2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in
17 * the documentation and/or other materials provided with the
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
23 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
24 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
25 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
27 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
28 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 #include "qemu/osdep.h"
34 #include "qemu/units.h"
35 #include "qemu/cutils.h"
37 #include "hw/registerfields.h"
38 #include "sysemu/block-backend.h"
40 #include "hw/sd/sdcard_legacy.h"
41 #include "migration/vmstate.h"
42 #include "qapi/error.h"
43 #include "qemu/bitmap.h"
44 #include "hw/qdev-properties.h"
45 #include "hw/qdev-properties-system.h"
46 #include "qemu/error-report.h"
47 #include "qemu/timer.h"
49 #include "qemu/module.h"
50 #include "sdmmc-internal.h"
55 #define SDSC_MAX_CAPACITY (2 * GiB)
57 #define INVALID_ADDRESS UINT32_MAX
60 sd_r0
= 0, /* no response */
61 sd_r1
, /* normal response command */
62 sd_r2_i
, /* CID register */
63 sd_r2_s
, /* CSD register */
64 sd_r3
, /* OCR register */
65 sd_r6
= 6, /* Published RCA response */
66 sd_r7
, /* Operating voltage */
73 sd_card_identification_mode
,
74 sd_data_transfer_mode
,
78 sd_inactive_state
= -1,
81 sd_identification_state
,
85 sd_receivingdata_state
,
91 DeviceState parent_obj
;
93 /* If true, created by sd_init() for a non-qdevified caller */
94 /* TODO purge them with fire */
95 bool me_no_qdev_me_kill_mammoth_with_rocks
;
97 /* SD Memory Card Registers */
103 uint32_t card_status
;
104 uint8_t sd_status
[64];
106 /* Static properties */
108 uint8_t spec_version
;
112 /* Runtime changeables */
114 uint32_t mode
; /* current card mode, one of SDCardModes */
115 int32_t state
; /* current card state, one of SDCardStates */
118 unsigned long *wp_group_bmap
;
119 int32_t wp_group_bits
;
122 uint32_t multi_blk_cnt
;
123 uint32_t erase_start
;
127 uint8_t function_group
[6];
129 /* True if we will handle the next command as an ACMD. Note that this does
130 * *not* track the APP_CMD status bit!
133 uint32_t blk_written
;
135 uint32_t data_offset
;
137 qemu_irq readonly_cb
;
138 qemu_irq inserted_cb
;
139 QEMUTimer
*ocr_power_timer
;
140 const char *proto_name
;
146 static void sd_realize(DeviceState
*dev
, Error
**errp
);
148 static const char *sd_state_name(enum SDCardStates state
)
150 static const char *state_name
[] = {
151 [sd_idle_state
] = "idle",
152 [sd_ready_state
] = "ready",
153 [sd_identification_state
] = "identification",
154 [sd_standby_state
] = "standby",
155 [sd_transfer_state
] = "transfer",
156 [sd_sendingdata_state
] = "sendingdata",
157 [sd_receivingdata_state
] = "receivingdata",
158 [sd_programming_state
] = "programming",
159 [sd_disconnect_state
] = "disconnect",
161 if (state
== sd_inactive_state
) {
164 assert(state
< ARRAY_SIZE(state_name
));
165 return state_name
[state
];
168 static const char *sd_response_name(sd_rsp_type_t rsp
)
170 static const char *response_name
[] = {
171 [sd_r0
] = "RESP#0 (no response)",
172 [sd_r1
] = "RESP#1 (normal cmd)",
173 [sd_r2_i
] = "RESP#2 (CID reg)",
174 [sd_r2_s
] = "RESP#2 (CSD reg)",
175 [sd_r3
] = "RESP#3 (OCR reg)",
176 [sd_r6
] = "RESP#6 (RCA)",
177 [sd_r7
] = "RESP#7 (operating voltage)",
179 if (rsp
== sd_illegal
) {
180 return "ILLEGAL RESP";
185 assert(rsp
< ARRAY_SIZE(response_name
));
186 return response_name
[rsp
];
189 static uint8_t sd_get_dat_lines(SDState
*sd
)
191 return sd
->enable
? sd
->dat_lines
: 0;
194 static bool sd_get_cmd_line(SDState
*sd
)
196 return sd
->enable
? sd
->cmd_line
: false;
199 static void sd_set_voltage(SDState
*sd
, uint16_t millivolts
)
201 trace_sdcard_set_voltage(millivolts
);
203 switch (millivolts
) {
204 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
205 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
208 qemu_log_mask(LOG_GUEST_ERROR
, "SD card voltage not supported: %.3fV",
209 millivolts
/ 1000.f
);
213 static void sd_set_mode(SDState
*sd
)
216 case sd_inactive_state
:
217 sd
->mode
= sd_inactive
;
222 case sd_identification_state
:
223 sd
->mode
= sd_card_identification_mode
;
226 case sd_standby_state
:
227 case sd_transfer_state
:
228 case sd_sendingdata_state
:
229 case sd_receivingdata_state
:
230 case sd_programming_state
:
231 case sd_disconnect_state
:
232 sd
->mode
= sd_data_transfer_mode
;
237 static const sd_cmd_type_t sd_cmd_type
[SDMMC_CMD_MAX
] = {
238 sd_bc
, sd_none
, sd_bcr
, sd_bcr
, sd_none
, sd_none
, sd_none
, sd_ac
,
239 sd_bcr
, sd_ac
, sd_ac
, sd_adtc
, sd_ac
, sd_ac
, sd_none
, sd_ac
,
241 sd_ac
, sd_adtc
, sd_adtc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
242 sd_adtc
, sd_adtc
, sd_adtc
, sd_adtc
, sd_ac
, sd_ac
, sd_adtc
, sd_none
,
244 sd_ac
, sd_ac
, sd_none
, sd_none
, sd_none
, sd_none
, sd_ac
, sd_none
,
245 sd_none
, sd_none
, sd_bc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
247 sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_ac
,
248 sd_adtc
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
, sd_none
,
251 static const int sd_cmd_class
[SDMMC_CMD_MAX
] = {
252 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0,
253 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6,
254 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7,
255 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8,
258 static uint8_t sd_crc7(const void *message
, size_t width
)
261 uint8_t shift_reg
= 0x00;
262 const uint8_t *msg
= (const uint8_t *)message
;
264 for (i
= 0; i
< width
; i
++, msg
++)
265 for (bit
= 7; bit
>= 0; bit
--) {
267 if ((shift_reg
>> 7) ^ ((*msg
>> bit
) & 1))
274 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
276 FIELD(OCR
, VDD_VOLTAGE_WINDOW
, 0, 24)
277 FIELD(OCR
, VDD_VOLTAGE_WIN_LO
, 0, 8)
278 FIELD(OCR
, DUAL_VOLTAGE_CARD
, 7, 1)
279 FIELD(OCR
, VDD_VOLTAGE_WIN_HI
, 8, 16)
280 FIELD(OCR
, ACCEPT_SWITCH_1V8
, 24, 1) /* Only UHS-I */
281 FIELD(OCR
, UHS_II_CARD
, 29, 1) /* Only UHS-II */
282 FIELD(OCR
, CARD_CAPACITY
, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
283 FIELD(OCR
, CARD_POWER_UP
, 31, 1)
285 #define ACMD41_ENQUIRY_MASK 0x00ffffff
286 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
287 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
288 | R_OCR_UHS_II_CARD_MASK \
289 | R_OCR_CARD_CAPACITY_MASK \
290 | R_OCR_CARD_POWER_UP_MASK)
292 static void sd_ocr_powerup(void *opaque
)
294 SDState
*sd
= opaque
;
296 trace_sdcard_powerup();
297 assert(!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
));
299 /* card power-up OK */
300 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_POWER_UP
, 1);
302 if (sd
->size
> SDSC_MAX_CAPACITY
) {
303 sd
->ocr
= FIELD_DP32(sd
->ocr
, OCR
, CARD_CAPACITY
, 1);
307 static void sd_set_ocr(SDState
*sd
)
309 /* All voltages OK */
310 sd
->ocr
= R_OCR_VDD_VOLTAGE_WIN_HI_MASK
;
314 * We don't need to emulate power up sequence in SPI-mode.
315 * Thus, the card's power up status bit should be set to 1 when reset.
316 * The card's capacity status bit should also be set if SD card size
317 * is larger than 2GB for SDHC support.
323 static void sd_set_scr(SDState
*sd
)
325 sd
->scr
[0] = 0 << 4; /* SCR structure version 1.0 */
326 if (sd
->spec_version
== SD_PHY_SPECv1_10_VERS
) {
327 sd
->scr
[0] |= 1; /* Spec Version 1.10 */
329 sd
->scr
[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
331 sd
->scr
[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
332 | 0b0101; /* 1-bit or 4-bit width bus modes */
333 sd
->scr
[2] = 0x00; /* Extended Security is not supported. */
334 if (sd
->spec_version
>= SD_PHY_SPECv3_01_VERS
) {
335 sd
->scr
[2] |= 1 << 7; /* Spec Version 3.0X */
338 /* reserved for manufacturer usage */
352 static void sd_set_cid(SDState
*sd
)
354 sd
->cid
[0] = MID
; /* Fake card manufacturer ID (MID) */
355 sd
->cid
[1] = OID
[0]; /* OEM/Application ID (OID) */
357 sd
->cid
[3] = PNM
[0]; /* Fake product name (PNM) */
362 sd
->cid
[8] = PRV
; /* Fake product revision (PRV) */
363 sd
->cid
[9] = 0xde; /* Fake serial number (PSN) */
367 sd
->cid
[13] = 0x00 | /* Manufacture date (MDT) */
368 ((MDT_YR
- 2000) / 10);
369 sd
->cid
[14] = ((MDT_YR
% 10) << 4) | MDT_MON
;
370 sd
->cid
[15] = (sd_crc7(sd
->cid
, 15) << 1) | 1;
373 #define HWBLOCK_SHIFT 9 /* 512 bytes */
374 #define SECTOR_SHIFT 5 /* 16 kilobytes */
375 #define WPGROUP_SHIFT 7 /* 2 megs */
376 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
377 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
379 static const uint8_t sd_csd_rw_mask
[16] = {
380 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
381 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
384 static void sd_set_csd(SDState
*sd
, uint64_t size
)
386 int hwblock_shift
= HWBLOCK_SHIFT
;
388 uint32_t sectsize
= (1 << (SECTOR_SHIFT
+ 1)) - 1;
389 uint32_t wpsize
= (1 << (WPGROUP_SHIFT
+ 1)) - 1;
391 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
392 if (size
== SDSC_MAX_CAPACITY
) {
395 csize
= (size
>> (CMULT_SHIFT
+ hwblock_shift
)) - 1;
397 if (size
<= SDSC_MAX_CAPACITY
) { /* Standard Capacity SD */
398 sd
->csd
[0] = 0x00; /* CSD structure */
399 sd
->csd
[1] = 0x26; /* Data read access-time-1 */
400 sd
->csd
[2] = 0x00; /* Data read access-time-2 */
401 sd
->csd
[3] = 0x32; /* Max. data transfer rate: 25 MHz */
402 sd
->csd
[4] = 0x5f; /* Card Command Classes */
403 sd
->csd
[5] = 0x50 | /* Max. read data block length */
405 sd
->csd
[6] = 0xe0 | /* Partial block for read allowed */
406 ((csize
>> 10) & 0x03);
407 sd
->csd
[7] = 0x00 | /* Device size */
408 ((csize
>> 2) & 0xff);
409 sd
->csd
[8] = 0x3f | /* Max. read current */
410 ((csize
<< 6) & 0xc0);
411 sd
->csd
[9] = 0xfc | /* Max. write current */
412 ((CMULT_SHIFT
- 2) >> 1);
413 sd
->csd
[10] = 0x40 | /* Erase sector size */
414 (((CMULT_SHIFT
- 2) << 7) & 0x80) | (sectsize
>> 1);
415 sd
->csd
[11] = 0x00 | /* Write protect group size */
416 ((sectsize
<< 7) & 0x80) | wpsize
;
417 sd
->csd
[12] = 0x90 | /* Write speed factor */
418 (hwblock_shift
>> 2);
419 sd
->csd
[13] = 0x20 | /* Max. write data block length */
420 ((hwblock_shift
<< 6) & 0xc0);
421 sd
->csd
[14] = 0x00; /* File format group */
432 sd
->csd
[7] = (size
>> 16) & 0xff;
433 sd
->csd
[8] = (size
>> 8) & 0xff;
434 sd
->csd
[9] = (size
& 0xff);
441 sd
->csd
[15] = (sd_crc7(sd
->csd
, 15) << 1) | 1;
444 static void sd_set_rca(SDState
*sd
)
449 FIELD(CSR
, AKE_SEQ_ERROR
, 3, 1)
450 FIELD(CSR
, APP_CMD
, 5, 1)
451 FIELD(CSR
, FX_EVENT
, 6, 1)
452 FIELD(CSR
, READY_FOR_DATA
, 8, 1)
453 FIELD(CSR
, CURRENT_STATE
, 9, 4)
454 FIELD(CSR
, ERASE_RESET
, 13, 1)
455 FIELD(CSR
, CARD_ECC_DISABLED
, 14, 1)
456 FIELD(CSR
, WP_ERASE_SKIP
, 15, 1)
457 FIELD(CSR
, CSD_OVERWRITE
, 16, 1)
458 FIELD(CSR
, DEFERRED_RESPONSE
, 17, 1)
459 FIELD(CSR
, ERROR
, 19, 1)
460 FIELD(CSR
, CC_ERROR
, 20, 1)
461 FIELD(CSR
, CARD_ECC_FAILED
, 21, 1)
462 FIELD(CSR
, ILLEGAL_COMMAND
, 22, 1)
463 FIELD(CSR
, COM_CRC_ERROR
, 23, 1)
464 FIELD(CSR
, LOCK_UNLOCK_FAILED
, 24, 1)
465 FIELD(CSR
, CARD_IS_LOCKED
, 25, 1)
466 FIELD(CSR
, WP_VIOLATION
, 26, 1)
467 FIELD(CSR
, ERASE_PARAM
, 27, 1)
468 FIELD(CSR
, ERASE_SEQ_ERROR
, 28, 1)
469 FIELD(CSR
, BLOCK_LEN_ERROR
, 29, 1)
470 FIELD(CSR
, ADDRESS_ERROR
, 30, 1)
471 FIELD(CSR
, OUT_OF_RANGE
, 31, 1)
473 /* Card status bits, split by clear condition:
474 * A : According to the card current state
475 * B : Always related to the previous command
476 * C : Cleared by read
478 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
479 | R_CSR_CARD_ECC_DISABLED_MASK \
480 | R_CSR_CARD_IS_LOCKED_MASK)
481 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
482 | R_CSR_ILLEGAL_COMMAND_MASK \
483 | R_CSR_COM_CRC_ERROR_MASK)
484 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
485 | R_CSR_APP_CMD_MASK \
486 | R_CSR_ERASE_RESET_MASK \
487 | R_CSR_WP_ERASE_SKIP_MASK \
488 | R_CSR_CSD_OVERWRITE_MASK \
490 | R_CSR_CC_ERROR_MASK \
491 | R_CSR_CARD_ECC_FAILED_MASK \
492 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
493 | R_CSR_WP_VIOLATION_MASK \
494 | R_CSR_ERASE_PARAM_MASK \
495 | R_CSR_ERASE_SEQ_ERROR_MASK \
496 | R_CSR_BLOCK_LEN_ERROR_MASK \
497 | R_CSR_ADDRESS_ERROR_MASK \
498 | R_CSR_OUT_OF_RANGE_MASK)
500 static void sd_set_cardstatus(SDState
*sd
)
502 sd
->card_status
= 0x00000100;
505 static void sd_set_sdstatus(SDState
*sd
)
507 memset(sd
->sd_status
, 0, 64);
510 static int sd_req_crc_validate(SDRequest
*req
)
513 buffer
[0] = 0x40 | req
->cmd
;
514 stl_be_p(&buffer
[1], req
->arg
);
516 return sd_crc7(buffer
, 5) != req
->crc
; /* TODO */
519 static void sd_response_r1_make(SDState
*sd
, uint8_t *response
)
521 stl_be_p(response
, sd
->card_status
);
523 /* Clear the "clear on read" status bits */
524 sd
->card_status
&= ~CARD_STATUS_C
;
527 static void sd_response_r3_make(SDState
*sd
, uint8_t *response
)
529 stl_be_p(response
, sd
->ocr
& ACMD41_R3_MASK
);
532 static void sd_response_r6_make(SDState
*sd
, uint8_t *response
)
536 status
= ((sd
->card_status
>> 8) & 0xc000) |
537 ((sd
->card_status
>> 6) & 0x2000) |
538 (sd
->card_status
& 0x1fff);
539 sd
->card_status
&= ~(CARD_STATUS_C
& 0xc81fff);
540 stw_be_p(response
+ 0, sd
->rca
);
541 stw_be_p(response
+ 2, status
);
544 static void sd_response_r7_make(SDState
*sd
, uint8_t *response
)
546 stl_be_p(response
, sd
->vhs
);
549 static inline uint64_t sd_addr_to_wpnum(uint64_t addr
)
551 return addr
>> (HWBLOCK_SHIFT
+ SECTOR_SHIFT
+ WPGROUP_SHIFT
);
554 static void sd_reset(DeviceState
*dev
)
556 SDState
*sd
= SD_CARD(dev
);
560 trace_sdcard_reset();
562 blk_get_geometry(sd
->blk
, §
);
568 sect
= sd_addr_to_wpnum(size
) + 1;
570 sd
->state
= sd_idle_state
;
576 sd_set_csd(sd
, size
);
577 sd_set_cardstatus(sd
);
580 g_free(sd
->wp_group_bmap
);
581 sd
->wp_switch
= sd
->blk
? !blk_is_writable(sd
->blk
) : false;
582 sd
->wp_group_bits
= sect
;
583 sd
->wp_group_bmap
= bitmap_new(sd
->wp_group_bits
);
584 memset(sd
->function_group
, 0, sizeof(sd
->function_group
));
585 sd
->erase_start
= INVALID_ADDRESS
;
586 sd
->erase_end
= INVALID_ADDRESS
;
589 sd
->expecting_acmd
= false;
592 sd
->multi_blk_cnt
= 0;
595 static bool sd_get_inserted(SDState
*sd
)
597 return sd
->blk
&& blk_is_inserted(sd
->blk
);
600 static bool sd_get_readonly(SDState
*sd
)
602 return sd
->wp_switch
;
605 static void sd_cardchange(void *opaque
, bool load
, Error
**errp
)
607 SDState
*sd
= opaque
;
608 DeviceState
*dev
= DEVICE(sd
);
610 bool inserted
= sd_get_inserted(sd
);
611 bool readonly
= sd_get_readonly(sd
);
614 trace_sdcard_inserted(readonly
);
617 trace_sdcard_ejected();
620 if (sd
->me_no_qdev_me_kill_mammoth_with_rocks
) {
621 qemu_set_irq(sd
->inserted_cb
, inserted
);
623 qemu_set_irq(sd
->readonly_cb
, readonly
);
626 sdbus
= SD_BUS(qdev_get_parent_bus(dev
));
627 sdbus_set_inserted(sdbus
, inserted
);
629 sdbus_set_readonly(sdbus
, readonly
);
634 static const BlockDevOps sd_block_ops
= {
635 .change_media_cb
= sd_cardchange
,
638 static bool sd_ocr_vmstate_needed(void *opaque
)
640 SDState
*sd
= opaque
;
642 /* Include the OCR state (and timer) if it is not yet powered up */
643 return !FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
);
646 static const VMStateDescription sd_ocr_vmstate
= {
647 .name
= "sd-card/ocr-state",
649 .minimum_version_id
= 1,
650 .needed
= sd_ocr_vmstate_needed
,
651 .fields
= (VMStateField
[]) {
652 VMSTATE_UINT32(ocr
, SDState
),
653 VMSTATE_TIMER_PTR(ocr_power_timer
, SDState
),
654 VMSTATE_END_OF_LIST()
658 static int sd_vmstate_pre_load(void *opaque
)
660 SDState
*sd
= opaque
;
662 /* If the OCR state is not included (prior versions, or not
663 * needed), then the OCR must be set as powered up. If the OCR state
664 * is included, this will be replaced by the state restore.
671 static const VMStateDescription sd_vmstate
= {
674 .minimum_version_id
= 2,
675 .pre_load
= sd_vmstate_pre_load
,
676 .fields
= (VMStateField
[]) {
677 VMSTATE_UINT32(mode
, SDState
),
678 VMSTATE_INT32(state
, SDState
),
679 VMSTATE_UINT8_ARRAY(cid
, SDState
, 16),
680 VMSTATE_UINT8_ARRAY(csd
, SDState
, 16),
681 VMSTATE_UINT16(rca
, SDState
),
682 VMSTATE_UINT32(card_status
, SDState
),
683 VMSTATE_PARTIAL_BUFFER(sd_status
, SDState
, 1),
684 VMSTATE_UINT32(vhs
, SDState
),
685 VMSTATE_BITMAP(wp_group_bmap
, SDState
, 0, wp_group_bits
),
686 VMSTATE_UINT32(blk_len
, SDState
),
687 VMSTATE_UINT32(multi_blk_cnt
, SDState
),
688 VMSTATE_UINT32(erase_start
, SDState
),
689 VMSTATE_UINT32(erase_end
, SDState
),
690 VMSTATE_UINT8_ARRAY(pwd
, SDState
, 16),
691 VMSTATE_UINT32(pwd_len
, SDState
),
692 VMSTATE_UINT8_ARRAY(function_group
, SDState
, 6),
693 VMSTATE_UINT8(current_cmd
, SDState
),
694 VMSTATE_BOOL(expecting_acmd
, SDState
),
695 VMSTATE_UINT32(blk_written
, SDState
),
696 VMSTATE_UINT64(data_start
, SDState
),
697 VMSTATE_UINT32(data_offset
, SDState
),
698 VMSTATE_UINT8_ARRAY(data
, SDState
, 512),
699 VMSTATE_UNUSED_V(1, 512),
700 VMSTATE_BOOL(enable
, SDState
),
701 VMSTATE_END_OF_LIST()
703 .subsections
= (const VMStateDescription
*[]) {
709 /* Legacy initialization function for use by non-qdevified callers */
710 SDState
*sd_init(BlockBackend
*blk
, bool is_spi
)
717 obj
= object_new(TYPE_SD_CARD
);
719 if (!qdev_prop_set_drive_err(dev
, "drive", blk
, &err
)) {
720 error_reportf_err(err
, "sd_init failed: ");
723 qdev_prop_set_bit(dev
, "spi", is_spi
);
726 * Realizing the device properly would put it into the QOM
727 * composition tree even though it is not plugged into an
728 * appropriate bus. That's a no-no. Hide the device from
729 * QOM/qdev, and call its qdev realize callback directly.
732 object_unparent(obj
);
733 sd_realize(dev
, &err
);
735 error_reportf_err(err
, "sd_init failed: ");
740 sd
->me_no_qdev_me_kill_mammoth_with_rocks
= true;
744 void sd_set_cb(SDState
*sd
, qemu_irq readonly
, qemu_irq insert
)
746 sd
->readonly_cb
= readonly
;
747 sd
->inserted_cb
= insert
;
748 qemu_set_irq(readonly
, sd
->blk
? !blk_is_writable(sd
->blk
) : 0);
749 qemu_set_irq(insert
, sd
->blk
? blk_is_inserted(sd
->blk
) : 0);
752 static void sd_blk_read(SDState
*sd
, uint64_t addr
, uint32_t len
)
754 trace_sdcard_read_block(addr
, len
);
755 if (!sd
->blk
|| blk_pread(sd
->blk
, addr
, sd
->data
, len
) < 0) {
756 fprintf(stderr
, "sd_blk_read: read error on host side\n");
760 static void sd_blk_write(SDState
*sd
, uint64_t addr
, uint32_t len
)
762 trace_sdcard_write_block(addr
, len
);
763 if (!sd
->blk
|| blk_pwrite(sd
->blk
, addr
, sd
->data
, len
, 0) < 0) {
764 fprintf(stderr
, "sd_blk_write: write error on host side\n");
768 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len)
769 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
770 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
771 #define APP_WRITE_BLOCK(a, len)
773 static void sd_erase(SDState
*sd
)
775 uint64_t erase_start
= sd
->erase_start
;
776 uint64_t erase_end
= sd
->erase_end
;
780 int erase_len
= 1 << HWBLOCK_SHIFT
;
782 trace_sdcard_erase(sd
->erase_start
, sd
->erase_end
);
783 if (sd
->erase_start
== INVALID_ADDRESS
784 || sd
->erase_end
== INVALID_ADDRESS
) {
785 sd
->card_status
|= ERASE_SEQ_ERROR
;
786 sd
->erase_start
= INVALID_ADDRESS
;
787 sd
->erase_end
= INVALID_ADDRESS
;
791 if (FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
792 /* High capacity memory card: erase units are 512 byte blocks */
798 if (erase_start
> sd
->size
|| erase_end
> sd
->size
) {
799 sd
->card_status
|= OUT_OF_RANGE
;
800 sd
->erase_start
= INVALID_ADDRESS
;
801 sd
->erase_end
= INVALID_ADDRESS
;
805 sd
->erase_start
= INVALID_ADDRESS
;
806 sd
->erase_end
= INVALID_ADDRESS
;
809 memset(sd
->data
, 0xff, erase_len
);
810 for (erase_addr
= erase_start
; erase_addr
<= erase_end
;
811 erase_addr
+= erase_len
) {
813 /* Only SDSC cards support write protect groups */
814 wpnum
= sd_addr_to_wpnum(erase_addr
);
815 assert(wpnum
< sd
->wp_group_bits
);
816 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
817 sd
->card_status
|= WP_ERASE_SKIP
;
821 BLK_WRITE_BLOCK(erase_addr
, erase_len
);
825 static uint32_t sd_wpbits(SDState
*sd
, uint64_t addr
)
830 wpnum
= sd_addr_to_wpnum(addr
);
832 for (i
= 0; i
< 32; i
++, wpnum
++, addr
+= WPGROUP_SIZE
) {
833 if (addr
>= sd
->size
) {
835 * If the addresses of the last groups are outside the valid range,
836 * then the corresponding write protection bits shall be set to 0.
840 assert(wpnum
< sd
->wp_group_bits
);
841 if (test_bit(wpnum
, sd
->wp_group_bmap
)) {
849 static void sd_function_switch(SDState
*sd
, uint32_t arg
)
851 int i
, mode
, new_func
;
852 mode
= !!(arg
& 0x80000000);
854 sd
->data
[0] = 0x00; /* Maximum current consumption */
856 sd
->data
[2] = 0x80; /* Supported group 6 functions */
858 sd
->data
[4] = 0x80; /* Supported group 5 functions */
860 sd
->data
[6] = 0x80; /* Supported group 4 functions */
862 sd
->data
[8] = 0x80; /* Supported group 3 functions */
864 sd
->data
[10] = 0x80; /* Supported group 2 functions */
866 sd
->data
[12] = 0x80; /* Supported group 1 functions */
869 memset(&sd
->data
[14], 0, 3);
870 for (i
= 0; i
< 6; i
++) {
871 new_func
= (arg
>> (i
* 4)) & 0x0f;
872 if (mode
&& new_func
!= 0x0f)
873 sd
->function_group
[i
] = new_func
;
874 sd
->data
[16 - (i
>> 1)] |= new_func
<< ((i
% 2) * 4);
876 memset(&sd
->data
[17], 0, 47);
879 static inline bool sd_wp_addr(SDState
*sd
, uint64_t addr
)
881 return test_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
884 static void sd_lock_command(SDState
*sd
)
886 int erase
, lock
, clr_pwd
, set_pwd
, pwd_len
;
887 erase
= !!(sd
->data
[0] & 0x08);
888 lock
= sd
->data
[0] & 0x04;
889 clr_pwd
= sd
->data
[0] & 0x02;
890 set_pwd
= sd
->data
[0] & 0x01;
893 pwd_len
= sd
->data
[1];
900 trace_sdcard_unlock();
903 if (!(sd
->card_status
& CARD_IS_LOCKED
) || sd
->blk_len
> 1 ||
904 set_pwd
|| clr_pwd
|| lock
|| sd
->wp_switch
||
905 (sd
->csd
[14] & 0x20)) {
906 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
909 bitmap_zero(sd
->wp_group_bmap
, sd
->wp_group_bits
);
910 sd
->csd
[14] &= ~0x10;
911 sd
->card_status
&= ~CARD_IS_LOCKED
;
913 /* Erasing the entire card here! */
914 fprintf(stderr
, "SD: Card force-erased by CMD42\n");
918 if (sd
->blk_len
< 2 + pwd_len
||
919 pwd_len
<= sd
->pwd_len
||
920 pwd_len
> sd
->pwd_len
+ 16) {
921 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
925 if (sd
->pwd_len
&& memcmp(sd
->pwd
, sd
->data
+ 2, sd
->pwd_len
)) {
926 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
930 pwd_len
-= sd
->pwd_len
;
931 if ((pwd_len
&& !set_pwd
) ||
932 (clr_pwd
&& (set_pwd
|| lock
)) ||
933 (lock
&& !sd
->pwd_len
&& !set_pwd
) ||
934 (!set_pwd
&& !clr_pwd
&&
935 (((sd
->card_status
& CARD_IS_LOCKED
) && lock
) ||
936 (!(sd
->card_status
& CARD_IS_LOCKED
) && !lock
)))) {
937 sd
->card_status
|= LOCK_UNLOCK_FAILED
;
942 memcpy(sd
->pwd
, sd
->data
+ 2 + sd
->pwd_len
, pwd_len
);
943 sd
->pwd_len
= pwd_len
;
951 sd
->card_status
|= CARD_IS_LOCKED
;
953 sd
->card_status
&= ~CARD_IS_LOCKED
;
956 static bool address_in_range(SDState
*sd
, const char *desc
,
957 uint64_t addr
, uint32_t length
)
959 if (addr
+ length
> sd
->size
) {
960 qemu_log_mask(LOG_GUEST_ERROR
,
961 "%s offset %"PRIu64
" > card %"PRIu64
" [%%%u]\n",
962 desc
, addr
, sd
->size
, length
);
963 sd
->card_status
|= ADDRESS_ERROR
;
969 static sd_rsp_type_t
sd_normal_command(SDState
*sd
, SDRequest req
)
971 uint32_t rca
= 0x0000;
972 uint64_t addr
= (sd
->ocr
& (1 << 30)) ? (uint64_t) req
.arg
<< 9 : req
.arg
;
974 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
975 * However there is no ACMD55, so we want to trace this particular case.
977 if (req
.cmd
!= 55 || sd
->expecting_acmd
) {
978 trace_sdcard_normal_command(sd
->proto_name
,
979 sd_cmd_name(req
.cmd
), req
.cmd
,
980 req
.arg
, sd_state_name(sd
->state
));
983 /* Not interpreting this as an app command */
984 sd
->card_status
&= ~APP_CMD
;
986 if (sd_cmd_type
[req
.cmd
] == sd_ac
987 || sd_cmd_type
[req
.cmd
] == sd_adtc
) {
991 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
992 * if not, its effects are cancelled */
993 if (sd
->multi_blk_cnt
!= 0 && !(req
.cmd
== 18 || req
.cmd
== 25)) {
994 sd
->multi_blk_cnt
= 0;
997 if (sd_cmd_class
[req
.cmd
] == 6 && FIELD_EX32(sd
->ocr
, OCR
, CARD_CAPACITY
)) {
998 /* Only Standard Capacity cards support class 6 commands */
1003 /* Basic commands (Class 0 and Class 1) */
1004 case 0: /* CMD0: GO_IDLE_STATE */
1005 switch (sd
->state
) {
1006 case sd_inactive_state
:
1007 return sd
->spi
? sd_r1
: sd_r0
;
1010 sd
->state
= sd_idle_state
;
1011 sd_reset(DEVICE(sd
));
1012 return sd
->spi
? sd_r1
: sd_r0
;
1016 case 1: /* CMD1: SEND_OP_CMD */
1020 sd
->state
= sd_transfer_state
;
1023 case 2: /* CMD2: ALL_SEND_CID */
1026 switch (sd
->state
) {
1027 case sd_ready_state
:
1028 sd
->state
= sd_identification_state
;
1036 case 3: /* CMD3: SEND_RELATIVE_ADDR */
1039 switch (sd
->state
) {
1040 case sd_identification_state
:
1041 case sd_standby_state
:
1042 sd
->state
= sd_standby_state
;
1051 case 4: /* CMD4: SEND_DSR */
1054 switch (sd
->state
) {
1055 case sd_standby_state
:
1063 case 5: /* CMD5: reserved for SDIO cards */
1066 case 6: /* CMD6: SWITCH_FUNCTION */
1068 case sd_data_transfer_mode
:
1069 sd_function_switch(sd
, req
.arg
);
1070 sd
->state
= sd_sendingdata_state
;
1072 sd
->data_offset
= 0;
1080 case 7: /* CMD7: SELECT/DESELECT_CARD */
1083 switch (sd
->state
) {
1084 case sd_standby_state
:
1088 sd
->state
= sd_transfer_state
;
1091 case sd_transfer_state
:
1092 case sd_sendingdata_state
:
1096 sd
->state
= sd_standby_state
;
1099 case sd_disconnect_state
:
1103 sd
->state
= sd_programming_state
;
1106 case sd_programming_state
:
1110 sd
->state
= sd_disconnect_state
;
1118 case 8: /* CMD8: SEND_IF_COND */
1119 if (sd
->spec_version
< SD_PHY_SPECv2_00_VERS
) {
1122 if (sd
->state
!= sd_idle_state
) {
1127 /* No response if not exactly one VHS bit is set. */
1128 if (!(req
.arg
>> 8) || (req
.arg
>> (ctz32(req
.arg
& ~0xff) + 1))) {
1129 return sd
->spi
? sd_r7
: sd_r0
;
1136 case 9: /* CMD9: SEND_CSD */
1137 switch (sd
->state
) {
1138 case sd_standby_state
:
1144 case sd_transfer_state
:
1147 sd
->state
= sd_sendingdata_state
;
1148 memcpy(sd
->data
, sd
->csd
, 16);
1149 sd
->data_start
= addr
;
1150 sd
->data_offset
= 0;
1158 case 10: /* CMD10: SEND_CID */
1159 switch (sd
->state
) {
1160 case sd_standby_state
:
1166 case sd_transfer_state
:
1169 sd
->state
= sd_sendingdata_state
;
1170 memcpy(sd
->data
, sd
->cid
, 16);
1171 sd
->data_start
= addr
;
1172 sd
->data_offset
= 0;
1180 case 12: /* CMD12: STOP_TRANSMISSION */
1181 switch (sd
->state
) {
1182 case sd_sendingdata_state
:
1183 sd
->state
= sd_transfer_state
;
1186 case sd_receivingdata_state
:
1187 sd
->state
= sd_programming_state
;
1188 /* Bzzzzzzztt .... Operation complete. */
1189 sd
->state
= sd_transfer_state
;
1197 case 13: /* CMD13: SEND_STATUS */
1199 case sd_data_transfer_mode
:
1200 if (!sd
->spi
&& sd
->rca
!= rca
) {
1211 case 15: /* CMD15: GO_INACTIVE_STATE */
1215 case sd_data_transfer_mode
:
1219 sd
->state
= sd_inactive_state
;
1227 /* Block read commands (Classs 2) */
1228 case 16: /* CMD16: SET_BLOCKLEN */
1229 switch (sd
->state
) {
1230 case sd_transfer_state
:
1231 if (req
.arg
> (1 << HWBLOCK_SHIFT
)) {
1232 sd
->card_status
|= BLOCK_LEN_ERROR
;
1234 trace_sdcard_set_blocklen(req
.arg
);
1235 sd
->blk_len
= req
.arg
;
1245 case 17: /* CMD17: READ_SINGLE_BLOCK */
1246 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1247 switch (sd
->state
) {
1248 case sd_transfer_state
:
1250 if (!address_in_range(sd
, "READ_BLOCK", addr
, sd
->blk_len
)) {
1254 sd
->state
= sd_sendingdata_state
;
1255 sd
->data_start
= addr
;
1256 sd
->data_offset
= 0;
1264 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
1265 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1268 if (sd
->state
== sd_transfer_state
) {
1269 sd
->state
= sd_sendingdata_state
;
1270 sd
->data_offset
= 0;
1275 case 23: /* CMD23: SET_BLOCK_COUNT */
1276 if (sd
->spec_version
< SD_PHY_SPECv3_01_VERS
) {
1279 switch (sd
->state
) {
1280 case sd_transfer_state
:
1281 sd
->multi_blk_cnt
= req
.arg
;
1289 /* Block write commands (Class 4) */
1290 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1291 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1292 switch (sd
->state
) {
1293 case sd_transfer_state
:
1295 if (!address_in_range(sd
, "WRITE_BLOCK", addr
, sd
->blk_len
)) {
1299 sd
->state
= sd_receivingdata_state
;
1300 sd
->data_start
= addr
;
1301 sd
->data_offset
= 0;
1302 sd
->blk_written
= 0;
1304 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
1305 if (sd_wp_addr(sd
, sd
->data_start
)) {
1306 sd
->card_status
|= WP_VIOLATION
;
1309 if (sd
->csd
[14] & 0x30) {
1310 sd
->card_status
|= WP_VIOLATION
;
1319 case 26: /* CMD26: PROGRAM_CID */
1322 switch (sd
->state
) {
1323 case sd_transfer_state
:
1324 sd
->state
= sd_receivingdata_state
;
1326 sd
->data_offset
= 0;
1334 case 27: /* CMD27: PROGRAM_CSD */
1335 switch (sd
->state
) {
1336 case sd_transfer_state
:
1337 sd
->state
= sd_receivingdata_state
;
1339 sd
->data_offset
= 0;
1347 /* Write protection (Class 6) */
1348 case 28: /* CMD28: SET_WRITE_PROT */
1349 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1353 switch (sd
->state
) {
1354 case sd_transfer_state
:
1355 if (!address_in_range(sd
, "SET_WRITE_PROT", addr
, 1)) {
1359 sd
->state
= sd_programming_state
;
1360 set_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1361 /* Bzzzzzzztt .... Operation complete. */
1362 sd
->state
= sd_transfer_state
;
1370 case 29: /* CMD29: CLR_WRITE_PROT */
1371 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1375 switch (sd
->state
) {
1376 case sd_transfer_state
:
1377 if (!address_in_range(sd
, "CLR_WRITE_PROT", addr
, 1)) {
1381 sd
->state
= sd_programming_state
;
1382 clear_bit(sd_addr_to_wpnum(addr
), sd
->wp_group_bmap
);
1383 /* Bzzzzzzztt .... Operation complete. */
1384 sd
->state
= sd_transfer_state
;
1392 case 30: /* CMD30: SEND_WRITE_PROT */
1393 if (sd
->size
> SDSC_MAX_CAPACITY
) {
1397 switch (sd
->state
) {
1398 case sd_transfer_state
:
1399 if (!address_in_range(sd
, "SEND_WRITE_PROT",
1400 req
.arg
, sd
->blk_len
)) {
1404 sd
->state
= sd_sendingdata_state
;
1405 *(uint32_t *) sd
->data
= sd_wpbits(sd
, req
.arg
);
1406 sd
->data_start
= addr
;
1407 sd
->data_offset
= 0;
1415 /* Erase commands (Class 5) */
1416 case 32: /* CMD32: ERASE_WR_BLK_START */
1417 switch (sd
->state
) {
1418 case sd_transfer_state
:
1419 sd
->erase_start
= req
.arg
;
1427 case 33: /* CMD33: ERASE_WR_BLK_END */
1428 switch (sd
->state
) {
1429 case sd_transfer_state
:
1430 sd
->erase_end
= req
.arg
;
1438 case 38: /* CMD38: ERASE */
1439 switch (sd
->state
) {
1440 case sd_transfer_state
:
1441 if (sd
->csd
[14] & 0x30) {
1442 sd
->card_status
|= WP_VIOLATION
;
1446 sd
->state
= sd_programming_state
;
1448 /* Bzzzzzzztt .... Operation complete. */
1449 sd
->state
= sd_transfer_state
;
1457 /* Lock card commands (Class 7) */
1458 case 42: /* CMD42: LOCK_UNLOCK */
1459 switch (sd
->state
) {
1460 case sd_transfer_state
:
1461 sd
->state
= sd_receivingdata_state
;
1463 sd
->data_offset
= 0;
1472 /* CMD52, CMD53, CMD54: reserved for SDIO cards
1473 * (see the SDIO Simplified Specification V2.0)
1474 * Handle as illegal command but do not complain
1475 * on stderr, as some OSes may use these in their
1476 * probing for presence of an SDIO card.
1480 /* Application specific commands (Class 8) */
1481 case 55: /* CMD55: APP_CMD */
1482 switch (sd
->state
) {
1483 case sd_ready_state
:
1484 case sd_identification_state
:
1485 case sd_inactive_state
:
1489 qemu_log_mask(LOG_GUEST_ERROR
,
1490 "SD: illegal RCA 0x%04x for APP_CMD\n", req
.cmd
);
1496 if (sd
->rca
!= rca
) {
1500 sd
->expecting_acmd
= true;
1501 sd
->card_status
|= APP_CMD
;
1504 case 56: /* CMD56: GEN_CMD */
1505 switch (sd
->state
) {
1506 case sd_transfer_state
:
1507 sd
->data_offset
= 0;
1509 sd
->state
= sd_sendingdata_state
;
1511 sd
->state
= sd_receivingdata_state
;
1519 case 58: /* CMD58: READ_OCR (SPI) */
1525 case 59: /* CMD59: CRC_ON_OFF (SPI) */
1533 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Unknown CMD%i\n", req
.cmd
);
1537 qemu_log_mask(LOG_GUEST_ERROR
, "SD: CMD%i in a wrong state: %s\n",
1538 req
.cmd
, sd_state_name(sd
->state
));
1542 static sd_rsp_type_t
sd_app_command(SDState
*sd
,
1545 trace_sdcard_app_command(sd
->proto_name
, sd_acmd_name(req
.cmd
),
1546 req
.cmd
, req
.arg
, sd_state_name(sd
->state
));
1547 sd
->card_status
|= APP_CMD
;
1549 case 6: /* ACMD6: SET_BUS_WIDTH */
1551 goto unimplemented_spi_cmd
;
1553 switch (sd
->state
) {
1554 case sd_transfer_state
:
1555 sd
->sd_status
[0] &= 0x3f;
1556 sd
->sd_status
[0] |= (req
.arg
& 0x03) << 6;
1564 case 13: /* ACMD13: SD_STATUS */
1565 switch (sd
->state
) {
1566 case sd_transfer_state
:
1567 sd
->state
= sd_sendingdata_state
;
1569 sd
->data_offset
= 0;
1577 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1578 switch (sd
->state
) {
1579 case sd_transfer_state
:
1580 *(uint32_t *) sd
->data
= sd
->blk_written
;
1582 sd
->state
= sd_sendingdata_state
;
1584 sd
->data_offset
= 0;
1592 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1593 switch (sd
->state
) {
1594 case sd_transfer_state
:
1602 case 41: /* ACMD41: SD_APP_OP_COND */
1605 sd
->state
= sd_transfer_state
;
1608 if (sd
->state
!= sd_idle_state
) {
1611 /* If it's the first ACMD41 since reset, we need to decide
1612 * whether to power up. If this is not an enquiry ACMD41,
1613 * we immediately report power on and proceed below to the
1614 * ready state, but if it is, we set a timer to model a
1615 * delay for power up. This works around a bug in EDK2
1616 * UEFI, which sends an initial enquiry ACMD41, but
1617 * assumes that the card is in ready state as soon as it
1618 * sees the power up bit set. */
1619 if (!FIELD_EX32(sd
->ocr
, OCR
, CARD_POWER_UP
)) {
1620 if ((req
.arg
& ACMD41_ENQUIRY_MASK
) != 0) {
1621 timer_del(sd
->ocr_power_timer
);
1624 trace_sdcard_inquiry_cmd41();
1625 if (!timer_pending(sd
->ocr_power_timer
)) {
1626 timer_mod_ns(sd
->ocr_power_timer
,
1627 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
)
1628 + OCR_POWER_DELAY_NS
));
1633 if (FIELD_EX32(sd
->ocr
& req
.arg
, OCR
, VDD_VOLTAGE_WINDOW
)) {
1634 /* We accept any voltage. 10000 V is nothing.
1636 * Once we're powered up, we advance straight to ready state
1637 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1639 sd
->state
= sd_ready_state
;
1644 case 42: /* ACMD42: SET_CLR_CARD_DETECT */
1645 switch (sd
->state
) {
1646 case sd_transfer_state
:
1647 /* Bringing in the 50KOhm pull-up resistor... Done. */
1655 case 51: /* ACMD51: SEND_SCR */
1656 switch (sd
->state
) {
1657 case sd_transfer_state
:
1658 sd
->state
= sd_sendingdata_state
;
1660 sd
->data_offset
= 0;
1668 case 18: /* Reserved for SD security applications */
1673 /* Refer to the "SD Specifications Part3 Security Specification" for
1674 * information about the SD Security Features.
1676 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i Security not implemented\n",
1681 /* Fall back to standard commands. */
1682 return sd_normal_command(sd
, req
);
1684 unimplemented_spi_cmd
:
1685 /* Commands that are recognised but not yet implemented in SPI mode. */
1686 qemu_log_mask(LOG_UNIMP
, "SD: CMD%i not implemented in SPI mode\n",
1691 qemu_log_mask(LOG_GUEST_ERROR
, "SD: ACMD%i in a wrong state\n", req
.cmd
);
1695 static int cmd_valid_while_locked(SDState
*sd
, const uint8_t cmd
)
1697 /* Valid commands in locked state:
1699 * lock card class (7)
1701 * implicitly, the ACMD prefix CMD55
1703 * Anything else provokes an "illegal command" response.
1705 if (sd
->expecting_acmd
) {
1706 return cmd
== 41 || cmd
== 42;
1708 if (cmd
== 16 || cmd
== 55) {
1711 return sd_cmd_class
[cmd
] == 0 || sd_cmd_class
[cmd
] == 7;
1714 int sd_do_command(SDState
*sd
, SDRequest
*req
,
1715 uint8_t *response
) {
1717 sd_rsp_type_t rtype
;
1720 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
) {
1724 if (sd_req_crc_validate(req
)) {
1725 sd
->card_status
|= COM_CRC_ERROR
;
1730 if (req
->cmd
>= SDMMC_CMD_MAX
) {
1731 qemu_log_mask(LOG_GUEST_ERROR
, "SD: incorrect command 0x%02x\n",
1736 if (sd
->card_status
& CARD_IS_LOCKED
) {
1737 if (!cmd_valid_while_locked(sd
, req
->cmd
)) {
1738 sd
->card_status
|= ILLEGAL_COMMAND
;
1739 sd
->expecting_acmd
= false;
1740 qemu_log_mask(LOG_GUEST_ERROR
, "SD: Card is locked\n");
1746 last_state
= sd
->state
;
1749 if (sd
->expecting_acmd
) {
1750 sd
->expecting_acmd
= false;
1751 rtype
= sd_app_command(sd
, *req
);
1753 rtype
= sd_normal_command(sd
, *req
);
1756 if (rtype
== sd_illegal
) {
1757 sd
->card_status
|= ILLEGAL_COMMAND
;
1759 /* Valid command, we can update the 'state before command' bits.
1760 * (Do this now so they appear in r1 responses.)
1762 sd
->current_cmd
= req
->cmd
;
1763 sd
->card_status
&= ~CURRENT_STATE
;
1764 sd
->card_status
|= (last_state
<< 9);
1771 sd_response_r1_make(sd
, response
);
1776 memcpy(response
, sd
->cid
, sizeof(sd
->cid
));
1781 memcpy(response
, sd
->csd
, sizeof(sd
->csd
));
1786 sd_response_r3_make(sd
, response
);
1791 sd_response_r6_make(sd
, response
);
1796 sd_response_r7_make(sd
, response
);
1805 g_assert_not_reached();
1807 trace_sdcard_response(sd_response_name(rtype
), rsplen
);
1809 if (rtype
!= sd_illegal
) {
1810 /* Clear the "clear on valid command" status bits now we've
1813 sd
->card_status
&= ~CARD_STATUS_B
;
1817 qemu_hexdump(stderr
, "Response", response
, rsplen
);
1823 void sd_write_byte(SDState
*sd
, uint8_t value
)
1827 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
1830 if (sd
->state
!= sd_receivingdata_state
) {
1831 qemu_log_mask(LOG_GUEST_ERROR
,
1832 "%s: not in Receiving-Data state\n", __func__
);
1836 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
1839 trace_sdcard_write_data(sd
->proto_name
,
1840 sd_acmd_name(sd
->current_cmd
),
1841 sd
->current_cmd
, value
);
1842 switch (sd
->current_cmd
) {
1843 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1844 sd
->data
[sd
->data_offset
++] = value
;
1845 if (sd
->data_offset
>= sd
->blk_len
) {
1846 /* TODO: Check CRC before committing */
1847 sd
->state
= sd_programming_state
;
1848 BLK_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1850 sd
->csd
[14] |= 0x40;
1851 /* Bzzzzzzztt .... Operation complete. */
1852 sd
->state
= sd_transfer_state
;
1856 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1857 if (sd
->data_offset
== 0) {
1858 /* Start of the block - let's check the address is valid */
1859 if (!address_in_range(sd
, "WRITE_MULTIPLE_BLOCK",
1860 sd
->data_start
, sd
->blk_len
)) {
1863 if (sd
->size
<= SDSC_MAX_CAPACITY
) {
1864 if (sd_wp_addr(sd
, sd
->data_start
)) {
1865 sd
->card_status
|= WP_VIOLATION
;
1870 sd
->data
[sd
->data_offset
++] = value
;
1871 if (sd
->data_offset
>= sd
->blk_len
) {
1872 /* TODO: Check CRC before committing */
1873 sd
->state
= sd_programming_state
;
1874 BLK_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1876 sd
->data_start
+= sd
->blk_len
;
1877 sd
->data_offset
= 0;
1878 sd
->csd
[14] |= 0x40;
1880 /* Bzzzzzzztt .... Operation complete. */
1881 if (sd
->multi_blk_cnt
!= 0) {
1882 if (--sd
->multi_blk_cnt
== 0) {
1884 sd
->state
= sd_transfer_state
;
1889 sd
->state
= sd_receivingdata_state
;
1893 case 26: /* CMD26: PROGRAM_CID */
1894 sd
->data
[sd
->data_offset
++] = value
;
1895 if (sd
->data_offset
>= sizeof(sd
->cid
)) {
1896 /* TODO: Check CRC before committing */
1897 sd
->state
= sd_programming_state
;
1898 for (i
= 0; i
< sizeof(sd
->cid
); i
++)
1899 if ((sd
->cid
[i
] | 0x00) != sd
->data
[i
])
1900 sd
->card_status
|= CID_CSD_OVERWRITE
;
1902 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
1903 for (i
= 0; i
< sizeof(sd
->cid
); i
++) {
1905 sd
->cid
[i
] &= sd
->data
[i
];
1907 /* Bzzzzzzztt .... Operation complete. */
1908 sd
->state
= sd_transfer_state
;
1912 case 27: /* CMD27: PROGRAM_CSD */
1913 sd
->data
[sd
->data_offset
++] = value
;
1914 if (sd
->data_offset
>= sizeof(sd
->csd
)) {
1915 /* TODO: Check CRC before committing */
1916 sd
->state
= sd_programming_state
;
1917 for (i
= 0; i
< sizeof(sd
->csd
); i
++)
1918 if ((sd
->csd
[i
] | sd_csd_rw_mask
[i
]) !=
1919 (sd
->data
[i
] | sd_csd_rw_mask
[i
]))
1920 sd
->card_status
|= CID_CSD_OVERWRITE
;
1922 /* Copy flag (OTP) & Permanent write protect */
1923 if (sd
->csd
[14] & ~sd
->data
[14] & 0x60)
1924 sd
->card_status
|= CID_CSD_OVERWRITE
;
1926 if (!(sd
->card_status
& CID_CSD_OVERWRITE
))
1927 for (i
= 0; i
< sizeof(sd
->csd
); i
++) {
1928 sd
->csd
[i
] |= sd_csd_rw_mask
[i
];
1929 sd
->csd
[i
] &= sd
->data
[i
];
1931 /* Bzzzzzzztt .... Operation complete. */
1932 sd
->state
= sd_transfer_state
;
1936 case 42: /* CMD42: LOCK_UNLOCK */
1937 sd
->data
[sd
->data_offset
++] = value
;
1938 if (sd
->data_offset
>= sd
->blk_len
) {
1939 /* TODO: Check CRC before committing */
1940 sd
->state
= sd_programming_state
;
1941 sd_lock_command(sd
);
1942 /* Bzzzzzzztt .... Operation complete. */
1943 sd
->state
= sd_transfer_state
;
1947 case 56: /* CMD56: GEN_CMD */
1948 sd
->data
[sd
->data_offset
++] = value
;
1949 if (sd
->data_offset
>= sd
->blk_len
) {
1950 APP_WRITE_BLOCK(sd
->data_start
, sd
->data_offset
);
1951 sd
->state
= sd_transfer_state
;
1956 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
1961 #define SD_TUNING_BLOCK_SIZE 64
1963 static const uint8_t sd_tuning_block_pattern
[SD_TUNING_BLOCK_SIZE
] = {
1964 /* See: Physical Layer Simplified Specification Version 3.01, Table 4-2 */
1965 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
1966 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
1967 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
1968 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
1969 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
1970 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
1971 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
1972 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde,
1975 uint8_t sd_read_byte(SDState
*sd
)
1977 /* TODO: Append CRCs */
1981 if (!sd
->blk
|| !blk_is_inserted(sd
->blk
) || !sd
->enable
)
1984 if (sd
->state
!= sd_sendingdata_state
) {
1985 qemu_log_mask(LOG_GUEST_ERROR
,
1986 "%s: not in Sending-Data state\n", __func__
);
1990 if (sd
->card_status
& (ADDRESS_ERROR
| WP_VIOLATION
))
1993 io_len
= (sd
->ocr
& (1 << 30)) ? 512 : sd
->blk_len
;
1995 trace_sdcard_read_data(sd
->proto_name
,
1996 sd_acmd_name(sd
->current_cmd
),
1997 sd
->current_cmd
, io_len
);
1998 switch (sd
->current_cmd
) {
1999 case 6: /* CMD6: SWITCH_FUNCTION */
2000 ret
= sd
->data
[sd
->data_offset
++];
2002 if (sd
->data_offset
>= 64)
2003 sd
->state
= sd_transfer_state
;
2006 case 9: /* CMD9: SEND_CSD */
2007 case 10: /* CMD10: SEND_CID */
2008 ret
= sd
->data
[sd
->data_offset
++];
2010 if (sd
->data_offset
>= 16)
2011 sd
->state
= sd_transfer_state
;
2014 case 13: /* ACMD13: SD_STATUS */
2015 ret
= sd
->sd_status
[sd
->data_offset
++];
2017 if (sd
->data_offset
>= sizeof(sd
->sd_status
))
2018 sd
->state
= sd_transfer_state
;
2021 case 17: /* CMD17: READ_SINGLE_BLOCK */
2022 if (sd
->data_offset
== 0)
2023 BLK_READ_BLOCK(sd
->data_start
, io_len
);
2024 ret
= sd
->data
[sd
->data_offset
++];
2026 if (sd
->data_offset
>= io_len
)
2027 sd
->state
= sd_transfer_state
;
2030 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2031 if (sd
->data_offset
== 0) {
2032 if (!address_in_range(sd
, "READ_MULTIPLE_BLOCK",
2033 sd
->data_start
, io_len
)) {
2036 BLK_READ_BLOCK(sd
->data_start
, io_len
);
2038 ret
= sd
->data
[sd
->data_offset
++];
2040 if (sd
->data_offset
>= io_len
) {
2041 sd
->data_start
+= io_len
;
2042 sd
->data_offset
= 0;
2044 if (sd
->multi_blk_cnt
!= 0) {
2045 if (--sd
->multi_blk_cnt
== 0) {
2047 sd
->state
= sd_transfer_state
;
2054 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2055 if (sd
->data_offset
>= SD_TUNING_BLOCK_SIZE
- 1) {
2056 sd
->state
= sd_transfer_state
;
2058 ret
= sd_tuning_block_pattern
[sd
->data_offset
++];
2061 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2062 ret
= sd
->data
[sd
->data_offset
++];
2064 if (sd
->data_offset
>= 4)
2065 sd
->state
= sd_transfer_state
;
2068 case 30: /* CMD30: SEND_WRITE_PROT */
2069 ret
= sd
->data
[sd
->data_offset
++];
2071 if (sd
->data_offset
>= 4)
2072 sd
->state
= sd_transfer_state
;
2075 case 51: /* ACMD51: SEND_SCR */
2076 ret
= sd
->scr
[sd
->data_offset
++];
2078 if (sd
->data_offset
>= sizeof(sd
->scr
))
2079 sd
->state
= sd_transfer_state
;
2082 case 56: /* CMD56: GEN_CMD */
2083 if (sd
->data_offset
== 0)
2084 APP_READ_BLOCK(sd
->data_start
, sd
->blk_len
);
2085 ret
= sd
->data
[sd
->data_offset
++];
2087 if (sd
->data_offset
>= sd
->blk_len
)
2088 sd
->state
= sd_transfer_state
;
2092 qemu_log_mask(LOG_GUEST_ERROR
, "%s: unknown command\n", __func__
);
2099 static bool sd_receive_ready(SDState
*sd
)
2101 return sd
->state
== sd_receivingdata_state
;
2104 static bool sd_data_ready(SDState
*sd
)
2106 return sd
->state
== sd_sendingdata_state
;
2109 void sd_enable(SDState
*sd
, bool enable
)
2111 sd
->enable
= enable
;
2114 static void sd_instance_init(Object
*obj
)
2116 SDState
*sd
= SD_CARD(obj
);
2119 sd
->ocr_power_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, sd_ocr_powerup
, sd
);
2122 static void sd_instance_finalize(Object
*obj
)
2124 SDState
*sd
= SD_CARD(obj
);
2126 timer_free(sd
->ocr_power_timer
);
2129 static void sd_realize(DeviceState
*dev
, Error
**errp
)
2131 SDState
*sd
= SD_CARD(dev
);
2134 sd
->proto_name
= sd
->spi
? "SPI" : "SD";
2136 switch (sd
->spec_version
) {
2137 case SD_PHY_SPECv1_10_VERS
2138 ... SD_PHY_SPECv3_01_VERS
:
2141 error_setg(errp
, "Invalid SD card Spec version: %u", sd
->spec_version
);
2148 if (!blk_supports_write_perm(sd
->blk
)) {
2149 error_setg(errp
, "Cannot use read-only drive as SD card");
2153 blk_size
= blk_getlength(sd
->blk
);
2154 if (blk_size
> 0 && !is_power_of_2(blk_size
)) {
2155 int64_t blk_size_aligned
= pow2ceil(blk_size
);
2158 blk_size_str
= size_to_str(blk_size
);
2159 error_setg(errp
, "Invalid SD card size: %s", blk_size_str
);
2160 g_free(blk_size_str
);
2162 blk_size_str
= size_to_str(blk_size_aligned
);
2163 error_append_hint(errp
,
2164 "SD card size has to be a power of 2, e.g. %s.\n"
2165 "You can resize disk images with"
2166 " 'qemu-img resize <imagefile> <new-size>'\n"
2167 "(note that this will lose data if you make the"
2168 " image smaller than it currently is).\n",
2170 g_free(blk_size_str
);
2175 ret
= blk_set_perm(sd
->blk
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE
,
2176 BLK_PERM_ALL
, errp
);
2180 blk_set_dev_ops(sd
->blk
, &sd_block_ops
, sd
);
2184 static Property sd_properties
[] = {
2185 DEFINE_PROP_UINT8("spec_version", SDState
,
2186 spec_version
, SD_PHY_SPECv2_00_VERS
),
2187 DEFINE_PROP_DRIVE("drive", SDState
, blk
),
2188 /* We do not model the chip select pin, so allow the board to select
2189 * whether card should be in SSI or MMC/SD mode. It is also up to the
2190 * board to ensure that ssi transfers only occur when the chip select
2192 DEFINE_PROP_BOOL("spi", SDState
, spi
, false),
2193 DEFINE_PROP_END_OF_LIST()
2196 static void sd_class_init(ObjectClass
*klass
, void *data
)
2198 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2199 SDCardClass
*sc
= SD_CARD_CLASS(klass
);
2201 dc
->realize
= sd_realize
;
2202 device_class_set_props(dc
, sd_properties
);
2203 dc
->vmsd
= &sd_vmstate
;
2204 dc
->reset
= sd_reset
;
2205 dc
->bus_type
= TYPE_SD_BUS
;
2206 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
2208 sc
->set_voltage
= sd_set_voltage
;
2209 sc
->get_dat_lines
= sd_get_dat_lines
;
2210 sc
->get_cmd_line
= sd_get_cmd_line
;
2211 sc
->do_command
= sd_do_command
;
2212 sc
->write_byte
= sd_write_byte
;
2213 sc
->read_byte
= sd_read_byte
;
2214 sc
->receive_ready
= sd_receive_ready
;
2215 sc
->data_ready
= sd_data_ready
;
2216 sc
->enable
= sd_enable
;
2217 sc
->get_inserted
= sd_get_inserted
;
2218 sc
->get_readonly
= sd_get_readonly
;
2221 static const TypeInfo sd_info
= {
2222 .name
= TYPE_SD_CARD
,
2223 .parent
= TYPE_DEVICE
,
2224 .instance_size
= sizeof(SDState
),
2225 .class_size
= sizeof(SDCardClass
),
2226 .class_init
= sd_class_init
,
2227 .instance_init
= sd_instance_init
,
2228 .instance_finalize
= sd_instance_finalize
,
2231 static void sd_register_types(void)
2233 type_register_static(&sd_info
);
2236 type_init(sd_register_types
)