1 /* 2 * Raspberry Pi (BCM2835) SD Host Controller 3 * 4 * Copyright (c) 2017 Antfield SAS 5 * 6 * Authors: 7 * Clement Deschamps <clement.deschamps@antfield.fr> 8 * Luc Michel <luc.michel@antfield.fr> 9 * 10 * This work is licensed under the terms of the GNU GPL, version 2 or later. 11 * See the COPYING file in the top-level directory. 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/log.h" 16 #include "qemu/module.h" 17 #include "sysemu/blockdev.h" 18 #include "hw/irq.h" 19 #include "hw/sd/bcm2835_sdhost.h" 20 #include "trace.h" 21 22 #define TYPE_BCM2835_SDHOST_BUS "bcm2835-sdhost-bus" 23 #define BCM2835_SDHOST_BUS(obj) \ 24 OBJECT_CHECK(SDBus, (obj), TYPE_BCM2835_SDHOST_BUS) 25 26 #define SDCMD 0x00 /* Command to SD card - 16 R/W */ 27 #define SDARG 0x04 /* Argument to SD card - 32 R/W */ 28 #define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */ 29 #define SDCDIV 0x0c /* Start value for clock divider - 11 R/W */ 30 #define SDRSP0 0x10 /* SD card rsp (31:0) - 32 R */ 31 #define SDRSP1 0x14 /* SD card rsp (63:32) - 32 R */ 32 #define SDRSP2 0x18 /* SD card rsp (95:64) - 32 R */ 33 #define SDRSP3 0x1c /* SD card rsp (127:96) - 32 R */ 34 #define SDHSTS 0x20 /* SD host status - 11 R */ 35 #define SDVDD 0x30 /* SD card power control - 1 R/W */ 36 #define SDEDM 0x34 /* Emergency Debug Mode - 13 R/W */ 37 #define SDHCFG 0x38 /* Host configuration - 2 R/W */ 38 #define SDHBCT 0x3c /* Host byte count (debug) - 32 R/W */ 39 #define SDDATA 0x40 /* Data to/from SD card - 32 R/W */ 40 #define SDHBLC 0x50 /* Host block count (SDIO/SDHC) - 9 R/W */ 41 42 #define SDCMD_NEW_FLAG 0x8000 43 #define SDCMD_FAIL_FLAG 0x4000 44 #define SDCMD_BUSYWAIT 0x800 45 #define SDCMD_NO_RESPONSE 0x400 46 #define SDCMD_LONG_RESPONSE 0x200 47 #define SDCMD_WRITE_CMD 0x80 48 #define SDCMD_READ_CMD 0x40 49 #define SDCMD_CMD_MASK 0x3f 50 51 #define SDCDIV_MAX_CDIV 0x7ff 52 53 #define SDHSTS_BUSY_IRPT 0x400 54 #define SDHSTS_BLOCK_IRPT 0x200 55 #define SDHSTS_SDIO_IRPT 0x100 56 #define SDHSTS_REW_TIME_OUT 0x80 57 #define SDHSTS_CMD_TIME_OUT 0x40 58 #define SDHSTS_CRC16_ERROR 0x20 59 #define SDHSTS_CRC7_ERROR 0x10 60 #define SDHSTS_FIFO_ERROR 0x08 61 /* Reserved */ 62 /* Reserved */ 63 #define SDHSTS_DATA_FLAG 0x01 64 65 #define SDHCFG_BUSY_IRPT_EN (1 << 10) 66 #define SDHCFG_BLOCK_IRPT_EN (1 << 8) 67 #define SDHCFG_SDIO_IRPT_EN (1 << 5) 68 #define SDHCFG_DATA_IRPT_EN (1 << 4) 69 #define SDHCFG_SLOW_CARD (1 << 3) 70 #define SDHCFG_WIDE_EXT_BUS (1 << 2) 71 #define SDHCFG_WIDE_INT_BUS (1 << 1) 72 #define SDHCFG_REL_CMD_LINE (1 << 0) 73 74 #define SDEDM_FORCE_DATA_MODE (1 << 19) 75 #define SDEDM_CLOCK_PULSE (1 << 20) 76 #define SDEDM_BYPASS (1 << 21) 77 78 #define SDEDM_WRITE_THRESHOLD_SHIFT 9 79 #define SDEDM_READ_THRESHOLD_SHIFT 14 80 #define SDEDM_THRESHOLD_MASK 0x1f 81 82 #define SDEDM_FSM_MASK 0xf 83 #define SDEDM_FSM_IDENTMODE 0x0 84 #define SDEDM_FSM_DATAMODE 0x1 85 #define SDEDM_FSM_READDATA 0x2 86 #define SDEDM_FSM_WRITEDATA 0x3 87 #define SDEDM_FSM_READWAIT 0x4 88 #define SDEDM_FSM_READCRC 0x5 89 #define SDEDM_FSM_WRITECRC 0x6 90 #define SDEDM_FSM_WRITEWAIT1 0x7 91 #define SDEDM_FSM_POWERDOWN 0x8 92 #define SDEDM_FSM_POWERUP 0x9 93 #define SDEDM_FSM_WRITESTART1 0xa 94 #define SDEDM_FSM_WRITESTART2 0xb 95 #define SDEDM_FSM_GENPULSES 0xc 96 #define SDEDM_FSM_WRITEWAIT2 0xd 97 #define SDEDM_FSM_STARTPOWDOWN 0xf 98 99 #define SDDATA_FIFO_WORDS 16 100 101 static void bcm2835_sdhost_update_irq(BCM2835SDHostState *s) 102 { 103 uint32_t irq = s->status & 104 (SDHSTS_BUSY_IRPT | SDHSTS_BLOCK_IRPT | SDHSTS_SDIO_IRPT); 105 trace_bcm2835_sdhost_update_irq(irq); 106 qemu_set_irq(s->irq, !!irq); 107 } 108 109 static void bcm2835_sdhost_send_command(BCM2835SDHostState *s) 110 { 111 SDRequest request; 112 uint8_t rsp[16]; 113 int rlen; 114 115 request.cmd = s->cmd & SDCMD_CMD_MASK; 116 request.arg = s->cmdarg; 117 118 rlen = sdbus_do_command(&s->sdbus, &request, rsp); 119 if (rlen < 0) { 120 goto error; 121 } 122 if (!(s->cmd & SDCMD_NO_RESPONSE)) { 123 if (rlen == 0 || (rlen == 4 && (s->cmd & SDCMD_LONG_RESPONSE))) { 124 goto error; 125 } 126 if (rlen != 4 && rlen != 16) { 127 goto error; 128 } 129 if (rlen == 4) { 130 s->rsp[0] = ldl_be_p(&rsp[0]); 131 s->rsp[1] = s->rsp[2] = s->rsp[3] = 0; 132 } else { 133 s->rsp[0] = ldl_be_p(&rsp[12]); 134 s->rsp[1] = ldl_be_p(&rsp[8]); 135 s->rsp[2] = ldl_be_p(&rsp[4]); 136 s->rsp[3] = ldl_be_p(&rsp[0]); 137 } 138 } 139 /* We never really delay commands, so if this was a 'busywait' command 140 * then we've completed it now and can raise the interrupt. 141 */ 142 if ((s->cmd & SDCMD_BUSYWAIT) && (s->config & SDHCFG_BUSY_IRPT_EN)) { 143 s->status |= SDHSTS_BUSY_IRPT; 144 } 145 return; 146 147 error: 148 s->cmd |= SDCMD_FAIL_FLAG; 149 s->status |= SDHSTS_CMD_TIME_OUT; 150 } 151 152 static void bcm2835_sdhost_fifo_push(BCM2835SDHostState *s, uint32_t value) 153 { 154 int n; 155 156 if (s->fifo_len == BCM2835_SDHOST_FIFO_LEN) { 157 /* FIFO overflow */ 158 return; 159 } 160 n = (s->fifo_pos + s->fifo_len) & (BCM2835_SDHOST_FIFO_LEN - 1); 161 s->fifo_len++; 162 s->fifo[n] = value; 163 } 164 165 static uint32_t bcm2835_sdhost_fifo_pop(BCM2835SDHostState *s) 166 { 167 uint32_t value; 168 169 if (s->fifo_len == 0) { 170 /* FIFO underflow */ 171 return 0; 172 } 173 value = s->fifo[s->fifo_pos]; 174 s->fifo_len--; 175 s->fifo_pos = (s->fifo_pos + 1) & (BCM2835_SDHOST_FIFO_LEN - 1); 176 return value; 177 } 178 179 static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s) 180 { 181 uint32_t value = 0; 182 int n; 183 int is_read; 184 int is_write; 185 186 is_read = (s->cmd & SDCMD_READ_CMD) != 0; 187 is_write = (s->cmd & SDCMD_WRITE_CMD) != 0; 188 if (s->datacnt != 0 && (is_write || sdbus_data_ready(&s->sdbus))) { 189 if (is_read) { 190 n = 0; 191 while (s->datacnt && s->fifo_len < BCM2835_SDHOST_FIFO_LEN) { 192 value |= (uint32_t)sdbus_read_data(&s->sdbus) << (n * 8); 193 s->datacnt--; 194 n++; 195 if (n == 4) { 196 bcm2835_sdhost_fifo_push(s, value); 197 s->status |= SDHSTS_DATA_FLAG; 198 if (s->config & SDHCFG_DATA_IRPT_EN) { 199 s->status |= SDHSTS_SDIO_IRPT; 200 } 201 n = 0; 202 value = 0; 203 } 204 } 205 if (n != 0) { 206 bcm2835_sdhost_fifo_push(s, value); 207 s->status |= SDHSTS_DATA_FLAG; 208 if (s->config & SDHCFG_DATA_IRPT_EN) { 209 s->status |= SDHSTS_SDIO_IRPT; 210 } 211 } 212 } else if (is_write) { /* write */ 213 n = 0; 214 while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) { 215 if (n == 0) { 216 value = bcm2835_sdhost_fifo_pop(s); 217 s->status |= SDHSTS_DATA_FLAG; 218 if (s->config & SDHCFG_DATA_IRPT_EN) { 219 s->status |= SDHSTS_SDIO_IRPT; 220 } 221 n = 4; 222 } 223 n--; 224 s->datacnt--; 225 sdbus_write_data(&s->sdbus, value & 0xff); 226 value >>= 8; 227 } 228 } 229 if (s->datacnt == 0) { 230 s->edm &= ~SDEDM_FSM_MASK; 231 s->edm |= SDEDM_FSM_DATAMODE; 232 trace_bcm2835_sdhost_edm_change("datacnt 0", s->edm); 233 } 234 if (is_write) { 235 /* set block interrupt at end of each block transfer */ 236 if (s->hbct && s->datacnt % s->hbct == 0 && 237 (s->config & SDHCFG_BLOCK_IRPT_EN)) { 238 s->status |= SDHSTS_BLOCK_IRPT; 239 } 240 /* set data interrupt after each transfer */ 241 s->status |= SDHSTS_DATA_FLAG; 242 if (s->config & SDHCFG_DATA_IRPT_EN) { 243 s->status |= SDHSTS_SDIO_IRPT; 244 } 245 } 246 } 247 248 bcm2835_sdhost_update_irq(s); 249 250 s->edm &= ~(0x1f << 4); 251 s->edm |= ((s->fifo_len & 0x1f) << 4); 252 trace_bcm2835_sdhost_edm_change("fifo run", s->edm); 253 } 254 255 static uint64_t bcm2835_sdhost_read(void *opaque, hwaddr offset, 256 unsigned size) 257 { 258 BCM2835SDHostState *s = (BCM2835SDHostState *)opaque; 259 uint32_t res = 0; 260 261 switch (offset) { 262 case SDCMD: 263 res = s->cmd; 264 break; 265 case SDHSTS: 266 res = s->status; 267 break; 268 case SDRSP0: 269 res = s->rsp[0]; 270 break; 271 case SDRSP1: 272 res = s->rsp[1]; 273 break; 274 case SDRSP2: 275 res = s->rsp[2]; 276 break; 277 case SDRSP3: 278 res = s->rsp[3]; 279 break; 280 case SDEDM: 281 res = s->edm; 282 break; 283 case SDVDD: 284 res = s->vdd; 285 break; 286 case SDDATA: 287 res = bcm2835_sdhost_fifo_pop(s); 288 bcm2835_sdhost_fifo_run(s); 289 break; 290 case SDHBCT: 291 res = s->hbct; 292 break; 293 case SDHBLC: 294 res = s->hblc; 295 break; 296 297 default: 298 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 299 __func__, offset); 300 res = 0; 301 break; 302 } 303 304 trace_bcm2835_sdhost_read(offset, res, size); 305 306 return res; 307 } 308 309 static void bcm2835_sdhost_write(void *opaque, hwaddr offset, 310 uint64_t value, unsigned size) 311 { 312 BCM2835SDHostState *s = (BCM2835SDHostState *)opaque; 313 314 trace_bcm2835_sdhost_write(offset, value, size); 315 316 switch (offset) { 317 case SDCMD: 318 s->cmd = value; 319 if (value & SDCMD_NEW_FLAG) { 320 bcm2835_sdhost_send_command(s); 321 bcm2835_sdhost_fifo_run(s); 322 s->cmd &= ~SDCMD_NEW_FLAG; 323 } 324 break; 325 case SDTOUT: 326 break; 327 case SDCDIV: 328 break; 329 case SDHSTS: 330 s->status &= ~value; 331 bcm2835_sdhost_update_irq(s); 332 break; 333 case SDARG: 334 s->cmdarg = value; 335 break; 336 case SDEDM: 337 if ((value & 0xf) == 0xf) { 338 /* power down */ 339 value &= ~0xf; 340 } 341 s->edm = value; 342 trace_bcm2835_sdhost_edm_change("guest register write", s->edm); 343 break; 344 case SDHCFG: 345 s->config = value; 346 bcm2835_sdhost_fifo_run(s); 347 break; 348 case SDVDD: 349 s->vdd = value; 350 break; 351 case SDDATA: 352 bcm2835_sdhost_fifo_push(s, value); 353 bcm2835_sdhost_fifo_run(s); 354 break; 355 case SDHBCT: 356 s->hbct = value; 357 break; 358 case SDHBLC: 359 s->hblc = value; 360 s->datacnt = s->hblc * s->hbct; 361 bcm2835_sdhost_fifo_run(s); 362 break; 363 364 default: 365 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 366 __func__, offset); 367 break; 368 } 369 } 370 371 static const MemoryRegionOps bcm2835_sdhost_ops = { 372 .read = bcm2835_sdhost_read, 373 .write = bcm2835_sdhost_write, 374 .endianness = DEVICE_NATIVE_ENDIAN, 375 }; 376 377 static const VMStateDescription vmstate_bcm2835_sdhost = { 378 .name = TYPE_BCM2835_SDHOST, 379 .version_id = 1, 380 .minimum_version_id = 1, 381 .fields = (VMStateField[]) { 382 VMSTATE_UINT32(cmd, BCM2835SDHostState), 383 VMSTATE_UINT32(cmdarg, BCM2835SDHostState), 384 VMSTATE_UINT32(status, BCM2835SDHostState), 385 VMSTATE_UINT32_ARRAY(rsp, BCM2835SDHostState, 4), 386 VMSTATE_UINT32(config, BCM2835SDHostState), 387 VMSTATE_UINT32(edm, BCM2835SDHostState), 388 VMSTATE_UINT32(vdd, BCM2835SDHostState), 389 VMSTATE_UINT32(hbct, BCM2835SDHostState), 390 VMSTATE_UINT32(hblc, BCM2835SDHostState), 391 VMSTATE_INT32(fifo_pos, BCM2835SDHostState), 392 VMSTATE_INT32(fifo_len, BCM2835SDHostState), 393 VMSTATE_UINT32_ARRAY(fifo, BCM2835SDHostState, BCM2835_SDHOST_FIFO_LEN), 394 VMSTATE_UINT32(datacnt, BCM2835SDHostState), 395 VMSTATE_END_OF_LIST() 396 } 397 }; 398 399 static void bcm2835_sdhost_init(Object *obj) 400 { 401 BCM2835SDHostState *s = BCM2835_SDHOST(obj); 402 403 qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), 404 TYPE_BCM2835_SDHOST_BUS, DEVICE(s), "sd-bus"); 405 406 memory_region_init_io(&s->iomem, obj, &bcm2835_sdhost_ops, s, 407 TYPE_BCM2835_SDHOST, 0x1000); 408 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem); 409 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq); 410 } 411 412 static void bcm2835_sdhost_reset(DeviceState *dev) 413 { 414 BCM2835SDHostState *s = BCM2835_SDHOST(dev); 415 416 s->cmd = 0; 417 s->cmdarg = 0; 418 s->edm = 0x0000c60f; 419 trace_bcm2835_sdhost_edm_change("device reset", s->edm); 420 s->config = 0; 421 s->hbct = 0; 422 s->hblc = 0; 423 s->datacnt = 0; 424 s->fifo_pos = 0; 425 s->fifo_len = 0; 426 } 427 428 static void bcm2835_sdhost_class_init(ObjectClass *klass, void *data) 429 { 430 DeviceClass *dc = DEVICE_CLASS(klass); 431 432 dc->reset = bcm2835_sdhost_reset; 433 dc->vmsd = &vmstate_bcm2835_sdhost; 434 } 435 436 static TypeInfo bcm2835_sdhost_info = { 437 .name = TYPE_BCM2835_SDHOST, 438 .parent = TYPE_SYS_BUS_DEVICE, 439 .instance_size = sizeof(BCM2835SDHostState), 440 .class_init = bcm2835_sdhost_class_init, 441 .instance_init = bcm2835_sdhost_init, 442 }; 443 444 static const TypeInfo bcm2835_sdhost_bus_info = { 445 .name = TYPE_BCM2835_SDHOST_BUS, 446 .parent = TYPE_SD_BUS, 447 .instance_size = sizeof(SDBus), 448 }; 449 450 static void bcm2835_sdhost_register_types(void) 451 { 452 type_register_static(&bcm2835_sdhost_info); 453 type_register_static(&bcm2835_sdhost_bus_info); 454 } 455 456 type_init(bcm2835_sdhost_register_types) 457