cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

omap_mmc.c (16884B)


      1/*
      2 * OMAP on-chip MMC/SD host emulation.
      3 *
      4 * Datasheet: TI Multimedia Card (MMC/SD/SDIO) Interface (SPRU765A)
      5 *
      6 * Copyright (C) 2006-2007 Andrzej Zaborowski  <balrog@zabor.org>
      7 *
      8 * This program is free software; you can redistribute it and/or
      9 * modify it under the terms of the GNU General Public License as
     10 * published by the Free Software Foundation; either version 2 or
     11 * (at your option) version 3 of the License.
     12 *
     13 * This program is distributed in the hope that it will be useful,
     14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     16 * GNU General Public License for more details.
     17 *
     18 * You should have received a copy of the GNU General Public License along
     19 * with this program; if not, see <http://www.gnu.org/licenses/>.
     20 */
     21
     22#include "qemu/osdep.h"
     23#include "qemu/log.h"
     24#include "hw/irq.h"
     25#include "hw/arm/omap.h"
     26#include "hw/sd/sdcard_legacy.h"
     27
     28struct omap_mmc_s {
     29    qemu_irq irq;
     30    qemu_irq *dma;
     31    qemu_irq coverswitch;
     32    MemoryRegion iomem;
     33    omap_clk clk;
     34    SDState *card;
     35    uint16_t last_cmd;
     36    uint16_t sdio;
     37    uint16_t rsp[8];
     38    uint32_t arg;
     39    int lines;
     40    int dw;
     41    int mode;
     42    int enable;
     43    int be;
     44    int rev;
     45    uint16_t status;
     46    uint16_t mask;
     47    uint8_t cto;
     48    uint16_t dto;
     49    int clkdiv;
     50    uint16_t fifo[32];
     51    int fifo_start;
     52    int fifo_len;
     53    uint16_t blen;
     54    uint16_t blen_counter;
     55    uint16_t nblk;
     56    uint16_t nblk_counter;
     57    int tx_dma;
     58    int rx_dma;
     59    int af_level;
     60    int ae_level;
     61
     62    int ddir;
     63    int transfer;
     64
     65    int cdet_wakeup;
     66    int cdet_enable;
     67    int cdet_state;
     68    qemu_irq cdet;
     69};
     70
     71static void omap_mmc_interrupts_update(struct omap_mmc_s *s)
     72{
     73    qemu_set_irq(s->irq, !!(s->status & s->mask));
     74}
     75
     76static void omap_mmc_fifolevel_update(struct omap_mmc_s *host)
     77{
     78    if (!host->transfer && !host->fifo_len) {
     79        host->status &= 0xf3ff;
     80        return;
     81    }
     82
     83    if (host->fifo_len > host->af_level && host->ddir) {
     84        if (host->rx_dma) {
     85            host->status &= 0xfbff;
     86            qemu_irq_raise(host->dma[1]);
     87        } else
     88            host->status |= 0x0400;
     89    } else {
     90        host->status &= 0xfbff;
     91        qemu_irq_lower(host->dma[1]);
     92    }
     93
     94    if (host->fifo_len < host->ae_level && !host->ddir) {
     95        if (host->tx_dma) {
     96            host->status &= 0xf7ff;
     97            qemu_irq_raise(host->dma[0]);
     98        } else
     99            host->status |= 0x0800;
    100    } else {
    101        qemu_irq_lower(host->dma[0]);
    102        host->status &= 0xf7ff;
    103    }
    104}
    105
    106typedef enum {
    107    sd_nore = 0,	/* no response */
    108    sd_r1,		/* normal response command */
    109    sd_r2,		/* CID, CSD registers */
    110    sd_r3,		/* OCR register */
    111    sd_r6 = 6,		/* Published RCA response */
    112    sd_r1b = -1,
    113} sd_rsp_type_t;
    114
    115static void omap_mmc_command(struct omap_mmc_s *host, int cmd, int dir,
    116                sd_cmd_type_t type, int busy, sd_rsp_type_t resptype, int init)
    117{
    118    uint32_t rspstatus, mask;
    119    int rsplen, timeout;
    120    SDRequest request;
    121    uint8_t response[16];
    122
    123    if (init && cmd == 0) {
    124        host->status |= 0x0001;
    125        return;
    126    }
    127
    128    if (resptype == sd_r1 && busy)
    129        resptype = sd_r1b;
    130
    131    if (type == sd_adtc) {
    132        host->fifo_start = 0;
    133        host->fifo_len = 0;
    134        host->transfer = 1;
    135        host->ddir = dir;
    136    } else
    137        host->transfer = 0;
    138    timeout = 0;
    139    mask = 0;
    140    rspstatus = 0;
    141
    142    request.cmd = cmd;
    143    request.arg = host->arg;
    144    request.crc = 0; /* FIXME */
    145
    146    rsplen = sd_do_command(host->card, &request, response);
    147
    148    /* TODO: validate CRCs */
    149    switch (resptype) {
    150    case sd_nore:
    151        rsplen = 0;
    152        break;
    153
    154    case sd_r1:
    155    case sd_r1b:
    156        if (rsplen < 4) {
    157            timeout = 1;
    158            break;
    159        }
    160        rsplen = 4;
    161
    162        mask = OUT_OF_RANGE | ADDRESS_ERROR | BLOCK_LEN_ERROR |
    163                ERASE_SEQ_ERROR | ERASE_PARAM | WP_VIOLATION |
    164                LOCK_UNLOCK_FAILED | COM_CRC_ERROR | ILLEGAL_COMMAND |
    165                CARD_ECC_FAILED | CC_ERROR | SD_ERROR |
    166                CID_CSD_OVERWRITE;
    167        if (host->sdio & (1 << 13))
    168            mask |= AKE_SEQ_ERROR;
    169        rspstatus = ldl_be_p(response);
    170        break;
    171
    172    case sd_r2:
    173        if (rsplen < 16) {
    174            timeout = 1;
    175            break;
    176        }
    177        rsplen = 16;
    178        break;
    179
    180    case sd_r3:
    181        if (rsplen < 4) {
    182            timeout = 1;
    183            break;
    184        }
    185        rsplen = 4;
    186
    187        rspstatus = ldl_be_p(response);
    188        if (rspstatus & 0x80000000)
    189            host->status &= 0xe000;
    190        else
    191            host->status |= 0x1000;
    192        break;
    193
    194    case sd_r6:
    195        if (rsplen < 4) {
    196            timeout = 1;
    197            break;
    198        }
    199        rsplen = 4;
    200
    201        mask = 0xe000 | AKE_SEQ_ERROR;
    202        rspstatus = (response[2] << 8) | (response[3] << 0);
    203    }
    204
    205    if (rspstatus & mask)
    206        host->status |= 0x4000;
    207    else
    208        host->status &= 0xb000;
    209
    210    if (rsplen)
    211        for (rsplen = 0; rsplen < 8; rsplen ++)
    212            host->rsp[~rsplen & 7] = response[(rsplen << 1) | 1] |
    213                    (response[(rsplen << 1) | 0] << 8);
    214
    215    if (timeout)
    216        host->status |= 0x0080;
    217    else if (cmd == 12)
    218        host->status |= 0x0005;	/* Makes it more real */
    219    else
    220        host->status |= 0x0001;
    221}
    222
    223static void omap_mmc_transfer(struct omap_mmc_s *host)
    224{
    225    uint8_t value;
    226
    227    if (!host->transfer)
    228        return;
    229
    230    while (1) {
    231        if (host->ddir) {
    232            if (host->fifo_len > host->af_level)
    233                break;
    234
    235            value = sd_read_byte(host->card);
    236            host->fifo[(host->fifo_start + host->fifo_len) & 31] = value;
    237            if (-- host->blen_counter) {
    238                value = sd_read_byte(host->card);
    239                host->fifo[(host->fifo_start + host->fifo_len) & 31] |=
    240                        value << 8;
    241                host->blen_counter --;
    242            }
    243
    244            host->fifo_len ++;
    245        } else {
    246            if (!host->fifo_len)
    247                break;
    248
    249            value = host->fifo[host->fifo_start] & 0xff;
    250            sd_write_byte(host->card, value);
    251            if (-- host->blen_counter) {
    252                value = host->fifo[host->fifo_start] >> 8;
    253                sd_write_byte(host->card, value);
    254                host->blen_counter --;
    255            }
    256
    257            host->fifo_start ++;
    258            host->fifo_len --;
    259            host->fifo_start &= 31;
    260        }
    261
    262        if (host->blen_counter == 0) {
    263            host->nblk_counter --;
    264            host->blen_counter = host->blen;
    265
    266            if (host->nblk_counter == 0) {
    267                host->nblk_counter = host->nblk;
    268                host->transfer = 0;
    269                host->status |= 0x0008;
    270                break;
    271            }
    272        }
    273    }
    274}
    275
    276static void omap_mmc_update(void *opaque)
    277{
    278    struct omap_mmc_s *s = opaque;
    279    omap_mmc_transfer(s);
    280    omap_mmc_fifolevel_update(s);
    281    omap_mmc_interrupts_update(s);
    282}
    283
    284static void omap_mmc_pseudo_reset(struct omap_mmc_s *host)
    285{
    286    host->status = 0;
    287    host->fifo_len = 0;
    288}
    289
    290void omap_mmc_reset(struct omap_mmc_s *host)
    291{
    292    host->last_cmd = 0;
    293    memset(host->rsp, 0, sizeof(host->rsp));
    294    host->arg = 0;
    295    host->dw = 0;
    296    host->mode = 0;
    297    host->enable = 0;
    298    host->mask = 0;
    299    host->cto = 0;
    300    host->dto = 0;
    301    host->blen = 0;
    302    host->blen_counter = 0;
    303    host->nblk = 0;
    304    host->nblk_counter = 0;
    305    host->tx_dma = 0;
    306    host->rx_dma = 0;
    307    host->ae_level = 0x00;
    308    host->af_level = 0x1f;
    309    host->transfer = 0;
    310    host->cdet_wakeup = 0;
    311    host->cdet_enable = 0;
    312    qemu_set_irq(host->coverswitch, host->cdet_state);
    313    host->clkdiv = 0;
    314
    315    omap_mmc_pseudo_reset(host);
    316
    317    /* Since we're still using the legacy SD API the card is not plugged
    318     * into any bus, and we must reset it manually. When omap_mmc is
    319     * QOMified this must move into the QOM reset function.
    320     */
    321    device_cold_reset(DEVICE(host->card));
    322}
    323
    324static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
    325                              unsigned size)
    326{
    327    uint16_t i;
    328    struct omap_mmc_s *s = (struct omap_mmc_s *) opaque;
    329
    330    if (size != 2) {
    331        return omap_badwidth_read16(opaque, offset);
    332    }
    333
    334    switch (offset) {
    335    case 0x00:	/* MMC_CMD */
    336        return s->last_cmd;
    337
    338    case 0x04:	/* MMC_ARGL */
    339        return s->arg & 0x0000ffff;
    340
    341    case 0x08:	/* MMC_ARGH */
    342        return s->arg >> 16;
    343
    344    case 0x0c:	/* MMC_CON */
    345        return (s->dw << 15) | (s->mode << 12) | (s->enable << 11) | 
    346                (s->be << 10) | s->clkdiv;
    347
    348    case 0x10:	/* MMC_STAT */
    349        return s->status;
    350
    351    case 0x14:	/* MMC_IE */
    352        return s->mask;
    353
    354    case 0x18:	/* MMC_CTO */
    355        return s->cto;
    356
    357    case 0x1c:	/* MMC_DTO */
    358        return s->dto;
    359
    360    case 0x20:	/* MMC_DATA */
    361        /* TODO: support 8-bit access */
    362        i = s->fifo[s->fifo_start];
    363        if (s->fifo_len == 0) {
    364            printf("MMC: FIFO underrun\n");
    365            return i;
    366        }
    367        s->fifo_start ++;
    368        s->fifo_len --;
    369        s->fifo_start &= 31;
    370        omap_mmc_transfer(s);
    371        omap_mmc_fifolevel_update(s);
    372        omap_mmc_interrupts_update(s);
    373        return i;
    374
    375    case 0x24:	/* MMC_BLEN */
    376        return s->blen_counter;
    377
    378    case 0x28:	/* MMC_NBLK */
    379        return s->nblk_counter;
    380
    381    case 0x2c:	/* MMC_BUF */
    382        return (s->rx_dma << 15) | (s->af_level << 8) |
    383            (s->tx_dma << 7) | s->ae_level;
    384
    385    case 0x30:	/* MMC_SPI */
    386        return 0x0000;
    387    case 0x34:	/* MMC_SDIO */
    388        return (s->cdet_wakeup << 2) | (s->cdet_enable) | s->sdio;
    389    case 0x38:	/* MMC_SYST */
    390        return 0x0000;
    391
    392    case 0x3c:	/* MMC_REV */
    393        return s->rev;
    394
    395    case 0x40:	/* MMC_RSP0 */
    396    case 0x44:	/* MMC_RSP1 */
    397    case 0x48:	/* MMC_RSP2 */
    398    case 0x4c:	/* MMC_RSP3 */
    399    case 0x50:	/* MMC_RSP4 */
    400    case 0x54:	/* MMC_RSP5 */
    401    case 0x58:	/* MMC_RSP6 */
    402    case 0x5c:	/* MMC_RSP7 */
    403        return s->rsp[(offset - 0x40) >> 2];
    404
    405    /* OMAP2-specific */
    406    case 0x60:	/* MMC_IOSR */
    407    case 0x64:	/* MMC_SYSC */
    408        return 0;
    409    case 0x68:	/* MMC_SYSS */
    410        return 1;						/* RSTD */
    411    }
    412
    413    OMAP_BAD_REG(offset);
    414    return 0;
    415}
    416
    417static void omap_mmc_write(void *opaque, hwaddr offset,
    418                           uint64_t value, unsigned size)
    419{
    420    int i;
    421    struct omap_mmc_s *s = (struct omap_mmc_s *) opaque;
    422
    423    if (size != 2) {
    424        omap_badwidth_write16(opaque, offset, value);
    425        return;
    426    }
    427
    428    switch (offset) {
    429    case 0x00:	/* MMC_CMD */
    430        if (!s->enable)
    431            break;
    432
    433        s->last_cmd = value;
    434        for (i = 0; i < 8; i ++)
    435            s->rsp[i] = 0x0000;
    436        omap_mmc_command(s, value & 63, (value >> 15) & 1,
    437                (sd_cmd_type_t) ((value >> 12) & 3),
    438                (value >> 11) & 1,
    439                (sd_rsp_type_t) ((value >> 8) & 7),
    440                (value >> 7) & 1);
    441        omap_mmc_update(s);
    442        break;
    443
    444    case 0x04:	/* MMC_ARGL */
    445        s->arg &= 0xffff0000;
    446        s->arg |= 0x0000ffff & value;
    447        break;
    448
    449    case 0x08:	/* MMC_ARGH */
    450        s->arg &= 0x0000ffff;
    451        s->arg |= value << 16;
    452        break;
    453
    454    case 0x0c:	/* MMC_CON */
    455        s->dw = (value >> 15) & 1;
    456        s->mode = (value >> 12) & 3;
    457        s->enable = (value >> 11) & 1;
    458        s->be = (value >> 10) & 1;
    459        s->clkdiv = (value >> 0) & (s->rev >= 2 ? 0x3ff : 0xff);
    460        if (s->mode != 0) {
    461            qemu_log_mask(LOG_UNIMP,
    462                          "omap_mmc_wr: mode #%i unimplemented\n", s->mode);
    463        }
    464        if (s->be != 0) {
    465            qemu_log_mask(LOG_UNIMP,
    466                          "omap_mmc_wr: Big Endian not implemented\n");
    467        }
    468        if (s->dw != 0 && s->lines < 4)
    469            printf("4-bit SD bus enabled\n");
    470        if (!s->enable)
    471            omap_mmc_pseudo_reset(s);
    472        break;
    473
    474    case 0x10:	/* MMC_STAT */
    475        s->status &= ~value;
    476        omap_mmc_interrupts_update(s);
    477        break;
    478
    479    case 0x14:	/* MMC_IE */
    480        s->mask = value & 0x7fff;
    481        omap_mmc_interrupts_update(s);
    482        break;
    483
    484    case 0x18:	/* MMC_CTO */
    485        s->cto = value & 0xff;
    486        if (s->cto > 0xfd && s->rev <= 1)
    487            printf("MMC: CTO of 0xff and 0xfe cannot be used!\n");
    488        break;
    489
    490    case 0x1c:	/* MMC_DTO */
    491        s->dto = value & 0xffff;
    492        break;
    493
    494    case 0x20:	/* MMC_DATA */
    495        /* TODO: support 8-bit access */
    496        if (s->fifo_len == 32)
    497            break;
    498        s->fifo[(s->fifo_start + s->fifo_len) & 31] = value;
    499        s->fifo_len ++;
    500        omap_mmc_transfer(s);
    501        omap_mmc_fifolevel_update(s);
    502        omap_mmc_interrupts_update(s);
    503        break;
    504
    505    case 0x24:	/* MMC_BLEN */
    506        s->blen = (value & 0x07ff) + 1;
    507        s->blen_counter = s->blen;
    508        break;
    509
    510    case 0x28:	/* MMC_NBLK */
    511        s->nblk = (value & 0x07ff) + 1;
    512        s->nblk_counter = s->nblk;
    513        s->blen_counter = s->blen;
    514        break;
    515
    516    case 0x2c:	/* MMC_BUF */
    517        s->rx_dma = (value >> 15) & 1;
    518        s->af_level = (value >> 8) & 0x1f;
    519        s->tx_dma = (value >> 7) & 1;
    520        s->ae_level = value & 0x1f;
    521
    522        if (s->rx_dma)
    523            s->status &= 0xfbff;
    524        if (s->tx_dma)
    525            s->status &= 0xf7ff;
    526        omap_mmc_fifolevel_update(s);
    527        omap_mmc_interrupts_update(s);
    528        break;
    529
    530    /* SPI, SDIO and TEST modes unimplemented */
    531    case 0x30:	/* MMC_SPI (OMAP1 only) */
    532        break;
    533    case 0x34:	/* MMC_SDIO */
    534        s->sdio = value & (s->rev >= 2 ? 0xfbf3 : 0x2020);
    535        s->cdet_wakeup = (value >> 9) & 1;
    536        s->cdet_enable = (value >> 2) & 1;
    537        break;
    538    case 0x38:	/* MMC_SYST */
    539        break;
    540
    541    case 0x3c:	/* MMC_REV */
    542    case 0x40:	/* MMC_RSP0 */
    543    case 0x44:	/* MMC_RSP1 */
    544    case 0x48:	/* MMC_RSP2 */
    545    case 0x4c:	/* MMC_RSP3 */
    546    case 0x50:	/* MMC_RSP4 */
    547    case 0x54:	/* MMC_RSP5 */
    548    case 0x58:	/* MMC_RSP6 */
    549    case 0x5c:	/* MMC_RSP7 */
    550        OMAP_RO_REG(offset);
    551        break;
    552
    553    /* OMAP2-specific */
    554    case 0x60:	/* MMC_IOSR */
    555        if (value & 0xf)
    556            printf("MMC: SDIO bits used!\n");
    557        break;
    558    case 0x64:	/* MMC_SYSC */
    559        if (value & (1 << 2))					/* SRTS */
    560            omap_mmc_reset(s);
    561        break;
    562    case 0x68:	/* MMC_SYSS */
    563        OMAP_RO_REG(offset);
    564        break;
    565
    566    default:
    567        OMAP_BAD_REG(offset);
    568    }
    569}
    570
    571static const MemoryRegionOps omap_mmc_ops = {
    572    .read = omap_mmc_read,
    573    .write = omap_mmc_write,
    574    .endianness = DEVICE_NATIVE_ENDIAN,
    575};
    576
    577static void omap_mmc_cover_cb(void *opaque, int line, int level)
    578{
    579    struct omap_mmc_s *host = (struct omap_mmc_s *) opaque;
    580
    581    if (!host->cdet_state && level) {
    582        host->status |= 0x0002;
    583        omap_mmc_interrupts_update(host);
    584        if (host->cdet_wakeup) {
    585            /* TODO: Assert wake-up */
    586        }
    587    }
    588
    589    if (host->cdet_state != level) {
    590        qemu_set_irq(host->coverswitch, level);
    591        host->cdet_state = level;
    592    }
    593}
    594
    595struct omap_mmc_s *omap_mmc_init(hwaddr base,
    596                MemoryRegion *sysmem,
    597                BlockBackend *blk,
    598                qemu_irq irq, qemu_irq dma[], omap_clk clk)
    599{
    600    struct omap_mmc_s *s = g_new0(struct omap_mmc_s, 1);
    601
    602    s->irq = irq;
    603    s->dma = dma;
    604    s->clk = clk;
    605    s->lines = 1;	/* TODO: needs to be settable per-board */
    606    s->rev = 1;
    607
    608    memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
    609    memory_region_add_subregion(sysmem, base, &s->iomem);
    610
    611    /* Instantiate the storage */
    612    s->card = sd_init(blk, false);
    613    if (s->card == NULL) {
    614        exit(1);
    615    }
    616
    617    omap_mmc_reset(s);
    618
    619    return s;
    620}
    621
    622struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
    623                BlockBackend *blk, qemu_irq irq, qemu_irq dma[],
    624                omap_clk fclk, omap_clk iclk)
    625{
    626    struct omap_mmc_s *s = g_new0(struct omap_mmc_s, 1);
    627
    628    s->irq = irq;
    629    s->dma = dma;
    630    s->clk = fclk;
    631    s->lines = 4;
    632    s->rev = 2;
    633
    634    memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
    635                          omap_l4_region_size(ta, 0));
    636    omap_l4_attach(ta, 0, &s->iomem);
    637
    638    /* Instantiate the storage */
    639    s->card = sd_init(blk, false);
    640    if (s->card == NULL) {
    641        exit(1);
    642    }
    643
    644    s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);
    645    sd_set_cb(s->card, NULL, s->cdet);
    646
    647    omap_mmc_reset(s);
    648
    649    return s;
    650}
    651
    652void omap_mmc_handlers(struct omap_mmc_s *s, qemu_irq ro, qemu_irq cover)
    653{
    654    if (s->cdet) {
    655        sd_set_cb(s->card, ro, s->cdet);
    656        s->coverswitch = cover;
    657        qemu_set_irq(cover, s->cdet_state);
    658    } else
    659        sd_set_cb(s->card, ro, cover);
    660}
    661
    662void omap_mmc_enable(struct omap_mmc_s *s, int enable)
    663{
    664    sd_enable(s->card, enable);
    665}