hw/sd/bcm2835_emmc.c

   1 /*
   2  * Raspberry Pi emulation (c) 2012 Gregory Estrade
   3  * This code is licensed under the GNU GPLv2 and later.
   4  */
   5
   6 #include "sysemu/blockdev.h"
   7 #include "hw/sd/bcm2835_emmc.h"
   8
   9 /*
  10  * Controller registers
  11  */
  12
  13 #define SDHCI_DMA_ADDRESS   0x00
  14 #define SDHCI_ARGUMENT2     SDHCI_DMA_ADDRESS
  15
  16 #define SDHCI_BLOCK_SIZE    0x04
  17 #define  SDHCI_MAKE_BLKSZ(dma, blksz) (((dma & 0x7) << 12) | (blksz & 0xFFF))
  18
  19 #define SDHCI_BLOCK_COUNT   0x06
  20
  21 #define SDHCI_ARGUMENT      0x08
  22
  23 #define SDHCI_TRANSFER_MODE 0x0C
  24 #define  SDHCI_TRNS_DMA     0x01
  25 #define  SDHCI_TRNS_BLK_CNT_EN  0x02
  26 #define  SDHCI_TRNS_AUTO_CMD12  0x04
  27 #define  SDHCI_TRNS_AUTO_CMD23  0x08
  28 #define  SDHCI_TRNS_READ    0x10
  29 #define  SDHCI_TRNS_MULTI   0x20
  30
  31 #define SDHCI_COMMAND       0x0E
  32 #define  SDHCI_CMD_RESP_MASK    0x03
  33 #define  SDHCI_CMD_CRC      0x08
  34 #define  SDHCI_CMD_INDEX    0x10
  35 #define  SDHCI_CMD_DATA     0x20
  36 #define  SDHCI_CMD_ABORTCMD 0xC0
  37
  38 #define  SDHCI_CMD_RESP_NONE    0x00
  39 #define  SDHCI_CMD_RESP_LONG    0x01
  40 #define  SDHCI_CMD_RESP_SHORT   0x02
  41 #define  SDHCI_CMD_RESP_SHORT_BUSY 0x03
  42
  43 #define SDHCI_MAKE_CMD(c, f) (((c & 0xff) << 8) | (f & 0xff))
  44 #define SDHCI_GET_CMD(c) ((c>>8) & 0x3f)
  45
  46 #define SDHCI_RESPONSE      0x10
  47
  48 #define SDHCI_BUFFER        0x20
  49
  50 #define SDHCI_PRESENT_STATE 0x24
  51 #define  SDHCI_CMD_INHIBIT  0x00000001
  52 #define  SDHCI_DATA_INHIBIT 0x00000002
  53 #define  SDHCI_DOING_WRITE  0x00000100
  54 #define  SDHCI_DOING_READ   0x00000200
  55 #define  SDHCI_SPACE_AVAILABLE  0x00000400
  56 #define  SDHCI_DATA_AVAILABLE   0x00000800
  57 #define  SDHCI_CARD_PRESENT 0x00010000
  58 #define  SDHCI_WRITE_PROTECT    0x00080000
  59 #define  SDHCI_DATA_LVL_MASK    0x00F00000
  60 #define   SDHCI_DATA_LVL_SHIFT  20
  61
  62 #define SDHCI_HOST_CONTROL  0x28
  63 #define  SDHCI_CTRL_LED     0x01
  64 #define  SDHCI_CTRL_4BITBUS 0x02
  65 #define  SDHCI_CTRL_HISPD   0x04
  66 #define  SDHCI_CTRL_DMA_MASK    0x18
  67 #define   SDHCI_CTRL_SDMA   0x00
  68 #define   SDHCI_CTRL_ADMA1  0x08
  69 #define   SDHCI_CTRL_ADMA32 0x10
  70 #define   SDHCI_CTRL_ADMA64 0x18
  71 #define   SDHCI_CTRL_8BITBUS    0x20
  72
  73 #define SDHCI_POWER_CONTROL 0x29
  74 #define  SDHCI_POWER_ON     0x01
  75 #define  SDHCI_POWER_180    0x0A
  76 #define  SDHCI_POWER_300    0x0C
  77 #define  SDHCI_POWER_330    0x0E
  78
  79 #define SDHCI_BLOCK_GAP_CONTROL 0x2A
  80
  81 #define SDHCI_WAKE_UP_CONTROL   0x2B
  82 #define  SDHCI_WAKE_ON_INT  0x01
  83 #define  SDHCI_WAKE_ON_INSERT   0x02
  84 #define  SDHCI_WAKE_ON_REMOVE   0x04
  85
  86 #define SDHCI_CLOCK_CONTROL 0x2C
  87 #define  SDHCI_DIVIDER_SHIFT    8
  88 #define  SDHCI_DIVIDER_HI_SHIFT 6
  89 #define  SDHCI_DIV_MASK 0xFF
  90 #define  SDHCI_DIV_MASK_LEN 8
  91 #define  SDHCI_DIV_HI_MASK  0x300
  92 #define  SDHCI_PROG_CLOCK_MODE  0x0020
  93 #define  SDHCI_CLOCK_CARD_EN    0x0004
  94 #define  SDHCI_CLOCK_INT_STABLE 0x0002
  95 #define  SDHCI_CLOCK_INT_EN 0x0001
  96
  97 #define SDHCI_TIMEOUT_CONTROL   0x2E
  98
  99 #define SDHCI_SOFTWARE_RESET    0x2F
 100 #define  SDHCI_RESET_ALL    0x01
 101 #define  SDHCI_RESET_CMD    0x02
 102 #define  SDHCI_RESET_DATA   0x04
 103
 104 #define SDHCI_INT_STATUS    0x30
 105 #define SDHCI_INT_ENABLE    0x34
 106 #define SDHCI_SIGNAL_ENABLE 0x38
 107 #define  SDHCI_INT_RESPONSE 0x00000001
 108 #define  SDHCI_INT_DATA_END 0x00000002
 109 #define  SDHCI_INT_DMA_END  0x00000008
 110 #define  SDHCI_INT_SPACE_AVAIL  0x00000010
 111 #define  SDHCI_INT_DATA_AVAIL   0x00000020
 112 #define  SDHCI_INT_CARD_INSERT  0x00000040
 113 #define  SDHCI_INT_CARD_REMOVE  0x00000080
 114 #define  SDHCI_INT_CARD_INT 0x00000100
 115 #define  SDHCI_INT_ERROR    0x00008000
 116 #define  SDHCI_INT_TIMEOUT  0x00010000
 117 #define  SDHCI_INT_CRC      0x00020000
 118 #define  SDHCI_INT_END_BIT  0x00040000
 119 #define  SDHCI_INT_INDEX    0x00080000
 120 #define  SDHCI_INT_DATA_TIMEOUT 0x00100000
 121 #define  SDHCI_INT_DATA_CRC 0x00200000
 122 #define  SDHCI_INT_DATA_END_BIT 0x00400000
 123 #define  SDHCI_INT_BUS_POWER    0x00800000
 124 #define  SDHCI_INT_ACMD12ERR    0x01000000
 125 #define  SDHCI_INT_ADMA_ERROR   0x02000000
 126
 127 #define  SDHCI_INT_NORMAL_MASK  0x00007FFF
 128 #define  SDHCI_INT_ERROR_MASK   0xFFFF8000
 129
 130 #define  SDHCI_INT_CMD_MASK (SDHCI_INT_RESPONSE | SDHCI_INT_TIMEOUT | \
 131         SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX)
 132 #define  SDHCI_INT_DATA_MASK    (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
 133         SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
 134         SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
 135         SDHCI_INT_DATA_END_BIT | SDHCI_INT_ADMA_ERROR)
 136 #define SDHCI_INT_ALL_MASK  ((unsigned int)-1)
 137
 138 /* Per the BCM2835 ARM peripherals document (p76), some interrupts are
 139  * not implemented (reserved) */
 140 #define BCM2835_DISABLED_INTS (SDHCI_INT_DMA_END | SDHCI_INT_CARD_INSERT \
 141                                | SDHCI_INT_CARD_REMOVE)
 142
 143 #define SDHCI_ACMD12_ERR    0x3C
 144
 145 #define SDHCI_HOST_CONTROL2     0x3E
 146 #define  SDHCI_CTRL_UHS_MASK        0x0007
 147 #define   SDHCI_CTRL_UHS_SDR12      0x0000
 148 #define   SDHCI_CTRL_UHS_SDR25      0x0001
 149 #define   SDHCI_CTRL_UHS_SDR50      0x0002
 150 #define   SDHCI_CTRL_UHS_SDR104     0x0003
 151 #define   SDHCI_CTRL_UHS_DDR50      0x0004
 152 #define  SDHCI_CTRL_VDD_180     0x0008
 153 #define  SDHCI_CTRL_DRV_TYPE_MASK   0x0030
 154 #define   SDHCI_CTRL_DRV_TYPE_B     0x0000
 155 #define   SDHCI_CTRL_DRV_TYPE_A     0x0010
 156 #define   SDHCI_CTRL_DRV_TYPE_C     0x0020
 157 #define   SDHCI_CTRL_DRV_TYPE_D     0x0030
 158 #define  SDHCI_CTRL_EXEC_TUNING     0x0040
 159 #define  SDHCI_CTRL_TUNED_CLK       0x0080
 160 #define  SDHCI_CTRL_PRESET_VAL_ENABLE   0x8000
 161
 162 #define SDHCI_CAPABILITIES  0x40
 163 #define  SDHCI_TIMEOUT_CLK_MASK 0x0000003F
 164 #define  SDHCI_TIMEOUT_CLK_SHIFT 0
 165 #define  SDHCI_TIMEOUT_CLK_UNIT 0x00000080
 166 #define  SDHCI_CLOCK_BASE_MASK  0x00003F00
 167 #define  SDHCI_CLOCK_V3_BASE_MASK   0x0000FF00
 168 #define  SDHCI_CLOCK_BASE_SHIFT 8
 169 #define  SDHCI_MAX_BLOCK_MASK   0x00030000
 170 #define  SDHCI_MAX_BLOCK_SHIFT  16
 171 #define  SDHCI_CAN_DO_8BIT  0x00040000
 172 #define  SDHCI_CAN_DO_ADMA2 0x00080000
 173 #define  SDHCI_CAN_DO_ADMA1 0x00100000
 174 #define  SDHCI_CAN_DO_HISPD 0x00200000
 175 #define  SDHCI_CAN_DO_SDMA  0x00400000
 176 #define  SDHCI_CAN_VDD_330  0x01000000
 177 #define  SDHCI_CAN_VDD_300  0x02000000
 178 #define  SDHCI_CAN_VDD_180  0x04000000
 179 #define  SDHCI_CAN_64BIT    0x10000000
 180
 181 #define  SDHCI_SUPPORT_SDR50    0x00000001
 182 #define  SDHCI_SUPPORT_SDR104   0x00000002
 183 #define  SDHCI_SUPPORT_DDR50    0x00000004
 184 #define  SDHCI_DRIVER_TYPE_A    0x00000010
 185 #define  SDHCI_DRIVER_TYPE_C    0x00000020
 186 #define  SDHCI_DRIVER_TYPE_D    0x00000040
 187 #define  SDHCI_RETUNING_TIMER_COUNT_MASK    0x00000F00
 188 #define  SDHCI_RETUNING_TIMER_COUNT_SHIFT   8
 189 #define  SDHCI_USE_SDR50_TUNING         0x00002000
 190 #define  SDHCI_RETUNING_MODE_MASK       0x0000C000
 191 #define  SDHCI_RETUNING_MODE_SHIFT      14
 192 #define  SDHCI_CLOCK_MUL_MASK   0x00FF0000
 193 #define  SDHCI_CLOCK_MUL_SHIFT  16
 194
 195 #define SDHCI_CAPABILITIES_1    0x44
 196
 197 #define SDHCI_MAX_CURRENT       0x48
 198 #define  SDHCI_MAX_CURRENT_330_MASK 0x0000FF
 199 #define  SDHCI_MAX_CURRENT_330_SHIFT    0
 200 #define  SDHCI_MAX_CURRENT_300_MASK 0x00FF00
 201 #define  SDHCI_MAX_CURRENT_300_SHIFT    8
 202 #define  SDHCI_MAX_CURRENT_180_MASK 0xFF0000
 203 #define  SDHCI_MAX_CURRENT_180_SHIFT    16
 204 #define   SDHCI_MAX_CURRENT_MULTIPLIER  4
 205
 206 /* 4C-4F reserved for more max current */
 207
 208 #define SDHCI_SET_ACMD12_ERROR  0x50
 209 #define SDHCI_SET_INT_ERROR 0x52
 210
 211 #define SDHCI_ADMA_ERROR    0x54
 212
 213 /* 55-57 reserved */
 214
 215 #define SDHCI_ADMA_ADDRESS  0x58
 216
 217 /* 60-FB reserved */
 218
 219 #define SDHCI_SLOT_INT_STATUS   0xFC
 220
 221 #define SDHCI_HOST_VERSION  0xFE
 222 #define  SDHCI_VENDOR_VER_MASK  0xFF00
 223 #define  SDHCI_VENDOR_VER_SHIFT 8
 224 #define  SDHCI_SPEC_VER_MASK    0x00FF
 225 #define  SDHCI_SPEC_VER_SHIFT   0
 226 #define   SDHCI_SPEC_100    0
 227 #define   SDHCI_SPEC_200    1
 228 #define   SDHCI_SPEC_300    2
 229
 230 /*
 231  * End of controller registers.
 232  */
 233 #define MMC_VDD_165_195     0x00000080  /* VDD voltage 1.65 - 1.95 */
 234 #define MMC_VDD_20_21       0x00000100  /* VDD voltage 2.0 ~ 2.1 */
 235 #define MMC_VDD_21_22       0x00000200  /* VDD voltage 2.1 ~ 2.2 */
 236 #define MMC_VDD_22_23       0x00000400  /* VDD voltage 2.2 ~ 2.3 */
 237 #define MMC_VDD_23_24       0x00000800  /* VDD voltage 2.3 ~ 2.4 */
 238 #define MMC_VDD_24_25       0x00001000  /* VDD voltage 2.4 ~ 2.5 */
 239 #define MMC_VDD_25_26       0x00002000  /* VDD voltage 2.5 ~ 2.6 */
 240 #define MMC_VDD_26_27       0x00004000  /* VDD voltage 2.6 ~ 2.7 */
 241 #define MMC_VDD_27_28       0x00008000  /* VDD voltage 2.7 ~ 2.8 */
 242 #define MMC_VDD_28_29       0x00010000  /* VDD voltage 2.8 ~ 2.9 */
 243 #define MMC_VDD_29_30       0x00020000  /* VDD voltage 2.9 ~ 3.0 */
 244 #define MMC_VDD_30_31       0x00040000  /* VDD voltage 3.0 ~ 3.1 */
 245 #define MMC_VDD_31_32       0x00080000  /* VDD voltage 3.1 ~ 3.2 */
 246 #define MMC_VDD_32_33       0x00100000  /* VDD voltage 3.2 ~ 3.3 */
 247 #define MMC_VDD_33_34       0x00200000  /* VDD voltage 3.3 ~ 3.4 */
 248 #define MMC_VDD_34_35       0x00400000  /* VDD voltage 3.4 ~ 3.5 */
 249 #define MMC_VDD_35_36       0x00800000  /* VDD voltage 3.5 ~ 3.6 */
 250
 251 #define MMC_CAP_4_BIT_DATA  (1 << 0)    /* Can the host do 4 bit transfers */
 252 #define MMC_CAP_MMC_HIGHSPEED   (1 << 1)    /* Can do MMC high-speed timing */
 253 #define MMC_CAP_SD_HIGHSPEED    (1 << 2)    /* Can do SD high-speed timing */
 254 #define MMC_CAP_SDIO_IRQ    (1 << 3)    /* Can signal pending SDIO IRQs */
 255 #define MMC_CAP_SPI     (1 << 4)    /* Talks only SPI protocols */
 256 #define MMC_CAP_NEEDS_POLL  (1 << 5)    /* Needs polling for card-detection */
 257 #define MMC_CAP_8_BIT_DATA  (1 << 6)    /* Can the host do 8 bit transfers */
 258 #define MMC_CAP_DISABLE     (1 << 7)    /* Can the host be disabled */
 259 #define MMC_CAP_NONREMOVABLE    (1 << 8)    /* Nonremovable e.g. eMMC */
 260 #define MMC_CAP_WAIT_WHILE_BUSY (1 << 9)    /* Waits while card is busy */
 261 #define MMC_CAP_ERASE       (1 << 10)   /* Allow erase/trim commands */
 262 #define MMC_CAP_1_8V_DDR    (1 << 11)   /* can support */
 263                         /* DDR mode at 1.8V */
 264 #define MMC_CAP_1_2V_DDR    (1 << 12)   /* can support */
 265                         /* DDR mode at 1.2V */
 266 #define MMC_CAP_POWER_OFF_CARD  (1 << 13)   /* Can power off after boot */
 267 #define MMC_CAP_BUS_WIDTH_TEST  (1 << 14)   /* CMD14/CMD19 bus width ok */
 268 #define MMC_CAP_UHS_SDR12   (1 << 15) /* Host supports UHS SDR12 mode */
 269 #define MMC_CAP_UHS_SDR25   (1 << 16) /* Host supports UHS SDR25 mode */
 270 #define MMC_CAP_UHS_SDR50   (1 << 17) /* Host supports UHS SDR50 mode */
 271 #define MMC_CAP_UHS_SDR104  (1 << 18) /* Host supports UHS SDR104 mode */
 272 #define MMC_CAP_UHS_DDR50   (1 << 19) /* Host supports UHS DDR50 mode */
 273 #define MMC_CAP_SET_XPC_330 (1 << 20) /* Host supports >150mA current at 3.3V */
 274 #define MMC_CAP_SET_XPC_300 (1 << 21) /* Host supports >150mA current at 3.0V */
 275 #define MMC_CAP_SET_XPC_180 (1 << 22) /* Host supports >150mA current at 1.8V */
 276 #define MMC_CAP_DRIVER_TYPE_A   (1 << 23) /* Host supports Driver Type A */
 277 #define MMC_CAP_DRIVER_TYPE_C   (1 << 24) /* Host supports Driver Type C */
 278 #define MMC_CAP_DRIVER_TYPE_D   (1 << 25) /* Host supports Driver Type D */
 279 #define MMC_CAP_MAX_CURRENT_200 (1 << 26) /* Host max current limit is 200mA */
 280 #define MMC_CAP_MAX_CURRENT_400 (1 << 27) /* Host max current limit is 400mA */
 281 #define MMC_CAP_MAX_CURRENT_600 (1 << 28) /* Host max current limit is 600mA */
 282 #define MMC_CAP_MAX_CURRENT_800 (1 << 29) /* Host max current limit is 800mA */
 283 #define MMC_CAP_CMD23       (1 << 30)   /* CMD23 supported. */
 284 #define MMC_CAP_HW_RESET    (1 << 31)   /* Hardware reset */
 285
 286
 287 #define MMC_CAP2_BOOTPART_NOACC (1 << 0)   /* Boot partition no access */
 288 #define MMC_CAP2_CACHE_CTRL (1 << 1)       /* Allow cache control */
 289 #define MMC_CAP2_POWEROFF_NOTIFY (1 << 2)  /* Notify poweroff supported */
 290 #define MMC_CAP2_NO_MULTI_READ  (1 << 3)   /* Multiblock reads don't work */
 291 #define MMC_CAP2_FORCE_MULTIBLOCK (1 << 4) /* Always use multiblock transfers */
 292
 293 #define COMPLETION_DELAY (100000)
 294
 295 static void bcm2835_emmc_set_irq(BCM2835EmmcState *s)
 296 {
 297     /* the error bit must be set iff there are any other errors */
 298     assert(((s->interrupt & SDHCI_INT_ERROR) == 0)
 299            == ((s->interrupt & SDHCI_INT_ERROR_MASK & ~SDHCI_INT_ERROR) == 0));
 300
 301     if (s->irpt_en & s->irpt_mask & s->interrupt & ~BCM2835_DISABLED_INTS) {
 302         qemu_set_irq(s->irq, 1);
 303     } else {
 304         qemu_set_irq(s->irq, 0);
 305     }
 306 }
 307
 308 static void autocmd12(BCM2835EmmcState *s)
 309 {
 310     SDRequest request;
 311     uint8_t response[16];
 312
 313     if (!(s->cmdtm & SDHCI_TRNS_AUTO_CMD12)) {
 314         return;
 315     }
 316
 317     request.cmd = 12;
 318     request.arg = 0;
 319     request.crc = 0;
 320     sd_do_command(s->card, &request, response);
 321 }
 322
 323 static void autocmd23(BCM2835EmmcState *s)
 324 {
 325     SDRequest request;
 326     uint8_t response[16];
 327
 328     if (!(s->cmdtm & SDHCI_TRNS_AUTO_CMD23)) {
 329         return;
 330     }
 331
 332     request.cmd = 23;
 333     request.arg = (s->blksizecnt >> 16) & 0xffff;
 334     request.crc = 0;
 335     sd_do_command(s->card, &request, response);
 336 }
 337
 338 static void delayed_completion(void *opaque)
 339 {
 340     BCM2835EmmcState *s = (BCM2835EmmcState *)opaque;
 341
 342     s->interrupt |= SDHCI_INT_DATA_END;
 343     autocmd12(s);
 344
 345     bcm2835_emmc_set_irq(s);
 346 }
 347
 348
 349 static uint64_t bcm2835_emmc_read(void *opaque, hwaddr offset,
 350     unsigned size)
 351 {
 352     BCM2835EmmcState *s = (BCM2835EmmcState *)opaque;
 353     uint32_t res = 0;
 354     uint8_t tmp = 0;
 355     int set_irq = 0;
 356     uint32_t blkcnt;
 357     uint8_t cmd;
 358     int64_t now;
 359
 360     assert(size == 4);
 361
 362     switch (offset) {
 363     case SDHCI_ARGUMENT2:      /* ARG2 */
 364         res = s->arg2;
 365         break;
 366     case SDHCI_BLOCK_SIZE:     /* BLKSIZECNT */
 367         res = s->blksizecnt;
 368         break;
 369     case SDHCI_ARGUMENT:       /* ARG1 */
 370         res = s->arg1;
 371         break;
 372     case SDHCI_TRANSFER_MODE:   /* CMDTM */
 373         res = s->cmdtm;
 374         break;
 375     case SDHCI_RESPONSE+0:      /* RESP0 */
 376         res = s->resp0;
 377         break;
 378     case SDHCI_RESPONSE+4:      /* RESP1 */
 379         res = s->resp1;
 380         break;
 381     case SDHCI_RESPONSE+8:      /* RESP2 */
 382         res = s->resp2;
 383         break;
 384     case SDHCI_RESPONSE+12:      /* RESP3 */
 385         res = s->resp3;
 386         break;
 387     case SDHCI_BUFFER:          /* DATA */
 388         cmd = ((s->cmdtm >> (16 + 8)) & 0x3f);
 389
 390         s->data = 0;
 391         tmp = sd_read_data(s->card);
 392         s->data |= (tmp << 0);
 393         tmp = sd_read_data(s->card);
 394         s->data |= (tmp << 8);
 395         tmp = sd_read_data(s->card);
 396         s->data |= (tmp << 16);
 397         tmp = sd_read_data(s->card);
 398         s->data |= (tmp << 24);
 399
 400         s->status |= SDHCI_DATA_AVAILABLE;
 401
 402         s->bytecnt += 4;
 403
 404         if (s->bytecnt == 512) {
 405             s->bytecnt = 0;
 406             if (s->cmdtm & SDHCI_TRNS_BLK_CNT_EN) {
 407                 blkcnt = (s->blksizecnt >> 16) & 0xffff;
 408                 blkcnt--;
 409                 s->blksizecnt = (blkcnt << 16) | (s->blksizecnt & 0xffff);
 410                 if (blkcnt == 0) {
 411                     s->status &= ~SDHCI_DATA_AVAILABLE;
 412
 413                     if (COMPLETION_DELAY > 0) {
 414                         now = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL);
 415                         timer_mod(s->delay_timer,
 416                             now + COMPLETION_DELAY);
 417                     } else {
 418                         s->interrupt |= SDHCI_INT_DATA_END;
 419                         autocmd12(s);
 420                     }
 421                 }
 422             }
 423             if (!s->acmd && (cmd == 17)) {
 424                 /* Single read */
 425                 s->status &= ~SDHCI_DATA_AVAILABLE;
 426
 427                 s->interrupt |= SDHCI_INT_DATA_END;
 428             }
 429         }
 430         if (!sd_data_ready(s->card)) {
 431             s->status &= ~SDHCI_DATA_AVAILABLE;
 432
 433             s->interrupt |= SDHCI_INT_DATA_END;
 434         }
 435
 436         if (s->status & SDHCI_DATA_AVAILABLE) {
 437             s->interrupt |= SDHCI_INT_DATA_AVAIL;
 438         }
 439
 440         set_irq = 1;
 441         res = s->data;
 442         break;
 443     case SDHCI_PRESENT_STATE:   /* STATUS */
 444         res = s->status;
 445         break;
 446     case SDHCI_HOST_CONTROL:    /* CONTROL0 */
 447         res = s->control0;
 448         break;
 449     case SDHCI_CLOCK_CONTROL:   /* CONTROL1 */
 450         res = s->control1;
 451         break;
 452     case SDHCI_INT_STATUS:      /* INTERRUPT */
 453         res = s->interrupt & s->irpt_mask;
 454         break;
 455     case SDHCI_INT_ENABLE:      /* IRPT_MASK */
 456         res = s->irpt_mask;
 457         break;
 458     case SDHCI_SIGNAL_ENABLE:   /* IRPT_EN */
 459         res = s->irpt_en;
 460         break;
 461     case SDHCI_CAPABILITIES:
 462         res = s->caps;
 463         break;
 464     case SDHCI_CAPABILITIES_1:
 465         res = s->caps;
 466         break;
 467     case SDHCI_ACMD12_ERR:      /* CONTROL2 */
 468         res = s->control2;
 469         break;
 470     case SDHCI_SET_ACMD12_ERROR:    /* FORCE_IRPT */
 471         res = s->force_irpt;
 472         break;
 473     case SDHCI_SLOT_INT_STATUS: /* SLOTISR_VERSION */
 474         res = s->slotisr_ver;
 475         break;
 476     case SDHCI_MAX_CURRENT:
 477         res = s->maxcurr;
 478         break;
 479     case SDHCI_MAX_CURRENT+4:
 480         res = s->maxcurr2;
 481         break;
 482     default:
 483         break;
 484     }
 485
 486     if (set_irq) {
 487         bcm2835_emmc_set_irq(s);
 488     }
 489
 490     return res;
 491 }
 492
 493 static void bcm2835_emmc_write(void *opaque, hwaddr offset,
 494                         uint64_t value, unsigned size)
 495 {
 496     BCM2835EmmcState *s = (BCM2835EmmcState *)opaque;
 497     uint8_t cmd;
 498     SDRequest request;
 499     uint8_t response[16];
 500     int resplen;
 501     uint32_t blkcnt;
 502     int64_t now;
 503
 504     assert(size == 4);
 505
 506     switch (offset) {
 507     case SDHCI_ARGUMENT2:      /* ARG2 */
 508         s->arg2 = value;
 509         break;
 510     case SDHCI_BLOCK_SIZE:     /* BLKSIZECNT */
 511         s->blksizecnt = value;
 512         break;
 513     case SDHCI_ARGUMENT:       /* ARG1 */
 514         s->arg1 = value;
 515         break;
 516     case SDHCI_TRANSFER_MODE:   /* CMDTM */
 517         s->cmdtm = value;
 518         cmd = ((value >> (16 + 8)) & 0x3f);
 519
 520         if (!s->acmd && (cmd == 18 || cmd == 25)) {
 521             autocmd23(s);
 522         }
 523
 524         request.cmd = cmd;
 525         request.arg = s->arg1;
 526         request.crc = 0;
 527
 528         s->bytecnt = 0;
 529
 530         s->status &= ~SDHCI_DATA_AVAILABLE;
 531         s->status &= ~SDHCI_SPACE_AVAILABLE;
 532
 533         resplen = sd_do_command(s->card, &request, response);
 534
 535         if (resplen > 0) {
 536             if (resplen == 4) {
 537                 s->resp0 = (response[0] << 24)
 538                     | (response[1] << 16)
 539                     | (response[2] << 8)
 540                     | (response[3] << 0);
 541                 if (!s->acmd && ((cmd == 24) || (cmd == 25))) {
 542                     s->status |= SDHCI_SPACE_AVAILABLE;
 543                     s->interrupt |= SDHCI_INT_SPACE_AVAIL;
 544                 }
 545             } else if (resplen == 16) {
 546                 s->resp3 = 0
 547                     | (response[1-1] << 16)
 548                     | (response[2-1] << 8)
 549                     | (response[3-1] << 0);
 550                 s->resp2 = 0
 551                     | (response[0+4-1] << 24)
 552                     | (response[1+4-1] << 16)
 553                     | (response[2+4-1] << 8)
 554                     | (response[3+4-1] << 0);
 555                 s->resp1 = 0
 556                     | (response[0+8-1] << 24)
 557                     | (response[1+8-1] << 16)
 558                     | (response[2+8-1] << 8)
 559                     | (response[3+8-1] << 0);
 560                 s->resp0 = 0
 561                     | (response[0+12-1] << 24)
 562                     | (response[1+12-1] << 16)
 563                     | (response[2+12-1] << 8)
 564                     | (response[3+12-1] << 0);
 565             }
 566
 567             s->interrupt |= SDHCI_INT_RESPONSE;
 568
 569             if (!s->acmd && (cmd == 12)) {
 570                 /* Stop transmission */
 571                 s->status &= ~SDHCI_SPACE_AVAILABLE;
 572                 s->interrupt |= SDHCI_INT_DATA_END;
 573             } else {
 574                 if (sd_data_ready(s->card)) {
 575                     s->status |= SDHCI_DATA_AVAILABLE;
 576                     s->interrupt |= SDHCI_INT_DATA_AVAIL;
 577                 } else {
 578                     s->interrupt |= SDHCI_INT_DATA_END;
 579                 }
 580             }
 581             bcm2835_emmc_set_irq(s);
 582         } else {
 583             /* Unrecognized commands */
 584             if ((!s->acmd && (cmd == 52))
 585                 || (!s->acmd && (cmd == 5))
 586        ) {
 587                 s->interrupt |= SDHCI_INT_TIMEOUT;
 588                 s->interrupt |= SDHCI_INT_ERROR;
 589             }
 590             if (!s->acmd && (cmd == 0)) {
 591                 s->interrupt |= SDHCI_INT_RESPONSE;
 592             }
 593             if (!s->acmd && (cmd == 7)) {
 594                 s->interrupt |= SDHCI_INT_RESPONSE;
 595             }
 596             bcm2835_emmc_set_irq(s);
 597         }
 598         if (cmd == 55) {
 599             s->acmd = 1;
 600         } else {
 601             s->acmd = 0;
 602         }
 603         break;
 604     case SDHCI_BUFFER:          /* DATA */
 605         cmd = ((s->cmdtm >> (16 + 8)) & 0x3f);
 606
 607         s->data = value;
 608
 609         sd_write_data(s->card, (value >> 0) & 0xff);
 610         sd_write_data(s->card, (value >> 8) & 0xff);
 611         sd_write_data(s->card, (value >> 16) & 0xff);
 612         sd_write_data(s->card, (value >> 24) & 0xff);
 613
 614         s->status |= SDHCI_SPACE_AVAILABLE;
 615
 616         s->bytecnt += 4;
 617
 618         if (s->bytecnt == 512) {
 619             s->bytecnt = 0;
 620             if (s->cmdtm & SDHCI_TRNS_BLK_CNT_EN) {
 621                 blkcnt = (s->blksizecnt >> 16) & 0xffff;
 622                 blkcnt--;
 623                 s->blksizecnt = (blkcnt << 16) | (s->blksizecnt & 0xffff);
 624                 if (blkcnt == 0) {
 625                     if (COMPLETION_DELAY > 0) {
 626                         now = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL);
 627                         timer_mod(s->delay_timer,
 628                             now + COMPLETION_DELAY);
 629                     } else {
 630                         s->interrupt |= SDHCI_INT_DATA_END;
 631                         autocmd12(s);
 632                     }
 633                 }
 634             }
 635             if (!s->acmd && (cmd == 24)) {
 636                 /* Single write */
 637                 s->status &= ~SDHCI_SPACE_AVAILABLE;
 638
 639                 s->interrupt |= SDHCI_INT_DATA_END;
 640             }
 641         }
 642
 643         if (s->status & SDHCI_SPACE_AVAILABLE) {
 644             s->interrupt |= SDHCI_INT_SPACE_AVAIL;
 645         }
 646
 647         bcm2835_emmc_set_irq(s);
 648         break;
 649     case SDHCI_HOST_CONTROL:    /* CONTROL0 */
 650         s->control0 &= ~0x007f0026;
 651         value &= 0x007f0026;
 652         s->control0 |= value;
 653         break;
 654     case SDHCI_CLOCK_CONTROL:  /* CONTROL1 */
 655         s->control0 &= ~0x070fffe7;
 656         value &= 0x070fffe7;
 657         if (value & ((SDHCI_RESET_ALL
 658             | SDHCI_RESET_CMD
 659             | SDHCI_RESET_DATA) << 24)) {
 660             /* Reset */
 661             /* TODO: implement proper reset logic. In the meantime,
 662              * one observed side-effect of reset is clearing the card
 663              * inserted bit. */
 664             if (value & (SDHCI_RESET_ALL << 24)) {
 665                 s->interrupt &= ~SDHCI_INT_CARD_INSERT;
 666             }
 667             value &= ~((SDHCI_RESET_ALL
 668                 | SDHCI_RESET_CMD
 669                 | SDHCI_RESET_DATA) << 24);
 670         }
 671         s->control1 |= value;
 672         break;
 673     case SDHCI_INT_STATUS:      /* INTERRUPT */
 674         s->interrupt &= ~value;
 675         /* clearing all error sources also clears the overall error status */
 676         if ((s->interrupt & SDHCI_INT_ERROR_MASK) == SDHCI_INT_ERROR) {
 677             s->interrupt &= ~SDHCI_INT_ERROR_MASK;
 678         }
 679         bcm2835_emmc_set_irq(s);
 680         break;
 681
 682     case SDHCI_INT_ENABLE:      /* IRPT_MASK */
 683         s->irpt_mask = value;
 684         bcm2835_emmc_set_irq(s);
 685         break;
 686     case SDHCI_SIGNAL_ENABLE:   /* IRPT_EN */
 687         s->irpt_en = value;
 688         bcm2835_emmc_set_irq(s);
 689         break;
 690     case SDHCI_ACMD12_ERR:      /* CONTROL2 */
 691         s->control2 &= ~0x00e7009f;
 692         value &= 0x00e7009f;
 693         s->control2 |= value;
 694         break;
 695     case SDHCI_SET_ACMD12_ERROR:    /* FORCE_IRPT */
 696         s->force_irpt = value;
 697         break;
 698
 699     default:
 700         break;
 701     }
 702 }
 703
 704 static const MemoryRegionOps bcm2835_emmc_ops = {
 705     .read = bcm2835_emmc_read,
 706     .write = bcm2835_emmc_write,
 707     .endianness = DEVICE_NATIVE_ENDIAN,
 708 };
 709
 710 static const VMStateDescription vmstate_bcm2835_emmc = {
 711     .name = TYPE_BCM2835_EMMC,
 712     .version_id = 1,
 713     .minimum_version_id = 1,
 714     .minimum_version_id_old = 1,
 715     .fields      = (VMStateField[]) {
 716         VMSTATE_END_OF_LIST()
 717     }
 718 };
 719
 720 static void bcm2835_emmc_init(Object *obj)
 721 {
 722     BCM2835EmmcState *s = BCM2835_EMMC(obj);
 723
 724     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_emmc_ops, s,
 725                           TYPE_BCM2835_EMMC, 0x100000);
 726     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 727     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
 728 }
 729
 730 static void bcm2835_emmc_realize(DeviceState *dev, Error **errp)
 731 {
 732     BCM2835EmmcState *s = BCM2835_EMMC(dev);
 733     DriveInfo *dinfo;
 734
 735     dinfo = drive_get(IF_SD, 0, 0);
 736     if (!dinfo) {
 737         error_setg(errp, "bcm2835_emmc: missing SD card");
 738         return;
 739     }
 740     s->card = sd_init(blk_by_legacy_dinfo(dinfo), 0);
 741
 742     s->arg2 = 0;
 743     s->blksizecnt = 0;
 744     s->arg1 = 0;
 745     s->cmdtm = 0;
 746     s->resp0 = 0;
 747     s->resp1 = 0;
 748     s->resp2 = 0;
 749     s->resp3 = 0;
 750     s->data = 0;
 751     s->status = (0x1ff << 16);
 752     s->control0 = 0;
 753     s->control1 = SDHCI_CLOCK_INT_STABLE;
 754
 755     /* Although the Broadcom doc says it is unimplemented/reserved, on
 756      * real hardware the card inserted interrupt is actually set at
 757      * boot, and is later cleared by a reset command (as observed on a
 758      * Raspberry Pi 2). Moreover, EDK2/UEFI depend on seeing this bit
 759      * set, so we set it here and later clear it in the reset. */
 760     s->interrupt = SDHCI_INT_CARD_INSERT;
 761
 762     s->irpt_mask = 0;
 763     s->irpt_en = 0;
 764     s->control2 = 0;
 765     s->force_irpt = 0;
 766     s->spi_int_spt = 0;
 767     s->slotisr_ver = (0x9900 | SDHCI_SPEC_300) << 16;
 768     s->caps = 0;
 769     s->caps2 = 0;
 770     s->maxcurr = 1;
 771     s->maxcurr2 = 0;
 772
 773     s->acmd = 0;
 774     s->write_op = 0;
 775
 776     s->delay_timer = timer_new_us(QEMU_CLOCK_VIRTUAL, delayed_completion, s);
 777 }
 778
 779 static void bcm2835_emmc_class_init(ObjectClass *klass, void *data)
 780 {
 781     DeviceClass *dc = DEVICE_CLASS(klass);
 782
 783     dc->realize = bcm2835_emmc_realize;
 784     dc->vmsd = &vmstate_bcm2835_emmc;
 785 }
 786
 787 static TypeInfo bcm2835_emmc_info = {
 788     .name          = TYPE_BCM2835_EMMC,
 789     .parent        = TYPE_SYS_BUS_DEVICE,
 790     .instance_size = sizeof(BCM2835EmmcState),
 791     .class_init    = bcm2835_emmc_class_init,
 792     .instance_init = bcm2835_emmc_init,
 793 };
 794
 795 static void bcm2835_emmc_register_types(void)
 796 {
 797     type_register_static(&bcm2835_emmc_info);
 798 }
 799
 800 type_init(bcm2835_emmc_register_types)