sd.c · samitouri/QOSamiQemu · siGit Code & Deploy

Code Commits Issues Pulls Sessions CI/CD

master

c 3,319 lines 102 KB

Raw

1	/*
2	* SD Memory Card emulation as defined in the "SD Memory Card Physical
3	* layer specification, Version 2.00."
4	*
5	* eMMC emulation defined in "JEDEC Standard No. 84-A43"
6	*
7	* Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
8	* Copyright (c) 2007 CodeSourcery
9	* Copyright (c) 2018 Philippe Mathieu-Daudé
10	*
11	* Redistribution and use in source and binary forms, with or without
12	* modification, are permitted provided that the following conditions
13	* are met:
14	*
15	* 1. Redistributions of source code must retain the above copyright
16	* notice, this list of conditions and the following disclaimer.
17	* 2. Redistributions in binary form must reproduce the above copyright
18	* notice, this list of conditions and the following disclaimer in
19	* the documentation and/or other materials provided with the
20	* distribution.
21	*
22	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
23	* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24	* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
25	* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
26	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
29	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
30	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33	*/
34
35	#include "qemu/osdep.h"
36	#include "qemu/units.h"
37	#include "qemu/cutils.h"
38	#include "qemu/bswap.h"
39	#include "hw/core/irq.h"
40	#include "hw/core/registerfields.h"
41	#include "system/block-backend.h"
42	#include "hw/sd/sd.h"
43	#include "migration/vmstate.h"
44	#include "qapi/error.h"
45	#include "qemu/bitmap.h"
46	#include "hw/core/qdev-properties.h"
47	#include "hw/core/qdev-properties-system.h"
48	#include "qemu/error-report.h"
49	#include "qemu/timer.h"
50	#include "qemu/log.h"
51	#include "qemu/guest-random.h"
52	#include "qemu/module.h"
53	#include "sdmmc-internal.h"
54	#include "trace.h"
55	#include "crypto/hmac.h"
56
57	//#define DEBUG_SD 1
58
59	#define SDSC_MAX_CAPACITY (2 * GiB)
60
61	#define INVALID_ADDRESS UINT32_MAX
62
63	typedef enum {
64	sd_r0 = 0, /* no response */
65	sd_r1, /* normal response command */
66	spi_r2, /* STATUS */
67	sd_r2_i, /* CID register */
68	sd_r2_s, /* CSD register */
69	sd_r3, /* OCR register */
70	sd_r6 = 6, /* Published RCA response */
71	sd_r7, /* Operating voltage */
72	sd_r1b = -1,
73	sd_illegal = -2,
74	} sd_rsp_type_t;
75
76	typedef enum {
77	sd_spi,
78	sd_bc, /* broadcast -- no response */
79	sd_bcr, /* broadcast with response */
80	sd_ac, /* addressed -- no data transfer */
81	sd_adtc, /* addressed with data transfer */
82	} sd_cmd_type_t;
83
84	enum SDCardModes {
85	sd_inactive,
86	sd_card_identification_mode,
87	sd_data_transfer_mode,
88	};
89
90	enum SDCardStates {
91	sd_waitirq_state = -2, /* emmc */
92	sd_inactive_state = -1,
93
94	sd_idle_state = 0,
95	sd_ready_state = 1,
96	sd_identification_state = 2,
97	sd_standby_state = 3,
98	sd_transfer_state = 4,
99	sd_sendingdata_state = 5,
100	sd_receivingdata_state = 6,
101	sd_programming_state = 7,
102	sd_disconnect_state = 8,
103	sd_bus_test_state = 9, /* emmc */
104	sd_sleep_state = 10, /* emmc */
105	sd_io_state = 15 /* sd */
106	};
107
108	#define SDMMC_CMD_MAX 64
109
110	typedef sd_rsp_type_t (sd_cmd_handler)(SDState sd, SDRequest req);
111
112	typedef struct SDProto {
113	const char *name;
114	struct {
115	const unsigned class;
116	const sd_cmd_type_t type;
117	const char *name;
118	sd_cmd_handler handler;
119	} cmd[SDMMC_CMD_MAX], acmd[SDMMC_CMD_MAX];
120	} SDProto;
121
122	#define RPMB_STUFF_LEN 196
123	#define RPMB_KEY_MAC_LEN 32
124	#define RPMB_DATA_LEN 256 /* one RPMB block is half a sector */
125	#define RPMB_NONCE_LEN 16
126	#define RPMB_HASH_LEN 284
127
128	typedef struct QEMU_PACKED {
129	uint8_t stuff_bytes[RPMB_STUFF_LEN];
130	uint8_t key_mac[RPMB_KEY_MAC_LEN];
131	uint8_t data[RPMB_DATA_LEN];
132	uint8_t nonce[RPMB_NONCE_LEN];
133	uint32_t write_counter;
134	uint16_t address;
135	uint16_t block_count;
136	uint16_t result;
137	uint16_t req_resp;
138	} RPMBDataFrame;
139
140	QEMU_BUILD_BUG_MSG(sizeof(RPMBDataFrame) != 512,
141	"invalid RPMBDataFrame size");
142
143	struct SDState {
144	DeviceState parent_obj;
145
146	/* SD Memory Card Registers */
147	uint32_t ocr;
148	uint8_t scr[8];
149	uint8_t cid[16];
150	uint8_t csd[16];
151	uint16_t rca;
152	uint32_t card_status;
153	uint8_t sd_status[64];
154	union {
155	uint8_t ext_csd[512];
156	struct {
157	uint8_t ext_csd_rw[192]; /* Modes segment */
158	uint8_t ext_csd_ro[320]; /* Properties segment */
159	};
160	};
161
162	/* Static properties */
163
164	uint8_t spec_version;
165	uint64_t boot_part_size;
166	uint64_t rpmb_part_size;
167	BlockBackend *blk;
168	uint8_t boot_config;
169
170	const SDProto *proto;
171
172	/* Runtime changeables */
173
174	int32_t state; /* current card state, one of SDCardStates */
175	uint32_t vhs;
176	bool wp_switch;
177	unsigned long *wp_group_bmap;
178	int32_t wp_group_bits;
179	uint64_t size;
180	uint32_t blk_len;
181	uint32_t multi_blk_cnt;
182	uint32_t erase_start;
183	uint32_t erase_end;
184	uint8_t pwd[16];
185	uint32_t pwd_len;
186	uint8_t function_group[6];
187	uint8_t current_cmd;
188	const char *last_cmd_name;
189	/* True if we will handle the next command as an ACMD. Note that this does
190	* not track the APP_CMD status bit!
191	*/
192	bool expecting_acmd;
193	uint32_t blk_written;
194
195	uint64_t data_start;
196	uint32_t data_offset;
197	size_t data_size;
198	uint8_t data[512];
199	struct {
200	uint32_t write_counter;
201	uint8_t key[RPMB_KEY_MAC_LEN];
202	uint8_t key_set;
203	RPMBDataFrame result;
204	} rpmb;
205	QEMUTimer *ocr_power_timer;
206	uint8_t dat_lines;
207	bool cmd_line;
208	char *preset_auth_key;
209	};
210
211	static void sd_realize(DeviceState dev, Error *errp);
212
213	static const SDProto sd_proto_spi;
214	static const SDProto sd_proto_emmc;
215
216	static bool sd_is_spi(SDState *sd)
217	{
218	return sd->proto == &sd_proto_spi;
219	}
220
221	static bool sd_is_emmc(SDState *sd)
222	{
223	return sd->proto == &sd_proto_emmc;
224	}
225
226	static const char *sd_version_str(enum SDPhySpecificationVersion version)
227	{
228	static const char *sdphy_version[] = {
229	[SD_PHY_SPECv2_00_VERS] = "v2.00",
230	[SD_PHY_SPECv3_01_VERS] = "v3.01",
231	};
232	if (version >= ARRAY_SIZE(sdphy_version)) {
233	return "unsupported version";
234	}
235	return sdphy_version[version];
236	}
237
238	static const char *sd_mode_name(enum SDCardModes mode)
239	{
240	static const char *mode_name[] = {
241	[sd_inactive] = "inactive",
242	[sd_card_identification_mode] = "identification",
243	[sd_data_transfer_mode] = "transfer",
244	};
245	assert(mode < ARRAY_SIZE(mode_name));
246	return mode_name[mode];
247	}
248
249	static const char *sd_state_name(enum SDCardStates state)
250	{
251	static const char *state_name[] = {
252	[sd_idle_state] = "idle",
253	[sd_ready_state] = "ready",
254	[sd_identification_state] = "identification",
255	[sd_standby_state] = "standby",
256	[sd_transfer_state] = "transfer",
257	[sd_sendingdata_state] = "sendingdata",
258	[sd_bus_test_state] = "bus-test",
259	[sd_receivingdata_state] = "receivingdata",
260	[sd_programming_state] = "programming",
261	[sd_disconnect_state] = "disconnect",
262	[sd_sleep_state] = "sleep",
263	[sd_io_state] = "i/o"
264	};
265	if (state == sd_inactive_state) {
266	return "inactive";
267	}
268	if (state == sd_waitirq_state) {
269	return "wait-irq";
270	}
271	assert(state < ARRAY_SIZE(state_name));
272	return state_name[state];
273	}
274
275	static const char *sd_response_name(sd_rsp_type_t rsp)
276	{
277	static const char *response_name[] = {
278	[sd_r0] = "RESP#0 (no response)",
279	[sd_r1] = "RESP#1 (normal cmd)",
280	[spi_r2] = "RESP#2 (STATUS reg)",
281	[sd_r2_i] = "RESP#2 (CID reg)",
282	[sd_r2_s] = "RESP#2 (CSD reg)",
283	[sd_r3] = "RESP#3 (OCR reg)",
284	[sd_r6] = "RESP#6 (RCA)",
285	[sd_r7] = "RESP#7 (operating voltage)",
286	};
287	if (rsp == sd_illegal) {
288	return "ILLEGAL RESP";
289	}
290	if (rsp == sd_r1b) {
291	rsp = sd_r1;
292	}
293	assert(rsp < ARRAY_SIZE(response_name));
294	return response_name[rsp];
295	}
296
297	static const char sd_cmd_name(SDState sd, uint8_t cmd)
298	{
299	static const char *cmd_abbrev[SDMMC_CMD_MAX] = {
300	[18] = "READ_MULTIPLE_BLOCK",
301	[25] = "WRITE_MULTIPLE_BLOCK",
302	};
303	const SDProto *sdp = sd->proto;
304
305	if (sdp->cmd[cmd].handler) {
306	assert(!cmd_abbrev[cmd]);
307	return sdp->cmd[cmd].name;
308	}
309	return cmd_abbrev[cmd] ? cmd_abbrev[cmd] : "UNKNOWN_CMD";
310	}
311
312	static const char sd_acmd_name(SDState sd, uint8_t cmd)
313	{
314	const SDProto *sdp = sd->proto;
315
316	if (sdp->acmd[cmd].handler) {
317	return sdp->acmd[cmd].name;
318	}
319
320	return "UNKNOWN_ACMD";
321	}
322
323	static uint8_t sd_get_dat_lines(SDState *sd)
324	{
325	return sd->dat_lines;
326	}
327
328	static bool sd_get_cmd_line(SDState *sd)
329	{
330	return sd->cmd_line;
331	}
332
333	static void sd_set_voltage(SDState *sd, uint16_t millivolts)
334	{
335	trace_sdcard_set_voltage(millivolts);
336
337	switch (millivolts) {
338	case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
339	case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
340	break;
341	default:
342	qemu_log_mask(LOG_GUEST_ERROR, "SD card voltage not supported: %.3fV",
343	millivolts / 1000.f);
344	}
345	}
346
347	static enum SDCardModes sd_mode(SDState *sd)
348	{
349	switch (sd->state) {
350	case sd_inactive_state:
351	return sd_inactive;
352	case sd_idle_state:
353	case sd_ready_state:
354	case sd_identification_state:
355	return sd_card_identification_mode;
356	case sd_standby_state:
357	case sd_transfer_state:
358	case sd_sendingdata_state:
359	case sd_receivingdata_state:
360	case sd_programming_state:
361	case sd_disconnect_state:
362	return sd_data_transfer_mode;
363	default:
364	g_assert_not_reached();
365	}
366	}
367
368	static uint8_t sd_crc7(const void *message, size_t width)
369	{
370	int i, bit;
371	uint8_t shift_reg = 0x00;
372	const uint8_t msg = (const uint8_t )message;
373
374	for (i = 0; i < width; i ++, msg ++)
375	for (bit = 7; bit >= 0; bit --) {
376	shift_reg <<= 1;
377	if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
378	shift_reg ^= 0x89;
379	}
380
381	return shift_reg;
382	}
383
384	/* Operation Conditions register */
385
386	#define OCR_POWER_DELAY_NS 500000 /* 0.5ms */
387
388	FIELD(OCR, VDD_VOLTAGE_WINDOW, 0, 24)
389	FIELD(OCR, VDD_VOLTAGE_WIN_LO, 0, 8)
390	FIELD(OCR, DUAL_VOLTAGE_CARD, 7, 1)
391	FIELD(OCR, VDD_VOLTAGE_WIN_HI, 8, 16)
392	FIELD(OCR, ACCEPT_SWITCH_1V8, 24, 1) /* Only UHS-I */
393	FIELD(OCR, UHS_II_CARD, 29, 1) /* Only UHS-II */
394	FIELD(OCR, CARD_CAPACITY, 30, 1) /* 0:SDSC, 1:SDHC/SDXC */
395	FIELD(OCR, CARD_POWER_UP, 31, 1)
396
397	#define ACMD41_ENQUIRY_MASK 0x00ffffff
398	#define ACMD41_R3_MASK (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
399	\| R_OCR_ACCEPT_SWITCH_1V8_MASK \
400	\| R_OCR_UHS_II_CARD_MASK \
401	\| R_OCR_CARD_CAPACITY_MASK \
402	\| R_OCR_CARD_POWER_UP_MASK)
403
404	static void sd_ocr_powerup(void *opaque)
405	{
406	SDState *sd = opaque;
407
408	trace_sdcard_powerup();
409	assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
410
411	/* card power-up OK */
412	sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
413
414	if (sd->size > SDSC_MAX_CAPACITY) {
415	sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
416	}
417	}
418
419	static void sd_set_ocr(SDState *sd)
420	{
421	/* All voltages OK */
422	sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
423
424	if (sd_is_spi(sd)) {
425	/*
426	* We don't need to emulate power up sequence in SPI-mode.
427	* Thus, the card's power up status bit should be set to 1 when reset.
428	* The card's capacity status bit should also be set if SD card size
429	* is larger than 2GB for SDHC support.
430	*/
431	sd_ocr_powerup(sd);
432	}
433	}
434
435	/* SD Configuration register */
436
437	static void sd_set_scr(SDState *sd)
438	{
439	sd->scr[0] = 0 << 4; /* SCR structure version 1.0 */
440	sd->scr[0] \|= 2; /* Spec Version 2.00 or Version 3.0X */
441	sd->scr[1] = (2 << 4) /* SDSC Card (Security Version 1.01) */
442	\| 0b0101; /* 1-bit or 4-bit width bus modes */
443	sd->scr[2] = 0x00; /* Extended Security is not supported. */
444	if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
445	sd->scr[2] \|= 1 << 7; /* Spec Version 3.0X */
446	}
447	sd->scr[3] = 0x00;
448	/* reserved for manufacturer usage */
449	sd->scr[4] = 0x00;
450	sd->scr[5] = 0x00;
451	sd->scr[6] = 0x00;
452	sd->scr[7] = 0x00;
453	}
454
455	/* Card IDentification register */
456
457	#define MID 0xaa
458	#define OID "XY"
459	#define PNM "QEMU!"
460	#define PRV 0x01
461	#define MDT_YR 2006
462	#define MDT_MON 2
463
464	static void sd_set_cid(SDState *sd)
465	{
466	sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
467	sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
468	sd->cid[2] = OID[1];
469	sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
470	sd->cid[4] = PNM[1];
471	sd->cid[5] = PNM[2];
472	sd->cid[6] = PNM[3];
473	sd->cid[7] = PNM[4];
474	sd->cid[8] = PRV; /* Fake product revision (PRV) */
475	stl_be_p(&sd->cid[9], 0xdeadbeef); /* Fake serial number (PSN) */
476	sd->cid[13] = 0x00 \| /* Manufacture date (MDT) */
477	((MDT_YR - 2000) / 10);
478	sd->cid[14] = ((MDT_YR % 10) << 4) \| MDT_MON;
479	sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) \| 1;
480	}
481
482	static void emmc_set_cid(SDState *sd)
483	{
484	sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
485	sd->cid[1] = 0b01; /* CBX: soldered BGA */
486	sd->cid[2] = OID[0]; /* OEM/Application ID (OID) */
487	sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
488	sd->cid[4] = PNM[1];
489	sd->cid[5] = PNM[2];
490	sd->cid[6] = PNM[3];
491	sd->cid[7] = PNM[4];
492	sd->cid[8] = PNM[4];
493	sd->cid[9] = PRV; /* Fake product revision (PRV) */
494	stl_be_p(&sd->cid[10], 0xdeadbeef); /* Fake serial number (PSN) */
495	sd->cid[14] = (MDT_MON << 4) \| (MDT_YR - 1997); /* Manufacture date (MDT) */
496	sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) \| 1;
497	}
498
499	/* Card-Specific Data register */
500
501	#define HWBLOCK_SHIFT 9 /* 512 bytes */
502	#define SECTOR_SHIFT 5 /* 16 kilobytes */
503	#define WPGROUP_SHIFT 7 /* 2 megs */
504	#define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
505	#define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
506
507	static const uint8_t sd_csd_rw_mask[16] = {
508	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
509	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
510	};
511
512	static void emmc_set_ext_csd(SDState *sd, uint64_t size)
513	{
514	uint32_t sectcount = size >> HWBLOCK_SHIFT;
515
516	memset(sd->ext_csd, 0, sizeof(sd->ext_csd)); /* FIXME only RW at reset */
517
518	/* Properties segment (RO) */
519	sd->ext_csd[EXT_CSD_S_CMD_SET] = 0b1; /* supported command sets */
520	sd->ext_csd[EXT_CSD_BOOT_INFO] = 0x0; /* Boot information */
521	/* Boot partition size. 128KB unit */
522	sd->ext_csd[EXT_CSD_BOOT_MULT] = sd->boot_part_size / (128 * KiB);
523	sd->ext_csd[EXT_CSD_ACC_SIZE] = 0x1; /* Access size */
524	sd->ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE] = 0x01; /* HC Erase unit size */
525	sd->ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT] = 0x01; /* HC erase timeout */
526	sd->ext_csd[EXT_CSD_REL_WR_SEC_C] = 0x1; /* Reliable write sector count */
527	sd->ext_csd[EXT_CSD_HC_WP_GRP_SIZE] = 0x01; /* HC write protect group size */
528	sd->ext_csd[EXT_CSD_S_C_VCC] = 0x01; /* Sleep current VCC */
529	sd->ext_csd[EXT_CSD_S_C_VCCQ] = 0x01; /* Sleep current VCCQ */
530	sd->ext_csd[EXT_CSD_S_A_TIMEOUT] = 0x01; /* Sleep/Awake timeout */
531	stl_le_p(&sd->ext_csd[EXT_CSD_SEC_CNT], sectcount); /* Sector count */
532	sd->ext_csd[210] = 0x46; /* Min write perf for 8bit@52Mhz */
533	sd->ext_csd[209] = 0x46; /* Min read perf for 8bit@52Mhz */
534	sd->ext_csd[208] = 0x46; /* Min write perf for 4bit@52Mhz */
535	sd->ext_csd[207] = 0x46; /* Min read perf for 4bit@52Mhz */
536	sd->ext_csd[206] = 0x46; /* Min write perf for 4bit@26Mhz */
537	sd->ext_csd[205] = 0x46; /* Min read perf for 4bit@26Mhz */
538	sd->ext_csd[EXT_CSD_CARD_TYPE] = 0b11;
539	sd->ext_csd[EXT_CSD_STRUCTURE] = 2;
540	sd->ext_csd[EXT_CSD_REV] = 5;
541	sd->ext_csd[EXT_CSD_RPMB_MULT] = sd->rpmb_part_size / (128 * KiB);
542	sd->ext_csd[EXT_CSD_PARTITION_SUPPORT] = 0b111;
543
544	/* Mode segment (RW) */
545	sd->ext_csd[EXT_CSD_PART_CONFIG] = sd->boot_config;
546	}
547
548	static void emmc_set_csd(SDState *sd, uint64_t size)
549	{
550	int hwblock_shift = HWBLOCK_SHIFT;
551	uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
552	uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
553
554	sd->csd[0] = (3 << 6) \| (4 << 2); /* Spec v4.3 with EXT_CSD */
555	sd->csd[1] = (1 << 3) \| 6; /* Asynchronous data access time: 1ms */
556	sd->csd[2] = 0x00;
557	sd->csd[3] = (1 << 3) \| 3;; /* Maximum bus clock frequency: 100MHz */
558	sd->csd[4] = 0x0f;
559	if (size <= 2 * GiB) {
560	/* use 1k blocks */
561	uint32_t csize1k = (size >> (CMULT_SHIFT + 10)) - 1;
562	sd->csd[5] = 0x5a;
563	sd->csd[6] = 0x80 \| ((csize1k >> 10) & 0xf);
564	sd->csd[7] = (csize1k >> 2) & 0xff;
565	} else { /* >= 2GB : size stored in ext CSD, block addressing */
566	sd->csd[5] = 0x59;
567	sd->csd[6] = 0x8f;
568	sd->csd[7] = 0xff;
569	sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
570	}
571	sd->csd[8] = 0xff;
572	sd->csd[9] = 0xfc \| /* Max. write current */
573	((CMULT_SHIFT - 2) >> 1);
574	sd->csd[10] = 0x40 \| /* Erase sector size */
575	(((CMULT_SHIFT - 2) << 7) & 0x80) \| (sectsize >> 1);
576	sd->csd[11] = 0x00 \| /* Write protect group size */
577	((sectsize << 7) & 0x80) \| wpsize;
578	sd->csd[12] = 0x90 \| /* Write speed factor */
579	(hwblock_shift >> 2);
580	sd->csd[13] = 0x20 \| /* Max. write data block length */
581	((hwblock_shift << 6) & 0xc0);
582	sd->csd[14] = 0x00;
583	sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) \| 1;
584	emmc_set_ext_csd(sd, size);
585	}
586
587	static void sd_set_csd(SDState *sd, uint64_t size)
588	{
589	int hwblock_shift = HWBLOCK_SHIFT;
590	uint32_t csize;
591	uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
592	uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
593
594	/* To indicate 2 GiB card, BLOCK_LEN shall be 1024 bytes */
595	if (size == SDSC_MAX_CAPACITY) {
596	hwblock_shift += 1;
597	}
598	csize = (size >> (CMULT_SHIFT + hwblock_shift)) - 1;
599
600	if (size <= SDSC_MAX_CAPACITY) { /* Standard Capacity SD */
601	sd->csd[0] = 0x00; /* CSD structure */
602	sd->csd[1] = 0x26; /* Data read access-time-1 */
603	sd->csd[2] = 0x00; /* Data read access-time-2 */
604	sd->csd[3] = 0x32; /* Max. data transfer rate: 25 MHz */
605	sd->csd[4] = 0x5f; /* Card Command Classes */
606	sd->csd[5] = 0x50 \| /* Max. read data block length */
607	hwblock_shift;
608	sd->csd[6] = 0xe0 \| /* Partial block for read allowed */
609	((csize >> 10) & 0x03);
610	sd->csd[7] = 0x00 \| /* Device size */
611	((csize >> 2) & 0xff);
612	sd->csd[8] = 0x3f \| /* Max. read current */
613	((csize << 6) & 0xc0);
614	sd->csd[9] = 0xfc \| /* Max. write current */
615	((CMULT_SHIFT - 2) >> 1);
616	sd->csd[10] = 0x40 \| /* Erase sector size */
617	(((CMULT_SHIFT - 2) << 7) & 0x80) \| (sectsize >> 1);
618	sd->csd[11] = 0x00 \| /* Write protect group size */
619	((sectsize << 7) & 0x80) \| wpsize;
620	sd->csd[12] = 0x90 \| /* Write speed factor */
621	(hwblock_shift >> 2);
622	sd->csd[13] = 0x20 \| /* Max. write data block length */
623	((hwblock_shift << 6) & 0xc0);
624	sd->csd[14] = 0x00; /* File format group */
625	} else { /* SDHC */
626	size /= 512 * KiB;
627	size -= 1;
628	sd->csd[0] = 0x40;
629	sd->csd[1] = 0x0e;
630	sd->csd[2] = 0x00;
631	sd->csd[3] = 0x32;
632	sd->csd[4] = 0x5b;
633	sd->csd[5] = 0x59;
634	sd->csd[6] = 0x00;
635	st24_be_p(&sd->csd[7], size);
636	sd->csd[10] = 0x7f;
637	sd->csd[11] = 0x80;
638	sd->csd[12] = 0x0a;
639	sd->csd[13] = 0x40;
640	sd->csd[14] = 0x00;
641	}
642	sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) \| 1;
643	}
644
645	/* Relative Card Address register */
646
647	static void sd_set_rca(SDState *sd, uint16_t value)
648	{
649	trace_sdcard_set_rca(value);
650	sd->rca = value;
651	}
652
653	static uint16_t sd_req_get_rca(SDState *s, SDRequest req)
654	{
655	switch (s->proto->cmd[req.cmd].type) {
656	case sd_ac:
657	case sd_adtc:
658	return req.arg >> 16;
659	case sd_spi:
660	default:
661	g_assert_not_reached();
662	}
663	}
664
665	static bool sd_req_rca_same(SDState *s, SDRequest req)
666	{
667	return sd_req_get_rca(s, req) == s->rca;
668	}
669
670	/* Card Status register */
671
672	FIELD(CSR, AKE_SEQ_ERROR, 3, 1)
673	FIELD(CSR, APP_CMD, 5, 1)
674	FIELD(CSR, FX_EVENT, 6, 1)
675	FIELD(CSR, SWITCH_ERROR, 7, 1)
676	FIELD(CSR, READY_FOR_DATA, 8, 1)
677	FIELD(CSR, CURRENT_STATE, 9, 4)
678	FIELD(CSR, ERASE_RESET, 13, 1)
679	FIELD(CSR, CARD_ECC_DISABLED, 14, 1)
680	FIELD(CSR, WP_ERASE_SKIP, 15, 1)
681	FIELD(CSR, CSD_OVERWRITE, 16, 1)
682	FIELD(CSR, DEFERRED_RESPONSE, 17, 1)
683	FIELD(CSR, ERROR, 19, 1)
684	FIELD(CSR, CC_ERROR, 20, 1)
685	FIELD(CSR, CARD_ECC_FAILED, 21, 1)
686	FIELD(CSR, ILLEGAL_COMMAND, 22, 1)
687	FIELD(CSR, COM_CRC_ERROR, 23, 1)
688	FIELD(CSR, LOCK_UNLOCK_FAILED, 24, 1)
689	FIELD(CSR, CARD_IS_LOCKED, 25, 1)
690	FIELD(CSR, WP_VIOLATION, 26, 1)
691	FIELD(CSR, ERASE_PARAM, 27, 1)
692	FIELD(CSR, ERASE_SEQ_ERROR, 28, 1)
693	FIELD(CSR, BLOCK_LEN_ERROR, 29, 1)
694	FIELD(CSR, ADDRESS_ERROR, 30, 1)
695	FIELD(CSR, OUT_OF_RANGE, 31, 1)
696
697	/* Card status bits, split by clear condition:
698	* A : According to the card current state
699	* B : Always related to the previous command
700	* C : Cleared by read
701	*/
702	#define CARD_STATUS_A (R_CSR_READY_FOR_DATA_MASK \
703	\| R_CSR_CARD_ECC_DISABLED_MASK \
704	\| R_CSR_CARD_IS_LOCKED_MASK)
705	#define CARD_STATUS_B (R_CSR_CURRENT_STATE_MASK \
706	\| R_CSR_ILLEGAL_COMMAND_MASK \
707	\| R_CSR_COM_CRC_ERROR_MASK)
708	#define CARD_STATUS_C (R_CSR_AKE_SEQ_ERROR_MASK \
709	\| R_CSR_APP_CMD_MASK \
710	\| R_CSR_ERASE_RESET_MASK \
711	\| R_CSR_WP_ERASE_SKIP_MASK \
712	\| R_CSR_CSD_OVERWRITE_MASK \
713	\| R_CSR_ERROR_MASK \
714	\| R_CSR_CC_ERROR_MASK \
715	\| R_CSR_CARD_ECC_FAILED_MASK \
716	\| R_CSR_LOCK_UNLOCK_FAILED_MASK \
717	\| R_CSR_WP_VIOLATION_MASK \
718	\| R_CSR_ERASE_PARAM_MASK \
719	\| R_CSR_ERASE_SEQ_ERROR_MASK \
720	\| R_CSR_BLOCK_LEN_ERROR_MASK \
721	\| R_CSR_ADDRESS_ERROR_MASK \
722	\| R_CSR_OUT_OF_RANGE_MASK)
723
724	static void sd_set_cardstatus(SDState *sd)
725	{
726	sd->card_status = READY_FOR_DATA;
727	}
728
729	static void sd_set_sdstatus(SDState *sd)
730	{
731	memset(sd->sd_status, 0, 64);
732	}
733
734	static const uint8_t sd_tuning_block_pattern4[64] = {
735	/*
736	* See: Physical Layer Simplified Specification Version 3.01,
737	* Table 4-2.
738	*/
739	0xff, 0x0f, 0xff, 0x00, 0x0f, 0xfc, 0xc3, 0xcc,
740	0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef,
741	0xff, 0xdf, 0xff, 0xdd, 0xff, 0xfb, 0xff, 0xfb,
742	0xbf, 0xff, 0x7f, 0xff, 0x77, 0xf7, 0xbd, 0xef,
743	0xff, 0xf0, 0xff, 0xf0, 0x0f, 0xfc, 0xcc, 0x3c,
744	0xcc, 0x33, 0xcc, 0xcf, 0xff, 0xef, 0xff, 0xee,
745	0xff, 0xfd, 0xff, 0xfd, 0xdf, 0xff, 0xbf, 0xff,
746	0xbb, 0xff, 0xf7, 0xff, 0xf7, 0x7f, 0x7b, 0xde
747	};
748
749	static int sd_req_crc_validate(SDRequest *req)
750	{
751	uint8_t buffer[5];
752	buffer[0] = 0x40 \| req->cmd;
753	stl_be_p(&buffer[1], req->arg);
754	return 0;
755	return sd_crc7(buffer, 5) != req->crc; /* TODO */
756	}
757
758	static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
759	{
760	switch (rtype) {
761	case sd_r1:
762	case sd_r1b:
763	return sd_is_spi(sd) ? 1 : 4;
764
765	case spi_r2:
766	assert(sd_is_spi(sd));
767	return 2;
768
769	case sd_r2_i:
770	case sd_r2_s:
771	assert(!sd_is_spi(sd));
772	return 16;
773
774	case sd_r3:
775	case sd_r7:
776	return sd_is_spi(sd) ? 5 : 4;
777
778	case sd_r6:
779	assert(!sd_is_spi(sd));
780	return 4;
781
782	case sd_r0:
783	case sd_illegal:
784	return sd_is_spi(sd) ? 1 : 0;
785
786	default:
787	g_assert_not_reached();
788	}
789	}
790
791	static void sd_response_r1_make(SDState sd, uint8_t response)
792	{
793	if (sd_is_spi(sd)) {
794	response[0] = sd->state == sd_idle_state;
795	response[0] \|= FIELD_EX32(sd->card_status, CSR, ERASE_RESET) << 1;
796	response[0] \|= FIELD_EX32(sd->card_status, CSR, ILLEGAL_COMMAND) << 2;
797	response[0] \|= FIELD_EX32(sd->card_status, CSR, COM_CRC_ERROR) << 3;
798	response[0] \|= FIELD_EX32(sd->card_status, CSR, ERASE_SEQ_ERROR) << 4;
799	response[0] \|= FIELD_EX32(sd->card_status, CSR, ADDRESS_ERROR) << 5;
800	response[0] \|= FIELD_EX32(sd->card_status, CSR, BLOCK_LEN_ERROR) << 6;
801	response[0] \|= 0 << 7;
802	} else {
803	stl_be_p(response, sd->card_status);
804	}
805
806	/* Clear the "clear on read" status bits */
807	sd->card_status &= ~CARD_STATUS_C;
808	}
809
810	static void spi_response_r2_make(SDState sd, uint8_t resp)
811	{
812	/* Prepend R1 */
813	sd_response_r1_make(sd, resp);
814
815	resp[1] = FIELD_EX32(sd->card_status, CSR, CARD_IS_LOCKED) << 0;
816	resp[1] \|= (FIELD_EX32(sd->card_status, CSR, LOCK_UNLOCK_FAILED)
817	\|\| FIELD_EX32(sd->card_status, CSR, WP_ERASE_SKIP)) << 1;
818	resp[1] \|= FIELD_EX32(sd->card_status, CSR, ERROR) << 2;
819	resp[1] \|= FIELD_EX32(sd->card_status, CSR, CC_ERROR) << 3;
820	resp[1] \|= FIELD_EX32(sd->card_status, CSR, CARD_ECC_FAILED) << 4;
821	resp[1] \|= FIELD_EX32(sd->card_status, CSR, WP_VIOLATION) << 5;
822	resp[1] \|= FIELD_EX32(sd->card_status, CSR, ERASE_PARAM) << 6;
823	resp[1] \|= FIELD_EX32(sd->card_status, CSR, OUT_OF_RANGE) << 7;
824	}
825
826	static void sd_response_r3_make(SDState sd, uint8_t response)
827	{
828	if (sd_is_spi(sd)) {
829	/* Prepend R1 */
830	sd_response_r1_make(sd, response);
831	response++;
832	}
833	stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
834	}
835
836	static void sd_response_r6_make(SDState sd, uint8_t response)
837	{
838	uint16_t status;
839
840	status = ((sd->card_status >> 8) & 0xc000) \|
841	((sd->card_status >> 6) & 0x2000) \|
842	(sd->card_status & 0x1fff);
843	sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
844	stw_be_p(response + 0, sd->rca);
845	stw_be_p(response + 2, status);
846	}
847
848	static void sd_response_r7_make(SDState sd, uint8_t response)
849	{
850	if (sd_is_spi(sd)) {
851	/* Prepend R1 */
852	sd_response_r1_make(sd, response);
853	response++;
854	}
855	stl_be_p(response, sd->vhs);
856	}
857
858	static uint32_t sd_blk_len(SDState *sd)
859	{
860	if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
861	return 1 << HWBLOCK_SHIFT;
862	}
863	return sd->blk_len;
864	}
865
866	/*
867	* This requires a disk image that has two boot partitions inserted at the
868	* beginning of it, followed by an RPMB partition. The size of the boot
869	* partitions is the "boot-partition-size" property, the one of the RPMB
870	* partition is 'rpmb-partition-size'.
871	*/
872	static uint32_t sd_part_offset(SDState *sd)
873	{
874	unsigned partition_access;
875
876	if (!sd_is_emmc(sd)) {
877	return 0;
878	}
879
880	partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
881	& EXT_CSD_PART_CONFIG_ACC_MASK;
882	switch (partition_access) {
883	case EXT_CSD_PART_CONFIG_ACC_DEFAULT:
884	return sd->boot_part_size * 2 + sd->rpmb_part_size;
885	case EXT_CSD_PART_CONFIG_ACC_BOOT1:
886	return 0;
887	case EXT_CSD_PART_CONFIG_ACC_BOOT2:
888	return sd->boot_part_size * 1;
889	case EXT_CSD_PART_CONFIG_ACC_RPMB:
890	return sd->boot_part_size * 2;
891	default:
892	g_assert_not_reached();
893	}
894	}
895
896	static uint64_t sd_req_get_address(SDState *sd, SDRequest req)
897	{
898	uint64_t addr;
899
900	if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
901	addr = (uint64_t) req.arg << HWBLOCK_SHIFT;
902	} else {
903	addr = req.arg;
904	}
905	trace_sdcard_req_addr(req.arg, addr);
906	return addr;
907	}
908
909	static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
910	{
911	return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
912	}
913
914	static void sd_reset(DeviceState *dev)
915	{
916	SDState *sd = SDMMC_COMMON(dev);
917	SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
918	uint64_t size;
919	uint64_t sect;
920
921	trace_sdcard_reset();
922	if (sd->blk) {
923	blk_get_geometry(sd->blk, &sect);
924	} else {
925	sect = 0;
926	}
927	size = sect << HWBLOCK_SHIFT;
928	if (sd_is_emmc(sd)) {
929	size -= sd->boot_part_size * 2 + sd->rpmb_part_size;
930	}
931
932	sect = sd_addr_to_wpnum(size) + 1;
933
934	sd->state = sd_idle_state;
935
936	/* card registers */
937	sd->rca = sd_is_emmc(sd) ? 0x0001 : 0x0000;
938	sd->size = size;
939	sd_set_ocr(sd);
940	sd_set_scr(sd);
941	sc->set_cid(sd);
942	sc->set_csd(sd, size);
943	sd_set_cardstatus(sd);
944	sd_set_sdstatus(sd);
945
946	g_free(sd->wp_group_bmap);
947	sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false;
948	sd->wp_group_bits = sect;
949	sd->wp_group_bmap = bitmap_new(sd->wp_group_bits);
950	memset(sd->function_group, 0, sizeof(sd->function_group));
951	sd->erase_start = INVALID_ADDRESS;
952	sd->erase_end = INVALID_ADDRESS;
953	sd->blk_len = 0x200;
954	sd->pwd_len = 0;
955	sd->expecting_acmd = false;
956	sd->dat_lines = 0xf;
957	sd->cmd_line = true;
958	sd->multi_blk_cnt = 0;
959	}
960
961	static bool sd_get_inserted(SDState *sd)
962	{
963	return sd->blk && blk_is_inserted(sd->blk);
964	}
965
966	static bool sd_get_readonly(SDState *sd)
967	{
968	return sd->wp_switch;
969	}
970
971	static void sd_cardchange(void opaque, bool load, Error *errp)
972	{
973	SDState *sd = opaque;
974	DeviceState *dev = DEVICE(sd);
975	SDBus *sdbus;
976	bool inserted = sd_get_inserted(sd);
977	bool readonly = sd_get_readonly(sd);
978
979	if (inserted) {
980	trace_sdcard_inserted(readonly);
981	sd_reset(dev);
982	} else {
983	trace_sdcard_ejected();
984	}
985
986	sdbus = SD_BUS(qdev_get_parent_bus(dev));
987	sdbus_set_inserted(sdbus, inserted);
988	if (inserted) {
989	sdbus_set_readonly(sdbus, readonly);
990	}
991	}
992
993	static const BlockDevOps sd_block_ops = {
994	.change_media_cb = sd_cardchange,
995	};
996
997	static bool sd_ocr_vmstate_needed(void *opaque)
998	{
999	SDState *sd = opaque;
1000
1001	/* Include the OCR state (and timer) if it is not yet powered up */
1002	return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
1003	}
1004
1005	static const VMStateDescription sd_ocr_vmstate = {
1006	.name = "sd-card/ocr-state",
1007	.version_id = 1,
1008	.minimum_version_id = 1,
1009	.needed = sd_ocr_vmstate_needed,
1010	.fields = (const VMStateField[]) {
1011	VMSTATE_UINT32(ocr, SDState),
1012	VMSTATE_TIMER_PTR(ocr_power_timer, SDState),
1013	VMSTATE_END_OF_LIST()
1014	},
1015	};
1016
1017	static bool vmstate_needed_for_rpmb(void *opaque)
1018	{
1019	SDState *sd = opaque;
1020
1021	return sd->rpmb_part_size > 0;
1022	}
1023
1024	static const VMStateDescription emmc_rpmb_vmstate = {
1025	.name = "sd-card/ext_csd_modes-state",
1026	.version_id = 1,
1027	.minimum_version_id = 1,
1028	.needed = vmstate_needed_for_rpmb,
1029	.fields = (const VMStateField[]) {
1030	VMSTATE_UINT8_ARRAY(rpmb.result.key_mac, SDState, RPMB_KEY_MAC_LEN),
1031	VMSTATE_UINT8_ARRAY(rpmb.result.data, SDState, RPMB_DATA_LEN),
1032	VMSTATE_UINT8_ARRAY(rpmb.result.nonce, SDState, RPMB_NONCE_LEN),
1033	VMSTATE_UINT32(rpmb.result.write_counter, SDState),
1034	VMSTATE_UINT16(rpmb.result.address, SDState),
1035	VMSTATE_UINT16(rpmb.result.block_count, SDState),
1036	VMSTATE_UINT16(rpmb.result.result, SDState),
1037	VMSTATE_UINT16(rpmb.result.req_resp, SDState),
1038	VMSTATE_UINT32(rpmb.write_counter, SDState),
1039	VMSTATE_UINT8_ARRAY(rpmb.key, SDState, 32),
1040	VMSTATE_UINT8(rpmb.key_set, SDState),
1041	VMSTATE_END_OF_LIST()
1042	},
1043	};
1044
1045	static bool vmstate_needed_for_emmc(void *opaque)
1046	{
1047	SDState *sd = opaque;
1048
1049	return sd_is_emmc(sd);
1050	}
1051
1052	static const VMStateDescription emmc_extcsd_vmstate = {
1053	.name = "sd-card/ext_csd_modes-state",
1054	.version_id = 1,
1055	.minimum_version_id = 1,
1056	.needed = vmstate_needed_for_emmc,
1057	.fields = (const VMStateField[]) {
1058	VMSTATE_UINT8_ARRAY(ext_csd_rw, SDState, 192),
1059	VMSTATE_END_OF_LIST()
1060	},
1061	};
1062
1063	static int sd_vmstate_pre_load(void *opaque)
1064	{
1065	SDState *sd = opaque;
1066
1067	/* If the OCR state is not included (prior versions, or not
1068	* needed), then the OCR must be set as powered up. If the OCR state
1069	* is included, this will be replaced by the state restore.
1070	*/
1071	sd_ocr_powerup(sd);
1072
1073	return 0;
1074	}
1075
1076	static const VMStateDescription sd_vmstate = {
1077	.name = "sd-card",
1078	.version_id = 2,
1079	.minimum_version_id = 2,
1080	.pre_load = sd_vmstate_pre_load,
1081	.fields = (const VMStateField[]) {
1082	VMSTATE_UNUSED(4),
1083	VMSTATE_INT32(state, SDState),
1084	VMSTATE_UINT8_ARRAY(cid, SDState, 16),
1085	VMSTATE_UINT8_ARRAY(csd, SDState, 16),
1086	VMSTATE_UINT16(rca, SDState),
1087	VMSTATE_UINT32(card_status, SDState),
1088	VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1),
1089	VMSTATE_UINT32(vhs, SDState),
1090	VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits),
1091	VMSTATE_UINT32(blk_len, SDState),
1092	VMSTATE_UINT32(multi_blk_cnt, SDState),
1093	VMSTATE_UINT32(erase_start, SDState),
1094	VMSTATE_UINT32(erase_end, SDState),
1095	VMSTATE_UINT8_ARRAY(pwd, SDState, 16),
1096	VMSTATE_UINT32(pwd_len, SDState),
1097	VMSTATE_UINT8_ARRAY(function_group, SDState, 6),
1098	VMSTATE_UINT8(current_cmd, SDState),
1099	VMSTATE_BOOL(expecting_acmd, SDState),
1100	VMSTATE_UINT32(blk_written, SDState),
1101	VMSTATE_UINT64(data_start, SDState),
1102	VMSTATE_UINT32(data_offset, SDState),
1103	VMSTATE_UINT8_ARRAY(data, SDState, 512),
1104	VMSTATE_UNUSED_V(1, 512),
1105	VMSTATE_UNUSED(1),
1106	VMSTATE_END_OF_LIST()
1107	},
1108	.subsections = (const VMStateDescription * const []) {
1109	&sd_ocr_vmstate,
1110	&emmc_extcsd_vmstate,
1111	&emmc_rpmb_vmstate,
1112	NULL
1113	},
1114	};
1115
1116	static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1117	{
1118	trace_sdcard_read_block(addr, len);
1119	addr += sd_part_offset(sd);
1120	if (!sd->blk \|\| blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {
1121	fprintf(stderr, "sd_blk_read: read error on host side\n");
1122	}
1123	}
1124
1125	static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1126	{
1127	trace_sdcard_write_block(addr, len);
1128	addr += sd_part_offset(sd);
1129	if (!sd->blk \|\| blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {
1130	fprintf(stderr, "sd_blk_write: write error on host side\n");
1131	}
1132	}
1133
1134	static bool rpmb_calc_hmac(SDState sd, const RPMBDataFrame frame,
1135	unsigned int num_blocks, uint8_t *mac)
1136	{
1137	g_autoptr(QCryptoHmac) hmac = NULL;
1138	size_t mac_len = RPMB_KEY_MAC_LEN;
1139	bool success = true;
1140	Error *err = NULL;
1141	uint64_t offset;
1142
1143	hmac = qcrypto_hmac_new(QCRYPTO_HASH_ALGO_SHA256, sd->rpmb.key,
1144	RPMB_KEY_MAC_LEN, &err);
1145	if (!hmac) {
1146	error_report_err(err);
1147	return false;
1148	}
1149
1150	/*
1151	* This implies a read request because we only support single-block write
1152	* requests so far.
1153	*/
1154	if (num_blocks > 1) {
1155	/*
1156	* Unfortunately, the underlying crypto libraries do not allow us to
1157	* migrate an active QCryptoHmac state. Therefore, we have to calculate
1158	* the HMAC in one run. To avoid buffering a complete read sequence in
1159	* SDState, reconstruct all frames except for the last one.
1160	*/
1161	void *buf = sd->data;
1162
1163	assert(RPMB_HASH_LEN <= sizeof(sd->data));
1164
1165	/*
1166	* We will hash everything from data field to the end of RPMBDataFrame.
1167	*/
1168	memcpy((uint8_t *)buf + RPMB_DATA_LEN,
1169	(uint8_t *)frame + offsetof(RPMBDataFrame, nonce),
1170	RPMB_HASH_LEN - RPMB_DATA_LEN);
1171
1172	offset = lduw_be_p(&frame->address) * RPMB_DATA_LEN + sd_part_offset(sd);
1173	do {
1174	if (blk_pread(sd->blk, offset, RPMB_DATA_LEN, buf, 0) < 0) {
1175	error_report("sd_blk_read: read error on host side");
1176	success = false;
1177	break;
1178	}
1179	if (qcrypto_hmac_bytes(hmac, buf, RPMB_HASH_LEN, NULL, NULL,
1180	&err) < 0) {
1181	error_report_err(err);
1182	success = false;
1183	break;
1184	}
1185	offset += RPMB_DATA_LEN;
1186	} while (--num_blocks > 1);
1187	}
1188
1189	if (success &&
1190	qcrypto_hmac_bytes(hmac, frame->data, RPMB_HASH_LEN, &mac,
1191	&mac_len, &err) < 0) {
1192	error_report_err(err);
1193	success = false;
1194	}
1195	assert(!success \|\| mac_len == RPMB_KEY_MAC_LEN);
1196
1197	return success;
1198	}
1199
1200	static void emmc_rpmb_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1201	{
1202	uint16_t resp = lduw_be_p(&sd->rpmb.result.req_resp);
1203	uint16_t result = lduw_be_p(&sd->rpmb.result.result);
1204	unsigned int curr_block = 0;
1205
1206	if ((result & ~RPMB_RESULT_COUTER_EXPIRED) == RPMB_RESULT_OK &&
1207	resp == RPMB_RESP(RPMB_REQ_AUTH_DATA_READ)) {
1208	curr_block = lduw_be_p(&sd->rpmb.result.address);
1209	if (sd->rpmb.result.block_count == 0) {
1210	stw_be_p(&sd->rpmb.result.block_count, sd->multi_blk_cnt);
1211	} else {
1212	curr_block += lduw_be_p(&sd->rpmb.result.block_count);
1213	curr_block -= sd->multi_blk_cnt;
1214	}
1215	addr = curr_block * RPMB_DATA_LEN + sd_part_offset(sd);
1216	if (blk_pread(sd->blk, addr, RPMB_DATA_LEN,
1217	sd->rpmb.result.data, 0) < 0) {
1218	error_report("sd_blk_read: read error on host side");
1219	memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
1220	stw_be_p(&sd->rpmb.result.result,
1221	RPMB_RESULT_READ_FAILURE
1222	\| (result & RPMB_RESULT_COUTER_EXPIRED));
1223	}
1224	if (sd->multi_blk_cnt == 1 &&
1225	!rpmb_calc_hmac(sd, &sd->rpmb.result,
1226	lduw_be_p(&sd->rpmb.result.block_count),
1227	sd->rpmb.result.key_mac)) {
1228	memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
1229	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
1230	}
1231	} else if (!rpmb_calc_hmac(sd, &sd->rpmb.result, 1,
1232	sd->rpmb.result.key_mac)) {
1233	memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
1234	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
1235	}
1236	memcpy(sd->data, &sd->rpmb.result, sizeof(sd->rpmb.result));
1237
1238	trace_sdcard_rpmb_read_block(resp, curr_block,
1239	lduw_be_p(&sd->rpmb.result.result));
1240	}
1241
1242	static void emmc_rpmb_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1243	{
1244	RPMBDataFrame frame = (RPMBDataFrame )sd->data;
1245	uint16_t req = lduw_be_p(&frame->req_resp);
1246	uint8_t mac[RPMB_KEY_MAC_LEN];
1247
1248	if (req == RPMB_REQ_READ_RESULT) {
1249	/* just return the current result register */
1250	goto exit;
1251	}
1252	memset(&sd->rpmb.result, 0, sizeof(sd->rpmb.result));
1253	memcpy(sd->rpmb.result.nonce, frame->nonce, sizeof(sd->rpmb.result.nonce));
1254	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_OK);
1255	stw_be_p(&sd->rpmb.result.req_resp, RPMB_RESP(req));
1256
1257	if (!sd->rpmb.key_set && req != RPMB_REQ_PROGRAM_AUTH_KEY) {
1258	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_NO_AUTH_KEY);
1259	goto exit;
1260	}
1261
1262	switch (req) {
1263	case RPMB_REQ_PROGRAM_AUTH_KEY:
1264	if (sd->rpmb.key_set) {
1265	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
1266	break;
1267	}
1268	memcpy(sd->rpmb.key, frame->key_mac, sizeof(sd->rpmb.key));
1269	sd->rpmb.key_set = 1;
1270	break;
1271	case RPMB_REQ_READ_WRITE_COUNTER:
1272	stl_be_p(&sd->rpmb.result.write_counter, sd->rpmb.write_counter);
1273	break;
1274	case RPMB_REQ_AUTH_DATA_WRITE:
1275	/* We only support single-block writes so far */
1276	if (sd->multi_blk_cnt != 1) {
1277	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_GENERAL_FAILURE);
1278	break;
1279	}
1280	if (sd->rpmb.write_counter == 0xffffffff) {
1281	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
1282	break;
1283	}
1284	if (!rpmb_calc_hmac(sd, frame, 1, mac) \|\|
1285	memcmp(frame->key_mac, mac, RPMB_KEY_MAC_LEN) != 0) {
1286	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
1287	break;
1288	}
1289	if (ldl_be_p(&frame->write_counter) != sd->rpmb.write_counter) {
1290	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_COUNTER_FAILURE);
1291	break;
1292	}
1293	sd->rpmb.result.address = frame->address;
1294	addr = lduw_be_p(&frame->address) * RPMB_DATA_LEN + sd_part_offset(sd);
1295	if (blk_pwrite(sd->blk, addr, RPMB_DATA_LEN, frame->data, 0) < 0) {
1296	error_report("sd_blk_write: write error on host side");
1297	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
1298	} else {
1299	sd->rpmb.write_counter++;
1300	}
1301	stl_be_p(&sd->rpmb.result.write_counter, sd->rpmb.write_counter);
1302	break;
1303	case RPMB_REQ_AUTH_DATA_READ:
1304	sd->rpmb.result.address = frame->address;
1305	break;
1306	default:
1307	qemu_log_mask(LOG_UNIMP, "RPMB request %d not implemented\n", req);
1308	stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_GENERAL_FAILURE);
1309	break;
1310	}
1311	exit:
1312	if (sd->rpmb.write_counter == 0xffffffff) {
1313	stw_be_p(&sd->rpmb.result.result,
1314	lduw_be_p(&sd->rpmb.result.result) \| RPMB_RESULT_COUTER_EXPIRED);
1315	}
1316	trace_sdcard_rpmb_write_block(req, lduw_be_p(&sd->rpmb.result.result));
1317	}
1318
1319	static void sd_erase(SDState *sd)
1320	{
1321	uint64_t erase_start = sd->erase_start;
1322	uint64_t erase_end = sd->erase_end;
1323	bool sdsc = true;
1324	uint64_t wpnum;
1325	uint64_t erase_addr;
1326	int erase_len = 1 << HWBLOCK_SHIFT;
1327
1328	trace_sdcard_erase(sd->erase_start, sd->erase_end);
1329	if (sd->erase_start == INVALID_ADDRESS
1330	\|\| sd->erase_end == INVALID_ADDRESS) {
1331	sd->card_status \|= ERASE_SEQ_ERROR;
1332	sd->erase_start = INVALID_ADDRESS;
1333	sd->erase_end = INVALID_ADDRESS;
1334	return;
1335	}
1336
1337	if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
1338	/* High capacity memory card: erase units are 512 byte blocks */
1339	erase_start <<= HWBLOCK_SHIFT;
1340	erase_end <<= HWBLOCK_SHIFT;
1341	sdsc = false;
1342	}
1343
1344	if (erase_start > sd->size \|\| erase_end > sd->size) {
1345	sd->card_status \|= OUT_OF_RANGE;
1346	sd->erase_start = INVALID_ADDRESS;
1347	sd->erase_end = INVALID_ADDRESS;
1348	return;
1349	}
1350
1351	sd->erase_start = INVALID_ADDRESS;
1352	sd->erase_end = INVALID_ADDRESS;
1353	sd->csd[14] \|= 0x40;
1354
1355	memset(sd->data, 0xff, erase_len);
1356	for (erase_addr = erase_start; erase_addr <= erase_end;
1357	erase_addr += erase_len) {
1358	if (sdsc) {
1359	/* Only SDSC cards support write protect groups */
1360	wpnum = sd_addr_to_wpnum(erase_addr);
1361	assert(wpnum < sd->wp_group_bits);
1362	if (test_bit(wpnum, sd->wp_group_bmap)) {
1363	sd->card_status \|= WP_ERASE_SKIP;
1364	continue;
1365	}
1366	}
1367	sd_blk_write(sd, erase_addr, erase_len);
1368	}
1369	}
1370
1371	static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
1372	{
1373	uint32_t i, wpnum;
1374	uint32_t ret = 0;
1375
1376	wpnum = sd_addr_to_wpnum(addr);
1377
1378	for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) {
1379	if (addr >= sd->size) {
1380	/*
1381	* If the addresses of the last groups are outside the valid range,
1382	* then the corresponding write protection bits shall be set to 0.
1383	*/
1384	continue;
1385	}
1386	assert(wpnum < sd->wp_group_bits);
1387	if (test_bit(wpnum, sd->wp_group_bmap)) {
1388	ret \|= (1 << i);
1389	}
1390	}
1391
1392	return ret;
1393	}
1394
1395	enum ExtCsdAccessMode {
1396	EXT_CSD_ACCESS_MODE_COMMAND_SET = 0,
1397	EXT_CSD_ACCESS_MODE_SET_BITS = 1,
1398	EXT_CSD_ACCESS_MODE_CLEAR_BITS = 2,
1399	EXT_CSD_ACCESS_MODE_WRITE_BYTE = 3
1400	};
1401
1402	static void emmc_function_switch(SDState *sd, uint32_t arg)
1403	{
1404	uint8_t access = extract32(arg, 24, 2);
1405	uint8_t index = extract32(arg, 16, 8);
1406	uint8_t value = extract32(arg, 8, 8);
1407	uint8_t b = sd->ext_csd[index];
1408
1409	trace_sdcard_switch(access, index, value, extract32(arg, 0, 2));
1410
1411	if (index >= 192) {
1412	qemu_log_mask(LOG_GUEST_ERROR, "MMC switching illegal offset\n");
1413	sd->card_status \|= R_CSR_SWITCH_ERROR_MASK;
1414	return;
1415	}
1416
1417	switch (access) {
1418	case EXT_CSD_ACCESS_MODE_COMMAND_SET:
1419	qemu_log_mask(LOG_UNIMP, "MMC Command set switching not supported\n");
1420	return;
1421	case EXT_CSD_ACCESS_MODE_SET_BITS:
1422	b \|= value;
1423	break;
1424	case EXT_CSD_ACCESS_MODE_CLEAR_BITS:
1425	b &= ~value;
1426	break;
1427	case EXT_CSD_ACCESS_MODE_WRITE_BYTE:
1428	b = value;
1429	break;
1430	}
1431
1432	if (index == EXT_CSD_PART_CONFIG) {
1433	uint8_t part = b & EXT_CSD_PART_CONFIG_ACC_MASK;
1434
1435	if (((part == EXT_CSD_PART_CONFIG_ACC_BOOT1 \|\|
1436	part == EXT_CSD_PART_CONFIG_ACC_BOOT2) && !sd->boot_part_size) \|\|
1437	(part == EXT_CSD_PART_CONFIG_ACC_RPMB && !sd->rpmb_part_size)) {
1438	qemu_log_mask(LOG_GUEST_ERROR,
1439	"MMC switching to illegal partition\n");
1440	sd->card_status \|= R_CSR_SWITCH_ERROR_MASK;
1441	return;
1442	}
1443	}
1444
1445	trace_sdcard_ext_csd_update(index, sd->ext_csd[index], b);
1446	sd->ext_csd[index] = b;
1447	}
1448
1449	static void sd_function_switch(SDState *sd, uint32_t arg)
1450	{
1451	int i, mode, new_func;
1452	mode = !!(arg & 0x80000000);
1453
1454	sd->data[0] = 0x00; /* Maximum current consumption */
1455	sd->data[1] = 0x01;
1456	sd->data[2] = 0x80; /* Supported group 6 functions */
1457	sd->data[3] = 0x01;
1458	sd->data[4] = 0x80; /* Supported group 5 functions */
1459	sd->data[5] = 0x01;
1460	sd->data[6] = 0x80; /* Supported group 4 functions */
1461	sd->data[7] = 0x01;
1462	sd->data[8] = 0x80; /* Supported group 3 functions */
1463	sd->data[9] = 0x01;
1464	sd->data[10] = 0x80; /* Supported group 2 functions */
1465	sd->data[11] = 0x43;
1466	sd->data[12] = 0x80; /* Supported group 1 functions */
1467	sd->data[13] = 0x03;
1468
1469	memset(&sd->data[14], 0, 3);
1470	for (i = 0; i < 6; i ++) {
1471	new_func = (arg >> (i * 4)) & 0x0f;
1472	if (mode && new_func != 0x0f)
1473	sd->function_group[i] = new_func;
1474	sd->data[16 - (i >> 1)] \|= new_func << ((i % 2) * 4);
1475	}
1476	memset(&sd->data[17], 0, 47);
1477	}
1478
1479	static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
1480	{
1481	return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
1482	}
1483
1484	static void sd_lock_command(SDState *sd)
1485	{
1486	int erase, lock, clr_pwd, set_pwd, pwd_len;
1487	erase = !!(sd->data[0] & 0x08);
1488	lock = sd->data[0] & 0x04;
1489	clr_pwd = sd->data[0] & 0x02;
1490	set_pwd = sd->data[0] & 0x01;
1491
1492	if (sd->blk_len > 1)
1493	pwd_len = sd->data[1];
1494	else
1495	pwd_len = 0;
1496
1497	if (lock) {
1498	trace_sdcard_lock();
1499	} else {
1500	trace_sdcard_unlock();
1501	}
1502	if (erase) {
1503	if (!(sd->card_status & CARD_IS_LOCKED) \|\| sd->blk_len > 1 \|\|
1504	set_pwd \|\| clr_pwd \|\| lock \|\| sd->wp_switch \|\|
1505	(sd->csd[14] & 0x20)) {
1506	sd->card_status \|= LOCK_UNLOCK_FAILED;
1507	return;
1508	}
1509	bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits);
1510	sd->csd[14] &= ~0x10;
1511	sd->card_status &= ~CARD_IS_LOCKED;
1512	sd->pwd_len = 0;
1513	/* Erasing the entire card here! */
1514	fprintf(stderr, "SD: Card force-erased by CMD42\n");
1515	return;
1516	}
1517
1518	if (sd->blk_len < 2 + pwd_len \|\|
1519	pwd_len <= sd->pwd_len \|\|
1520	pwd_len > sd->pwd_len + 16) {
1521	sd->card_status \|= LOCK_UNLOCK_FAILED;
1522	return;
1523	}
1524
1525	if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
1526	sd->card_status \|= LOCK_UNLOCK_FAILED;
1527	return;
1528	}
1529
1530	pwd_len -= sd->pwd_len;
1531	if ((pwd_len && !set_pwd) \|\|
1532	(clr_pwd && (set_pwd \|\| lock)) \|\|
1533	(lock && !sd->pwd_len && !set_pwd) \|\|
1534	(!set_pwd && !clr_pwd &&
1535	(((sd->card_status & CARD_IS_LOCKED) && lock) \|\|
1536	(!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
1537	sd->card_status \|= LOCK_UNLOCK_FAILED;
1538	return;
1539	}
1540
1541	if (set_pwd) {
1542	memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
1543	sd->pwd_len = pwd_len;
1544	}
1545
1546	if (clr_pwd) {
1547	sd->pwd_len = 0;
1548	}
1549
1550	if (lock)
1551	sd->card_status \|= CARD_IS_LOCKED;
1552	else
1553	sd->card_status &= ~CARD_IS_LOCKED;
1554	}
1555
1556	static bool address_in_range(SDState sd, const char desc,
1557	uint64_t addr, uint32_t length)
1558	{
1559	if (addr + length > sd->size) {
1560	qemu_log_mask(LOG_GUEST_ERROR,
1561	"%s offset %"PRIu64" > card %"PRIu64" [%%%u]\n",
1562	desc, addr, sd->size, length);
1563	sd->card_status \|= ADDRESS_ERROR;
1564	return false;
1565	}
1566	return true;
1567	}
1568
1569	static sd_rsp_type_t sd_invalid_state_for_cmd(SDState *sd, SDRequest req)
1570	{
1571	qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong state: %s (spec %s)\n",
1572	sd->proto->name, req.cmd, sd_state_name(sd->state),
1573	sd_version_str(sd->spec_version));
1574
1575	return sd_illegal;
1576	}
1577
1578	static sd_rsp_type_t sd_invalid_mode_for_cmd(SDState *sd, SDRequest req)
1579	{
1580	qemu_log_mask(LOG_GUEST_ERROR, "%s: CMD%i in a wrong mode: %s (spec %s)\n",
1581	sd->proto->name, req.cmd, sd_mode_name(sd_mode(sd)),
1582	sd_version_str(sd->spec_version));
1583
1584	return sd_illegal;
1585	}
1586
1587	static sd_rsp_type_t sd_cmd_illegal(SDState *sd, SDRequest req)
1588	{
1589	qemu_log_mask(LOG_GUEST_ERROR, "%s: Unknown CMD%i for spec %s\n",
1590	sd->proto->name, req.cmd,
1591	sd_version_str(sd->spec_version));
1592
1593	return sd_illegal;
1594	}
1595
1596	/* Commands that are recognised but not yet implemented. */
1597	static sd_rsp_type_t sd_cmd_unimplemented(SDState *sd, SDRequest req)
1598	{
1599	qemu_log_mask(LOG_UNIMP, "%s: CMD%i not implemented\n",
1600	sd->proto->name, req.cmd);
1601
1602	return sd_illegal;
1603	}
1604
1605	static sd_rsp_type_t sd_cmd_optional(SDState *sd, SDRequest req)
1606	{
1607	qemu_log_mask(LOG_UNIMP, "%s: Optional CMD%i not implemented\n",
1608	sd->proto->name, req.cmd);
1609
1610	return sd_illegal;
1611	}
1612
1613	/* Configure fields for following sd_generic_write_data() calls */
1614	static sd_rsp_type_t sd_cmd_to_receivingdata(SDState *sd, SDRequest req,
1615	uint64_t start, size_t size)
1616	{
1617	if (sd->state != sd_transfer_state) {
1618	return sd_invalid_state_for_cmd(sd, req);
1619	}
1620	sd->state = sd_receivingdata_state;
1621	sd->data_start = start;
1622	sd->data_offset = 0;
1623	/* sd->data[] used as receive buffer */
1624	sd->data_size = size ?: sizeof(sd->data);
1625	return sd_r1;
1626	}
1627
1628	/* Configure fields for following sd_generic_read_data() calls */
1629	static sd_rsp_type_t sd_cmd_to_sendingdata(SDState *sd, SDRequest req,
1630	uint64_t start,
1631	const void *data, size_t size)
1632	{
1633	if (sd->state != sd_transfer_state) {
1634	return sd_invalid_state_for_cmd(sd, req);
1635	}
1636
1637	sd->state = sd_sendingdata_state;
1638	sd->data_start = start;
1639	sd->data_offset = 0;
1640	if (data) {
1641	assert(size > 0 && size <= sizeof(sd->data));
1642	memcpy(sd->data, data, size);
1643	}
1644	if (size) {
1645	sd->data_size = size;
1646	}
1647	return sd_r1;
1648	}
1649
1650	/* CMD0 */
1651	static sd_rsp_type_t sd_cmd_GO_IDLE_STATE(SDState *sd, SDRequest req)
1652	{
1653	if (sd->state == sd_sleep_state) {
1654	switch (req.arg) {
1655	case 0x00000000:
1656	case 0xf0f0f0f0:
1657	break;
1658	default:
1659	return sd_r0;
1660	}
1661	}
1662	if (sd->state != sd_inactive_state) {
1663	sd->state = sd_idle_state;
1664	sd_reset(DEVICE(sd));
1665	}
1666
1667	return sd_is_spi(sd) ? sd_r1 : sd_r0;
1668	}
1669
1670	/* CMD2 */
1671	static sd_rsp_type_t sd_cmd_ALL_SEND_CID(SDState *sd, SDRequest req)
1672	{
1673	switch (sd->state) {
1674	case sd_ready_state:
1675	sd->state = sd_identification_state;
1676	return sd_r2_i;
1677	default:
1678	return sd_invalid_state_for_cmd(sd, req);
1679	}
1680	}
1681
1682	/* CMD3 */
1683	static sd_rsp_type_t sd_cmd_SEND_RELATIVE_ADDR(SDState *sd, SDRequest req)
1684	{
1685	uint16_t random_rca;
1686
1687	switch (sd->state) {
1688	case sd_identification_state:
1689	case sd_standby_state:
1690	sd->state = sd_standby_state;
1691	qemu_guest_getrandom_nofail(&random_rca, sizeof(random_rca));
1692	sd_set_rca(sd, random_rca);
1693	return sd_r6;
1694
1695	default:
1696	return sd_invalid_state_for_cmd(sd, req);
1697	}
1698	}
1699
1700	static sd_rsp_type_t emmc_cmd_SET_RELATIVE_ADDR(SDState *sd, SDRequest req)
1701	{
1702	switch (sd->state) {
1703	case sd_identification_state:
1704	case sd_standby_state:
1705	sd->state = sd_standby_state;
1706	sd_set_rca(sd, req.arg >> 16);
1707	return sd_r1;
1708
1709	default:
1710	return sd_invalid_state_for_cmd(sd, req);
1711	}
1712	}
1713
1714	/* CMD5 */
1715	static sd_rsp_type_t emmc_cmd_sleep_awake(SDState *sd, SDRequest req)
1716	{
1717	bool do_sleep = extract32(req.arg, 15, 1);
1718
1719	switch (sd->state) {
1720	case sd_sleep_state:
1721	if (!do_sleep) {
1722	/* Awake */
1723	sd->state = sd_standby_state;
1724	}
1725	return sd_r1b;
1726
1727	case sd_standby_state:
1728	if (do_sleep) {
1729	sd->state = sd_sleep_state;
1730	}
1731	return sd_r1b;
1732
1733	default:
1734	return sd_invalid_state_for_cmd(sd, req);
1735	}
1736	}
1737
1738	/* CMD6 */
1739	static sd_rsp_type_t sd_cmd_SWITCH_FUNCTION(SDState *sd, SDRequest req)
1740	{
1741	if (sd_mode(sd) != sd_data_transfer_mode) {
1742	return sd_invalid_mode_for_cmd(sd, req);
1743	}
1744	if (sd_is_spi(sd)) {
1745	if (sd->state == sd_idle_state) {
1746	return sd_invalid_state_for_cmd(sd, req);
1747	}
1748	} else {
1749	if (sd->state != sd_transfer_state) {
1750	return sd_invalid_state_for_cmd(sd, req);
1751	}
1752	}
1753
1754	sd_function_switch(sd, req.arg);
1755	return sd_cmd_to_sendingdata(sd, req, 0, NULL, 64);
1756	}
1757
1758	static sd_rsp_type_t emmc_cmd_SWITCH(SDState *sd, SDRequest req)
1759	{
1760	switch (sd->state) {
1761	case sd_transfer_state:
1762	sd->state = sd_programming_state;
1763	emmc_function_switch(sd, req.arg);
1764	sd->state = sd_transfer_state;
1765	return sd_r1b;
1766	default:
1767	return sd_invalid_state_for_cmd(sd, req);
1768	}
1769	}
1770
1771	/* CMD7 */
1772	static sd_rsp_type_t sd_cmd_DE_SELECT_CARD(SDState *sd, SDRequest req)
1773	{
1774	bool same_rca = sd_req_rca_same(sd, req);
1775
1776	switch (sd->state) {
1777	case sd_standby_state:
1778	if (!same_rca) {
1779	return sd_r0;
1780	}
1781	sd->state = sd_transfer_state;
1782	return sd_r1b;
1783
1784	case sd_transfer_state:
1785	case sd_sendingdata_state:
1786	if (same_rca) {
1787	break;
1788	}
1789	sd->state = sd_standby_state;
1790	return sd_r1b;
1791
1792	case sd_disconnect_state:
1793	if (!same_rca) {
1794	return sd_r0;
1795	}
1796	sd->state = sd_programming_state;
1797	return sd_r1b;
1798
1799	case sd_programming_state:
1800	if (same_rca) {
1801	break;
1802	}
1803	sd->state = sd_disconnect_state;
1804	return sd_r1b;
1805
1806	default:
1807	break;
1808	}
1809	return sd_invalid_state_for_cmd(sd, req);
1810	}
1811
1812	/* CMD8 */
1813	static sd_rsp_type_t sd_cmd_SEND_IF_COND(SDState *sd, SDRequest req)
1814	{
1815	if (sd->state != sd_idle_state) {
1816	return sd_invalid_state_for_cmd(sd, req);
1817	}
1818	sd->vhs = 0;
1819
1820	/* No response if not exactly one VHS bit is set. */
1821	if (!(req.arg >> 8) \|\| (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
1822	return sd_is_spi(sd) ? sd_r7 : sd_r0;
1823	}
1824
1825	/* Accept. */
1826	sd->vhs = req.arg;
1827	return sd_r7;
1828	}
1829
1830	/* CMD8 */
1831	static sd_rsp_type_t emmc_cmd_SEND_EXT_CSD(SDState *sd, SDRequest req)
1832	{
1833	if (sd->state != sd_transfer_state) {
1834	return sd_invalid_state_for_cmd(sd, req);
1835	}
1836
1837	return sd_cmd_to_sendingdata(sd, req, sd_req_get_address(sd, req),
1838	sd->ext_csd, sizeof(sd->ext_csd));
1839	}
1840
1841	static sd_rsp_type_t spi_cmd_SEND_CxD(SDState *sd, SDRequest req,
1842	const void *data, size_t size)
1843	{
1844	/*
1845	* XXX as of v10.1.0-rc1 command is reached in sd_idle_state,
1846	* so disable this check.
1847	if (sd->state != sd_standby_state) {
1848	return sd_invalid_state_for_cmd(sd, req);
1849	}
1850	*/
1851
1852	/*
1853	* Since SPI returns CSD and CID on the DAT lines,
1854	* switch to sd_transfer_state.
1855	*/
1856	sd->state = sd_transfer_state;
1857
1858	return sd_cmd_to_sendingdata(sd, req, 0, data, size);
1859	}
1860
1861	/* CMD9 */
1862	static sd_rsp_type_t spi_cmd_SEND_CSD(SDState *sd, SDRequest req)
1863	{
1864	return spi_cmd_SEND_CxD(sd, req, sd->csd, sizeof(sd->csd));
1865	}
1866
1867	static sd_rsp_type_t sd_cmd_SEND_CSD(SDState *sd, SDRequest req)
1868	{
1869	if (sd->state != sd_standby_state) {
1870	return sd_invalid_state_for_cmd(sd, req);
1871	}
1872
1873	return sd_req_rca_same(sd, req) ? sd_r2_s : sd_r0;
1874	}
1875
1876	/* CMD10 */
1877	static sd_rsp_type_t spi_cmd_SEND_CID(SDState *sd, SDRequest req)
1878	{
1879	return spi_cmd_SEND_CxD(sd, req, sd->cid, sizeof(sd->cid));
1880	}
1881
1882	static sd_rsp_type_t sd_cmd_SEND_CID(SDState *sd, SDRequest req)
1883	{
1884	if (sd->state != sd_standby_state) {
1885	return sd_invalid_state_for_cmd(sd, req);
1886	}
1887
1888	return sd_req_rca_same(sd, req) ? sd_r2_i : sd_r0;
1889	}
1890
1891	/* CMD12 */
1892	static sd_rsp_type_t sd_cmd_STOP_TRANSMISSION(SDState *sd, SDRequest req)
1893	{
1894	switch (sd->state) {
1895	case sd_sendingdata_state:
1896	sd->state = sd_transfer_state;
1897	return sd_r1b;
1898	case sd_receivingdata_state:
1899	sd->state = sd_programming_state;
1900	/* Bzzzzzzztt .... Operation complete. */
1901	sd->state = sd_transfer_state;
1902	return sd_r1;
1903	default:
1904	return sd_invalid_state_for_cmd(sd, req);
1905	}
1906	}
1907
1908	/* CMD13 */
1909	static sd_rsp_type_t sd_cmd_SEND_STATUS(SDState *sd, SDRequest req)
1910	{
1911	if (sd_mode(sd) != sd_data_transfer_mode) {
1912	return sd_invalid_mode_for_cmd(sd, req);
1913	}
1914
1915	switch (sd->state) {
1916	case sd_standby_state:
1917	case sd_transfer_state:
1918	case sd_sendingdata_state:
1919	case sd_receivingdata_state:
1920	case sd_programming_state:
1921	case sd_disconnect_state:
1922	break;
1923	default:
1924	return sd_invalid_state_for_cmd(sd, req);
1925	}
1926
1927	if (sd_is_spi(sd)) {
1928	return spi_r2;
1929	}
1930
1931	return sd_req_rca_same(sd, req) ? sd_r1 : sd_r0;
1932	}
1933
1934	/* CMD15 */
1935	static sd_rsp_type_t sd_cmd_GO_INACTIVE_STATE(SDState *sd, SDRequest req)
1936	{
1937	if (sd_mode(sd) != sd_data_transfer_mode) {
1938	return sd_invalid_mode_for_cmd(sd, req);
1939	}
1940	switch (sd->state) {
1941	case sd_standby_state:
1942	case sd_transfer_state:
1943	case sd_sendingdata_state:
1944	case sd_receivingdata_state:
1945	case sd_programming_state:
1946	case sd_disconnect_state:
1947	break;
1948	default:
1949	return sd_invalid_state_for_cmd(sd, req);
1950	}
1951	if (sd_req_rca_same(sd, req)) {
1952	sd->state = sd_inactive_state;
1953	}
1954
1955	return sd_r0;
1956	}
1957
1958	/* CMD16 */
1959	static sd_rsp_type_t sd_cmd_SET_BLOCKLEN(SDState *sd, SDRequest req)
1960	{
1961	if (sd->state != sd_transfer_state) {
1962	return sd_invalid_state_for_cmd(sd, req);
1963	}
1964	if (req.arg > (1 << HWBLOCK_SHIFT)) {
1965	sd->card_status \|= BLOCK_LEN_ERROR;
1966	} else {
1967	trace_sdcard_set_blocklen(req.arg);
1968	sd->blk_len = req.arg;
1969	}
1970
1971	return sd_r1;
1972	}
1973
1974	/* CMD17 */
1975	static sd_rsp_type_t sd_cmd_READ_SINGLE_BLOCK(SDState *sd, SDRequest req)
1976	{
1977	uint64_t addr;
1978
1979	if (sd->state != sd_transfer_state) {
1980	return sd_invalid_state_for_cmd(sd, req);
1981	}
1982
1983	addr = sd_req_get_address(sd, req);
1984	if (!address_in_range(sd, "READ_SINGLE_BLOCK", addr, sd->blk_len)) {
1985	return sd_r1;
1986	}
1987
1988	sd_blk_read(sd, addr, sd->blk_len);
1989	return sd_cmd_to_sendingdata(sd, req, addr, NULL, sd->blk_len);
1990	}
1991
1992	/* CMD19 */
1993	static sd_rsp_type_t sd_cmd_SEND_TUNING_BLOCK(SDState *sd, SDRequest req)
1994	{
1995	if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
1996	return sd_cmd_illegal(sd, req);
1997	}
1998
1999	return sd_cmd_to_sendingdata(sd, req, 0,
2000	sd_tuning_block_pattern4,
2001	sizeof(sd_tuning_block_pattern4));
2002	}
2003
2004	/* CMD23 */
2005	static sd_rsp_type_t sd_cmd_SET_BLOCK_COUNT(SDState *sd, SDRequest req)
2006	{
2007	if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
2008	return sd_cmd_illegal(sd, req);
2009	}
2010
2011	if (sd->state != sd_transfer_state) {
2012	return sd_invalid_state_for_cmd(sd, req);
2013	}
2014
2015	sd->multi_blk_cnt = req.arg;
2016	if (sd_is_emmc(sd)) {
2017	sd->multi_blk_cnt &= 0xffff;
2018	}
2019	trace_sdcard_set_block_count(sd->multi_blk_cnt);
2020
2021	return sd_r1;
2022	}
2023
2024	/* CMD24 */
2025	static sd_rsp_type_t sd_cmd_WRITE_SINGLE_BLOCK(SDState *sd, SDRequest req)
2026	{
2027	uint64_t addr;
2028
2029	if (sd->state != sd_transfer_state) {
2030	return sd_invalid_state_for_cmd(sd, req);
2031	}
2032
2033	addr = sd_req_get_address(sd, req);
2034	if (!address_in_range(sd, "WRITE_SINGLE_BLOCK", addr, sd->blk_len)) {
2035	return sd_r1;
2036	}
2037
2038	if (sd->size <= SDSC_MAX_CAPACITY) {
2039	if (sd_wp_addr(sd, addr)) {
2040	sd->card_status \|= WP_VIOLATION;
2041	}
2042	}
2043	if (sd->csd[14] & 0x30) {
2044	sd->card_status \|= WP_VIOLATION;
2045	}
2046
2047	sd->blk_written = 0;
2048	return sd_cmd_to_receivingdata(sd, req, addr, sd->blk_len);
2049	}
2050
2051	/* CMD26 */
2052	static sd_rsp_type_t emmc_cmd_PROGRAM_CID(SDState *sd, SDRequest req)
2053	{
2054	return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->cid));
2055	}
2056
2057	/* CMD27 */
2058	static sd_rsp_type_t sd_cmd_PROGRAM_CSD(SDState *sd, SDRequest req)
2059	{
2060	return sd_cmd_to_receivingdata(sd, req, 0, sizeof(sd->csd));
2061	}
2062
2063	static sd_rsp_type_t sd_cmd_SET_CLR_WRITE_PROT(SDState *sd, SDRequest req,
2064	bool is_write)
2065	{
2066	uint64_t addr;
2067
2068	if (sd->size > SDSC_MAX_CAPACITY) {
2069	return sd_illegal;
2070	}
2071
2072	if (sd->state != sd_transfer_state) {
2073	return sd_invalid_state_for_cmd(sd, req);
2074	}
2075
2076	addr = sd_req_get_address(sd, req);
2077	if (!address_in_range(sd, is_write ? "SET_WRITE_PROT" : "CLR_WRITE_PROT",
2078	addr, 1)) {
2079	return sd_r1b;
2080	}
2081
2082	sd->state = sd_programming_state;
2083	if (is_write) {
2084	set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
2085	} else {
2086	clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap);
2087	}
2088	/* Bzzzzzzztt .... Operation complete. */
2089	sd->state = sd_transfer_state;
2090	return sd_r1;
2091	}
2092
2093	/* CMD28 */
2094	static sd_rsp_type_t sd_cmd_SET_WRITE_PROT(SDState *sd, SDRequest req)
2095	{
2096	return sd_cmd_SET_CLR_WRITE_PROT(sd, req, true);
2097	}
2098
2099	/* CMD29 */
2100	static sd_rsp_type_t sd_cmd_CLR_WRITE_PROT(SDState *sd, SDRequest req)
2101	{
2102	return sd_cmd_SET_CLR_WRITE_PROT(sd, req, false);
2103	}
2104
2105	/* CMD30 */
2106	static sd_rsp_type_t sd_cmd_SEND_WRITE_PROT(SDState *sd, SDRequest req)
2107	{
2108	uint64_t addr;
2109	uint32_t data;
2110
2111	if (sd->size > SDSC_MAX_CAPACITY) {
2112	return sd_illegal;
2113	}
2114
2115	if (sd->state != sd_transfer_state) {
2116	return sd_invalid_state_for_cmd(sd, req);
2117	}
2118
2119	addr = sd_req_get_address(sd, req);
2120	if (!address_in_range(sd, "SEND_WRITE_PROT", addr, sd->blk_len)) {
2121	return sd_r1;
2122	}
2123
2124	data = sd_wpbits(sd, req.arg);
2125	return sd_cmd_to_sendingdata(sd, req, addr, &data, sizeof(data));
2126	}
2127
2128	/* CMD32 */
2129	static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_START(SDState *sd, SDRequest req)
2130	{
2131	if (sd->state != sd_transfer_state) {
2132	return sd_invalid_state_for_cmd(sd, req);
2133	}
2134	sd->erase_start = req.arg;
2135	return sd_r1;
2136	}
2137
2138	/* CMD33 */
2139	static sd_rsp_type_t sd_cmd_ERASE_WR_BLK_END(SDState *sd, SDRequest req)
2140	{
2141	if (sd->state != sd_transfer_state) {
2142	return sd_invalid_state_for_cmd(sd, req);
2143	}
2144	sd->erase_end = req.arg;
2145	return sd_r1;
2146	}
2147
2148	/* CMD38 */
2149	static sd_rsp_type_t sd_cmd_ERASE(SDState *sd, SDRequest req)
2150	{
2151	if (sd->state != sd_transfer_state) {
2152	return sd_invalid_state_for_cmd(sd, req);
2153	}
2154	if (sd->csd[14] & 0x30) {
2155	sd->card_status \|= WP_VIOLATION;
2156	return sd_r1b;
2157	}
2158
2159	sd->state = sd_programming_state;
2160	sd_erase(sd);
2161	/* Bzzzzzzztt .... Operation complete. */
2162	sd->state = sd_transfer_state;
2163	return sd_r1b;
2164	}
2165
2166	/* CMD42 */
2167	static sd_rsp_type_t sd_cmd_LOCK_UNLOCK(SDState *sd, SDRequest req)
2168	{
2169	return sd_cmd_to_receivingdata(sd, req, 0, 0);
2170	}
2171
2172	/* CMD55 */
2173	static sd_rsp_type_t sd_cmd_APP_CMD(SDState *sd, SDRequest req)
2174	{
2175	switch (sd->state) {
2176	case sd_ready_state:
2177	case sd_identification_state:
2178	case sd_inactive_state:
2179	case sd_sleep_state:
2180	return sd_invalid_state_for_cmd(sd, req);
2181	case sd_idle_state:
2182	if (!sd_is_spi(sd) && sd_req_get_rca(sd, req) != 0x0000) {
2183	qemu_log_mask(LOG_GUEST_ERROR,
2184	"SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
2185	}
2186	/* fall-through */
2187	default:
2188	break;
2189	}
2190	if (!sd_is_spi(sd) && !sd_req_rca_same(sd, req)) {
2191	return sd_r0;
2192	}
2193	sd->expecting_acmd = true;
2194	sd->card_status \|= APP_CMD;
2195
2196	return sd_r1;
2197	}
2198
2199	/* CMD56 */
2200	static sd_rsp_type_t sd_cmd_GEN_CMD(SDState *sd, SDRequest req)
2201	{
2202	if (sd->state != sd_transfer_state) {
2203	return sd_invalid_state_for_cmd(sd, req);
2204	}
2205
2206	/* Vendor specific command: our model is RAZ/WI */
2207	if (req.arg & 1) {
2208	memset(sd->data, 0, sizeof(sd->data));
2209	return sd_cmd_to_sendingdata(sd, req, 0, NULL, 0);
2210	} else {
2211	return sd_cmd_to_receivingdata(sd, req, 0, 0);
2212	}
2213	}
2214
2215	/* CMD58 */
2216	static sd_rsp_type_t spi_cmd_READ_OCR(SDState *sd, SDRequest req)
2217	{
2218	return sd_r3;
2219	}
2220
2221	/* CMD59 */
2222	static sd_rsp_type_t spi_cmd_CRC_ON_OFF(SDState *sd, SDRequest req)
2223	{
2224	return sd_r1;
2225	}
2226
2227	/* ACMD6 */
2228	static sd_rsp_type_t sd_acmd_SET_BUS_WIDTH(SDState *sd, SDRequest req)
2229	{
2230	if (sd->state != sd_transfer_state) {
2231	return sd_invalid_state_for_cmd(sd, req);
2232	}
2233
2234	sd->sd_status[0] &= 0x3f;
2235	sd->sd_status[0] \|= (req.arg & 0x03) << 6;
2236	return sd_r1;
2237	}
2238
2239	/* ACMD13 */
2240	static sd_rsp_type_t sd_acmd_SD_STATUS(SDState *sd, SDRequest req)
2241	{
2242	sd_rsp_type_t rsp;
2243
2244	rsp = sd_cmd_to_sendingdata(sd, req, 0,
2245	sd->sd_status, sizeof(sd->sd_status));
2246	if (sd_is_spi(sd) && rsp != sd_illegal) {
2247	return spi_r2;
2248	}
2249	return rsp;
2250	}
2251
2252	/* ACMD22 */
2253	static sd_rsp_type_t sd_acmd_SEND_NUM_WR_BLOCKS(SDState *sd, SDRequest req)
2254	{
2255	return sd_cmd_to_sendingdata(sd, req, 0,
2256	&sd->blk_written, sizeof(sd->blk_written));
2257	}
2258
2259	/* ACMD23 */
2260	static sd_rsp_type_t sd_acmd_SET_WR_BLK_ERASE_COUNT(SDState *sd, SDRequest req)
2261	{
2262	if (sd->state != sd_transfer_state) {
2263	return sd_invalid_state_for_cmd(sd, req);
2264	}
2265	return sd_r1;
2266	}
2267
2268	/* ACMD41 */
2269	static sd_rsp_type_t sd_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
2270	{
2271	if (sd->state != sd_idle_state) {
2272	return sd_invalid_state_for_cmd(sd, req);
2273	}
2274
2275	/*
2276	* If it's the first ACMD41 since reset, we need to decide
2277	* whether to power up. If this is not an enquiry ACMD41,
2278	* we immediately report power on and proceed below to the
2279	* ready state, but if it is, we set a timer to model a
2280	* delay for power up. This works around a bug in EDK2
2281	* UEFI, which sends an initial enquiry ACMD41, but
2282	* assumes that the card is in ready state as soon as it
2283	* sees the power up bit set.
2284	*/
2285	if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
2286	if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
2287	timer_del(sd->ocr_power_timer);
2288	sd_ocr_powerup(sd);
2289	} else {
2290	trace_sdcard_inquiry_cmd41();
2291	if (!timer_pending(sd->ocr_power_timer)) {
2292	timer_mod_ns(sd->ocr_power_timer,
2293	(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
2294	+ OCR_POWER_DELAY_NS));
2295	}
2296	}
2297	}
2298
2299	if (sd_is_spi(sd)) {
2300	sd->state = sd_ready_state;
2301	return sd_r1;
2302	} else {
2303	if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
2304	/*
2305	* We accept any voltage. 10000 V is nothing.
2306	*
2307	* Once we're powered up, we advance straight to ready state
2308	* unless it's an enquiry ACMD41 (bits 23:0 == 0).
2309	*/
2310	sd->state = sd_ready_state;
2311	}
2312	return sd_r3;
2313	}
2314	}
2315
2316	/* ACMD42 */
2317	static sd_rsp_type_t sd_acmd_SET_CLR_CARD_DETECT(SDState *sd, SDRequest req)
2318	{
2319	if (sd->state != sd_transfer_state) {
2320	return sd_invalid_state_for_cmd(sd, req);
2321	}
2322
2323	/* Bringing in the 50KOhm pull-up resistor... Done. */
2324	return sd_r1;
2325	}
2326
2327	/* ACMD51 */
2328	static sd_rsp_type_t sd_acmd_SEND_SCR(SDState *sd, SDRequest req)
2329	{
2330	return sd_cmd_to_sendingdata(sd, req, 0, sd->scr, sizeof(sd->scr));
2331	}
2332
2333	static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
2334	{
2335	uint64_t addr;
2336
2337	sd->last_cmd_name = sd_cmd_name(sd, req.cmd);
2338	/* CMD55 precedes an ACMD, so we are not interested in tracing it.
2339	* However there is no ACMD55, so we want to trace this particular case.
2340	*/
2341	if (req.cmd != 55 \|\| sd->expecting_acmd) {
2342	trace_sdcard_normal_command(sd->proto->name,
2343	sd->last_cmd_name, req.cmd,
2344	req.arg,
2345	sd_mode_name(sd_mode(sd)),
2346	sd_state_name(sd->state));
2347	}
2348
2349	/* Not interpreting this as an app command */
2350	sd->card_status &= ~APP_CMD;
2351
2352	/* CMD23 (set block count) must be immediately followed by CMD18 or CMD25
2353	* if not, its effects are cancelled */
2354	if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 \|\| req.cmd == 25)) {
2355	sd->multi_blk_cnt = 0;
2356	}
2357
2358	if (sd->proto->cmd[req.cmd].class == 6 && FIELD_EX32(sd->ocr, OCR,
2359	CARD_CAPACITY)) {
2360	/* Only Standard Capacity cards support class 6 commands */
2361	return sd_illegal;
2362	}
2363
2364	if (sd->proto->cmd[req.cmd].handler) {
2365	return sd->proto->cmd[req.cmd].handler(sd, req);
2366	}
2367
2368	switch (req.cmd) {
2369	/* Block read commands (Class 2) */
2370	case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2371	addr = sd_req_get_address(sd, req);
2372	switch (sd->state) {
2373	case sd_transfer_state:
2374
2375	if (!address_in_range(sd, "READ_BLOCK", addr, sd->blk_len)) {
2376	return sd_r1;
2377	}
2378
2379	sd->state = sd_sendingdata_state;
2380	sd->data_start = addr;
2381	sd->data_offset = 0;
2382	return sd_r1;
2383
2384	default:
2385	break;
2386	}
2387	break;
2388
2389	/* Block write commands (Class 4) */
2390	case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2391	addr = sd_req_get_address(sd, req);
2392	switch (sd->state) {
2393	case sd_transfer_state:
2394
2395	if (!address_in_range(sd, "WRITE_BLOCK", addr, sd->blk_len)) {
2396	return sd_r1;
2397	}
2398
2399	sd->state = sd_receivingdata_state;
2400	sd->data_start = addr;
2401	sd->data_offset = 0;
2402	sd->blk_written = 0;
2403
2404	if (sd->size <= SDSC_MAX_CAPACITY) {
2405	if (sd_wp_addr(sd, sd->data_start)) {
2406	sd->card_status \|= WP_VIOLATION;
2407	}
2408	}
2409	if (sd->csd[14] & 0x30) {
2410	sd->card_status \|= WP_VIOLATION;
2411	}
2412	return sd_r1;
2413
2414	default:
2415	break;
2416	}
2417	break;
2418
2419	default:
2420	qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
2421	return sd_illegal;
2422	}
2423
2424	return sd_invalid_state_for_cmd(sd, req);
2425	}
2426
2427	static sd_rsp_type_t sd_app_command(SDState *sd,
2428	SDRequest req)
2429	{
2430	sd->last_cmd_name = sd_acmd_name(sd, req.cmd);
2431	trace_sdcard_app_command(sd->proto->name, sd->last_cmd_name,
2432	req.cmd, req.arg,
2433	sd_mode_name(sd_mode(sd)),
2434	sd_state_name(sd->state));
2435	sd->card_status \|= APP_CMD;
2436
2437	if (sd->proto->acmd[req.cmd].handler) {
2438	return sd->proto->acmd[req.cmd].handler(sd, req);
2439	}
2440
2441	switch (req.cmd) {
2442	case 18: /* Reserved for SD security applications */
2443	case 25:
2444	case 26:
2445	case 38:
2446	case 43 ... 49:
2447	/* Refer to the "SD Specifications Part3 Security Specification" for
2448	* information about the SD Security Features.
2449	*/
2450	qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
2451	req.cmd);
2452	return sd_illegal;
2453
2454	default:
2455	/* Fall back to standard commands. */
2456	return sd_normal_command(sd, req);
2457	}
2458
2459	qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
2460	return sd_illegal;
2461	}
2462
2463	static bool cmd_valid_while_locked(SDState *sd, unsigned cmd)
2464	{
2465	unsigned cmd_class;
2466
2467	/* Valid commands in locked state:
2468	* basic class (0)
2469	* lock card class (7)
2470	* CMD16
2471	* implicitly, the ACMD prefix CMD55
2472	* ACMD41 and ACMD42
2473	* Anything else provokes an "illegal command" response.
2474	*/
2475	if (sd->expecting_acmd) {
2476	return cmd == 41 \|\| cmd == 42;
2477	}
2478	if (cmd == 16 \|\| cmd == 55) {
2479	return true;
2480	}
2481	if (!sd->proto->cmd[cmd].handler) {
2482	return false;
2483	}
2484	cmd_class = sd->proto->cmd[cmd].class;
2485
2486	return cmd_class == 0 \|\| cmd_class == 7;
2487	}
2488
2489	static size_t sd_do_command(SDState sd, SDRequest req,
2490	uint8_t *response, size_t respsz)
2491	{
2492	int last_state;
2493	sd_rsp_type_t rtype;
2494	int rsplen;
2495
2496	if (!sd->blk \|\| !blk_is_inserted(sd->blk)) {
2497	return 0;
2498	}
2499
2500	if (sd->state == sd_inactive_state) {
2501	rtype = sd_illegal;
2502	goto send_response;
2503	}
2504
2505	if (sd_req_crc_validate(req)) {
2506	sd->card_status \|= COM_CRC_ERROR;
2507	rtype = sd_illegal;
2508	goto send_response;
2509	}
2510
2511	if (req->cmd >= SDMMC_CMD_MAX) {
2512	qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
2513	req->cmd);
2514	req->cmd &= 0x3f;
2515	}
2516
2517	if (sd->state == sd_sleep_state && req->cmd) {
2518	qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is sleeping\n");
2519	rtype = sd_r0;
2520	goto send_response;
2521	}
2522
2523	if (sd->card_status & CARD_IS_LOCKED) {
2524	if (!cmd_valid_while_locked(sd, req->cmd)) {
2525	sd->card_status \|= ILLEGAL_COMMAND;
2526	sd->expecting_acmd = false;
2527	qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n");
2528	rtype = sd_illegal;
2529	goto send_response;
2530	}
2531	}
2532
2533	last_state = sd->state;
2534
2535	if (sd->expecting_acmd) {
2536	sd->expecting_acmd = false;
2537	rtype = sd_app_command(sd, *req);
2538	} else {
2539	rtype = sd_normal_command(sd, *req);
2540	}
2541
2542	if (rtype == sd_illegal) {
2543	sd->card_status \|= ILLEGAL_COMMAND;
2544	} else {
2545	/* Valid command, we can update the 'state before command' bits.
2546	* (Do this now so they appear in r1 responses.)
2547	*/
2548	sd->card_status = FIELD_DP32(sd->card_status, CSR,
2549	CURRENT_STATE, last_state);
2550	}
2551
2552	send_response:
2553	rsplen = sd_response_size(sd, rtype);
2554	assert(rsplen <= respsz);
2555
2556	switch (rtype) {
2557	case sd_r1:
2558	case sd_r1b:
2559	sd_response_r1_make(sd, response);
2560	break;
2561
2562	case spi_r2:
2563	spi_response_r2_make(sd, response);
2564	break;
2565
2566	case sd_r2_i:
2567	memcpy(response, sd->cid, sizeof(sd->cid));
2568	break;
2569
2570	case sd_r2_s:
2571	memcpy(response, sd->csd, sizeof(sd->csd));
2572	break;
2573
2574	case sd_r3:
2575	sd_response_r3_make(sd, response);
2576	break;
2577
2578	case sd_r6:
2579	sd_response_r6_make(sd, response);
2580	break;
2581
2582	case sd_r7:
2583	sd_response_r7_make(sd, response);
2584	break;
2585
2586	case sd_r0:
2587	/*
2588	* Invalid state transition, reset implementation
2589	* fields to avoid OOB abuse.
2590	*/
2591	sd->data_start = 0;
2592	sd->data_offset = 0;
2593	/* fall-through */
2594	case sd_illegal:
2595	break;
2596	default:
2597	g_assert_not_reached();
2598	}
2599	trace_sdcard_response(sd_response_name(rtype), rsplen);
2600
2601	if (rtype != sd_illegal) {
2602	/* Clear the "clear on valid command" status bits now we've
2603	* sent any response
2604	*/
2605	sd->card_status &= ~CARD_STATUS_B;
2606	}
2607
2608	#ifdef DEBUG_SD
2609	qemu_hexdump(stderr, "Response", response, rsplen);
2610	#endif
2611
2612	sd->current_cmd = rtype == sd_illegal ? 0 : req->cmd;
2613
2614	return rsplen;
2615	}
2616
2617	/* Return true if buffer is consumed. Configured by sd_cmd_to_receivingdata() */
2618	static bool sd_generic_write_data(SDState sd, const void buf, size_t *len)
2619	{
2620	size_t to_write = MIN(sd->data_size - sd->data_offset, *len);
2621
2622	memcpy(&sd->data[sd->data_offset], buf, to_write);
2623	sd->data_offset += to_write;
2624	*len = to_write;
2625
2626	if (sd->data_offset >= sd->data_size) {
2627	sd->state = sd_transfer_state;
2628	return true;
2629	}
2630	return false;
2631	}
2632
2633	/* Return true when buffer is consumed. Configured by sd_cmd_to_sendingdata() */
2634	static bool sd_generic_read_data(SDState sd, void buf, size_t *len)
2635	{
2636	size_t to_read = MIN(sd->data_size - sd->data_offset, *len);
2637
2638	memcpy(buf, &sd->data[sd->data_offset], to_read);
2639	sd->data_offset += to_read;
2640	*len = to_read;
2641
2642	if (sd->data_offset >= sd->data_size) {
2643	sd->state = sd_transfer_state;
2644	return true;
2645	}
2646
2647	return false;
2648	}
2649
2650	static void sdcard_write_data_dump(const char proto, const char cmd_desc,
2651	uint8_t cmd, uint32_t offset,
2652	const void *buf, size_t len)
2653	{
2654	g_autoptr(GString) str = NULL;
2655
2656	if (trace_event_get_state_backends(TRACE_SDCARD_WRITE_DATA)) {
2657	str = qemu_hexdump_line(NULL, buf, len, 8, 0);
2658	trace_sdcard_write_data(proto, cmd_desc, cmd, offset, str->str);
2659	}
2660	}
2661
2662	static size_t sd_write_data(SDState sd, const void buf, size_t length)
2663	{
2664	unsigned int partition_access;
2665	int i;
2666	const uint8_t *value = buf;
2667
2668	if (!sd->blk \|\| !blk_is_inserted(sd->blk)) {
2669	return length;
2670	}
2671
2672	if (sd->state != sd_receivingdata_state) {
2673	qemu_log_mask(LOG_GUEST_ERROR,
2674	"%s: not in Receiving-Data state\n", __func__);
2675	return length;
2676	}
2677
2678	if (sd->card_status & (ADDRESS_ERROR \| WP_VIOLATION))
2679	return length;
2680
2681	sdcard_write_data_dump(sd->proto->name,
2682	sd->last_cmd_name,
2683	sd->current_cmd, sd->data_offset, buf, length);
2684	switch (sd->current_cmd) {
2685	case 24: /* CMD24: WRITE_SINGLE_BLOCK */
2686	if (sd_generic_write_data(sd, buf, &length)) {
2687	/* TODO: Check CRC before committing */
2688	sd->state = sd_programming_state;
2689	sd_blk_write(sd, sd->data_start, sd->data_offset);
2690	sd->blk_written ++;
2691	sd->csd[14] \|= 0x40;
2692	/* Bzzzzzzztt .... Operation complete. */
2693	sd->state = sd_transfer_state;
2694	}
2695	break;
2696
2697	case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
2698	/*
2699	* Only read one byte at a time. We will be called again with the
2700	* remaining.
2701	*/
2702	length = 1;
2703
2704	if (sd->data_offset == 0) {
2705	/* Start of the block - let's check the address is valid */
2706	if (!address_in_range(sd, "WRITE_MULTIPLE_BLOCK",
2707	sd->data_start, sd->blk_len)) {
2708	break;
2709	}
2710	if (sd->size <= SDSC_MAX_CAPACITY) {
2711	if (sd_wp_addr(sd, sd->data_start)) {
2712	sd->card_status \|= WP_VIOLATION;
2713	break;
2714	}
2715	}
2716	}
2717	sd->data[sd->data_offset++] = value[0];
2718	if (sd->data_offset >= sd->blk_len) {
2719	/* TODO: Check CRC before committing */
2720	sd->state = sd_programming_state;
2721	partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
2722	& EXT_CSD_PART_CONFIG_ACC_MASK;
2723	if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {
2724	emmc_rpmb_blk_write(sd, sd->data_start, sd->data_offset);
2725	} else {
2726	sd_blk_write(sd, sd->data_start, sd->data_offset);
2727	}
2728	sd->blk_written++;
2729	sd->data_start += sd->blk_len;
2730	sd->data_offset = 0;
2731	sd->csd[14] \|= 0x40;
2732
2733	/* Bzzzzzzztt .... Operation complete. */
2734	if (sd->multi_blk_cnt != 0) {
2735	if (--sd->multi_blk_cnt == 0) {
2736	/* Stop! */
2737	sd->state = sd_transfer_state;
2738	break;
2739	}
2740	}
2741
2742	sd->state = sd_receivingdata_state;
2743	}
2744	break;
2745
2746	case 26: /* CMD26: PROGRAM_CID */
2747	if (sd_generic_write_data(sd, buf, &length)) {
2748	/* TODO: Check CRC before committing */
2749	sd->state = sd_programming_state;
2750	for (i = 0; i < sizeof(sd->cid); i ++)
2751	if ((sd->cid[i] \| 0x00) != sd->data[i])
2752	sd->card_status \|= CID_CSD_OVERWRITE;
2753
2754	if (!(sd->card_status & CID_CSD_OVERWRITE))
2755	for (i = 0; i < sizeof(sd->cid); i ++) {
2756	sd->cid[i] \|= 0x00;
2757	sd->cid[i] &= sd->data[i];
2758	}
2759	/* Bzzzzzzztt .... Operation complete. */
2760	sd->state = sd_transfer_state;
2761	}
2762	break;
2763
2764	case 27: /* CMD27: PROGRAM_CSD */
2765	if (sd_generic_write_data(sd, buf, &length)) {
2766	/* TODO: Check CRC before committing */
2767	sd->state = sd_programming_state;
2768	for (i = 0; i < sizeof(sd->csd); i ++)
2769	if ((sd->csd[i] \| sd_csd_rw_mask[i]) !=
2770	(sd->data[i] \| sd_csd_rw_mask[i]))
2771	sd->card_status \|= CID_CSD_OVERWRITE;
2772
2773	/* Copy flag (OTP) & Permanent write protect */
2774	if (sd->csd[14] & ~sd->data[14] & 0x60)
2775	sd->card_status \|= CID_CSD_OVERWRITE;
2776
2777	if (!(sd->card_status & CID_CSD_OVERWRITE))
2778	for (i = 0; i < sizeof(sd->csd); i ++) {
2779	sd->csd[i] \|= sd_csd_rw_mask[i];
2780	sd->csd[i] &= sd->data[i];
2781	}
2782	/* Bzzzzzzztt .... Operation complete. */
2783	sd->state = sd_transfer_state;
2784	}
2785	break;
2786
2787	case 42: /* CMD42: LOCK_UNLOCK */
2788	if (sd_generic_write_data(sd, buf, &length)) {
2789	/* TODO: Check CRC before committing */
2790	sd->state = sd_programming_state;
2791	sd_lock_command(sd);
2792	/* Bzzzzzzztt .... Operation complete. */
2793	sd->state = sd_transfer_state;
2794	}
2795	break;
2796
2797	case 56: /* CMD56: GEN_CMD */
2798	sd_generic_write_data(sd, buf, &length);
2799	break;
2800
2801	default:
2802	g_assert_not_reached();
2803	}
2804
2805	return length;
2806	}
2807
2808	static size_t sd_read_data(SDState sd, void buf, size_t length)
2809	{
2810	/* TODO: Append CRCs */
2811	const uint8_t dummy_byte = 0x00;
2812	unsigned int partition_access;
2813	uint32_t io_len;
2814	uint8_t *value = buf;
2815
2816	if (!sd->blk \|\| !blk_is_inserted(sd->blk)) {
2817	memset(buf, dummy_byte, length);
2818	return length;
2819	}
2820
2821	if (sd->state != sd_sendingdata_state) {
2822	qemu_log_mask(LOG_GUEST_ERROR,
2823	"%s: not in Sending-Data state\n", __func__);
2824	memset(buf, dummy_byte, length);
2825	return length;
2826	}
2827
2828	if (sd->card_status & (ADDRESS_ERROR \| WP_VIOLATION)) {
2829	memset(buf, dummy_byte, length);
2830	return length;
2831	}
2832
2833	io_len = sd_blk_len(sd);
2834
2835	trace_sdcard_read_data(sd->proto->name,
2836	sd->last_cmd_name, sd->current_cmd,
2837	sd->data_offset, sd->data_size, io_len);
2838	switch (sd->current_cmd) {
2839	case 6: /* CMD6: SWITCH_FUNCTION */
2840	case 8: /* CMD8: SEND_EXT_CSD */
2841	case 9: /* CMD9: SEND_CSD */
2842	case 10: /* CMD10: SEND_CID */
2843	case 13: /* ACMD13: SD_STATUS */
2844	case 17: /* CMD17: READ_SINGLE_BLOCK */
2845	case 19: /* CMD19: SEND_TUNING_BLOCK (SD) */
2846	case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
2847	case 30: /* CMD30: SEND_WRITE_PROT */
2848	case 51: /* ACMD51: SEND_SCR */
2849	case 56: /* CMD56: GEN_CMD */
2850	sd_generic_read_data(sd, buf, &length);
2851	break;
2852
2853	case 18: /* CMD18: READ_MULTIPLE_BLOCK */
2854	/*
2855	* We will only read one byte at a time. We will be called again with
2856	* the remaining buffer.
2857	*/
2858	length = 1;
2859
2860	if (sd->data_offset == 0) {
2861	if (!address_in_range(sd, "READ_MULTIPLE_BLOCK",
2862	sd->data_start, io_len)) {
2863	*value = dummy_byte;
2864	return length;
2865	}
2866	partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
2867	& EXT_CSD_PART_CONFIG_ACC_MASK;
2868	if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {
2869	emmc_rpmb_blk_read(sd, sd->data_start, io_len);
2870	} else {
2871	sd_blk_read(sd, sd->data_start, io_len);
2872	}
2873	}
2874	*value = sd->data[sd->data_offset++];
2875
2876	if (sd->data_offset >= io_len) {
2877	sd->data_start += io_len;
2878	sd->data_offset = 0;
2879
2880	if (sd->multi_blk_cnt != 0) {
2881	if (--sd->multi_blk_cnt == 0) {
2882	/* Stop! */
2883	sd->state = sd_transfer_state;
2884	break;
2885	}
2886	}
2887	}
2888	break;
2889
2890	default:
2891	qemu_log_mask(LOG_GUEST_ERROR, "%s: DAT read illegal for command %s\n",
2892	__func__, sd->last_cmd_name);
2893	memset(buf, dummy_byte, length);
2894	}
2895
2896	return length;
2897	}
2898
2899	static bool sd_receive_ready(SDState *sd)
2900	{
2901	return sd->state == sd_receivingdata_state;
2902	}
2903
2904	static bool sd_data_ready(SDState *sd)
2905	{
2906	return sd->state == sd_sendingdata_state;
2907	}
2908
2909	static const SDProto sd_proto_spi = {
2910	.name = "SPI",
2911	.cmd = {
2912	[0] = {0, sd_spi, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2913	[1] = {0, sd_spi, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2914	[5] = {9, sd_spi, "IO_SEND_OP_COND", sd_cmd_optional},
2915	[6] = {10, sd_spi, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2916	[8] = {0, sd_spi, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2917	[9] = {0, sd_spi, "SEND_CSD", spi_cmd_SEND_CSD},
2918	[10] = {0, sd_spi, "SEND_CID", spi_cmd_SEND_CID},
2919	[12] = {0, sd_spi, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2920	[13] = {0, sd_spi, "SEND_STATUS", sd_cmd_SEND_STATUS},
2921	[16] = {2, sd_spi, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2922	[17] = {2, sd_spi, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2923	[24] = {4, sd_spi, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2924	[27] = {4, sd_spi, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2925	[28] = {6, sd_spi, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2926	[29] = {6, sd_spi, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2927	[30] = {6, sd_spi, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2928	[32] = {5, sd_spi, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2929	[33] = {5, sd_spi, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2930	[34] = {10, sd_spi, "READ_SEC_CMD", sd_cmd_optional},
2931	[35] = {10, sd_spi, "WRITE_SEC_CMD", sd_cmd_optional},
2932	[36] = {10, sd_spi, "SEND_PSI", sd_cmd_optional},
2933	[37] = {10, sd_spi, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2934	[38] = {5, sd_spi, "ERASE", sd_cmd_ERASE},
2935	[42] = {7, sd_spi, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2936	[50] = {10, sd_spi, "DIRECT_SECURE_READ", sd_cmd_optional},
2937	[52] = {9, sd_spi, "IO_RW_DIRECT", sd_cmd_optional},
2938	[53] = {9, sd_spi, "IO_RW_EXTENDED", sd_cmd_optional},
2939	[55] = {8, sd_spi, "APP_CMD", sd_cmd_APP_CMD},
2940	[56] = {8, sd_spi, "GEN_CMD", sd_cmd_GEN_CMD},
2941	[57] = {10, sd_spi, "DIRECT_SECURE_WRITE", sd_cmd_optional},
2942	[58] = {0, sd_spi, "READ_OCR", spi_cmd_READ_OCR},
2943	[59] = {0, sd_spi, "CRC_ON_OFF", spi_cmd_CRC_ON_OFF},
2944	},
2945	.acmd = {
2946	[13] = {8, sd_spi, "SD_STATUS", sd_acmd_SD_STATUS},
2947	[22] = {8, sd_spi, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
2948	[23] = {8, sd_spi, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
2949	[41] = {8, sd_spi, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
2950	[42] = {8, sd_spi, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
2951	[51] = {8, sd_spi, "SEND_SCR", sd_acmd_SEND_SCR},
2952	},
2953	};
2954
2955	static const SDProto sd_proto_sd = {
2956	.name = "SD",
2957	.cmd = {
2958	[0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
2959	[2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
2960	[3] = {0, sd_bcr, "SEND_RELATIVE_ADDR", sd_cmd_SEND_RELATIVE_ADDR},
2961	[4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
2962	[5] = {9, sd_bc, "IO_SEND_OP_COND", sd_cmd_optional},
2963	[6] = {10, sd_adtc, "SWITCH_FUNCTION", sd_cmd_SWITCH_FUNCTION},
2964	[7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
2965	[8] = {0, sd_bcr, "SEND_IF_COND", sd_cmd_SEND_IF_COND},
2966	[9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
2967	[10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
2968	[11] = {0, sd_ac, "VOLTAGE_SWITCH", sd_cmd_optional},
2969	[12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
2970	[13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
2971	[15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
2972	[16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
2973	[17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
2974	[19] = {2, sd_adtc, "SEND_TUNING_BLOCK", sd_cmd_SEND_TUNING_BLOCK},
2975	[20] = {2, sd_ac, "SPEED_CLASS_CONTROL", sd_cmd_optional},
2976	[23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
2977	[24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
2978	[27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
2979	[28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
2980	[29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
2981	[30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
2982	[32] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
2983	[33] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
2984	[34] = {10, sd_adtc, "READ_SEC_CMD", sd_cmd_optional},
2985	[35] = {10, sd_adtc, "WRITE_SEC_CMD", sd_cmd_optional},
2986	[36] = {10, sd_adtc, "SEND_PSI", sd_cmd_optional},
2987	[37] = {10, sd_ac, "CONTROL_ASSD_SYSTEM", sd_cmd_optional},
2988	[38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
2989	[42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
2990	[43] = {1, sd_ac, "Q_MANAGEMENT", sd_cmd_optional},
2991	[44] = {1, sd_ac, "Q_TASK_INFO_A", sd_cmd_optional},
2992	[45] = {1, sd_ac, "Q_TASK_INFO_B", sd_cmd_optional},
2993	[46] = {1, sd_adtc, "Q_RD_TASK", sd_cmd_optional},
2994	[47] = {1, sd_adtc, "Q_WR_TASK", sd_cmd_optional},
2995	[48] = {1, sd_adtc, "READ_EXTR_SINGLE", sd_cmd_optional},
2996	[49] = {1, sd_adtc, "WRITE_EXTR_SINGLE", sd_cmd_optional},
2997	[50] = {10, sd_adtc, "DIRECT_SECURE_READ", sd_cmd_optional},
2998	[52] = {9, sd_bc, "IO_RW_DIRECT", sd_cmd_optional},
2999	[53] = {9, sd_bc, "IO_RW_EXTENDED", sd_cmd_optional},
3000	[55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
3001	[56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
3002	[57] = {10, sd_adtc, "DIRECT_SECURE_WRITE", sd_cmd_optional},
3003	[58] = {11, sd_adtc, "READ_EXTR_MULTI", sd_cmd_optional},
3004	[59] = {11, sd_adtc, "WRITE_EXTR_MULTI", sd_cmd_optional},
3005	},
3006	.acmd = {
3007	[6] = {8, sd_ac, "SET_BUS_WIDTH", sd_acmd_SET_BUS_WIDTH},
3008	[13] = {8, sd_adtc, "SD_STATUS", sd_acmd_SD_STATUS},
3009	[22] = {8, sd_adtc, "SEND_NUM_WR_BLOCKS", sd_acmd_SEND_NUM_WR_BLOCKS},
3010	[23] = {8, sd_ac, "SET_WR_BLK_ERASE_COUNT", sd_acmd_SET_WR_BLK_ERASE_COUNT},
3011	[41] = {8, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
3012	[42] = {8, sd_ac, "SET_CLR_CARD_DETECT", sd_acmd_SET_CLR_CARD_DETECT},
3013	[51] = {8, sd_adtc, "SEND_SCR", sd_acmd_SEND_SCR},
3014	},
3015	};
3016
3017	static const SDProto sd_proto_emmc = {
3018	/* Only v4.3 is supported */
3019	.name = "eMMC",
3020	.cmd = {
3021	[0] = {0, sd_bc, "GO_IDLE_STATE", sd_cmd_GO_IDLE_STATE},
3022	[1] = {0, sd_bcr, "SEND_OP_COND", sd_cmd_SEND_OP_COND},
3023	[2] = {0, sd_bcr, "ALL_SEND_CID", sd_cmd_ALL_SEND_CID},
3024	[3] = {0, sd_ac, "SET_RELATIVE_ADDR", emmc_cmd_SET_RELATIVE_ADDR},
3025	[4] = {0, sd_bc, "SEND_DSR", sd_cmd_unimplemented},
3026	[5] = {0, sd_ac, "SLEEP/AWAKE", emmc_cmd_sleep_awake},
3027	[6] = {10, sd_adtc, "SWITCH", emmc_cmd_SWITCH},
3028	[7] = {0, sd_ac, "(DE)SELECT_CARD", sd_cmd_DE_SELECT_CARD},
3029	[8] = {0, sd_adtc, "SEND_EXT_CSD", emmc_cmd_SEND_EXT_CSD},
3030	[9] = {0, sd_ac, "SEND_CSD", sd_cmd_SEND_CSD},
3031	[10] = {0, sd_ac, "SEND_CID", sd_cmd_SEND_CID},
3032	[11] = {1, sd_adtc, "READ_DAT_UNTIL_STOP", sd_cmd_unimplemented},
3033	[12] = {0, sd_ac, "STOP_TRANSMISSION", sd_cmd_STOP_TRANSMISSION},
3034	[13] = {0, sd_ac, "SEND_STATUS", sd_cmd_SEND_STATUS},
3035	[14] = {0, sd_adtc, "BUSTEST_R", sd_cmd_unimplemented},
3036	[15] = {0, sd_ac, "GO_INACTIVE_STATE", sd_cmd_GO_INACTIVE_STATE},
3037	[16] = {2, sd_ac, "SET_BLOCKLEN", sd_cmd_SET_BLOCKLEN},
3038	[17] = {2, sd_adtc, "READ_SINGLE_BLOCK", sd_cmd_READ_SINGLE_BLOCK},
3039	[19] = {0, sd_adtc, "BUSTEST_W", sd_cmd_unimplemented},
3040	[20] = {3, sd_adtc, "WRITE_DAT_UNTIL_STOP", sd_cmd_unimplemented},
3041	[23] = {2, sd_ac, "SET_BLOCK_COUNT", sd_cmd_SET_BLOCK_COUNT},
3042	[24] = {4, sd_adtc, "WRITE_SINGLE_BLOCK", sd_cmd_WRITE_SINGLE_BLOCK},
3043	[26] = {4, sd_adtc, "PROGRAM_CID", emmc_cmd_PROGRAM_CID},
3044	[27] = {4, sd_adtc, "PROGRAM_CSD", sd_cmd_PROGRAM_CSD},
3045	[28] = {6, sd_ac, "SET_WRITE_PROT", sd_cmd_SET_WRITE_PROT},
3046	[29] = {6, sd_ac, "CLR_WRITE_PROT", sd_cmd_CLR_WRITE_PROT},
3047	[30] = {6, sd_adtc, "SEND_WRITE_PROT", sd_cmd_SEND_WRITE_PROT},
3048	[31] = {6, sd_adtc, "SEND_WRITE_PROT_TYPE", sd_cmd_unimplemented},
3049	[35] = {5, sd_ac, "ERASE_WR_BLK_START", sd_cmd_ERASE_WR_BLK_START},
3050	[36] = {5, sd_ac, "ERASE_WR_BLK_END", sd_cmd_ERASE_WR_BLK_END},
3051	[38] = {5, sd_ac, "ERASE", sd_cmd_ERASE},
3052	[39] = {9, sd_ac, "FAST_IO", sd_cmd_unimplemented},
3053	[40] = {9, sd_bcr, "GO_IRQ_STATE", sd_cmd_unimplemented},
3054	[42] = {7, sd_adtc, "LOCK_UNLOCK", sd_cmd_LOCK_UNLOCK},
3055	[49] = {0, sd_adtc, "SET_TIME", sd_cmd_unimplemented},
3056	[55] = {8, sd_ac, "APP_CMD", sd_cmd_APP_CMD},
3057	[56] = {8, sd_adtc, "GEN_CMD", sd_cmd_GEN_CMD},
3058	},
3059	};
3060
3061	static void sd_instance_init(Object *obj)
3062	{
3063	SDState *sd = SDMMC_COMMON(obj);
3064	SDCardClass *sc = SDMMC_COMMON_GET_CLASS(sd);
3065
3066	sd->proto = sc->proto;
3067	sd->last_cmd_name = "UNSET";
3068	sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd);
3069	}
3070
3071	static void sd_instance_finalize(Object *obj)
3072	{
3073	SDState *sd = SDMMC_COMMON(obj);
3074
3075	timer_free(sd->ocr_power_timer);
3076	}
3077
3078	static void sd_blk_size_error(SDState *sd, int64_t blk_size,
3079	int64_t blk_size_aligned, const char *rule,
3080	Error **errp)
3081	{
3082	const char *dev_type = sd_is_emmc(sd) ? "eMMC" : "SD card";
3083	char *blk_size_str;
3084
3085	blk_size_str = size_to_str(blk_size);
3086	error_setg(errp, "Invalid %s size: %s", dev_type, blk_size_str);
3087	g_free(blk_size_str);
3088
3089	blk_size_str = size_to_str(blk_size_aligned);
3090	error_append_hint(errp,
3091	"%s size has to be %s, e.g. %s.\n"
3092	"You can resize disk images with"
3093	" 'qemu-img resize <imagefile> <new-size>'\n"
3094	"(note that this will lose data if you make the"
3095	" image smaller than it currently is).\n",
3096	dev_type, rule, blk_size_str);
3097	g_free(blk_size_str);
3098	}
3099
3100	static void sd_realize(DeviceState dev, Error *errp)
3101	{
3102	SDState *sd = SDMMC_COMMON(dev);
3103	int64_t blk_size = -ENOMEDIUM;
3104	int ret;
3105
3106	switch (sd->spec_version) {
3107	case SD_PHY_SPECv2_00_VERS
3108	... SD_PHY_SPECv3_01_VERS:
3109	break;
3110	default:
3111	error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
3112	return;
3113	}
3114
3115	if (sd->blk) {
3116	if (!blk_supports_write_perm(sd->blk)) {
3117	error_setg(errp, "Cannot use read-only drive as SD card");
3118	return;
3119	}
3120
3121	blk_size = blk_getlength(sd->blk);
3122	}
3123	if (blk_size >= 0) {
3124	blk_size -= sd->boot_part_size * 2 + sd->rpmb_part_size;
3125	if (blk_size > SDSC_MAX_CAPACITY) {
3126	if (sd_is_emmc(sd) &&
3127	!QEMU_IS_ALIGNED(blk_size, 1 << HWBLOCK_SHIFT)) {
3128	int64_t blk_size_aligned =
3129	((blk_size >> HWBLOCK_SHIFT) + 1) << HWBLOCK_SHIFT;
3130	sd_blk_size_error(sd, blk_size, blk_size_aligned,
3131	"multiples of 512", errp);
3132	return;
3133	} else if (!sd_is_emmc(sd) &&
3134	!QEMU_IS_ALIGNED(blk_size, 512 * KiB)) {
3135	int64_t blk_size_aligned = ((blk_size >> 19) + 1) << 19;
3136	sd_blk_size_error(sd, blk_size, blk_size_aligned,
3137	"multiples of 512K", errp);
3138	return;
3139	}
3140	} else if (blk_size > 0 && !is_power_of_2(blk_size)) {
3141	sd_blk_size_error(sd, blk_size, pow2ceil(blk_size), "a power of 2",
3142	errp);
3143	return;
3144	} else if (blk_size < 0) {
3145	error_setg(errp, "eMMC image smaller than boot partitions");
3146	return;
3147	}
3148
3149	ret = blk_set_perm(sd->blk, BLK_PERM_CONSISTENT_READ \| BLK_PERM_WRITE,
3150	BLK_PERM_ALL, errp);
3151	if (ret < 0) {
3152	return;
3153	}
3154	blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
3155	}
3156	if (!QEMU_IS_ALIGNED(sd->boot_part_size, 128 * KiB) \|\|
3157	sd->boot_part_size > 255 * 128 * KiB) {
3158	g_autofree char *size_str = size_to_str(sd->boot_part_size);
3159
3160	error_setg(errp, "Invalid boot partition size: %s", size_str);
3161	error_append_hint(errp,
3162	"The boot partition size must be multiples of 128K"
3163	"and not larger than 32640K.\n");
3164	}
3165	if (!QEMU_IS_ALIGNED(sd->rpmb_part_size, 128 * KiB) \|\|
3166	sd->rpmb_part_size > 128 * 128 * KiB) {
3167	char *size_str = size_to_str(sd->boot_part_size);
3168
3169	error_setg(errp, "Invalid RPMB partition size: %s", size_str);
3170	g_free(size_str);
3171	error_append_hint(errp,
3172	"The RPMB partition size must be multiples of 128K"
3173	"and not larger than 16384K.\n");
3174	}
3175	if (sd_is_emmc(sd) && sd->preset_auth_key) {
3176	if (strlen(sd->preset_auth_key) != 64) {
3177	error_setg(errp,
3178	"Authentication key must be 32 bytes long, "
3179	"encoded hexadecimally");
3180	return;
3181	}
3182
3183	char *pos = sd->preset_auth_key;
3184	unsigned int n;
3185	for (n = 0; n < RPMB_KEY_MAC_LEN; n++, pos += 2) {
3186	int chrs;
3187	if (sscanf(pos, "%02hhx%n", &sd->rpmb.key[n], &chrs) != 1 \|\|
3188	chrs != 2) {
3189	error_setg(errp,
3190	"Authentication key contains invalid characters");
3191	return;
3192	}
3193	}
3194	sd->rpmb.key_set = 1;
3195	}
3196	}
3197
3198	static void emmc_realize(DeviceState dev, Error *errp)
3199	{
3200	SDState *sd = SDMMC_COMMON(dev);
3201
3202	sd->spec_version = SD_PHY_SPECv3_01_VERS; /* Actually v4.5 */
3203
3204	sd_realize(dev, errp);
3205	}
3206
3207	static const Property sdmmc_common_properties[] = {
3208	DEFINE_PROP_DRIVE("drive", SDState, blk),
3209	};
3210
3211	static const Property sd_properties[] = {
3212	DEFINE_PROP_UINT8("spec_version", SDState,
3213	spec_version, SD_PHY_SPECv3_01_VERS),
3214	};
3215
3216	static const Property emmc_properties[] = {
3217	DEFINE_PROP_UINT64("boot-partition-size", SDState, boot_part_size, 0),
3218	DEFINE_PROP_UINT8("boot-config", SDState, boot_config, 0x0),
3219	DEFINE_PROP_UINT64("rpmb-partition-size", SDState, rpmb_part_size, 0),
3220	DEFINE_PROP_STRING("auth-key", SDState, preset_auth_key),
3221	};
3222
3223	static void sdmmc_common_class_init(ObjectClass klass, const void data)
3224	{
3225	DeviceClass *dc = DEVICE_CLASS(klass);
3226	SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
3227
3228	device_class_set_props(dc, sdmmc_common_properties);
3229	dc->vmsd = &sd_vmstate;
3230	device_class_set_legacy_reset(dc, sd_reset);
3231	dc->bus_type = TYPE_SD_BUS;
3232	set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
3233
3234	sc->set_voltage = sd_set_voltage;
3235	sc->get_dat_lines = sd_get_dat_lines;
3236	sc->get_cmd_line = sd_get_cmd_line;
3237	sc->do_command = sd_do_command;
3238	sc->write_data = sd_write_data;
3239	sc->read_data = sd_read_data;
3240	sc->receive_ready = sd_receive_ready;
3241	sc->data_ready = sd_data_ready;
3242	sc->get_inserted = sd_get_inserted;
3243	sc->get_readonly = sd_get_readonly;
3244	}
3245
3246	static void sd_class_init(ObjectClass klass, const void data)
3247	{
3248	DeviceClass *dc = DEVICE_CLASS(klass);
3249	SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
3250
3251	dc->realize = sd_realize;
3252	device_class_set_props(dc, sd_properties);
3253
3254	sc->set_cid = sd_set_cid;
3255	sc->set_csd = sd_set_csd;
3256	sc->proto = &sd_proto_sd;
3257	}
3258
3259	/*
3260	* We do not model the chip select pin, so allow the board to select
3261	* whether card should be in SSI or MMC/SD mode. It is also up to the
3262	* board to ensure that ssi transfers only occur when the chip select
3263	* is asserted.
3264	*/
3265	static void sd_spi_class_init(ObjectClass klass, const void data)
3266	{
3267	DeviceClass *dc = DEVICE_CLASS(klass);
3268	SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
3269
3270	dc->desc = "SD SPI";
3271	sc->proto = &sd_proto_spi;
3272	}
3273
3274	static void emmc_class_init(ObjectClass klass, const void data)
3275	{
3276	DeviceClass *dc = DEVICE_CLASS(klass);
3277	SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
3278
3279	assert(qcrypto_hmac_supports(QCRYPTO_HASH_ALGO_SHA256));
3280
3281	dc->desc = "eMMC";
3282	dc->realize = emmc_realize;
3283	device_class_set_props(dc, emmc_properties);
3284
3285	sc->proto = &sd_proto_emmc;
3286
3287	sc->set_cid = emmc_set_cid;
3288	sc->set_csd = emmc_set_csd;
3289	}
3290
3291	static const TypeInfo sd_types[] = {
3292	{
3293	.name = TYPE_SDMMC_COMMON,
3294	.parent = TYPE_DEVICE,
3295	.abstract = true,
3296	.instance_size = sizeof(SDState),
3297	.class_size = sizeof(SDCardClass),
3298	.class_init = sdmmc_common_class_init,
3299	.instance_init = sd_instance_init,
3300	.instance_finalize = sd_instance_finalize,
3301	},
3302	{
3303	.name = TYPE_SD_CARD,
3304	.parent = TYPE_SDMMC_COMMON,
3305	.class_init = sd_class_init,
3306	},
3307	{
3308	.name = TYPE_SD_CARD_SPI,
3309	.parent = TYPE_SD_CARD,
3310	.class_init = sd_spi_class_init,
3311	},
3312	{
3313	.name = TYPE_EMMC,
3314	.parent = TYPE_SDMMC_COMMON,
3315	.class_init = emmc_class_init,
3316	},
3317	};
3318
3319	DEFINE_TYPES(sd_types)