xref: /openbmc/qemu/hw/sd/sdhci.c (revision 6a0acfff)
1 /*
2  * SD Association Host Standard Specification v2.0 controller emulation
3  *
4  * Copyright (c) 2011 Samsung Electronics Co., Ltd.
5  * Mitsyanko Igor <i.mitsyanko@samsung.com>
6  * Peter A.G. Crosthwaite <peter.crosthwaite@petalogix.com>
7  *
8  * Based on MMC controller for Samsung S5PC1xx-based board emulation
9  * by Alexey Merkulov and Vladimir Monakhov.
10  *
11  * This program is free software; you can redistribute it and/or modify it
12  * under the terms of the GNU General Public License as published by the
13  * Free Software Foundation; either version 2 of the License, or (at your
14  * option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
19  * See the GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "hw/hw.h"
30 #include "hw/irq.h"
31 #include "sysemu/dma.h"
32 #include "qemu/timer.h"
33 #include "qemu/bitops.h"
34 #include "hw/sd/sdhci.h"
35 #include "sdhci-internal.h"
36 #include "qemu/log.h"
37 #include "qemu/module.h"
38 #include "trace.h"
39 
40 #define TYPE_SDHCI_BUS "sdhci-bus"
41 #define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS)
42 
43 #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
44 
45 static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
46 {
47     return 1 << (9 + FIELD_EX32(s->capareg, SDHC_CAPAB, MAXBLOCKLENGTH));
48 }
49 
50 /* return true on error */
51 static bool sdhci_check_capab_freq_range(SDHCIState *s, const char *desc,
52                                          uint8_t freq, Error **errp)
53 {
54     if (s->sd_spec_version >= 3) {
55         return false;
56     }
57     switch (freq) {
58     case 0:
59     case 10 ... 63:
60         break;
61     default:
62         error_setg(errp, "SD %s clock frequency can have value"
63                    "in range 0-63 only", desc);
64         return true;
65     }
66     return false;
67 }
68 
69 static void sdhci_check_capareg(SDHCIState *s, Error **errp)
70 {
71     uint64_t msk = s->capareg;
72     uint32_t val;
73     bool y;
74 
75     switch (s->sd_spec_version) {
76     case 4:
77         val = FIELD_EX64(s->capareg, SDHC_CAPAB, BUS64BIT_V4);
78         trace_sdhci_capareg("64-bit system bus (v4)", val);
79         msk = FIELD_DP64(msk, SDHC_CAPAB, BUS64BIT_V4, 0);
80 
81         val = FIELD_EX64(s->capareg, SDHC_CAPAB, UHS_II);
82         trace_sdhci_capareg("UHS-II", val);
83         msk = FIELD_DP64(msk, SDHC_CAPAB, UHS_II, 0);
84 
85         val = FIELD_EX64(s->capareg, SDHC_CAPAB, ADMA3);
86         trace_sdhci_capareg("ADMA3", val);
87         msk = FIELD_DP64(msk, SDHC_CAPAB, ADMA3, 0);
88 
89     /* fallthrough */
90     case 3:
91         val = FIELD_EX64(s->capareg, SDHC_CAPAB, ASYNC_INT);
92         trace_sdhci_capareg("async interrupt", val);
93         msk = FIELD_DP64(msk, SDHC_CAPAB, ASYNC_INT, 0);
94 
95         val = FIELD_EX64(s->capareg, SDHC_CAPAB, SLOT_TYPE);
96         if (val) {
97             error_setg(errp, "slot-type not supported");
98             return;
99         }
100         trace_sdhci_capareg("slot type", val);
101         msk = FIELD_DP64(msk, SDHC_CAPAB, SLOT_TYPE, 0);
102 
103         if (val != 2) {
104             val = FIELD_EX64(s->capareg, SDHC_CAPAB, EMBEDDED_8BIT);
105             trace_sdhci_capareg("8-bit bus", val);
106         }
107         msk = FIELD_DP64(msk, SDHC_CAPAB, EMBEDDED_8BIT, 0);
108 
109         val = FIELD_EX64(s->capareg, SDHC_CAPAB, BUS_SPEED);
110         trace_sdhci_capareg("bus speed mask", val);
111         msk = FIELD_DP64(msk, SDHC_CAPAB, BUS_SPEED, 0);
112 
113         val = FIELD_EX64(s->capareg, SDHC_CAPAB, DRIVER_STRENGTH);
114         trace_sdhci_capareg("driver strength mask", val);
115         msk = FIELD_DP64(msk, SDHC_CAPAB, DRIVER_STRENGTH, 0);
116 
117         val = FIELD_EX64(s->capareg, SDHC_CAPAB, TIMER_RETUNING);
118         trace_sdhci_capareg("timer re-tuning", val);
119         msk = FIELD_DP64(msk, SDHC_CAPAB, TIMER_RETUNING, 0);
120 
121         val = FIELD_EX64(s->capareg, SDHC_CAPAB, SDR50_TUNING);
122         trace_sdhci_capareg("use SDR50 tuning", val);
123         msk = FIELD_DP64(msk, SDHC_CAPAB, SDR50_TUNING, 0);
124 
125         val = FIELD_EX64(s->capareg, SDHC_CAPAB, RETUNING_MODE);
126         trace_sdhci_capareg("re-tuning mode", val);
127         msk = FIELD_DP64(msk, SDHC_CAPAB, RETUNING_MODE, 0);
128 
129         val = FIELD_EX64(s->capareg, SDHC_CAPAB, CLOCK_MULT);
130         trace_sdhci_capareg("clock multiplier", val);
131         msk = FIELD_DP64(msk, SDHC_CAPAB, CLOCK_MULT, 0);
132 
133     /* fallthrough */
134     case 2: /* default version */
135         val = FIELD_EX64(s->capareg, SDHC_CAPAB, ADMA2);
136         trace_sdhci_capareg("ADMA2", val);
137         msk = FIELD_DP64(msk, SDHC_CAPAB, ADMA2, 0);
138 
139         val = FIELD_EX64(s->capareg, SDHC_CAPAB, ADMA1);
140         trace_sdhci_capareg("ADMA1", val);
141         msk = FIELD_DP64(msk, SDHC_CAPAB, ADMA1, 0);
142 
143         val = FIELD_EX64(s->capareg, SDHC_CAPAB, BUS64BIT);
144         trace_sdhci_capareg("64-bit system bus (v3)", val);
145         msk = FIELD_DP64(msk, SDHC_CAPAB, BUS64BIT, 0);
146 
147     /* fallthrough */
148     case 1:
149         y = FIELD_EX64(s->capareg, SDHC_CAPAB, TOUNIT);
150         msk = FIELD_DP64(msk, SDHC_CAPAB, TOUNIT, 0);
151 
152         val = FIELD_EX64(s->capareg, SDHC_CAPAB, TOCLKFREQ);
153         trace_sdhci_capareg(y ? "timeout (MHz)" : "Timeout (KHz)", val);
154         if (sdhci_check_capab_freq_range(s, "timeout", val, errp)) {
155             return;
156         }
157         msk = FIELD_DP64(msk, SDHC_CAPAB, TOCLKFREQ, 0);
158 
159         val = FIELD_EX64(s->capareg, SDHC_CAPAB, BASECLKFREQ);
160         trace_sdhci_capareg(y ? "base (MHz)" : "Base (KHz)", val);
161         if (sdhci_check_capab_freq_range(s, "base", val, errp)) {
162             return;
163         }
164         msk = FIELD_DP64(msk, SDHC_CAPAB, BASECLKFREQ, 0);
165 
166         val = FIELD_EX64(s->capareg, SDHC_CAPAB, MAXBLOCKLENGTH);
167         if (val >= 3) {
168             error_setg(errp, "block size can be 512, 1024 or 2048 only");
169             return;
170         }
171         trace_sdhci_capareg("max block length", sdhci_get_fifolen(s));
172         msk = FIELD_DP64(msk, SDHC_CAPAB, MAXBLOCKLENGTH, 0);
173 
174         val = FIELD_EX64(s->capareg, SDHC_CAPAB, HIGHSPEED);
175         trace_sdhci_capareg("high speed", val);
176         msk = FIELD_DP64(msk, SDHC_CAPAB, HIGHSPEED, 0);
177 
178         val = FIELD_EX64(s->capareg, SDHC_CAPAB, SDMA);
179         trace_sdhci_capareg("SDMA", val);
180         msk = FIELD_DP64(msk, SDHC_CAPAB, SDMA, 0);
181 
182         val = FIELD_EX64(s->capareg, SDHC_CAPAB, SUSPRESUME);
183         trace_sdhci_capareg("suspend/resume", val);
184         msk = FIELD_DP64(msk, SDHC_CAPAB, SUSPRESUME, 0);
185 
186         val = FIELD_EX64(s->capareg, SDHC_CAPAB, V33);
187         trace_sdhci_capareg("3.3v", val);
188         msk = FIELD_DP64(msk, SDHC_CAPAB, V33, 0);
189 
190         val = FIELD_EX64(s->capareg, SDHC_CAPAB, V30);
191         trace_sdhci_capareg("3.0v", val);
192         msk = FIELD_DP64(msk, SDHC_CAPAB, V30, 0);
193 
194         val = FIELD_EX64(s->capareg, SDHC_CAPAB, V18);
195         trace_sdhci_capareg("1.8v", val);
196         msk = FIELD_DP64(msk, SDHC_CAPAB, V18, 0);
197         break;
198 
199     default:
200         error_setg(errp, "Unsupported spec version: %u", s->sd_spec_version);
201     }
202     if (msk) {
203         qemu_log_mask(LOG_UNIMP,
204                       "SDHCI: unknown CAPAB mask: 0x%016" PRIx64 "\n", msk);
205     }
206 }
207 
208 static uint8_t sdhci_slotint(SDHCIState *s)
209 {
210     return (s->norintsts & s->norintsigen) || (s->errintsts & s->errintsigen) ||
211          ((s->norintsts & SDHC_NIS_INSERT) && (s->wakcon & SDHC_WKUP_ON_INS)) ||
212          ((s->norintsts & SDHC_NIS_REMOVE) && (s->wakcon & SDHC_WKUP_ON_RMV));
213 }
214 
215 static inline void sdhci_update_irq(SDHCIState *s)
216 {
217     qemu_set_irq(s->irq, sdhci_slotint(s));
218 }
219 
220 static void sdhci_raise_insertion_irq(void *opaque)
221 {
222     SDHCIState *s = (SDHCIState *)opaque;
223 
224     if (s->norintsts & SDHC_NIS_REMOVE) {
225         timer_mod(s->insert_timer,
226                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY);
227     } else {
228         s->prnsts = 0x1ff0000;
229         if (s->norintstsen & SDHC_NISEN_INSERT) {
230             s->norintsts |= SDHC_NIS_INSERT;
231         }
232         sdhci_update_irq(s);
233     }
234 }
235 
236 static void sdhci_set_inserted(DeviceState *dev, bool level)
237 {
238     SDHCIState *s = (SDHCIState *)dev;
239 
240     trace_sdhci_set_inserted(level ? "insert" : "eject");
241     if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
242         /* Give target some time to notice card ejection */
243         timer_mod(s->insert_timer,
244                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY);
245     } else {
246         if (level) {
247             s->prnsts = 0x1ff0000;
248             if (s->norintstsen & SDHC_NISEN_INSERT) {
249                 s->norintsts |= SDHC_NIS_INSERT;
250             }
251         } else {
252             s->prnsts = 0x1fa0000;
253             s->pwrcon &= ~SDHC_POWER_ON;
254             s->clkcon &= ~SDHC_CLOCK_SDCLK_EN;
255             if (s->norintstsen & SDHC_NISEN_REMOVE) {
256                 s->norintsts |= SDHC_NIS_REMOVE;
257             }
258         }
259         sdhci_update_irq(s);
260     }
261 }
262 
263 static void sdhci_set_readonly(DeviceState *dev, bool level)
264 {
265     SDHCIState *s = (SDHCIState *)dev;
266 
267     if (level) {
268         s->prnsts &= ~SDHC_WRITE_PROTECT;
269     } else {
270         /* Write enabled */
271         s->prnsts |= SDHC_WRITE_PROTECT;
272     }
273 }
274 
275 static void sdhci_reset(SDHCIState *s)
276 {
277     DeviceState *dev = DEVICE(s);
278 
279     timer_del(s->insert_timer);
280     timer_del(s->transfer_timer);
281 
282     /* Set all registers to 0. Capabilities/Version registers are not cleared
283      * and assumed to always preserve their value, given to them during
284      * initialization */
285     memset(&s->sdmasysad, 0, (uintptr_t)&s->capareg - (uintptr_t)&s->sdmasysad);
286 
287     /* Reset other state based on current card insertion/readonly status */
288     sdhci_set_inserted(dev, sdbus_get_inserted(&s->sdbus));
289     sdhci_set_readonly(dev, sdbus_get_readonly(&s->sdbus));
290 
291     s->data_count = 0;
292     s->stopped_state = sdhc_not_stopped;
293     s->pending_insert_state = false;
294 }
295 
296 static void sdhci_poweron_reset(DeviceState *dev)
297 {
298     /* QOM (ie power-on) reset. This is identical to reset
299      * commanded via device register apart from handling of the
300      * 'pending insert on powerup' quirk.
301      */
302     SDHCIState *s = (SDHCIState *)dev;
303 
304     sdhci_reset(s);
305 
306     if (s->pending_insert_quirk) {
307         s->pending_insert_state = true;
308     }
309 }
310 
311 static void sdhci_data_transfer(void *opaque);
312 
313 static void sdhci_send_command(SDHCIState *s)
314 {
315     SDRequest request;
316     uint8_t response[16];
317     int rlen;
318 
319     s->errintsts = 0;
320     s->acmd12errsts = 0;
321     request.cmd = s->cmdreg >> 8;
322     request.arg = s->argument;
323 
324     trace_sdhci_send_command(request.cmd, request.arg);
325     rlen = sdbus_do_command(&s->sdbus, &request, response);
326 
327     if (s->cmdreg & SDHC_CMD_RESPONSE) {
328         if (rlen == 4) {
329             s->rspreg[0] = ldl_be_p(response);
330             s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
331             trace_sdhci_response4(s->rspreg[0]);
332         } else if (rlen == 16) {
333             s->rspreg[0] = ldl_be_p(&response[11]);
334             s->rspreg[1] = ldl_be_p(&response[7]);
335             s->rspreg[2] = ldl_be_p(&response[3]);
336             s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
337                             response[2];
338             trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
339                                    s->rspreg[1], s->rspreg[0]);
340         } else {
341             trace_sdhci_error("timeout waiting for command response");
342             if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
343                 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
344                 s->norintsts |= SDHC_NIS_ERR;
345             }
346         }
347 
348         if (!(s->quirks & SDHCI_QUIRK_NO_BUSY_IRQ) &&
349             (s->norintstsen & SDHC_NISEN_TRSCMP) &&
350             (s->cmdreg & SDHC_CMD_RESPONSE) == SDHC_CMD_RSP_WITH_BUSY) {
351             s->norintsts |= SDHC_NIS_TRSCMP;
352         }
353     }
354 
355     if (s->norintstsen & SDHC_NISEN_CMDCMP) {
356         s->norintsts |= SDHC_NIS_CMDCMP;
357     }
358 
359     sdhci_update_irq(s);
360 
361     if (s->blksize && (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
362         s->data_count = 0;
363         sdhci_data_transfer(s);
364     }
365 }
366 
367 static void sdhci_end_transfer(SDHCIState *s)
368 {
369     /* Automatically send CMD12 to stop transfer if AutoCMD12 enabled */
370     if ((s->trnmod & SDHC_TRNS_ACMD12) != 0) {
371         SDRequest request;
372         uint8_t response[16];
373 
374         request.cmd = 0x0C;
375         request.arg = 0;
376         trace_sdhci_end_transfer(request.cmd, request.arg);
377         sdbus_do_command(&s->sdbus, &request, response);
378         /* Auto CMD12 response goes to the upper Response register */
379         s->rspreg[3] = ldl_be_p(response);
380     }
381 
382     s->prnsts &= ~(SDHC_DOING_READ | SDHC_DOING_WRITE |
383             SDHC_DAT_LINE_ACTIVE | SDHC_DATA_INHIBIT |
384             SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE);
385 
386     if (s->norintstsen & SDHC_NISEN_TRSCMP) {
387         s->norintsts |= SDHC_NIS_TRSCMP;
388     }
389 
390     sdhci_update_irq(s);
391 }
392 
393 /*
394  * Programmed i/o data transfer
395  */
396 #define BLOCK_SIZE_MASK (4 * KiB - 1)
397 
398 /* Fill host controller's read buffer with BLKSIZE bytes of data from card */
399 static void sdhci_read_block_from_card(SDHCIState *s)
400 {
401     int index = 0;
402     uint8_t data;
403     const uint16_t blk_size = s->blksize & BLOCK_SIZE_MASK;
404 
405     if ((s->trnmod & SDHC_TRNS_MULTI) &&
406             (s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0)) {
407         return;
408     }
409 
410     for (index = 0; index < blk_size; index++) {
411         data = sdbus_read_data(&s->sdbus);
412         if (!FIELD_EX32(s->hostctl2, SDHC_HOSTCTL2, EXECUTE_TUNING)) {
413             /* Device is not in tuning */
414             s->fifo_buffer[index] = data;
415         }
416     }
417 
418     if (FIELD_EX32(s->hostctl2, SDHC_HOSTCTL2, EXECUTE_TUNING)) {
419         /* Device is in tuning */
420         s->hostctl2 &= ~R_SDHC_HOSTCTL2_EXECUTE_TUNING_MASK;
421         s->hostctl2 |= R_SDHC_HOSTCTL2_SAMPLING_CLKSEL_MASK;
422         s->prnsts &= ~(SDHC_DAT_LINE_ACTIVE | SDHC_DOING_READ |
423                        SDHC_DATA_INHIBIT);
424         goto read_done;
425     }
426 
427     /* New data now available for READ through Buffer Port Register */
428     s->prnsts |= SDHC_DATA_AVAILABLE;
429     if (s->norintstsen & SDHC_NISEN_RBUFRDY) {
430         s->norintsts |= SDHC_NIS_RBUFRDY;
431     }
432 
433     /* Clear DAT line active status if that was the last block */
434     if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
435             ((s->trnmod & SDHC_TRNS_MULTI) && s->blkcnt == 1)) {
436         s->prnsts &= ~SDHC_DAT_LINE_ACTIVE;
437     }
438 
439     /* If stop at block gap request was set and it's not the last block of
440      * data - generate Block Event interrupt */
441     if (s->stopped_state == sdhc_gap_read && (s->trnmod & SDHC_TRNS_MULTI) &&
442             s->blkcnt != 1)    {
443         s->prnsts &= ~SDHC_DAT_LINE_ACTIVE;
444         if (s->norintstsen & SDHC_EISEN_BLKGAP) {
445             s->norintsts |= SDHC_EIS_BLKGAP;
446         }
447     }
448 
449 read_done:
450     sdhci_update_irq(s);
451 }
452 
453 /* Read @size byte of data from host controller @s BUFFER DATA PORT register */
454 static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
455 {
456     uint32_t value = 0;
457     int i;
458 
459     /* first check that a valid data exists in host controller input buffer */
460     if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
461         trace_sdhci_error("read from empty buffer");
462         return 0;
463     }
464 
465     for (i = 0; i < size; i++) {
466         value |= s->fifo_buffer[s->data_count] << i * 8;
467         s->data_count++;
468         /* check if we've read all valid data (blksize bytes) from buffer */
469         if ((s->data_count) >= (s->blksize & BLOCK_SIZE_MASK)) {
470             trace_sdhci_read_dataport(s->data_count);
471             s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
472             s->data_count = 0;  /* next buff read must start at position [0] */
473 
474             if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
475                 s->blkcnt--;
476             }
477 
478             /* if that was the last block of data */
479             if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
480                 ((s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0)) ||
481                  /* stop at gap request */
482                 (s->stopped_state == sdhc_gap_read &&
483                  !(s->prnsts & SDHC_DAT_LINE_ACTIVE))) {
484                 sdhci_end_transfer(s);
485             } else { /* if there are more data, read next block from card */
486                 sdhci_read_block_from_card(s);
487             }
488             break;
489         }
490     }
491 
492     return value;
493 }
494 
495 /* Write data from host controller FIFO to card */
496 static void sdhci_write_block_to_card(SDHCIState *s)
497 {
498     int index = 0;
499 
500     if (s->prnsts & SDHC_SPACE_AVAILABLE) {
501         if (s->norintstsen & SDHC_NISEN_WBUFRDY) {
502             s->norintsts |= SDHC_NIS_WBUFRDY;
503         }
504         sdhci_update_irq(s);
505         return;
506     }
507 
508     if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
509         if (s->blkcnt == 0) {
510             return;
511         } else {
512             s->blkcnt--;
513         }
514     }
515 
516     for (index = 0; index < (s->blksize & BLOCK_SIZE_MASK); index++) {
517         sdbus_write_data(&s->sdbus, s->fifo_buffer[index]);
518     }
519 
520     /* Next data can be written through BUFFER DATORT register */
521     s->prnsts |= SDHC_SPACE_AVAILABLE;
522 
523     /* Finish transfer if that was the last block of data */
524     if ((s->trnmod & SDHC_TRNS_MULTI) == 0 ||
525             ((s->trnmod & SDHC_TRNS_MULTI) &&
526             (s->trnmod & SDHC_TRNS_BLK_CNT_EN) && (s->blkcnt == 0))) {
527         sdhci_end_transfer(s);
528     } else if (s->norintstsen & SDHC_NISEN_WBUFRDY) {
529         s->norintsts |= SDHC_NIS_WBUFRDY;
530     }
531 
532     /* Generate Block Gap Event if requested and if not the last block */
533     if (s->stopped_state == sdhc_gap_write && (s->trnmod & SDHC_TRNS_MULTI) &&
534             s->blkcnt > 0) {
535         s->prnsts &= ~SDHC_DOING_WRITE;
536         if (s->norintstsen & SDHC_EISEN_BLKGAP) {
537             s->norintsts |= SDHC_EIS_BLKGAP;
538         }
539         sdhci_end_transfer(s);
540     }
541 
542     sdhci_update_irq(s);
543 }
544 
545 /* Write @size bytes of @value data to host controller @s Buffer Data Port
546  * register */
547 static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
548 {
549     unsigned i;
550 
551     /* Check that there is free space left in a buffer */
552     if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
553         trace_sdhci_error("Can't write to data buffer: buffer full");
554         return;
555     }
556 
557     for (i = 0; i < size; i++) {
558         s->fifo_buffer[s->data_count] = value & 0xFF;
559         s->data_count++;
560         value >>= 8;
561         if (s->data_count >= (s->blksize & BLOCK_SIZE_MASK)) {
562             trace_sdhci_write_dataport(s->data_count);
563             s->data_count = 0;
564             s->prnsts &= ~SDHC_SPACE_AVAILABLE;
565             if (s->prnsts & SDHC_DOING_WRITE) {
566                 sdhci_write_block_to_card(s);
567             }
568         }
569     }
570 }
571 
572 /*
573  * Single DMA data transfer
574  */
575 
576 /* Multi block SDMA transfer */
577 static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
578 {
579     bool page_aligned = false;
580     unsigned int n, begin;
581     const uint16_t block_size = s->blksize & BLOCK_SIZE_MASK;
582     uint32_t boundary_chk = 1 << (((s->blksize & ~BLOCK_SIZE_MASK) >> 12) + 12);
583     uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
584 
585     if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {
586         qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");
587         return;
588     }
589 
590     /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
591      * possible stop at page boundary if initial address is not page aligned,
592      * allow them to work properly */
593     if ((s->sdmasysad % boundary_chk) == 0) {
594         page_aligned = true;
595     }
596 
597     if (s->trnmod & SDHC_TRNS_READ) {
598         s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
599                 SDHC_DAT_LINE_ACTIVE;
600         while (s->blkcnt) {
601             if (s->data_count == 0) {
602                 for (n = 0; n < block_size; n++) {
603                     s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
604                 }
605             }
606             begin = s->data_count;
607             if (((boundary_count + begin) < block_size) && page_aligned) {
608                 s->data_count = boundary_count + begin;
609                 boundary_count = 0;
610              } else {
611                 s->data_count = block_size;
612                 boundary_count -= block_size - begin;
613                 if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
614                     s->blkcnt--;
615                 }
616             }
617             dma_memory_write(s->dma_as, s->sdmasysad,
618                              &s->fifo_buffer[begin], s->data_count - begin);
619             s->sdmasysad += s->data_count - begin;
620             if (s->data_count == block_size) {
621                 s->data_count = 0;
622             }
623             if (page_aligned && boundary_count == 0) {
624                 break;
625             }
626         }
627     } else {
628         s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT |
629                 SDHC_DAT_LINE_ACTIVE;
630         while (s->blkcnt) {
631             begin = s->data_count;
632             if (((boundary_count + begin) < block_size) && page_aligned) {
633                 s->data_count = boundary_count + begin;
634                 boundary_count = 0;
635              } else {
636                 s->data_count = block_size;
637                 boundary_count -= block_size - begin;
638             }
639             dma_memory_read(s->dma_as, s->sdmasysad,
640                             &s->fifo_buffer[begin], s->data_count - begin);
641             s->sdmasysad += s->data_count - begin;
642             if (s->data_count == block_size) {
643                 for (n = 0; n < block_size; n++) {
644                     sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
645                 }
646                 s->data_count = 0;
647                 if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
648                     s->blkcnt--;
649                 }
650             }
651             if (page_aligned && boundary_count == 0) {
652                 break;
653             }
654         }
655     }
656 
657     if (s->blkcnt == 0) {
658         sdhci_end_transfer(s);
659     } else {
660         if (s->norintstsen & SDHC_NISEN_DMA) {
661             s->norintsts |= SDHC_NIS_DMA;
662         }
663         sdhci_update_irq(s);
664     }
665 }
666 
667 /* single block SDMA transfer */
668 static void sdhci_sdma_transfer_single_block(SDHCIState *s)
669 {
670     int n;
671     uint32_t datacnt = s->blksize & BLOCK_SIZE_MASK;
672 
673     if (s->trnmod & SDHC_TRNS_READ) {
674         for (n = 0; n < datacnt; n++) {
675             s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
676         }
677         dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
678     } else {
679         dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
680         for (n = 0; n < datacnt; n++) {
681             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
682         }
683     }
684     s->blkcnt--;
685 
686     sdhci_end_transfer(s);
687 }
688 
689 typedef struct ADMADescr {
690     hwaddr addr;
691     uint16_t length;
692     uint8_t attr;
693     uint8_t incr;
694 } ADMADescr;
695 
696 static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
697 {
698     uint32_t adma1 = 0;
699     uint64_t adma2 = 0;
700     hwaddr entry_addr = (hwaddr)s->admasysaddr;
701     switch (SDHC_DMA_TYPE(s->hostctl1)) {
702     case SDHC_CTRL_ADMA2_32:
703         dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma2,
704                         sizeof(adma2));
705         adma2 = le64_to_cpu(adma2);
706         /* The spec does not specify endianness of descriptor table.
707          * We currently assume that it is LE.
708          */
709         dscr->addr = (hwaddr)extract64(adma2, 32, 32) & ~0x3ull;
710         dscr->length = (uint16_t)extract64(adma2, 16, 16);
711         dscr->attr = (uint8_t)extract64(adma2, 0, 7);
712         dscr->incr = 8;
713         break;
714     case SDHC_CTRL_ADMA1_32:
715         dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma1,
716                         sizeof(adma1));
717         adma1 = le32_to_cpu(adma1);
718         dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
719         dscr->attr = (uint8_t)extract32(adma1, 0, 7);
720         dscr->incr = 4;
721         if ((dscr->attr & SDHC_ADMA_ATTR_ACT_MASK) == SDHC_ADMA_ATTR_SET_LEN) {
722             dscr->length = (uint16_t)extract32(adma1, 12, 16);
723         } else {
724             dscr->length = 4 * KiB;
725         }
726         break;
727     case SDHC_CTRL_ADMA2_64:
728         dma_memory_read(s->dma_as, entry_addr,
729                         (uint8_t *)(&dscr->attr), 1);
730         dma_memory_read(s->dma_as, entry_addr + 2,
731                         (uint8_t *)(&dscr->length), 2);
732         dscr->length = le16_to_cpu(dscr->length);
733         dma_memory_read(s->dma_as, entry_addr + 4,
734                         (uint8_t *)(&dscr->addr), 8);
735         dscr->addr = le64_to_cpu(dscr->addr);
736         dscr->attr &= (uint8_t) ~0xC0;
737         dscr->incr = 12;
738         break;
739     }
740 }
741 
742 /* Advanced DMA data transfer */
743 
744 static void sdhci_do_adma(SDHCIState *s)
745 {
746     unsigned int n, begin, length;
747     const uint16_t block_size = s->blksize & BLOCK_SIZE_MASK;
748     ADMADescr dscr = {};
749     int i;
750 
751     for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
752         s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
753 
754         get_adma_description(s, &dscr);
755         trace_sdhci_adma_loop(dscr.addr, dscr.length, dscr.attr);
756 
757         if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
758             /* Indicate that error occurred in ST_FDS state */
759             s->admaerr &= ~SDHC_ADMAERR_STATE_MASK;
760             s->admaerr |= SDHC_ADMAERR_STATE_ST_FDS;
761 
762             /* Generate ADMA error interrupt */
763             if (s->errintstsen & SDHC_EISEN_ADMAERR) {
764                 s->errintsts |= SDHC_EIS_ADMAERR;
765                 s->norintsts |= SDHC_NIS_ERR;
766             }
767 
768             sdhci_update_irq(s);
769             return;
770         }
771 
772         length = dscr.length ? dscr.length : 64 * KiB;
773 
774         switch (dscr.attr & SDHC_ADMA_ATTR_ACT_MASK) {
775         case SDHC_ADMA_ATTR_ACT_TRAN:  /* data transfer */
776 
777             if (s->trnmod & SDHC_TRNS_READ) {
778                 while (length) {
779                     if (s->data_count == 0) {
780                         for (n = 0; n < block_size; n++) {
781                             s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
782                         }
783                     }
784                     begin = s->data_count;
785                     if ((length + begin) < block_size) {
786                         s->data_count = length + begin;
787                         length = 0;
788                      } else {
789                         s->data_count = block_size;
790                         length -= block_size - begin;
791                     }
792                     dma_memory_write(s->dma_as, dscr.addr,
793                                      &s->fifo_buffer[begin],
794                                      s->data_count - begin);
795                     dscr.addr += s->data_count - begin;
796                     if (s->data_count == block_size) {
797                         s->data_count = 0;
798                         if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
799                             s->blkcnt--;
800                             if (s->blkcnt == 0) {
801                                 break;
802                             }
803                         }
804                     }
805                 }
806             } else {
807                 while (length) {
808                     begin = s->data_count;
809                     if ((length + begin) < block_size) {
810                         s->data_count = length + begin;
811                         length = 0;
812                      } else {
813                         s->data_count = block_size;
814                         length -= block_size - begin;
815                     }
816                     dma_memory_read(s->dma_as, dscr.addr,
817                                     &s->fifo_buffer[begin],
818                                     s->data_count - begin);
819                     dscr.addr += s->data_count - begin;
820                     if (s->data_count == block_size) {
821                         for (n = 0; n < block_size; n++) {
822                             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
823                         }
824                         s->data_count = 0;
825                         if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
826                             s->blkcnt--;
827                             if (s->blkcnt == 0) {
828                                 break;
829                             }
830                         }
831                     }
832                 }
833             }
834             s->admasysaddr += dscr.incr;
835             break;
836         case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
837             s->admasysaddr = dscr.addr;
838             trace_sdhci_adma("link", s->admasysaddr);
839             break;
840         default:
841             s->admasysaddr += dscr.incr;
842             break;
843         }
844 
845         if (dscr.attr & SDHC_ADMA_ATTR_INT) {
846             trace_sdhci_adma("interrupt", s->admasysaddr);
847             if (s->norintstsen & SDHC_NISEN_DMA) {
848                 s->norintsts |= SDHC_NIS_DMA;
849             }
850 
851             sdhci_update_irq(s);
852         }
853 
854         /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
855         if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
856                     (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
857             trace_sdhci_adma_transfer_completed();
858             if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
859                 (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
860                 s->blkcnt != 0)) {
861                 trace_sdhci_error("SD/MMC host ADMA length mismatch");
862                 s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
863                         SDHC_ADMAERR_STATE_ST_TFR;
864                 if (s->errintstsen & SDHC_EISEN_ADMAERR) {
865                     trace_sdhci_error("Set ADMA error flag");
866                     s->errintsts |= SDHC_EIS_ADMAERR;
867                     s->norintsts |= SDHC_NIS_ERR;
868                 }
869 
870                 sdhci_update_irq(s);
871             }
872             sdhci_end_transfer(s);
873             return;
874         }
875 
876     }
877 
878     /* we have unfinished business - reschedule to continue ADMA */
879     timer_mod(s->transfer_timer,
880                    qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
881 }
882 
883 /* Perform data transfer according to controller configuration */
884 
885 static void sdhci_data_transfer(void *opaque)
886 {
887     SDHCIState *s = (SDHCIState *)opaque;
888 
889     if (s->trnmod & SDHC_TRNS_DMA) {
890         switch (SDHC_DMA_TYPE(s->hostctl1)) {
891         case SDHC_CTRL_SDMA:
892             if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
893                 sdhci_sdma_transfer_single_block(s);
894             } else {
895                 sdhci_sdma_transfer_multi_blocks(s);
896             }
897 
898             break;
899         case SDHC_CTRL_ADMA1_32:
900             if (!(s->capareg & R_SDHC_CAPAB_ADMA1_MASK)) {
901                 trace_sdhci_error("ADMA1 not supported");
902                 break;
903             }
904 
905             sdhci_do_adma(s);
906             break;
907         case SDHC_CTRL_ADMA2_32:
908             if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK)) {
909                 trace_sdhci_error("ADMA2 not supported");
910                 break;
911             }
912 
913             sdhci_do_adma(s);
914             break;
915         case SDHC_CTRL_ADMA2_64:
916             if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK) ||
917                     !(s->capareg & R_SDHC_CAPAB_BUS64BIT_MASK)) {
918                 trace_sdhci_error("64 bit ADMA not supported");
919                 break;
920             }
921 
922             sdhci_do_adma(s);
923             break;
924         default:
925             trace_sdhci_error("Unsupported DMA type");
926             break;
927         }
928     } else {
929         if ((s->trnmod & SDHC_TRNS_READ) && sdbus_data_ready(&s->sdbus)) {
930             s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
931                     SDHC_DAT_LINE_ACTIVE;
932             sdhci_read_block_from_card(s);
933         } else {
934             s->prnsts |= SDHC_DOING_WRITE | SDHC_DAT_LINE_ACTIVE |
935                     SDHC_SPACE_AVAILABLE | SDHC_DATA_INHIBIT;
936             sdhci_write_block_to_card(s);
937         }
938     }
939 }
940 
941 static bool sdhci_can_issue_command(SDHCIState *s)
942 {
943     if (!SDHC_CLOCK_IS_ON(s->clkcon) ||
944         (((s->prnsts & SDHC_DATA_INHIBIT) || s->stopped_state) &&
945         ((s->cmdreg & SDHC_CMD_DATA_PRESENT) ||
946         ((s->cmdreg & SDHC_CMD_RESPONSE) == SDHC_CMD_RSP_WITH_BUSY &&
947         !(SDHC_COMMAND_TYPE(s->cmdreg) == SDHC_CMD_ABORT))))) {
948         return false;
949     }
950 
951     return true;
952 }
953 
954 /* The Buffer Data Port register must be accessed in sequential and
955  * continuous manner */
956 static inline bool
957 sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
958 {
959     if ((s->data_count & 0x3) != byte_num) {
960         trace_sdhci_error("Non-sequential access to Buffer Data Port register"
961                           "is prohibited\n");
962         return false;
963     }
964     return true;
965 }
966 
967 static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
968 {
969     SDHCIState *s = (SDHCIState *)opaque;
970     uint32_t ret = 0;
971 
972     switch (offset & ~0x3) {
973     case SDHC_SYSAD:
974         ret = s->sdmasysad;
975         break;
976     case SDHC_BLKSIZE:
977         ret = s->blksize | (s->blkcnt << 16);
978         break;
979     case SDHC_ARGUMENT:
980         ret = s->argument;
981         break;
982     case SDHC_TRNMOD:
983         ret = s->trnmod | (s->cmdreg << 16);
984         break;
985     case SDHC_RSPREG0 ... SDHC_RSPREG3:
986         ret = s->rspreg[((offset & ~0x3) - SDHC_RSPREG0) >> 2];
987         break;
988     case  SDHC_BDATA:
989         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
990             ret = sdhci_read_dataport(s, size);
991             trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
992             return ret;
993         }
994         break;
995     case SDHC_PRNSTS:
996         ret = s->prnsts;
997         ret = FIELD_DP32(ret, SDHC_PRNSTS, DAT_LVL,
998                          sdbus_get_dat_lines(&s->sdbus));
999         ret = FIELD_DP32(ret, SDHC_PRNSTS, CMD_LVL,
1000                          sdbus_get_cmd_line(&s->sdbus));
1001         break;
1002     case SDHC_HOSTCTL:
1003         ret = s->hostctl1 | (s->pwrcon << 8) | (s->blkgap << 16) |
1004               (s->wakcon << 24);
1005         break;
1006     case SDHC_CLKCON:
1007         ret = s->clkcon | (s->timeoutcon << 16);
1008         break;
1009     case SDHC_NORINTSTS:
1010         ret = s->norintsts | (s->errintsts << 16);
1011         break;
1012     case SDHC_NORINTSTSEN:
1013         ret = s->norintstsen | (s->errintstsen << 16);
1014         break;
1015     case SDHC_NORINTSIGEN:
1016         ret = s->norintsigen | (s->errintsigen << 16);
1017         break;
1018     case SDHC_ACMD12ERRSTS:
1019         ret = s->acmd12errsts | (s->hostctl2 << 16);
1020         break;
1021     case SDHC_CAPAB:
1022         ret = (uint32_t)s->capareg;
1023         break;
1024     case SDHC_CAPAB + 4:
1025         ret = (uint32_t)(s->capareg >> 32);
1026         break;
1027     case SDHC_MAXCURR:
1028         ret = (uint32_t)s->maxcurr;
1029         break;
1030     case SDHC_MAXCURR + 4:
1031         ret = (uint32_t)(s->maxcurr >> 32);
1032         break;
1033     case SDHC_ADMAERR:
1034         ret =  s->admaerr;
1035         break;
1036     case SDHC_ADMASYSADDR:
1037         ret = (uint32_t)s->admasysaddr;
1038         break;
1039     case SDHC_ADMASYSADDR + 4:
1040         ret = (uint32_t)(s->admasysaddr >> 32);
1041         break;
1042     case SDHC_SLOT_INT_STATUS:
1043         ret = (s->version << 16) | sdhci_slotint(s);
1044         break;
1045     default:
1046         qemu_log_mask(LOG_UNIMP, "SDHC rd_%ub @0x%02" HWADDR_PRIx " "
1047                       "not implemented\n", size, offset);
1048         break;
1049     }
1050 
1051     ret >>= (offset & 0x3) * 8;
1052     ret &= (1ULL << (size * 8)) - 1;
1053     trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
1054     return ret;
1055 }
1056 
1057 static inline void sdhci_blkgap_write(SDHCIState *s, uint8_t value)
1058 {
1059     if ((value & SDHC_STOP_AT_GAP_REQ) && (s->blkgap & SDHC_STOP_AT_GAP_REQ)) {
1060         return;
1061     }
1062     s->blkgap = value & SDHC_STOP_AT_GAP_REQ;
1063 
1064     if ((value & SDHC_CONTINUE_REQ) && s->stopped_state &&
1065             (s->blkgap & SDHC_STOP_AT_GAP_REQ) == 0) {
1066         if (s->stopped_state == sdhc_gap_read) {
1067             s->prnsts |= SDHC_DAT_LINE_ACTIVE | SDHC_DOING_READ;
1068             sdhci_read_block_from_card(s);
1069         } else {
1070             s->prnsts |= SDHC_DAT_LINE_ACTIVE | SDHC_DOING_WRITE;
1071             sdhci_write_block_to_card(s);
1072         }
1073         s->stopped_state = sdhc_not_stopped;
1074     } else if (!s->stopped_state && (value & SDHC_STOP_AT_GAP_REQ)) {
1075         if (s->prnsts & SDHC_DOING_READ) {
1076             s->stopped_state = sdhc_gap_read;
1077         } else if (s->prnsts & SDHC_DOING_WRITE) {
1078             s->stopped_state = sdhc_gap_write;
1079         }
1080     }
1081 }
1082 
1083 static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
1084 {
1085     switch (value) {
1086     case SDHC_RESET_ALL:
1087         sdhci_reset(s);
1088         break;
1089     case SDHC_RESET_CMD:
1090         s->prnsts &= ~SDHC_CMD_INHIBIT;
1091         s->norintsts &= ~SDHC_NIS_CMDCMP;
1092         break;
1093     case SDHC_RESET_DATA:
1094         s->data_count = 0;
1095         s->prnsts &= ~(SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE |
1096                 SDHC_DOING_READ | SDHC_DOING_WRITE |
1097                 SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);
1098         s->blkgap &= ~(SDHC_STOP_AT_GAP_REQ | SDHC_CONTINUE_REQ);
1099         s->stopped_state = sdhc_not_stopped;
1100         s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |
1101                 SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);
1102         break;
1103     }
1104 }
1105 
1106 static void
1107 sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
1108 {
1109     SDHCIState *s = (SDHCIState *)opaque;
1110     unsigned shift =  8 * (offset & 0x3);
1111     uint32_t mask = ~(((1ULL << (size * 8)) - 1) << shift);
1112     uint32_t value = val;
1113     value <<= shift;
1114 
1115     switch (offset & ~0x3) {
1116     case SDHC_SYSAD:
1117         s->sdmasysad = (s->sdmasysad & mask) | value;
1118         MASKED_WRITE(s->sdmasysad, mask, value);
1119         /* Writing to last byte of sdmasysad might trigger transfer */
1120         if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt &&
1121                 s->blksize && SDHC_DMA_TYPE(s->hostctl1) == SDHC_CTRL_SDMA) {
1122             if (s->trnmod & SDHC_TRNS_MULTI) {
1123                 sdhci_sdma_transfer_multi_blocks(s);
1124             } else {
1125                 sdhci_sdma_transfer_single_block(s);
1126             }
1127         }
1128         break;
1129     case SDHC_BLKSIZE:
1130         if (!TRANSFERRING_DATA(s->prnsts)) {
1131             MASKED_WRITE(s->blksize, mask, value);
1132             MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
1133         }
1134 
1135         /* Limit block size to the maximum buffer size */
1136         if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
1137             qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \
1138                           "the maximum buffer 0x%x", __func__, s->blksize,
1139                           s->buf_maxsz);
1140 
1141             s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
1142         }
1143 
1144         break;
1145     case SDHC_ARGUMENT:
1146         MASKED_WRITE(s->argument, mask, value);
1147         break;
1148     case SDHC_TRNMOD:
1149         /* DMA can be enabled only if it is supported as indicated by
1150          * capabilities register */
1151         if (!(s->capareg & R_SDHC_CAPAB_SDMA_MASK)) {
1152             value &= ~SDHC_TRNS_DMA;
1153         }
1154         MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
1155         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
1156 
1157         /* Writing to the upper byte of CMDREG triggers SD command generation */
1158         if ((mask & 0xFF000000) || !sdhci_can_issue_command(s)) {
1159             break;
1160         }
1161 
1162         sdhci_send_command(s);
1163         break;
1164     case  SDHC_BDATA:
1165         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
1166             sdhci_write_dataport(s, value >> shift, size);
1167         }
1168         break;
1169     case SDHC_HOSTCTL:
1170         if (!(mask & 0xFF0000)) {
1171             sdhci_blkgap_write(s, value >> 16);
1172         }
1173         MASKED_WRITE(s->hostctl1, mask, value);
1174         MASKED_WRITE(s->pwrcon, mask >> 8, value >> 8);
1175         MASKED_WRITE(s->wakcon, mask >> 24, value >> 24);
1176         if (!(s->prnsts & SDHC_CARD_PRESENT) || ((s->pwrcon >> 1) & 0x7) < 5 ||
1177                 !(s->capareg & (1 << (31 - ((s->pwrcon >> 1) & 0x7))))) {
1178             s->pwrcon &= ~SDHC_POWER_ON;
1179         }
1180         break;
1181     case SDHC_CLKCON:
1182         if (!(mask & 0xFF000000)) {
1183             sdhci_reset_write(s, value >> 24);
1184         }
1185         MASKED_WRITE(s->clkcon, mask, value);
1186         MASKED_WRITE(s->timeoutcon, mask >> 16, value >> 16);
1187         if (s->clkcon & SDHC_CLOCK_INT_EN) {
1188             s->clkcon |= SDHC_CLOCK_INT_STABLE;
1189         } else {
1190             s->clkcon &= ~SDHC_CLOCK_INT_STABLE;
1191         }
1192         break;
1193     case SDHC_NORINTSTS:
1194         if (s->norintstsen & SDHC_NISEN_CARDINT) {
1195             value &= ~SDHC_NIS_CARDINT;
1196         }
1197         s->norintsts &= mask | ~value;
1198         s->errintsts &= (mask >> 16) | ~(value >> 16);
1199         if (s->errintsts) {
1200             s->norintsts |= SDHC_NIS_ERR;
1201         } else {
1202             s->norintsts &= ~SDHC_NIS_ERR;
1203         }
1204         sdhci_update_irq(s);
1205         break;
1206     case SDHC_NORINTSTSEN:
1207         MASKED_WRITE(s->norintstsen, mask, value);
1208         MASKED_WRITE(s->errintstsen, mask >> 16, value >> 16);
1209         s->norintsts &= s->norintstsen;
1210         s->errintsts &= s->errintstsen;
1211         if (s->errintsts) {
1212             s->norintsts |= SDHC_NIS_ERR;
1213         } else {
1214             s->norintsts &= ~SDHC_NIS_ERR;
1215         }
1216         /* Quirk for Raspberry Pi: pending card insert interrupt
1217          * appears when first enabled after power on */
1218         if ((s->norintstsen & SDHC_NISEN_INSERT) && s->pending_insert_state) {
1219             assert(s->pending_insert_quirk);
1220             s->norintsts |= SDHC_NIS_INSERT;
1221             s->pending_insert_state = false;
1222         }
1223         sdhci_update_irq(s);
1224         break;
1225     case SDHC_NORINTSIGEN:
1226         MASKED_WRITE(s->norintsigen, mask, value);
1227         MASKED_WRITE(s->errintsigen, mask >> 16, value >> 16);
1228         sdhci_update_irq(s);
1229         break;
1230     case SDHC_ADMAERR:
1231         MASKED_WRITE(s->admaerr, mask, value);
1232         break;
1233     case SDHC_ADMASYSADDR:
1234         s->admasysaddr = (s->admasysaddr & (0xFFFFFFFF00000000ULL |
1235                 (uint64_t)mask)) | (uint64_t)value;
1236         break;
1237     case SDHC_ADMASYSADDR + 4:
1238         s->admasysaddr = (s->admasysaddr & (0x00000000FFFFFFFFULL |
1239                 ((uint64_t)mask << 32))) | ((uint64_t)value << 32);
1240         break;
1241     case SDHC_FEAER:
1242         s->acmd12errsts |= value;
1243         s->errintsts |= (value >> 16) & s->errintstsen;
1244         if (s->acmd12errsts) {
1245             s->errintsts |= SDHC_EIS_CMD12ERR;
1246         }
1247         if (s->errintsts) {
1248             s->norintsts |= SDHC_NIS_ERR;
1249         }
1250         sdhci_update_irq(s);
1251         break;
1252     case SDHC_ACMD12ERRSTS:
1253         MASKED_WRITE(s->acmd12errsts, mask, value & UINT16_MAX);
1254         if (s->uhs_mode >= UHS_I) {
1255             MASKED_WRITE(s->hostctl2, mask >> 16, value >> 16);
1256 
1257             if (FIELD_EX32(s->hostctl2, SDHC_HOSTCTL2, V18_ENA)) {
1258                 sdbus_set_voltage(&s->sdbus, SD_VOLTAGE_1_8V);
1259             } else {
1260                 sdbus_set_voltage(&s->sdbus, SD_VOLTAGE_3_3V);
1261             }
1262         }
1263         break;
1264 
1265     case SDHC_CAPAB:
1266     case SDHC_CAPAB + 4:
1267     case SDHC_MAXCURR:
1268     case SDHC_MAXCURR + 4:
1269         qemu_log_mask(LOG_GUEST_ERROR, "SDHC wr_%ub @0x%02" HWADDR_PRIx
1270                       " <- 0x%08x read-only\n", size, offset, value >> shift);
1271         break;
1272 
1273     default:
1274         qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
1275                       "not implemented\n", size, offset, value >> shift);
1276         break;
1277     }
1278     trace_sdhci_access("wr", size << 3, offset, "<-",
1279                        value >> shift, value >> shift);
1280 }
1281 
1282 static const MemoryRegionOps sdhci_mmio_ops = {
1283     .read = sdhci_read,
1284     .write = sdhci_write,
1285     .valid = {
1286         .min_access_size = 1,
1287         .max_access_size = 4,
1288         .unaligned = false
1289     },
1290     .endianness = DEVICE_LITTLE_ENDIAN,
1291 };
1292 
1293 static void sdhci_init_readonly_registers(SDHCIState *s, Error **errp)
1294 {
1295     Error *local_err = NULL;
1296 
1297     switch (s->sd_spec_version) {
1298     case 2 ... 3:
1299         break;
1300     default:
1301         error_setg(errp, "Only Spec v2/v3 are supported");
1302         return;
1303     }
1304     s->version = (SDHC_HCVER_VENDOR << 8) | (s->sd_spec_version - 1);
1305 
1306     sdhci_check_capareg(s, &local_err);
1307     if (local_err) {
1308         error_propagate(errp, local_err);
1309         return;
1310     }
1311 }
1312 
1313 /* --- qdev common --- */
1314 
1315 void sdhci_initfn(SDHCIState *s)
1316 {
1317     qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
1318                         TYPE_SDHCI_BUS, DEVICE(s), "sd-bus");
1319 
1320     s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_raise_insertion_irq, s);
1321     s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_data_transfer, s);
1322 
1323     s->io_ops = &sdhci_mmio_ops;
1324 }
1325 
1326 void sdhci_uninitfn(SDHCIState *s)
1327 {
1328     timer_del(s->insert_timer);
1329     timer_free(s->insert_timer);
1330     timer_del(s->transfer_timer);
1331     timer_free(s->transfer_timer);
1332 
1333     g_free(s->fifo_buffer);
1334     s->fifo_buffer = NULL;
1335 }
1336 
1337 void sdhci_common_realize(SDHCIState *s, Error **errp)
1338 {
1339     Error *local_err = NULL;
1340 
1341     sdhci_init_readonly_registers(s, &local_err);
1342     if (local_err) {
1343         error_propagate(errp, local_err);
1344         return;
1345     }
1346     s->buf_maxsz = sdhci_get_fifolen(s);
1347     s->fifo_buffer = g_malloc0(s->buf_maxsz);
1348 
1349     memory_region_init_io(&s->iomem, OBJECT(s), s->io_ops, s, "sdhci",
1350                           SDHC_REGISTERS_MAP_SIZE);
1351 }
1352 
1353 void sdhci_common_unrealize(SDHCIState *s, Error **errp)
1354 {
1355     /* This function is expected to be called only once for each class:
1356      * - SysBus:    via DeviceClass->unrealize(),
1357      * - PCI:       via PCIDeviceClass->exit().
1358      * However to avoid double-free and/or use-after-free we still nullify
1359      * this variable (better safe than sorry!). */
1360     g_free(s->fifo_buffer);
1361     s->fifo_buffer = NULL;
1362 }
1363 
1364 static bool sdhci_pending_insert_vmstate_needed(void *opaque)
1365 {
1366     SDHCIState *s = opaque;
1367 
1368     return s->pending_insert_state;
1369 }
1370 
1371 static const VMStateDescription sdhci_pending_insert_vmstate = {
1372     .name = "sdhci/pending-insert",
1373     .version_id = 1,
1374     .minimum_version_id = 1,
1375     .needed = sdhci_pending_insert_vmstate_needed,
1376     .fields = (VMStateField[]) {
1377         VMSTATE_BOOL(pending_insert_state, SDHCIState),
1378         VMSTATE_END_OF_LIST()
1379     },
1380 };
1381 
1382 const VMStateDescription sdhci_vmstate = {
1383     .name = "sdhci",
1384     .version_id = 1,
1385     .minimum_version_id = 1,
1386     .fields = (VMStateField[]) {
1387         VMSTATE_UINT32(sdmasysad, SDHCIState),
1388         VMSTATE_UINT16(blksize, SDHCIState),
1389         VMSTATE_UINT16(blkcnt, SDHCIState),
1390         VMSTATE_UINT32(argument, SDHCIState),
1391         VMSTATE_UINT16(trnmod, SDHCIState),
1392         VMSTATE_UINT16(cmdreg, SDHCIState),
1393         VMSTATE_UINT32_ARRAY(rspreg, SDHCIState, 4),
1394         VMSTATE_UINT32(prnsts, SDHCIState),
1395         VMSTATE_UINT8(hostctl1, SDHCIState),
1396         VMSTATE_UINT8(pwrcon, SDHCIState),
1397         VMSTATE_UINT8(blkgap, SDHCIState),
1398         VMSTATE_UINT8(wakcon, SDHCIState),
1399         VMSTATE_UINT16(clkcon, SDHCIState),
1400         VMSTATE_UINT8(timeoutcon, SDHCIState),
1401         VMSTATE_UINT8(admaerr, SDHCIState),
1402         VMSTATE_UINT16(norintsts, SDHCIState),
1403         VMSTATE_UINT16(errintsts, SDHCIState),
1404         VMSTATE_UINT16(norintstsen, SDHCIState),
1405         VMSTATE_UINT16(errintstsen, SDHCIState),
1406         VMSTATE_UINT16(norintsigen, SDHCIState),
1407         VMSTATE_UINT16(errintsigen, SDHCIState),
1408         VMSTATE_UINT16(acmd12errsts, SDHCIState),
1409         VMSTATE_UINT16(data_count, SDHCIState),
1410         VMSTATE_UINT64(admasysaddr, SDHCIState),
1411         VMSTATE_UINT8(stopped_state, SDHCIState),
1412         VMSTATE_VBUFFER_UINT32(fifo_buffer, SDHCIState, 1, NULL, buf_maxsz),
1413         VMSTATE_TIMER_PTR(insert_timer, SDHCIState),
1414         VMSTATE_TIMER_PTR(transfer_timer, SDHCIState),
1415         VMSTATE_END_OF_LIST()
1416     },
1417     .subsections = (const VMStateDescription*[]) {
1418         &sdhci_pending_insert_vmstate,
1419         NULL
1420     },
1421 };
1422 
1423 void sdhci_common_class_init(ObjectClass *klass, void *data)
1424 {
1425     DeviceClass *dc = DEVICE_CLASS(klass);
1426 
1427     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1428     dc->vmsd = &sdhci_vmstate;
1429     dc->reset = sdhci_poweron_reset;
1430 }
1431 
1432 /* --- qdev SysBus --- */
1433 
1434 static Property sdhci_sysbus_properties[] = {
1435     DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
1436     DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
1437                      false),
1438     DEFINE_PROP_LINK("dma", SDHCIState,
1439                      dma_mr, TYPE_MEMORY_REGION, MemoryRegion *),
1440     DEFINE_PROP_END_OF_LIST(),
1441 };
1442 
1443 static void sdhci_sysbus_init(Object *obj)
1444 {
1445     SDHCIState *s = SYSBUS_SDHCI(obj);
1446 
1447     sdhci_initfn(s);
1448 }
1449 
1450 static void sdhci_sysbus_finalize(Object *obj)
1451 {
1452     SDHCIState *s = SYSBUS_SDHCI(obj);
1453 
1454     if (s->dma_mr) {
1455         object_unparent(OBJECT(s->dma_mr));
1456     }
1457 
1458     sdhci_uninitfn(s);
1459 }
1460 
1461 static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
1462 {
1463     SDHCIState *s = SYSBUS_SDHCI(dev);
1464     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1465     Error *local_err = NULL;
1466 
1467     sdhci_common_realize(s, &local_err);
1468     if (local_err) {
1469         error_propagate(errp, local_err);
1470         return;
1471     }
1472 
1473     if (s->dma_mr) {
1474         s->dma_as = &s->sysbus_dma_as;
1475         address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
1476     } else {
1477         /* use system_memory() if property "dma" not set */
1478         s->dma_as = &address_space_memory;
1479     }
1480 
1481     sysbus_init_irq(sbd, &s->irq);
1482 
1483     sysbus_init_mmio(sbd, &s->iomem);
1484 }
1485 
1486 static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
1487 {
1488     SDHCIState *s = SYSBUS_SDHCI(dev);
1489 
1490     sdhci_common_unrealize(s, &error_abort);
1491 
1492      if (s->dma_mr) {
1493         address_space_destroy(s->dma_as);
1494     }
1495 }
1496 
1497 static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
1498 {
1499     DeviceClass *dc = DEVICE_CLASS(klass);
1500 
1501     dc->props = sdhci_sysbus_properties;
1502     dc->realize = sdhci_sysbus_realize;
1503     dc->unrealize = sdhci_sysbus_unrealize;
1504 
1505     sdhci_common_class_init(klass, data);
1506 }
1507 
1508 static const TypeInfo sdhci_sysbus_info = {
1509     .name = TYPE_SYSBUS_SDHCI,
1510     .parent = TYPE_SYS_BUS_DEVICE,
1511     .instance_size = sizeof(SDHCIState),
1512     .instance_init = sdhci_sysbus_init,
1513     .instance_finalize = sdhci_sysbus_finalize,
1514     .class_init = sdhci_sysbus_class_init,
1515 };
1516 
1517 /* --- qdev bus master --- */
1518 
1519 static void sdhci_bus_class_init(ObjectClass *klass, void *data)
1520 {
1521     SDBusClass *sbc = SD_BUS_CLASS(klass);
1522 
1523     sbc->set_inserted = sdhci_set_inserted;
1524     sbc->set_readonly = sdhci_set_readonly;
1525 }
1526 
1527 static const TypeInfo sdhci_bus_info = {
1528     .name = TYPE_SDHCI_BUS,
1529     .parent = TYPE_SD_BUS,
1530     .instance_size = sizeof(SDBus),
1531     .class_init = sdhci_bus_class_init,
1532 };
1533 
1534 static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)
1535 {
1536     SDHCIState *s = SYSBUS_SDHCI(opaque);
1537     uint32_t ret;
1538     uint16_t hostctl1;
1539 
1540     switch (offset) {
1541     default:
1542         return sdhci_read(opaque, offset, size);
1543 
1544     case SDHC_HOSTCTL:
1545         /*
1546          * For a detailed explanation on the following bit
1547          * manipulation code see comments in a similar part of
1548          * usdhc_write()
1549          */
1550         hostctl1 = SDHC_DMA_TYPE(s->hostctl1) << (8 - 3);
1551 
1552         if (s->hostctl1 & SDHC_CTRL_8BITBUS) {
1553             hostctl1 |= ESDHC_CTRL_8BITBUS;
1554         }
1555 
1556         if (s->hostctl1 & SDHC_CTRL_4BITBUS) {
1557             hostctl1 |= ESDHC_CTRL_4BITBUS;
1558         }
1559 
1560         ret  = hostctl1;
1561         ret |= (uint32_t)s->blkgap << 16;
1562         ret |= (uint32_t)s->wakcon << 24;
1563 
1564         break;
1565 
1566     case SDHC_PRNSTS:
1567         /* Add SDSTB (SD Clock Stable) bit to PRNSTS */
1568         ret = sdhci_read(opaque, offset, size) & ~ESDHC_PRNSTS_SDSTB;
1569         if (s->clkcon & SDHC_CLOCK_INT_STABLE) {
1570             ret |= ESDHC_PRNSTS_SDSTB;
1571         }
1572         break;
1573 
1574     case ESDHC_DLL_CTRL:
1575     case ESDHC_TUNE_CTRL_STATUS:
1576     case ESDHC_UNDOCUMENTED_REG27:
1577     case ESDHC_TUNING_CTRL:
1578     case ESDHC_VENDOR_SPEC:
1579     case ESDHC_MIX_CTRL:
1580     case ESDHC_WTMK_LVL:
1581         ret = 0;
1582         break;
1583     }
1584 
1585     return ret;
1586 }
1587 
1588 static void
1589 usdhc_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
1590 {
1591     SDHCIState *s = SYSBUS_SDHCI(opaque);
1592     uint8_t hostctl1;
1593     uint32_t value = (uint32_t)val;
1594 
1595     switch (offset) {
1596     case ESDHC_DLL_CTRL:
1597     case ESDHC_TUNE_CTRL_STATUS:
1598     case ESDHC_UNDOCUMENTED_REG27:
1599     case ESDHC_TUNING_CTRL:
1600     case ESDHC_WTMK_LVL:
1601     case ESDHC_VENDOR_SPEC:
1602         break;
1603 
1604     case SDHC_HOSTCTL:
1605         /*
1606          * Here's What ESDHCI has at offset 0x28 (SDHC_HOSTCTL)
1607          *
1608          *       7         6     5      4      3      2        1      0
1609          * |-----------+--------+--------+-----------+----------+---------|
1610          * | Card      | Card   | Endian | DATA3     | Data     | Led     |
1611          * | Detect    | Detect | Mode   | as Card   | Transfer | Control |
1612          * | Signal    | Test   |        | Detection | Width    |         |
1613          * | Selection | Level  |        | Pin       |          |         |
1614          * |-----------+--------+--------+-----------+----------+---------|
1615          *
1616          * and 0x29
1617          *
1618          *  15      10 9    8
1619          * |----------+------|
1620          * | Reserved | DMA  |
1621          * |          | Sel. |
1622          * |          |      |
1623          * |----------+------|
1624          *
1625          * and here's what SDCHI spec expects those offsets to be:
1626          *
1627          * 0x28 (Host Control Register)
1628          *
1629          *     7        6         5       4  3      2         1        0
1630          * |--------+--------+----------+------+--------+----------+---------|
1631          * | Card   | Card   | Extended | DMA  | High   | Data     | LED     |
1632          * | Detect | Detect | Data     | Sel. | Speed  | Transfer | Control |
1633          * | Signal | Test   | Transfer |      | Enable | Width    |         |
1634          * | Sel.   | Level  | Width    |      |        |          |         |
1635          * |--------+--------+----------+------+--------+----------+---------|
1636          *
1637          * and 0x29 (Power Control Register)
1638          *
1639          * |----------------------------------|
1640          * | Power Control Register           |
1641          * |                                  |
1642          * | Description omitted,             |
1643          * | since it has no analog in ESDHCI |
1644          * |                                  |
1645          * |----------------------------------|
1646          *
1647          * Since offsets 0x2A and 0x2B should be compatible between
1648          * both IP specs we only need to reconcile least 16-bit of the
1649          * word we've been given.
1650          */
1651 
1652         /*
1653          * First, save bits 7 6 and 0 since they are identical
1654          */
1655         hostctl1 = value & (SDHC_CTRL_LED |
1656                             SDHC_CTRL_CDTEST_INS |
1657                             SDHC_CTRL_CDTEST_EN);
1658         /*
1659          * Second, split "Data Transfer Width" from bits 2 and 1 in to
1660          * bits 5 and 1
1661          */
1662         if (value & ESDHC_CTRL_8BITBUS) {
1663             hostctl1 |= SDHC_CTRL_8BITBUS;
1664         }
1665 
1666         if (value & ESDHC_CTRL_4BITBUS) {
1667             hostctl1 |= ESDHC_CTRL_4BITBUS;
1668         }
1669 
1670         /*
1671          * Third, move DMA select from bits 9 and 8 to bits 4 and 3
1672          */
1673         hostctl1 |= SDHC_DMA_TYPE(value >> (8 - 3));
1674 
1675         /*
1676          * Now place the corrected value into low 16-bit of the value
1677          * we are going to give standard SDHCI write function
1678          *
1679          * NOTE: This transformation should be the inverse of what can
1680          * be found in drivers/mmc/host/sdhci-esdhc-imx.c in Linux
1681          * kernel
1682          */
1683         value &= ~UINT16_MAX;
1684         value |= hostctl1;
1685         value |= (uint16_t)s->pwrcon << 8;
1686 
1687         sdhci_write(opaque, offset, value, size);
1688         break;
1689 
1690     case ESDHC_MIX_CTRL:
1691         /*
1692          * So, when SD/MMC stack in Linux tries to write to "Transfer
1693          * Mode Register", ESDHC i.MX quirk code will translate it
1694          * into a write to ESDHC_MIX_CTRL, so we do the opposite in
1695          * order to get where we started
1696          *
1697          * Note that Auto CMD23 Enable bit is located in a wrong place
1698          * on i.MX, but since it is not used by QEMU we do not care.
1699          *
1700          * We don't want to call sdhci_write(.., SDHC_TRNMOD, ...)
1701          * here becuase it will result in a call to
1702          * sdhci_send_command(s) which we don't want.
1703          *
1704          */
1705         s->trnmod = value & UINT16_MAX;
1706         break;
1707     case SDHC_TRNMOD:
1708         /*
1709          * Similar to above, but this time a write to "Command
1710          * Register" will be translated into a 4-byte write to
1711          * "Transfer Mode register" where lower 16-bit of value would
1712          * be set to zero. So what we do is fill those bits with
1713          * cached value from s->trnmod and let the SDHCI
1714          * infrastructure handle the rest
1715          */
1716         sdhci_write(opaque, offset, val | s->trnmod, size);
1717         break;
1718     case SDHC_BLKSIZE:
1719         /*
1720          * ESDHCI does not implement "Host SDMA Buffer Boundary", and
1721          * Linux driver will try to zero this field out which will
1722          * break the rest of SDHCI emulation.
1723          *
1724          * Linux defaults to maximum possible setting (512K boundary)
1725          * and it seems to be the only option that i.MX IP implements,
1726          * so we artificially set it to that value.
1727          */
1728         val |= 0x7 << 12;
1729         /* FALLTHROUGH */
1730     default:
1731         sdhci_write(opaque, offset, val, size);
1732         break;
1733     }
1734 }
1735 
1736 
1737 static const MemoryRegionOps usdhc_mmio_ops = {
1738     .read = usdhc_read,
1739     .write = usdhc_write,
1740     .valid = {
1741         .min_access_size = 1,
1742         .max_access_size = 4,
1743         .unaligned = false
1744     },
1745     .endianness = DEVICE_LITTLE_ENDIAN,
1746 };
1747 
1748 static void imx_usdhc_init(Object *obj)
1749 {
1750     SDHCIState *s = SYSBUS_SDHCI(obj);
1751 
1752     s->io_ops = &usdhc_mmio_ops;
1753     s->quirks = SDHCI_QUIRK_NO_BUSY_IRQ;
1754 }
1755 
1756 static const TypeInfo imx_usdhc_info = {
1757     .name = TYPE_IMX_USDHC,
1758     .parent = TYPE_SYSBUS_SDHCI,
1759     .instance_init = imx_usdhc_init,
1760 };
1761 
1762 static void sdhci_register_types(void)
1763 {
1764     type_register_static(&sdhci_sysbus_info);
1765     type_register_static(&sdhci_bus_info);
1766     type_register_static(&imx_usdhc_info);
1767 }
1768 
1769 type_init(sdhci_register_types)
1770