1 /* 2 * Raspberry Pi (BCM2835) SD Host Controller 3 * 4 * Copyright (c) 2017 Antfield SAS 5 * 6 * Authors: 7 * Clement Deschamps <clement.deschamps@antfield.fr> 8 * Luc Michel <luc.michel@antfield.fr> 9 * 10 * This work is licensed under the terms of the GNU GPL, version 2 or later. 11 * See the COPYING file in the top-level directory. 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/log.h" 16 #include "sysemu/blockdev.h" 17 #include "hw/sd/bcm2835_sdhost.h" 18 #include "trace.h" 19 20 #define TYPE_BCM2835_SDHOST_BUS "bcm2835-sdhost-bus" 21 #define BCM2835_SDHOST_BUS(obj) \ 22 OBJECT_CHECK(SDBus, (obj), TYPE_BCM2835_SDHOST_BUS) 23 24 #define SDCMD 0x00 /* Command to SD card - 16 R/W */ 25 #define SDARG 0x04 /* Argument to SD card - 32 R/W */ 26 #define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */ 27 #define SDCDIV 0x0c /* Start value for clock divider - 11 R/W */ 28 #define SDRSP0 0x10 /* SD card rsp (31:0) - 32 R */ 29 #define SDRSP1 0x14 /* SD card rsp (63:32) - 32 R */ 30 #define SDRSP2 0x18 /* SD card rsp (95:64) - 32 R */ 31 #define SDRSP3 0x1c /* SD card rsp (127:96) - 32 R */ 32 #define SDHSTS 0x20 /* SD host status - 11 R */ 33 #define SDVDD 0x30 /* SD card power control - 1 R/W */ 34 #define SDEDM 0x34 /* Emergency Debug Mode - 13 R/W */ 35 #define SDHCFG 0x38 /* Host configuration - 2 R/W */ 36 #define SDHBCT 0x3c /* Host byte count (debug) - 32 R/W */ 37 #define SDDATA 0x40 /* Data to/from SD card - 32 R/W */ 38 #define SDHBLC 0x50 /* Host block count (SDIO/SDHC) - 9 R/W */ 39 40 #define SDCMD_NEW_FLAG 0x8000 41 #define SDCMD_FAIL_FLAG 0x4000 42 #define SDCMD_BUSYWAIT 0x800 43 #define SDCMD_NO_RESPONSE 0x400 44 #define SDCMD_LONG_RESPONSE 0x200 45 #define SDCMD_WRITE_CMD 0x80 46 #define SDCMD_READ_CMD 0x40 47 #define SDCMD_CMD_MASK 0x3f 48 49 #define SDCDIV_MAX_CDIV 0x7ff 50 51 #define SDHSTS_BUSY_IRPT 0x400 52 #define SDHSTS_BLOCK_IRPT 0x200 53 #define SDHSTS_SDIO_IRPT 0x100 54 #define SDHSTS_REW_TIME_OUT 0x80 55 #define SDHSTS_CMD_TIME_OUT 0x40 56 #define SDHSTS_CRC16_ERROR 0x20 57 #define SDHSTS_CRC7_ERROR 0x10 58 #define SDHSTS_FIFO_ERROR 0x08 59 /* Reserved */ 60 /* Reserved */ 61 #define SDHSTS_DATA_FLAG 0x01 62 63 #define SDHCFG_BUSY_IRPT_EN (1 << 10) 64 #define SDHCFG_BLOCK_IRPT_EN (1 << 8) 65 #define SDHCFG_SDIO_IRPT_EN (1 << 5) 66 #define SDHCFG_DATA_IRPT_EN (1 << 4) 67 #define SDHCFG_SLOW_CARD (1 << 3) 68 #define SDHCFG_WIDE_EXT_BUS (1 << 2) 69 #define SDHCFG_WIDE_INT_BUS (1 << 1) 70 #define SDHCFG_REL_CMD_LINE (1 << 0) 71 72 #define SDEDM_FORCE_DATA_MODE (1 << 19) 73 #define SDEDM_CLOCK_PULSE (1 << 20) 74 #define SDEDM_BYPASS (1 << 21) 75 76 #define SDEDM_WRITE_THRESHOLD_SHIFT 9 77 #define SDEDM_READ_THRESHOLD_SHIFT 14 78 #define SDEDM_THRESHOLD_MASK 0x1f 79 80 #define SDEDM_FSM_MASK 0xf 81 #define SDEDM_FSM_IDENTMODE 0x0 82 #define SDEDM_FSM_DATAMODE 0x1 83 #define SDEDM_FSM_READDATA 0x2 84 #define SDEDM_FSM_WRITEDATA 0x3 85 #define SDEDM_FSM_READWAIT 0x4 86 #define SDEDM_FSM_READCRC 0x5 87 #define SDEDM_FSM_WRITECRC 0x6 88 #define SDEDM_FSM_WRITEWAIT1 0x7 89 #define SDEDM_FSM_POWERDOWN 0x8 90 #define SDEDM_FSM_POWERUP 0x9 91 #define SDEDM_FSM_WRITESTART1 0xa 92 #define SDEDM_FSM_WRITESTART2 0xb 93 #define SDEDM_FSM_GENPULSES 0xc 94 #define SDEDM_FSM_WRITEWAIT2 0xd 95 #define SDEDM_FSM_STARTPOWDOWN 0xf 96 97 #define SDDATA_FIFO_WORDS 16 98 99 static void bcm2835_sdhost_update_irq(BCM2835SDHostState *s) 100 { 101 uint32_t irq = s->status & 102 (SDHSTS_BUSY_IRPT | SDHSTS_BLOCK_IRPT | SDHSTS_SDIO_IRPT); 103 trace_bcm2835_sdhost_update_irq(irq); 104 qemu_set_irq(s->irq, !!irq); 105 } 106 107 static void bcm2835_sdhost_send_command(BCM2835SDHostState *s) 108 { 109 SDRequest request; 110 uint8_t rsp[16]; 111 int rlen; 112 113 request.cmd = s->cmd & SDCMD_CMD_MASK; 114 request.arg = s->cmdarg; 115 116 rlen = sdbus_do_command(&s->sdbus, &request, rsp); 117 if (rlen < 0) { 118 goto error; 119 } 120 if (!(s->cmd & SDCMD_NO_RESPONSE)) { 121 if (rlen == 0 || (rlen == 4 && (s->cmd & SDCMD_LONG_RESPONSE))) { 122 goto error; 123 } 124 if (rlen != 4 && rlen != 16) { 125 goto error; 126 } 127 if (rlen == 4) { 128 s->rsp[0] = ldl_be_p(&rsp[0]); 129 s->rsp[1] = s->rsp[2] = s->rsp[3] = 0; 130 } else { 131 s->rsp[0] = ldl_be_p(&rsp[12]); 132 s->rsp[1] = ldl_be_p(&rsp[8]); 133 s->rsp[2] = ldl_be_p(&rsp[4]); 134 s->rsp[3] = ldl_be_p(&rsp[0]); 135 } 136 } 137 /* We never really delay commands, so if this was a 'busywait' command 138 * then we've completed it now and can raise the interrupt. 139 */ 140 if ((s->cmd & SDCMD_BUSYWAIT) && (s->config & SDHCFG_BUSY_IRPT_EN)) { 141 s->status |= SDHSTS_BUSY_IRPT; 142 } 143 return; 144 145 error: 146 s->cmd |= SDCMD_FAIL_FLAG; 147 s->status |= SDHSTS_CMD_TIME_OUT; 148 } 149 150 static void bcm2835_sdhost_fifo_push(BCM2835SDHostState *s, uint32_t value) 151 { 152 int n; 153 154 if (s->fifo_len == BCM2835_SDHOST_FIFO_LEN) { 155 /* FIFO overflow */ 156 return; 157 } 158 n = (s->fifo_pos + s->fifo_len) & (BCM2835_SDHOST_FIFO_LEN - 1); 159 s->fifo_len++; 160 s->fifo[n] = value; 161 } 162 163 static uint32_t bcm2835_sdhost_fifo_pop(BCM2835SDHostState *s) 164 { 165 uint32_t value; 166 167 if (s->fifo_len == 0) { 168 /* FIFO underflow */ 169 return 0; 170 } 171 value = s->fifo[s->fifo_pos]; 172 s->fifo_len--; 173 s->fifo_pos = (s->fifo_pos + 1) & (BCM2835_SDHOST_FIFO_LEN - 1); 174 return value; 175 } 176 177 static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s) 178 { 179 uint32_t value = 0; 180 int n; 181 int is_read; 182 183 is_read = (s->cmd & SDCMD_READ_CMD) != 0; 184 if (s->datacnt != 0 && (!is_read || sdbus_data_ready(&s->sdbus))) { 185 if (is_read) { 186 n = 0; 187 while (s->datacnt && s->fifo_len < BCM2835_SDHOST_FIFO_LEN) { 188 value |= (uint32_t)sdbus_read_data(&s->sdbus) << (n * 8); 189 s->datacnt--; 190 n++; 191 if (n == 4) { 192 bcm2835_sdhost_fifo_push(s, value); 193 s->status |= SDHSTS_DATA_FLAG; 194 if (s->config & SDHCFG_DATA_IRPT_EN) { 195 s->status |= SDHSTS_SDIO_IRPT; 196 } 197 n = 0; 198 value = 0; 199 } 200 } 201 if (n != 0) { 202 bcm2835_sdhost_fifo_push(s, value); 203 s->status |= SDHSTS_DATA_FLAG; 204 } 205 } else { /* write */ 206 n = 0; 207 while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) { 208 if (n == 0) { 209 value = bcm2835_sdhost_fifo_pop(s); 210 s->status |= SDHSTS_DATA_FLAG; 211 if (s->config & SDHCFG_DATA_IRPT_EN) { 212 s->status |= SDHSTS_SDIO_IRPT; 213 } 214 n = 4; 215 } 216 n--; 217 s->datacnt--; 218 sdbus_write_data(&s->sdbus, value & 0xff); 219 value >>= 8; 220 } 221 } 222 if (s->datacnt == 0) { 223 s->edm &= ~SDEDM_FSM_MASK; 224 s->edm |= SDEDM_FSM_DATAMODE; 225 trace_bcm2835_sdhost_edm_change("datacnt 0", s->edm); 226 227 if ((s->cmd & SDCMD_WRITE_CMD) && 228 (s->config & SDHCFG_BLOCK_IRPT_EN)) { 229 s->status |= SDHSTS_BLOCK_IRPT; 230 } 231 } 232 } 233 234 bcm2835_sdhost_update_irq(s); 235 236 s->edm &= ~(0x1f << 4); 237 s->edm |= ((s->fifo_len & 0x1f) << 4); 238 trace_bcm2835_sdhost_edm_change("fifo run", s->edm); 239 } 240 241 static uint64_t bcm2835_sdhost_read(void *opaque, hwaddr offset, 242 unsigned size) 243 { 244 BCM2835SDHostState *s = (BCM2835SDHostState *)opaque; 245 uint32_t res = 0; 246 247 switch (offset) { 248 case SDCMD: 249 res = s->cmd; 250 break; 251 case SDHSTS: 252 res = s->status; 253 break; 254 case SDRSP0: 255 res = s->rsp[0]; 256 break; 257 case SDRSP1: 258 res = s->rsp[1]; 259 break; 260 case SDRSP2: 261 res = s->rsp[2]; 262 break; 263 case SDRSP3: 264 res = s->rsp[3]; 265 break; 266 case SDEDM: 267 res = s->edm; 268 break; 269 case SDVDD: 270 res = s->vdd; 271 break; 272 case SDDATA: 273 res = bcm2835_sdhost_fifo_pop(s); 274 bcm2835_sdhost_fifo_run(s); 275 break; 276 case SDHBCT: 277 res = s->hbct; 278 break; 279 case SDHBLC: 280 res = s->hblc; 281 break; 282 283 default: 284 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 285 __func__, offset); 286 res = 0; 287 break; 288 } 289 290 trace_bcm2835_sdhost_read(offset, res, size); 291 292 return res; 293 } 294 295 static void bcm2835_sdhost_write(void *opaque, hwaddr offset, 296 uint64_t value, unsigned size) 297 { 298 BCM2835SDHostState *s = (BCM2835SDHostState *)opaque; 299 300 trace_bcm2835_sdhost_write(offset, value, size); 301 302 switch (offset) { 303 case SDCMD: 304 s->cmd = value; 305 if (value & SDCMD_NEW_FLAG) { 306 bcm2835_sdhost_send_command(s); 307 bcm2835_sdhost_fifo_run(s); 308 s->cmd &= ~SDCMD_NEW_FLAG; 309 } 310 break; 311 case SDTOUT: 312 break; 313 case SDCDIV: 314 break; 315 case SDHSTS: 316 s->status &= ~value; 317 bcm2835_sdhost_update_irq(s); 318 break; 319 case SDARG: 320 s->cmdarg = value; 321 break; 322 case SDEDM: 323 if ((value & 0xf) == 0xf) { 324 /* power down */ 325 value &= ~0xf; 326 } 327 s->edm = value; 328 trace_bcm2835_sdhost_edm_change("guest register write", s->edm); 329 break; 330 case SDHCFG: 331 s->config = value; 332 bcm2835_sdhost_fifo_run(s); 333 break; 334 case SDVDD: 335 s->vdd = value; 336 break; 337 case SDDATA: 338 bcm2835_sdhost_fifo_push(s, value); 339 bcm2835_sdhost_fifo_run(s); 340 break; 341 case SDHBCT: 342 s->hbct = value; 343 break; 344 case SDHBLC: 345 s->hblc = value; 346 s->datacnt = s->hblc * s->hbct; 347 bcm2835_sdhost_fifo_run(s); 348 break; 349 350 default: 351 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 352 __func__, offset); 353 break; 354 } 355 } 356 357 static const MemoryRegionOps bcm2835_sdhost_ops = { 358 .read = bcm2835_sdhost_read, 359 .write = bcm2835_sdhost_write, 360 .endianness = DEVICE_NATIVE_ENDIAN, 361 }; 362 363 static const VMStateDescription vmstate_bcm2835_sdhost = { 364 .name = TYPE_BCM2835_SDHOST, 365 .version_id = 1, 366 .minimum_version_id = 1, 367 .fields = (VMStateField[]) { 368 VMSTATE_UINT32(cmd, BCM2835SDHostState), 369 VMSTATE_UINT32(cmdarg, BCM2835SDHostState), 370 VMSTATE_UINT32(status, BCM2835SDHostState), 371 VMSTATE_UINT32_ARRAY(rsp, BCM2835SDHostState, 4), 372 VMSTATE_UINT32(config, BCM2835SDHostState), 373 VMSTATE_UINT32(edm, BCM2835SDHostState), 374 VMSTATE_UINT32(vdd, BCM2835SDHostState), 375 VMSTATE_UINT32(hbct, BCM2835SDHostState), 376 VMSTATE_UINT32(hblc, BCM2835SDHostState), 377 VMSTATE_INT32(fifo_pos, BCM2835SDHostState), 378 VMSTATE_INT32(fifo_len, BCM2835SDHostState), 379 VMSTATE_UINT32_ARRAY(fifo, BCM2835SDHostState, BCM2835_SDHOST_FIFO_LEN), 380 VMSTATE_UINT32(datacnt, BCM2835SDHostState), 381 VMSTATE_END_OF_LIST() 382 } 383 }; 384 385 static void bcm2835_sdhost_init(Object *obj) 386 { 387 BCM2835SDHostState *s = BCM2835_SDHOST(obj); 388 389 qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), 390 TYPE_BCM2835_SDHOST_BUS, DEVICE(s), "sd-bus"); 391 392 memory_region_init_io(&s->iomem, obj, &bcm2835_sdhost_ops, s, 393 TYPE_BCM2835_SDHOST, 0x1000); 394 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem); 395 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq); 396 } 397 398 static void bcm2835_sdhost_reset(DeviceState *dev) 399 { 400 BCM2835SDHostState *s = BCM2835_SDHOST(dev); 401 402 s->cmd = 0; 403 s->cmdarg = 0; 404 s->edm = 0x0000c60f; 405 trace_bcm2835_sdhost_edm_change("device reset", s->edm); 406 s->config = 0; 407 s->hbct = 0; 408 s->hblc = 0; 409 s->datacnt = 0; 410 s->fifo_pos = 0; 411 s->fifo_len = 0; 412 } 413 414 static void bcm2835_sdhost_class_init(ObjectClass *klass, void *data) 415 { 416 DeviceClass *dc = DEVICE_CLASS(klass); 417 418 dc->reset = bcm2835_sdhost_reset; 419 dc->vmsd = &vmstate_bcm2835_sdhost; 420 } 421 422 static TypeInfo bcm2835_sdhost_info = { 423 .name = TYPE_BCM2835_SDHOST, 424 .parent = TYPE_SYS_BUS_DEVICE, 425 .instance_size = sizeof(BCM2835SDHostState), 426 .class_init = bcm2835_sdhost_class_init, 427 .instance_init = bcm2835_sdhost_init, 428 }; 429 430 static const TypeInfo bcm2835_sdhost_bus_info = { 431 .name = TYPE_BCM2835_SDHOST_BUS, 432 .parent = TYPE_SD_BUS, 433 .instance_size = sizeof(SDBus), 434 }; 435 436 static void bcm2835_sdhost_register_types(void) 437 { 438 type_register_static(&bcm2835_sdhost_info); 439 type_register_static(&bcm2835_sdhost_bus_info); 440 } 441 442 type_init(bcm2835_sdhost_register_types) 443