/* data pointer of HS mode */
+
+___ep0_get_conf_desc2:
+	li	$22, 1			/* set EP0 to TX state */
+	sub	$8, $21, 32
+	blez	$8, _ep0_idle_state_fini /* wLength <= 32 */
+	nop
+	li	$21, 32			/* max length of config_desc */
+	b	_ep0_idle_state_fini
+	nop
+
+___ep0_get_string_desc:
+	li	$22, 1			/* set EP0 to TX state */
+
+	srl	$9, $25, 16		/* wValue & 0xff */
+	andi	$9, 0xff
+
+	sub	$8, $9, 1
+	beqz	$8, ___ep0_get_string_manufacture
+	sub	$8, $9, 2
+	beqz	$8, ___ep0_get_string_product
+	nop
+
+___ep0_get_string_lang_ids:
+	load_addr	$20, string_lang_ids	/* data pointer */
+	b	_ep0_idle_state_fini
+	li	$21, 4			/* data length */
+
+___ep0_get_string_manufacture:
+	load_addr	$20, string_manufacture	/* data pointer */
+	b	_ep0_idle_state_fini
+	li	$21, 16			/* data length */
+
+___ep0_get_string_product:
+	load_addr	$20, string_product	/* data pointer */
+	b	_ep0_idle_state_fini
+	li	$21, 46			/* data length */
+
+_ep0_idle_state_fini:
+	li	$9, 0x40		/* SVDOUTPKTRDY */
+	beqz	$23, _ep0_idle_state_fini2
+	nop
+	ori	$9, $9, 0x08		/* DATAEND */
+_ep0_idle_state_fini2:
+	sb	$9, 0x12($27)		/* CSR0 */
+	beqz	$22, check_intr_ep1in
+	nop
+
+	/* 2.2 Handle EP0 TX state interrupt */
+ep0_tx_state:
+	sub	$9, $22, 1
+	bnez	$9, check_intr_ep1in
+	nop
+
+	sub	$9, $21, 64		/* max packetsize */
+	blez	$9, _ep0_tx_state2	/* data count <= 64 */
+	ori	$19, $21, 0
+	li	$19, 64
+
+_ep0_tx_state2:
+	beqz	$19, _ep0_tx_state3	/* send ZLP */
+	ori	$18, $19, 0		/* record bytes to be transferred */
+	sub	$21, $21, $19		/* decrement data count */
+
+_ep0_fifo_write_loop:
+	lbu	$9, 0($20)		/* read data */
+	sb	$9, 0x20($27)		/* load FIFO */
+	sub	$19, $19, 1		/* decrement counter */
+	bnez	$19, _ep0_fifo_write_loop
+	addi	$20, $20, 1		/* increment data pointer */
+
+	sub	$9, $18, 64		/* max packetsize */
+	beqz	$9, _ep0_tx_state4
+	nop
+
+_ep0_tx_state3:
+	/* transferred bytes < max packetsize */
+	li	$9, 0x0a		/* set INPKTRDY and DATAEND */
+	sb	$9, 0x12($27)		/* CSR0 */
+	li	$22, 0			/* set EP0 to IDLE state */
+	b	check_intr_ep1in
+	nop
+
+_ep0_tx_state4:
+	/* transferred bytes == max packetsize */
+	li	$9, 0x02		/* set INPKTRDY */
+	sb	$9, 0x12($27)		/* CSR0 */
+	b	check_intr_ep1in
+	nop
+
+	/* 3. Check and handle EP1 BULK-IN interrupt */
+check_intr_ep1in:
+	andi	$9, $10, 0x2		/* check EP1 IN interrupt */
+	beqz	$9, check_intr_ep1out
+	nop
+
+handle_epin1_intr:
+	li	$9, 1
+	sb	$9, 0x0e($27)		/* set INDEX 1 */
+	lbu	$9, 0x12($27)		/* read INCSR */
+
+	andi	$8, $9, 0x2		/* check INCSR_FFNOTEMPT */
+	bnez	$8, _epin1_tx_state4
+	nop
+
+_epin1_write_fifo:
+	lhu	$9, 0x10($27)		/* get INMAXP */
+	sub	$8, $21, $9
+	blez	$8, _epin1_tx_state1	/* bytes left <= INMAXP */
+	ori	$19, $21, 0
+	ori	$19, $9, 0
+
+_epin1_tx_state1:
+	beqz	$19, _epin1_tx_state4	/* No data */
+	nop
+
+	sub	$21, $21, $19		/* decrement data count */
+
+	srl	$5, $19, 2		/* # of word */
+	andi	$6, $19, 0x3		/* # of byte */
+	beqz	$5, _epin1_tx_state2
+	nop
+
+_epin1_fifo_write_word:
+	lw	$9, 0($20)		/* read data from source address */
+	sw	$9, 0x24($27)		/* write FIFO */
+	sub	$5, $5, 1		/* decrement counter */
+	bnez	$5, _epin1_fifo_write_word
+	addiu	$20, $20, 4		/* increment dest address */
+
+_epin1_tx_state2:
+	beqz	$6, _epin1_tx_state3
+	nop
+
+_epin1_fifo_write_byte:
+	lbu	$9, 0($20)		/* read data from source address */
+	sb	$9, 0x24($27)		/* write FIFO */
+	sub	$6, $6, 1		/* decrement counter */
+	bnez	$6, _epin1_fifo_write_byte
+	addiu	$20, $20, 1		/* increment dest address */
+
+_epin1_tx_state3:
+	li	$9, 0x1
+	sb	$9, 0x12($27)		/* INCSR, set INPKTRDY */
+
+_epin1_tx_state4:
+	/* 4. Check and handle EP1 BULK-OUT interrupt */
+check_intr_ep1out:
+	lhu	$9, 0x04($27)		/* read INTROUT */
+	andi	$9, 0x2
+	beqz	$9, check_status_next
+	nop
+
+handle_epout1_intr:
+	li	$9, 1
+	sb	$9, 0x0e($27)		/* set INDEX 1 */
+
+	lbu	$9, 0x16($27)		/* read OUTCSR */
+	andi	$9, 0x1			/* check OUTPKTRDY */
+	beqz	$9, check_status_next
+	nop
+
+_epout1_read_fifo:
+	lhu	$19, 0x18($27)		/* read OUTCOUNT */
+	srl	$5, $19, 2		/* # of word */
+	andi	$6, $19, 0x3		/* # of byte */
+	beqz	$5, _epout1_rx_state1
+	nop
+
+_epout1_fifo_read_word:
+	lw	$9, 0x24($27)		/* read FIFO */
+	sw	$9, 0($20)		/* store to dest address */
+	sub	$5, $5, 1		/* decrement counter */
+	bnez	$5, _epout1_fifo_read_word
+	addiu	$20, $20, 4		/* increment dest address */
+
+_epout1_rx_state1:
+	beqz	$6, _epout1_rx_state2
+	nop
+
+_epout1_fifo_read_byte:
+	lbu	$9, 0x24($27)		/* read FIFO */
+	sb	$9, 0($20)		/* store to dest address */
+	sub	$6, $6, 1		/* decrement counter */
+	bnez	$6, _epout1_fifo_read_byte
+	addiu	$20, $20, 1		/* increment dest address */
+
+_epout1_rx_state2:
+	sb	$0, 0x16($27)		/* clear OUTPKTRDY */
+
+check_status_next:
+	b	usb_command_loop
+	nop
+
+/* Device/Configuration/Interface/Endpoint/String Descriptors */
+
+	.align	2
+device_desc:
+	.byte	0x12		/* bLength */
+	.byte	0x01		/* bDescriptorType */
+	.byte	0x00		/* bcdUSB */
+	.byte	0x02		/* bcdUSB */
+	.byte	0x00		/* bDeviceClass */
+	.byte	0x00		/* bDeviceSubClass */
+	.byte	0x00		/* bDeviceProtocol */
+	.byte	0x40		/* bMaxPacketSize0 */
+	.byte	0x1a		/* idVendor */
+	.byte	0x60		/* idVendor */
+	.byte	0x40		/* idProduct */
+	.byte	0x47		/* idProduct */
+	.byte	0x00		/* bcdDevice */
+	.byte	0x01		/* bcdDevice */
+	.byte	0x01		/* iManufacturer */
+	.byte	0x02		/* iProduct */
+	.byte	0x00		/* iSerialNumber */
+	.byte	0x01		/* bNumConfigurations */
+
+	.align	2
+dev_qualifier:
+	.byte	0x0a		/* bLength */
+	.byte	0x06		/* bDescriptorType */
+	.byte	0x00		/* bcdUSB */
+	.byte	0x02		/* bcdUSB */
+	.byte	0x00		/* bDeviceClass */
+	.byte	0x00		/* bDeviceSubClass */
+	.byte	0x00		/* bDeviceProtocol */
+	.byte	0x40		/* bMaxPacketSize0 */
+	.byte	0x01		/* bNumConfigurations */
+	.byte	0x00		/* bRESERVED */
+
+	.align	2
+config_desc_hs:
+	.byte	0x09		/* bLength */
+	.byte	0x02		/* bDescriptorType */
+	.byte	0x20		/* wTotalLength */
+	.byte	0x00		/* wTotalLength */
+	.byte	0x01		/* bNumInterfaces */
+	.byte	0x01		/* bConfigurationValue */
+	.byte	0x00		/* iConfiguration */
+	.byte	0xc0		/* bmAttributes */
+	.byte	0x01		/* MaxPower */
+intf_desc_hs:
+	.byte	0x09		/* bLength */
+	.byte	0x04		/* bDescriptorType */
+	.byte	0x00		/* bInterfaceNumber */
+	.byte	0x00		/* bAlternateSetting */
+	.byte	0x02		/* bNumEndpoints */
+	.byte	0xff		/* bInterfaceClass */
+	.byte	0x00		/* bInterfaceSubClass */
+	.byte	0x50		/* bInterfaceProtocol */
+	.byte	0x00		/* iInterface */
+ep1_desc_hs:
+	.byte	0x07		/* bLength */
+	.byte	0x05		/* bDescriptorType */
+	.byte	0x01		/* bEndpointAddress */
+	.byte	0x02		/* bmAttributes */
+	.byte	0x00		/* wMaxPacketSize */
+	.byte	0x02		/* wMaxPacketSize */
+	.byte	0x00		/* bInterval */
+ep2_desc_hs:
+	.byte	0x07		/* bLength */
+	.byte	0x05		/* bDescriptorType */
+	.byte	0x81		/* bEndpointAddress */
+	.byte	0x02		/* bmAttributes */
+	.byte	0x00		/* wMaxPacketSize */
+	.byte	0x02		/* wMaxPacketSize */
+	.byte	0x00		/* bInterval */
+
+	.align	2
+config_desc_fs:
+	.byte	0x09		/* bLength */
+	.byte	0x02		/* bDescriptorType */
+	.byte	0x20		/* wTotalLength */
+	.byte	0x00		/* wTotalLength */
+	.byte	0x01		/* bNumInterfaces */
+	.byte	0x01		/* bConfigurationValue */
+	.byte	0x00		/* iConfiguration */
+	.byte	0xc0		/* bmAttributes */
+	.byte	0x01		/* MaxPower */
+intf_desc_fs:
+	.byte	0x09		/* bLength */
+	.byte	0x04		/* bDescriptorType */
+	.byte	0x00		/* bInterfaceNumber */
+	.byte	0x00		/* bAlternateSetting */
+	.byte	0x02		/* bNumEndpoints */
+	.byte	0xff		/* bInterfaceClass */
+	.byte	0x00		/* bInterfaceSubClass */
+	.byte	0x50		/* bInterfaceProtocol */
+	.byte	0x00		/* iInterface */
+ep1_desc_fs:
+	.byte	0x07		/* bLength */
+	.byte	0x05		/* bDescriptorType */
+	.byte	0x01		/* bEndpointAddress */
+	.byte	0x02		/* bmAttributes */
+	.byte	0x40		/* wMaxPacketSize */
+	.byte	0x00		/* wMaxPacketSize */
+	.byte	0x00		/* bInterval */
+ep2_desc_fs:
+	.byte	0x07		/* bLength */
+	.byte	0x05		/* bDescriptorType */
+	.byte	0x81		/* bEndpointAddress */
+	.byte	0x02		/* bmAttributes */
+	.byte	0x40		/* wMaxPacketSize */
+	.byte	0x00		/* wMaxPacketSize */
+	.byte	0x00		/* bInterval */
+
+	.align	2
+string_lang_ids:
+	.byte	0x04
+	.byte	0x03
+	.byte	0x09
+	.byte	0x04
+
+	.align	2
+string_manufacture:
+	.byte	0x10
+	.byte	0x03
+	.byte	0x49
+	.byte	0x00
+	.byte	0x6e
+	.byte	0x00
+	.byte	0x67
+	.byte	0x00
+	.byte	0x65
+	.byte	0x00
+	.byte	0x6e
+	.byte	0x00
+	.byte	0x69
+	.byte	0x00
+	.byte	0x63
+	.byte	0x00
+
+	.align	2
+string_product:
+	.byte	0x2e
+	.byte	0x03
+	.byte	0x4a
+	.byte	0x00
+	.byte	0x5a
+	.byte	0x00
+	.byte	0x34
+	.byte	0x00
+	.byte	0x37
+	.byte	0x00
+	.byte	0x34
+	.byte	0x00
+	.byte	0x30
+	.byte	0x00
+	.byte	0x20
+	.byte	0x00
+	.byte	0x55
+	.byte	0x00
+	.byte	0x53
+	.byte	0x00
+	.byte	0x42
+	.byte	0x00
+	.byte	0x20
+	.byte	0x00
+	.byte	0x42
+	.byte	0x00
+	.byte	0x6f
+	.byte	0x00
+	.byte	0x6f
+	.byte	0x00
+	.byte	0x74
+	.byte	0x00
+	.byte	0x20
+	.byte	0x00
+	.byte	0x44
+	.byte	0x00
+	.byte	0x65
+	.byte	0x00
+	.byte	0x76
+	.byte	0x00
+	.byte	0x69
+	.byte	0x00
+	.byte	0x63
+	.byte	0x00
+	.byte	0x65
+	.byte	0x00
+
+	.align	2
+cpu_info_data:
+	.byte	0x4a
+	.byte	0x5a
+	.byte	0x34
+	.byte	0x37
+	.byte	0x34
+	.byte	0x30
+	.byte	0x56
+	.byte	0x31
+usbboot_end:
+
+    .set reorder