hw/sd/sd.c

   1 /*
   2  * SD Memory Card emulation as defined in the "SD Memory Card Physical
   3  * layer specification, Version 1.10."
   4  *
   5  * Copyright (c) 2006 Andrzej Zaborowski  <[email protected]>
   6  * Copyright (c) 2007 CodeSourcery
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the
  17  *    distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
  20  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
  23  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  25  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  26  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  27  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  */
  31
  32 #include "qemu/osdep.h"
  33 #include "hw/qdev.h"
  34 #include "hw/hw.h"
  35 #include "sysemu/block-backend.h"
  36 #include "hw/sd/sd.h"
  37 #include "qapi/error.h"
  38 #include "qemu/bitmap.h"
  39 #include "hw/qdev-properties.h"
  40 #include "qemu/error-report.h"
  41 #include "qemu/timer.h"
  42 #include "qemu/log.h"
  43 #include "trace.h"
  44
  45 //#define DEBUG_SD 1
  46
  47 #ifdef DEBUG_SD
  48 #define DPRINTF(fmt, ...) \
  49 do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
  50 #else
  51 #define DPRINTF(fmt, ...) do {} while(0)
  52 #endif
  53
  54 #define ACMD41_ENQUIRY_MASK     0x00ffffff
  55 #define OCR_POWER_UP            0x80000000
  56 #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
  57
  58 typedef enum {
  59     sd_r0 = 0,    /* no response */
  60     sd_r1,        /* normal response command */
  61     sd_r2_i,      /* CID register */
  62     sd_r2_s,      /* CSD register */
  63     sd_r3,        /* OCR register */
  64     sd_r6 = 6,    /* Published RCA response */
  65     sd_r7,        /* Operating voltage */
  66     sd_r1b = -1,
  67     sd_illegal = -2,
  68 } sd_rsp_type_t;
  69
  70 enum SDCardModes {
  71     sd_inactive,
  72     sd_card_identification_mode,
  73     sd_data_transfer_mode,
  74 };
  75
  76 enum SDCardStates {
  77     sd_inactive_state = -1,
  78     sd_idle_state = 0,
  79     sd_ready_state,
  80     sd_identification_state,
  81     sd_standby_state,
  82     sd_transfer_state,
  83     sd_sendingdata_state,
  84     sd_receivingdata_state,
  85     sd_programming_state,
  86     sd_disconnect_state,
  87 };
  88
  89 struct SDState {
  90     DeviceState parent_obj;
  91
  92     /* SD Memory Card Registers */
  93     uint32_t ocr;
  94     uint8_t scr[8];
  95     uint8_t cid[16];
  96     uint8_t csd[16];
  97     uint16_t rca;
  98     uint32_t card_status;
  99     uint8_t sd_status[64];
 100
 101     /* Configurable properties */
 102     BlockBackend *blk;
 103     bool spi;
 104
 105     uint32_t mode;    /* current card mode, one of SDCardModes */
 106     int32_t state;    /* current card state, one of SDCardStates */
 107     uint32_t vhs;
 108     bool wp_switch;
 109     unsigned long *wp_groups;
 110     int32_t wpgrps_size;
 111     uint64_t size;
 112     uint32_t blk_len;
 113     uint32_t multi_blk_cnt;
 114     uint32_t erase_start;
 115     uint32_t erase_end;
 116     uint8_t pwd[16];
 117     uint32_t pwd_len;
 118     uint8_t function_group[6];
 119     uint8_t current_cmd;
 120     /* True if we will handle the next command as an ACMD. Note that this does
 121      * *not* track the APP_CMD status bit!
 122      */
 123     bool expecting_acmd;
 124     uint32_t blk_written;
 125     uint64_t data_start;
 126     uint32_t data_offset;
 127     uint8_t data[512];
 128     qemu_irq readonly_cb;
 129     qemu_irq inserted_cb;
 130     QEMUTimer *ocr_power_timer;
 131     bool enable;
 132     uint8_t dat_lines;
 133     bool cmd_line;
 134 };
 135
 136 static const char *sd_state_name(enum SDCardStates state)
 137 {
 138     static const char *state_name[] = {
 139         [sd_idle_state]             = "idle",
 140         [sd_ready_state]            = "ready",
 141         [sd_identification_state]   = "identification",
 142         [sd_standby_state]          = "standby",
 143         [sd_transfer_state]         = "transfer",
 144         [sd_sendingdata_state]      = "sendingdata",
 145         [sd_receivingdata_state]    = "receivingdata",
 146         [sd_programming_state]      = "programming",
 147         [sd_disconnect_state]       = "disconnect",
 148     };
 149     if (state == sd_inactive_state) {
 150         return "inactive";
 151     }
 152     assert(state <= ARRAY_SIZE(state_name));
 153     return state_name[state];
 154 }
 155
 156 static uint8_t sd_get_dat_lines(SDState *sd)
 157 {
 158     return sd->enable ? sd->dat_lines : 0;
 159 }
 160
 161 static bool sd_get_cmd_line(SDState *sd)
 162 {
 163     return sd->enable ? sd->cmd_line : false;
 164 }
 165
 166 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
 167 {
 168     switch (millivolts) {
 169     case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
 170     case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
 171         break;
 172     default:
 173         qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
 174                       millivolts / 1000.f);
 175     }
 176 }
 177
 178 static void sd_set_mode(SDState *sd)
 179 {
 180     switch (sd->state) {
 181     case sd_inactive_state:
 182         sd->mode = sd_inactive;
 183         break;
 184
 185     case sd_idle_state:
 186     case sd_ready_state:
 187     case sd_identification_state:
 188         sd->mode = sd_card_identification_mode;
 189         break;
 190
 191     case sd_standby_state:
 192     case sd_transfer_state:
 193     case sd_sendingdata_state:
 194     case sd_receivingdata_state:
 195     case sd_programming_state:
 196     case sd_disconnect_state:
 197         sd->mode = sd_data_transfer_mode;
 198         break;
 199     }
 200 }
 201
 202 static const sd_cmd_type_t sd_cmd_type[64] = {
 203     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
 204     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
 205     sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
 206     sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
 207     sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
 208     sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
 209     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
 210     sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
 211 };
 212
 213 static const int sd_cmd_class[64] = {
 214     0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
 215     2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
 216     5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
 217     7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
 218 };
 219
 220 static uint8_t sd_crc7(void *message, size_t width)
 221 {
 222     int i, bit;
 223     uint8_t shift_reg = 0x00;
 224     uint8_t *msg = (uint8_t *) message;
 225
 226     for (i = 0; i < width; i ++, msg ++)
 227         for (bit = 7; bit >= 0; bit --) {
 228             shift_reg <<= 1;
 229             if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
 230                 shift_reg ^= 0x89;
 231         }
 232
 233     return shift_reg;
 234 }
 235
 236 static uint16_t sd_crc16(void *message, size_t width)
 237 {
 238     int i, bit;
 239     uint16_t shift_reg = 0x0000;
 240     uint16_t *msg = (uint16_t *) message;
 241     width <<= 1;
 242
 243     for (i = 0; i < width; i ++, msg ++)
 244         for (bit = 15; bit >= 0; bit --) {
 245             shift_reg <<= 1;
 246             if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
 247                 shift_reg ^= 0x1011;
 248         }
 249
 250     return shift_reg;
 251 }
 252
 253 static void sd_set_ocr(SDState *sd)
 254 {
 255     /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
 256     sd->ocr = 0x00ffff00;
 257 }
 258
 259 static void sd_ocr_powerup(void *opaque)
 260 {
 261     SDState *sd = opaque;
 262
 263     /* Set powered up bit in OCR */
 264     assert(!(sd->ocr & OCR_POWER_UP));
 265     sd->ocr |= OCR_POWER_UP;
 266 }
 267
 268 static void sd_set_scr(SDState *sd)
 269 {
 270     sd->scr[0] = 0x00;          /* SCR Structure */
 271     sd->scr[1] = 0x2f;          /* SD Security Support */
 272     sd->scr[2] = 0x00;
 273     sd->scr[3] = 0x00;
 274     sd->scr[4] = 0x00;
 275     sd->scr[5] = 0x00;
 276     sd->scr[6] = 0x00;
 277     sd->scr[7] = 0x00;
 278 }
 279
 280 #define MID     0xaa
 281 #define OID     "XY"
 282 #define PNM     "QEMU!"
 283 #define PRV     0x01
 284 #define MDT_YR  2006
 285 #define MDT_MON 2
 286
 287 static void sd_set_cid(SDState *sd)
 288 {
 289     sd->cid[0] = MID;           /* Fake card manufacturer ID (MID) */
 290     sd->cid[1] = OID[0];        /* OEM/Application ID (OID) */
 291     sd->cid[2] = OID[1];
 292     sd->cid[3] = PNM[0];        /* Fake product name (PNM) */
 293     sd->cid[4] = PNM[1];
 294     sd->cid[5] = PNM[2];
 295     sd->cid[6] = PNM[3];
 296     sd->cid[7] = PNM[4];
 297     sd->cid[8] = PRV;           /* Fake product revision (PRV) */
 298     sd->cid[9] = 0xde;          /* Fake serial number (PSN) */
 299     sd->cid[10] = 0xad;
 300     sd->cid[11] = 0xbe;
 301     sd->cid[12] = 0xef;
 302     sd->cid[13] = 0x00 |        /* Manufacture date (MDT) */
 303         ((MDT_YR - 2000) / 10);
 304     sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
 305     sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
 306 }
 307
 308 #define HWBLOCK_SHIFT   9                       /* 512 bytes */
 309 #define SECTOR_SHIFT    5                       /* 16 kilobytes */
 310 #define WPGROUP_SHIFT   7                       /* 2 megs */
 311 #define CMULT_SHIFT     9                       /* 512 times HWBLOCK_SIZE */
 312 #define WPGROUP_SIZE    (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
 313
 314 static const uint8_t sd_csd_rw_mask[16] = {
 315     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 316     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
 317 };
 318
 319 static void sd_set_csd(SDState *sd, uint64_t size)
 320 {
 321     uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
 322     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
 323     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
 324
 325     if (size <= 0x40000000) {   /* Standard Capacity SD */
 326         sd->csd[0] = 0x00;      /* CSD structure */
 327         sd->csd[1] = 0x26;      /* Data read access-time-1 */
 328         sd->csd[2] = 0x00;      /* Data read access-time-2 */
 329         sd->csd[3] = 0x5a;      /* Max. data transfer rate */
 330         sd->csd[4] = 0x5f;      /* Card Command Classes */
 331         sd->csd[5] = 0x50 |     /* Max. read data block length */
 332             HWBLOCK_SHIFT;
 333         sd->csd[6] = 0xe0 |     /* Partial block for read allowed */
 334             ((csize >> 10) & 0x03);
 335         sd->csd[7] = 0x00 |     /* Device size */
 336             ((csize >> 2) & 0xff);
 337         sd->csd[8] = 0x3f |     /* Max. read current */
 338             ((csize << 6) & 0xc0);
 339         sd->csd[9] = 0xfc |     /* Max. write current */
 340             ((CMULT_SHIFT - 2) >> 1);
 341         sd->csd[10] = 0x40 |    /* Erase sector size */
 342             (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
 343         sd->csd[11] = 0x00 |    /* Write protect group size */
 344             ((sectsize << 7) & 0x80) | wpsize;
 345         sd->csd[12] = 0x90 |    /* Write speed factor */
 346             (HWBLOCK_SHIFT >> 2);
 347         sd->csd[13] = 0x20 |    /* Max. write data block length */
 348             ((HWBLOCK_SHIFT << 6) & 0xc0);
 349         sd->csd[14] = 0x00;     /* File format group */
 350         sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
 351     } else {                    /* SDHC */
 352         size /= 512 * 1024;
 353         size -= 1;
 354         sd->csd[0] = 0x40;
 355         sd->csd[1] = 0x0e;
 356         sd->csd[2] = 0x00;
 357         sd->csd[3] = 0x32;
 358         sd->csd[4] = 0x5b;
 359         sd->csd[5] = 0x59;
 360         sd->csd[6] = 0x00;
 361         sd->csd[7] = (size >> 16) & 0xff;
 362         sd->csd[8] = (size >> 8) & 0xff;
 363         sd->csd[9] = (size & 0xff);
 364         sd->csd[10] = 0x7f;
 365         sd->csd[11] = 0x80;
 366         sd->csd[12] = 0x0a;
 367         sd->csd[13] = 0x40;
 368         sd->csd[14] = 0x00;
 369         sd->csd[15] = 0x00;
 370         sd->ocr |= 1 << 30;     /* High Capacity SD Memory Card */
 371     }
 372 }
 373
 374 static void sd_set_rca(SDState *sd)
 375 {
 376     sd->rca += 0x4567;
 377 }
 378
 379 /* Card status bits, split by clear condition:
 380  * A : According to the card current state
 381  * B : Always related to the previous command
 382  * C : Cleared by read
 383  */
 384 #define CARD_STATUS_A   0x02004100
 385 #define CARD_STATUS_B   0x00c01e00
 386 #define CARD_STATUS_C   0xfd39a028
 387
 388 static void sd_set_cardstatus(SDState *sd)
 389 {
 390     sd->card_status = 0x00000100;
 391 }
 392
 393 static void sd_set_sdstatus(SDState *sd)
 394 {
 395     memset(sd->sd_status, 0, 64);
 396 }
 397
 398 static int sd_req_crc_validate(SDRequest *req)
 399 {
 400     uint8_t buffer[5];
 401     buffer[0] = 0x40 | req->cmd;
 402     buffer[1] = (req->arg >> 24) & 0xff;
 403     buffer[2] = (req->arg >> 16) & 0xff;
 404     buffer[3] = (req->arg >> 8) & 0xff;
 405     buffer[4] = (req->arg >> 0) & 0xff;
 406     return 0;
 407     return sd_crc7(buffer, 5) != req->crc;      /* TODO */
 408 }
 409
 410 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 411 {
 412     uint32_t status = sd->card_status;
 413     /* Clear the "clear on read" status bits */
 414     sd->card_status &= ~CARD_STATUS_C;
 415
 416     response[0] = (status >> 24) & 0xff;
 417     response[1] = (status >> 16) & 0xff;
 418     response[2] = (status >> 8) & 0xff;
 419     response[3] = (status >> 0) & 0xff;
 420 }
 421
 422 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 423 {
 424     response[0] = (sd->ocr >> 24) & 0xff;
 425     response[1] = (sd->ocr >> 16) & 0xff;
 426     response[2] = (sd->ocr >> 8) & 0xff;
 427     response[3] = (sd->ocr >> 0) & 0xff;
 428 }
 429
 430 static void sd_response_r6_make(SDState *sd, uint8_t *response)
 431 {
 432     uint16_t arg;
 433     uint16_t status;
 434
 435     arg = sd->rca;
 436     status = ((sd->card_status >> 8) & 0xc000) |
 437              ((sd->card_status >> 6) & 0x2000) |
 438               (sd->card_status & 0x1fff);
 439     sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
 440
 441     response[0] = (arg >> 8) & 0xff;
 442     response[1] = arg & 0xff;
 443     response[2] = (status >> 8) & 0xff;
 444     response[3] = status & 0xff;
 445 }
 446
 447 static void sd_response_r7_make(SDState *sd, uint8_t *response)
 448 {
 449     response[0] = (sd->vhs >> 24) & 0xff;
 450     response[1] = (sd->vhs >> 16) & 0xff;
 451     response[2] = (sd->vhs >>  8) & 0xff;
 452     response[3] = (sd->vhs >>  0) & 0xff;
 453 }
 454
 455 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
 456 {
 457     return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
 458 }
 459
 460 static void sd_reset(DeviceState *dev)
 461 {
 462     SDState *sd = SD_CARD(dev);
 463     uint64_t size;
 464     uint64_t sect;
 465
 466     if (sd->blk) {
 467         blk_get_geometry(sd->blk, &sect);
 468     } else {
 469         sect = 0;
 470     }
 471     size = sect << 9;
 472
 473     sect = sd_addr_to_wpnum(size) + 1;
 474
 475     sd->state = sd_idle_state;
 476     sd->rca = 0x0000;
 477     sd_set_ocr(sd);
 478     sd_set_scr(sd);
 479     sd_set_cid(sd);
 480     sd_set_csd(sd, size);
 481     sd_set_cardstatus(sd);
 482     sd_set_sdstatus(sd);
 483
 484     g_free(sd->wp_groups);
 485     sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;
 486     sd->wpgrps_size = sect;
 487     sd->wp_groups = bitmap_new(sd->wpgrps_size);
 488     memset(sd->function_group, 0, sizeof(sd->function_group));
 489     sd->erase_start = 0;
 490     sd->erase_end = 0;
 491     sd->size = size;
 492     sd->blk_len = 0x200;
 493     sd->pwd_len = 0;
 494     sd->expecting_acmd = false;
 495     sd->dat_lines = 0xf;
 496     sd->cmd_line = true;
 497     sd->multi_blk_cnt = 0;
 498 }
 499
 500 static bool sd_get_inserted(SDState *sd)
 501 {
 502     return sd->blk && blk_is_inserted(sd->blk);
 503 }
 504
 505 static bool sd_get_readonly(SDState *sd)
 506 {
 507     return sd->wp_switch;
 508 }
 509
 510 static void sd_cardchange(void *opaque, bool load, Error **errp)
 511 {
 512     SDState *sd = opaque;
 513     DeviceState *dev = DEVICE(sd);
 514     SDBus *sdbus = SD_BUS(qdev_get_parent_bus(dev));
 515     bool inserted = sd_get_inserted(sd);
 516     bool readonly = sd_get_readonly(sd);
 517
 518     if (inserted) {
 519         sd_reset(dev);
 520     }
 521
 522     /* The IRQ notification is for legacy non-QOM SD controller devices;
 523      * QOMified controllers use the SDBus APIs.
 524      */
 525     if (sdbus) {
 526         sdbus_set_inserted(sdbus, inserted);
 527         if (inserted) {
 528             sdbus_set_readonly(sdbus, readonly);
 529         }
 530     } else {
 531         qemu_set_irq(sd->inserted_cb, inserted);
 532         if (inserted) {
 533             qemu_set_irq(sd->readonly_cb, readonly);
 534         }
 535     }
 536 }
 537
 538 static const BlockDevOps sd_block_ops = {
 539     .change_media_cb = sd_cardchange,
 540 };
 541
 542 static bool sd_ocr_vmstate_needed(void *opaque)
 543 {
 544     SDState *sd = opaque;
 545
 546     /* Include the OCR state (and timer) if it is not yet powered up */
 547     return !(sd->ocr & OCR_POWER_UP);
 548 }
 549
 550 static const VMStateDescription sd_ocr_vmstate = {
 551     .name = "sd-card/ocr-state",
 552     .version_id = 1,
 553     .minimum_version_id = 1,
 554     .needed = sd_ocr_vmstate_needed,
 555     .fields = (VMStateField[]) {
 556         VMSTATE_UINT32(ocr, SDState),
 557         VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
 558         VMSTATE_END_OF_LIST()
 559     },
 560 };
 561
 562 static int sd_vmstate_pre_load(void *opaque)
 563 {
 564     SDState *sd = opaque;
 565
 566     /* If the OCR state is not included (prior versions, or not
 567      * needed), then the OCR must be set as powered up. If the OCR state
 568      * is included, this will be replaced by the state restore.
 569      */
 570     sd_ocr_powerup(sd);
 571
 572     return 0;
 573 }
 574
 575 static const VMStateDescription sd_vmstate = {
 576     .name = "sd-card",
 577     .version_id = 1,
 578     .minimum_version_id = 1,
 579     .pre_load = sd_vmstate_pre_load,
 580     .fields = (VMStateField[]) {
 581         VMSTATE_UINT32(mode, SDState),
 582         VMSTATE_INT32(state, SDState),
 583         VMSTATE_UINT8_ARRAY(cid, SDState, 16),
 584         VMSTATE_UINT8_ARRAY(csd, SDState, 16),
 585         VMSTATE_UINT16(rca, SDState),
 586         VMSTATE_UINT32(card_status, SDState),
 587         VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
 588         VMSTATE_UINT32(vhs, SDState),
 589         VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size),
 590         VMSTATE_UINT32(blk_len, SDState),
 591         VMSTATE_UINT32(multi_blk_cnt, SDState),
 592         VMSTATE_UINT32(erase_start, SDState),
 593         VMSTATE_UINT32(erase_end, SDState),
 594         VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
 595         VMSTATE_UINT32(pwd_len, SDState),
 596         VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
 597         VMSTATE_UINT8(current_cmd, SDState),
 598         VMSTATE_BOOL(expecting_acmd, SDState),
 599         VMSTATE_UINT32(blk_written, SDState),
 600         VMSTATE_UINT64(data_start, SDState),
 601         VMSTATE_UINT32(data_offset, SDState),
 602         VMSTATE_UINT8_ARRAY(data, SDState, 512),
 603         VMSTATE_UNUSED_V(1, 512),
 604         VMSTATE_BOOL(enable, SDState),
 605         VMSTATE_END_OF_LIST()
 606     },
 607     .subsections = (const VMStateDescription*[]) {
 608         &sd_ocr_vmstate,
 609         NULL
 610     },
 611 };
 612
 613 /* Legacy initialization function for use by non-qdevified callers */
 614 SDState *sd_init(BlockBackend *blk, bool is_spi)
 615 {
 616     Object *obj;
 617     DeviceState *dev;
 618     Error *err = NULL;
 619
 620     obj = object_new(TYPE_SD_CARD);
 621     dev = DEVICE(obj);
 622     qdev_prop_set_drive(dev, "drive", blk, &err);
 623     if (err) {
 624         error_report("sd_init failed: %s", error_get_pretty(err));
 625         return NULL;
 626     }
 627     qdev_prop_set_bit(dev, "spi", is_spi);
 628     object_property_set_bool(obj, true, "realized", &err);
 629     if (err) {
 630         error_report("sd_init failed: %s", error_get_pretty(err));
 631         return NULL;
 632     }
 633
 634     return SD_CARD(dev);
 635 }
 636
 637 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
 638 {
 639     sd->readonly_cb = readonly;
 640     sd->inserted_cb = insert;
 641     qemu_set_irq(readonly, sd->blk ? blk_is_read_only(sd->blk) : 0);
 642     qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
 643 }
 644
 645 static void sd_erase(SDState *sd)
 646 {
 647     int i;
 648     uint64_t erase_start = sd->erase_start;
 649     uint64_t erase_end = sd->erase_end;
 650
 651     if (!sd->erase_start || !sd->erase_end) {
 652         sd->card_status |= ERASE_SEQ_ERROR;
 653         return;
 654     }
 655
 656     if (extract32(sd->ocr, OCR_CCS_BITN, 1)) {
 657         /* High capacity memory card: erase units are 512 byte blocks */
 658         erase_start *= 512;
 659         erase_end *= 512;
 660     }
 661
 662     erase_start = sd_addr_to_wpnum(erase_start);
 663     erase_end = sd_addr_to_wpnum(erase_end);
 664     sd->erase_start = 0;
 665     sd->erase_end = 0;
 666     sd->csd[14] |= 0x40;
 667
 668     for (i = erase_start; i <= erase_end; i++) {
 669         if (test_bit(i, sd->wp_groups)) {
 670             sd->card_status |= WP_ERASE_SKIP;
 671         }
 672     }
 673 }
 674
 675 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
 676 {
 677     uint32_t i, wpnum;
 678     uint32_t ret = 0;
 679
 680     wpnum = sd_addr_to_wpnum(addr);
 681
 682     for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
 683         if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
 684             ret |= (1 << i);
 685         }
 686     }
 687
 688     return ret;
 689 }
 690
 691 static void sd_function_switch(SDState *sd, uint32_t arg)
 692 {
 693     int i, mode, new_func, crc;
 694     mode = !!(arg & 0x80000000);
 695
 696     sd->data[0] = 0x00;         /* Maximum current consumption */
 697     sd->data[1] = 0x01;
 698     sd->data[2] = 0x80;         /* Supported group 6 functions */
 699     sd->data[3] = 0x01;
 700     sd->data[4] = 0x80;         /* Supported group 5 functions */
 701     sd->data[5] = 0x01;
 702     sd->data[6] = 0x80;         /* Supported group 4 functions */
 703     sd->data[7] = 0x01;
 704     sd->data[8] = 0x80;         /* Supported group 3 functions */
 705     sd->data[9] = 0x01;
 706     sd->data[10] = 0x80;        /* Supported group 2 functions */
 707     sd->data[11] = 0x43;
 708     sd->data[12] = 0x80;        /* Supported group 1 functions */
 709     sd->data[13] = 0x03;
 710     for (i = 0; i < 6; i ++) {
 711         new_func = (arg >> (i * 4)) & 0x0f;
 712         if (mode && new_func != 0x0f)
 713             sd->function_group[i] = new_func;
 714         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
 715     }
 716     memset(&sd->data[17], 0, 47);
 717     crc = sd_crc16(sd->data, 64);
 718     sd->data[65] = crc >> 8;
 719     sd->data[66] = crc & 0xff;
 720 }
 721
 722 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 723 {
 724     return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
 725 }
 726
 727 static void sd_lock_command(SDState *sd)
 728 {
 729     int erase, lock, clr_pwd, set_pwd, pwd_len;
 730     erase = !!(sd->data[0] & 0x08);
 731     lock = sd->data[0] & 0x04;
 732     clr_pwd = sd->data[0] & 0x02;
 733     set_pwd = sd->data[0] & 0x01;
 734
 735     if (sd->blk_len > 1)
 736         pwd_len = sd->data[1];
 737     else
 738         pwd_len = 0;
 739
 740     if (erase) {
 741         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
 742                         set_pwd || clr_pwd || lock || sd->wp_switch ||
 743                         (sd->csd[14] & 0x20)) {
 744             sd->card_status |= LOCK_UNLOCK_FAILED;
 745             return;
 746         }
 747         bitmap_zero(sd->wp_groups, sd->wpgrps_size);
 748         sd->csd[14] &= ~0x10;
 749         sd->card_status &= ~CARD_IS_LOCKED;
 750         sd->pwd_len = 0;
 751         /* Erasing the entire card here! */
 752         fprintf(stderr, "SD: Card force-erased by CMD42\n");
 753         return;
 754     }
 755
 756     if (sd->blk_len < 2 + pwd_len ||
 757                     pwd_len <= sd->pwd_len ||
 758                     pwd_len > sd->pwd_len + 16) {
 759         sd->card_status |= LOCK_UNLOCK_FAILED;
 760         return;
 761     }
 762
 763     if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
 764         sd->card_status |= LOCK_UNLOCK_FAILED;
 765         return;
 766     }
 767
 768     pwd_len -= sd->pwd_len;
 769     if ((pwd_len && !set_pwd) ||
 770                     (clr_pwd && (set_pwd || lock)) ||
 771                     (lock && !sd->pwd_len && !set_pwd) ||
 772                     (!set_pwd && !clr_pwd &&
 773                      (((sd->card_status & CARD_IS_LOCKED) && lock) ||
 774                       (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
 775         sd->card_status |= LOCK_UNLOCK_FAILED;
 776         return;
 777     }
 778
 779     if (set_pwd) {
 780         memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
 781         sd->pwd_len = pwd_len;
 782     }
 783
 784     if (clr_pwd) {
 785         sd->pwd_len = 0;
 786     }
 787
 788     if (lock)
 789         sd->card_status |= CARD_IS_LOCKED;
 790     else
 791         sd->card_status &= ~CARD_IS_LOCKED;
 792 }
 793
 794 static sd_rsp_type_t sd_normal_command(SDState *sd,
 795                                        SDRequest req)
 796 {
 797     uint32_t rca = 0x0000;
 798     uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
 799
 800     trace_sdcard_normal_command(req.cmd, req.arg, sd_state_name(sd->state));
 801
 802     /* Not interpreting this as an app command */
 803     sd->card_status &= ~APP_CMD;
 804
 805     if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
 806         || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
 807         rca = req.arg >> 16;
 808     }
 809
 810     /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
 811      * if not, its effects are cancelled */
 812     if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
 813         sd->multi_blk_cnt = 0;
 814     }
 815
 816     switch (req.cmd) {
 817     /* Basic commands (Class 0 and Class 1) */
 818     case 0:     /* CMD0:   GO_IDLE_STATE */
 819         switch (sd->state) {
 820         case sd_inactive_state:
 821             return sd->spi ? sd_r1 : sd_r0;
 822
 823         default:
 824             sd->state = sd_idle_state;
 825             sd_reset(DEVICE(sd));
 826             return sd->spi ? sd_r1 : sd_r0;
 827         }
 828         break;
 829
 830     case 1:     /* CMD1:   SEND_OP_CMD */
 831         if (!sd->spi)
 832             goto bad_cmd;
 833
 834         sd->state = sd_transfer_state;
 835         return sd_r1;
 836
 837     case 2:     /* CMD2:   ALL_SEND_CID */
 838         if (sd->spi)
 839             goto bad_cmd;
 840         switch (sd->state) {
 841         case sd_ready_state:
 842             sd->state = sd_identification_state;
 843             return sd_r2_i;
 844
 845         default:
 846             break;
 847         }
 848         break;
 849
 850     case 3:     /* CMD3:   SEND_RELATIVE_ADDR */
 851         if (sd->spi)
 852             goto bad_cmd;
 853         switch (sd->state) {
 854         case sd_identification_state:
 855         case sd_standby_state:
 856             sd->state = sd_standby_state;
 857             sd_set_rca(sd);
 858             return sd_r6;
 859
 860         default:
 861             break;
 862         }
 863         break;
 864
 865     case 4:     /* CMD4:   SEND_DSR */
 866         if (sd->spi)
 867             goto bad_cmd;
 868         switch (sd->state) {
 869         case sd_standby_state:
 870             break;
 871
 872         default:
 873             break;
 874         }
 875         break;
 876
 877     case 5: /* CMD5: reserved for SDIO cards */
 878         return sd_illegal;
 879
 880     case 6:     /* CMD6:   SWITCH_FUNCTION */
 881         if (sd->spi)
 882             goto bad_cmd;
 883         switch (sd->mode) {
 884         case sd_data_transfer_mode:
 885             sd_function_switch(sd, req.arg);
 886             sd->state = sd_sendingdata_state;
 887             sd->data_start = 0;
 888             sd->data_offset = 0;
 889             return sd_r1;
 890
 891         default:
 892             break;
 893         }
 894         break;
 895
 896     case 7:     /* CMD7:   SELECT/DESELECT_CARD */
 897         if (sd->spi)
 898             goto bad_cmd;
 899         switch (sd->state) {
 900         case sd_standby_state:
 901             if (sd->rca != rca)
 902                 return sd_r0;
 903
 904             sd->state = sd_transfer_state;
 905             return sd_r1b;
 906
 907         case sd_transfer_state:
 908         case sd_sendingdata_state:
 909             if (sd->rca == rca)
 910                 break;
 911
 912             sd->state = sd_standby_state;
 913             return sd_r1b;
 914
 915         case sd_disconnect_state:
 916             if (sd->rca != rca)
 917                 return sd_r0;
 918
 919             sd->state = sd_programming_state;
 920             return sd_r1b;
 921
 922         case sd_programming_state:
 923             if (sd->rca == rca)
 924                 break;
 925
 926             sd->state = sd_disconnect_state;
 927             return sd_r1b;
 928
 929         default:
 930             break;
 931         }
 932         break;
 933
 934     case 8:     /* CMD8:   SEND_IF_COND */
 935         /* Physical Layer Specification Version 2.00 command */
 936         switch (sd->state) {
 937         case sd_idle_state:
 938             sd->vhs = 0;
 939
 940             /* No response if not exactly one VHS bit is set.  */
 941             if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
 942                 return sd->spi ? sd_r7 : sd_r0;
 943             }
 944
 945             /* Accept.  */
 946             sd->vhs = req.arg;
 947             return sd_r7;
 948
 949         default:
 950             break;
 951         }
 952         break;
 953
 954     case 9:     /* CMD9:   SEND_CSD */
 955         switch (sd->state) {
 956         case sd_standby_state:
 957             if (sd->rca != rca)
 958                 return sd_r0;
 959
 960             return sd_r2_s;
 961
 962         case sd_transfer_state:
 963             if (!sd->spi)
 964                 break;
 965             sd->state = sd_sendingdata_state;
 966             memcpy(sd->data, sd->csd, 16);
 967             sd->data_start = addr;
 968             sd->data_offset = 0;
 969             return sd_r1;
 970
 971         default:
 972             break;
 973         }
 974         break;
 975
 976     case 10:    /* CMD10:  SEND_CID */
 977         switch (sd->state) {
 978         case sd_standby_state:
 979             if (sd->rca != rca)
 980                 return sd_r0;
 981
 982             return sd_r2_i;
 983
 984         case sd_transfer_state:
 985             if (!sd->spi)
 986                 break;
 987             sd->state = sd_sendingdata_state;
 988             memcpy(sd->data, sd->cid, 16);
 989             sd->data_start = addr;
 990             sd->data_offset = 0;
 991             return sd_r1;
 992
 993         default:
 994             break;
 995         }
 996         break;
 997
 998     case 11:    /* CMD11:  READ_DAT_UNTIL_STOP */
 999         if (sd->spi)
1000             goto bad_cmd;
1001         switch (sd->state) {
1002         case sd_transfer_state:
1003             sd->state = sd_sendingdata_state;
1004             sd->data_start = req.arg;
1005             sd->data_offset = 0;
1006
1007             if (sd->data_start + sd->blk_len > sd->size)
1008                 sd->card_status |= ADDRESS_ERROR;
1009             return sd_r0;
1010
1011         default:
1012             break;
1013         }
1014         break;
1015
1016     case 12:    /* CMD12:  STOP_TRANSMISSION */
1017         switch (sd->state) {
1018         case sd_sendingdata_state:
1019             sd->state = sd_transfer_state;
1020             return sd_r1b;
1021
1022         case sd_receivingdata_state:
1023             sd->state = sd_programming_state;
1024             /* Bzzzzzzztt .... Operation complete.  */
1025             sd->state = sd_transfer_state;
1026             return sd_r1b;
1027
1028         default:
1029             break;
1030         }
1031         break;
1032
1033     case 13:    /* CMD13:  SEND_STATUS */
1034         switch (sd->mode) {
1035         case sd_data_transfer_mode:
1036             if (sd->rca != rca)
1037                 return sd_r0;
1038
1039             return sd_r1;
1040
1041         default:
1042             break;
1043         }
1044         break;
1045
1046     case 15:    /* CMD15:  GO_INACTIVE_STATE */
1047         if (sd->spi)
1048             goto bad_cmd;
1049         switch (sd->mode) {
1050         case sd_data_transfer_mode:
1051             if (sd->rca != rca)
1052                 return sd_r0;
1053
1054             sd->state = sd_inactive_state;
1055             return sd_r0;
1056
1057         default:
1058             break;
1059         }
1060         break;
1061
1062     /* Block read commands (Classs 2) */
1063     case 16:    /* CMD16:  SET_BLOCKLEN */
1064         switch (sd->state) {
1065         case sd_transfer_state:
1066             if (req.arg > (1 << HWBLOCK_SHIFT))
1067                 sd->card_status |= BLOCK_LEN_ERROR;
1068             else
1069                 sd->blk_len = req.arg;
1070
1071             return sd_r1;
1072
1073         default:
1074             break;
1075         }
1076         break;
1077
1078     case 17:    /* CMD17:  READ_SINGLE_BLOCK */
1079         switch (sd->state) {
1080         case sd_transfer_state:
1081             sd->state = sd_sendingdata_state;
1082             sd->data_start = addr;
1083             sd->data_offset = 0;
1084
1085             if (sd->data_start + sd->blk_len > sd->size)
1086                 sd->card_status |= ADDRESS_ERROR;
1087             return sd_r1;
1088
1089         default:
1090             break;
1091         }
1092         break;
1093
1094     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
1095         switch (sd->state) {
1096         case sd_transfer_state:
1097             sd->state = sd_sendingdata_state;
1098             sd->data_start = addr;
1099             sd->data_offset = 0;
1100
1101             if (sd->data_start + sd->blk_len > sd->size)
1102                 sd->card_status |= ADDRESS_ERROR;
1103             return sd_r1;
1104
1105         default:
1106             break;
1107         }
1108         break;
1109
1110     case 23:    /* CMD23: SET_BLOCK_COUNT */
1111         switch (sd->state) {
1112         case sd_transfer_state:
1113             sd->multi_blk_cnt = req.arg;
1114             return sd_r1;
1115
1116         default:
1117             break;
1118         }
1119         break;
1120
1121     /* Block write commands (Class 4) */
1122     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
1123         if (sd->spi)
1124             goto unimplemented_cmd;
1125         switch (sd->state) {
1126         case sd_transfer_state:
1127             /* Writing in SPI mode not implemented.  */
1128             if (sd->spi)
1129                 break;
1130             sd->state = sd_receivingdata_state;
1131             sd->data_start = addr;
1132             sd->data_offset = 0;
1133             sd->blk_written = 0;
1134
1135             if (sd->data_start + sd->blk_len > sd->size)
1136                 sd->card_status |= ADDRESS_ERROR;
1137             if (sd_wp_addr(sd, sd->data_start))
1138                 sd->card_status |= WP_VIOLATION;
1139             if (sd->csd[14] & 0x30)
1140                 sd->card_status |= WP_VIOLATION;
1141             return sd_r1;
1142
1143         default:
1144             break;
1145         }
1146         break;
1147
1148     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
1149         if (sd->spi)
1150             goto unimplemented_cmd;
1151         switch (sd->state) {
1152         case sd_transfer_state:
1153             /* Writing in SPI mode not implemented.  */
1154             if (sd->spi)
1155                 break;
1156             sd->state = sd_receivingdata_state;
1157             sd->data_start = addr;
1158             sd->data_offset = 0;
1159             sd->blk_written = 0;
1160
1161             if (sd->data_start + sd->blk_len > sd->size)
1162                 sd->card_status |= ADDRESS_ERROR;
1163             if (sd_wp_addr(sd, sd->data_start))
1164                 sd->card_status |= WP_VIOLATION;
1165             if (sd->csd[14] & 0x30)
1166                 sd->card_status |= WP_VIOLATION;
1167             return sd_r1;
1168
1169         default:
1170             break;
1171         }
1172         break;
1173
1174     case 26:    /* CMD26:  PROGRAM_CID */
1175         if (sd->spi)
1176             goto bad_cmd;
1177         switch (sd->state) {
1178         case sd_transfer_state:
1179             sd->state = sd_receivingdata_state;
1180             sd->data_start = 0;
1181             sd->data_offset = 0;
1182             return sd_r1;
1183
1184         default:
1185             break;
1186         }
1187         break;
1188
1189     case 27:    /* CMD27:  PROGRAM_CSD */
1190         if (sd->spi)
1191             goto unimplemented_cmd;
1192         switch (sd->state) {
1193         case sd_transfer_state:
1194             sd->state = sd_receivingdata_state;
1195             sd->data_start = 0;
1196             sd->data_offset = 0;
1197             return sd_r1;
1198
1199         default:
1200             break;
1201         }
1202         break;
1203
1204     /* Write protection (Class 6) */
1205     case 28:    /* CMD28:  SET_WRITE_PROT */
1206         switch (sd->state) {
1207         case sd_transfer_state:
1208             if (addr >= sd->size) {
1209                 sd->card_status |= ADDRESS_ERROR;
1210                 return sd_r1b;
1211             }
1212
1213             sd->state = sd_programming_state;
1214             set_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1215             /* Bzzzzzzztt .... Operation complete.  */
1216             sd->state = sd_transfer_state;
1217             return sd_r1b;
1218
1219         default:
1220             break;
1221         }
1222         break;
1223
1224     case 29:    /* CMD29:  CLR_WRITE_PROT */
1225         switch (sd->state) {
1226         case sd_transfer_state:
1227             if (addr >= sd->size) {
1228                 sd->card_status |= ADDRESS_ERROR;
1229                 return sd_r1b;
1230             }
1231
1232             sd->state = sd_programming_state;
1233             clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1234             /* Bzzzzzzztt .... Operation complete.  */
1235             sd->state = sd_transfer_state;
1236             return sd_r1b;
1237
1238         default:
1239             break;
1240         }
1241         break;
1242
1243     case 30:    /* CMD30:  SEND_WRITE_PROT */
1244         switch (sd->state) {
1245         case sd_transfer_state:
1246             sd->state = sd_sendingdata_state;
1247             *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1248             sd->data_start = addr;
1249             sd->data_offset = 0;
1250             return sd_r1b;
1251
1252         default:
1253             break;
1254         }
1255         break;
1256
1257     /* Erase commands (Class 5) */
1258     case 32:    /* CMD32:  ERASE_WR_BLK_START */
1259         switch (sd->state) {
1260         case sd_transfer_state:
1261             sd->erase_start = req.arg;
1262             return sd_r1;
1263
1264         default:
1265             break;
1266         }
1267         break;
1268
1269     case 33:    /* CMD33:  ERASE_WR_BLK_END */
1270         switch (sd->state) {
1271         case sd_transfer_state:
1272             sd->erase_end = req.arg;
1273             return sd_r1;
1274
1275         default:
1276             break;
1277         }
1278         break;
1279
1280     case 38:    /* CMD38:  ERASE */
1281         switch (sd->state) {
1282         case sd_transfer_state:
1283             if (sd->csd[14] & 0x30) {
1284                 sd->card_status |= WP_VIOLATION;
1285                 return sd_r1b;
1286             }
1287
1288             sd->state = sd_programming_state;
1289             sd_erase(sd);
1290             /* Bzzzzzzztt .... Operation complete.  */
1291             sd->state = sd_transfer_state;
1292             return sd_r1b;
1293
1294         default:
1295             break;
1296         }
1297         break;
1298
1299     /* Lock card commands (Class 7) */
1300     case 42:    /* CMD42:  LOCK_UNLOCK */
1301         if (sd->spi)
1302             goto unimplemented_cmd;
1303         switch (sd->state) {
1304         case sd_transfer_state:
1305             sd->state = sd_receivingdata_state;
1306             sd->data_start = 0;
1307             sd->data_offset = 0;
1308             return sd_r1;
1309
1310         default:
1311             break;
1312         }
1313         break;
1314
1315     case 52:
1316     case 53:
1317         /* CMD52, CMD53: reserved for SDIO cards
1318          * (see the SDIO Simplified Specification V2.0)
1319          * Handle as illegal command but do not complain
1320          * on stderr, as some OSes may use these in their
1321          * probing for presence of an SDIO card.
1322          */
1323         return sd_illegal;
1324
1325     /* Application specific commands (Class 8) */
1326     case 55:    /* CMD55:  APP_CMD */
1327         if (sd->rca != rca)
1328             return sd_r0;
1329
1330         sd->expecting_acmd = true;
1331         sd->card_status |= APP_CMD;
1332         return sd_r1;
1333
1334     case 56:    /* CMD56:  GEN_CMD */
1335         switch (sd->state) {
1336         case sd_transfer_state:
1337             sd->data_offset = 0;
1338             if (req.arg & 1)
1339                 sd->state = sd_sendingdata_state;
1340             else
1341                 sd->state = sd_receivingdata_state;
1342             return sd_r1;
1343
1344         default:
1345             break;
1346         }
1347         break;
1348
1349     default:
1350     bad_cmd:
1351         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1352         return sd_illegal;
1353
1354     unimplemented_cmd:
1355         /* Commands that are recognised but not yet implemented in SPI mode.  */
1356         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
1357                       req.cmd);
1358         return sd_illegal;
1359     }
1360
1361     qemu_log_mask(LOG_GUEST_ERROR, "SD: CMD%i in a wrong state\n", req.cmd);
1362     return sd_illegal;
1363 }
1364
1365 static sd_rsp_type_t sd_app_command(SDState *sd,
1366                                     SDRequest req)
1367 {
1368     trace_sdcard_app_command(req.cmd, req.arg);
1369     sd->card_status |= APP_CMD;
1370     switch (req.cmd) {
1371     case 6:     /* ACMD6:  SET_BUS_WIDTH */
1372         switch (sd->state) {
1373         case sd_transfer_state:
1374             sd->sd_status[0] &= 0x3f;
1375             sd->sd_status[0] |= (req.arg & 0x03) << 6;
1376             return sd_r1;
1377
1378         default:
1379             break;
1380         }
1381         break;
1382
1383     case 13:    /* ACMD13: SD_STATUS */
1384         switch (sd->state) {
1385         case sd_transfer_state:
1386             sd->state = sd_sendingdata_state;
1387             sd->data_start = 0;
1388             sd->data_offset = 0;
1389             return sd_r1;
1390
1391         default:
1392             break;
1393         }
1394         break;
1395
1396     case 22:    /* ACMD22: SEND_NUM_WR_BLOCKS */
1397         switch (sd->state) {
1398         case sd_transfer_state:
1399             *(uint32_t *) sd->data = sd->blk_written;
1400
1401             sd->state = sd_sendingdata_state;
1402             sd->data_start = 0;
1403             sd->data_offset = 0;
1404             return sd_r1;
1405
1406         default:
1407             break;
1408         }
1409         break;
1410
1411     case 23:    /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1412         switch (sd->state) {
1413         case sd_transfer_state:
1414             return sd_r1;
1415
1416         default:
1417             break;
1418         }
1419         break;
1420
1421     case 41:    /* ACMD41: SD_APP_OP_COND */
1422         if (sd->spi) {
1423             /* SEND_OP_CMD */
1424             sd->state = sd_transfer_state;
1425             return sd_r1;
1426         }
1427         switch (sd->state) {
1428         case sd_idle_state:
1429             /* If it's the first ACMD41 since reset, we need to decide
1430              * whether to power up. If this is not an enquiry ACMD41,
1431              * we immediately report power on and proceed below to the
1432              * ready state, but if it is, we set a timer to model a
1433              * delay for power up. This works around a bug in EDK2
1434              * UEFI, which sends an initial enquiry ACMD41, but
1435              * assumes that the card is in ready state as soon as it
1436              * sees the power up bit set. */
1437             if (!(sd->ocr & OCR_POWER_UP)) {
1438                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1439                     timer_del(sd->ocr_power_timer);
1440                     sd_ocr_powerup(sd);
1441                 } else if (!timer_pending(sd->ocr_power_timer)) {
1442                     timer_mod_ns(sd->ocr_power_timer,
1443                                  (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1444                                   + OCR_POWER_DELAY_NS));
1445                 }
1446             }
1447
1448             /* We accept any voltage.  10000 V is nothing.
1449              *
1450              * Once we're powered up, we advance straight to ready state
1451              * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1452              */
1453             if (req.arg & ACMD41_ENQUIRY_MASK) {
1454                 sd->state = sd_ready_state;
1455             }
1456
1457             return sd_r3;
1458
1459         default:
1460             break;
1461         }
1462         break;
1463
1464     case 42:    /* ACMD42: SET_CLR_CARD_DETECT */
1465         switch (sd->state) {
1466         case sd_transfer_state:
1467             /* Bringing in the 50KOhm pull-up resistor... Done.  */
1468             return sd_r1;
1469
1470         default:
1471             break;
1472         }
1473         break;
1474
1475     case 51:    /* ACMD51: SEND_SCR */
1476         switch (sd->state) {
1477         case sd_transfer_state:
1478             sd->state = sd_sendingdata_state;
1479             sd->data_start = 0;
1480             sd->data_offset = 0;
1481             return sd_r1;
1482
1483         default:
1484             break;
1485         }
1486         break;
1487
1488     default:
1489         /* Fall back to standard commands.  */
1490         return sd_normal_command(sd, req);
1491     }
1492
1493     qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
1494     return sd_illegal;
1495 }
1496
1497 static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
1498 {
1499     /* Valid commands in locked state:
1500      * basic class (0)
1501      * lock card class (7)
1502      * CMD16
1503      * implicitly, the ACMD prefix CMD55
1504      * ACMD41 and ACMD42
1505      * Anything else provokes an "illegal command" response.
1506      */
1507     if (sd->expecting_acmd) {
1508         return req->cmd == 41 || req->cmd == 42;
1509     }
1510     if (req->cmd == 16 || req->cmd == 55) {
1511         return 1;
1512     }
1513     return sd_cmd_class[req->cmd & 0x3F] == 0
1514             || sd_cmd_class[req->cmd & 0x3F] == 7;
1515 }
1516
1517 int sd_do_command(SDState *sd, SDRequest *req,
1518                   uint8_t *response) {
1519     int last_state;
1520     sd_rsp_type_t rtype;
1521     int rsplen;
1522
1523     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
1524         return 0;
1525     }
1526
1527     if (sd_req_crc_validate(req)) {
1528         sd->card_status |= COM_CRC_ERROR;
1529         rtype = sd_illegal;
1530         goto send_response;
1531     }
1532
1533     if (sd->card_status & CARD_IS_LOCKED) {
1534         if (!cmd_valid_while_locked(sd, req)) {
1535             sd->card_status |= ILLEGAL_COMMAND;
1536             sd->expecting_acmd = false;
1537             qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
1538             rtype = sd_illegal;
1539             goto send_response;
1540         }
1541     }
1542
1543     last_state = sd->state;
1544     sd_set_mode(sd);
1545
1546     if (sd->expecting_acmd) {
1547         sd->expecting_acmd = false;
1548         rtype = sd_app_command(sd, *req);
1549     } else {
1550         rtype = sd_normal_command(sd, *req);
1551     }
1552
1553     if (rtype == sd_illegal) {
1554         sd->card_status |= ILLEGAL_COMMAND;
1555     } else {
1556         /* Valid command, we can update the 'state before command' bits.
1557          * (Do this now so they appear in r1 responses.)
1558          */
1559         sd->current_cmd = req->cmd;
1560         sd->card_status &= ~CURRENT_STATE;
1561         sd->card_status |= (last_state << 9);
1562     }
1563
1564 send_response:
1565     switch (rtype) {
1566     case sd_r1:
1567     case sd_r1b:
1568         sd_response_r1_make(sd, response);
1569         rsplen = 4;
1570         break;
1571
1572     case sd_r2_i:
1573         memcpy(response, sd->cid, sizeof(sd->cid));
1574         rsplen = 16;
1575         break;
1576
1577     case sd_r2_s:
1578         memcpy(response, sd->csd, sizeof(sd->csd));
1579         rsplen = 16;
1580         break;
1581
1582     case sd_r3:
1583         sd_response_r3_make(sd, response);
1584         rsplen = 4;
1585         break;
1586
1587     case sd_r6:
1588         sd_response_r6_make(sd, response);
1589         rsplen = 4;
1590         break;
1591
1592     case sd_r7:
1593         sd_response_r7_make(sd, response);
1594         rsplen = 4;
1595         break;
1596
1597     case sd_r0:
1598     case sd_illegal:
1599     default:
1600         rsplen = 0;
1601         break;
1602     }
1603
1604     if (rtype != sd_illegal) {
1605         /* Clear the "clear on valid command" status bits now we've
1606          * sent any response
1607          */
1608         sd->card_status &= ~CARD_STATUS_B;
1609     }
1610
1611 #ifdef DEBUG_SD
1612     if (rsplen) {
1613         int i;
1614         DPRINTF("Response:");
1615         for (i = 0; i < rsplen; i++) {
1616             DPRINTF(" %02x", response[i]);
1617         }
1618         DPRINTF(" state %d\n", sd->state);
1619     } else {
1620         DPRINTF("No response %d\n", sd->state);
1621     }
1622 #endif
1623
1624     return rsplen;
1625 }
1626
1627 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1628 {
1629     trace_sdcard_read_block(addr, len);
1630     if (!sd->blk || blk_pread(sd->blk, addr, sd->data, len) < 0) {
1631         fprintf(stderr, "sd_blk_read: read error on host side\n");
1632     }
1633 }
1634
1635 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1636 {
1637     trace_sdcard_write_block(addr, len);
1638     if (!sd->blk || blk_pwrite(sd->blk, addr, sd->data, len, 0) < 0) {
1639         fprintf(stderr, "sd_blk_write: write error on host side\n");
1640     }
1641 }
1642
1643 #define BLK_READ_BLOCK(a, len)  sd_blk_read(sd, a, len)
1644 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
1645 #define APP_READ_BLOCK(a, len)  memset(sd->data, 0xec, len)
1646 #define APP_WRITE_BLOCK(a, len)
1647
1648 void sd_write_data(SDState *sd, uint8_t value)
1649 {
1650     int i;
1651
1652     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1653         return;
1654
1655     if (sd->state != sd_receivingdata_state) {
1656         qemu_log_mask(LOG_GUEST_ERROR,
1657                       "sd_write_data: not in Receiving-Data state\n");
1658         return;
1659     }
1660
1661     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1662         return;
1663
1664     switch (sd->current_cmd) {
1665     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
1666         sd->data[sd->data_offset ++] = value;
1667         if (sd->data_offset >= sd->blk_len) {
1668             /* TODO: Check CRC before committing */
1669             sd->state = sd_programming_state;
1670             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1671             sd->blk_written ++;
1672             sd->csd[14] |= 0x40;
1673             /* Bzzzzzzztt .... Operation complete.  */
1674             sd->state = sd_transfer_state;
1675         }
1676         break;
1677
1678     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
1679         if (sd->data_offset == 0) {
1680             /* Start of the block - let's check the address is valid */
1681             if (sd->data_start + sd->blk_len > sd->size) {
1682                 sd->card_status |= ADDRESS_ERROR;
1683                 break;
1684             }
1685             if (sd_wp_addr(sd, sd->data_start)) {
1686                 sd->card_status |= WP_VIOLATION;
1687                 break;
1688             }
1689         }
1690         sd->data[sd->data_offset++] = value;
1691         if (sd->data_offset >= sd->blk_len) {
1692             /* TODO: Check CRC before committing */
1693             sd->state = sd_programming_state;
1694             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1695             sd->blk_written++;
1696             sd->data_start += sd->blk_len;
1697             sd->data_offset = 0;
1698             sd->csd[14] |= 0x40;
1699
1700             /* Bzzzzzzztt .... Operation complete.  */
1701             if (sd->multi_blk_cnt != 0) {
1702                 if (--sd->multi_blk_cnt == 0) {
1703                     /* Stop! */
1704                     sd->state = sd_transfer_state;
1705                     break;
1706                 }
1707             }
1708
1709             sd->state = sd_receivingdata_state;
1710         }
1711         break;
1712
1713     case 26:    /* CMD26:  PROGRAM_CID */
1714         sd->data[sd->data_offset ++] = value;
1715         if (sd->data_offset >= sizeof(sd->cid)) {
1716             /* TODO: Check CRC before committing */
1717             sd->state = sd_programming_state;
1718             for (i = 0; i < sizeof(sd->cid); i ++)
1719                 if ((sd->cid[i] | 0x00) != sd->data[i])
1720                     sd->card_status |= CID_CSD_OVERWRITE;
1721
1722             if (!(sd->card_status & CID_CSD_OVERWRITE))
1723                 for (i = 0; i < sizeof(sd->cid); i ++) {
1724                     sd->cid[i] |= 0x00;
1725                     sd->cid[i] &= sd->data[i];
1726                 }
1727             /* Bzzzzzzztt .... Operation complete.  */
1728             sd->state = sd_transfer_state;
1729         }
1730         break;
1731
1732     case 27:    /* CMD27:  PROGRAM_CSD */
1733         sd->data[sd->data_offset ++] = value;
1734         if (sd->data_offset >= sizeof(sd->csd)) {
1735             /* TODO: Check CRC before committing */
1736             sd->state = sd_programming_state;
1737             for (i = 0; i < sizeof(sd->csd); i ++)
1738                 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1739                     (sd->data[i] | sd_csd_rw_mask[i]))
1740                     sd->card_status |= CID_CSD_OVERWRITE;
1741
1742             /* Copy flag (OTP) & Permanent write protect */
1743             if (sd->csd[14] & ~sd->data[14] & 0x60)
1744                 sd->card_status |= CID_CSD_OVERWRITE;
1745
1746             if (!(sd->card_status & CID_CSD_OVERWRITE))
1747                 for (i = 0; i < sizeof(sd->csd); i ++) {
1748                     sd->csd[i] |= sd_csd_rw_mask[i];
1749                     sd->csd[i] &= sd->data[i];
1750                 }
1751             /* Bzzzzzzztt .... Operation complete.  */
1752             sd->state = sd_transfer_state;
1753         }
1754         break;
1755
1756     case 42:    /* CMD42:  LOCK_UNLOCK */
1757         sd->data[sd->data_offset ++] = value;
1758         if (sd->data_offset >= sd->blk_len) {
1759             /* TODO: Check CRC before committing */
1760             sd->state = sd_programming_state;
1761             sd_lock_command(sd);
1762             /* Bzzzzzzztt .... Operation complete.  */
1763             sd->state = sd_transfer_state;
1764         }
1765         break;
1766
1767     case 56:    /* CMD56:  GEN_CMD */
1768         sd->data[sd->data_offset ++] = value;
1769         if (sd->data_offset >= sd->blk_len) {
1770             APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1771             sd->state = sd_transfer_state;
1772         }
1773         break;
1774
1775     default:
1776         qemu_log_mask(LOG_GUEST_ERROR, "sd_write_data: unknown command\n");
1777         break;
1778     }
1779 }
1780
1781 uint8_t sd_read_data(SDState *sd)
1782 {
1783     /* TODO: Append CRCs */
1784     uint8_t ret;
1785     int io_len;
1786
1787     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1788         return 0x00;
1789
1790     if (sd->state != sd_sendingdata_state) {
1791         qemu_log_mask(LOG_GUEST_ERROR,
1792                       "sd_read_data: not in Sending-Data state\n");
1793         return 0x00;
1794     }
1795
1796     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1797         return 0x00;
1798
1799     io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1800
1801     switch (sd->current_cmd) {
1802     case 6:     /* CMD6:   SWITCH_FUNCTION */
1803         ret = sd->data[sd->data_offset ++];
1804
1805         if (sd->data_offset >= 64)
1806             sd->state = sd_transfer_state;
1807         break;
1808
1809     case 9:     /* CMD9:   SEND_CSD */
1810     case 10:    /* CMD10:  SEND_CID */
1811         ret = sd->data[sd->data_offset ++];
1812
1813         if (sd->data_offset >= 16)
1814             sd->state = sd_transfer_state;
1815         break;
1816
1817     case 11:    /* CMD11:  READ_DAT_UNTIL_STOP */
1818         if (sd->data_offset == 0)
1819             BLK_READ_BLOCK(sd->data_start, io_len);
1820         ret = sd->data[sd->data_offset ++];
1821
1822         if (sd->data_offset >= io_len) {
1823             sd->data_start += io_len;
1824             sd->data_offset = 0;
1825             if (sd->data_start + io_len > sd->size) {
1826                 sd->card_status |= ADDRESS_ERROR;
1827                 break;
1828             }
1829         }
1830         break;
1831
1832     case 13:    /* ACMD13: SD_STATUS */
1833         ret = sd->sd_status[sd->data_offset ++];
1834
1835         if (sd->data_offset >= sizeof(sd->sd_status))
1836             sd->state = sd_transfer_state;
1837         break;
1838
1839     case 17:    /* CMD17:  READ_SINGLE_BLOCK */
1840         if (sd->data_offset == 0)
1841             BLK_READ_BLOCK(sd->data_start, io_len);
1842         ret = sd->data[sd->data_offset ++];
1843
1844         if (sd->data_offset >= io_len)
1845             sd->state = sd_transfer_state;
1846         break;
1847
1848     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
1849         if (sd->data_offset == 0) {
1850             if (sd->data_start + io_len > sd->size) {
1851                 sd->card_status |= ADDRESS_ERROR;
1852                 return 0x00;
1853             }
1854             BLK_READ_BLOCK(sd->data_start, io_len);
1855         }
1856         ret = sd->data[sd->data_offset ++];
1857
1858         if (sd->data_offset >= io_len) {
1859             sd->data_start += io_len;
1860             sd->data_offset = 0;
1861
1862             if (sd->multi_blk_cnt != 0) {
1863                 if (--sd->multi_blk_cnt == 0) {
1864                     /* Stop! */
1865                     sd->state = sd_transfer_state;
1866                     break;
1867                 }
1868             }
1869         }
1870         break;
1871
1872     case 22:    /* ACMD22: SEND_NUM_WR_BLOCKS */
1873         ret = sd->data[sd->data_offset ++];
1874
1875         if (sd->data_offset >= 4)
1876             sd->state = sd_transfer_state;
1877         break;
1878
1879     case 30:    /* CMD30:  SEND_WRITE_PROT */
1880         ret = sd->data[sd->data_offset ++];
1881
1882         if (sd->data_offset >= 4)
1883             sd->state = sd_transfer_state;
1884         break;
1885
1886     case 51:    /* ACMD51: SEND_SCR */
1887         ret = sd->scr[sd->data_offset ++];
1888
1889         if (sd->data_offset >= sizeof(sd->scr))
1890             sd->state = sd_transfer_state;
1891         break;
1892
1893     case 56:    /* CMD56:  GEN_CMD */
1894         if (sd->data_offset == 0)
1895             APP_READ_BLOCK(sd->data_start, sd->blk_len);
1896         ret = sd->data[sd->data_offset ++];
1897
1898         if (sd->data_offset >= sd->blk_len)
1899             sd->state = sd_transfer_state;
1900         break;
1901
1902     default:
1903         qemu_log_mask(LOG_GUEST_ERROR, "sd_read_data: unknown command\n");
1904         return 0x00;
1905     }
1906
1907     return ret;
1908 }
1909
1910 bool sd_data_ready(SDState *sd)
1911 {
1912     return sd->state == sd_sendingdata_state;
1913 }
1914
1915 void sd_enable(SDState *sd, bool enable)
1916 {
1917     sd->enable = enable;
1918 }
1919
1920 static void sd_instance_init(Object *obj)
1921 {
1922     SDState *sd = SD_CARD(obj);
1923
1924     sd->enable = true;
1925     sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
1926 }
1927
1928 static void sd_instance_finalize(Object *obj)
1929 {
1930     SDState *sd = SD_CARD(obj);
1931
1932     timer_del(sd->ocr_power_timer);
1933     timer_free(sd->ocr_power_timer);
1934 }
1935
1936 static void sd_realize(DeviceState *dev, Error **errp)
1937 {
1938     SDState *sd = SD_CARD(dev);
1939     int ret;
1940
1941     if (sd->blk && blk_is_read_only(sd->blk)) {
1942         error_setg(errp, "Cannot use read-only drive as SD card");
1943         return;
1944     }
1945
1946     if (sd->blk) {
1947         ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
1948                            BLK_PERM_ALL, errp);
1949         if (ret < 0) {
1950             return;
1951         }
1952         blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
1953     }
1954 }
1955
1956 static Property sd_properties[] = {
1957     DEFINE_PROP_DRIVE("drive", SDState, blk),
1958     /* We do not model the chip select pin, so allow the board to select
1959      * whether card should be in SSI or MMC/SD mode.  It is also up to the
1960      * board to ensure that ssi transfers only occur when the chip select
1961      * is asserted.  */
1962     DEFINE_PROP_BOOL("spi", SDState, spi, false),
1963     DEFINE_PROP_END_OF_LIST()
1964 };
1965
1966 static void sd_class_init(ObjectClass *klass, void *data)
1967 {
1968     DeviceClass *dc = DEVICE_CLASS(klass);
1969     SDCardClass *sc = SD_CARD_CLASS(klass);
1970
1971     dc->realize = sd_realize;
1972     dc->props = sd_properties;
1973     dc->vmsd = &sd_vmstate;
1974     dc->reset = sd_reset;
1975     dc->bus_type = TYPE_SD_BUS;
1976
1977     sc->set_voltage = sd_set_voltage;
1978     sc->get_dat_lines = sd_get_dat_lines;
1979     sc->get_cmd_line = sd_get_cmd_line;
1980     sc->do_command = sd_do_command;
1981     sc->write_data = sd_write_data;
1982     sc->read_data = sd_read_data;
1983     sc->data_ready = sd_data_ready;
1984     sc->enable = sd_enable;
1985     sc->get_inserted = sd_get_inserted;
1986     sc->get_readonly = sd_get_readonly;
1987 }
1988
1989 static const TypeInfo sd_info = {
1990     .name = TYPE_SD_CARD,
1991     .parent = TYPE_DEVICE,
1992     .instance_size = sizeof(SDState),
1993     .class_size = sizeof(SDCardClass),
1994     .class_init = sd_class_init,
1995     .instance_init = sd_instance_init,
1996     .instance_finalize = sd_instance_finalize,
1997 };
1998
1999 static void sd_register_types(void)
2000 {
2001     type_register_static(&sd_info);
2002 }
2003
2004 type_init(sd_register_types)