xref: /openbmc/qemu/hw/sd/sd.c (revision 4a09d0bb)
1 /*
2  * SD Memory Card emulation as defined in the "SD Memory Card Physical
3  * layer specification, Version 1.10."
4  *
5  * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
6  * Copyright (c) 2007 CodeSourcery
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the
17  *    distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
23  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 #include "qemu/osdep.h"
33 #include "hw/qdev.h"
34 #include "hw/hw.h"
35 #include "sysemu/block-backend.h"
36 #include "hw/sd/sd.h"
37 #include "qapi/error.h"
38 #include "qemu/bitmap.h"
39 #include "hw/qdev-properties.h"
40 #include "qemu/error-report.h"
41 #include "qemu/timer.h"
42 #include "qemu/log.h"
43 
44 //#define DEBUG_SD 1
45 
46 #ifdef DEBUG_SD
47 #define DPRINTF(fmt, ...) \
48 do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
49 #else
50 #define DPRINTF(fmt, ...) do {} while(0)
51 #endif
52 
53 #define ACMD41_ENQUIRY_MASK     0x00ffffff
54 #define OCR_POWER_UP            0x80000000
55 #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
56 
57 typedef enum {
58     sd_r0 = 0,    /* no response */
59     sd_r1,        /* normal response command */
60     sd_r2_i,      /* CID register */
61     sd_r2_s,      /* CSD register */
62     sd_r3,        /* OCR register */
63     sd_r6 = 6,    /* Published RCA response */
64     sd_r7,        /* Operating voltage */
65     sd_r1b = -1,
66     sd_illegal = -2,
67 } sd_rsp_type_t;
68 
69 enum SDCardModes {
70     sd_inactive,
71     sd_card_identification_mode,
72     sd_data_transfer_mode,
73 };
74 
75 enum SDCardStates {
76     sd_inactive_state = -1,
77     sd_idle_state = 0,
78     sd_ready_state,
79     sd_identification_state,
80     sd_standby_state,
81     sd_transfer_state,
82     sd_sendingdata_state,
83     sd_receivingdata_state,
84     sd_programming_state,
85     sd_disconnect_state,
86 };
87 
88 struct SDState {
89     DeviceState parent_obj;
90 
91     uint32_t mode;    /* current card mode, one of SDCardModes */
92     int32_t state;    /* current card state, one of SDCardStates */
93     uint32_t ocr;
94     QEMUTimer *ocr_power_timer;
95     uint8_t scr[8];
96     uint8_t cid[16];
97     uint8_t csd[16];
98     uint16_t rca;
99     uint32_t card_status;
100     uint8_t sd_status[64];
101     uint32_t vhs;
102     bool wp_switch;
103     unsigned long *wp_groups;
104     int32_t wpgrps_size;
105     uint64_t size;
106     uint32_t blk_len;
107     uint32_t multi_blk_cnt;
108     uint32_t erase_start;
109     uint32_t erase_end;
110     uint8_t pwd[16];
111     uint32_t pwd_len;
112     uint8_t function_group[6];
113 
114     bool spi;
115     uint8_t current_cmd;
116     /* True if we will handle the next command as an ACMD. Note that this does
117      * *not* track the APP_CMD status bit!
118      */
119     bool expecting_acmd;
120     uint32_t blk_written;
121     uint64_t data_start;
122     uint32_t data_offset;
123     uint8_t data[512];
124     qemu_irq readonly_cb;
125     qemu_irq inserted_cb;
126     BlockBackend *blk;
127 
128     bool enable;
129 };
130 
131 static void sd_set_mode(SDState *sd)
132 {
133     switch (sd->state) {
134     case sd_inactive_state:
135         sd->mode = sd_inactive;
136         break;
137 
138     case sd_idle_state:
139     case sd_ready_state:
140     case sd_identification_state:
141         sd->mode = sd_card_identification_mode;
142         break;
143 
144     case sd_standby_state:
145     case sd_transfer_state:
146     case sd_sendingdata_state:
147     case sd_receivingdata_state:
148     case sd_programming_state:
149     case sd_disconnect_state:
150         sd->mode = sd_data_transfer_mode;
151         break;
152     }
153 }
154 
155 static const sd_cmd_type_t sd_cmd_type[64] = {
156     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
157     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
158     sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
159     sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
160     sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
161     sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
162     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
163     sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
164 };
165 
166 static const int sd_cmd_class[64] = {
167     0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
168     2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
169     5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
170     7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
171 };
172 
173 static uint8_t sd_crc7(void *message, size_t width)
174 {
175     int i, bit;
176     uint8_t shift_reg = 0x00;
177     uint8_t *msg = (uint8_t *) message;
178 
179     for (i = 0; i < width; i ++, msg ++)
180         for (bit = 7; bit >= 0; bit --) {
181             shift_reg <<= 1;
182             if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
183                 shift_reg ^= 0x89;
184         }
185 
186     return shift_reg;
187 }
188 
189 static uint16_t sd_crc16(void *message, size_t width)
190 {
191     int i, bit;
192     uint16_t shift_reg = 0x0000;
193     uint16_t *msg = (uint16_t *) message;
194     width <<= 1;
195 
196     for (i = 0; i < width; i ++, msg ++)
197         for (bit = 15; bit >= 0; bit --) {
198             shift_reg <<= 1;
199             if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
200                 shift_reg ^= 0x1011;
201         }
202 
203     return shift_reg;
204 }
205 
206 static void sd_set_ocr(SDState *sd)
207 {
208     /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
209     sd->ocr = 0x00ffff00;
210 }
211 
212 static void sd_ocr_powerup(void *opaque)
213 {
214     SDState *sd = opaque;
215 
216     /* Set powered up bit in OCR */
217     assert(!(sd->ocr & OCR_POWER_UP));
218     sd->ocr |= OCR_POWER_UP;
219 }
220 
221 static void sd_set_scr(SDState *sd)
222 {
223     sd->scr[0] = 0x00;		/* SCR Structure */
224     sd->scr[1] = 0x2f;		/* SD Security Support */
225     sd->scr[2] = 0x00;
226     sd->scr[3] = 0x00;
227     sd->scr[4] = 0x00;
228     sd->scr[5] = 0x00;
229     sd->scr[6] = 0x00;
230     sd->scr[7] = 0x00;
231 }
232 
233 #define MID	0xaa
234 #define OID	"XY"
235 #define PNM	"QEMU!"
236 #define PRV	0x01
237 #define MDT_YR	2006
238 #define MDT_MON	2
239 
240 static void sd_set_cid(SDState *sd)
241 {
242     sd->cid[0] = MID;		/* Fake card manufacturer ID (MID) */
243     sd->cid[1] = OID[0];	/* OEM/Application ID (OID) */
244     sd->cid[2] = OID[1];
245     sd->cid[3] = PNM[0];	/* Fake product name (PNM) */
246     sd->cid[4] = PNM[1];
247     sd->cid[5] = PNM[2];
248     sd->cid[6] = PNM[3];
249     sd->cid[7] = PNM[4];
250     sd->cid[8] = PRV;		/* Fake product revision (PRV) */
251     sd->cid[9] = 0xde;		/* Fake serial number (PSN) */
252     sd->cid[10] = 0xad;
253     sd->cid[11] = 0xbe;
254     sd->cid[12] = 0xef;
255     sd->cid[13] = 0x00 |	/* Manufacture date (MDT) */
256         ((MDT_YR - 2000) / 10);
257     sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
258     sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
259 }
260 
261 #define HWBLOCK_SHIFT	9			/* 512 bytes */
262 #define SECTOR_SHIFT	5			/* 16 kilobytes */
263 #define WPGROUP_SHIFT	7			/* 2 megs */
264 #define CMULT_SHIFT	9			/* 512 times HWBLOCK_SIZE */
265 #define WPGROUP_SIZE	(1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
266 
267 static const uint8_t sd_csd_rw_mask[16] = {
268     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
269     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
270 };
271 
272 static void sd_set_csd(SDState *sd, uint64_t size)
273 {
274     uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
275     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
276     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
277 
278     if (size <= 0x40000000) {	/* Standard Capacity SD */
279         sd->csd[0] = 0x00;	/* CSD structure */
280         sd->csd[1] = 0x26;	/* Data read access-time-1 */
281         sd->csd[2] = 0x00;	/* Data read access-time-2 */
282         sd->csd[3] = 0x5a;	/* Max. data transfer rate */
283         sd->csd[4] = 0x5f;	/* Card Command Classes */
284         sd->csd[5] = 0x50 |	/* Max. read data block length */
285             HWBLOCK_SHIFT;
286         sd->csd[6] = 0xe0 |	/* Partial block for read allowed */
287             ((csize >> 10) & 0x03);
288         sd->csd[7] = 0x00 |	/* Device size */
289             ((csize >> 2) & 0xff);
290         sd->csd[8] = 0x3f |	/* Max. read current */
291             ((csize << 6) & 0xc0);
292         sd->csd[9] = 0xfc |	/* Max. write current */
293             ((CMULT_SHIFT - 2) >> 1);
294         sd->csd[10] = 0x40 |	/* Erase sector size */
295             (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
296         sd->csd[11] = 0x00 |	/* Write protect group size */
297             ((sectsize << 7) & 0x80) | wpsize;
298         sd->csd[12] = 0x90 |	/* Write speed factor */
299             (HWBLOCK_SHIFT >> 2);
300         sd->csd[13] = 0x20 |	/* Max. write data block length */
301             ((HWBLOCK_SHIFT << 6) & 0xc0);
302         sd->csd[14] = 0x00;	/* File format group */
303         sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
304     } else {			/* SDHC */
305         size /= 512 * 1024;
306         size -= 1;
307         sd->csd[0] = 0x40;
308         sd->csd[1] = 0x0e;
309         sd->csd[2] = 0x00;
310         sd->csd[3] = 0x32;
311         sd->csd[4] = 0x5b;
312         sd->csd[5] = 0x59;
313         sd->csd[6] = 0x00;
314         sd->csd[7] = (size >> 16) & 0xff;
315         sd->csd[8] = (size >> 8) & 0xff;
316         sd->csd[9] = (size & 0xff);
317         sd->csd[10] = 0x7f;
318         sd->csd[11] = 0x80;
319         sd->csd[12] = 0x0a;
320         sd->csd[13] = 0x40;
321         sd->csd[14] = 0x00;
322         sd->csd[15] = 0x00;
323         sd->ocr |= 1 << 30;     /* High Capacity SD Memory Card */
324     }
325 }
326 
327 static void sd_set_rca(SDState *sd)
328 {
329     sd->rca += 0x4567;
330 }
331 
332 /* Card status bits, split by clear condition:
333  * A : According to the card current state
334  * B : Always related to the previous command
335  * C : Cleared by read
336  */
337 #define CARD_STATUS_A	0x02004100
338 #define CARD_STATUS_B	0x00c01e00
339 #define CARD_STATUS_C	0xfd39a028
340 
341 static void sd_set_cardstatus(SDState *sd)
342 {
343     sd->card_status = 0x00000100;
344 }
345 
346 static void sd_set_sdstatus(SDState *sd)
347 {
348     memset(sd->sd_status, 0, 64);
349 }
350 
351 static int sd_req_crc_validate(SDRequest *req)
352 {
353     uint8_t buffer[5];
354     buffer[0] = 0x40 | req->cmd;
355     buffer[1] = (req->arg >> 24) & 0xff;
356     buffer[2] = (req->arg >> 16) & 0xff;
357     buffer[3] = (req->arg >> 8) & 0xff;
358     buffer[4] = (req->arg >> 0) & 0xff;
359     return 0;
360     return sd_crc7(buffer, 5) != req->crc;	/* TODO */
361 }
362 
363 static void sd_response_r1_make(SDState *sd, uint8_t *response)
364 {
365     uint32_t status = sd->card_status;
366     /* Clear the "clear on read" status bits */
367     sd->card_status &= ~CARD_STATUS_C;
368 
369     response[0] = (status >> 24) & 0xff;
370     response[1] = (status >> 16) & 0xff;
371     response[2] = (status >> 8) & 0xff;
372     response[3] = (status >> 0) & 0xff;
373 }
374 
375 static void sd_response_r3_make(SDState *sd, uint8_t *response)
376 {
377     response[0] = (sd->ocr >> 24) & 0xff;
378     response[1] = (sd->ocr >> 16) & 0xff;
379     response[2] = (sd->ocr >> 8) & 0xff;
380     response[3] = (sd->ocr >> 0) & 0xff;
381 }
382 
383 static void sd_response_r6_make(SDState *sd, uint8_t *response)
384 {
385     uint16_t arg;
386     uint16_t status;
387 
388     arg = sd->rca;
389     status = ((sd->card_status >> 8) & 0xc000) |
390              ((sd->card_status >> 6) & 0x2000) |
391               (sd->card_status & 0x1fff);
392     sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
393 
394     response[0] = (arg >> 8) & 0xff;
395     response[1] = arg & 0xff;
396     response[2] = (status >> 8) & 0xff;
397     response[3] = status & 0xff;
398 }
399 
400 static void sd_response_r7_make(SDState *sd, uint8_t *response)
401 {
402     response[0] = (sd->vhs >> 24) & 0xff;
403     response[1] = (sd->vhs >> 16) & 0xff;
404     response[2] = (sd->vhs >>  8) & 0xff;
405     response[3] = (sd->vhs >>  0) & 0xff;
406 }
407 
408 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
409 {
410     return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
411 }
412 
413 static void sd_reset(DeviceState *dev)
414 {
415     SDState *sd = SD_CARD(dev);
416     uint64_t size;
417     uint64_t sect;
418 
419     if (sd->blk) {
420         blk_get_geometry(sd->blk, &sect);
421     } else {
422         sect = 0;
423     }
424     size = sect << 9;
425 
426     sect = sd_addr_to_wpnum(size) + 1;
427 
428     sd->state = sd_idle_state;
429     sd->rca = 0x0000;
430     sd_set_ocr(sd);
431     sd_set_scr(sd);
432     sd_set_cid(sd);
433     sd_set_csd(sd, size);
434     sd_set_cardstatus(sd);
435     sd_set_sdstatus(sd);
436 
437     g_free(sd->wp_groups);
438     sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;
439     sd->wpgrps_size = sect;
440     sd->wp_groups = bitmap_new(sd->wpgrps_size);
441     memset(sd->function_group, 0, sizeof(sd->function_group));
442     sd->erase_start = 0;
443     sd->erase_end = 0;
444     sd->size = size;
445     sd->blk_len = 0x200;
446     sd->pwd_len = 0;
447     sd->expecting_acmd = false;
448     sd->multi_blk_cnt = 0;
449 }
450 
451 static bool sd_get_inserted(SDState *sd)
452 {
453     return sd->blk && blk_is_inserted(sd->blk);
454 }
455 
456 static bool sd_get_readonly(SDState *sd)
457 {
458     return sd->wp_switch;
459 }
460 
461 static void sd_cardchange(void *opaque, bool load)
462 {
463     SDState *sd = opaque;
464     DeviceState *dev = DEVICE(sd);
465     SDBus *sdbus = SD_BUS(qdev_get_parent_bus(dev));
466     bool inserted = sd_get_inserted(sd);
467     bool readonly = sd_get_readonly(sd);
468 
469     if (inserted) {
470         sd_reset(dev);
471     }
472 
473     /* The IRQ notification is for legacy non-QOM SD controller devices;
474      * QOMified controllers use the SDBus APIs.
475      */
476     if (sdbus) {
477         sdbus_set_inserted(sdbus, inserted);
478         if (inserted) {
479             sdbus_set_readonly(sdbus, readonly);
480         }
481     } else {
482         qemu_set_irq(sd->inserted_cb, inserted);
483         if (inserted) {
484             qemu_set_irq(sd->readonly_cb, readonly);
485         }
486     }
487 }
488 
489 static const BlockDevOps sd_block_ops = {
490     .change_media_cb = sd_cardchange,
491 };
492 
493 static bool sd_ocr_vmstate_needed(void *opaque)
494 {
495     SDState *sd = opaque;
496 
497     /* Include the OCR state (and timer) if it is not yet powered up */
498     return !(sd->ocr & OCR_POWER_UP);
499 }
500 
501 static const VMStateDescription sd_ocr_vmstate = {
502     .name = "sd-card/ocr-state",
503     .version_id = 1,
504     .minimum_version_id = 1,
505     .needed = sd_ocr_vmstate_needed,
506     .fields = (VMStateField[]) {
507         VMSTATE_UINT32(ocr, SDState),
508         VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
509         VMSTATE_END_OF_LIST()
510     },
511 };
512 
513 static int sd_vmstate_pre_load(void *opaque)
514 {
515     SDState *sd = opaque;
516 
517     /* If the OCR state is not included (prior versions, or not
518      * needed), then the OCR must be set as powered up. If the OCR state
519      * is included, this will be replaced by the state restore.
520      */
521     sd_ocr_powerup(sd);
522 
523     return 0;
524 }
525 
526 static const VMStateDescription sd_vmstate = {
527     .name = "sd-card",
528     .version_id = 1,
529     .minimum_version_id = 1,
530     .pre_load = sd_vmstate_pre_load,
531     .fields = (VMStateField[]) {
532         VMSTATE_UINT32(mode, SDState),
533         VMSTATE_INT32(state, SDState),
534         VMSTATE_UINT8_ARRAY(cid, SDState, 16),
535         VMSTATE_UINT8_ARRAY(csd, SDState, 16),
536         VMSTATE_UINT16(rca, SDState),
537         VMSTATE_UINT32(card_status, SDState),
538         VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
539         VMSTATE_UINT32(vhs, SDState),
540         VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size),
541         VMSTATE_UINT32(blk_len, SDState),
542         VMSTATE_UINT32(multi_blk_cnt, SDState),
543         VMSTATE_UINT32(erase_start, SDState),
544         VMSTATE_UINT32(erase_end, SDState),
545         VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
546         VMSTATE_UINT32(pwd_len, SDState),
547         VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
548         VMSTATE_UINT8(current_cmd, SDState),
549         VMSTATE_BOOL(expecting_acmd, SDState),
550         VMSTATE_UINT32(blk_written, SDState),
551         VMSTATE_UINT64(data_start, SDState),
552         VMSTATE_UINT32(data_offset, SDState),
553         VMSTATE_UINT8_ARRAY(data, SDState, 512),
554         VMSTATE_UNUSED_V(1, 512),
555         VMSTATE_BOOL(enable, SDState),
556         VMSTATE_END_OF_LIST()
557     },
558     .subsections = (const VMStateDescription*[]) {
559         &sd_ocr_vmstate,
560         NULL
561     },
562 };
563 
564 /* Legacy initialization function for use by non-qdevified callers */
565 SDState *sd_init(BlockBackend *blk, bool is_spi)
566 {
567     Object *obj;
568     DeviceState *dev;
569     Error *err = NULL;
570 
571     obj = object_new(TYPE_SD_CARD);
572     dev = DEVICE(obj);
573     qdev_prop_set_drive(dev, "drive", blk, &err);
574     if (err) {
575         error_report("sd_init failed: %s", error_get_pretty(err));
576         return NULL;
577     }
578     qdev_prop_set_bit(dev, "spi", is_spi);
579     object_property_set_bool(obj, true, "realized", &err);
580     if (err) {
581         error_report("sd_init failed: %s", error_get_pretty(err));
582         return NULL;
583     }
584 
585     return SD_CARD(dev);
586 }
587 
588 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
589 {
590     sd->readonly_cb = readonly;
591     sd->inserted_cb = insert;
592     qemu_set_irq(readonly, sd->blk ? blk_is_read_only(sd->blk) : 0);
593     qemu_set_irq(insert, sd->blk ? blk_is_inserted(sd->blk) : 0);
594 }
595 
596 static void sd_erase(SDState *sd)
597 {
598     int i;
599     uint64_t erase_start = sd->erase_start;
600     uint64_t erase_end = sd->erase_end;
601 
602     if (!sd->erase_start || !sd->erase_end) {
603         sd->card_status |= ERASE_SEQ_ERROR;
604         return;
605     }
606 
607     if (extract32(sd->ocr, OCR_CCS_BITN, 1)) {
608         /* High capacity memory card: erase units are 512 byte blocks */
609         erase_start *= 512;
610         erase_end *= 512;
611     }
612 
613     erase_start = sd_addr_to_wpnum(erase_start);
614     erase_end = sd_addr_to_wpnum(erase_end);
615     sd->erase_start = 0;
616     sd->erase_end = 0;
617     sd->csd[14] |= 0x40;
618 
619     for (i = erase_start; i <= erase_end; i++) {
620         if (test_bit(i, sd->wp_groups)) {
621             sd->card_status |= WP_ERASE_SKIP;
622         }
623     }
624 }
625 
626 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
627 {
628     uint32_t i, wpnum;
629     uint32_t ret = 0;
630 
631     wpnum = sd_addr_to_wpnum(addr);
632 
633     for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
634         if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) {
635             ret |= (1 << i);
636         }
637     }
638 
639     return ret;
640 }
641 
642 static void sd_function_switch(SDState *sd, uint32_t arg)
643 {
644     int i, mode, new_func, crc;
645     mode = !!(arg & 0x80000000);
646 
647     sd->data[0] = 0x00;		/* Maximum current consumption */
648     sd->data[1] = 0x01;
649     sd->data[2] = 0x80;		/* Supported group 6 functions */
650     sd->data[3] = 0x01;
651     sd->data[4] = 0x80;		/* Supported group 5 functions */
652     sd->data[5] = 0x01;
653     sd->data[6] = 0x80;		/* Supported group 4 functions */
654     sd->data[7] = 0x01;
655     sd->data[8] = 0x80;		/* Supported group 3 functions */
656     sd->data[9] = 0x01;
657     sd->data[10] = 0x80;	/* Supported group 2 functions */
658     sd->data[11] = 0x43;
659     sd->data[12] = 0x80;	/* Supported group 1 functions */
660     sd->data[13] = 0x03;
661     for (i = 0; i < 6; i ++) {
662         new_func = (arg >> (i * 4)) & 0x0f;
663         if (mode && new_func != 0x0f)
664             sd->function_group[i] = new_func;
665         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
666     }
667     memset(&sd->data[17], 0, 47);
668     crc = sd_crc16(sd->data, 64);
669     sd->data[65] = crc >> 8;
670     sd->data[66] = crc & 0xff;
671 }
672 
673 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
674 {
675     return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
676 }
677 
678 static void sd_lock_command(SDState *sd)
679 {
680     int erase, lock, clr_pwd, set_pwd, pwd_len;
681     erase = !!(sd->data[0] & 0x08);
682     lock = sd->data[0] & 0x04;
683     clr_pwd = sd->data[0] & 0x02;
684     set_pwd = sd->data[0] & 0x01;
685 
686     if (sd->blk_len > 1)
687         pwd_len = sd->data[1];
688     else
689         pwd_len = 0;
690 
691     if (erase) {
692         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
693                         set_pwd || clr_pwd || lock || sd->wp_switch ||
694                         (sd->csd[14] & 0x20)) {
695             sd->card_status |= LOCK_UNLOCK_FAILED;
696             return;
697         }
698         bitmap_zero(sd->wp_groups, sd->wpgrps_size);
699         sd->csd[14] &= ~0x10;
700         sd->card_status &= ~CARD_IS_LOCKED;
701         sd->pwd_len = 0;
702         /* Erasing the entire card here! */
703         fprintf(stderr, "SD: Card force-erased by CMD42\n");
704         return;
705     }
706 
707     if (sd->blk_len < 2 + pwd_len ||
708                     pwd_len <= sd->pwd_len ||
709                     pwd_len > sd->pwd_len + 16) {
710         sd->card_status |= LOCK_UNLOCK_FAILED;
711         return;
712     }
713 
714     if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
715         sd->card_status |= LOCK_UNLOCK_FAILED;
716         return;
717     }
718 
719     pwd_len -= sd->pwd_len;
720     if ((pwd_len && !set_pwd) ||
721                     (clr_pwd && (set_pwd || lock)) ||
722                     (lock && !sd->pwd_len && !set_pwd) ||
723                     (!set_pwd && !clr_pwd &&
724                      (((sd->card_status & CARD_IS_LOCKED) && lock) ||
725                       (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
726         sd->card_status |= LOCK_UNLOCK_FAILED;
727         return;
728     }
729 
730     if (set_pwd) {
731         memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
732         sd->pwd_len = pwd_len;
733     }
734 
735     if (clr_pwd) {
736         sd->pwd_len = 0;
737     }
738 
739     if (lock)
740         sd->card_status |= CARD_IS_LOCKED;
741     else
742         sd->card_status &= ~CARD_IS_LOCKED;
743 }
744 
745 static sd_rsp_type_t sd_normal_command(SDState *sd,
746                                        SDRequest req)
747 {
748     uint32_t rca = 0x0000;
749     uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
750 
751     /* Not interpreting this as an app command */
752     sd->card_status &= ~APP_CMD;
753 
754     if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
755         || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
756         rca = req.arg >> 16;
757     }
758 
759     /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
760      * if not, its effects are cancelled */
761     if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) {
762         sd->multi_blk_cnt = 0;
763     }
764 
765     DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
766     switch (req.cmd) {
767     /* Basic commands (Class 0 and Class 1) */
768     case 0:	/* CMD0:   GO_IDLE_STATE */
769         switch (sd->state) {
770         case sd_inactive_state:
771             return sd->spi ? sd_r1 : sd_r0;
772 
773         default:
774             sd->state = sd_idle_state;
775             sd_reset(DEVICE(sd));
776             return sd->spi ? sd_r1 : sd_r0;
777         }
778         break;
779 
780     case 1:	/* CMD1:   SEND_OP_CMD */
781         if (!sd->spi)
782             goto bad_cmd;
783 
784         sd->state = sd_transfer_state;
785         return sd_r1;
786 
787     case 2:	/* CMD2:   ALL_SEND_CID */
788         if (sd->spi)
789             goto bad_cmd;
790         switch (sd->state) {
791         case sd_ready_state:
792             sd->state = sd_identification_state;
793             return sd_r2_i;
794 
795         default:
796             break;
797         }
798         break;
799 
800     case 3:	/* CMD3:   SEND_RELATIVE_ADDR */
801         if (sd->spi)
802             goto bad_cmd;
803         switch (sd->state) {
804         case sd_identification_state:
805         case sd_standby_state:
806             sd->state = sd_standby_state;
807             sd_set_rca(sd);
808             return sd_r6;
809 
810         default:
811             break;
812         }
813         break;
814 
815     case 4:	/* CMD4:   SEND_DSR */
816         if (sd->spi)
817             goto bad_cmd;
818         switch (sd->state) {
819         case sd_standby_state:
820             break;
821 
822         default:
823             break;
824         }
825         break;
826 
827     case 5: /* CMD5: reserved for SDIO cards */
828         return sd_illegal;
829 
830     case 6:	/* CMD6:   SWITCH_FUNCTION */
831         if (sd->spi)
832             goto bad_cmd;
833         switch (sd->mode) {
834         case sd_data_transfer_mode:
835             sd_function_switch(sd, req.arg);
836             sd->state = sd_sendingdata_state;
837             sd->data_start = 0;
838             sd->data_offset = 0;
839             return sd_r1;
840 
841         default:
842             break;
843         }
844         break;
845 
846     case 7:	/* CMD7:   SELECT/DESELECT_CARD */
847         if (sd->spi)
848             goto bad_cmd;
849         switch (sd->state) {
850         case sd_standby_state:
851             if (sd->rca != rca)
852                 return sd_r0;
853 
854             sd->state = sd_transfer_state;
855             return sd_r1b;
856 
857         case sd_transfer_state:
858         case sd_sendingdata_state:
859             if (sd->rca == rca)
860                 break;
861 
862             sd->state = sd_standby_state;
863             return sd_r1b;
864 
865         case sd_disconnect_state:
866             if (sd->rca != rca)
867                 return sd_r0;
868 
869             sd->state = sd_programming_state;
870             return sd_r1b;
871 
872         case sd_programming_state:
873             if (sd->rca == rca)
874                 break;
875 
876             sd->state = sd_disconnect_state;
877             return sd_r1b;
878 
879         default:
880             break;
881         }
882         break;
883 
884     case 8:	/* CMD8:   SEND_IF_COND */
885         /* Physical Layer Specification Version 2.00 command */
886         switch (sd->state) {
887         case sd_idle_state:
888             sd->vhs = 0;
889 
890             /* No response if not exactly one VHS bit is set.  */
891             if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
892                 return sd->spi ? sd_r7 : sd_r0;
893             }
894 
895             /* Accept.  */
896             sd->vhs = req.arg;
897             return sd_r7;
898 
899         default:
900             break;
901         }
902         break;
903 
904     case 9:	/* CMD9:   SEND_CSD */
905         switch (sd->state) {
906         case sd_standby_state:
907             if (sd->rca != rca)
908                 return sd_r0;
909 
910             return sd_r2_s;
911 
912         case sd_transfer_state:
913             if (!sd->spi)
914                 break;
915             sd->state = sd_sendingdata_state;
916             memcpy(sd->data, sd->csd, 16);
917             sd->data_start = addr;
918             sd->data_offset = 0;
919             return sd_r1;
920 
921         default:
922             break;
923         }
924         break;
925 
926     case 10:	/* CMD10:  SEND_CID */
927         switch (sd->state) {
928         case sd_standby_state:
929             if (sd->rca != rca)
930                 return sd_r0;
931 
932             return sd_r2_i;
933 
934         case sd_transfer_state:
935             if (!sd->spi)
936                 break;
937             sd->state = sd_sendingdata_state;
938             memcpy(sd->data, sd->cid, 16);
939             sd->data_start = addr;
940             sd->data_offset = 0;
941             return sd_r1;
942 
943         default:
944             break;
945         }
946         break;
947 
948     case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
949         if (sd->spi)
950             goto bad_cmd;
951         switch (sd->state) {
952         case sd_transfer_state:
953             sd->state = sd_sendingdata_state;
954             sd->data_start = req.arg;
955             sd->data_offset = 0;
956 
957             if (sd->data_start + sd->blk_len > sd->size)
958                 sd->card_status |= ADDRESS_ERROR;
959             return sd_r0;
960 
961         default:
962             break;
963         }
964         break;
965 
966     case 12:	/* CMD12:  STOP_TRANSMISSION */
967         switch (sd->state) {
968         case sd_sendingdata_state:
969             sd->state = sd_transfer_state;
970             return sd_r1b;
971 
972         case sd_receivingdata_state:
973             sd->state = sd_programming_state;
974             /* Bzzzzzzztt .... Operation complete.  */
975             sd->state = sd_transfer_state;
976             return sd_r1b;
977 
978         default:
979             break;
980         }
981         break;
982 
983     case 13:	/* CMD13:  SEND_STATUS */
984         switch (sd->mode) {
985         case sd_data_transfer_mode:
986             if (sd->rca != rca)
987                 return sd_r0;
988 
989             return sd_r1;
990 
991         default:
992             break;
993         }
994         break;
995 
996     case 15:	/* CMD15:  GO_INACTIVE_STATE */
997         if (sd->spi)
998             goto bad_cmd;
999         switch (sd->mode) {
1000         case sd_data_transfer_mode:
1001             if (sd->rca != rca)
1002                 return sd_r0;
1003 
1004             sd->state = sd_inactive_state;
1005             return sd_r0;
1006 
1007         default:
1008             break;
1009         }
1010         break;
1011 
1012     /* Block read commands (Classs 2) */
1013     case 16:	/* CMD16:  SET_BLOCKLEN */
1014         switch (sd->state) {
1015         case sd_transfer_state:
1016             if (req.arg > (1 << HWBLOCK_SHIFT))
1017                 sd->card_status |= BLOCK_LEN_ERROR;
1018             else
1019                 sd->blk_len = req.arg;
1020 
1021             return sd_r1;
1022 
1023         default:
1024             break;
1025         }
1026         break;
1027 
1028     case 17:	/* CMD17:  READ_SINGLE_BLOCK */
1029         switch (sd->state) {
1030         case sd_transfer_state:
1031             sd->state = sd_sendingdata_state;
1032             sd->data_start = addr;
1033             sd->data_offset = 0;
1034 
1035             if (sd->data_start + sd->blk_len > sd->size)
1036                 sd->card_status |= ADDRESS_ERROR;
1037             return sd_r1;
1038 
1039         default:
1040             break;
1041         }
1042         break;
1043 
1044     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */
1045         switch (sd->state) {
1046         case sd_transfer_state:
1047             sd->state = sd_sendingdata_state;
1048             sd->data_start = addr;
1049             sd->data_offset = 0;
1050 
1051             if (sd->data_start + sd->blk_len > sd->size)
1052                 sd->card_status |= ADDRESS_ERROR;
1053             return sd_r1;
1054 
1055         default:
1056             break;
1057         }
1058         break;
1059 
1060     case 23:    /* CMD23: SET_BLOCK_COUNT */
1061         switch (sd->state) {
1062         case sd_transfer_state:
1063             sd->multi_blk_cnt = req.arg;
1064             return sd_r1;
1065 
1066         default:
1067             break;
1068         }
1069         break;
1070 
1071     /* Block write commands (Class 4) */
1072     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
1073         if (sd->spi)
1074             goto unimplemented_cmd;
1075         switch (sd->state) {
1076         case sd_transfer_state:
1077             /* Writing in SPI mode not implemented.  */
1078             if (sd->spi)
1079                 break;
1080             sd->state = sd_receivingdata_state;
1081             sd->data_start = addr;
1082             sd->data_offset = 0;
1083             sd->blk_written = 0;
1084 
1085             if (sd->data_start + sd->blk_len > sd->size)
1086                 sd->card_status |= ADDRESS_ERROR;
1087             if (sd_wp_addr(sd, sd->data_start))
1088                 sd->card_status |= WP_VIOLATION;
1089             if (sd->csd[14] & 0x30)
1090                 sd->card_status |= WP_VIOLATION;
1091             return sd_r1;
1092 
1093         default:
1094             break;
1095         }
1096         break;
1097 
1098     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */
1099         if (sd->spi)
1100             goto unimplemented_cmd;
1101         switch (sd->state) {
1102         case sd_transfer_state:
1103             /* Writing in SPI mode not implemented.  */
1104             if (sd->spi)
1105                 break;
1106             sd->state = sd_receivingdata_state;
1107             sd->data_start = addr;
1108             sd->data_offset = 0;
1109             sd->blk_written = 0;
1110 
1111             if (sd->data_start + sd->blk_len > sd->size)
1112                 sd->card_status |= ADDRESS_ERROR;
1113             if (sd_wp_addr(sd, sd->data_start))
1114                 sd->card_status |= WP_VIOLATION;
1115             if (sd->csd[14] & 0x30)
1116                 sd->card_status |= WP_VIOLATION;
1117             return sd_r1;
1118 
1119         default:
1120             break;
1121         }
1122         break;
1123 
1124     case 26:	/* CMD26:  PROGRAM_CID */
1125         if (sd->spi)
1126             goto bad_cmd;
1127         switch (sd->state) {
1128         case sd_transfer_state:
1129             sd->state = sd_receivingdata_state;
1130             sd->data_start = 0;
1131             sd->data_offset = 0;
1132             return sd_r1;
1133 
1134         default:
1135             break;
1136         }
1137         break;
1138 
1139     case 27:	/* CMD27:  PROGRAM_CSD */
1140         if (sd->spi)
1141             goto unimplemented_cmd;
1142         switch (sd->state) {
1143         case sd_transfer_state:
1144             sd->state = sd_receivingdata_state;
1145             sd->data_start = 0;
1146             sd->data_offset = 0;
1147             return sd_r1;
1148 
1149         default:
1150             break;
1151         }
1152         break;
1153 
1154     /* Write protection (Class 6) */
1155     case 28:	/* CMD28:  SET_WRITE_PROT */
1156         switch (sd->state) {
1157         case sd_transfer_state:
1158             if (addr >= sd->size) {
1159                 sd->card_status |= ADDRESS_ERROR;
1160                 return sd_r1b;
1161             }
1162 
1163             sd->state = sd_programming_state;
1164             set_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1165             /* Bzzzzzzztt .... Operation complete.  */
1166             sd->state = sd_transfer_state;
1167             return sd_r1b;
1168 
1169         default:
1170             break;
1171         }
1172         break;
1173 
1174     case 29:	/* CMD29:  CLR_WRITE_PROT */
1175         switch (sd->state) {
1176         case sd_transfer_state:
1177             if (addr >= sd->size) {
1178                 sd->card_status |= ADDRESS_ERROR;
1179                 return sd_r1b;
1180             }
1181 
1182             sd->state = sd_programming_state;
1183             clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
1184             /* Bzzzzzzztt .... Operation complete.  */
1185             sd->state = sd_transfer_state;
1186             return sd_r1b;
1187 
1188         default:
1189             break;
1190         }
1191         break;
1192 
1193     case 30:	/* CMD30:  SEND_WRITE_PROT */
1194         switch (sd->state) {
1195         case sd_transfer_state:
1196             sd->state = sd_sendingdata_state;
1197             *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1198             sd->data_start = addr;
1199             sd->data_offset = 0;
1200             return sd_r1b;
1201 
1202         default:
1203             break;
1204         }
1205         break;
1206 
1207     /* Erase commands (Class 5) */
1208     case 32:	/* CMD32:  ERASE_WR_BLK_START */
1209         switch (sd->state) {
1210         case sd_transfer_state:
1211             sd->erase_start = req.arg;
1212             return sd_r1;
1213 
1214         default:
1215             break;
1216         }
1217         break;
1218 
1219     case 33:	/* CMD33:  ERASE_WR_BLK_END */
1220         switch (sd->state) {
1221         case sd_transfer_state:
1222             sd->erase_end = req.arg;
1223             return sd_r1;
1224 
1225         default:
1226             break;
1227         }
1228         break;
1229 
1230     case 38:	/* CMD38:  ERASE */
1231         switch (sd->state) {
1232         case sd_transfer_state:
1233             if (sd->csd[14] & 0x30) {
1234                 sd->card_status |= WP_VIOLATION;
1235                 return sd_r1b;
1236             }
1237 
1238             sd->state = sd_programming_state;
1239             sd_erase(sd);
1240             /* Bzzzzzzztt .... Operation complete.  */
1241             sd->state = sd_transfer_state;
1242             return sd_r1b;
1243 
1244         default:
1245             break;
1246         }
1247         break;
1248 
1249     /* Lock card commands (Class 7) */
1250     case 42:	/* CMD42:  LOCK_UNLOCK */
1251         if (sd->spi)
1252             goto unimplemented_cmd;
1253         switch (sd->state) {
1254         case sd_transfer_state:
1255             sd->state = sd_receivingdata_state;
1256             sd->data_start = 0;
1257             sd->data_offset = 0;
1258             return sd_r1;
1259 
1260         default:
1261             break;
1262         }
1263         break;
1264 
1265     case 52:
1266     case 53:
1267         /* CMD52, CMD53: reserved for SDIO cards
1268          * (see the SDIO Simplified Specification V2.0)
1269          * Handle as illegal command but do not complain
1270          * on stderr, as some OSes may use these in their
1271          * probing for presence of an SDIO card.
1272          */
1273         return sd_illegal;
1274 
1275     /* Application specific commands (Class 8) */
1276     case 55:	/* CMD55:  APP_CMD */
1277         if (sd->rca != rca)
1278             return sd_r0;
1279 
1280         sd->expecting_acmd = true;
1281         sd->card_status |= APP_CMD;
1282         return sd_r1;
1283 
1284     case 56:	/* CMD56:  GEN_CMD */
1285         fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1286 
1287         switch (sd->state) {
1288         case sd_transfer_state:
1289             sd->data_offset = 0;
1290             if (req.arg & 1)
1291                 sd->state = sd_sendingdata_state;
1292             else
1293                 sd->state = sd_receivingdata_state;
1294             return sd_r1;
1295 
1296         default:
1297             break;
1298         }
1299         break;
1300 
1301     default:
1302     bad_cmd:
1303         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
1304         return sd_illegal;
1305 
1306     unimplemented_cmd:
1307         /* Commands that are recognised but not yet implemented in SPI mode.  */
1308         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
1309                       req.cmd);
1310         return sd_illegal;
1311     }
1312 
1313     qemu_log_mask(LOG_GUEST_ERROR, "SD: CMD%i in a wrong state\n", req.cmd);
1314     return sd_illegal;
1315 }
1316 
1317 static sd_rsp_type_t sd_app_command(SDState *sd,
1318                                     SDRequest req)
1319 {
1320     DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1321     sd->card_status |= APP_CMD;
1322     switch (req.cmd) {
1323     case 6:	/* ACMD6:  SET_BUS_WIDTH */
1324         switch (sd->state) {
1325         case sd_transfer_state:
1326             sd->sd_status[0] &= 0x3f;
1327             sd->sd_status[0] |= (req.arg & 0x03) << 6;
1328             return sd_r1;
1329 
1330         default:
1331             break;
1332         }
1333         break;
1334 
1335     case 13:	/* ACMD13: SD_STATUS */
1336         switch (sd->state) {
1337         case sd_transfer_state:
1338             sd->state = sd_sendingdata_state;
1339             sd->data_start = 0;
1340             sd->data_offset = 0;
1341             return sd_r1;
1342 
1343         default:
1344             break;
1345         }
1346         break;
1347 
1348     case 22:	/* ACMD22: SEND_NUM_WR_BLOCKS */
1349         switch (sd->state) {
1350         case sd_transfer_state:
1351             *(uint32_t *) sd->data = sd->blk_written;
1352 
1353             sd->state = sd_sendingdata_state;
1354             sd->data_start = 0;
1355             sd->data_offset = 0;
1356             return sd_r1;
1357 
1358         default:
1359             break;
1360         }
1361         break;
1362 
1363     case 23:	/* ACMD23: SET_WR_BLK_ERASE_COUNT */
1364         switch (sd->state) {
1365         case sd_transfer_state:
1366             return sd_r1;
1367 
1368         default:
1369             break;
1370         }
1371         break;
1372 
1373     case 41:	/* ACMD41: SD_APP_OP_COND */
1374         if (sd->spi) {
1375             /* SEND_OP_CMD */
1376             sd->state = sd_transfer_state;
1377             return sd_r1;
1378         }
1379         switch (sd->state) {
1380         case sd_idle_state:
1381             /* If it's the first ACMD41 since reset, we need to decide
1382              * whether to power up. If this is not an enquiry ACMD41,
1383              * we immediately report power on and proceed below to the
1384              * ready state, but if it is, we set a timer to model a
1385              * delay for power up. This works around a bug in EDK2
1386              * UEFI, which sends an initial enquiry ACMD41, but
1387              * assumes that the card is in ready state as soon as it
1388              * sees the power up bit set. */
1389             if (!(sd->ocr & OCR_POWER_UP)) {
1390                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
1391                     timer_del(sd->ocr_power_timer);
1392                     sd_ocr_powerup(sd);
1393                 } else if (!timer_pending(sd->ocr_power_timer)) {
1394                     timer_mod_ns(sd->ocr_power_timer,
1395                                  (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
1396                                   + OCR_POWER_DELAY_NS));
1397                 }
1398             }
1399 
1400             /* We accept any voltage.  10000 V is nothing.
1401              *
1402              * Once we're powered up, we advance straight to ready state
1403              * unless it's an enquiry ACMD41 (bits 23:0 == 0).
1404              */
1405             if (req.arg & ACMD41_ENQUIRY_MASK) {
1406                 sd->state = sd_ready_state;
1407             }
1408 
1409             return sd_r3;
1410 
1411         default:
1412             break;
1413         }
1414         break;
1415 
1416     case 42:	/* ACMD42: SET_CLR_CARD_DETECT */
1417         switch (sd->state) {
1418         case sd_transfer_state:
1419             /* Bringing in the 50KOhm pull-up resistor... Done.  */
1420             return sd_r1;
1421 
1422         default:
1423             break;
1424         }
1425         break;
1426 
1427     case 51:	/* ACMD51: SEND_SCR */
1428         switch (sd->state) {
1429         case sd_transfer_state:
1430             sd->state = sd_sendingdata_state;
1431             sd->data_start = 0;
1432             sd->data_offset = 0;
1433             return sd_r1;
1434 
1435         default:
1436             break;
1437         }
1438         break;
1439 
1440     default:
1441         /* Fall back to standard commands.  */
1442         return sd_normal_command(sd, req);
1443     }
1444 
1445     qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
1446     return sd_illegal;
1447 }
1448 
1449 static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
1450 {
1451     /* Valid commands in locked state:
1452      * basic class (0)
1453      * lock card class (7)
1454      * CMD16
1455      * implicitly, the ACMD prefix CMD55
1456      * ACMD41 and ACMD42
1457      * Anything else provokes an "illegal command" response.
1458      */
1459     if (sd->expecting_acmd) {
1460         return req->cmd == 41 || req->cmd == 42;
1461     }
1462     if (req->cmd == 16 || req->cmd == 55) {
1463         return 1;
1464     }
1465     return sd_cmd_class[req->cmd & 0x3F] == 0
1466             || sd_cmd_class[req->cmd & 0x3F] == 7;
1467 }
1468 
1469 int sd_do_command(SDState *sd, SDRequest *req,
1470                   uint8_t *response) {
1471     int last_state;
1472     sd_rsp_type_t rtype;
1473     int rsplen;
1474 
1475     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable) {
1476         return 0;
1477     }
1478 
1479     if (sd_req_crc_validate(req)) {
1480         sd->card_status |= COM_CRC_ERROR;
1481         rtype = sd_illegal;
1482         goto send_response;
1483     }
1484 
1485     if (sd->card_status & CARD_IS_LOCKED) {
1486         if (!cmd_valid_while_locked(sd, req)) {
1487             sd->card_status |= ILLEGAL_COMMAND;
1488             sd->expecting_acmd = false;
1489             qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
1490             rtype = sd_illegal;
1491             goto send_response;
1492         }
1493     }
1494 
1495     last_state = sd->state;
1496     sd_set_mode(sd);
1497 
1498     if (sd->expecting_acmd) {
1499         sd->expecting_acmd = false;
1500         rtype = sd_app_command(sd, *req);
1501     } else {
1502         rtype = sd_normal_command(sd, *req);
1503     }
1504 
1505     if (rtype == sd_illegal) {
1506         sd->card_status |= ILLEGAL_COMMAND;
1507     } else {
1508         /* Valid command, we can update the 'state before command' bits.
1509          * (Do this now so they appear in r1 responses.)
1510          */
1511         sd->current_cmd = req->cmd;
1512         sd->card_status &= ~CURRENT_STATE;
1513         sd->card_status |= (last_state << 9);
1514     }
1515 
1516 send_response:
1517     switch (rtype) {
1518     case sd_r1:
1519     case sd_r1b:
1520         sd_response_r1_make(sd, response);
1521         rsplen = 4;
1522         break;
1523 
1524     case sd_r2_i:
1525         memcpy(response, sd->cid, sizeof(sd->cid));
1526         rsplen = 16;
1527         break;
1528 
1529     case sd_r2_s:
1530         memcpy(response, sd->csd, sizeof(sd->csd));
1531         rsplen = 16;
1532         break;
1533 
1534     case sd_r3:
1535         sd_response_r3_make(sd, response);
1536         rsplen = 4;
1537         break;
1538 
1539     case sd_r6:
1540         sd_response_r6_make(sd, response);
1541         rsplen = 4;
1542         break;
1543 
1544     case sd_r7:
1545         sd_response_r7_make(sd, response);
1546         rsplen = 4;
1547         break;
1548 
1549     case sd_r0:
1550     case sd_illegal:
1551     default:
1552         rsplen = 0;
1553         break;
1554     }
1555 
1556     if (rtype != sd_illegal) {
1557         /* Clear the "clear on valid command" status bits now we've
1558          * sent any response
1559          */
1560         sd->card_status &= ~CARD_STATUS_B;
1561     }
1562 
1563 #ifdef DEBUG_SD
1564     if (rsplen) {
1565         int i;
1566         DPRINTF("Response:");
1567         for (i = 0; i < rsplen; i++)
1568             fprintf(stderr, " %02x", response[i]);
1569         fprintf(stderr, " state %d\n", sd->state);
1570     } else {
1571         DPRINTF("No response %d\n", sd->state);
1572     }
1573 #endif
1574 
1575     return rsplen;
1576 }
1577 
1578 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1579 {
1580     DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
1581             (unsigned long long) addr, len);
1582     if (!sd->blk || blk_pread(sd->blk, addr, sd->data, len) < 0) {
1583         fprintf(stderr, "sd_blk_read: read error on host side\n");
1584     }
1585 }
1586 
1587 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1588 {
1589     if (!sd->blk || blk_pwrite(sd->blk, addr, sd->data, len, 0) < 0) {
1590         fprintf(stderr, "sd_blk_write: write error on host side\n");
1591     }
1592 }
1593 
1594 #define BLK_READ_BLOCK(a, len)	sd_blk_read(sd, a, len)
1595 #define BLK_WRITE_BLOCK(a, len)	sd_blk_write(sd, a, len)
1596 #define APP_READ_BLOCK(a, len)	memset(sd->data, 0xec, len)
1597 #define APP_WRITE_BLOCK(a, len)
1598 
1599 void sd_write_data(SDState *sd, uint8_t value)
1600 {
1601     int i;
1602 
1603     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1604         return;
1605 
1606     if (sd->state != sd_receivingdata_state) {
1607         qemu_log_mask(LOG_GUEST_ERROR,
1608                       "sd_write_data: not in Receiving-Data state\n");
1609         return;
1610     }
1611 
1612     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1613         return;
1614 
1615     switch (sd->current_cmd) {
1616     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
1617         sd->data[sd->data_offset ++] = value;
1618         if (sd->data_offset >= sd->blk_len) {
1619             /* TODO: Check CRC before committing */
1620             sd->state = sd_programming_state;
1621             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1622             sd->blk_written ++;
1623             sd->csd[14] |= 0x40;
1624             /* Bzzzzzzztt .... Operation complete.  */
1625             sd->state = sd_transfer_state;
1626         }
1627         break;
1628 
1629     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */
1630         if (sd->data_offset == 0) {
1631             /* Start of the block - let's check the address is valid */
1632             if (sd->data_start + sd->blk_len > sd->size) {
1633                 sd->card_status |= ADDRESS_ERROR;
1634                 break;
1635             }
1636             if (sd_wp_addr(sd, sd->data_start)) {
1637                 sd->card_status |= WP_VIOLATION;
1638                 break;
1639             }
1640         }
1641         sd->data[sd->data_offset++] = value;
1642         if (sd->data_offset >= sd->blk_len) {
1643             /* TODO: Check CRC before committing */
1644             sd->state = sd_programming_state;
1645             BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1646             sd->blk_written++;
1647             sd->data_start += sd->blk_len;
1648             sd->data_offset = 0;
1649             sd->csd[14] |= 0x40;
1650 
1651             /* Bzzzzzzztt .... Operation complete.  */
1652             if (sd->multi_blk_cnt != 0) {
1653                 if (--sd->multi_blk_cnt == 0) {
1654                     /* Stop! */
1655                     sd->state = sd_transfer_state;
1656                     break;
1657                 }
1658             }
1659 
1660             sd->state = sd_receivingdata_state;
1661         }
1662         break;
1663 
1664     case 26:	/* CMD26:  PROGRAM_CID */
1665         sd->data[sd->data_offset ++] = value;
1666         if (sd->data_offset >= sizeof(sd->cid)) {
1667             /* TODO: Check CRC before committing */
1668             sd->state = sd_programming_state;
1669             for (i = 0; i < sizeof(sd->cid); i ++)
1670                 if ((sd->cid[i] | 0x00) != sd->data[i])
1671                     sd->card_status |= CID_CSD_OVERWRITE;
1672 
1673             if (!(sd->card_status & CID_CSD_OVERWRITE))
1674                 for (i = 0; i < sizeof(sd->cid); i ++) {
1675                     sd->cid[i] |= 0x00;
1676                     sd->cid[i] &= sd->data[i];
1677                 }
1678             /* Bzzzzzzztt .... Operation complete.  */
1679             sd->state = sd_transfer_state;
1680         }
1681         break;
1682 
1683     case 27:	/* CMD27:  PROGRAM_CSD */
1684         sd->data[sd->data_offset ++] = value;
1685         if (sd->data_offset >= sizeof(sd->csd)) {
1686             /* TODO: Check CRC before committing */
1687             sd->state = sd_programming_state;
1688             for (i = 0; i < sizeof(sd->csd); i ++)
1689                 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1690                     (sd->data[i] | sd_csd_rw_mask[i]))
1691                     sd->card_status |= CID_CSD_OVERWRITE;
1692 
1693             /* Copy flag (OTP) & Permanent write protect */
1694             if (sd->csd[14] & ~sd->data[14] & 0x60)
1695                 sd->card_status |= CID_CSD_OVERWRITE;
1696 
1697             if (!(sd->card_status & CID_CSD_OVERWRITE))
1698                 for (i = 0; i < sizeof(sd->csd); i ++) {
1699                     sd->csd[i] |= sd_csd_rw_mask[i];
1700                     sd->csd[i] &= sd->data[i];
1701                 }
1702             /* Bzzzzzzztt .... Operation complete.  */
1703             sd->state = sd_transfer_state;
1704         }
1705         break;
1706 
1707     case 42:	/* CMD42:  LOCK_UNLOCK */
1708         sd->data[sd->data_offset ++] = value;
1709         if (sd->data_offset >= sd->blk_len) {
1710             /* TODO: Check CRC before committing */
1711             sd->state = sd_programming_state;
1712             sd_lock_command(sd);
1713             /* Bzzzzzzztt .... Operation complete.  */
1714             sd->state = sd_transfer_state;
1715         }
1716         break;
1717 
1718     case 56:	/* CMD56:  GEN_CMD */
1719         sd->data[sd->data_offset ++] = value;
1720         if (sd->data_offset >= sd->blk_len) {
1721             APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1722             sd->state = sd_transfer_state;
1723         }
1724         break;
1725 
1726     default:
1727         qemu_log_mask(LOG_GUEST_ERROR, "sd_write_data: unknown command\n");
1728         break;
1729     }
1730 }
1731 
1732 uint8_t sd_read_data(SDState *sd)
1733 {
1734     /* TODO: Append CRCs */
1735     uint8_t ret;
1736     int io_len;
1737 
1738     if (!sd->blk || !blk_is_inserted(sd->blk) || !sd->enable)
1739         return 0x00;
1740 
1741     if (sd->state != sd_sendingdata_state) {
1742         qemu_log_mask(LOG_GUEST_ERROR,
1743                       "sd_read_data: not in Sending-Data state\n");
1744         return 0x00;
1745     }
1746 
1747     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1748         return 0x00;
1749 
1750     io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1751 
1752     switch (sd->current_cmd) {
1753     case 6:	/* CMD6:   SWITCH_FUNCTION */
1754         ret = sd->data[sd->data_offset ++];
1755 
1756         if (sd->data_offset >= 64)
1757             sd->state = sd_transfer_state;
1758         break;
1759 
1760     case 9:	/* CMD9:   SEND_CSD */
1761     case 10:	/* CMD10:  SEND_CID */
1762         ret = sd->data[sd->data_offset ++];
1763 
1764         if (sd->data_offset >= 16)
1765             sd->state = sd_transfer_state;
1766         break;
1767 
1768     case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
1769         if (sd->data_offset == 0)
1770             BLK_READ_BLOCK(sd->data_start, io_len);
1771         ret = sd->data[sd->data_offset ++];
1772 
1773         if (sd->data_offset >= io_len) {
1774             sd->data_start += io_len;
1775             sd->data_offset = 0;
1776             if (sd->data_start + io_len > sd->size) {
1777                 sd->card_status |= ADDRESS_ERROR;
1778                 break;
1779             }
1780         }
1781         break;
1782 
1783     case 13:	/* ACMD13: SD_STATUS */
1784         ret = sd->sd_status[sd->data_offset ++];
1785 
1786         if (sd->data_offset >= sizeof(sd->sd_status))
1787             sd->state = sd_transfer_state;
1788         break;
1789 
1790     case 17:	/* CMD17:  READ_SINGLE_BLOCK */
1791         if (sd->data_offset == 0)
1792             BLK_READ_BLOCK(sd->data_start, io_len);
1793         ret = sd->data[sd->data_offset ++];
1794 
1795         if (sd->data_offset >= io_len)
1796             sd->state = sd_transfer_state;
1797         break;
1798 
1799     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */
1800         if (sd->data_offset == 0)
1801             BLK_READ_BLOCK(sd->data_start, io_len);
1802         ret = sd->data[sd->data_offset ++];
1803 
1804         if (sd->data_offset >= io_len) {
1805             sd->data_start += io_len;
1806             sd->data_offset = 0;
1807 
1808             if (sd->multi_blk_cnt != 0) {
1809                 if (--sd->multi_blk_cnt == 0) {
1810                     /* Stop! */
1811                     sd->state = sd_transfer_state;
1812                     break;
1813                 }
1814             }
1815 
1816             if (sd->data_start + io_len > sd->size) {
1817                 sd->card_status |= ADDRESS_ERROR;
1818                 break;
1819             }
1820         }
1821         break;
1822 
1823     case 22:	/* ACMD22: SEND_NUM_WR_BLOCKS */
1824         ret = sd->data[sd->data_offset ++];
1825 
1826         if (sd->data_offset >= 4)
1827             sd->state = sd_transfer_state;
1828         break;
1829 
1830     case 30:	/* CMD30:  SEND_WRITE_PROT */
1831         ret = sd->data[sd->data_offset ++];
1832 
1833         if (sd->data_offset >= 4)
1834             sd->state = sd_transfer_state;
1835         break;
1836 
1837     case 51:	/* ACMD51: SEND_SCR */
1838         ret = sd->scr[sd->data_offset ++];
1839 
1840         if (sd->data_offset >= sizeof(sd->scr))
1841             sd->state = sd_transfer_state;
1842         break;
1843 
1844     case 56:	/* CMD56:  GEN_CMD */
1845         if (sd->data_offset == 0)
1846             APP_READ_BLOCK(sd->data_start, sd->blk_len);
1847         ret = sd->data[sd->data_offset ++];
1848 
1849         if (sd->data_offset >= sd->blk_len)
1850             sd->state = sd_transfer_state;
1851         break;
1852 
1853     default:
1854         qemu_log_mask(LOG_GUEST_ERROR, "sd_read_data: unknown command\n");
1855         return 0x00;
1856     }
1857 
1858     return ret;
1859 }
1860 
1861 bool sd_data_ready(SDState *sd)
1862 {
1863     return sd->state == sd_sendingdata_state;
1864 }
1865 
1866 void sd_enable(SDState *sd, bool enable)
1867 {
1868     sd->enable = enable;
1869 }
1870 
1871 static void sd_instance_init(Object *obj)
1872 {
1873     SDState *sd = SD_CARD(obj);
1874 
1875     sd->enable = true;
1876     sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
1877 }
1878 
1879 static void sd_instance_finalize(Object *obj)
1880 {
1881     SDState *sd = SD_CARD(obj);
1882 
1883     timer_del(sd->ocr_power_timer);
1884     timer_free(sd->ocr_power_timer);
1885 }
1886 
1887 static void sd_realize(DeviceState *dev, Error **errp)
1888 {
1889     SDState *sd = SD_CARD(dev);
1890 
1891     if (sd->blk && blk_is_read_only(sd->blk)) {
1892         error_setg(errp, "Cannot use read-only drive as SD card");
1893         return;
1894     }
1895 
1896     if (sd->blk) {
1897         blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
1898     }
1899 }
1900 
1901 static Property sd_properties[] = {
1902     DEFINE_PROP_DRIVE("drive", SDState, blk),
1903     /* We do not model the chip select pin, so allow the board to select
1904      * whether card should be in SSI or MMC/SD mode.  It is also up to the
1905      * board to ensure that ssi transfers only occur when the chip select
1906      * is asserted.  */
1907     DEFINE_PROP_BOOL("spi", SDState, spi, false),
1908     DEFINE_PROP_END_OF_LIST()
1909 };
1910 
1911 static void sd_class_init(ObjectClass *klass, void *data)
1912 {
1913     DeviceClass *dc = DEVICE_CLASS(klass);
1914     SDCardClass *sc = SD_CARD_CLASS(klass);
1915 
1916     dc->realize = sd_realize;
1917     dc->props = sd_properties;
1918     dc->vmsd = &sd_vmstate;
1919     dc->reset = sd_reset;
1920     dc->bus_type = TYPE_SD_BUS;
1921 
1922     sc->do_command = sd_do_command;
1923     sc->write_data = sd_write_data;
1924     sc->read_data = sd_read_data;
1925     sc->data_ready = sd_data_ready;
1926     sc->enable = sd_enable;
1927     sc->get_inserted = sd_get_inserted;
1928     sc->get_readonly = sd_get_readonly;
1929 }
1930 
1931 static const TypeInfo sd_info = {
1932     .name = TYPE_SD_CARD,
1933     .parent = TYPE_DEVICE,
1934     .instance_size = sizeof(SDState),
1935     .class_size = sizeof(SDCardClass),
1936     .class_init = sd_class_init,
1937     .instance_init = sd_instance_init,
1938     .instance_finalize = sd_instance_finalize,
1939 };
1940 
1941 static void sd_register_types(void)
1942 {
1943     type_register_static(&sd_info);
1944 }
1945 
1946 type_init(sd_register_types)
1947