2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
24 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
28 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 #include "qemu/osdep.h"
34 #include "qemu/units.h"
35 #include "qemu/cutils.h"
37 #include "hw/registerfields.h"
38 #include "sysemu/block-backend.h"
40 #include "hw/sd/sdcard_legacy.h"
41 #include "migration/vmstate.h"
42 #include "qapi/error.h"
43 #include "qemu/bitmap.h"
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "qemu/error-report.h"
47 #include "qemu/timer.h"
49 #include "qemu/module.h"
50 #include "sdmmc-internal.h"
55 #define SDSC_MAX_CAPACITY (2 * GiB)
57 #define INVALID_ADDRESS UINT32_MAX
60 sd_r0
= 0, /* no response */
61 sd_r1
, /* normal response command */
62 sd_r2_i
, /* CID register */
63 sd_r2_s
, /* CSD register */
64 sd_r3
, /* OCR register */
65 sd_r6
= 6, /* Published RCA response */
66 sd_r7
, /* Operating voltage */
73 sd_card_identification_mode
,
74 sd_data_transfer_mode
,
78 sd_inactive_state
= -1,
81 sd_identification_state
,
85 sd_receivingdata_state
,
91 DeviceState parent_obj
;
93 /* If true, created by sd_init() for a non-qdevified caller */
94 /* TODO purge them with fire */
95 bool me_no_qdev_me_kill_mammoth_with_rocks
;
97 /* SD Memory Card Registers */
103 uint32_t card_status
;
104 uint8_t sd_status
[64];
106 /* Static properties */
108 uint8_t spec_version
;
112 /* Runtime changeables */
114 uint32_t mode
; /* current card mode, one of SDCardModes */
115 int32_t state
; /* current card state, one of SDCardStates */
118 unsigned long *wp_groups
;
122 uint32_t multi_blk_cnt
;
123 uint32_t erase_start
;
127 uint8_t function_group
[6];
129 /* True if we will handle the next command as an ACMD. Note that this does
130 * *not* track the APP_CMD status bit!
133 uint32_t blk_written
;
135 uint32_t data_offset
;
137 qemu_irq readonly_cb
;
138 qemu_irq inserted_cb
;
139 QEMUTimer
*ocr_power_timer
;
140 const char *proto_name
;
146 static void sd_realize(DeviceState
*dev
, Error
**errp
);
148 static const char *sd_state_name(enum SDCardStates state
)
150 static const char *state_name
[] = {
151 [sd_idle_state
] = "idle",
152 [sd_ready_state
] = "ready",
153 [sd_identification_state
] = "identification",
154 [sd_standby_state
] = "standby",
155 [sd_transfer_state
] = "transfer",
156 [sd_sendingdata_state
] = "sendingdata",
157 [sd_receivingdata_state
] = "receivingdata",
158 [sd_programming_state
] = "programming",
159 [sd_disconnect_state
] = "disconnect",
161 if (state
== sd_inactive_state
) {
164 assert(state
< ARRAY_SIZE(state_name
));
165 return state_name
[state
];
168 static const char *sd_response_name(sd_rsp_type_t rsp
)
170 static const char *response_name
[] = {
171 [sd_r0
] = "RESP#0 (no response)",
172 [sd_r1
] = "RESP#1 (normal cmd)",
173 [sd_r2_i
] = "RESP#2 (CID reg)",
174 [sd_r2_s
] = "RESP#2 (CSD reg)",
175 [sd_r3
] = "RESP#3 (OCR reg)",
176 [sd_r6
] = "RESP#6 (RCA)",
177 [sd_r7
] = "RESP#7 (operating voltage)",
179 if (rsp
== sd_illegal
) {
180 return "ILLEGAL RESP";
185 assert(rsp
< ARRAY_SIZE(response_name
));
186 return response_name
[rsp
];
189 static uint8_t sd_get_dat_lines(SDState
*sd
)
191 return sd
->enable
? sd
->dat_lines
: 0;
194 static bool sd_get_cmd_line(SDState
*sd
)
196 return sd
->enable
? sd
->cmd_line
: false;
199 static void sd_set_voltage(SDState
*sd
, uint16_t millivolts
)
201 trace_sdcard_set_voltage(millivolts
);
203 switch (millivolts
) {
204 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
205 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
208 qemu_log_mask(LOG_GUEST_ERROR
, "SD card voltage not supported: %.3fV",
209 millivolts
/ 1000.f
);
213 static void sd_set_mode(SDState
*sd
)
216 case sd_inactive_state
:
217 sd
->mode
= sd_inactive
;
222 case sd_identification_state
:
223 sd
->mode
= sd_card_identification_mode
;
226 case sd_standby_state
:
227 case sd_transfer_state
:
228 case sd_sendingdata_state
:
229 case sd_receivingdata_state
:
230 case sd_programming_state
:
231 case sd_disconnect_state
:
232 sd
->mode
= sd_data_transfer_mode
;
237 static const sd_cmd_type_t sd_cmd_type
[SDMMC_CMD_MAX
] = {
238 sd_bc
, sd_none
, sd_bcr
, sd_bcr
, sd_none
, sd_none
, sd_none
, sd_ac
,
239 sd_bcr
, sd_ac
, sd_ac
, sd_adtc
, sd_ac
, sd_ac
, sd_none
, sd_ac
,
241 sd_ac
, sd_adtc
, sd_adtc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
242 sd_adtc
, sd_adtc
, sd_adtc
, sd_adtc
, sd_ac
, sd_ac
, sd_adtc
, sd_none
,
244 sd_ac
, sd_ac
, sd_none
, sd_none
, sd_none
, sd_none
, sd_ac
, sd_none
,
245 sd_none
, sd_none
, sd_bc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
247 sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_ac
,
248 sd_adtc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
251 static const int sd_cmd_class
[SDMMC_CMD_MAX
] = {
252 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0,
253 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6,
254 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7,
255 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8,
258 static uint8_t sd_crc7(const void *message
, size_t width
)
261 uint8_t shift_reg
= 0x00;
262 const uint8_t *msg
= (const uint8_t *)message
;
264 for (i
= 0; i
< width
; i
++, msg
++)
265 for (bit
= 7; bit
>= 0; bit
--) {
267 if ((shift_reg
>> 7) ^ ((*msg
>> bit
) & 1))
274 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
276 FIELD(OCR
, VDD_VOLTAGE_WINDOW
, 0, 24)
277 FIELD(OCR
, VDD_VOLTAGE_WIN_LO
, 0, 8)
278 FIELD(OCR
, DUAL_VOLTAGE_CARD
, 7, 1)
279 FIELD(OCR
, VDD_VOLTAGE_WIN_HI
, 8, 16)
280 FIELD(OCR
, ACCEPT_SWITCH_1V8
, 24, 1) /* Only UHS-I */
281 FIELD(OCR
, UHS_II_CARD
, 29, 1) /* Only UHS-II */
282 FIELD(OCR
, CARD_CAPACITY
, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
283 FIELD(OCR
, CARD_POWER_UP
, 31, 1)
285 #define ACMD41_ENQUIRY_MASK 0x00ffffff
286 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
287 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
288 | R_OCR_UHS_II_CARD_MASK \
289 | R_OCR_CARD_CAPACITY_MASK \
290 | R_OCR_CARD_POWER_UP_MASK)
292 static void sd_set_ocr(SDState
*sd
)
294 /* All voltages OK */
295 sd
->ocr
= R_OCR_VDD_VOLTAGE_WIN_HI_MASK
;
298 static void sd_ocr_powerup(void *opaque
)
300 SDState
*sd
= opaque
;
302 trace_sdcard_powerup();
303 assert(!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
));
305 /* card power-up OK */
306 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_POWER_UP
, 1);
308 if (sd
->size
> SDSC_MAX_CAPACITY
) {
309 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_CAPACITY
, 1);
313 static void sd_set_scr(SDState
*sd
)
315 sd
->scr
[0] = 0 << 4; /* SCR structure version 1.0 */
316 if (sd
->spec_version
== SD_PHY_SPECv1_10_VERS
) {
317 sd
->scr
[0] |= 1; /* Spec Version 1.10 */
319 sd
->scr
[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
321 sd
->scr
[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
322 | 0b0101; /* 1-bit or 4-bit width bus modes */
323 sd
->scr
[2] = 0x00; /* Extended Security is not supported. */
324 if (sd
->spec_version
>= SD_PHY_SPECv3_01_VERS
) {
325 sd
->scr
[2] |= 1 << 7; /* Spec Version 3.0X */
328 /* reserved for manufacturer usage */
342 static void sd_set_cid(SDState
*sd
)
344 sd
->cid
[0] = MID
; /* Fake card manufacturer ID (MID) */
345 sd
->cid
[1] = OID
[0]; /* OEM/Application ID (OID) */
347 sd
->cid
[3] = PNM
[0]; /* Fake product name (PNM) */
352 sd
->cid
[8] = PRV
; /* Fake product revision (PRV) */
353 sd
->cid
[9] = 0xde; /* Fake serial number (PSN) */
357 sd
->cid
[13] = 0x00 | /* Manufacture date (MDT) */
358 ((MDT_YR
- 2000) / 10);
359 sd
->cid
[14] = ((MDT_YR
% 10) << 4) | MDT_MON
;
360 sd
->cid
[15] = (sd_crc7(sd
->cid
, 15) << 1) | 1;
363 #define HWBLOCK_SHIFT 9 /* 512 bytes */
364 #define SECTOR_SHIFT 5 /* 16 kilobytes */
365 #define WPGROUP_SHIFT 7 /* 2 megs */
366 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
367 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
369 static const uint8_t sd_csd_rw_mask
[16] = {
370 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
371 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
374 static void sd_set_csd(SDState
*sd
, uint64_t size
)
376 int hwblock_shift
= HWBLOCK_SHIFT
;
378 uint32_t sectsize
= (1 << (SECTOR_SHIFT
+ 1)) - 1;
379 uint32_t wpsize
= (1 << (WPGROUP_SHIFT
+ 1)) - 1;
381 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
382 if (size
== SDSC_MAX_CAPACITY
) {
385 csize
= (size
>> (CMULT_SHIFT
+ hwblock_shift
)) - 1;
387 if (size
<= SDSC_MAX_CAPACITY
) { /* Standard Capacity SD */
388 sd
->csd
[0] = 0x00; /* CSD structure */
389 sd
->csd
[1] = 0x26; /* Data read access-time-1 */
390 sd
->csd
[2] = 0x00; /* Data read access-time-2 */
391 sd
->csd
[3] = 0x32; /* Max. data transfer rate: 25 MHz */
392 sd
->csd
[4] = 0x5f; /* Card Command Classes */
393 sd
->csd
[5] = 0x50 | /* Max. read data block length */
395 sd
->csd
[6] = 0xe0 | /* Partial block for read allowed */
396 ((csize
>> 10) & 0x03);
397 sd
->csd
[7] = 0x00 | /* Device size */
398 ((csize
>> 2) & 0xff);
399 sd
->csd
[8] = 0x3f | /* Max. read current */
400 ((csize
<< 6) & 0xc0);
401 sd
->csd
[9] = 0xfc | /* Max. write current */
402 ((CMULT_SHIFT
- 2) >> 1);
403 sd
->csd
[10] = 0x40 | /* Erase sector size */
404 (((CMULT_SHIFT
- 2) << 7) & 0x80) | (sectsize
>> 1);
405 sd
->csd
[11] = 0x00 | /* Write protect group size */
406 ((sectsize
<< 7) & 0x80) | wpsize
;
407 sd
->csd
[12] = 0x90 | /* Write speed factor */
408 (hwblock_shift
>> 2);
409 sd
->csd
[13] = 0x20 | /* Max. write data block length */
410 ((hwblock_shift
<< 6) & 0xc0);
411 sd
->csd
[14] = 0x00; /* File format group */
422 sd
->csd
[7] = (size
>> 16) & 0xff;
423 sd
->csd
[8] = (size
>> 8) & 0xff;
424 sd
->csd
[9] = (size
& 0xff);
431 sd
->csd
[15] = (sd_crc7(sd
->csd
, 15) << 1) | 1;
434 static void sd_set_rca(SDState
*sd
)
439 FIELD(CSR
, AKE_SEQ_ERROR
, 3, 1)
440 FIELD(CSR
, APP_CMD
, 5, 1)
441 FIELD(CSR
, FX_EVENT
, 6, 1)
442 FIELD(CSR
, READY_FOR_DATA
, 8, 1)
443 FIELD(CSR
, CURRENT_STATE
, 9, 4)
444 FIELD(CSR
, ERASE_RESET
, 13, 1)
445 FIELD(CSR
, CARD_ECC_DISABLED
, 14, 1)
446 FIELD(CSR
, WP_ERASE_SKIP
, 15, 1)
447 FIELD(CSR
, CSD_OVERWRITE
, 16, 1)
448 FIELD(CSR
, DEFERRED_RESPONSE
, 17, 1)
449 FIELD(CSR
, ERROR
, 19, 1)
450 FIELD(CSR
, CC_ERROR
, 20, 1)
451 FIELD(CSR
, CARD_ECC_FAILED
, 21, 1)
452 FIELD(CSR
, ILLEGAL_COMMAND
, 22, 1)
453 FIELD(CSR
, COM_CRC_ERROR
, 23, 1)
454 FIELD(CSR
, LOCK_UNLOCK_FAILED
, 24, 1)
455 FIELD(CSR
, CARD_IS_LOCKED
, 25, 1)
456 FIELD(CSR
, WP_VIOLATION
, 26, 1)
457 FIELD(CSR
, ERASE_PARAM
, 27, 1)
458 FIELD(CSR
, ERASE_SEQ_ERROR
, 28, 1)
459 FIELD(CSR
, BLOCK_LEN_ERROR
, 29, 1)
460 FIELD(CSR
, ADDRESS_ERROR
, 30, 1)
461 FIELD(CSR
, OUT_OF_RANGE
, 31, 1)
463 /* Card status bits, split by clear condition:
464 * A : According to the card current state
465 * B : Always related to the previous command
466 * C : Cleared by read
468 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
469 | R_CSR_CARD_ECC_DISABLED_MASK \
470 | R_CSR_CARD_IS_LOCKED_MASK)
471 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
472 | R_CSR_ILLEGAL_COMMAND_MASK \
473 | R_CSR_COM_CRC_ERROR_MASK)
474 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
475 | R_CSR_APP_CMD_MASK \
476 | R_CSR_ERASE_RESET_MASK \
477 | R_CSR_WP_ERASE_SKIP_MASK \
478 | R_CSR_CSD_OVERWRITE_MASK \
480 | R_CSR_CC_ERROR_MASK \
481 | R_CSR_CARD_ECC_FAILED_MASK \
482 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
483 | R_CSR_WP_VIOLATION_MASK \
484 | R_CSR_ERASE_PARAM_MASK \
485 | R_CSR_ERASE_SEQ_ERROR_MASK \
486 | R_CSR_BLOCK_LEN_ERROR_MASK \
487 | R_CSR_ADDRESS_ERROR_MASK \
488 | R_CSR_OUT_OF_RANGE_MASK)
490 static void sd_set_cardstatus(SDState
*sd
)
492 sd
->card_status
= 0x00000100;
495 static void sd_set_sdstatus(SDState
*sd
)
497 memset(sd
->sd_status
, 0, 64);
500 static int sd_req_crc_validate(SDRequest
*req
)
503 buffer
[0] = 0x40 | req
->cmd
;
504 stl_be_p(&buffer
[1], req
->arg
);
506 return sd_crc7(buffer
, 5) != req
->crc
; /* TODO */
509 static void sd_response_r1_make(SDState
*sd
, uint8_t *response
)
511 stl_be_p(response
, sd
->card_status
);
513 /* Clear the "clear on read" status bits */
514 sd
->card_status
&= ~CARD_STATUS_C
;
517 static void sd_response_r3_make(SDState
*sd
, uint8_t *response
)
519 stl_be_p(response
, sd
->ocr
& ACMD41_R3_MASK
);
522 static void sd_response_r6_make(SDState
*sd
, uint8_t *response
)
526 status
= ((sd
->card_status
>> 8) & 0xc000) |
527 ((sd
->card_status
>> 6) & 0x2000) |
528 (sd
->card_status
& 0x1fff);
529 sd
->card_status
&= ~(CARD_STATUS_C
& 0xc81fff);
530 stw_be_p(response
+ 0, sd
->rca
);
531 stw_be_p(response
+ 2, status
);
534 static void sd_response_r7_make(SDState
*sd
, uint8_t *response
)
536 stl_be_p(response
, sd
->vhs
);
539 static inline uint64_t sd_addr_to_wpnum(uint64_t addr
)
541 return addr
>> (HWBLOCK_SHIFT
+ SECTOR_SHIFT
+ WPGROUP_SHIFT
);
544 static void sd_reset(DeviceState
*dev
)
546 SDState
*sd
= SD_CARD(dev
);
550 trace_sdcard_reset();
552 blk_get_geometry(sd
->blk
, §
);
558 sect
= sd_addr_to_wpnum(size
) + 1;
560 sd
->state
= sd_idle_state
;
565 sd_set_csd(sd
, size
);
566 sd_set_cardstatus(sd
);
569 g_free(sd
->wp_groups
);
570 sd
->wp_switch
= sd
->blk
? !blk_is_writable(sd
->blk
) : false;
571 sd
->wpgrps_size
= sect
;
572 sd
->wp_groups
= bitmap_new(sd
->wpgrps_size
);
573 memset(sd
->function_group
, 0, sizeof(sd
->function_group
));
574 sd
->erase_start
= INVALID_ADDRESS
;
575 sd
->erase_end
= INVALID_ADDRESS
;
579 sd
->expecting_acmd
= false;
582 sd
->multi_blk_cnt
= 0;
585 static bool sd_get_inserted(SDState
*sd
)
587 return sd
->blk
&& blk_is_inserted(sd
->blk
);
590 static bool sd_get_readonly(SDState
*sd
)
592 return sd
->wp_switch
;
595 static void sd_cardchange(void *opaque
, bool load
, Error
**errp
)
597 SDState
*sd
= opaque
;
598 DeviceState
*dev
= DEVICE(sd
);
600 bool inserted
= sd_get_inserted(sd
);
601 bool readonly
= sd_get_readonly(sd
);
604 trace_sdcard_inserted(readonly
);
607 trace_sdcard_ejected();
610 if (sd
->me_no_qdev_me_kill_mammoth_with_rocks
) {
611 qemu_set_irq(sd
->inserted_cb
, inserted
);
613 qemu_set_irq(sd
->readonly_cb
, readonly
);
616 sdbus
= SD_BUS(qdev_get_parent_bus(dev
));
617 sdbus_set_inserted(sdbus
, inserted
);
619 sdbus_set_readonly(sdbus
, readonly
);
624 static const BlockDevOps sd_block_ops
= {
625 .change_media_cb
= sd_cardchange
,
628 static bool sd_ocr_vmstate_needed(void *opaque
)
630 SDState
*sd
= opaque
;
632 /* Include the OCR state (and timer) if it is not yet powered up */
633 return !FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
);
636 static const VMStateDescription sd_ocr_vmstate
= {
637 .name
= "sd-card/ocr-state",
639 .minimum_version_id
= 1,
640 .needed
= sd_ocr_vmstate_needed
,
641 .fields
= (VMStateField
[]) {
642 VMSTATE_UINT32(ocr
, SDState
),
643 VMSTATE_TIMER_PTR(ocr_power_timer
, SDState
),
644 VMSTATE_END_OF_LIST()
648 static int sd_vmstate_pre_load(void *opaque
)
650 SDState
*sd
= opaque
;
652 /* If the OCR state is not included (prior versions, or not
653 * needed), then the OCR must be set as powered up. If the OCR state
654 * is included, this will be replaced by the state restore.
661 static const VMStateDescription sd_vmstate
= {
664 .minimum_version_id
= 2,
665 .pre_load
= sd_vmstate_pre_load
,
666 .fields
= (VMStateField
[]) {
667 VMSTATE_UINT32(mode
, SDState
),
668 VMSTATE_INT32(state
, SDState
),
669 VMSTATE_UINT8_ARRAY(cid
, SDState
, 16),
670 VMSTATE_UINT8_ARRAY(csd
, SDState
, 16),
671 VMSTATE_UINT16(rca
, SDState
),
672 VMSTATE_UINT32(card_status
, SDState
),
673 VMSTATE_PARTIAL_BUFFER(sd_status
, SDState
, 1),
674 VMSTATE_UINT32(vhs
, SDState
),
675 VMSTATE_BITMAP(wp_groups
, SDState
, 0, wpgrps_size
),
676 VMSTATE_UINT32(blk_len
, SDState
),
677 VMSTATE_UINT32(multi_blk_cnt
, SDState
),
678 VMSTATE_UINT32(erase_start
, SDState
),
679 VMSTATE_UINT32(erase_end
, SDState
),
680 VMSTATE_UINT8_ARRAY(pwd
, SDState
, 16),
681 VMSTATE_UINT32(pwd_len
, SDState
),
682 VMSTATE_UINT8_ARRAY(function_group
, SDState
, 6),
683 VMSTATE_UINT8(current_cmd
, SDState
),
684 VMSTATE_BOOL(expecting_acmd
, SDState
),
685 VMSTATE_UINT32(blk_written
, SDState
),
686 VMSTATE_UINT64(data_start
, SDState
),
687 VMSTATE_UINT32(data_offset
, SDState
),
688 VMSTATE_UINT8_ARRAY(data
, SDState
, 512),
689 VMSTATE_UNUSED_V(1, 512),
690 VMSTATE_BOOL(enable
, SDState
),
691 VMSTATE_END_OF_LIST()
693 .subsections
= (const VMStateDescription
*[]) {
699 /* Legacy initialization function for use by non-qdevified callers */
700 SDState
*sd_init(BlockBackend
*blk
, bool is_spi
)
707 obj
= object_new(TYPE_SD_CARD
);
709 if (!qdev_prop_set_drive_err(dev
, "drive", blk
, &err
)) {
710 error_reportf_err(err
, "sd_init failed: ");
713 qdev_prop_set_bit(dev
, "spi", is_spi
);
716 * Realizing the device properly would put it into the QOM
717 * composition tree even though it is not plugged into an
718 * appropriate bus. That's a no-no. Hide the device from
719 * QOM/qdev, and call its qdev realize callback directly.
722 object_unparent(obj
);
723 sd_realize(dev
, &err
);
725 error_reportf_err(err
, "sd_init failed: ");
730 sd
->me_no_qdev_me_kill_mammoth_with_rocks
= true;
734 void sd_set_cb(SDState
*sd
, qemu_irq readonly
, qemu_irq insert
)
736 sd
->readonly_cb
= readonly
;
737 sd
->inserted_cb
= insert
;
738 qemu_set_irq(readonly
, sd
->blk
? !blk_is_writable(sd
->blk
) : 0);
739 qemu_set_irq(insert
, sd
->blk
? blk_is_inserted(sd
->blk
) : 0);
742 static void sd_erase(SDState
*sd
)
745 uint64_t erase_start
= sd
->erase_start
;
746 uint64_t erase_end
= sd
->erase_end
;
748 trace_sdcard_erase(sd
->erase_start
, sd
->erase_end
);
749 if (sd
->erase_start
== INVALID_ADDRESS
750 || sd
->erase_end
== INVALID_ADDRESS
) {
751 sd
->card_status
|= ERASE_SEQ_ERROR
;
752 sd
->erase_start
= INVALID_ADDRESS
;
753 sd
->erase_end
= INVALID_ADDRESS
;
757 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
758 /* High capacity memory card: erase units are 512 byte blocks */
763 if (sd
->erase_start
> sd
->size
|| sd
->erase_end
> sd
->size
) {
764 sd
->card_status
|= OUT_OF_RANGE
;
765 sd
->erase_start
= INVALID_ADDRESS
;
766 sd
->erase_end
= INVALID_ADDRESS
;
770 erase_start
= sd_addr_to_wpnum(erase_start
);
771 erase_end
= sd_addr_to_wpnum(erase_end
);
772 sd
->erase_start
= INVALID_ADDRESS
;
773 sd
->erase_end
= INVALID_ADDRESS
;
776 for (i
= erase_start
; i
<= erase_end
; i
++) {
777 assert(i
< sd
->wpgrps_size
);
778 if (test_bit(i
, sd
->wp_groups
)) {
779 sd
->card_status
|= WP_ERASE_SKIP
;
784 static uint32_t sd_wpbits(SDState
*sd
, uint64_t addr
)
789 wpnum
= sd_addr_to_wpnum(addr
);
791 for (i
= 0; i
< 32; i
++, wpnum
++, addr
+= WPGROUP_SIZE
) {
792 assert(wpnum
< sd
->wpgrps_size
);
793 if (addr
< sd
->size
&& test_bit(wpnum
, sd
->wp_groups
)) {
801 static void sd_function_switch(SDState
*sd
, uint32_t arg
)
803 int i
, mode
, new_func
;
804 mode
= !!(arg
& 0x80000000);
806 sd
->data
[0] = 0x00; /* Maximum current consumption */
808 sd
->data
[2] = 0x80; /* Supported group 6 functions */
810 sd
->data
[4] = 0x80; /* Supported group 5 functions */
812 sd
->data
[6] = 0x80; /* Supported group 4 functions */
814 sd
->data
[8] = 0x80; /* Supported group 3 functions */
816 sd
->data
[10] = 0x80; /* Supported group 2 functions */
818 sd
->data
[12] = 0x80; /* Supported group 1 functions */
821 memset(&sd
->data
[14], 0, 3);
822 for (i
= 0; i
< 6; i
++) {
823 new_func
= (arg
>> (i
* 4)) & 0x0f;
824 if (mode
&& new_func
!= 0x0f)
825 sd
->function_group
[i
] = new_func
;
826 sd
->data
[16 - (i
>> 1)] |= new_func
<< ((i
% 2) * 4);
828 memset(&sd
->data
[17], 0, 47);
831 static inline bool sd_wp_addr(SDState
*sd
, uint64_t addr
)
833 return test_bit(sd_addr_to_wpnum(addr
), sd
->wp_groups
);
836 static void sd_lock_command(SDState
*sd
)
838 int erase
, lock
, clr_pwd
, set_pwd
, pwd_len
;
839 erase
= !!(sd
->data
[0] & 0x08);
840 lock
= sd
->data
[0] & 0x04;
841 clr_pwd
= sd
->data
[0] & 0x02;
842 set_pwd
= sd
->data
[0] & 0x01;
845 pwd_len
= sd
->data
[1];
852 trace_sdcard_unlock();
855 if (!(sd
->card_status
& CARD_IS_LOCKED
) || sd
->blk_len
> 1 ||
856 set_pwd
|| clr_pwd
|| lock
|| sd
->wp_switch
||
857 (sd
->csd
[14] & 0x20)) {
858 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
861 bitmap_zero(sd
->wp_groups
, sd
->wpgrps_size
);
862 sd
->csd
[14] &= ~0x10;
863 sd
->card_status
&= ~CARD_IS_LOCKED
;
865 /* Erasing the entire card here! */
866 fprintf(stderr
, "SD: Card force-erased by CMD42\n");
870 if (sd
->blk_len
< 2 + pwd_len
||
871 pwd_len
<= sd
->pwd_len
||
872 pwd_len
> sd
->pwd_len
+ 16) {
873 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
877 if (sd
->pwd_len
&& memcmp(sd
->pwd
, sd
->data
+ 2, sd
->pwd_len
)) {
878 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
882 pwd_len
-= sd
->pwd_len
;
883 if ((pwd_len
&& !set_pwd
) ||
884 (clr_pwd
&& (set_pwd
|| lock
)) ||
885 (lock
&& !sd
->pwd_len
&& !set_pwd
) ||
886 (!set_pwd
&& !clr_pwd
&&
887 (((sd
->card_status
& CARD_IS_LOCKED
) && lock
) ||
888 (!(sd
->card_status
& CARD_IS_LOCKED
) && !lock
)))) {
889 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
894 memcpy(sd
->pwd
, sd
->data
+ 2 + sd
->pwd_len
, pwd_len
);
895 sd
->pwd_len
= pwd_len
;
903 sd
->card_status
|= CARD_IS_LOCKED
;
905 sd
->card_status
&= ~CARD_IS_LOCKED
;
908 static sd_rsp_type_t
sd_normal_command(SDState
*sd
, SDRequest req
)
910 uint32_t rca
= 0x0000;
911 uint64_t addr
= (sd
->ocr
& (1 << 30)) ? (uint64_t) req
.arg
<< 9 : req
.arg
;
913 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
914 * However there is no ACMD55, so we want to trace this particular case.
916 if (req
.cmd
!= 55 || sd
->expecting_acmd
) {
917 trace_sdcard_normal_command(sd
->proto_name
,
918 sd_cmd_name(req
.cmd
), req
.cmd
,
919 req
.arg
, sd_state_name(sd
->state
));
922 /* Not interpreting this as an app command */
923 sd
->card_status
&= ~APP_CMD
;
925 if (sd_cmd_type
[req
.cmd
] == sd_ac
926 || sd_cmd_type
[req
.cmd
] == sd_adtc
) {
930 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
931 * if not, its effects are cancelled */
932 if (sd
->multi_blk_cnt
!= 0 && !(req
.cmd
== 18 || req
.cmd
== 25)) {
933 sd
->multi_blk_cnt
= 0;
936 if (sd_cmd_class
[req
.cmd
] == 6 && FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
937 /* Only Standard Capacity cards support class 6 commands */
942 /* Basic commands (Class 0 and Class 1) */
943 case 0: /* CMD0: GO_IDLE_STATE */
945 case sd_inactive_state
:
946 return sd
->spi
? sd_r1
: sd_r0
;
949 sd
->state
= sd_idle_state
;
950 sd_reset(DEVICE(sd
));
951 return sd
->spi
? sd_r1
: sd_r0
;
955 case 1: /* CMD1: SEND_OP_CMD */
959 sd
->state
= sd_transfer_state
;
962 case 2: /* CMD2: ALL_SEND_CID */
967 sd
->state
= sd_identification_state
;
975 case 3: /* CMD3: SEND_RELATIVE_ADDR */
979 case sd_identification_state
:
980 case sd_standby_state
:
981 sd
->state
= sd_standby_state
;
990 case 4: /* CMD4: SEND_DSR */
994 case sd_standby_state
:
1002 case 5: /* CMD5: reserved for SDIO cards */
1005 case 6: /* CMD6: SWITCH_FUNCTION */
1007 case sd_data_transfer_mode
:
1008 sd_function_switch(sd
, req
.arg
);
1009 sd
->state
= sd_sendingdata_state
;
1011 sd
->data_offset
= 0;
1019 case 7: /* CMD7: SELECT/DESELECT_CARD */
1022 switch (sd
->state
) {
1023 case sd_standby_state
:
1027 sd
->state
= sd_transfer_state
;
1030 case sd_transfer_state
:
1031 case sd_sendingdata_state
:
1035 sd
->state
= sd_standby_state
;
1038 case sd_disconnect_state
:
1042 sd
->state
= sd_programming_state
;
1045 case sd_programming_state
:
1049 sd
->state
= sd_disconnect_state
;
1057 case 8: /* CMD8: SEND_IF_COND */
1058 if (sd
->spec_version
< SD_PHY_SPECv2_00_VERS
) {
1061 if (sd
->state
!= sd_idle_state
) {
1066 /* No response if not exactly one VHS bit is set. */
1067 if (!(req
.arg
>> 8) || (req
.arg
>> (ctz32(req
.arg
& ~0xff) + 1))) {
1068 return sd
->spi
? sd_r7
: sd_r0
;
1075 case 9: /* CMD9: SEND_CSD */
1076 switch (sd
->state
) {
1077 case sd_standby_state
:
1083 case sd_transfer_state
:
1086 sd
->state
= sd_sendingdata_state
;
1087 memcpy(sd
->data
, sd
->csd
, 16);
1088 sd
->data_start
= addr
;
1089 sd
->data_offset
= 0;
1097 case 10: /* CMD10: SEND_CID */
1098 switch (sd
->state
) {
1099 case sd_standby_state
:
1105 case sd_transfer_state
:
1108 sd
->state
= sd_sendingdata_state
;
1109 memcpy(sd
->data
, sd
->cid
, 16);
1110 sd
->data_start
= addr
;
1111 sd
->data_offset
= 0;
1119 case 12: /* CMD12: STOP_TRANSMISSION */
1120 switch (sd
->state
) {
1121 case sd_sendingdata_state
:
1122 sd
->state
= sd_transfer_state
;
1125 case sd_receivingdata_state
:
1126 sd
->state
= sd_programming_state
;
1127 /* Bzzzzzzztt .... Operation complete. */
1128 sd
->state
= sd_transfer_state
;
1136 case 13: /* CMD13: SEND_STATUS */
1138 case sd_data_transfer_mode
:
1149 case 15: /* CMD15: GO_INACTIVE_STATE */
1153 case sd_data_transfer_mode
:
1157 sd
->state
= sd_inactive_state
;
1165 /* Block read commands (Classs 2) */
1166 case 16: /* CMD16: SET_BLOCKLEN */
1167 switch (sd
->state
) {
1168 case sd_transfer_state
:
1169 if (req
.arg
> (1 << HWBLOCK_SHIFT
)) {
1170 sd
->card_status
|= BLOCK_LEN_ERROR
;
1172 trace_sdcard_set_blocklen(req
.arg
);
1173 sd
->blk_len
= req
.arg
;
1183 case 17: /* CMD17: READ_SINGLE_BLOCK */
1184 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1185 switch (sd
->state
) {
1186 case sd_transfer_state
:
1188 if (addr
+ sd
->blk_len
> sd
->size
) {
1189 sd
->card_status
|= ADDRESS_ERROR
;
1193 sd
->state
= sd_sendingdata_state
;
1194 sd
->data_start
= addr
;
1195 sd
->data_offset
= 0;
1203 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
1204 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1207 if (sd
->state
== sd_transfer_state
) {
1208 sd
->state
= sd_sendingdata_state
;
1209 sd
->data_offset
= 0;
1214 case 23: /* CMD23: SET_BLOCK_COUNT */
1215 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1218 switch (sd
->state
) {
1219 case sd_transfer_state
:
1220 sd
->multi_blk_cnt
= req
.arg
;
1228 /* Block write commands (Class 4) */
1229 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1230 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1231 switch (sd
->state
) {
1232 case sd_transfer_state
:
1233 /* Writing in SPI mode not implemented. */
1237 if (addr
+ sd
->blk_len
> sd
->size
) {
1238 sd
->card_status
|= ADDRESS_ERROR
;
1242 sd
->state
= sd_receivingdata_state
;
1243 sd
->data_start
= addr
;
1244 sd
->data_offset
= 0;
1245 sd
->blk_written
= 0;
1247 if (sd_wp_addr(sd
, sd
->data_start
)) {
1248 sd
->card_status
|= WP_VIOLATION
;
1250 if (sd
->csd
[14] & 0x30) {
1251 sd
->card_status
|= WP_VIOLATION
;
1260 case 26: /* CMD26: PROGRAM_CID */
1263 switch (sd
->state
) {
1264 case sd_transfer_state
:
1265 sd
->state
= sd_receivingdata_state
;
1267 sd
->data_offset
= 0;
1275 case 27: /* CMD27: PROGRAM_CSD */
1276 switch (sd
->state
) {
1277 case sd_transfer_state
:
1278 sd
->state
= sd_receivingdata_state
;
1280 sd
->data_offset
= 0;
1288 /* Write protection (Class 6) */
1289 case 28: /* CMD28: SET_WRITE_PROT */
1290 switch (sd
->state
) {
1291 case sd_transfer_state
:
1292 if (addr
>= sd
->size
) {
1293 sd
->card_status
|= ADDRESS_ERROR
;
1297 sd
->state
= sd_programming_state
;
1298 set_bit(sd_addr_to_wpnum(addr
), sd
->wp_groups
);
1299 /* Bzzzzzzztt .... Operation complete. */
1300 sd
->state
= sd_transfer_state
;
1308 case 29: /* CMD29: CLR_WRITE_PROT */
1309 switch (sd
->state
) {
1310 case sd_transfer_state
:
1311 if (addr
>= sd
->size
) {
1312 sd
->card_status
|= ADDRESS_ERROR
;
1316 sd
->state
= sd_programming_state
;
1317 clear_bit(sd_addr_to_wpnum(addr
), sd
->wp_groups
);
1318 /* Bzzzzzzztt .... Operation complete. */
1319 sd
->state
= sd_transfer_state
;
1327 case 30: /* CMD30: SEND_WRITE_PROT */
1328 switch (sd
->state
) {
1329 case sd_transfer_state
:
1330 sd
->state
= sd_sendingdata_state
;
1331 *(uint32_t *) sd
->data
= sd_wpbits(sd
, req
.arg
);
1332 sd
->data_start
= addr
;
1333 sd
->data_offset
= 0;
1341 /* Erase commands (Class 5) */
1342 case 32: /* CMD32: ERASE_WR_BLK_START */
1343 switch (sd
->state
) {
1344 case sd_transfer_state
:
1345 sd
->erase_start
= req
.arg
;
1353 case 33: /* CMD33: ERASE_WR_BLK_END */
1354 switch (sd
->state
) {
1355 case sd_transfer_state
:
1356 sd
->erase_end
= req
.arg
;
1364 case 38: /* CMD38: ERASE */
1365 switch (sd
->state
) {
1366 case sd_transfer_state
:
1367 if (sd
->csd
[14] & 0x30) {
1368 sd
->card_status
|= WP_VIOLATION
;
1372 sd
->state
= sd_programming_state
;
1374 /* Bzzzzzzztt .... Operation complete. */
1375 sd
->state
= sd_transfer_state
;
1383 /* Lock card commands (Class 7) */
1384 case 42: /* CMD42: LOCK_UNLOCK */
1385 switch (sd
->state
) {
1386 case sd_transfer_state
:
1387 sd
->state
= sd_receivingdata_state
;
1389 sd
->data_offset
= 0;
1398 /* CMD52, CMD53, CMD54: reserved for SDIO cards
1399 * (see the SDIO Simplified Specification V2.0)
1400 * Handle as illegal command but do not complain
1401 * on stderr, as some OSes may use these in their
1402 * probing for presence of an SDIO card.
1406 /* Application specific commands (Class 8) */
1407 case 55: /* CMD55: APP_CMD */
1408 switch (sd
->state
) {
1409 case sd_ready_state
:
1410 case sd_identification_state
:
1411 case sd_inactive_state
:
1415 qemu_log_mask(LOG_GUEST_ERROR
,
1416 "SD: illegal RCA 0x%04x for APP_CMD\n", req
.cmd
);
1422 if (sd
->rca
!= rca
) {
1426 sd
->expecting_acmd
= true;
1427 sd
->card_status
|= APP_CMD
;
1430 case 56: /* CMD56: GEN_CMD */
1431 switch (sd
->state
) {
1432 case sd_transfer_state
:
1433 sd
->data_offset
= 0;
1435 sd
->state
= sd_sendingdata_state
;
1437 sd
->state
= sd_receivingdata_state
;
1445 case 58: /* CMD58: READ_OCR (SPI) */
1451 case 59: /* CMD59: CRC_ON_OFF (SPI) */
1459 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Unknown CMD%i\n", req
.cmd
);
1463 qemu_log_mask(LOG_GUEST_ERROR
, "SD: CMD%i in a wrong state\n", req
.cmd
);
1467 static sd_rsp_type_t
sd_app_command(SDState
*sd
,
1470 trace_sdcard_app_command(sd
->proto_name
, sd_acmd_name(req
.cmd
),
1471 req
.cmd
, req
.arg
, sd_state_name(sd
->state
));
1472 sd
->card_status
|= APP_CMD
;
1474 case 6: /* ACMD6: SET_BUS_WIDTH */
1476 goto unimplemented_spi_cmd
;
1478 switch (sd
->state
) {
1479 case sd_transfer_state
:
1480 sd
->sd_status
[0] &= 0x3f;
1481 sd
->sd_status
[0] |= (req
.arg
& 0x03) << 6;
1489 case 13: /* ACMD13: SD_STATUS */
1490 switch (sd
->state
) {
1491 case sd_transfer_state
:
1492 sd
->state
= sd_sendingdata_state
;
1494 sd
->data_offset
= 0;
1502 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1503 switch (sd
->state
) {
1504 case sd_transfer_state
:
1505 *(uint32_t *) sd
->data
= sd
->blk_written
;
1507 sd
->state
= sd_sendingdata_state
;
1509 sd
->data_offset
= 0;
1517 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1518 switch (sd
->state
) {
1519 case sd_transfer_state
:
1527 case 41: /* ACMD41: SD_APP_OP_COND */
1530 sd
->state
= sd_transfer_state
;
1533 if (sd
->state
!= sd_idle_state
) {
1536 /* If it's the first ACMD41 since reset, we need to decide
1537 * whether to power up. If this is not an enquiry ACMD41,
1538 * we immediately report power on and proceed below to the
1539 * ready state, but if it is, we set a timer to model a
1540 * delay for power up. This works around a bug in EDK2
1541 * UEFI, which sends an initial enquiry ACMD41, but
1542 * assumes that the card is in ready state as soon as it
1543 * sees the power up bit set. */
1544 if (!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
)) {
1545 if ((req
.arg
& ACMD41_ENQUIRY_MASK
) != 0) {
1546 timer_del(sd
->ocr_power_timer
);
1549 trace_sdcard_inquiry_cmd41();
1550 if (!timer_pending(sd
->ocr_power_timer
)) {
1551 timer_mod_ns(sd
->ocr_power_timer
,
1552 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
)
1553 + OCR_POWER_DELAY_NS
));
1558 if (FIELD_EX32(sd
->ocr
& req
.arg
, OCR
, VDD_VOLTAGE_WINDOW
)) {
1559 /* We accept any voltage. 10000 V is nothing.
1561 * Once we're powered up, we advance straight to ready state
1562 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1564 sd
->state
= sd_ready_state
;
1569 case 42: /* ACMD42: SET_CLR_CARD_DETECT */
1570 switch (sd
->state
) {
1571 case sd_transfer_state
:
1572 /* Bringing in the 50KOhm pull-up resistor... Done. */
1580 case 51: /* ACMD51: SEND_SCR */
1581 switch (sd
->state
) {
1582 case sd_transfer_state
:
1583 sd
->state
= sd_sendingdata_state
;
1585 sd
->data_offset
= 0;
1593 case 18: /* Reserved for SD security applications */
1598 /* Refer to the "SD Specifications Part3 Security Specification" for
1599 * information about the SD Security Features.
1601 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i Security not implemented\n",
1606 /* Fall back to standard commands. */
1607 return sd_normal_command(sd
, req
);
1609 unimplemented_spi_cmd
:
1610 /* Commands that are recognised but not yet implemented in SPI mode. */
1611 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i not implemented in SPI mode\n",
1616 qemu_log_mask(LOG_GUEST_ERROR
, "SD: ACMD%i in a wrong state\n", req
.cmd
);
1620 static int cmd_valid_while_locked(SDState
*sd
, const uint8_t cmd
)
1622 /* Valid commands in locked state:
1624 * lock card class (7)
1626 * implicitly, the ACMD prefix CMD55
1628 * Anything else provokes an "illegal command" response.
1630 if (sd
->expecting_acmd
) {
1631 return cmd
== 41 || cmd
== 42;
1633 if (cmd
== 16 || cmd
== 55) {
1636 return sd_cmd_class
[cmd
] == 0 || sd_cmd_class
[cmd
] == 7;
1639 int sd_do_command(SDState
*sd
, SDRequest
*req
,
1640 uint8_t *response
) {
1642 sd_rsp_type_t rtype
;
1645 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
) {
1649 if (sd_req_crc_validate(req
)) {
1650 sd
->card_status
|= COM_CRC_ERROR
;
1655 if (req
->cmd
>= SDMMC_CMD_MAX
) {
1656 qemu_log_mask(LOG_GUEST_ERROR
, "SD: incorrect command 0x%02x\n",
1661 if (sd
->card_status
& CARD_IS_LOCKED
) {
1662 if (!cmd_valid_while_locked(sd
, req
->cmd
)) {
1663 sd
->card_status
|= ILLEGAL_COMMAND
;
1664 sd
->expecting_acmd
= false;
1665 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Card is locked\n");
1671 last_state
= sd
->state
;
1674 if (sd
->expecting_acmd
) {
1675 sd
->expecting_acmd
= false;
1676 rtype
= sd_app_command(sd
, *req
);
1678 rtype
= sd_normal_command(sd
, *req
);
1681 if (rtype
== sd_illegal
) {
1682 sd
->card_status
|= ILLEGAL_COMMAND
;
1684 /* Valid command, we can update the 'state before command' bits.
1685 * (Do this now so they appear in r1 responses.)
1687 sd
->current_cmd
= req
->cmd
;
1688 sd
->card_status
&= ~CURRENT_STATE
;
1689 sd
->card_status
|= (last_state
<< 9);
1696 sd_response_r1_make(sd
, response
);
1701 memcpy(response
, sd
->cid
, sizeof(sd
->cid
));
1706 memcpy(response
, sd
->csd
, sizeof(sd
->csd
));
1711 sd_response_r3_make(sd
, response
);
1716 sd_response_r6_make(sd
, response
);
1721 sd_response_r7_make(sd
, response
);
1730 g_assert_not_reached();
1732 trace_sdcard_response(sd_response_name(rtype
), rsplen
);
1734 if (rtype
!= sd_illegal
) {
1735 /* Clear the "clear on valid command" status bits now we've
1738 sd
->card_status
&= ~CARD_STATUS_B
;
1742 qemu_hexdump(stderr
, "Response", response
, rsplen
);
1748 static void sd_blk_read(SDState
*sd
, uint64_t addr
, uint32_t len
)
1750 trace_sdcard_read_block(addr
, len
);
1751 if (!sd
->blk
|| blk_pread(sd
->blk
, addr
, sd
->data
, len
) < 0) {
1752 fprintf(stderr
, "sd_blk_read: read error on host side\n");
1756 static void sd_blk_write(SDState
*sd
, uint64_t addr
, uint32_t len
)
1758 trace_sdcard_write_block(addr
, len
);
1759 if (!sd
->blk
|| blk_pwrite(sd
->blk
, addr
, sd
->data
, len
, 0) < 0) {
1760 fprintf(stderr
, "sd_blk_write: write error on host side\n");
1764 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len)
1765 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
1766 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
1767 #define APP_WRITE_BLOCK(a, len)
1769 void sd_write_byte(SDState
*sd
, uint8_t value
)
1773 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
1776 if (sd
->state
!= sd_receivingdata_state
) {
1777 qemu_log_mask(LOG_GUEST_ERROR
,
1778 "%s: not in Receiving-Data state\n", __func__
);
1782 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
1785 trace_sdcard_write_data(sd
->proto_name
,
1786 sd_acmd_name(sd
->current_cmd
),
1787 sd
->current_cmd
, value
);
1788 switch (sd
->current_cmd
) {
1789 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1790 sd
->data
[sd
->data_offset
++] = value
;
1791 if (sd
->data_offset
>= sd
->blk_len
) {
1792 /* TODO: Check CRC before committing */
1793 sd
->state
= sd_programming_state
;
1794 BLK_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1796 sd
->csd
[14] |= 0x40;
1797 /* Bzzzzzzztt .... Operation complete. */
1798 sd
->state
= sd_transfer_state
;
1802 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1803 if (sd
->data_offset
== 0) {
1804 /* Start of the block - let's check the address is valid */
1805 if (sd
->data_start
+ sd
->blk_len
> sd
->size
) {
1806 sd
->card_status
|= ADDRESS_ERROR
;
1809 if (sd_wp_addr(sd
, sd
->data_start
)) {
1810 sd
->card_status
|= WP_VIOLATION
;
1814 sd
->data
[sd
->data_offset
++] = value
;
1815 if (sd
->data_offset
>= sd
->blk_len
) {
1816 /* TODO: Check CRC before committing */
1817 sd
->state
= sd_programming_state
;
1818 BLK_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1820 sd
->data_start
+= sd
->blk_len
;
1821 sd
->data_offset
= 0;
1822 sd
->csd
[14] |= 0x40;
1824 /* Bzzzzzzztt .... Operation complete. */
1825 if (sd
->multi_blk_cnt
!= 0) {
1826 if (--sd
->multi_blk_cnt
== 0) {
1828 sd
->state
= sd_transfer_state
;
1833 sd
->state
= sd_receivingdata_state
;
1837 case 26: /* CMD26: PROGRAM_CID */
1838 sd
->data
[sd
->data_offset
++] = value
;
1839 if (sd
->data_offset
>= sizeof(sd
->cid
)) {
1840 /* TODO: Check CRC before committing */
1841 sd
->state
= sd_programming_state
;
1842 for (i
= 0; i
< sizeof(sd
->cid
); i
++)
1843 if ((sd
->cid
[i
] | 0x00) != sd
->data
[i
])
1844 sd
->card_status
|= CID_CSD_OVERWRITE
;
1846 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
1847 for (i
= 0; i
< sizeof(sd
->cid
); i
++) {
1849 sd
->cid
[i
] &= sd
->data
[i
];
1851 /* Bzzzzzzztt .... Operation complete. */
1852 sd
->state
= sd_transfer_state
;
1856 case 27: /* CMD27: PROGRAM_CSD */
1857 sd
->data
[sd
->data_offset
++] = value
;
1858 if (sd
->data_offset
>= sizeof(sd
->csd
)) {
1859 /* TODO: Check CRC before committing */
1860 sd
->state
= sd_programming_state
;
1861 for (i
= 0; i
< sizeof(sd
->csd
); i
++)
1862 if ((sd
->csd
[i
] | sd_csd_rw_mask
[i
]) !=
1863 (sd
->data
[i
] | sd_csd_rw_mask
[i
]))
1864 sd
->card_status
|= CID_CSD_OVERWRITE
;
1866 /* Copy flag (OTP) & Permanent write protect */
1867 if (sd
->csd
[14] & ~sd
->data
[14] & 0x60)
1868 sd
->card_status
|= CID_CSD_OVERWRITE
;
1870 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
1871 for (i
= 0; i
< sizeof(sd
->csd
); i
++) {
1872 sd
->csd
[i
] |= sd_csd_rw_mask
[i
];
1873 sd
->csd
[i
] &= sd
->data
[i
];
1875 /* Bzzzzzzztt .... Operation complete. */
1876 sd
->state
= sd_transfer_state
;
1880 case 42: /* CMD42: LOCK_UNLOCK */
1881 sd
->data
[sd
->data_offset
++] = value
;
1882 if (sd
->data_offset
>= sd
->blk_len
) {
1883 /* TODO: Check CRC before committing */
1884 sd
->state
= sd_programming_state
;
1885 sd_lock_command(sd
);
1886 /* Bzzzzzzztt .... Operation complete. */
1887 sd
->state
= sd_transfer_state
;
1891 case 56: /* CMD56: GEN_CMD */
1892 sd
->data
[sd
->data_offset
++] = value
;
1893 if (sd
->data_offset
>= sd
->blk_len
) {
1894 APP_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1895 sd
->state
= sd_transfer_state
;
1900 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
1905 #define SD_TUNING_BLOCK_SIZE 64
1907 static const uint8_t sd_tuning_block_pattern
[SD_TUNING_BLOCK_SIZE
] = {
1908 /* See: Physical Layer Simplified Specification Version 3.01, Table 4-2 */
1909 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
1910 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
1911 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
1912 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
1913 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
1914 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
1915 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
1916 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde,
1919 uint8_t sd_read_byte(SDState
*sd
)
1921 /* TODO: Append CRCs */
1925 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
1928 if (sd
->state
!= sd_sendingdata_state
) {
1929 qemu_log_mask(LOG_GUEST_ERROR
,
1930 "%s: not in Sending-Data state\n", __func__
);
1934 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
1937 io_len
= (sd
->ocr
& (1 << 30)) ? 512 : sd
->blk_len
;
1939 trace_sdcard_read_data(sd
->proto_name
,
1940 sd_acmd_name(sd
->current_cmd
),
1941 sd
->current_cmd
, io_len
);
1942 switch (sd
->current_cmd
) {
1943 case 6: /* CMD6: SWITCH_FUNCTION */
1944 ret
= sd
->data
[sd
->data_offset
++];
1946 if (sd
->data_offset
>= 64)
1947 sd
->state
= sd_transfer_state
;
1950 case 9: /* CMD9: SEND_CSD */
1951 case 10: /* CMD10: SEND_CID */
1952 ret
= sd
->data
[sd
->data_offset
++];
1954 if (sd
->data_offset
>= 16)
1955 sd
->state
= sd_transfer_state
;
1958 case 13: /* ACMD13: SD_STATUS */
1959 ret
= sd
->sd_status
[sd
->data_offset
++];
1961 if (sd
->data_offset
>= sizeof(sd
->sd_status
))
1962 sd
->state
= sd_transfer_state
;
1965 case 17: /* CMD17: READ_SINGLE_BLOCK */
1966 if (sd
->data_offset
== 0)
1967 BLK_READ_BLOCK(sd
->data_start
, io_len
);
1968 ret
= sd
->data
[sd
->data_offset
++];
1970 if (sd
->data_offset
>= io_len
)
1971 sd
->state
= sd_transfer_state
;
1974 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1975 if (sd
->data_offset
== 0) {
1976 if (sd
->data_start
+ io_len
> sd
->size
) {
1977 sd
->card_status
|= ADDRESS_ERROR
;
1980 BLK_READ_BLOCK(sd
->data_start
, io_len
);
1982 ret
= sd
->data
[sd
->data_offset
++];
1984 if (sd
->data_offset
>= io_len
) {
1985 sd
->data_start
+= io_len
;
1986 sd
->data_offset
= 0;
1988 if (sd
->multi_blk_cnt
!= 0) {
1989 if (--sd
->multi_blk_cnt
== 0) {
1991 sd
->state
= sd_transfer_state
;
1998 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
1999 if (sd
->data_offset
>= SD_TUNING_BLOCK_SIZE
- 1) {
2000 sd
->state
= sd_transfer_state
;
2002 ret
= sd_tuning_block_pattern
[sd
->data_offset
++];
2005 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2006 ret
= sd
->data
[sd
->data_offset
++];
2008 if (sd
->data_offset
>= 4)
2009 sd
->state
= sd_transfer_state
;
2012 case 30: /* CMD30: SEND_WRITE_PROT */
2013 ret
= sd
->data
[sd
->data_offset
++];
2015 if (sd
->data_offset
>= 4)
2016 sd
->state
= sd_transfer_state
;
2019 case 51: /* ACMD51: SEND_SCR */
2020 ret
= sd
->scr
[sd
->data_offset
++];
2022 if (sd
->data_offset
>= sizeof(sd
->scr
))
2023 sd
->state
= sd_transfer_state
;
2026 case 56: /* CMD56: GEN_CMD */
2027 if (sd
->data_offset
== 0)
2028 APP_READ_BLOCK(sd
->data_start
, sd
->blk_len
);
2029 ret
= sd
->data
[sd
->data_offset
++];
2031 if (sd
->data_offset
>= sd
->blk_len
)
2032 sd
->state
= sd_transfer_state
;
2036 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
2043 static bool sd_data_ready(SDState
*sd
)
2045 return sd
->state
== sd_sendingdata_state
;
2048 void sd_enable(SDState
*sd
, bool enable
)
2050 sd
->enable
= enable
;
2053 static void sd_instance_init(Object
*obj
)
2055 SDState
*sd
= SD_CARD(obj
);
2058 sd
->ocr_power_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, sd_ocr_powerup
, sd
);
2061 static void sd_instance_finalize(Object
*obj
)
2063 SDState
*sd
= SD_CARD(obj
);
2065 timer_free(sd
->ocr_power_timer
);
2068 static void sd_realize(DeviceState
*dev
, Error
**errp
)
2070 SDState
*sd
= SD_CARD(dev
);
2073 sd
->proto_name
= sd
->spi
? "SPI" : "SD";
2075 switch (sd
->spec_version
) {
2076 case SD_PHY_SPECv1_10_VERS
2077 ... SD_PHY_SPECv3_01_VERS
:
2080 error_setg(errp
, "Invalid SD card Spec version: %u", sd
->spec_version
);
2087 if (!blk_supports_write_perm(sd
->blk
)) {
2088 error_setg(errp
, "Cannot use read-only drive as SD card");
2092 blk_size
= blk_getlength(sd
->blk
);
2093 if (blk_size
> 0 && !is_power_of_2(blk_size
)) {
2094 int64_t blk_size_aligned
= pow2ceil(blk_size
);
2097 blk_size_str
= size_to_str(blk_size
);
2098 error_setg(errp
, "Invalid SD card size: %s", blk_size_str
);
2099 g_free(blk_size_str
);
2101 blk_size_str
= size_to_str(blk_size_aligned
);
2102 error_append_hint(errp
,
2103 "SD card size has to be a power of 2, e.g. %s.\n"
2104 "You can resize disk images with"
2105 " 'qemu-img resize <imagefile> <new-size>'\n"
2106 "(note that this will lose data if you make the"
2107 " image smaller than it currently is).\n",
2109 g_free(blk_size_str
);
2114 ret
= blk_set_perm(sd
->blk
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE
,
2115 BLK_PERM_ALL
, errp
);
2119 blk_set_dev_ops(sd
->blk
, &sd_block_ops
, sd
);
2123 static Property sd_properties
[] = {
2124 DEFINE_PROP_UINT8("spec_version", SDState
,
2125 spec_version
, SD_PHY_SPECv2_00_VERS
),
2126 DEFINE_PROP_DRIVE("drive", SDState
, blk
),
2127 /* We do not model the chip select pin, so allow the board to select
2128 * whether card should be in SSI or MMC/SD mode. It is also up to the
2129 * board to ensure that ssi transfers only occur when the chip select
2131 DEFINE_PROP_BOOL("spi", SDState
, spi
, false),
2132 DEFINE_PROP_END_OF_LIST()
2135 static void sd_class_init(ObjectClass
*klass
, void *data
)
2137 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2138 SDCardClass
*sc
= SD_CARD_CLASS(klass
);
2140 dc
->realize
= sd_realize
;
2141 device_class_set_props(dc
, sd_properties
);
2142 dc
->vmsd
= &sd_vmstate
;
2143 dc
->reset
= sd_reset
;
2144 dc
->bus_type
= TYPE_SD_BUS
;
2145 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
2147 sc
->set_voltage
= sd_set_voltage
;
2148 sc
->get_dat_lines
= sd_get_dat_lines
;
2149 sc
->get_cmd_line
= sd_get_cmd_line
;
2150 sc
->do_command
= sd_do_command
;
2151 sc
->write_byte
= sd_write_byte
;
2152 sc
->read_byte
= sd_read_byte
;
2153 sc
->data_ready
= sd_data_ready
;
2154 sc
->enable
= sd_enable
;
2155 sc
->get_inserted
= sd_get_inserted
;
2156 sc
->get_readonly
= sd_get_readonly
;
2159 static const TypeInfo sd_info
= {
2160 .name
= TYPE_SD_CARD
,
2161 .parent
= TYPE_DEVICE
,
2162 .instance_size
= sizeof(SDState
),
2163 .class_size
= sizeof(SDCardClass
),
2164 .class_init
= sd_class_init
,
2165 .instance_init
= sd_instance_init
,
2166 .instance_finalize
= sd_instance_finalize
,
2169 static void sd_register_types(void)
2171 type_register_static(&sd_info
);
2174 type_init(sd_register_types
)