2 * Raspberry Pi (BCM2835) SD Host Controller
4 * Copyright (c) 2017 Antfield SAS
7 * Clement Deschamps <clement.deschamps@antfield.fr>
8 * Luc Michel <luc.michel@antfield.fr>
10 * This work is licensed under the terms of the GNU GPL, version 2 or later.
11 * See the COPYING file in the top-level directory.
14 #include "qemu/osdep.h"
16 #include "qemu/module.h"
17 #include "sysemu/blockdev.h"
18 #include "hw/sd/bcm2835_sdhost.h"
21 #define TYPE_BCM2835_SDHOST_BUS "bcm2835-sdhost-bus"
22 #define BCM2835_SDHOST_BUS(obj) \
23 OBJECT_CHECK(SDBus, (obj), TYPE_BCM2835_SDHOST_BUS)
25 #define SDCMD 0x00 /* Command to SD card - 16 R/W */
26 #define SDARG 0x04 /* Argument to SD card - 32 R/W */
27 #define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
28 #define SDCDIV 0x0c /* Start value for clock divider - 11 R/W */
29 #define SDRSP0 0x10 /* SD card rsp (31:0) - 32 R */
30 #define SDRSP1 0x14 /* SD card rsp (63:32) - 32 R */
31 #define SDRSP2 0x18 /* SD card rsp (95:64) - 32 R */
32 #define SDRSP3 0x1c /* SD card rsp (127:96) - 32 R */
33 #define SDHSTS 0x20 /* SD host status - 11 R */
34 #define SDVDD 0x30 /* SD card power control - 1 R/W */
35 #define SDEDM 0x34 /* Emergency Debug Mode - 13 R/W */
36 #define SDHCFG 0x38 /* Host configuration - 2 R/W */
37 #define SDHBCT 0x3c /* Host byte count (debug) - 32 R/W */
38 #define SDDATA 0x40 /* Data to/from SD card - 32 R/W */
39 #define SDHBLC 0x50 /* Host block count (SDIO/SDHC) - 9 R/W */
41 #define SDCMD_NEW_FLAG 0x8000
42 #define SDCMD_FAIL_FLAG 0x4000
43 #define SDCMD_BUSYWAIT 0x800
44 #define SDCMD_NO_RESPONSE 0x400
45 #define SDCMD_LONG_RESPONSE 0x200
46 #define SDCMD_WRITE_CMD 0x80
47 #define SDCMD_READ_CMD 0x40
48 #define SDCMD_CMD_MASK 0x3f
50 #define SDCDIV_MAX_CDIV 0x7ff
52 #define SDHSTS_BUSY_IRPT 0x400
53 #define SDHSTS_BLOCK_IRPT 0x200
54 #define SDHSTS_SDIO_IRPT 0x100
55 #define SDHSTS_REW_TIME_OUT 0x80
56 #define SDHSTS_CMD_TIME_OUT 0x40
57 #define SDHSTS_CRC16_ERROR 0x20
58 #define SDHSTS_CRC7_ERROR 0x10
59 #define SDHSTS_FIFO_ERROR 0x08
62 #define SDHSTS_DATA_FLAG 0x01
64 #define SDHCFG_BUSY_IRPT_EN (1 << 10)
65 #define SDHCFG_BLOCK_IRPT_EN (1 << 8)
66 #define SDHCFG_SDIO_IRPT_EN (1 << 5)
67 #define SDHCFG_DATA_IRPT_EN (1 << 4)
68 #define SDHCFG_SLOW_CARD (1 << 3)
69 #define SDHCFG_WIDE_EXT_BUS (1 << 2)
70 #define SDHCFG_WIDE_INT_BUS (1 << 1)
71 #define SDHCFG_REL_CMD_LINE (1 << 0)
73 #define SDEDM_FORCE_DATA_MODE (1 << 19)
74 #define SDEDM_CLOCK_PULSE (1 << 20)
75 #define SDEDM_BYPASS (1 << 21)
77 #define SDEDM_WRITE_THRESHOLD_SHIFT 9
78 #define SDEDM_READ_THRESHOLD_SHIFT 14
79 #define SDEDM_THRESHOLD_MASK 0x1f
81 #define SDEDM_FSM_MASK 0xf
82 #define SDEDM_FSM_IDENTMODE 0x0
83 #define SDEDM_FSM_DATAMODE 0x1
84 #define SDEDM_FSM_READDATA 0x2
85 #define SDEDM_FSM_WRITEDATA 0x3
86 #define SDEDM_FSM_READWAIT 0x4
87 #define SDEDM_FSM_READCRC 0x5
88 #define SDEDM_FSM_WRITECRC 0x6
89 #define SDEDM_FSM_WRITEWAIT1 0x7
90 #define SDEDM_FSM_POWERDOWN 0x8
91 #define SDEDM_FSM_POWERUP 0x9
92 #define SDEDM_FSM_WRITESTART1 0xa
93 #define SDEDM_FSM_WRITESTART2 0xb
94 #define SDEDM_FSM_GENPULSES 0xc
95 #define SDEDM_FSM_WRITEWAIT2 0xd
96 #define SDEDM_FSM_STARTPOWDOWN 0xf
98 #define SDDATA_FIFO_WORDS 16
100 static void bcm2835_sdhost_update_irq(BCM2835SDHostState
*s
)
102 uint32_t irq
= s
->status
&
103 (SDHSTS_BUSY_IRPT
| SDHSTS_BLOCK_IRPT
| SDHSTS_SDIO_IRPT
);
104 trace_bcm2835_sdhost_update_irq(irq
);
105 qemu_set_irq(s
->irq
, !!irq
);
108 static void bcm2835_sdhost_send_command(BCM2835SDHostState
*s
)
114 request
.cmd
= s
->cmd
& SDCMD_CMD_MASK
;
115 request
.arg
= s
->cmdarg
;
117 rlen
= sdbus_do_command(&s
->sdbus
, &request
, rsp
);
121 if (!(s
->cmd
& SDCMD_NO_RESPONSE
)) {
122 if (rlen
== 0 || (rlen
== 4 && (s
->cmd
& SDCMD_LONG_RESPONSE
))) {
125 if (rlen
!= 4 && rlen
!= 16) {
129 s
->rsp
[0] = ldl_be_p(&rsp
[0]);
130 s
->rsp
[1] = s
->rsp
[2] = s
->rsp
[3] = 0;
132 s
->rsp
[0] = ldl_be_p(&rsp
[12]);
133 s
->rsp
[1] = ldl_be_p(&rsp
[8]);
134 s
->rsp
[2] = ldl_be_p(&rsp
[4]);
135 s
->rsp
[3] = ldl_be_p(&rsp
[0]);
138 /* We never really delay commands, so if this was a 'busywait' command
139 * then we've completed it now and can raise the interrupt.
141 if ((s
->cmd
& SDCMD_BUSYWAIT
) && (s
->config
& SDHCFG_BUSY_IRPT_EN
)) {
142 s
->status
|= SDHSTS_BUSY_IRPT
;
147 s
->cmd
|= SDCMD_FAIL_FLAG
;
148 s
->status
|= SDHSTS_CMD_TIME_OUT
;
151 static void bcm2835_sdhost_fifo_push(BCM2835SDHostState
*s
, uint32_t value
)
155 if (s
->fifo_len
== BCM2835_SDHOST_FIFO_LEN
) {
159 n
= (s
->fifo_pos
+ s
->fifo_len
) & (BCM2835_SDHOST_FIFO_LEN
- 1);
164 static uint32_t bcm2835_sdhost_fifo_pop(BCM2835SDHostState
*s
)
168 if (s
->fifo_len
== 0) {
172 value
= s
->fifo
[s
->fifo_pos
];
174 s
->fifo_pos
= (s
->fifo_pos
+ 1) & (BCM2835_SDHOST_FIFO_LEN
- 1);
178 static void bcm2835_sdhost_fifo_run(BCM2835SDHostState
*s
)
185 is_read
= (s
->cmd
& SDCMD_READ_CMD
) != 0;
186 is_write
= (s
->cmd
& SDCMD_WRITE_CMD
) != 0;
187 if (s
->datacnt
!= 0 && (is_write
|| sdbus_data_ready(&s
->sdbus
))) {
190 while (s
->datacnt
&& s
->fifo_len
< BCM2835_SDHOST_FIFO_LEN
) {
191 value
|= (uint32_t)sdbus_read_data(&s
->sdbus
) << (n
* 8);
195 bcm2835_sdhost_fifo_push(s
, value
);
196 s
->status
|= SDHSTS_DATA_FLAG
;
197 if (s
->config
& SDHCFG_DATA_IRPT_EN
) {
198 s
->status
|= SDHSTS_SDIO_IRPT
;
205 bcm2835_sdhost_fifo_push(s
, value
);
206 s
->status
|= SDHSTS_DATA_FLAG
;
207 if (s
->config
& SDHCFG_DATA_IRPT_EN
) {
208 s
->status
|= SDHSTS_SDIO_IRPT
;
211 } else if (is_write
) { /* write */
213 while (s
->datacnt
> 0 && (s
->fifo_len
> 0 || n
> 0)) {
215 value
= bcm2835_sdhost_fifo_pop(s
);
216 s
->status
|= SDHSTS_DATA_FLAG
;
217 if (s
->config
& SDHCFG_DATA_IRPT_EN
) {
218 s
->status
|= SDHSTS_SDIO_IRPT
;
224 sdbus_write_data(&s
->sdbus
, value
& 0xff);
228 if (s
->datacnt
== 0) {
229 s
->edm
&= ~SDEDM_FSM_MASK
;
230 s
->edm
|= SDEDM_FSM_DATAMODE
;
231 trace_bcm2835_sdhost_edm_change("datacnt 0", s
->edm
);
234 /* set block interrupt at end of each block transfer */
235 if (s
->hbct
&& s
->datacnt
% s
->hbct
== 0 &&
236 (s
->config
& SDHCFG_BLOCK_IRPT_EN
)) {
237 s
->status
|= SDHSTS_BLOCK_IRPT
;
239 /* set data interrupt after each transfer */
240 s
->status
|= SDHSTS_DATA_FLAG
;
241 if (s
->config
& SDHCFG_DATA_IRPT_EN
) {
242 s
->status
|= SDHSTS_SDIO_IRPT
;
247 bcm2835_sdhost_update_irq(s
);
249 s
->edm
&= ~(0x1f << 4);
250 s
->edm
|= ((s
->fifo_len
& 0x1f) << 4);
251 trace_bcm2835_sdhost_edm_change("fifo run", s
->edm
);
254 static uint64_t bcm2835_sdhost_read(void *opaque
, hwaddr offset
,
257 BCM2835SDHostState
*s
= (BCM2835SDHostState
*)opaque
;
286 res
= bcm2835_sdhost_fifo_pop(s
);
287 bcm2835_sdhost_fifo_run(s
);
297 qemu_log_mask(LOG_GUEST_ERROR
, "%s: Bad offset %"HWADDR_PRIx
"\n",
303 trace_bcm2835_sdhost_read(offset
, res
, size
);
308 static void bcm2835_sdhost_write(void *opaque
, hwaddr offset
,
309 uint64_t value
, unsigned size
)
311 BCM2835SDHostState
*s
= (BCM2835SDHostState
*)opaque
;
313 trace_bcm2835_sdhost_write(offset
, value
, size
);
318 if (value
& SDCMD_NEW_FLAG
) {
319 bcm2835_sdhost_send_command(s
);
320 bcm2835_sdhost_fifo_run(s
);
321 s
->cmd
&= ~SDCMD_NEW_FLAG
;
330 bcm2835_sdhost_update_irq(s
);
336 if ((value
& 0xf) == 0xf) {
341 trace_bcm2835_sdhost_edm_change("guest register write", s
->edm
);
345 bcm2835_sdhost_fifo_run(s
);
351 bcm2835_sdhost_fifo_push(s
, value
);
352 bcm2835_sdhost_fifo_run(s
);
359 s
->datacnt
= s
->hblc
* s
->hbct
;
360 bcm2835_sdhost_fifo_run(s
);
364 qemu_log_mask(LOG_GUEST_ERROR
, "%s: Bad offset %"HWADDR_PRIx
"\n",
370 static const MemoryRegionOps bcm2835_sdhost_ops
= {
371 .read
= bcm2835_sdhost_read
,
372 .write
= bcm2835_sdhost_write
,
373 .endianness
= DEVICE_NATIVE_ENDIAN
,
376 static const VMStateDescription vmstate_bcm2835_sdhost
= {
377 .name
= TYPE_BCM2835_SDHOST
,
379 .minimum_version_id
= 1,
380 .fields
= (VMStateField
[]) {
381 VMSTATE_UINT32(cmd
, BCM2835SDHostState
),
382 VMSTATE_UINT32(cmdarg
, BCM2835SDHostState
),
383 VMSTATE_UINT32(status
, BCM2835SDHostState
),
384 VMSTATE_UINT32_ARRAY(rsp
, BCM2835SDHostState
, 4),
385 VMSTATE_UINT32(config
, BCM2835SDHostState
),
386 VMSTATE_UINT32(edm
, BCM2835SDHostState
),
387 VMSTATE_UINT32(vdd
, BCM2835SDHostState
),
388 VMSTATE_UINT32(hbct
, BCM2835SDHostState
),
389 VMSTATE_UINT32(hblc
, BCM2835SDHostState
),
390 VMSTATE_INT32(fifo_pos
, BCM2835SDHostState
),
391 VMSTATE_INT32(fifo_len
, BCM2835SDHostState
),
392 VMSTATE_UINT32_ARRAY(fifo
, BCM2835SDHostState
, BCM2835_SDHOST_FIFO_LEN
),
393 VMSTATE_UINT32(datacnt
, BCM2835SDHostState
),
394 VMSTATE_END_OF_LIST()
398 static void bcm2835_sdhost_init(Object
*obj
)
400 BCM2835SDHostState
*s
= BCM2835_SDHOST(obj
);
402 qbus_create_inplace(&s
->sdbus
, sizeof(s
->sdbus
),
403 TYPE_BCM2835_SDHOST_BUS
, DEVICE(s
), "sd-bus");
405 memory_region_init_io(&s
->iomem
, obj
, &bcm2835_sdhost_ops
, s
,
406 TYPE_BCM2835_SDHOST
, 0x1000);
407 sysbus_init_mmio(SYS_BUS_DEVICE(s
), &s
->iomem
);
408 sysbus_init_irq(SYS_BUS_DEVICE(s
), &s
->irq
);
411 static void bcm2835_sdhost_reset(DeviceState
*dev
)
413 BCM2835SDHostState
*s
= BCM2835_SDHOST(dev
);
418 trace_bcm2835_sdhost_edm_change("device reset", s
->edm
);
427 static void bcm2835_sdhost_class_init(ObjectClass
*klass
, void *data
)
429 DeviceClass
*dc
= DEVICE_CLASS(klass
);
431 dc
->reset
= bcm2835_sdhost_reset
;
432 dc
->vmsd
= &vmstate_bcm2835_sdhost
;
435 static TypeInfo bcm2835_sdhost_info
= {
436 .name
= TYPE_BCM2835_SDHOST
,
437 .parent
= TYPE_SYS_BUS_DEVICE
,
438 .instance_size
= sizeof(BCM2835SDHostState
),
439 .class_init
= bcm2835_sdhost_class_init
,
440 .instance_init
= bcm2835_sdhost_init
,
443 static const TypeInfo bcm2835_sdhost_bus_info
= {
444 .name
= TYPE_BCM2835_SDHOST_BUS
,
445 .parent
= TYPE_SD_BUS
,
446 .instance_size
= sizeof(SDBus
),
449 static void bcm2835_sdhost_register_types(void)
451 type_register_static(&bcm2835_sdhost_info
);
452 type_register_static(&bcm2835_sdhost_bus_info
);
455 type_init(bcm2835_sdhost_register_types
)