xref: /qemu/hw/sd/allwinner-sdhost.c (revision abff1abf)
1 /*
2  * Allwinner (sun4i and above) SD Host Controller emulation
3  *
4  * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
5  *
6  * This program is free software: you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation, either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/module.h"
23 #include "qemu/units.h"
24 #include "sysemu/blockdev.h"
25 #include "hw/irq.h"
26 #include "hw/sd/allwinner-sdhost.h"
27 #include "migration/vmstate.h"
28 #include "trace.h"
29 
30 #define TYPE_AW_SDHOST_BUS "allwinner-sdhost-bus"
31 #define AW_SDHOST_BUS(obj) \
32     OBJECT_CHECK(SDBus, (obj), TYPE_AW_SDHOST_BUS)
33 
34 /* SD Host register offsets */
35 enum {
36     REG_SD_GCTL       = 0x00,  /* Global Control */
37     REG_SD_CKCR       = 0x04,  /* Clock Control */
38     REG_SD_TMOR       = 0x08,  /* Timeout */
39     REG_SD_BWDR       = 0x0C,  /* Bus Width */
40     REG_SD_BKSR       = 0x10,  /* Block Size */
41     REG_SD_BYCR       = 0x14,  /* Byte Count */
42     REG_SD_CMDR       = 0x18,  /* Command */
43     REG_SD_CAGR       = 0x1C,  /* Command Argument */
44     REG_SD_RESP0      = 0x20,  /* Response Zero */
45     REG_SD_RESP1      = 0x24,  /* Response One */
46     REG_SD_RESP2      = 0x28,  /* Response Two */
47     REG_SD_RESP3      = 0x2C,  /* Response Three */
48     REG_SD_IMKR       = 0x30,  /* Interrupt Mask */
49     REG_SD_MISR       = 0x34,  /* Masked Interrupt Status */
50     REG_SD_RISR       = 0x38,  /* Raw Interrupt Status */
51     REG_SD_STAR       = 0x3C,  /* Status */
52     REG_SD_FWLR       = 0x40,  /* FIFO Water Level */
53     REG_SD_FUNS       = 0x44,  /* FIFO Function Select */
54     REG_SD_DBGC       = 0x50,  /* Debug Enable */
55     REG_SD_A12A       = 0x58,  /* Auto command 12 argument */
56     REG_SD_NTSR       = 0x5C,  /* SD NewTiming Set */
57     REG_SD_SDBG       = 0x60,  /* SD newTiming Set Debug */
58     REG_SD_HWRST      = 0x78,  /* Hardware Reset Register */
59     REG_SD_DMAC       = 0x80,  /* Internal DMA Controller Control */
60     REG_SD_DLBA       = 0x84,  /* Descriptor List Base Address */
61     REG_SD_IDST       = 0x88,  /* Internal DMA Controller Status */
62     REG_SD_IDIE       = 0x8C,  /* Internal DMA Controller IRQ Enable */
63     REG_SD_THLDC      = 0x100, /* Card Threshold Control */
64     REG_SD_DSBD       = 0x10C, /* eMMC DDR Start Bit Detection Control */
65     REG_SD_RES_CRC    = 0x110, /* Response CRC from card/eMMC */
66     REG_SD_DATA7_CRC  = 0x114, /* CRC Data 7 from card/eMMC */
67     REG_SD_DATA6_CRC  = 0x118, /* CRC Data 6 from card/eMMC */
68     REG_SD_DATA5_CRC  = 0x11C, /* CRC Data 5 from card/eMMC */
69     REG_SD_DATA4_CRC  = 0x120, /* CRC Data 4 from card/eMMC */
70     REG_SD_DATA3_CRC  = 0x124, /* CRC Data 3 from card/eMMC */
71     REG_SD_DATA2_CRC  = 0x128, /* CRC Data 2 from card/eMMC */
72     REG_SD_DATA1_CRC  = 0x12C, /* CRC Data 1 from card/eMMC */
73     REG_SD_DATA0_CRC  = 0x130, /* CRC Data 0 from card/eMMC */
74     REG_SD_CRC_STA    = 0x134, /* CRC status from card/eMMC during write */
75     REG_SD_FIFO       = 0x200, /* Read/Write FIFO */
76 };
77 
78 /* SD Host register flags */
79 enum {
80     SD_GCTL_FIFO_AC_MOD     = (1 << 31),
81     SD_GCTL_DDR_MOD_SEL     = (1 << 10),
82     SD_GCTL_CD_DBC_ENB      = (1 << 8),
83     SD_GCTL_DMA_ENB         = (1 << 5),
84     SD_GCTL_INT_ENB         = (1 << 4),
85     SD_GCTL_DMA_RST         = (1 << 2),
86     SD_GCTL_FIFO_RST        = (1 << 1),
87     SD_GCTL_SOFT_RST        = (1 << 0),
88 };
89 
90 enum {
91     SD_CMDR_LOAD            = (1 << 31),
92     SD_CMDR_CLKCHANGE       = (1 << 21),
93     SD_CMDR_WRITE           = (1 << 10),
94     SD_CMDR_AUTOSTOP        = (1 << 12),
95     SD_CMDR_DATA            = (1 << 9),
96     SD_CMDR_RESPONSE_LONG   = (1 << 7),
97     SD_CMDR_RESPONSE        = (1 << 6),
98     SD_CMDR_CMDID_MASK      = (0x3f),
99 };
100 
101 enum {
102     SD_RISR_CARD_REMOVE     = (1 << 31),
103     SD_RISR_CARD_INSERT     = (1 << 30),
104     SD_RISR_SDIO_INTR       = (1 << 16),
105     SD_RISR_AUTOCMD_DONE    = (1 << 14),
106     SD_RISR_DATA_COMPLETE   = (1 << 3),
107     SD_RISR_CMD_COMPLETE    = (1 << 2),
108     SD_RISR_NO_RESPONSE     = (1 << 1),
109 };
110 
111 enum {
112     SD_STAR_CARD_PRESENT    = (1 << 8),
113 };
114 
115 enum {
116     SD_IDST_INT_SUMMARY     = (1 << 8),
117     SD_IDST_RECEIVE_IRQ     = (1 << 1),
118     SD_IDST_TRANSMIT_IRQ    = (1 << 0),
119     SD_IDST_IRQ_MASK        = (1 << 1) | (1 << 0) | (1 << 8),
120     SD_IDST_WR_MASK         = (0x3ff),
121 };
122 
123 /* SD Host register reset values */
124 enum {
125     REG_SD_GCTL_RST         = 0x00000300,
126     REG_SD_CKCR_RST         = 0x0,
127     REG_SD_TMOR_RST         = 0xFFFFFF40,
128     REG_SD_BWDR_RST         = 0x0,
129     REG_SD_BKSR_RST         = 0x00000200,
130     REG_SD_BYCR_RST         = 0x00000200,
131     REG_SD_CMDR_RST         = 0x0,
132     REG_SD_CAGR_RST         = 0x0,
133     REG_SD_RESP_RST         = 0x0,
134     REG_SD_IMKR_RST         = 0x0,
135     REG_SD_MISR_RST         = 0x0,
136     REG_SD_RISR_RST         = 0x0,
137     REG_SD_STAR_RST         = 0x00000100,
138     REG_SD_FWLR_RST         = 0x000F0000,
139     REG_SD_FUNS_RST         = 0x0,
140     REG_SD_DBGC_RST         = 0x0,
141     REG_SD_A12A_RST         = 0x0000FFFF,
142     REG_SD_NTSR_RST         = 0x00000001,
143     REG_SD_SDBG_RST         = 0x0,
144     REG_SD_HWRST_RST        = 0x00000001,
145     REG_SD_DMAC_RST         = 0x0,
146     REG_SD_DLBA_RST         = 0x0,
147     REG_SD_IDST_RST         = 0x0,
148     REG_SD_IDIE_RST         = 0x0,
149     REG_SD_THLDC_RST        = 0x0,
150     REG_SD_DSBD_RST         = 0x0,
151     REG_SD_RES_CRC_RST      = 0x0,
152     REG_SD_DATA_CRC_RST     = 0x0,
153     REG_SD_CRC_STA_RST      = 0x0,
154     REG_SD_FIFO_RST         = 0x0,
155 };
156 
157 /* Data transfer descriptor for DMA */
158 typedef struct TransferDescriptor {
159     uint32_t status; /* Status flags */
160     uint32_t size;   /* Data buffer size */
161     uint32_t addr;   /* Data buffer address */
162     uint32_t next;   /* Physical address of next descriptor */
163 } TransferDescriptor;
164 
165 /* Data transfer descriptor flags */
166 enum {
167     DESC_STATUS_HOLD   = (1 << 31), /* Set when descriptor is in use by DMA */
168     DESC_STATUS_ERROR  = (1 << 30), /* Set when DMA transfer error occurred */
169     DESC_STATUS_CHAIN  = (1 << 4),  /* Indicates chained descriptor. */
170     DESC_STATUS_FIRST  = (1 << 3),  /* Set on the first descriptor */
171     DESC_STATUS_LAST   = (1 << 2),  /* Set on the last descriptor */
172     DESC_STATUS_NOIRQ  = (1 << 1),  /* Skip raising interrupt after transfer */
173     DESC_SIZE_MASK     = (0xfffffffc)
174 };
175 
176 static void allwinner_sdhost_update_irq(AwSdHostState *s)
177 {
178     uint32_t irq;
179 
180     if (s->global_ctl & SD_GCTL_INT_ENB) {
181         irq = s->irq_status & s->irq_mask;
182     } else {
183         irq = 0;
184     }
185 
186     trace_allwinner_sdhost_update_irq(irq);
187     qemu_set_irq(s->irq, irq);
188 }
189 
190 static void allwinner_sdhost_update_transfer_cnt(AwSdHostState *s,
191                                                  uint32_t bytes)
192 {
193     if (s->transfer_cnt > bytes) {
194         s->transfer_cnt -= bytes;
195     } else {
196         s->transfer_cnt = 0;
197     }
198 
199     if (!s->transfer_cnt) {
200         s->irq_status |= SD_RISR_DATA_COMPLETE;
201     }
202 }
203 
204 static void allwinner_sdhost_set_inserted(DeviceState *dev, bool inserted)
205 {
206     AwSdHostState *s = AW_SDHOST(dev);
207 
208     trace_allwinner_sdhost_set_inserted(inserted);
209 
210     if (inserted) {
211         s->irq_status |= SD_RISR_CARD_INSERT;
212         s->irq_status &= ~SD_RISR_CARD_REMOVE;
213         s->status |= SD_STAR_CARD_PRESENT;
214     } else {
215         s->irq_status &= ~SD_RISR_CARD_INSERT;
216         s->irq_status |= SD_RISR_CARD_REMOVE;
217         s->status &= ~SD_STAR_CARD_PRESENT;
218     }
219 
220     allwinner_sdhost_update_irq(s);
221 }
222 
223 static void allwinner_sdhost_send_command(AwSdHostState *s)
224 {
225     SDRequest request;
226     uint8_t resp[16];
227     int rlen;
228 
229     /* Auto clear load flag */
230     s->command &= ~SD_CMDR_LOAD;
231 
232     /* Clock change does not actually interact with the SD bus */
233     if (!(s->command & SD_CMDR_CLKCHANGE)) {
234 
235         /* Prepare request */
236         request.cmd = s->command & SD_CMDR_CMDID_MASK;
237         request.arg = s->command_arg;
238 
239         /* Send request to SD bus */
240         rlen = sdbus_do_command(&s->sdbus, &request, resp);
241         if (rlen < 0) {
242             goto error;
243         }
244 
245         /* If the command has a response, store it in the response registers */
246         if ((s->command & SD_CMDR_RESPONSE)) {
247             if (rlen == 4 && !(s->command & SD_CMDR_RESPONSE_LONG)) {
248                 s->response[0] = ldl_be_p(&resp[0]);
249                 s->response[1] = s->response[2] = s->response[3] = 0;
250 
251             } else if (rlen == 16 && (s->command & SD_CMDR_RESPONSE_LONG)) {
252                 s->response[0] = ldl_be_p(&resp[12]);
253                 s->response[1] = ldl_be_p(&resp[8]);
254                 s->response[2] = ldl_be_p(&resp[4]);
255                 s->response[3] = ldl_be_p(&resp[0]);
256             } else {
257                 goto error;
258             }
259         }
260     }
261 
262     /* Set interrupt status bits */
263     s->irq_status |= SD_RISR_CMD_COMPLETE;
264     return;
265 
266 error:
267     s->irq_status |= SD_RISR_NO_RESPONSE;
268 }
269 
270 static void allwinner_sdhost_auto_stop(AwSdHostState *s)
271 {
272     /*
273      * The stop command (CMD12) ensures the SD bus
274      * returns to the transfer state.
275      */
276     if ((s->command & SD_CMDR_AUTOSTOP) && (s->transfer_cnt == 0)) {
277         /* First save current command registers */
278         uint32_t saved_cmd = s->command;
279         uint32_t saved_arg = s->command_arg;
280 
281         /* Prepare stop command (CMD12) */
282         s->command &= ~SD_CMDR_CMDID_MASK;
283         s->command |= 12; /* CMD12 */
284         s->command_arg = 0;
285 
286         /* Put the command on SD bus */
287         allwinner_sdhost_send_command(s);
288 
289         /* Restore command values */
290         s->command = saved_cmd;
291         s->command_arg = saved_arg;
292 
293         /* Set IRQ status bit for automatic stop done */
294         s->irq_status |= SD_RISR_AUTOCMD_DONE;
295     }
296 }
297 
298 static uint32_t allwinner_sdhost_process_desc(AwSdHostState *s,
299                                               hwaddr desc_addr,
300                                               TransferDescriptor *desc,
301                                               bool is_write, uint32_t max_bytes)
302 {
303     AwSdHostClass *klass = AW_SDHOST_GET_CLASS(s);
304     uint32_t num_done = 0;
305     uint32_t num_bytes = max_bytes;
306     uint8_t buf[1024];
307 
308     /* Read descriptor */
309     cpu_physical_memory_read(desc_addr, desc, sizeof(*desc));
310     if (desc->size == 0) {
311         desc->size = klass->max_desc_size;
312     } else if (desc->size > klass->max_desc_size) {
313         qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA descriptor buffer size "
314                       " is out-of-bounds: %" PRIu32 " > %zu",
315                       __func__, desc->size, klass->max_desc_size);
316         desc->size = klass->max_desc_size;
317     }
318     if (desc->size < num_bytes) {
319         num_bytes = desc->size;
320     }
321 
322     trace_allwinner_sdhost_process_desc(desc_addr, desc->size,
323                                         is_write, max_bytes);
324 
325     while (num_done < num_bytes) {
326         /* Try to completely fill the local buffer */
327         uint32_t buf_bytes = num_bytes - num_done;
328         if (buf_bytes > sizeof(buf)) {
329             buf_bytes = sizeof(buf);
330         }
331 
332         /* Write to SD bus */
333         if (is_write) {
334             cpu_physical_memory_read((desc->addr & DESC_SIZE_MASK) + num_done,
335                                       buf, buf_bytes);
336 
337             for (uint32_t i = 0; i < buf_bytes; i++) {
338                 sdbus_write_data(&s->sdbus, buf[i]);
339             }
340 
341         /* Read from SD bus */
342         } else {
343             for (uint32_t i = 0; i < buf_bytes; i++) {
344                 buf[i] = sdbus_read_data(&s->sdbus);
345             }
346             cpu_physical_memory_write((desc->addr & DESC_SIZE_MASK) + num_done,
347                                        buf, buf_bytes);
348         }
349         num_done += buf_bytes;
350     }
351 
352     /* Clear hold flag and flush descriptor */
353     desc->status &= ~DESC_STATUS_HOLD;
354     cpu_physical_memory_write(desc_addr, desc, sizeof(*desc));
355 
356     return num_done;
357 }
358 
359 static void allwinner_sdhost_dma(AwSdHostState *s)
360 {
361     TransferDescriptor desc;
362     hwaddr desc_addr = s->desc_base;
363     bool is_write = (s->command & SD_CMDR_WRITE);
364     uint32_t bytes_done = 0;
365 
366     /* Check if DMA can be performed */
367     if (s->byte_count == 0 || s->block_size == 0 ||
368       !(s->global_ctl & SD_GCTL_DMA_ENB)) {
369         return;
370     }
371 
372     /*
373      * For read operations, data must be available on the SD bus
374      * If not, it is an error and we should not act at all
375      */
376     if (!is_write && !sdbus_data_ready(&s->sdbus)) {
377         return;
378     }
379 
380     /* Process the DMA descriptors until all data is copied */
381     while (s->byte_count > 0) {
382         bytes_done = allwinner_sdhost_process_desc(s, desc_addr, &desc,
383                                                    is_write, s->byte_count);
384         allwinner_sdhost_update_transfer_cnt(s, bytes_done);
385 
386         if (bytes_done <= s->byte_count) {
387             s->byte_count -= bytes_done;
388         } else {
389             s->byte_count = 0;
390         }
391 
392         if (desc.status & DESC_STATUS_LAST) {
393             break;
394         } else {
395             desc_addr = desc.next;
396         }
397     }
398 
399     /* Raise IRQ to signal DMA is completed */
400     s->irq_status |= SD_RISR_DATA_COMPLETE | SD_RISR_SDIO_INTR;
401 
402     /* Update DMAC bits */
403     s->dmac_status |= SD_IDST_INT_SUMMARY;
404 
405     if (is_write) {
406         s->dmac_status |= SD_IDST_TRANSMIT_IRQ;
407     } else {
408         s->dmac_status |= SD_IDST_RECEIVE_IRQ;
409     }
410 }
411 
412 static uint64_t allwinner_sdhost_read(void *opaque, hwaddr offset,
413                                       unsigned size)
414 {
415     AwSdHostState *s = AW_SDHOST(opaque);
416     uint32_t res = 0;
417 
418     switch (offset) {
419     case REG_SD_GCTL:      /* Global Control */
420         res = s->global_ctl;
421         break;
422     case REG_SD_CKCR:      /* Clock Control */
423         res = s->clock_ctl;
424         break;
425     case REG_SD_TMOR:      /* Timeout */
426         res = s->timeout;
427         break;
428     case REG_SD_BWDR:      /* Bus Width */
429         res = s->bus_width;
430         break;
431     case REG_SD_BKSR:      /* Block Size */
432         res = s->block_size;
433         break;
434     case REG_SD_BYCR:      /* Byte Count */
435         res = s->byte_count;
436         break;
437     case REG_SD_CMDR:      /* Command */
438         res = s->command;
439         break;
440     case REG_SD_CAGR:      /* Command Argument */
441         res = s->command_arg;
442         break;
443     case REG_SD_RESP0:     /* Response Zero */
444         res = s->response[0];
445         break;
446     case REG_SD_RESP1:     /* Response One */
447         res = s->response[1];
448         break;
449     case REG_SD_RESP2:     /* Response Two */
450         res = s->response[2];
451         break;
452     case REG_SD_RESP3:     /* Response Three */
453         res = s->response[3];
454         break;
455     case REG_SD_IMKR:      /* Interrupt Mask */
456         res = s->irq_mask;
457         break;
458     case REG_SD_MISR:      /* Masked Interrupt Status */
459         res = s->irq_status & s->irq_mask;
460         break;
461     case REG_SD_RISR:      /* Raw Interrupt Status */
462         res = s->irq_status;
463         break;
464     case REG_SD_STAR:      /* Status */
465         res = s->status;
466         break;
467     case REG_SD_FWLR:      /* FIFO Water Level */
468         res = s->fifo_wlevel;
469         break;
470     case REG_SD_FUNS:      /* FIFO Function Select */
471         res = s->fifo_func_sel;
472         break;
473     case REG_SD_DBGC:      /* Debug Enable */
474         res = s->debug_enable;
475         break;
476     case REG_SD_A12A:      /* Auto command 12 argument */
477         res = s->auto12_arg;
478         break;
479     case REG_SD_NTSR:      /* SD NewTiming Set */
480         res = s->newtiming_set;
481         break;
482     case REG_SD_SDBG:      /* SD newTiming Set Debug */
483         res = s->newtiming_debug;
484         break;
485     case REG_SD_HWRST:     /* Hardware Reset Register */
486         res = s->hardware_rst;
487         break;
488     case REG_SD_DMAC:      /* Internal DMA Controller Control */
489         res = s->dmac;
490         break;
491     case REG_SD_DLBA:      /* Descriptor List Base Address */
492         res = s->desc_base;
493         break;
494     case REG_SD_IDST:      /* Internal DMA Controller Status */
495         res = s->dmac_status;
496         break;
497     case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
498         res = s->dmac_irq;
499         break;
500     case REG_SD_THLDC:     /* Card Threshold Control */
501         res = s->card_threshold;
502         break;
503     case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
504         res = s->startbit_detect;
505         break;
506     case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
507         res = s->response_crc;
508         break;
509     case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
510     case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
511     case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
512     case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
513     case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
514     case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
515     case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
516     case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
517         res = s->data_crc[((offset - REG_SD_DATA7_CRC) / sizeof(uint32_t))];
518         break;
519     case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
520         res = s->status_crc;
521         break;
522     case REG_SD_FIFO:      /* Read/Write FIFO */
523         if (sdbus_data_ready(&s->sdbus)) {
524             res = sdbus_read_data(&s->sdbus);
525             res |= sdbus_read_data(&s->sdbus) << 8;
526             res |= sdbus_read_data(&s->sdbus) << 16;
527             res |= sdbus_read_data(&s->sdbus) << 24;
528             allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
529             allwinner_sdhost_auto_stop(s);
530             allwinner_sdhost_update_irq(s);
531         } else {
532             qemu_log_mask(LOG_GUEST_ERROR, "%s: no data ready on SD bus\n",
533                           __func__);
534         }
535         break;
536     default:
537         qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
538                       HWADDR_PRIx"\n", __func__, offset);
539         res = 0;
540         break;
541     }
542 
543     trace_allwinner_sdhost_read(offset, res, size);
544     return res;
545 }
546 
547 static void allwinner_sdhost_write(void *opaque, hwaddr offset,
548                                    uint64_t value, unsigned size)
549 {
550     AwSdHostState *s = AW_SDHOST(opaque);
551 
552     trace_allwinner_sdhost_write(offset, value, size);
553 
554     switch (offset) {
555     case REG_SD_GCTL:      /* Global Control */
556         s->global_ctl = value;
557         s->global_ctl &= ~(SD_GCTL_DMA_RST | SD_GCTL_FIFO_RST |
558                            SD_GCTL_SOFT_RST);
559         allwinner_sdhost_update_irq(s);
560         break;
561     case REG_SD_CKCR:      /* Clock Control */
562         s->clock_ctl = value;
563         break;
564     case REG_SD_TMOR:      /* Timeout */
565         s->timeout = value;
566         break;
567     case REG_SD_BWDR:      /* Bus Width */
568         s->bus_width = value;
569         break;
570     case REG_SD_BKSR:      /* Block Size */
571         s->block_size = value;
572         break;
573     case REG_SD_BYCR:      /* Byte Count */
574         s->byte_count = value;
575         s->transfer_cnt = value;
576         break;
577     case REG_SD_CMDR:      /* Command */
578         s->command = value;
579         if (value & SD_CMDR_LOAD) {
580             allwinner_sdhost_send_command(s);
581             allwinner_sdhost_dma(s);
582             allwinner_sdhost_auto_stop(s);
583         }
584         allwinner_sdhost_update_irq(s);
585         break;
586     case REG_SD_CAGR:      /* Command Argument */
587         s->command_arg = value;
588         break;
589     case REG_SD_RESP0:     /* Response Zero */
590         s->response[0] = value;
591         break;
592     case REG_SD_RESP1:     /* Response One */
593         s->response[1] = value;
594         break;
595     case REG_SD_RESP2:     /* Response Two */
596         s->response[2] = value;
597         break;
598     case REG_SD_RESP3:     /* Response Three */
599         s->response[3] = value;
600         break;
601     case REG_SD_IMKR:      /* Interrupt Mask */
602         s->irq_mask = value;
603         allwinner_sdhost_update_irq(s);
604         break;
605     case REG_SD_MISR:      /* Masked Interrupt Status */
606     case REG_SD_RISR:      /* Raw Interrupt Status */
607         s->irq_status &= ~value;
608         allwinner_sdhost_update_irq(s);
609         break;
610     case REG_SD_STAR:      /* Status */
611         s->status &= ~value;
612         allwinner_sdhost_update_irq(s);
613         break;
614     case REG_SD_FWLR:      /* FIFO Water Level */
615         s->fifo_wlevel = value;
616         break;
617     case REG_SD_FUNS:      /* FIFO Function Select */
618         s->fifo_func_sel = value;
619         break;
620     case REG_SD_DBGC:      /* Debug Enable */
621         s->debug_enable = value;
622         break;
623     case REG_SD_A12A:      /* Auto command 12 argument */
624         s->auto12_arg = value;
625         break;
626     case REG_SD_NTSR:      /* SD NewTiming Set */
627         s->newtiming_set = value;
628         break;
629     case REG_SD_SDBG:      /* SD newTiming Set Debug */
630         s->newtiming_debug = value;
631         break;
632     case REG_SD_HWRST:     /* Hardware Reset Register */
633         s->hardware_rst = value;
634         break;
635     case REG_SD_DMAC:      /* Internal DMA Controller Control */
636         s->dmac = value;
637         allwinner_sdhost_update_irq(s);
638         break;
639     case REG_SD_DLBA:      /* Descriptor List Base Address */
640         s->desc_base = value;
641         break;
642     case REG_SD_IDST:      /* Internal DMA Controller Status */
643         s->dmac_status &= (~SD_IDST_WR_MASK) | (~value & SD_IDST_WR_MASK);
644         allwinner_sdhost_update_irq(s);
645         break;
646     case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
647         s->dmac_irq = value;
648         allwinner_sdhost_update_irq(s);
649         break;
650     case REG_SD_THLDC:     /* Card Threshold Control */
651         s->card_threshold = value;
652         break;
653     case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
654         s->startbit_detect = value;
655         break;
656     case REG_SD_FIFO:      /* Read/Write FIFO */
657         sdbus_write_data(&s->sdbus, value & 0xff);
658         sdbus_write_data(&s->sdbus, (value >> 8) & 0xff);
659         sdbus_write_data(&s->sdbus, (value >> 16) & 0xff);
660         sdbus_write_data(&s->sdbus, (value >> 24) & 0xff);
661         allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
662         allwinner_sdhost_auto_stop(s);
663         allwinner_sdhost_update_irq(s);
664         break;
665     case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
666     case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
667     case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
668     case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
669     case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
670     case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
671     case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
672     case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
673     case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
674     case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
675         break;
676     default:
677         qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
678                       HWADDR_PRIx"\n", __func__, offset);
679         break;
680     }
681 }
682 
683 static const MemoryRegionOps allwinner_sdhost_ops = {
684     .read = allwinner_sdhost_read,
685     .write = allwinner_sdhost_write,
686     .endianness = DEVICE_NATIVE_ENDIAN,
687     .valid = {
688         .min_access_size = 4,
689         .max_access_size = 4,
690     },
691     .impl.min_access_size = 4,
692 };
693 
694 static const VMStateDescription vmstate_allwinner_sdhost = {
695     .name = "allwinner-sdhost",
696     .version_id = 1,
697     .minimum_version_id = 1,
698     .fields = (VMStateField[]) {
699         VMSTATE_UINT32(global_ctl, AwSdHostState),
700         VMSTATE_UINT32(clock_ctl, AwSdHostState),
701         VMSTATE_UINT32(timeout, AwSdHostState),
702         VMSTATE_UINT32(bus_width, AwSdHostState),
703         VMSTATE_UINT32(block_size, AwSdHostState),
704         VMSTATE_UINT32(byte_count, AwSdHostState),
705         VMSTATE_UINT32(transfer_cnt, AwSdHostState),
706         VMSTATE_UINT32(command, AwSdHostState),
707         VMSTATE_UINT32(command_arg, AwSdHostState),
708         VMSTATE_UINT32_ARRAY(response, AwSdHostState, 4),
709         VMSTATE_UINT32(irq_mask, AwSdHostState),
710         VMSTATE_UINT32(irq_status, AwSdHostState),
711         VMSTATE_UINT32(status, AwSdHostState),
712         VMSTATE_UINT32(fifo_wlevel, AwSdHostState),
713         VMSTATE_UINT32(fifo_func_sel, AwSdHostState),
714         VMSTATE_UINT32(debug_enable, AwSdHostState),
715         VMSTATE_UINT32(auto12_arg, AwSdHostState),
716         VMSTATE_UINT32(newtiming_set, AwSdHostState),
717         VMSTATE_UINT32(newtiming_debug, AwSdHostState),
718         VMSTATE_UINT32(hardware_rst, AwSdHostState),
719         VMSTATE_UINT32(dmac, AwSdHostState),
720         VMSTATE_UINT32(desc_base, AwSdHostState),
721         VMSTATE_UINT32(dmac_status, AwSdHostState),
722         VMSTATE_UINT32(dmac_irq, AwSdHostState),
723         VMSTATE_UINT32(card_threshold, AwSdHostState),
724         VMSTATE_UINT32(startbit_detect, AwSdHostState),
725         VMSTATE_UINT32(response_crc, AwSdHostState),
726         VMSTATE_UINT32_ARRAY(data_crc, AwSdHostState, 8),
727         VMSTATE_UINT32(status_crc, AwSdHostState),
728         VMSTATE_END_OF_LIST()
729     }
730 };
731 
732 static void allwinner_sdhost_init(Object *obj)
733 {
734     AwSdHostState *s = AW_SDHOST(obj);
735 
736     qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
737                          TYPE_AW_SDHOST_BUS, DEVICE(s), "sd-bus");
738 
739     memory_region_init_io(&s->iomem, obj, &allwinner_sdhost_ops, s,
740                            TYPE_AW_SDHOST, 4 * KiB);
741     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
742     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
743 }
744 
745 static void allwinner_sdhost_reset(DeviceState *dev)
746 {
747     AwSdHostState *s = AW_SDHOST(dev);
748 
749     s->global_ctl = REG_SD_GCTL_RST;
750     s->clock_ctl = REG_SD_CKCR_RST;
751     s->timeout = REG_SD_TMOR_RST;
752     s->bus_width = REG_SD_BWDR_RST;
753     s->block_size = REG_SD_BKSR_RST;
754     s->byte_count = REG_SD_BYCR_RST;
755     s->transfer_cnt = 0;
756 
757     s->command = REG_SD_CMDR_RST;
758     s->command_arg = REG_SD_CAGR_RST;
759 
760     for (int i = 0; i < ARRAY_SIZE(s->response); i++) {
761         s->response[i] = REG_SD_RESP_RST;
762     }
763 
764     s->irq_mask = REG_SD_IMKR_RST;
765     s->irq_status = REG_SD_RISR_RST;
766     s->status = REG_SD_STAR_RST;
767 
768     s->fifo_wlevel = REG_SD_FWLR_RST;
769     s->fifo_func_sel = REG_SD_FUNS_RST;
770     s->debug_enable = REG_SD_DBGC_RST;
771     s->auto12_arg = REG_SD_A12A_RST;
772     s->newtiming_set = REG_SD_NTSR_RST;
773     s->newtiming_debug = REG_SD_SDBG_RST;
774     s->hardware_rst = REG_SD_HWRST_RST;
775     s->dmac = REG_SD_DMAC_RST;
776     s->desc_base = REG_SD_DLBA_RST;
777     s->dmac_status = REG_SD_IDST_RST;
778     s->dmac_irq = REG_SD_IDIE_RST;
779     s->card_threshold = REG_SD_THLDC_RST;
780     s->startbit_detect = REG_SD_DSBD_RST;
781     s->response_crc = REG_SD_RES_CRC_RST;
782 
783     for (int i = 0; i < ARRAY_SIZE(s->data_crc); i++) {
784         s->data_crc[i] = REG_SD_DATA_CRC_RST;
785     }
786 
787     s->status_crc = REG_SD_CRC_STA_RST;
788 }
789 
790 static void allwinner_sdhost_bus_class_init(ObjectClass *klass, void *data)
791 {
792     SDBusClass *sbc = SD_BUS_CLASS(klass);
793 
794     sbc->set_inserted = allwinner_sdhost_set_inserted;
795 }
796 
797 static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
798 {
799     DeviceClass *dc = DEVICE_CLASS(klass);
800 
801     dc->reset = allwinner_sdhost_reset;
802     dc->vmsd = &vmstate_allwinner_sdhost;
803 }
804 
805 static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
806 {
807     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
808     sc->max_desc_size = 8 * KiB;
809 }
810 
811 static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
812 {
813     AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
814     sc->max_desc_size = 64 * KiB;
815 }
816 
817 static TypeInfo allwinner_sdhost_info = {
818     .name          = TYPE_AW_SDHOST,
819     .parent        = TYPE_SYS_BUS_DEVICE,
820     .instance_init = allwinner_sdhost_init,
821     .instance_size = sizeof(AwSdHostState),
822     .class_init    = allwinner_sdhost_class_init,
823     .class_size    = sizeof(AwSdHostClass),
824     .abstract      = true,
825 };
826 
827 static const TypeInfo allwinner_sdhost_sun4i_info = {
828     .name          = TYPE_AW_SDHOST_SUN4I,
829     .parent        = TYPE_AW_SDHOST,
830     .class_init    = allwinner_sdhost_sun4i_class_init,
831 };
832 
833 static const TypeInfo allwinner_sdhost_sun5i_info = {
834     .name          = TYPE_AW_SDHOST_SUN5I,
835     .parent        = TYPE_AW_SDHOST,
836     .class_init    = allwinner_sdhost_sun5i_class_init,
837 };
838 
839 static const TypeInfo allwinner_sdhost_bus_info = {
840     .name = TYPE_AW_SDHOST_BUS,
841     .parent = TYPE_SD_BUS,
842     .instance_size = sizeof(SDBus),
843     .class_init = allwinner_sdhost_bus_class_init,
844 };
845 
846 static void allwinner_sdhost_register_types(void)
847 {
848     type_register_static(&allwinner_sdhost_info);
849     type_register_static(&allwinner_sdhost_sun4i_info);
850     type_register_static(&allwinner_sdhost_sun5i_info);
851     type_register_static(&allwinner_sdhost_bus_info);
852 }
853 
854 type_init(allwinner_sdhost_register_types)
855