hw/sd/sd.c

   1 /*
   2  * SD Memory Card emulation as defined in the "SD Memory Card Physical
   3  * layer specification, Version 2.00."
   4  *
   5  * Copyright (c) 2006 Andrzej Zaborowski  <[email protected]>
   6  * Copyright (c) 2007 CodeSourcery
   7  * Copyright (c) 2018 Philippe Mathieu-Daudé <[email protected]>
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  *
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
  21  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
  23  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
  24  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  25  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  26  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  27  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  28  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include "qemu/osdep.h"
  34 #include "qemu/units.h"
  35 #include "qemu/cutils.h"
  36 #include "hw/irq.h"
  37 #include "hw/registerfields.h"
  38 #include "sysemu/block-backend.h"
  39 #include "hw/sd/sd.h"
  40 #include "hw/sd/sdcard_legacy.h"
  41 #include "migration/vmstate.h"
  42 #include "qapi/error.h"
  43 #include "qemu/bitmap.h"
  44 #include "hw/qdev-properties.h"
  45 #include "qemu/error-report.h"
  46 #include "qemu/timer.h"
  47 #include "qemu/log.h"
  48 #include "qemu/module.h"
  49 #include "sdmmc-internal.h"
  50 #include "trace.h"
  51
  52 //#define DEBUG_SD 1
  53
  54 #define SDSC_MAX_CAPACITY   (2 * GiB)
  55
  56 #define INVALID_ADDRESS     UINT32_MAX
  57
  58 typedef enum {
  59     sd_r0 = 0,    /* no response */
  60     sd_r1,        /* normal response command */
  61     sd_r2_i,      /* CID register */
  62     sd_r2_s,      /* CSD register */
  63     sd_r3,        /* OCR register */
  64     sd_r6 = 6,    /* Published RCA response */
  65     sd_r7,        /* Operating voltage */
  66     sd_r1b = -1,
  67     sd_illegal = -2,
  68 } sd_rsp_type_t;
  69
  70 enum SDCardModes {
  71     sd_inactive,
  72     sd_card_identification_mode,
  73     sd_data_transfer_mode,
  74 };
  75
  76 enum SDCardStates {
  77     sd_inactive_state = -1,
  78     sd_idle_state = 0,
  79     sd_ready_state,
  80     sd_identification_state,
  81     sd_standby_state,
  82     sd_transfer_state,
  83     sd_sendingdata_state,
  84     sd_receivingdata_state,
  85     sd_programming_state,
  86     sd_disconnect_state,
  87 };
  88
  89 struct SDState {
  90     DeviceState parent_obj;
  91
  92     /* If true, created by sd_init() for a non-qdevified caller */
  93     /* TODO purge them with fire */
  94     bool me_no_qdev_me_kill_mammoth_with_rocks;
  95
  96     /* SD Memory Card Registers */
  97     uint32_t ocr;
  98     uint8_t scr[8];
  99     uint8_t cid[16];
 100     uint8_t csd[16];
 101     uint16_t rca;
 102     uint32_t card_status;
 103     uint8_t sd_status[64];
 104
 105     /* Configurable properties */
 106     uint8_t spec_version;
 107     BlockBackend *blk;
 108     bool spi;
 109
 110     uint32_t mode;    /* current card mode, one of SDCardModes */
 111     int32_t state;    /* current card state, one of SDCardStates */
 112     uint32_t vhs;
 113     bool wp_switch;
 114     unsigned long *wp_groups;
 115     int32_t wpgrps_size;
 116     uint64_t size;
 117     uint32_t blk_len;
 118     uint32_t multi_blk_cnt;
 119     uint32_t erase_start;
 120     uint32_t erase_end;
 121     uint8_t pwd[16];
 122     uint32_t pwd_len;
 123     uint8_t function_group[6];
 124     uint8_t current_cmd;
 125     /* True if we will handle the next command as an ACMD. Note that this does
 126      * *not* track the APP_CMD status bit!
 127      */
 128     bool expecting_acmd;
 129     uint32_t blk_written;
 130     uint64_t data_start;
 131     uint32_t data_offset;
 132     uint8_t data[512];
 133     qemu_irq readonly_cb;
 134     qemu_irq inserted_cb;
 135     QEMUTimer *ocr_power_timer;
 136     const char *proto_name;
 137     bool enable;
 138     uint8_t dat_lines;
 139     bool cmd_line;
 140 };
 141
 142 static void sd_realize(DeviceState *dev, Error **errp);
 143
 144 static const char *sd_state_name(enum SDCardStates state)
 145 {
 146     static const char *state_name[] = {
 147         [sd_idle_state]             = "idle",
 148         [sd_ready_state]            = "ready",
 149         [sd_identification_state]   = "identification",
 150         [sd_standby_state]          = "standby",
 151         [sd_transfer_state]         = "transfer",
 152         [sd_sendingdata_state]      = "sendingdata",
 153         [sd_receivingdata_state]    = "receivingdata",
 154         [sd_programming_state]      = "programming",
 155         [sd_disconnect_state]       = "disconnect",
 156     };
 157     if (state == sd_inactive_state) {
 158         return "inactive";
 159     }
 160     assert(state < ARRAY_SIZE(state_name));
 161     return state_name[state];
 162 }
 163
 164 static const char *sd_response_name(sd_rsp_type_t rsp)
 165 {
 166     static const char *response_name[] = {
 167         [sd_r0]     = "RESP#0 (no response)",
 168         [sd_r1]     = "RESP#1 (normal cmd)",
 169         [sd_r2_i]   = "RESP#2 (CID reg)",
 170         [sd_r2_s]   = "RESP#2 (CSD reg)",
 171         [sd_r3]     = "RESP#3 (OCR reg)",
 172         [sd_r6]     = "RESP#6 (RCA)",
 173         [sd_r7]     = "RESP#7 (operating voltage)",
 174     };
 175     if (rsp == sd_illegal) {
 176         return "ILLEGAL RESP";
 177     }
 178     if (rsp == sd_r1b) {
 179         rsp = sd_r1;
 180     }
 181     assert(rsp < ARRAY_SIZE(response_name));
 182     return response_name[rsp];
 183 }
 184
 185 static uint8_t sd_get_dat_lines(SDState *sd)
 186 {
 187     return sd->enable ? sd->dat_lines : 0;
 188 }
 189
 190 static bool sd_get_cmd_line(SDState *sd)
 191 {
 192     return sd->enable ? sd->cmd_line : false;
 193 }
 194
 195 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
 196 {
 197     trace_sdcard_set_voltage(millivolts);
 198
 199     switch (millivolts) {
 200     case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
 201     case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
 202         break;
 203     default:
 204         qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
 205                       millivolts / 1000.f);
 206     }
 207 }
 208
 209 static void sd_set_mode(SDState *sd)
 210 {
 211     switch (sd->state) {
 212     case sd_inactive_state:
 213         sd->mode = sd_inactive;
 214         break;
 215
 216     case sd_idle_state:
 217     case sd_ready_state:
 218     case sd_identification_state:
 219         sd->mode = sd_card_identification_mode;
 220         break;
 221
 222     case sd_standby_state:
 223     case sd_transfer_state:
 224     case sd_sendingdata_state:
 225     case sd_receivingdata_state:
 226     case sd_programming_state:
 227     case sd_disconnect_state:
 228         sd->mode = sd_data_transfer_mode;
 229         break;
 230     }
 231 }
 232
 233 static const sd_cmd_type_t sd_cmd_type[SDMMC_CMD_MAX] = {
 234     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
 235     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
 236     /* 16 */
 237     sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
 238     sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
 239     /* 32 */
 240     sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
 241     sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
 242     /* 48 */
 243     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
 244     sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
 245 };
 246
 247 static const int sd_cmd_class[SDMMC_CMD_MAX] = {
 248     0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
 249     2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
 250     5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
 251     7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
 252 };
 253
 254 static uint8_t sd_crc7(void *message, size_t width)
 255 {
 256     int i, bit;
 257     uint8_t shift_reg = 0x00;
 258     uint8_t *msg = (uint8_t *) message;
 259
 260     for (i = 0; i < width; i ++, msg ++)
 261         for (bit = 7; bit >= 0; bit --) {
 262             shift_reg <<= 1;
 263             if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
 264                 shift_reg ^= 0x89;
 265         }
 266
 267     return shift_reg;
 268 }
 269
 270 static uint16_t sd_crc16(void *message, size_t width)
 271 {
 272     int i, bit;
 273     uint16_t shift_reg = 0x0000;
 274     uint16_t *msg = (uint16_t *) message;
 275     width <<= 1;
 276
 277     for (i = 0; i < width; i ++, msg ++)
 278         for (bit = 15; bit >= 0; bit --) {
 279             shift_reg <<= 1;
 280             if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
 281                 shift_reg ^= 0x1011;
 282         }
 283
 284     return shift_reg;
 285 }
 286
 287 #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
 288
 289 FIELD(OCR, VDD_VOLTAGE_WINDOW,          0, 24)
 290 FIELD(OCR, VDD_VOLTAGE_WIN_LO,          0,  8)
 291 FIELD(OCR, DUAL_VOLTAGE_CARD,           7,  1)
 292 FIELD(OCR, VDD_VOLTAGE_WIN_HI,          8, 16)
 293 FIELD(OCR, ACCEPT_SWITCH_1V8,          24,  1) /* Only UHS-I */
 294 FIELD(OCR, UHS_II_CARD,                29,  1) /* Only UHS-II */
 295 FIELD(OCR, CARD_CAPACITY,              30,  1) /* 0:SDSC, 1:SDHC/SDXC */
 296 FIELD(OCR, CARD_POWER_UP,              31,  1)
 297
 298 #define ACMD41_ENQUIRY_MASK     0x00ffffff
 299 #define ACMD41_R3_MASK          (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
 300                                | R_OCR_ACCEPT_SWITCH_1V8_MASK \
 301                                | R_OCR_UHS_II_CARD_MASK \
 302                                | R_OCR_CARD_CAPACITY_MASK \
 303                                | R_OCR_CARD_POWER_UP_MASK)
 304
 305 static void sd_set_ocr(SDState *sd)
 306 {
 307     /* All voltages OK */
 308     sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
 309 }
 310
 311 static void sd_ocr_powerup(void *opaque)
 312 {
 313     SDState *sd = opaque;
 314
 315     trace_sdcard_powerup();
 316     assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
 317
 318     /* card power-up OK */
 319     sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
 320
 321     if (sd->size > SDSC_MAX_CAPACITY) {
 322         sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
 323     }
 324 }
 325
 326 static void sd_set_scr(SDState *sd)
 327 {
 328     sd->scr[0] = 0 << 4;        /* SCR structure version 1.0 */
 329     if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
 330         sd->scr[0] |= 1;        /* Spec Version 1.10 */
 331     } else {
 332         sd->scr[0] |= 2;        /* Spec Version 2.00 or Version 3.0X */
 333     }
 334     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
 335                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
 336     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
 337     if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
 338         sd->scr[2] |= 1 << 7;   /* Spec Version 3.0X */
 339     }
 340     sd->scr[3] = 0x00;
 341     /* reserved for manufacturer usage */
 342     sd->scr[4] = 0x00;
 343     sd->scr[5] = 0x00;
 344     sd->scr[6] = 0x00;
 345     sd->scr[7] = 0x00;
 346 }
 347
 348 #define MID     0xaa
 349 #define OID     "XY"
 350 #define PNM     "QEMU!"
 351 #define PRV     0x01
 352 #define MDT_YR  2006
 353 #define MDT_MON 2
 354
 355 static void sd_set_cid(SDState *sd)
 356 {
 357     sd->cid[0] = MID;           /* Fake card manufacturer ID (MID) */
 358     sd->cid[1] = OID[0];        /* OEM/Application ID (OID) */
 359     sd->cid[2] = OID[1];
 360     sd->cid[3] = PNM[0];        /* Fake product name (PNM) */
 361     sd->cid[4] = PNM[1];
 362     sd->cid[5] = PNM[2];
 363     sd->cid[6] = PNM[3];
 364     sd->cid[7] = PNM[4];
 365     sd->cid[8] = PRV;           /* Fake product revision (PRV) */
 366     sd->cid[9] = 0xde;          /* Fake serial number (PSN) */
 367     sd->cid[10] = 0xad;
 368     sd->cid[11] = 0xbe;
 369     sd->cid[12] = 0xef;
 370     sd->cid[13] = 0x00 |        /* Manufacture date (MDT) */
 371         ((MDT_YR - 2000) / 10);
 372     sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
 373     sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
 374 }
 375
 376 #define HWBLOCK_SHIFT   9                       /* 512 bytes */
 377 #define SECTOR_SHIFT    5                       /* 16 kilobytes */
 378 #define WPGROUP_SHIFT   7                       /* 2 megs */
 379 #define CMULT_SHIFT     9                       /* 512 times HWBLOCK_SIZE */
 380 #define WPGROUP_SIZE    (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
 381
 382 static const uint8_t sd_csd_rw_mask[16] = {
 383     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 384     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
 385 };
 386
 387 static void sd_set_csd(SDState *sd, uint64_t size)
 388 {
 389     uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
 390     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
 391     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
 392
 393     if (size <= SDSC_MAX_CAPACITY) { /* Standard Capacity SD */
 394         sd->csd[0] = 0x00;      /* CSD structure */
 395         sd->csd[1] = 0x26;      /* Data read access-time-1 */
 396         sd->csd[2] = 0x00;      /* Data read access-time-2 */
 397         sd->csd[3] = 0x32;      /* Max. data transfer rate: 25 MHz */
 398         sd->csd[4] = 0x5f;      /* Card Command Classes */
 399         sd->csd[5] = 0x50 |     /* Max. read data block length */
 400             HWBLOCK_SHIFT;
 401         sd->csd[6] = 0xe0 |     /* Partial block for read allowed */
 402             ((csize >> 10) & 0x03);
 403         sd->csd[7] = 0x00 |     /* Device size */
 404             ((csize >> 2) & 0xff);
 405         sd->csd[8] = 0x3f |     /* Max. read current */
 406             ((csize << 6) & 0xc0);
 407         sd->csd[9] = 0xfc |     /* Max. write current */
 408             ((CMULT_SHIFT - 2) >> 1);
 409         sd->csd[10] = 0x40 |    /* Erase sector size */
 410             (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
 411         sd->csd[11] = 0x00 |    /* Write protect group size */
 412             ((sectsize << 7) & 0x80) | wpsize;
 413         sd->csd[12] = 0x90 |    /* Write speed factor */
 414             (HWBLOCK_SHIFT >> 2);
 415         sd->csd[13] = 0x20 |    /* Max. write data block length */
 416             ((HWBLOCK_SHIFT << 6) & 0xc0);
 417         sd->csd[14] = 0x00;     /* File format group */
 418     } else {                    /* SDHC */
 419         size /= 512 * KiB;
 420         size -= 1;
 421         sd->csd[0] = 0x40;
 422         sd->csd[1] = 0x0e;
 423         sd->csd[2] = 0x00;
 424         sd->csd[3] = 0x32;
 425         sd->csd[4] = 0x5b;
 426         sd->csd[5] = 0x59;
 427         sd->csd[6] = 0x00;
 428         sd->csd[7] = (size >> 16) & 0xff;
 429         sd->csd[8] = (size >> 8) & 0xff;
 430         sd->csd[9] = (size & 0xff);
 431         sd->csd[10] = 0x7f;
 432         sd->csd[11] = 0x80;
 433         sd->csd[12] = 0x0a;
 434         sd->csd[13] = 0x40;
 435         sd->csd[14] = 0x00;
 436     }
 437     sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
 438 }
 439
 440 static void sd_set_rca(SDState *sd)
 441 {
 442     sd->rca += 0x4567;
 443 }
 444
 445 FIELD(CSR, AKE_SEQ_ERROR,               3,  1)
 446 FIELD(CSR, APP_CMD,                     5,  1)
 447 FIELD(CSR, FX_EVENT,                    6,  1)
 448 FIELD(CSR, READY_FOR_DATA,              8,  1)
 449 FIELD(CSR, CURRENT_STATE,               9,  4)
 450 FIELD(CSR, ERASE_RESET,                13,  1)
 451 FIELD(CSR, CARD_ECC_DISABLED,          14,  1)
 452 FIELD(CSR, WP_ERASE_SKIP,              15,  1)
 453 FIELD(CSR, CSD_OVERWRITE,              16,  1)
 454 FIELD(CSR, DEFERRED_RESPONSE,          17,  1)
 455 FIELD(CSR, ERROR,                      19,  1)
 456 FIELD(CSR, CC_ERROR,                   20,  1)
 457 FIELD(CSR, CARD_ECC_FAILED,            21,  1)
 458 FIELD(CSR, ILLEGAL_COMMAND,            22,  1)
 459 FIELD(CSR, COM_CRC_ERROR,              23,  1)
 460 FIELD(CSR, LOCK_UNLOCK_FAILED,         24,  1)
 461 FIELD(CSR, CARD_IS_LOCKED,             25,  1)
 462 FIELD(CSR, WP_VIOLATION,               26,  1)
 463 FIELD(CSR, ERASE_PARAM,                27,  1)
 464 FIELD(CSR, ERASE_SEQ_ERROR,            28,  1)
 465 FIELD(CSR, BLOCK_LEN_ERROR,            29,  1)
 466 FIELD(CSR, ADDRESS_ERROR,              30,  1)
 467 FIELD(CSR, OUT_OF_RANGE,               31,  1)
 468
 469 /* Card status bits, split by clear condition:
 470  * A : According to the card current state
 471  * B : Always related to the previous command
 472  * C : Cleared by read
 473  */
 474 #define CARD_STATUS_A           (R_CSR_READY_FOR_DATA_MASK \
 475                                | R_CSR_CARD_ECC_DISABLED_MASK \
 476                                | R_CSR_CARD_IS_LOCKED_MASK)
 477 #define CARD_STATUS_B           (R_CSR_CURRENT_STATE_MASK \
 478                                | R_CSR_ILLEGAL_COMMAND_MASK \
 479                                | R_CSR_COM_CRC_ERROR_MASK)
 480 #define CARD_STATUS_C           (R_CSR_AKE_SEQ_ERROR_MASK \
 481                                | R_CSR_APP_CMD_MASK \
 482                                | R_CSR_ERASE_RESET_MASK \
 483                                | R_CSR_WP_ERASE_SKIP_MASK \
 484                                | R_CSR_CSD_OVERWRITE_MASK \
 485                                | R_CSR_ERROR_MASK \
 486                                | R_CSR_CC_ERROR_MASK \
 487                                | R_CSR_CARD_ECC_FAILED_MASK \
 488                                | R_CSR_LOCK_UNLOCK_FAILED_MASK \
 489                                | R_CSR_WP_VIOLATION_MASK \
 490                                | R_CSR_ERASE_PARAM_MASK \
 491                                | R_CSR_ERASE_SEQ_ERROR_MASK \
 492                                | R_CSR_BLOCK_LEN_ERROR_MASK \
 493                                | R_CSR_ADDRESS_ERROR_MASK \
 494                                | R_CSR_OUT_OF_RANGE_MASK)
 495
 496 static void sd_set_cardstatus(SDState *sd)
 497 {
 498     sd->card_status = 0x00000100;
 499 }
 500
 501 static void sd_set_sdstatus(SDState *sd)
 502 {
 503     memset(sd->sd_status, 0, 64);
 504 }
 505
 506 static int sd_req_crc_validate(SDRequest *req)
 507 {
 508     uint8_t buffer[5];
 509     buffer[0] = 0x40 | req->cmd;
 510     stl_be_p(&buffer[1], req->arg);
 511     return 0;
 512     return sd_crc7(buffer, 5) != req->crc;      /* TODO */
 513 }
 514
 515 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 516 {
 517     stl_be_p(response, sd->card_status);
 518
 519     /* Clear the "clear on read" status bits */
 520     sd->card_status &= ~CARD_STATUS_C;
 521 }
 522
 523 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 524 {
 525     stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
 526 }
 527
 528 static void sd_response_r6_make(SDState *sd, uint8_t *response)
 529 {
 530     uint16_t status;
 531
 532     status = ((sd->card_status >> 8) & 0xc000) |
 533              ((sd->card_status >> 6) & 0x2000) |
 534               (sd->card_status & 0x1fff);
 535     sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
 536     stw_be_p(response + 0, sd->rca);
 537     stw_be_p(response + 2, status);
 538 }
 539
 540 static void sd_response_r7_make(SDState *sd, uint8_t *response)
 541 {
 542     stl_be_p(response, sd->vhs);
 543 }
 544
 545 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
 546 {
 547     return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
 548 }
 549
 550 static void sd_reset(DeviceState *dev)
 551 {
 552     SDState *sd = SD_CARD(dev);
 553     uint64_t size;
 554     uint64_t sect;
 555
 556     trace_sdcard_reset();
 557     if (sd->blk) {
 558         blk_get_geometry(sd->blk, &sect);
 559     } else {
 560         sect = 0;
 561     }
 562     size = sect << 9;
 563
 564     sect = sd_addr_to_wpnum(size) + 1;
 565
 566     sd->state = sd_idle_state;
 567     sd->rca = 0x0000;
 568     sd_set_ocr(sd);
 569     sd_set_scr(sd);
 570     sd_set_cid(sd);
 571     sd_set_csd(sd, size);
 572     sd_set_cardstatus(sd);
 573     sd_set_sdstatus(sd);
 574
 575     g_free(sd->wp_groups);
 576     sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;
 577     sd->wpgrps_size = sect;
 578     sd->wp_groups = bitmap_new(sd->wpgrps_size);
 579     memset(sd->function_group, 0, sizeof(sd->function_group));
 580     sd->erase_start = INVALID_ADDRESS;
 581     sd->erase_end = INVALID_ADDRESS;
 582     sd->size = size;
 583     sd->blk_len = 0x200;
 584     sd->pwd_len = 0;
 585     sd->expecting_acmd = false;
 586     sd->dat_lines = 0xf;
 587     sd->cmd_line = true;
 588     sd->multi_blk_cnt = 0;
 589 }
 590
 591 static bool sd_get_inserted(SDState *sd)
 592 {
 593     return sd->blk && blk_is_inserted(sd->blk);
 594 }
 595
 596 static bool sd_get_readonly(SDState *sd)
 597 {
 598     return sd->wp_switch;
 599 }
 600
 601 static void sd_cardchange(void *opaque, bool load, Error **errp)
 602 {
 603     SDState *sd = opaque;
 604     DeviceState *dev = DEVICE(sd);
 605     SDBus *sdbus;
 606     bool inserted = sd_get_inserted(sd);
 607     bool readonly = sd_get_readonly(sd);
 608
 609     if (inserted) {
 610         trace_sdcard_inserted(readonly);
 611         sd_reset(dev);
 612     } else {
 613         trace_sdcard_ejected();
 614     }
 615
 616     if (sd->me_no_qdev_me_kill_mammoth_with_rocks) {
 617         qemu_set_irq(sd->inserted_cb, inserted);
 618         if (inserted) {
 619             qemu_set_irq(sd->readonly_cb, readonly);
 620         }
 621     } else {
 622         sdbus = SD_BUS(qdev_get_parent_bus(dev));
 623         sdbus_set_inserted(sdbus, inserted);
 624         if (inserted) {
 625             sdbus_set_readonly(sdbus, readonly);
 626         }
 627     }
 628 }
 629
 630 static const BlockDevOps sd_block_ops = {
 631     .change_media_cb = sd_cardchange,
 632 };
 633
 634 static bool sd_ocr_vmstate_needed(void *opaque)
 635 {
 636     SDState *sd = opaque;
 637
 638     /* Include the OCR state (and timer) if it is not yet powered up */
 639     return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
 640 }
 641
 642 static const VMStateDescription sd_ocr_vmstate = {
 643     .name = "sd-card/ocr-state",
 644     .version_id = 1,
 645     .minimum_version_id = 1,
 646     .needed = sd_ocr_vmstate_needed,
 647     .fields = (VMStateField[]) {
 648         VMSTATE_UINT32(ocr, SDState),
 649         VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
 650         VMSTATE_END_OF_LIST()
 651     },
 652 };
 653
 654 static int sd_vmstate_pre_load(void *opaque)
 655 {
 656     SDState *sd = opaque;
 657
 658     /* If the OCR state is not included (prior versions, or not
 659      * needed), then the OCR must be set as powered up. If the OCR state
 660      * is included, this will be replaced by the state restore.
 661      */
 662     sd_ocr_powerup(sd);
 663
 664     return 0;
 665 }
 666
 667 static const VMStateDescription sd_vmstate = {
 668     .name = "sd-card",
 669     .version_id = 2,
 670     .minimum_version_id = 2,
 671     .pre_load = sd_vmstate_pre_load,
 672     .fields = (VMStateField[]) {
 673         VMSTATE_UINT32(mode, SDState),
 674         VMSTATE_INT32(state, SDState),
 675         VMSTATE_UINT8_ARRAY(cid, SDState, 16),
 676         VMSTATE_UINT8_ARRAY(csd, SDState, 16),
 677         VMSTATE_UINT16(rca, SDState),
 678         VMSTATE_UINT32(card_status, SDState),
 679         VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
 680         VMSTATE_UINT32(vhs, SDState),
 681         VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size),
 682         VMSTATE_UINT32(blk_len, SDState),
 683         VMSTATE_UINT32(multi_blk_cnt, SDState),
 684         VMSTATE_UINT32(erase_start, SDState),
 685         VMSTATE_UINT32(erase_end, SDState),
 686         VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
 687         VMSTATE_UINT32(pwd_len, SDState),
 688         VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
 689         VMSTATE_UINT8(current_cmd, SDState),
 690         VMSTATE_BOOL(expecting_acmd, SDState),
 691         VMSTATE_UINT32(blk_written, SDState),
 692         VMSTATE_UINT64(data_start, SDState),
 693         VMSTATE_UINT32(data_offset, SDState),
 694         VMSTATE_UINT8_ARRAY(data, SDState, 512),
 695         VMSTATE_UNUSED_V(1, 512),
 696         VMSTATE_BOOL(enable, SDState),
 697         VMSTATE_END_OF_LIST()
 698     },
 699     .subsections = (const VMStateDescription*[]) {
 700         &sd_ocr_vmstate,
 701         NULL
 702     },
 703 };
 704
 705 /* Legacy initialization function for use by non-qdevified callers */
 706 SDState *sd_init(BlockBackend *blk, bool is_spi)
 707 {
 708     Object *obj;
 709     DeviceState *dev;
 710     SDState *sd;
 711     Error *err = NULL;
 712
 713     obj = object_new(TYPE_SD_CARD);
 714     dev = DEVICE(obj);
 715     if (!qdev_prop_set_drive_err(dev, "drive", blk, &err)) {
 716         error_reportf_err(err, "sd_init failed: ");
 717         return NULL;
 718     }
 719     qdev_prop_set_bit(dev, "spi", is_spi);
 720
 721     /*
 722      * Realizing the device properly would put it into the QOM
 723      * composition tree even though it is not plugged into an
 724      * appropriate bus.  That's a no-no.  Hide the device from
 725      * QOM/qdev, and call its qdev realize callback directly.
 726      */
 727     object_ref(obj);
 728     object_unparent(obj);
 729     sd_realize(dev, &err);
 730     if (err) {
 731         error_reportf_err(err, "sd_init failed: ");
 732         return NULL;
 733     }
 734
 735     sd = SD_CARD(dev);
 736     sd->me_no_qdev_me_kill_mammoth_with_rocks = true;
 737     return sd;
 738 }
 739
 740 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
 741 {
 742     sd->readonly_cb = readonly;
 743     sd->inserted_cb = insert;
 744     qemu_set_irq(readonly, sd->blk ? blk_is_read_only(sd->blk) : 0);
 745     qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
 746 }
 747
 748 static void sd_erase(SDState *sd)
 749 {
 750     int i;
 751     uint64_t erase_start = sd->erase_start;
 752     uint64_t erase_end = sd->erase_end;
 753
 754     trace_sdcard_erase(sd->erase_start, sd->erase_end);
 755     if (sd->erase_start == INVALID_ADDRESS
 756             || sd->erase_end == INVALID_ADDRESS) {
 757         sd->card_status |= ERASE_SEQ_ERROR;
 758         sd->erase_start = INVALID_ADDRESS;
 759         sd->erase_end = INVALID_ADDRESS;
 760         return;
 761     }
 762
 763     if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
 764         /* High capacity memory card: erase units are 512 byte blocks */
 765         erase_start *= 512;
 766         erase_end *= 512;
 767     }
 768
 769     if (sd->erase_start > sd->size || sd->erase_end > sd->size) {
 770         sd->card_status |= OUT_OF_RANGE;
 771         sd->erase_start = INVALID_ADDRESS;
 772         sd->erase_end = INVALID_ADDRESS;
 773         return;
 774     }
 775
 776     erase_start = sd_addr_to_wpnum(erase_start);
 777     erase_end = sd_addr_to_wpnum(erase_end);
 778     sd->erase_start = INVALID_ADDRESS;
 779     sd->erase_end = INVALID_ADDRESS;
 780     sd->csd[14] |= 0x40;
 781
 782     for (i = erase_start; i <= erase_end; i++) {
 783         if (test_bit(i, sd->wp_groups)) {
 784             sd->card_status |= WP_ERASE_SKIP;
 785         }
 786     }
 787 }
 788
 789 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
 790 {
 791     uint32_t i, wpnum;
 792     uint32_t ret = 0;
 793
 794     wpnum = sd_addr_to_wpnum(addr);
 795
 796     for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
 797         if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
 798             ret |= (1 << i);
 799         }
 800     }
 801
 802     return ret;
 803 }
 804
 805 static void sd_function_switch(SDState *sd, uint32_t arg)
 806 {
 807     int i, mode, new_func;
 808     mode = !!(arg & 0x80000000);
 809
 810     sd->data[0] = 0x00;         /* Maximum current consumption */
 811     sd->data[1] = 0x01;
 812     sd->data[2] = 0x80;         /* Supported group 6 functions */
 813     sd->data[3] = 0x01;
 814     sd->data[4] = 0x80;         /* Supported group 5 functions */
 815     sd->data[5] = 0x01;
 816     sd->data[6] = 0x80;         /* Supported group 4 functions */
 817     sd->data[7] = 0x01;
 818     sd->data[8] = 0x80;         /* Supported group 3 functions */
 819     sd->data[9] = 0x01;
 820     sd->data[10] = 0x80;        /* Supported group 2 functions */
 821     sd->data[11] = 0x43;
 822     sd->data[12] = 0x80;        /* Supported group 1 functions */
 823     sd->data[13] = 0x03;
 824
 825     for (i = 0; i < 6; i ++) {
 826         new_func = (arg >> (i * 4)) & 0x0f;
 827         if (mode && new_func != 0x0f)
 828             sd->function_group[i] = new_func;
 829         sd->data[16 - (i >> 1)] |= new_func << ((i % 2) * 4);
 830     }
 831     memset(&sd->data[17], 0, 47);
 832     stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 833 }
 834
 835 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 836 {
 837     return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
 838 }
 839
 840 static void sd_lock_command(SDState *sd)
 841 {
 842     int erase, lock, clr_pwd, set_pwd, pwd_len;
 843     erase = !!(sd->data[0] & 0x08);
 844     lock = sd->data[0] & 0x04;
 845     clr_pwd = sd->data[0] & 0x02;
 846     set_pwd = sd->data[0] & 0x01;
 847
 848     if (sd->blk_len > 1)
 849         pwd_len = sd->data[1];
 850     else
 851         pwd_len = 0;
 852
 853     if (lock) {
 854         trace_sdcard_lock();
 855     } else {
 856         trace_sdcard_unlock();
 857     }
 858     if (erase) {
 859         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
 860                         set_pwd || clr_pwd || lock || sd->wp_switch ||
 861                         (sd->csd[14] & 0x20)) {
 862             sd->card_status |= LOCK_UNLOCK_FAILED;
 863             return;
 864         }
 865         bitmap_zero(sd->wp_groups, sd->wpgrps_size);
 866         sd->csd[14] &= ~0x10;
 867         sd->card_status &= ~CARD_IS_LOCKED;
 868         sd->pwd_len = 0;
 869         /* Erasing the entire card here! */
 870         fprintf(stderr, "SD: Card force-erased by CMD42\n");
 871         return;
 872     }
 873
 874     if (sd->blk_len < 2 + pwd_len ||
 875                     pwd_len <= sd->pwd_len ||
 876                     pwd_len > sd->pwd_len + 16) {
 877         sd->card_status |= LOCK_UNLOCK_FAILED;
 878         return;
 879     }
 880
 881     if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
 882         sd->card_status |= LOCK_UNLOCK_FAILED;
 883         return;
 884     }
 885
 886     pwd_len -= sd->pwd_len;
 887     if ((pwd_len && !set_pwd) ||
 888                     (clr_pwd && (set_pwd || lock)) ||
 889                     (lock && !sd->pwd_len && !set_pwd) ||
 890                     (!set_pwd && !clr_pwd &&
 891                      (((sd->card_status & CARD_IS_LOCKED) && lock) ||
 892                       (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
 893         sd->card_status |= LOCK_UNLOCK_FAILED;
 894         return;
 895     }
 896
 897     if (set_pwd) {
 898         memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
 899         sd->pwd_len = pwd_len;
 900     }
 901
 902     if (clr_pwd) {
 903         sd->pwd_len = 0;
 904     }
 905
 906     if (lock)
 907         sd->card_status |= CARD_IS_LOCKED;
 908     else
 909         sd->card_status &= ~CARD_IS_LOCKED;
 910 }
 911
 912 static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
 913 {
 914     uint32_t rca = 0x0000;
 915     uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
 916
 917     /* CMD55 precedes an ACMD, so we are not interested in tracing it.
 918      * However there is no ACMD55, so we want to trace this particular case.
 919      */
 920     if (req.cmd != 55 || sd->expecting_acmd) {
 921         trace_sdcard_normal_command(sd->proto_name,
 922                                     sd_cmd_name(req.cmd), req.cmd,
 923                                     req.arg, sd_state_name(sd->state));
 924     }
 925
 926     /* Not interpreting this as an app command */
 927     sd->card_status &= ~APP_CMD;
 928
 929     if (sd_cmd_type[req.cmd] == sd_ac
 930         || sd_cmd_type[req.cmd] == sd_adtc) {
 931         rca = req.arg >> 16;
 932     }
 933
 934     /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
 935      * if not, its effects are cancelled */
 936     if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
 937         sd->multi_blk_cnt = 0;
 938     }
 939
 940     if (sd_cmd_class[req.cmd] == 6 && FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
 941         /* Only Standard Capacity cards support class 6 commands */
 942         return sd_illegal;
 943     }
 944
 945     switch (req.cmd) {
 946     /* Basic commands (Class 0 and Class 1) */
 947     case 0:     /* CMD0:   GO_IDLE_STATE */
 948         switch (sd->state) {
 949         case sd_inactive_state:
 950             return sd->spi ? sd_r1 : sd_r0;
 951
 952         default:
 953             sd->state = sd_idle_state;
 954             sd_reset(DEVICE(sd));
 955             return sd->spi ? sd_r1 : sd_r0;
 956         }
 957         break;
 958
 959     case 1:     /* CMD1:   SEND_OP_CMD */
 960         if (!sd->spi)
 961             goto bad_cmd;
 962
 963         sd->state = sd_transfer_state;
 964         return sd_r1;
 965
 966     case 2:     /* CMD2:   ALL_SEND_CID */
 967         if (sd->spi)
 968             goto bad_cmd;
 969         switch (sd->state) {
 970         case sd_ready_state:
 971             sd->state = sd_identification_state;
 972             return sd_r2_i;
 973
 974         default:
 975             break;
 976         }
 977         break;
 978
 979     case 3:     /* CMD3:   SEND_RELATIVE_ADDR */
 980         if (sd->spi)
 981             goto bad_cmd;
 982         switch (sd->state) {
 983         case sd_identification_state:
 984         case sd_standby_state:
 985             sd->state = sd_standby_state;
 986             sd_set_rca(sd);
 987             return sd_r6;
 988
 989         default:
 990             break;
 991         }
 992         break;
 993
 994     case 4:     /* CMD4:   SEND_DSR */
 995         if (sd->spi)
 996             goto bad_cmd;
 997         switch (sd->state) {
 998         case sd_standby_state:
 999             break;
1000
1001         default:
1002             break;
1003         }
1004         break;
1005
1006     case 5: /* CMD5: reserved for SDIO cards */
1007         return sd_illegal;
1008
1009     case 6:     /* CMD6:   SWITCH_FUNCTION */
1010         switch (sd->mode) {
1011         case sd_data_transfer_mode:
1012             sd_function_switch(sd, req.arg);
1013             sd->state = sd_sendingdata_state;
1014             sd->data_start = 0;
1015             sd->data_offset = 0;
1016             return sd_r1;
1017
1018         default:
1019             break;
1020         }
1021         break;
1022
1023     case 7:     /* CMD7:   SELECT/DESELECT_CARD */
1024         if (sd->spi)
1025             goto bad_cmd;
1026         switch (sd->state) {
1027         case sd_standby_state:
1028             if (sd->rca != rca)
1029                 return sd_r0;
1030
1031             sd->state = sd_transfer_state;
1032             return sd_r1b;
1033
1034         case sd_transfer_state:
1035         case sd_sendingdata_state:
1036             if (sd->rca == rca)
1037                 break;
1038
1039             sd->state = sd_standby_state;
1040             return sd_r1b;
1041
1042         case sd_disconnect_state:
1043             if (sd->rca != rca)
1044                 return sd_r0;
1045
1046             sd->state = sd_programming_state;
1047             return sd_r1b;
1048
1049         case sd_programming_state:
1050             if (sd->rca == rca)
1051                 break;
1052
1053             sd->state = sd_disconnect_state;
1054             return sd_r1b;
1055
1056         default:
1057             break;
1058         }
1059         break;
1060
1061     case 8:     /* CMD8:   SEND_IF_COND */
1062         if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
1063             break;
1064         }
1065         if (sd->state != sd_idle_state) {
1066             break;
1067         }
1068         sd->vhs = 0;
1069
1070         /* No response if not exactly one VHS bit is set.  */
1071         if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
1072             return sd->spi ? sd_r7 : sd_r0;
1073         }
1074
1075         /* Accept.  */
1076         sd->vhs = req.arg;
1077         return sd_r7;
1078
1079     case 9:     /* CMD9:   SEND_CSD */
1080         switch (sd->state) {
1081         case sd_standby_state:
1082             if (sd->rca != rca)
1083                 return sd_r0;
1084
1085             return sd_r2_s;
1086
1087         case sd_transfer_state:
1088             if (!sd->spi)
1089                 break;
1090             sd->state = sd_sendingdata_state;
1091             memcpy(sd->data, sd->csd, 16);
1092             sd->data_start = addr;
1093             sd->data_offset = 0;
1094             return sd_r1;
1095
1096         default:
1097             break;
1098         }
1099         break;
1100
1101     case 10:    /* CMD10:  SEND_CID */
1102         switch (sd->state) {
1103         case sd_standby_state:
1104             if (sd->rca != rca)
1105                 return sd_r0;
1106
1107             return sd_r2_i;
1108
1109         case sd_transfer_state:
1110             if (!sd->spi)
1111                 break;
1112             sd->state = sd_sendingdata_state;
1113             memcpy(sd->data, sd->cid, 16);
1114             sd->data_start = addr;
1115             sd->data_offset = 0;
1116             return sd_r1;
1117
1118         default:
1119             break;
1120         }
1121         break;
1122
1123     case 12:    /* CMD12:  STOP_TRANSMISSION */
1124         switch (sd->state) {
1125         case sd_sendingdata_state:
1126             sd->state = sd_transfer_state;
1127             return sd_r1b;
1128
1129         case sd_receivingdata_state:
1130             sd->state = sd_programming_state;
1131             /* Bzzzzzzztt .... Operation complete.  */
1132             sd->state = sd_transfer_state;
1133             return sd_r1b;
1134
1135         default:
1136             break;
1137         }
1138         break;
1139
1140     case 13:    /* CMD13:  SEND_STATUS */
1141         switch (sd->mode) {
1142         case sd_data_transfer_mode:
1143             if (sd->rca != rca)
1144                 return sd_r0;
1145
1146             return sd_r1;
1147
1148         default:
1149             break;
1150         }
1151         break;
1152
1153     case 15:    /* CMD15:  GO_INACTIVE_STATE */
1154         if (sd->spi)
1155             goto bad_cmd;
1156         switch (sd->mode) {
1157         case sd_data_transfer_mode:
1158             if (sd->rca != rca)
1159                 return sd_r0;
1160
1161             sd->state = sd_inactive_state;
1162             return sd_r0;
1163
1164         default:
1165             break;
1166         }
1167         break;
1168
1169     /* Block read commands (Classs 2) */
1170     case 16:    /* CMD16:  SET_BLOCKLEN */
1171         switch (sd->state) {
1172         case sd_transfer_state:
1173             if (req.arg > (1 << HWBLOCK_SHIFT)) {
1174                 sd->card_status |= BLOCK_LEN_ERROR;
1175             } else {
1176                 trace_sdcard_set_blocklen(req.arg);
1177                 sd->blk_len = req.arg;
1178             }
1179
1180             return sd_r1;
1181
1182         default:
1183             break;
1184         }
1185         break;
1186
1187     case 17:    /* CMD17:  READ_SINGLE_BLOCK */
1188         switch (sd->state) {
1189         case sd_transfer_state:
1190
1191             if (addr + sd->blk_len > sd->size) {
1192                 sd->card_status |= ADDRESS_ERROR;
1193                 return sd_r1;
1194             }
1195
1196             sd->state = sd_sendingdata_state;
1197             sd->data_start = addr;
1198             sd->data_offset = 0;
1199             return sd_r1;
1200
1201         default:
1202             break;
1203         }
1204         break;
1205
1206     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
1207         switch (sd->state) {
1208         case sd_transfer_state:
1209
1210             if (addr + sd->blk_len > sd->size) {
1211                 sd->card_status |= ADDRESS_ERROR;
1212                 return sd_r1;
1213             }
1214
1215             sd->state = sd_sendingdata_state;
1216             sd->data_start = addr;
1217             sd->data_offset = 0;
1218             return sd_r1;
1219
1220         default:
1221             break;
1222         }
1223         break;
1224
1225     case 19:    /* CMD19: SEND_TUNING_BLOCK (SD) */
1226         if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1227             break;
1228         }
1229         if (sd->state == sd_transfer_state) {
1230             sd->state = sd_sendingdata_state;
1231             sd->data_offset = 0;
1232             return sd_r1;
1233         }
1234         break;
1235
1236     case 23:    /* CMD23: SET_BLOCK_COUNT */
1237         if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1238             break;
1239         }
1240         switch (sd->state) {
1241         case sd_transfer_state:
1242             sd->multi_blk_cnt = req.arg;
1243             return sd_r1;
1244
1245         default:
1246             break;
1247         }
1248         break;
1249
1250     /* Block write commands (Class 4) */
1251     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
1252         switch (sd->state) {
1253         case sd_transfer_state:
1254             /* Writing in SPI mode not implemented.  */
1255             if (sd->spi)
1256                 break;
1257
1258             if (addr + sd->blk_len > sd->size) {
1259                 sd->card_status |= ADDRESS_ERROR;
1260                 return sd_r1;
1261             }
1262
1263             sd->state = sd_receivingdata_state;
1264             sd->data_start = addr;
1265             sd->data_offset = 0;
1266             sd->blk_written = 0;
1267
1268             if (sd_wp_addr(sd, sd->data_start)) {
1269                 sd->card_status |= WP_VIOLATION;
1270             }
1271             if (sd->csd[14] & 0x30) {
1272                 sd->card_status |= WP_VIOLATION;
1273             }
1274             return sd_r1;
1275
1276         default:
1277             break;
1278         }
1279         break;
1280
1281     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
1282         switch (sd->state) {
1283         case sd_transfer_state:
1284             /* Writing in SPI mode not implemented.  */
1285             if (sd->spi)
1286                 break;
1287
1288             if (addr + sd->blk_len > sd->size) {
1289                 sd->card_status |= ADDRESS_ERROR;
1290                 return sd_r1;
1291             }
1292
1293             sd->state = sd_receivingdata_state;
1294             sd->data_start = addr;
1295             sd->data_offset = 0;
1296             sd->blk_written = 0;
1297
1298             if (sd_wp_addr(sd, sd->data_start)) {
1299                 sd->card_status |= WP_VIOLATION;
1300             }
1301             if (sd->csd[14] & 0x30) {
1302                 sd->card_status |= WP_VIOLATION;
1303             }
1304             return sd_r1;
1305
1306         default:
1307             break;
1308         }
1309         break;
1310
1311     case 26:    /* CMD26:  PROGRAM_CID */
1312         if (sd->spi)
1313             goto bad_cmd;
1314         switch (sd->state) {
1315         case sd_transfer_state:
1316             sd->state = sd_receivingdata_state;
1317             sd->data_start = 0;
1318             sd->data_offset = 0;
1319             return sd_r1;
1320
1321         default:
1322             break;
1323         }
1324         break;
1325
1326     case 27:    /* CMD27:  PROGRAM_CSD */
1327         switch (sd->state) {
1328         case sd_transfer_state:
1329             sd->state = sd_receivingdata_state;
1330             sd->data_start = 0;
1331             sd->data_offset = 0;
1332             return sd_r1;
1333
1334         default:
1335             break;
1336         }
1337         break;
1338
1339     /* Write protection (Class 6) */
1340     case 28:    /* CMD28:  SET_WRITE_PROT */
1341         switch (sd->state) {
1342         case sd_transfer_state:
1343             if (addr >= sd->size) {
1344                 sd->card_status |= ADDRESS_ERROR;
1345                 return sd_r1b;
1346             }
1347
1348             sd->state = sd_programming_state;
1349             set_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1350             /* Bzzzzzzztt .... Operation complete.  */
1351             sd->state = sd_transfer_state;
1352             return sd_r1b;
1353
1354         default:
1355             break;
1356         }
1357         break;
1358
1359     case 29:    /* CMD29:  CLR_WRITE_PROT */
1360         switch (sd->state) {
1361         case sd_transfer_state:
1362             if (addr >= sd->size) {
1363                 sd->card_status |= ADDRESS_ERROR;
1364                 return sd_r1b;
1365             }
1366
1367             sd->state = sd_programming_state;
1368             clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1369             /* Bzzzzzzztt .... Operation complete.  */
1370             sd->state = sd_transfer_state;
1371             return sd_r1b;
1372
1373         default:
1374             break;
1375         }
1376         break;
1377
1378     case 30:    /* CMD30:  SEND_WRITE_PROT */
1379         switch (sd->state) {
1380         case sd_transfer_state:
1381             sd->state = sd_sendingdata_state;
1382             *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1383             sd->data_start = addr;
1384             sd->data_offset = 0;
1385             return sd_r1b;
1386
1387         default:
1388             break;
1389         }
1390         break;
1391
1392     /* Erase commands (Class 5) */
1393     case 32:    /* CMD32:  ERASE_WR_BLK_START */
1394         switch (sd->state) {
1395         case sd_transfer_state:
1396             sd->erase_start = req.arg;
1397             return sd_r1;
1398
1399         default:
1400             break;
1401         }
1402         break;
1403
1404     case 33:    /* CMD33:  ERASE_WR_BLK_END */
1405         switch (sd->state) {
1406         case sd_transfer_state:
1407             sd->erase_end = req.arg;
1408             return sd_r1;
1409
1410         default:
1411             break;
1412         }
1413         break;
1414
1415     case 38:    /* CMD38:  ERASE */
1416         switch (sd->state) {
1417         case sd_transfer_state:
1418             if (sd->csd[14] & 0x30) {
1419                 sd->card_status |= WP_VIOLATION;
1420                 return sd_r1b;
1421             }
1422
1423             sd->state = sd_programming_state;
1424             sd_erase(sd);
1425             /* Bzzzzzzztt .... Operation complete.  */
1426             sd->state = sd_transfer_state;
1427             return sd_r1b;
1428
1429         default:
1430             break;
1431         }
1432         break;
1433
1434     /* Lock card commands (Class 7) */
1435     case 42:    /* CMD42:  LOCK_UNLOCK */
1436         switch (sd->state) {
1437         case sd_transfer_state:
1438             sd->state = sd_receivingdata_state;
1439             sd->data_start = 0;
1440             sd->data_offset = 0;
1441             return sd_r1;
1442
1443         default:
1444             break;
1445         }
1446         break;
1447
1448     case 52 ... 54:
1449         /* CMD52, CMD53, CMD54: reserved for SDIO cards
1450          * (see the SDIO Simplified Specification V2.0)
1451          * Handle as illegal command but do not complain
1452          * on stderr, as some OSes may use these in their
1453          * probing for presence of an SDIO card.
1454          */
1455         return sd_illegal;
1456
1457     /* Application specific commands (Class 8) */
1458     case 55:    /* CMD55:  APP_CMD */
1459         switch (sd->state) {
1460         case sd_ready_state:
1461         case sd_identification_state:
1462         case sd_inactive_state:
1463             return sd_illegal;
1464         case sd_idle_state:
1465             if (rca) {
1466                 qemu_log_mask(LOG_GUEST_ERROR,
1467                               "SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
1468             }
1469         default:
1470             break;
1471         }
1472         if (!sd->spi) {
1473             if (sd->rca != rca) {
1474                 return sd_r0;
1475             }
1476         }
1477         sd->expecting_acmd = true;
1478         sd->card_status |= APP_CMD;
1479         return sd_r1;
1480
1481     case 56:    /* CMD56:  GEN_CMD */
1482         switch (sd->state) {
1483         case sd_transfer_state:
1484             sd->data_offset = 0;
1485             if (req.arg & 1)
1486                 sd->state = sd_sendingdata_state;
1487             else
1488                 sd->state = sd_receivingdata_state;
1489             return sd_r1;
1490
1491         default:
1492             break;
1493         }
1494         break;
1495
1496     case 58:    /* CMD58:   READ_OCR (SPI) */
1497         if (!sd->spi) {
1498             goto bad_cmd;
1499         }
1500         return sd_r3;
1501
1502     case 59:    /* CMD59:   CRC_ON_OFF (SPI) */
1503         if (!sd->spi) {
1504             goto bad_cmd;
1505         }
1506         goto unimplemented_spi_cmd;
1507
1508     default:
1509     bad_cmd:
1510         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1511         return sd_illegal;
1512
1513     unimplemented_spi_cmd:
1514         /* Commands that are recognised but not yet implemented in SPI mode.  */
1515         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
1516                       req.cmd);
1517         return sd_illegal;
1518     }
1519
1520     qemu_log_mask(LOG_GUEST_ERROR, "SD: CMD%i in a wrong state\n", req.cmd);
1521     return sd_illegal;
1522 }
1523
1524 static sd_rsp_type_t sd_app_command(SDState *sd,
1525                                     SDRequest req)
1526 {
1527     trace_sdcard_app_command(sd->proto_name, sd_acmd_name(req.cmd),
1528                              req.cmd, req.arg, sd_state_name(sd->state));
1529     sd->card_status |= APP_CMD;
1530     switch (req.cmd) {
1531     case 6:     /* ACMD6:  SET_BUS_WIDTH */
1532         if (sd->spi) {
1533             goto unimplemented_spi_cmd;
1534         }
1535         switch (sd->state) {
1536         case sd_transfer_state:
1537             sd->sd_status[0] &= 0x3f;
1538             sd->sd_status[0] |= (req.arg & 0x03) << 6;
1539             return sd_r1;
1540
1541         default:
1542             break;
1543         }
1544         break;
1545
1546     case 13:    /* ACMD13: SD_STATUS */
1547         switch (sd->state) {
1548         case sd_transfer_state:
1549             sd->state = sd_sendingdata_state;
1550             sd->data_start = 0;
1551             sd->data_offset = 0;
1552             return sd_r1;
1553
1554         default:
1555             break;
1556         }
1557         break;
1558
1559     case 22:    /* ACMD22: SEND_NUM_WR_BLOCKS */
1560         switch (sd->state) {
1561         case sd_transfer_state:
1562             *(uint32_t *) sd->data = sd->blk_written;
1563
1564             sd->state = sd_sendingdata_state;
1565             sd->data_start = 0;
1566             sd->data_offset = 0;
1567             return sd_r1;
1568
1569         default:
1570             break;
1571         }
1572         break;
1573
1574     case 23:    /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1575         switch (sd->state) {
1576         case sd_transfer_state:
1577             return sd_r1;
1578
1579         default:
1580             break;
1581         }
1582         break;
1583
1584     case 41:    /* ACMD41: SD_APP_OP_COND */
1585         if (sd->spi) {
1586             /* SEND_OP_CMD */
1587             sd->state = sd_transfer_state;
1588             return sd_r1;
1589         }
1590         if (sd->state != sd_idle_state) {
1591             break;
1592         }
1593         /* If it's the first ACMD41 since reset, we need to decide
1594          * whether to power up. If this is not an enquiry ACMD41,
1595          * we immediately report power on and proceed below to the
1596          * ready state, but if it is, we set a timer to model a
1597          * delay for power up. This works around a bug in EDK2
1598          * UEFI, which sends an initial enquiry ACMD41, but
1599          * assumes that the card is in ready state as soon as it
1600          * sees the power up bit set. */
1601         if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
1602             if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1603                 timer_del(sd->ocr_power_timer);
1604                 sd_ocr_powerup(sd);
1605             } else {
1606                 trace_sdcard_inquiry_cmd41();
1607                 if (!timer_pending(sd->ocr_power_timer)) {
1608                     timer_mod_ns(sd->ocr_power_timer,
1609                                  (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1610                                   + OCR_POWER_DELAY_NS));
1611                 }
1612             }
1613         }
1614
1615         if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
1616             /* We accept any voltage.  10000 V is nothing.
1617              *
1618              * Once we're powered up, we advance straight to ready state
1619              * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1620              */
1621             sd->state = sd_ready_state;
1622         }
1623
1624         return sd_r3;
1625
1626     case 42:    /* ACMD42: SET_CLR_CARD_DETECT */
1627         switch (sd->state) {
1628         case sd_transfer_state:
1629             /* Bringing in the 50KOhm pull-up resistor... Done.  */
1630             return sd_r1;
1631
1632         default:
1633             break;
1634         }
1635         break;
1636
1637     case 51:    /* ACMD51: SEND_SCR */
1638         switch (sd->state) {
1639         case sd_transfer_state:
1640             sd->state = sd_sendingdata_state;
1641             sd->data_start = 0;
1642             sd->data_offset = 0;
1643             return sd_r1;
1644
1645         default:
1646             break;
1647         }
1648         break;
1649
1650     case 18:    /* Reserved for SD security applications */
1651     case 25:
1652     case 26:
1653     case 38:
1654     case 43 ... 49:
1655         /* Refer to the "SD Specifications Part3 Security Specification" for
1656          * information about the SD Security Features.
1657          */
1658         qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
1659                       req.cmd);
1660         return sd_illegal;
1661
1662     default:
1663         /* Fall back to standard commands.  */
1664         return sd_normal_command(sd, req);
1665
1666     unimplemented_spi_cmd:
1667         /* Commands that are recognised but not yet implemented in SPI mode.  */
1668         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
1669                       req.cmd);
1670         return sd_illegal;
1671     }
1672
1673     qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
1674     return sd_illegal;
1675 }
1676
1677 static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
1678 {
1679     /* Valid commands in locked state:
1680      * basic class (0)
1681      * lock card class (7)
1682      * CMD16
1683      * implicitly, the ACMD prefix CMD55
1684      * ACMD41 and ACMD42
1685      * Anything else provokes an "illegal command" response.
1686      */
1687     if (sd->expecting_acmd) {
1688         return req->cmd == 41 || req->cmd == 42;
1689     }
1690     if (req->cmd == 16 || req->cmd == 55) {
1691         return 1;
1692     }
1693     return sd_cmd_class[req->cmd] == 0
1694             || sd_cmd_class[req->cmd] == 7;
1695 }
1696
1697 int sd_do_command(SDState *sd, SDRequest *req,
1698                   uint8_t *response) {
1699     int last_state;
1700     sd_rsp_type_t rtype;
1701     int rsplen;
1702
1703     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
1704         return 0;
1705     }
1706
1707     if (sd_req_crc_validate(req)) {
1708         sd->card_status |= COM_CRC_ERROR;
1709         rtype = sd_illegal;
1710         goto send_response;
1711     }
1712
1713     if (req->cmd >= SDMMC_CMD_MAX) {
1714         qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
1715                       req->cmd);
1716         req->cmd &= 0x3f;
1717     }
1718
1719     if (sd->card_status & CARD_IS_LOCKED) {
1720         if (!cmd_valid_while_locked(sd, req)) {
1721             sd->card_status |= ILLEGAL_COMMAND;
1722             sd->expecting_acmd = false;
1723             qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
1724             rtype = sd_illegal;
1725             goto send_response;
1726         }
1727     }
1728
1729     last_state = sd->state;
1730     sd_set_mode(sd);
1731
1732     if (sd->expecting_acmd) {
1733         sd->expecting_acmd = false;
1734         rtype = sd_app_command(sd, *req);
1735     } else {
1736         rtype = sd_normal_command(sd, *req);
1737     }
1738
1739     if (rtype == sd_illegal) {
1740         sd->card_status |= ILLEGAL_COMMAND;
1741     } else {
1742         /* Valid command, we can update the 'state before command' bits.
1743          * (Do this now so they appear in r1 responses.)
1744          */
1745         sd->current_cmd = req->cmd;
1746         sd->card_status &= ~CURRENT_STATE;
1747         sd->card_status |= (last_state << 9);
1748     }
1749
1750 send_response:
1751     switch (rtype) {
1752     case sd_r1:
1753     case sd_r1b:
1754         sd_response_r1_make(sd, response);
1755         rsplen = 4;
1756         break;
1757
1758     case sd_r2_i:
1759         memcpy(response, sd->cid, sizeof(sd->cid));
1760         rsplen = 16;
1761         break;
1762
1763     case sd_r2_s:
1764         memcpy(response, sd->csd, sizeof(sd->csd));
1765         rsplen = 16;
1766         break;
1767
1768     case sd_r3:
1769         sd_response_r3_make(sd, response);
1770         rsplen = 4;
1771         break;
1772
1773     case sd_r6:
1774         sd_response_r6_make(sd, response);
1775         rsplen = 4;
1776         break;
1777
1778     case sd_r7:
1779         sd_response_r7_make(sd, response);
1780         rsplen = 4;
1781         break;
1782
1783     case sd_r0:
1784     case sd_illegal:
1785         rsplen = 0;
1786         break;
1787     default:
1788         g_assert_not_reached();
1789     }
1790     trace_sdcard_response(sd_response_name(rtype), rsplen);
1791
1792     if (rtype != sd_illegal) {
1793         /* Clear the "clear on valid command" status bits now we've
1794          * sent any response
1795          */
1796         sd->card_status &= ~CARD_STATUS_B;
1797     }
1798
1799 #ifdef DEBUG_SD
1800     qemu_hexdump(stderr, "Response", response, rsplen);
1801 #endif
1802
1803     return rsplen;
1804 }
1805
1806 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1807 {
1808     trace_sdcard_read_block(addr, len);
1809     if (!sd->blk || blk_pread(sd->blk, addr, sd->data, len) < 0) {
1810         fprintf(stderr, "sd_blk_read: read error on host side\n");
1811     }
1812 }
1813
1814 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1815 {
1816     trace_sdcard_write_block(addr, len);
1817     if (!sd->blk || blk_pwrite(sd->blk, addr, sd->data, len, 0) < 0) {
1818         fprintf(stderr, "sd_blk_write: write error on host side\n");
1819     }
1820 }
1821
1822 #define BLK_READ_BLOCK(a, len)  sd_blk_read(sd, a, len)
1823 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
1824 #define APP_READ_BLOCK(a, len)  memset(sd->data, 0xec, len)
1825 #define APP_WRITE_BLOCK(a, len)
1826
1827 void sd_write_byte(SDState *sd, uint8_t value)
1828 {
1829     int i;
1830
1831     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1832         return;
1833
1834     if (sd->state != sd_receivingdata_state) {
1835         qemu_log_mask(LOG_GUEST_ERROR,
1836                       "%s: not in Receiving-Data state\n", __func__);
1837         return;
1838     }
1839
1840     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1841         return;
1842
1843     trace_sdcard_write_data(sd->proto_name,
1844                             sd_acmd_name(sd->current_cmd),
1845                             sd->current_cmd, value);
1846     switch (sd->current_cmd) {
1847     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
1848         sd->data[sd->data_offset ++] = value;
1849         if (sd->data_offset >= sd->blk_len) {
1850             /* TODO: Check CRC before committing */
1851             sd->state = sd_programming_state;
1852             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1853             sd->blk_written ++;
1854             sd->csd[14] |= 0x40;
1855             /* Bzzzzzzztt .... Operation complete.  */
1856             sd->state = sd_transfer_state;
1857         }
1858         break;
1859
1860     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
1861         if (sd->data_offset == 0) {
1862             /* Start of the block - let's check the address is valid */
1863             if (sd->data_start + sd->blk_len > sd->size) {
1864                 sd->card_status |= ADDRESS_ERROR;
1865                 break;
1866             }
1867             if (sd_wp_addr(sd, sd->data_start)) {
1868                 sd->card_status |= WP_VIOLATION;
1869                 break;
1870             }
1871         }
1872         sd->data[sd->data_offset++] = value;
1873         if (sd->data_offset >= sd->blk_len) {
1874             /* TODO: Check CRC before committing */
1875             sd->state = sd_programming_state;
1876             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1877             sd->blk_written++;
1878             sd->data_start += sd->blk_len;
1879             sd->data_offset = 0;
1880             sd->csd[14] |= 0x40;
1881
1882             /* Bzzzzzzztt .... Operation complete.  */
1883             if (sd->multi_blk_cnt != 0) {
1884                 if (--sd->multi_blk_cnt == 0) {
1885                     /* Stop! */
1886                     sd->state = sd_transfer_state;
1887                     break;
1888                 }
1889             }
1890
1891             sd->state = sd_receivingdata_state;
1892         }
1893         break;
1894
1895     case 26:    /* CMD26:  PROGRAM_CID */
1896         sd->data[sd->data_offset ++] = value;
1897         if (sd->data_offset >= sizeof(sd->cid)) {
1898             /* TODO: Check CRC before committing */
1899             sd->state = sd_programming_state;
1900             for (i = 0; i < sizeof(sd->cid); i ++)
1901                 if ((sd->cid[i] | 0x00) != sd->data[i])
1902                     sd->card_status |= CID_CSD_OVERWRITE;
1903
1904             if (!(sd->card_status & CID_CSD_OVERWRITE))
1905                 for (i = 0; i < sizeof(sd->cid); i ++) {
1906                     sd->cid[i] |= 0x00;
1907                     sd->cid[i] &= sd->data[i];
1908                 }
1909             /* Bzzzzzzztt .... Operation complete.  */
1910             sd->state = sd_transfer_state;
1911         }
1912         break;
1913
1914     case 27:    /* CMD27:  PROGRAM_CSD */
1915         sd->data[sd->data_offset ++] = value;
1916         if (sd->data_offset >= sizeof(sd->csd)) {
1917             /* TODO: Check CRC before committing */
1918             sd->state = sd_programming_state;
1919             for (i = 0; i < sizeof(sd->csd); i ++)
1920                 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1921                     (sd->data[i] | sd_csd_rw_mask[i]))
1922                     sd->card_status |= CID_CSD_OVERWRITE;
1923
1924             /* Copy flag (OTP) & Permanent write protect */
1925             if (sd->csd[14] & ~sd->data[14] & 0x60)
1926                 sd->card_status |= CID_CSD_OVERWRITE;
1927
1928             if (!(sd->card_status & CID_CSD_OVERWRITE))
1929                 for (i = 0; i < sizeof(sd->csd); i ++) {
1930                     sd->csd[i] |= sd_csd_rw_mask[i];
1931                     sd->csd[i] &= sd->data[i];
1932                 }
1933             /* Bzzzzzzztt .... Operation complete.  */
1934             sd->state = sd_transfer_state;
1935         }
1936         break;
1937
1938     case 42:    /* CMD42:  LOCK_UNLOCK */
1939         sd->data[sd->data_offset ++] = value;
1940         if (sd->data_offset >= sd->blk_len) {
1941             /* TODO: Check CRC before committing */
1942             sd->state = sd_programming_state;
1943             sd_lock_command(sd);
1944             /* Bzzzzzzztt .... Operation complete.  */
1945             sd->state = sd_transfer_state;
1946         }
1947         break;
1948
1949     case 56:    /* CMD56:  GEN_CMD */
1950         sd->data[sd->data_offset ++] = value;
1951         if (sd->data_offset >= sd->blk_len) {
1952             APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1953             sd->state = sd_transfer_state;
1954         }
1955         break;
1956
1957     default:
1958         qemu_log_mask(LOG_GUEST_ERROR, "%s: unknown command\n", __func__);
1959         break;
1960     }
1961 }
1962
1963 #define SD_TUNING_BLOCK_SIZE    64
1964
1965 static const uint8_t sd_tuning_block_pattern[SD_TUNING_BLOCK_SIZE] = {
1966     /* See: Physical Layer Simplified Specification Version 3.01, Table 4-2 */
1967     0xff, 0x0f, 0xff, 0x00,         0x0f, 0xfc, 0xc3, 0xcc,
1968     0xc3, 0x3c, 0xcc, 0xff,         0xfe, 0xff, 0xfe, 0xef,
1969     0xff, 0xdf, 0xff, 0xdd,         0xff, 0xfb, 0xff, 0xfb,
1970     0xbf, 0xff, 0x7f, 0xff,         0x77, 0xf7, 0xbd, 0xef,
1971     0xff, 0xf0, 0xff, 0xf0,         0x0f, 0xfc, 0xcc, 0x3c,
1972     0xcc, 0x33, 0xcc, 0xcf,         0xff, 0xef, 0xff, 0xee,
1973     0xff, 0xfd, 0xff, 0xfd,         0xdf, 0xff, 0xbf, 0xff,
1974     0xbb, 0xff, 0xf7, 0xff,         0xf7, 0x7f, 0x7b, 0xde,
1975 };
1976
1977 uint8_t sd_read_byte(SDState *sd)
1978 {
1979     /* TODO: Append CRCs */
1980     uint8_t ret;
1981     int io_len;
1982
1983     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1984         return 0x00;
1985
1986     if (sd->state != sd_sendingdata_state) {
1987         qemu_log_mask(LOG_GUEST_ERROR,
1988                       "%s: not in Sending-Data state\n", __func__);
1989         return 0x00;
1990     }
1991
1992     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1993         return 0x00;
1994
1995     io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1996
1997     trace_sdcard_read_data(sd->proto_name,
1998                            sd_acmd_name(sd->current_cmd),
1999                            sd->current_cmd, io_len);
2000     switch (sd->current_cmd) {
2001     case 6:     /* CMD6:   SWITCH_FUNCTION */
2002         ret = sd->data[sd->data_offset ++];
2003
2004         if (sd->data_offset >= 64)
2005             sd->state = sd_transfer_state;
2006         break;
2007
2008     case 9:     /* CMD9:   SEND_CSD */
2009     case 10:    /* CMD10:  SEND_CID */
2010         ret = sd->data[sd->data_offset ++];
2011
2012         if (sd->data_offset >= 16)
2013             sd->state = sd_transfer_state;
2014         break;
2015
2016     case 13:    /* ACMD13: SD_STATUS */
2017         ret = sd->sd_status[sd->data_offset ++];
2018
2019         if (sd->data_offset >= sizeof(sd->sd_status))
2020             sd->state = sd_transfer_state;
2021         break;
2022
2023     case 17:    /* CMD17:  READ_SINGLE_BLOCK */
2024         if (sd->data_offset == 0)
2025             BLK_READ_BLOCK(sd->data_start, io_len);
2026         ret = sd->data[sd->data_offset ++];
2027
2028         if (sd->data_offset >= io_len)
2029             sd->state = sd_transfer_state;
2030         break;
2031
2032     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
2033         if (sd->data_offset == 0) {
2034             if (sd->data_start + io_len > sd->size) {
2035                 sd->card_status |= ADDRESS_ERROR;
2036                 return 0x00;
2037             }
2038             BLK_READ_BLOCK(sd->data_start, io_len);
2039         }
2040         ret = sd->data[sd->data_offset ++];
2041
2042         if (sd->data_offset >= io_len) {
2043             sd->data_start += io_len;
2044             sd->data_offset = 0;
2045
2046             if (sd->multi_blk_cnt != 0) {
2047                 if (--sd->multi_blk_cnt == 0) {
2048                     /* Stop! */
2049                     sd->state = sd_transfer_state;
2050                     break;
2051                 }
2052             }
2053         }
2054         break;
2055
2056     case 19:    /* CMD19:  SEND_TUNING_BLOCK (SD) */
2057         if (sd->data_offset >= SD_TUNING_BLOCK_SIZE - 1) {
2058             sd->state = sd_transfer_state;
2059         }
2060         ret = sd_tuning_block_pattern[sd->data_offset++];
2061         break;
2062
2063     case 22:    /* ACMD22: SEND_NUM_WR_BLOCKS */
2064         ret = sd->data[sd->data_offset ++];
2065
2066         if (sd->data_offset >= 4)
2067             sd->state = sd_transfer_state;
2068         break;
2069
2070     case 30:    /* CMD30:  SEND_WRITE_PROT */
2071         ret = sd->data[sd->data_offset ++];
2072
2073         if (sd->data_offset >= 4)
2074             sd->state = sd_transfer_state;
2075         break;
2076
2077     case 51:    /* ACMD51: SEND_SCR */
2078         ret = sd->scr[sd->data_offset ++];
2079
2080         if (sd->data_offset >= sizeof(sd->scr))
2081             sd->state = sd_transfer_state;
2082         break;
2083
2084     case 56:    /* CMD56:  GEN_CMD */
2085         if (sd->data_offset == 0)
2086             APP_READ_BLOCK(sd->data_start, sd->blk_len);
2087         ret = sd->data[sd->data_offset ++];
2088
2089         if (sd->data_offset >= sd->blk_len)
2090             sd->state = sd_transfer_state;
2091         break;
2092
2093     default:
2094         qemu_log_mask(LOG_GUEST_ERROR, "%s: unknown command\n", __func__);
2095         return 0x00;
2096     }
2097
2098     return ret;
2099 }
2100
2101 static bool sd_data_ready(SDState *sd)
2102 {
2103     return sd->state == sd_sendingdata_state;
2104 }
2105
2106 void sd_enable(SDState *sd, bool enable)
2107 {
2108     sd->enable = enable;
2109 }
2110
2111 static void sd_instance_init(Object *obj)
2112 {
2113     SDState *sd = SD_CARD(obj);
2114
2115     sd->enable = true;
2116     sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
2117 }
2118
2119 static void sd_instance_finalize(Object *obj)
2120 {
2121     SDState *sd = SD_CARD(obj);
2122
2123     timer_del(sd->ocr_power_timer);
2124     timer_free(sd->ocr_power_timer);
2125 }
2126
2127 static void sd_realize(DeviceState *dev, Error **errp)
2128 {
2129     SDState *sd = SD_CARD(dev);
2130     int ret;
2131
2132     sd->proto_name = sd->spi ? "SPI" : "SD";
2133
2134     switch (sd->spec_version) {
2135     case SD_PHY_SPECv1_10_VERS
2136      ... SD_PHY_SPECv3_01_VERS:
2137         break;
2138     default:
2139         error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
2140         return;
2141     }
2142
2143     if (sd->blk) {
2144         int64_t blk_size;
2145
2146         if (blk_is_read_only(sd->blk)) {
2147             error_setg(errp, "Cannot use read-only drive as SD card");
2148             return;
2149         }
2150
2151         blk_size = blk_getlength(sd->blk);
2152         if (blk_size > 0 && !is_power_of_2(blk_size)) {
2153             int64_t blk_size_aligned = pow2ceil(blk_size);
2154             char *blk_size_str;
2155
2156             blk_size_str = size_to_str(blk_size);
2157             error_setg(errp, "Invalid SD card size: %s", blk_size_str);
2158             g_free(blk_size_str);
2159
2160             blk_size_str = size_to_str(blk_size_aligned);
2161             error_append_hint(errp,
2162                               "SD card size has to be a power of 2, e.g. %s.\n"
2163                               "You can resize disk images with"
2164                               " 'qemu-img resize <imagefile> <new-size>'\n"
2165                               "(note that this will lose data if you make the"
2166                               " image smaller than it currently is).\n",
2167                               blk_size_str);
2168             g_free(blk_size_str);
2169
2170             return;
2171         }
2172
2173         ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
2174                            BLK_PERM_ALL, errp);
2175         if (ret < 0) {
2176             return;
2177         }
2178         blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
2179     }
2180 }
2181
2182 static Property sd_properties[] = {
2183     DEFINE_PROP_UINT8("spec_version", SDState,
2184                       spec_version, SD_PHY_SPECv2_00_VERS),
2185     DEFINE_PROP_DRIVE("drive", SDState, blk),
2186     /* We do not model the chip select pin, so allow the board to select
2187      * whether card should be in SSI or MMC/SD mode.  It is also up to the
2188      * board to ensure that ssi transfers only occur when the chip select
2189      * is asserted.  */
2190     DEFINE_PROP_BOOL("spi", SDState, spi, false),
2191     DEFINE_PROP_END_OF_LIST()
2192 };
2193
2194 static void sd_class_init(ObjectClass *klass, void *data)
2195 {
2196     DeviceClass *dc = DEVICE_CLASS(klass);
2197     SDCardClass *sc = SD_CARD_CLASS(klass);
2198
2199     dc->realize = sd_realize;
2200     device_class_set_props(dc, sd_properties);
2201     dc->vmsd = &sd_vmstate;
2202     dc->reset = sd_reset;
2203     dc->bus_type = TYPE_SD_BUS;
2204     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2205
2206     sc->set_voltage = sd_set_voltage;
2207     sc->get_dat_lines = sd_get_dat_lines;
2208     sc->get_cmd_line = sd_get_cmd_line;
2209     sc->do_command = sd_do_command;
2210     sc->write_byte = sd_write_byte;
2211     sc->read_byte = sd_read_byte;
2212     sc->data_ready = sd_data_ready;
2213     sc->enable = sd_enable;
2214     sc->get_inserted = sd_get_inserted;
2215     sc->get_readonly = sd_get_readonly;
2216 }
2217
2218 static const TypeInfo sd_info = {
2219     .name = TYPE_SD_CARD,
2220     .parent = TYPE_DEVICE,
2221     .instance_size = sizeof(SDState),
2222     .class_size = sizeof(SDCardClass),
2223     .class_init = sd_class_init,
2224     .instance_init = sd_instance_init,
2225     .instance_finalize = sd_instance_finalize,
2226 };
2227
2228 static void sd_register_types(void)
2229 {
2230     type_register_static(&sd_info);
2231 }
2232
2233 type_init(sd_register_types)