1 | /* |
2 | * Arm PrimeCell PL181 MultiMedia Card Interface |
3 | * |
4 | * Copyright (c) 2007 CodeSourcery. |
5 | * Written by Paul Brook |
6 | * |
7 | * This code is licensed under the GPL. |
8 | */ |
9 | |
10 | #include "qemu/osdep.h" |
11 | #include "sysemu/blockdev.h" |
12 | #include "hw/sysbus.h" |
13 | #include "migration/vmstate.h" |
14 | #include "hw/irq.h" |
15 | #include "hw/sd/sd.h" |
16 | #include "qemu/log.h" |
17 | #include "qemu/module.h" |
18 | #include "qapi/error.h" |
19 | |
20 | //#define DEBUG_PL181 1 |
21 | |
22 | #ifdef DEBUG_PL181 |
23 | #define DPRINTF(fmt, ...) \ |
24 | do { printf("pl181: " fmt , ## __VA_ARGS__); } while (0) |
25 | #else |
26 | #define DPRINTF(fmt, ...) do {} while(0) |
27 | #endif |
28 | |
29 | #define PL181_FIFO_LEN 16 |
30 | |
31 | #define TYPE_PL181 "pl181" |
32 | #define PL181(obj) OBJECT_CHECK(PL181State, (obj), TYPE_PL181) |
33 | |
34 | typedef struct PL181State { |
35 | SysBusDevice parent_obj; |
36 | |
37 | MemoryRegion iomem; |
38 | SDState *card; |
39 | uint32_t clock; |
40 | uint32_t power; |
41 | uint32_t cmdarg; |
42 | uint32_t cmd; |
43 | uint32_t datatimer; |
44 | uint32_t datalength; |
45 | uint32_t respcmd; |
46 | uint32_t response[4]; |
47 | uint32_t datactrl; |
48 | uint32_t datacnt; |
49 | uint32_t status; |
50 | uint32_t mask[2]; |
51 | int32_t fifo_pos; |
52 | int32_t fifo_len; |
53 | /* The linux 2.6.21 driver is buggy, and misbehaves if new data arrives |
54 | while it is reading the FIFO. We hack around this by deferring |
55 | subsequent transfers until after the driver polls the status word. |
56 | http://www.arm.linux.org.uk/developer/patches/viewpatch.php?id=4446/1 |
57 | */ |
58 | int32_t linux_hack; |
59 | uint32_t fifo[PL181_FIFO_LEN]; |
60 | qemu_irq irq[2]; |
61 | /* GPIO outputs for 'card is readonly' and 'card inserted' */ |
62 | qemu_irq cardstatus[2]; |
63 | } PL181State; |
64 | |
65 | static const VMStateDescription vmstate_pl181 = { |
66 | .name = "pl181" , |
67 | .version_id = 1, |
68 | .minimum_version_id = 1, |
69 | .fields = (VMStateField[]) { |
70 | VMSTATE_UINT32(clock, PL181State), |
71 | VMSTATE_UINT32(power, PL181State), |
72 | VMSTATE_UINT32(cmdarg, PL181State), |
73 | VMSTATE_UINT32(cmd, PL181State), |
74 | VMSTATE_UINT32(datatimer, PL181State), |
75 | VMSTATE_UINT32(datalength, PL181State), |
76 | VMSTATE_UINT32(respcmd, PL181State), |
77 | VMSTATE_UINT32_ARRAY(response, PL181State, 4), |
78 | VMSTATE_UINT32(datactrl, PL181State), |
79 | VMSTATE_UINT32(datacnt, PL181State), |
80 | VMSTATE_UINT32(status, PL181State), |
81 | VMSTATE_UINT32_ARRAY(mask, PL181State, 2), |
82 | VMSTATE_INT32(fifo_pos, PL181State), |
83 | VMSTATE_INT32(fifo_len, PL181State), |
84 | VMSTATE_INT32(linux_hack, PL181State), |
85 | VMSTATE_UINT32_ARRAY(fifo, PL181State, PL181_FIFO_LEN), |
86 | VMSTATE_END_OF_LIST() |
87 | } |
88 | }; |
89 | |
90 | #define PL181_CMD_INDEX 0x3f |
91 | #define PL181_CMD_RESPONSE (1 << 6) |
92 | #define PL181_CMD_LONGRESP (1 << 7) |
93 | #define PL181_CMD_INTERRUPT (1 << 8) |
94 | #define PL181_CMD_PENDING (1 << 9) |
95 | #define PL181_CMD_ENABLE (1 << 10) |
96 | |
97 | #define PL181_DATA_ENABLE (1 << 0) |
98 | #define PL181_DATA_DIRECTION (1 << 1) |
99 | #define PL181_DATA_MODE (1 << 2) |
100 | #define PL181_DATA_DMAENABLE (1 << 3) |
101 | |
102 | #define PL181_STATUS_CMDCRCFAIL (1 << 0) |
103 | #define PL181_STATUS_DATACRCFAIL (1 << 1) |
104 | #define PL181_STATUS_CMDTIMEOUT (1 << 2) |
105 | #define PL181_STATUS_DATATIMEOUT (1 << 3) |
106 | #define PL181_STATUS_TXUNDERRUN (1 << 4) |
107 | #define PL181_STATUS_RXOVERRUN (1 << 5) |
108 | #define PL181_STATUS_CMDRESPEND (1 << 6) |
109 | #define PL181_STATUS_CMDSENT (1 << 7) |
110 | #define PL181_STATUS_DATAEND (1 << 8) |
111 | #define PL181_STATUS_DATABLOCKEND (1 << 10) |
112 | #define PL181_STATUS_CMDACTIVE (1 << 11) |
113 | #define PL181_STATUS_TXACTIVE (1 << 12) |
114 | #define PL181_STATUS_RXACTIVE (1 << 13) |
115 | #define PL181_STATUS_TXFIFOHALFEMPTY (1 << 14) |
116 | #define PL181_STATUS_RXFIFOHALFFULL (1 << 15) |
117 | #define PL181_STATUS_TXFIFOFULL (1 << 16) |
118 | #define PL181_STATUS_RXFIFOFULL (1 << 17) |
119 | #define PL181_STATUS_TXFIFOEMPTY (1 << 18) |
120 | #define PL181_STATUS_RXFIFOEMPTY (1 << 19) |
121 | #define PL181_STATUS_TXDATAAVLBL (1 << 20) |
122 | #define PL181_STATUS_RXDATAAVLBL (1 << 21) |
123 | |
124 | #define PL181_STATUS_TX_FIFO (PL181_STATUS_TXACTIVE \ |
125 | |PL181_STATUS_TXFIFOHALFEMPTY \ |
126 | |PL181_STATUS_TXFIFOFULL \ |
127 | |PL181_STATUS_TXFIFOEMPTY \ |
128 | |PL181_STATUS_TXDATAAVLBL) |
129 | #define PL181_STATUS_RX_FIFO (PL181_STATUS_RXACTIVE \ |
130 | |PL181_STATUS_RXFIFOHALFFULL \ |
131 | |PL181_STATUS_RXFIFOFULL \ |
132 | |PL181_STATUS_RXFIFOEMPTY \ |
133 | |PL181_STATUS_RXDATAAVLBL) |
134 | |
135 | static const unsigned char pl181_id[] = |
136 | { 0x81, 0x11, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 }; |
137 | |
138 | static void pl181_update(PL181State *s) |
139 | { |
140 | int i; |
141 | for (i = 0; i < 2; i++) { |
142 | qemu_set_irq(s->irq[i], (s->status & s->mask[i]) != 0); |
143 | } |
144 | } |
145 | |
146 | static void pl181_fifo_push(PL181State *s, uint32_t value) |
147 | { |
148 | int n; |
149 | |
150 | if (s->fifo_len == PL181_FIFO_LEN) { |
151 | fprintf(stderr, "pl181: FIFO overflow\n" ); |
152 | return; |
153 | } |
154 | n = (s->fifo_pos + s->fifo_len) & (PL181_FIFO_LEN - 1); |
155 | s->fifo_len++; |
156 | s->fifo[n] = value; |
157 | DPRINTF("FIFO push %08x\n" , (int)value); |
158 | } |
159 | |
160 | static uint32_t pl181_fifo_pop(PL181State *s) |
161 | { |
162 | uint32_t value; |
163 | |
164 | if (s->fifo_len == 0) { |
165 | fprintf(stderr, "pl181: FIFO underflow\n" ); |
166 | return 0; |
167 | } |
168 | value = s->fifo[s->fifo_pos]; |
169 | s->fifo_len--; |
170 | s->fifo_pos = (s->fifo_pos + 1) & (PL181_FIFO_LEN - 1); |
171 | DPRINTF("FIFO pop %08x\n" , (int)value); |
172 | return value; |
173 | } |
174 | |
175 | static void pl181_send_command(PL181State *s) |
176 | { |
177 | SDRequest request; |
178 | uint8_t response[16]; |
179 | int rlen; |
180 | |
181 | request.cmd = s->cmd & PL181_CMD_INDEX; |
182 | request.arg = s->cmdarg; |
183 | DPRINTF("Command %d %08x\n" , request.cmd, request.arg); |
184 | rlen = sd_do_command(s->card, &request, response); |
185 | if (rlen < 0) |
186 | goto error; |
187 | if (s->cmd & PL181_CMD_RESPONSE) { |
188 | if (rlen == 0 || (rlen == 4 && (s->cmd & PL181_CMD_LONGRESP))) |
189 | goto error; |
190 | if (rlen != 4 && rlen != 16) |
191 | goto error; |
192 | s->response[0] = ldl_be_p(&response[0]); |
193 | if (rlen == 4) { |
194 | s->response[1] = s->response[2] = s->response[3] = 0; |
195 | } else { |
196 | s->response[1] = ldl_be_p(&response[4]); |
197 | s->response[2] = ldl_be_p(&response[8]); |
198 | s->response[3] = ldl_be_p(&response[12]) & ~1; |
199 | } |
200 | DPRINTF("Response received\n" ); |
201 | s->status |= PL181_STATUS_CMDRESPEND; |
202 | } else { |
203 | DPRINTF("Command sent\n" ); |
204 | s->status |= PL181_STATUS_CMDSENT; |
205 | } |
206 | return; |
207 | |
208 | error: |
209 | DPRINTF("Timeout\n" ); |
210 | s->status |= PL181_STATUS_CMDTIMEOUT; |
211 | } |
212 | |
213 | /* Transfer data between the card and the FIFO. This is complicated by |
214 | the FIFO holding 32-bit words and the card taking data in single byte |
215 | chunks. FIFO bytes are transferred in little-endian order. */ |
216 | |
217 | static void pl181_fifo_run(PL181State *s) |
218 | { |
219 | uint32_t bits; |
220 | uint32_t value = 0; |
221 | int n; |
222 | int is_read; |
223 | |
224 | is_read = (s->datactrl & PL181_DATA_DIRECTION) != 0; |
225 | if (s->datacnt != 0 && (!is_read || sd_data_ready(s->card)) |
226 | && !s->linux_hack) { |
227 | if (is_read) { |
228 | n = 0; |
229 | while (s->datacnt && s->fifo_len < PL181_FIFO_LEN) { |
230 | value |= (uint32_t)sd_read_data(s->card) << (n * 8); |
231 | s->datacnt--; |
232 | n++; |
233 | if (n == 4) { |
234 | pl181_fifo_push(s, value); |
235 | n = 0; |
236 | value = 0; |
237 | } |
238 | } |
239 | if (n != 0) { |
240 | pl181_fifo_push(s, value); |
241 | } |
242 | } else { /* write */ |
243 | n = 0; |
244 | while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) { |
245 | if (n == 0) { |
246 | value = pl181_fifo_pop(s); |
247 | n = 4; |
248 | } |
249 | n--; |
250 | s->datacnt--; |
251 | sd_write_data(s->card, value & 0xff); |
252 | value >>= 8; |
253 | } |
254 | } |
255 | } |
256 | s->status &= ~(PL181_STATUS_RX_FIFO | PL181_STATUS_TX_FIFO); |
257 | if (s->datacnt == 0) { |
258 | s->status |= PL181_STATUS_DATAEND; |
259 | /* HACK: */ |
260 | s->status |= PL181_STATUS_DATABLOCKEND; |
261 | DPRINTF("Transfer Complete\n" ); |
262 | } |
263 | if (s->datacnt == 0 && s->fifo_len == 0) { |
264 | s->datactrl &= ~PL181_DATA_ENABLE; |
265 | DPRINTF("Data engine idle\n" ); |
266 | } else { |
267 | /* Update FIFO bits. */ |
268 | bits = PL181_STATUS_TXACTIVE | PL181_STATUS_RXACTIVE; |
269 | if (s->fifo_len == 0) { |
270 | bits |= PL181_STATUS_TXFIFOEMPTY; |
271 | bits |= PL181_STATUS_RXFIFOEMPTY; |
272 | } else { |
273 | bits |= PL181_STATUS_TXDATAAVLBL; |
274 | bits |= PL181_STATUS_RXDATAAVLBL; |
275 | } |
276 | if (s->fifo_len == 16) { |
277 | bits |= PL181_STATUS_TXFIFOFULL; |
278 | bits |= PL181_STATUS_RXFIFOFULL; |
279 | } |
280 | if (s->fifo_len <= 8) { |
281 | bits |= PL181_STATUS_TXFIFOHALFEMPTY; |
282 | } |
283 | if (s->fifo_len >= 8) { |
284 | bits |= PL181_STATUS_RXFIFOHALFFULL; |
285 | } |
286 | if (s->datactrl & PL181_DATA_DIRECTION) { |
287 | bits &= PL181_STATUS_RX_FIFO; |
288 | } else { |
289 | bits &= PL181_STATUS_TX_FIFO; |
290 | } |
291 | s->status |= bits; |
292 | } |
293 | } |
294 | |
295 | static uint64_t pl181_read(void *opaque, hwaddr offset, |
296 | unsigned size) |
297 | { |
298 | PL181State *s = (PL181State *)opaque; |
299 | uint32_t tmp; |
300 | |
301 | if (offset >= 0xfe0 && offset < 0x1000) { |
302 | return pl181_id[(offset - 0xfe0) >> 2]; |
303 | } |
304 | switch (offset) { |
305 | case 0x00: /* Power */ |
306 | return s->power; |
307 | case 0x04: /* Clock */ |
308 | return s->clock; |
309 | case 0x08: /* Argument */ |
310 | return s->cmdarg; |
311 | case 0x0c: /* Command */ |
312 | return s->cmd; |
313 | case 0x10: /* RespCmd */ |
314 | return s->respcmd; |
315 | case 0x14: /* Response0 */ |
316 | return s->response[0]; |
317 | case 0x18: /* Response1 */ |
318 | return s->response[1]; |
319 | case 0x1c: /* Response2 */ |
320 | return s->response[2]; |
321 | case 0x20: /* Response3 */ |
322 | return s->response[3]; |
323 | case 0x24: /* DataTimer */ |
324 | return s->datatimer; |
325 | case 0x28: /* DataLength */ |
326 | return s->datalength; |
327 | case 0x2c: /* DataCtrl */ |
328 | return s->datactrl; |
329 | case 0x30: /* DataCnt */ |
330 | return s->datacnt; |
331 | case 0x34: /* Status */ |
332 | tmp = s->status; |
333 | if (s->linux_hack) { |
334 | s->linux_hack = 0; |
335 | pl181_fifo_run(s); |
336 | pl181_update(s); |
337 | } |
338 | return tmp; |
339 | case 0x3c: /* Mask0 */ |
340 | return s->mask[0]; |
341 | case 0x40: /* Mask1 */ |
342 | return s->mask[1]; |
343 | case 0x48: /* FifoCnt */ |
344 | /* The documentation is somewhat vague about exactly what FifoCnt |
345 | does. On real hardware it appears to be when decrememnted |
346 | when a word is transferred between the FIFO and the serial |
347 | data engine. DataCnt is decremented after each byte is |
348 | transferred between the serial engine and the card. |
349 | We don't emulate this level of detail, so both can be the same. */ |
350 | tmp = (s->datacnt + 3) >> 2; |
351 | if (s->linux_hack) { |
352 | s->linux_hack = 0; |
353 | pl181_fifo_run(s); |
354 | pl181_update(s); |
355 | } |
356 | return tmp; |
357 | case 0x80: case 0x84: case 0x88: case 0x8c: /* FifoData */ |
358 | case 0x90: case 0x94: case 0x98: case 0x9c: |
359 | case 0xa0: case 0xa4: case 0xa8: case 0xac: |
360 | case 0xb0: case 0xb4: case 0xb8: case 0xbc: |
361 | if (s->fifo_len == 0) { |
362 | qemu_log_mask(LOG_GUEST_ERROR, "pl181: Unexpected FIFO read\n" ); |
363 | return 0; |
364 | } else { |
365 | uint32_t value; |
366 | value = pl181_fifo_pop(s); |
367 | s->linux_hack = 1; |
368 | pl181_fifo_run(s); |
369 | pl181_update(s); |
370 | return value; |
371 | } |
372 | default: |
373 | qemu_log_mask(LOG_GUEST_ERROR, |
374 | "pl181_read: Bad offset %x\n" , (int)offset); |
375 | return 0; |
376 | } |
377 | } |
378 | |
379 | static void pl181_write(void *opaque, hwaddr offset, |
380 | uint64_t value, unsigned size) |
381 | { |
382 | PL181State *s = (PL181State *)opaque; |
383 | |
384 | switch (offset) { |
385 | case 0x00: /* Power */ |
386 | s->power = value & 0xff; |
387 | break; |
388 | case 0x04: /* Clock */ |
389 | s->clock = value & 0xff; |
390 | break; |
391 | case 0x08: /* Argument */ |
392 | s->cmdarg = value; |
393 | break; |
394 | case 0x0c: /* Command */ |
395 | s->cmd = value; |
396 | if (s->cmd & PL181_CMD_ENABLE) { |
397 | if (s->cmd & PL181_CMD_INTERRUPT) { |
398 | qemu_log_mask(LOG_UNIMP, |
399 | "pl181: Interrupt mode not implemented\n" ); |
400 | } if (s->cmd & PL181_CMD_PENDING) { |
401 | qemu_log_mask(LOG_UNIMP, |
402 | "pl181: Pending commands not implemented\n" ); |
403 | } else { |
404 | pl181_send_command(s); |
405 | pl181_fifo_run(s); |
406 | } |
407 | /* The command has completed one way or the other. */ |
408 | s->cmd &= ~PL181_CMD_ENABLE; |
409 | } |
410 | break; |
411 | case 0x24: /* DataTimer */ |
412 | s->datatimer = value; |
413 | break; |
414 | case 0x28: /* DataLength */ |
415 | s->datalength = value & 0xffff; |
416 | break; |
417 | case 0x2c: /* DataCtrl */ |
418 | s->datactrl = value & 0xff; |
419 | if (value & PL181_DATA_ENABLE) { |
420 | s->datacnt = s->datalength; |
421 | pl181_fifo_run(s); |
422 | } |
423 | break; |
424 | case 0x38: /* Clear */ |
425 | s->status &= ~(value & 0x7ff); |
426 | break; |
427 | case 0x3c: /* Mask0 */ |
428 | s->mask[0] = value; |
429 | break; |
430 | case 0x40: /* Mask1 */ |
431 | s->mask[1] = value; |
432 | break; |
433 | case 0x80: case 0x84: case 0x88: case 0x8c: /* FifoData */ |
434 | case 0x90: case 0x94: case 0x98: case 0x9c: |
435 | case 0xa0: case 0xa4: case 0xa8: case 0xac: |
436 | case 0xb0: case 0xb4: case 0xb8: case 0xbc: |
437 | if (s->datacnt == 0) { |
438 | qemu_log_mask(LOG_GUEST_ERROR, "pl181: Unexpected FIFO write\n" ); |
439 | } else { |
440 | pl181_fifo_push(s, value); |
441 | pl181_fifo_run(s); |
442 | } |
443 | break; |
444 | default: |
445 | qemu_log_mask(LOG_GUEST_ERROR, |
446 | "pl181_write: Bad offset %x\n" , (int)offset); |
447 | } |
448 | pl181_update(s); |
449 | } |
450 | |
451 | static const MemoryRegionOps pl181_ops = { |
452 | .read = pl181_read, |
453 | .write = pl181_write, |
454 | .endianness = DEVICE_NATIVE_ENDIAN, |
455 | }; |
456 | |
457 | static void pl181_reset(DeviceState *d) |
458 | { |
459 | PL181State *s = PL181(d); |
460 | |
461 | s->power = 0; |
462 | s->cmdarg = 0; |
463 | s->cmd = 0; |
464 | s->datatimer = 0; |
465 | s->datalength = 0; |
466 | s->respcmd = 0; |
467 | s->response[0] = 0; |
468 | s->response[1] = 0; |
469 | s->response[2] = 0; |
470 | s->response[3] = 0; |
471 | s->datatimer = 0; |
472 | s->datalength = 0; |
473 | s->datactrl = 0; |
474 | s->datacnt = 0; |
475 | s->status = 0; |
476 | s->linux_hack = 0; |
477 | s->mask[0] = 0; |
478 | s->mask[1] = 0; |
479 | |
480 | /* We can assume our GPIO outputs have been wired up now */ |
481 | sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]); |
482 | /* Since we're still using the legacy SD API the card is not plugged |
483 | * into any bus, and we must reset it manually. |
484 | */ |
485 | device_reset(DEVICE(s->card)); |
486 | } |
487 | |
488 | static void pl181_init(Object *obj) |
489 | { |
490 | DeviceState *dev = DEVICE(obj); |
491 | PL181State *s = PL181(obj); |
492 | SysBusDevice *sbd = SYS_BUS_DEVICE(obj); |
493 | |
494 | memory_region_init_io(&s->iomem, obj, &pl181_ops, s, "pl181" , 0x1000); |
495 | sysbus_init_mmio(sbd, &s->iomem); |
496 | sysbus_init_irq(sbd, &s->irq[0]); |
497 | sysbus_init_irq(sbd, &s->irq[1]); |
498 | qdev_init_gpio_out(dev, s->cardstatus, 2); |
499 | } |
500 | |
501 | static void pl181_realize(DeviceState *dev, Error **errp) |
502 | { |
503 | PL181State *s = PL181(dev); |
504 | DriveInfo *dinfo; |
505 | |
506 | /* FIXME use a qdev drive property instead of drive_get_next() */ |
507 | dinfo = drive_get_next(IF_SD); |
508 | s->card = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, false); |
509 | if (s->card == NULL) { |
510 | error_setg(errp, "sd_init failed" ); |
511 | } |
512 | } |
513 | |
514 | static void pl181_class_init(ObjectClass *klass, void *data) |
515 | { |
516 | DeviceClass *k = DEVICE_CLASS(klass); |
517 | |
518 | k->vmsd = &vmstate_pl181; |
519 | k->reset = pl181_reset; |
520 | /* Reason: init() method uses drive_get_next() */ |
521 | k->user_creatable = false; |
522 | k->realize = pl181_realize; |
523 | } |
524 | |
525 | static const TypeInfo pl181_info = { |
526 | .name = TYPE_PL181, |
527 | .parent = TYPE_SYS_BUS_DEVICE, |
528 | .instance_size = sizeof(PL181State), |
529 | .instance_init = pl181_init, |
530 | .class_init = pl181_class_init, |
531 | }; |
532 | |
533 | static void pl181_register_types(void) |
534 | { |
535 | type_register_static(&pl181_info); |
536 | } |
537 | |
538 | type_init(pl181_register_types) |
539 | |