?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
hw/sd/sdcard: Implement eMMC sleep state (CMD5)
[qemu/armbru.git] / hw / sd / sd.c
blobd98952a12f91ff51db2eddadd3636573abf3bee3
1 /*
2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
4 *
5 * eMMC emulation defined in "JEDEC Standard No. 84-A43"
6 *
7 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
8 * Copyright (c) 2007 CodeSourcery
9 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 *
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in
19 * the documentation and/or other materials provided with the
20 * distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
23 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
25 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
29 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
30 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #include "qemu/osdep.h"
36 #include "qemu/units.h"
37 #include "qemu/cutils.h"
38 #include "hw/irq.h"
39 #include "hw/registerfields.h"
40 #include "sysemu/block-backend.h"
41 #include "hw/sd/sd.h"
42 #include "hw/sd/sdcard_legacy.h"
43 #include "migration/vmstate.h"
44 #include "qapi/error.h"
45 #include "qemu/bitmap.h"
46 #include "hw/qdev-properties.h"
47 #include "hw/qdev-properties-system.h"
48 #include "qemu/error-report.h"
49 #include "qemu/timer.h"
50 #include "qemu/log.h"
51 #include "qemu/guest-random.h"
52 #include "qemu/module.h"
53 #include "sdmmc-internal.h"
54 #include "trace.h"
55
56 //#define DEBUG_SD 1
57
58 #define SDSC_MAX_CAPACITY (2 * GiB)
59
60 #define INVALID_ADDRESS UINT32_MAX
61
62 typedef enum {
63 sd_r0 = 0, /* no response */
64 sd_r1, /* normal response command */
65 sd_r2_i, /* CID register */
66 sd_r2_s, /* CSD register */
67 sd_r3, /* OCR register */
68 sd_r6 = 6, /* Published RCA response */
69 sd_r7, /* Operating voltage */
70 sd_r1b = -1,
71 sd_illegal = -2,
72 } sd_rsp_type_t;
73
74 enum SDCardModes {
75 sd_inactive,
76 sd_card_identification_mode,
77 sd_data_transfer_mode,
78 };
79
80 enum SDCardStates {
81 sd_waitirq_state = -2, /* emmc */
82 sd_inactive_state = -1,
83
84 sd_idle_state = 0,
85 sd_ready_state = 1,
86 sd_identification_state = 2,
87 sd_standby_state = 3,
88 sd_transfer_state = 4,
89 sd_sendingdata_state = 5,
90 sd_receivingdata_state = 6,
91 sd_programming_state = 7,
92 sd_disconnect_state = 8,
93 sd_bus_test_state = 9, /* emmc */
94 sd_sleep_state = 10, /* emmc */
95 sd_io_state = 15 /* sd */
96 };
97
98 #define SDMMC_CMD_MAX 64
99
100 typedef sd_rsp_type_t (*sd_cmd_handler)(SDState *sd, SDRequest req);
101
102 typedef struct SDProto {
103 const char *name;
104 struct {
105 const unsigned class;
106 const sd_cmd_type_t type;
107 const char *name;
108 sd_cmd_handler handler;
109 } cmd[SDMMC_CMD_MAX], acmd[SDMMC_CMD_MAX];
110 } SDProto;
111
112 struct SDState {
113 DeviceState parent_obj;
114
115 /* If true, created by sd_init() for a non-qdevified caller */
116 /* TODO purge them with fire */
117 bool me_no_qdev_me_kill_mammoth_with_rocks;
118
119 /* SD Memory Card Registers */
120 uint32_t ocr;
121 uint8_t scr[8];
122 uint8_t cid[16];
123 uint8_t csd[16];
124 uint16_t rca;
125 uint32_t card_status;
126 uint8_t sd_status[64];
127
128 /* Static properties */
129
130 uint8_t spec_version;
131 BlockBackend *blk;
132
133 const SDProto *proto;
134
135 /* Runtime changeables */
136
137 uint32_t mode; /* current card mode, one of SDCardModes */
138 int32_t state; /* current card state, one of SDCardStates */
139 uint32_t vhs;
140 bool wp_switch;
141 unsigned long *wp_group_bmap;
142 int32_t wp_group_bits;
143 uint64_t size;
144 uint32_t blk_len;
145 uint32_t multi_blk_cnt;
146 uint32_t erase_start;
147 uint32_t erase_end;
148 uint8_t pwd[16];
149 uint32_t pwd_len;
150 uint8_t function_group[6];
151 uint8_t current_cmd;
152 const char *last_cmd_name;
153 /* True if we will handle the next command as an ACMD. Note that this does
154 * *not* track the APP_CMD status bit!
155 */
156 bool expecting_acmd;
157 uint32_t blk_written;
158
159 uint64_t data_start;
160 uint32_t data_offset;
161 size_t data_size;
162 uint8_t data[512];
163 qemu_irq readonly_cb;
164 qemu_irq inserted_cb;
165 QEMUTimer *ocr_power_timer;
166 bool enable;
167 uint8_t dat_lines;
168 bool cmd_line;
169 };
170
171 static void sd_realize(DeviceState *dev, Error **errp);
172
173 static const SDProto sd_proto_spi;
174 static const SDProto sd_proto_emmc;
175
176 static bool sd_is_spi(SDState *sd)
177 {
178 return sd->proto == &sd_proto_spi;
179 }
180
181 static bool sd_is_emmc(SDState *sd)
182 {
183 return sd->proto == &sd_proto_emmc;
184 }
185
186 static const char *sd_version_str(enum SDPhySpecificationVersion version)
187 {
188 static const char *sdphy_version[] = {
189 [SD_PHY_SPECv1_10_VERS] = "v1.10",
190 [SD_PHY_SPECv2_00_VERS] = "v2.00",
191 [SD_PHY_SPECv3_01_VERS] = "v3.01",
192 };
193 if (version >= ARRAY_SIZE(sdphy_version)) {
194 return "unsupported version";
195 }
196 return sdphy_version[version];
197 }
198
199 static const char *sd_mode_name(enum SDCardModes mode)
200 {
201 static const char *mode_name[] = {
202 [sd_inactive] = "inactive",
203 [sd_card_identification_mode] = "identification",
204 [sd_data_transfer_mode] = "transfer",
205 };
206 assert(mode < ARRAY_SIZE(mode_name));
207 return mode_name[mode];
208 }
209
210 static const char *sd_state_name(enum SDCardStates state)
211 {
212 static const char *state_name[] = {
213 [sd_idle_state] = "idle",
214 [sd_ready_state] = "ready",
215 [sd_identification_state] = "identification",
216 [sd_standby_state] = "standby",
217 [sd_transfer_state] = "transfer",
218 [sd_sendingdata_state] = "sendingdata",
219 [sd_bus_test_state] = "bus-test",
220 [sd_receivingdata_state] = "receivingdata",
221 [sd_programming_state] = "programming",
222 [sd_disconnect_state] = "disconnect",
223 [sd_sleep_state] = "sleep",
224 [sd_io_state] = "i/o"
225 };
226 if (state == sd_inactive_state) {
227 return "inactive";
228 }
229 if (state == sd_waitirq_state) {
230 return "wait-irq";
231 }
232 assert(state < ARRAY_SIZE(state_name));
233 return state_name[state];
234 }
235
236 static const char *sd_response_name(sd_rsp_type_t rsp)
237 {
238 static const char *response_name[] = {
239 [sd_r0] = "RESP#0 (no response)",
240 [sd_r1] = "RESP#1 (normal cmd)",
241 [sd_r2_i] = "RESP#2 (CID reg)",
242 [sd_r2_s] = "RESP#2 (CSD reg)",
243 [sd_r3] = "RESP#3 (OCR reg)",
244 [sd_r6] = "RESP#6 (RCA)",
245 [sd_r7] = "RESP#7 (operating voltage)",
246 };
247 if (rsp == sd_illegal) {
248 return "ILLEGAL RESP";
249 }
250 if (rsp == sd_r1b) {
251 rsp = sd_r1;
252 }
253 assert(rsp < ARRAY_SIZE(response_name));
254 return response_name[rsp];
255 }
256
257 static const char *sd_cmd_name(SDState *sd, uint8_t cmd)
258 {
259 static const char *cmd_abbrev[SDMMC_CMD_MAX] = {
260 [18] = "READ_MULTIPLE_BLOCK",
261 [25] = "WRITE_MULTIPLE_BLOCK",
262 };
263 const SDProto *sdp = sd->proto;
264
265 if (sdp->cmd[cmd].handler) {
266 assert(!cmd_abbrev[cmd]);
267 return sdp->cmd[cmd].name;
268 }
269 return cmd_abbrev[cmd] ? cmd_abbrev[cmd] : "UNKNOWN_CMD";
270 }
271
272 static const char *sd_acmd_name(SDState *sd, uint8_t cmd)
273 {
274 const SDProto *sdp = sd->proto;
275
276 if (sdp->acmd[cmd].handler) {
277 return sdp->acmd[cmd].name;
278 }
279
280 return "UNKNOWN_ACMD";
281 }
282
283 static uint8_t sd_get_dat_lines(SDState *sd)
284 {
285 return sd->enable ? sd->dat_lines : 0;
286 }
287
288 static bool sd_get_cmd_line(SDState *sd)
289 {
290 return sd->enable ? sd->cmd_line : false;
291 }
292
293 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
294 {
295 trace_sdcard_set_voltage(millivolts);
296
297 switch (millivolts) {
298 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
299 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
300 break;
301 default:
302 qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
303 millivolts / 1000.f);
304 }
305 }
306
307 static void sd_set_mode(SDState *sd)
308 {
309 switch (sd->state) {
310 case sd_inactive_state:
311 sd->mode = sd_inactive;
312 break;
313
314 case sd_idle_state:
315 case sd_ready_state:
316 case sd_identification_state:
317 sd->mode = sd_card_identification_mode;
318 break;
319
320 case sd_standby_state:
321 case sd_transfer_state:
322 case sd_sendingdata_state:
323 case sd_receivingdata_state:
324 case sd_programming_state:
325 case sd_disconnect_state:
326 sd->mode = sd_data_transfer_mode;
327 break;
328 }
329 }
330
331 static uint8_t sd_crc7(const void *message, size_t width)
332 {
333 int i, bit;
334 uint8_t shift_reg = 0x00;
335 const uint8_t *msg = (const uint8_t *)message;
336
337 for (i = 0; i < width; i ++, msg ++)
338 for (bit = 7; bit >= 0; bit --) {
339 shift_reg <<= 1;
340 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
341 shift_reg ^= 0x89;
342 }
343
344 return shift_reg;
345 }
346
347 /* Operation Conditions register */
348
349 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
350
351 FIELD(OCR, VDD_VOLTAGE_WINDOW, 0, 24)
352 FIELD(OCR, VDD_VOLTAGE_WIN_LO, 0, 8)
353 FIELD(OCR, DUAL_VOLTAGE_CARD, 7, 1)
354 FIELD(OCR, VDD_VOLTAGE_WIN_HI, 8, 16)
355 FIELD(OCR, ACCEPT_SWITCH_1V8, 24, 1) /* Only UHS-I */
356 FIELD(OCR, UHS_II_CARD, 29, 1) /* Only UHS-II */
357 FIELD(OCR, CARD_CAPACITY, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
358 FIELD(OCR, CARD_POWER_UP, 31, 1)
359
360 #define ACMD41_ENQUIRY_MASK 0x00ffffff
361 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
362 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
363 | R_OCR_UHS_II_CARD_MASK \
364 | R_OCR_CARD_CAPACITY_MASK \
365 | R_OCR_CARD_POWER_UP_MASK)
366
367 static void sd_ocr_powerup(void *opaque)
368 {
369 SDState *sd = opaque;
370
371 trace_sdcard_powerup();
372 assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
373
374 /* card power-up OK */
375 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
376
377 if (sd->size > SDSC_MAX_CAPACITY) {
378 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
379 }
380 }
381
382 static void sd_set_ocr(SDState *sd)
383 {
384 /* All voltages OK */
385 sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
386
387 if (sd_is_spi(sd)) {
388 /*
389 * We don't need to emulate power up sequence in SPI-mode.
390 * Thus, the card's power up status bit should be set to 1 when reset.
391 * The card's capacity status bit should also be set if SD card size
392 * is larger than 2GB for SDHC support.
393 */
394 sd_ocr_powerup(sd);
395 }
396 }
397
398 /* SD Configuration register */
399
400 static void sd_set_scr(SDState *sd)
401 {
402 sd->scr[0] = 0 << 4; /* SCR structure version 1.0 */
403 if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
404 sd->scr[0] |= 1; /* Spec Version 1.10 */
405 } else {
406 sd->scr[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
407 }
408 sd->scr[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
409 | 0b0101; /* 1-bit or 4-bit width bus modes */
410 sd->scr[2] = 0x00; /* Extended Security is not supported. */
411 if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
412 sd->scr[2] |= 1 << 7; /* Spec Version 3.0X */
413 }
414 sd->scr[3] = 0x00;
415 /* reserved for manufacturer usage */
416 sd->scr[4] = 0x00;
417 sd->scr[5] = 0x00;
418 sd->scr[6] = 0x00;
419 sd->scr[7] = 0x00;
420 }
421
422 /* Card IDentification register */
423
424 #define MID 0xaa
425 #define OID "XY"
426 #define PNM "QEMU!"
427 #define PRV 0x01
428 #define MDT_YR 2006
429 #define MDT_MON 2
430
431 static void sd_set_cid(SDState *sd)
432 {
433 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
434 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
435 sd->cid[2] = OID[1];
436 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
437 sd->cid[4] = PNM[1];
438 sd->cid[5] = PNM[2];
439 sd->cid[6] = PNM[3];
440 sd->cid[7] = PNM[4];
441 sd->cid[8] = PRV; /* Fake product revision (PRV) */
442 stl_be_p(&sd->cid[9], 0xdeadbeef); /* Fake serial number (PSN) */
443 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */
444 ((MDT_YR - 2000) / 10);
445 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
446 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
447 }
448
449 static void emmc_set_cid(SDState *sd)
450 {
451 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
452 sd->cid[1] = 0b01; /* CBX: soldered BGA */
453 sd->cid[2] = OID[0]; /* OEM/Application ID (OID) */
454 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
455 sd->cid[4] = PNM[1];
456 sd->cid[5] = PNM[2];
457 sd->cid[6] = PNM[3];
458 sd->cid[7] = PNM[4];
459 sd->cid[8] = PNM[4];
460 sd->cid[9] = PRV; /* Fake product revision (PRV) */
461 stl_be_p(&sd->cid[10], 0xdeadbeef); /* Fake serial number (PSN) */
462 sd->cid[14] = (MDT_MON << 4) | (MDT_YR - 1997); /* Manufacture date (MDT) */
463 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
464 }
465
466 /* Card-Specific Data register */
467
468 #define HWBLOCK_SHIFT 9 /* 512 bytes */
469 #define SECTOR_SHIFT 5 /* 16 kilobytes */
470 #define WPGROUP_SHIFT 7 /* 2 megs */
471 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
472 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
473
474 static const uint8_t sd_csd_rw_mask[16] = {
475 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
476 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
477 };
478
479 static void emmc_set_csd(SDState *sd, uint64_t size)
480 {
481 int hwblock_shift = HWBLOCK_SHIFT;
482 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
483 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
484
485 sd->csd[0] = (3 << 6) | (4 << 2); /* Spec v4.3 with EXT_CSD */
486 sd->csd[1] = (1 << 3) | 6; /* Asynchronous data access time: 1ms */
487 sd->csd[2] = 0x00;
488 sd->csd[3] = (1 << 3) | 3;; /* Maximum bus clock frequency: 100MHz */
489 sd->csd[4] = 0x0f;
490 if (size <= 2 * GiB) {
491 /* use 1k blocks */
492 uint32_t csize1k = (size >> (CMULT_SHIFT + 10)) - 1;
493 sd->csd[5] = 0x5a;
494 sd->csd[6] = 0x80 | ((csize1k >> 10) & 0xf);
495 sd->csd[7] = (csize1k >> 2) & 0xff;
496 } else { /* >= 2GB : size stored in ext CSD, block addressing */
497 sd->csd[5] = 0x59;
498 sd->csd[6] = 0x8f;
499 sd->csd[7] = 0xff;
500 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
501 }
502 sd->csd[8] = 0xff;
503 sd->csd[9] = 0xfc | /* Max. write current */
504 ((CMULT_SHIFT - 2) >> 1);
505 sd->csd[10] = 0x40 | /* Erase sector size */
506 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
507 sd->csd[11] = 0x00 | /* Write protect group size */
508 ((sectsize << 7) & 0x80) | wpsize;
509 sd->csd[12] = 0x90 | /* Write speed factor */
510 (hwblock_shift >> 2);
511 sd->csd[13] = 0x20 | /* Max. write data block length */
512 ((hwblock_shift << 6) & 0xc0);
513 sd->csd[14] = 0x00;
514 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
515 }
516
517 static void sd_set_csd(SDState *sd, uint64_t size)
518 {
519 int hwblock_shift = HWBLOCK_SHIFT;
520 uint32_t csize;
521 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
522 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
523
524 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
525 if (size == SDSC_MAX_CAPACITY) {
526 hwblock_shift += 1;
527 }
528 csize = (size >> (CMULT_SHIFT + hwblock_shift)) - 1;
529
530 if (size <= SDSC_MAX_CAPACITY) { /* Standard Capacity SD */
531 sd->csd[0] = 0x00; /* CSD structure */
532 sd->csd[1] = 0x26; /* Data read access-time-1 */
533 sd->csd[2] = 0x00; /* Data read access-time-2 */
534 sd->csd[3] = 0x32; /* Max. data transfer rate: 25 MHz */
535 sd->csd[4] = 0x5f; /* Card Command Classes */
536 sd->csd[5] = 0x50 | /* Max. read data block length */
537 hwblock_shift;
538 sd->csd[6] = 0xe0 | /* Partial block for read allowed */
539 ((csize >> 10) & 0x03);
540 sd->csd[7] = 0x00 | /* Device size */
541 ((csize >> 2) & 0xff);
542 sd->csd[8] = 0x3f | /* Max. read current */
543 ((csize << 6) & 0xc0);
544 sd->csd[9] = 0xfc | /* Max. write current */
545 ((CMULT_SHIFT - 2) >> 1);
546 sd->csd[10] = 0x40 | /* Erase sector size */
547 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
548 sd->csd[11] = 0x00 | /* Write protect group size */
549 ((sectsize << 7) & 0x80) | wpsize;
550 sd->csd[12] = 0x90 | /* Write speed factor */
551 (hwblock_shift >> 2);
552 sd->csd[13] = 0x20 | /* Max. write data block length */
553 ((hwblock_shift << 6) & 0xc0);
554 sd->csd[14] = 0x00; /* File format group */
555 } else { /* SDHC */
556 size /= 512 * KiB;
557 size -= 1;
558 sd->csd[0] = 0x40;
559 sd->csd[1] = 0x0e;
560 sd->csd[2] = 0x00;
561 sd->csd[3] = 0x32;
562 sd->csd[4] = 0x5b;
563 sd->csd[5] = 0x59;
564 sd->csd[6] = 0x00;
565 st24_be_p(&sd->csd[7], size);
566 sd->csd[10] = 0x7f;
567 sd->csd[11] = 0x80;
568 sd->csd[12] = 0x0a;
569 sd->csd[13] = 0x40;
570 sd->csd[14] = 0x00;
571 }
572 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
573 }
574
575 /* Relative Card Address register */
576
577 static void sd_set_rca(SDState *sd, uint16_t value)
578 {
579 trace_sdcard_set_rca(value);
580 sd->rca = value;
581 }
582
583 static uint16_t sd_req_get_rca(SDState *s, SDRequest req)
584 {
585 switch (s->proto->cmd[req.cmd].type) {
586 case sd_ac:
587 case sd_adtc:
588 return req.arg >> 16;
589 case sd_spi:
590 default:
591 g_assert_not_reached();
592 }
593 }
594
595 static bool sd_req_rca_same(SDState *s, SDRequest req)
596 {
597 return sd_req_get_rca(s, req) == s->rca;
598 }
599
600 /* Card Status register */
601
602 FIELD(CSR, AKE_SEQ_ERROR, 3, 1)
603 FIELD(CSR, APP_CMD, 5, 1)
604 FIELD(CSR, FX_EVENT, 6, 1)
605 FIELD(CSR, READY_FOR_DATA, 8, 1)
606 FIELD(CSR, CURRENT_STATE, 9, 4)
607 FIELD(CSR, ERASE_RESET, 13, 1)
608 FIELD(CSR, CARD_ECC_DISABLED, 14, 1)
609 FIELD(CSR, WP_ERASE_SKIP, 15, 1)
610 FIELD(CSR, CSD_OVERWRITE, 16, 1)
611 FIELD(CSR, DEFERRED_RESPONSE, 17, 1)
612 FIELD(CSR, ERROR, 19, 1)
613 FIELD(CSR, CC_ERROR, 20, 1)
614 FIELD(CSR, CARD_ECC_FAILED, 21, 1)
615 FIELD(CSR, ILLEGAL_COMMAND, 22, 1)
616 FIELD(CSR, COM_CRC_ERROR, 23, 1)
617 FIELD(CSR, LOCK_UNLOCK_FAILED, 24, 1)
618 FIELD(CSR, CARD_IS_LOCKED, 25, 1)
619 FIELD(CSR, WP_VIOLATION, 26, 1)
620 FIELD(CSR, ERASE_PARAM, 27, 1)
621 FIELD(CSR, ERASE_SEQ_ERROR, 28, 1)
622 FIELD(CSR, BLOCK_LEN_ERROR, 29, 1)
623 FIELD(CSR, ADDRESS_ERROR, 30, 1)
624 FIELD(CSR, OUT_OF_RANGE, 31, 1)
625
626 /* Card status bits, split by clear condition:
627 * A : According to the card current state
628 * B : Always related to the previous command
629 * C : Cleared by read
630 */
631 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
632 | R_CSR_CARD_ECC_DISABLED_MASK \
633 | R_CSR_CARD_IS_LOCKED_MASK)
634 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
635 | R_CSR_ILLEGAL_COMMAND_MASK \
636 | R_CSR_COM_CRC_ERROR_MASK)
637 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
638 | R_CSR_APP_CMD_MASK \
639 | R_CSR_ERASE_RESET_MASK \
640 | R_CSR_WP_ERASE_SKIP_MASK \
641 | R_CSR_CSD_OVERWRITE_MASK \
642 | R_CSR_ERROR_MASK \
643 | R_CSR_CC_ERROR_MASK \
644 | R_CSR_CARD_ECC_FAILED_MASK \
645 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
646 | R_CSR_WP_VIOLATION_MASK \
647 | R_CSR_ERASE_PARAM_MASK \
648 | R_CSR_ERASE_SEQ_ERROR_MASK \
649 | R_CSR_BLOCK_LEN_ERROR_MASK \
650 | R_CSR_ADDRESS_ERROR_MASK \
651 | R_CSR_OUT_OF_RANGE_MASK)
652
653 static void sd_set_cardstatus(SDState *sd)
654 {
655 sd->card_status = READY_FOR_DATA;
656 }
657
658 static void sd_set_sdstatus(SDState *sd)
659 {
660 memset(sd->sd_status, 0, 64);
661 }
662
663 static const uint8_t sd_tuning_block_pattern4[64] = {
664 /*
665 * See: Physical Layer Simplified Specification Version 3.01,
666 * Table 4-2.
667 */
668 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
669 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
670 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
671 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
672 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
673 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
674 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
675 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde
676 };
677
678 static int sd_req_crc_validate(SDRequest *req)
679 {
680 uint8_t buffer[5];
681 buffer[0] = 0x40 | req->cmd;
682 stl_be_p(&buffer[1], req->arg);
683 return 0;
684 return sd_crc7(buffer, 5) != req->crc; /* TODO */
685 }
686
687 static void sd_response_r1_make(SDState *sd, uint8_t *response)
688 {
689 stl_be_p(response, sd->card_status);
690
691 /* Clear the "clear on read" status bits */
692 sd->card_status &= ~CARD_STATUS_C;
693 }
694
695 static void sd_response_r3_make(SDState *sd, uint8_t *response)
696 {
697 stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
698 }
699
700 static void sd_response_r6_make(SDState *sd, uint8_t *response)
701 {
702 uint16_t status;
703
704 status = ((sd->card_status >> 8) & 0xc000) |
705 ((sd->card_status >> 6) & 0x2000) |
706 (sd->card_status & 0x1fff);
707 sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
708 stw_be_p(response + 0, sd->rca);
709 stw_be_p(response + 2, status);
710 }
711
712 static void sd_response_r7_make(SDState *sd, uint8_t *response)
713 {
714 stl_be_p(response, sd->vhs);
715 }
716
717 static uint32_t sd_blk_len(SDState *sd)
718 {
719 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
720 return 1 << HWBLOCK_SHIFT;
721 }
722 return sd->blk_len;
723 }
724
725 static uint64_t sd_req_get_address(SDState *sd, SDRequest req)
726 {
727 uint64_t addr;
728
729 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
730 addr = (uint64_t) req.arg << HWBLOCK_SHIFT;
731 } else {
732 addr = req.arg;
733 }
734 trace_sdcard_req_addr(req.arg, addr);
735 return addr;
736 }
737
738 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
739 {
740 return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
741 }
742
743 static void sd_reset(DeviceState *dev)
744 {
745 SDState *sd = SDMMC_COMMON(dev);
746 SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
747 uint64_t size;
748 uint64_t sect;
749
750 trace_sdcard_reset();
751 if (sd->blk) {
752 blk_get_geometry(sd->blk, &sect);
753 } else {
754 sect = 0;
755 }
756 size = sect << HWBLOCK_SHIFT;
757
758 sect = sd_addr_to_wpnum(size) + 1;
759
760 sd->state = sd_idle_state;
761
762 /* card registers */
763 sd->rca = sd_is_emmc(sd) ? 0x0001 : 0x0000;
764 sd->size = size;
765 sd_set_ocr(sd);
766 sd_set_scr(sd);
767 sc->set_cid(sd);
768 sc->set_csd(sd, size);
769 sd_set_cardstatus(sd);
770 sd_set_sdstatus(sd);
771
772 g_free(sd->wp_group_bmap);
773 sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false;
774 sd->wp_group_bits = sect;
775 sd->wp_group_bmap = bitmap_new(sd->wp_group_bits);
776 memset(sd->function_group, 0, sizeof(sd->function_group));
777 sd->erase_start = INVALID_ADDRESS;
778 sd->erase_end = INVALID_ADDRESS;
779 sd->blk_len = 0x200;
780 sd->pwd_len = 0;
781 sd->expecting_acmd = false;
782 sd->dat_lines = 0xf;
783 sd->cmd_line = true;
784 sd->multi_blk_cnt = 0;
785 }
786
787 static bool sd_get_inserted(SDState *sd)
788 {
789 return sd->blk && blk_is_inserted(sd->blk);
790 }
791
792 static bool sd_get_readonly(SDState *sd)
793 {
794 return sd->wp_switch;
795 }
796
797 static void sd_cardchange(void *opaque, bool load, Error **errp)
798 {
799 SDState *sd = opaque;
800 DeviceState *dev = DEVICE(sd);
801 SDBus *sdbus;
802 bool inserted = sd_get_inserted(sd);
803 bool readonly = sd_get_readonly(sd);
804
805 if (inserted) {
806 trace_sdcard_inserted(readonly);
807 sd_reset(dev);
808 } else {
809 trace_sdcard_ejected();
810 }
811
812 if (sd->me_no_qdev_me_kill_mammoth_with_rocks) {
813 qemu_set_irq(sd->inserted_cb, inserted);
814 if (inserted) {
815 qemu_set_irq(sd->readonly_cb, readonly);
816 }
817 } else {
818 sdbus = SD_BUS(qdev_get_parent_bus(dev));
819 sdbus_set_inserted(sdbus, inserted);
820 if (inserted) {
821 sdbus_set_readonly(sdbus, readonly);
822 }
823 }
824 }
825
826 static const BlockDevOps sd_block_ops = {
827 .change_media_cb = sd_cardchange,
828 };
829
830 static bool sd_ocr_vmstate_needed(void *opaque)
831 {
832 SDState *sd = opaque;
833
834 /* Include the OCR state (and timer) if it is not yet powered up */
835 return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
836 }
837
838 static const VMStateDescription sd_ocr_vmstate = {
839 .name = "sd-card/ocr-state",
840 .version_id = 1,
841 .minimum_version_id = 1,
842 .needed = sd_ocr_vmstate_needed,
843 .fields = (const VMStateField[]) {
844 VMSTATE_UINT32(ocr, SDState),
845 VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
846 VMSTATE_END_OF_LIST()
847 },
848 };
849
850 static int sd_vmstate_pre_load(void *opaque)
851 {
852 SDState *sd = opaque;
853
854 /* If the OCR state is not included (prior versions, or not
855 * needed), then the OCR must be set as powered up. If the OCR state
856 * is included, this will be replaced by the state restore.
857 */
858 sd_ocr_powerup(sd);
859
860 return 0;
861 }
862
863 static const VMStateDescription sd_vmstate = {
864 .name = "sd-card",
865 .version_id = 2,
866 .minimum_version_id = 2,
867 .pre_load = sd_vmstate_pre_load,
868 .fields = (const VMStateField[]) {
869 VMSTATE_UINT32(mode, SDState),
870 VMSTATE_INT32(state, SDState),
871 VMSTATE_UINT8_ARRAY(cid, SDState, 16),
872 VMSTATE_UINT8_ARRAY(csd, SDState, 16),
873 VMSTATE_UINT16(rca, SDState),
874 VMSTATE_UINT32(card_status, SDState),
875 VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
876 VMSTATE_UINT32(vhs, SDState),
877 VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits),
878 VMSTATE_UINT32(blk_len, SDState),
879 VMSTATE_UINT32(multi_blk_cnt, SDState),
880 VMSTATE_UINT32(erase_start, SDState),
881 VMSTATE_UINT32(erase_end, SDState),
882 VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
883 VMSTATE_UINT32(pwd_len, SDState),
884 VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
885 VMSTATE_UINT8(current_cmd, SDState),
886 VMSTATE_BOOL(expecting_acmd, SDState),
887 VMSTATE_UINT32(blk_written, SDState),
888 VMSTATE_UINT64(data_start, SDState),
889 VMSTATE_UINT32(data_offset, SDState),
890 VMSTATE_UINT8_ARRAY(data, SDState, 512),
891 VMSTATE_UNUSED_V(1, 512),
892 VMSTATE_BOOL(enable, SDState),
893 VMSTATE_END_OF_LIST()
894 },
895 .subsections = (const VMStateDescription * const []) {
896 &sd_ocr_vmstate,
897 NULL
898 },
899 };
900
901 /* Legacy initialization function for use by non-qdevified callers */
902 SDState *sd_init(BlockBackend *blk, bool is_spi)
903 {
904 Object *obj;
905 DeviceState *dev;
906 SDState *sd;
907 Error *err = NULL;
908
909 obj = object_new(is_spi ? TYPE_SD_CARD_SPI : TYPE_SD_CARD);
910 dev = DEVICE(obj);
911 if (!qdev_prop_set_drive_err(dev, "drive", blk, &err)) {
912 error_reportf_err(err, "sd_init failed: ");
913 return NULL;
914 }
915
916 /*
917 * Realizing the device properly would put it into the QOM
918 * composition tree even though it is not plugged into an
919 * appropriate bus. That's a no-no. Hide the device from
920 * QOM/qdev, and call its qdev realize callback directly.
921 */
922 object_ref(obj);
923 object_unparent(obj);
924 sd_realize(dev, &err);
925 if (err) {
926 error_reportf_err(err, "sd_init failed: ");
927 return NULL;
928 }
929
930 sd = SD_CARD(dev);
931 sd->me_no_qdev_me_kill_mammoth_with_rocks = true;
932 return sd;
933 }
934
935 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
936 {
937 sd->readonly_cb = readonly;
938 sd->inserted_cb = insert;
939 qemu_set_irq(readonly, sd->blk ? !blk_is_writable(sd->blk) : 0);
940 qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
941 }
942
943 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
944 {
945 trace_sdcard_read_block(addr, len);
946 if (!sd->blk || blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {
947 fprintf(stderr, "sd_blk_read: read error on host side\n");
948 }
949 }
950
951 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
952 {
953 trace_sdcard_write_block(addr, len);
954 if (!sd->blk || blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {
955 fprintf(stderr, "sd_blk_write: write error on host side\n");
956 }
957 }
958
959 static void sd_erase(SDState *sd)
960 {
961 uint64_t erase_start = sd->erase_start;
962 uint64_t erase_end = sd->erase_end;
963 bool sdsc = true;
964 uint64_t wpnum;
965 uint64_t erase_addr;
966 int erase_len = 1 << HWBLOCK_SHIFT;
967
968 trace_sdcard_erase(sd->erase_start, sd->erase_end);
969 if (sd->erase_start == INVALID_ADDRESS
970 || sd->erase_end == INVALID_ADDRESS) {
971 sd->card_status |= ERASE_SEQ_ERROR;
972 sd->erase_start = INVALID_ADDRESS;
973 sd->erase_end = INVALID_ADDRESS;
974 return;
975 }
976
977 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
978 /* High capacity memory card: erase units are 512 byte blocks */
979 erase_start <<= HWBLOCK_SHIFT;
980 erase_end <<= HWBLOCK_SHIFT;
981 sdsc = false;
982 }
983
984 if (erase_start > sd->size || erase_end > sd->size) {
985 sd->card_status |= OUT_OF_RANGE;
986 sd->erase_start = INVALID_ADDRESS;
987 sd->erase_end = INVALID_ADDRESS;
988 return;
989 }
990
991 sd->erase_start = INVALID_ADDRESS;
992 sd->erase_end = INVALID_ADDRESS;
993 sd->csd[14] |= 0x40;
994
995 memset(sd->data, 0xff, erase_len);
996 for (erase_addr = erase_start; erase_addr <= erase_end;
997 erase_addr += erase_len) {
998 if (sdsc) {
999 /* Only SDSC cards support write protect groups */
1000 wpnum = sd_addr_to_wpnum(erase_addr);
1001 assert(wpnum < sd->wp_group_bits);
1002 if (test_bit(wpnum, sd->wp_group_bmap)) {
1003 sd->card_status |= WP_ERASE_SKIP;
1004 continue;
1005 }
1006 }
1007 sd_blk_write(sd, erase_addr, erase_len);
1008 }
1009 }
1010
1011 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
1012 {
1013 uint32_t i, wpnum;
1014 uint32_t ret = 0;
1015
1016 wpnum = sd_addr_to_wpnum(addr);
1017
1018 for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
1019 if (addr >= sd->size) {
1020 /*
1021 * If the addresses of the last groups are outside the valid range,
1022 * then the corresponding write protection bits shall be set to 0.
1023 */
1024 continue;
1025 }
1026 assert(wpnum < sd->wp_group_bits);
1027 if (test_bit(wpnum, sd->wp_group_bmap)) {
1028 ret |= (1 << i);
1029 }
1030 }
1031
1032 return ret;
1033 }
1034
1035 static void sd_function_switch(SDState *sd, uint32_t arg)
1036 {
1037 int i, mode, new_func;
1038 mode = !!(arg & 0x80000000);
1039
1040 sd->data[0] = 0x00; /* Maximum current consumption */
1041 sd->data[1] = 0x01;
1042 sd->data[2] = 0x80; /* Supported group 6 functions */
1043 sd->data[3] = 0x01;
1044 sd->data[4] = 0x80; /* Supported group 5 functions */
1045 sd->data[5] = 0x01;
1046 sd->data[6] = 0x80; /* Supported group 4 functions */
1047 sd->data[7] = 0x01;
1048 sd->data[8] = 0x80; /* Supported group 3 functions */
1049 sd->data[9] = 0x01;
1050 sd->data[10] = 0x80; /* Supported group 2 functions */
1051 sd->data[11] = 0x43;
1052 sd->data[12] = 0x80; /* Supported group 1 functions */
1053 sd->data[13] = 0x03;
1054
1055 memset(&sd->data[14], 0, 3);
1056 for (i = 0; i < 6; i ++) {
1057 new_func = (arg >> (i * 4)) & 0x0f;
1058 if (mode && new_func != 0x0f)
1059 sd->function_group[i] = new_func;
1060 sd->data[16 - (i >> 1)] |= new_func << ((i % 2) * 4);
1061 }
1062 memset(&sd->data[17], 0, 47);
1063 }
1064
1065 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
1066 {
1067 return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1068 }
1069
1070 static void sd_lock_command(SDState *sd)
1071 {
1072 int erase, lock, clr_pwd, set_pwd, pwd_len;
1073 erase = !!(sd->data[0] & 0x08);
1074 lock = sd->data[0] & 0x04;
1075 clr_pwd = sd->data[0] & 0x02;
1076 set_pwd = sd->data[0] & 0x01;
1077
1078 if (sd->blk_len > 1)
1079 pwd_len = sd->data[1];
1080 else
1081 pwd_len = 0;
1082
1083 if (lock) {
1084 trace_sdcard_lock();
1085 } else {
1086 trace_sdcard_unlock();
1087 }
1088 if (erase) {
1089 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
1090 set_pwd || clr_pwd || lock || sd->wp_switch ||
1091 (sd->csd[14] & 0x20)) {
1092 sd->card_status |= LOCK_UNLOCK_FAILED;
1093 return;
1094 }
1095 bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits);
1096 sd->csd[14] &= ~0x10;
1097 sd->card_status &= ~CARD_IS_LOCKED;
1098 sd->pwd_len = 0;
1099 /* Erasing the entire card here! */
1100 fprintf(stderr, "SD: Card force-erased by CMD42\n");
1101 return;
1102 }
1103
1104 if (sd->blk_len < 2 + pwd_len ||
1105 pwd_len <= sd->pwd_len ||
1106 pwd_len > sd->pwd_len + 16) {
1107 sd->card_status |= LOCK_UNLOCK_FAILED;
1108 return;
1109 }
1110
1111 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
1112 sd->card_status |= LOCK_UNLOCK_FAILED;
1113 return;
1114 }
1115
1116 pwd_len -= sd->pwd_len;
1117 if ((pwd_len && !set_pwd) ||
1118 (clr_pwd && (set_pwd || lock)) ||
1119 (lock && !sd->pwd_len && !set_pwd) ||
1120 (!set_pwd && !clr_pwd &&
1121 (((sd->card_status & CARD_IS_LOCKED) && lock) ||
1122 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
1123 sd->card_status |= LOCK_UNLOCK_FAILED;
1124 return;
1125 }
1126
1127 if (set_pwd) {
1128 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
1129 sd->pwd_len = pwd_len;
1130 }
1131
1132 if (clr_pwd) {
1133 sd->pwd_len = 0;
1134 }
1135
1136 if (lock)
1137 sd->card_status |= CARD_IS_LOCKED;
1138 else
1139 sd->card_status &= ~CARD_IS_LOCKED;
1140 }
1141
1142 static bool address_in_range(SDState *sd, const char *desc,
1143 uint64_t addr, uint32_t length)
1144 {
1145 if (addr + length > sd->size) {
1146 qemu_log_mask(LOG_GUEST_ERROR,
1147 "%s offset %"PRIu64" > card %"PRIu64" [%%%u]\n",
1148 desc, addr, sd->size, length);
1149 sd->card_status |= ADDRESS_ERROR;
1150 return false;
1151 }
1152 return true;
1153 }
1154
1155 static sd_rsp_type_t sd_invalid_state_for_cmd(SDState *sd, SDRequest req)
1156 {
1157 qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1158 sd->proto->name, req.cmd, sd_state_name(sd->state),
1159 sd_version_str(sd->spec_version));
1160
1161 return sd_illegal;
1162 }
1163
1164 static sd_rsp_type_t sd_invalid_mode_for_cmd(SDState *sd, SDRequest req)
1165 {
1166 qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
1167 sd->proto->name, req.cmd, sd_mode_name(sd->mode),
1168 sd_version_str(sd->spec_version));
1169
1170 return sd_illegal;
1171 }
1172
1173 static sd_rsp_type_t sd_cmd_illegal(SDState *sd, SDRequest req)
1174 {
1175 qemu_log_mask(LOG_GUEST_ERROR, "%s: Unknown CMD%i for spec %s\n",
1176 sd->proto->name, req.cmd,
1177 sd_version_str(sd->spec_version));
1178
1179 return sd_illegal;
1180 }
1181
1182 /* Commands that are recognised but not yet implemented. */
1183 static sd_rsp_type_t sd_cmd_unimplemented(SDState *sd, SDRequest req)
1184 {
1185 qemu_log_mask(LOG_UNIMP, "%s: CMD%i not implemented\n",
1186 sd->proto->name, req.cmd);
1187
1188 return sd_illegal;
1189 }
1190
1191 static sd_rsp_type_t sd_cmd_optional(SDState *sd, SDRequest req)
1192 {
1193 qemu_log_mask(LOG_UNIMP, "%s: Optional CMD%i not implemented\n",
1194 sd->proto->name, req.cmd);
1195
1196 return sd_illegal;
1197 }
1198
1199 /* Configure fields for following sd_generic_write_byte() calls */
1200 static sd_rsp_type_t sd_cmd_to_receivingdata(SDState *sd, SDRequest req,
1201 uint64_t start, size_t size)
1202 {
1203 if (sd->state != sd_transfer_state) {
1204 return sd_invalid_state_for_cmd(sd, req);
1205 }
1206 sd->state = sd_receivingdata_state;
1207 sd->data_start = start;
1208 sd->data_offset = 0;
1209 /* sd->data[] used as receive buffer */
1210 sd->data_size = size ?: sizeof(sd->data);
1211 return sd_r1;
1212 }
1213
1214 /* Configure fields for following sd_generic_read_byte() calls */
1215 static sd_rsp_type_t sd_cmd_to_sendingdata(SDState *sd, SDRequest req,
1216 uint64_t start,
1217 const void *data, size_t size)
1218 {
1219 if (sd->state != sd_transfer_state) {
1220 sd_invalid_state_for_cmd(sd, req);
1221 }
1222
1223 sd->state = sd_sendingdata_state;
1224 sd->data_start = start;
1225 sd->data_offset = 0;
1226 if (data) {
1227 assert(size > 0 && size <= sizeof(sd->data));
1228 memcpy(sd->data, data, size);
1229 }
1230 if (size) {
1231 sd->data_size = size;
1232 }
1233 return sd_r1;
1234 }
1235
1236 /* CMD0 */
1237 static sd_rsp_type_t sd_cmd_GO_IDLE_STATE(SDState *sd, SDRequest req)
1238 {
1239 if (sd->state == sd_sleep_state) {
1240 switch (req.arg) {
1241 case 0x00000000:
1242 case 0xf0f0f0f0:
1243 break;
1244 default:
1245 return sd_r0;
1246 }
1247 }
1248 if (sd->state != sd_inactive_state) {
1249 sd->state = sd_idle_state;
1250 sd_reset(DEVICE(sd));
1251 }
1252
1253 return sd_is_spi(sd) ? sd_r1 : sd_r0;
1254 }
1255
1256 /* CMD1 */
1257 static sd_rsp_type_t spi_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
1258 {
1259 sd->state = sd_transfer_state;
1260
1261 return sd_r1;
1262 }
1263
1264 /* CMD2 */
1265 static sd_rsp_type_t sd_cmd_ALL_SEND_CID(SDState *sd, SDRequest req)
1266 {
1267 switch (sd->state) {
1268 case sd_ready_state:
1269 sd->state = sd_identification_state;
1270 return sd_r2_i;
1271 default:
1272 return sd_invalid_state_for_cmd(sd, req);
1273 }
1274 }
1275
1276 /* CMD3 */
1277 static sd_rsp_type_t sd_cmd_SEND_RELATIVE_ADDR(SDState *sd, SDRequest req)
1278 {
1279 uint16_t random_rca;
1280
1281 switch (sd->state) {
1282 case sd_identification_state:
1283 case sd_standby_state:
1284 sd->state = sd_standby_state;
1285 qemu_guest_getrandom_nofail(&random_rca, sizeof(random_rca));
1286 sd_set_rca(sd, random_rca);
1287 return sd_r6;
1288
1289 default:
1290 return sd_invalid_state_for_cmd(sd, req);
1291 }
1292 }
1293
1294 static sd_rsp_type_t emmc_cmd_SET_RELATIVE_ADDR(SDState *sd, SDRequest req)
1295 {
1296 switch (sd->state) {
1297 case sd_identification_state:
1298 case sd_standby_state:
1299 sd->state = sd_standby_state;
1300 sd_set_rca(sd, req.arg >> 16);
1301 return sd_r1;
1302
1303 default:
1304 return sd_invalid_state_for_cmd(sd, req);
1305 }
1306 }
1307
1308 /* CMD5 */
1309 static sd_rsp_type_t emmc_cmd_sleep_awake(SDState *sd, SDRequest req)
1310 {
1311 bool do_sleep = extract32(req.arg, 15, 1);
1312
1313 switch (sd->state) {
1314 case sd_sleep_state:
1315 if (!do_sleep) {
1316 /* Awake */
1317 sd->state = sd_standby_state;
1318 }
1319 return sd_r1b;
1320
1321 case sd_standby_state:
1322 if (do_sleep) {
1323 sd->state = sd_sleep_state;
1324 }
1325 return sd_r1b;
1326
1327 default:
1328 return sd_invalid_state_for_cmd(sd, req);
1329 }
1330 }
1331
1332 /* CMD6 */
1333 static sd_rsp_type_t sd_cmd_SWITCH_FUNCTION(SDState *sd, SDRequest req)
1334 {
1335 if (sd->mode != sd_data_transfer_mode) {
1336 return sd_invalid_mode_for_cmd(sd, req);
1337 }
1338 if (sd->state != sd_transfer_state) {
1339 return sd_invalid_state_for_cmd(sd, req);
1340 }
1341
1342 sd_function_switch(sd, req.arg);
1343 return sd_cmd_to_sendingdata(sd, req, 0, NULL, 64);
1344 }
1345
1346 /* CMD7 */
1347 static sd_rsp_type_t sd_cmd_DE_SELECT_CARD(SDState *sd, SDRequest req)
1348 {
1349 bool same_rca = sd_req_rca_same(sd, req);
1350
1351 switch (sd->state) {
1352 case sd_standby_state:
1353 if (!same_rca) {
1354 return sd_r0;
1355 }
1356 sd->state = sd_transfer_state;
1357 return sd_r1b;
1358
1359 case sd_transfer_state:
1360 case sd_sendingdata_state:
1361 if (same_rca) {
1362 break;
1363 }
1364 sd->state = sd_standby_state;
1365 return sd_r1b;
1366
1367 case sd_disconnect_state:
1368 if (!same_rca) {
1369 return sd_r0;
1370 }
1371 sd->state = sd_programming_state;
1372 return sd_r1b;
1373
1374 case sd_programming_state:
1375 if (same_rca) {
1376 break;
1377 }
1378 sd->state = sd_disconnect_state;
1379 return sd_r1b;
1380
1381 default:
1382 break;
1383 }
1384 return sd_invalid_state_for_cmd(sd, req);
1385 }
1386
1387 /* CMD8 */
1388 static sd_rsp_type_t sd_cmd_SEND_IF_COND(SDState *sd, SDRequest req)
1389 {
1390 if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
1391 return sd_cmd_illegal(sd, req);
1392 }
1393 if (sd->state != sd_idle_state) {
1394 return sd_invalid_state_for_cmd(sd, req);
1395 }
1396 sd->vhs = 0;
1397
1398 /* No response if not exactly one VHS bit is set. */
1399 if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
1400 return sd_is_spi(sd) ? sd_r7 : sd_r0;
1401 }
1402
1403 /* Accept. */
1404 sd->vhs = req.arg;
1405 return sd_r7;
1406 }
1407
1408 /* CMD9 */
1409 static sd_rsp_type_t spi_cmd_SEND_CSD(SDState *sd, SDRequest req)
1410 {
1411 if (sd->state != sd_standby_state) {
1412 return sd_invalid_state_for_cmd(sd, req);
1413 }
1414 return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1415 sd->csd, 16);
1416 }
1417
1418 static sd_rsp_type_t sd_cmd_SEND_CSD(SDState *sd, SDRequest req)
1419 {
1420 if (sd->state != sd_standby_state) {
1421 return sd_invalid_state_for_cmd(sd, req);
1422 }
1423
1424 return sd_req_rca_same(sd, req) ? sd_r2_s : sd_r0;
1425 }
1426
1427 /* CMD10 */
1428 static sd_rsp_type_t spi_cmd_SEND_CID(SDState *sd, SDRequest req)
1429 {
1430 if (sd->state != sd_standby_state) {
1431 return sd_invalid_state_for_cmd(sd, req);
1432 }
1433 return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1434 sd->cid, 16);
1435 }
1436
1437 static sd_rsp_type_t sd_cmd_SEND_CID(SDState *sd, SDRequest req)
1438 {
1439 if (sd->state != sd_standby_state) {
1440 return sd_invalid_state_for_cmd(sd, req);
1441 }
1442
1443 return sd_req_rca_same(sd, req) ? sd_r2_i : sd_r0;
1444 }
1445
1446 /* CMD12 */
1447 static sd_rsp_type_t sd_cmd_STOP_TRANSMISSION(SDState *sd, SDRequest req)
1448 {
1449 switch (sd->state) {
1450 case sd_sendingdata_state:
1451 sd->state = sd_transfer_state;
1452 return sd_r1b;
1453 case sd_receivingdata_state:
1454 sd->state = sd_programming_state;
1455 /* Bzzzzzzztt .... Operation complete. */
1456 sd->state = sd_transfer_state;
1457 return sd_r1;
1458 default:
1459 return sd_invalid_state_for_cmd(sd, req);
1460 }
1461 }
1462
1463 /* CMD13 */
1464 static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
1465 {
1466 if (sd->mode != sd_data_transfer_mode) {
1467 return sd_invalid_mode_for_cmd(sd, req);
1468 }
1469
1470 switch (sd->state) {
1471 case sd_standby_state:
1472 case sd_transfer_state:
1473 case sd_sendingdata_state:
1474 case sd_receivingdata_state:
1475 case sd_programming_state:
1476 case sd_disconnect_state:
1477 break;
1478 default:
1479 return sd_invalid_state_for_cmd(sd, req);
1480 }
1481
1482 if (sd_is_spi(sd)) {
1483 return sd_r2_s;
1484 }
1485
1486 return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;
1487 }
1488
1489 /* CMD15 */
1490 static sd_rsp_type_t sd_cmd_GO_INACTIVE_STATE(SDState *sd, SDRequest req)
1491 {
1492 if (sd->mode != sd_data_transfer_mode) {
1493 return sd_invalid_mode_for_cmd(sd, req);
1494 }
1495 switch (sd->state) {
1496 case sd_standby_state:
1497 case sd_transfer_state:
1498 case sd_sendingdata_state:
1499 case sd_receivingdata_state:
1500 case sd_programming_state:
1501 case sd_disconnect_state:
1502 break;
1503 default:
1504 return sd_invalid_state_for_cmd(sd, req);
1505 }
1506 if (sd_req_rca_same(sd, req)) {
1507 sd->state = sd_inactive_state;
1508 }
1509
1510 return sd_r0;
1511 }
1512
1513 /* CMD16 */
1514 static sd_rsp_type_t sd_cmd_SET_BLOCKLEN(SDState *sd, SDRequest req)
1515 {
1516 if (sd->state != sd_transfer_state) {
1517 return sd_invalid_state_for_cmd(sd, req);
1518 }
1519 if (req.arg > (1 << HWBLOCK_SHIFT)) {
1520 sd->card_status |= BLOCK_LEN_ERROR;
1521 } else {
1522 trace_sdcard_set_blocklen(req.arg);
1523 sd->blk_len = req.arg;
1524 }
1525
1526 return sd_r1;
1527 }
1528
1529 /* CMD17 */
1530 static sd_rsp_type_t sd_cmd_READ_SINGLE_BLOCK(SDState *sd, SDRequest req)
1531 {
1532 uint64_t addr;
1533
1534 if (sd->state != sd_transfer_state) {
1535 return sd_invalid_state_for_cmd(sd, req);
1536 }
1537
1538 addr = sd_req_get_address(sd, req);
1539 if (!address_in_range(sd, "READ_SINGLE_BLOCK", addr, sd->blk_len)) {
1540 return sd_r1;
1541 }
1542
1543 sd_blk_read(sd, addr, sd->blk_len);
1544 return sd_cmd_to_sendingdata(sd, req, addr, NULL, sd->blk_len);
1545 }
1546
1547 /* CMD19 */
1548 static sd_rsp_type_t sd_cmd_SEND_TUNING_BLOCK(SDState *sd, SDRequest req)
1549 {
1550 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1551 return sd_cmd_illegal(sd, req);
1552 }
1553
1554 return sd_cmd_to_sendingdata(sd, req, 0,
1555 sd_tuning_block_pattern4,
1556 sizeof(sd_tuning_block_pattern4));
1557 }
1558
1559 /* CMD23 */
1560 static sd_rsp_type_t sd_cmd_SET_BLOCK_COUNT(SDState *sd, SDRequest req)
1561 {
1562 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1563 return sd_cmd_illegal(sd, req);
1564 }
1565
1566 if (sd->state != sd_transfer_state) {
1567 return sd_invalid_state_for_cmd(sd, req);
1568 }
1569
1570 sd->multi_blk_cnt = req.arg;
1571 if (sd_is_emmc(sd)) {
1572 sd->multi_blk_cnt &= 0xffff;
1573 }
1574 trace_sdcard_set_block_count(sd->multi_blk_cnt);
1575
1576 return sd_r1;
1577 }
1578
1579 /* CMD24 */
1580 static sd_rsp_type_t sd_cmd_WRITE_SINGLE_BLOCK(SDState *sd, SDRequest req)
1581 {
1582 uint64_t addr;
1583
1584 if (sd->state != sd_transfer_state) {
1585 return sd_invalid_state_for_cmd(sd, req);
1586 }
1587
1588 addr = sd_req_get_address(sd, req);
1589 if (!address_in_range(sd, "WRITE_SINGLE_BLOCK", addr, sd->blk_len)) {
1590 return sd_r1;
1591 }
1592
1593 if (sd->size <= SDSC_MAX_CAPACITY) {
1594 if (sd_wp_addr(sd, addr)) {
1595 sd->card_status |= WP_VIOLATION;
1596 }
1597 }
1598 if (sd->csd[14] & 0x30) {
1599 sd->card_status |= WP_VIOLATION;
1600 }
1601
1602 sd->blk_written = 0;
1603 return sd_cmd_to_receivingdata(sd, req, addr, sd->blk_len);
1604 }
1605
1606 /* CMD26 */
1607 static sd_rsp_type_t emmc_cmd_PROGRAM_CID(SDState *sd, SDRequest req)
1608 {
1609 return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->cid));
1610 }
1611
1612 /* CMD27 */
1613 static sd_rsp_type_t sd_cmd_PROGRAM_CSD(SDState *sd, SDRequest req)
1614 {
1615 return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->csd));
1616 }
1617
1618 static sd_rsp_type_t sd_cmd_SET_CLR_WRITE_PROT(SDState *sd, SDRequest req,
1619 bool is_write)
1620 {
1621 uint64_t addr;
1622
1623 if (sd->size > SDSC_MAX_CAPACITY) {
1624 return sd_illegal;
1625 }
1626
1627 if (sd->state != sd_transfer_state) {
1628 return sd_invalid_state_for_cmd(sd, req);
1629 }
1630
1631 addr = sd_req_get_address(sd, req);
1632 if (!address_in_range(sd, is_write ? "SET_WRITE_PROT" : "CLR_WRITE_PROT",
1633 addr, 1)) {
1634 return sd_r1b;
1635 }
1636
1637 sd->state = sd_programming_state;
1638 if (is_write) {
1639 set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1640 } else {
1641 clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1642 }
1643 /* Bzzzzzzztt .... Operation complete. */
1644 sd->state = sd_transfer_state;
1645 return sd_r1;
1646 }
1647
1648 /* CMD28 */
1649 static sd_rsp_type_t sd_cmd_SET_WRITE_PROT(SDState *sd, SDRequest req)
1650 {
1651 return sd_cmd_SET_CLR_WRITE_PROT(sd, req, true);
1652 }
1653
1654 /* CMD29 */
1655 static sd_rsp_type_t sd_cmd_CLR_WRITE_PROT(SDState *sd, SDRequest req)
1656 {
1657 return sd_cmd_SET_CLR_WRITE_PROT(sd, req, false);
1658 }
1659
1660 /* CMD30 */
1661 static sd_rsp_type_t sd_cmd_SEND_WRITE_PROT(SDState *sd, SDRequest req)
1662 {
1663 uint64_t addr;
1664 uint32_t data;
1665
1666 if (sd->size > SDSC_MAX_CAPACITY) {
1667 return sd_illegal;
1668 }
1669
1670 if (sd->state != sd_transfer_state) {
1671 return sd_invalid_state_for_cmd(sd, req);
1672 }
1673
1674 addr = sd_req_get_address(sd, req);
1675 if (!address_in_range(sd, "SEND_WRITE_PROT", addr, sd->blk_len)) {
1676 return sd_r1;
1677 }
1678
1679 data = sd_wpbits(sd, req.arg);
1680 return sd_cmd_to_sendingdata(sd, req, addr, &data, sizeof(data));
1681 }
1682
1683 /* CMD32 */
1684 static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_START(SDState *sd, SDRequest req)
1685 {
1686 if (sd->state != sd_transfer_state) {
1687 return sd_invalid_state_for_cmd(sd, req);
1688 }
1689 sd->erase_start = req.arg;
1690 return sd_r1;
1691 }
1692
1693 /* CMD33 */
1694 static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_END(SDState *sd, SDRequest req)
1695 {
1696 if (sd->state != sd_transfer_state) {
1697 return sd_invalid_state_for_cmd(sd, req);
1698 }
1699 sd->erase_end = req.arg;
1700 return sd_r1;
1701 }
1702
1703 /* CMD38 */
1704 static sd_rsp_type_t sd_cmd_ERASE(SDState *sd, SDRequest req)
1705 {
1706 if (sd->state != sd_transfer_state) {
1707 return sd_invalid_state_for_cmd(sd, req);
1708 }
1709 if (sd->csd[14] & 0x30) {
1710 sd->card_status |= WP_VIOLATION;
1711 return sd_r1b;
1712 }
1713
1714 sd->state = sd_programming_state;
1715 sd_erase(sd);
1716 /* Bzzzzzzztt .... Operation complete. */
1717 sd->state = sd_transfer_state;
1718 return sd_r1b;
1719 }
1720
1721 /* CMD42 */
1722 static sd_rsp_type_t sd_cmd_LOCK_UNLOCK(SDState *sd, SDRequest req)
1723 {
1724 return sd_cmd_to_receivingdata(sd, req, 0, 0);
1725 }
1726
1727 /* CMD55 */
1728 static sd_rsp_type_t sd_cmd_APP_CMD(SDState *sd, SDRequest req)
1729 {
1730 switch (sd->state) {
1731 case sd_ready_state:
1732 case sd_identification_state:
1733 case sd_inactive_state:
1734 case sd_sleep_state:
1735 return sd_invalid_state_for_cmd(sd, req);
1736 case sd_idle_state:
1737 if (!sd_is_spi(sd) && sd_req_get_rca(sd, req) != 0x0000) {
1738 qemu_log_mask(LOG_GUEST_ERROR,
1739 "SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
1740 }
1741 /* fall-through */
1742 default:
1743 break;
1744 }
1745 if (!sd_is_spi(sd) && !sd_req_rca_same(sd, req)) {
1746 return sd_r0;
1747 }
1748 sd->expecting_acmd = true;
1749 sd->card_status |= APP_CMD;
1750
1751 return sd_r1;
1752 }
1753
1754 /* CMD56 */
1755 static sd_rsp_type_t sd_cmd_GEN_CMD(SDState *sd, SDRequest req)
1756 {
1757 if (sd->state != sd_transfer_state) {
1758 return sd_invalid_state_for_cmd(sd, req);
1759 }
1760
1761 /* Vendor specific command: our model is RAZ/WI */
1762 if (req.arg & 1) {
1763 memset(sd->data, 0, sizeof(sd->data));
1764 return sd_cmd_to_sendingdata(sd, req, 0, NULL, 0);
1765 } else {
1766 return sd_cmd_to_receivingdata(sd, req, 0, 0);
1767 }
1768 }
1769
1770 /* CMD58 */
1771 static sd_rsp_type_t spi_cmd_READ_OCR(SDState *sd, SDRequest req)
1772 {
1773 return sd_r3;
1774 }
1775
1776 /* CMD59 */
1777 static sd_rsp_type_t spi_cmd_CRC_ON_OFF(SDState *sd, SDRequest req)
1778 {
1779 return sd_r1;
1780 }
1781
1782 /* ACMD6 */
1783 static sd_rsp_type_t sd_acmd_SET_BUS_WIDTH(SDState *sd, SDRequest req)
1784 {
1785 if (sd->state != sd_transfer_state) {
1786 return sd_invalid_state_for_cmd(sd, req);
1787 }
1788
1789 sd->sd_status[0] &= 0x3f;
1790 sd->sd_status[0] |= (req.arg & 0x03) << 6;
1791 return sd_r1;
1792 }
1793
1794 /* ACMD13 */
1795 static sd_rsp_type_t sd_acmd_SD_STATUS(SDState *sd, SDRequest req)
1796 {
1797 return sd_cmd_to_sendingdata(sd, req, 0,
1798 sd->sd_status, sizeof(sd->sd_status));
1799 }
1800
1801 /* ACMD22 */
1802 static sd_rsp_type_t sd_acmd_SEND_NUM_WR_BLOCKS(SDState *sd, SDRequest req)
1803 {
1804 return sd_cmd_to_sendingdata(sd, req, 0,
1805 &sd->blk_written, sizeof(sd->blk_written));
1806 }
1807
1808 /* ACMD23 */
1809 static sd_rsp_type_t sd_acmd_SET_WR_BLK_ERASE_COUNT(SDState *sd, SDRequest req)
1810 {
1811 if (sd->state != sd_transfer_state) {
1812 return sd_invalid_state_for_cmd(sd, req);
1813 }
1814 return sd_r1;
1815 }
1816
1817 /* ACMD41 */
1818 static sd_rsp_type_t sd_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
1819 {
1820 if (sd->state != sd_idle_state) {
1821 return sd_invalid_state_for_cmd(sd, req);
1822 }
1823
1824 /*
1825 * If it's the first ACMD41 since reset, we need to decide
1826 * whether to power up. If this is not an enquiry ACMD41,
1827 * we immediately report power on and proceed below to the
1828 * ready state, but if it is, we set a timer to model a
1829 * delay for power up. This works around a bug in EDK2
1830 * UEFI, which sends an initial enquiry ACMD41, but
1831 * assumes that the card is in ready state as soon as it
1832 * sees the power up bit set.
1833 */
1834 if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
1835 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1836 timer_del(sd->ocr_power_timer);
1837 sd_ocr_powerup(sd);
1838 } else {
1839 trace_sdcard_inquiry_cmd41();
1840 if (!timer_pending(sd->ocr_power_timer)) {
1841 timer_mod_ns(sd->ocr_power_timer,
1842 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1843 + OCR_POWER_DELAY_NS));
1844 }
1845 }
1846 }
1847
1848 if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
1849 /*
1850 * We accept any voltage. 10000 V is nothing.
1851 *
1852 * Once we're powered up, we advance straight to ready state
1853 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1854 */
1855 sd->state = sd_ready_state;
1856 }
1857
1858 return sd_r3;
1859 }
1860
1861 /* ACMD42 */
1862 static sd_rsp_type_t sd_acmd_SET_CLR_CARD_DETECT(SDState *sd, SDRequest req)
1863 {
1864 if (sd->state != sd_transfer_state) {
1865 return sd_invalid_state_for_cmd(sd, req);
1866 }
1867
1868 /* Bringing in the 50KOhm pull-up resistor... Done. */
1869 return sd_r1;
1870 }
1871
1872 /* ACMD51 */
1873 static sd_rsp_type_t sd_acmd_SEND_SCR(SDState *sd, SDRequest req)
1874 {
1875 return sd_cmd_to_sendingdata(sd, req, 0, sd->scr, sizeof(sd->scr));
1876 }
1877
1878 static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
1879 {
1880 uint64_t addr;
1881
1882 sd->last_cmd_name = sd_cmd_name(sd, req.cmd);
1883 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
1884 * However there is no ACMD55, so we want to trace this particular case.
1885 */
1886 if (req.cmd != 55 || sd->expecting_acmd) {
1887 trace_sdcard_normal_command(sd->proto->name,
1888 sd->last_cmd_name, req.cmd,
1889 req.arg, sd_state_name(sd->state));
1890 }
1891
1892 /* Not interpreting this as an app command */
1893 sd->card_status &= ~APP_CMD;
1894
1895 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
1896 * if not, its effects are cancelled */
1897 if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
1898 sd->multi_blk_cnt = 0;
1899 }
1900
1901 if (sd->proto->cmd[req.cmd].class == 6 && FIELD_EX32(sd->ocr, OCR,
1902 CARD_CAPACITY)) {
1903 /* Only Standard Capacity cards support class 6 commands */
1904 return sd_illegal;
1905 }
1906
1907 if (sd->proto->cmd[req.cmd].handler) {
1908 return sd->proto->cmd[req.cmd].handler(sd, req);
1909 }
1910
1911 switch (req.cmd) {
1912 /* Block read commands (Class 2) */
1913 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1914 addr = sd_req_get_address(sd, req);
1915 switch (sd->state) {
1916 case sd_transfer_state:
1917
1918 if (!address_in_range(sd, "READ_BLOCK", addr, sd->blk_len)) {
1919 return sd_r1;
1920 }
1921
1922 sd->state = sd_sendingdata_state;
1923 sd->data_start = addr;
1924 sd->data_offset = 0;
1925 return sd_r1;
1926
1927 default:
1928 break;
1929 }
1930 break;
1931
1932 /* Block write commands (Class 4) */
1933 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1934 addr = sd_req_get_address(sd, req);
1935 switch (sd->state) {
1936 case sd_transfer_state:
1937
1938 if (!address_in_range(sd, "WRITE_BLOCK", addr, sd->blk_len)) {
1939 return sd_r1;
1940 }
1941
1942 sd->state = sd_receivingdata_state;
1943 sd->data_start = addr;
1944 sd->data_offset = 0;
1945 sd->blk_written = 0;
1946
1947 if (sd->size <= SDSC_MAX_CAPACITY) {
1948 if (sd_wp_addr(sd, sd->data_start)) {
1949 sd->card_status |= WP_VIOLATION;
1950 }
1951 }
1952 if (sd->csd[14] & 0x30) {
1953 sd->card_status |= WP_VIOLATION;
1954 }
1955 return sd_r1;
1956
1957 default:
1958 break;
1959 }
1960 break;
1961
1962 default:
1963 qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1964 return sd_illegal;
1965 }
1966
1967 return sd_invalid_state_for_cmd(sd, req);
1968 }
1969
1970 static sd_rsp_type_t sd_app_command(SDState *sd,
1971 SDRequest req)
1972 {
1973 sd->last_cmd_name = sd_acmd_name(sd, req.cmd);
1974 trace_sdcard_app_command(sd->proto->name, sd->last_cmd_name,
1975 req.cmd, req.arg, sd_state_name(sd->state));
1976 sd->card_status |= APP_CMD;
1977
1978 if (sd->proto->acmd[req.cmd].handler) {
1979 return sd->proto->acmd[req.cmd].handler(sd, req);
1980 }
1981
1982 switch (req.cmd) {
1983 case 18: /* Reserved for SD security applications */
1984 case 25:
1985 case 26:
1986 case 38:
1987 case 43 ... 49:
1988 /* Refer to the "SD Specifications Part3 Security Specification" for
1989 * information about the SD Security Features.
1990 */
1991 qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
1992 req.cmd);
1993 return sd_illegal;
1994
1995 default:
1996 /* Fall back to standard commands. */
1997 return sd_normal_command(sd, req);
1998 }
1999
2000 qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
2001 return sd_illegal;
2002 }
2003
2004 static bool cmd_valid_while_locked(SDState *sd, unsigned cmd)
2005 {
2006 unsigned cmd_class;
2007
2008 /* Valid commands in locked state:
2009 * basic class (0)
2010 * lock card class (7)
2011 * CMD16
2012 * implicitly, the ACMD prefix CMD55
2013 * ACMD41 and ACMD42
2014 * Anything else provokes an "illegal command" response.
2015 */
2016 if (sd->expecting_acmd) {
2017 return cmd == 41 || cmd == 42;
2018 }
2019 if (cmd == 16 || cmd == 55) {
2020 return true;
2021 }
2022 if (!sd->proto->cmd[cmd].handler) {
2023 return false;
2024 }
2025 cmd_class = sd->proto->cmd[cmd].class;
2026
2027 return cmd_class == 0 || cmd_class == 7;
2028 }
2029
2030 int sd_do_command(SDState *sd, SDRequest *req,
2031 uint8_t *response) {
2032 int last_state;
2033 sd_rsp_type_t rtype;
2034 int rsplen;
2035
2036 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
2037 return 0;
2038 }
2039
2040 if (sd->state == sd_inactive_state) {
2041 rtype = sd_illegal;
2042 goto send_response;
2043 }
2044
2045 if (sd_req_crc_validate(req)) {
2046 sd->card_status |= COM_CRC_ERROR;
2047 rtype = sd_illegal;
2048 goto send_response;
2049 }
2050
2051 if (req->cmd >= SDMMC_CMD_MAX) {
2052 qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
2053 req->cmd);
2054 req->cmd &= 0x3f;
2055 }
2056
2057 if (sd->state == sd_sleep_state && req->cmd) {
2058 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is sleeping\n");
2059 rtype = sd_r0;
2060 goto send_response;
2061 }
2062
2063 if (sd->card_status & CARD_IS_LOCKED) {
2064 if (!cmd_valid_while_locked(sd, req->cmd)) {
2065 sd->card_status |= ILLEGAL_COMMAND;
2066 sd->expecting_acmd = false;
2067 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
2068 rtype = sd_illegal;
2069 goto send_response;
2070 }
2071 }
2072
2073 last_state = sd->state;
2074 sd_set_mode(sd);
2075
2076 if (sd->expecting_acmd) {
2077 sd->expecting_acmd = false;
2078 rtype = sd_app_command(sd, *req);
2079 } else {
2080 rtype = sd_normal_command(sd, *req);
2081 }
2082
2083 if (rtype == sd_illegal) {
2084 sd->card_status |= ILLEGAL_COMMAND;
2085 } else {
2086 /* Valid command, we can update the 'state before command' bits.
2087 * (Do this now so they appear in r1 responses.)
2088 */
2089 sd->card_status = FIELD_DP32(sd->card_status, CSR,
2090 CURRENT_STATE, last_state);
2091 }
2092
2093 send_response:
2094 switch (rtype) {
2095 case sd_r1:
2096 case sd_r1b:
2097 sd_response_r1_make(sd, response);
2098 rsplen = 4;
2099 break;
2100
2101 case sd_r2_i:
2102 memcpy(response, sd->cid, sizeof(sd->cid));
2103 rsplen = 16;
2104 break;
2105
2106 case sd_r2_s:
2107 memcpy(response, sd->csd, sizeof(sd->csd));
2108 rsplen = 16;
2109 break;
2110
2111 case sd_r3:
2112 sd_response_r3_make(sd, response);
2113 rsplen = 4;
2114 break;
2115
2116 case sd_r6:
2117 sd_response_r6_make(sd, response);
2118 rsplen = 4;
2119 break;
2120
2121 case sd_r7:
2122 sd_response_r7_make(sd, response);
2123 rsplen = 4;
2124 break;
2125
2126 case sd_r0:
2127 /*
2128 * Invalid state transition, reset implementation
2129 * fields to avoid OOB abuse.
2130 */
2131 sd->data_start = 0;
2132 sd->data_offset = 0;
2133 /* fall-through */
2134 case sd_illegal:
2135 rsplen = 0;
2136 break;
2137 default:
2138 g_assert_not_reached();
2139 }
2140 trace_sdcard_response(sd_response_name(rtype), rsplen);
2141
2142 if (rtype != sd_illegal) {
2143 /* Clear the "clear on valid command" status bits now we've
2144 * sent any response
2145 */
2146 sd->card_status &= ~CARD_STATUS_B;
2147 }
2148
2149 #ifdef DEBUG_SD
2150 qemu_hexdump(stderr, "Response", response, rsplen);
2151 #endif
2152
2153 sd->current_cmd = rtype == sd_illegal ? 0 : req->cmd;
2154
2155 return rsplen;
2156 }
2157
2158 /* Return true if buffer is consumed. Configured by sd_cmd_to_receivingdata() */
2159 static bool sd_generic_write_byte(SDState *sd, uint8_t value)
2160 {
2161 sd->data[sd->data_offset] = value;
2162
2163 if (++sd->data_offset >= sd->data_size) {
2164 sd->state = sd_transfer_state;
2165 return true;
2166 }
2167 return false;
2168 }
2169
2170 /* Return true when buffer is consumed. Configured by sd_cmd_to_sendingdata() */
2171 static bool sd_generic_read_byte(SDState *sd, uint8_t *value)
2172 {
2173 *value = sd->data[sd->data_offset];
2174
2175 if (++sd->data_offset >= sd->data_size) {
2176 sd->state = sd_transfer_state;
2177 return true;
2178 }
2179
2180 return false;
2181 }
2182
2183 void sd_write_byte(SDState *sd, uint8_t value)
2184 {
2185 int i;
2186
2187 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
2188 return;
2189
2190 if (sd->state != sd_receivingdata_state) {
2191 qemu_log_mask(LOG_GUEST_ERROR,
2192 "%s: not in Receiving-Data state\n", __func__);
2193 return;
2194 }
2195
2196 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
2197 return;
2198
2199 trace_sdcard_write_data(sd->proto->name,
2200 sd->last_cmd_name,
2201 sd->current_cmd, sd->data_offset, value);
2202 switch (sd->current_cmd) {
2203 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
2204 if (sd_generic_write_byte(sd, value)) {
2205 /* TODO: Check CRC before committing */
2206 sd->state = sd_programming_state;
2207 sd_blk_write(sd, sd->data_start, sd->data_offset);
2208 sd->blk_written ++;
2209 sd->csd[14] |= 0x40;
2210 /* Bzzzzzzztt .... Operation complete. */
2211 sd->state = sd_transfer_state;
2212 }
2213 break;
2214
2215 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2216 if (sd->data_offset == 0) {
2217 /* Start of the block - let's check the address is valid */
2218 if (!address_in_range(sd, "WRITE_MULTIPLE_BLOCK",
2219 sd->data_start, sd->blk_len)) {
2220 break;
2221 }
2222 if (sd->size <= SDSC_MAX_CAPACITY) {
2223 if (sd_wp_addr(sd, sd->data_start)) {
2224 sd->card_status |= WP_VIOLATION;
2225 break;
2226 }
2227 }
2228 }
2229 sd->data[sd->data_offset++] = value;
2230 if (sd->data_offset >= sd->blk_len) {
2231 /* TODO: Check CRC before committing */
2232 sd->state = sd_programming_state;
2233 sd_blk_write(sd, sd->data_start, sd->data_offset);
2234 sd->blk_written++;
2235 sd->data_start += sd->blk_len;
2236 sd->data_offset = 0;
2237 sd->csd[14] |= 0x40;
2238
2239 /* Bzzzzzzztt .... Operation complete. */
2240 if (sd->multi_blk_cnt != 0) {
2241 if (--sd->multi_blk_cnt == 0) {
2242 /* Stop! */
2243 sd->state = sd_transfer_state;
2244 break;
2245 }
2246 }
2247
2248 sd->state = sd_receivingdata_state;
2249 }
2250 break;
2251
2252 case 26: /* CMD26: PROGRAM_CID */
2253 if (sd_generic_write_byte(sd, value)) {
2254 /* TODO: Check CRC before committing */
2255 sd->state = sd_programming_state;
2256 for (i = 0; i < sizeof(sd->cid); i ++)
2257 if ((sd->cid[i] | 0x00) != sd->data[i])
2258 sd->card_status |= CID_CSD_OVERWRITE;
2259
2260 if (!(sd->card_status & CID_CSD_OVERWRITE))
2261 for (i = 0; i < sizeof(sd->cid); i ++) {
2262 sd->cid[i] |= 0x00;
2263 sd->cid[i] &= sd->data[i];
2264 }
2265 /* Bzzzzzzztt .... Operation complete. */
2266 sd->state = sd_transfer_state;
2267 }
2268 break;
2269
2270 case 27: /* CMD27: PROGRAM_CSD */
2271 if (sd_generic_write_byte(sd, value)) {
2272 /* TODO: Check CRC before committing */
2273 sd->state = sd_programming_state;
2274 for (i = 0; i < sizeof(sd->csd); i ++)
2275 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
2276 (sd->data[i] | sd_csd_rw_mask[i]))
2277 sd->card_status |= CID_CSD_OVERWRITE;
2278
2279 /* Copy flag (OTP) & Permanent write protect */
2280 if (sd->csd[14] & ~sd->data[14] & 0x60)
2281 sd->card_status |= CID_CSD_OVERWRITE;
2282
2283 if (!(sd->card_status & CID_CSD_OVERWRITE))
2284 for (i = 0; i < sizeof(sd->csd); i ++) {
2285 sd->csd[i] |= sd_csd_rw_mask[i];
2286 sd->csd[i] &= sd->data[i];
2287 }
2288 /* Bzzzzzzztt .... Operation complete. */
2289 sd->state = sd_transfer_state;
2290 }
2291 break;
2292
2293 case 42: /* CMD42: LOCK_UNLOCK */
2294 if (sd_generic_write_byte(sd, value)) {
2295 /* TODO: Check CRC before committing */
2296 sd->state = sd_programming_state;
2297 sd_lock_command(sd);
2298 /* Bzzzzzzztt .... Operation complete. */
2299 sd->state = sd_transfer_state;
2300 }
2301 break;
2302
2303 case 56: /* CMD56: GEN_CMD */
2304 sd_generic_write_byte(sd, value);
2305 break;
2306
2307 default:
2308 g_assert_not_reached();
2309 }
2310 }
2311
2312 uint8_t sd_read_byte(SDState *sd)
2313 {
2314 /* TODO: Append CRCs */
2315 uint8_t ret;
2316 uint32_t io_len;
2317
2318 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
2319 return 0x00;
2320
2321 if (sd->state != sd_sendingdata_state) {
2322 qemu_log_mask(LOG_GUEST_ERROR,
2323 "%s: not in Sending-Data state\n", __func__);
2324 return 0x00;
2325 }
2326
2327 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
2328 return 0x00;
2329
2330 io_len = sd_blk_len(sd);
2331
2332 trace_sdcard_read_data(sd->proto->name,
2333 sd->last_cmd_name, sd->current_cmd,
2334 sd->data_offset, sd->data_size, io_len);
2335 switch (sd->current_cmd) {
2336 case 6: /* CMD6: SWITCH_FUNCTION */
2337 case 9: /* CMD9: SEND_CSD */
2338 case 10: /* CMD10: SEND_CID */
2339 case 13: /* ACMD13: SD_STATUS */
2340 case 17: /* CMD17: READ_SINGLE_BLOCK */
2341 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2342 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2343 case 30: /* CMD30: SEND_WRITE_PROT */
2344 case 51: /* ACMD51: SEND_SCR */
2345 case 56: /* CMD56: GEN_CMD */
2346 sd_generic_read_byte(sd, &ret);
2347 break;
2348
2349 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2350 if (sd->data_offset == 0) {
2351 if (!address_in_range(sd, "READ_MULTIPLE_BLOCK",
2352 sd->data_start, io_len)) {
2353 return 0x00;
2354 }
2355 sd_blk_read(sd, sd->data_start, io_len);
2356 }
2357 ret = sd->data[sd->data_offset ++];
2358
2359 if (sd->data_offset >= io_len) {
2360 sd->data_start += io_len;
2361 sd->data_offset = 0;
2362
2363 if (sd->multi_blk_cnt != 0) {
2364 if (--sd->multi_blk_cnt == 0) {
2365 /* Stop! */
2366 sd->state = sd_transfer_state;
2367 break;
2368 }
2369 }
2370 }
2371 break;
2372
2373 default:
2374 g_assert_not_reached();
2375 }
2376
2377 return ret;
2378 }
2379
2380 static bool sd_receive_ready(SDState *sd)
2381 {
2382 return sd->state == sd_receivingdata_state;
2383 }
2384
2385 static bool sd_data_ready(SDState *sd)
2386 {
2387 return sd->state == sd_sendingdata_state;
2388 }
2389
2390 void sd_enable(SDState *sd, bool enable)
2391 {
2392 sd->enable = enable;
2393 }
2394
2395 static const SDProto sd_proto_spi = {
2396 .name = "SPI",
2397 .cmd = {
2398 [0] = {0, sd_spi, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2399 [1] = {0, sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
2400 [5] = {9, sd_spi, "IO_SEND_OP_COND", sd_cmd_optional},
2401 [6] = {10, sd_spi, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2402 [8] = {0, sd_spi, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2403 [9] = {0, sd_spi, "SEND_CSD", spi_cmd_SEND_CSD},
2404 [10] = {0, sd_spi, "SEND_CID", spi_cmd_SEND_CID},
2405 [12] = {0, sd_spi, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2406 [13] = {0, sd_spi, "SEND_STATUS", sd_cmd_SEND_STATUS},
2407 [16] = {2, sd_spi, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2408 [17] = {2, sd_spi, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2409 [24] = {4, sd_spi, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2410 [27] = {4, sd_spi, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2411 [28] = {6, sd_spi, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2412 [29] = {6, sd_spi, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2413 [30] = {6, sd_spi, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2414 [32] = {5, sd_spi, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2415 [33] = {5, sd_spi, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2416 [34] = {10, sd_spi, "READ_SEC_CMD", sd_cmd_optional},
2417 [35] = {10, sd_spi, "WRITE_SEC_CMD", sd_cmd_optional},
2418 [36] = {10, sd_spi, "SEND_PSI", sd_cmd_optional},
2419 [37] = {10, sd_spi, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2420 [38] = {5, sd_spi, "ERASE", sd_cmd_ERASE},
2421 [42] = {7, sd_spi, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2422 [50] = {10, sd_spi, "DIRECT_SECURE_READ", sd_cmd_optional},
2423 [52] = {9, sd_spi, "IO_RW_DIRECT", sd_cmd_optional},
2424 [53] = {9, sd_spi, "IO_RW_EXTENDED", sd_cmd_optional},
2425 [55] = {8, sd_spi, "APP_CMD", sd_cmd_APP_CMD},
2426 [56] = {8, sd_spi, "GEN_CMD", sd_cmd_GEN_CMD},
2427 [57] = {10, sd_spi, "DIRECT_SECURE_WRITE", sd_cmd_optional},
2428 [58] = {0, sd_spi, "READ_OCR", spi_cmd_READ_OCR},
2429 [59] = {0, sd_spi, "CRC_ON_OFF", spi_cmd_CRC_ON_OFF},
2430 },
2431 .acmd = {
2432 [13] = {8, sd_spi, "SD_STATUS", sd_acmd_SD_STATUS},
2433 [22] = {8, sd_spi, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
2434 [23] = {8, sd_spi, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
2435 [41] = {8, sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
2436 [42] = {8, sd_spi, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
2437 [51] = {8, sd_spi, "SEND_SCR", sd_acmd_SEND_SCR},
2438 },
2439 };
2440
2441 static const SDProto sd_proto_sd = {
2442 .name = "SD",
2443 .cmd = {
2444 [0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2445 [2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
2446 [3] = {0, sd_bcr, "SEND_RELATIVE_ADDR", sd_cmd_SEND_RELATIVE_ADDR},
2447 [4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
2448 [5] = {9, sd_bc, "IO_SEND_OP_COND", sd_cmd_optional},
2449 [6] = {10, sd_adtc, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2450 [7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
2451 [8] = {0, sd_bcr, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2452 [9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
2453 [10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
2454 [11] = {0, sd_ac, "VOLTAGE_SWITCH", sd_cmd_optional},
2455 [12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2456 [13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
2457 [15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
2458 [16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2459 [17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2460 [19] = {2, sd_adtc, "SEND_TUNING_BLOCK", sd_cmd_SEND_TUNING_BLOCK},
2461 [20] = {2, sd_ac, "SPEED_CLASS_CONTROL", sd_cmd_optional},
2462 [23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
2463 [24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2464 [27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2465 [28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2466 [29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2467 [30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2468 [32] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2469 [33] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2470 [34] = {10, sd_adtc, "READ_SEC_CMD", sd_cmd_optional},
2471 [35] = {10, sd_adtc, "WRITE_SEC_CMD", sd_cmd_optional},
2472 [36] = {10, sd_adtc, "SEND_PSI", sd_cmd_optional},
2473 [37] = {10, sd_ac, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2474 [38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
2475 [42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2476 [43] = {1, sd_ac, "Q_MANAGEMENT", sd_cmd_optional},
2477 [44] = {1, sd_ac, "Q_TASK_INFO_A", sd_cmd_optional},
2478 [45] = {1, sd_ac, "Q_TASK_INFO_B", sd_cmd_optional},
2479 [46] = {1, sd_adtc, "Q_RD_TASK", sd_cmd_optional},
2480 [47] = {1, sd_adtc, "Q_WR_TASK", sd_cmd_optional},
2481 [48] = {1, sd_adtc, "READ_EXTR_SINGLE", sd_cmd_optional},
2482 [49] = {1, sd_adtc, "WRITE_EXTR_SINGLE", sd_cmd_optional},
2483 [50] = {10, sd_adtc, "DIRECT_SECURE_READ", sd_cmd_optional},
2484 [52] = {9, sd_bc, "IO_RW_DIRECT", sd_cmd_optional},
2485 [53] = {9, sd_bc, "IO_RW_EXTENDED", sd_cmd_optional},
2486 [55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
2487 [56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
2488 [57] = {10, sd_adtc, "DIRECT_SECURE_WRITE", sd_cmd_optional},
2489 [58] = {11, sd_adtc, "READ_EXTR_MULTI", sd_cmd_optional},
2490 [59] = {11, sd_adtc, "WRITE_EXTR_MULTI", sd_cmd_optional},
2491 },
2492 .acmd = {
2493 [6] = {8, sd_ac, "SET_BUS_WIDTH", sd_acmd_SET_BUS_WIDTH},
2494 [13] = {8, sd_adtc, "SD_STATUS", sd_acmd_SD_STATUS},
2495 [22] = {8, sd_adtc, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
2496 [23] = {8, sd_ac, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
2497 [41] = {8, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2498 [42] = {8, sd_ac, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
2499 [51] = {8, sd_adtc, "SEND_SCR", sd_acmd_SEND_SCR},
2500 },
2501 };
2502
2503 static const SDProto sd_proto_emmc = {
2504 /* Only v4.3 is supported */
2505 .name = "eMMC",
2506 .cmd = {
2507 [0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2508 [1] = {0, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2509 [2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
2510 [3] = {0, sd_ac, "SET_RELATIVE_ADDR", emmc_cmd_SET_RELATIVE_ADDR},
2511 [4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
2512 [5] = {0, sd_ac, "SLEEP/AWAKE", emmc_cmd_sleep_awake},
2513 [7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
2514 [9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
2515 [10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
2516 [11] = {1, sd_adtc, "READ_DAT_UNTIL_STOP", sd_cmd_unimplemented},
2517 [12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2518 [13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
2519 [14] = {0, sd_adtc, "BUSTEST_R", sd_cmd_unimplemented},
2520 [15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
2521 [16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2522 [17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2523 [19] = {0, sd_adtc, "BUSTEST_W", sd_cmd_unimplemented},
2524 [20] = {3, sd_adtc, "WRITE_DAT_UNTIL_STOP", sd_cmd_unimplemented},
2525 [23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
2526 [24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2527 [26] = {4, sd_adtc, "PROGRAM_CID", emmc_cmd_PROGRAM_CID},
2528 [27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2529 [28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2530 [29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2531 [30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2532 [31] = {6, sd_adtc, "SEND_WRITE_PROT_TYPE", sd_cmd_unimplemented},
2533 [35] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2534 [36] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2535 [38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
2536 [39] = {9, sd_ac, "FAST_IO", sd_cmd_unimplemented},
2537 [40] = {9, sd_bcr, "GO_IRQ_STATE", sd_cmd_unimplemented},
2538 [42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2539 [49] = {0, sd_adtc, "SET_TIME", sd_cmd_unimplemented},
2540 [55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
2541 [56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
2542 },
2543 };
2544
2545 static void sd_instance_init(Object *obj)
2546 {
2547 SDState *sd = SDMMC_COMMON(obj);
2548 SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
2549
2550 sd->proto = sc->proto;
2551 sd->last_cmd_name = "UNSET";
2552 sd->enable = true;
2553 sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
2554 }
2555
2556 static void sd_instance_finalize(Object *obj)
2557 {
2558 SDState *sd = SDMMC_COMMON(obj);
2559
2560 timer_free(sd->ocr_power_timer);
2561 }
2562
2563 static void sd_realize(DeviceState *dev, Error **errp)
2564 {
2565 SDState *sd = SDMMC_COMMON(dev);
2566 int ret;
2567
2568 switch (sd->spec_version) {
2569 case SD_PHY_SPECv1_10_VERS
2570 ... SD_PHY_SPECv3_01_VERS:
2571 break;
2572 default:
2573 error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
2574 return;
2575 }
2576
2577 if (sd->blk) {
2578 int64_t blk_size;
2579
2580 if (!blk_supports_write_perm(sd->blk)) {
2581 error_setg(errp, "Cannot use read-only drive as SD card");
2582 return;
2583 }
2584
2585 blk_size = blk_getlength(sd->blk);
2586 if (blk_size > 0 && !is_power_of_2(blk_size)) {
2587 int64_t blk_size_aligned = pow2ceil(blk_size);
2588 char *blk_size_str;
2589
2590 blk_size_str = size_to_str(blk_size);
2591 error_setg(errp, "Invalid SD card size: %s", blk_size_str);
2592 g_free(blk_size_str);
2593
2594 blk_size_str = size_to_str(blk_size_aligned);
2595 error_append_hint(errp,
2596 "SD card size has to be a power of 2, e.g. %s.\n"
2597 "You can resize disk images with"
2598 " 'qemu-img resize <imagefile> <new-size>'\n"
2599 "(note that this will lose data if you make the"
2600 " image smaller than it currently is).\n",
2601 blk_size_str);
2602 g_free(blk_size_str);
2603
2604 return;
2605 }
2606
2607 ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
2608 BLK_PERM_ALL, errp);
2609 if (ret < 0) {
2610 return;
2611 }
2612 blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
2613 }
2614 }
2615
2616 static void emmc_realize(DeviceState *dev, Error **errp)
2617 {
2618 SDState *sd = SDMMC_COMMON(dev);
2619
2620 sd->spec_version = SD_PHY_SPECv3_01_VERS; /* Actually v4.3 */
2621
2622 sd_realize(dev, errp);
2623 }
2624
2625 static Property sdmmc_common_properties[] = {
2626 DEFINE_PROP_DRIVE("drive", SDState, blk),
2627 DEFINE_PROP_END_OF_LIST()
2628 };
2629
2630 static Property sd_properties[] = {
2631 DEFINE_PROP_UINT8("spec_version", SDState,
2632 spec_version, SD_PHY_SPECv3_01_VERS),
2633 DEFINE_PROP_END_OF_LIST()
2634 };
2635
2636 static Property emmc_properties[] = {
2637 DEFINE_PROP_END_OF_LIST()
2638 };
2639
2640 static void sdmmc_common_class_init(ObjectClass *klass, void *data)
2641 {
2642 DeviceClass *dc = DEVICE_CLASS(klass);
2643 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2644
2645 device_class_set_props(dc, sdmmc_common_properties);
2646 dc->vmsd = &sd_vmstate;
2647 dc->reset = sd_reset;
2648 dc->bus_type = TYPE_SD_BUS;
2649 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2650
2651 sc->set_voltage = sd_set_voltage;
2652 sc->get_dat_lines = sd_get_dat_lines;
2653 sc->get_cmd_line = sd_get_cmd_line;
2654 sc->do_command = sd_do_command;
2655 sc->write_byte = sd_write_byte;
2656 sc->read_byte = sd_read_byte;
2657 sc->receive_ready = sd_receive_ready;
2658 sc->data_ready = sd_data_ready;
2659 sc->enable = sd_enable;
2660 sc->get_inserted = sd_get_inserted;
2661 sc->get_readonly = sd_get_readonly;
2662 }
2663
2664 static void sd_class_init(ObjectClass *klass, void *data)
2665 {
2666 DeviceClass *dc = DEVICE_CLASS(klass);
2667 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2668
2669 dc->realize = sd_realize;
2670 device_class_set_props(dc, sd_properties);
2671
2672 sc->set_cid = sd_set_cid;
2673 sc->set_csd = sd_set_csd;
2674 sc->proto = &sd_proto_sd;
2675 }
2676
2677 /*
2678 * We do not model the chip select pin, so allow the board to select
2679 * whether card should be in SSI or MMC/SD mode. It is also up to the
2680 * board to ensure that ssi transfers only occur when the chip select
2681 * is asserted.
2682 */
2683 static void sd_spi_class_init(ObjectClass *klass, void *data)
2684 {
2685 DeviceClass *dc = DEVICE_CLASS(klass);
2686 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2687
2688 dc->desc = "SD SPI";
2689 sc->proto = &sd_proto_spi;
2690 }
2691
2692 static void emmc_class_init(ObjectClass *klass, void *data)
2693 {
2694 DeviceClass *dc = DEVICE_CLASS(klass);
2695 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2696
2697 dc->desc = "eMMC";
2698 dc->realize = emmc_realize;
2699 device_class_set_props(dc, emmc_properties);
2700 /* Reason: Soldered on board */
2701 dc->user_creatable = false;
2702
2703 sc->proto = &sd_proto_emmc;
2704
2705 sc->set_cid = emmc_set_cid;
2706 sc->set_csd = emmc_set_csd;
2707 }
2708
2709 static const TypeInfo sd_types[] = {
2710 {
2711 .name = TYPE_SDMMC_COMMON,
2712 .parent = TYPE_DEVICE,
2713 .abstract = true,
2714 .instance_size = sizeof(SDState),
2715 .class_size = sizeof(SDCardClass),
2716 .class_init = sdmmc_common_class_init,
2717 .instance_init = sd_instance_init,
2718 .instance_finalize = sd_instance_finalize,
2719 },
2720 {
2721 .name = TYPE_SD_CARD,
2722 .parent = TYPE_SDMMC_COMMON,
2723 .class_init = sd_class_init,
2724 },
2725 {
2726 .name = TYPE_SD_CARD_SPI,
2727 .parent = TYPE_SD_CARD,
2728 .class_init = sd_spi_class_init,
2729 },
2730 {
2731 .name = TYPE_EMMC,
2732 .parent = TYPE_SDMMC_COMMON,
2733 .class_init = emmc_class_init,
2734 },
2735 };
2736
2737 DEFINE_TYPES(sd_types)
armbru's QEMU hackery