xref: /openbmc/qemu/hw/sd/sdhci.c (revision 2ce68e4c)
1 /*
2  * SD Association Host Standard Specification v2.0 controller emulation
3  *
4  * Copyright (c) 2011 Samsung Electronics Co., Ltd.
5  * Mitsyanko Igor <i.mitsyanko@samsung.com>
6  * Peter A.G. Crosthwaite <peter.crosthwaite@petalogix.com>
7  *
8  * Based on MMC controller for Samsung S5PC1xx-based board emulation
9  * by Alexey Merkulov and Vladimir Monakhov.
10  *
11  * This program is free software; you can redistribute it and/or modify it
12  * under the terms of the GNU General Public License as published by the
13  * Free Software Foundation; either version 2 of the License, or (at your
14  * option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
19  * See the GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24 
25 #include <inttypes.h>
26 #include "hw/hw.h"
27 #include "sysemu/block-backend.h"
28 #include "sysemu/blockdev.h"
29 #include "sysemu/dma.h"
30 #include "qemu/timer.h"
31 #include "qemu/bitops.h"
32 
33 #include "sdhci.h"
34 
35 /* host controller debug messages */
36 #ifndef SDHC_DEBUG
37 #define SDHC_DEBUG                        0
38 #endif
39 
40 #define DPRINT_L1(fmt, args...) \
41     do { \
42         if (SDHC_DEBUG) { \
43             fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
44         } \
45     } while (0)
46 #define DPRINT_L2(fmt, args...) \
47     do { \
48         if (SDHC_DEBUG > 1) { \
49             fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
50         } \
51     } while (0)
52 #define ERRPRINT(fmt, args...) \
53     do { \
54         if (SDHC_DEBUG) { \
55             fprintf(stderr, "QEMU SDHC ERROR: " fmt, ## args); \
56         } \
57     } while (0)
58 
59 /* Default SD/MMC host controller features information, which will be
60  * presented in CAPABILITIES register of generic SD host controller at reset.
61  * If not stated otherwise:
62  * 0 - not supported, 1 - supported, other - prohibited.
63  */
64 #define SDHC_CAPAB_64BITBUS       0ul        /* 64-bit System Bus Support */
65 #define SDHC_CAPAB_18V            1ul        /* Voltage support 1.8v */
66 #define SDHC_CAPAB_30V            0ul        /* Voltage support 3.0v */
67 #define SDHC_CAPAB_33V            1ul        /* Voltage support 3.3v */
68 #define SDHC_CAPAB_SUSPRESUME     0ul        /* Suspend/resume support */
69 #define SDHC_CAPAB_SDMA           1ul        /* SDMA support */
70 #define SDHC_CAPAB_HIGHSPEED      1ul        /* High speed support */
71 #define SDHC_CAPAB_ADMA1          1ul        /* ADMA1 support */
72 #define SDHC_CAPAB_ADMA2          1ul        /* ADMA2 support */
73 /* Maximum host controller R/W buffers size
74  * Possible values: 512, 1024, 2048 bytes */
75 #define SDHC_CAPAB_MAXBLOCKLENGTH 512ul
76 /* Maximum clock frequency for SDclock in MHz
77  * value in range 10-63 MHz, 0 - not defined */
78 #define SDHC_CAPAB_BASECLKFREQ    52ul
79 #define SDHC_CAPAB_TOUNIT         1ul  /* Timeout clock unit 0 - kHz, 1 - MHz */
80 /* Timeout clock frequency 1-63, 0 - not defined */
81 #define SDHC_CAPAB_TOCLKFREQ      52ul
82 
83 /* Now check all parameters and calculate CAPABILITIES REGISTER value */
84 #if SDHC_CAPAB_64BITBUS > 1 || SDHC_CAPAB_18V > 1 || SDHC_CAPAB_30V > 1 ||     \
85     SDHC_CAPAB_33V > 1 || SDHC_CAPAB_SUSPRESUME > 1 || SDHC_CAPAB_SDMA > 1 ||  \
86     SDHC_CAPAB_HIGHSPEED > 1 || SDHC_CAPAB_ADMA2 > 1 || SDHC_CAPAB_ADMA1 > 1 ||\
87     SDHC_CAPAB_TOUNIT > 1
88 #error Capabilities features can have value 0 or 1 only!
89 #endif
90 
91 #if SDHC_CAPAB_MAXBLOCKLENGTH == 512
92 #define MAX_BLOCK_LENGTH 0ul
93 #elif SDHC_CAPAB_MAXBLOCKLENGTH == 1024
94 #define MAX_BLOCK_LENGTH 1ul
95 #elif SDHC_CAPAB_MAXBLOCKLENGTH == 2048
96 #define MAX_BLOCK_LENGTH 2ul
97 #else
98 #error Max host controller block size can have value 512, 1024 or 2048 only!
99 #endif
100 
101 #if (SDHC_CAPAB_BASECLKFREQ > 0 && SDHC_CAPAB_BASECLKFREQ < 10) || \
102     SDHC_CAPAB_BASECLKFREQ > 63
103 #error SDclock frequency can have value in range 0, 10-63 only!
104 #endif
105 
106 #if SDHC_CAPAB_TOCLKFREQ > 63
107 #error Timeout clock frequency can have value in range 0-63 only!
108 #endif
109 
110 #define SDHC_CAPAB_REG_DEFAULT                                 \
111    ((SDHC_CAPAB_64BITBUS << 28) | (SDHC_CAPAB_18V << 26) |     \
112     (SDHC_CAPAB_30V << 25) | (SDHC_CAPAB_33V << 24) |          \
113     (SDHC_CAPAB_SUSPRESUME << 23) | (SDHC_CAPAB_SDMA << 22) |  \
114     (SDHC_CAPAB_HIGHSPEED << 21) | (SDHC_CAPAB_ADMA1 << 20) |  \
115     (SDHC_CAPAB_ADMA2 << 19) | (MAX_BLOCK_LENGTH << 16) |      \
116     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
117     (SDHC_CAPAB_TOCLKFREQ))
118 
119 #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
120 
121 static uint8_t sdhci_slotint(SDHCIState *s)
122 {
123     return (s->norintsts & s->norintsigen) || (s->errintsts & s->errintsigen) ||
124          ((s->norintsts & SDHC_NIS_INSERT) && (s->wakcon & SDHC_WKUP_ON_INS)) ||
125          ((s->norintsts & SDHC_NIS_REMOVE) && (s->wakcon & SDHC_WKUP_ON_RMV));
126 }
127 
128 static inline void sdhci_update_irq(SDHCIState *s)
129 {
130     qemu_set_irq(s->irq, sdhci_slotint(s));
131 }
132 
133 static void sdhci_raise_insertion_irq(void *opaque)
134 {
135     SDHCIState *s = (SDHCIState *)opaque;
136 
137     if (s->norintsts & SDHC_NIS_REMOVE) {
138         timer_mod(s->insert_timer,
139                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY);
140     } else {
141         s->prnsts = 0x1ff0000;
142         if (s->norintstsen & SDHC_NISEN_INSERT) {
143             s->norintsts |= SDHC_NIS_INSERT;
144         }
145         sdhci_update_irq(s);
146     }
147 }
148 
149 static void sdhci_insert_eject_cb(void *opaque, int irq, int level)
150 {
151     SDHCIState *s = (SDHCIState *)opaque;
152     DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject");
153 
154     if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
155         /* Give target some time to notice card ejection */
156         timer_mod(s->insert_timer,
157                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY);
158     } else {
159         if (level) {
160             s->prnsts = 0x1ff0000;
161             if (s->norintstsen & SDHC_NISEN_INSERT) {
162                 s->norintsts |= SDHC_NIS_INSERT;
163             }
164         } else {
165             s->prnsts = 0x1fa0000;
166             s->pwrcon &= ~SDHC_POWER_ON;
167             s->clkcon &= ~SDHC_CLOCK_SDCLK_EN;
168             if (s->norintstsen & SDHC_NISEN_REMOVE) {
169                 s->norintsts |= SDHC_NIS_REMOVE;
170             }
171         }
172         sdhci_update_irq(s);
173     }
174 }
175 
176 static void sdhci_card_readonly_cb(void *opaque, int irq, int level)
177 {
178     SDHCIState *s = (SDHCIState *)opaque;
179 
180     if (level) {
181         s->prnsts &= ~SDHC_WRITE_PROTECT;
182     } else {
183         /* Write enabled */
184         s->prnsts |= SDHC_WRITE_PROTECT;
185     }
186 }
187 
188 static void sdhci_reset(SDHCIState *s)
189 {
190     timer_del(s->insert_timer);
191     timer_del(s->transfer_timer);
192     /* Set all registers to 0. Capabilities registers are not cleared
193      * and assumed to always preserve their value, given to them during
194      * initialization */
195     memset(&s->sdmasysad, 0, (uintptr_t)&s->capareg - (uintptr_t)&s->sdmasysad);
196 
197     sd_set_cb(s->card, s->ro_cb, s->eject_cb);
198     s->data_count = 0;
199     s->stopped_state = sdhc_not_stopped;
200 }
201 
202 static void sdhci_data_transfer(void *opaque);
203 
204 static void sdhci_send_command(SDHCIState *s)
205 {
206     SDRequest request;
207     uint8_t response[16];
208     int rlen;
209 
210     s->errintsts = 0;
211     s->acmd12errsts = 0;
212     request.cmd = s->cmdreg >> 8;
213     request.arg = s->argument;
214     DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg);
215     rlen = sd_do_command(s->card, &request, response);
216 
217     if (s->cmdreg & SDHC_CMD_RESPONSE) {
218         if (rlen == 4) {
219             s->rspreg[0] = (response[0] << 24) | (response[1] << 16) |
220                            (response[2] << 8)  |  response[3];
221             s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
222             DPRINT_L1("Response: RSPREG[31..0]=0x%08x\n", s->rspreg[0]);
223         } else if (rlen == 16) {
224             s->rspreg[0] = (response[11] << 24) | (response[12] << 16) |
225                            (response[13] << 8) |  response[14];
226             s->rspreg[1] = (response[7] << 24) | (response[8] << 16) |
227                            (response[9] << 8)  |  response[10];
228             s->rspreg[2] = (response[3] << 24) | (response[4] << 16) |
229                            (response[5] << 8)  |  response[6];
230             s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
231                             response[2];
232             DPRINT_L1("Response received:\n RSPREG[127..96]=0x%08x, RSPREG[95.."
233                   "64]=0x%08x,\n RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x\n",
234                   s->rspreg[3], s->rspreg[2], s->rspreg[1], s->rspreg[0]);
235         } else {
236             ERRPRINT("Timeout waiting for command response\n");
237             if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
238                 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
239                 s->norintsts |= SDHC_NIS_ERR;
240             }
241         }
242 
243         if ((s->norintstsen & SDHC_NISEN_TRSCMP) &&
244             (s->cmdreg & SDHC_CMD_RESPONSE) == SDHC_CMD_RSP_WITH_BUSY) {
245             s->norintsts |= SDHC_NIS_TRSCMP;
246         }
247     } else if (rlen != 0 && (s->errintstsen & SDHC_EISEN_CMDIDX)) {
248         s->errintsts |= SDHC_EIS_CMDIDX;
249         s->norintsts |= SDHC_NIS_ERR;
250     }
251 
252     if (s->norintstsen & SDHC_NISEN_CMDCMP) {
253         s->norintsts |= SDHC_NIS_CMDCMP;
254     }
255 
256     sdhci_update_irq(s);
257 
258     if (s->blksize && (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
259         s->data_count = 0;
260         sdhci_data_transfer(s);
261     }
262 }
263 
264 static void sdhci_end_transfer(SDHCIState *s)
265 {
266     /* Automatically send CMD12 to stop transfer if AutoCMD12 enabled */
267     if ((s->trnmod & SDHC_TRNS_ACMD12) != 0) {
268         SDRequest request;
269         uint8_t response[16];
270 
271         request.cmd = 0x0C;
272         request.arg = 0;
273         DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg);
274         sd_do_command(s->card, &request, response);
275         /* Auto CMD12 response goes to the upper Response register */
276         s->rspreg[3] = (response[0] << 24) | (response[1] << 16) |
277                 (response[2] << 8) | response[3];
278     }
279 
280     s->prnsts &= ~(SDHC_DOING_READ | SDHC_DOING_WRITE |
281             SDHC_DAT_LINE_ACTIVE | SDHC_DATA_INHIBIT |
282             SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE);
283 
284     if (s->norintstsen & SDHC_NISEN_TRSCMP) {
285         s->norintsts |= SDHC_NIS_TRSCMP;
286     }
287 
288     sdhci_update_irq(s);
289 }
290 
291 /*
292  * Programmed i/o data transfer
293  */
294 
295 /* Fill host controller's read buffer with BLKSIZE bytes of data from card */
296 static void sdhci_read_block_from_card(SDHCIState *s)
297 {
298     int index = 0;
299 
300     if ((s->trnmod & SDHC_TRNS_MULTI) &&
301             (s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0)) {
302         return;
303     }
304 
305     for (index = 0; index < (s->blksize & 0x0fff); index++) {
306         s->fifo_buffer[index] = sd_read_data(s->card);
307     }
308 
309     /* New data now available for READ through Buffer Port Register */
310     s->prnsts |= SDHC_DATA_AVAILABLE;
311     if (s->norintstsen & SDHC_NISEN_RBUFRDY) {
312         s->norintsts |= SDHC_NIS_RBUFRDY;
313     }
314 
315     /* Clear DAT line active status if that was the last block */
316     if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
317             ((s->trnmod & SDHC_TRNS_MULTI) && s->blkcnt == 1)) {
318         s->prnsts &= ~SDHC_DAT_LINE_ACTIVE;
319     }
320 
321     /* If stop at block gap request was set and it's not the last block of
322      * data - generate Block Event interrupt */
323     if (s->stopped_state == sdhc_gap_read && (s->trnmod & SDHC_TRNS_MULTI) &&
324             s->blkcnt != 1)    {
325         s->prnsts &= ~SDHC_DAT_LINE_ACTIVE;
326         if (s->norintstsen & SDHC_EISEN_BLKGAP) {
327             s->norintsts |= SDHC_EIS_BLKGAP;
328         }
329     }
330 
331     sdhci_update_irq(s);
332 }
333 
334 /* Read @size byte of data from host controller @s BUFFER DATA PORT register */
335 static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
336 {
337     uint32_t value = 0;
338     int i;
339 
340     /* first check that a valid data exists in host controller input buffer */
341     if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
342         ERRPRINT("Trying to read from empty buffer\n");
343         return 0;
344     }
345 
346     for (i = 0; i < size; i++) {
347         value |= s->fifo_buffer[s->data_count] << i * 8;
348         s->data_count++;
349         /* check if we've read all valid data (blksize bytes) from buffer */
350         if ((s->data_count) >= (s->blksize & 0x0fff)) {
351             DPRINT_L2("All %u bytes of data have been read from input buffer\n",
352                     s->data_count);
353             s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
354             s->data_count = 0;  /* next buff read must start at position [0] */
355 
356             if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
357                 s->blkcnt--;
358             }
359 
360             /* if that was the last block of data */
361             if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
362                 ((s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0)) ||
363                  /* stop at gap request */
364                 (s->stopped_state == sdhc_gap_read &&
365                  !(s->prnsts & SDHC_DAT_LINE_ACTIVE))) {
366                 sdhci_end_transfer(s);
367             } else { /* if there are more data, read next block from card */
368                 sdhci_read_block_from_card(s);
369             }
370             break;
371         }
372     }
373 
374     return value;
375 }
376 
377 /* Write data from host controller FIFO to card */
378 static void sdhci_write_block_to_card(SDHCIState *s)
379 {
380     int index = 0;
381 
382     if (s->prnsts & SDHC_SPACE_AVAILABLE) {
383         if (s->norintstsen & SDHC_NISEN_WBUFRDY) {
384             s->norintsts |= SDHC_NIS_WBUFRDY;
385         }
386         sdhci_update_irq(s);
387         return;
388     }
389 
390     if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
391         if (s->blkcnt == 0) {
392             return;
393         } else {
394             s->blkcnt--;
395         }
396     }
397 
398     for (index = 0; index < (s->blksize & 0x0fff); index++) {
399         sd_write_data(s->card, s->fifo_buffer[index]);
400     }
401 
402     /* Next data can be written through BUFFER DATORT register */
403     s->prnsts |= SDHC_SPACE_AVAILABLE;
404 
405     /* Finish transfer if that was the last block of data */
406     if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
407             ((s->trnmod & SDHC_TRNS_MULTI) &&
408             (s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0))) {
409         sdhci_end_transfer(s);
410     } else if (s->norintstsen & SDHC_NISEN_WBUFRDY) {
411         s->norintsts |= SDHC_NIS_WBUFRDY;
412     }
413 
414     /* Generate Block Gap Event if requested and if not the last block */
415     if (s->stopped_state == sdhc_gap_write && (s->trnmod & SDHC_TRNS_MULTI) &&
416             s->blkcnt > 0) {
417         s->prnsts &= ~SDHC_DOING_WRITE;
418         if (s->norintstsen & SDHC_EISEN_BLKGAP) {
419             s->norintsts |= SDHC_EIS_BLKGAP;
420         }
421         sdhci_end_transfer(s);
422     }
423 
424     sdhci_update_irq(s);
425 }
426 
427 /* Write @size bytes of @value data to host controller @s Buffer Data Port
428  * register */
429 static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
430 {
431     unsigned i;
432 
433     /* Check that there is free space left in a buffer */
434     if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
435         ERRPRINT("Can't write to data buffer: buffer full\n");
436         return;
437     }
438 
439     for (i = 0; i < size; i++) {
440         s->fifo_buffer[s->data_count] = value & 0xFF;
441         s->data_count++;
442         value >>= 8;
443         if (s->data_count >= (s->blksize & 0x0fff)) {
444             DPRINT_L2("write buffer filled with %u bytes of data\n",
445                     s->data_count);
446             s->data_count = 0;
447             s->prnsts &= ~SDHC_SPACE_AVAILABLE;
448             if (s->prnsts & SDHC_DOING_WRITE) {
449                 sdhci_write_block_to_card(s);
450             }
451         }
452     }
453 }
454 
455 /*
456  * Single DMA data transfer
457  */
458 
459 /* Multi block SDMA transfer */
460 static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
461 {
462     bool page_aligned = false;
463     unsigned int n, begin;
464     const uint16_t block_size = s->blksize & 0x0fff;
465     uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);
466     uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
467 
468     /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
469      * possible stop at page boundary if initial address is not page aligned,
470      * allow them to work properly */
471     if ((s->sdmasysad % boundary_chk) == 0) {
472         page_aligned = true;
473     }
474 
475     if (s->trnmod & SDHC_TRNS_READ) {
476         s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
477                 SDHC_DAT_LINE_ACTIVE;
478         while (s->blkcnt) {
479             if (s->data_count == 0) {
480                 for (n = 0; n < block_size; n++) {
481                     s->fifo_buffer[n] = sd_read_data(s->card);
482                 }
483             }
484             begin = s->data_count;
485             if (((boundary_count + begin) < block_size) && page_aligned) {
486                 s->data_count = boundary_count + begin;
487                 boundary_count = 0;
488              } else {
489                 s->data_count = block_size;
490                 boundary_count -= block_size - begin;
491                 if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
492                     s->blkcnt--;
493                 }
494             }
495             dma_memory_write(&address_space_memory, s->sdmasysad,
496                              &s->fifo_buffer[begin], s->data_count - begin);
497             s->sdmasysad += s->data_count - begin;
498             if (s->data_count == block_size) {
499                 s->data_count = 0;
500             }
501             if (page_aligned && boundary_count == 0) {
502                 break;
503             }
504         }
505     } else {
506         s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT |
507                 SDHC_DAT_LINE_ACTIVE;
508         while (s->blkcnt) {
509             begin = s->data_count;
510             if (((boundary_count + begin) < block_size) && page_aligned) {
511                 s->data_count = boundary_count + begin;
512                 boundary_count = 0;
513              } else {
514                 s->data_count = block_size;
515                 boundary_count -= block_size - begin;
516             }
517             dma_memory_read(&address_space_memory, s->sdmasysad,
518                             &s->fifo_buffer[begin], s->data_count);
519             s->sdmasysad += s->data_count - begin;
520             if (s->data_count == block_size) {
521                 for (n = 0; n < block_size; n++) {
522                     sd_write_data(s->card, s->fifo_buffer[n]);
523                 }
524                 s->data_count = 0;
525                 if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
526                     s->blkcnt--;
527                 }
528             }
529             if (page_aligned && boundary_count == 0) {
530                 break;
531             }
532         }
533     }
534 
535     if (s->blkcnt == 0) {
536         sdhci_end_transfer(s);
537     } else {
538         if (s->norintstsen & SDHC_NISEN_DMA) {
539             s->norintsts |= SDHC_NIS_DMA;
540         }
541         sdhci_update_irq(s);
542     }
543 }
544 
545 /* single block SDMA transfer */
546 
547 static void sdhci_sdma_transfer_single_block(SDHCIState *s)
548 {
549     int n;
550     uint32_t datacnt = s->blksize & 0x0fff;
551 
552     if (s->trnmod & SDHC_TRNS_READ) {
553         for (n = 0; n < datacnt; n++) {
554             s->fifo_buffer[n] = sd_read_data(s->card);
555         }
556         dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer,
557                          datacnt);
558     } else {
559         dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer,
560                         datacnt);
561         for (n = 0; n < datacnt; n++) {
562             sd_write_data(s->card, s->fifo_buffer[n]);
563         }
564     }
565 
566     if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
567         s->blkcnt--;
568     }
569 
570     sdhci_end_transfer(s);
571 }
572 
573 typedef struct ADMADescr {
574     hwaddr addr;
575     uint16_t length;
576     uint8_t attr;
577     uint8_t incr;
578 } ADMADescr;
579 
580 static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
581 {
582     uint32_t adma1 = 0;
583     uint64_t adma2 = 0;
584     hwaddr entry_addr = (hwaddr)s->admasysaddr;
585     switch (SDHC_DMA_TYPE(s->hostctl)) {
586     case SDHC_CTRL_ADMA2_32:
587         dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma2,
588                         sizeof(adma2));
589         adma2 = le64_to_cpu(adma2);
590         /* The spec does not specify endianness of descriptor table.
591          * We currently assume that it is LE.
592          */
593         dscr->addr = (hwaddr)extract64(adma2, 32, 32) & ~0x3ull;
594         dscr->length = (uint16_t)extract64(adma2, 16, 16);
595         dscr->attr = (uint8_t)extract64(adma2, 0, 7);
596         dscr->incr = 8;
597         break;
598     case SDHC_CTRL_ADMA1_32:
599         dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma1,
600                         sizeof(adma1));
601         adma1 = le32_to_cpu(adma1);
602         dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
603         dscr->attr = (uint8_t)extract32(adma1, 0, 7);
604         dscr->incr = 4;
605         if ((dscr->attr & SDHC_ADMA_ATTR_ACT_MASK) == SDHC_ADMA_ATTR_SET_LEN) {
606             dscr->length = (uint16_t)extract32(adma1, 12, 16);
607         } else {
608             dscr->length = 4096;
609         }
610         break;
611     case SDHC_CTRL_ADMA2_64:
612         dma_memory_read(&address_space_memory, entry_addr,
613                         (uint8_t *)(&dscr->attr), 1);
614         dma_memory_read(&address_space_memory, entry_addr + 2,
615                         (uint8_t *)(&dscr->length), 2);
616         dscr->length = le16_to_cpu(dscr->length);
617         dma_memory_read(&address_space_memory, entry_addr + 4,
618                         (uint8_t *)(&dscr->addr), 8);
619         dscr->attr = le64_to_cpu(dscr->attr);
620         dscr->attr &= 0xfffffff8;
621         dscr->incr = 12;
622         break;
623     }
624 }
625 
626 /* Advanced DMA data transfer */
627 
628 static void sdhci_do_adma(SDHCIState *s)
629 {
630     unsigned int n, begin, length;
631     const uint16_t block_size = s->blksize & 0x0fff;
632     ADMADescr dscr;
633     int i;
634 
635     for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
636         s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
637 
638         get_adma_description(s, &dscr);
639         DPRINT_L2("ADMA loop: addr=" TARGET_FMT_plx ", len=%d, attr=%x\n",
640                 dscr.addr, dscr.length, dscr.attr);
641 
642         if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
643             /* Indicate that error occurred in ST_FDS state */
644             s->admaerr &= ~SDHC_ADMAERR_STATE_MASK;
645             s->admaerr |= SDHC_ADMAERR_STATE_ST_FDS;
646 
647             /* Generate ADMA error interrupt */
648             if (s->errintstsen & SDHC_EISEN_ADMAERR) {
649                 s->errintsts |= SDHC_EIS_ADMAERR;
650                 s->norintsts |= SDHC_NIS_ERR;
651             }
652 
653             sdhci_update_irq(s);
654             return;
655         }
656 
657         length = dscr.length ? dscr.length : 65536;
658 
659         switch (dscr.attr & SDHC_ADMA_ATTR_ACT_MASK) {
660         case SDHC_ADMA_ATTR_ACT_TRAN:  /* data transfer */
661 
662             if (s->trnmod & SDHC_TRNS_READ) {
663                 while (length) {
664                     if (s->data_count == 0) {
665                         for (n = 0; n < block_size; n++) {
666                             s->fifo_buffer[n] = sd_read_data(s->card);
667                         }
668                     }
669                     begin = s->data_count;
670                     if ((length + begin) < block_size) {
671                         s->data_count = length + begin;
672                         length = 0;
673                      } else {
674                         s->data_count = block_size;
675                         length -= block_size - begin;
676                     }
677                     dma_memory_write(&address_space_memory, dscr.addr,
678                                      &s->fifo_buffer[begin],
679                                      s->data_count - begin);
680                     dscr.addr += s->data_count - begin;
681                     if (s->data_count == block_size) {
682                         s->data_count = 0;
683                         if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
684                             s->blkcnt--;
685                             if (s->blkcnt == 0) {
686                                 break;
687                             }
688                         }
689                     }
690                 }
691             } else {
692                 while (length) {
693                     begin = s->data_count;
694                     if ((length + begin) < block_size) {
695                         s->data_count = length + begin;
696                         length = 0;
697                      } else {
698                         s->data_count = block_size;
699                         length -= block_size - begin;
700                     }
701                     dma_memory_read(&address_space_memory, dscr.addr,
702                                     &s->fifo_buffer[begin],
703                                     s->data_count - begin);
704                     dscr.addr += s->data_count - begin;
705                     if (s->data_count == block_size) {
706                         for (n = 0; n < block_size; n++) {
707                             sd_write_data(s->card, s->fifo_buffer[n]);
708                         }
709                         s->data_count = 0;
710                         if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
711                             s->blkcnt--;
712                             if (s->blkcnt == 0) {
713                                 break;
714                             }
715                         }
716                     }
717                 }
718             }
719             s->admasysaddr += dscr.incr;
720             break;
721         case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
722             s->admasysaddr = dscr.addr;
723             DPRINT_L1("ADMA link: admasysaddr=0x%" PRIx64 "\n",
724                       s->admasysaddr);
725             break;
726         default:
727             s->admasysaddr += dscr.incr;
728             break;
729         }
730 
731         if (dscr.attr & SDHC_ADMA_ATTR_INT) {
732             DPRINT_L1("ADMA interrupt: admasysaddr=0x%" PRIx64 "\n",
733                       s->admasysaddr);
734             if (s->norintstsen & SDHC_NISEN_DMA) {
735                 s->norintsts |= SDHC_NIS_DMA;
736             }
737 
738             sdhci_update_irq(s);
739         }
740 
741         /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
742         if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
743                     (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
744             DPRINT_L2("ADMA transfer completed\n");
745             if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
746                 (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
747                 s->blkcnt != 0)) {
748                 ERRPRINT("SD/MMC host ADMA length mismatch\n");
749                 s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
750                         SDHC_ADMAERR_STATE_ST_TFR;
751                 if (s->errintstsen & SDHC_EISEN_ADMAERR) {
752                     ERRPRINT("Set ADMA error flag\n");
753                     s->errintsts |= SDHC_EIS_ADMAERR;
754                     s->norintsts |= SDHC_NIS_ERR;
755                 }
756 
757                 sdhci_update_irq(s);
758             }
759             sdhci_end_transfer(s);
760             return;
761         }
762 
763     }
764 
765     /* we have unfinished business - reschedule to continue ADMA */
766     timer_mod(s->transfer_timer,
767                    qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
768 }
769 
770 /* Perform data transfer according to controller configuration */
771 
772 static void sdhci_data_transfer(void *opaque)
773 {
774     SDHCIState *s = (SDHCIState *)opaque;
775 
776     if (s->trnmod & SDHC_TRNS_DMA) {
777         switch (SDHC_DMA_TYPE(s->hostctl)) {
778         case SDHC_CTRL_SDMA:
779             if ((s->trnmod & SDHC_TRNS_MULTI) &&
780                     (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {
781                 break;
782             }
783 
784             if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
785                 sdhci_sdma_transfer_single_block(s);
786             } else {
787                 sdhci_sdma_transfer_multi_blocks(s);
788             }
789 
790             break;
791         case SDHC_CTRL_ADMA1_32:
792             if (!(s->capareg & SDHC_CAN_DO_ADMA1)) {
793                 ERRPRINT("ADMA1 not supported\n");
794                 break;
795             }
796 
797             sdhci_do_adma(s);
798             break;
799         case SDHC_CTRL_ADMA2_32:
800             if (!(s->capareg & SDHC_CAN_DO_ADMA2)) {
801                 ERRPRINT("ADMA2 not supported\n");
802                 break;
803             }
804 
805             sdhci_do_adma(s);
806             break;
807         case SDHC_CTRL_ADMA2_64:
808             if (!(s->capareg & SDHC_CAN_DO_ADMA2) ||
809                     !(s->capareg & SDHC_64_BIT_BUS_SUPPORT)) {
810                 ERRPRINT("64 bit ADMA not supported\n");
811                 break;
812             }
813 
814             sdhci_do_adma(s);
815             break;
816         default:
817             ERRPRINT("Unsupported DMA type\n");
818             break;
819         }
820     } else {
821         if ((s->trnmod & SDHC_TRNS_READ) && sd_data_ready(s->card)) {
822             s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
823                     SDHC_DAT_LINE_ACTIVE;
824             sdhci_read_block_from_card(s);
825         } else {
826             s->prnsts |= SDHC_DOING_WRITE | SDHC_DAT_LINE_ACTIVE |
827                     SDHC_SPACE_AVAILABLE | SDHC_DATA_INHIBIT;
828             sdhci_write_block_to_card(s);
829         }
830     }
831 }
832 
833 static bool sdhci_can_issue_command(SDHCIState *s)
834 {
835     if (!SDHC_CLOCK_IS_ON(s->clkcon) || !(s->pwrcon & SDHC_POWER_ON) ||
836         (((s->prnsts & SDHC_DATA_INHIBIT) || s->stopped_state) &&
837         ((s->cmdreg & SDHC_CMD_DATA_PRESENT) ||
838         ((s->cmdreg & SDHC_CMD_RESPONSE) == SDHC_CMD_RSP_WITH_BUSY &&
839         !(SDHC_COMMAND_TYPE(s->cmdreg) == SDHC_CMD_ABORT))))) {
840         return false;
841     }
842 
843     return true;
844 }
845 
846 /* The Buffer Data Port register must be accessed in sequential and
847  * continuous manner */
848 static inline bool
849 sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
850 {
851     if ((s->data_count & 0x3) != byte_num) {
852         ERRPRINT("Non-sequential access to Buffer Data Port register"
853                 "is prohibited\n");
854         return false;
855     }
856     return true;
857 }
858 
859 static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
860 {
861     SDHCIState *s = (SDHCIState *)opaque;
862     uint32_t ret = 0;
863 
864     switch (offset & ~0x3) {
865     case SDHC_SYSAD:
866         ret = s->sdmasysad;
867         break;
868     case SDHC_BLKSIZE:
869         ret = s->blksize | (s->blkcnt << 16);
870         break;
871     case SDHC_ARGUMENT:
872         ret = s->argument;
873         break;
874     case SDHC_TRNMOD:
875         ret = s->trnmod | (s->cmdreg << 16);
876         break;
877     case SDHC_RSPREG0 ... SDHC_RSPREG3:
878         ret = s->rspreg[((offset & ~0x3) - SDHC_RSPREG0) >> 2];
879         break;
880     case  SDHC_BDATA:
881         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
882             ret = sdhci_read_dataport(s, size);
883             DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset,
884                       ret, ret);
885             return ret;
886         }
887         break;
888     case SDHC_PRNSTS:
889         ret = s->prnsts;
890         break;
891     case SDHC_HOSTCTL:
892         ret = s->hostctl | (s->pwrcon << 8) | (s->blkgap << 16) |
893               (s->wakcon << 24);
894         break;
895     case SDHC_CLKCON:
896         ret = s->clkcon | (s->timeoutcon << 16);
897         break;
898     case SDHC_NORINTSTS:
899         ret = s->norintsts | (s->errintsts << 16);
900         break;
901     case SDHC_NORINTSTSEN:
902         ret = s->norintstsen | (s->errintstsen << 16);
903         break;
904     case SDHC_NORINTSIGEN:
905         ret = s->norintsigen | (s->errintsigen << 16);
906         break;
907     case SDHC_ACMD12ERRSTS:
908         ret = s->acmd12errsts;
909         break;
910     case SDHC_CAPAREG:
911         ret = s->capareg;
912         break;
913     case SDHC_MAXCURR:
914         ret = s->maxcurr;
915         break;
916     case SDHC_ADMAERR:
917         ret =  s->admaerr;
918         break;
919     case SDHC_ADMASYSADDR:
920         ret = (uint32_t)s->admasysaddr;
921         break;
922     case SDHC_ADMASYSADDR + 4:
923         ret = (uint32_t)(s->admasysaddr >> 32);
924         break;
925     case SDHC_SLOT_INT_STATUS:
926         ret = (SD_HOST_SPECv2_VERS << 16) | sdhci_slotint(s);
927         break;
928     default:
929         ERRPRINT("bad %ub read: addr[0x%04x]\n", size, (int)offset);
930         break;
931     }
932 
933     ret >>= (offset & 0x3) * 8;
934     ret &= (1ULL << (size * 8)) - 1;
935     DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset, ret, ret);
936     return ret;
937 }
938 
939 static inline void sdhci_blkgap_write(SDHCIState *s, uint8_t value)
940 {
941     if ((value & SDHC_STOP_AT_GAP_REQ) && (s->blkgap & SDHC_STOP_AT_GAP_REQ)) {
942         return;
943     }
944     s->blkgap = value & SDHC_STOP_AT_GAP_REQ;
945 
946     if ((value & SDHC_CONTINUE_REQ) && s->stopped_state &&
947             (s->blkgap & SDHC_STOP_AT_GAP_REQ) == 0) {
948         if (s->stopped_state == sdhc_gap_read) {
949             s->prnsts |= SDHC_DAT_LINE_ACTIVE | SDHC_DOING_READ;
950             sdhci_read_block_from_card(s);
951         } else {
952             s->prnsts |= SDHC_DAT_LINE_ACTIVE | SDHC_DOING_WRITE;
953             sdhci_write_block_to_card(s);
954         }
955         s->stopped_state = sdhc_not_stopped;
956     } else if (!s->stopped_state && (value & SDHC_STOP_AT_GAP_REQ)) {
957         if (s->prnsts & SDHC_DOING_READ) {
958             s->stopped_state = sdhc_gap_read;
959         } else if (s->prnsts & SDHC_DOING_WRITE) {
960             s->stopped_state = sdhc_gap_write;
961         }
962     }
963 }
964 
965 static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
966 {
967     switch (value) {
968     case SDHC_RESET_ALL:
969         sdhci_reset(s);
970         break;
971     case SDHC_RESET_CMD:
972         s->prnsts &= ~SDHC_CMD_INHIBIT;
973         s->norintsts &= ~SDHC_NIS_CMDCMP;
974         break;
975     case SDHC_RESET_DATA:
976         s->data_count = 0;
977         s->prnsts &= ~(SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE |
978                 SDHC_DOING_READ | SDHC_DOING_WRITE |
979                 SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);
980         s->blkgap &= ~(SDHC_STOP_AT_GAP_REQ | SDHC_CONTINUE_REQ);
981         s->stopped_state = sdhc_not_stopped;
982         s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |
983                 SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);
984         break;
985     }
986 }
987 
988 static void
989 sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
990 {
991     SDHCIState *s = (SDHCIState *)opaque;
992     unsigned shift =  8 * (offset & 0x3);
993     uint32_t mask = ~(((1ULL << (size * 8)) - 1) << shift);
994     uint32_t value = val;
995     value <<= shift;
996 
997     switch (offset & ~0x3) {
998     case SDHC_SYSAD:
999         s->sdmasysad = (s->sdmasysad & mask) | value;
1000         MASKED_WRITE(s->sdmasysad, mask, value);
1001         /* Writing to last byte of sdmasysad might trigger transfer */
1002         if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt &&
1003                 s->blksize && SDHC_DMA_TYPE(s->hostctl) == SDHC_CTRL_SDMA) {
1004             sdhci_sdma_transfer_multi_blocks(s);
1005         }
1006         break;
1007     case SDHC_BLKSIZE:
1008         if (!TRANSFERRING_DATA(s->prnsts)) {
1009             MASKED_WRITE(s->blksize, mask, value);
1010             MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
1011         }
1012 
1013         /* Limit block size to the maximum buffer size */
1014         if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
1015             qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \
1016                           "the maximum buffer 0x%x", __func__, s->blksize,
1017                           s->buf_maxsz);
1018 
1019             s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
1020         }
1021 
1022         break;
1023     case SDHC_ARGUMENT:
1024         MASKED_WRITE(s->argument, mask, value);
1025         break;
1026     case SDHC_TRNMOD:
1027         /* DMA can be enabled only if it is supported as indicated by
1028          * capabilities register */
1029         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
1030             value &= ~SDHC_TRNS_DMA;
1031         }
1032         MASKED_WRITE(s->trnmod, mask, value);
1033         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
1034 
1035         /* Writing to the upper byte of CMDREG triggers SD command generation */
1036         if ((mask & 0xFF000000) || !sdhci_can_issue_command(s)) {
1037             break;
1038         }
1039 
1040         sdhci_send_command(s);
1041         break;
1042     case  SDHC_BDATA:
1043         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
1044             sdhci_write_dataport(s, value >> shift, size);
1045         }
1046         break;
1047     case SDHC_HOSTCTL:
1048         if (!(mask & 0xFF0000)) {
1049             sdhci_blkgap_write(s, value >> 16);
1050         }
1051         MASKED_WRITE(s->hostctl, mask, value);
1052         MASKED_WRITE(s->pwrcon, mask >> 8, value >> 8);
1053         MASKED_WRITE(s->wakcon, mask >> 24, value >> 24);
1054         if (!(s->prnsts & SDHC_CARD_PRESENT) || ((s->pwrcon >> 1) & 0x7) < 5 ||
1055                 !(s->capareg & (1 << (31 - ((s->pwrcon >> 1) & 0x7))))) {
1056             s->pwrcon &= ~SDHC_POWER_ON;
1057         }
1058         break;
1059     case SDHC_CLKCON:
1060         if (!(mask & 0xFF000000)) {
1061             sdhci_reset_write(s, value >> 24);
1062         }
1063         MASKED_WRITE(s->clkcon, mask, value);
1064         MASKED_WRITE(s->timeoutcon, mask >> 16, value >> 16);
1065         if (s->clkcon & SDHC_CLOCK_INT_EN) {
1066             s->clkcon |= SDHC_CLOCK_INT_STABLE;
1067         } else {
1068             s->clkcon &= ~SDHC_CLOCK_INT_STABLE;
1069         }
1070         break;
1071     case SDHC_NORINTSTS:
1072         if (s->norintstsen & SDHC_NISEN_CARDINT) {
1073             value &= ~SDHC_NIS_CARDINT;
1074         }
1075         s->norintsts &= mask | ~value;
1076         s->errintsts &= (mask >> 16) | ~(value >> 16);
1077         if (s->errintsts) {
1078             s->norintsts |= SDHC_NIS_ERR;
1079         } else {
1080             s->norintsts &= ~SDHC_NIS_ERR;
1081         }
1082         sdhci_update_irq(s);
1083         break;
1084     case SDHC_NORINTSTSEN:
1085         MASKED_WRITE(s->norintstsen, mask, value);
1086         MASKED_WRITE(s->errintstsen, mask >> 16, value >> 16);
1087         s->norintsts &= s->norintstsen;
1088         s->errintsts &= s->errintstsen;
1089         if (s->errintsts) {
1090             s->norintsts |= SDHC_NIS_ERR;
1091         } else {
1092             s->norintsts &= ~SDHC_NIS_ERR;
1093         }
1094         sdhci_update_irq(s);
1095         break;
1096     case SDHC_NORINTSIGEN:
1097         MASKED_WRITE(s->norintsigen, mask, value);
1098         MASKED_WRITE(s->errintsigen, mask >> 16, value >> 16);
1099         sdhci_update_irq(s);
1100         break;
1101     case SDHC_ADMAERR:
1102         MASKED_WRITE(s->admaerr, mask, value);
1103         break;
1104     case SDHC_ADMASYSADDR:
1105         s->admasysaddr = (s->admasysaddr & (0xFFFFFFFF00000000ULL |
1106                 (uint64_t)mask)) | (uint64_t)value;
1107         break;
1108     case SDHC_ADMASYSADDR + 4:
1109         s->admasysaddr = (s->admasysaddr & (0x00000000FFFFFFFFULL |
1110                 ((uint64_t)mask << 32))) | ((uint64_t)value << 32);
1111         break;
1112     case SDHC_FEAER:
1113         s->acmd12errsts |= value;
1114         s->errintsts |= (value >> 16) & s->errintstsen;
1115         if (s->acmd12errsts) {
1116             s->errintsts |= SDHC_EIS_CMD12ERR;
1117         }
1118         if (s->errintsts) {
1119             s->norintsts |= SDHC_NIS_ERR;
1120         }
1121         sdhci_update_irq(s);
1122         break;
1123     default:
1124         ERRPRINT("bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n",
1125                  size, (int)offset, value >> shift, value >> shift);
1126         break;
1127     }
1128     DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
1129               size, (int)offset, value >> shift, value >> shift);
1130 }
1131 
1132 static const MemoryRegionOps sdhci_mmio_ops = {
1133     .read = sdhci_read,
1134     .write = sdhci_write,
1135     .valid = {
1136         .min_access_size = 1,
1137         .max_access_size = 4,
1138         .unaligned = false
1139     },
1140     .endianness = DEVICE_LITTLE_ENDIAN,
1141 };
1142 
1143 static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
1144 {
1145     switch (SDHC_CAPAB_BLOCKSIZE(s->capareg)) {
1146     case 0:
1147         return 512;
1148     case 1:
1149         return 1024;
1150     case 2:
1151         return 2048;
1152     default:
1153         hw_error("SDHC: unsupported value for maximum block size\n");
1154         return 0;
1155     }
1156 }
1157 
1158 static void sdhci_initfn(SDHCIState *s, BlockBackend *blk)
1159 {
1160     s->card = sd_init(blk, false);
1161     if (s->card == NULL) {
1162         exit(1);
1163     }
1164     s->eject_cb = qemu_allocate_irq(sdhci_insert_eject_cb, s, 0);
1165     s->ro_cb = qemu_allocate_irq(sdhci_card_readonly_cb, s, 0);
1166     sd_set_cb(s->card, s->ro_cb, s->eject_cb);
1167 
1168     s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_raise_insertion_irq, s);
1169     s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_data_transfer, s);
1170 }
1171 
1172 static void sdhci_uninitfn(SDHCIState *s)
1173 {
1174     timer_del(s->insert_timer);
1175     timer_free(s->insert_timer);
1176     timer_del(s->transfer_timer);
1177     timer_free(s->transfer_timer);
1178     qemu_free_irq(s->eject_cb);
1179     qemu_free_irq(s->ro_cb);
1180 
1181     g_free(s->fifo_buffer);
1182     s->fifo_buffer = NULL;
1183 }
1184 
1185 const VMStateDescription sdhci_vmstate = {
1186     .name = "sdhci",
1187     .version_id = 1,
1188     .minimum_version_id = 1,
1189     .fields = (VMStateField[]) {
1190         VMSTATE_UINT32(sdmasysad, SDHCIState),
1191         VMSTATE_UINT16(blksize, SDHCIState),
1192         VMSTATE_UINT16(blkcnt, SDHCIState),
1193         VMSTATE_UINT32(argument, SDHCIState),
1194         VMSTATE_UINT16(trnmod, SDHCIState),
1195         VMSTATE_UINT16(cmdreg, SDHCIState),
1196         VMSTATE_UINT32_ARRAY(rspreg, SDHCIState, 4),
1197         VMSTATE_UINT32(prnsts, SDHCIState),
1198         VMSTATE_UINT8(hostctl, SDHCIState),
1199         VMSTATE_UINT8(pwrcon, SDHCIState),
1200         VMSTATE_UINT8(blkgap, SDHCIState),
1201         VMSTATE_UINT8(wakcon, SDHCIState),
1202         VMSTATE_UINT16(clkcon, SDHCIState),
1203         VMSTATE_UINT8(timeoutcon, SDHCIState),
1204         VMSTATE_UINT8(admaerr, SDHCIState),
1205         VMSTATE_UINT16(norintsts, SDHCIState),
1206         VMSTATE_UINT16(errintsts, SDHCIState),
1207         VMSTATE_UINT16(norintstsen, SDHCIState),
1208         VMSTATE_UINT16(errintstsen, SDHCIState),
1209         VMSTATE_UINT16(norintsigen, SDHCIState),
1210         VMSTATE_UINT16(errintsigen, SDHCIState),
1211         VMSTATE_UINT16(acmd12errsts, SDHCIState),
1212         VMSTATE_UINT16(data_count, SDHCIState),
1213         VMSTATE_UINT64(admasysaddr, SDHCIState),
1214         VMSTATE_UINT8(stopped_state, SDHCIState),
1215         VMSTATE_VBUFFER_UINT32(fifo_buffer, SDHCIState, 1, NULL, 0, buf_maxsz),
1216         VMSTATE_TIMER_PTR(insert_timer, SDHCIState),
1217         VMSTATE_TIMER_PTR(transfer_timer, SDHCIState),
1218         VMSTATE_END_OF_LIST()
1219     }
1220 };
1221 
1222 /* Capabilities registers provide information on supported features of this
1223  * specific host controller implementation */
1224 static Property sdhci_pci_properties[] = {
1225     DEFINE_BLOCK_PROPERTIES(SDHCIState, conf),
1226     DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
1227             SDHC_CAPAB_REG_DEFAULT),
1228     DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
1229     DEFINE_PROP_END_OF_LIST(),
1230 };
1231 
1232 static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
1233 {
1234     SDHCIState *s = PCI_SDHCI(dev);
1235     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
1236     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
1237     sdhci_initfn(s, s->conf.blk);
1238     s->buf_maxsz = sdhci_get_fifolen(s);
1239     s->fifo_buffer = g_malloc0(s->buf_maxsz);
1240     s->irq = pci_allocate_irq(dev);
1241     memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
1242             SDHC_REGISTERS_MAP_SIZE);
1243     pci_register_bar(dev, 0, 0, &s->iomem);
1244 }
1245 
1246 static void sdhci_pci_exit(PCIDevice *dev)
1247 {
1248     SDHCIState *s = PCI_SDHCI(dev);
1249     sdhci_uninitfn(s);
1250 }
1251 
1252 static void sdhci_pci_class_init(ObjectClass *klass, void *data)
1253 {
1254     DeviceClass *dc = DEVICE_CLASS(klass);
1255     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1256 
1257     k->realize = sdhci_pci_realize;
1258     k->exit = sdhci_pci_exit;
1259     k->vendor_id = PCI_VENDOR_ID_REDHAT;
1260     k->device_id = PCI_DEVICE_ID_REDHAT_SDHCI;
1261     k->class_id = PCI_CLASS_SYSTEM_SDHCI;
1262     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1263     dc->vmsd = &sdhci_vmstate;
1264     dc->props = sdhci_pci_properties;
1265 }
1266 
1267 static const TypeInfo sdhci_pci_info = {
1268     .name = TYPE_PCI_SDHCI,
1269     .parent = TYPE_PCI_DEVICE,
1270     .instance_size = sizeof(SDHCIState),
1271     .class_init = sdhci_pci_class_init,
1272 };
1273 
1274 static Property sdhci_sysbus_properties[] = {
1275     DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
1276             SDHC_CAPAB_REG_DEFAULT),
1277     DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
1278     DEFINE_PROP_END_OF_LIST(),
1279 };
1280 
1281 static void sdhci_sysbus_init(Object *obj)
1282 {
1283     SDHCIState *s = SYSBUS_SDHCI(obj);
1284     DriveInfo *di;
1285 
1286     /* FIXME use a qdev drive property instead of drive_get_next() */
1287     di = drive_get_next(IF_SD);
1288     sdhci_initfn(s, di ? blk_by_legacy_dinfo(di) : NULL);
1289 }
1290 
1291 static void sdhci_sysbus_finalize(Object *obj)
1292 {
1293     SDHCIState *s = SYSBUS_SDHCI(obj);
1294     sdhci_uninitfn(s);
1295 }
1296 
1297 static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
1298 {
1299     SDHCIState *s = SYSBUS_SDHCI(dev);
1300     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1301 
1302     s->buf_maxsz = sdhci_get_fifolen(s);
1303     s->fifo_buffer = g_malloc0(s->buf_maxsz);
1304     sysbus_init_irq(sbd, &s->irq);
1305     memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
1306             SDHC_REGISTERS_MAP_SIZE);
1307     sysbus_init_mmio(sbd, &s->iomem);
1308 }
1309 
1310 static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
1311 {
1312     DeviceClass *dc = DEVICE_CLASS(klass);
1313 
1314     dc->vmsd = &sdhci_vmstate;
1315     dc->props = sdhci_sysbus_properties;
1316     dc->realize = sdhci_sysbus_realize;
1317     /* Reason: instance_init() method uses drive_get_next() */
1318     dc->cannot_instantiate_with_device_add_yet = true;
1319 }
1320 
1321 static const TypeInfo sdhci_sysbus_info = {
1322     .name = TYPE_SYSBUS_SDHCI,
1323     .parent = TYPE_SYS_BUS_DEVICE,
1324     .instance_size = sizeof(SDHCIState),
1325     .instance_init = sdhci_sysbus_init,
1326     .instance_finalize = sdhci_sysbus_finalize,
1327     .class_init = sdhci_sysbus_class_init,
1328 };
1329 
1330 static void sdhci_register_types(void)
1331 {
1332     type_register_static(&sdhci_pci_info);
1333     type_register_static(&sdhci_sysbus_info);
1334 }
1335 
1336 type_init(sdhci_register_types)
1337