2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
24 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
28 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 #include "qemu/osdep.h"
34 #include "qemu/units.h"
35 #include "qemu/cutils.h"
37 #include "hw/registerfields.h"
38 #include "sysemu/block-backend.h"
40 #include "hw/sd/sdcard_legacy.h"
41 #include "migration/vmstate.h"
42 #include "qapi/error.h"
43 #include "qemu/bitmap.h"
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "qemu/error-report.h"
47 #include "qemu/timer.h"
49 #include "qemu/module.h"
50 #include "sdmmc-internal.h"
55 #define SDSC_MAX_CAPACITY (2 * GiB)
57 #define INVALID_ADDRESS UINT32_MAX
60 sd_r0
= 0, /* no response */
61 sd_r1
, /* normal response command */
62 sd_r2_i
, /* CID register */
63 sd_r2_s
, /* CSD register */
64 sd_r3
, /* OCR register */
65 sd_r6
= 6, /* Published RCA response */
66 sd_r7
, /* Operating voltage */
73 sd_card_identification_mode
,
74 sd_data_transfer_mode
,
78 sd_inactive_state
= -1,
81 sd_identification_state
= 2,
83 sd_transfer_state
= 4,
84 sd_sendingdata_state
= 5,
85 sd_receivingdata_state
= 6,
86 sd_programming_state
= 7,
87 sd_disconnect_state
= 8,
90 #define SDMMC_CMD_MAX 64
92 typedef sd_rsp_type_t (*sd_cmd_handler
)(SDState
*sd
, SDRequest req
);
94 typedef struct SDProto
{
98 const sd_cmd_type_t type
;
100 sd_cmd_handler handler
;
101 } cmd
[SDMMC_CMD_MAX
], acmd
[SDMMC_CMD_MAX
];
105 DeviceState parent_obj
;
107 /* If true, created by sd_init() for a non-qdevified caller */
108 /* TODO purge them with fire */
109 bool me_no_qdev_me_kill_mammoth_with_rocks
;
111 /* SD Memory Card Registers */
117 uint32_t card_status
;
118 uint8_t sd_status
[64];
120 /* Static properties */
122 uint8_t spec_version
;
125 const SDProto
*proto
;
127 /* Runtime changeables */
129 uint32_t mode
; /* current card mode, one of SDCardModes */
130 int32_t state
; /* current card state, one of SDCardStates */
133 unsigned long *wp_group_bmap
;
134 int32_t wp_group_bits
;
137 uint32_t multi_blk_cnt
;
138 uint32_t erase_start
;
142 uint8_t function_group
[6];
144 const char *last_cmd_name
;
145 /* True if we will handle the next command as an ACMD. Note that this does
146 * *not* track the APP_CMD status bit!
149 uint32_t blk_written
;
152 uint32_t data_offset
;
155 qemu_irq readonly_cb
;
156 qemu_irq inserted_cb
;
157 QEMUTimer
*ocr_power_timer
;
163 static void sd_realize(DeviceState
*dev
, Error
**errp
);
165 static const SDProto sd_proto_spi
;
167 static bool sd_is_spi(SDState
*sd
)
169 return sd
->proto
== &sd_proto_spi
;
172 static const char *sd_version_str(enum SDPhySpecificationVersion version
)
174 static const char *sdphy_version
[] = {
175 [SD_PHY_SPECv1_10_VERS
] = "v1.10",
176 [SD_PHY_SPECv2_00_VERS
] = "v2.00",
177 [SD_PHY_SPECv3_01_VERS
] = "v3.01",
179 if (version
>= ARRAY_SIZE(sdphy_version
)) {
180 return "unsupported version";
182 return sdphy_version
[version
];
185 static const char *sd_mode_name(enum SDCardModes mode
)
187 static const char *mode_name
[] = {
188 [sd_inactive
] = "inactive",
189 [sd_card_identification_mode
] = "identification",
190 [sd_data_transfer_mode
] = "transfer",
192 assert(mode
< ARRAY_SIZE(mode_name
));
193 return mode_name
[mode
];
196 static const char *sd_state_name(enum SDCardStates state
)
198 static const char *state_name
[] = {
199 [sd_idle_state
] = "idle",
200 [sd_ready_state
] = "ready",
201 [sd_identification_state
] = "identification",
202 [sd_standby_state
] = "standby",
203 [sd_transfer_state
] = "transfer",
204 [sd_sendingdata_state
] = "sendingdata",
205 [sd_receivingdata_state
] = "receivingdata",
206 [sd_programming_state
] = "programming",
207 [sd_disconnect_state
] = "disconnect",
209 if (state
== sd_inactive_state
) {
212 assert(state
< ARRAY_SIZE(state_name
));
213 return state_name
[state
];
216 static const char *sd_response_name(sd_rsp_type_t rsp
)
218 static const char *response_name
[] = {
219 [sd_r0
] = "RESP#0 (no response)",
220 [sd_r1
] = "RESP#1 (normal cmd)",
221 [sd_r2_i
] = "RESP#2 (CID reg)",
222 [sd_r2_s
] = "RESP#2 (CSD reg)",
223 [sd_r3
] = "RESP#3 (OCR reg)",
224 [sd_r6
] = "RESP#6 (RCA)",
225 [sd_r7
] = "RESP#7 (operating voltage)",
227 if (rsp
== sd_illegal
) {
228 return "ILLEGAL RESP";
233 assert(rsp
< ARRAY_SIZE(response_name
));
234 return response_name
[rsp
];
237 static const char *sd_cmd_name(SDState
*sd
, uint8_t cmd
)
239 static const char *cmd_abbrev
[SDMMC_CMD_MAX
] = {
240 [18] = "READ_MULTIPLE_BLOCK",
242 [25] = "WRITE_MULTIPLE_BLOCK",
246 [60] = "MANUF_RSVD", [61] = "MANUF_RSVD",
247 [62] = "MANUF_RSVD", [63] = "MANUF_RSVD",
249 const SDProto
*sdp
= sd
->proto
;
251 if (sdp
->cmd
[cmd
].handler
) {
252 assert(!cmd_abbrev
[cmd
]);
253 return sdp
->cmd
[cmd
].name
;
255 return cmd_abbrev
[cmd
] ? cmd_abbrev
[cmd
] : "UNKNOWN_CMD";
258 static const char *sd_acmd_name(SDState
*sd
, uint8_t cmd
)
260 static const char *acmd_abbrev
[SDMMC_CMD_MAX
] = {
261 [14] = "DPS_spec", [15] = "DPS_spec",
264 [52] = "SECU_spec", [53] = "SECU_spec",
266 [56] = "SECU_spec", [57] = "SECU_spec",
267 [58] = "SECU_spec", [59] = "SECU_spec",
269 const SDProto
*sdp
= sd
->proto
;
271 if (sdp
->acmd
[cmd
].handler
) {
272 assert(!acmd_abbrev
[cmd
]);
273 return sdp
->acmd
[cmd
].name
;
276 return acmd_abbrev
[cmd
] ? acmd_abbrev
[cmd
] : "UNKNOWN_ACMD";
279 static uint8_t sd_get_dat_lines(SDState
*sd
)
281 return sd
->enable
? sd
->dat_lines
: 0;
284 static bool sd_get_cmd_line(SDState
*sd
)
286 return sd
->enable
? sd
->cmd_line
: false;
289 static void sd_set_voltage(SDState
*sd
, uint16_t millivolts
)
291 trace_sdcard_set_voltage(millivolts
);
293 switch (millivolts
) {
294 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
295 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
298 qemu_log_mask(LOG_GUEST_ERROR
, "SD card voltage not supported: %.3fV",
299 millivolts
/ 1000.f
);
303 static void sd_set_mode(SDState
*sd
)
306 case sd_inactive_state
:
307 sd
->mode
= sd_inactive
;
312 case sd_identification_state
:
313 sd
->mode
= sd_card_identification_mode
;
316 case sd_standby_state
:
317 case sd_transfer_state
:
318 case sd_sendingdata_state
:
319 case sd_receivingdata_state
:
320 case sd_programming_state
:
321 case sd_disconnect_state
:
322 sd
->mode
= sd_data_transfer_mode
;
327 static uint8_t sd_crc7(const void *message
, size_t width
)
330 uint8_t shift_reg
= 0x00;
331 const uint8_t *msg
= (const uint8_t *)message
;
333 for (i
= 0; i
< width
; i
++, msg
++)
334 for (bit
= 7; bit
>= 0; bit
--) {
336 if ((shift_reg
>> 7) ^ ((*msg
>> bit
) & 1))
343 /* Operation Conditions register */
345 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
347 FIELD(OCR
, VDD_VOLTAGE_WINDOW
, 0, 24)
348 FIELD(OCR
, VDD_VOLTAGE_WIN_LO
, 0, 8)
349 FIELD(OCR
, DUAL_VOLTAGE_CARD
, 7, 1)
350 FIELD(OCR
, VDD_VOLTAGE_WIN_HI
, 8, 16)
351 FIELD(OCR
, ACCEPT_SWITCH_1V8
, 24, 1) /* Only UHS-I */
352 FIELD(OCR
, UHS_II_CARD
, 29, 1) /* Only UHS-II */
353 FIELD(OCR
, CARD_CAPACITY
, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
354 FIELD(OCR
, CARD_POWER_UP
, 31, 1)
356 #define ACMD41_ENQUIRY_MASK 0x00ffffff
357 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
358 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
359 | R_OCR_UHS_II_CARD_MASK \
360 | R_OCR_CARD_CAPACITY_MASK \
361 | R_OCR_CARD_POWER_UP_MASK)
363 static void sd_ocr_powerup(void *opaque
)
365 SDState
*sd
= opaque
;
367 trace_sdcard_powerup();
368 assert(!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
));
370 /* card power-up OK */
371 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_POWER_UP
, 1);
373 if (sd
->size
> SDSC_MAX_CAPACITY
) {
374 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_CAPACITY
, 1);
378 static void sd_set_ocr(SDState
*sd
)
380 /* All voltages OK */
381 sd
->ocr
= R_OCR_VDD_VOLTAGE_WIN_HI_MASK
;
385 * We don't need to emulate power up sequence in SPI-mode.
386 * Thus, the card's power up status bit should be set to 1 when reset.
387 * The card's capacity status bit should also be set if SD card size
388 * is larger than 2GB for SDHC support.
394 /* SD Configuration register */
396 static void sd_set_scr(SDState
*sd
)
398 sd
->scr
[0] = 0 << 4; /* SCR structure version 1.0 */
399 if (sd
->spec_version
== SD_PHY_SPECv1_10_VERS
) {
400 sd
->scr
[0] |= 1; /* Spec Version 1.10 */
402 sd
->scr
[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
404 sd
->scr
[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
405 | 0b0101; /* 1-bit or 4-bit width bus modes */
406 sd
->scr
[2] = 0x00; /* Extended Security is not supported. */
407 if (sd
->spec_version
>= SD_PHY_SPECv3_01_VERS
) {
408 sd
->scr
[2] |= 1 << 7; /* Spec Version 3.0X */
411 /* reserved for manufacturer usage */
418 /* Card IDentification register */
427 static void sd_set_cid(SDState
*sd
)
429 sd
->cid
[0] = MID
; /* Fake card manufacturer ID (MID) */
430 sd
->cid
[1] = OID
[0]; /* OEM/Application ID (OID) */
432 sd
->cid
[3] = PNM
[0]; /* Fake product name (PNM) */
437 sd
->cid
[8] = PRV
; /* Fake product revision (PRV) */
438 stl_be_p(&sd
->cid
[9], 0xdeadbeef); /* Fake serial number (PSN) */
439 sd
->cid
[13] = 0x00 | /* Manufacture date (MDT) */
440 ((MDT_YR
- 2000) / 10);
441 sd
->cid
[14] = ((MDT_YR
% 10) << 4) | MDT_MON
;
442 sd
->cid
[15] = (sd_crc7(sd
->cid
, 15) << 1) | 1;
445 /* Card-Specific Data register */
447 #define HWBLOCK_SHIFT 9 /* 512 bytes */
448 #define SECTOR_SHIFT 5 /* 16 kilobytes */
449 #define WPGROUP_SHIFT 7 /* 2 megs */
450 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
451 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
453 static const uint8_t sd_csd_rw_mask
[16] = {
454 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
455 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
458 static void sd_set_csd(SDState
*sd
, uint64_t size
)
460 int hwblock_shift
= HWBLOCK_SHIFT
;
462 uint32_t sectsize
= (1 << (SECTOR_SHIFT
+ 1)) - 1;
463 uint32_t wpsize
= (1 << (WPGROUP_SHIFT
+ 1)) - 1;
465 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
466 if (size
== SDSC_MAX_CAPACITY
) {
469 csize
= (size
>> (CMULT_SHIFT
+ hwblock_shift
)) - 1;
471 if (size
<= SDSC_MAX_CAPACITY
) { /* Standard Capacity SD */
472 sd
->csd
[0] = 0x00; /* CSD structure */
473 sd
->csd
[1] = 0x26; /* Data read access-time-1 */
474 sd
->csd
[2] = 0x00; /* Data read access-time-2 */
475 sd
->csd
[3] = 0x32; /* Max. data transfer rate: 25 MHz */
476 sd
->csd
[4] = 0x5f; /* Card Command Classes */
477 sd
->csd
[5] = 0x50 | /* Max. read data block length */
479 sd
->csd
[6] = 0xe0 | /* Partial block for read allowed */
480 ((csize
>> 10) & 0x03);
481 sd
->csd
[7] = 0x00 | /* Device size */
482 ((csize
>> 2) & 0xff);
483 sd
->csd
[8] = 0x3f | /* Max. read current */
484 ((csize
<< 6) & 0xc0);
485 sd
->csd
[9] = 0xfc | /* Max. write current */
486 ((CMULT_SHIFT
- 2) >> 1);
487 sd
->csd
[10] = 0x40 | /* Erase sector size */
488 (((CMULT_SHIFT
- 2) << 7) & 0x80) | (sectsize
>> 1);
489 sd
->csd
[11] = 0x00 | /* Write protect group size */
490 ((sectsize
<< 7) & 0x80) | wpsize
;
491 sd
->csd
[12] = 0x90 | /* Write speed factor */
492 (hwblock_shift
>> 2);
493 sd
->csd
[13] = 0x20 | /* Max. write data block length */
494 ((hwblock_shift
<< 6) & 0xc0);
495 sd
->csd
[14] = 0x00; /* File format group */
506 st24_be_p(&sd
->csd
[7], size
);
513 sd
->csd
[15] = (sd_crc7(sd
->csd
, 15) << 1) | 1;
516 /* Relative Card Address register */
518 static void sd_set_rca(SDState
*sd
)
523 static uint16_t sd_req_get_rca(SDState
*s
, SDRequest req
)
525 switch (s
->proto
->cmd
[req
.cmd
].type
) {
527 /* Called from legacy code not ported to SDProto array */
528 assert(!s
->proto
->cmd
[req
.cmd
].handler
);
532 return req
.arg
>> 16;
534 g_assert_not_reached();
540 static bool sd_req_rca_same(SDState
*s
, SDRequest req
)
542 return sd_req_get_rca(s
, req
) == s
->rca
;
545 /* Card Status register */
547 FIELD(CSR
, AKE_SEQ_ERROR
, 3, 1)
548 FIELD(CSR
, APP_CMD
, 5, 1)
549 FIELD(CSR
, FX_EVENT
, 6, 1)
550 FIELD(CSR
, READY_FOR_DATA
, 8, 1)
551 FIELD(CSR
, CURRENT_STATE
, 9, 4)
552 FIELD(CSR
, ERASE_RESET
, 13, 1)
553 FIELD(CSR
, CARD_ECC_DISABLED
, 14, 1)
554 FIELD(CSR
, WP_ERASE_SKIP
, 15, 1)
555 FIELD(CSR
, CSD_OVERWRITE
, 16, 1)
556 FIELD(CSR
, DEFERRED_RESPONSE
, 17, 1)
557 FIELD(CSR
, ERROR
, 19, 1)
558 FIELD(CSR
, CC_ERROR
, 20, 1)
559 FIELD(CSR
, CARD_ECC_FAILED
, 21, 1)
560 FIELD(CSR
, ILLEGAL_COMMAND
, 22, 1)
561 FIELD(CSR
, COM_CRC_ERROR
, 23, 1)
562 FIELD(CSR
, LOCK_UNLOCK_FAILED
, 24, 1)
563 FIELD(CSR
, CARD_IS_LOCKED
, 25, 1)
564 FIELD(CSR
, WP_VIOLATION
, 26, 1)
565 FIELD(CSR
, ERASE_PARAM
, 27, 1)
566 FIELD(CSR
, ERASE_SEQ_ERROR
, 28, 1)
567 FIELD(CSR
, BLOCK_LEN_ERROR
, 29, 1)
568 FIELD(CSR
, ADDRESS_ERROR
, 30, 1)
569 FIELD(CSR
, OUT_OF_RANGE
, 31, 1)
571 /* Card status bits, split by clear condition:
572 * A : According to the card current state
573 * B : Always related to the previous command
574 * C : Cleared by read
576 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
577 | R_CSR_CARD_ECC_DISABLED_MASK \
578 | R_CSR_CARD_IS_LOCKED_MASK)
579 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
580 | R_CSR_ILLEGAL_COMMAND_MASK \
581 | R_CSR_COM_CRC_ERROR_MASK)
582 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
583 | R_CSR_APP_CMD_MASK \
584 | R_CSR_ERASE_RESET_MASK \
585 | R_CSR_WP_ERASE_SKIP_MASK \
586 | R_CSR_CSD_OVERWRITE_MASK \
588 | R_CSR_CC_ERROR_MASK \
589 | R_CSR_CARD_ECC_FAILED_MASK \
590 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
591 | R_CSR_WP_VIOLATION_MASK \
592 | R_CSR_ERASE_PARAM_MASK \
593 | R_CSR_ERASE_SEQ_ERROR_MASK \
594 | R_CSR_BLOCK_LEN_ERROR_MASK \
595 | R_CSR_ADDRESS_ERROR_MASK \
596 | R_CSR_OUT_OF_RANGE_MASK)
598 static void sd_set_cardstatus(SDState
*sd
)
600 sd
->card_status
= READY_FOR_DATA
;
603 static void sd_set_sdstatus(SDState
*sd
)
605 memset(sd
->sd_status
, 0, 64);
608 static const uint8_t sd_tuning_block_pattern4
[64] = {
610 * See: Physical Layer Simplified Specification Version 3.01,
613 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
614 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
615 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
616 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
617 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
618 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
619 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
620 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde
623 static int sd_req_crc_validate(SDRequest
*req
)
626 buffer
[0] = 0x40 | req
->cmd
;
627 stl_be_p(&buffer
[1], req
->arg
);
629 return sd_crc7(buffer
, 5) != req
->crc
; /* TODO */
632 static void sd_response_r1_make(SDState
*sd
, uint8_t *response
)
634 stl_be_p(response
, sd
->card_status
);
636 /* Clear the "clear on read" status bits */
637 sd
->card_status
&= ~CARD_STATUS_C
;
640 static void sd_response_r3_make(SDState
*sd
, uint8_t *response
)
642 stl_be_p(response
, sd
->ocr
& ACMD41_R3_MASK
);
645 static void sd_response_r6_make(SDState
*sd
, uint8_t *response
)
649 status
= ((sd
->card_status
>> 8) & 0xc000) |
650 ((sd
->card_status
>> 6) & 0x2000) |
651 (sd
->card_status
& 0x1fff);
652 sd
->card_status
&= ~(CARD_STATUS_C
& 0xc81fff);
653 stw_be_p(response
+ 0, sd
->rca
);
654 stw_be_p(response
+ 2, status
);
657 static void sd_response_r7_make(SDState
*sd
, uint8_t *response
)
659 stl_be_p(response
, sd
->vhs
);
662 static uint32_t sd_blk_len(SDState
*sd
)
664 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
665 return 1 << HWBLOCK_SHIFT
;
670 static uint64_t sd_req_get_address(SDState
*sd
, SDRequest req
)
674 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
675 addr
= (uint64_t) req
.arg
<< HWBLOCK_SHIFT
;
679 trace_sdcard_req_addr(req
.arg
, addr
);
683 static inline uint64_t sd_addr_to_wpnum(uint64_t addr
)
685 return addr
>> (HWBLOCK_SHIFT
+ SECTOR_SHIFT
+ WPGROUP_SHIFT
);
688 static void sd_reset(DeviceState
*dev
)
690 SDState
*sd
= SD_CARD(dev
);
694 trace_sdcard_reset();
696 blk_get_geometry(sd
->blk
, §
);
700 size
= sect
<< HWBLOCK_SHIFT
;
702 sect
= sd_addr_to_wpnum(size
) + 1;
704 sd
->state
= sd_idle_state
;
712 sd_set_csd(sd
, size
);
713 sd_set_cardstatus(sd
);
716 g_free(sd
->wp_group_bmap
);
717 sd
->wp_switch
= sd
->blk
? !blk_is_writable(sd
->blk
) : false;
718 sd
->wp_group_bits
= sect
;
719 sd
->wp_group_bmap
= bitmap_new(sd
->wp_group_bits
);
720 memset(sd
->function_group
, 0, sizeof(sd
->function_group
));
721 sd
->erase_start
= INVALID_ADDRESS
;
722 sd
->erase_end
= INVALID_ADDRESS
;
725 sd
->expecting_acmd
= false;
728 sd
->multi_blk_cnt
= 0;
731 static bool sd_get_inserted(SDState
*sd
)
733 return sd
->blk
&& blk_is_inserted(sd
->blk
);
736 static bool sd_get_readonly(SDState
*sd
)
738 return sd
->wp_switch
;
741 static void sd_cardchange(void *opaque
, bool load
, Error
**errp
)
743 SDState
*sd
= opaque
;
744 DeviceState
*dev
= DEVICE(sd
);
746 bool inserted
= sd_get_inserted(sd
);
747 bool readonly
= sd_get_readonly(sd
);
750 trace_sdcard_inserted(readonly
);
753 trace_sdcard_ejected();
756 if (sd
->me_no_qdev_me_kill_mammoth_with_rocks
) {
757 qemu_set_irq(sd
->inserted_cb
, inserted
);
759 qemu_set_irq(sd
->readonly_cb
, readonly
);
762 sdbus
= SD_BUS(qdev_get_parent_bus(dev
));
763 sdbus_set_inserted(sdbus
, inserted
);
765 sdbus_set_readonly(sdbus
, readonly
);
770 static const BlockDevOps sd_block_ops
= {
771 .change_media_cb
= sd_cardchange
,
774 static bool sd_ocr_vmstate_needed(void *opaque
)
776 SDState
*sd
= opaque
;
778 /* Include the OCR state (and timer) if it is not yet powered up */
779 return !FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
);
782 static const VMStateDescription sd_ocr_vmstate
= {
783 .name
= "sd-card/ocr-state",
785 .minimum_version_id
= 1,
786 .needed
= sd_ocr_vmstate_needed
,
787 .fields
= (const VMStateField
[]) {
788 VMSTATE_UINT32(ocr
, SDState
),
789 VMSTATE_TIMER_PTR(ocr_power_timer
, SDState
),
790 VMSTATE_END_OF_LIST()
794 static int sd_vmstate_pre_load(void *opaque
)
796 SDState
*sd
= opaque
;
798 /* If the OCR state is not included (prior versions, or not
799 * needed), then the OCR must be set as powered up. If the OCR state
800 * is included, this will be replaced by the state restore.
807 static const VMStateDescription sd_vmstate
= {
810 .minimum_version_id
= 2,
811 .pre_load
= sd_vmstate_pre_load
,
812 .fields
= (const VMStateField
[]) {
813 VMSTATE_UINT32(mode
, SDState
),
814 VMSTATE_INT32(state
, SDState
),
815 VMSTATE_UINT8_ARRAY(cid
, SDState
, 16),
816 VMSTATE_UINT8_ARRAY(csd
, SDState
, 16),
817 VMSTATE_UINT16(rca
, SDState
),
818 VMSTATE_UINT32(card_status
, SDState
),
819 VMSTATE_PARTIAL_BUFFER(sd_status
, SDState
, 1),
820 VMSTATE_UINT32(vhs
, SDState
),
821 VMSTATE_BITMAP(wp_group_bmap
, SDState
, 0, wp_group_bits
),
822 VMSTATE_UINT32(blk_len
, SDState
),
823 VMSTATE_UINT32(multi_blk_cnt
, SDState
),
824 VMSTATE_UINT32(erase_start
, SDState
),
825 VMSTATE_UINT32(erase_end
, SDState
),
826 VMSTATE_UINT8_ARRAY(pwd
, SDState
, 16),
827 VMSTATE_UINT32(pwd_len
, SDState
),
828 VMSTATE_UINT8_ARRAY(function_group
, SDState
, 6),
829 VMSTATE_UINT8(current_cmd
, SDState
),
830 VMSTATE_BOOL(expecting_acmd
, SDState
),
831 VMSTATE_UINT32(blk_written
, SDState
),
832 VMSTATE_UINT64(data_start
, SDState
),
833 VMSTATE_UINT32(data_offset
, SDState
),
834 VMSTATE_UINT8_ARRAY(data
, SDState
, 512),
835 VMSTATE_UNUSED_V(1, 512),
836 VMSTATE_BOOL(enable
, SDState
),
837 VMSTATE_END_OF_LIST()
839 .subsections
= (const VMStateDescription
* const []) {
845 /* Legacy initialization function for use by non-qdevified callers */
846 SDState
*sd_init(BlockBackend
*blk
, bool is_spi
)
853 obj
= object_new(is_spi
? TYPE_SD_CARD_SPI
: TYPE_SD_CARD
);
855 if (!qdev_prop_set_drive_err(dev
, "drive", blk
, &err
)) {
856 error_reportf_err(err
, "sd_init failed: ");
861 * Realizing the device properly would put it into the QOM
862 * composition tree even though it is not plugged into an
863 * appropriate bus. That's a no-no. Hide the device from
864 * QOM/qdev, and call its qdev realize callback directly.
867 object_unparent(obj
);
868 sd_realize(dev
, &err
);
870 error_reportf_err(err
, "sd_init failed: ");
875 sd
->me_no_qdev_me_kill_mammoth_with_rocks
= true;
879 void sd_set_cb(SDState
*sd
, qemu_irq readonly
, qemu_irq insert
)
881 sd
->readonly_cb
= readonly
;
882 sd
->inserted_cb
= insert
;
883 qemu_set_irq(readonly
, sd
->blk
? !blk_is_writable(sd
->blk
) : 0);
884 qemu_set_irq(insert
, sd
->blk
? blk_is_inserted(sd
->blk
) : 0);
887 static void sd_blk_read(SDState
*sd
, uint64_t addr
, uint32_t len
)
889 trace_sdcard_read_block(addr
, len
);
890 if (!sd
->blk
|| blk_pread(sd
->blk
, addr
, len
, sd
->data
, 0) < 0) {
891 fprintf(stderr
, "sd_blk_read: read error on host side\n");
895 static void sd_blk_write(SDState
*sd
, uint64_t addr
, uint32_t len
)
897 trace_sdcard_write_block(addr
, len
);
898 if (!sd
->blk
|| blk_pwrite(sd
->blk
, addr
, len
, sd
->data
, 0) < 0) {
899 fprintf(stderr
, "sd_blk_write: write error on host side\n");
903 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
904 #define APP_WRITE_BLOCK(a, len)
906 static void sd_erase(SDState
*sd
)
908 uint64_t erase_start
= sd
->erase_start
;
909 uint64_t erase_end
= sd
->erase_end
;
913 int erase_len
= 1 << HWBLOCK_SHIFT
;
915 trace_sdcard_erase(sd
->erase_start
, sd
->erase_end
);
916 if (sd
->erase_start
== INVALID_ADDRESS
917 || sd
->erase_end
== INVALID_ADDRESS
) {
918 sd
->card_status
|= ERASE_SEQ_ERROR
;
919 sd
->erase_start
= INVALID_ADDRESS
;
920 sd
->erase_end
= INVALID_ADDRESS
;
924 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
925 /* High capacity memory card: erase units are 512 byte blocks */
926 erase_start
<<= HWBLOCK_SHIFT
;
927 erase_end
<<= HWBLOCK_SHIFT
;
931 if (erase_start
> sd
->size
|| erase_end
> sd
->size
) {
932 sd
->card_status
|= OUT_OF_RANGE
;
933 sd
->erase_start
= INVALID_ADDRESS
;
934 sd
->erase_end
= INVALID_ADDRESS
;
938 sd
->erase_start
= INVALID_ADDRESS
;
939 sd
->erase_end
= INVALID_ADDRESS
;
942 memset(sd
->data
, 0xff, erase_len
);
943 for (erase_addr
= erase_start
; erase_addr
<= erase_end
;
944 erase_addr
+= erase_len
) {
946 /* Only SDSC cards support write protect groups */
947 wpnum
= sd_addr_to_wpnum(erase_addr
);
948 assert(wpnum
< sd
->wp_group_bits
);
949 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
950 sd
->card_status
|= WP_ERASE_SKIP
;
954 sd_blk_write(sd
, erase_addr
, erase_len
);
958 static uint32_t sd_wpbits(SDState
*sd
, uint64_t addr
)
963 wpnum
= sd_addr_to_wpnum(addr
);
965 for (i
= 0; i
< 32; i
++, wpnum
++, addr
+= WPGROUP_SIZE
) {
966 if (addr
>= sd
->size
) {
968 * If the addresses of the last groups are outside the valid range,
969 * then the corresponding write protection bits shall be set to 0.
973 assert(wpnum
< sd
->wp_group_bits
);
974 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
982 static void sd_function_switch(SDState
*sd
, uint32_t arg
)
984 int i
, mode
, new_func
;
985 mode
= !!(arg
& 0x80000000);
987 sd
->data
[0] = 0x00; /* Maximum current consumption */
989 sd
->data
[2] = 0x80; /* Supported group 6 functions */
991 sd
->data
[4] = 0x80; /* Supported group 5 functions */
993 sd
->data
[6] = 0x80; /* Supported group 4 functions */
995 sd
->data
[8] = 0x80; /* Supported group 3 functions */
997 sd
->data
[10] = 0x80; /* Supported group 2 functions */
999 sd
->data
[12] = 0x80; /* Supported group 1 functions */
1000 sd
->data
[13] = 0x03;
1002 memset(&sd
->data
[14], 0, 3);
1003 for (i
= 0; i
< 6; i
++) {
1004 new_func
= (arg
>> (i
* 4)) & 0x0f;
1005 if (mode
&& new_func
!= 0x0f)
1006 sd
->function_group
[i
] = new_func
;
1007 sd
->data
[16 - (i
>> 1)] |= new_func
<< ((i
% 2) * 4);
1009 memset(&sd
->data
[17], 0, 47);
1012 static inline bool sd_wp_addr(SDState
*sd
, uint64_t addr
)
1014 return test_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1017 static void sd_lock_command(SDState
*sd
)
1019 int erase
, lock
, clr_pwd
, set_pwd
, pwd_len
;
1020 erase
= !!(sd
->data
[0] & 0x08);
1021 lock
= sd
->data
[0] & 0x04;
1022 clr_pwd
= sd
->data
[0] & 0x02;
1023 set_pwd
= sd
->data
[0] & 0x01;
1025 if (sd
->blk_len
> 1)
1026 pwd_len
= sd
->data
[1];
1031 trace_sdcard_lock();
1033 trace_sdcard_unlock();
1036 if (!(sd
->card_status
& CARD_IS_LOCKED
) || sd
->blk_len
> 1 ||
1037 set_pwd
|| clr_pwd
|| lock
|| sd
->wp_switch
||
1038 (sd
->csd
[14] & 0x20)) {
1039 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1042 bitmap_zero(sd
->wp_group_bmap
, sd
->wp_group_bits
);
1043 sd
->csd
[14] &= ~0x10;
1044 sd
->card_status
&= ~CARD_IS_LOCKED
;
1046 /* Erasing the entire card here! */
1047 fprintf(stderr
, "SD: Card force-erased by CMD42\n");
1051 if (sd
->blk_len
< 2 + pwd_len
||
1052 pwd_len
<= sd
->pwd_len
||
1053 pwd_len
> sd
->pwd_len
+ 16) {
1054 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1058 if (sd
->pwd_len
&& memcmp(sd
->pwd
, sd
->data
+ 2, sd
->pwd_len
)) {
1059 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1063 pwd_len
-= sd
->pwd_len
;
1064 if ((pwd_len
&& !set_pwd
) ||
1065 (clr_pwd
&& (set_pwd
|| lock
)) ||
1066 (lock
&& !sd
->pwd_len
&& !set_pwd
) ||
1067 (!set_pwd
&& !clr_pwd
&&
1068 (((sd
->card_status
& CARD_IS_LOCKED
) && lock
) ||
1069 (!(sd
->card_status
& CARD_IS_LOCKED
) && !lock
)))) {
1070 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1075 memcpy(sd
->pwd
, sd
->data
+ 2 + sd
->pwd_len
, pwd_len
);
1076 sd
->pwd_len
= pwd_len
;
1084 sd
->card_status
|= CARD_IS_LOCKED
;
1086 sd
->card_status
&= ~CARD_IS_LOCKED
;
1089 static bool address_in_range(SDState
*sd
, const char *desc
,
1090 uint64_t addr
, uint32_t length
)
1092 if (addr
+ length
> sd
->size
) {
1093 qemu_log_mask(LOG_GUEST_ERROR
,
1094 "%s offset %"PRIu64
" > card %"PRIu64
" [%%%u]\n",
1095 desc
, addr
, sd
->size
, length
);
1096 sd
->card_status
|= ADDRESS_ERROR
;
1102 static sd_rsp_type_t
sd_invalid_state_for_cmd(SDState
*sd
, SDRequest req
)
1104 qemu_log_mask(LOG_GUEST_ERROR
, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1105 sd
->proto
->name
, req
.cmd
, sd_state_name(sd
->state
),
1106 sd_version_str(sd
->spec_version
));
1111 static sd_rsp_type_t
sd_invalid_mode_for_cmd(SDState
*sd
, SDRequest req
)
1113 qemu_log_mask(LOG_GUEST_ERROR
, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
1114 sd
->proto
->name
, req
.cmd
, sd_mode_name(sd
->mode
),
1115 sd_version_str(sd
->spec_version
));
1120 static sd_rsp_type_t
sd_cmd_illegal(SDState
*sd
, SDRequest req
)
1122 qemu_log_mask(LOG_GUEST_ERROR
, "%s: Unknown CMD%i for spec %s\n",
1123 sd
->proto
->name
, req
.cmd
,
1124 sd_version_str(sd
->spec_version
));
1129 /* Commands that are recognised but not yet implemented. */
1130 static sd_rsp_type_t
sd_cmd_unimplemented(SDState
*sd
, SDRequest req
)
1132 qemu_log_mask(LOG_UNIMP
, "%s: CMD%i not implemented\n",
1133 sd
->proto
->name
, req
.cmd
);
1138 static sd_rsp_type_t
sd_cmd_optional(SDState
*sd
, SDRequest req
)
1140 qemu_log_mask(LOG_UNIMP
, "%s: Optional CMD%i not implemented\n",
1141 sd
->proto
->name
, req
.cmd
);
1146 /* Configure fields for following sd_generic_write_byte() calls */
1147 static sd_rsp_type_t
sd_cmd_to_receivingdata(SDState
*sd
, SDRequest req
,
1148 uint64_t start
, size_t size
)
1150 if (sd
->state
!= sd_transfer_state
) {
1151 return sd_invalid_state_for_cmd(sd
, req
);
1153 sd
->state
= sd_receivingdata_state
;
1154 sd
->data_start
= start
;
1155 sd
->data_offset
= 0;
1156 /* sd->data[] used as receive buffer */
1157 sd
->data_size
= size
?: sizeof(sd
->data
);
1161 /* Configure fields for following sd_generic_read_byte() calls */
1162 static sd_rsp_type_t
sd_cmd_to_sendingdata(SDState
*sd
, SDRequest req
,
1164 const void *data
, size_t size
)
1166 if (sd
->state
!= sd_transfer_state
) {
1167 sd_invalid_state_for_cmd(sd
, req
);
1170 sd
->state
= sd_sendingdata_state
;
1171 sd
->data_start
= start
;
1172 sd
->data_offset
= 0;
1174 assert(size
> 0 && size
<= sizeof(sd
->data
));
1175 memcpy(sd
->data
, data
, size
);
1178 sd
->data_size
= size
;
1184 static sd_rsp_type_t
sd_cmd_GO_IDLE_STATE(SDState
*sd
, SDRequest req
)
1186 sd
->state
= sd_idle_state
;
1187 sd_reset(DEVICE(sd
));
1189 return sd_is_spi(sd
) ? sd_r1
: sd_r0
;
1193 static sd_rsp_type_t
spi_cmd_SEND_OP_COND(SDState
*sd
, SDRequest req
)
1195 sd
->state
= sd_transfer_state
;
1201 static sd_rsp_type_t
sd_cmd_ALL_SEND_CID(SDState
*sd
, SDRequest req
)
1203 switch (sd
->state
) {
1204 case sd_ready_state
:
1205 sd
->state
= sd_identification_state
;
1208 return sd_invalid_state_for_cmd(sd
, req
);
1213 static sd_rsp_type_t
sd_cmd_SEND_RELATIVE_ADDR(SDState
*sd
, SDRequest req
)
1215 switch (sd
->state
) {
1216 case sd_identification_state
:
1217 case sd_standby_state
:
1218 sd
->state
= sd_standby_state
;
1223 return sd_invalid_state_for_cmd(sd
, req
);
1228 static sd_rsp_type_t
sd_cmd_SWITCH_FUNCTION(SDState
*sd
, SDRequest req
)
1230 if (sd
->mode
!= sd_data_transfer_mode
) {
1231 return sd_invalid_mode_for_cmd(sd
, req
);
1233 if (sd
->state
!= sd_transfer_state
) {
1234 return sd_invalid_state_for_cmd(sd
, req
);
1237 sd_function_switch(sd
, req
.arg
);
1238 return sd_cmd_to_sendingdata(sd
, req
, 0, NULL
, 64);
1242 static sd_rsp_type_t
sd_cmd_DE_SELECT_CARD(SDState
*sd
, SDRequest req
)
1244 bool same_rca
= sd_req_rca_same(sd
, req
);
1246 switch (sd
->state
) {
1247 case sd_standby_state
:
1251 sd
->state
= sd_transfer_state
;
1254 case sd_transfer_state
:
1255 case sd_sendingdata_state
:
1259 sd
->state
= sd_standby_state
;
1262 case sd_disconnect_state
:
1266 sd
->state
= sd_programming_state
;
1269 case sd_programming_state
:
1273 sd
->state
= sd_disconnect_state
;
1279 return sd_invalid_state_for_cmd(sd
, req
);
1283 static sd_rsp_type_t
sd_cmd_SEND_IF_COND(SDState
*sd
, SDRequest req
)
1285 if (sd
->spec_version
< SD_PHY_SPECv2_00_VERS
) {
1286 return sd_cmd_illegal(sd
, req
);
1288 if (sd
->state
!= sd_idle_state
) {
1289 return sd_invalid_state_for_cmd(sd
, req
);
1293 /* No response if not exactly one VHS bit is set. */
1294 if (!(req
.arg
>> 8) || (req
.arg
>> (ctz32(req
.arg
& ~0xff) + 1))) {
1295 return sd_is_spi(sd
) ? sd_r7
: sd_r0
;
1304 static sd_rsp_type_t
spi_cmd_SEND_CSD(SDState
*sd
, SDRequest req
)
1306 if (sd
->state
!= sd_standby_state
) {
1307 return sd_invalid_state_for_cmd(sd
, req
);
1309 return sd_cmd_to_sendingdata(sd
, req
, sd_req_get_address(sd
, req
),
1313 static sd_rsp_type_t
sd_cmd_SEND_CSD(SDState
*sd
, SDRequest req
)
1315 if (sd
->state
!= sd_standby_state
) {
1316 return sd_invalid_state_for_cmd(sd
, req
);
1319 return sd_req_rca_same(sd
, req
) ? sd_r2_s
: sd_r0
;
1323 static sd_rsp_type_t
spi_cmd_SEND_CID(SDState
*sd
, SDRequest req
)
1325 if (sd
->state
!= sd_standby_state
) {
1326 return sd_invalid_state_for_cmd(sd
, req
);
1328 return sd_cmd_to_sendingdata(sd
, req
, sd_req_get_address(sd
, req
),
1332 static sd_rsp_type_t
sd_cmd_SEND_CID(SDState
*sd
, SDRequest req
)
1334 if (sd
->state
!= sd_standby_state
) {
1335 return sd_invalid_state_for_cmd(sd
, req
);
1338 return sd_req_rca_same(sd
, req
) ? sd_r2_i
: sd_r0
;
1342 static sd_rsp_type_t
sd_cmd_STOP_TRANSMISSION(SDState
*sd
, SDRequest req
)
1344 switch (sd
->state
) {
1345 case sd_sendingdata_state
:
1346 sd
->state
= sd_transfer_state
;
1348 case sd_receivingdata_state
:
1349 sd
->state
= sd_programming_state
;
1350 /* Bzzzzzzztt .... Operation complete. */
1351 sd
->state
= sd_transfer_state
;
1354 return sd_invalid_state_for_cmd(sd
, req
);
1359 static sd_rsp_type_t
sd_cmd_SEND_STATUS(SDState
*sd
, SDRequest req
)
1361 if (sd
->mode
!= sd_data_transfer_mode
) {
1362 return sd_invalid_mode_for_cmd(sd
, req
);
1365 switch (sd
->state
) {
1366 case sd_standby_state
:
1367 case sd_transfer_state
:
1368 case sd_sendingdata_state
:
1369 case sd_receivingdata_state
:
1370 case sd_programming_state
:
1371 case sd_disconnect_state
:
1374 return sd_invalid_state_for_cmd(sd
, req
);
1377 if (sd_is_spi(sd
)) {
1381 return sd_req_rca_same(sd
, req
) ? sd_r1
: sd_r0
;
1385 static sd_rsp_type_t
sd_cmd_GO_INACTIVE_STATE(SDState
*sd
, SDRequest req
)
1387 if (sd
->mode
!= sd_data_transfer_mode
) {
1388 return sd_invalid_mode_for_cmd(sd
, req
);
1390 switch (sd
->state
) {
1391 case sd_standby_state
:
1392 case sd_transfer_state
:
1393 case sd_sendingdata_state
:
1394 case sd_receivingdata_state
:
1395 case sd_programming_state
:
1396 case sd_disconnect_state
:
1399 return sd_invalid_state_for_cmd(sd
, req
);
1401 if (sd_req_rca_same(sd
, req
)) {
1402 sd
->state
= sd_inactive_state
;
1409 static sd_rsp_type_t
sd_cmd_SET_BLOCKLEN(SDState
*sd
, SDRequest req
)
1411 if (sd
->state
!= sd_transfer_state
) {
1412 return sd_invalid_state_for_cmd(sd
, req
);
1414 if (req
.arg
> (1 << HWBLOCK_SHIFT
)) {
1415 sd
->card_status
|= BLOCK_LEN_ERROR
;
1417 trace_sdcard_set_blocklen(req
.arg
);
1418 sd
->blk_len
= req
.arg
;
1425 static sd_rsp_type_t
sd_cmd_READ_SINGLE_BLOCK(SDState
*sd
, SDRequest req
)
1429 if (sd
->state
!= sd_transfer_state
) {
1430 return sd_invalid_state_for_cmd(sd
, req
);
1433 addr
= sd_req_get_address(sd
, req
);
1434 if (!address_in_range(sd
, "READ_SINGLE_BLOCK", addr
, sd
->blk_len
)) {
1438 sd_blk_read(sd
, addr
, sd
->blk_len
);
1439 return sd_cmd_to_sendingdata(sd
, req
, addr
, NULL
, sd
->blk_len
);
1443 static sd_rsp_type_t
sd_cmd_SEND_TUNING_BLOCK(SDState
*sd
, SDRequest req
)
1445 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1446 return sd_cmd_illegal(sd
, req
);
1449 return sd_cmd_to_sendingdata(sd
, req
, 0,
1450 sd_tuning_block_pattern4
,
1451 sizeof(sd_tuning_block_pattern4
));
1455 static sd_rsp_type_t
sd_cmd_SET_BLOCK_COUNT(SDState
*sd
, SDRequest req
)
1457 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1458 return sd_cmd_illegal(sd
, req
);
1461 if (sd
->state
!= sd_transfer_state
) {
1462 return sd_invalid_state_for_cmd(sd
, req
);
1465 sd
->multi_blk_cnt
= req
.arg
;
1466 trace_sdcard_set_block_count(sd
->multi_blk_cnt
);
1472 static sd_rsp_type_t
sd_cmd_WRITE_SINGLE_BLOCK(SDState
*sd
, SDRequest req
)
1476 if (sd
->state
!= sd_transfer_state
) {
1477 return sd_invalid_state_for_cmd(sd
, req
);
1480 addr
= sd_req_get_address(sd
, req
);
1481 if (!address_in_range(sd
, "WRITE_SINGLE_BLOCK", addr
, sd
->blk_len
)) {
1485 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
1486 if (sd_wp_addr(sd
, addr
)) {
1487 sd
->card_status
|= WP_VIOLATION
;
1490 if (sd
->csd
[14] & 0x30) {
1491 sd
->card_status
|= WP_VIOLATION
;
1494 sd
->blk_written
= 0;
1495 return sd_cmd_to_receivingdata(sd
, req
, addr
, sd
->blk_len
);
1499 static sd_rsp_type_t
sd_cmd_PROGRAM_CSD(SDState
*sd
, SDRequest req
)
1501 return sd_cmd_to_receivingdata(sd
, req
, 0, sizeof(sd
->csd
));
1504 static sd_rsp_type_t
sd_cmd_SET_CLR_WRITE_PROT(SDState
*sd
, SDRequest req
,
1509 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1513 if (sd
->state
!= sd_transfer_state
) {
1514 return sd_invalid_state_for_cmd(sd
, req
);
1517 addr
= sd_req_get_address(sd
, req
);
1518 if (!address_in_range(sd
, is_write
? "SET_WRITE_PROT" : "CLR_WRITE_PROT",
1523 sd
->state
= sd_programming_state
;
1525 set_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1527 clear_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1529 /* Bzzzzzzztt .... Operation complete. */
1530 sd
->state
= sd_transfer_state
;
1535 static sd_rsp_type_t
sd_cmd_SET_WRITE_PROT(SDState
*sd
, SDRequest req
)
1537 return sd_cmd_SET_CLR_WRITE_PROT(sd
, req
, true);
1541 static sd_rsp_type_t
sd_cmd_CLR_WRITE_PROT(SDState
*sd
, SDRequest req
)
1543 return sd_cmd_SET_CLR_WRITE_PROT(sd
, req
, false);
1547 static sd_rsp_type_t
sd_cmd_SEND_WRITE_PROT(SDState
*sd
, SDRequest req
)
1552 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1556 if (sd
->state
!= sd_transfer_state
) {
1557 return sd_invalid_state_for_cmd(sd
, req
);
1560 addr
= sd_req_get_address(sd
, req
);
1561 if (!address_in_range(sd
, "SEND_WRITE_PROT", addr
, sd
->blk_len
)) {
1565 data
= sd_wpbits(sd
, req
.arg
);
1566 return sd_cmd_to_sendingdata(sd
, req
, addr
, &data
, sizeof(data
));
1570 static sd_rsp_type_t
sd_cmd_ERASE_WR_BLK_START(SDState
*sd
, SDRequest req
)
1572 if (sd
->state
!= sd_transfer_state
) {
1573 return sd_invalid_state_for_cmd(sd
, req
);
1575 sd
->erase_start
= req
.arg
;
1580 static sd_rsp_type_t
sd_cmd_ERASE_WR_BLK_END(SDState
*sd
, SDRequest req
)
1582 if (sd
->state
!= sd_transfer_state
) {
1583 return sd_invalid_state_for_cmd(sd
, req
);
1585 sd
->erase_end
= req
.arg
;
1590 static sd_rsp_type_t
sd_cmd_ERASE(SDState
*sd
, SDRequest req
)
1592 if (sd
->state
!= sd_transfer_state
) {
1593 return sd_invalid_state_for_cmd(sd
, req
);
1595 if (sd
->csd
[14] & 0x30) {
1596 sd
->card_status
|= WP_VIOLATION
;
1600 sd
->state
= sd_programming_state
;
1602 /* Bzzzzzzztt .... Operation complete. */
1603 sd
->state
= sd_transfer_state
;
1608 static sd_rsp_type_t
sd_cmd_LOCK_UNLOCK(SDState
*sd
, SDRequest req
)
1610 return sd_cmd_to_receivingdata(sd
, req
, 0, 0);
1614 static sd_rsp_type_t
sd_cmd_APP_CMD(SDState
*sd
, SDRequest req
)
1616 switch (sd
->state
) {
1617 case sd_ready_state
:
1618 case sd_identification_state
:
1619 case sd_inactive_state
:
1620 return sd_invalid_state_for_cmd(sd
, req
);
1622 if (!sd_is_spi(sd
) && sd_req_get_rca(sd
, req
) != 0x0000) {
1623 qemu_log_mask(LOG_GUEST_ERROR
,
1624 "SD: illegal RCA 0x%04x for APP_CMD\n", req
.cmd
);
1630 if (!sd_is_spi(sd
) && !sd_req_rca_same(sd
, req
)) {
1633 sd
->expecting_acmd
= true;
1634 sd
->card_status
|= APP_CMD
;
1640 static sd_rsp_type_t
spi_cmd_READ_OCR(SDState
*sd
, SDRequest req
)
1646 static sd_rsp_type_t
spi_cmd_CRC_ON_OFF(SDState
*sd
, SDRequest req
)
1652 static sd_rsp_type_t
sd_acmd_SET_BUS_WIDTH(SDState
*sd
, SDRequest req
)
1654 if (sd
->state
!= sd_transfer_state
) {
1655 return sd_invalid_state_for_cmd(sd
, req
);
1658 sd
->sd_status
[0] &= 0x3f;
1659 sd
->sd_status
[0] |= (req
.arg
& 0x03) << 6;
1664 static sd_rsp_type_t
sd_acmd_SD_STATUS(SDState
*sd
, SDRequest req
)
1666 return sd_cmd_to_sendingdata(sd
, req
, 0,
1667 sd
->sd_status
, sizeof(sd
->sd_status
));
1671 static sd_rsp_type_t
sd_acmd_SEND_NUM_WR_BLOCKS(SDState
*sd
, SDRequest req
)
1673 return sd_cmd_to_sendingdata(sd
, req
, 0,
1674 &sd
->blk_written
, sizeof(sd
->blk_written
));
1678 static sd_rsp_type_t
sd_acmd_SET_WR_BLK_ERASE_COUNT(SDState
*sd
, SDRequest req
)
1680 if (sd
->state
!= sd_transfer_state
) {
1681 return sd_invalid_state_for_cmd(sd
, req
);
1687 static sd_rsp_type_t
sd_acmd_SD_APP_OP_COND(SDState
*sd
, SDRequest req
)
1689 if (sd
->state
!= sd_idle_state
) {
1690 return sd_invalid_state_for_cmd(sd
, req
);
1694 * If it's the first ACMD41 since reset, we need to decide
1695 * whether to power up. If this is not an enquiry ACMD41,
1696 * we immediately report power on and proceed below to the
1697 * ready state, but if it is, we set a timer to model a
1698 * delay for power up. This works around a bug in EDK2
1699 * UEFI, which sends an initial enquiry ACMD41, but
1700 * assumes that the card is in ready state as soon as it
1701 * sees the power up bit set.
1703 if (!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
)) {
1704 if ((req
.arg
& ACMD41_ENQUIRY_MASK
) != 0) {
1705 timer_del(sd
->ocr_power_timer
);
1708 trace_sdcard_inquiry_cmd41();
1709 if (!timer_pending(sd
->ocr_power_timer
)) {
1710 timer_mod_ns(sd
->ocr_power_timer
,
1711 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
)
1712 + OCR_POWER_DELAY_NS
));
1717 if (FIELD_EX32(sd
->ocr
& req
.arg
, OCR
, VDD_VOLTAGE_WINDOW
)) {
1719 * We accept any voltage. 10000 V is nothing.
1721 * Once we're powered up, we advance straight to ready state
1722 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1724 sd
->state
= sd_ready_state
;
1731 static sd_rsp_type_t
sd_acmd_SET_CLR_CARD_DETECT(SDState
*sd
, SDRequest req
)
1733 if (sd
->state
!= sd_transfer_state
) {
1734 return sd_invalid_state_for_cmd(sd
, req
);
1737 /* Bringing in the 50KOhm pull-up resistor... Done. */
1742 static sd_rsp_type_t
sd_acmd_SEND_SCR(SDState
*sd
, SDRequest req
)
1744 return sd_cmd_to_sendingdata(sd
, req
, 0, sd
->scr
, sizeof(sd
->scr
));
1747 static sd_rsp_type_t
sd_normal_command(SDState
*sd
, SDRequest req
)
1751 sd
->last_cmd_name
= sd_cmd_name(sd
, req
.cmd
);
1752 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
1753 * However there is no ACMD55, so we want to trace this particular case.
1755 if (req
.cmd
!= 55 || sd
->expecting_acmd
) {
1756 trace_sdcard_normal_command(sd
->proto
->name
,
1757 sd
->last_cmd_name
, req
.cmd
,
1758 req
.arg
, sd_state_name(sd
->state
));
1761 /* Not interpreting this as an app command */
1762 sd
->card_status
&= ~APP_CMD
;
1764 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
1765 * if not, its effects are cancelled */
1766 if (sd
->multi_blk_cnt
!= 0 && !(req
.cmd
== 18 || req
.cmd
== 25)) {
1767 sd
->multi_blk_cnt
= 0;
1770 if (sd
->proto
->cmd
[req
.cmd
].class == 6 && FIELD_EX32(sd
->ocr
, OCR
,
1772 /* Only Standard Capacity cards support class 6 commands */
1776 if (sd
->proto
->cmd
[req
.cmd
].handler
) {
1777 return sd
->proto
->cmd
[req
.cmd
].handler(sd
, req
);
1781 /* Block read commands (Class 2) */
1782 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1783 addr
= sd_req_get_address(sd
, req
);
1784 switch (sd
->state
) {
1785 case sd_transfer_state
:
1787 if (!address_in_range(sd
, "READ_BLOCK", addr
, sd
->blk_len
)) {
1791 sd
->state
= sd_sendingdata_state
;
1792 sd
->data_start
= addr
;
1793 sd
->data_offset
= 0;
1801 /* Block write commands (Class 4) */
1802 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1803 addr
= sd_req_get_address(sd
, req
);
1804 switch (sd
->state
) {
1805 case sd_transfer_state
:
1807 if (!address_in_range(sd
, "WRITE_BLOCK", addr
, sd
->blk_len
)) {
1811 sd
->state
= sd_receivingdata_state
;
1812 sd
->data_start
= addr
;
1813 sd
->data_offset
= 0;
1814 sd
->blk_written
= 0;
1816 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
1817 if (sd_wp_addr(sd
, sd
->data_start
)) {
1818 sd
->card_status
|= WP_VIOLATION
;
1821 if (sd
->csd
[14] & 0x30) {
1822 sd
->card_status
|= WP_VIOLATION
;
1831 case 26: /* CMD26: PROGRAM_CID */
1832 return sd_cmd_to_receivingdata(sd
, req
, 0, sizeof(sd
->cid
));
1834 /* Application specific commands (Class 8) */
1835 case 56: /* CMD56: GEN_CMD */
1836 switch (sd
->state
) {
1837 case sd_transfer_state
:
1838 sd
->data_offset
= 0;
1840 sd
->state
= sd_sendingdata_state
;
1842 sd
->state
= sd_receivingdata_state
;
1851 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Unknown CMD%i\n", req
.cmd
);
1855 return sd_invalid_state_for_cmd(sd
, req
);
1858 static sd_rsp_type_t
sd_app_command(SDState
*sd
,
1861 sd
->last_cmd_name
= sd_acmd_name(sd
, req
.cmd
);
1862 trace_sdcard_app_command(sd
->proto
->name
, sd
->last_cmd_name
,
1863 req
.cmd
, req
.arg
, sd_state_name(sd
->state
));
1864 sd
->card_status
|= APP_CMD
;
1866 if (sd
->proto
->acmd
[req
.cmd
].handler
) {
1867 return sd
->proto
->acmd
[req
.cmd
].handler(sd
, req
);
1871 case 18: /* Reserved for SD security applications */
1876 /* Refer to the "SD Specifications Part3 Security Specification" for
1877 * information about the SD Security Features.
1879 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i Security not implemented\n",
1884 /* Fall back to standard commands. */
1885 return sd_normal_command(sd
, req
);
1888 qemu_log_mask(LOG_GUEST_ERROR
, "SD: ACMD%i in a wrong state\n", req
.cmd
);
1892 static bool cmd_valid_while_locked(SDState
*sd
, unsigned cmd
)
1896 /* Valid commands in locked state:
1898 * lock card class (7)
1900 * implicitly, the ACMD prefix CMD55
1902 * Anything else provokes an "illegal command" response.
1904 if (sd
->expecting_acmd
) {
1905 return cmd
== 41 || cmd
== 42;
1907 if (cmd
== 16 || cmd
== 55) {
1910 if (!sd
->proto
->cmd
[cmd
].handler
) {
1913 cmd_class
= sd
->proto
->cmd
[cmd
].class;
1915 return cmd_class
== 0 || cmd_class
== 7;
1918 int sd_do_command(SDState
*sd
, SDRequest
*req
,
1919 uint8_t *response
) {
1921 sd_rsp_type_t rtype
;
1924 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
) {
1928 if (sd
->state
== sd_inactive_state
) {
1933 if (sd_req_crc_validate(req
)) {
1934 sd
->card_status
|= COM_CRC_ERROR
;
1939 if (req
->cmd
>= SDMMC_CMD_MAX
) {
1940 qemu_log_mask(LOG_GUEST_ERROR
, "SD: incorrect command 0x%02x\n",
1945 if (sd
->card_status
& CARD_IS_LOCKED
) {
1946 if (!cmd_valid_while_locked(sd
, req
->cmd
)) {
1947 sd
->card_status
|= ILLEGAL_COMMAND
;
1948 sd
->expecting_acmd
= false;
1949 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Card is locked\n");
1955 last_state
= sd
->state
;
1958 if (sd
->expecting_acmd
) {
1959 sd
->expecting_acmd
= false;
1960 rtype
= sd_app_command(sd
, *req
);
1962 rtype
= sd_normal_command(sd
, *req
);
1965 if (rtype
== sd_illegal
) {
1966 sd
->card_status
|= ILLEGAL_COMMAND
;
1968 /* Valid command, we can update the 'state before command' bits.
1969 * (Do this now so they appear in r1 responses.)
1971 sd
->current_cmd
= req
->cmd
;
1972 sd
->card_status
= FIELD_DP32(sd
->card_status
, CSR
,
1973 CURRENT_STATE
, last_state
);
1980 sd_response_r1_make(sd
, response
);
1985 memcpy(response
, sd
->cid
, sizeof(sd
->cid
));
1990 memcpy(response
, sd
->csd
, sizeof(sd
->csd
));
1995 sd_response_r3_make(sd
, response
);
2000 sd_response_r6_make(sd
, response
);
2005 sd_response_r7_make(sd
, response
);
2011 * Invalid state transition, reset implementation
2012 * fields to avoid OOB abuse.
2015 sd
->data_offset
= 0;
2021 g_assert_not_reached();
2023 trace_sdcard_response(sd_response_name(rtype
), rsplen
);
2025 if (rtype
!= sd_illegal
) {
2026 /* Clear the "clear on valid command" status bits now we've
2029 sd
->card_status
&= ~CARD_STATUS_B
;
2033 qemu_hexdump(stderr
, "Response", response
, rsplen
);
2039 /* Return true if buffer is consumed. Configured by sd_cmd_to_receivingdata() */
2040 static bool sd_generic_write_byte(SDState
*sd
, uint8_t value
)
2042 sd
->data
[sd
->data_offset
] = value
;
2044 if (++sd
->data_offset
>= sd
->data_size
) {
2045 sd
->state
= sd_transfer_state
;
2051 /* Return true when buffer is consumed. Configured by sd_cmd_to_sendingdata() */
2052 static bool sd_generic_read_byte(SDState
*sd
, uint8_t *value
)
2054 *value
= sd
->data
[sd
->data_offset
];
2056 if (++sd
->data_offset
>= sd
->data_size
) {
2057 sd
->state
= sd_transfer_state
;
2064 void sd_write_byte(SDState
*sd
, uint8_t value
)
2068 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
2071 if (sd
->state
!= sd_receivingdata_state
) {
2072 qemu_log_mask(LOG_GUEST_ERROR
,
2073 "%s: not in Receiving-Data state\n", __func__
);
2077 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
2080 trace_sdcard_write_data(sd
->proto
->name
,
2082 sd
->current_cmd
, sd
->data_offset
, value
);
2083 switch (sd
->current_cmd
) {
2084 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
2085 if (sd_generic_write_byte(sd
, value
)) {
2086 /* TODO: Check CRC before committing */
2087 sd
->state
= sd_programming_state
;
2088 sd_blk_write(sd
, sd
->data_start
, sd
->data_offset
);
2090 sd
->csd
[14] |= 0x40;
2091 /* Bzzzzzzztt .... Operation complete. */
2092 sd
->state
= sd_transfer_state
;
2096 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2097 if (sd
->data_offset
== 0) {
2098 /* Start of the block - let's check the address is valid */
2099 if (!address_in_range(sd
, "WRITE_MULTIPLE_BLOCK",
2100 sd
->data_start
, sd
->blk_len
)) {
2103 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
2104 if (sd_wp_addr(sd
, sd
->data_start
)) {
2105 sd
->card_status
|= WP_VIOLATION
;
2110 sd
->data
[sd
->data_offset
++] = value
;
2111 if (sd
->data_offset
>= sd
->blk_len
) {
2112 /* TODO: Check CRC before committing */
2113 sd
->state
= sd_programming_state
;
2114 sd_blk_write(sd
, sd
->data_start
, sd
->data_offset
);
2116 sd
->data_start
+= sd
->blk_len
;
2117 sd
->data_offset
= 0;
2118 sd
->csd
[14] |= 0x40;
2120 /* Bzzzzzzztt .... Operation complete. */
2121 if (sd
->multi_blk_cnt
!= 0) {
2122 if (--sd
->multi_blk_cnt
== 0) {
2124 sd
->state
= sd_transfer_state
;
2129 sd
->state
= sd_receivingdata_state
;
2133 case 26: /* CMD26: PROGRAM_CID */
2134 if (sd_generic_write_byte(sd
, value
)) {
2135 /* TODO: Check CRC before committing */
2136 sd
->state
= sd_programming_state
;
2137 for (i
= 0; i
< sizeof(sd
->cid
); i
++)
2138 if ((sd
->cid
[i
] | 0x00) != sd
->data
[i
])
2139 sd
->card_status
|= CID_CSD_OVERWRITE
;
2141 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
2142 for (i
= 0; i
< sizeof(sd
->cid
); i
++) {
2144 sd
->cid
[i
] &= sd
->data
[i
];
2146 /* Bzzzzzzztt .... Operation complete. */
2147 sd
->state
= sd_transfer_state
;
2151 case 27: /* CMD27: PROGRAM_CSD */
2152 if (sd_generic_write_byte(sd
, value
)) {
2153 /* TODO: Check CRC before committing */
2154 sd
->state
= sd_programming_state
;
2155 for (i
= 0; i
< sizeof(sd
->csd
); i
++)
2156 if ((sd
->csd
[i
] | sd_csd_rw_mask
[i
]) !=
2157 (sd
->data
[i
] | sd_csd_rw_mask
[i
]))
2158 sd
->card_status
|= CID_CSD_OVERWRITE
;
2160 /* Copy flag (OTP) & Permanent write protect */
2161 if (sd
->csd
[14] & ~sd
->data
[14] & 0x60)
2162 sd
->card_status
|= CID_CSD_OVERWRITE
;
2164 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
2165 for (i
= 0; i
< sizeof(sd
->csd
); i
++) {
2166 sd
->csd
[i
] |= sd_csd_rw_mask
[i
];
2167 sd
->csd
[i
] &= sd
->data
[i
];
2169 /* Bzzzzzzztt .... Operation complete. */
2170 sd
->state
= sd_transfer_state
;
2174 case 42: /* CMD42: LOCK_UNLOCK */
2175 if (sd_generic_write_byte(sd
, value
)) {
2176 /* TODO: Check CRC before committing */
2177 sd
->state
= sd_programming_state
;
2178 sd_lock_command(sd
);
2179 /* Bzzzzzzztt .... Operation complete. */
2180 sd
->state
= sd_transfer_state
;
2184 case 56: /* CMD56: GEN_CMD */
2185 sd
->data
[sd
->data_offset
++] = value
;
2186 if (sd
->data_offset
>= sd
->blk_len
) {
2187 APP_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
2188 sd
->state
= sd_transfer_state
;
2193 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
2198 uint8_t sd_read_byte(SDState
*sd
)
2200 /* TODO: Append CRCs */
2204 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
2207 if (sd
->state
!= sd_sendingdata_state
) {
2208 qemu_log_mask(LOG_GUEST_ERROR
,
2209 "%s: not in Sending-Data state\n", __func__
);
2213 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
2216 io_len
= sd_blk_len(sd
);
2218 trace_sdcard_read_data(sd
->proto
->name
,
2220 sd
->current_cmd
, sd
->data_offset
, io_len
);
2221 switch (sd
->current_cmd
) {
2222 case 6: /* CMD6: SWITCH_FUNCTION */
2223 case 9: /* CMD9: SEND_CSD */
2224 case 10: /* CMD10: SEND_CID */
2225 case 13: /* ACMD13: SD_STATUS */
2226 case 17: /* CMD17: READ_SINGLE_BLOCK */
2227 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2228 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2229 case 30: /* CMD30: SEND_WRITE_PROT */
2230 case 51: /* ACMD51: SEND_SCR */
2231 sd_generic_read_byte(sd
, &ret
);
2234 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2235 if (sd
->data_offset
== 0) {
2236 if (!address_in_range(sd
, "READ_MULTIPLE_BLOCK",
2237 sd
->data_start
, io_len
)) {
2240 sd_blk_read(sd
, sd
->data_start
, io_len
);
2242 ret
= sd
->data
[sd
->data_offset
++];
2244 if (sd
->data_offset
>= io_len
) {
2245 sd
->data_start
+= io_len
;
2246 sd
->data_offset
= 0;
2248 if (sd
->multi_blk_cnt
!= 0) {
2249 if (--sd
->multi_blk_cnt
== 0) {
2251 sd
->state
= sd_transfer_state
;
2258 case 56: /* CMD56: GEN_CMD */
2259 if (sd
->data_offset
== 0)
2260 APP_READ_BLOCK(sd
->data_start
, sd
->blk_len
);
2261 ret
= sd
->data
[sd
->data_offset
++];
2263 if (sd
->data_offset
>= sd
->blk_len
)
2264 sd
->state
= sd_transfer_state
;
2268 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
2275 static bool sd_receive_ready(SDState
*sd
)
2277 return sd
->state
== sd_receivingdata_state
;
2280 static bool sd_data_ready(SDState
*sd
)
2282 return sd
->state
== sd_sendingdata_state
;
2285 void sd_enable(SDState
*sd
, bool enable
)
2287 sd
->enable
= enable
;
2290 static const SDProto sd_proto_spi
= {
2293 [0] = {0, sd_spi
, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE
},
2294 [1] = {0, sd_spi
, "SEND_OP_COND", spi_cmd_SEND_OP_COND
},
2295 [5] = {9, sd_spi
, "IO_SEND_OP_COND", sd_cmd_optional
},
2296 [6] = {10, sd_spi
, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION
},
2297 [8] = {0, sd_spi
, "SEND_IF_COND", sd_cmd_SEND_IF_COND
},
2298 [9] = {0, sd_spi
, "SEND_CSD", spi_cmd_SEND_CSD
},
2299 [10] = {0, sd_spi
, "SEND_CID", spi_cmd_SEND_CID
},
2300 [12] = {0, sd_spi
, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION
},
2301 [13] = {0, sd_spi
, "SEND_STATUS", sd_cmd_SEND_STATUS
},
2302 [16] = {2, sd_spi
, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN
},
2303 [17] = {2, sd_spi
, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK
},
2304 [24] = {4, sd_spi
, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK
},
2305 [27] = {4, sd_spi
, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD
},
2306 [28] = {6, sd_spi
, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT
},
2307 [29] = {6, sd_spi
, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT
},
2308 [30] = {6, sd_spi
, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT
},
2309 [32] = {5, sd_spi
, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START
},
2310 [33] = {5, sd_spi
, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END
},
2311 [34] = {10, sd_spi
, "READ_SEC_CMD", sd_cmd_optional
},
2312 [35] = {10, sd_spi
, "WRITE_SEC_CMD", sd_cmd_optional
},
2313 [36] = {10, sd_spi
, "SEND_PSI", sd_cmd_optional
},
2314 [37] = {10, sd_spi
, "CONTROL_ASSD_SYSTEM", sd_cmd_optional
},
2315 [38] = {5, sd_spi
, "ERASE", sd_cmd_ERASE
},
2316 [42] = {7, sd_spi
, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK
},
2317 [50] = {10, sd_spi
, "DIRECT_SECURE_READ", sd_cmd_optional
},
2318 [52] = {9, sd_spi
, "IO_RW_DIRECT", sd_cmd_optional
},
2319 [53] = {9, sd_spi
, "IO_RW_EXTENDED", sd_cmd_optional
},
2320 [55] = {8, sd_spi
, "APP_CMD", sd_cmd_APP_CMD
},
2321 [57] = {10, sd_spi
, "DIRECT_SECURE_WRITE", sd_cmd_optional
},
2322 [58] = {0, sd_spi
, "READ_OCR", spi_cmd_READ_OCR
},
2323 [59] = {0, sd_spi
, "CRC_ON_OFF", spi_cmd_CRC_ON_OFF
},
2326 [13] = {8, sd_spi
, "SD_STATUS", sd_acmd_SD_STATUS
},
2327 [22] = {8, sd_spi
, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS
},
2328 [23] = {8, sd_spi
, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT
},
2329 [41] = {8, sd_spi
, "SEND_OP_COND", spi_cmd_SEND_OP_COND
},
2330 [42] = {8, sd_spi
, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT
},
2331 [51] = {8, sd_spi
, "SEND_SCR", sd_acmd_SEND_SCR
},
2335 static const SDProto sd_proto_sd
= {
2338 [0] = {0, sd_bc
, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE
},
2339 [2] = {0, sd_bcr
, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID
},
2340 [3] = {0, sd_bcr
, "SEND_RELATIVE_ADDR", sd_cmd_SEND_RELATIVE_ADDR
},
2341 [4] = {0, sd_bc
, "SEND_DSR", sd_cmd_unimplemented
},
2342 [5] = {9, sd_bc
, "IO_SEND_OP_COND", sd_cmd_optional
},
2343 [6] = {10, sd_adtc
, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION
},
2344 [7] = {0, sd_ac
, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD
},
2345 [8] = {0, sd_bcr
, "SEND_IF_COND", sd_cmd_SEND_IF_COND
},
2346 [9] = {0, sd_ac
, "SEND_CSD", sd_cmd_SEND_CSD
},
2347 [10] = {0, sd_ac
, "SEND_CID", sd_cmd_SEND_CID
},
2348 [11] = {0, sd_ac
, "VOLTAGE_SWITCH", sd_cmd_optional
},
2349 [12] = {0, sd_ac
, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION
},
2350 [13] = {0, sd_ac
, "SEND_STATUS", sd_cmd_SEND_STATUS
},
2351 [15] = {0, sd_ac
, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE
},
2352 [16] = {2, sd_ac
, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN
},
2353 [17] = {2, sd_adtc
, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK
},
2354 [19] = {2, sd_adtc
, "SEND_TUNING_BLOCK", sd_cmd_SEND_TUNING_BLOCK
},
2355 [20] = {2, sd_ac
, "SPEED_CLASS_CONTROL", sd_cmd_optional
},
2356 [23] = {2, sd_ac
, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT
},
2357 [24] = {4, sd_adtc
, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK
},
2358 [27] = {4, sd_adtc
, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD
},
2359 [28] = {6, sd_ac
, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT
},
2360 [29] = {6, sd_ac
, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT
},
2361 [30] = {6, sd_adtc
, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT
},
2362 [32] = {5, sd_ac
, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START
},
2363 [33] = {5, sd_ac
, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END
},
2364 [34] = {10, sd_adtc
, "READ_SEC_CMD", sd_cmd_optional
},
2365 [35] = {10, sd_adtc
, "WRITE_SEC_CMD", sd_cmd_optional
},
2366 [36] = {10, sd_adtc
, "SEND_PSI", sd_cmd_optional
},
2367 [37] = {10, sd_ac
, "CONTROL_ASSD_SYSTEM", sd_cmd_optional
},
2368 [38] = {5, sd_ac
, "ERASE", sd_cmd_ERASE
},
2369 [42] = {7, sd_adtc
, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK
},
2370 [43] = {1, sd_ac
, "Q_MANAGEMENT", sd_cmd_optional
},
2371 [44] = {1, sd_ac
, "Q_TASK_INFO_A", sd_cmd_optional
},
2372 [45] = {1, sd_ac
, "Q_TASK_INFO_B", sd_cmd_optional
},
2373 [46] = {1, sd_adtc
, "Q_RD_TASK", sd_cmd_optional
},
2374 [47] = {1, sd_adtc
, "Q_WR_TASK", sd_cmd_optional
},
2375 [48] = {1, sd_adtc
, "READ_EXTR_SINGLE", sd_cmd_optional
},
2376 [49] = {1, sd_adtc
, "WRITE_EXTR_SINGLE", sd_cmd_optional
},
2377 [50] = {10, sd_adtc
, "DIRECT_SECURE_READ", sd_cmd_optional
},
2378 [52] = {9, sd_bc
, "IO_RW_DIRECT", sd_cmd_optional
},
2379 [53] = {9, sd_bc
, "IO_RW_EXTENDED", sd_cmd_optional
},
2380 [55] = {8, sd_ac
, "APP_CMD", sd_cmd_APP_CMD
},
2381 [57] = {10, sd_adtc
, "DIRECT_SECURE_WRITE", sd_cmd_optional
},
2382 [58] = {11, sd_adtc
, "READ_EXTR_MULTI", sd_cmd_optional
},
2383 [59] = {11, sd_adtc
, "WRITE_EXTR_MULTI", sd_cmd_optional
},
2386 [6] = {8, sd_ac
, "SET_BUS_WIDTH", sd_acmd_SET_BUS_WIDTH
},
2387 [13] = {8, sd_adtc
, "SD_STATUS", sd_acmd_SD_STATUS
},
2388 [22] = {8, sd_adtc
, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS
},
2389 [23] = {8, sd_ac
, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT
},
2390 [41] = {8, sd_bcr
, "SD_APP_OP_COND", sd_acmd_SD_APP_OP_COND
},
2391 [42] = {8, sd_ac
, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT
},
2392 [51] = {8, sd_adtc
, "SEND_SCR", sd_acmd_SEND_SCR
},
2396 static void sd_instance_init(Object
*obj
)
2398 SDState
*sd
= SD_CARD(obj
);
2399 SDCardClass
*sc
= SD_CARD_GET_CLASS(sd
);
2401 sd
->proto
= sc
->proto
;
2402 sd
->last_cmd_name
= "UNSET";
2404 sd
->ocr_power_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, sd_ocr_powerup
, sd
);
2407 static void sd_instance_finalize(Object
*obj
)
2409 SDState
*sd
= SD_CARD(obj
);
2411 timer_free(sd
->ocr_power_timer
);
2414 static void sd_realize(DeviceState
*dev
, Error
**errp
)
2416 SDState
*sd
= SD_CARD(dev
);
2419 switch (sd
->spec_version
) {
2420 case SD_PHY_SPECv1_10_VERS
2421 ... SD_PHY_SPECv3_01_VERS
:
2424 error_setg(errp
, "Invalid SD card Spec version: %u", sd
->spec_version
);
2431 if (!blk_supports_write_perm(sd
->blk
)) {
2432 error_setg(errp
, "Cannot use read-only drive as SD card");
2436 blk_size
= blk_getlength(sd
->blk
);
2437 if (blk_size
> 0 && !is_power_of_2(blk_size
)) {
2438 int64_t blk_size_aligned
= pow2ceil(blk_size
);
2441 blk_size_str
= size_to_str(blk_size
);
2442 error_setg(errp
, "Invalid SD card size: %s", blk_size_str
);
2443 g_free(blk_size_str
);
2445 blk_size_str
= size_to_str(blk_size_aligned
);
2446 error_append_hint(errp
,
2447 "SD card size has to be a power of 2, e.g. %s.\n"
2448 "You can resize disk images with"
2449 " 'qemu-img resize <imagefile> <new-size>'\n"
2450 "(note that this will lose data if you make the"
2451 " image smaller than it currently is).\n",
2453 g_free(blk_size_str
);
2458 ret
= blk_set_perm(sd
->blk
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE
,
2459 BLK_PERM_ALL
, errp
);
2463 blk_set_dev_ops(sd
->blk
, &sd_block_ops
, sd
);
2467 static Property sd_properties
[] = {
2468 DEFINE_PROP_UINT8("spec_version", SDState
,
2469 spec_version
, SD_PHY_SPECv2_00_VERS
),
2470 DEFINE_PROP_DRIVE("drive", SDState
, blk
),
2471 /* We do not model the chip select pin, so allow the board to select
2472 * whether card should be in SSI or MMC/SD mode. It is also up to the
2473 * board to ensure that ssi transfers only occur when the chip select
2475 DEFINE_PROP_END_OF_LIST()
2478 static void sd_class_init(ObjectClass
*klass
, void *data
)
2480 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2481 SDCardClass
*sc
= SD_CARD_CLASS(klass
);
2483 dc
->realize
= sd_realize
;
2484 device_class_set_props(dc
, sd_properties
);
2485 dc
->vmsd
= &sd_vmstate
;
2486 dc
->reset
= sd_reset
;
2487 dc
->bus_type
= TYPE_SD_BUS
;
2488 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
2490 sc
->set_voltage
= sd_set_voltage
;
2491 sc
->get_dat_lines
= sd_get_dat_lines
;
2492 sc
->get_cmd_line
= sd_get_cmd_line
;
2493 sc
->do_command
= sd_do_command
;
2494 sc
->write_byte
= sd_write_byte
;
2495 sc
->read_byte
= sd_read_byte
;
2496 sc
->receive_ready
= sd_receive_ready
;
2497 sc
->data_ready
= sd_data_ready
;
2498 sc
->enable
= sd_enable
;
2499 sc
->get_inserted
= sd_get_inserted
;
2500 sc
->get_readonly
= sd_get_readonly
;
2501 sc
->proto
= &sd_proto_sd
;
2505 * We do not model the chip select pin, so allow the board to select
2506 * whether card should be in SSI or MMC/SD mode. It is also up to the
2507 * board to ensure that ssi transfers only occur when the chip select
2510 static void sd_spi_class_init(ObjectClass
*klass
, void *data
)
2512 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2513 SDCardClass
*sc
= SD_CARD_CLASS(klass
);
2515 dc
->desc
= "SD SPI";
2516 sc
->proto
= &sd_proto_spi
;
2519 static const TypeInfo sd_types
[] = {
2521 .name
= TYPE_SD_CARD
,
2522 .parent
= TYPE_DEVICE
,
2523 .instance_size
= sizeof(SDState
),
2524 .class_size
= sizeof(SDCardClass
),
2525 .class_init
= sd_class_init
,
2526 .instance_init
= sd_instance_init
,
2527 .instance_finalize
= sd_instance_finalize
,
2530 .name
= TYPE_SD_CARD_SPI
,
2531 .parent
= TYPE_SD_CARD
,
2532 .class_init
= sd_spi_class_init
,
2536 DEFINE_TYPES(sd_types
)