?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
include/qemu/osdep.h: Don't include qapi/error.h
[qemu/ar7.git] / hw / sd / sd.c
blobb66e5d2dba20188b77d88b65cb17770861c3549c
1 /*
2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 1.10."
4 *
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include "qemu/osdep.h"
33 #include "hw/qdev.h"
34 #include "hw/hw.h"
35 #include "sysemu/block-backend.h"
36 #include "hw/sd/sd.h"
37 #include "qapi/error.h"
38 #include "qemu/bitmap.h"
39 #include "hw/qdev-properties.h"
40 #include "qemu/error-report.h"
41 #include "qemu/timer.h"
42
43 //#define DEBUG_SD 1
44
45 #ifdef DEBUG_SD
46 #define DPRINTF(fmt, ...) \
47 do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
48 #else
49 #define DPRINTF(fmt, ...) do {} while(0)
50 #endif
51
52 #define ACMD41_ENQUIRY_MASK 0x00ffffff
53 #define OCR_POWER_UP 0x80000000
54 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
55
56 typedef enum {
57 sd_r0 = 0, /* no response */
58 sd_r1, /* normal response command */
59 sd_r2_i, /* CID register */
60 sd_r2_s, /* CSD register */
61 sd_r3, /* OCR register */
62 sd_r6 = 6, /* Published RCA response */
63 sd_r7, /* Operating voltage */
64 sd_r1b = -1,
65 sd_illegal = -2,
66 } sd_rsp_type_t;
67
68 enum SDCardModes {
69 sd_inactive,
70 sd_card_identification_mode,
71 sd_data_transfer_mode,
72 };
73
74 enum SDCardStates {
75 sd_inactive_state = -1,
76 sd_idle_state = 0,
77 sd_ready_state,
78 sd_identification_state,
79 sd_standby_state,
80 sd_transfer_state,
81 sd_sendingdata_state,
82 sd_receivingdata_state,
83 sd_programming_state,
84 sd_disconnect_state,
85 };
86
87 struct SDState {
88 DeviceState parent_obj;
89
90 uint32_t mode; /* current card mode, one of SDCardModes */
91 int32_t state; /* current card state, one of SDCardStates */
92 uint32_t ocr;
93 QEMUTimer *ocr_power_timer;
94 uint8_t scr[8];
95 uint8_t cid[16];
96 uint8_t csd[16];
97 uint16_t rca;
98 uint32_t card_status;
99 uint8_t sd_status[64];
100 uint32_t vhs;
101 bool wp_switch;
102 unsigned long *wp_groups;
103 int32_t wpgrps_size;
104 uint64_t size;
105 uint32_t blk_len;
106 uint32_t multi_blk_cnt;
107 uint32_t erase_start;
108 uint32_t erase_end;
109 uint8_t pwd[16];
110 uint32_t pwd_len;
111 uint8_t function_group[6];
112
113 bool spi;
114 uint8_t current_cmd;
115 /* True if we will handle the next command as an ACMD. Note that this does
116 * *not* track the APP_CMD status bit!
117 */
118 bool expecting_acmd;
119 uint32_t blk_written;
120 uint64_t data_start;
121 uint32_t data_offset;
122 uint8_t data[512];
123 qemu_irq readonly_cb;
124 qemu_irq inserted_cb;
125 BlockBackend *blk;
126 uint8_t *buf;
127
128 bool enable;
129 };
130
131 static void sd_set_mode(SDState *sd)
132 {
133 switch (sd->state) {
134 case sd_inactive_state:
135 sd->mode = sd_inactive;
136 break;
137
138 case sd_idle_state:
139 case sd_ready_state:
140 case sd_identification_state:
141 sd->mode = sd_card_identification_mode;
142 break;
143
144 case sd_standby_state:
145 case sd_transfer_state:
146 case sd_sendingdata_state:
147 case sd_receivingdata_state:
148 case sd_programming_state:
149 case sd_disconnect_state:
150 sd->mode = sd_data_transfer_mode;
151 break;
152 }
153 }
154
155 static const sd_cmd_type_t sd_cmd_type[64] = {
156 sd_bc, sd_none, sd_bcr, sd_bcr, sd_none, sd_none, sd_none, sd_ac,
157 sd_bcr, sd_ac, sd_ac, sd_adtc, sd_ac, sd_ac, sd_none, sd_ac,
158 sd_ac, sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
159 sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac, sd_ac, sd_adtc, sd_none,
160 sd_ac, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none,
161 sd_none, sd_none, sd_bc, sd_none, sd_none, sd_none, sd_none, sd_none,
162 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
163 sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
164 };
165
166 static const int sd_cmd_class[64] = {
167 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0,
168 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6,
169 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7,
170 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8,
171 };
172
173 static uint8_t sd_crc7(void *message, size_t width)
174 {
175 int i, bit;
176 uint8_t shift_reg = 0x00;
177 uint8_t *msg = (uint8_t *) message;
178
179 for (i = 0; i < width; i ++, msg ++)
180 for (bit = 7; bit >= 0; bit --) {
181 shift_reg <<= 1;
182 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
183 shift_reg ^= 0x89;
184 }
185
186 return shift_reg;
187 }
188
189 static uint16_t sd_crc16(void *message, size_t width)
190 {
191 int i, bit;
192 uint16_t shift_reg = 0x0000;
193 uint16_t *msg = (uint16_t *) message;
194 width <<= 1;
195
196 for (i = 0; i < width; i ++, msg ++)
197 for (bit = 15; bit >= 0; bit --) {
198 shift_reg <<= 1;
199 if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
200 shift_reg ^= 0x1011;
201 }
202
203 return shift_reg;
204 }
205
206 static void sd_set_ocr(SDState *sd)
207 {
208 /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
209 sd->ocr = 0x00ffff00;
210 }
211
212 static void sd_ocr_powerup(void *opaque)
213 {
214 SDState *sd = opaque;
215
216 /* Set powered up bit in OCR */
217 assert(!(sd->ocr & OCR_POWER_UP));
218 sd->ocr |= OCR_POWER_UP;
219 }
220
221 static void sd_set_scr(SDState *sd)
222 {
223 sd->scr[0] = 0x00; /* SCR Structure */
224 sd->scr[1] = 0x2f; /* SD Security Support */
225 sd->scr[2] = 0x00;
226 sd->scr[3] = 0x00;
227 sd->scr[4] = 0x00;
228 sd->scr[5] = 0x00;
229 sd->scr[6] = 0x00;
230 sd->scr[7] = 0x00;
231 }
232
233 #define MID 0xaa
234 #define OID "XY"
235 #define PNM "QEMU!"
236 #define PRV 0x01
237 #define MDT_YR 2006
238 #define MDT_MON 2
239
240 static void sd_set_cid(SDState *sd)
241 {
242 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
243 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
244 sd->cid[2] = OID[1];
245 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
246 sd->cid[4] = PNM[1];
247 sd->cid[5] = PNM[2];
248 sd->cid[6] = PNM[3];
249 sd->cid[7] = PNM[4];
250 sd->cid[8] = PRV; /* Fake product revision (PRV) */
251 sd->cid[9] = 0xde; /* Fake serial number (PSN) */
252 sd->cid[10] = 0xad;
253 sd->cid[11] = 0xbe;
254 sd->cid[12] = 0xef;
255 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */
256 ((MDT_YR - 2000) / 10);
257 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
258 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
259 }
260
261 #define HWBLOCK_SHIFT 9 /* 512 bytes */
262 #define SECTOR_SHIFT 5 /* 16 kilobytes */
263 #define WPGROUP_SHIFT 7 /* 2 megs */
264 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
265 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
266
267 static const uint8_t sd_csd_rw_mask[16] = {
268 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
269 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
270 };
271
272 static void sd_set_csd(SDState *sd, uint64_t size)
273 {
274 uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
275 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
276 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
277
278 if (size <= 0x40000000) { /* Standard Capacity SD */
279 sd->csd[0] = 0x00; /* CSD structure */
280 sd->csd[1] = 0x26; /* Data read access-time-1 */
281 sd->csd[2] = 0x00; /* Data read access-time-2 */
282 sd->csd[3] = 0x5a; /* Max. data transfer rate */
283 sd->csd[4] = 0x5f; /* Card Command Classes */
284 sd->csd[5] = 0x50 | /* Max. read data block length */
285 HWBLOCK_SHIFT;
286 sd->csd[6] = 0xe0 | /* Partial block for read allowed */
287 ((csize >> 10) & 0x03);
288 sd->csd[7] = 0x00 | /* Device size */
289 ((csize >> 2) & 0xff);
290 sd->csd[8] = 0x3f | /* Max. read current */
291 ((csize << 6) & 0xc0);
292 sd->csd[9] = 0xfc | /* Max. write current */
293 ((CMULT_SHIFT - 2) >> 1);
294 sd->csd[10] = 0x40 | /* Erase sector size */
295 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
296 sd->csd[11] = 0x00 | /* Write protect group size */
297 ((sectsize << 7) & 0x80) | wpsize;
298 sd->csd[12] = 0x90 | /* Write speed factor */
299 (HWBLOCK_SHIFT >> 2);
300 sd->csd[13] = 0x20 | /* Max. write data block length */
301 ((HWBLOCK_SHIFT << 6) & 0xc0);
302 sd->csd[14] = 0x00; /* File format group */
303 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
304 } else { /* SDHC */
305 size /= 512 * 1024;
306 size -= 1;
307 sd->csd[0] = 0x40;
308 sd->csd[1] = 0x0e;
309 sd->csd[2] = 0x00;
310 sd->csd[3] = 0x32;
311 sd->csd[4] = 0x5b;
312 sd->csd[5] = 0x59;
313 sd->csd[6] = 0x00;
314 sd->csd[7] = (size >> 16) & 0xff;
315 sd->csd[8] = (size >> 8) & 0xff;
316 sd->csd[9] = (size & 0xff);
317 sd->csd[10] = 0x7f;
318 sd->csd[11] = 0x80;
319 sd->csd[12] = 0x0a;
320 sd->csd[13] = 0x40;
321 sd->csd[14] = 0x00;
322 sd->csd[15] = 0x00;
323 sd->ocr |= 1 << 30; /* High Capacity SD Memory Card */
324 }
325 }
326
327 static void sd_set_rca(SDState *sd)
328 {
329 sd->rca += 0x4567;
330 }
331
332 /* Card status bits, split by clear condition:
333 * A : According to the card current state
334 * B : Always related to the previous command
335 * C : Cleared by read
336 */
337 #define CARD_STATUS_A 0x02004100
338 #define CARD_STATUS_B 0x00c01e00
339 #define CARD_STATUS_C 0xfd39a028
340
341 static void sd_set_cardstatus(SDState *sd)
342 {
343 sd->card_status = 0x00000100;
344 }
345
346 static void sd_set_sdstatus(SDState *sd)
347 {
348 memset(sd->sd_status, 0, 64);
349 }
350
351 static int sd_req_crc_validate(SDRequest *req)
352 {
353 uint8_t buffer[5];
354 buffer[0] = 0x40 | req->cmd;
355 buffer[1] = (req->arg >> 24) & 0xff;
356 buffer[2] = (req->arg >> 16) & 0xff;
357 buffer[3] = (req->arg >> 8) & 0xff;
358 buffer[4] = (req->arg >> 0) & 0xff;
359 return 0;
360 return sd_crc7(buffer, 5) != req->crc; /* TODO */
361 }
362
363 static void sd_response_r1_make(SDState *sd, uint8_t *response)
364 {
365 uint32_t status = sd->card_status;
366 /* Clear the "clear on read" status bits */
367 sd->card_status &= ~CARD_STATUS_C;
368
369 response[0] = (status >> 24) & 0xff;
370 response[1] = (status >> 16) & 0xff;
371 response[2] = (status >> 8) & 0xff;
372 response[3] = (status >> 0) & 0xff;
373 }
374
375 static void sd_response_r3_make(SDState *sd, uint8_t *response)
376 {
377 response[0] = (sd->ocr >> 24) & 0xff;
378 response[1] = (sd->ocr >> 16) & 0xff;
379 response[2] = (sd->ocr >> 8) & 0xff;
380 response[3] = (sd->ocr >> 0) & 0xff;
381 }
382
383 static void sd_response_r6_make(SDState *sd, uint8_t *response)
384 {
385 uint16_t arg;
386 uint16_t status;
387
388 arg = sd->rca;
389 status = ((sd->card_status >> 8) & 0xc000) |
390 ((sd->card_status >> 6) & 0x2000) |
391 (sd->card_status & 0x1fff);
392 sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
393
394 response[0] = (arg >> 8) & 0xff;
395 response[1] = arg & 0xff;
396 response[2] = (status >> 8) & 0xff;
397 response[3] = status & 0xff;
398 }
399
400 static void sd_response_r7_make(SDState *sd, uint8_t *response)
401 {
402 response[0] = (sd->vhs >> 24) & 0xff;
403 response[1] = (sd->vhs >> 16) & 0xff;
404 response[2] = (sd->vhs >> 8) & 0xff;
405 response[3] = (sd->vhs >> 0) & 0xff;
406 }
407
408 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
409 {
410 return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
411 }
412
413 static void sd_reset(DeviceState *dev)
414 {
415 SDState *sd = SD_CARD(dev);
416 uint64_t size;
417 uint64_t sect;
418
419 if (sd->blk) {
420 blk_get_geometry(sd->blk, &sect);
421 } else {
422 sect = 0;
423 }
424 size = sect << 9;
425
426 sect = sd_addr_to_wpnum(size) + 1;
427
428 sd->state = sd_idle_state;
429 sd->rca = 0x0000;
430 sd_set_ocr(sd);
431 sd_set_scr(sd);
432 sd_set_cid(sd);
433 sd_set_csd(sd, size);
434 sd_set_cardstatus(sd);
435 sd_set_sdstatus(sd);
436
437 g_free(sd->wp_groups);
438 sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;
439 sd->wpgrps_size = sect;
440 sd->wp_groups = bitmap_new(sd->wpgrps_size);
441 memset(sd->function_group, 0, sizeof(sd->function_group));
442 sd->erase_start = 0;
443 sd->erase_end = 0;
444 sd->size = size;
445 sd->blk_len = 0x200;
446 sd->pwd_len = 0;
447 sd->expecting_acmd = false;
448 sd->multi_blk_cnt = 0;
449 }
450
451 static bool sd_get_inserted(SDState *sd)
452 {
453 return sd->blk && blk_is_inserted(sd->blk);
454 }
455
456 static bool sd_get_readonly(SDState *sd)
457 {
458 return sd->wp_switch;
459 }
460
461 static void sd_cardchange(void *opaque, bool load)
462 {
463 SDState *sd = opaque;
464 DeviceState *dev = DEVICE(sd);
465 SDBus *sdbus = SD_BUS(qdev_get_parent_bus(dev));
466 bool inserted = sd_get_inserted(sd);
467 bool readonly = sd_get_readonly(sd);
468
469 if (inserted) {
470 sd_reset(dev);
471 }
472
473 /* The IRQ notification is for legacy non-QOM SD controller devices;
474 * QOMified controllers use the SDBus APIs.
475 */
476 if (sdbus) {
477 sdbus_set_inserted(sdbus, inserted);
478 if (inserted) {
479 sdbus_set_readonly(sdbus, readonly);
480 }
481 } else {
482 qemu_set_irq(sd->inserted_cb, inserted);
483 if (inserted) {
484 qemu_set_irq(sd->readonly_cb, readonly);
485 }
486 }
487 }
488
489 static const BlockDevOps sd_block_ops = {
490 .change_media_cb = sd_cardchange,
491 };
492
493 static bool sd_ocr_vmstate_needed(void *opaque)
494 {
495 SDState *sd = opaque;
496
497 /* Include the OCR state (and timer) if it is not yet powered up */
498 return !(sd->ocr & OCR_POWER_UP);
499 }
500
501 static const VMStateDescription sd_ocr_vmstate = {
502 .name = "sd-card/ocr-state",
503 .version_id = 1,
504 .minimum_version_id = 1,
505 .needed = sd_ocr_vmstate_needed,
506 .fields = (VMStateField[]) {
507 VMSTATE_UINT32(ocr, SDState),
508 VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
509 VMSTATE_END_OF_LIST()
510 },
511 };
512
513 static int sd_vmstate_pre_load(void *opaque)
514 {
515 SDState *sd = opaque;
516
517 /* If the OCR state is not included (prior versions, or not
518 * needed), then the OCR must be set as powered up. If the OCR state
519 * is included, this will be replaced by the state restore.
520 */
521 sd_ocr_powerup(sd);
522
523 return 0;
524 }
525
526 static const VMStateDescription sd_vmstate = {
527 .name = "sd-card",
528 .version_id = 1,
529 .minimum_version_id = 1,
530 .pre_load = sd_vmstate_pre_load,
531 .fields = (VMStateField[]) {
532 VMSTATE_UINT32(mode, SDState),
533 VMSTATE_INT32(state, SDState),
534 VMSTATE_UINT8_ARRAY(cid, SDState, 16),
535 VMSTATE_UINT8_ARRAY(csd, SDState, 16),
536 VMSTATE_UINT16(rca, SDState),
537 VMSTATE_UINT32(card_status, SDState),
538 VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
539 VMSTATE_UINT32(vhs, SDState),
540 VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size),
541 VMSTATE_UINT32(blk_len, SDState),
542 VMSTATE_UINT32(multi_blk_cnt, SDState),
543 VMSTATE_UINT32(erase_start, SDState),
544 VMSTATE_UINT32(erase_end, SDState),
545 VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
546 VMSTATE_UINT32(pwd_len, SDState),
547 VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
548 VMSTATE_UINT8(current_cmd, SDState),
549 VMSTATE_BOOL(expecting_acmd, SDState),
550 VMSTATE_UINT32(blk_written, SDState),
551 VMSTATE_UINT64(data_start, SDState),
552 VMSTATE_UINT32(data_offset, SDState),
553 VMSTATE_UINT8_ARRAY(data, SDState, 512),
554 VMSTATE_BUFFER_POINTER_UNSAFE(buf, SDState, 1, 512),
555 VMSTATE_BOOL(enable, SDState),
556 VMSTATE_END_OF_LIST()
557 },
558 .subsections = (const VMStateDescription*[]) {
559 &sd_ocr_vmstate,
560 NULL
561 },
562 };
563
564 /* Legacy initialization function for use by non-qdevified callers */
565 SDState *sd_init(BlockBackend *blk, bool is_spi)
566 {
567 Object *obj;
568 DeviceState *dev;
569 Error *err = NULL;
570
571 obj = object_new(TYPE_SD_CARD);
572 dev = DEVICE(obj);
573 qdev_prop_set_drive(dev, "drive", blk, &err);
574 if (err) {
575 error_report("sd_init failed: %s", error_get_pretty(err));
576 return NULL;
577 }
578 qdev_prop_set_bit(dev, "spi", is_spi);
579 object_property_set_bool(obj, true, "realized", &err);
580 if (err) {
581 error_report("sd_init failed: %s", error_get_pretty(err));
582 return NULL;
583 }
584
585 return SD_CARD(dev);
586 }
587
588 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
589 {
590 sd->readonly_cb = readonly;
591 sd->inserted_cb = insert;
592 qemu_set_irq(readonly, sd->blk ? blk_is_read_only(sd->blk) : 0);
593 qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
594 }
595
596 static void sd_erase(SDState *sd)
597 {
598 int i;
599 uint64_t erase_start = sd->erase_start;
600 uint64_t erase_end = sd->erase_end;
601
602 if (!sd->erase_start || !sd->erase_end) {
603 sd->card_status |= ERASE_SEQ_ERROR;
604 return;
605 }
606
607 if (extract32(sd->ocr, OCR_CCS_BITN, 1)) {
608 /* High capacity memory card: erase units are 512 byte blocks */
609 erase_start *= 512;
610 erase_end *= 512;
611 }
612
613 erase_start = sd_addr_to_wpnum(erase_start);
614 erase_end = sd_addr_to_wpnum(erase_end);
615 sd->erase_start = 0;
616 sd->erase_end = 0;
617 sd->csd[14] |= 0x40;
618
619 for (i = erase_start; i <= erase_end; i++) {
620 if (test_bit(i, sd->wp_groups)) {
621 sd->card_status |= WP_ERASE_SKIP;
622 }
623 }
624 }
625
626 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
627 {
628 uint32_t i, wpnum;
629 uint32_t ret = 0;
630
631 wpnum = sd_addr_to_wpnum(addr);
632
633 for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
634 if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
635 ret |= (1 << i);
636 }
637 }
638
639 return ret;
640 }
641
642 static void sd_function_switch(SDState *sd, uint32_t arg)
643 {
644 int i, mode, new_func, crc;
645 mode = !!(arg & 0x80000000);
646
647 sd->data[0] = 0x00; /* Maximum current consumption */
648 sd->data[1] = 0x01;
649 sd->data[2] = 0x80; /* Supported group 6 functions */
650 sd->data[3] = 0x01;
651 sd->data[4] = 0x80; /* Supported group 5 functions */
652 sd->data[5] = 0x01;
653 sd->data[6] = 0x80; /* Supported group 4 functions */
654 sd->data[7] = 0x01;
655 sd->data[8] = 0x80; /* Supported group 3 functions */
656 sd->data[9] = 0x01;
657 sd->data[10] = 0x80; /* Supported group 2 functions */
658 sd->data[11] = 0x43;
659 sd->data[12] = 0x80; /* Supported group 1 functions */
660 sd->data[13] = 0x03;
661 for (i = 0; i < 6; i ++) {
662 new_func = (arg >> (i * 4)) & 0x0f;
663 if (mode && new_func != 0x0f)
664 sd->function_group[i] = new_func;
665 sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
666 }
667 memset(&sd->data[17], 0, 47);
668 crc = sd_crc16(sd->data, 64);
669 sd->data[65] = crc >> 8;
670 sd->data[66] = crc & 0xff;
671 }
672
673 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
674 {
675 return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
676 }
677
678 static void sd_lock_command(SDState *sd)
679 {
680 int erase, lock, clr_pwd, set_pwd, pwd_len;
681 erase = !!(sd->data[0] & 0x08);
682 lock = sd->data[0] & 0x04;
683 clr_pwd = sd->data[0] & 0x02;
684 set_pwd = sd->data[0] & 0x01;
685
686 if (sd->blk_len > 1)
687 pwd_len = sd->data[1];
688 else
689 pwd_len = 0;
690
691 if (erase) {
692 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
693 set_pwd || clr_pwd || lock || sd->wp_switch ||
694 (sd->csd[14] & 0x20)) {
695 sd->card_status |= LOCK_UNLOCK_FAILED;
696 return;
697 }
698 bitmap_zero(sd->wp_groups, sd->wpgrps_size);
699 sd->csd[14] &= ~0x10;
700 sd->card_status &= ~CARD_IS_LOCKED;
701 sd->pwd_len = 0;
702 /* Erasing the entire card here! */
703 fprintf(stderr, "SD: Card force-erased by CMD42\n");
704 return;
705 }
706
707 if (sd->blk_len < 2 + pwd_len ||
708 pwd_len <= sd->pwd_len ||
709 pwd_len > sd->pwd_len + 16) {
710 sd->card_status |= LOCK_UNLOCK_FAILED;
711 return;
712 }
713
714 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
715 sd->card_status |= LOCK_UNLOCK_FAILED;
716 return;
717 }
718
719 pwd_len -= sd->pwd_len;
720 if ((pwd_len && !set_pwd) ||
721 (clr_pwd && (set_pwd || lock)) ||
722 (lock && !sd->pwd_len && !set_pwd) ||
723 (!set_pwd && !clr_pwd &&
724 (((sd->card_status & CARD_IS_LOCKED) && lock) ||
725 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
726 sd->card_status |= LOCK_UNLOCK_FAILED;
727 return;
728 }
729
730 if (set_pwd) {
731 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
732 sd->pwd_len = pwd_len;
733 }
734
735 if (clr_pwd) {
736 sd->pwd_len = 0;
737 }
738
739 if (lock)
740 sd->card_status |= CARD_IS_LOCKED;
741 else
742 sd->card_status &= ~CARD_IS_LOCKED;
743 }
744
745 static sd_rsp_type_t sd_normal_command(SDState *sd,
746 SDRequest req)
747 {
748 uint32_t rca = 0x0000;
749 uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
750
751 /* Not interpreting this as an app command */
752 sd->card_status &= ~APP_CMD;
753
754 if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
755 || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
756 rca = req.arg >> 16;
757 }
758
759 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
760 * if not, its effects are cancelled */
761 if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
762 sd->multi_blk_cnt = 0;
763 }
764
765 DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
766 switch (req.cmd) {
767 /* Basic commands (Class 0 and Class 1) */
768 case 0: /* CMD0: GO_IDLE_STATE */
769 switch (sd->state) {
770 case sd_inactive_state:
771 return sd->spi ? sd_r1 : sd_r0;
772
773 default:
774 sd->state = sd_idle_state;
775 sd_reset(DEVICE(sd));
776 return sd->spi ? sd_r1 : sd_r0;
777 }
778 break;
779
780 case 1: /* CMD1: SEND_OP_CMD */
781 if (!sd->spi)
782 goto bad_cmd;
783
784 sd->state = sd_transfer_state;
785 return sd_r1;
786
787 case 2: /* CMD2: ALL_SEND_CID */
788 if (sd->spi)
789 goto bad_cmd;
790 switch (sd->state) {
791 case sd_ready_state:
792 sd->state = sd_identification_state;
793 return sd_r2_i;
794
795 default:
796 break;
797 }
798 break;
799
800 case 3: /* CMD3: SEND_RELATIVE_ADDR */
801 if (sd->spi)
802 goto bad_cmd;
803 switch (sd->state) {
804 case sd_identification_state:
805 case sd_standby_state:
806 sd->state = sd_standby_state;
807 sd_set_rca(sd);
808 return sd_r6;
809
810 default:
811 break;
812 }
813 break;
814
815 case 4: /* CMD4: SEND_DSR */
816 if (sd->spi)
817 goto bad_cmd;
818 switch (sd->state) {
819 case sd_standby_state:
820 break;
821
822 default:
823 break;
824 }
825 break;
826
827 case 5: /* CMD5: reserved for SDIO cards */
828 return sd_illegal;
829
830 case 6: /* CMD6: SWITCH_FUNCTION */
831 if (sd->spi)
832 goto bad_cmd;
833 switch (sd->mode) {
834 case sd_data_transfer_mode:
835 sd_function_switch(sd, req.arg);
836 sd->state = sd_sendingdata_state;
837 sd->data_start = 0;
838 sd->data_offset = 0;
839 return sd_r1;
840
841 default:
842 break;
843 }
844 break;
845
846 case 7: /* CMD7: SELECT/DESELECT_CARD */
847 if (sd->spi)
848 goto bad_cmd;
849 switch (sd->state) {
850 case sd_standby_state:
851 if (sd->rca != rca)
852 return sd_r0;
853
854 sd->state = sd_transfer_state;
855 return sd_r1b;
856
857 case sd_transfer_state:
858 case sd_sendingdata_state:
859 if (sd->rca == rca)
860 break;
861
862 sd->state = sd_standby_state;
863 return sd_r1b;
864
865 case sd_disconnect_state:
866 if (sd->rca != rca)
867 return sd_r0;
868
869 sd->state = sd_programming_state;
870 return sd_r1b;
871
872 case sd_programming_state:
873 if (sd->rca == rca)
874 break;
875
876 sd->state = sd_disconnect_state;
877 return sd_r1b;
878
879 default:
880 break;
881 }
882 break;
883
884 case 8: /* CMD8: SEND_IF_COND */
885 /* Physical Layer Specification Version 2.00 command */
886 switch (sd->state) {
887 case sd_idle_state:
888 sd->vhs = 0;
889
890 /* No response if not exactly one VHS bit is set. */
891 if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
892 return sd->spi ? sd_r7 : sd_r0;
893 }
894
895 /* Accept. */
896 sd->vhs = req.arg;
897 return sd_r7;
898
899 default:
900 break;
901 }
902 break;
903
904 case 9: /* CMD9: SEND_CSD */
905 switch (sd->state) {
906 case sd_standby_state:
907 if (sd->rca != rca)
908 return sd_r0;
909
910 return sd_r2_s;
911
912 case sd_transfer_state:
913 if (!sd->spi)
914 break;
915 sd->state = sd_sendingdata_state;
916 memcpy(sd->data, sd->csd, 16);
917 sd->data_start = addr;
918 sd->data_offset = 0;
919 return sd_r1;
920
921 default:
922 break;
923 }
924 break;
925
926 case 10: /* CMD10: SEND_CID */
927 switch (sd->state) {
928 case sd_standby_state:
929 if (sd->rca != rca)
930 return sd_r0;
931
932 return sd_r2_i;
933
934 case sd_transfer_state:
935 if (!sd->spi)
936 break;
937 sd->state = sd_sendingdata_state;
938 memcpy(sd->data, sd->cid, 16);
939 sd->data_start = addr;
940 sd->data_offset = 0;
941 return sd_r1;
942
943 default:
944 break;
945 }
946 break;
947
948 case 11: /* CMD11: READ_DAT_UNTIL_STOP */
949 if (sd->spi)
950 goto bad_cmd;
951 switch (sd->state) {
952 case sd_transfer_state:
953 sd->state = sd_sendingdata_state;
954 sd->data_start = req.arg;
955 sd->data_offset = 0;
956
957 if (sd->data_start + sd->blk_len > sd->size)
958 sd->card_status |= ADDRESS_ERROR;
959 return sd_r0;
960
961 default:
962 break;
963 }
964 break;
965
966 case 12: /* CMD12: STOP_TRANSMISSION */
967 switch (sd->state) {
968 case sd_sendingdata_state:
969 sd->state = sd_transfer_state;
970 return sd_r1b;
971
972 case sd_receivingdata_state:
973 sd->state = sd_programming_state;
974 /* Bzzzzzzztt .... Operation complete. */
975 sd->state = sd_transfer_state;
976 return sd_r1b;
977
978 default:
979 break;
980 }
981 break;
982
983 case 13: /* CMD13: SEND_STATUS */
984 switch (sd->mode) {
985 case sd_data_transfer_mode:
986 if (sd->rca != rca)
987 return sd_r0;
988
989 return sd_r1;
990
991 default:
992 break;
993 }
994 break;
995
996 case 15: /* CMD15: GO_INACTIVE_STATE */
997 if (sd->spi)
998 goto bad_cmd;
999 switch (sd->mode) {
1000 case sd_data_transfer_mode:
1001 if (sd->rca != rca)
1002 return sd_r0;
1003
1004 sd->state = sd_inactive_state;
1005 return sd_r0;
1006
1007 default:
1008 break;
1009 }
1010 break;
1011
1012 /* Block read commands (Classs 2) */
1013 case 16: /* CMD16: SET_BLOCKLEN */
1014 switch (sd->state) {
1015 case sd_transfer_state:
1016 if (req.arg > (1 << HWBLOCK_SHIFT))
1017 sd->card_status |= BLOCK_LEN_ERROR;
1018 else
1019 sd->blk_len = req.arg;
1020
1021 return sd_r1;
1022
1023 default:
1024 break;
1025 }
1026 break;
1027
1028 case 17: /* CMD17: READ_SINGLE_BLOCK */
1029 switch (sd->state) {
1030 case sd_transfer_state:
1031 sd->state = sd_sendingdata_state;
1032 sd->data_start = addr;
1033 sd->data_offset = 0;
1034
1035 if (sd->data_start + sd->blk_len > sd->size)
1036 sd->card_status |= ADDRESS_ERROR;
1037 return sd_r1;
1038
1039 default:
1040 break;
1041 }
1042 break;
1043
1044 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1045 switch (sd->state) {
1046 case sd_transfer_state:
1047 sd->state = sd_sendingdata_state;
1048 sd->data_start = addr;
1049 sd->data_offset = 0;
1050
1051 if (sd->data_start + sd->blk_len > sd->size)
1052 sd->card_status |= ADDRESS_ERROR;
1053 return sd_r1;
1054
1055 default:
1056 break;
1057 }
1058 break;
1059
1060 case 23: /* CMD23: SET_BLOCK_COUNT */
1061 switch (sd->state) {
1062 case sd_transfer_state:
1063 sd->multi_blk_cnt = req.arg;
1064 return sd_r1;
1065
1066 default:
1067 break;
1068 }
1069 break;
1070
1071 /* Block write commands (Class 4) */
1072 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1073 if (sd->spi)
1074 goto unimplemented_cmd;
1075 switch (sd->state) {
1076 case sd_transfer_state:
1077 /* Writing in SPI mode not implemented. */
1078 if (sd->spi)
1079 break;
1080 sd->state = sd_receivingdata_state;
1081 sd->data_start = addr;
1082 sd->data_offset = 0;
1083 sd->blk_written = 0;
1084
1085 if (sd->data_start + sd->blk_len > sd->size)
1086 sd->card_status |= ADDRESS_ERROR;
1087 if (sd_wp_addr(sd, sd->data_start))
1088 sd->card_status |= WP_VIOLATION;
1089 if (sd->csd[14] & 0x30)
1090 sd->card_status |= WP_VIOLATION;
1091 return sd_r1;
1092
1093 default:
1094 break;
1095 }
1096 break;
1097
1098 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1099 if (sd->spi)
1100 goto unimplemented_cmd;
1101 switch (sd->state) {
1102 case sd_transfer_state:
1103 /* Writing in SPI mode not implemented. */
1104 if (sd->spi)
1105 break;
1106 sd->state = sd_receivingdata_state;
1107 sd->data_start = addr;
1108 sd->data_offset = 0;
1109 sd->blk_written = 0;
1110
1111 if (sd->data_start + sd->blk_len > sd->size)
1112 sd->card_status |= ADDRESS_ERROR;
1113 if (sd_wp_addr(sd, sd->data_start))
1114 sd->card_status |= WP_VIOLATION;
1115 if (sd->csd[14] & 0x30)
1116 sd->card_status |= WP_VIOLATION;
1117 return sd_r1;
1118
1119 default:
1120 break;
1121 }
1122 break;
1123
1124 case 26: /* CMD26: PROGRAM_CID */
1125 if (sd->spi)
1126 goto bad_cmd;
1127 switch (sd->state) {
1128 case sd_transfer_state:
1129 sd->state = sd_receivingdata_state;
1130 sd->data_start = 0;
1131 sd->data_offset = 0;
1132 return sd_r1;
1133
1134 default:
1135 break;
1136 }
1137 break;
1138
1139 case 27: /* CMD27: PROGRAM_CSD */
1140 if (sd->spi)
1141 goto unimplemented_cmd;
1142 switch (sd->state) {
1143 case sd_transfer_state:
1144 sd->state = sd_receivingdata_state;
1145 sd->data_start = 0;
1146 sd->data_offset = 0;
1147 return sd_r1;
1148
1149 default:
1150 break;
1151 }
1152 break;
1153
1154 /* Write protection (Class 6) */
1155 case 28: /* CMD28: SET_WRITE_PROT */
1156 switch (sd->state) {
1157 case sd_transfer_state:
1158 if (addr >= sd->size) {
1159 sd->card_status |= ADDRESS_ERROR;
1160 return sd_r1b;
1161 }
1162
1163 sd->state = sd_programming_state;
1164 set_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1165 /* Bzzzzzzztt .... Operation complete. */
1166 sd->state = sd_transfer_state;
1167 return sd_r1b;
1168
1169 default:
1170 break;
1171 }
1172 break;
1173
1174 case 29: /* CMD29: CLR_WRITE_PROT */
1175 switch (sd->state) {
1176 case sd_transfer_state:
1177 if (addr >= sd->size) {
1178 sd->card_status |= ADDRESS_ERROR;
1179 return sd_r1b;
1180 }
1181
1182 sd->state = sd_programming_state;
1183 clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1184 /* Bzzzzzzztt .... Operation complete. */
1185 sd->state = sd_transfer_state;
1186 return sd_r1b;
1187
1188 default:
1189 break;
1190 }
1191 break;
1192
1193 case 30: /* CMD30: SEND_WRITE_PROT */
1194 switch (sd->state) {
1195 case sd_transfer_state:
1196 sd->state = sd_sendingdata_state;
1197 *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1198 sd->data_start = addr;
1199 sd->data_offset = 0;
1200 return sd_r1b;
1201
1202 default:
1203 break;
1204 }
1205 break;
1206
1207 /* Erase commands (Class 5) */
1208 case 32: /* CMD32: ERASE_WR_BLK_START */
1209 switch (sd->state) {
1210 case sd_transfer_state:
1211 sd->erase_start = req.arg;
1212 return sd_r1;
1213
1214 default:
1215 break;
1216 }
1217 break;
1218
1219 case 33: /* CMD33: ERASE_WR_BLK_END */
1220 switch (sd->state) {
1221 case sd_transfer_state:
1222 sd->erase_end = req.arg;
1223 return sd_r1;
1224
1225 default:
1226 break;
1227 }
1228 break;
1229
1230 case 38: /* CMD38: ERASE */
1231 switch (sd->state) {
1232 case sd_transfer_state:
1233 if (sd->csd[14] & 0x30) {
1234 sd->card_status |= WP_VIOLATION;
1235 return sd_r1b;
1236 }
1237
1238 sd->state = sd_programming_state;
1239 sd_erase(sd);
1240 /* Bzzzzzzztt .... Operation complete. */
1241 sd->state = sd_transfer_state;
1242 return sd_r1b;
1243
1244 default:
1245 break;
1246 }
1247 break;
1248
1249 /* Lock card commands (Class 7) */
1250 case 42: /* CMD42: LOCK_UNLOCK */
1251 if (sd->spi)
1252 goto unimplemented_cmd;
1253 switch (sd->state) {
1254 case sd_transfer_state:
1255 sd->state = sd_receivingdata_state;
1256 sd->data_start = 0;
1257 sd->data_offset = 0;
1258 return sd_r1;
1259
1260 default:
1261 break;
1262 }
1263 break;
1264
1265 case 52:
1266 case 53:
1267 /* CMD52, CMD53: reserved for SDIO cards
1268 * (see the SDIO Simplified Specification V2.0)
1269 * Handle as illegal command but do not complain
1270 * on stderr, as some OSes may use these in their
1271 * probing for presence of an SDIO card.
1272 */
1273 return sd_illegal;
1274
1275 /* Application specific commands (Class 8) */
1276 case 55: /* CMD55: APP_CMD */
1277 if (sd->rca != rca)
1278 return sd_r0;
1279
1280 sd->expecting_acmd = true;
1281 sd->card_status |= APP_CMD;
1282 return sd_r1;
1283
1284 case 56: /* CMD56: GEN_CMD */
1285 fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1286
1287 switch (sd->state) {
1288 case sd_transfer_state:
1289 sd->data_offset = 0;
1290 if (req.arg & 1)
1291 sd->state = sd_sendingdata_state;
1292 else
1293 sd->state = sd_receivingdata_state;
1294 return sd_r1;
1295
1296 default:
1297 break;
1298 }
1299 break;
1300
1301 default:
1302 bad_cmd:
1303 qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1304 return sd_illegal;
1305
1306 unimplemented_cmd:
1307 /* Commands that are recognised but not yet implemented in SPI mode. */
1308 qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
1309 req.cmd);
1310 return sd_illegal;
1311 }
1312
1313 qemu_log_mask(LOG_GUEST_ERROR, "SD: CMD%i in a wrong state\n", req.cmd);
1314 return sd_illegal;
1315 }
1316
1317 static sd_rsp_type_t sd_app_command(SDState *sd,
1318 SDRequest req)
1319 {
1320 DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1321 sd->card_status |= APP_CMD;
1322 switch (req.cmd) {
1323 case 6: /* ACMD6: SET_BUS_WIDTH */
1324 switch (sd->state) {
1325 case sd_transfer_state:
1326 sd->sd_status[0] &= 0x3f;
1327 sd->sd_status[0] |= (req.arg & 0x03) << 6;
1328 return sd_r1;
1329
1330 default:
1331 break;
1332 }
1333 break;
1334
1335 case 13: /* ACMD13: SD_STATUS */
1336 switch (sd->state) {
1337 case sd_transfer_state:
1338 sd->state = sd_sendingdata_state;
1339 sd->data_start = 0;
1340 sd->data_offset = 0;
1341 return sd_r1;
1342
1343 default:
1344 break;
1345 }
1346 break;
1347
1348 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1349 switch (sd->state) {
1350 case sd_transfer_state:
1351 *(uint32_t *) sd->data = sd->blk_written;
1352
1353 sd->state = sd_sendingdata_state;
1354 sd->data_start = 0;
1355 sd->data_offset = 0;
1356 return sd_r1;
1357
1358 default:
1359 break;
1360 }
1361 break;
1362
1363 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1364 switch (sd->state) {
1365 case sd_transfer_state:
1366 return sd_r1;
1367
1368 default:
1369 break;
1370 }
1371 break;
1372
1373 case 41: /* ACMD41: SD_APP_OP_COND */
1374 if (sd->spi) {
1375 /* SEND_OP_CMD */
1376 sd->state = sd_transfer_state;
1377 return sd_r1;
1378 }
1379 switch (sd->state) {
1380 case sd_idle_state:
1381 /* If it's the first ACMD41 since reset, we need to decide
1382 * whether to power up. If this is not an enquiry ACMD41,
1383 * we immediately report power on and proceed below to the
1384 * ready state, but if it is, we set a timer to model a
1385 * delay for power up. This works around a bug in EDK2
1386 * UEFI, which sends an initial enquiry ACMD41, but
1387 * assumes that the card is in ready state as soon as it
1388 * sees the power up bit set. */
1389 if (!(sd->ocr & OCR_POWER_UP)) {
1390 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1391 timer_del(sd->ocr_power_timer);
1392 sd_ocr_powerup(sd);
1393 } else if (!timer_pending(sd->ocr_power_timer)) {
1394 timer_mod_ns(sd->ocr_power_timer,
1395 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1396 + OCR_POWER_DELAY_NS));
1397 }
1398 }
1399
1400 /* We accept any voltage. 10000 V is nothing.
1401 *
1402 * Once we're powered up, we advance straight to ready state
1403 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1404 */
1405 if (req.arg & ACMD41_ENQUIRY_MASK) {
1406 sd->state = sd_ready_state;
1407 }
1408
1409 return sd_r3;
1410
1411 default:
1412 break;
1413 }
1414 break;
1415
1416 case 42: /* ACMD42: SET_CLR_CARD_DETECT */
1417 switch (sd->state) {
1418 case sd_transfer_state:
1419 /* Bringing in the 50KOhm pull-up resistor... Done. */
1420 return sd_r1;
1421
1422 default:
1423 break;
1424 }
1425 break;
1426
1427 case 51: /* ACMD51: SEND_SCR */
1428 switch (sd->state) {
1429 case sd_transfer_state:
1430 sd->state = sd_sendingdata_state;
1431 sd->data_start = 0;
1432 sd->data_offset = 0;
1433 return sd_r1;
1434
1435 default:
1436 break;
1437 }
1438 break;
1439
1440 default:
1441 /* Fall back to standard commands. */
1442 return sd_normal_command(sd, req);
1443 }
1444
1445 qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
1446 return sd_illegal;
1447 }
1448
1449 static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
1450 {
1451 /* Valid commands in locked state:
1452 * basic class (0)
1453 * lock card class (7)
1454 * CMD16
1455 * implicitly, the ACMD prefix CMD55
1456 * ACMD41 and ACMD42
1457 * Anything else provokes an "illegal command" response.
1458 */
1459 if (sd->expecting_acmd) {
1460 return req->cmd == 41 || req->cmd == 42;
1461 }
1462 if (req->cmd == 16 || req->cmd == 55) {
1463 return 1;
1464 }
1465 return sd_cmd_class[req->cmd & 0x3F] == 0
1466 || sd_cmd_class[req->cmd & 0x3F] == 7;
1467 }
1468
1469 int sd_do_command(SDState *sd, SDRequest *req,
1470 uint8_t *response) {
1471 int last_state;
1472 sd_rsp_type_t rtype;
1473 int rsplen;
1474
1475 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
1476 return 0;
1477 }
1478
1479 if (sd_req_crc_validate(req)) {
1480 sd->card_status |= COM_CRC_ERROR;
1481 rtype = sd_illegal;
1482 goto send_response;
1483 }
1484
1485 if (sd->card_status & CARD_IS_LOCKED) {
1486 if (!cmd_valid_while_locked(sd, req)) {
1487 sd->card_status |= ILLEGAL_COMMAND;
1488 sd->expecting_acmd = false;
1489 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
1490 rtype = sd_illegal;
1491 goto send_response;
1492 }
1493 }
1494
1495 last_state = sd->state;
1496 sd_set_mode(sd);
1497
1498 if (sd->expecting_acmd) {
1499 sd->expecting_acmd = false;
1500 rtype = sd_app_command(sd, *req);
1501 } else {
1502 rtype = sd_normal_command(sd, *req);
1503 }
1504
1505 if (rtype == sd_illegal) {
1506 sd->card_status |= ILLEGAL_COMMAND;
1507 } else {
1508 /* Valid command, we can update the 'state before command' bits.
1509 * (Do this now so they appear in r1 responses.)
1510 */
1511 sd->current_cmd = req->cmd;
1512 sd->card_status &= ~CURRENT_STATE;
1513 sd->card_status |= (last_state << 9);
1514 }
1515
1516 send_response:
1517 switch (rtype) {
1518 case sd_r1:
1519 case sd_r1b:
1520 sd_response_r1_make(sd, response);
1521 rsplen = 4;
1522 break;
1523
1524 case sd_r2_i:
1525 memcpy(response, sd->cid, sizeof(sd->cid));
1526 rsplen = 16;
1527 break;
1528
1529 case sd_r2_s:
1530 memcpy(response, sd->csd, sizeof(sd->csd));
1531 rsplen = 16;
1532 break;
1533
1534 case sd_r3:
1535 sd_response_r3_make(sd, response);
1536 rsplen = 4;
1537 break;
1538
1539 case sd_r6:
1540 sd_response_r6_make(sd, response);
1541 rsplen = 4;
1542 break;
1543
1544 case sd_r7:
1545 sd_response_r7_make(sd, response);
1546 rsplen = 4;
1547 break;
1548
1549 case sd_r0:
1550 case sd_illegal:
1551 default:
1552 rsplen = 0;
1553 break;
1554 }
1555
1556 if (rtype != sd_illegal) {
1557 /* Clear the "clear on valid command" status bits now we've
1558 * sent any response
1559 */
1560 sd->card_status &= ~CARD_STATUS_B;
1561 }
1562
1563 #ifdef DEBUG_SD
1564 if (rsplen) {
1565 int i;
1566 DPRINTF("Response:");
1567 for (i = 0; i < rsplen; i++)
1568 fprintf(stderr, " %02x", response[i]);
1569 fprintf(stderr, " state %d\n", sd->state);
1570 } else {
1571 DPRINTF("No response %d\n", sd->state);
1572 }
1573 #endif
1574
1575 return rsplen;
1576 }
1577
1578 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1579 {
1580 uint64_t end = addr + len;
1581
1582 DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
1583 (unsigned long long) addr, len);
1584 if (!sd->blk || blk_read(sd->blk, addr >> 9, sd->buf, 1) < 0) {
1585 fprintf(stderr, "sd_blk_read: read error on host side\n");
1586 return;
1587 }
1588
1589 if (end > (addr & ~511) + 512) {
1590 memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511));
1591
1592 if (blk_read(sd->blk, end >> 9, sd->buf, 1) < 0) {
1593 fprintf(stderr, "sd_blk_read: read error on host side\n");
1594 return;
1595 }
1596 memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511);
1597 } else
1598 memcpy(sd->data, sd->buf + (addr & 511), len);
1599 }
1600
1601 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1602 {
1603 uint64_t end = addr + len;
1604
1605 if ((addr & 511) || len < 512)
1606 if (!sd->blk || blk_read(sd->blk, addr >> 9, sd->buf, 1) < 0) {
1607 fprintf(stderr, "sd_blk_write: read error on host side\n");
1608 return;
1609 }
1610
1611 if (end > (addr & ~511) + 512) {
1612 memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511));
1613 if (blk_write(sd->blk, addr >> 9, sd->buf, 1) < 0) {
1614 fprintf(stderr, "sd_blk_write: write error on host side\n");
1615 return;
1616 }
1617
1618 if (blk_read(sd->blk, end >> 9, sd->buf, 1) < 0) {
1619 fprintf(stderr, "sd_blk_write: read error on host side\n");
1620 return;
1621 }
1622 memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511);
1623 if (blk_write(sd->blk, end >> 9, sd->buf, 1) < 0) {
1624 fprintf(stderr, "sd_blk_write: write error on host side\n");
1625 }
1626 } else {
1627 memcpy(sd->buf + (addr & 511), sd->data, len);
1628 if (!sd->blk || blk_write(sd->blk, addr >> 9, sd->buf, 1) < 0) {
1629 fprintf(stderr, "sd_blk_write: write error on host side\n");
1630 }
1631 }
1632 }
1633
1634 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len)
1635 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
1636 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
1637 #define APP_WRITE_BLOCK(a, len)
1638
1639 void sd_write_data(SDState *sd, uint8_t value)
1640 {
1641 int i;
1642
1643 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1644 return;
1645
1646 if (sd->state != sd_receivingdata_state) {
1647 qemu_log_mask(LOG_GUEST_ERROR,
1648 "sd_write_data: not in Receiving-Data state\n");
1649 return;
1650 }
1651
1652 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1653 return;
1654
1655 switch (sd->current_cmd) {
1656 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1657 sd->data[sd->data_offset ++] = value;
1658 if (sd->data_offset >= sd->blk_len) {
1659 /* TODO: Check CRC before committing */
1660 sd->state = sd_programming_state;
1661 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1662 sd->blk_written ++;
1663 sd->csd[14] |= 0x40;
1664 /* Bzzzzzzztt .... Operation complete. */
1665 sd->state = sd_transfer_state;
1666 }
1667 break;
1668
1669 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1670 if (sd->data_offset == 0) {
1671 /* Start of the block - let's check the address is valid */
1672 if (sd->data_start + sd->blk_len > sd->size) {
1673 sd->card_status |= ADDRESS_ERROR;
1674 break;
1675 }
1676 if (sd_wp_addr(sd, sd->data_start)) {
1677 sd->card_status |= WP_VIOLATION;
1678 break;
1679 }
1680 }
1681 sd->data[sd->data_offset++] = value;
1682 if (sd->data_offset >= sd->blk_len) {
1683 /* TODO: Check CRC before committing */
1684 sd->state = sd_programming_state;
1685 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1686 sd->blk_written++;
1687 sd->data_start += sd->blk_len;
1688 sd->data_offset = 0;
1689 sd->csd[14] |= 0x40;
1690
1691 /* Bzzzzzzztt .... Operation complete. */
1692 if (sd->multi_blk_cnt != 0) {
1693 if (--sd->multi_blk_cnt == 0) {
1694 /* Stop! */
1695 sd->state = sd_transfer_state;
1696 break;
1697 }
1698 }
1699
1700 sd->state = sd_receivingdata_state;
1701 }
1702 break;
1703
1704 case 26: /* CMD26: PROGRAM_CID */
1705 sd->data[sd->data_offset ++] = value;
1706 if (sd->data_offset >= sizeof(sd->cid)) {
1707 /* TODO: Check CRC before committing */
1708 sd->state = sd_programming_state;
1709 for (i = 0; i < sizeof(sd->cid); i ++)
1710 if ((sd->cid[i] | 0x00) != sd->data[i])
1711 sd->card_status |= CID_CSD_OVERWRITE;
1712
1713 if (!(sd->card_status & CID_CSD_OVERWRITE))
1714 for (i = 0; i < sizeof(sd->cid); i ++) {
1715 sd->cid[i] |= 0x00;
1716 sd->cid[i] &= sd->data[i];
1717 }
1718 /* Bzzzzzzztt .... Operation complete. */
1719 sd->state = sd_transfer_state;
1720 }
1721 break;
1722
1723 case 27: /* CMD27: PROGRAM_CSD */
1724 sd->data[sd->data_offset ++] = value;
1725 if (sd->data_offset >= sizeof(sd->csd)) {
1726 /* TODO: Check CRC before committing */
1727 sd->state = sd_programming_state;
1728 for (i = 0; i < sizeof(sd->csd); i ++)
1729 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1730 (sd->data[i] | sd_csd_rw_mask[i]))
1731 sd->card_status |= CID_CSD_OVERWRITE;
1732
1733 /* Copy flag (OTP) & Permanent write protect */
1734 if (sd->csd[14] & ~sd->data[14] & 0x60)
1735 sd->card_status |= CID_CSD_OVERWRITE;
1736
1737 if (!(sd->card_status & CID_CSD_OVERWRITE))
1738 for (i = 0; i < sizeof(sd->csd); i ++) {
1739 sd->csd[i] |= sd_csd_rw_mask[i];
1740 sd->csd[i] &= sd->data[i];
1741 }
1742 /* Bzzzzzzztt .... Operation complete. */
1743 sd->state = sd_transfer_state;
1744 }
1745 break;
1746
1747 case 42: /* CMD42: LOCK_UNLOCK */
1748 sd->data[sd->data_offset ++] = value;
1749 if (sd->data_offset >= sd->blk_len) {
1750 /* TODO: Check CRC before committing */
1751 sd->state = sd_programming_state;
1752 sd_lock_command(sd);
1753 /* Bzzzzzzztt .... Operation complete. */
1754 sd->state = sd_transfer_state;
1755 }
1756 break;
1757
1758 case 56: /* CMD56: GEN_CMD */
1759 sd->data[sd->data_offset ++] = value;
1760 if (sd->data_offset >= sd->blk_len) {
1761 APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1762 sd->state = sd_transfer_state;
1763 }
1764 break;
1765
1766 default:
1767 qemu_log_mask(LOG_GUEST_ERROR, "sd_write_data: unknown command\n");
1768 break;
1769 }
1770 }
1771
1772 uint8_t sd_read_data(SDState *sd)
1773 {
1774 /* TODO: Append CRCs */
1775 uint8_t ret;
1776 int io_len;
1777
1778 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1779 return 0x00;
1780
1781 if (sd->state != sd_sendingdata_state) {
1782 qemu_log_mask(LOG_GUEST_ERROR,
1783 "sd_read_data: not in Sending-Data state\n");
1784 return 0x00;
1785 }
1786
1787 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1788 return 0x00;
1789
1790 io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1791
1792 switch (sd->current_cmd) {
1793 case 6: /* CMD6: SWITCH_FUNCTION */
1794 ret = sd->data[sd->data_offset ++];
1795
1796 if (sd->data_offset >= 64)
1797 sd->state = sd_transfer_state;
1798 break;
1799
1800 case 9: /* CMD9: SEND_CSD */
1801 case 10: /* CMD10: SEND_CID */
1802 ret = sd->data[sd->data_offset ++];
1803
1804 if (sd->data_offset >= 16)
1805 sd->state = sd_transfer_state;
1806 break;
1807
1808 case 11: /* CMD11: READ_DAT_UNTIL_STOP */
1809 if (sd->data_offset == 0)
1810 BLK_READ_BLOCK(sd->data_start, io_len);
1811 ret = sd->data[sd->data_offset ++];
1812
1813 if (sd->data_offset >= io_len) {
1814 sd->data_start += io_len;
1815 sd->data_offset = 0;
1816 if (sd->data_start + io_len > sd->size) {
1817 sd->card_status |= ADDRESS_ERROR;
1818 break;
1819 }
1820 }
1821 break;
1822
1823 case 13: /* ACMD13: SD_STATUS */
1824 ret = sd->sd_status[sd->data_offset ++];
1825
1826 if (sd->data_offset >= sizeof(sd->sd_status))
1827 sd->state = sd_transfer_state;
1828 break;
1829
1830 case 17: /* CMD17: READ_SINGLE_BLOCK */
1831 if (sd->data_offset == 0)
1832 BLK_READ_BLOCK(sd->data_start, io_len);
1833 ret = sd->data[sd->data_offset ++];
1834
1835 if (sd->data_offset >= io_len)
1836 sd->state = sd_transfer_state;
1837 break;
1838
1839 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1840 if (sd->data_offset == 0)
1841 BLK_READ_BLOCK(sd->data_start, io_len);
1842 ret = sd->data[sd->data_offset ++];
1843
1844 if (sd->data_offset >= io_len) {
1845 sd->data_start += io_len;
1846 sd->data_offset = 0;
1847
1848 if (sd->multi_blk_cnt != 0) {
1849 if (--sd->multi_blk_cnt == 0) {
1850 /* Stop! */
1851 sd->state = sd_transfer_state;
1852 break;
1853 }
1854 }
1855
1856 if (sd->data_start + io_len > sd->size) {
1857 sd->card_status |= ADDRESS_ERROR;
1858 break;
1859 }
1860 }
1861 break;
1862
1863 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1864 ret = sd->data[sd->data_offset ++];
1865
1866 if (sd->data_offset >= 4)
1867 sd->state = sd_transfer_state;
1868 break;
1869
1870 case 30: /* CMD30: SEND_WRITE_PROT */
1871 ret = sd->data[sd->data_offset ++];
1872
1873 if (sd->data_offset >= 4)
1874 sd->state = sd_transfer_state;
1875 break;
1876
1877 case 51: /* ACMD51: SEND_SCR */
1878 ret = sd->scr[sd->data_offset ++];
1879
1880 if (sd->data_offset >= sizeof(sd->scr))
1881 sd->state = sd_transfer_state;
1882 break;
1883
1884 case 56: /* CMD56: GEN_CMD */
1885 if (sd->data_offset == 0)
1886 APP_READ_BLOCK(sd->data_start, sd->blk_len);
1887 ret = sd->data[sd->data_offset ++];
1888
1889 if (sd->data_offset >= sd->blk_len)
1890 sd->state = sd_transfer_state;
1891 break;
1892
1893 default:
1894 qemu_log_mask(LOG_GUEST_ERROR, "sd_read_data: unknown command\n");
1895 return 0x00;
1896 }
1897
1898 return ret;
1899 }
1900
1901 bool sd_data_ready(SDState *sd)
1902 {
1903 return sd->state == sd_sendingdata_state;
1904 }
1905
1906 void sd_enable(SDState *sd, bool enable)
1907 {
1908 sd->enable = enable;
1909 }
1910
1911 static void sd_instance_init(Object *obj)
1912 {
1913 SDState *sd = SD_CARD(obj);
1914
1915 sd->enable = true;
1916 sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
1917 }
1918
1919 static void sd_realize(DeviceState *dev, Error **errp)
1920 {
1921 SDState *sd = SD_CARD(dev);
1922
1923 if (sd->blk && blk_is_read_only(sd->blk)) {
1924 error_setg(errp, "Cannot use read-only drive as SD card");
1925 return;
1926 }
1927
1928 sd->buf = blk_blockalign(sd->blk, 512);
1929
1930 if (sd->blk) {
1931 blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
1932 }
1933 }
1934
1935 static Property sd_properties[] = {
1936 DEFINE_PROP_DRIVE("drive", SDState, blk),
1937 /* We do not model the chip select pin, so allow the board to select
1938 * whether card should be in SSI or MMC/SD mode. It is also up to the
1939 * board to ensure that ssi transfers only occur when the chip select
1940 * is asserted. */
1941 DEFINE_PROP_BOOL("spi", SDState, spi, false),
1942 DEFINE_PROP_END_OF_LIST()
1943 };
1944
1945 static void sd_class_init(ObjectClass *klass, void *data)
1946 {
1947 DeviceClass *dc = DEVICE_CLASS(klass);
1948 SDCardClass *sc = SD_CARD_CLASS(klass);
1949
1950 dc->realize = sd_realize;
1951 dc->props = sd_properties;
1952 dc->vmsd = &sd_vmstate;
1953 dc->reset = sd_reset;
1954 dc->bus_type = TYPE_SD_BUS;
1955
1956 sc->do_command = sd_do_command;
1957 sc->write_data = sd_write_data;
1958 sc->read_data = sd_read_data;
1959 sc->data_ready = sd_data_ready;
1960 sc->enable = sd_enable;
1961 sc->get_inserted = sd_get_inserted;
1962 sc->get_readonly = sd_get_readonly;
1963 }
1964
1965 static const TypeInfo sd_info = {
1966 .name = TYPE_SD_CARD,
1967 .parent = TYPE_DEVICE,
1968 .instance_size = sizeof(SDState),
1969 .class_size = sizeof(SDCardClass),
1970 .class_init = sd_class_init,
1971 .instance_init = sd_instance_init,
1972 };
1973
1974 static void sd_register_types(void)
1975 {
1976 type_register_static(&sd_info);
1977 }
1978
1979 type_init(sd_register_types)
AR7 emulation for QEMU