?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'pull-loongarch-20241016' of https://gitlab.com/gaosong/qemu into staging
[qemu/armbru.git] / hw / sd / sd.c
bloba5d2d929a8afc577c7dc1948d69187948772c933
1 /*
2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 2.00."
4 *
5 * eMMC emulation defined in "JEDEC Standard No. 84-A43"
6 *
7 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
8 * Copyright (c) 2007 CodeSourcery
9 * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 *
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in
19 * the documentation and/or other materials provided with the
20 * distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
23 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
25 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
29 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
30 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #include "qemu/osdep.h"
36 #include "qemu/units.h"
37 #include "qemu/cutils.h"
38 #include "hw/irq.h"
39 #include "hw/registerfields.h"
40 #include "sysemu/block-backend.h"
41 #include "hw/sd/sd.h"
42 #include "hw/sd/sdcard_legacy.h"
43 #include "migration/vmstate.h"
44 #include "qapi/error.h"
45 #include "qemu/bitmap.h"
46 #include "hw/qdev-properties.h"
47 #include "hw/qdev-properties-system.h"
48 #include "qemu/error-report.h"
49 #include "qemu/timer.h"
50 #include "qemu/log.h"
51 #include "qemu/guest-random.h"
52 #include "qemu/module.h"
53 #include "sdmmc-internal.h"
54 #include "trace.h"
55
56 //#define DEBUG_SD 1
57
58 #define SDSC_MAX_CAPACITY (2 * GiB)
59
60 #define INVALID_ADDRESS UINT32_MAX
61
62 typedef enum {
63 sd_r0 = 0, /* no response */
64 sd_r1, /* normal response command */
65 sd_r2_i, /* CID register */
66 sd_r2_s, /* CSD register */
67 sd_r3, /* OCR register */
68 sd_r6 = 6, /* Published RCA response */
69 sd_r7, /* Operating voltage */
70 sd_r1b = -1,
71 sd_illegal = -2,
72 } sd_rsp_type_t;
73
74 enum SDCardModes {
75 sd_inactive,
76 sd_card_identification_mode,
77 sd_data_transfer_mode,
78 };
79
80 enum SDCardStates {
81 sd_waitirq_state = -2, /* emmc */
82 sd_inactive_state = -1,
83
84 sd_idle_state = 0,
85 sd_ready_state = 1,
86 sd_identification_state = 2,
87 sd_standby_state = 3,
88 sd_transfer_state = 4,
89 sd_sendingdata_state = 5,
90 sd_receivingdata_state = 6,
91 sd_programming_state = 7,
92 sd_disconnect_state = 8,
93 sd_bus_test_state = 9, /* emmc */
94 sd_sleep_state = 10, /* emmc */
95 sd_io_state = 15 /* sd */
96 };
97
98 #define SDMMC_CMD_MAX 64
99
100 typedef sd_rsp_type_t (*sd_cmd_handler)(SDState *sd, SDRequest req);
101
102 typedef struct SDProto {
103 const char *name;
104 struct {
105 const unsigned class;
106 const sd_cmd_type_t type;
107 const char *name;
108 sd_cmd_handler handler;
109 } cmd[SDMMC_CMD_MAX], acmd[SDMMC_CMD_MAX];
110 } SDProto;
111
112 struct SDState {
113 DeviceState parent_obj;
114
115 /* If true, created by sd_init() for a non-qdevified caller */
116 /* TODO purge them with fire */
117 bool me_no_qdev_me_kill_mammoth_with_rocks;
118
119 /* SD Memory Card Registers */
120 uint32_t ocr;
121 uint8_t scr[8];
122 uint8_t cid[16];
123 uint8_t csd[16];
124 uint16_t rca;
125 uint32_t card_status;
126 uint8_t sd_status[64];
127 union {
128 uint8_t ext_csd[512];
129 struct {
130 uint8_t ext_csd_rw[192]; /* Modes segment */
131 uint8_t ext_csd_ro[320]; /* Properties segment */
132 };
133 };
134
135 /* Static properties */
136
137 uint8_t spec_version;
138 uint64_t boot_part_size;
139 BlockBackend *blk;
140 uint8_t boot_config;
141
142 const SDProto *proto;
143
144 /* Runtime changeables */
145
146 uint32_t mode; /* current card mode, one of SDCardModes */
147 int32_t state; /* current card state, one of SDCardStates */
148 uint32_t vhs;
149 bool wp_switch;
150 unsigned long *wp_group_bmap;
151 int32_t wp_group_bits;
152 uint64_t size;
153 uint32_t blk_len;
154 uint32_t multi_blk_cnt;
155 uint32_t erase_start;
156 uint32_t erase_end;
157 uint8_t pwd[16];
158 uint32_t pwd_len;
159 uint8_t function_group[6];
160 uint8_t current_cmd;
161 const char *last_cmd_name;
162 /* True if we will handle the next command as an ACMD. Note that this does
163 * *not* track the APP_CMD status bit!
164 */
165 bool expecting_acmd;
166 uint32_t blk_written;
167
168 uint64_t data_start;
169 uint32_t data_offset;
170 size_t data_size;
171 uint8_t data[512];
172 qemu_irq readonly_cb;
173 qemu_irq inserted_cb;
174 QEMUTimer *ocr_power_timer;
175 bool enable;
176 uint8_t dat_lines;
177 bool cmd_line;
178 };
179
180 static void sd_realize(DeviceState *dev, Error **errp);
181
182 static const SDProto sd_proto_spi;
183 static const SDProto sd_proto_emmc;
184
185 static bool sd_is_spi(SDState *sd)
186 {
187 return sd->proto == &sd_proto_spi;
188 }
189
190 static bool sd_is_emmc(SDState *sd)
191 {
192 return sd->proto == &sd_proto_emmc;
193 }
194
195 static const char *sd_version_str(enum SDPhySpecificationVersion version)
196 {
197 static const char *sdphy_version[] = {
198 [SD_PHY_SPECv1_10_VERS] = "v1.10",
199 [SD_PHY_SPECv2_00_VERS] = "v2.00",
200 [SD_PHY_SPECv3_01_VERS] = "v3.01",
201 };
202 if (version >= ARRAY_SIZE(sdphy_version)) {
203 return "unsupported version";
204 }
205 return sdphy_version[version];
206 }
207
208 static const char *sd_mode_name(enum SDCardModes mode)
209 {
210 static const char *mode_name[] = {
211 [sd_inactive] = "inactive",
212 [sd_card_identification_mode] = "identification",
213 [sd_data_transfer_mode] = "transfer",
214 };
215 assert(mode < ARRAY_SIZE(mode_name));
216 return mode_name[mode];
217 }
218
219 static const char *sd_state_name(enum SDCardStates state)
220 {
221 static const char *state_name[] = {
222 [sd_idle_state] = "idle",
223 [sd_ready_state] = "ready",
224 [sd_identification_state] = "identification",
225 [sd_standby_state] = "standby",
226 [sd_transfer_state] = "transfer",
227 [sd_sendingdata_state] = "sendingdata",
228 [sd_bus_test_state] = "bus-test",
229 [sd_receivingdata_state] = "receivingdata",
230 [sd_programming_state] = "programming",
231 [sd_disconnect_state] = "disconnect",
232 [sd_sleep_state] = "sleep",
233 [sd_io_state] = "i/o"
234 };
235 if (state == sd_inactive_state) {
236 return "inactive";
237 }
238 if (state == sd_waitirq_state) {
239 return "wait-irq";
240 }
241 assert(state < ARRAY_SIZE(state_name));
242 return state_name[state];
243 }
244
245 static const char *sd_response_name(sd_rsp_type_t rsp)
246 {
247 static const char *response_name[] = {
248 [sd_r0] = "RESP#0 (no response)",
249 [sd_r1] = "RESP#1 (normal cmd)",
250 [sd_r2_i] = "RESP#2 (CID reg)",
251 [sd_r2_s] = "RESP#2 (CSD reg)",
252 [sd_r3] = "RESP#3 (OCR reg)",
253 [sd_r6] = "RESP#6 (RCA)",
254 [sd_r7] = "RESP#7 (operating voltage)",
255 };
256 if (rsp == sd_illegal) {
257 return "ILLEGAL RESP";
258 }
259 if (rsp == sd_r1b) {
260 rsp = sd_r1;
261 }
262 assert(rsp < ARRAY_SIZE(response_name));
263 return response_name[rsp];
264 }
265
266 static const char *sd_cmd_name(SDState *sd, uint8_t cmd)
267 {
268 static const char *cmd_abbrev[SDMMC_CMD_MAX] = {
269 [18] = "READ_MULTIPLE_BLOCK",
270 [25] = "WRITE_MULTIPLE_BLOCK",
271 };
272 const SDProto *sdp = sd->proto;
273
274 if (sdp->cmd[cmd].handler) {
275 assert(!cmd_abbrev[cmd]);
276 return sdp->cmd[cmd].name;
277 }
278 return cmd_abbrev[cmd] ? cmd_abbrev[cmd] : "UNKNOWN_CMD";
279 }
280
281 static const char *sd_acmd_name(SDState *sd, uint8_t cmd)
282 {
283 const SDProto *sdp = sd->proto;
284
285 if (sdp->acmd[cmd].handler) {
286 return sdp->acmd[cmd].name;
287 }
288
289 return "UNKNOWN_ACMD";
290 }
291
292 static uint8_t sd_get_dat_lines(SDState *sd)
293 {
294 return sd->enable ? sd->dat_lines : 0;
295 }
296
297 static bool sd_get_cmd_line(SDState *sd)
298 {
299 return sd->enable ? sd->cmd_line : false;
300 }
301
302 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
303 {
304 trace_sdcard_set_voltage(millivolts);
305
306 switch (millivolts) {
307 case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
308 case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
309 break;
310 default:
311 qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
312 millivolts / 1000.f);
313 }
314 }
315
316 static void sd_set_mode(SDState *sd)
317 {
318 switch (sd->state) {
319 case sd_inactive_state:
320 sd->mode = sd_inactive;
321 break;
322
323 case sd_idle_state:
324 case sd_ready_state:
325 case sd_identification_state:
326 sd->mode = sd_card_identification_mode;
327 break;
328
329 case sd_standby_state:
330 case sd_transfer_state:
331 case sd_sendingdata_state:
332 case sd_receivingdata_state:
333 case sd_programming_state:
334 case sd_disconnect_state:
335 sd->mode = sd_data_transfer_mode;
336 break;
337 }
338 }
339
340 static uint8_t sd_crc7(const void *message, size_t width)
341 {
342 int i, bit;
343 uint8_t shift_reg = 0x00;
344 const uint8_t *msg = (const uint8_t *)message;
345
346 for (i = 0; i < width; i ++, msg ++)
347 for (bit = 7; bit >= 0; bit --) {
348 shift_reg <<= 1;
349 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
350 shift_reg ^= 0x89;
351 }
352
353 return shift_reg;
354 }
355
356 /* Operation Conditions register */
357
358 #define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
359
360 FIELD(OCR, VDD_VOLTAGE_WINDOW, 0, 24)
361 FIELD(OCR, VDD_VOLTAGE_WIN_LO, 0, 8)
362 FIELD(OCR, DUAL_VOLTAGE_CARD, 7, 1)
363 FIELD(OCR, VDD_VOLTAGE_WIN_HI, 8, 16)
364 FIELD(OCR, ACCEPT_SWITCH_1V8, 24, 1) /* Only UHS-I */
365 FIELD(OCR, UHS_II_CARD, 29, 1) /* Only UHS-II */
366 FIELD(OCR, CARD_CAPACITY, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
367 FIELD(OCR, CARD_POWER_UP, 31, 1)
368
369 #define ACMD41_ENQUIRY_MASK 0x00ffffff
370 #define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
371 | R_OCR_ACCEPT_SWITCH_1V8_MASK \
372 | R_OCR_UHS_II_CARD_MASK \
373 | R_OCR_CARD_CAPACITY_MASK \
374 | R_OCR_CARD_POWER_UP_MASK)
375
376 static void sd_ocr_powerup(void *opaque)
377 {
378 SDState *sd = opaque;
379
380 trace_sdcard_powerup();
381 assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
382
383 /* card power-up OK */
384 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
385
386 if (sd->size > SDSC_MAX_CAPACITY) {
387 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
388 }
389 }
390
391 static void sd_set_ocr(SDState *sd)
392 {
393 /* All voltages OK */
394 sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
395
396 if (sd_is_spi(sd)) {
397 /*
398 * We don't need to emulate power up sequence in SPI-mode.
399 * Thus, the card's power up status bit should be set to 1 when reset.
400 * The card's capacity status bit should also be set if SD card size
401 * is larger than 2GB for SDHC support.
402 */
403 sd_ocr_powerup(sd);
404 }
405 }
406
407 /* SD Configuration register */
408
409 static void sd_set_scr(SDState *sd)
410 {
411 sd->scr[0] = 0 << 4; /* SCR structure version 1.0 */
412 if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
413 sd->scr[0] |= 1; /* Spec Version 1.10 */
414 } else {
415 sd->scr[0] |= 2; /* Spec Version 2.00 or Version 3.0X */
416 }
417 sd->scr[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
418 | 0b0101; /* 1-bit or 4-bit width bus modes */
419 sd->scr[2] = 0x00; /* Extended Security is not supported. */
420 if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
421 sd->scr[2] |= 1 << 7; /* Spec Version 3.0X */
422 }
423 sd->scr[3] = 0x00;
424 /* reserved for manufacturer usage */
425 sd->scr[4] = 0x00;
426 sd->scr[5] = 0x00;
427 sd->scr[6] = 0x00;
428 sd->scr[7] = 0x00;
429 }
430
431 /* Card IDentification register */
432
433 #define MID 0xaa
434 #define OID "XY"
435 #define PNM "QEMU!"
436 #define PRV 0x01
437 #define MDT_YR 2006
438 #define MDT_MON 2
439
440 static void sd_set_cid(SDState *sd)
441 {
442 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
443 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
444 sd->cid[2] = OID[1];
445 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
446 sd->cid[4] = PNM[1];
447 sd->cid[5] = PNM[2];
448 sd->cid[6] = PNM[3];
449 sd->cid[7] = PNM[4];
450 sd->cid[8] = PRV; /* Fake product revision (PRV) */
451 stl_be_p(&sd->cid[9], 0xdeadbeef); /* Fake serial number (PSN) */
452 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */
453 ((MDT_YR - 2000) / 10);
454 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
455 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
456 }
457
458 static void emmc_set_cid(SDState *sd)
459 {
460 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
461 sd->cid[1] = 0b01; /* CBX: soldered BGA */
462 sd->cid[2] = OID[0]; /* OEM/Application ID (OID) */
463 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
464 sd->cid[4] = PNM[1];
465 sd->cid[5] = PNM[2];
466 sd->cid[6] = PNM[3];
467 sd->cid[7] = PNM[4];
468 sd->cid[8] = PNM[4];
469 sd->cid[9] = PRV; /* Fake product revision (PRV) */
470 stl_be_p(&sd->cid[10], 0xdeadbeef); /* Fake serial number (PSN) */
471 sd->cid[14] = (MDT_MON << 4) | (MDT_YR - 1997); /* Manufacture date (MDT) */
472 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
473 }
474
475 /* Card-Specific Data register */
476
477 #define HWBLOCK_SHIFT 9 /* 512 bytes */
478 #define SECTOR_SHIFT 5 /* 16 kilobytes */
479 #define WPGROUP_SHIFT 7 /* 2 megs */
480 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
481 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
482
483 static const uint8_t sd_csd_rw_mask[16] = {
484 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
485 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
486 };
487
488 static void emmc_set_ext_csd(SDState *sd, uint64_t size)
489 {
490 uint32_t sectcount = size >> HWBLOCK_SHIFT;
491
492 memset(sd->ext_csd, 0, sizeof(sd->ext_csd)); /* FIXME only RW at reset */
493
494 /* Properties segment (RO) */
495 sd->ext_csd[EXT_CSD_S_CMD_SET] = 0b1; /* supported command sets */
496 sd->ext_csd[EXT_CSD_BOOT_INFO] = 0x0; /* Boot information */
497 /* Boot partition size. 128KB unit */
498 sd->ext_csd[EXT_CSD_BOOT_MULT] = sd->boot_part_size / (128 * KiB);
499 sd->ext_csd[EXT_CSD_ACC_SIZE] = 0x1; /* Access size */
500 sd->ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE] = 0x01; /* HC Erase unit size */
501 sd->ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT] = 0x01; /* HC erase timeout */
502 sd->ext_csd[EXT_CSD_REL_WR_SEC_C] = 0x1; /* Reliable write sector count */
503 sd->ext_csd[EXT_CSD_HC_WP_GRP_SIZE] = 0x01; /* HC write protect group size */
504 sd->ext_csd[EXT_CSD_S_C_VCC] = 0x01; /* Sleep current VCC */
505 sd->ext_csd[EXT_CSD_S_C_VCCQ] = 0x01; /* Sleep current VCCQ */
506 sd->ext_csd[EXT_CSD_S_A_TIMEOUT] = 0x01; /* Sleep/Awake timeout */
507 stl_le_p(&sd->ext_csd[EXT_CSD_SEC_CNT], sectcount); /* Sector count */
508 sd->ext_csd[210] = 0x46; /* Min write perf for 8bit@52Mhz */
509 sd->ext_csd[209] = 0x46; /* Min read perf for 8bit@52Mhz */
510 sd->ext_csd[208] = 0x46; /* Min write perf for 4bit@52Mhz */
511 sd->ext_csd[207] = 0x46; /* Min read perf for 4bit@52Mhz */
512 sd->ext_csd[206] = 0x46; /* Min write perf for 4bit@26Mhz */
513 sd->ext_csd[205] = 0x46; /* Min read perf for 4bit@26Mhz */
514 sd->ext_csd[EXT_CSD_CARD_TYPE] = 0b11;
515 sd->ext_csd[EXT_CSD_STRUCTURE] = 2;
516 sd->ext_csd[EXT_CSD_REV] = 3;
517
518 /* Mode segment (RW) */
519 sd->ext_csd[EXT_CSD_PART_CONFIG] = sd->boot_config;
520 }
521
522 static void emmc_set_csd(SDState *sd, uint64_t size)
523 {
524 int hwblock_shift = HWBLOCK_SHIFT;
525 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
526 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
527
528 sd->csd[0] = (3 << 6) | (4 << 2); /* Spec v4.3 with EXT_CSD */
529 sd->csd[1] = (1 << 3) | 6; /* Asynchronous data access time: 1ms */
530 sd->csd[2] = 0x00;
531 sd->csd[3] = (1 << 3) | 3;; /* Maximum bus clock frequency: 100MHz */
532 sd->csd[4] = 0x0f;
533 if (size <= 2 * GiB) {
534 /* use 1k blocks */
535 uint32_t csize1k = (size >> (CMULT_SHIFT + 10)) - 1;
536 sd->csd[5] = 0x5a;
537 sd->csd[6] = 0x80 | ((csize1k >> 10) & 0xf);
538 sd->csd[7] = (csize1k >> 2) & 0xff;
539 } else { /* >= 2GB : size stored in ext CSD, block addressing */
540 sd->csd[5] = 0x59;
541 sd->csd[6] = 0x8f;
542 sd->csd[7] = 0xff;
543 sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
544 }
545 sd->csd[8] = 0xff;
546 sd->csd[9] = 0xfc | /* Max. write current */
547 ((CMULT_SHIFT - 2) >> 1);
548 sd->csd[10] = 0x40 | /* Erase sector size */
549 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
550 sd->csd[11] = 0x00 | /* Write protect group size */
551 ((sectsize << 7) & 0x80) | wpsize;
552 sd->csd[12] = 0x90 | /* Write speed factor */
553 (hwblock_shift >> 2);
554 sd->csd[13] = 0x20 | /* Max. write data block length */
555 ((hwblock_shift << 6) & 0xc0);
556 sd->csd[14] = 0x00;
557 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
558 emmc_set_ext_csd(sd, size);
559 }
560
561 static void sd_set_csd(SDState *sd, uint64_t size)
562 {
563 int hwblock_shift = HWBLOCK_SHIFT;
564 uint32_t csize;
565 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
566 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
567
568 /* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
569 if (size == SDSC_MAX_CAPACITY) {
570 hwblock_shift += 1;
571 }
572 csize = (size >> (CMULT_SHIFT + hwblock_shift)) - 1;
573
574 if (size <= SDSC_MAX_CAPACITY) { /* Standard Capacity SD */
575 sd->csd[0] = 0x00; /* CSD structure */
576 sd->csd[1] = 0x26; /* Data read access-time-1 */
577 sd->csd[2] = 0x00; /* Data read access-time-2 */
578 sd->csd[3] = 0x32; /* Max. data transfer rate: 25 MHz */
579 sd->csd[4] = 0x5f; /* Card Command Classes */
580 sd->csd[5] = 0x50 | /* Max. read data block length */
581 hwblock_shift;
582 sd->csd[6] = 0xe0 | /* Partial block for read allowed */
583 ((csize >> 10) & 0x03);
584 sd->csd[7] = 0x00 | /* Device size */
585 ((csize >> 2) & 0xff);
586 sd->csd[8] = 0x3f | /* Max. read current */
587 ((csize << 6) & 0xc0);
588 sd->csd[9] = 0xfc | /* Max. write current */
589 ((CMULT_SHIFT - 2) >> 1);
590 sd->csd[10] = 0x40 | /* Erase sector size */
591 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
592 sd->csd[11] = 0x00 | /* Write protect group size */
593 ((sectsize << 7) & 0x80) | wpsize;
594 sd->csd[12] = 0x90 | /* Write speed factor */
595 (hwblock_shift >> 2);
596 sd->csd[13] = 0x20 | /* Max. write data block length */
597 ((hwblock_shift << 6) & 0xc0);
598 sd->csd[14] = 0x00; /* File format group */
599 } else { /* SDHC */
600 size /= 512 * KiB;
601 size -= 1;
602 sd->csd[0] = 0x40;
603 sd->csd[1] = 0x0e;
604 sd->csd[2] = 0x00;
605 sd->csd[3] = 0x32;
606 sd->csd[4] = 0x5b;
607 sd->csd[5] = 0x59;
608 sd->csd[6] = 0x00;
609 st24_be_p(&sd->csd[7], size);
610 sd->csd[10] = 0x7f;
611 sd->csd[11] = 0x80;
612 sd->csd[12] = 0x0a;
613 sd->csd[13] = 0x40;
614 sd->csd[14] = 0x00;
615 }
616 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
617 }
618
619 /* Relative Card Address register */
620
621 static void sd_set_rca(SDState *sd, uint16_t value)
622 {
623 trace_sdcard_set_rca(value);
624 sd->rca = value;
625 }
626
627 static uint16_t sd_req_get_rca(SDState *s, SDRequest req)
628 {
629 switch (s->proto->cmd[req.cmd].type) {
630 case sd_ac:
631 case sd_adtc:
632 return req.arg >> 16;
633 case sd_spi:
634 default:
635 g_assert_not_reached();
636 }
637 }
638
639 static bool sd_req_rca_same(SDState *s, SDRequest req)
640 {
641 return sd_req_get_rca(s, req) == s->rca;
642 }
643
644 /* Card Status register */
645
646 FIELD(CSR, AKE_SEQ_ERROR, 3, 1)
647 FIELD(CSR, APP_CMD, 5, 1)
648 FIELD(CSR, FX_EVENT, 6, 1)
649 FIELD(CSR, SWITCH_ERROR, 7, 1)
650 FIELD(CSR, READY_FOR_DATA, 8, 1)
651 FIELD(CSR, CURRENT_STATE, 9, 4)
652 FIELD(CSR, ERASE_RESET, 13, 1)
653 FIELD(CSR, CARD_ECC_DISABLED, 14, 1)
654 FIELD(CSR, WP_ERASE_SKIP, 15, 1)
655 FIELD(CSR, CSD_OVERWRITE, 16, 1)
656 FIELD(CSR, DEFERRED_RESPONSE, 17, 1)
657 FIELD(CSR, ERROR, 19, 1)
658 FIELD(CSR, CC_ERROR, 20, 1)
659 FIELD(CSR, CARD_ECC_FAILED, 21, 1)
660 FIELD(CSR, ILLEGAL_COMMAND, 22, 1)
661 FIELD(CSR, COM_CRC_ERROR, 23, 1)
662 FIELD(CSR, LOCK_UNLOCK_FAILED, 24, 1)
663 FIELD(CSR, CARD_IS_LOCKED, 25, 1)
664 FIELD(CSR, WP_VIOLATION, 26, 1)
665 FIELD(CSR, ERASE_PARAM, 27, 1)
666 FIELD(CSR, ERASE_SEQ_ERROR, 28, 1)
667 FIELD(CSR, BLOCK_LEN_ERROR, 29, 1)
668 FIELD(CSR, ADDRESS_ERROR, 30, 1)
669 FIELD(CSR, OUT_OF_RANGE, 31, 1)
670
671 /* Card status bits, split by clear condition:
672 * A : According to the card current state
673 * B : Always related to the previous command
674 * C : Cleared by read
675 */
676 #define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
677 | R_CSR_CARD_ECC_DISABLED_MASK \
678 | R_CSR_CARD_IS_LOCKED_MASK)
679 #define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
680 | R_CSR_ILLEGAL_COMMAND_MASK \
681 | R_CSR_COM_CRC_ERROR_MASK)
682 #define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
683 | R_CSR_APP_CMD_MASK \
684 | R_CSR_ERASE_RESET_MASK \
685 | R_CSR_WP_ERASE_SKIP_MASK \
686 | R_CSR_CSD_OVERWRITE_MASK \
687 | R_CSR_ERROR_MASK \
688 | R_CSR_CC_ERROR_MASK \
689 | R_CSR_CARD_ECC_FAILED_MASK \
690 | R_CSR_LOCK_UNLOCK_FAILED_MASK \
691 | R_CSR_WP_VIOLATION_MASK \
692 | R_CSR_ERASE_PARAM_MASK \
693 | R_CSR_ERASE_SEQ_ERROR_MASK \
694 | R_CSR_BLOCK_LEN_ERROR_MASK \
695 | R_CSR_ADDRESS_ERROR_MASK \
696 | R_CSR_OUT_OF_RANGE_MASK)
697
698 static void sd_set_cardstatus(SDState *sd)
699 {
700 sd->card_status = READY_FOR_DATA;
701 }
702
703 static void sd_set_sdstatus(SDState *sd)
704 {
705 memset(sd->sd_status, 0, 64);
706 }
707
708 static const uint8_t sd_tuning_block_pattern4[64] = {
709 /*
710 * See: Physical Layer Simplified Specification Version 3.01,
711 * Table 4-2.
712 */
713 0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
714 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
715 0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
716 0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
717 0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
718 0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
719 0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
720 0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde
721 };
722
723 static int sd_req_crc_validate(SDRequest *req)
724 {
725 uint8_t buffer[5];
726 buffer[0] = 0x40 | req->cmd;
727 stl_be_p(&buffer[1], req->arg);
728 return 0;
729 return sd_crc7(buffer, 5) != req->crc; /* TODO */
730 }
731
732 static void sd_response_r1_make(SDState *sd, uint8_t *response)
733 {
734 stl_be_p(response, sd->card_status);
735
736 /* Clear the "clear on read" status bits */
737 sd->card_status &= ~CARD_STATUS_C;
738 }
739
740 static void sd_response_r3_make(SDState *sd, uint8_t *response)
741 {
742 stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
743 }
744
745 static void sd_response_r6_make(SDState *sd, uint8_t *response)
746 {
747 uint16_t status;
748
749 status = ((sd->card_status >> 8) & 0xc000) |
750 ((sd->card_status >> 6) & 0x2000) |
751 (sd->card_status & 0x1fff);
752 sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
753 stw_be_p(response + 0, sd->rca);
754 stw_be_p(response + 2, status);
755 }
756
757 static void sd_response_r7_make(SDState *sd, uint8_t *response)
758 {
759 stl_be_p(response, sd->vhs);
760 }
761
762 static uint32_t sd_blk_len(SDState *sd)
763 {
764 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
765 return 1 << HWBLOCK_SHIFT;
766 }
767 return sd->blk_len;
768 }
769
770 /*
771 * This requires a disk image that has two boot partitions inserted at the
772 * beginning of it. The size of the boot partitions is the "boot-size"
773 * property.
774 */
775 static uint32_t sd_bootpart_offset(SDState *sd)
776 {
777 unsigned partition_access;
778
779 if (!sd->boot_part_size || !sd_is_emmc(sd)) {
780 return 0;
781 }
782
783 partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
784 & EXT_CSD_PART_CONFIG_ACC_MASK;
785 switch (partition_access) {
786 case EXT_CSD_PART_CONFIG_ACC_DEFAULT:
787 return sd->boot_part_size * 2;
788 case EXT_CSD_PART_CONFIG_ACC_BOOT0:
789 return 0;
790 case EXT_CSD_PART_CONFIG_ACC_BOOT0 + 1:
791 return sd->boot_part_size * 1;
792 default:
793 g_assert_not_reached();
794 }
795 }
796
797 static uint64_t sd_req_get_address(SDState *sd, SDRequest req)
798 {
799 uint64_t addr;
800
801 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
802 addr = (uint64_t) req.arg << HWBLOCK_SHIFT;
803 } else {
804 addr = req.arg;
805 }
806 trace_sdcard_req_addr(req.arg, addr);
807 return addr;
808 }
809
810 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
811 {
812 return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
813 }
814
815 static void sd_reset(DeviceState *dev)
816 {
817 SDState *sd = SDMMC_COMMON(dev);
818 SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
819 uint64_t size;
820 uint64_t sect;
821
822 trace_sdcard_reset();
823 if (sd->blk) {
824 blk_get_geometry(sd->blk, &sect);
825 } else {
826 sect = 0;
827 }
828 size = sect << HWBLOCK_SHIFT;
829 size -= sd_bootpart_offset(sd);
830
831 sect = sd_addr_to_wpnum(size) + 1;
832
833 sd->state = sd_idle_state;
834
835 /* card registers */
836 sd->rca = sd_is_emmc(sd) ? 0x0001 : 0x0000;
837 sd->size = size;
838 sd_set_ocr(sd);
839 sd_set_scr(sd);
840 sc->set_cid(sd);
841 sc->set_csd(sd, size);
842 sd_set_cardstatus(sd);
843 sd_set_sdstatus(sd);
844
845 g_free(sd->wp_group_bmap);
846 sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false;
847 sd->wp_group_bits = sect;
848 sd->wp_group_bmap = bitmap_new(sd->wp_group_bits);
849 memset(sd->function_group, 0, sizeof(sd->function_group));
850 sd->erase_start = INVALID_ADDRESS;
851 sd->erase_end = INVALID_ADDRESS;
852 sd->blk_len = 0x200;
853 sd->pwd_len = 0;
854 sd->expecting_acmd = false;
855 sd->dat_lines = 0xf;
856 sd->cmd_line = true;
857 sd->multi_blk_cnt = 0;
858 }
859
860 static bool sd_get_inserted(SDState *sd)
861 {
862 return sd->blk && blk_is_inserted(sd->blk);
863 }
864
865 static bool sd_get_readonly(SDState *sd)
866 {
867 return sd->wp_switch;
868 }
869
870 static void sd_cardchange(void *opaque, bool load, Error **errp)
871 {
872 SDState *sd = opaque;
873 DeviceState *dev = DEVICE(sd);
874 SDBus *sdbus;
875 bool inserted = sd_get_inserted(sd);
876 bool readonly = sd_get_readonly(sd);
877
878 if (inserted) {
879 trace_sdcard_inserted(readonly);
880 sd_reset(dev);
881 } else {
882 trace_sdcard_ejected();
883 }
884
885 if (sd->me_no_qdev_me_kill_mammoth_with_rocks) {
886 qemu_set_irq(sd->inserted_cb, inserted);
887 if (inserted) {
888 qemu_set_irq(sd->readonly_cb, readonly);
889 }
890 } else {
891 sdbus = SD_BUS(qdev_get_parent_bus(dev));
892 sdbus_set_inserted(sdbus, inserted);
893 if (inserted) {
894 sdbus_set_readonly(sdbus, readonly);
895 }
896 }
897 }
898
899 static const BlockDevOps sd_block_ops = {
900 .change_media_cb = sd_cardchange,
901 };
902
903 static bool sd_ocr_vmstate_needed(void *opaque)
904 {
905 SDState *sd = opaque;
906
907 /* Include the OCR state (and timer) if it is not yet powered up */
908 return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
909 }
910
911 static const VMStateDescription sd_ocr_vmstate = {
912 .name = "sd-card/ocr-state",
913 .version_id = 1,
914 .minimum_version_id = 1,
915 .needed = sd_ocr_vmstate_needed,
916 .fields = (const VMStateField[]) {
917 VMSTATE_UINT32(ocr, SDState),
918 VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
919 VMSTATE_END_OF_LIST()
920 },
921 };
922
923 static bool vmstate_needed_for_emmc(void *opaque)
924 {
925 SDState *sd = opaque;
926
927 return sd_is_emmc(sd);
928 }
929
930 static const VMStateDescription emmc_extcsd_vmstate = {
931 .name = "sd-card/ext_csd_modes-state",
932 .version_id = 1,
933 .minimum_version_id = 1,
934 .needed = vmstate_needed_for_emmc,
935 .fields = (const VMStateField[]) {
936 VMSTATE_UINT8_ARRAY(ext_csd_rw, SDState, 192),
937 VMSTATE_END_OF_LIST()
938 },
939 };
940
941 static int sd_vmstate_pre_load(void *opaque)
942 {
943 SDState *sd = opaque;
944
945 /* If the OCR state is not included (prior versions, or not
946 * needed), then the OCR must be set as powered up. If the OCR state
947 * is included, this will be replaced by the state restore.
948 */
949 sd_ocr_powerup(sd);
950
951 return 0;
952 }
953
954 static const VMStateDescription sd_vmstate = {
955 .name = "sd-card",
956 .version_id = 2,
957 .minimum_version_id = 2,
958 .pre_load = sd_vmstate_pre_load,
959 .fields = (const VMStateField[]) {
960 VMSTATE_UINT32(mode, SDState),
961 VMSTATE_INT32(state, SDState),
962 VMSTATE_UINT8_ARRAY(cid, SDState, 16),
963 VMSTATE_UINT8_ARRAY(csd, SDState, 16),
964 VMSTATE_UINT16(rca, SDState),
965 VMSTATE_UINT32(card_status, SDState),
966 VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
967 VMSTATE_UINT32(vhs, SDState),
968 VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits),
969 VMSTATE_UINT32(blk_len, SDState),
970 VMSTATE_UINT32(multi_blk_cnt, SDState),
971 VMSTATE_UINT32(erase_start, SDState),
972 VMSTATE_UINT32(erase_end, SDState),
973 VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
974 VMSTATE_UINT32(pwd_len, SDState),
975 VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
976 VMSTATE_UINT8(current_cmd, SDState),
977 VMSTATE_BOOL(expecting_acmd, SDState),
978 VMSTATE_UINT32(blk_written, SDState),
979 VMSTATE_UINT64(data_start, SDState),
980 VMSTATE_UINT32(data_offset, SDState),
981 VMSTATE_UINT8_ARRAY(data, SDState, 512),
982 VMSTATE_UNUSED_V(1, 512),
983 VMSTATE_BOOL(enable, SDState),
984 VMSTATE_END_OF_LIST()
985 },
986 .subsections = (const VMStateDescription * const []) {
987 &sd_ocr_vmstate,
988 &emmc_extcsd_vmstate,
989 NULL
990 },
991 };
992
993 /* Legacy initialization function for use by non-qdevified callers */
994 SDState *sd_init(BlockBackend *blk, bool is_spi)
995 {
996 Object *obj;
997 DeviceState *dev;
998 SDState *sd;
999 Error *err = NULL;
1000
1001 obj = object_new(is_spi ? TYPE_SD_CARD_SPI : TYPE_SD_CARD);
1002 dev = DEVICE(obj);
1003 if (!qdev_prop_set_drive_err(dev, "drive", blk, &err)) {
1004 error_reportf_err(err, "sd_init failed: ");
1005 return NULL;
1006 }
1007
1008 /*
1009 * Realizing the device properly would put it into the QOM
1010 * composition tree even though it is not plugged into an
1011 * appropriate bus. That's a no-no. Hide the device from
1012 * QOM/qdev, and call its qdev realize callback directly.
1013 */
1014 object_ref(obj);
1015 object_unparent(obj);
1016 sd_realize(dev, &err);
1017 if (err) {
1018 error_reportf_err(err, "sd_init failed: ");
1019 return NULL;
1020 }
1021
1022 sd = SD_CARD(dev);
1023 sd->me_no_qdev_me_kill_mammoth_with_rocks = true;
1024 return sd;
1025 }
1026
1027 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
1028 {
1029 sd->readonly_cb = readonly;
1030 sd->inserted_cb = insert;
1031 qemu_set_irq(readonly, sd->blk ? !blk_is_writable(sd->blk) : 0);
1032 qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
1033 }
1034
1035 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1036 {
1037 trace_sdcard_read_block(addr, len);
1038 addr += sd_bootpart_offset(sd);
1039 if (!sd->blk || blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {
1040 fprintf(stderr, "sd_blk_read: read error on host side\n");
1041 }
1042 }
1043
1044 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1045 {
1046 trace_sdcard_write_block(addr, len);
1047 addr += sd_bootpart_offset(sd);
1048 if (!sd->blk || blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {
1049 fprintf(stderr, "sd_blk_write: write error on host side\n");
1050 }
1051 }
1052
1053 static void sd_erase(SDState *sd)
1054 {
1055 uint64_t erase_start = sd->erase_start;
1056 uint64_t erase_end = sd->erase_end;
1057 bool sdsc = true;
1058 uint64_t wpnum;
1059 uint64_t erase_addr;
1060 int erase_len = 1 << HWBLOCK_SHIFT;
1061
1062 trace_sdcard_erase(sd->erase_start, sd->erase_end);
1063 if (sd->erase_start == INVALID_ADDRESS
1064 || sd->erase_end == INVALID_ADDRESS) {
1065 sd->card_status |= ERASE_SEQ_ERROR;
1066 sd->erase_start = INVALID_ADDRESS;
1067 sd->erase_end = INVALID_ADDRESS;
1068 return;
1069 }
1070
1071 if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
1072 /* High capacity memory card: erase units are 512 byte blocks */
1073 erase_start <<= HWBLOCK_SHIFT;
1074 erase_end <<= HWBLOCK_SHIFT;
1075 sdsc = false;
1076 }
1077
1078 if (erase_start > sd->size || erase_end > sd->size) {
1079 sd->card_status |= OUT_OF_RANGE;
1080 sd->erase_start = INVALID_ADDRESS;
1081 sd->erase_end = INVALID_ADDRESS;
1082 return;
1083 }
1084
1085 sd->erase_start = INVALID_ADDRESS;
1086 sd->erase_end = INVALID_ADDRESS;
1087 sd->csd[14] |= 0x40;
1088
1089 memset(sd->data, 0xff, erase_len);
1090 for (erase_addr = erase_start; erase_addr <= erase_end;
1091 erase_addr += erase_len) {
1092 if (sdsc) {
1093 /* Only SDSC cards support write protect groups */
1094 wpnum = sd_addr_to_wpnum(erase_addr);
1095 assert(wpnum < sd->wp_group_bits);
1096 if (test_bit(wpnum, sd->wp_group_bmap)) {
1097 sd->card_status |= WP_ERASE_SKIP;
1098 continue;
1099 }
1100 }
1101 sd_blk_write(sd, erase_addr, erase_len);
1102 }
1103 }
1104
1105 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
1106 {
1107 uint32_t i, wpnum;
1108 uint32_t ret = 0;
1109
1110 wpnum = sd_addr_to_wpnum(addr);
1111
1112 for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
1113 if (addr >= sd->size) {
1114 /*
1115 * If the addresses of the last groups are outside the valid range,
1116 * then the corresponding write protection bits shall be set to 0.
1117 */
1118 continue;
1119 }
1120 assert(wpnum < sd->wp_group_bits);
1121 if (test_bit(wpnum, sd->wp_group_bmap)) {
1122 ret |= (1 << i);
1123 }
1124 }
1125
1126 return ret;
1127 }
1128
1129 enum ExtCsdAccessMode {
1130 EXT_CSD_ACCESS_MODE_COMMAND_SET = 0,
1131 EXT_CSD_ACCESS_MODE_SET_BITS = 1,
1132 EXT_CSD_ACCESS_MODE_CLEAR_BITS = 2,
1133 EXT_CSD_ACCESS_MODE_WRITE_BYTE = 3
1134 };
1135
1136 static void emmc_function_switch(SDState *sd, uint32_t arg)
1137 {
1138 uint8_t access = extract32(arg, 24, 2);
1139 uint8_t index = extract32(arg, 16, 8);
1140 uint8_t value = extract32(arg, 8, 8);
1141 uint8_t b = sd->ext_csd[index];
1142
1143 trace_sdcard_switch(access, index, value, extract32(arg, 0, 2));
1144
1145 if (index >= 192) {
1146 qemu_log_mask(LOG_GUEST_ERROR, "MMC switching illegal offset\n");
1147 sd->card_status |= R_CSR_SWITCH_ERROR_MASK;
1148 return;
1149 }
1150
1151 switch (access) {
1152 case EXT_CSD_ACCESS_MODE_COMMAND_SET:
1153 qemu_log_mask(LOG_UNIMP, "MMC Command set switching not supported\n");
1154 return;
1155 case EXT_CSD_ACCESS_MODE_SET_BITS:
1156 b |= value;
1157 break;
1158 case EXT_CSD_ACCESS_MODE_CLEAR_BITS:
1159 b &= ~value;
1160 break;
1161 case EXT_CSD_ACCESS_MODE_WRITE_BYTE:
1162 b = value;
1163 break;
1164 }
1165
1166 trace_sdcard_ext_csd_update(index, sd->ext_csd[index], b);
1167 sd->ext_csd[index] = b;
1168 }
1169
1170 static void sd_function_switch(SDState *sd, uint32_t arg)
1171 {
1172 int i, mode, new_func;
1173 mode = !!(arg & 0x80000000);
1174
1175 sd->data[0] = 0x00; /* Maximum current consumption */
1176 sd->data[1] = 0x01;
1177 sd->data[2] = 0x80; /* Supported group 6 functions */
1178 sd->data[3] = 0x01;
1179 sd->data[4] = 0x80; /* Supported group 5 functions */
1180 sd->data[5] = 0x01;
1181 sd->data[6] = 0x80; /* Supported group 4 functions */
1182 sd->data[7] = 0x01;
1183 sd->data[8] = 0x80; /* Supported group 3 functions */
1184 sd->data[9] = 0x01;
1185 sd->data[10] = 0x80; /* Supported group 2 functions */
1186 sd->data[11] = 0x43;
1187 sd->data[12] = 0x80; /* Supported group 1 functions */
1188 sd->data[13] = 0x03;
1189
1190 memset(&sd->data[14], 0, 3);
1191 for (i = 0; i < 6; i ++) {
1192 new_func = (arg >> (i * 4)) & 0x0f;
1193 if (mode && new_func != 0x0f)
1194 sd->function_group[i] = new_func;
1195 sd->data[16 - (i >> 1)] |= new_func << ((i % 2) * 4);
1196 }
1197 memset(&sd->data[17], 0, 47);
1198 }
1199
1200 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
1201 {
1202 return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1203 }
1204
1205 static void sd_lock_command(SDState *sd)
1206 {
1207 int erase, lock, clr_pwd, set_pwd, pwd_len;
1208 erase = !!(sd->data[0] & 0x08);
1209 lock = sd->data[0] & 0x04;
1210 clr_pwd = sd->data[0] & 0x02;
1211 set_pwd = sd->data[0] & 0x01;
1212
1213 if (sd->blk_len > 1)
1214 pwd_len = sd->data[1];
1215 else
1216 pwd_len = 0;
1217
1218 if (lock) {
1219 trace_sdcard_lock();
1220 } else {
1221 trace_sdcard_unlock();
1222 }
1223 if (erase) {
1224 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
1225 set_pwd || clr_pwd || lock || sd->wp_switch ||
1226 (sd->csd[14] & 0x20)) {
1227 sd->card_status |= LOCK_UNLOCK_FAILED;
1228 return;
1229 }
1230 bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits);
1231 sd->csd[14] &= ~0x10;
1232 sd->card_status &= ~CARD_IS_LOCKED;
1233 sd->pwd_len = 0;
1234 /* Erasing the entire card here! */
1235 fprintf(stderr, "SD: Card force-erased by CMD42\n");
1236 return;
1237 }
1238
1239 if (sd->blk_len < 2 + pwd_len ||
1240 pwd_len <= sd->pwd_len ||
1241 pwd_len > sd->pwd_len + 16) {
1242 sd->card_status |= LOCK_UNLOCK_FAILED;
1243 return;
1244 }
1245
1246 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
1247 sd->card_status |= LOCK_UNLOCK_FAILED;
1248 return;
1249 }
1250
1251 pwd_len -= sd->pwd_len;
1252 if ((pwd_len && !set_pwd) ||
1253 (clr_pwd && (set_pwd || lock)) ||
1254 (lock && !sd->pwd_len && !set_pwd) ||
1255 (!set_pwd && !clr_pwd &&
1256 (((sd->card_status & CARD_IS_LOCKED) && lock) ||
1257 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
1258 sd->card_status |= LOCK_UNLOCK_FAILED;
1259 return;
1260 }
1261
1262 if (set_pwd) {
1263 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
1264 sd->pwd_len = pwd_len;
1265 }
1266
1267 if (clr_pwd) {
1268 sd->pwd_len = 0;
1269 }
1270
1271 if (lock)
1272 sd->card_status |= CARD_IS_LOCKED;
1273 else
1274 sd->card_status &= ~CARD_IS_LOCKED;
1275 }
1276
1277 static bool address_in_range(SDState *sd, const char *desc,
1278 uint64_t addr, uint32_t length)
1279 {
1280 if (addr + length > sd->size) {
1281 qemu_log_mask(LOG_GUEST_ERROR,
1282 "%s offset %"PRIu64" > card %"PRIu64" [%%%u]\n",
1283 desc, addr, sd->size, length);
1284 sd->card_status |= ADDRESS_ERROR;
1285 return false;
1286 }
1287 return true;
1288 }
1289
1290 static sd_rsp_type_t sd_invalid_state_for_cmd(SDState *sd, SDRequest req)
1291 {
1292 qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1293 sd->proto->name, req.cmd, sd_state_name(sd->state),
1294 sd_version_str(sd->spec_version));
1295
1296 return sd_illegal;
1297 }
1298
1299 static sd_rsp_type_t sd_invalid_mode_for_cmd(SDState *sd, SDRequest req)
1300 {
1301 qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
1302 sd->proto->name, req.cmd, sd_mode_name(sd->mode),
1303 sd_version_str(sd->spec_version));
1304
1305 return sd_illegal;
1306 }
1307
1308 static sd_rsp_type_t sd_cmd_illegal(SDState *sd, SDRequest req)
1309 {
1310 qemu_log_mask(LOG_GUEST_ERROR, "%s: Unknown CMD%i for spec %s\n",
1311 sd->proto->name, req.cmd,
1312 sd_version_str(sd->spec_version));
1313
1314 return sd_illegal;
1315 }
1316
1317 /* Commands that are recognised but not yet implemented. */
1318 static sd_rsp_type_t sd_cmd_unimplemented(SDState *sd, SDRequest req)
1319 {
1320 qemu_log_mask(LOG_UNIMP, "%s: CMD%i not implemented\n",
1321 sd->proto->name, req.cmd);
1322
1323 return sd_illegal;
1324 }
1325
1326 static sd_rsp_type_t sd_cmd_optional(SDState *sd, SDRequest req)
1327 {
1328 qemu_log_mask(LOG_UNIMP, "%s: Optional CMD%i not implemented\n",
1329 sd->proto->name, req.cmd);
1330
1331 return sd_illegal;
1332 }
1333
1334 /* Configure fields for following sd_generic_write_byte() calls */
1335 static sd_rsp_type_t sd_cmd_to_receivingdata(SDState *sd, SDRequest req,
1336 uint64_t start, size_t size)
1337 {
1338 if (sd->state != sd_transfer_state) {
1339 return sd_invalid_state_for_cmd(sd, req);
1340 }
1341 sd->state = sd_receivingdata_state;
1342 sd->data_start = start;
1343 sd->data_offset = 0;
1344 /* sd->data[] used as receive buffer */
1345 sd->data_size = size ?: sizeof(sd->data);
1346 return sd_r1;
1347 }
1348
1349 /* Configure fields for following sd_generic_read_byte() calls */
1350 static sd_rsp_type_t sd_cmd_to_sendingdata(SDState *sd, SDRequest req,
1351 uint64_t start,
1352 const void *data, size_t size)
1353 {
1354 if (sd->state != sd_transfer_state) {
1355 sd_invalid_state_for_cmd(sd, req);
1356 }
1357
1358 sd->state = sd_sendingdata_state;
1359 sd->data_start = start;
1360 sd->data_offset = 0;
1361 if (data) {
1362 assert(size > 0 && size <= sizeof(sd->data));
1363 memcpy(sd->data, data, size);
1364 }
1365 if (size) {
1366 sd->data_size = size;
1367 }
1368 return sd_r1;
1369 }
1370
1371 /* CMD0 */
1372 static sd_rsp_type_t sd_cmd_GO_IDLE_STATE(SDState *sd, SDRequest req)
1373 {
1374 if (sd->state == sd_sleep_state) {
1375 switch (req.arg) {
1376 case 0x00000000:
1377 case 0xf0f0f0f0:
1378 break;
1379 default:
1380 return sd_r0;
1381 }
1382 }
1383 if (sd->state != sd_inactive_state) {
1384 sd->state = sd_idle_state;
1385 sd_reset(DEVICE(sd));
1386 }
1387
1388 return sd_is_spi(sd) ? sd_r1 : sd_r0;
1389 }
1390
1391 /* CMD1 */
1392 static sd_rsp_type_t spi_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
1393 {
1394 sd->state = sd_transfer_state;
1395
1396 return sd_r1;
1397 }
1398
1399 /* CMD2 */
1400 static sd_rsp_type_t sd_cmd_ALL_SEND_CID(SDState *sd, SDRequest req)
1401 {
1402 switch (sd->state) {
1403 case sd_ready_state:
1404 sd->state = sd_identification_state;
1405 return sd_r2_i;
1406 default:
1407 return sd_invalid_state_for_cmd(sd, req);
1408 }
1409 }
1410
1411 /* CMD3 */
1412 static sd_rsp_type_t sd_cmd_SEND_RELATIVE_ADDR(SDState *sd, SDRequest req)
1413 {
1414 uint16_t random_rca;
1415
1416 switch (sd->state) {
1417 case sd_identification_state:
1418 case sd_standby_state:
1419 sd->state = sd_standby_state;
1420 qemu_guest_getrandom_nofail(&random_rca, sizeof(random_rca));
1421 sd_set_rca(sd, random_rca);
1422 return sd_r6;
1423
1424 default:
1425 return sd_invalid_state_for_cmd(sd, req);
1426 }
1427 }
1428
1429 static sd_rsp_type_t emmc_cmd_SET_RELATIVE_ADDR(SDState *sd, SDRequest req)
1430 {
1431 switch (sd->state) {
1432 case sd_identification_state:
1433 case sd_standby_state:
1434 sd->state = sd_standby_state;
1435 sd_set_rca(sd, req.arg >> 16);
1436 return sd_r1;
1437
1438 default:
1439 return sd_invalid_state_for_cmd(sd, req);
1440 }
1441 }
1442
1443 /* CMD5 */
1444 static sd_rsp_type_t emmc_cmd_sleep_awake(SDState *sd, SDRequest req)
1445 {
1446 bool do_sleep = extract32(req.arg, 15, 1);
1447
1448 switch (sd->state) {
1449 case sd_sleep_state:
1450 if (!do_sleep) {
1451 /* Awake */
1452 sd->state = sd_standby_state;
1453 }
1454 return sd_r1b;
1455
1456 case sd_standby_state:
1457 if (do_sleep) {
1458 sd->state = sd_sleep_state;
1459 }
1460 return sd_r1b;
1461
1462 default:
1463 return sd_invalid_state_for_cmd(sd, req);
1464 }
1465 }
1466
1467 /* CMD6 */
1468 static sd_rsp_type_t sd_cmd_SWITCH_FUNCTION(SDState *sd, SDRequest req)
1469 {
1470 if (sd->mode != sd_data_transfer_mode) {
1471 return sd_invalid_mode_for_cmd(sd, req);
1472 }
1473 if (sd->state != sd_transfer_state) {
1474 return sd_invalid_state_for_cmd(sd, req);
1475 }
1476
1477 sd_function_switch(sd, req.arg);
1478 return sd_cmd_to_sendingdata(sd, req, 0, NULL, 64);
1479 }
1480
1481 static sd_rsp_type_t emmc_cmd_SWITCH(SDState *sd, SDRequest req)
1482 {
1483 switch (sd->state) {
1484 case sd_transfer_state:
1485 sd->state = sd_programming_state;
1486 emmc_function_switch(sd, req.arg);
1487 sd->state = sd_transfer_state;
1488 return sd_r1b;
1489 default:
1490 return sd_invalid_state_for_cmd(sd, req);
1491 }
1492 }
1493
1494 /* CMD7 */
1495 static sd_rsp_type_t sd_cmd_DE_SELECT_CARD(SDState *sd, SDRequest req)
1496 {
1497 bool same_rca = sd_req_rca_same(sd, req);
1498
1499 switch (sd->state) {
1500 case sd_standby_state:
1501 if (!same_rca) {
1502 return sd_r0;
1503 }
1504 sd->state = sd_transfer_state;
1505 return sd_r1b;
1506
1507 case sd_transfer_state:
1508 case sd_sendingdata_state:
1509 if (same_rca) {
1510 break;
1511 }
1512 sd->state = sd_standby_state;
1513 return sd_r1b;
1514
1515 case sd_disconnect_state:
1516 if (!same_rca) {
1517 return sd_r0;
1518 }
1519 sd->state = sd_programming_state;
1520 return sd_r1b;
1521
1522 case sd_programming_state:
1523 if (same_rca) {
1524 break;
1525 }
1526 sd->state = sd_disconnect_state;
1527 return sd_r1b;
1528
1529 default:
1530 break;
1531 }
1532 return sd_invalid_state_for_cmd(sd, req);
1533 }
1534
1535 /* CMD8 */
1536 static sd_rsp_type_t sd_cmd_SEND_IF_COND(SDState *sd, SDRequest req)
1537 {
1538 if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
1539 return sd_cmd_illegal(sd, req);
1540 }
1541 if (sd->state != sd_idle_state) {
1542 return sd_invalid_state_for_cmd(sd, req);
1543 }
1544 sd->vhs = 0;
1545
1546 /* No response if not exactly one VHS bit is set. */
1547 if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
1548 return sd_is_spi(sd) ? sd_r7 : sd_r0;
1549 }
1550
1551 /* Accept. */
1552 sd->vhs = req.arg;
1553 return sd_r7;
1554 }
1555
1556 /* CMD8 */
1557 static sd_rsp_type_t emmc_cmd_SEND_EXT_CSD(SDState *sd, SDRequest req)
1558 {
1559 if (sd->state != sd_transfer_state) {
1560 return sd_invalid_state_for_cmd(sd, req);
1561 }
1562
1563 return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1564 sd->ext_csd, sizeof(sd->ext_csd));
1565 }
1566
1567 /* CMD9 */
1568 static sd_rsp_type_t spi_cmd_SEND_CSD(SDState *sd, SDRequest req)
1569 {
1570 if (sd->state != sd_standby_state) {
1571 return sd_invalid_state_for_cmd(sd, req);
1572 }
1573 return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1574 sd->csd, 16);
1575 }
1576
1577 static sd_rsp_type_t sd_cmd_SEND_CSD(SDState *sd, SDRequest req)
1578 {
1579 if (sd->state != sd_standby_state) {
1580 return sd_invalid_state_for_cmd(sd, req);
1581 }
1582
1583 return sd_req_rca_same(sd, req) ? sd_r2_s : sd_r0;
1584 }
1585
1586 /* CMD10 */
1587 static sd_rsp_type_t spi_cmd_SEND_CID(SDState *sd, SDRequest req)
1588 {
1589 if (sd->state != sd_standby_state) {
1590 return sd_invalid_state_for_cmd(sd, req);
1591 }
1592 return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1593 sd->cid, 16);
1594 }
1595
1596 static sd_rsp_type_t sd_cmd_SEND_CID(SDState *sd, SDRequest req)
1597 {
1598 if (sd->state != sd_standby_state) {
1599 return sd_invalid_state_for_cmd(sd, req);
1600 }
1601
1602 return sd_req_rca_same(sd, req) ? sd_r2_i : sd_r0;
1603 }
1604
1605 /* CMD12 */
1606 static sd_rsp_type_t sd_cmd_STOP_TRANSMISSION(SDState *sd, SDRequest req)
1607 {
1608 switch (sd->state) {
1609 case sd_sendingdata_state:
1610 sd->state = sd_transfer_state;
1611 return sd_r1b;
1612 case sd_receivingdata_state:
1613 sd->state = sd_programming_state;
1614 /* Bzzzzzzztt .... Operation complete. */
1615 sd->state = sd_transfer_state;
1616 return sd_r1;
1617 default:
1618 return sd_invalid_state_for_cmd(sd, req);
1619 }
1620 }
1621
1622 /* CMD13 */
1623 static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
1624 {
1625 if (sd->mode != sd_data_transfer_mode) {
1626 return sd_invalid_mode_for_cmd(sd, req);
1627 }
1628
1629 switch (sd->state) {
1630 case sd_standby_state:
1631 case sd_transfer_state:
1632 case sd_sendingdata_state:
1633 case sd_receivingdata_state:
1634 case sd_programming_state:
1635 case sd_disconnect_state:
1636 break;
1637 default:
1638 return sd_invalid_state_for_cmd(sd, req);
1639 }
1640
1641 if (sd_is_spi(sd)) {
1642 return sd_r2_s;
1643 }
1644
1645 return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;
1646 }
1647
1648 /* CMD15 */
1649 static sd_rsp_type_t sd_cmd_GO_INACTIVE_STATE(SDState *sd, SDRequest req)
1650 {
1651 if (sd->mode != sd_data_transfer_mode) {
1652 return sd_invalid_mode_for_cmd(sd, req);
1653 }
1654 switch (sd->state) {
1655 case sd_standby_state:
1656 case sd_transfer_state:
1657 case sd_sendingdata_state:
1658 case sd_receivingdata_state:
1659 case sd_programming_state:
1660 case sd_disconnect_state:
1661 break;
1662 default:
1663 return sd_invalid_state_for_cmd(sd, req);
1664 }
1665 if (sd_req_rca_same(sd, req)) {
1666 sd->state = sd_inactive_state;
1667 }
1668
1669 return sd_r0;
1670 }
1671
1672 /* CMD16 */
1673 static sd_rsp_type_t sd_cmd_SET_BLOCKLEN(SDState *sd, SDRequest req)
1674 {
1675 if (sd->state != sd_transfer_state) {
1676 return sd_invalid_state_for_cmd(sd, req);
1677 }
1678 if (req.arg > (1 << HWBLOCK_SHIFT)) {
1679 sd->card_status |= BLOCK_LEN_ERROR;
1680 } else {
1681 trace_sdcard_set_blocklen(req.arg);
1682 sd->blk_len = req.arg;
1683 }
1684
1685 return sd_r1;
1686 }
1687
1688 /* CMD17 */
1689 static sd_rsp_type_t sd_cmd_READ_SINGLE_BLOCK(SDState *sd, SDRequest req)
1690 {
1691 uint64_t addr;
1692
1693 if (sd->state != sd_transfer_state) {
1694 return sd_invalid_state_for_cmd(sd, req);
1695 }
1696
1697 addr = sd_req_get_address(sd, req);
1698 if (!address_in_range(sd, "READ_SINGLE_BLOCK", addr, sd->blk_len)) {
1699 return sd_r1;
1700 }
1701
1702 sd_blk_read(sd, addr, sd->blk_len);
1703 return sd_cmd_to_sendingdata(sd, req, addr, NULL, sd->blk_len);
1704 }
1705
1706 /* CMD19 */
1707 static sd_rsp_type_t sd_cmd_SEND_TUNING_BLOCK(SDState *sd, SDRequest req)
1708 {
1709 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1710 return sd_cmd_illegal(sd, req);
1711 }
1712
1713 return sd_cmd_to_sendingdata(sd, req, 0,
1714 sd_tuning_block_pattern4,
1715 sizeof(sd_tuning_block_pattern4));
1716 }
1717
1718 /* CMD23 */
1719 static sd_rsp_type_t sd_cmd_SET_BLOCK_COUNT(SDState *sd, SDRequest req)
1720 {
1721 if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1722 return sd_cmd_illegal(sd, req);
1723 }
1724
1725 if (sd->state != sd_transfer_state) {
1726 return sd_invalid_state_for_cmd(sd, req);
1727 }
1728
1729 sd->multi_blk_cnt = req.arg;
1730 if (sd_is_emmc(sd)) {
1731 sd->multi_blk_cnt &= 0xffff;
1732 }
1733 trace_sdcard_set_block_count(sd->multi_blk_cnt);
1734
1735 return sd_r1;
1736 }
1737
1738 /* CMD24 */
1739 static sd_rsp_type_t sd_cmd_WRITE_SINGLE_BLOCK(SDState *sd, SDRequest req)
1740 {
1741 uint64_t addr;
1742
1743 if (sd->state != sd_transfer_state) {
1744 return sd_invalid_state_for_cmd(sd, req);
1745 }
1746
1747 addr = sd_req_get_address(sd, req);
1748 if (!address_in_range(sd, "WRITE_SINGLE_BLOCK", addr, sd->blk_len)) {
1749 return sd_r1;
1750 }
1751
1752 if (sd->size <= SDSC_MAX_CAPACITY) {
1753 if (sd_wp_addr(sd, addr)) {
1754 sd->card_status |= WP_VIOLATION;
1755 }
1756 }
1757 if (sd->csd[14] & 0x30) {
1758 sd->card_status |= WP_VIOLATION;
1759 }
1760
1761 sd->blk_written = 0;
1762 return sd_cmd_to_receivingdata(sd, req, addr, sd->blk_len);
1763 }
1764
1765 /* CMD26 */
1766 static sd_rsp_type_t emmc_cmd_PROGRAM_CID(SDState *sd, SDRequest req)
1767 {
1768 return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->cid));
1769 }
1770
1771 /* CMD27 */
1772 static sd_rsp_type_t sd_cmd_PROGRAM_CSD(SDState *sd, SDRequest req)
1773 {
1774 return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->csd));
1775 }
1776
1777 static sd_rsp_type_t sd_cmd_SET_CLR_WRITE_PROT(SDState *sd, SDRequest req,
1778 bool is_write)
1779 {
1780 uint64_t addr;
1781
1782 if (sd->size > SDSC_MAX_CAPACITY) {
1783 return sd_illegal;
1784 }
1785
1786 if (sd->state != sd_transfer_state) {
1787 return sd_invalid_state_for_cmd(sd, req);
1788 }
1789
1790 addr = sd_req_get_address(sd, req);
1791 if (!address_in_range(sd, is_write ? "SET_WRITE_PROT" : "CLR_WRITE_PROT",
1792 addr, 1)) {
1793 return sd_r1b;
1794 }
1795
1796 sd->state = sd_programming_state;
1797 if (is_write) {
1798 set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1799 } else {
1800 clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1801 }
1802 /* Bzzzzzzztt .... Operation complete. */
1803 sd->state = sd_transfer_state;
1804 return sd_r1;
1805 }
1806
1807 /* CMD28 */
1808 static sd_rsp_type_t sd_cmd_SET_WRITE_PROT(SDState *sd, SDRequest req)
1809 {
1810 return sd_cmd_SET_CLR_WRITE_PROT(sd, req, true);
1811 }
1812
1813 /* CMD29 */
1814 static sd_rsp_type_t sd_cmd_CLR_WRITE_PROT(SDState *sd, SDRequest req)
1815 {
1816 return sd_cmd_SET_CLR_WRITE_PROT(sd, req, false);
1817 }
1818
1819 /* CMD30 */
1820 static sd_rsp_type_t sd_cmd_SEND_WRITE_PROT(SDState *sd, SDRequest req)
1821 {
1822 uint64_t addr;
1823 uint32_t data;
1824
1825 if (sd->size > SDSC_MAX_CAPACITY) {
1826 return sd_illegal;
1827 }
1828
1829 if (sd->state != sd_transfer_state) {
1830 return sd_invalid_state_for_cmd(sd, req);
1831 }
1832
1833 addr = sd_req_get_address(sd, req);
1834 if (!address_in_range(sd, "SEND_WRITE_PROT", addr, sd->blk_len)) {
1835 return sd_r1;
1836 }
1837
1838 data = sd_wpbits(sd, req.arg);
1839 return sd_cmd_to_sendingdata(sd, req, addr, &data, sizeof(data));
1840 }
1841
1842 /* CMD32 */
1843 static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_START(SDState *sd, SDRequest req)
1844 {
1845 if (sd->state != sd_transfer_state) {
1846 return sd_invalid_state_for_cmd(sd, req);
1847 }
1848 sd->erase_start = req.arg;
1849 return sd_r1;
1850 }
1851
1852 /* CMD33 */
1853 static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_END(SDState *sd, SDRequest req)
1854 {
1855 if (sd->state != sd_transfer_state) {
1856 return sd_invalid_state_for_cmd(sd, req);
1857 }
1858 sd->erase_end = req.arg;
1859 return sd_r1;
1860 }
1861
1862 /* CMD38 */
1863 static sd_rsp_type_t sd_cmd_ERASE(SDState *sd, SDRequest req)
1864 {
1865 if (sd->state != sd_transfer_state) {
1866 return sd_invalid_state_for_cmd(sd, req);
1867 }
1868 if (sd->csd[14] & 0x30) {
1869 sd->card_status |= WP_VIOLATION;
1870 return sd_r1b;
1871 }
1872
1873 sd->state = sd_programming_state;
1874 sd_erase(sd);
1875 /* Bzzzzzzztt .... Operation complete. */
1876 sd->state = sd_transfer_state;
1877 return sd_r1b;
1878 }
1879
1880 /* CMD42 */
1881 static sd_rsp_type_t sd_cmd_LOCK_UNLOCK(SDState *sd, SDRequest req)
1882 {
1883 return sd_cmd_to_receivingdata(sd, req, 0, 0);
1884 }
1885
1886 /* CMD55 */
1887 static sd_rsp_type_t sd_cmd_APP_CMD(SDState *sd, SDRequest req)
1888 {
1889 switch (sd->state) {
1890 case sd_ready_state:
1891 case sd_identification_state:
1892 case sd_inactive_state:
1893 case sd_sleep_state:
1894 return sd_invalid_state_for_cmd(sd, req);
1895 case sd_idle_state:
1896 if (!sd_is_spi(sd) && sd_req_get_rca(sd, req) != 0x0000) {
1897 qemu_log_mask(LOG_GUEST_ERROR,
1898 "SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
1899 }
1900 /* fall-through */
1901 default:
1902 break;
1903 }
1904 if (!sd_is_spi(sd) && !sd_req_rca_same(sd, req)) {
1905 return sd_r0;
1906 }
1907 sd->expecting_acmd = true;
1908 sd->card_status |= APP_CMD;
1909
1910 return sd_r1;
1911 }
1912
1913 /* CMD56 */
1914 static sd_rsp_type_t sd_cmd_GEN_CMD(SDState *sd, SDRequest req)
1915 {
1916 if (sd->state != sd_transfer_state) {
1917 return sd_invalid_state_for_cmd(sd, req);
1918 }
1919
1920 /* Vendor specific command: our model is RAZ/WI */
1921 if (req.arg & 1) {
1922 memset(sd->data, 0, sizeof(sd->data));
1923 return sd_cmd_to_sendingdata(sd, req, 0, NULL, 0);
1924 } else {
1925 return sd_cmd_to_receivingdata(sd, req, 0, 0);
1926 }
1927 }
1928
1929 /* CMD58 */
1930 static sd_rsp_type_t spi_cmd_READ_OCR(SDState *sd, SDRequest req)
1931 {
1932 return sd_r3;
1933 }
1934
1935 /* CMD59 */
1936 static sd_rsp_type_t spi_cmd_CRC_ON_OFF(SDState *sd, SDRequest req)
1937 {
1938 return sd_r1;
1939 }
1940
1941 /* ACMD6 */
1942 static sd_rsp_type_t sd_acmd_SET_BUS_WIDTH(SDState *sd, SDRequest req)
1943 {
1944 if (sd->state != sd_transfer_state) {
1945 return sd_invalid_state_for_cmd(sd, req);
1946 }
1947
1948 sd->sd_status[0] &= 0x3f;
1949 sd->sd_status[0] |= (req.arg & 0x03) << 6;
1950 return sd_r1;
1951 }
1952
1953 /* ACMD13 */
1954 static sd_rsp_type_t sd_acmd_SD_STATUS(SDState *sd, SDRequest req)
1955 {
1956 return sd_cmd_to_sendingdata(sd, req, 0,
1957 sd->sd_status, sizeof(sd->sd_status));
1958 }
1959
1960 /* ACMD22 */
1961 static sd_rsp_type_t sd_acmd_SEND_NUM_WR_BLOCKS(SDState *sd, SDRequest req)
1962 {
1963 return sd_cmd_to_sendingdata(sd, req, 0,
1964 &sd->blk_written, sizeof(sd->blk_written));
1965 }
1966
1967 /* ACMD23 */
1968 static sd_rsp_type_t sd_acmd_SET_WR_BLK_ERASE_COUNT(SDState *sd, SDRequest req)
1969 {
1970 if (sd->state != sd_transfer_state) {
1971 return sd_invalid_state_for_cmd(sd, req);
1972 }
1973 return sd_r1;
1974 }
1975
1976 /* ACMD41 */
1977 static sd_rsp_type_t sd_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
1978 {
1979 if (sd->state != sd_idle_state) {
1980 return sd_invalid_state_for_cmd(sd, req);
1981 }
1982
1983 /*
1984 * If it's the first ACMD41 since reset, we need to decide
1985 * whether to power up. If this is not an enquiry ACMD41,
1986 * we immediately report power on and proceed below to the
1987 * ready state, but if it is, we set a timer to model a
1988 * delay for power up. This works around a bug in EDK2
1989 * UEFI, which sends an initial enquiry ACMD41, but
1990 * assumes that the card is in ready state as soon as it
1991 * sees the power up bit set.
1992 */
1993 if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
1994 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1995 timer_del(sd->ocr_power_timer);
1996 sd_ocr_powerup(sd);
1997 } else {
1998 trace_sdcard_inquiry_cmd41();
1999 if (!timer_pending(sd->ocr_power_timer)) {
2000 timer_mod_ns(sd->ocr_power_timer,
2001 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
2002 + OCR_POWER_DELAY_NS));
2003 }
2004 }
2005 }
2006
2007 if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
2008 /*
2009 * We accept any voltage. 10000 V is nothing.
2010 *
2011 * Once we're powered up, we advance straight to ready state
2012 * unless it's an enquiry ACMD41 (bits 23:0 == 0).
2013 */
2014 sd->state = sd_ready_state;
2015 }
2016
2017 return sd_r3;
2018 }
2019
2020 /* ACMD42 */
2021 static sd_rsp_type_t sd_acmd_SET_CLR_CARD_DETECT(SDState *sd, SDRequest req)
2022 {
2023 if (sd->state != sd_transfer_state) {
2024 return sd_invalid_state_for_cmd(sd, req);
2025 }
2026
2027 /* Bringing in the 50KOhm pull-up resistor... Done. */
2028 return sd_r1;
2029 }
2030
2031 /* ACMD51 */
2032 static sd_rsp_type_t sd_acmd_SEND_SCR(SDState *sd, SDRequest req)
2033 {
2034 return sd_cmd_to_sendingdata(sd, req, 0, sd->scr, sizeof(sd->scr));
2035 }
2036
2037 static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
2038 {
2039 uint64_t addr;
2040
2041 sd->last_cmd_name = sd_cmd_name(sd, req.cmd);
2042 /* CMD55 precedes an ACMD, so we are not interested in tracing it.
2043 * However there is no ACMD55, so we want to trace this particular case.
2044 */
2045 if (req.cmd != 55 || sd->expecting_acmd) {
2046 trace_sdcard_normal_command(sd->proto->name,
2047 sd->last_cmd_name, req.cmd,
2048 req.arg, sd_state_name(sd->state));
2049 }
2050
2051 /* Not interpreting this as an app command */
2052 sd->card_status &= ~APP_CMD;
2053
2054 /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
2055 * if not, its effects are cancelled */
2056 if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
2057 sd->multi_blk_cnt = 0;
2058 }
2059
2060 if (sd->proto->cmd[req.cmd].class == 6 && FIELD_EX32(sd->ocr, OCR,
2061 CARD_CAPACITY)) {
2062 /* Only Standard Capacity cards support class 6 commands */
2063 return sd_illegal;
2064 }
2065
2066 if (sd->proto->cmd[req.cmd].handler) {
2067 return sd->proto->cmd[req.cmd].handler(sd, req);
2068 }
2069
2070 switch (req.cmd) {
2071 /* Block read commands (Class 2) */
2072 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2073 addr = sd_req_get_address(sd, req);
2074 switch (sd->state) {
2075 case sd_transfer_state:
2076
2077 if (!address_in_range(sd, "READ_BLOCK", addr, sd->blk_len)) {
2078 return sd_r1;
2079 }
2080
2081 sd->state = sd_sendingdata_state;
2082 sd->data_start = addr;
2083 sd->data_offset = 0;
2084 return sd_r1;
2085
2086 default:
2087 break;
2088 }
2089 break;
2090
2091 /* Block write commands (Class 4) */
2092 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2093 addr = sd_req_get_address(sd, req);
2094 switch (sd->state) {
2095 case sd_transfer_state:
2096
2097 if (!address_in_range(sd, "WRITE_BLOCK", addr, sd->blk_len)) {
2098 return sd_r1;
2099 }
2100
2101 sd->state = sd_receivingdata_state;
2102 sd->data_start = addr;
2103 sd->data_offset = 0;
2104 sd->blk_written = 0;
2105
2106 if (sd->size <= SDSC_MAX_CAPACITY) {
2107 if (sd_wp_addr(sd, sd->data_start)) {
2108 sd->card_status |= WP_VIOLATION;
2109 }
2110 }
2111 if (sd->csd[14] & 0x30) {
2112 sd->card_status |= WP_VIOLATION;
2113 }
2114 return sd_r1;
2115
2116 default:
2117 break;
2118 }
2119 break;
2120
2121 default:
2122 qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
2123 return sd_illegal;
2124 }
2125
2126 return sd_invalid_state_for_cmd(sd, req);
2127 }
2128
2129 static sd_rsp_type_t sd_app_command(SDState *sd,
2130 SDRequest req)
2131 {
2132 sd->last_cmd_name = sd_acmd_name(sd, req.cmd);
2133 trace_sdcard_app_command(sd->proto->name, sd->last_cmd_name,
2134 req.cmd, req.arg, sd_state_name(sd->state));
2135 sd->card_status |= APP_CMD;
2136
2137 if (sd->proto->acmd[req.cmd].handler) {
2138 return sd->proto->acmd[req.cmd].handler(sd, req);
2139 }
2140
2141 switch (req.cmd) {
2142 case 18: /* Reserved for SD security applications */
2143 case 25:
2144 case 26:
2145 case 38:
2146 case 43 ... 49:
2147 /* Refer to the "SD Specifications Part3 Security Specification" for
2148 * information about the SD Security Features.
2149 */
2150 qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
2151 req.cmd);
2152 return sd_illegal;
2153
2154 default:
2155 /* Fall back to standard commands. */
2156 return sd_normal_command(sd, req);
2157 }
2158
2159 qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
2160 return sd_illegal;
2161 }
2162
2163 static bool cmd_valid_while_locked(SDState *sd, unsigned cmd)
2164 {
2165 unsigned cmd_class;
2166
2167 /* Valid commands in locked state:
2168 * basic class (0)
2169 * lock card class (7)
2170 * CMD16
2171 * implicitly, the ACMD prefix CMD55
2172 * ACMD41 and ACMD42
2173 * Anything else provokes an "illegal command" response.
2174 */
2175 if (sd->expecting_acmd) {
2176 return cmd == 41 || cmd == 42;
2177 }
2178 if (cmd == 16 || cmd == 55) {
2179 return true;
2180 }
2181 if (!sd->proto->cmd[cmd].handler) {
2182 return false;
2183 }
2184 cmd_class = sd->proto->cmd[cmd].class;
2185
2186 return cmd_class == 0 || cmd_class == 7;
2187 }
2188
2189 int sd_do_command(SDState *sd, SDRequest *req,
2190 uint8_t *response) {
2191 int last_state;
2192 sd_rsp_type_t rtype;
2193 int rsplen;
2194
2195 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
2196 return 0;
2197 }
2198
2199 if (sd->state == sd_inactive_state) {
2200 rtype = sd_illegal;
2201 goto send_response;
2202 }
2203
2204 if (sd_req_crc_validate(req)) {
2205 sd->card_status |= COM_CRC_ERROR;
2206 rtype = sd_illegal;
2207 goto send_response;
2208 }
2209
2210 if (req->cmd >= SDMMC_CMD_MAX) {
2211 qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
2212 req->cmd);
2213 req->cmd &= 0x3f;
2214 }
2215
2216 if (sd->state == sd_sleep_state && req->cmd) {
2217 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is sleeping\n");
2218 rtype = sd_r0;
2219 goto send_response;
2220 }
2221
2222 if (sd->card_status & CARD_IS_LOCKED) {
2223 if (!cmd_valid_while_locked(sd, req->cmd)) {
2224 sd->card_status |= ILLEGAL_COMMAND;
2225 sd->expecting_acmd = false;
2226 qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
2227 rtype = sd_illegal;
2228 goto send_response;
2229 }
2230 }
2231
2232 last_state = sd->state;
2233 sd_set_mode(sd);
2234
2235 if (sd->expecting_acmd) {
2236 sd->expecting_acmd = false;
2237 rtype = sd_app_command(sd, *req);
2238 } else {
2239 rtype = sd_normal_command(sd, *req);
2240 }
2241
2242 if (rtype == sd_illegal) {
2243 sd->card_status |= ILLEGAL_COMMAND;
2244 } else {
2245 /* Valid command, we can update the 'state before command' bits.
2246 * (Do this now so they appear in r1 responses.)
2247 */
2248 sd->card_status = FIELD_DP32(sd->card_status, CSR,
2249 CURRENT_STATE, last_state);
2250 }
2251
2252 send_response:
2253 switch (rtype) {
2254 case sd_r1:
2255 case sd_r1b:
2256 sd_response_r1_make(sd, response);
2257 rsplen = 4;
2258 break;
2259
2260 case sd_r2_i:
2261 memcpy(response, sd->cid, sizeof(sd->cid));
2262 rsplen = 16;
2263 break;
2264
2265 case sd_r2_s:
2266 memcpy(response, sd->csd, sizeof(sd->csd));
2267 rsplen = 16;
2268 break;
2269
2270 case sd_r3:
2271 sd_response_r3_make(sd, response);
2272 rsplen = 4;
2273 break;
2274
2275 case sd_r6:
2276 sd_response_r6_make(sd, response);
2277 rsplen = 4;
2278 break;
2279
2280 case sd_r7:
2281 sd_response_r7_make(sd, response);
2282 rsplen = 4;
2283 break;
2284
2285 case sd_r0:
2286 /*
2287 * Invalid state transition, reset implementation
2288 * fields to avoid OOB abuse.
2289 */
2290 sd->data_start = 0;
2291 sd->data_offset = 0;
2292 /* fall-through */
2293 case sd_illegal:
2294 rsplen = 0;
2295 break;
2296 default:
2297 g_assert_not_reached();
2298 }
2299 trace_sdcard_response(sd_response_name(rtype), rsplen);
2300
2301 if (rtype != sd_illegal) {
2302 /* Clear the "clear on valid command" status bits now we've
2303 * sent any response
2304 */
2305 sd->card_status &= ~CARD_STATUS_B;
2306 }
2307
2308 #ifdef DEBUG_SD
2309 qemu_hexdump(stderr, "Response", response, rsplen);
2310 #endif
2311
2312 sd->current_cmd = rtype == sd_illegal ? 0 : req->cmd;
2313
2314 return rsplen;
2315 }
2316
2317 /* Return true if buffer is consumed. Configured by sd_cmd_to_receivingdata() */
2318 static bool sd_generic_write_byte(SDState *sd, uint8_t value)
2319 {
2320 sd->data[sd->data_offset] = value;
2321
2322 if (++sd->data_offset >= sd->data_size) {
2323 sd->state = sd_transfer_state;
2324 return true;
2325 }
2326 return false;
2327 }
2328
2329 /* Return true when buffer is consumed. Configured by sd_cmd_to_sendingdata() */
2330 static bool sd_generic_read_byte(SDState *sd, uint8_t *value)
2331 {
2332 *value = sd->data[sd->data_offset];
2333
2334 if (++sd->data_offset >= sd->data_size) {
2335 sd->state = sd_transfer_state;
2336 return true;
2337 }
2338
2339 return false;
2340 }
2341
2342 void sd_write_byte(SDState *sd, uint8_t value)
2343 {
2344 int i;
2345
2346 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
2347 return;
2348
2349 if (sd->state != sd_receivingdata_state) {
2350 qemu_log_mask(LOG_GUEST_ERROR,
2351 "%s: not in Receiving-Data state\n", __func__);
2352 return;
2353 }
2354
2355 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
2356 return;
2357
2358 trace_sdcard_write_data(sd->proto->name,
2359 sd->last_cmd_name,
2360 sd->current_cmd, sd->data_offset, value);
2361 switch (sd->current_cmd) {
2362 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
2363 if (sd_generic_write_byte(sd, value)) {
2364 /* TODO: Check CRC before committing */
2365 sd->state = sd_programming_state;
2366 sd_blk_write(sd, sd->data_start, sd->data_offset);
2367 sd->blk_written ++;
2368 sd->csd[14] |= 0x40;
2369 /* Bzzzzzzztt .... Operation complete. */
2370 sd->state = sd_transfer_state;
2371 }
2372 break;
2373
2374 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2375 if (sd->data_offset == 0) {
2376 /* Start of the block - let's check the address is valid */
2377 if (!address_in_range(sd, "WRITE_MULTIPLE_BLOCK",
2378 sd->data_start, sd->blk_len)) {
2379 break;
2380 }
2381 if (sd->size <= SDSC_MAX_CAPACITY) {
2382 if (sd_wp_addr(sd, sd->data_start)) {
2383 sd->card_status |= WP_VIOLATION;
2384 break;
2385 }
2386 }
2387 }
2388 sd->data[sd->data_offset++] = value;
2389 if (sd->data_offset >= sd->blk_len) {
2390 /* TODO: Check CRC before committing */
2391 sd->state = sd_programming_state;
2392 sd_blk_write(sd, sd->data_start, sd->data_offset);
2393 sd->blk_written++;
2394 sd->data_start += sd->blk_len;
2395 sd->data_offset = 0;
2396 sd->csd[14] |= 0x40;
2397
2398 /* Bzzzzzzztt .... Operation complete. */
2399 if (sd->multi_blk_cnt != 0) {
2400 if (--sd->multi_blk_cnt == 0) {
2401 /* Stop! */
2402 sd->state = sd_transfer_state;
2403 break;
2404 }
2405 }
2406
2407 sd->state = sd_receivingdata_state;
2408 }
2409 break;
2410
2411 case 26: /* CMD26: PROGRAM_CID */
2412 if (sd_generic_write_byte(sd, value)) {
2413 /* TODO: Check CRC before committing */
2414 sd->state = sd_programming_state;
2415 for (i = 0; i < sizeof(sd->cid); i ++)
2416 if ((sd->cid[i] | 0x00) != sd->data[i])
2417 sd->card_status |= CID_CSD_OVERWRITE;
2418
2419 if (!(sd->card_status & CID_CSD_OVERWRITE))
2420 for (i = 0; i < sizeof(sd->cid); i ++) {
2421 sd->cid[i] |= 0x00;
2422 sd->cid[i] &= sd->data[i];
2423 }
2424 /* Bzzzzzzztt .... Operation complete. */
2425 sd->state = sd_transfer_state;
2426 }
2427 break;
2428
2429 case 27: /* CMD27: PROGRAM_CSD */
2430 if (sd_generic_write_byte(sd, value)) {
2431 /* TODO: Check CRC before committing */
2432 sd->state = sd_programming_state;
2433 for (i = 0; i < sizeof(sd->csd); i ++)
2434 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
2435 (sd->data[i] | sd_csd_rw_mask[i]))
2436 sd->card_status |= CID_CSD_OVERWRITE;
2437
2438 /* Copy flag (OTP) & Permanent write protect */
2439 if (sd->csd[14] & ~sd->data[14] & 0x60)
2440 sd->card_status |= CID_CSD_OVERWRITE;
2441
2442 if (!(sd->card_status & CID_CSD_OVERWRITE))
2443 for (i = 0; i < sizeof(sd->csd); i ++) {
2444 sd->csd[i] |= sd_csd_rw_mask[i];
2445 sd->csd[i] &= sd->data[i];
2446 }
2447 /* Bzzzzzzztt .... Operation complete. */
2448 sd->state = sd_transfer_state;
2449 }
2450 break;
2451
2452 case 42: /* CMD42: LOCK_UNLOCK */
2453 if (sd_generic_write_byte(sd, value)) {
2454 /* TODO: Check CRC before committing */
2455 sd->state = sd_programming_state;
2456 sd_lock_command(sd);
2457 /* Bzzzzzzztt .... Operation complete. */
2458 sd->state = sd_transfer_state;
2459 }
2460 break;
2461
2462 case 56: /* CMD56: GEN_CMD */
2463 sd_generic_write_byte(sd, value);
2464 break;
2465
2466 default:
2467 g_assert_not_reached();
2468 }
2469 }
2470
2471 uint8_t sd_read_byte(SDState *sd)
2472 {
2473 /* TODO: Append CRCs */
2474 const uint8_t dummy_byte = 0x00;
2475 uint8_t ret;
2476 uint32_t io_len;
2477
2478 if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
2479 return dummy_byte;
2480
2481 if (sd->state != sd_sendingdata_state) {
2482 qemu_log_mask(LOG_GUEST_ERROR,
2483 "%s: not in Sending-Data state\n", __func__);
2484 return dummy_byte;
2485 }
2486
2487 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION)) {
2488 return dummy_byte;
2489 }
2490
2491 io_len = sd_blk_len(sd);
2492
2493 trace_sdcard_read_data(sd->proto->name,
2494 sd->last_cmd_name, sd->current_cmd,
2495 sd->data_offset, sd->data_size, io_len);
2496 switch (sd->current_cmd) {
2497 case 6: /* CMD6: SWITCH_FUNCTION */
2498 case 8: /* CMD8: SEND_EXT_CSD */
2499 case 9: /* CMD9: SEND_CSD */
2500 case 10: /* CMD10: SEND_CID */
2501 case 13: /* ACMD13: SD_STATUS */
2502 case 17: /* CMD17: READ_SINGLE_BLOCK */
2503 case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2504 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2505 case 30: /* CMD30: SEND_WRITE_PROT */
2506 case 51: /* ACMD51: SEND_SCR */
2507 case 56: /* CMD56: GEN_CMD */
2508 sd_generic_read_byte(sd, &ret);
2509 break;
2510
2511 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2512 if (sd->data_offset == 0) {
2513 if (!address_in_range(sd, "READ_MULTIPLE_BLOCK",
2514 sd->data_start, io_len)) {
2515 return dummy_byte;
2516 }
2517 sd_blk_read(sd, sd->data_start, io_len);
2518 }
2519 ret = sd->data[sd->data_offset ++];
2520
2521 if (sd->data_offset >= io_len) {
2522 sd->data_start += io_len;
2523 sd->data_offset = 0;
2524
2525 if (sd->multi_blk_cnt != 0) {
2526 if (--sd->multi_blk_cnt == 0) {
2527 /* Stop! */
2528 sd->state = sd_transfer_state;
2529 break;
2530 }
2531 }
2532 }
2533 break;
2534
2535 default:
2536 qemu_log_mask(LOG_GUEST_ERROR, "%s: DAT read illegal for command %s\n",
2537 __func__, sd->last_cmd_name);
2538 return dummy_byte;
2539 }
2540
2541 return ret;
2542 }
2543
2544 static bool sd_receive_ready(SDState *sd)
2545 {
2546 return sd->state == sd_receivingdata_state;
2547 }
2548
2549 static bool sd_data_ready(SDState *sd)
2550 {
2551 return sd->state == sd_sendingdata_state;
2552 }
2553
2554 void sd_enable(SDState *sd, bool enable)
2555 {
2556 sd->enable = enable;
2557 }
2558
2559 static const SDProto sd_proto_spi = {
2560 .name = "SPI",
2561 .cmd = {
2562 [0] = {0, sd_spi, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2563 [1] = {0, sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
2564 [5] = {9, sd_spi, "IO_SEND_OP_COND", sd_cmd_optional},
2565 [6] = {10, sd_spi, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2566 [8] = {0, sd_spi, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2567 [9] = {0, sd_spi, "SEND_CSD", spi_cmd_SEND_CSD},
2568 [10] = {0, sd_spi, "SEND_CID", spi_cmd_SEND_CID},
2569 [12] = {0, sd_spi, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2570 [13] = {0, sd_spi, "SEND_STATUS", sd_cmd_SEND_STATUS},
2571 [16] = {2, sd_spi, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2572 [17] = {2, sd_spi, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2573 [24] = {4, sd_spi, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2574 [27] = {4, sd_spi, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2575 [28] = {6, sd_spi, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2576 [29] = {6, sd_spi, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2577 [30] = {6, sd_spi, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2578 [32] = {5, sd_spi, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2579 [33] = {5, sd_spi, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2580 [34] = {10, sd_spi, "READ_SEC_CMD", sd_cmd_optional},
2581 [35] = {10, sd_spi, "WRITE_SEC_CMD", sd_cmd_optional},
2582 [36] = {10, sd_spi, "SEND_PSI", sd_cmd_optional},
2583 [37] = {10, sd_spi, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2584 [38] = {5, sd_spi, "ERASE", sd_cmd_ERASE},
2585 [42] = {7, sd_spi, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2586 [50] = {10, sd_spi, "DIRECT_SECURE_READ", sd_cmd_optional},
2587 [52] = {9, sd_spi, "IO_RW_DIRECT", sd_cmd_optional},
2588 [53] = {9, sd_spi, "IO_RW_EXTENDED", sd_cmd_optional},
2589 [55] = {8, sd_spi, "APP_CMD", sd_cmd_APP_CMD},
2590 [56] = {8, sd_spi, "GEN_CMD", sd_cmd_GEN_CMD},
2591 [57] = {10, sd_spi, "DIRECT_SECURE_WRITE", sd_cmd_optional},
2592 [58] = {0, sd_spi, "READ_OCR", spi_cmd_READ_OCR},
2593 [59] = {0, sd_spi, "CRC_ON_OFF", spi_cmd_CRC_ON_OFF},
2594 },
2595 .acmd = {
2596 [13] = {8, sd_spi, "SD_STATUS", sd_acmd_SD_STATUS},
2597 [22] = {8, sd_spi, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
2598 [23] = {8, sd_spi, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
2599 [41] = {8, sd_spi, "SEND_OP_COND", spi_cmd_SEND_OP_COND},
2600 [42] = {8, sd_spi, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
2601 [51] = {8, sd_spi, "SEND_SCR", sd_acmd_SEND_SCR},
2602 },
2603 };
2604
2605 static const SDProto sd_proto_sd = {
2606 .name = "SD",
2607 .cmd = {
2608 [0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2609 [2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
2610 [3] = {0, sd_bcr, "SEND_RELATIVE_ADDR", sd_cmd_SEND_RELATIVE_ADDR},
2611 [4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
2612 [5] = {9, sd_bc, "IO_SEND_OP_COND", sd_cmd_optional},
2613 [6] = {10, sd_adtc, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2614 [7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
2615 [8] = {0, sd_bcr, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2616 [9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
2617 [10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
2618 [11] = {0, sd_ac, "VOLTAGE_SWITCH", sd_cmd_optional},
2619 [12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2620 [13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
2621 [15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
2622 [16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2623 [17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2624 [19] = {2, sd_adtc, "SEND_TUNING_BLOCK", sd_cmd_SEND_TUNING_BLOCK},
2625 [20] = {2, sd_ac, "SPEED_CLASS_CONTROL", sd_cmd_optional},
2626 [23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
2627 [24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2628 [27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2629 [28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2630 [29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2631 [30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2632 [32] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2633 [33] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2634 [34] = {10, sd_adtc, "READ_SEC_CMD", sd_cmd_optional},
2635 [35] = {10, sd_adtc, "WRITE_SEC_CMD", sd_cmd_optional},
2636 [36] = {10, sd_adtc, "SEND_PSI", sd_cmd_optional},
2637 [37] = {10, sd_ac, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2638 [38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
2639 [42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2640 [43] = {1, sd_ac, "Q_MANAGEMENT", sd_cmd_optional},
2641 [44] = {1, sd_ac, "Q_TASK_INFO_A", sd_cmd_optional},
2642 [45] = {1, sd_ac, "Q_TASK_INFO_B", sd_cmd_optional},
2643 [46] = {1, sd_adtc, "Q_RD_TASK", sd_cmd_optional},
2644 [47] = {1, sd_adtc, "Q_WR_TASK", sd_cmd_optional},
2645 [48] = {1, sd_adtc, "READ_EXTR_SINGLE", sd_cmd_optional},
2646 [49] = {1, sd_adtc, "WRITE_EXTR_SINGLE", sd_cmd_optional},
2647 [50] = {10, sd_adtc, "DIRECT_SECURE_READ", sd_cmd_optional},
2648 [52] = {9, sd_bc, "IO_RW_DIRECT", sd_cmd_optional},
2649 [53] = {9, sd_bc, "IO_RW_EXTENDED", sd_cmd_optional},
2650 [55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
2651 [56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
2652 [57] = {10, sd_adtc, "DIRECT_SECURE_WRITE", sd_cmd_optional},
2653 [58] = {11, sd_adtc, "READ_EXTR_MULTI", sd_cmd_optional},
2654 [59] = {11, sd_adtc, "WRITE_EXTR_MULTI", sd_cmd_optional},
2655 },
2656 .acmd = {
2657 [6] = {8, sd_ac, "SET_BUS_WIDTH", sd_acmd_SET_BUS_WIDTH},
2658 [13] = {8, sd_adtc, "SD_STATUS", sd_acmd_SD_STATUS},
2659 [22] = {8, sd_adtc, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
2660 [23] = {8, sd_ac, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
2661 [41] = {8, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2662 [42] = {8, sd_ac, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
2663 [51] = {8, sd_adtc, "SEND_SCR", sd_acmd_SEND_SCR},
2664 },
2665 };
2666
2667 static const SDProto sd_proto_emmc = {
2668 /* Only v4.3 is supported */
2669 .name = "eMMC",
2670 .cmd = {
2671 [0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2672 [1] = {0, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2673 [2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
2674 [3] = {0, sd_ac, "SET_RELATIVE_ADDR", emmc_cmd_SET_RELATIVE_ADDR},
2675 [4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
2676 [5] = {0, sd_ac, "SLEEP/AWAKE", emmc_cmd_sleep_awake},
2677 [6] = {10, sd_adtc, "SWITCH", emmc_cmd_SWITCH},
2678 [7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
2679 [8] = {0, sd_adtc, "SEND_EXT_CSD", emmc_cmd_SEND_EXT_CSD},
2680 [9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
2681 [10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
2682 [11] = {1, sd_adtc, "READ_DAT_UNTIL_STOP", sd_cmd_unimplemented},
2683 [12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2684 [13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
2685 [14] = {0, sd_adtc, "BUSTEST_R", sd_cmd_unimplemented},
2686 [15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
2687 [16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2688 [17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2689 [19] = {0, sd_adtc, "BUSTEST_W", sd_cmd_unimplemented},
2690 [20] = {3, sd_adtc, "WRITE_DAT_UNTIL_STOP", sd_cmd_unimplemented},
2691 [23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
2692 [24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2693 [26] = {4, sd_adtc, "PROGRAM_CID", emmc_cmd_PROGRAM_CID},
2694 [27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2695 [28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2696 [29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2697 [30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2698 [31] = {6, sd_adtc, "SEND_WRITE_PROT_TYPE", sd_cmd_unimplemented},
2699 [35] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2700 [36] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2701 [38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
2702 [39] = {9, sd_ac, "FAST_IO", sd_cmd_unimplemented},
2703 [40] = {9, sd_bcr, "GO_IRQ_STATE", sd_cmd_unimplemented},
2704 [42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2705 [49] = {0, sd_adtc, "SET_TIME", sd_cmd_unimplemented},
2706 [55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
2707 [56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
2708 },
2709 };
2710
2711 static void sd_instance_init(Object *obj)
2712 {
2713 SDState *sd = SDMMC_COMMON(obj);
2714 SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
2715
2716 sd->proto = sc->proto;
2717 sd->last_cmd_name = "UNSET";
2718 sd->enable = true;
2719 sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
2720 }
2721
2722 static void sd_instance_finalize(Object *obj)
2723 {
2724 SDState *sd = SDMMC_COMMON(obj);
2725
2726 timer_free(sd->ocr_power_timer);
2727 }
2728
2729 static void sd_realize(DeviceState *dev, Error **errp)
2730 {
2731 SDState *sd = SDMMC_COMMON(dev);
2732 int ret;
2733
2734 switch (sd->spec_version) {
2735 case SD_PHY_SPECv1_10_VERS
2736 ... SD_PHY_SPECv3_01_VERS:
2737 break;
2738 default:
2739 error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
2740 return;
2741 }
2742
2743 if (sd->blk) {
2744 int64_t blk_size;
2745
2746 if (!blk_supports_write_perm(sd->blk)) {
2747 error_setg(errp, "Cannot use read-only drive as SD card");
2748 return;
2749 }
2750
2751 blk_size = blk_getlength(sd->blk);
2752 if (blk_size > 0 && !is_power_of_2(blk_size)) {
2753 int64_t blk_size_aligned = pow2ceil(blk_size);
2754 char *blk_size_str;
2755
2756 blk_size_str = size_to_str(blk_size);
2757 error_setg(errp, "Invalid SD card size: %s", blk_size_str);
2758 g_free(blk_size_str);
2759
2760 blk_size_str = size_to_str(blk_size_aligned);
2761 error_append_hint(errp,
2762 "SD card size has to be a power of 2, e.g. %s.\n"
2763 "You can resize disk images with"
2764 " 'qemu-img resize <imagefile> <new-size>'\n"
2765 "(note that this will lose data if you make the"
2766 " image smaller than it currently is).\n",
2767 blk_size_str);
2768 g_free(blk_size_str);
2769
2770 return;
2771 }
2772
2773 ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
2774 BLK_PERM_ALL, errp);
2775 if (ret < 0) {
2776 return;
2777 }
2778 blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
2779 }
2780 }
2781
2782 static void emmc_realize(DeviceState *dev, Error **errp)
2783 {
2784 SDState *sd = SDMMC_COMMON(dev);
2785
2786 sd->spec_version = SD_PHY_SPECv3_01_VERS; /* Actually v4.3 */
2787
2788 sd_realize(dev, errp);
2789 }
2790
2791 static Property sdmmc_common_properties[] = {
2792 DEFINE_PROP_DRIVE("drive", SDState, blk),
2793 DEFINE_PROP_END_OF_LIST()
2794 };
2795
2796 static Property sd_properties[] = {
2797 DEFINE_PROP_UINT8("spec_version", SDState,
2798 spec_version, SD_PHY_SPECv3_01_VERS),
2799 DEFINE_PROP_END_OF_LIST()
2800 };
2801
2802 static Property emmc_properties[] = {
2803 DEFINE_PROP_UINT64("boot-partition-size", SDState, boot_part_size, 0),
2804 DEFINE_PROP_UINT8("boot-config", SDState, boot_config, 0x0),
2805 DEFINE_PROP_END_OF_LIST()
2806 };
2807
2808 static void sdmmc_common_class_init(ObjectClass *klass, void *data)
2809 {
2810 DeviceClass *dc = DEVICE_CLASS(klass);
2811 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2812
2813 device_class_set_props(dc, sdmmc_common_properties);
2814 dc->vmsd = &sd_vmstate;
2815 device_class_set_legacy_reset(dc, sd_reset);
2816 dc->bus_type = TYPE_SD_BUS;
2817 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2818
2819 sc->set_voltage = sd_set_voltage;
2820 sc->get_dat_lines = sd_get_dat_lines;
2821 sc->get_cmd_line = sd_get_cmd_line;
2822 sc->do_command = sd_do_command;
2823 sc->write_byte = sd_write_byte;
2824 sc->read_byte = sd_read_byte;
2825 sc->receive_ready = sd_receive_ready;
2826 sc->data_ready = sd_data_ready;
2827 sc->enable = sd_enable;
2828 sc->get_inserted = sd_get_inserted;
2829 sc->get_readonly = sd_get_readonly;
2830 }
2831
2832 static void sd_class_init(ObjectClass *klass, void *data)
2833 {
2834 DeviceClass *dc = DEVICE_CLASS(klass);
2835 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2836
2837 dc->realize = sd_realize;
2838 device_class_set_props(dc, sd_properties);
2839
2840 sc->set_cid = sd_set_cid;
2841 sc->set_csd = sd_set_csd;
2842 sc->proto = &sd_proto_sd;
2843 }
2844
2845 /*
2846 * We do not model the chip select pin, so allow the board to select
2847 * whether card should be in SSI or MMC/SD mode. It is also up to the
2848 * board to ensure that ssi transfers only occur when the chip select
2849 * is asserted.
2850 */
2851 static void sd_spi_class_init(ObjectClass *klass, void *data)
2852 {
2853 DeviceClass *dc = DEVICE_CLASS(klass);
2854 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2855
2856 dc->desc = "SD SPI";
2857 sc->proto = &sd_proto_spi;
2858 }
2859
2860 static void emmc_class_init(ObjectClass *klass, void *data)
2861 {
2862 DeviceClass *dc = DEVICE_CLASS(klass);
2863 SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
2864
2865 dc->desc = "eMMC";
2866 dc->realize = emmc_realize;
2867 device_class_set_props(dc, emmc_properties);
2868 /* Reason: Soldered on board */
2869 dc->user_creatable = false;
2870
2871 sc->proto = &sd_proto_emmc;
2872
2873 sc->set_cid = emmc_set_cid;
2874 sc->set_csd = emmc_set_csd;
2875 }
2876
2877 static const TypeInfo sd_types[] = {
2878 {
2879 .name = TYPE_SDMMC_COMMON,
2880 .parent = TYPE_DEVICE,
2881 .abstract = true,
2882 .instance_size = sizeof(SDState),
2883 .class_size = sizeof(SDCardClass),
2884 .class_init = sdmmc_common_class_init,
2885 .instance_init = sd_instance_init,
2886 .instance_finalize = sd_instance_finalize,
2887 },
2888 {
2889 .name = TYPE_SD_CARD,
2890 .parent = TYPE_SDMMC_COMMON,
2891 .class_init = sd_class_init,
2892 },
2893 {
2894 .name = TYPE_SD_CARD_SPI,
2895 .parent = TYPE_SD_CARD,
2896 .class_init = sd_spi_class_init,
2897 },
2898 {
2899 .name = TYPE_EMMC,
2900 .parent = TYPE_SDMMC_COMMON,
2901 .class_init = emmc_class_init,
2902 },
2903 };
2904
2905 DEFINE_TYPES(sd_types)
armbru's QEMU hackery