2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
5 * eMMC emulation defined in "JEDEC Standard No. 84-A43"
7 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
8 * Copyright (c) 2007 CodeSourcery
9 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in
19 * the documentation and/or other materials provided with the
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
23 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
25 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
29 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
30 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 #include "qemu/osdep.h"
36 #include "qemu/units.h"
37 #include "qemu/cutils.h"
39 #include "hw/registerfields.h"
40 #include "sysemu/block-backend.h"
42 #include "hw/sd/sdcard_legacy.h"
43 #include "migration/vmstate.h"
44 #include "qapi/error.h"
45 #include "qemu/bitmap.h"
46 #include "hw/qdev-properties.h"
47 #include "hw/qdev-properties-system.h"
48 #include "qemu/error-report.h"
49 #include "qemu/timer.h"
51 #include "qemu/guest-random.h"
52 #include "qemu/module.h"
53 #include "sdmmc-internal.h"
58 #define SDSC_MAX_CAPACITY (2 * GiB)
60 #define INVALID_ADDRESS UINT32_MAX
63 sd_r0
= 0, /* no response */
64 sd_r1
, /* normal response command */
65 sd_r2_i
, /* CID register */
66 sd_r2_s
, /* CSD register */
67 sd_r3
, /* OCR register */
68 sd_r6
= 6, /* Published RCA response */
69 sd_r7
, /* Operating voltage */
76 sd_card_identification_mode
,
77 sd_data_transfer_mode
,
81 sd_waitirq_state
= -2, /* emmc */
82 sd_inactive_state
= -1,
86 sd_identification_state
= 2,
88 sd_transfer_state
= 4,
89 sd_sendingdata_state
= 5,
90 sd_receivingdata_state
= 6,
91 sd_programming_state
= 7,
92 sd_disconnect_state
= 8,
93 sd_bus_test_state
= 9, /* emmc */
94 sd_sleep_state
= 10, /* emmc */
95 sd_io_state
= 15 /* sd */
98 #define SDMMC_CMD_MAX 64
100 typedef sd_rsp_type_t (*sd_cmd_handler
)(SDState
*sd
, SDRequest req
);
102 typedef struct SDProto
{
105 const unsigned class;
106 const sd_cmd_type_t type
;
108 sd_cmd_handler handler
;
109 } cmd
[SDMMC_CMD_MAX
], acmd
[SDMMC_CMD_MAX
];
113 DeviceState parent_obj
;
115 /* If true, created by sd_init() for a non-qdevified caller */
116 /* TODO purge them with fire */
117 bool me_no_qdev_me_kill_mammoth_with_rocks
;
119 /* SD Memory Card Registers */
125 uint32_t card_status
;
126 uint8_t sd_status
[64];
128 uint8_t ext_csd
[512];
130 uint8_t ext_csd_rw
[192]; /* Modes segment */
131 uint8_t ext_csd_ro
[320]; /* Properties segment */
135 /* Static properties */
137 uint8_t spec_version
;
138 uint64_t boot_part_size
;
141 const SDProto
*proto
;
143 /* Runtime changeables */
145 uint32_t mode
; /* current card mode, one of SDCardModes */
146 int32_t state
; /* current card state, one of SDCardStates */
149 unsigned long *wp_group_bmap
;
150 int32_t wp_group_bits
;
153 uint32_t multi_blk_cnt
;
154 uint32_t erase_start
;
158 uint8_t function_group
[6];
160 const char *last_cmd_name
;
161 /* True if we will handle the next command as an ACMD. Note that this does
162 * *not* track the APP_CMD status bit!
165 uint32_t blk_written
;
168 uint32_t data_offset
;
171 qemu_irq readonly_cb
;
172 qemu_irq inserted_cb
;
173 QEMUTimer
*ocr_power_timer
;
179 static void sd_realize(DeviceState
*dev
, Error
**errp
);
181 static const SDProto sd_proto_spi
;
182 static const SDProto sd_proto_emmc
;
184 static bool sd_is_spi(SDState
*sd
)
186 return sd
->proto
== &sd_proto_spi
;
189 static bool sd_is_emmc(SDState
*sd
)
191 return sd
->proto
== &sd_proto_emmc
;
194 static const char *sd_version_str(enum SDPhySpecificationVersion version
)
196 static const char *sdphy_version
[] = {
197 [SD_PHY_SPECv1_10_VERS
] = "v1.10",
198 [SD_PHY_SPECv2_00_VERS
] = "v2.00",
199 [SD_PHY_SPECv3_01_VERS
] = "v3.01",
201 if (version
>= ARRAY_SIZE(sdphy_version
)) {
202 return "unsupported version";
204 return sdphy_version
[version
];
207 static const char *sd_mode_name(enum SDCardModes mode
)
209 static const char *mode_name
[] = {
210 [sd_inactive
] = "inactive",
211 [sd_card_identification_mode
] = "identification",
212 [sd_data_transfer_mode
] = "transfer",
214 assert(mode
< ARRAY_SIZE(mode_name
));
215 return mode_name
[mode
];
218 static const char *sd_state_name(enum SDCardStates state
)
220 static const char *state_name
[] = {
221 [sd_idle_state
] = "idle",
222 [sd_ready_state
] = "ready",
223 [sd_identification_state
] = "identification",
224 [sd_standby_state
] = "standby",
225 [sd_transfer_state
] = "transfer",
226 [sd_sendingdata_state
] = "sendingdata",
227 [sd_bus_test_state
] = "bus-test",
228 [sd_receivingdata_state
] = "receivingdata",
229 [sd_programming_state
] = "programming",
230 [sd_disconnect_state
] = "disconnect",
231 [sd_sleep_state
] = "sleep",
232 [sd_io_state
] = "i/o"
234 if (state
== sd_inactive_state
) {
237 if (state
== sd_waitirq_state
) {
240 assert(state
< ARRAY_SIZE(state_name
));
241 return state_name
[state
];
244 static const char *sd_response_name(sd_rsp_type_t rsp
)
246 static const char *response_name
[] = {
247 [sd_r0
] = "RESP#0 (no response)",
248 [sd_r1
] = "RESP#1 (normal cmd)",
249 [sd_r2_i
] = "RESP#2 (CID reg)",
250 [sd_r2_s
] = "RESP#2 (CSD reg)",
251 [sd_r3
] = "RESP#3 (OCR reg)",
252 [sd_r6
] = "RESP#6 (RCA)",
253 [sd_r7
] = "RESP#7 (operating voltage)",
255 if (rsp
== sd_illegal
) {
256 return "ILLEGAL RESP";
261 assert(rsp
< ARRAY_SIZE(response_name
));
262 return response_name
[rsp
];
265 static const char *sd_cmd_name(SDState
*sd
, uint8_t cmd
)
267 static const char *cmd_abbrev
[SDMMC_CMD_MAX
] = {
268 [18] = "READ_MULTIPLE_BLOCK",
269 [25] = "WRITE_MULTIPLE_BLOCK",
271 const SDProto
*sdp
= sd
->proto
;
273 if (sdp
->cmd
[cmd
].handler
) {
274 assert(!cmd_abbrev
[cmd
]);
275 return sdp
->cmd
[cmd
].name
;
277 return cmd_abbrev
[cmd
] ? cmd_abbrev
[cmd
] : "UNKNOWN_CMD";
280 static const char *sd_acmd_name(SDState
*sd
, uint8_t cmd
)
282 const SDProto
*sdp
= sd
->proto
;
284 if (sdp
->acmd
[cmd
].handler
) {
285 return sdp
->acmd
[cmd
].name
;
288 return "UNKNOWN_ACMD";
291 static uint8_t sd_get_dat_lines(SDState
*sd
)
293 return sd
->enable
? sd
->dat_lines
: 0;
296 static bool sd_get_cmd_line(SDState
*sd
)
298 return sd
->enable
? sd
->cmd_line
: false;
301 static void sd_set_voltage(SDState
*sd
, uint16_t millivolts
)
303 trace_sdcard_set_voltage(millivolts
);
305 switch (millivolts
) {
306 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
307 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
310 qemu_log_mask(LOG_GUEST_ERROR
, "SD card voltage not supported: %.3fV",
311 millivolts
/ 1000.f
);
315 static void sd_set_mode(SDState
*sd
)
318 case sd_inactive_state
:
319 sd
->mode
= sd_inactive
;
324 case sd_identification_state
:
325 sd
->mode
= sd_card_identification_mode
;
328 case sd_standby_state
:
329 case sd_transfer_state
:
330 case sd_sendingdata_state
:
331 case sd_receivingdata_state
:
332 case sd_programming_state
:
333 case sd_disconnect_state
:
334 sd
->mode
= sd_data_transfer_mode
;
339 static uint8_t sd_crc7(const void *message
, size_t width
)
342 uint8_t shift_reg
= 0x00;
343 const uint8_t *msg
= (const uint8_t *)message
;
345 for (i
= 0; i
< width
; i
++, msg
++)
346 for (bit
= 7; bit
>= 0; bit
--) {
348 if ((shift_reg
>> 7) ^ ((*msg
>> bit
) & 1))
355 /* Operation Conditions register */
357 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
359 FIELD(OCR
, VDD_VOLTAGE_WINDOW
, 0, 24)
360 FIELD(OCR
, VDD_VOLTAGE_WIN_LO
, 0, 8)
361 FIELD(OCR
, DUAL_VOLTAGE_CARD
, 7, 1)
362 FIELD(OCR
, VDD_VOLTAGE_WIN_HI
, 8, 16)
363 FIELD(OCR
, ACCEPT_SWITCH_1V8
, 24, 1) /* Only UHS-I */
364 FIELD(OCR
, UHS_II_CARD
, 29, 1) /* Only UHS-II */
365 FIELD(OCR
, CARD_CAPACITY
, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
366 FIELD(OCR
, CARD_POWER_UP
, 31, 1)
368 #define ACMD41_ENQUIRY_MASK 0x00ffffff
369 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
370 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
371 | R_OCR_UHS_II_CARD_MASK \
372 | R_OCR_CARD_CAPACITY_MASK \
373 | R_OCR_CARD_POWER_UP_MASK)
375 static void sd_ocr_powerup(void *opaque
)
377 SDState
*sd
= opaque
;
379 trace_sdcard_powerup();
380 assert(!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
));
382 /* card power-up OK */
383 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_POWER_UP
, 1);
385 if (sd
->size
> SDSC_MAX_CAPACITY
) {
386 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_CAPACITY
, 1);
390 static void sd_set_ocr(SDState
*sd
)
392 /* All voltages OK */
393 sd
->ocr
= R_OCR_VDD_VOLTAGE_WIN_HI_MASK
;
397 * We don't need to emulate power up sequence in SPI-mode.
398 * Thus, the card's power up status bit should be set to 1 when reset.
399 * The card's capacity status bit should also be set if SD card size
400 * is larger than 2GB for SDHC support.
406 /* SD Configuration register */
408 static void sd_set_scr(SDState
*sd
)
410 sd
->scr
[0] = 0 << 4; /* SCR structure version 1.0 */
411 if (sd
->spec_version
== SD_PHY_SPECv1_10_VERS
) {
412 sd
->scr
[0] |= 1; /* Spec Version 1.10 */
414 sd
->scr
[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
416 sd
->scr
[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
417 | 0b0101; /* 1-bit or 4-bit width bus modes */
418 sd
->scr
[2] = 0x00; /* Extended Security is not supported. */
419 if (sd
->spec_version
>= SD_PHY_SPECv3_01_VERS
) {
420 sd
->scr
[2] |= 1 << 7; /* Spec Version 3.0X */
423 /* reserved for manufacturer usage */
430 /* Card IDentification register */
439 static void sd_set_cid(SDState
*sd
)
441 sd
->cid
[0] = MID
; /* Fake card manufacturer ID (MID) */
442 sd
->cid
[1] = OID
[0]; /* OEM/Application ID (OID) */
444 sd
->cid
[3] = PNM
[0]; /* Fake product name (PNM) */
449 sd
->cid
[8] = PRV
; /* Fake product revision (PRV) */
450 stl_be_p(&sd
->cid
[9], 0xdeadbeef); /* Fake serial number (PSN) */
451 sd
->cid
[13] = 0x00 | /* Manufacture date (MDT) */
452 ((MDT_YR
- 2000) / 10);
453 sd
->cid
[14] = ((MDT_YR
% 10) << 4) | MDT_MON
;
454 sd
->cid
[15] = (sd_crc7(sd
->cid
, 15) << 1) | 1;
457 static void emmc_set_cid(SDState
*sd
)
459 sd
->cid
[0] = MID
; /* Fake card manufacturer ID (MID) */
460 sd
->cid
[1] = 0b01; /* CBX: soldered BGA */
461 sd
->cid
[2] = OID
[0]; /* OEM/Application ID (OID) */
462 sd
->cid
[3] = PNM
[0]; /* Fake product name (PNM) */
468 sd
->cid
[9] = PRV
; /* Fake product revision (PRV) */
469 stl_be_p(&sd
->cid
[10], 0xdeadbeef); /* Fake serial number (PSN) */
470 sd
->cid
[14] = (MDT_MON
<< 4) | (MDT_YR
- 1997); /* Manufacture date (MDT) */
471 sd
->cid
[15] = (sd_crc7(sd
->cid
, 15) << 1) | 1;
474 /* Card-Specific Data register */
476 #define HWBLOCK_SHIFT 9 /* 512 bytes */
477 #define SECTOR_SHIFT 5 /* 16 kilobytes */
478 #define WPGROUP_SHIFT 7 /* 2 megs */
479 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
480 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
482 static const uint8_t sd_csd_rw_mask
[16] = {
483 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
484 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
487 static void emmc_set_ext_csd(SDState
*sd
, uint64_t size
)
489 uint32_t sectcount
= size
>> HWBLOCK_SHIFT
;
491 memset(sd
->ext_csd
, 0, sizeof(sd
->ext_csd
)); /* FIXME only RW at reset */
493 /* Properties segment (RO) */
494 sd
->ext_csd
[EXT_CSD_S_CMD_SET
] = 0b1; /* supported command sets */
495 sd
->ext_csd
[EXT_CSD_BOOT_INFO
] = 0x0; /* Boot information */
496 /* Boot partition size. 128KB unit */
497 sd
->ext_csd
[EXT_CSD_BOOT_MULT
] = sd
->boot_part_size
/ (128 * KiB
);
498 sd
->ext_csd
[EXT_CSD_ACC_SIZE
] = 0x1; /* Access size */
499 sd
->ext_csd
[EXT_CSD_HC_ERASE_GRP_SIZE
] = 0x01; /* HC Erase unit size */
500 sd
->ext_csd
[EXT_CSD_ERASE_TIMEOUT_MULT
] = 0x01; /* HC erase timeout */
501 sd
->ext_csd
[EXT_CSD_REL_WR_SEC_C
] = 0x1; /* Reliable write sector count */
502 sd
->ext_csd
[EXT_CSD_HC_WP_GRP_SIZE
] = 0x01; /* HC write protect group size */
503 sd
->ext_csd
[EXT_CSD_S_C_VCC
] = 0x01; /* Sleep current VCC */
504 sd
->ext_csd
[EXT_CSD_S_C_VCCQ
] = 0x01; /* Sleep current VCCQ */
505 sd
->ext_csd
[EXT_CSD_S_A_TIMEOUT
] = 0x01; /* Sleep/Awake timeout */
506 stl_le_p(&sd
->ext_csd
[EXT_CSD_SEC_CNT
], sectcount
); /* Sector count */
507 sd
->ext_csd
[210] = 0x46; /* Min write perf for 8bit@52Mhz */
508 sd
->ext_csd
[209] = 0x46; /* Min read perf for 8bit@52Mhz */
509 sd
->ext_csd
[208] = 0x46; /* Min write perf for 4bit@52Mhz */
510 sd
->ext_csd
[207] = 0x46; /* Min read perf for 4bit@52Mhz */
511 sd
->ext_csd
[206] = 0x46; /* Min write perf for 4bit@26Mhz */
512 sd
->ext_csd
[205] = 0x46; /* Min read perf for 4bit@26Mhz */
513 sd
->ext_csd
[EXT_CSD_CARD_TYPE
] = 0b11;
514 sd
->ext_csd
[EXT_CSD_STRUCTURE
] = 2;
515 sd
->ext_csd
[EXT_CSD_REV
] = 3;
518 static void emmc_set_csd(SDState
*sd
, uint64_t size
)
520 int hwblock_shift
= HWBLOCK_SHIFT
;
521 uint32_t sectsize
= (1 << (SECTOR_SHIFT
+ 1)) - 1;
522 uint32_t wpsize
= (1 << (WPGROUP_SHIFT
+ 1)) - 1;
524 sd
->csd
[0] = (3 << 6) | (4 << 2); /* Spec v4.3 with EXT_CSD */
525 sd
->csd
[1] = (1 << 3) | 6; /* Asynchronous data access time: 1ms */
527 sd
->csd
[3] = (1 << 3) | 3;; /* Maximum bus clock frequency: 100MHz */
529 if (size
<= 2 * GiB
) {
531 uint32_t csize1k
= (size
>> (CMULT_SHIFT
+ 10)) - 1;
533 sd
->csd
[6] = 0x80 | ((csize1k
>> 10) & 0xf);
534 sd
->csd
[7] = (csize1k
>> 2) & 0xff;
535 } else { /* >= 2GB : size stored in ext CSD, block addressing */
539 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_CAPACITY
, 1);
542 sd
->csd
[9] = 0xfc | /* Max. write current */
543 ((CMULT_SHIFT
- 2) >> 1);
544 sd
->csd
[10] = 0x40 | /* Erase sector size */
545 (((CMULT_SHIFT
- 2) << 7) & 0x80) | (sectsize
>> 1);
546 sd
->csd
[11] = 0x00 | /* Write protect group size */
547 ((sectsize
<< 7) & 0x80) | wpsize
;
548 sd
->csd
[12] = 0x90 | /* Write speed factor */
549 (hwblock_shift
>> 2);
550 sd
->csd
[13] = 0x20 | /* Max. write data block length */
551 ((hwblock_shift
<< 6) & 0xc0);
553 sd
->csd
[15] = (sd_crc7(sd
->csd
, 15) << 1) | 1;
554 emmc_set_ext_csd(sd
, size
);
557 static void sd_set_csd(SDState
*sd
, uint64_t size
)
559 int hwblock_shift
= HWBLOCK_SHIFT
;
561 uint32_t sectsize
= (1 << (SECTOR_SHIFT
+ 1)) - 1;
562 uint32_t wpsize
= (1 << (WPGROUP_SHIFT
+ 1)) - 1;
564 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
565 if (size
== SDSC_MAX_CAPACITY
) {
568 csize
= (size
>> (CMULT_SHIFT
+ hwblock_shift
)) - 1;
570 if (size
<= SDSC_MAX_CAPACITY
) { /* Standard Capacity SD */
571 sd
->csd
[0] = 0x00; /* CSD structure */
572 sd
->csd
[1] = 0x26; /* Data read access-time-1 */
573 sd
->csd
[2] = 0x00; /* Data read access-time-2 */
574 sd
->csd
[3] = 0x32; /* Max. data transfer rate: 25 MHz */
575 sd
->csd
[4] = 0x5f; /* Card Command Classes */
576 sd
->csd
[5] = 0x50 | /* Max. read data block length */
578 sd
->csd
[6] = 0xe0 | /* Partial block for read allowed */
579 ((csize
>> 10) & 0x03);
580 sd
->csd
[7] = 0x00 | /* Device size */
581 ((csize
>> 2) & 0xff);
582 sd
->csd
[8] = 0x3f | /* Max. read current */
583 ((csize
<< 6) & 0xc0);
584 sd
->csd
[9] = 0xfc | /* Max. write current */
585 ((CMULT_SHIFT
- 2) >> 1);
586 sd
->csd
[10] = 0x40 | /* Erase sector size */
587 (((CMULT_SHIFT
- 2) << 7) & 0x80) | (sectsize
>> 1);
588 sd
->csd
[11] = 0x00 | /* Write protect group size */
589 ((sectsize
<< 7) & 0x80) | wpsize
;
590 sd
->csd
[12] = 0x90 | /* Write speed factor */
591 (hwblock_shift
>> 2);
592 sd
->csd
[13] = 0x20 | /* Max. write data block length */
593 ((hwblock_shift
<< 6) & 0xc0);
594 sd
->csd
[14] = 0x00; /* File format group */
605 st24_be_p(&sd
->csd
[7], size
);
612 sd
->csd
[15] = (sd_crc7(sd
->csd
, 15) << 1) | 1;
615 /* Relative Card Address register */
617 static void sd_set_rca(SDState
*sd
, uint16_t value
)
619 trace_sdcard_set_rca(value
);
623 static uint16_t sd_req_get_rca(SDState
*s
, SDRequest req
)
625 switch (s
->proto
->cmd
[req
.cmd
].type
) {
628 return req
.arg
>> 16;
631 g_assert_not_reached();
635 static bool sd_req_rca_same(SDState
*s
, SDRequest req
)
637 return sd_req_get_rca(s
, req
) == s
->rca
;
640 /* Card Status register */
642 FIELD(CSR
, AKE_SEQ_ERROR
, 3, 1)
643 FIELD(CSR
, APP_CMD
, 5, 1)
644 FIELD(CSR
, FX_EVENT
, 6, 1)
645 FIELD(CSR
, SWITCH_ERROR
, 7, 1)
646 FIELD(CSR
, READY_FOR_DATA
, 8, 1)
647 FIELD(CSR
, CURRENT_STATE
, 9, 4)
648 FIELD(CSR
, ERASE_RESET
, 13, 1)
649 FIELD(CSR
, CARD_ECC_DISABLED
, 14, 1)
650 FIELD(CSR
, WP_ERASE_SKIP
, 15, 1)
651 FIELD(CSR
, CSD_OVERWRITE
, 16, 1)
652 FIELD(CSR
, DEFERRED_RESPONSE
, 17, 1)
653 FIELD(CSR
, ERROR
, 19, 1)
654 FIELD(CSR
, CC_ERROR
, 20, 1)
655 FIELD(CSR
, CARD_ECC_FAILED
, 21, 1)
656 FIELD(CSR
, ILLEGAL_COMMAND
, 22, 1)
657 FIELD(CSR
, COM_CRC_ERROR
, 23, 1)
658 FIELD(CSR
, LOCK_UNLOCK_FAILED
, 24, 1)
659 FIELD(CSR
, CARD_IS_LOCKED
, 25, 1)
660 FIELD(CSR
, WP_VIOLATION
, 26, 1)
661 FIELD(CSR
, ERASE_PARAM
, 27, 1)
662 FIELD(CSR
, ERASE_SEQ_ERROR
, 28, 1)
663 FIELD(CSR
, BLOCK_LEN_ERROR
, 29, 1)
664 FIELD(CSR
, ADDRESS_ERROR
, 30, 1)
665 FIELD(CSR
, OUT_OF_RANGE
, 31, 1)
667 /* Card status bits, split by clear condition:
668 * A : According to the card current state
669 * B : Always related to the previous command
670 * C : Cleared by read
672 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
673 | R_CSR_CARD_ECC_DISABLED_MASK \
674 | R_CSR_CARD_IS_LOCKED_MASK)
675 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
676 | R_CSR_ILLEGAL_COMMAND_MASK \
677 | R_CSR_COM_CRC_ERROR_MASK)
678 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
679 | R_CSR_APP_CMD_MASK \
680 | R_CSR_ERASE_RESET_MASK \
681 | R_CSR_WP_ERASE_SKIP_MASK \
682 | R_CSR_CSD_OVERWRITE_MASK \
684 | R_CSR_CC_ERROR_MASK \
685 | R_CSR_CARD_ECC_FAILED_MASK \
686 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
687 | R_CSR_WP_VIOLATION_MASK \
688 | R_CSR_ERASE_PARAM_MASK \
689 | R_CSR_ERASE_SEQ_ERROR_MASK \
690 | R_CSR_BLOCK_LEN_ERROR_MASK \
691 | R_CSR_ADDRESS_ERROR_MASK \
692 | R_CSR_OUT_OF_RANGE_MASK)
694 static void sd_set_cardstatus(SDState
*sd
)
696 sd
->card_status
= READY_FOR_DATA
;
699 static void sd_set_sdstatus(SDState
*sd
)
701 memset(sd
->sd_status
, 0, 64);
704 static const uint8_t sd_tuning_block_pattern4
[64] = {
706 * See: Physical Layer Simplified Specification Version 3.01,
709 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
710 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
711 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
712 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
713 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
714 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
715 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
716 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde
719 static int sd_req_crc_validate(SDRequest
*req
)
722 buffer
[0] = 0x40 | req
->cmd
;
723 stl_be_p(&buffer
[1], req
->arg
);
725 return sd_crc7(buffer
, 5) != req
->crc
; /* TODO */
728 static void sd_response_r1_make(SDState
*sd
, uint8_t *response
)
730 stl_be_p(response
, sd
->card_status
);
732 /* Clear the "clear on read" status bits */
733 sd
->card_status
&= ~CARD_STATUS_C
;
736 static void sd_response_r3_make(SDState
*sd
, uint8_t *response
)
738 stl_be_p(response
, sd
->ocr
& ACMD41_R3_MASK
);
741 static void sd_response_r6_make(SDState
*sd
, uint8_t *response
)
745 status
= ((sd
->card_status
>> 8) & 0xc000) |
746 ((sd
->card_status
>> 6) & 0x2000) |
747 (sd
->card_status
& 0x1fff);
748 sd
->card_status
&= ~(CARD_STATUS_C
& 0xc81fff);
749 stw_be_p(response
+ 0, sd
->rca
);
750 stw_be_p(response
+ 2, status
);
753 static void sd_response_r7_make(SDState
*sd
, uint8_t *response
)
755 stl_be_p(response
, sd
->vhs
);
758 static uint32_t sd_blk_len(SDState
*sd
)
760 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
761 return 1 << HWBLOCK_SHIFT
;
766 static uint64_t sd_req_get_address(SDState
*sd
, SDRequest req
)
770 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
771 addr
= (uint64_t) req
.arg
<< HWBLOCK_SHIFT
;
775 trace_sdcard_req_addr(req
.arg
, addr
);
779 static inline uint64_t sd_addr_to_wpnum(uint64_t addr
)
781 return addr
>> (HWBLOCK_SHIFT
+ SECTOR_SHIFT
+ WPGROUP_SHIFT
);
784 static void sd_reset(DeviceState
*dev
)
786 SDState
*sd
= SDMMC_COMMON(dev
);
787 SDCardClass
*sc
= SDMMC_COMMON_GET_CLASS(sd
);
791 trace_sdcard_reset();
793 blk_get_geometry(sd
->blk
, §
);
797 size
= sect
<< HWBLOCK_SHIFT
;
799 sect
= sd_addr_to_wpnum(size
) + 1;
801 sd
->state
= sd_idle_state
;
804 sd
->rca
= sd_is_emmc(sd
) ? 0x0001 : 0x0000;
809 sc
->set_csd(sd
, size
);
810 sd_set_cardstatus(sd
);
813 g_free(sd
->wp_group_bmap
);
814 sd
->wp_switch
= sd
->blk
? !blk_is_writable(sd
->blk
) : false;
815 sd
->wp_group_bits
= sect
;
816 sd
->wp_group_bmap
= bitmap_new(sd
->wp_group_bits
);
817 memset(sd
->function_group
, 0, sizeof(sd
->function_group
));
818 sd
->erase_start
= INVALID_ADDRESS
;
819 sd
->erase_end
= INVALID_ADDRESS
;
822 sd
->expecting_acmd
= false;
825 sd
->multi_blk_cnt
= 0;
828 static bool sd_get_inserted(SDState
*sd
)
830 return sd
->blk
&& blk_is_inserted(sd
->blk
);
833 static bool sd_get_readonly(SDState
*sd
)
835 return sd
->wp_switch
;
838 static void sd_cardchange(void *opaque
, bool load
, Error
**errp
)
840 SDState
*sd
= opaque
;
841 DeviceState
*dev
= DEVICE(sd
);
843 bool inserted
= sd_get_inserted(sd
);
844 bool readonly
= sd_get_readonly(sd
);
847 trace_sdcard_inserted(readonly
);
850 trace_sdcard_ejected();
853 if (sd
->me_no_qdev_me_kill_mammoth_with_rocks
) {
854 qemu_set_irq(sd
->inserted_cb
, inserted
);
856 qemu_set_irq(sd
->readonly_cb
, readonly
);
859 sdbus
= SD_BUS(qdev_get_parent_bus(dev
));
860 sdbus_set_inserted(sdbus
, inserted
);
862 sdbus_set_readonly(sdbus
, readonly
);
867 static const BlockDevOps sd_block_ops
= {
868 .change_media_cb
= sd_cardchange
,
871 static bool sd_ocr_vmstate_needed(void *opaque
)
873 SDState
*sd
= opaque
;
875 /* Include the OCR state (and timer) if it is not yet powered up */
876 return !FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
);
879 static const VMStateDescription sd_ocr_vmstate
= {
880 .name
= "sd-card/ocr-state",
882 .minimum_version_id
= 1,
883 .needed
= sd_ocr_vmstate_needed
,
884 .fields
= (const VMStateField
[]) {
885 VMSTATE_UINT32(ocr
, SDState
),
886 VMSTATE_TIMER_PTR(ocr_power_timer
, SDState
),
887 VMSTATE_END_OF_LIST()
891 static bool vmstate_needed_for_emmc(void *opaque
)
893 SDState
*sd
= opaque
;
895 return sd_is_emmc(sd
);
898 static const VMStateDescription emmc_extcsd_vmstate
= {
899 .name
= "sd-card/ext_csd_modes-state",
901 .minimum_version_id
= 1,
902 .needed
= vmstate_needed_for_emmc
,
903 .fields
= (const VMStateField
[]) {
904 VMSTATE_UINT8_ARRAY(ext_csd_rw
, SDState
, 192),
905 VMSTATE_END_OF_LIST()
909 static int sd_vmstate_pre_load(void *opaque
)
911 SDState
*sd
= opaque
;
913 /* If the OCR state is not included (prior versions, or not
914 * needed), then the OCR must be set as powered up. If the OCR state
915 * is included, this will be replaced by the state restore.
922 static const VMStateDescription sd_vmstate
= {
925 .minimum_version_id
= 2,
926 .pre_load
= sd_vmstate_pre_load
,
927 .fields
= (const VMStateField
[]) {
928 VMSTATE_UINT32(mode
, SDState
),
929 VMSTATE_INT32(state
, SDState
),
930 VMSTATE_UINT8_ARRAY(cid
, SDState
, 16),
931 VMSTATE_UINT8_ARRAY(csd
, SDState
, 16),
932 VMSTATE_UINT16(rca
, SDState
),
933 VMSTATE_UINT32(card_status
, SDState
),
934 VMSTATE_PARTIAL_BUFFER(sd_status
, SDState
, 1),
935 VMSTATE_UINT32(vhs
, SDState
),
936 VMSTATE_BITMAP(wp_group_bmap
, SDState
, 0, wp_group_bits
),
937 VMSTATE_UINT32(blk_len
, SDState
),
938 VMSTATE_UINT32(multi_blk_cnt
, SDState
),
939 VMSTATE_UINT32(erase_start
, SDState
),
940 VMSTATE_UINT32(erase_end
, SDState
),
941 VMSTATE_UINT8_ARRAY(pwd
, SDState
, 16),
942 VMSTATE_UINT32(pwd_len
, SDState
),
943 VMSTATE_UINT8_ARRAY(function_group
, SDState
, 6),
944 VMSTATE_UINT8(current_cmd
, SDState
),
945 VMSTATE_BOOL(expecting_acmd
, SDState
),
946 VMSTATE_UINT32(blk_written
, SDState
),
947 VMSTATE_UINT64(data_start
, SDState
),
948 VMSTATE_UINT32(data_offset
, SDState
),
949 VMSTATE_UINT8_ARRAY(data
, SDState
, 512),
950 VMSTATE_UNUSED_V(1, 512),
951 VMSTATE_BOOL(enable
, SDState
),
952 VMSTATE_END_OF_LIST()
954 .subsections
= (const VMStateDescription
* const []) {
956 &emmc_extcsd_vmstate
,
961 /* Legacy initialization function for use by non-qdevified callers */
962 SDState
*sd_init(BlockBackend
*blk
, bool is_spi
)
969 obj
= object_new(is_spi
? TYPE_SD_CARD_SPI
: TYPE_SD_CARD
);
971 if (!qdev_prop_set_drive_err(dev
, "drive", blk
, &err
)) {
972 error_reportf_err(err
, "sd_init failed: ");
977 * Realizing the device properly would put it into the QOM
978 * composition tree even though it is not plugged into an
979 * appropriate bus. That's a no-no. Hide the device from
980 * QOM/qdev, and call its qdev realize callback directly.
983 object_unparent(obj
);
984 sd_realize(dev
, &err
);
986 error_reportf_err(err
, "sd_init failed: ");
991 sd
->me_no_qdev_me_kill_mammoth_with_rocks
= true;
995 void sd_set_cb(SDState
*sd
, qemu_irq readonly
, qemu_irq insert
)
997 sd
->readonly_cb
= readonly
;
998 sd
->inserted_cb
= insert
;
999 qemu_set_irq(readonly
, sd
->blk
? !blk_is_writable(sd
->blk
) : 0);
1000 qemu_set_irq(insert
, sd
->blk
? blk_is_inserted(sd
->blk
) : 0);
1003 static void sd_blk_read(SDState
*sd
, uint64_t addr
, uint32_t len
)
1005 trace_sdcard_read_block(addr
, len
);
1006 if (!sd
->blk
|| blk_pread(sd
->blk
, addr
, len
, sd
->data
, 0) < 0) {
1007 fprintf(stderr
, "sd_blk_read: read error on host side\n");
1011 static void sd_blk_write(SDState
*sd
, uint64_t addr
, uint32_t len
)
1013 trace_sdcard_write_block(addr
, len
);
1014 if (!sd
->blk
|| blk_pwrite(sd
->blk
, addr
, len
, sd
->data
, 0) < 0) {
1015 fprintf(stderr
, "sd_blk_write: write error on host side\n");
1019 static void sd_erase(SDState
*sd
)
1021 uint64_t erase_start
= sd
->erase_start
;
1022 uint64_t erase_end
= sd
->erase_end
;
1025 uint64_t erase_addr
;
1026 int erase_len
= 1 << HWBLOCK_SHIFT
;
1028 trace_sdcard_erase(sd
->erase_start
, sd
->erase_end
);
1029 if (sd
->erase_start
== INVALID_ADDRESS
1030 || sd
->erase_end
== INVALID_ADDRESS
) {
1031 sd
->card_status
|= ERASE_SEQ_ERROR
;
1032 sd
->erase_start
= INVALID_ADDRESS
;
1033 sd
->erase_end
= INVALID_ADDRESS
;
1037 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
1038 /* High capacity memory card: erase units are 512 byte blocks */
1039 erase_start
<<= HWBLOCK_SHIFT
;
1040 erase_end
<<= HWBLOCK_SHIFT
;
1044 if (erase_start
> sd
->size
|| erase_end
> sd
->size
) {
1045 sd
->card_status
|= OUT_OF_RANGE
;
1046 sd
->erase_start
= INVALID_ADDRESS
;
1047 sd
->erase_end
= INVALID_ADDRESS
;
1051 sd
->erase_start
= INVALID_ADDRESS
;
1052 sd
->erase_end
= INVALID_ADDRESS
;
1053 sd
->csd
[14] |= 0x40;
1055 memset(sd
->data
, 0xff, erase_len
);
1056 for (erase_addr
= erase_start
; erase_addr
<= erase_end
;
1057 erase_addr
+= erase_len
) {
1059 /* Only SDSC cards support write protect groups */
1060 wpnum
= sd_addr_to_wpnum(erase_addr
);
1061 assert(wpnum
< sd
->wp_group_bits
);
1062 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
1063 sd
->card_status
|= WP_ERASE_SKIP
;
1067 sd_blk_write(sd
, erase_addr
, erase_len
);
1071 static uint32_t sd_wpbits(SDState
*sd
, uint64_t addr
)
1076 wpnum
= sd_addr_to_wpnum(addr
);
1078 for (i
= 0; i
< 32; i
++, wpnum
++, addr
+= WPGROUP_SIZE
) {
1079 if (addr
>= sd
->size
) {
1081 * If the addresses of the last groups are outside the valid range,
1082 * then the corresponding write protection bits shall be set to 0.
1086 assert(wpnum
< sd
->wp_group_bits
);
1087 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
1095 enum ExtCsdAccessMode
{
1096 EXT_CSD_ACCESS_MODE_COMMAND_SET
= 0,
1097 EXT_CSD_ACCESS_MODE_SET_BITS
= 1,
1098 EXT_CSD_ACCESS_MODE_CLEAR_BITS
= 2,
1099 EXT_CSD_ACCESS_MODE_WRITE_BYTE
= 3
1102 static void emmc_function_switch(SDState
*sd
, uint32_t arg
)
1104 uint8_t access
= extract32(arg
, 24, 2);
1105 uint8_t index
= extract32(arg
, 16, 8);
1106 uint8_t value
= extract32(arg
, 8, 8);
1107 uint8_t b
= sd
->ext_csd
[index
];
1109 trace_sdcard_switch(access
, index
, value
, extract32(arg
, 0, 2));
1112 qemu_log_mask(LOG_GUEST_ERROR
, "MMC switching illegal offset\n");
1113 sd
->card_status
|= R_CSR_SWITCH_ERROR_MASK
;
1118 case EXT_CSD_ACCESS_MODE_COMMAND_SET
:
1119 qemu_log_mask(LOG_UNIMP
, "MMC Command set switching not supported\n");
1121 case EXT_CSD_ACCESS_MODE_SET_BITS
:
1124 case EXT_CSD_ACCESS_MODE_CLEAR_BITS
:
1127 case EXT_CSD_ACCESS_MODE_WRITE_BYTE
:
1132 trace_sdcard_ext_csd_update(index
, sd
->ext_csd
[index
], b
);
1133 sd
->ext_csd
[index
] = b
;
1136 static void sd_function_switch(SDState
*sd
, uint32_t arg
)
1138 int i
, mode
, new_func
;
1139 mode
= !!(arg
& 0x80000000);
1141 sd
->data
[0] = 0x00; /* Maximum current consumption */
1143 sd
->data
[2] = 0x80; /* Supported group 6 functions */
1145 sd
->data
[4] = 0x80; /* Supported group 5 functions */
1147 sd
->data
[6] = 0x80; /* Supported group 4 functions */
1149 sd
->data
[8] = 0x80; /* Supported group 3 functions */
1151 sd
->data
[10] = 0x80; /* Supported group 2 functions */
1152 sd
->data
[11] = 0x43;
1153 sd
->data
[12] = 0x80; /* Supported group 1 functions */
1154 sd
->data
[13] = 0x03;
1156 memset(&sd
->data
[14], 0, 3);
1157 for (i
= 0; i
< 6; i
++) {
1158 new_func
= (arg
>> (i
* 4)) & 0x0f;
1159 if (mode
&& new_func
!= 0x0f)
1160 sd
->function_group
[i
] = new_func
;
1161 sd
->data
[16 - (i
>> 1)] |= new_func
<< ((i
% 2) * 4);
1163 memset(&sd
->data
[17], 0, 47);
1166 static inline bool sd_wp_addr(SDState
*sd
, uint64_t addr
)
1168 return test_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1171 static void sd_lock_command(SDState
*sd
)
1173 int erase
, lock
, clr_pwd
, set_pwd
, pwd_len
;
1174 erase
= !!(sd
->data
[0] & 0x08);
1175 lock
= sd
->data
[0] & 0x04;
1176 clr_pwd
= sd
->data
[0] & 0x02;
1177 set_pwd
= sd
->data
[0] & 0x01;
1179 if (sd
->blk_len
> 1)
1180 pwd_len
= sd
->data
[1];
1185 trace_sdcard_lock();
1187 trace_sdcard_unlock();
1190 if (!(sd
->card_status
& CARD_IS_LOCKED
) || sd
->blk_len
> 1 ||
1191 set_pwd
|| clr_pwd
|| lock
|| sd
->wp_switch
||
1192 (sd
->csd
[14] & 0x20)) {
1193 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1196 bitmap_zero(sd
->wp_group_bmap
, sd
->wp_group_bits
);
1197 sd
->csd
[14] &= ~0x10;
1198 sd
->card_status
&= ~CARD_IS_LOCKED
;
1200 /* Erasing the entire card here! */
1201 fprintf(stderr
, "SD: Card force-erased by CMD42\n");
1205 if (sd
->blk_len
< 2 + pwd_len
||
1206 pwd_len
<= sd
->pwd_len
||
1207 pwd_len
> sd
->pwd_len
+ 16) {
1208 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1212 if (sd
->pwd_len
&& memcmp(sd
->pwd
, sd
->data
+ 2, sd
->pwd_len
)) {
1213 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1217 pwd_len
-= sd
->pwd_len
;
1218 if ((pwd_len
&& !set_pwd
) ||
1219 (clr_pwd
&& (set_pwd
|| lock
)) ||
1220 (lock
&& !sd
->pwd_len
&& !set_pwd
) ||
1221 (!set_pwd
&& !clr_pwd
&&
1222 (((sd
->card_status
& CARD_IS_LOCKED
) && lock
) ||
1223 (!(sd
->card_status
& CARD_IS_LOCKED
) && !lock
)))) {
1224 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
1229 memcpy(sd
->pwd
, sd
->data
+ 2 + sd
->pwd_len
, pwd_len
);
1230 sd
->pwd_len
= pwd_len
;
1238 sd
->card_status
|= CARD_IS_LOCKED
;
1240 sd
->card_status
&= ~CARD_IS_LOCKED
;
1243 static bool address_in_range(SDState
*sd
, const char *desc
,
1244 uint64_t addr
, uint32_t length
)
1246 if (addr
+ length
> sd
->size
) {
1247 qemu_log_mask(LOG_GUEST_ERROR
,
1248 "%s offset %"PRIu64
" > card %"PRIu64
" [%%%u]\n",
1249 desc
, addr
, sd
->size
, length
);
1250 sd
->card_status
|= ADDRESS_ERROR
;
1256 static sd_rsp_type_t
sd_invalid_state_for_cmd(SDState
*sd
, SDRequest req
)
1258 qemu_log_mask(LOG_GUEST_ERROR
, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1259 sd
->proto
->name
, req
.cmd
, sd_state_name(sd
->state
),
1260 sd_version_str(sd
->spec_version
));
1265 static sd_rsp_type_t
sd_invalid_mode_for_cmd(SDState
*sd
, SDRequest req
)
1267 qemu_log_mask(LOG_GUEST_ERROR
, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
1268 sd
->proto
->name
, req
.cmd
, sd_mode_name(sd
->mode
),
1269 sd_version_str(sd
->spec_version
));
1274 static sd_rsp_type_t
sd_cmd_illegal(SDState
*sd
, SDRequest req
)
1276 qemu_log_mask(LOG_GUEST_ERROR
, "%s: Unknown CMD%i for spec %s\n",
1277 sd
->proto
->name
, req
.cmd
,
1278 sd_version_str(sd
->spec_version
));
1283 /* Commands that are recognised but not yet implemented. */
1284 static sd_rsp_type_t
sd_cmd_unimplemented(SDState
*sd
, SDRequest req
)
1286 qemu_log_mask(LOG_UNIMP
, "%s: CMD%i not implemented\n",
1287 sd
->proto
->name
, req
.cmd
);
1292 static sd_rsp_type_t
sd_cmd_optional(SDState
*sd
, SDRequest req
)
1294 qemu_log_mask(LOG_UNIMP
, "%s: Optional CMD%i not implemented\n",
1295 sd
->proto
->name
, req
.cmd
);
1300 /* Configure fields for following sd_generic_write_byte() calls */
1301 static sd_rsp_type_t
sd_cmd_to_receivingdata(SDState
*sd
, SDRequest req
,
1302 uint64_t start
, size_t size
)
1304 if (sd
->state
!= sd_transfer_state
) {
1305 return sd_invalid_state_for_cmd(sd
, req
);
1307 sd
->state
= sd_receivingdata_state
;
1308 sd
->data_start
= start
;
1309 sd
->data_offset
= 0;
1310 /* sd->data[] used as receive buffer */
1311 sd
->data_size
= size
?: sizeof(sd
->data
);
1315 /* Configure fields for following sd_generic_read_byte() calls */
1316 static sd_rsp_type_t
sd_cmd_to_sendingdata(SDState
*sd
, SDRequest req
,
1318 const void *data
, size_t size
)
1320 if (sd
->state
!= sd_transfer_state
) {
1321 sd_invalid_state_for_cmd(sd
, req
);
1324 sd
->state
= sd_sendingdata_state
;
1325 sd
->data_start
= start
;
1326 sd
->data_offset
= 0;
1328 assert(size
> 0 && size
<= sizeof(sd
->data
));
1329 memcpy(sd
->data
, data
, size
);
1332 sd
->data_size
= size
;
1338 static sd_rsp_type_t
sd_cmd_GO_IDLE_STATE(SDState
*sd
, SDRequest req
)
1340 if (sd
->state
== sd_sleep_state
) {
1349 if (sd
->state
!= sd_inactive_state
) {
1350 sd
->state
= sd_idle_state
;
1351 sd_reset(DEVICE(sd
));
1354 return sd_is_spi(sd
) ? sd_r1
: sd_r0
;
1358 static sd_rsp_type_t
spi_cmd_SEND_OP_COND(SDState
*sd
, SDRequest req
)
1360 sd
->state
= sd_transfer_state
;
1366 static sd_rsp_type_t
sd_cmd_ALL_SEND_CID(SDState
*sd
, SDRequest req
)
1368 switch (sd
->state
) {
1369 case sd_ready_state
:
1370 sd
->state
= sd_identification_state
;
1373 return sd_invalid_state_for_cmd(sd
, req
);
1378 static sd_rsp_type_t
sd_cmd_SEND_RELATIVE_ADDR(SDState
*sd
, SDRequest req
)
1380 uint16_t random_rca
;
1382 switch (sd
->state
) {
1383 case sd_identification_state
:
1384 case sd_standby_state
:
1385 sd
->state
= sd_standby_state
;
1386 qemu_guest_getrandom_nofail(&random_rca
, sizeof(random_rca
));
1387 sd_set_rca(sd
, random_rca
);
1391 return sd_invalid_state_for_cmd(sd
, req
);
1395 static sd_rsp_type_t
emmc_cmd_SET_RELATIVE_ADDR(SDState
*sd
, SDRequest req
)
1397 switch (sd
->state
) {
1398 case sd_identification_state
:
1399 case sd_standby_state
:
1400 sd
->state
= sd_standby_state
;
1401 sd_set_rca(sd
, req
.arg
>> 16);
1405 return sd_invalid_state_for_cmd(sd
, req
);
1410 static sd_rsp_type_t
emmc_cmd_sleep_awake(SDState
*sd
, SDRequest req
)
1412 bool do_sleep
= extract32(req
.arg
, 15, 1);
1414 switch (sd
->state
) {
1415 case sd_sleep_state
:
1418 sd
->state
= sd_standby_state
;
1422 case sd_standby_state
:
1424 sd
->state
= sd_sleep_state
;
1429 return sd_invalid_state_for_cmd(sd
, req
);
1434 static sd_rsp_type_t
sd_cmd_SWITCH_FUNCTION(SDState
*sd
, SDRequest req
)
1436 if (sd
->mode
!= sd_data_transfer_mode
) {
1437 return sd_invalid_mode_for_cmd(sd
, req
);
1439 if (sd
->state
!= sd_transfer_state
) {
1440 return sd_invalid_state_for_cmd(sd
, req
);
1443 sd_function_switch(sd
, req
.arg
);
1444 return sd_cmd_to_sendingdata(sd
, req
, 0, NULL
, 64);
1447 static sd_rsp_type_t
emmc_cmd_SWITCH(SDState
*sd
, SDRequest req
)
1449 switch (sd
->state
) {
1450 case sd_transfer_state
:
1451 sd
->state
= sd_programming_state
;
1452 emmc_function_switch(sd
, req
.arg
);
1453 sd
->state
= sd_transfer_state
;
1456 return sd_invalid_state_for_cmd(sd
, req
);
1461 static sd_rsp_type_t
sd_cmd_DE_SELECT_CARD(SDState
*sd
, SDRequest req
)
1463 bool same_rca
= sd_req_rca_same(sd
, req
);
1465 switch (sd
->state
) {
1466 case sd_standby_state
:
1470 sd
->state
= sd_transfer_state
;
1473 case sd_transfer_state
:
1474 case sd_sendingdata_state
:
1478 sd
->state
= sd_standby_state
;
1481 case sd_disconnect_state
:
1485 sd
->state
= sd_programming_state
;
1488 case sd_programming_state
:
1492 sd
->state
= sd_disconnect_state
;
1498 return sd_invalid_state_for_cmd(sd
, req
);
1502 static sd_rsp_type_t
sd_cmd_SEND_IF_COND(SDState
*sd
, SDRequest req
)
1504 if (sd
->spec_version
< SD_PHY_SPECv2_00_VERS
) {
1505 return sd_cmd_illegal(sd
, req
);
1507 if (sd
->state
!= sd_idle_state
) {
1508 return sd_invalid_state_for_cmd(sd
, req
);
1512 /* No response if not exactly one VHS bit is set. */
1513 if (!(req
.arg
>> 8) || (req
.arg
>> (ctz32(req
.arg
& ~0xff) + 1))) {
1514 return sd_is_spi(sd
) ? sd_r7
: sd_r0
;
1523 static sd_rsp_type_t
emmc_cmd_SEND_EXT_CSD(SDState
*sd
, SDRequest req
)
1525 if (sd
->state
!= sd_transfer_state
) {
1526 return sd_invalid_state_for_cmd(sd
, req
);
1529 return sd_cmd_to_sendingdata(sd
, req
, sd_req_get_address(sd
, req
),
1530 sd
->ext_csd
, sizeof(sd
->ext_csd
));
1534 static sd_rsp_type_t
spi_cmd_SEND_CSD(SDState
*sd
, SDRequest req
)
1536 if (sd
->state
!= sd_standby_state
) {
1537 return sd_invalid_state_for_cmd(sd
, req
);
1539 return sd_cmd_to_sendingdata(sd
, req
, sd_req_get_address(sd
, req
),
1543 static sd_rsp_type_t
sd_cmd_SEND_CSD(SDState
*sd
, SDRequest req
)
1545 if (sd
->state
!= sd_standby_state
) {
1546 return sd_invalid_state_for_cmd(sd
, req
);
1549 return sd_req_rca_same(sd
, req
) ? sd_r2_s
: sd_r0
;
1553 static sd_rsp_type_t
spi_cmd_SEND_CID(SDState
*sd
, SDRequest req
)
1555 if (sd
->state
!= sd_standby_state
) {
1556 return sd_invalid_state_for_cmd(sd
, req
);
1558 return sd_cmd_to_sendingdata(sd
, req
, sd_req_get_address(sd
, req
),
1562 static sd_rsp_type_t
sd_cmd_SEND_CID(SDState
*sd
, SDRequest req
)
1564 if (sd
->state
!= sd_standby_state
) {
1565 return sd_invalid_state_for_cmd(sd
, req
);
1568 return sd_req_rca_same(sd
, req
) ? sd_r2_i
: sd_r0
;
1572 static sd_rsp_type_t
sd_cmd_STOP_TRANSMISSION(SDState
*sd
, SDRequest req
)
1574 switch (sd
->state
) {
1575 case sd_sendingdata_state
:
1576 sd
->state
= sd_transfer_state
;
1578 case sd_receivingdata_state
:
1579 sd
->state
= sd_programming_state
;
1580 /* Bzzzzzzztt .... Operation complete. */
1581 sd
->state
= sd_transfer_state
;
1584 return sd_invalid_state_for_cmd(sd
, req
);
1589 static sd_rsp_type_t
sd_cmd_SEND_STATUS(SDState
*sd
, SDRequest req
)
1591 if (sd
->mode
!= sd_data_transfer_mode
) {
1592 return sd_invalid_mode_for_cmd(sd
, req
);
1595 switch (sd
->state
) {
1596 case sd_standby_state
:
1597 case sd_transfer_state
:
1598 case sd_sendingdata_state
:
1599 case sd_receivingdata_state
:
1600 case sd_programming_state
:
1601 case sd_disconnect_state
:
1604 return sd_invalid_state_for_cmd(sd
, req
);
1607 if (sd_is_spi(sd
)) {
1611 return sd_req_rca_same(sd
, req
) ? sd_r1
: sd_r0
;
1615 static sd_rsp_type_t
sd_cmd_GO_INACTIVE_STATE(SDState
*sd
, SDRequest req
)
1617 if (sd
->mode
!= sd_data_transfer_mode
) {
1618 return sd_invalid_mode_for_cmd(sd
, req
);
1620 switch (sd
->state
) {
1621 case sd_standby_state
:
1622 case sd_transfer_state
:
1623 case sd_sendingdata_state
:
1624 case sd_receivingdata_state
:
1625 case sd_programming_state
:
1626 case sd_disconnect_state
:
1629 return sd_invalid_state_for_cmd(sd
, req
);
1631 if (sd_req_rca_same(sd
, req
)) {
1632 sd
->state
= sd_inactive_state
;
1639 static sd_rsp_type_t
sd_cmd_SET_BLOCKLEN(SDState
*sd
, SDRequest req
)
1641 if (sd
->state
!= sd_transfer_state
) {
1642 return sd_invalid_state_for_cmd(sd
, req
);
1644 if (req
.arg
> (1 << HWBLOCK_SHIFT
)) {
1645 sd
->card_status
|= BLOCK_LEN_ERROR
;
1647 trace_sdcard_set_blocklen(req
.arg
);
1648 sd
->blk_len
= req
.arg
;
1655 static sd_rsp_type_t
sd_cmd_READ_SINGLE_BLOCK(SDState
*sd
, SDRequest req
)
1659 if (sd
->state
!= sd_transfer_state
) {
1660 return sd_invalid_state_for_cmd(sd
, req
);
1663 addr
= sd_req_get_address(sd
, req
);
1664 if (!address_in_range(sd
, "READ_SINGLE_BLOCK", addr
, sd
->blk_len
)) {
1668 sd_blk_read(sd
, addr
, sd
->blk_len
);
1669 return sd_cmd_to_sendingdata(sd
, req
, addr
, NULL
, sd
->blk_len
);
1673 static sd_rsp_type_t
sd_cmd_SEND_TUNING_BLOCK(SDState
*sd
, SDRequest req
)
1675 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1676 return sd_cmd_illegal(sd
, req
);
1679 return sd_cmd_to_sendingdata(sd
, req
, 0,
1680 sd_tuning_block_pattern4
,
1681 sizeof(sd_tuning_block_pattern4
));
1685 static sd_rsp_type_t
sd_cmd_SET_BLOCK_COUNT(SDState
*sd
, SDRequest req
)
1687 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1688 return sd_cmd_illegal(sd
, req
);
1691 if (sd
->state
!= sd_transfer_state
) {
1692 return sd_invalid_state_for_cmd(sd
, req
);
1695 sd
->multi_blk_cnt
= req
.arg
;
1696 if (sd_is_emmc(sd
)) {
1697 sd
->multi_blk_cnt
&= 0xffff;
1699 trace_sdcard_set_block_count(sd
->multi_blk_cnt
);
1705 static sd_rsp_type_t
sd_cmd_WRITE_SINGLE_BLOCK(SDState
*sd
, SDRequest req
)
1709 if (sd
->state
!= sd_transfer_state
) {
1710 return sd_invalid_state_for_cmd(sd
, req
);
1713 addr
= sd_req_get_address(sd
, req
);
1714 if (!address_in_range(sd
, "WRITE_SINGLE_BLOCK", addr
, sd
->blk_len
)) {
1718 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
1719 if (sd_wp_addr(sd
, addr
)) {
1720 sd
->card_status
|= WP_VIOLATION
;
1723 if (sd
->csd
[14] & 0x30) {
1724 sd
->card_status
|= WP_VIOLATION
;
1727 sd
->blk_written
= 0;
1728 return sd_cmd_to_receivingdata(sd
, req
, addr
, sd
->blk_len
);
1732 static sd_rsp_type_t
emmc_cmd_PROGRAM_CID(SDState
*sd
, SDRequest req
)
1734 return sd_cmd_to_receivingdata(sd
, req
, 0, sizeof(sd
->cid
));
1738 static sd_rsp_type_t
sd_cmd_PROGRAM_CSD(SDState
*sd
, SDRequest req
)
1740 return sd_cmd_to_receivingdata(sd
, req
, 0, sizeof(sd
->csd
));
1743 static sd_rsp_type_t
sd_cmd_SET_CLR_WRITE_PROT(SDState
*sd
, SDRequest req
,
1748 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1752 if (sd
->state
!= sd_transfer_state
) {
1753 return sd_invalid_state_for_cmd(sd
, req
);
1756 addr
= sd_req_get_address(sd
, req
);
1757 if (!address_in_range(sd
, is_write
? "SET_WRITE_PROT" : "CLR_WRITE_PROT",
1762 sd
->state
= sd_programming_state
;
1764 set_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1766 clear_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1768 /* Bzzzzzzztt .... Operation complete. */
1769 sd
->state
= sd_transfer_state
;
1774 static sd_rsp_type_t
sd_cmd_SET_WRITE_PROT(SDState
*sd
, SDRequest req
)
1776 return sd_cmd_SET_CLR_WRITE_PROT(sd
, req
, true);
1780 static sd_rsp_type_t
sd_cmd_CLR_WRITE_PROT(SDState
*sd
, SDRequest req
)
1782 return sd_cmd_SET_CLR_WRITE_PROT(sd
, req
, false);
1786 static sd_rsp_type_t
sd_cmd_SEND_WRITE_PROT(SDState
*sd
, SDRequest req
)
1791 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1795 if (sd
->state
!= sd_transfer_state
) {
1796 return sd_invalid_state_for_cmd(sd
, req
);
1799 addr
= sd_req_get_address(sd
, req
);
1800 if (!address_in_range(sd
, "SEND_WRITE_PROT", addr
, sd
->blk_len
)) {
1804 data
= sd_wpbits(sd
, req
.arg
);
1805 return sd_cmd_to_sendingdata(sd
, req
, addr
, &data
, sizeof(data
));
1809 static sd_rsp_type_t
sd_cmd_ERASE_WR_BLK_START(SDState
*sd
, SDRequest req
)
1811 if (sd
->state
!= sd_transfer_state
) {
1812 return sd_invalid_state_for_cmd(sd
, req
);
1814 sd
->erase_start
= req
.arg
;
1819 static sd_rsp_type_t
sd_cmd_ERASE_WR_BLK_END(SDState
*sd
, SDRequest req
)
1821 if (sd
->state
!= sd_transfer_state
) {
1822 return sd_invalid_state_for_cmd(sd
, req
);
1824 sd
->erase_end
= req
.arg
;
1829 static sd_rsp_type_t
sd_cmd_ERASE(SDState
*sd
, SDRequest req
)
1831 if (sd
->state
!= sd_transfer_state
) {
1832 return sd_invalid_state_for_cmd(sd
, req
);
1834 if (sd
->csd
[14] & 0x30) {
1835 sd
->card_status
|= WP_VIOLATION
;
1839 sd
->state
= sd_programming_state
;
1841 /* Bzzzzzzztt .... Operation complete. */
1842 sd
->state
= sd_transfer_state
;
1847 static sd_rsp_type_t
sd_cmd_LOCK_UNLOCK(SDState
*sd
, SDRequest req
)
1849 return sd_cmd_to_receivingdata(sd
, req
, 0, 0);
1853 static sd_rsp_type_t
sd_cmd_APP_CMD(SDState
*sd
, SDRequest req
)
1855 switch (sd
->state
) {
1856 case sd_ready_state
:
1857 case sd_identification_state
:
1858 case sd_inactive_state
:
1859 case sd_sleep_state
:
1860 return sd_invalid_state_for_cmd(sd
, req
);
1862 if (!sd_is_spi(sd
) && sd_req_get_rca(sd
, req
) != 0x0000) {
1863 qemu_log_mask(LOG_GUEST_ERROR
,
1864 "SD: illegal RCA 0x%04x for APP_CMD\n", req
.cmd
);
1870 if (!sd_is_spi(sd
) && !sd_req_rca_same(sd
, req
)) {
1873 sd
->expecting_acmd
= true;
1874 sd
->card_status
|= APP_CMD
;
1880 static sd_rsp_type_t
sd_cmd_GEN_CMD(SDState
*sd
, SDRequest req
)
1882 if (sd
->state
!= sd_transfer_state
) {
1883 return sd_invalid_state_for_cmd(sd
, req
);
1886 /* Vendor specific command: our model is RAZ/WI */
1888 memset(sd
->data
, 0, sizeof(sd
->data
));
1889 return sd_cmd_to_sendingdata(sd
, req
, 0, NULL
, 0);
1891 return sd_cmd_to_receivingdata(sd
, req
, 0, 0);
1896 static sd_rsp_type_t
spi_cmd_READ_OCR(SDState
*sd
, SDRequest req
)
1902 static sd_rsp_type_t
spi_cmd_CRC_ON_OFF(SDState
*sd
, SDRequest req
)
1908 static sd_rsp_type_t
sd_acmd_SET_BUS_WIDTH(SDState
*sd
, SDRequest req
)
1910 if (sd
->state
!= sd_transfer_state
) {
1911 return sd_invalid_state_for_cmd(sd
, req
);
1914 sd
->sd_status
[0] &= 0x3f;
1915 sd
->sd_status
[0] |= (req
.arg
& 0x03) << 6;
1920 static sd_rsp_type_t
sd_acmd_SD_STATUS(SDState
*sd
, SDRequest req
)
1922 return sd_cmd_to_sendingdata(sd
, req
, 0,
1923 sd
->sd_status
, sizeof(sd
->sd_status
));
1927 static sd_rsp_type_t
sd_acmd_SEND_NUM_WR_BLOCKS(SDState
*sd
, SDRequest req
)
1929 return sd_cmd_to_sendingdata(sd
, req
, 0,
1930 &sd
->blk_written
, sizeof(sd
->blk_written
));
1934 static sd_rsp_type_t
sd_acmd_SET_WR_BLK_ERASE_COUNT(SDState
*sd
, SDRequest req
)
1936 if (sd
->state
!= sd_transfer_state
) {
1937 return sd_invalid_state_for_cmd(sd
, req
);
1943 static sd_rsp_type_t
sd_cmd_SEND_OP_COND(SDState
*sd
, SDRequest req
)
1945 if (sd
->state
!= sd_idle_state
) {
1946 return sd_invalid_state_for_cmd(sd
, req
);
1950 * If it's the first ACMD41 since reset, we need to decide
1951 * whether to power up. If this is not an enquiry ACMD41,
1952 * we immediately report power on and proceed below to the
1953 * ready state, but if it is, we set a timer to model a
1954 * delay for power up. This works around a bug in EDK2
1955 * UEFI, which sends an initial enquiry ACMD41, but
1956 * assumes that the card is in ready state as soon as it
1957 * sees the power up bit set.
1959 if (!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
)) {
1960 if ((req
.arg
& ACMD41_ENQUIRY_MASK
) != 0) {
1961 timer_del(sd
->ocr_power_timer
);
1964 trace_sdcard_inquiry_cmd41();
1965 if (!timer_pending(sd
->ocr_power_timer
)) {
1966 timer_mod_ns(sd
->ocr_power_timer
,
1967 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
)
1968 + OCR_POWER_DELAY_NS
));
1973 if (FIELD_EX32(sd
->ocr
& req
.arg
, OCR
, VDD_VOLTAGE_WINDOW
)) {
1975 * We accept any voltage. 10000 V is nothing.
1977 * Once we're powered up, we advance straight to ready state
1978 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1980 sd
->state
= sd_ready_state
;
1987 static sd_rsp_type_t
sd_acmd_SET_CLR_CARD_DETECT(SDState
*sd
, SDRequest req
)
1989 if (sd
->state
!= sd_transfer_state
) {
1990 return sd_invalid_state_for_cmd(sd
, req
);
1993 /* Bringing in the 50KOhm pull-up resistor... Done. */
1998 static sd_rsp_type_t
sd_acmd_SEND_SCR(SDState
*sd
, SDRequest req
)
2000 return sd_cmd_to_sendingdata(sd
, req
, 0, sd
->scr
, sizeof(sd
->scr
));
2003 static sd_rsp_type_t
sd_normal_command(SDState
*sd
, SDRequest req
)
2007 sd
->last_cmd_name
= sd_cmd_name(sd
, req
.cmd
);
2008 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
2009 * However there is no ACMD55, so we want to trace this particular case.
2011 if (req
.cmd
!= 55 || sd
->expecting_acmd
) {
2012 trace_sdcard_normal_command(sd
->proto
->name
,
2013 sd
->last_cmd_name
, req
.cmd
,
2014 req
.arg
, sd_state_name(sd
->state
));
2017 /* Not interpreting this as an app command */
2018 sd
->card_status
&= ~APP_CMD
;
2020 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
2021 * if not, its effects are cancelled */
2022 if (sd
->multi_blk_cnt
!= 0 && !(req
.cmd
== 18 || req
.cmd
== 25)) {
2023 sd
->multi_blk_cnt
= 0;
2026 if (sd
->proto
->cmd
[req
.cmd
].class == 6 && FIELD_EX32(sd
->ocr
, OCR
,
2028 /* Only Standard Capacity cards support class 6 commands */
2032 if (sd
->proto
->cmd
[req
.cmd
].handler
) {
2033 return sd
->proto
->cmd
[req
.cmd
].handler(sd
, req
);
2037 /* Block read commands (Class 2) */
2038 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2039 addr
= sd_req_get_address(sd
, req
);
2040 switch (sd
->state
) {
2041 case sd_transfer_state
:
2043 if (!address_in_range(sd
, "READ_BLOCK", addr
, sd
->blk_len
)) {
2047 sd
->state
= sd_sendingdata_state
;
2048 sd
->data_start
= addr
;
2049 sd
->data_offset
= 0;
2057 /* Block write commands (Class 4) */
2058 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2059 addr
= sd_req_get_address(sd
, req
);
2060 switch (sd
->state
) {
2061 case sd_transfer_state
:
2063 if (!address_in_range(sd
, "WRITE_BLOCK", addr
, sd
->blk_len
)) {
2067 sd
->state
= sd_receivingdata_state
;
2068 sd
->data_start
= addr
;
2069 sd
->data_offset
= 0;
2070 sd
->blk_written
= 0;
2072 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
2073 if (sd_wp_addr(sd
, sd
->data_start
)) {
2074 sd
->card_status
|= WP_VIOLATION
;
2077 if (sd
->csd
[14] & 0x30) {
2078 sd
->card_status
|= WP_VIOLATION
;
2088 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Unknown CMD%i\n", req
.cmd
);
2092 return sd_invalid_state_for_cmd(sd
, req
);
2095 static sd_rsp_type_t
sd_app_command(SDState
*sd
,
2098 sd
->last_cmd_name
= sd_acmd_name(sd
, req
.cmd
);
2099 trace_sdcard_app_command(sd
->proto
->name
, sd
->last_cmd_name
,
2100 req
.cmd
, req
.arg
, sd_state_name(sd
->state
));
2101 sd
->card_status
|= APP_CMD
;
2103 if (sd
->proto
->acmd
[req
.cmd
].handler
) {
2104 return sd
->proto
->acmd
[req
.cmd
].handler(sd
, req
);
2108 case 18: /* Reserved for SD security applications */
2113 /* Refer to the "SD Specifications Part3 Security Specification" for
2114 * information about the SD Security Features.
2116 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i Security not implemented\n",
2121 /* Fall back to standard commands. */
2122 return sd_normal_command(sd
, req
);
2125 qemu_log_mask(LOG_GUEST_ERROR
, "SD: ACMD%i in a wrong state\n", req
.cmd
);
2129 static bool cmd_valid_while_locked(SDState
*sd
, unsigned cmd
)
2133 /* Valid commands in locked state:
2135 * lock card class (7)
2137 * implicitly, the ACMD prefix CMD55
2139 * Anything else provokes an "illegal command" response.
2141 if (sd
->expecting_acmd
) {
2142 return cmd
== 41 || cmd
== 42;
2144 if (cmd
== 16 || cmd
== 55) {
2147 if (!sd
->proto
->cmd
[cmd
].handler
) {
2150 cmd_class
= sd
->proto
->cmd
[cmd
].class;
2152 return cmd_class
== 0 || cmd_class
== 7;
2155 int sd_do_command(SDState
*sd
, SDRequest
*req
,
2156 uint8_t *response
) {
2158 sd_rsp_type_t rtype
;
2161 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
) {
2165 if (sd
->state
== sd_inactive_state
) {
2170 if (sd_req_crc_validate(req
)) {
2171 sd
->card_status
|= COM_CRC_ERROR
;
2176 if (req
->cmd
>= SDMMC_CMD_MAX
) {
2177 qemu_log_mask(LOG_GUEST_ERROR
, "SD: incorrect command 0x%02x\n",
2182 if (sd
->state
== sd_sleep_state
&& req
->cmd
) {
2183 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Card is sleeping\n");
2188 if (sd
->card_status
& CARD_IS_LOCKED
) {
2189 if (!cmd_valid_while_locked(sd
, req
->cmd
)) {
2190 sd
->card_status
|= ILLEGAL_COMMAND
;
2191 sd
->expecting_acmd
= false;
2192 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Card is locked\n");
2198 last_state
= sd
->state
;
2201 if (sd
->expecting_acmd
) {
2202 sd
->expecting_acmd
= false;
2203 rtype
= sd_app_command(sd
, *req
);
2205 rtype
= sd_normal_command(sd
, *req
);
2208 if (rtype
== sd_illegal
) {
2209 sd
->card_status
|= ILLEGAL_COMMAND
;
2211 /* Valid command, we can update the 'state before command' bits.
2212 * (Do this now so they appear in r1 responses.)
2214 sd
->card_status
= FIELD_DP32(sd
->card_status
, CSR
,
2215 CURRENT_STATE
, last_state
);
2222 sd_response_r1_make(sd
, response
);
2227 memcpy(response
, sd
->cid
, sizeof(sd
->cid
));
2232 memcpy(response
, sd
->csd
, sizeof(sd
->csd
));
2237 sd_response_r3_make(sd
, response
);
2242 sd_response_r6_make(sd
, response
);
2247 sd_response_r7_make(sd
, response
);
2253 * Invalid state transition, reset implementation
2254 * fields to avoid OOB abuse.
2257 sd
->data_offset
= 0;
2263 g_assert_not_reached();
2265 trace_sdcard_response(sd_response_name(rtype
), rsplen
);
2267 if (rtype
!= sd_illegal
) {
2268 /* Clear the "clear on valid command" status bits now we've
2271 sd
->card_status
&= ~CARD_STATUS_B
;
2275 qemu_hexdump(stderr
, "Response", response
, rsplen
);
2278 sd
->current_cmd
= rtype
== sd_illegal
? 0 : req
->cmd
;
2283 /* Return true if buffer is consumed. Configured by sd_cmd_to_receivingdata() */
2284 static bool sd_generic_write_byte(SDState
*sd
, uint8_t value
)
2286 sd
->data
[sd
->data_offset
] = value
;
2288 if (++sd
->data_offset
>= sd
->data_size
) {
2289 sd
->state
= sd_transfer_state
;
2295 /* Return true when buffer is consumed. Configured by sd_cmd_to_sendingdata() */
2296 static bool sd_generic_read_byte(SDState
*sd
, uint8_t *value
)
2298 *value
= sd
->data
[sd
->data_offset
];
2300 if (++sd
->data_offset
>= sd
->data_size
) {
2301 sd
->state
= sd_transfer_state
;
2308 void sd_write_byte(SDState
*sd
, uint8_t value
)
2312 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
2315 if (sd
->state
!= sd_receivingdata_state
) {
2316 qemu_log_mask(LOG_GUEST_ERROR
,
2317 "%s: not in Receiving-Data state\n", __func__
);
2321 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
2324 trace_sdcard_write_data(sd
->proto
->name
,
2326 sd
->current_cmd
, sd
->data_offset
, value
);
2327 switch (sd
->current_cmd
) {
2328 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
2329 if (sd_generic_write_byte(sd
, value
)) {
2330 /* TODO: Check CRC before committing */
2331 sd
->state
= sd_programming_state
;
2332 sd_blk_write(sd
, sd
->data_start
, sd
->data_offset
);
2334 sd
->csd
[14] |= 0x40;
2335 /* Bzzzzzzztt .... Operation complete. */
2336 sd
->state
= sd_transfer_state
;
2340 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2341 if (sd
->data_offset
== 0) {
2342 /* Start of the block - let's check the address is valid */
2343 if (!address_in_range(sd
, "WRITE_MULTIPLE_BLOCK",
2344 sd
->data_start
, sd
->blk_len
)) {
2347 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
2348 if (sd_wp_addr(sd
, sd
->data_start
)) {
2349 sd
->card_status
|= WP_VIOLATION
;
2354 sd
->data
[sd
->data_offset
++] = value
;
2355 if (sd
->data_offset
>= sd
->blk_len
) {
2356 /* TODO: Check CRC before committing */
2357 sd
->state
= sd_programming_state
;
2358 sd_blk_write(sd
, sd
->data_start
, sd
->data_offset
);
2360 sd
->data_start
+= sd
->blk_len
;
2361 sd
->data_offset
= 0;
2362 sd
->csd
[14] |= 0x40;
2364 /* Bzzzzzzztt .... Operation complete. */
2365 if (sd
->multi_blk_cnt
!= 0) {
2366 if (--sd
->multi_blk_cnt
== 0) {
2368 sd
->state
= sd_transfer_state
;
2373 sd
->state
= sd_receivingdata_state
;
2377 case 26: /* CMD26: PROGRAM_CID */
2378 if (sd_generic_write_byte(sd
, value
)) {
2379 /* TODO: Check CRC before committing */
2380 sd
->state
= sd_programming_state
;
2381 for (i
= 0; i
< sizeof(sd
->cid
); i
++)
2382 if ((sd
->cid
[i
] | 0x00) != sd
->data
[i
])
2383 sd
->card_status
|= CID_CSD_OVERWRITE
;
2385 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
2386 for (i
= 0; i
< sizeof(sd
->cid
); i
++) {
2388 sd
->cid
[i
] &= sd
->data
[i
];
2390 /* Bzzzzzzztt .... Operation complete. */
2391 sd
->state
= sd_transfer_state
;
2395 case 27: /* CMD27: PROGRAM_CSD */
2396 if (sd_generic_write_byte(sd
, value
)) {
2397 /* TODO: Check CRC before committing */
2398 sd
->state
= sd_programming_state
;
2399 for (i
= 0; i
< sizeof(sd
->csd
); i
++)
2400 if ((sd
->csd
[i
] | sd_csd_rw_mask
[i
]) !=
2401 (sd
->data
[i
] | sd_csd_rw_mask
[i
]))
2402 sd
->card_status
|= CID_CSD_OVERWRITE
;
2404 /* Copy flag (OTP) & Permanent write protect */
2405 if (sd
->csd
[14] & ~sd
->data
[14] & 0x60)
2406 sd
->card_status
|= CID_CSD_OVERWRITE
;
2408 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
2409 for (i
= 0; i
< sizeof(sd
->csd
); i
++) {
2410 sd
->csd
[i
] |= sd_csd_rw_mask
[i
];
2411 sd
->csd
[i
] &= sd
->data
[i
];
2413 /* Bzzzzzzztt .... Operation complete. */
2414 sd
->state
= sd_transfer_state
;
2418 case 42: /* CMD42: LOCK_UNLOCK */
2419 if (sd_generic_write_byte(sd
, value
)) {
2420 /* TODO: Check CRC before committing */
2421 sd
->state
= sd_programming_state
;
2422 sd_lock_command(sd
);
2423 /* Bzzzzzzztt .... Operation complete. */
2424 sd
->state
= sd_transfer_state
;
2428 case 56: /* CMD56: GEN_CMD */
2429 sd_generic_write_byte(sd
, value
);
2433 g_assert_not_reached();
2437 uint8_t sd_read_byte(SDState
*sd
)
2439 /* TODO: Append CRCs */
2443 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
2446 if (sd
->state
!= sd_sendingdata_state
) {
2447 qemu_log_mask(LOG_GUEST_ERROR
,
2448 "%s: not in Sending-Data state\n", __func__
);
2452 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
2455 io_len
= sd_blk_len(sd
);
2457 trace_sdcard_read_data(sd
->proto
->name
,
2458 sd
->last_cmd_name
, sd
->current_cmd
,
2459 sd
->data_offset
, sd
->data_size
, io_len
);
2460 switch (sd
->current_cmd
) {
2461 case 6: /* CMD6: SWITCH_FUNCTION */
2462 case 8: /* CMD8: SEND_EXT_CSD */
2463 case 9: /* CMD9: SEND_CSD */
2464 case 10: /* CMD10: SEND_CID */
2465 case 13: /* ACMD13: SD_STATUS */
2466 case 17: /* CMD17: READ_SINGLE_BLOCK */
2467 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2468 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2469 case 30: /* CMD30: SEND_WRITE_PROT */
2470 case 51: /* ACMD51: SEND_SCR */
2471 case 56: /* CMD56: GEN_CMD */
2472 sd_generic_read_byte(sd
, &ret
);
2475 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2476 if (sd
->data_offset
== 0) {
2477 if (!address_in_range(sd
, "READ_MULTIPLE_BLOCK",
2478 sd
->data_start
, io_len
)) {
2481 sd_blk_read(sd
, sd
->data_start
, io_len
);
2483 ret
= sd
->data
[sd
->data_offset
++];
2485 if (sd
->data_offset
>= io_len
) {
2486 sd
->data_start
+= io_len
;
2487 sd
->data_offset
= 0;
2489 if (sd
->multi_blk_cnt
!= 0) {
2490 if (--sd
->multi_blk_cnt
== 0) {
2492 sd
->state
= sd_transfer_state
;
2500 g_assert_not_reached();
2506 static bool sd_receive_ready(SDState
*sd
)
2508 return sd
->state
== sd_receivingdata_state
;
2511 static bool sd_data_ready(SDState
*sd
)
2513 return sd
->state
== sd_sendingdata_state
;
2516 void sd_enable(SDState
*sd
, bool enable
)
2518 sd
->enable
= enable
;
2521 static const SDProto sd_proto_spi
= {
2524 [0] = {0, sd_spi
, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE
},
2525 [1] = {0, sd_spi
, "SEND_OP_COND", spi_cmd_SEND_OP_COND
},
2526 [5] = {9, sd_spi
, "IO_SEND_OP_COND", sd_cmd_optional
},
2527 [6] = {10, sd_spi
, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION
},
2528 [8] = {0, sd_spi
, "SEND_IF_COND", sd_cmd_SEND_IF_COND
},
2529 [9] = {0, sd_spi
, "SEND_CSD", spi_cmd_SEND_CSD
},
2530 [10] = {0, sd_spi
, "SEND_CID", spi_cmd_SEND_CID
},
2531 [12] = {0, sd_spi
, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION
},
2532 [13] = {0, sd_spi
, "SEND_STATUS", sd_cmd_SEND_STATUS
},
2533 [16] = {2, sd_spi
, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN
},
2534 [17] = {2, sd_spi
, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK
},
2535 [24] = {4, sd_spi
, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK
},
2536 [27] = {4, sd_spi
, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD
},
2537 [28] = {6, sd_spi
, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT
},
2538 [29] = {6, sd_spi
, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT
},
2539 [30] = {6, sd_spi
, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT
},
2540 [32] = {5, sd_spi
, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START
},
2541 [33] = {5, sd_spi
, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END
},
2542 [34] = {10, sd_spi
, "READ_SEC_CMD", sd_cmd_optional
},
2543 [35] = {10, sd_spi
, "WRITE_SEC_CMD", sd_cmd_optional
},
2544 [36] = {10, sd_spi
, "SEND_PSI", sd_cmd_optional
},
2545 [37] = {10, sd_spi
, "CONTROL_ASSD_SYSTEM", sd_cmd_optional
},
2546 [38] = {5, sd_spi
, "ERASE", sd_cmd_ERASE
},
2547 [42] = {7, sd_spi
, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK
},
2548 [50] = {10, sd_spi
, "DIRECT_SECURE_READ", sd_cmd_optional
},
2549 [52] = {9, sd_spi
, "IO_RW_DIRECT", sd_cmd_optional
},
2550 [53] = {9, sd_spi
, "IO_RW_EXTENDED", sd_cmd_optional
},
2551 [55] = {8, sd_spi
, "APP_CMD", sd_cmd_APP_CMD
},
2552 [56] = {8, sd_spi
, "GEN_CMD", sd_cmd_GEN_CMD
},
2553 [57] = {10, sd_spi
, "DIRECT_SECURE_WRITE", sd_cmd_optional
},
2554 [58] = {0, sd_spi
, "READ_OCR", spi_cmd_READ_OCR
},
2555 [59] = {0, sd_spi
, "CRC_ON_OFF", spi_cmd_CRC_ON_OFF
},
2558 [13] = {8, sd_spi
, "SD_STATUS", sd_acmd_SD_STATUS
},
2559 [22] = {8, sd_spi
, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS
},
2560 [23] = {8, sd_spi
, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT
},
2561 [41] = {8, sd_spi
, "SEND_OP_COND", spi_cmd_SEND_OP_COND
},
2562 [42] = {8, sd_spi
, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT
},
2563 [51] = {8, sd_spi
, "SEND_SCR", sd_acmd_SEND_SCR
},
2567 static const SDProto sd_proto_sd
= {
2570 [0] = {0, sd_bc
, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE
},
2571 [2] = {0, sd_bcr
, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID
},
2572 [3] = {0, sd_bcr
, "SEND_RELATIVE_ADDR", sd_cmd_SEND_RELATIVE_ADDR
},
2573 [4] = {0, sd_bc
, "SEND_DSR", sd_cmd_unimplemented
},
2574 [5] = {9, sd_bc
, "IO_SEND_OP_COND", sd_cmd_optional
},
2575 [6] = {10, sd_adtc
, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION
},
2576 [7] = {0, sd_ac
, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD
},
2577 [8] = {0, sd_bcr
, "SEND_IF_COND", sd_cmd_SEND_IF_COND
},
2578 [9] = {0, sd_ac
, "SEND_CSD", sd_cmd_SEND_CSD
},
2579 [10] = {0, sd_ac
, "SEND_CID", sd_cmd_SEND_CID
},
2580 [11] = {0, sd_ac
, "VOLTAGE_SWITCH", sd_cmd_optional
},
2581 [12] = {0, sd_ac
, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION
},
2582 [13] = {0, sd_ac
, "SEND_STATUS", sd_cmd_SEND_STATUS
},
2583 [15] = {0, sd_ac
, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE
},
2584 [16] = {2, sd_ac
, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN
},
2585 [17] = {2, sd_adtc
, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK
},
2586 [19] = {2, sd_adtc
, "SEND_TUNING_BLOCK", sd_cmd_SEND_TUNING_BLOCK
},
2587 [20] = {2, sd_ac
, "SPEED_CLASS_CONTROL", sd_cmd_optional
},
2588 [23] = {2, sd_ac
, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT
},
2589 [24] = {4, sd_adtc
, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK
},
2590 [27] = {4, sd_adtc
, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD
},
2591 [28] = {6, sd_ac
, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT
},
2592 [29] = {6, sd_ac
, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT
},
2593 [30] = {6, sd_adtc
, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT
},
2594 [32] = {5, sd_ac
, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START
},
2595 [33] = {5, sd_ac
, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END
},
2596 [34] = {10, sd_adtc
, "READ_SEC_CMD", sd_cmd_optional
},
2597 [35] = {10, sd_adtc
, "WRITE_SEC_CMD", sd_cmd_optional
},
2598 [36] = {10, sd_adtc
, "SEND_PSI", sd_cmd_optional
},
2599 [37] = {10, sd_ac
, "CONTROL_ASSD_SYSTEM", sd_cmd_optional
},
2600 [38] = {5, sd_ac
, "ERASE", sd_cmd_ERASE
},
2601 [42] = {7, sd_adtc
, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK
},
2602 [43] = {1, sd_ac
, "Q_MANAGEMENT", sd_cmd_optional
},
2603 [44] = {1, sd_ac
, "Q_TASK_INFO_A", sd_cmd_optional
},
2604 [45] = {1, sd_ac
, "Q_TASK_INFO_B", sd_cmd_optional
},
2605 [46] = {1, sd_adtc
, "Q_RD_TASK", sd_cmd_optional
},
2606 [47] = {1, sd_adtc
, "Q_WR_TASK", sd_cmd_optional
},
2607 [48] = {1, sd_adtc
, "READ_EXTR_SINGLE", sd_cmd_optional
},
2608 [49] = {1, sd_adtc
, "WRITE_EXTR_SINGLE", sd_cmd_optional
},
2609 [50] = {10, sd_adtc
, "DIRECT_SECURE_READ", sd_cmd_optional
},
2610 [52] = {9, sd_bc
, "IO_RW_DIRECT", sd_cmd_optional
},
2611 [53] = {9, sd_bc
, "IO_RW_EXTENDED", sd_cmd_optional
},
2612 [55] = {8, sd_ac
, "APP_CMD", sd_cmd_APP_CMD
},
2613 [56] = {8, sd_adtc
, "GEN_CMD", sd_cmd_GEN_CMD
},
2614 [57] = {10, sd_adtc
, "DIRECT_SECURE_WRITE", sd_cmd_optional
},
2615 [58] = {11, sd_adtc
, "READ_EXTR_MULTI", sd_cmd_optional
},
2616 [59] = {11, sd_adtc
, "WRITE_EXTR_MULTI", sd_cmd_optional
},
2619 [6] = {8, sd_ac
, "SET_BUS_WIDTH", sd_acmd_SET_BUS_WIDTH
},
2620 [13] = {8, sd_adtc
, "SD_STATUS", sd_acmd_SD_STATUS
},
2621 [22] = {8, sd_adtc
, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS
},
2622 [23] = {8, sd_ac
, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT
},
2623 [41] = {8, sd_bcr
, "SEND_OP_COND", sd_cmd_SEND_OP_COND
},
2624 [42] = {8, sd_ac
, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT
},
2625 [51] = {8, sd_adtc
, "SEND_SCR", sd_acmd_SEND_SCR
},
2629 static const SDProto sd_proto_emmc
= {
2630 /* Only v4.3 is supported */
2633 [0] = {0, sd_bc
, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE
},
2634 [1] = {0, sd_bcr
, "SEND_OP_COND", sd_cmd_SEND_OP_COND
},
2635 [2] = {0, sd_bcr
, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID
},
2636 [3] = {0, sd_ac
, "SET_RELATIVE_ADDR", emmc_cmd_SET_RELATIVE_ADDR
},
2637 [4] = {0, sd_bc
, "SEND_DSR", sd_cmd_unimplemented
},
2638 [5] = {0, sd_ac
, "SLEEP/AWAKE", emmc_cmd_sleep_awake
},
2639 [6] = {10, sd_adtc
, "SWITCH", emmc_cmd_SWITCH
},
2640 [7] = {0, sd_ac
, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD
},
2641 [8] = {0, sd_adtc
, "SEND_EXT_CSD", emmc_cmd_SEND_EXT_CSD
},
2642 [9] = {0, sd_ac
, "SEND_CSD", sd_cmd_SEND_CSD
},
2643 [10] = {0, sd_ac
, "SEND_CID", sd_cmd_SEND_CID
},
2644 [11] = {1, sd_adtc
, "READ_DAT_UNTIL_STOP", sd_cmd_unimplemented
},
2645 [12] = {0, sd_ac
, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION
},
2646 [13] = {0, sd_ac
, "SEND_STATUS", sd_cmd_SEND_STATUS
},
2647 [14] = {0, sd_adtc
, "BUSTEST_R", sd_cmd_unimplemented
},
2648 [15] = {0, sd_ac
, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE
},
2649 [16] = {2, sd_ac
, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN
},
2650 [17] = {2, sd_adtc
, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK
},
2651 [19] = {0, sd_adtc
, "BUSTEST_W", sd_cmd_unimplemented
},
2652 [20] = {3, sd_adtc
, "WRITE_DAT_UNTIL_STOP", sd_cmd_unimplemented
},
2653 [23] = {2, sd_ac
, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT
},
2654 [24] = {4, sd_adtc
, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK
},
2655 [26] = {4, sd_adtc
, "PROGRAM_CID", emmc_cmd_PROGRAM_CID
},
2656 [27] = {4, sd_adtc
, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD
},
2657 [28] = {6, sd_ac
, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT
},
2658 [29] = {6, sd_ac
, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT
},
2659 [30] = {6, sd_adtc
, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT
},
2660 [31] = {6, sd_adtc
, "SEND_WRITE_PROT_TYPE", sd_cmd_unimplemented
},
2661 [35] = {5, sd_ac
, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START
},
2662 [36] = {5, sd_ac
, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END
},
2663 [38] = {5, sd_ac
, "ERASE", sd_cmd_ERASE
},
2664 [39] = {9, sd_ac
, "FAST_IO", sd_cmd_unimplemented
},
2665 [40] = {9, sd_bcr
, "GO_IRQ_STATE", sd_cmd_unimplemented
},
2666 [42] = {7, sd_adtc
, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK
},
2667 [49] = {0, sd_adtc
, "SET_TIME", sd_cmd_unimplemented
},
2668 [55] = {8, sd_ac
, "APP_CMD", sd_cmd_APP_CMD
},
2669 [56] = {8, sd_adtc
, "GEN_CMD", sd_cmd_GEN_CMD
},
2673 static void sd_instance_init(Object
*obj
)
2675 SDState
*sd
= SDMMC_COMMON(obj
);
2676 SDCardClass
*sc
= SDMMC_COMMON_GET_CLASS(sd
);
2678 sd
->proto
= sc
->proto
;
2679 sd
->last_cmd_name
= "UNSET";
2681 sd
->ocr_power_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, sd_ocr_powerup
, sd
);
2684 static void sd_instance_finalize(Object
*obj
)
2686 SDState
*sd
= SDMMC_COMMON(obj
);
2688 timer_free(sd
->ocr_power_timer
);
2691 static void sd_realize(DeviceState
*dev
, Error
**errp
)
2693 SDState
*sd
= SDMMC_COMMON(dev
);
2696 switch (sd
->spec_version
) {
2697 case SD_PHY_SPECv1_10_VERS
2698 ... SD_PHY_SPECv3_01_VERS
:
2701 error_setg(errp
, "Invalid SD card Spec version: %u", sd
->spec_version
);
2708 if (!blk_supports_write_perm(sd
->blk
)) {
2709 error_setg(errp
, "Cannot use read-only drive as SD card");
2713 blk_size
= blk_getlength(sd
->blk
);
2714 if (blk_size
> 0 && !is_power_of_2(blk_size
)) {
2715 int64_t blk_size_aligned
= pow2ceil(blk_size
);
2718 blk_size_str
= size_to_str(blk_size
);
2719 error_setg(errp
, "Invalid SD card size: %s", blk_size_str
);
2720 g_free(blk_size_str
);
2722 blk_size_str
= size_to_str(blk_size_aligned
);
2723 error_append_hint(errp
,
2724 "SD card size has to be a power of 2, e.g. %s.\n"
2725 "You can resize disk images with"
2726 " 'qemu-img resize <imagefile> <new-size>'\n"
2727 "(note that this will lose data if you make the"
2728 " image smaller than it currently is).\n",
2730 g_free(blk_size_str
);
2735 ret
= blk_set_perm(sd
->blk
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE
,
2736 BLK_PERM_ALL
, errp
);
2740 blk_set_dev_ops(sd
->blk
, &sd_block_ops
, sd
);
2744 static void emmc_realize(DeviceState
*dev
, Error
**errp
)
2746 SDState
*sd
= SDMMC_COMMON(dev
);
2748 sd
->spec_version
= SD_PHY_SPECv3_01_VERS
; /* Actually v4.3 */
2750 sd_realize(dev
, errp
);
2753 static Property sdmmc_common_properties
[] = {
2754 DEFINE_PROP_DRIVE("drive", SDState
, blk
),
2755 DEFINE_PROP_END_OF_LIST()
2758 static Property sd_properties
[] = {
2759 DEFINE_PROP_UINT8("spec_version", SDState
,
2760 spec_version
, SD_PHY_SPECv3_01_VERS
),
2761 DEFINE_PROP_END_OF_LIST()
2764 static Property emmc_properties
[] = {
2765 DEFINE_PROP_UINT64("boot-partition-size", SDState
, boot_part_size
, 0),
2766 DEFINE_PROP_END_OF_LIST()
2769 static void sdmmc_common_class_init(ObjectClass
*klass
, void *data
)
2771 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2772 SDCardClass
*sc
= SDMMC_COMMON_CLASS(klass
);
2774 device_class_set_props(dc
, sdmmc_common_properties
);
2775 dc
->vmsd
= &sd_vmstate
;
2776 dc
->reset
= sd_reset
;
2777 dc
->bus_type
= TYPE_SD_BUS
;
2778 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
2780 sc
->set_voltage
= sd_set_voltage
;
2781 sc
->get_dat_lines
= sd_get_dat_lines
;
2782 sc
->get_cmd_line
= sd_get_cmd_line
;
2783 sc
->do_command
= sd_do_command
;
2784 sc
->write_byte
= sd_write_byte
;
2785 sc
->read_byte
= sd_read_byte
;
2786 sc
->receive_ready
= sd_receive_ready
;
2787 sc
->data_ready
= sd_data_ready
;
2788 sc
->enable
= sd_enable
;
2789 sc
->get_inserted
= sd_get_inserted
;
2790 sc
->get_readonly
= sd_get_readonly
;
2793 static void sd_class_init(ObjectClass
*klass
, void *data
)
2795 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2796 SDCardClass
*sc
= SDMMC_COMMON_CLASS(klass
);
2798 dc
->realize
= sd_realize
;
2799 device_class_set_props(dc
, sd_properties
);
2801 sc
->set_cid
= sd_set_cid
;
2802 sc
->set_csd
= sd_set_csd
;
2803 sc
->proto
= &sd_proto_sd
;
2807 * We do not model the chip select pin, so allow the board to select
2808 * whether card should be in SSI or MMC/SD mode. It is also up to the
2809 * board to ensure that ssi transfers only occur when the chip select
2812 static void sd_spi_class_init(ObjectClass
*klass
, void *data
)
2814 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2815 SDCardClass
*sc
= SDMMC_COMMON_CLASS(klass
);
2817 dc
->desc
= "SD SPI";
2818 sc
->proto
= &sd_proto_spi
;
2821 static void emmc_class_init(ObjectClass
*klass
, void *data
)
2823 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2824 SDCardClass
*sc
= SDMMC_COMMON_CLASS(klass
);
2827 dc
->realize
= emmc_realize
;
2828 device_class_set_props(dc
, emmc_properties
);
2829 /* Reason: Soldered on board */
2830 dc
->user_creatable
= false;
2832 sc
->proto
= &sd_proto_emmc
;
2834 sc
->set_cid
= emmc_set_cid
;
2835 sc
->set_csd
= emmc_set_csd
;
2838 static const TypeInfo sd_types
[] = {
2840 .name
= TYPE_SDMMC_COMMON
,
2841 .parent
= TYPE_DEVICE
,
2843 .instance_size
= sizeof(SDState
),
2844 .class_size
= sizeof(SDCardClass
),
2845 .class_init
= sdmmc_common_class_init
,
2846 .instance_init
= sd_instance_init
,
2847 .instance_finalize
= sd_instance_finalize
,
2850 .name
= TYPE_SD_CARD
,
2851 .parent
= TYPE_SDMMC_COMMON
,
2852 .class_init
= sd_class_init
,
2855 .name
= TYPE_SD_CARD_SPI
,
2856 .parent
= TYPE_SD_CARD
,
2857 .class_init
= sd_spi_class_init
,
2861 .parent
= TYPE_SDMMC_COMMON
,
2862 .class_init
= emmc_class_init
,
2866 DEFINE_TYPES(sd_types
)