?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
memory: Simplify memory_region_init_rom_device_nomigrate() calls
[qemu/ar7.git] / hw / sd / sd.c
blob807b5d3de321661017109232e168093868809514
1 /*
2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
4 *
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
24 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
28 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include "qemu/osdep.h"
34 #include "qemu/units.h"
35 #include "qemu/cutils.h"
36 #include "hw/irq.h"
37 #include "hw/registerfields.h"
38 #include "sysemu/block-backend.h"
39 #include "hw/sd/sd.h"
40 #include "hw/sd/sdcard_legacy.h"
41 #include "migration/vmstate.h"
42 #include "qapi/error.h"
43 #include "qemu/bitmap.h"
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "qemu/error-report.h"
47 #include "qemu/timer.h"
48 #include "qemu/log.h"
49 #include "qemu/module.h"
50 #include "sdmmc-internal.h"
51 #include "trace.h"
52
53 //#define DEBUG_SD 1
54
55 #define SDSC_MAX_CAPACITY (2 * GiB)
56
57 #define INVALID_ADDRESS UINT32_MAX
58
59 typedef enum {
60 sd_r0 = 0, /* no response */
61 sd_r1, /* normal response command */
62 sd_r2_i, /* CID register */
63 sd_r2_s, /* CSD register */
64 sd_r3, /* OCR register */
65 sd_r6 = 6, /* Published RCA response */
66 sd_r7, /* Operating voltage */
67 sd_r1b = -1,
68 sd_illegal = -2,
69 } sd_rsp_type_t;
70
71 enum SDCardModes {
72 sd_inactive,
73 sd_card_identification_mode,
74 sd_data_transfer_mode,
75 };
76
77 enum SDCardStates {
78 sd_inactive_state = -1,
79 sd_idle_state = 0,
80 sd_ready_state,
81 sd_identification_state,
82 sd_standby_state,
83 sd_transfer_state,
84 sd_sendingdata_state,
85 sd_receivingdata_state,
86 sd_programming_state,
87 sd_disconnect_state,
88 };
89
90 typedef sd_rsp_type_t (*sd_cmd_handler)(SDState *sd, SDRequest req);
91
92 typedef struct SDProto {
93 const char *name;
94 sd_cmd_handler cmd[SDMMC_CMD_MAX];
95 sd_cmd_handler acmd[SDMMC_CMD_MAX];
96 } SDProto;
97
98 struct SDState {
99 DeviceState parent_obj;
100
101 /* If true, created by sd_init() for a non-qdevified caller */
102 /* TODO purge them with fire */
103 bool me_no_qdev_me_kill_mammoth_with_rocks;
104
105 /* SD Memory Card Registers */
106 uint32_t ocr;
107 uint8_t scr[8];
108 uint8_t cid[16];
109 uint8_t csd[16];
110 uint16_t rca;
111 uint32_t card_status;
112 uint8_t sd_status[64];
113
114 /* Static properties */
115
116 uint8_t spec_version;
117 BlockBackend *blk;
118
119 /* Runtime changeables */
120
121 uint32_t mode; /* current card mode, one of SDCardModes */
122 int32_t state; /* current card state, one of SDCardStates */
123 uint32_t vhs;
124 bool wp_switch;
125 unsigned long *wp_group_bmap;
126 int32_t wp_group_bits;
127 uint64_t size;
128 uint32_t blk_len;
129 uint32_t multi_blk_cnt;
130 uint32_t erase_start;
131 uint32_t erase_end;
132 uint8_t pwd[16];
133 uint32_t pwd_len;
134 uint8_t function_group[6];
135 uint8_t current_cmd;
136 /* True if we will handle the next command as an ACMD. Note that this does
137 * *not* track the APP_CMD status bit!
138 */
139 bool expecting_acmd;
140 uint32_t blk_written;
141 uint64_t data_start;
142 uint32_t data_offset;
143 uint8_t data[512];
144 qemu_irq readonly_cb;
145 qemu_irq inserted_cb;
146 QEMUTimer *ocr_power_timer;
147 bool enable;
148 uint8_t dat_lines;
149 bool cmd_line;
150 };
151
152 static void sd_realize(DeviceState *dev, Error **errp);
153
154 static const struct SDProto *sd_proto(SDState *sd)
155 {
156 SDCardClass *sc = SD_CARD_GET_CLASS(sd);
157
158 return sc->proto;
159 }
160
161 static const SDProto sd_proto_spi;
162
163 static bool sd_is_spi(SDState *sd)
164 {
165 return sd_proto(sd) == &sd_proto_spi;
166 }
167
168 static const char *sd_version_str(enum SDPhySpecificationVersion version)
169 {
170 static const char *sdphy_version[] = {
171 [SD_PHY_SPECv1_10_VERS] = "v1.10",
172 [SD_PHY_SPECv2_00_VERS] = "v2.00",
173 [SD_PHY_SPECv3_01_VERS] = "v3.01",
174 };
175 if (version >= ARRAY_SIZE(sdphy_version)) {
176 return "unsupported version";
177 }
178 return sdphy_version[version];
179 }
180
181 static const char *sd_state_name(enum SDCardStates state)
182 {
183 static const char *state_name[] = {
184 [sd_idle_state] = "idle",
185 [sd_ready_state] = "ready",
186 [sd_identification_state] = "identification",
187 [sd_standby_state] = "standby",
188 [sd_transfer_state] = "transfer",
189 [sd_sendingdata_state] = "sendingdata",
190 [sd_receivingdata_state] = "receivingdata",
191 [sd_programming_state] = "programming",
192 [sd_disconnect_state] = "disconnect",
193 };
194 if (state == sd_inactive_state) {
195 return "inactive";
196 }
197 assert(state < ARRAY_SIZE(state_name));
198 return state_name[state];
199 }
200
201 static const char *sd_response_name(sd_rsp_type_t rsp)
202 {
203 static const char *response_name[] = {
204 [sd_r0] = "RESP#0 (no response)",
205 [sd_r1] = "RESP#1 (normal cmd)",
206 [sd_r2_i] = "RESP#2 (CID reg)",
207 [sd_r2_s] = "RESP#2 (CSD reg)",
208 [sd_r3] = "RESP#3 (OCR reg)",
209 [sd_r6] = "RESP#6 (RCA)",
210 [sd_r7] = "RESP#7 (operating voltage)",
211 };
212 if (rsp == sd_illegal) {
213 return "ILLEGAL RESP";
214 }
215 if (rsp == sd_r1b) {
216 rsp = sd_r1;
217 }
218 assert(rsp < ARRAY_SIZE(response_name));
219 return response_name[rsp];
220 }
221
222 static uint8_t sd_get_dat_lines(SDState *sd)
223 {
224 return sd->enable ? sd->dat_lines : 0;
225 }
226
227 static bool sd_get_cmd_line(SDState *sd)
228 {
229 return sd->enable ? sd->cmd_line : false;
230 }
231
232 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
233 {
234 trace_sdcard_set_voltage(millivolts);
235
236 switch (millivolts) {
237 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
238 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
239 break;
240 default:
241 qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
242 millivolts / 1000.f);
243 }
244 }
245
246 static void sd_set_mode(SDState *sd)
247 {
248 switch (sd->state) {
249 case sd_inactive_state:
250 sd->mode = sd_inactive;
251 break;
252
253 case sd_idle_state:
254 case sd_ready_state:
255 case sd_identification_state:
256 sd->mode = sd_card_identification_mode;
257 break;
258
259 case sd_standby_state:
260 case sd_transfer_state:
261 case sd_sendingdata_state:
262 case sd_receivingdata_state:
263 case sd_programming_state:
264 case sd_disconnect_state:
265 sd->mode = sd_data_transfer_mode;
266 break;
267 }
268 }
269
270 static const sd_cmd_type_t sd_cmd_type[SDMMC_CMD_MAX] = {
271 sd_bc, sd_none, sd_bcr, sd_bcr, sd_none, sd_none, sd_none, sd_ac,
272 sd_bcr, sd_ac, sd_ac, sd_adtc, sd_ac, sd_ac, sd_none, sd_ac,
273 /* 16 */
274 sd_ac, sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
275 sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac, sd_ac, sd_adtc, sd_none,
276 /* 32 */
277 sd_ac, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none,
278 sd_none, sd_none, sd_bc, sd_none, sd_none, sd_none, sd_none, sd_none,
279 /* 48 */
280 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
281 sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
282 };
283
284 static const int sd_cmd_class[SDMMC_CMD_MAX] = {
285 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0,
286 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6,
287 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7,
288 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8,
289 };
290
291 static uint8_t sd_crc7(const void *message, size_t width)
292 {
293 int i, bit;
294 uint8_t shift_reg = 0x00;
295 const uint8_t *msg = (const uint8_t *)message;
296
297 for (i = 0; i < width; i ++, msg ++)
298 for (bit = 7; bit >= 0; bit --) {
299 shift_reg <<= 1;
300 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
301 shift_reg ^= 0x89;
302 }
303
304 return shift_reg;
305 }
306
307 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
308
309 FIELD(OCR, VDD_VOLTAGE_WINDOW, 0, 24)
310 FIELD(OCR, VDD_VOLTAGE_WIN_LO, 0, 8)
311 FIELD(OCR, DUAL_VOLTAGE_CARD, 7, 1)
312 FIELD(OCR, VDD_VOLTAGE_WIN_HI, 8, 16)
313 FIELD(OCR, ACCEPT_SWITCH_1V8, 24, 1) /* Only UHS-I */
314 FIELD(OCR, UHS_II_CARD, 29, 1) /* Only UHS-II */
315 FIELD(OCR, CARD_CAPACITY, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
316 FIELD(OCR, CARD_POWER_UP, 31, 1)
317
318 #define ACMD41_ENQUIRY_MASK 0x00ffffff
319 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
320 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
321 | R_OCR_UHS_II_CARD_MASK \
322 | R_OCR_CARD_CAPACITY_MASK \
323 | R_OCR_CARD_POWER_UP_MASK)
324
325 static void sd_ocr_powerup(void *opaque)
326 {
327 SDState *sd = opaque;
328
329 trace_sdcard_powerup();
330 assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
331
332 /* card power-up OK */
333 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
334
335 if (sd->size > SDSC_MAX_CAPACITY) {
336 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
337 }
338 }
339
340 static void sd_set_ocr(SDState *sd)
341 {
342 /* All voltages OK */
343 sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
344
345 if (sd_is_spi(sd)) {
346 /*
347 * We don't need to emulate power up sequence in SPI-mode.
348 * Thus, the card's power up status bit should be set to 1 when reset.
349 * The card's capacity status bit should also be set if SD card size
350 * is larger than 2GB for SDHC support.
351 */
352 sd_ocr_powerup(sd);
353 }
354 }
355
356 static void sd_set_scr(SDState *sd)
357 {
358 sd->scr[0] = 0 << 4; /* SCR structure version 1.0 */
359 if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
360 sd->scr[0] |= 1; /* Spec Version 1.10 */
361 } else {
362 sd->scr[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
363 }
364 sd->scr[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
365 | 0b0101; /* 1-bit or 4-bit width bus modes */
366 sd->scr[2] = 0x00; /* Extended Security is not supported. */
367 if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
368 sd->scr[2] |= 1 << 7; /* Spec Version 3.0X */
369 }
370 sd->scr[3] = 0x00;
371 /* reserved for manufacturer usage */
372 sd->scr[4] = 0x00;
373 sd->scr[5] = 0x00;
374 sd->scr[6] = 0x00;
375 sd->scr[7] = 0x00;
376 }
377
378 #define MID 0xaa
379 #define OID "XY"
380 #define PNM "QEMU!"
381 #define PRV 0x01
382 #define MDT_YR 2006
383 #define MDT_MON 2
384
385 static void sd_set_cid(SDState *sd)
386 {
387 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
388 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
389 sd->cid[2] = OID[1];
390 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
391 sd->cid[4] = PNM[1];
392 sd->cid[5] = PNM[2];
393 sd->cid[6] = PNM[3];
394 sd->cid[7] = PNM[4];
395 sd->cid[8] = PRV; /* Fake product revision (PRV) */
396 sd->cid[9] = 0xde; /* Fake serial number (PSN) */
397 sd->cid[10] = 0xad;
398 sd->cid[11] = 0xbe;
399 sd->cid[12] = 0xef;
400 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */
401 ((MDT_YR - 2000) / 10);
402 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
403 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
404 }
405
406 #define HWBLOCK_SHIFT 9 /* 512 bytes */
407 #define SECTOR_SHIFT 5 /* 16 kilobytes */
408 #define WPGROUP_SHIFT 7 /* 2 megs */
409 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
410 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
411
412 static const uint8_t sd_csd_rw_mask[16] = {
413 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
414 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
415 };
416
417 static void sd_set_csd(SDState *sd, uint64_t size)
418 {
419 int hwblock_shift = HWBLOCK_SHIFT;
420 uint32_t csize;
421 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
422 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
423
424 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
425 if (size == SDSC_MAX_CAPACITY) {
426 hwblock_shift += 1;
427 }
428 csize = (size >> (CMULT_SHIFT + hwblock_shift)) - 1;
429
430 if (size <= SDSC_MAX_CAPACITY) { /* Standard Capacity SD */
431 sd->csd[0] = 0x00; /* CSD structure */
432 sd->csd[1] = 0x26; /* Data read access-time-1 */
433 sd->csd[2] = 0x00; /* Data read access-time-2 */
434 sd->csd[3] = 0x32; /* Max. data transfer rate: 25 MHz */
435 sd->csd[4] = 0x5f; /* Card Command Classes */
436 sd->csd[5] = 0x50 | /* Max. read data block length */
437 hwblock_shift;
438 sd->csd[6] = 0xe0 | /* Partial block for read allowed */
439 ((csize >> 10) & 0x03);
440 sd->csd[7] = 0x00 | /* Device size */
441 ((csize >> 2) & 0xff);
442 sd->csd[8] = 0x3f | /* Max. read current */
443 ((csize << 6) & 0xc0);
444 sd->csd[9] = 0xfc | /* Max. write current */
445 ((CMULT_SHIFT - 2) >> 1);
446 sd->csd[10] = 0x40 | /* Erase sector size */
447 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
448 sd->csd[11] = 0x00 | /* Write protect group size */
449 ((sectsize << 7) & 0x80) | wpsize;
450 sd->csd[12] = 0x90 | /* Write speed factor */
451 (hwblock_shift >> 2);
452 sd->csd[13] = 0x20 | /* Max. write data block length */
453 ((hwblock_shift << 6) & 0xc0);
454 sd->csd[14] = 0x00; /* File format group */
455 } else { /* SDHC */
456 size /= 512 * KiB;
457 size -= 1;
458 sd->csd[0] = 0x40;
459 sd->csd[1] = 0x0e;
460 sd->csd[2] = 0x00;
461 sd->csd[3] = 0x32;
462 sd->csd[4] = 0x5b;
463 sd->csd[5] = 0x59;
464 sd->csd[6] = 0x00;
465 sd->csd[7] = (size >> 16) & 0xff;
466 sd->csd[8] = (size >> 8) & 0xff;
467 sd->csd[9] = (size & 0xff);
468 sd->csd[10] = 0x7f;
469 sd->csd[11] = 0x80;
470 sd->csd[12] = 0x0a;
471 sd->csd[13] = 0x40;
472 sd->csd[14] = 0x00;
473 }
474 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
475 }
476
477 static void sd_set_rca(SDState *sd)
478 {
479 sd->rca += 0x4567;
480 }
481
482 FIELD(CSR, AKE_SEQ_ERROR, 3, 1)
483 FIELD(CSR, APP_CMD, 5, 1)
484 FIELD(CSR, FX_EVENT, 6, 1)
485 FIELD(CSR, READY_FOR_DATA, 8, 1)
486 FIELD(CSR, CURRENT_STATE, 9, 4)
487 FIELD(CSR, ERASE_RESET, 13, 1)
488 FIELD(CSR, CARD_ECC_DISABLED, 14, 1)
489 FIELD(CSR, WP_ERASE_SKIP, 15, 1)
490 FIELD(CSR, CSD_OVERWRITE, 16, 1)
491 FIELD(CSR, DEFERRED_RESPONSE, 17, 1)
492 FIELD(CSR, ERROR, 19, 1)
493 FIELD(CSR, CC_ERROR, 20, 1)
494 FIELD(CSR, CARD_ECC_FAILED, 21, 1)
495 FIELD(CSR, ILLEGAL_COMMAND, 22, 1)
496 FIELD(CSR, COM_CRC_ERROR, 23, 1)
497 FIELD(CSR, LOCK_UNLOCK_FAILED, 24, 1)
498 FIELD(CSR, CARD_IS_LOCKED, 25, 1)
499 FIELD(CSR, WP_VIOLATION, 26, 1)
500 FIELD(CSR, ERASE_PARAM, 27, 1)
501 FIELD(CSR, ERASE_SEQ_ERROR, 28, 1)
502 FIELD(CSR, BLOCK_LEN_ERROR, 29, 1)
503 FIELD(CSR, ADDRESS_ERROR, 30, 1)
504 FIELD(CSR, OUT_OF_RANGE, 31, 1)
505
506 /* Card status bits, split by clear condition:
507 * A : According to the card current state
508 * B : Always related to the previous command
509 * C : Cleared by read
510 */
511 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
512 | R_CSR_CARD_ECC_DISABLED_MASK \
513 | R_CSR_CARD_IS_LOCKED_MASK)
514 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
515 | R_CSR_ILLEGAL_COMMAND_MASK \
516 | R_CSR_COM_CRC_ERROR_MASK)
517 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
518 | R_CSR_APP_CMD_MASK \
519 | R_CSR_ERASE_RESET_MASK \
520 | R_CSR_WP_ERASE_SKIP_MASK \
521 | R_CSR_CSD_OVERWRITE_MASK \
522 | R_CSR_ERROR_MASK \
523 | R_CSR_CC_ERROR_MASK \
524 | R_CSR_CARD_ECC_FAILED_MASK \
525 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
526 | R_CSR_WP_VIOLATION_MASK \
527 | R_CSR_ERASE_PARAM_MASK \
528 | R_CSR_ERASE_SEQ_ERROR_MASK \
529 | R_CSR_BLOCK_LEN_ERROR_MASK \
530 | R_CSR_ADDRESS_ERROR_MASK \
531 | R_CSR_OUT_OF_RANGE_MASK)
532
533 static void sd_set_cardstatus(SDState *sd)
534 {
535 sd->card_status = 0x00000100;
536 }
537
538 static void sd_set_sdstatus(SDState *sd)
539 {
540 memset(sd->sd_status, 0, 64);
541 }
542
543 static int sd_req_crc_validate(SDRequest *req)
544 {
545 uint8_t buffer[5];
546 buffer[0] = 0x40 | req->cmd;
547 stl_be_p(&buffer[1], req->arg);
548 return 0;
549 return sd_crc7(buffer, 5) != req->crc; /* TODO */
550 }
551
552 static void sd_response_r1_make(SDState *sd, uint8_t *response)
553 {
554 stl_be_p(response, sd->card_status);
555
556 /* Clear the "clear on read" status bits */
557 sd->card_status &= ~CARD_STATUS_C;
558 }
559
560 static void sd_response_r3_make(SDState *sd, uint8_t *response)
561 {
562 stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
563 }
564
565 static void sd_response_r6_make(SDState *sd, uint8_t *response)
566 {
567 uint16_t status;
568
569 status = ((sd->card_status >> 8) & 0xc000) |
570 ((sd->card_status >> 6) & 0x2000) |
571 (sd->card_status & 0x1fff);
572 sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
573 stw_be_p(response + 0, sd->rca);
574 stw_be_p(response + 2, status);
575 }
576
577 static void sd_response_r7_make(SDState *sd, uint8_t *response)
578 {
579 stl_be_p(response, sd->vhs);
580 }
581
582 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
583 {
584 return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
585 }
586
587 static void sd_reset(DeviceState *dev)
588 {
589 SDState *sd = SD_CARD(dev);
590 uint64_t size;
591 uint64_t sect;
592
593 trace_sdcard_reset();
594 if (sd->blk) {
595 blk_get_geometry(sd->blk, &sect);
596 } else {
597 sect = 0;
598 }
599 size = sect << 9;
600
601 sect = sd_addr_to_wpnum(size) + 1;
602
603 sd->state = sd_idle_state;
604 sd->rca = 0x0000;
605 sd->size = size;
606 sd_set_ocr(sd);
607 sd_set_scr(sd);
608 sd_set_cid(sd);
609 sd_set_csd(sd, size);
610 sd_set_cardstatus(sd);
611 sd_set_sdstatus(sd);
612
613 g_free(sd->wp_group_bmap);
614 sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false;
615 sd->wp_group_bits = sect;
616 sd->wp_group_bmap = bitmap_new(sd->wp_group_bits);
617 memset(sd->function_group, 0, sizeof(sd->function_group));
618 sd->erase_start = INVALID_ADDRESS;
619 sd->erase_end = INVALID_ADDRESS;
620 sd->blk_len = 0x200;
621 sd->pwd_len = 0;
622 sd->expecting_acmd = false;
623 sd->dat_lines = 0xf;
624 sd->cmd_line = true;
625 sd->multi_blk_cnt = 0;
626 }
627
628 static bool sd_get_inserted(SDState *sd)
629 {
630 return sd->blk && blk_is_inserted(sd->blk);
631 }
632
633 static bool sd_get_readonly(SDState *sd)
634 {
635 return sd->wp_switch;
636 }
637
638 static void sd_cardchange(void *opaque, bool load, Error **errp)
639 {
640 SDState *sd = opaque;
641 DeviceState *dev = DEVICE(sd);
642 SDBus *sdbus;
643 bool inserted = sd_get_inserted(sd);
644 bool readonly = sd_get_readonly(sd);
645
646 if (inserted) {
647 trace_sdcard_inserted(readonly);
648 sd_reset(dev);
649 } else {
650 trace_sdcard_ejected();
651 }
652
653 if (sd->me_no_qdev_me_kill_mammoth_with_rocks) {
654 qemu_set_irq(sd->inserted_cb, inserted);
655 if (inserted) {
656 qemu_set_irq(sd->readonly_cb, readonly);
657 }
658 } else {
659 sdbus = SD_BUS(qdev_get_parent_bus(dev));
660 sdbus_set_inserted(sdbus, inserted);
661 if (inserted) {
662 sdbus_set_readonly(sdbus, readonly);
663 }
664 }
665 }
666
667 static const BlockDevOps sd_block_ops = {
668 .change_media_cb = sd_cardchange,
669 };
670
671 static bool sd_ocr_vmstate_needed(void *opaque)
672 {
673 SDState *sd = opaque;
674
675 /* Include the OCR state (and timer) if it is not yet powered up */
676 return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
677 }
678
679 static const VMStateDescription sd_ocr_vmstate = {
680 .name = "sd-card/ocr-state",
681 .version_id = 1,
682 .minimum_version_id = 1,
683 .needed = sd_ocr_vmstate_needed,
684 .fields = (const VMStateField[]) {
685 VMSTATE_UINT32(ocr, SDState),
686 VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
687 VMSTATE_END_OF_LIST()
688 },
689 };
690
691 static int sd_vmstate_pre_load(void *opaque)
692 {
693 SDState *sd = opaque;
694
695 /* If the OCR state is not included (prior versions, or not
696 * needed), then the OCR must be set as powered up. If the OCR state
697 * is included, this will be replaced by the state restore.
698 */
699 sd_ocr_powerup(sd);
700
701 return 0;
702 }
703
704 static const VMStateDescription sd_vmstate = {
705 .name = "sd-card",
706 .version_id = 2,
707 .minimum_version_id = 2,
708 .pre_load = sd_vmstate_pre_load,
709 .fields = (const VMStateField[]) {
710 VMSTATE_UINT32(mode, SDState),
711 VMSTATE_INT32(state, SDState),
712 VMSTATE_UINT8_ARRAY(cid, SDState, 16),
713 VMSTATE_UINT8_ARRAY(csd, SDState, 16),
714 VMSTATE_UINT16(rca, SDState),
715 VMSTATE_UINT32(card_status, SDState),
716 VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
717 VMSTATE_UINT32(vhs, SDState),
718 VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits),
719 VMSTATE_UINT32(blk_len, SDState),
720 VMSTATE_UINT32(multi_blk_cnt, SDState),
721 VMSTATE_UINT32(erase_start, SDState),
722 VMSTATE_UINT32(erase_end, SDState),
723 VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
724 VMSTATE_UINT32(pwd_len, SDState),
725 VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
726 VMSTATE_UINT8(current_cmd, SDState),
727 VMSTATE_BOOL(expecting_acmd, SDState),
728 VMSTATE_UINT32(blk_written, SDState),
729 VMSTATE_UINT64(data_start, SDState),
730 VMSTATE_UINT32(data_offset, SDState),
731 VMSTATE_UINT8_ARRAY(data, SDState, 512),
732 VMSTATE_UNUSED_V(1, 512),
733 VMSTATE_BOOL(enable, SDState),
734 VMSTATE_END_OF_LIST()
735 },
736 .subsections = (const VMStateDescription * const []) {
737 &sd_ocr_vmstate,
738 NULL
739 },
740 };
741
742 /* Legacy initialization function for use by non-qdevified callers */
743 SDState *sd_init(BlockBackend *blk, bool is_spi)
744 {
745 Object *obj;
746 DeviceState *dev;
747 SDState *sd;
748 Error *err = NULL;
749
750 obj = object_new(is_spi ? TYPE_SD_CARD_SPI : TYPE_SD_CARD);
751 dev = DEVICE(obj);
752 if (!qdev_prop_set_drive_err(dev, "drive", blk, &err)) {
753 error_reportf_err(err, "sd_init failed: ");
754 return NULL;
755 }
756
757 /*
758 * Realizing the device properly would put it into the QOM
759 * composition tree even though it is not plugged into an
760 * appropriate bus. That's a no-no. Hide the device from
761 * QOM/qdev, and call its qdev realize callback directly.
762 */
763 object_ref(obj);
764 object_unparent(obj);
765 sd_realize(dev, &err);
766 if (err) {
767 error_reportf_err(err, "sd_init failed: ");
768 return NULL;
769 }
770
771 sd = SD_CARD(dev);
772 sd->me_no_qdev_me_kill_mammoth_with_rocks = true;
773 return sd;
774 }
775
776 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
777 {
778 sd->readonly_cb = readonly;
779 sd->inserted_cb = insert;
780 qemu_set_irq(readonly, sd->blk ? !blk_is_writable(sd->blk) : 0);
781 qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
782 }
783
784 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
785 {
786 trace_sdcard_read_block(addr, len);
787 if (!sd->blk || blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {
788 fprintf(stderr, "sd_blk_read: read error on host side\n");
789 }
790 }
791
792 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
793 {
794 trace_sdcard_write_block(addr, len);
795 if (!sd->blk || blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {
796 fprintf(stderr, "sd_blk_write: write error on host side\n");
797 }
798 }
799
800 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len)
801 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
802 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
803 #define APP_WRITE_BLOCK(a, len)
804
805 static void sd_erase(SDState *sd)
806 {
807 uint64_t erase_start = sd->erase_start;
808 uint64_t erase_end = sd->erase_end;
809 bool sdsc = true;
810 uint64_t wpnum;
811 uint64_t erase_addr;
812 int erase_len = 1 << HWBLOCK_SHIFT;
813
814 trace_sdcard_erase(sd->erase_start, sd->erase_end);
815 if (sd->erase_start == INVALID_ADDRESS
816 || sd->erase_end == INVALID_ADDRESS) {
817 sd->card_status |= ERASE_SEQ_ERROR;
818 sd->erase_start = INVALID_ADDRESS;
819 sd->erase_end = INVALID_ADDRESS;
820 return;
821 }
822
823 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
824 /* High capacity memory card: erase units are 512 byte blocks */
825 erase_start *= 512;
826 erase_end *= 512;
827 sdsc = false;
828 }
829
830 if (erase_start > sd->size || erase_end > sd->size) {
831 sd->card_status |= OUT_OF_RANGE;
832 sd->erase_start = INVALID_ADDRESS;
833 sd->erase_end = INVALID_ADDRESS;
834 return;
835 }
836
837 sd->erase_start = INVALID_ADDRESS;
838 sd->erase_end = INVALID_ADDRESS;
839 sd->csd[14] |= 0x40;
840
841 memset(sd->data, 0xff, erase_len);
842 for (erase_addr = erase_start; erase_addr <= erase_end;
843 erase_addr += erase_len) {
844 if (sdsc) {
845 /* Only SDSC cards support write protect groups */
846 wpnum = sd_addr_to_wpnum(erase_addr);
847 assert(wpnum < sd->wp_group_bits);
848 if (test_bit(wpnum, sd->wp_group_bmap)) {
849 sd->card_status |= WP_ERASE_SKIP;
850 continue;
851 }
852 }
853 BLK_WRITE_BLOCK(erase_addr, erase_len);
854 }
855 }
856
857 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
858 {
859 uint32_t i, wpnum;
860 uint32_t ret = 0;
861
862 wpnum = sd_addr_to_wpnum(addr);
863
864 for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
865 if (addr >= sd->size) {
866 /*
867 * If the addresses of the last groups are outside the valid range,
868 * then the corresponding write protection bits shall be set to 0.
869 */
870 continue;
871 }
872 assert(wpnum < sd->wp_group_bits);
873 if (test_bit(wpnum, sd->wp_group_bmap)) {
874 ret |= (1 << i);
875 }
876 }
877
878 return ret;
879 }
880
881 static void sd_function_switch(SDState *sd, uint32_t arg)
882 {
883 int i, mode, new_func;
884 mode = !!(arg & 0x80000000);
885
886 sd->data[0] = 0x00; /* Maximum current consumption */
887 sd->data[1] = 0x01;
888 sd->data[2] = 0x80; /* Supported group 6 functions */
889 sd->data[3] = 0x01;
890 sd->data[4] = 0x80; /* Supported group 5 functions */
891 sd->data[5] = 0x01;
892 sd->data[6] = 0x80; /* Supported group 4 functions */
893 sd->data[7] = 0x01;
894 sd->data[8] = 0x80; /* Supported group 3 functions */
895 sd->data[9] = 0x01;
896 sd->data[10] = 0x80; /* Supported group 2 functions */
897 sd->data[11] = 0x43;
898 sd->data[12] = 0x80; /* Supported group 1 functions */
899 sd->data[13] = 0x03;
900
901 memset(&sd->data[14], 0, 3);
902 for (i = 0; i < 6; i ++) {
903 new_func = (arg >> (i * 4)) & 0x0f;
904 if (mode && new_func != 0x0f)
905 sd->function_group[i] = new_func;
906 sd->data[16 - (i >> 1)] |= new_func << ((i % 2) * 4);
907 }
908 memset(&sd->data[17], 0, 47);
909 }
910
911 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
912 {
913 return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
914 }
915
916 static void sd_lock_command(SDState *sd)
917 {
918 int erase, lock, clr_pwd, set_pwd, pwd_len;
919 erase = !!(sd->data[0] & 0x08);
920 lock = sd->data[0] & 0x04;
921 clr_pwd = sd->data[0] & 0x02;
922 set_pwd = sd->data[0] & 0x01;
923
924 if (sd->blk_len > 1)
925 pwd_len = sd->data[1];
926 else
927 pwd_len = 0;
928
929 if (lock) {
930 trace_sdcard_lock();
931 } else {
932 trace_sdcard_unlock();
933 }
934 if (erase) {
935 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
936 set_pwd || clr_pwd || lock || sd->wp_switch ||
937 (sd->csd[14] & 0x20)) {
938 sd->card_status |= LOCK_UNLOCK_FAILED;
939 return;
940 }
941 bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits);
942 sd->csd[14] &= ~0x10;
943 sd->card_status &= ~CARD_IS_LOCKED;
944 sd->pwd_len = 0;
945 /* Erasing the entire card here! */
946 fprintf(stderr, "SD: Card force-erased by CMD42\n");
947 return;
948 }
949
950 if (sd->blk_len < 2 + pwd_len ||
951 pwd_len <= sd->pwd_len ||
952 pwd_len > sd->pwd_len + 16) {
953 sd->card_status |= LOCK_UNLOCK_FAILED;
954 return;
955 }
956
957 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
958 sd->card_status |= LOCK_UNLOCK_FAILED;
959 return;
960 }
961
962 pwd_len -= sd->pwd_len;
963 if ((pwd_len && !set_pwd) ||
964 (clr_pwd && (set_pwd || lock)) ||
965 (lock && !sd->pwd_len && !set_pwd) ||
966 (!set_pwd && !clr_pwd &&
967 (((sd->card_status & CARD_IS_LOCKED) && lock) ||
968 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
969 sd->card_status |= LOCK_UNLOCK_FAILED;
970 return;
971 }
972
973 if (set_pwd) {
974 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
975 sd->pwd_len = pwd_len;
976 }
977
978 if (clr_pwd) {
979 sd->pwd_len = 0;
980 }
981
982 if (lock)
983 sd->card_status |= CARD_IS_LOCKED;
984 else
985 sd->card_status &= ~CARD_IS_LOCKED;
986 }
987
988 static bool address_in_range(SDState *sd, const char *desc,
989 uint64_t addr, uint32_t length)
990 {
991 if (addr + length > sd->size) {
992 qemu_log_mask(LOG_GUEST_ERROR,
993 "%s offset %"PRIu64" > card %"PRIu64" [%%%u]\n",
994 desc, addr, sd->size, length);
995 sd->card_status |= ADDRESS_ERROR;
996 return false;
997 }
998 return true;
999 }
1000
1001 static sd_rsp_type_t sd_invalid_state_for_cmd(SDState *sd, SDRequest req)
1002 {
1003 qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1004 sd_proto(sd)->name, req.cmd, sd_state_name(sd->state),
1005 sd_version_str(sd->spec_version));
1006
1007 return sd_illegal;
1008 }
1009
1010 static sd_rsp_type_t sd_cmd_illegal(SDState *sd, SDRequest req)
1011 {
1012 qemu_log_mask(LOG_GUEST_ERROR, "%s: Unknown CMD%i for spec %s\n",
1013 sd_proto(sd)->name, req.cmd,
1014 sd_version_str(sd->spec_version));
1015
1016 return sd_illegal;
1017 }
1018
1019 /* Commands that are recognised but not yet implemented. */
1020 static sd_rsp_type_t sd_cmd_unimplemented(SDState *sd, SDRequest req)
1021 {
1022 qemu_log_mask(LOG_UNIMP, "%s: CMD%i not implemented\n",
1023 sd_proto(sd)->name, req.cmd);
1024
1025 return sd_illegal;
1026 }
1027
1028 static sd_rsp_type_t sd_cmd_GO_IDLE_STATE(SDState *sd, SDRequest req)
1029 {
1030 if (sd->state != sd_inactive_state) {
1031 sd->state = sd_idle_state;
1032 sd_reset(DEVICE(sd));
1033 }
1034
1035 return sd_is_spi(sd) ? sd_r1 : sd_r0;
1036 }
1037
1038 static sd_rsp_type_t sd_cmd_SEND_OP_CMD(SDState *sd, SDRequest req)
1039 {
1040 sd->state = sd_transfer_state;
1041
1042 return sd_r1;
1043 }
1044
1045 static sd_rsp_type_t sd_cmd_ALL_SEND_CID(SDState *sd, SDRequest req)
1046 {
1047 if (sd->state != sd_ready_state) {
1048 return sd_invalid_state_for_cmd(sd, req);
1049 }
1050
1051 sd->state = sd_identification_state;
1052
1053 return sd_r2_i;
1054 }
1055
1056 static sd_rsp_type_t sd_cmd_SEND_RELATIVE_ADDR(SDState *sd, SDRequest req)
1057 {
1058 switch (sd->state) {
1059 case sd_identification_state:
1060 case sd_standby_state:
1061 sd->state = sd_standby_state;
1062 sd_set_rca(sd);
1063 return sd_r6;
1064
1065 default:
1066 return sd_invalid_state_for_cmd(sd, req);
1067 }
1068 }
1069
1070 static sd_rsp_type_t sd_cmd_SEND_TUNING_BLOCK(SDState *sd, SDRequest req)
1071 {
1072 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1073 return sd_cmd_illegal(sd, req);
1074 }
1075
1076 if (sd->state != sd_transfer_state) {
1077 return sd_invalid_state_for_cmd(sd, req);
1078 }
1079
1080 sd->state = sd_sendingdata_state;
1081 sd->data_offset = 0;
1082
1083 return sd_r1;
1084 }
1085
1086 static sd_rsp_type_t sd_cmd_SET_BLOCK_COUNT(SDState *sd, SDRequest req)
1087 {
1088 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1089 return sd_cmd_illegal(sd, req);
1090 }
1091
1092 if (sd->state != sd_transfer_state) {
1093 return sd_invalid_state_for_cmd(sd, req);
1094 }
1095
1096 sd->multi_blk_cnt = req.arg;
1097
1098 return sd_r1;
1099 }
1100
1101 static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
1102 {
1103 uint32_t rca = 0x0000;
1104 uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
1105
1106 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
1107 * However there is no ACMD55, so we want to trace this particular case.
1108 */
1109 if (req.cmd != 55 || sd->expecting_acmd) {
1110 trace_sdcard_normal_command(sd_proto(sd)->name,
1111 sd_cmd_name(req.cmd), req.cmd,
1112 req.arg, sd_state_name(sd->state));
1113 }
1114
1115 /* Not interpreting this as an app command */
1116 sd->card_status &= ~APP_CMD;
1117
1118 if (sd_cmd_type[req.cmd] == sd_ac
1119 || sd_cmd_type[req.cmd] == sd_adtc) {
1120 rca = req.arg >> 16;
1121 }
1122
1123 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
1124 * if not, its effects are cancelled */
1125 if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
1126 sd->multi_blk_cnt = 0;
1127 }
1128
1129 if (sd_cmd_class[req.cmd] == 6 && FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
1130 /* Only Standard Capacity cards support class 6 commands */
1131 return sd_illegal;
1132 }
1133
1134 if (sd_proto(sd)->cmd[req.cmd]) {
1135 return sd_proto(sd)->cmd[req.cmd](sd, req);
1136 }
1137
1138 switch (req.cmd) {
1139 /* Basic commands (Class 0 and Class 1) */
1140 case 4: /* CMD4: SEND_DSR */
1141 switch (sd->state) {
1142 case sd_standby_state:
1143 break;
1144
1145 default:
1146 break;
1147 }
1148 break;
1149
1150 case 6: /* CMD6: SWITCH_FUNCTION */
1151 switch (sd->mode) {
1152 case sd_data_transfer_mode:
1153 sd_function_switch(sd, req.arg);
1154 sd->state = sd_sendingdata_state;
1155 sd->data_start = 0;
1156 sd->data_offset = 0;
1157 return sd_r1;
1158
1159 default:
1160 break;
1161 }
1162 break;
1163
1164 case 7: /* CMD7: SELECT/DESELECT_CARD */
1165 switch (sd->state) {
1166 case sd_standby_state:
1167 if (sd->rca != rca)
1168 return sd_r0;
1169
1170 sd->state = sd_transfer_state;
1171 return sd_r1b;
1172
1173 case sd_transfer_state:
1174 case sd_sendingdata_state:
1175 if (sd->rca == rca)
1176 break;
1177
1178 sd->state = sd_standby_state;
1179 return sd_r1b;
1180
1181 case sd_disconnect_state:
1182 if (sd->rca != rca)
1183 return sd_r0;
1184
1185 sd->state = sd_programming_state;
1186 return sd_r1b;
1187
1188 case sd_programming_state:
1189 if (sd->rca == rca)
1190 break;
1191
1192 sd->state = sd_disconnect_state;
1193 return sd_r1b;
1194
1195 default:
1196 break;
1197 }
1198 break;
1199
1200 case 8: /* CMD8: SEND_IF_COND */
1201 if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
1202 break;
1203 }
1204 if (sd->state != sd_idle_state) {
1205 break;
1206 }
1207 sd->vhs = 0;
1208
1209 /* No response if not exactly one VHS bit is set. */
1210 if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
1211 return sd_is_spi(sd) ? sd_r7 : sd_r0;
1212 }
1213
1214 /* Accept. */
1215 sd->vhs = req.arg;
1216 return sd_r7;
1217
1218 case 9: /* CMD9: SEND_CSD */
1219 switch (sd->state) {
1220 case sd_standby_state:
1221 if (sd->rca != rca)
1222 return sd_r0;
1223
1224 return sd_r2_s;
1225
1226 case sd_transfer_state:
1227 if (!sd_is_spi(sd)) {
1228 break;
1229 }
1230 sd->state = sd_sendingdata_state;
1231 memcpy(sd->data, sd->csd, 16);
1232 sd->data_start = addr;
1233 sd->data_offset = 0;
1234 return sd_r1;
1235
1236 default:
1237 break;
1238 }
1239 break;
1240
1241 case 10: /* CMD10: SEND_CID */
1242 switch (sd->state) {
1243 case sd_standby_state:
1244 if (sd->rca != rca)
1245 return sd_r0;
1246
1247 return sd_r2_i;
1248
1249 case sd_transfer_state:
1250 if (!sd_is_spi(sd)) {
1251 break;
1252 }
1253 sd->state = sd_sendingdata_state;
1254 memcpy(sd->data, sd->cid, 16);
1255 sd->data_start = addr;
1256 sd->data_offset = 0;
1257 return sd_r1;
1258
1259 default:
1260 break;
1261 }
1262 break;
1263
1264 case 12: /* CMD12: STOP_TRANSMISSION */
1265 switch (sd->state) {
1266 case sd_sendingdata_state:
1267 sd->state = sd_transfer_state;
1268 return sd_r1b;
1269
1270 case sd_receivingdata_state:
1271 sd->state = sd_programming_state;
1272 /* Bzzzzzzztt .... Operation complete. */
1273 sd->state = sd_transfer_state;
1274 return sd_r1b;
1275
1276 default:
1277 break;
1278 }
1279 break;
1280
1281 case 13: /* CMD13: SEND_STATUS */
1282 switch (sd->mode) {
1283 case sd_data_transfer_mode:
1284 if (!sd_is_spi(sd) && sd->rca != rca) {
1285 return sd_r0;
1286 }
1287
1288 return sd_r1;
1289
1290 default:
1291 break;
1292 }
1293 break;
1294
1295 case 15: /* CMD15: GO_INACTIVE_STATE */
1296 switch (sd->mode) {
1297 case sd_data_transfer_mode:
1298 if (sd->rca != rca)
1299 return sd_r0;
1300
1301 sd->state = sd_inactive_state;
1302 return sd_r0;
1303
1304 default:
1305 break;
1306 }
1307 break;
1308
1309 /* Block read commands (Class 2) */
1310 case 16: /* CMD16: SET_BLOCKLEN */
1311 switch (sd->state) {
1312 case sd_transfer_state:
1313 if (req.arg > (1 << HWBLOCK_SHIFT)) {
1314 sd->card_status |= BLOCK_LEN_ERROR;
1315 } else {
1316 trace_sdcard_set_blocklen(req.arg);
1317 sd->blk_len = req.arg;
1318 }
1319
1320 return sd_r1;
1321
1322 default:
1323 break;
1324 }
1325 break;
1326
1327 case 17: /* CMD17: READ_SINGLE_BLOCK */
1328 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1329 switch (sd->state) {
1330 case sd_transfer_state:
1331
1332 if (!address_in_range(sd, "READ_BLOCK", addr, sd->blk_len)) {
1333 return sd_r1;
1334 }
1335
1336 sd->state = sd_sendingdata_state;
1337 sd->data_start = addr;
1338 sd->data_offset = 0;
1339 return sd_r1;
1340
1341 default:
1342 break;
1343 }
1344 break;
1345
1346 /* Block write commands (Class 4) */
1347 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1348 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1349 switch (sd->state) {
1350 case sd_transfer_state:
1351
1352 if (!address_in_range(sd, "WRITE_BLOCK", addr, sd->blk_len)) {
1353 return sd_r1;
1354 }
1355
1356 sd->state = sd_receivingdata_state;
1357 sd->data_start = addr;
1358 sd->data_offset = 0;
1359 sd->blk_written = 0;
1360
1361 if (sd->size <= SDSC_MAX_CAPACITY) {
1362 if (sd_wp_addr(sd, sd->data_start)) {
1363 sd->card_status |= WP_VIOLATION;
1364 }
1365 }
1366 if (sd->csd[14] & 0x30) {
1367 sd->card_status |= WP_VIOLATION;
1368 }
1369 return sd_r1;
1370
1371 default:
1372 break;
1373 }
1374 break;
1375
1376 case 26: /* CMD26: PROGRAM_CID */
1377 switch (sd->state) {
1378 case sd_transfer_state:
1379 sd->state = sd_receivingdata_state;
1380 sd->data_start = 0;
1381 sd->data_offset = 0;
1382 return sd_r1;
1383
1384 default:
1385 break;
1386 }
1387 break;
1388
1389 case 27: /* CMD27: PROGRAM_CSD */
1390 switch (sd->state) {
1391 case sd_transfer_state:
1392 sd->state = sd_receivingdata_state;
1393 sd->data_start = 0;
1394 sd->data_offset = 0;
1395 return sd_r1;
1396
1397 default:
1398 break;
1399 }
1400 break;
1401
1402 /* Write protection (Class 6) */
1403 case 28: /* CMD28: SET_WRITE_PROT */
1404 if (sd->size > SDSC_MAX_CAPACITY) {
1405 return sd_illegal;
1406 }
1407
1408 switch (sd->state) {
1409 case sd_transfer_state:
1410 if (!address_in_range(sd, "SET_WRITE_PROT", addr, 1)) {
1411 return sd_r1b;
1412 }
1413
1414 sd->state = sd_programming_state;
1415 set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1416 /* Bzzzzzzztt .... Operation complete. */
1417 sd->state = sd_transfer_state;
1418 return sd_r1b;
1419
1420 default:
1421 break;
1422 }
1423 break;
1424
1425 case 29: /* CMD29: CLR_WRITE_PROT */
1426 if (sd->size > SDSC_MAX_CAPACITY) {
1427 return sd_illegal;
1428 }
1429
1430 switch (sd->state) {
1431 case sd_transfer_state:
1432 if (!address_in_range(sd, "CLR_WRITE_PROT", addr, 1)) {
1433 return sd_r1b;
1434 }
1435
1436 sd->state = sd_programming_state;
1437 clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1438 /* Bzzzzzzztt .... Operation complete. */
1439 sd->state = sd_transfer_state;
1440 return sd_r1b;
1441
1442 default:
1443 break;
1444 }
1445 break;
1446
1447 case 30: /* CMD30: SEND_WRITE_PROT */
1448 if (sd->size > SDSC_MAX_CAPACITY) {
1449 return sd_illegal;
1450 }
1451
1452 switch (sd->state) {
1453 case sd_transfer_state:
1454 if (!address_in_range(sd, "SEND_WRITE_PROT",
1455 req.arg, sd->blk_len)) {
1456 return sd_r1;
1457 }
1458
1459 sd->state = sd_sendingdata_state;
1460 *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1461 sd->data_start = addr;
1462 sd->data_offset = 0;
1463 return sd_r1;
1464
1465 default:
1466 break;
1467 }
1468 break;
1469
1470 /* Erase commands (Class 5) */
1471 case 32: /* CMD32: ERASE_WR_BLK_START */
1472 switch (sd->state) {
1473 case sd_transfer_state:
1474 sd->erase_start = req.arg;
1475 return sd_r1;
1476
1477 default:
1478 break;
1479 }
1480 break;
1481
1482 case 33: /* CMD33: ERASE_WR_BLK_END */
1483 switch (sd->state) {
1484 case sd_transfer_state:
1485 sd->erase_end = req.arg;
1486 return sd_r1;
1487
1488 default:
1489 break;
1490 }
1491 break;
1492
1493 case 38: /* CMD38: ERASE */
1494 switch (sd->state) {
1495 case sd_transfer_state:
1496 if (sd->csd[14] & 0x30) {
1497 sd->card_status |= WP_VIOLATION;
1498 return sd_r1b;
1499 }
1500
1501 sd->state = sd_programming_state;
1502 sd_erase(sd);
1503 /* Bzzzzzzztt .... Operation complete. */
1504 sd->state = sd_transfer_state;
1505 return sd_r1b;
1506
1507 default:
1508 break;
1509 }
1510 break;
1511
1512 /* Lock card commands (Class 7) */
1513 case 42: /* CMD42: LOCK_UNLOCK */
1514 switch (sd->state) {
1515 case sd_transfer_state:
1516 sd->state = sd_receivingdata_state;
1517 sd->data_start = 0;
1518 sd->data_offset = 0;
1519 return sd_r1;
1520
1521 default:
1522 break;
1523 }
1524 break;
1525
1526 /* Application specific commands (Class 8) */
1527 case 55: /* CMD55: APP_CMD */
1528 switch (sd->state) {
1529 case sd_ready_state:
1530 case sd_identification_state:
1531 case sd_inactive_state:
1532 return sd_illegal;
1533 case sd_idle_state:
1534 if (rca) {
1535 qemu_log_mask(LOG_GUEST_ERROR,
1536 "SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
1537 }
1538 default:
1539 break;
1540 }
1541 if (!sd_is_spi(sd)) {
1542 if (sd->rca != rca) {
1543 return sd_r0;
1544 }
1545 }
1546 sd->expecting_acmd = true;
1547 sd->card_status |= APP_CMD;
1548 return sd_r1;
1549
1550 case 56: /* CMD56: GEN_CMD */
1551 switch (sd->state) {
1552 case sd_transfer_state:
1553 sd->data_offset = 0;
1554 if (req.arg & 1)
1555 sd->state = sd_sendingdata_state;
1556 else
1557 sd->state = sd_receivingdata_state;
1558 return sd_r1;
1559
1560 default:
1561 break;
1562 }
1563 break;
1564
1565 case 58: /* CMD58: READ_OCR (SPI) */
1566 return sd_r3;
1567
1568 case 59: /* CMD59: CRC_ON_OFF (SPI) */
1569 return sd_r1;
1570
1571 default:
1572 qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1573 return sd_illegal;
1574 }
1575
1576 return sd_invalid_state_for_cmd(sd, req);
1577 }
1578
1579 static sd_rsp_type_t sd_app_command(SDState *sd,
1580 SDRequest req)
1581 {
1582 trace_sdcard_app_command(sd_proto(sd)->name, sd_acmd_name(req.cmd),
1583 req.cmd, req.arg, sd_state_name(sd->state));
1584 sd->card_status |= APP_CMD;
1585
1586 if (sd_proto(sd)->acmd[req.cmd]) {
1587 return sd_proto(sd)->acmd[req.cmd](sd, req);
1588 }
1589
1590 switch (req.cmd) {
1591 case 6: /* ACMD6: SET_BUS_WIDTH */
1592 switch (sd->state) {
1593 case sd_transfer_state:
1594 sd->sd_status[0] &= 0x3f;
1595 sd->sd_status[0] |= (req.arg & 0x03) << 6;
1596 return sd_r1;
1597
1598 default:
1599 break;
1600 }
1601 break;
1602
1603 case 13: /* ACMD13: SD_STATUS */
1604 switch (sd->state) {
1605 case sd_transfer_state:
1606 sd->state = sd_sendingdata_state;
1607 sd->data_start = 0;
1608 sd->data_offset = 0;
1609 return sd_r1;
1610
1611 default:
1612 break;
1613 }
1614 break;
1615
1616 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1617 switch (sd->state) {
1618 case sd_transfer_state:
1619 *(uint32_t *) sd->data = sd->blk_written;
1620
1621 sd->state = sd_sendingdata_state;
1622 sd->data_start = 0;
1623 sd->data_offset = 0;
1624 return sd_r1;
1625
1626 default:
1627 break;
1628 }
1629 break;
1630
1631 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1632 switch (sd->state) {
1633 case sd_transfer_state:
1634 return sd_r1;
1635
1636 default:
1637 break;
1638 }
1639 break;
1640
1641 case 41: /* ACMD41: SD_APP_OP_COND */
1642 if (sd->state != sd_idle_state) {
1643 break;
1644 }
1645 /* If it's the first ACMD41 since reset, we need to decide
1646 * whether to power up. If this is not an enquiry ACMD41,
1647 * we immediately report power on and proceed below to the
1648 * ready state, but if it is, we set a timer to model a
1649 * delay for power up. This works around a bug in EDK2
1650 * UEFI, which sends an initial enquiry ACMD41, but
1651 * assumes that the card is in ready state as soon as it
1652 * sees the power up bit set. */
1653 if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
1654 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1655 timer_del(sd->ocr_power_timer);
1656 sd_ocr_powerup(sd);
1657 } else {
1658 trace_sdcard_inquiry_cmd41();
1659 if (!timer_pending(sd->ocr_power_timer)) {
1660 timer_mod_ns(sd->ocr_power_timer,
1661 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1662 + OCR_POWER_DELAY_NS));
1663 }
1664 }
1665 }
1666
1667 if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
1668 /* We accept any voltage. 10000 V is nothing.
1669 *
1670 * Once we're powered up, we advance straight to ready state
1671 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1672 */
1673 sd->state = sd_ready_state;
1674 }
1675
1676 return sd_r3;
1677
1678 case 42: /* ACMD42: SET_CLR_CARD_DETECT */
1679 switch (sd->state) {
1680 case sd_transfer_state:
1681 /* Bringing in the 50KOhm pull-up resistor... Done. */
1682 return sd_r1;
1683
1684 default:
1685 break;
1686 }
1687 break;
1688
1689 case 51: /* ACMD51: SEND_SCR */
1690 switch (sd->state) {
1691 case sd_transfer_state:
1692 sd->state = sd_sendingdata_state;
1693 sd->data_start = 0;
1694 sd->data_offset = 0;
1695 return sd_r1;
1696
1697 default:
1698 break;
1699 }
1700 break;
1701
1702 case 18: /* Reserved for SD security applications */
1703 case 25:
1704 case 26:
1705 case 38:
1706 case 43 ... 49:
1707 /* Refer to the "SD Specifications Part3 Security Specification" for
1708 * information about the SD Security Features.
1709 */
1710 qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
1711 req.cmd);
1712 return sd_illegal;
1713
1714 default:
1715 /* Fall back to standard commands. */
1716 return sd_normal_command(sd, req);
1717 }
1718
1719 qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
1720 return sd_illegal;
1721 }
1722
1723 static int cmd_valid_while_locked(SDState *sd, const uint8_t cmd)
1724 {
1725 /* Valid commands in locked state:
1726 * basic class (0)
1727 * lock card class (7)
1728 * CMD16
1729 * implicitly, the ACMD prefix CMD55
1730 * ACMD41 and ACMD42
1731 * Anything else provokes an "illegal command" response.
1732 */
1733 if (sd->expecting_acmd) {
1734 return cmd == 41 || cmd == 42;
1735 }
1736 if (cmd == 16 || cmd == 55) {
1737 return 1;
1738 }
1739 return sd_cmd_class[cmd] == 0 || sd_cmd_class[cmd] == 7;
1740 }
1741
1742 int sd_do_command(SDState *sd, SDRequest *req,
1743 uint8_t *response) {
1744 int last_state;
1745 sd_rsp_type_t rtype;
1746 int rsplen;
1747
1748 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
1749 return 0;
1750 }
1751
1752 if (sd_req_crc_validate(req)) {
1753 sd->card_status |= COM_CRC_ERROR;
1754 rtype = sd_illegal;
1755 goto send_response;
1756 }
1757
1758 if (req->cmd >= SDMMC_CMD_MAX) {
1759 qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
1760 req->cmd);
1761 req->cmd &= 0x3f;
1762 }
1763
1764 if (sd->card_status & CARD_IS_LOCKED) {
1765 if (!cmd_valid_while_locked(sd, req->cmd)) {
1766 sd->card_status |= ILLEGAL_COMMAND;
1767 sd->expecting_acmd = false;
1768 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
1769 rtype = sd_illegal;
1770 goto send_response;
1771 }
1772 }
1773
1774 last_state = sd->state;
1775 sd_set_mode(sd);
1776
1777 if (sd->expecting_acmd) {
1778 sd->expecting_acmd = false;
1779 rtype = sd_app_command(sd, *req);
1780 } else {
1781 rtype = sd_normal_command(sd, *req);
1782 }
1783
1784 if (rtype == sd_illegal) {
1785 sd->card_status |= ILLEGAL_COMMAND;
1786 } else {
1787 /* Valid command, we can update the 'state before command' bits.
1788 * (Do this now so they appear in r1 responses.)
1789 */
1790 sd->current_cmd = req->cmd;
1791 sd->card_status &= ~CURRENT_STATE;
1792 sd->card_status |= (last_state << 9);
1793 }
1794
1795 send_response:
1796 switch (rtype) {
1797 case sd_r1:
1798 case sd_r1b:
1799 sd_response_r1_make(sd, response);
1800 rsplen = 4;
1801 break;
1802
1803 case sd_r2_i:
1804 memcpy(response, sd->cid, sizeof(sd->cid));
1805 rsplen = 16;
1806 break;
1807
1808 case sd_r2_s:
1809 memcpy(response, sd->csd, sizeof(sd->csd));
1810 rsplen = 16;
1811 break;
1812
1813 case sd_r3:
1814 sd_response_r3_make(sd, response);
1815 rsplen = 4;
1816 break;
1817
1818 case sd_r6:
1819 sd_response_r6_make(sd, response);
1820 rsplen = 4;
1821 break;
1822
1823 case sd_r7:
1824 sd_response_r7_make(sd, response);
1825 rsplen = 4;
1826 break;
1827
1828 case sd_r0:
1829 case sd_illegal:
1830 rsplen = 0;
1831 break;
1832 default:
1833 g_assert_not_reached();
1834 }
1835 trace_sdcard_response(sd_response_name(rtype), rsplen);
1836
1837 if (rtype != sd_illegal) {
1838 /* Clear the "clear on valid command" status bits now we've
1839 * sent any response
1840 */
1841 sd->card_status &= ~CARD_STATUS_B;
1842 }
1843
1844 #ifdef DEBUG_SD
1845 qemu_hexdump(stderr, "Response", response, rsplen);
1846 #endif
1847
1848 return rsplen;
1849 }
1850
1851 void sd_write_byte(SDState *sd, uint8_t value)
1852 {
1853 int i;
1854
1855 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1856 return;
1857
1858 if (sd->state != sd_receivingdata_state) {
1859 qemu_log_mask(LOG_GUEST_ERROR,
1860 "%s: not in Receiving-Data state\n", __func__);
1861 return;
1862 }
1863
1864 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1865 return;
1866
1867 trace_sdcard_write_data(sd_proto(sd)->name,
1868 sd_acmd_name(sd->current_cmd),
1869 sd->current_cmd, value);
1870 switch (sd->current_cmd) {
1871 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1872 sd->data[sd->data_offset ++] = value;
1873 if (sd->data_offset >= sd->blk_len) {
1874 /* TODO: Check CRC before committing */
1875 sd->state = sd_programming_state;
1876 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1877 sd->blk_written ++;
1878 sd->csd[14] |= 0x40;
1879 /* Bzzzzzzztt .... Operation complete. */
1880 sd->state = sd_transfer_state;
1881 }
1882 break;
1883
1884 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1885 if (sd->data_offset == 0) {
1886 /* Start of the block - let's check the address is valid */
1887 if (!address_in_range(sd, "WRITE_MULTIPLE_BLOCK",
1888 sd->data_start, sd->blk_len)) {
1889 break;
1890 }
1891 if (sd->size <= SDSC_MAX_CAPACITY) {
1892 if (sd_wp_addr(sd, sd->data_start)) {
1893 sd->card_status |= WP_VIOLATION;
1894 break;
1895 }
1896 }
1897 }
1898 sd->data[sd->data_offset++] = value;
1899 if (sd->data_offset >= sd->blk_len) {
1900 /* TODO: Check CRC before committing */
1901 sd->state = sd_programming_state;
1902 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1903 sd->blk_written++;
1904 sd->data_start += sd->blk_len;
1905 sd->data_offset = 0;
1906 sd->csd[14] |= 0x40;
1907
1908 /* Bzzzzzzztt .... Operation complete. */
1909 if (sd->multi_blk_cnt != 0) {
1910 if (--sd->multi_blk_cnt == 0) {
1911 /* Stop! */
1912 sd->state = sd_transfer_state;
1913 break;
1914 }
1915 }
1916
1917 sd->state = sd_receivingdata_state;
1918 }
1919 break;
1920
1921 case 26: /* CMD26: PROGRAM_CID */
1922 sd->data[sd->data_offset ++] = value;
1923 if (sd->data_offset >= sizeof(sd->cid)) {
1924 /* TODO: Check CRC before committing */
1925 sd->state = sd_programming_state;
1926 for (i = 0; i < sizeof(sd->cid); i ++)
1927 if ((sd->cid[i] | 0x00) != sd->data[i])
1928 sd->card_status |= CID_CSD_OVERWRITE;
1929
1930 if (!(sd->card_status & CID_CSD_OVERWRITE))
1931 for (i = 0; i < sizeof(sd->cid); i ++) {
1932 sd->cid[i] |= 0x00;
1933 sd->cid[i] &= sd->data[i];
1934 }
1935 /* Bzzzzzzztt .... Operation complete. */
1936 sd->state = sd_transfer_state;
1937 }
1938 break;
1939
1940 case 27: /* CMD27: PROGRAM_CSD */
1941 sd->data[sd->data_offset ++] = value;
1942 if (sd->data_offset >= sizeof(sd->csd)) {
1943 /* TODO: Check CRC before committing */
1944 sd->state = sd_programming_state;
1945 for (i = 0; i < sizeof(sd->csd); i ++)
1946 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1947 (sd->data[i] | sd_csd_rw_mask[i]))
1948 sd->card_status |= CID_CSD_OVERWRITE;
1949
1950 /* Copy flag (OTP) & Permanent write protect */
1951 if (sd->csd[14] & ~sd->data[14] & 0x60)
1952 sd->card_status |= CID_CSD_OVERWRITE;
1953
1954 if (!(sd->card_status & CID_CSD_OVERWRITE))
1955 for (i = 0; i < sizeof(sd->csd); i ++) {
1956 sd->csd[i] |= sd_csd_rw_mask[i];
1957 sd->csd[i] &= sd->data[i];
1958 }
1959 /* Bzzzzzzztt .... Operation complete. */
1960 sd->state = sd_transfer_state;
1961 }
1962 break;
1963
1964 case 42: /* CMD42: LOCK_UNLOCK */
1965 sd->data[sd->data_offset ++] = value;
1966 if (sd->data_offset >= sd->blk_len) {
1967 /* TODO: Check CRC before committing */
1968 sd->state = sd_programming_state;
1969 sd_lock_command(sd);
1970 /* Bzzzzzzztt .... Operation complete. */
1971 sd->state = sd_transfer_state;
1972 }
1973 break;
1974
1975 case 56: /* CMD56: GEN_CMD */
1976 sd->data[sd->data_offset ++] = value;
1977 if (sd->data_offset >= sd->blk_len) {
1978 APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1979 sd->state = sd_transfer_state;
1980 }
1981 break;
1982
1983 default:
1984 qemu_log_mask(LOG_GUEST_ERROR, "%s: unknown command\n", __func__);
1985 break;
1986 }
1987 }
1988
1989 #define SD_TUNING_BLOCK_SIZE 64
1990
1991 static const uint8_t sd_tuning_block_pattern[SD_TUNING_BLOCK_SIZE] = {
1992 /* See: Physical Layer Simplified Specification Version 3.01, Table 4-2 */
1993 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
1994 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
1995 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
1996 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
1997 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
1998 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
1999 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
2000 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde,
2001 };
2002
2003 uint8_t sd_read_byte(SDState *sd)
2004 {
2005 /* TODO: Append CRCs */
2006 uint8_t ret;
2007 uint32_t io_len;
2008
2009 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
2010 return 0x00;
2011
2012 if (sd->state != sd_sendingdata_state) {
2013 qemu_log_mask(LOG_GUEST_ERROR,
2014 "%s: not in Sending-Data state\n", __func__);
2015 return 0x00;
2016 }
2017
2018 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
2019 return 0x00;
2020
2021 io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
2022
2023 trace_sdcard_read_data(sd_proto(sd)->name,
2024 sd_acmd_name(sd->current_cmd),
2025 sd->current_cmd, io_len);
2026 switch (sd->current_cmd) {
2027 case 6: /* CMD6: SWITCH_FUNCTION */
2028 ret = sd->data[sd->data_offset ++];
2029
2030 if (sd->data_offset >= 64)
2031 sd->state = sd_transfer_state;
2032 break;
2033
2034 case 9: /* CMD9: SEND_CSD */
2035 case 10: /* CMD10: SEND_CID */
2036 ret = sd->data[sd->data_offset ++];
2037
2038 if (sd->data_offset >= 16)
2039 sd->state = sd_transfer_state;
2040 break;
2041
2042 case 13: /* ACMD13: SD_STATUS */
2043 ret = sd->sd_status[sd->data_offset ++];
2044
2045 if (sd->data_offset >= sizeof(sd->sd_status))
2046 sd->state = sd_transfer_state;
2047 break;
2048
2049 case 17: /* CMD17: READ_SINGLE_BLOCK */
2050 if (sd->data_offset == 0)
2051 BLK_READ_BLOCK(sd->data_start, io_len);
2052 ret = sd->data[sd->data_offset ++];
2053
2054 if (sd->data_offset >= io_len)
2055 sd->state = sd_transfer_state;
2056 break;
2057
2058 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2059 if (sd->data_offset == 0) {
2060 if (!address_in_range(sd, "READ_MULTIPLE_BLOCK",
2061 sd->data_start, io_len)) {
2062 return 0x00;
2063 }
2064 BLK_READ_BLOCK(sd->data_start, io_len);
2065 }
2066 ret = sd->data[sd->data_offset ++];
2067
2068 if (sd->data_offset >= io_len) {
2069 sd->data_start += io_len;
2070 sd->data_offset = 0;
2071
2072 if (sd->multi_blk_cnt != 0) {
2073 if (--sd->multi_blk_cnt == 0) {
2074 /* Stop! */
2075 sd->state = sd_transfer_state;
2076 break;
2077 }
2078 }
2079 }
2080 break;
2081
2082 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2083 if (sd->data_offset >= SD_TUNING_BLOCK_SIZE - 1) {
2084 sd->state = sd_transfer_state;
2085 }
2086 ret = sd_tuning_block_pattern[sd->data_offset++];
2087 break;
2088
2089 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2090 ret = sd->data[sd->data_offset ++];
2091
2092 if (sd->data_offset >= 4)
2093 sd->state = sd_transfer_state;
2094 break;
2095
2096 case 30: /* CMD30: SEND_WRITE_PROT */
2097 ret = sd->data[sd->data_offset ++];
2098
2099 if (sd->data_offset >= 4)
2100 sd->state = sd_transfer_state;
2101 break;
2102
2103 case 51: /* ACMD51: SEND_SCR */
2104 ret = sd->scr[sd->data_offset ++];
2105
2106 if (sd->data_offset >= sizeof(sd->scr))
2107 sd->state = sd_transfer_state;
2108 break;
2109
2110 case 56: /* CMD56: GEN_CMD */
2111 if (sd->data_offset == 0)
2112 APP_READ_BLOCK(sd->data_start, sd->blk_len);
2113 ret = sd->data[sd->data_offset ++];
2114
2115 if (sd->data_offset >= sd->blk_len)
2116 sd->state = sd_transfer_state;
2117 break;
2118
2119 default:
2120 qemu_log_mask(LOG_GUEST_ERROR, "%s: unknown command\n", __func__);
2121 return 0x00;
2122 }
2123
2124 return ret;
2125 }
2126
2127 static bool sd_receive_ready(SDState *sd)
2128 {
2129 return sd->state == sd_receivingdata_state;
2130 }
2131
2132 static bool sd_data_ready(SDState *sd)
2133 {
2134 return sd->state == sd_sendingdata_state;
2135 }
2136
2137 void sd_enable(SDState *sd, bool enable)
2138 {
2139 sd->enable = enable;
2140 }
2141
2142 static const SDProto sd_proto_spi = {
2143 .name = "SPI",
2144 .cmd = {
2145 [0] = sd_cmd_GO_IDLE_STATE,
2146 [1] = sd_cmd_SEND_OP_CMD,
2147 [2 ... 4] = sd_cmd_illegal,
2148 [5] = sd_cmd_illegal,
2149 [7] = sd_cmd_illegal,
2150 [15] = sd_cmd_illegal,
2151 [26] = sd_cmd_illegal,
2152 [52 ... 54] = sd_cmd_illegal,
2153 },
2154 .acmd = {
2155 [6] = sd_cmd_unimplemented,
2156 [41] = sd_cmd_SEND_OP_CMD,
2157 },
2158 };
2159
2160 static const SDProto sd_proto_sd = {
2161 .name = "SD",
2162 .cmd = {
2163 [0] = sd_cmd_GO_IDLE_STATE,
2164 [1] = sd_cmd_illegal,
2165 [2] = sd_cmd_ALL_SEND_CID,
2166 [3] = sd_cmd_SEND_RELATIVE_ADDR,
2167 [5] = sd_cmd_illegal,
2168 [19] = sd_cmd_SEND_TUNING_BLOCK,
2169 [23] = sd_cmd_SET_BLOCK_COUNT,
2170 [52 ... 54] = sd_cmd_illegal,
2171 [58] = sd_cmd_illegal,
2172 [59] = sd_cmd_illegal,
2173 },
2174 };
2175
2176 static void sd_instance_init(Object *obj)
2177 {
2178 SDState *sd = SD_CARD(obj);
2179
2180 sd->enable = true;
2181 sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
2182 }
2183
2184 static void sd_instance_finalize(Object *obj)
2185 {
2186 SDState *sd = SD_CARD(obj);
2187
2188 timer_free(sd->ocr_power_timer);
2189 }
2190
2191 static void sd_realize(DeviceState *dev, Error **errp)
2192 {
2193 SDState *sd = SD_CARD(dev);
2194 int ret;
2195
2196 switch (sd->spec_version) {
2197 case SD_PHY_SPECv1_10_VERS
2198 ... SD_PHY_SPECv3_01_VERS:
2199 break;
2200 default:
2201 error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
2202 return;
2203 }
2204
2205 if (sd->blk) {
2206 int64_t blk_size;
2207
2208 if (!blk_supports_write_perm(sd->blk)) {
2209 error_setg(errp, "Cannot use read-only drive as SD card");
2210 return;
2211 }
2212
2213 blk_size = blk_getlength(sd->blk);
2214 if (blk_size > 0 && !is_power_of_2(blk_size)) {
2215 int64_t blk_size_aligned = pow2ceil(blk_size);
2216 char *blk_size_str;
2217
2218 blk_size_str = size_to_str(blk_size);
2219 error_setg(errp, "Invalid SD card size: %s", blk_size_str);
2220 g_free(blk_size_str);
2221
2222 blk_size_str = size_to_str(blk_size_aligned);
2223 error_append_hint(errp,
2224 "SD card size has to be a power of 2, e.g. %s.\n"
2225 "You can resize disk images with"
2226 " 'qemu-img resize <imagefile> <new-size>'\n"
2227 "(note that this will lose data if you make the"
2228 " image smaller than it currently is).\n",
2229 blk_size_str);
2230 g_free(blk_size_str);
2231
2232 return;
2233 }
2234
2235 ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
2236 BLK_PERM_ALL, errp);
2237 if (ret < 0) {
2238 return;
2239 }
2240 blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
2241 }
2242 }
2243
2244 static Property sd_properties[] = {
2245 DEFINE_PROP_UINT8("spec_version", SDState,
2246 spec_version, SD_PHY_SPECv2_00_VERS),
2247 DEFINE_PROP_DRIVE("drive", SDState, blk),
2248 /* We do not model the chip select pin, so allow the board to select
2249 * whether card should be in SSI or MMC/SD mode. It is also up to the
2250 * board to ensure that ssi transfers only occur when the chip select
2251 * is asserted. */
2252 DEFINE_PROP_END_OF_LIST()
2253 };
2254
2255 static void sd_class_init(ObjectClass *klass, void *data)
2256 {
2257 DeviceClass *dc = DEVICE_CLASS(klass);
2258 SDCardClass *sc = SD_CARD_CLASS(klass);
2259
2260 dc->realize = sd_realize;
2261 device_class_set_props(dc, sd_properties);
2262 dc->vmsd = &sd_vmstate;
2263 dc->reset = sd_reset;
2264 dc->bus_type = TYPE_SD_BUS;
2265 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2266
2267 sc->set_voltage = sd_set_voltage;
2268 sc->get_dat_lines = sd_get_dat_lines;
2269 sc->get_cmd_line = sd_get_cmd_line;
2270 sc->do_command = sd_do_command;
2271 sc->write_byte = sd_write_byte;
2272 sc->read_byte = sd_read_byte;
2273 sc->receive_ready = sd_receive_ready;
2274 sc->data_ready = sd_data_ready;
2275 sc->enable = sd_enable;
2276 sc->get_inserted = sd_get_inserted;
2277 sc->get_readonly = sd_get_readonly;
2278 sc->proto = &sd_proto_sd;
2279 }
2280
2281 /*
2282 * We do not model the chip select pin, so allow the board to select
2283 * whether card should be in SSI or MMC/SD mode. It is also up to the
2284 * board to ensure that ssi transfers only occur when the chip select
2285 * is asserted.
2286 */
2287 static void sd_spi_class_init(ObjectClass *klass, void *data)
2288 {
2289 DeviceClass *dc = DEVICE_CLASS(klass);
2290 SDCardClass *sc = SD_CARD_CLASS(klass);
2291
2292 dc->desc = "SD SPI";
2293 sc->proto = &sd_proto_spi;
2294 }
2295
2296 static const TypeInfo sd_types[] = {
2297 {
2298 .name = TYPE_SD_CARD,
2299 .parent = TYPE_DEVICE,
2300 .instance_size = sizeof(SDState),
2301 .class_size = sizeof(SDCardClass),
2302 .class_init = sd_class_init,
2303 .instance_init = sd_instance_init,
2304 .instance_finalize = sd_instance_finalize,
2305 },
2306 {
2307 .name = TYPE_SD_CARD_SPI,
2308 .parent = TYPE_SD_CARD,
2309 .class_init = sd_spi_class_init,
2310 },
2311 };
2312
2313 DEFINE_TYPES(sd_types)
AR7 emulation for QEMU