cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

allwinner-sdhost.c (29522B)


      1/*
      2 * Allwinner (sun4i and above) SD Host Controller emulation
      3 *
      4 * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
      5 *
      6 * This program is free software: you can redistribute it and/or modify
      7 * it under the terms of the GNU General Public License as published by
      8 * the Free Software Foundation, either version 2 of the License, or
      9 * (at your option) any later version.
     10 *
     11 * This program is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     14 * GNU General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU General Public License
     17 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
     18 */
     19
     20#include "qemu/osdep.h"
     21#include "qemu/log.h"
     22#include "qemu/module.h"
     23#include "qemu/units.h"
     24#include "qapi/error.h"
     25#include "sysemu/blockdev.h"
     26#include "sysemu/dma.h"
     27#include "hw/qdev-properties.h"
     28#include "hw/irq.h"
     29#include "hw/sd/allwinner-sdhost.h"
     30#include "migration/vmstate.h"
     31#include "trace.h"
     32#include "qom/object.h"
     33
     34#define TYPE_AW_SDHOST_BUS "allwinner-sdhost-bus"
     35/* This is reusing the SDBus typedef from SD_BUS */
     36DECLARE_INSTANCE_CHECKER(SDBus, AW_SDHOST_BUS,
     37                         TYPE_AW_SDHOST_BUS)
     38
     39/* SD Host register offsets */
     40enum {
     41    REG_SD_GCTL       = 0x00,  /* Global Control */
     42    REG_SD_CKCR       = 0x04,  /* Clock Control */
     43    REG_SD_TMOR       = 0x08,  /* Timeout */
     44    REG_SD_BWDR       = 0x0C,  /* Bus Width */
     45    REG_SD_BKSR       = 0x10,  /* Block Size */
     46    REG_SD_BYCR       = 0x14,  /* Byte Count */
     47    REG_SD_CMDR       = 0x18,  /* Command */
     48    REG_SD_CAGR       = 0x1C,  /* Command Argument */
     49    REG_SD_RESP0      = 0x20,  /* Response Zero */
     50    REG_SD_RESP1      = 0x24,  /* Response One */
     51    REG_SD_RESP2      = 0x28,  /* Response Two */
     52    REG_SD_RESP3      = 0x2C,  /* Response Three */
     53    REG_SD_IMKR       = 0x30,  /* Interrupt Mask */
     54    REG_SD_MISR       = 0x34,  /* Masked Interrupt Status */
     55    REG_SD_RISR       = 0x38,  /* Raw Interrupt Status */
     56    REG_SD_STAR       = 0x3C,  /* Status */
     57    REG_SD_FWLR       = 0x40,  /* FIFO Water Level */
     58    REG_SD_FUNS       = 0x44,  /* FIFO Function Select */
     59    REG_SD_DBGC       = 0x50,  /* Debug Enable */
     60    REG_SD_A12A       = 0x58,  /* Auto command 12 argument */
     61    REG_SD_NTSR       = 0x5C,  /* SD NewTiming Set */
     62    REG_SD_SDBG       = 0x60,  /* SD newTiming Set Debug */
     63    REG_SD_HWRST      = 0x78,  /* Hardware Reset Register */
     64    REG_SD_DMAC       = 0x80,  /* Internal DMA Controller Control */
     65    REG_SD_DLBA       = 0x84,  /* Descriptor List Base Address */
     66    REG_SD_IDST       = 0x88,  /* Internal DMA Controller Status */
     67    REG_SD_IDIE       = 0x8C,  /* Internal DMA Controller IRQ Enable */
     68    REG_SD_THLDC      = 0x100, /* Card Threshold Control */
     69    REG_SD_DSBD       = 0x10C, /* eMMC DDR Start Bit Detection Control */
     70    REG_SD_RES_CRC    = 0x110, /* Response CRC from card/eMMC */
     71    REG_SD_DATA7_CRC  = 0x114, /* CRC Data 7 from card/eMMC */
     72    REG_SD_DATA6_CRC  = 0x118, /* CRC Data 6 from card/eMMC */
     73    REG_SD_DATA5_CRC  = 0x11C, /* CRC Data 5 from card/eMMC */
     74    REG_SD_DATA4_CRC  = 0x120, /* CRC Data 4 from card/eMMC */
     75    REG_SD_DATA3_CRC  = 0x124, /* CRC Data 3 from card/eMMC */
     76    REG_SD_DATA2_CRC  = 0x128, /* CRC Data 2 from card/eMMC */
     77    REG_SD_DATA1_CRC  = 0x12C, /* CRC Data 1 from card/eMMC */
     78    REG_SD_DATA0_CRC  = 0x130, /* CRC Data 0 from card/eMMC */
     79    REG_SD_CRC_STA    = 0x134, /* CRC status from card/eMMC during write */
     80    REG_SD_FIFO       = 0x200, /* Read/Write FIFO */
     81};
     82
     83/* SD Host register flags */
     84enum {
     85    SD_GCTL_FIFO_AC_MOD     = (1 << 31),
     86    SD_GCTL_DDR_MOD_SEL     = (1 << 10),
     87    SD_GCTL_CD_DBC_ENB      = (1 << 8),
     88    SD_GCTL_DMA_ENB         = (1 << 5),
     89    SD_GCTL_INT_ENB         = (1 << 4),
     90    SD_GCTL_DMA_RST         = (1 << 2),
     91    SD_GCTL_FIFO_RST        = (1 << 1),
     92    SD_GCTL_SOFT_RST        = (1 << 0),
     93};
     94
     95enum {
     96    SD_CMDR_LOAD            = (1 << 31),
     97    SD_CMDR_CLKCHANGE       = (1 << 21),
     98    SD_CMDR_WRITE           = (1 << 10),
     99    SD_CMDR_AUTOSTOP        = (1 << 12),
    100    SD_CMDR_DATA            = (1 << 9),
    101    SD_CMDR_RESPONSE_LONG   = (1 << 7),
    102    SD_CMDR_RESPONSE        = (1 << 6),
    103    SD_CMDR_CMDID_MASK      = (0x3f),
    104};
    105
    106enum {
    107    SD_RISR_CARD_REMOVE     = (1 << 31),
    108    SD_RISR_CARD_INSERT     = (1 << 30),
    109    SD_RISR_SDIO_INTR       = (1 << 16),
    110    SD_RISR_AUTOCMD_DONE    = (1 << 14),
    111    SD_RISR_DATA_COMPLETE   = (1 << 3),
    112    SD_RISR_CMD_COMPLETE    = (1 << 2),
    113    SD_RISR_NO_RESPONSE     = (1 << 1),
    114};
    115
    116enum {
    117    SD_STAR_CARD_PRESENT    = (1 << 8),
    118};
    119
    120enum {
    121    SD_IDST_INT_SUMMARY     = (1 << 8),
    122    SD_IDST_RECEIVE_IRQ     = (1 << 1),
    123    SD_IDST_TRANSMIT_IRQ    = (1 << 0),
    124    SD_IDST_IRQ_MASK        = (1 << 1) | (1 << 0) | (1 << 8),
    125    SD_IDST_WR_MASK         = (0x3ff),
    126};
    127
    128/* SD Host register reset values */
    129enum {
    130    REG_SD_GCTL_RST         = 0x00000300,
    131    REG_SD_CKCR_RST         = 0x0,
    132    REG_SD_TMOR_RST         = 0xFFFFFF40,
    133    REG_SD_BWDR_RST         = 0x0,
    134    REG_SD_BKSR_RST         = 0x00000200,
    135    REG_SD_BYCR_RST         = 0x00000200,
    136    REG_SD_CMDR_RST         = 0x0,
    137    REG_SD_CAGR_RST         = 0x0,
    138    REG_SD_RESP_RST         = 0x0,
    139    REG_SD_IMKR_RST         = 0x0,
    140    REG_SD_MISR_RST         = 0x0,
    141    REG_SD_RISR_RST         = 0x0,
    142    REG_SD_STAR_RST         = 0x00000100,
    143    REG_SD_FWLR_RST         = 0x000F0000,
    144    REG_SD_FUNS_RST         = 0x0,
    145    REG_SD_DBGC_RST         = 0x0,
    146    REG_SD_A12A_RST         = 0x0000FFFF,
    147    REG_SD_NTSR_RST         = 0x00000001,
    148    REG_SD_SDBG_RST         = 0x0,
    149    REG_SD_HWRST_RST        = 0x00000001,
    150    REG_SD_DMAC_RST         = 0x0,
    151    REG_SD_DLBA_RST         = 0x0,
    152    REG_SD_IDST_RST         = 0x0,
    153    REG_SD_IDIE_RST         = 0x0,
    154    REG_SD_THLDC_RST        = 0x0,
    155    REG_SD_DSBD_RST         = 0x0,
    156    REG_SD_RES_CRC_RST      = 0x0,
    157    REG_SD_DATA_CRC_RST     = 0x0,
    158    REG_SD_CRC_STA_RST      = 0x0,
    159    REG_SD_FIFO_RST         = 0x0,
    160};
    161
    162/* Data transfer descriptor for DMA */
    163typedef struct TransferDescriptor {
    164    uint32_t status; /* Status flags */
    165    uint32_t size;   /* Data buffer size */
    166    uint32_t addr;   /* Data buffer address */
    167    uint32_t next;   /* Physical address of next descriptor */
    168} TransferDescriptor;
    169
    170/* Data transfer descriptor flags */
    171enum {
    172    DESC_STATUS_HOLD   = (1 << 31), /* Set when descriptor is in use by DMA */
    173    DESC_STATUS_ERROR  = (1 << 30), /* Set when DMA transfer error occurred */
    174    DESC_STATUS_CHAIN  = (1 << 4),  /* Indicates chained descriptor. */
    175    DESC_STATUS_FIRST  = (1 << 3),  /* Set on the first descriptor */
    176    DESC_STATUS_LAST   = (1 << 2),  /* Set on the last descriptor */
    177    DESC_STATUS_NOIRQ  = (1 << 1),  /* Skip raising interrupt after transfer */
    178    DESC_SIZE_MASK     = (0xfffffffc)
    179};
    180
    181static void allwinner_sdhost_update_irq(AwSdHostState *s)
    182{
    183    uint32_t irq;
    184
    185    if (s->global_ctl & SD_GCTL_INT_ENB) {
    186        irq = s->irq_status & s->irq_mask;
    187    } else {
    188        irq = 0;
    189    }
    190
    191    trace_allwinner_sdhost_update_irq(irq);
    192    qemu_set_irq(s->irq, irq);
    193}
    194
    195static void allwinner_sdhost_update_transfer_cnt(AwSdHostState *s,
    196                                                 uint32_t bytes)
    197{
    198    if (s->transfer_cnt > bytes) {
    199        s->transfer_cnt -= bytes;
    200    } else {
    201        s->transfer_cnt = 0;
    202    }
    203
    204    if (!s->transfer_cnt) {
    205        s->irq_status |= SD_RISR_DATA_COMPLETE;
    206    }
    207}
    208
    209static void allwinner_sdhost_set_inserted(DeviceState *dev, bool inserted)
    210{
    211    AwSdHostState *s = AW_SDHOST(dev);
    212
    213    trace_allwinner_sdhost_set_inserted(inserted);
    214
    215    if (inserted) {
    216        s->irq_status |= SD_RISR_CARD_INSERT;
    217        s->irq_status &= ~SD_RISR_CARD_REMOVE;
    218        s->status |= SD_STAR_CARD_PRESENT;
    219    } else {
    220        s->irq_status &= ~SD_RISR_CARD_INSERT;
    221        s->irq_status |= SD_RISR_CARD_REMOVE;
    222        s->status &= ~SD_STAR_CARD_PRESENT;
    223    }
    224
    225    allwinner_sdhost_update_irq(s);
    226}
    227
    228static void allwinner_sdhost_send_command(AwSdHostState *s)
    229{
    230    SDRequest request;
    231    uint8_t resp[16];
    232    int rlen;
    233
    234    /* Auto clear load flag */
    235    s->command &= ~SD_CMDR_LOAD;
    236
    237    /* Clock change does not actually interact with the SD bus */
    238    if (!(s->command & SD_CMDR_CLKCHANGE)) {
    239
    240        /* Prepare request */
    241        request.cmd = s->command & SD_CMDR_CMDID_MASK;
    242        request.arg = s->command_arg;
    243
    244        /* Send request to SD bus */
    245        rlen = sdbus_do_command(&s->sdbus, &request, resp);
    246        if (rlen < 0) {
    247            goto error;
    248        }
    249
    250        /* If the command has a response, store it in the response registers */
    251        if ((s->command & SD_CMDR_RESPONSE)) {
    252            if (rlen == 4 && !(s->command & SD_CMDR_RESPONSE_LONG)) {
    253                s->response[0] = ldl_be_p(&resp[0]);
    254                s->response[1] = s->response[2] = s->response[3] = 0;
    255
    256            } else if (rlen == 16 && (s->command & SD_CMDR_RESPONSE_LONG)) {
    257                s->response[0] = ldl_be_p(&resp[12]);
    258                s->response[1] = ldl_be_p(&resp[8]);
    259                s->response[2] = ldl_be_p(&resp[4]);
    260                s->response[3] = ldl_be_p(&resp[0]);
    261            } else {
    262                goto error;
    263            }
    264        }
    265    }
    266
    267    /* Set interrupt status bits */
    268    s->irq_status |= SD_RISR_CMD_COMPLETE;
    269    return;
    270
    271error:
    272    s->irq_status |= SD_RISR_NO_RESPONSE;
    273}
    274
    275static void allwinner_sdhost_auto_stop(AwSdHostState *s)
    276{
    277    /*
    278     * The stop command (CMD12) ensures the SD bus
    279     * returns to the transfer state.
    280     */
    281    if ((s->command & SD_CMDR_AUTOSTOP) && (s->transfer_cnt == 0)) {
    282        /* First save current command registers */
    283        uint32_t saved_cmd = s->command;
    284        uint32_t saved_arg = s->command_arg;
    285
    286        /* Prepare stop command (CMD12) */
    287        s->command &= ~SD_CMDR_CMDID_MASK;
    288        s->command |= 12; /* CMD12 */
    289        s->command_arg = 0;
    290
    291        /* Put the command on SD bus */
    292        allwinner_sdhost_send_command(s);
    293
    294        /* Restore command values */
    295        s->command = saved_cmd;
    296        s->command_arg = saved_arg;
    297
    298        /* Set IRQ status bit for automatic stop done */
    299        s->irq_status |= SD_RISR_AUTOCMD_DONE;
    300    }
    301}
    302
    303static uint32_t allwinner_sdhost_process_desc(AwSdHostState *s,
    304                                              hwaddr desc_addr,
    305                                              TransferDescriptor *desc,
    306                                              bool is_write, uint32_t max_bytes)
    307{
    308    AwSdHostClass *klass = AW_SDHOST_GET_CLASS(s);
    309    uint32_t num_done = 0;
    310    uint32_t num_bytes = max_bytes;
    311    uint8_t buf[1024];
    312
    313    /* Read descriptor */
    314    dma_memory_read(&s->dma_as, desc_addr, desc, sizeof(*desc));
    315    if (desc->size == 0) {
    316        desc->size = klass->max_desc_size;
    317    } else if (desc->size > klass->max_desc_size) {
    318        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA descriptor buffer size "
    319                      " is out-of-bounds: %" PRIu32 " > %zu",
    320                      __func__, desc->size, klass->max_desc_size);
    321        desc->size = klass->max_desc_size;
    322    }
    323    if (desc->size < num_bytes) {
    324        num_bytes = desc->size;
    325    }
    326
    327    trace_allwinner_sdhost_process_desc(desc_addr, desc->size,
    328                                        is_write, max_bytes);
    329
    330    while (num_done < num_bytes) {
    331        /* Try to completely fill the local buffer */
    332        uint32_t buf_bytes = num_bytes - num_done;
    333        if (buf_bytes > sizeof(buf)) {
    334            buf_bytes = sizeof(buf);
    335        }
    336
    337        /* Write to SD bus */
    338        if (is_write) {
    339            dma_memory_read(&s->dma_as,
    340                            (desc->addr & DESC_SIZE_MASK) + num_done,
    341                            buf, buf_bytes);
    342            sdbus_write_data(&s->sdbus, buf, buf_bytes);
    343
    344        /* Read from SD bus */
    345        } else {
    346            sdbus_read_data(&s->sdbus, buf, buf_bytes);
    347            dma_memory_write(&s->dma_as,
    348                             (desc->addr & DESC_SIZE_MASK) + num_done,
    349                             buf, buf_bytes);
    350        }
    351        num_done += buf_bytes;
    352    }
    353
    354    /* Clear hold flag and flush descriptor */
    355    desc->status &= ~DESC_STATUS_HOLD;
    356    dma_memory_write(&s->dma_as, desc_addr, desc, sizeof(*desc));
    357
    358    return num_done;
    359}
    360
    361static void allwinner_sdhost_dma(AwSdHostState *s)
    362{
    363    TransferDescriptor desc;
    364    hwaddr desc_addr = s->desc_base;
    365    bool is_write = (s->command & SD_CMDR_WRITE);
    366    uint32_t bytes_done = 0;
    367
    368    /* Check if DMA can be performed */
    369    if (s->byte_count == 0 || s->block_size == 0 ||
    370      !(s->global_ctl & SD_GCTL_DMA_ENB)) {
    371        return;
    372    }
    373
    374    /*
    375     * For read operations, data must be available on the SD bus
    376     * If not, it is an error and we should not act at all
    377     */
    378    if (!is_write && !sdbus_data_ready(&s->sdbus)) {
    379        return;
    380    }
    381
    382    /* Process the DMA descriptors until all data is copied */
    383    while (s->byte_count > 0) {
    384        bytes_done = allwinner_sdhost_process_desc(s, desc_addr, &desc,
    385                                                   is_write, s->byte_count);
    386        allwinner_sdhost_update_transfer_cnt(s, bytes_done);
    387
    388        if (bytes_done <= s->byte_count) {
    389            s->byte_count -= bytes_done;
    390        } else {
    391            s->byte_count = 0;
    392        }
    393
    394        if (desc.status & DESC_STATUS_LAST) {
    395            break;
    396        } else {
    397            desc_addr = desc.next;
    398        }
    399    }
    400
    401    /* Raise IRQ to signal DMA is completed */
    402    s->irq_status |= SD_RISR_DATA_COMPLETE | SD_RISR_SDIO_INTR;
    403
    404    /* Update DMAC bits */
    405    s->dmac_status |= SD_IDST_INT_SUMMARY;
    406
    407    if (is_write) {
    408        s->dmac_status |= SD_IDST_TRANSMIT_IRQ;
    409    } else {
    410        s->dmac_status |= SD_IDST_RECEIVE_IRQ;
    411    }
    412}
    413
    414static uint64_t allwinner_sdhost_read(void *opaque, hwaddr offset,
    415                                      unsigned size)
    416{
    417    AwSdHostState *s = AW_SDHOST(opaque);
    418    uint32_t res = 0;
    419
    420    switch (offset) {
    421    case REG_SD_GCTL:      /* Global Control */
    422        res = s->global_ctl;
    423        break;
    424    case REG_SD_CKCR:      /* Clock Control */
    425        res = s->clock_ctl;
    426        break;
    427    case REG_SD_TMOR:      /* Timeout */
    428        res = s->timeout;
    429        break;
    430    case REG_SD_BWDR:      /* Bus Width */
    431        res = s->bus_width;
    432        break;
    433    case REG_SD_BKSR:      /* Block Size */
    434        res = s->block_size;
    435        break;
    436    case REG_SD_BYCR:      /* Byte Count */
    437        res = s->byte_count;
    438        break;
    439    case REG_SD_CMDR:      /* Command */
    440        res = s->command;
    441        break;
    442    case REG_SD_CAGR:      /* Command Argument */
    443        res = s->command_arg;
    444        break;
    445    case REG_SD_RESP0:     /* Response Zero */
    446        res = s->response[0];
    447        break;
    448    case REG_SD_RESP1:     /* Response One */
    449        res = s->response[1];
    450        break;
    451    case REG_SD_RESP2:     /* Response Two */
    452        res = s->response[2];
    453        break;
    454    case REG_SD_RESP3:     /* Response Three */
    455        res = s->response[3];
    456        break;
    457    case REG_SD_IMKR:      /* Interrupt Mask */
    458        res = s->irq_mask;
    459        break;
    460    case REG_SD_MISR:      /* Masked Interrupt Status */
    461        res = s->irq_status & s->irq_mask;
    462        break;
    463    case REG_SD_RISR:      /* Raw Interrupt Status */
    464        res = s->irq_status;
    465        break;
    466    case REG_SD_STAR:      /* Status */
    467        res = s->status;
    468        break;
    469    case REG_SD_FWLR:      /* FIFO Water Level */
    470        res = s->fifo_wlevel;
    471        break;
    472    case REG_SD_FUNS:      /* FIFO Function Select */
    473        res = s->fifo_func_sel;
    474        break;
    475    case REG_SD_DBGC:      /* Debug Enable */
    476        res = s->debug_enable;
    477        break;
    478    case REG_SD_A12A:      /* Auto command 12 argument */
    479        res = s->auto12_arg;
    480        break;
    481    case REG_SD_NTSR:      /* SD NewTiming Set */
    482        res = s->newtiming_set;
    483        break;
    484    case REG_SD_SDBG:      /* SD newTiming Set Debug */
    485        res = s->newtiming_debug;
    486        break;
    487    case REG_SD_HWRST:     /* Hardware Reset Register */
    488        res = s->hardware_rst;
    489        break;
    490    case REG_SD_DMAC:      /* Internal DMA Controller Control */
    491        res = s->dmac;
    492        break;
    493    case REG_SD_DLBA:      /* Descriptor List Base Address */
    494        res = s->desc_base;
    495        break;
    496    case REG_SD_IDST:      /* Internal DMA Controller Status */
    497        res = s->dmac_status;
    498        break;
    499    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
    500        res = s->dmac_irq;
    501        break;
    502    case REG_SD_THLDC:     /* Card Threshold Control */
    503        res = s->card_threshold;
    504        break;
    505    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
    506        res = s->startbit_detect;
    507        break;
    508    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
    509        res = s->response_crc;
    510        break;
    511    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
    512    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
    513    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
    514    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
    515    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
    516    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
    517    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
    518    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
    519        res = s->data_crc[((offset - REG_SD_DATA7_CRC) / sizeof(uint32_t))];
    520        break;
    521    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
    522        res = s->status_crc;
    523        break;
    524    case REG_SD_FIFO:      /* Read/Write FIFO */
    525        if (sdbus_data_ready(&s->sdbus)) {
    526            sdbus_read_data(&s->sdbus, &res, sizeof(uint32_t));
    527            le32_to_cpus(&res);
    528            allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
    529            allwinner_sdhost_auto_stop(s);
    530            allwinner_sdhost_update_irq(s);
    531        } else {
    532            qemu_log_mask(LOG_GUEST_ERROR, "%s: no data ready on SD bus\n",
    533                          __func__);
    534        }
    535        break;
    536    default:
    537        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
    538                      HWADDR_PRIx"\n", __func__, offset);
    539        res = 0;
    540        break;
    541    }
    542
    543    trace_allwinner_sdhost_read(offset, res, size);
    544    return res;
    545}
    546
    547static void allwinner_sdhost_write(void *opaque, hwaddr offset,
    548                                   uint64_t value, unsigned size)
    549{
    550    AwSdHostState *s = AW_SDHOST(opaque);
    551    uint32_t u32;
    552
    553    trace_allwinner_sdhost_write(offset, value, size);
    554
    555    switch (offset) {
    556    case REG_SD_GCTL:      /* Global Control */
    557        s->global_ctl = value;
    558        s->global_ctl &= ~(SD_GCTL_DMA_RST | SD_GCTL_FIFO_RST |
    559                           SD_GCTL_SOFT_RST);
    560        allwinner_sdhost_update_irq(s);
    561        break;
    562    case REG_SD_CKCR:      /* Clock Control */
    563        s->clock_ctl = value;
    564        break;
    565    case REG_SD_TMOR:      /* Timeout */
    566        s->timeout = value;
    567        break;
    568    case REG_SD_BWDR:      /* Bus Width */
    569        s->bus_width = value;
    570        break;
    571    case REG_SD_BKSR:      /* Block Size */
    572        s->block_size = value;
    573        break;
    574    case REG_SD_BYCR:      /* Byte Count */
    575        s->byte_count = value;
    576        s->transfer_cnt = value;
    577        break;
    578    case REG_SD_CMDR:      /* Command */
    579        s->command = value;
    580        if (value & SD_CMDR_LOAD) {
    581            allwinner_sdhost_send_command(s);
    582            allwinner_sdhost_dma(s);
    583            allwinner_sdhost_auto_stop(s);
    584        }
    585        allwinner_sdhost_update_irq(s);
    586        break;
    587    case REG_SD_CAGR:      /* Command Argument */
    588        s->command_arg = value;
    589        break;
    590    case REG_SD_RESP0:     /* Response Zero */
    591        s->response[0] = value;
    592        break;
    593    case REG_SD_RESP1:     /* Response One */
    594        s->response[1] = value;
    595        break;
    596    case REG_SD_RESP2:     /* Response Two */
    597        s->response[2] = value;
    598        break;
    599    case REG_SD_RESP3:     /* Response Three */
    600        s->response[3] = value;
    601        break;
    602    case REG_SD_IMKR:      /* Interrupt Mask */
    603        s->irq_mask = value;
    604        allwinner_sdhost_update_irq(s);
    605        break;
    606    case REG_SD_MISR:      /* Masked Interrupt Status */
    607    case REG_SD_RISR:      /* Raw Interrupt Status */
    608        s->irq_status &= ~value;
    609        allwinner_sdhost_update_irq(s);
    610        break;
    611    case REG_SD_STAR:      /* Status */
    612        s->status &= ~value;
    613        allwinner_sdhost_update_irq(s);
    614        break;
    615    case REG_SD_FWLR:      /* FIFO Water Level */
    616        s->fifo_wlevel = value;
    617        break;
    618    case REG_SD_FUNS:      /* FIFO Function Select */
    619        s->fifo_func_sel = value;
    620        break;
    621    case REG_SD_DBGC:      /* Debug Enable */
    622        s->debug_enable = value;
    623        break;
    624    case REG_SD_A12A:      /* Auto command 12 argument */
    625        s->auto12_arg = value;
    626        break;
    627    case REG_SD_NTSR:      /* SD NewTiming Set */
    628        s->newtiming_set = value;
    629        break;
    630    case REG_SD_SDBG:      /* SD newTiming Set Debug */
    631        s->newtiming_debug = value;
    632        break;
    633    case REG_SD_HWRST:     /* Hardware Reset Register */
    634        s->hardware_rst = value;
    635        break;
    636    case REG_SD_DMAC:      /* Internal DMA Controller Control */
    637        s->dmac = value;
    638        allwinner_sdhost_update_irq(s);
    639        break;
    640    case REG_SD_DLBA:      /* Descriptor List Base Address */
    641        s->desc_base = value;
    642        break;
    643    case REG_SD_IDST:      /* Internal DMA Controller Status */
    644        s->dmac_status &= (~SD_IDST_WR_MASK) | (~value & SD_IDST_WR_MASK);
    645        allwinner_sdhost_update_irq(s);
    646        break;
    647    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
    648        s->dmac_irq = value;
    649        allwinner_sdhost_update_irq(s);
    650        break;
    651    case REG_SD_THLDC:     /* Card Threshold Control */
    652        s->card_threshold = value;
    653        break;
    654    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
    655        s->startbit_detect = value;
    656        break;
    657    case REG_SD_FIFO:      /* Read/Write FIFO */
    658        u32 = cpu_to_le32(value);
    659        sdbus_write_data(&s->sdbus, &u32, sizeof(u32));
    660        allwinner_sdhost_update_transfer_cnt(s, sizeof(u32));
    661        allwinner_sdhost_auto_stop(s);
    662        allwinner_sdhost_update_irq(s);
    663        break;
    664    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
    665    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
    666    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
    667    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
    668    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
    669    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
    670    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
    671    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
    672    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
    673    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
    674        break;
    675    default:
    676        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
    677                      HWADDR_PRIx"\n", __func__, offset);
    678        break;
    679    }
    680}
    681
    682static const MemoryRegionOps allwinner_sdhost_ops = {
    683    .read = allwinner_sdhost_read,
    684    .write = allwinner_sdhost_write,
    685    .endianness = DEVICE_NATIVE_ENDIAN,
    686    .valid = {
    687        .min_access_size = 4,
    688        .max_access_size = 4,
    689    },
    690    .impl.min_access_size = 4,
    691};
    692
    693static const VMStateDescription vmstate_allwinner_sdhost = {
    694    .name = "allwinner-sdhost",
    695    .version_id = 1,
    696    .minimum_version_id = 1,
    697    .fields = (VMStateField[]) {
    698        VMSTATE_UINT32(global_ctl, AwSdHostState),
    699        VMSTATE_UINT32(clock_ctl, AwSdHostState),
    700        VMSTATE_UINT32(timeout, AwSdHostState),
    701        VMSTATE_UINT32(bus_width, AwSdHostState),
    702        VMSTATE_UINT32(block_size, AwSdHostState),
    703        VMSTATE_UINT32(byte_count, AwSdHostState),
    704        VMSTATE_UINT32(transfer_cnt, AwSdHostState),
    705        VMSTATE_UINT32(command, AwSdHostState),
    706        VMSTATE_UINT32(command_arg, AwSdHostState),
    707        VMSTATE_UINT32_ARRAY(response, AwSdHostState, 4),
    708        VMSTATE_UINT32(irq_mask, AwSdHostState),
    709        VMSTATE_UINT32(irq_status, AwSdHostState),
    710        VMSTATE_UINT32(status, AwSdHostState),
    711        VMSTATE_UINT32(fifo_wlevel, AwSdHostState),
    712        VMSTATE_UINT32(fifo_func_sel, AwSdHostState),
    713        VMSTATE_UINT32(debug_enable, AwSdHostState),
    714        VMSTATE_UINT32(auto12_arg, AwSdHostState),
    715        VMSTATE_UINT32(newtiming_set, AwSdHostState),
    716        VMSTATE_UINT32(newtiming_debug, AwSdHostState),
    717        VMSTATE_UINT32(hardware_rst, AwSdHostState),
    718        VMSTATE_UINT32(dmac, AwSdHostState),
    719        VMSTATE_UINT32(desc_base, AwSdHostState),
    720        VMSTATE_UINT32(dmac_status, AwSdHostState),
    721        VMSTATE_UINT32(dmac_irq, AwSdHostState),
    722        VMSTATE_UINT32(card_threshold, AwSdHostState),
    723        VMSTATE_UINT32(startbit_detect, AwSdHostState),
    724        VMSTATE_UINT32(response_crc, AwSdHostState),
    725        VMSTATE_UINT32_ARRAY(data_crc, AwSdHostState, 8),
    726        VMSTATE_UINT32(status_crc, AwSdHostState),
    727        VMSTATE_END_OF_LIST()
    728    }
    729};
    730
    731static Property allwinner_sdhost_properties[] = {
    732    DEFINE_PROP_LINK("dma-memory", AwSdHostState, dma_mr,
    733                     TYPE_MEMORY_REGION, MemoryRegion *),
    734    DEFINE_PROP_END_OF_LIST(),
    735};
    736
    737static void allwinner_sdhost_init(Object *obj)
    738{
    739    AwSdHostState *s = AW_SDHOST(obj);
    740
    741    qbus_init(&s->sdbus, sizeof(s->sdbus),
    742              TYPE_AW_SDHOST_BUS, DEVICE(s), "sd-bus");
    743
    744    memory_region_init_io(&s->iomem, obj, &allwinner_sdhost_ops, s,
    745                           TYPE_AW_SDHOST, 4 * KiB);
    746    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
    747    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
    748}
    749
    750static void allwinner_sdhost_realize(DeviceState *dev, Error **errp)
    751{
    752    AwSdHostState *s = AW_SDHOST(dev);
    753
    754    if (!s->dma_mr) {
    755        error_setg(errp, TYPE_AW_SDHOST " 'dma-memory' link not set");
    756        return;
    757    }
    758
    759    address_space_init(&s->dma_as, s->dma_mr, "sdhost-dma");
    760}
    761
    762static void allwinner_sdhost_reset(DeviceState *dev)
    763{
    764    AwSdHostState *s = AW_SDHOST(dev);
    765
    766    s->global_ctl = REG_SD_GCTL_RST;
    767    s->clock_ctl = REG_SD_CKCR_RST;
    768    s->timeout = REG_SD_TMOR_RST;
    769    s->bus_width = REG_SD_BWDR_RST;
    770    s->block_size = REG_SD_BKSR_RST;
    771    s->byte_count = REG_SD_BYCR_RST;
    772    s->transfer_cnt = 0;
    773
    774    s->command = REG_SD_CMDR_RST;
    775    s->command_arg = REG_SD_CAGR_RST;
    776
    777    for (int i = 0; i < ARRAY_SIZE(s->response); i++) {
    778        s->response[i] = REG_SD_RESP_RST;
    779    }
    780
    781    s->irq_mask = REG_SD_IMKR_RST;
    782    s->irq_status = REG_SD_RISR_RST;
    783    s->status = REG_SD_STAR_RST;
    784
    785    s->fifo_wlevel = REG_SD_FWLR_RST;
    786    s->fifo_func_sel = REG_SD_FUNS_RST;
    787    s->debug_enable = REG_SD_DBGC_RST;
    788    s->auto12_arg = REG_SD_A12A_RST;
    789    s->newtiming_set = REG_SD_NTSR_RST;
    790    s->newtiming_debug = REG_SD_SDBG_RST;
    791    s->hardware_rst = REG_SD_HWRST_RST;
    792    s->dmac = REG_SD_DMAC_RST;
    793    s->desc_base = REG_SD_DLBA_RST;
    794    s->dmac_status = REG_SD_IDST_RST;
    795    s->dmac_irq = REG_SD_IDIE_RST;
    796    s->card_threshold = REG_SD_THLDC_RST;
    797    s->startbit_detect = REG_SD_DSBD_RST;
    798    s->response_crc = REG_SD_RES_CRC_RST;
    799
    800    for (int i = 0; i < ARRAY_SIZE(s->data_crc); i++) {
    801        s->data_crc[i] = REG_SD_DATA_CRC_RST;
    802    }
    803
    804    s->status_crc = REG_SD_CRC_STA_RST;
    805}
    806
    807static void allwinner_sdhost_bus_class_init(ObjectClass *klass, void *data)
    808{
    809    SDBusClass *sbc = SD_BUS_CLASS(klass);
    810
    811    sbc->set_inserted = allwinner_sdhost_set_inserted;
    812}
    813
    814static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
    815{
    816    DeviceClass *dc = DEVICE_CLASS(klass);
    817
    818    dc->reset = allwinner_sdhost_reset;
    819    dc->vmsd = &vmstate_allwinner_sdhost;
    820    dc->realize = allwinner_sdhost_realize;
    821    device_class_set_props(dc, allwinner_sdhost_properties);
    822}
    823
    824static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
    825{
    826    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
    827    sc->max_desc_size = 8 * KiB;
    828}
    829
    830static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
    831{
    832    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
    833    sc->max_desc_size = 64 * KiB;
    834}
    835
    836static TypeInfo allwinner_sdhost_info = {
    837    .name          = TYPE_AW_SDHOST,
    838    .parent        = TYPE_SYS_BUS_DEVICE,
    839    .instance_init = allwinner_sdhost_init,
    840    .instance_size = sizeof(AwSdHostState),
    841    .class_init    = allwinner_sdhost_class_init,
    842    .class_size    = sizeof(AwSdHostClass),
    843    .abstract      = true,
    844};
    845
    846static const TypeInfo allwinner_sdhost_sun4i_info = {
    847    .name          = TYPE_AW_SDHOST_SUN4I,
    848    .parent        = TYPE_AW_SDHOST,
    849    .class_init    = allwinner_sdhost_sun4i_class_init,
    850};
    851
    852static const TypeInfo allwinner_sdhost_sun5i_info = {
    853    .name          = TYPE_AW_SDHOST_SUN5I,
    854    .parent        = TYPE_AW_SDHOST,
    855    .class_init    = allwinner_sdhost_sun5i_class_init,
    856};
    857
    858static const TypeInfo allwinner_sdhost_bus_info = {
    859    .name = TYPE_AW_SDHOST_BUS,
    860    .parent = TYPE_SD_BUS,
    861    .instance_size = sizeof(SDBus),
    862    .class_init = allwinner_sdhost_bus_class_init,
    863};
    864
    865static void allwinner_sdhost_register_types(void)
    866{
    867    type_register_static(&allwinner_sdhost_info);
    868    type_register_static(&allwinner_sdhost_sun4i_info);
    869    type_register_static(&allwinner_sdhost_sun5i_info);
    870    type_register_static(&allwinner_sdhost_bus_info);
    871}
    872
    873type_init(allwinner_sdhost_register_types)