hw/pl181.c

   1 /*
   2  * Arm PrimeCell PL181 MultiMedia Card Interface
   3  *
   4  * Copyright (c) 2007 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the GPL.
   8  */
   9
  10 #include "sysemu/blockdev.h"
  11 #include "hw/sysbus.h"
  12 #include "hw/sd.h"
  13
  14 //#define DEBUG_PL181 1
  15
  16 #ifdef DEBUG_PL181
  17 #define DPRINTF(fmt, ...) \
  18 do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0)
  19 #else
  20 #define DPRINTF(fmt, ...) do {} while(0)
  21 #endif
  22
  23 #define PL181_FIFO_LEN 16
  24
  25 typedef struct {
  26     SysBusDevice busdev;
  27     MemoryRegion iomem;
  28     SDState *card;
  29     uint32_t clock;
  30     uint32_t power;
  31     uint32_t cmdarg;
  32     uint32_t cmd;
  33     uint32_t datatimer;
  34     uint32_t datalength;
  35     uint32_t respcmd;
  36     uint32_t response[4];
  37     uint32_t datactrl;
  38     uint32_t datacnt;
  39     uint32_t status;
  40     uint32_t mask[2];
  41     int32_t fifo_pos;
  42     int32_t fifo_len;
  43     /* The linux 2.6.21 driver is buggy, and misbehaves if new data arrives
  44        while it is reading the FIFO.  We hack around this be defering
  45        subsequent transfers until after the driver polls the status word.
  46        http://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=4446/1
  47      */
  48     int32_t linux_hack;
  49     uint32_t fifo[PL181_FIFO_LEN];
  50     qemu_irq irq[2];
  51     /* GPIO outputs for 'card is readonly' and 'card inserted' */
  52     qemu_irq cardstatus[2];
  53 } pl181_state;
  54
  55 static const VMStateDescription vmstate_pl181 = {
  56     .name = "pl181",
  57     .version_id = 1,
  58     .minimum_version_id = 1,
  59     .fields = (VMStateField[]) {
  60         VMSTATE_UINT32(clock, pl181_state),
  61         VMSTATE_UINT32(power, pl181_state),
  62         VMSTATE_UINT32(cmdarg, pl181_state),
  63         VMSTATE_UINT32(cmd, pl181_state),
  64         VMSTATE_UINT32(datatimer, pl181_state),
  65         VMSTATE_UINT32(datalength, pl181_state),
  66         VMSTATE_UINT32(respcmd, pl181_state),
  67         VMSTATE_UINT32_ARRAY(response, pl181_state, 4),
  68         VMSTATE_UINT32(datactrl, pl181_state),
  69         VMSTATE_UINT32(datacnt, pl181_state),
  70         VMSTATE_UINT32(status, pl181_state),
  71         VMSTATE_UINT32_ARRAY(mask, pl181_state, 2),
  72         VMSTATE_INT32(fifo_pos, pl181_state),
  73         VMSTATE_INT32(fifo_len, pl181_state),
  74         VMSTATE_INT32(linux_hack, pl181_state),
  75         VMSTATE_UINT32_ARRAY(fifo, pl181_state, PL181_FIFO_LEN),
  76         VMSTATE_END_OF_LIST()
  77     }
  78 };
  79
  80 #define PL181_CMD_INDEX     0x3f
  81 #define PL181_CMD_RESPONSE  (1 << 6)
  82 #define PL181_CMD_LONGRESP  (1 << 7)
  83 #define PL181_CMD_INTERRUPT (1 << 8)
  84 #define PL181_CMD_PENDING   (1 << 9)
  85 #define PL181_CMD_ENABLE    (1 << 10)
  86
  87 #define PL181_DATA_ENABLE             (1 << 0)
  88 #define PL181_DATA_DIRECTION          (1 << 1)
  89 #define PL181_DATA_MODE               (1 << 2)
  90 #define PL181_DATA_DMAENABLE          (1 << 3)
  91
  92 #define PL181_STATUS_CMDCRCFAIL       (1 << 0)
  93 #define PL181_STATUS_DATACRCFAIL      (1 << 1)
  94 #define PL181_STATUS_CMDTIMEOUT       (1 << 2)
  95 #define PL181_STATUS_DATATIMEOUT      (1 << 3)
  96 #define PL181_STATUS_TXUNDERRUN       (1 << 4)
  97 #define PL181_STATUS_RXOVERRUN        (1 << 5)
  98 #define PL181_STATUS_CMDRESPEND       (1 << 6)
  99 #define PL181_STATUS_CMDSENT          (1 << 7)
 100 #define PL181_STATUS_DATAEND          (1 << 8)
 101 #define PL181_STATUS_DATABLOCKEND     (1 << 10)
 102 #define PL181_STATUS_CMDACTIVE        (1 << 11)
 103 #define PL181_STATUS_TXACTIVE         (1 << 12)
 104 #define PL181_STATUS_RXACTIVE         (1 << 13)
 105 #define PL181_STATUS_TXFIFOHALFEMPTY  (1 << 14)
 106 #define PL181_STATUS_RXFIFOHALFFULL   (1 << 15)
 107 #define PL181_STATUS_TXFIFOFULL       (1 << 16)
 108 #define PL181_STATUS_RXFIFOFULL       (1 << 17)
 109 #define PL181_STATUS_TXFIFOEMPTY      (1 << 18)
 110 #define PL181_STATUS_RXFIFOEMPTY      (1 << 19)
 111 #define PL181_STATUS_TXDATAAVLBL      (1 << 20)
 112 #define PL181_STATUS_RXDATAAVLBL      (1 << 21)
 113
 114 #define PL181_STATUS_TX_FIFO (PL181_STATUS_TXACTIVE \
 115                              |PL181_STATUS_TXFIFOHALFEMPTY \
 116                              |PL181_STATUS_TXFIFOFULL \
 117                              |PL181_STATUS_TXFIFOEMPTY \
 118                              |PL181_STATUS_TXDATAAVLBL)
 119 #define PL181_STATUS_RX_FIFO (PL181_STATUS_RXACTIVE \
 120                              |PL181_STATUS_RXFIFOHALFFULL \
 121                              |PL181_STATUS_RXFIFOFULL \
 122                              |PL181_STATUS_RXFIFOEMPTY \
 123                              |PL181_STATUS_RXDATAAVLBL)
 124
 125 static const unsigned char pl181_id[] =
 126 { 0x81, 0x11, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
 127
 128 static void pl181_update(pl181_state *s)
 129 {
 130     int i;
 131     for (i = 0; i < 2; i++) {
 132         qemu_set_irq(s->irq[i], (s->status & s->mask[i]) != 0);
 133     }
 134 }
 135
 136 static void pl181_fifo_push(pl181_state *s, uint32_t value)
 137 {
 138     int n;
 139
 140     if (s->fifo_len == PL181_FIFO_LEN) {
 141         fprintf(stderr, "pl181: FIFO overflow\n");
 142         return;
 143     }
 144     n = (s->fifo_pos + s->fifo_len) & (PL181_FIFO_LEN - 1);
 145     s->fifo_len++;
 146     s->fifo[n] = value;
 147     DPRINTF("FIFO push %08x\n", (int)value);
 148 }
 149
 150 static uint32_t pl181_fifo_pop(pl181_state *s)
 151 {
 152     uint32_t value;
 153
 154     if (s->fifo_len == 0) {
 155         fprintf(stderr, "pl181: FIFO underflow\n");
 156         return 0;
 157     }
 158     value = s->fifo[s->fifo_pos];
 159     s->fifo_len--;
 160     s->fifo_pos = (s->fifo_pos + 1) & (PL181_FIFO_LEN - 1);
 161     DPRINTF("FIFO pop %08x\n", (int)value);
 162     return value;
 163 }
 164
 165 static void pl181_send_command(pl181_state *s)
 166 {
 167     SDRequest request;
 168     uint8_t response[16];
 169     int rlen;
 170
 171     request.cmd = s->cmd & PL181_CMD_INDEX;
 172     request.arg = s->cmdarg;
 173     DPRINTF("Command %d %08x\n", request.cmd, request.arg);
 174     rlen = sd_do_command(s->card, &request, response);
 175     if (rlen < 0)
 176         goto error;
 177     if (s->cmd & PL181_CMD_RESPONSE) {
 178 #define RWORD(n) ((response[n] << 24) | (response[n + 1] << 16) \
 179                   | (response[n + 2] << 8) | response[n + 3])
 180         if (rlen == 0 || (rlen == 4 && (s->cmd & PL181_CMD_LONGRESP)))
 181             goto error;
 182         if (rlen != 4 && rlen != 16)
 183             goto error;
 184         s->response[0] = RWORD(0);
 185         if (rlen == 4) {
 186             s->response[1] = s->response[2] = s->response[3] = 0;
 187         } else {
 188             s->response[1] = RWORD(4);
 189             s->response[2] = RWORD(8);
 190             s->response[3] = RWORD(12) & ~1;
 191         }
 192         DPRINTF("Response received\n");
 193         s->status |= PL181_STATUS_CMDRESPEND;
 194 #undef RWORD
 195     } else {
 196         DPRINTF("Command sent\n");
 197         s->status |= PL181_STATUS_CMDSENT;
 198     }
 199     return;
 200
 201 error:
 202     DPRINTF("Timeout\n");
 203     s->status |= PL181_STATUS_CMDTIMEOUT;
 204 }
 205
 206 /* Transfer data between the card and the FIFO.  This is complicated by
 207    the FIFO holding 32-bit words and the card taking data in single byte
 208    chunks.  FIFO bytes are transferred in little-endian order.  */
 209
 210 static void pl181_fifo_run(pl181_state *s)
 211 {
 212     uint32_t bits;
 213     uint32_t value = 0;
 214     int n;
 215     int is_read;
 216
 217     is_read = (s->datactrl & PL181_DATA_DIRECTION) != 0;
 218     if (s->datacnt != 0 && (!is_read || sd_data_ready(s->card))
 219             && !s->linux_hack) {
 220         if (is_read) {
 221             n = 0;
 222             while (s->datacnt && s->fifo_len < PL181_FIFO_LEN) {
 223                 value |= (uint32_t)sd_read_data(s->card) << (n * 8);
 224                 s->datacnt--;
 225                 n++;
 226                 if (n == 4) {
 227                     pl181_fifo_push(s, value);
 228                     n = 0;
 229                     value = 0;
 230                 }
 231             }
 232             if (n != 0) {
 233                 pl181_fifo_push(s, value);
 234             }
 235         } else { /* write */
 236             n = 0;
 237             while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) {
 238                 if (n == 0) {
 239                     value = pl181_fifo_pop(s);
 240                     n = 4;
 241                 }
 242                 n--;
 243                 s->datacnt--;
 244                 sd_write_data(s->card, value & 0xff);
 245                 value >>= 8;
 246             }
 247         }
 248     }
 249     s->status &= ~(PL181_STATUS_RX_FIFO | PL181_STATUS_TX_FIFO);
 250     if (s->datacnt == 0) {
 251         s->status |= PL181_STATUS_DATAEND;
 252         /* HACK: */
 253         s->status |= PL181_STATUS_DATABLOCKEND;
 254         DPRINTF("Transfer Complete\n");
 255     }
 256     if (s->datacnt == 0 && s->fifo_len == 0) {
 257         s->datactrl &= ~PL181_DATA_ENABLE;
 258         DPRINTF("Data engine idle\n");
 259     } else {
 260         /* Update FIFO bits.  */
 261         bits = PL181_STATUS_TXACTIVE | PL181_STATUS_RXACTIVE;
 262         if (s->fifo_len == 0) {
 263             bits |= PL181_STATUS_TXFIFOEMPTY;
 264             bits |= PL181_STATUS_RXFIFOEMPTY;
 265         } else {
 266             bits |= PL181_STATUS_TXDATAAVLBL;
 267             bits |= PL181_STATUS_RXDATAAVLBL;
 268         }
 269         if (s->fifo_len == 16) {
 270             bits |= PL181_STATUS_TXFIFOFULL;
 271             bits |= PL181_STATUS_RXFIFOFULL;
 272         }
 273         if (s->fifo_len <= 8) {
 274             bits |= PL181_STATUS_TXFIFOHALFEMPTY;
 275         }
 276         if (s->fifo_len >= 8) {
 277             bits |= PL181_STATUS_RXFIFOHALFFULL;
 278         }
 279         if (s->datactrl & PL181_DATA_DIRECTION) {
 280             bits &= PL181_STATUS_RX_FIFO;
 281         } else {
 282             bits &= PL181_STATUS_TX_FIFO;
 283         }
 284         s->status |= bits;
 285     }
 286 }
 287
 288 static uint64_t pl181_read(void *opaque, hwaddr offset,
 289                            unsigned size)
 290 {
 291     pl181_state *s = (pl181_state *)opaque;
 292     uint32_t tmp;
 293
 294     if (offset >= 0xfe0 && offset < 0x1000) {
 295         return pl181_id[(offset - 0xfe0) >> 2];
 296     }
 297     switch (offset) {
 298     case 0x00: /* Power */
 299         return s->power;
 300     case 0x04: /* Clock */
 301         return s->clock;
 302     case 0x08: /* Argument */
 303         return s->cmdarg;
 304     case 0x0c: /* Command */
 305         return s->cmd;
 306     case 0x10: /* RespCmd */
 307         return s->respcmd;
 308     case 0x14: /* Response0 */
 309         return s->response[0];
 310     case 0x18: /* Response1 */
 311         return s->response[1];
 312     case 0x1c: /* Response2 */
 313         return s->response[2];
 314     case 0x20: /* Response3 */
 315         return s->response[3];
 316     case 0x24: /* DataTimer */
 317         return s->datatimer;
 318     case 0x28: /* DataLength */
 319         return s->datalength;
 320     case 0x2c: /* DataCtrl */
 321         return s->datactrl;
 322     case 0x30: /* DataCnt */
 323         return s->datacnt;
 324     case 0x34: /* Status */
 325         tmp = s->status;
 326         if (s->linux_hack) {
 327             s->linux_hack = 0;
 328             pl181_fifo_run(s);
 329             pl181_update(s);
 330         }
 331         return tmp;
 332     case 0x3c: /* Mask0 */
 333         return s->mask[0];
 334     case 0x40: /* Mask1 */
 335         return s->mask[1];
 336     case 0x48: /* FifoCnt */
 337         /* The documentation is somewhat vague about exactly what FifoCnt
 338            does.  On real hardware it appears to be when decrememnted
 339            when a word is transferred between the FIFO and the serial
 340            data engine.  DataCnt is decremented after each byte is
 341            transferred between the serial engine and the card.
 342            We don't emulate this level of detail, so both can be the same.  */
 343         tmp = (s->datacnt + 3) >> 2;
 344         if (s->linux_hack) {
 345             s->linux_hack = 0;
 346             pl181_fifo_run(s);
 347             pl181_update(s);
 348         }
 349         return tmp;
 350     case 0x80: case 0x84: case 0x88: case 0x8c: /* FifoData */
 351     case 0x90: case 0x94: case 0x98: case 0x9c:
 352     case 0xa0: case 0xa4: case 0xa8: case 0xac:
 353     case 0xb0: case 0xb4: case 0xb8: case 0xbc:
 354         if (s->fifo_len == 0) {
 355             qemu_log_mask(LOG_GUEST_ERROR, "pl181: Unexpected FIFO read\n");
 356             return 0;
 357         } else {
 358             uint32_t value;
 359             value = pl181_fifo_pop(s);
 360             s->linux_hack = 1;
 361             pl181_fifo_run(s);
 362             pl181_update(s);
 363             return value;
 364         }
 365     default:
 366         qemu_log_mask(LOG_GUEST_ERROR,
 367                       "pl181_read: Bad offset %x\n", (int)offset);
 368         return 0;
 369     }
 370 }
 371
 372 static void pl181_write(void *opaque, hwaddr offset,
 373                         uint64_t value, unsigned size)
 374 {
 375     pl181_state *s = (pl181_state *)opaque;
 376
 377     switch (offset) {
 378     case 0x00: /* Power */
 379         s->power = value & 0xff;
 380         break;
 381     case 0x04: /* Clock */
 382         s->clock = value & 0xff;
 383         break;
 384     case 0x08: /* Argument */
 385         s->cmdarg = value;
 386         break;
 387     case 0x0c: /* Command */
 388         s->cmd = value;
 389         if (s->cmd & PL181_CMD_ENABLE) {
 390             if (s->cmd & PL181_CMD_INTERRUPT) {
 391                 qemu_log_mask(LOG_UNIMP,
 392                               "pl181: Interrupt mode not implemented\n");
 393             } if (s->cmd & PL181_CMD_PENDING) {
 394                 qemu_log_mask(LOG_UNIMP,
 395                               "pl181: Pending commands not implemented\n");
 396             } else {
 397                 pl181_send_command(s);
 398                 pl181_fifo_run(s);
 399             }
 400             /* The command has completed one way or the other.  */
 401             s->cmd &= ~PL181_CMD_ENABLE;
 402         }
 403         break;
 404     case 0x24: /* DataTimer */
 405         s->datatimer = value;
 406         break;
 407     case 0x28: /* DataLength */
 408         s->datalength = value & 0xffff;
 409         break;
 410     case 0x2c: /* DataCtrl */
 411         s->datactrl = value & 0xff;
 412         if (value & PL181_DATA_ENABLE) {
 413             s->datacnt = s->datalength;
 414             pl181_fifo_run(s);
 415         }
 416         break;
 417     case 0x38: /* Clear */
 418         s->status &= ~(value & 0x7ff);
 419         break;
 420     case 0x3c: /* Mask0 */
 421         s->mask[0] = value;
 422         break;
 423     case 0x40: /* Mask1 */
 424         s->mask[1] = value;
 425         break;
 426     case 0x80: case 0x84: case 0x88: case 0x8c: /* FifoData */
 427     case 0x90: case 0x94: case 0x98: case 0x9c:
 428     case 0xa0: case 0xa4: case 0xa8: case 0xac:
 429     case 0xb0: case 0xb4: case 0xb8: case 0xbc:
 430         if (s->datacnt == 0) {
 431             qemu_log_mask(LOG_GUEST_ERROR, "pl181: Unexpected FIFO write\n");
 432         } else {
 433             pl181_fifo_push(s, value);
 434             pl181_fifo_run(s);
 435         }
 436         break;
 437     default:
 438         qemu_log_mask(LOG_GUEST_ERROR,
 439                       "pl181_write: Bad offset %x\n", (int)offset);
 440     }
 441     pl181_update(s);
 442 }
 443
 444 static const MemoryRegionOps pl181_ops = {
 445     .read = pl181_read,
 446     .write = pl181_write,
 447     .endianness = DEVICE_NATIVE_ENDIAN,
 448 };
 449
 450 static void pl181_reset(DeviceState *d)
 451 {
 452     pl181_state *s = DO_UPCAST(pl181_state, busdev.qdev, d);
 453
 454     s->power = 0;
 455     s->cmdarg = 0;
 456     s->cmd = 0;
 457     s->datatimer = 0;
 458     s->datalength = 0;
 459     s->respcmd = 0;
 460     s->response[0] = 0;
 461     s->response[1] = 0;
 462     s->response[2] = 0;
 463     s->response[3] = 0;
 464     s->datatimer = 0;
 465     s->datalength = 0;
 466     s->datactrl = 0;
 467     s->datacnt = 0;
 468     s->status = 0;
 469     s->linux_hack = 0;
 470     s->mask[0] = 0;
 471     s->mask[1] = 0;
 472
 473     /* We can assume our GPIO outputs have been wired up now */
 474     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
 475 }
 476
 477 static int pl181_init(SysBusDevice *dev)
 478 {
 479     pl181_state *s = FROM_SYSBUS(pl181_state, dev);
 480     DriveInfo *dinfo;
 481
 482     memory_region_init_io(&s->iomem, &pl181_ops, s, "pl181", 0x1000);
 483     sysbus_init_mmio(dev, &s->iomem);
 484     sysbus_init_irq(dev, &s->irq[0]);
 485     sysbus_init_irq(dev, &s->irq[1]);
 486     qdev_init_gpio_out(&s->busdev.qdev, s->cardstatus, 2);
 487     dinfo = drive_get_next(IF_SD);
 488     s->card = sd_init(dinfo ? dinfo->bdrv : NULL, 0);
 489     return 0;
 490 }
 491
 492 static void pl181_class_init(ObjectClass *klass, void *data)
 493 {
 494     SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
 495     DeviceClass *k = DEVICE_CLASS(klass);
 496
 497     sdc->init = pl181_init;
 498     k->vmsd = &vmstate_pl181;
 499     k->reset = pl181_reset;
 500     k->no_user = 1;
 501 }
 502
 503 static const TypeInfo pl181_info = {
 504     .name          = "pl181",
 505     .parent        = TYPE_SYS_BUS_DEVICE,
 506     .instance_size = sizeof(pl181_state),
 507     .class_init    = pl181_class_init,
 508 };
 509
 510 static void pl181_register_types(void)
 511 {
 512     type_register_static(&pl181_info);
 513 }
 514
 515 type_init(pl181_register_types)