Statistics
| Branch: | Revision:

root / hw / sd.c @ 145feb17

History | View | Annotate | Download (46 kB)

1
/*
2
 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3
 * layer specification, Version 1.10."
4
 *
5
 * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
6
 * Copyright (c) 2007 CodeSourcery
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in
16
 *    the documentation and/or other materials provided with the
17
 *    distribution.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22
 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31

    
32
#include "hw.h"
33
#include "block.h"
34
#include "block_int.h"
35
#include "sd.h"
36

    
37
//#define DEBUG_SD 1
38

    
39
#ifdef DEBUG_SD
40
#define DPRINTF(fmt, ...) \
41
do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
42
#else
43
#define DPRINTF(fmt, ...) do {} while(0)
44
#endif
45

    
46
typedef enum {
47
    sd_r0 = 0,    /* no response */
48
    sd_r1,        /* normal response command */
49
    sd_r2_i,      /* CID register */
50
    sd_r2_s,      /* CSD register */
51
    sd_r3,        /* OCR register */
52
    sd_r6 = 6,    /* Published RCA response */
53
    sd_r7,        /* Operating voltage */
54
    sd_r1b = -1,
55
} sd_rsp_type_t;
56

    
57
struct SDState {
58
    enum {
59
        sd_inactive,
60
        sd_card_identification_mode,
61
        sd_data_transfer_mode,
62
    } mode;
63
    enum {
64
        sd_inactive_state = -1,
65
        sd_idle_state = 0,
66
        sd_ready_state,
67
        sd_identification_state,
68
        sd_standby_state,
69
        sd_transfer_state,
70
        sd_sendingdata_state,
71
        sd_receivingdata_state,
72
        sd_programming_state,
73
        sd_disconnect_state,
74
    } state;
75
    uint32_t ocr;
76
    uint8_t scr[8];
77
    uint8_t cid[16];
78
    uint8_t csd[16];
79
    uint16_t rca;
80
    uint32_t card_status;
81
    uint8_t sd_status[64];
82
    uint32_t vhs;
83
    int wp_switch;
84
    int *wp_groups;
85
    uint64_t size;
86
    int blk_len;
87
    uint32_t erase_start;
88
    uint32_t erase_end;
89
    uint8_t pwd[16];
90
    int pwd_len;
91
    int function_group[6];
92

    
93
    int spi;
94
    int current_cmd;
95
    int blk_written;
96
    uint64_t data_start;
97
    uint32_t data_offset;
98
    uint8_t data[512];
99
    qemu_irq readonly_cb;
100
    qemu_irq inserted_cb;
101
    BlockDriverState *bdrv;
102
    uint8_t *buf;
103

    
104
    int enable;
105
};
106

    
107
static void sd_set_status(SDState *sd)
108
{
109
    switch (sd->state) {
110
    case sd_inactive_state:
111
        sd->mode = sd_inactive;
112
        break;
113

    
114
    case sd_idle_state:
115
    case sd_ready_state:
116
    case sd_identification_state:
117
        sd->mode = sd_card_identification_mode;
118
        break;
119

    
120
    case sd_standby_state:
121
    case sd_transfer_state:
122
    case sd_sendingdata_state:
123
    case sd_receivingdata_state:
124
    case sd_programming_state:
125
    case sd_disconnect_state:
126
        sd->mode = sd_data_transfer_mode;
127
        break;
128
    }
129

    
130
    sd->card_status &= ~CURRENT_STATE;
131
    sd->card_status |= sd->state << 9;
132
}
133

    
134
static const sd_cmd_type_t sd_cmd_type[64] = {
135
    sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
136
    sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
137
    sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
138
    sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
139
    sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
140
    sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
141
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
142
    sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
143
};
144

    
145
static const sd_cmd_type_t sd_acmd_type[64] = {
146
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
147
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none,
148
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac,
149
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
150
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
151
    sd_none, sd_bcr,  sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_none,
152
    sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none,
153
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
154
};
155

    
156
static const int sd_cmd_class[64] = {
157
    0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
158
    2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
159
    5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
160
    7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
161
};
162

    
163
static uint8_t sd_crc7(void *message, size_t width)
164
{
165
    int i, bit;
166
    uint8_t shift_reg = 0x00;
167
    uint8_t *msg = (uint8_t *) message;
168

    
169
    for (i = 0; i < width; i ++, msg ++)
170
        for (bit = 7; bit >= 0; bit --) {
171
            shift_reg <<= 1;
172
            if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
173
                shift_reg ^= 0x89;
174
        }
175

    
176
    return shift_reg;
177
}
178

    
179
static uint16_t sd_crc16(void *message, size_t width)
180
{
181
    int i, bit;
182
    uint16_t shift_reg = 0x0000;
183
    uint16_t *msg = (uint16_t *) message;
184
    width <<= 1;
185

    
186
    for (i = 0; i < width; i ++, msg ++)
187
        for (bit = 15; bit >= 0; bit --) {
188
            shift_reg <<= 1;
189
            if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
190
                shift_reg ^= 0x1011;
191
        }
192

    
193
    return shift_reg;
194
}
195

    
196
static void sd_set_ocr(SDState *sd)
197
{
198
    /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */
199
    sd->ocr = 0x80ffff00;
200
}
201

    
202
static void sd_set_scr(SDState *sd)
203
{
204
    sd->scr[0] = 0x00;                /* SCR Structure */
205
    sd->scr[1] = 0x2f;                /* SD Security Support */
206
    sd->scr[2] = 0x00;
207
    sd->scr[3] = 0x00;
208
    sd->scr[4] = 0x00;
209
    sd->scr[5] = 0x00;
210
    sd->scr[6] = 0x00;
211
    sd->scr[7] = 0x00;
212
}
213

    
214
#define MID        0xaa
215
#define OID        "XY"
216
#define PNM        "QEMU!"
217
#define PRV        0x01
218
#define MDT_YR        2006
219
#define MDT_MON        2
220

    
221
static void sd_set_cid(SDState *sd)
222
{
223
    sd->cid[0] = MID;                /* Fake card manufacturer ID (MID) */
224
    sd->cid[1] = OID[0];        /* OEM/Application ID (OID) */
225
    sd->cid[2] = OID[1];
226
    sd->cid[3] = PNM[0];        /* Fake product name (PNM) */
227
    sd->cid[4] = PNM[1];
228
    sd->cid[5] = PNM[2];
229
    sd->cid[6] = PNM[3];
230
    sd->cid[7] = PNM[4];
231
    sd->cid[8] = PRV;                /* Fake product revision (PRV) */
232
    sd->cid[9] = 0xde;                /* Fake serial number (PSN) */
233
    sd->cid[10] = 0xad;
234
    sd->cid[11] = 0xbe;
235
    sd->cid[12] = 0xef;
236
    sd->cid[13] = 0x00 |        /* Manufacture date (MDT) */
237
        ((MDT_YR - 2000) / 10);
238
    sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
239
    sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
240
}
241

    
242
#define HWBLOCK_SHIFT        9                        /* 512 bytes */
243
#define SECTOR_SHIFT        5                        /* 16 kilobytes */
244
#define WPGROUP_SHIFT        7                        /* 2 megs */
245
#define CMULT_SHIFT        9                        /* 512 times HWBLOCK_SIZE */
246
#define WPGROUP_SIZE        (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
247

    
248
static const uint8_t sd_csd_rw_mask[16] = {
249
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
250
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
251
};
252

    
253
static void sd_set_csd(SDState *sd, uint64_t size)
254
{
255
    uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
256
    uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
257
    uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
258

    
259
    if (size <= 0x40000000) {        /* Standard Capacity SD */
260
        sd->csd[0] = 0x00;        /* CSD structure */
261
        sd->csd[1] = 0x26;        /* Data read access-time-1 */
262
        sd->csd[2] = 0x00;        /* Data read access-time-2 */
263
        sd->csd[3] = 0x5a;        /* Max. data transfer rate */
264
        sd->csd[4] = 0x5f;        /* Card Command Classes */
265
        sd->csd[5] = 0x50 |        /* Max. read data block length */
266
            HWBLOCK_SHIFT;
267
        sd->csd[6] = 0xe0 |        /* Partial block for read allowed */
268
            ((csize >> 10) & 0x03);
269
        sd->csd[7] = 0x00 |        /* Device size */
270
            ((csize >> 2) & 0xff);
271
        sd->csd[8] = 0x3f |        /* Max. read current */
272
            ((csize << 6) & 0xc0);
273
        sd->csd[9] = 0xfc |        /* Max. write current */
274
            ((CMULT_SHIFT - 2) >> 1);
275
        sd->csd[10] = 0x40 |        /* Erase sector size */
276
            (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
277
        sd->csd[11] = 0x00 |        /* Write protect group size */
278
            ((sectsize << 7) & 0x80) | wpsize;
279
        sd->csd[12] = 0x90 |        /* Write speed factor */
280
            (HWBLOCK_SHIFT >> 2);
281
        sd->csd[13] = 0x20 |        /* Max. write data block length */
282
            ((HWBLOCK_SHIFT << 6) & 0xc0);
283
        sd->csd[14] = 0x00;        /* File format group */
284
        sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
285
    } else {                        /* SDHC */
286
        size /= 512 * 1024;
287
        size -= 1;
288
        sd->csd[0] = 0x40;
289
        sd->csd[1] = 0x0e;
290
        sd->csd[2] = 0x00;
291
        sd->csd[3] = 0x32;
292
        sd->csd[4] = 0x5b;
293
        sd->csd[5] = 0x59;
294
        sd->csd[6] = 0x00;
295
        sd->csd[7] = (size >> 16) & 0xff;
296
        sd->csd[8] = (size >> 8) & 0xff;
297
        sd->csd[9] = (size & 0xff);
298
        sd->csd[10] = 0x7f;
299
        sd->csd[11] = 0x80;
300
        sd->csd[12] = 0x0a;
301
        sd->csd[13] = 0x40;
302
        sd->csd[14] = 0x00;
303
        sd->csd[15] = 0x00;
304
        sd->ocr |= 1 << 30;        /* High Capacity SD Memort Card */
305
    }
306
}
307

    
308
static void sd_set_rca(SDState *sd)
309
{
310
    sd->rca += 0x4567;
311
}
312

    
313
#define CARD_STATUS_A        0x02004100
314
#define CARD_STATUS_B        0x00c01e00
315
#define CARD_STATUS_C        0xfd39a028
316

    
317
static void sd_set_cardstatus(SDState *sd)
318
{
319
    sd->card_status = 0x00000100;
320
}
321

    
322
static void sd_set_sdstatus(SDState *sd)
323
{
324
    memset(sd->sd_status, 0, 64);
325
}
326

    
327
static int sd_req_crc_validate(SDRequest *req)
328
{
329
    uint8_t buffer[5];
330
    buffer[0] = 0x40 | req->cmd;
331
    buffer[1] = (req->arg >> 24) & 0xff;
332
    buffer[2] = (req->arg >> 16) & 0xff;
333
    buffer[3] = (req->arg >> 8) & 0xff;
334
    buffer[4] = (req->arg >> 0) & 0xff;
335
    return 0;
336
    return sd_crc7(buffer, 5) != req->crc;        /* TODO */
337
}
338

    
339
static void sd_response_r1_make(SDState *sd,
340
                                uint8_t *response, uint32_t last_status)
341
{
342
    uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;
343
    uint32_t status;
344

    
345
    status = (sd->card_status & ~mask) | (last_status & mask);
346
    sd->card_status &= ~CARD_STATUS_C | APP_CMD;
347

    
348
    response[0] = (status >> 24) & 0xff;
349
    response[1] = (status >> 16) & 0xff;
350
    response[2] = (status >> 8) & 0xff;
351
    response[3] = (status >> 0) & 0xff;
352
}
353

    
354
static void sd_response_r3_make(SDState *sd, uint8_t *response)
355
{
356
    response[0] = (sd->ocr >> 24) & 0xff;
357
    response[1] = (sd->ocr >> 16) & 0xff;
358
    response[2] = (sd->ocr >> 8) & 0xff;
359
    response[3] = (sd->ocr >> 0) & 0xff;
360
}
361

    
362
static void sd_response_r6_make(SDState *sd, uint8_t *response)
363
{
364
    uint16_t arg;
365
    uint16_t status;
366

    
367
    arg = sd->rca;
368
    status = ((sd->card_status >> 8) & 0xc000) |
369
             ((sd->card_status >> 6) & 0x2000) |
370
              (sd->card_status & 0x1fff);
371

    
372
    response[0] = (arg >> 8) & 0xff;
373
    response[1] = arg & 0xff;
374
    response[2] = (status >> 8) & 0xff;
375
    response[3] = status & 0xff;
376
}
377

    
378
static void sd_response_r7_make(SDState *sd, uint8_t *response)
379
{
380
    response[0] = (sd->vhs >> 24) & 0xff;
381
    response[1] = (sd->vhs >> 16) & 0xff;
382
    response[2] = (sd->vhs >>  8) & 0xff;
383
    response[3] = (sd->vhs >>  0) & 0xff;
384
}
385

    
386
static void sd_reset(SDState *sd, BlockDriverState *bdrv)
387
{
388
    uint64_t size;
389
    uint64_t sect;
390

    
391
    if (bdrv) {
392
        bdrv_get_geometry(bdrv, &sect);
393
    } else {
394
        sect = 0;
395
    }
396
    size = sect << 9;
397

    
398
    sect = (size >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) + 1;
399

    
400
    sd->state = sd_idle_state;
401
    sd->rca = 0x0000;
402
    sd_set_ocr(sd);
403
    sd_set_scr(sd);
404
    sd_set_cid(sd);
405
    sd_set_csd(sd, size);
406
    sd_set_cardstatus(sd);
407
    sd_set_sdstatus(sd);
408

    
409
    sd->bdrv = bdrv;
410

    
411
    if (sd->wp_groups)
412
        g_free(sd->wp_groups);
413
    sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
414
    sd->wp_groups = (int *) g_malloc0(sizeof(int) * sect);
415
    memset(sd->function_group, 0, sizeof(int) * 6);
416
    sd->erase_start = 0;
417
    sd->erase_end = 0;
418
    sd->size = size;
419
    sd->blk_len = 0x200;
420
    sd->pwd_len = 0;
421
}
422

    
423
static void sd_cardchange(void *opaque)
424
{
425
    SDState *sd = opaque;
426

    
427
    qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));
428
    if (bdrv_is_inserted(sd->bdrv)) {
429
        sd_reset(sd, sd->bdrv);
430
        qemu_set_irq(sd->readonly_cb, sd->wp_switch);
431
    }
432
}
433

    
434
static const BlockDevOps sd_block_ops = {
435
    .change_media_cb = sd_cardchange,
436
};
437

    
438
/* We do not model the chip select pin, so allow the board to select
439
   whether card should be in SSI or MMC/SD mode.  It is also up to the
440
   board to ensure that ssi transfers only occur when the chip select
441
   is asserted.  */
442
SDState *sd_init(BlockDriverState *bs, int is_spi)
443
{
444
    SDState *sd;
445

    
446
    sd = (SDState *) g_malloc0(sizeof(SDState));
447
    sd->buf = qemu_blockalign(bs, 512);
448
    sd->spi = is_spi;
449
    sd->enable = 1;
450
    sd_reset(sd, bs);
451
    if (sd->bdrv) {
452
        bdrv_attach_dev_nofail(sd->bdrv, sd);
453
        bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd);
454
    }
455
    return sd;
456
}
457

    
458
void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
459
{
460
    sd->readonly_cb = readonly;
461
    sd->inserted_cb = insert;
462
    qemu_set_irq(readonly, sd->bdrv ? bdrv_is_read_only(sd->bdrv) : 0);
463
    qemu_set_irq(insert, sd->bdrv ? bdrv_is_inserted(sd->bdrv) : 0);
464
}
465

    
466
static void sd_erase(SDState *sd)
467
{
468
    int i, start, end;
469
    if (!sd->erase_start || !sd->erase_end) {
470
        sd->card_status |= ERASE_SEQ_ERROR;
471
        return;
472
    }
473

    
474
    start = sd->erase_start >>
475
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
476
    end = sd->erase_end >>
477
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
478
    sd->erase_start = 0;
479
    sd->erase_end = 0;
480
    sd->csd[14] |= 0x40;
481

    
482
    for (i = start; i <= end; i ++)
483
        if (sd->wp_groups[i])
484
            sd->card_status |= WP_ERASE_SKIP;
485
}
486

    
487
static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
488
{
489
    uint32_t i, wpnum;
490
    uint32_t ret = 0;
491

    
492
    wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
493

    
494
    for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)
495
        if (addr < sd->size && sd->wp_groups[wpnum])
496
            ret |= (1 << i);
497

    
498
    return ret;
499
}
500

    
501
static void sd_function_switch(SDState *sd, uint32_t arg)
502
{
503
    int i, mode, new_func, crc;
504
    mode = !!(arg & 0x80000000);
505

    
506
    sd->data[0] = 0x00;                /* Maximum current consumption */
507
    sd->data[1] = 0x01;
508
    sd->data[2] = 0x80;                /* Supported group 6 functions */
509
    sd->data[3] = 0x01;
510
    sd->data[4] = 0x80;                /* Supported group 5 functions */
511
    sd->data[5] = 0x01;
512
    sd->data[6] = 0x80;                /* Supported group 4 functions */
513
    sd->data[7] = 0x01;
514
    sd->data[8] = 0x80;                /* Supported group 3 functions */
515
    sd->data[9] = 0x01;
516
    sd->data[10] = 0x80;        /* Supported group 2 functions */
517
    sd->data[11] = 0x43;
518
    sd->data[12] = 0x80;        /* Supported group 1 functions */
519
    sd->data[13] = 0x03;
520
    for (i = 0; i < 6; i ++) {
521
        new_func = (arg >> (i * 4)) & 0x0f;
522
        if (mode && new_func != 0x0f)
523
            sd->function_group[i] = new_func;
524
        sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
525
    }
526
    memset(&sd->data[17], 0, 47);
527
    crc = sd_crc16(sd->data, 64);
528
    sd->data[65] = crc >> 8;
529
    sd->data[66] = crc & 0xff;
530
}
531

    
532
static inline int sd_wp_addr(SDState *sd, uint32_t addr)
533
{
534
    return sd->wp_groups[addr >>
535
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)];
536
}
537

    
538
static void sd_lock_command(SDState *sd)
539
{
540
    int erase, lock, clr_pwd, set_pwd, pwd_len;
541
    erase = !!(sd->data[0] & 0x08);
542
    lock = sd->data[0] & 0x04;
543
    clr_pwd = sd->data[0] & 0x02;
544
    set_pwd = sd->data[0] & 0x01;
545

    
546
    if (sd->blk_len > 1)
547
        pwd_len = sd->data[1];
548
    else
549
        pwd_len = 0;
550

    
551
    if (erase) {
552
        if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
553
                        set_pwd || clr_pwd || lock || sd->wp_switch ||
554
                        (sd->csd[14] & 0x20)) {
555
            sd->card_status |= LOCK_UNLOCK_FAILED;
556
            return;
557
        }
558
        memset(sd->wp_groups, 0, sizeof(int) * (sd->size >>
559
                        (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)));
560
        sd->csd[14] &= ~0x10;
561
        sd->card_status &= ~CARD_IS_LOCKED;
562
        sd->pwd_len = 0;
563
        /* Erasing the entire card here! */
564
        fprintf(stderr, "SD: Card force-erased by CMD42\n");
565
        return;
566
    }
567

    
568
    if (sd->blk_len < 2 + pwd_len ||
569
                    pwd_len <= sd->pwd_len ||
570
                    pwd_len > sd->pwd_len + 16) {
571
        sd->card_status |= LOCK_UNLOCK_FAILED;
572
        return;
573
    }
574

    
575
    if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
576
        sd->card_status |= LOCK_UNLOCK_FAILED;
577
        return;
578
    }
579

    
580
    pwd_len -= sd->pwd_len;
581
    if ((pwd_len && !set_pwd) ||
582
                    (clr_pwd && (set_pwd || lock)) ||
583
                    (lock && !sd->pwd_len && !set_pwd) ||
584
                    (!set_pwd && !clr_pwd &&
585
                     (((sd->card_status & CARD_IS_LOCKED) && lock) ||
586
                      (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
587
        sd->card_status |= LOCK_UNLOCK_FAILED;
588
        return;
589
    }
590

    
591
    if (set_pwd) {
592
        memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
593
        sd->pwd_len = pwd_len;
594
    }
595

    
596
    if (clr_pwd) {
597
        sd->pwd_len = 0;
598
    }
599

    
600
    if (lock)
601
        sd->card_status |= CARD_IS_LOCKED;
602
    else
603
        sd->card_status &= ~CARD_IS_LOCKED;
604
}
605

    
606
static sd_rsp_type_t sd_normal_command(SDState *sd,
607
                                       SDRequest req)
608
{
609
    uint32_t rca = 0x0000;
610
    uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
611

    
612
    if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
613
        rca = req.arg >> 16;
614

    
615
    DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
616
    switch (req.cmd) {
617
    /* Basic commands (Class 0 and Class 1) */
618
    case 0:        /* CMD0:   GO_IDLE_STATE */
619
        switch (sd->state) {
620
        case sd_inactive_state:
621
            return sd->spi ? sd_r1 : sd_r0;
622

    
623
        default:
624
            sd->state = sd_idle_state;
625
            sd_reset(sd, sd->bdrv);
626
            return sd->spi ? sd_r1 : sd_r0;
627
        }
628
        break;
629

    
630
    case 1:        /* CMD1:   SEND_OP_CMD */
631
        if (!sd->spi)
632
            goto bad_cmd;
633

    
634
        sd->state = sd_transfer_state;
635
        return sd_r1;
636

    
637
    case 2:        /* CMD2:   ALL_SEND_CID */
638
        if (sd->spi)
639
            goto bad_cmd;
640
        switch (sd->state) {
641
        case sd_ready_state:
642
            sd->state = sd_identification_state;
643
            return sd_r2_i;
644

    
645
        default:
646
            break;
647
        }
648
        break;
649

    
650
    case 3:        /* CMD3:   SEND_RELATIVE_ADDR */
651
        if (sd->spi)
652
            goto bad_cmd;
653
        switch (sd->state) {
654
        case sd_identification_state:
655
        case sd_standby_state:
656
            sd->state = sd_standby_state;
657
            sd_set_rca(sd);
658
            return sd_r6;
659

    
660
        default:
661
            break;
662
        }
663
        break;
664

    
665
    case 4:        /* CMD4:   SEND_DSR */
666
        if (sd->spi)
667
            goto bad_cmd;
668
        switch (sd->state) {
669
        case sd_standby_state:
670
            break;
671

    
672
        default:
673
            break;
674
        }
675
        break;
676

    
677
    case 5: /* CMD5: reserved for SDIO cards */
678
        sd->card_status |= ILLEGAL_COMMAND;
679
        return sd_r0;
680

    
681
    case 6:        /* CMD6:   SWITCH_FUNCTION */
682
        if (sd->spi)
683
            goto bad_cmd;
684
        switch (sd->mode) {
685
        case sd_data_transfer_mode:
686
            sd_function_switch(sd, req.arg);
687
            sd->state = sd_sendingdata_state;
688
            sd->data_start = 0;
689
            sd->data_offset = 0;
690
            return sd_r1;
691

    
692
        default:
693
            break;
694
        }
695
        break;
696

    
697
    case 7:        /* CMD7:   SELECT/DESELECT_CARD */
698
        if (sd->spi)
699
            goto bad_cmd;
700
        switch (sd->state) {
701
        case sd_standby_state:
702
            if (sd->rca != rca)
703
                return sd_r0;
704

    
705
            sd->state = sd_transfer_state;
706
            return sd_r1b;
707

    
708
        case sd_transfer_state:
709
        case sd_sendingdata_state:
710
            if (sd->rca == rca)
711
                break;
712

    
713
            sd->state = sd_standby_state;
714
            return sd_r1b;
715

    
716
        case sd_disconnect_state:
717
            if (sd->rca != rca)
718
                return sd_r0;
719

    
720
            sd->state = sd_programming_state;
721
            return sd_r1b;
722

    
723
        case sd_programming_state:
724
            if (sd->rca == rca)
725
                break;
726

    
727
            sd->state = sd_disconnect_state;
728
            return sd_r1b;
729

    
730
        default:
731
            break;
732
        }
733
        break;
734

    
735
    case 8:        /* CMD8:   SEND_IF_COND */
736
        /* Physical Layer Specification Version 2.00 command */
737
        switch (sd->state) {
738
        case sd_idle_state:
739
            sd->vhs = 0;
740

    
741
            /* No response if not exactly one VHS bit is set.  */
742
            if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff)))
743
                return sd->spi ? sd_r7 : sd_r0;
744

    
745
            /* Accept.  */
746
            sd->vhs = req.arg;
747
            return sd_r7;
748

    
749
        default:
750
            break;
751
        }
752
        break;
753

    
754
    case 9:        /* CMD9:   SEND_CSD */
755
        switch (sd->state) {
756
        case sd_standby_state:
757
            if (sd->rca != rca)
758
                return sd_r0;
759

    
760
            return sd_r2_s;
761

    
762
        case sd_transfer_state:
763
            if (!sd->spi)
764
                break;
765
            sd->state = sd_sendingdata_state;
766
            memcpy(sd->data, sd->csd, 16);
767
            sd->data_start = addr;
768
            sd->data_offset = 0;
769
            return sd_r1;
770

    
771
        default:
772
            break;
773
        }
774
        break;
775

    
776
    case 10:        /* CMD10:  SEND_CID */
777
        switch (sd->state) {
778
        case sd_standby_state:
779
            if (sd->rca != rca)
780
                return sd_r0;
781

    
782
            return sd_r2_i;
783

    
784
        case sd_transfer_state:
785
            if (!sd->spi)
786
                break;
787
            sd->state = sd_sendingdata_state;
788
            memcpy(sd->data, sd->cid, 16);
789
            sd->data_start = addr;
790
            sd->data_offset = 0;
791
            return sd_r1;
792

    
793
        default:
794
            break;
795
        }
796
        break;
797

    
798
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
799
        if (sd->spi)
800
            goto bad_cmd;
801
        switch (sd->state) {
802
        case sd_transfer_state:
803
            sd->state = sd_sendingdata_state;
804
            sd->data_start = req.arg;
805
            sd->data_offset = 0;
806

    
807
            if (sd->data_start + sd->blk_len > sd->size)
808
                sd->card_status |= ADDRESS_ERROR;
809
            return sd_r0;
810

    
811
        default:
812
            break;
813
        }
814
        break;
815

    
816
    case 12:        /* CMD12:  STOP_TRANSMISSION */
817
        switch (sd->state) {
818
        case sd_sendingdata_state:
819
            sd->state = sd_transfer_state;
820
            return sd_r1b;
821

    
822
        case sd_receivingdata_state:
823
            sd->state = sd_programming_state;
824
            /* Bzzzzzzztt .... Operation complete.  */
825
            sd->state = sd_transfer_state;
826
            return sd_r1b;
827

    
828
        default:
829
            break;
830
        }
831
        break;
832

    
833
    case 13:        /* CMD13:  SEND_STATUS */
834
        switch (sd->mode) {
835
        case sd_data_transfer_mode:
836
            if (sd->rca != rca)
837
                return sd_r0;
838

    
839
            return sd_r1;
840

    
841
        default:
842
            break;
843
        }
844
        break;
845

    
846
    case 15:        /* CMD15:  GO_INACTIVE_STATE */
847
        if (sd->spi)
848
            goto bad_cmd;
849
        switch (sd->mode) {
850
        case sd_data_transfer_mode:
851
            if (sd->rca != rca)
852
                return sd_r0;
853

    
854
            sd->state = sd_inactive_state;
855
            return sd_r0;
856

    
857
        default:
858
            break;
859
        }
860
        break;
861

    
862
    /* Block read commands (Classs 2) */
863
    case 16:        /* CMD16:  SET_BLOCKLEN */
864
        switch (sd->state) {
865
        case sd_transfer_state:
866
            if (req.arg > (1 << HWBLOCK_SHIFT))
867
                sd->card_status |= BLOCK_LEN_ERROR;
868
            else
869
                sd->blk_len = req.arg;
870

    
871
            return sd_r1;
872

    
873
        default:
874
            break;
875
        }
876
        break;
877

    
878
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
879
        switch (sd->state) {
880
        case sd_transfer_state:
881
            sd->state = sd_sendingdata_state;
882
            sd->data_start = addr;
883
            sd->data_offset = 0;
884

    
885
            if (sd->data_start + sd->blk_len > sd->size)
886
                sd->card_status |= ADDRESS_ERROR;
887
            return sd_r1;
888

    
889
        default:
890
            break;
891
        }
892
        break;
893

    
894
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
895
        switch (sd->state) {
896
        case sd_transfer_state:
897
            sd->state = sd_sendingdata_state;
898
            sd->data_start = addr;
899
            sd->data_offset = 0;
900

    
901
            if (sd->data_start + sd->blk_len > sd->size)
902
                sd->card_status |= ADDRESS_ERROR;
903
            return sd_r1;
904

    
905
        default:
906
            break;
907
        }
908
        break;
909

    
910
    /* Block write commands (Class 4) */
911
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
912
        if (sd->spi)
913
            goto unimplemented_cmd;
914
        switch (sd->state) {
915
        case sd_transfer_state:
916
            /* Writing in SPI mode not implemented.  */
917
            if (sd->spi)
918
                break;
919
            sd->state = sd_receivingdata_state;
920
            sd->data_start = addr;
921
            sd->data_offset = 0;
922
            sd->blk_written = 0;
923

    
924
            if (sd->data_start + sd->blk_len > sd->size)
925
                sd->card_status |= ADDRESS_ERROR;
926
            if (sd_wp_addr(sd, sd->data_start))
927
                sd->card_status |= WP_VIOLATION;
928
            if (sd->csd[14] & 0x30)
929
                sd->card_status |= WP_VIOLATION;
930
            return sd_r1;
931

    
932
        default:
933
            break;
934
        }
935
        break;
936

    
937
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
938
        if (sd->spi)
939
            goto unimplemented_cmd;
940
        switch (sd->state) {
941
        case sd_transfer_state:
942
            /* Writing in SPI mode not implemented.  */
943
            if (sd->spi)
944
                break;
945
            sd->state = sd_receivingdata_state;
946
            sd->data_start = addr;
947
            sd->data_offset = 0;
948
            sd->blk_written = 0;
949

    
950
            if (sd->data_start + sd->blk_len > sd->size)
951
                sd->card_status |= ADDRESS_ERROR;
952
            if (sd_wp_addr(sd, sd->data_start))
953
                sd->card_status |= WP_VIOLATION;
954
            if (sd->csd[14] & 0x30)
955
                sd->card_status |= WP_VIOLATION;
956
            return sd_r1;
957

    
958
        default:
959
            break;
960
        }
961
        break;
962

    
963
    case 26:        /* CMD26:  PROGRAM_CID */
964
        if (sd->spi)
965
            goto bad_cmd;
966
        switch (sd->state) {
967
        case sd_transfer_state:
968
            sd->state = sd_receivingdata_state;
969
            sd->data_start = 0;
970
            sd->data_offset = 0;
971
            return sd_r1;
972

    
973
        default:
974
            break;
975
        }
976
        break;
977

    
978
    case 27:        /* CMD27:  PROGRAM_CSD */
979
        if (sd->spi)
980
            goto unimplemented_cmd;
981
        switch (sd->state) {
982
        case sd_transfer_state:
983
            sd->state = sd_receivingdata_state;
984
            sd->data_start = 0;
985
            sd->data_offset = 0;
986
            return sd_r1;
987

    
988
        default:
989
            break;
990
        }
991
        break;
992

    
993
    /* Write protection (Class 6) */
994
    case 28:        /* CMD28:  SET_WRITE_PROT */
995
        switch (sd->state) {
996
        case sd_transfer_state:
997
            if (addr >= sd->size) {
998
                sd->card_status = ADDRESS_ERROR;
999
                return sd_r1b;
1000
            }
1001

    
1002
            sd->state = sd_programming_state;
1003
            sd->wp_groups[addr >> (HWBLOCK_SHIFT +
1004
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 1;
1005
            /* Bzzzzzzztt .... Operation complete.  */
1006
            sd->state = sd_transfer_state;
1007
            return sd_r1b;
1008

    
1009
        default:
1010
            break;
1011
        }
1012
        break;
1013

    
1014
    case 29:        /* CMD29:  CLR_WRITE_PROT */
1015
        switch (sd->state) {
1016
        case sd_transfer_state:
1017
            if (addr >= sd->size) {
1018
                sd->card_status = ADDRESS_ERROR;
1019
                return sd_r1b;
1020
            }
1021

    
1022
            sd->state = sd_programming_state;
1023
            sd->wp_groups[addr >> (HWBLOCK_SHIFT +
1024
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 0;
1025
            /* Bzzzzzzztt .... Operation complete.  */
1026
            sd->state = sd_transfer_state;
1027
            return sd_r1b;
1028

    
1029
        default:
1030
            break;
1031
        }
1032
        break;
1033

    
1034
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1035
        switch (sd->state) {
1036
        case sd_transfer_state:
1037
            sd->state = sd_sendingdata_state;
1038
            *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1039
            sd->data_start = addr;
1040
            sd->data_offset = 0;
1041
            return sd_r1b;
1042

    
1043
        default:
1044
            break;
1045
        }
1046
        break;
1047

    
1048
    /* Erase commands (Class 5) */
1049
    case 32:        /* CMD32:  ERASE_WR_BLK_START */
1050
        switch (sd->state) {
1051
        case sd_transfer_state:
1052
            sd->erase_start = req.arg;
1053
            return sd_r1;
1054

    
1055
        default:
1056
            break;
1057
        }
1058
        break;
1059

    
1060
    case 33:        /* CMD33:  ERASE_WR_BLK_END */
1061
        switch (sd->state) {
1062
        case sd_transfer_state:
1063
            sd->erase_end = req.arg;
1064
            return sd_r1;
1065

    
1066
        default:
1067
            break;
1068
        }
1069
        break;
1070

    
1071
    case 38:        /* CMD38:  ERASE */
1072
        switch (sd->state) {
1073
        case sd_transfer_state:
1074
            if (sd->csd[14] & 0x30) {
1075
                sd->card_status |= WP_VIOLATION;
1076
                return sd_r1b;
1077
            }
1078

    
1079
            sd->state = sd_programming_state;
1080
            sd_erase(sd);
1081
            /* Bzzzzzzztt .... Operation complete.  */
1082
            sd->state = sd_transfer_state;
1083
            return sd_r1b;
1084

    
1085
        default:
1086
            break;
1087
        }
1088
        break;
1089

    
1090
    /* Lock card commands (Class 7) */
1091
    case 42:        /* CMD42:  LOCK_UNLOCK */
1092
        if (sd->spi)
1093
            goto unimplemented_cmd;
1094
        switch (sd->state) {
1095
        case sd_transfer_state:
1096
            sd->state = sd_receivingdata_state;
1097
            sd->data_start = 0;
1098
            sd->data_offset = 0;
1099
            return sd_r1;
1100

    
1101
        default:
1102
            break;
1103
        }
1104
        break;
1105

    
1106
    case 52:
1107
    case 53:
1108
        /* CMD52, CMD53: reserved for SDIO cards
1109
         * (see the SDIO Simplified Specification V2.0)
1110
         * Handle as illegal command but do not complain
1111
         * on stderr, as some OSes may use these in their
1112
         * probing for presence of an SDIO card.
1113
         */
1114
        sd->card_status |= ILLEGAL_COMMAND;
1115
        return sd_r0;
1116

    
1117
    /* Application specific commands (Class 8) */
1118
    case 55:        /* CMD55:  APP_CMD */
1119
        if (sd->rca != rca)
1120
            return sd_r0;
1121

    
1122
        sd->card_status |= APP_CMD;
1123
        return sd_r1;
1124

    
1125
    case 56:        /* CMD56:  GEN_CMD */
1126
        fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1127

    
1128
        switch (sd->state) {
1129
        case sd_transfer_state:
1130
            sd->data_offset = 0;
1131
            if (req.arg & 1)
1132
                sd->state = sd_sendingdata_state;
1133
            else
1134
                sd->state = sd_receivingdata_state;
1135
            return sd_r1;
1136

    
1137
        default:
1138
            break;
1139
        }
1140
        break;
1141

    
1142
    default:
1143
    bad_cmd:
1144
        sd->card_status |= ILLEGAL_COMMAND;
1145

    
1146
        fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd);
1147
        return sd_r0;
1148

    
1149
    unimplemented_cmd:
1150
        /* Commands that are recognised but not yet implemented in SPI mode.  */
1151
        sd->card_status |= ILLEGAL_COMMAND;
1152
        fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd);
1153
        return sd_r0;
1154
    }
1155

    
1156
    sd->card_status |= ILLEGAL_COMMAND;
1157
    fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd);
1158
    return sd_r0;
1159
}
1160

    
1161
static sd_rsp_type_t sd_app_command(SDState *sd,
1162
                                    SDRequest req)
1163
{
1164
    DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1165
    switch (req.cmd) {
1166
    case 6:        /* ACMD6:  SET_BUS_WIDTH */
1167
        switch (sd->state) {
1168
        case sd_transfer_state:
1169
            sd->sd_status[0] &= 0x3f;
1170
            sd->sd_status[0] |= (req.arg & 0x03) << 6;
1171
            return sd_r1;
1172

    
1173
        default:
1174
            break;
1175
        }
1176
        break;
1177

    
1178
    case 13:        /* ACMD13: SD_STATUS */
1179
        switch (sd->state) {
1180
        case sd_transfer_state:
1181
            sd->state = sd_sendingdata_state;
1182
            sd->data_start = 0;
1183
            sd->data_offset = 0;
1184
            return sd_r1;
1185

    
1186
        default:
1187
            break;
1188
        }
1189
        break;
1190

    
1191
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1192
        switch (sd->state) {
1193
        case sd_transfer_state:
1194
            *(uint32_t *) sd->data = sd->blk_written;
1195

    
1196
            sd->state = sd_sendingdata_state;
1197
            sd->data_start = 0;
1198
            sd->data_offset = 0;
1199
            return sd_r1;
1200

    
1201
        default:
1202
            break;
1203
        }
1204
        break;
1205

    
1206
    case 23:        /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1207
        switch (sd->state) {
1208
        case sd_transfer_state:
1209
            return sd_r1;
1210

    
1211
        default:
1212
            break;
1213
        }
1214
        break;
1215

    
1216
    case 41:        /* ACMD41: SD_APP_OP_COND */
1217
        if (sd->spi) {
1218
            /* SEND_OP_CMD */
1219
            sd->state = sd_transfer_state;
1220
            return sd_r1;
1221
        }
1222
        switch (sd->state) {
1223
        case sd_idle_state:
1224
            /* We accept any voltage.  10000 V is nothing.  */
1225
            if (req.arg)
1226
                sd->state = sd_ready_state;
1227

    
1228
            return sd_r3;
1229

    
1230
        default:
1231
            break;
1232
        }
1233
        break;
1234

    
1235
    case 42:        /* ACMD42: SET_CLR_CARD_DETECT */
1236
        switch (sd->state) {
1237
        case sd_transfer_state:
1238
            /* Bringing in the 50KOhm pull-up resistor... Done.  */
1239
            return sd_r1;
1240

    
1241
        default:
1242
            break;
1243
        }
1244
        break;
1245

    
1246
    case 51:        /* ACMD51: SEND_SCR */
1247
        switch (sd->state) {
1248
        case sd_transfer_state:
1249
            sd->state = sd_sendingdata_state;
1250
            sd->data_start = 0;
1251
            sd->data_offset = 0;
1252
            return sd_r1;
1253

    
1254
        default:
1255
            break;
1256
        }
1257
        break;
1258

    
1259
    default:
1260
        /* Fall back to standard commands.  */
1261
        sd->card_status &= ~APP_CMD;
1262
        return sd_normal_command(sd, req);
1263
    }
1264

    
1265
    fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd);
1266
    return sd_r0;
1267
}
1268

    
1269
int sd_do_command(SDState *sd, SDRequest *req,
1270
                  uint8_t *response) {
1271
    uint32_t last_status = sd->card_status;
1272
    sd_rsp_type_t rtype;
1273
    int rsplen;
1274

    
1275
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) {
1276
        return 0;
1277
    }
1278

    
1279
    if (sd_req_crc_validate(req)) {
1280
        sd->card_status &= ~COM_CRC_ERROR;
1281
        return 0;
1282
    }
1283

    
1284
    sd->card_status &= ~CARD_STATUS_B;
1285
    sd_set_status(sd);
1286

    
1287
    if (last_status & CARD_IS_LOCKED)
1288
        if (((last_status & APP_CMD) &&
1289
                                 req->cmd == 41) ||
1290
                        (!(last_status & APP_CMD) &&
1291
                         (sd_cmd_class[req->cmd] == 0 ||
1292
                          sd_cmd_class[req->cmd] == 7 ||
1293
                          req->cmd == 16 || req->cmd == 55))) {
1294
            sd->card_status |= ILLEGAL_COMMAND;
1295
            fprintf(stderr, "SD: Card is locked\n");
1296
            return 0;
1297
        }
1298

    
1299
    if (last_status & APP_CMD) {
1300
        rtype = sd_app_command(sd, *req);
1301
        sd->card_status &= ~APP_CMD;
1302
    } else
1303
        rtype = sd_normal_command(sd, *req);
1304

    
1305
    sd->current_cmd = req->cmd;
1306

    
1307
    switch (rtype) {
1308
    case sd_r1:
1309
    case sd_r1b:
1310
        sd_response_r1_make(sd, response, last_status);
1311
        rsplen = 4;
1312
        break;
1313

    
1314
    case sd_r2_i:
1315
        memcpy(response, sd->cid, sizeof(sd->cid));
1316
        rsplen = 16;
1317
        break;
1318

    
1319
    case sd_r2_s:
1320
        memcpy(response, sd->csd, sizeof(sd->csd));
1321
        rsplen = 16;
1322
        break;
1323

    
1324
    case sd_r3:
1325
        sd_response_r3_make(sd, response);
1326
        rsplen = 4;
1327
        break;
1328

    
1329
    case sd_r6:
1330
        sd_response_r6_make(sd, response);
1331
        rsplen = 4;
1332
        break;
1333

    
1334
    case sd_r7:
1335
        sd_response_r7_make(sd, response);
1336
        rsplen = 4;
1337
        break;
1338

    
1339
    case sd_r0:
1340
    default:
1341
        rsplen = 0;
1342
        break;
1343
    }
1344

    
1345
    if (sd->card_status & ILLEGAL_COMMAND)
1346
        rsplen = 0;
1347

    
1348
#ifdef DEBUG_SD
1349
    if (rsplen) {
1350
        int i;
1351
        DPRINTF("Response:");
1352
        for (i = 0; i < rsplen; i++)
1353
            printf(" %02x", response[i]);
1354
        printf(" state %d\n", sd->state);
1355
    } else {
1356
        DPRINTF("No response %d\n", sd->state);
1357
    }
1358
#endif
1359

    
1360
    return rsplen;
1361
}
1362

    
1363
static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1364
{
1365
    uint64_t end = addr + len;
1366

    
1367
    DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
1368
            (unsigned long long) addr, len);
1369
    if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1370
        fprintf(stderr, "sd_blk_read: read error on host side\n");
1371
        return;
1372
    }
1373

    
1374
    if (end > (addr & ~511) + 512) {
1375
        memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511));
1376

    
1377
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1378
            fprintf(stderr, "sd_blk_read: read error on host side\n");
1379
            return;
1380
        }
1381
        memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511);
1382
    } else
1383
        memcpy(sd->data, sd->buf + (addr & 511), len);
1384
}
1385

    
1386
static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1387
{
1388
    uint64_t end = addr + len;
1389

    
1390
    if ((addr & 511) || len < 512)
1391
        if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1392
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1393
            return;
1394
        }
1395

    
1396
    if (end > (addr & ~511) + 512) {
1397
        memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511));
1398
        if (bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1399
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1400
            return;
1401
        }
1402

    
1403
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1404
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1405
            return;
1406
        }
1407
        memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511);
1408
        if (bdrv_write(sd->bdrv, end >> 9, sd->buf, 1) == -1)
1409
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1410
    } else {
1411
        memcpy(sd->buf + (addr & 511), sd->data, len);
1412
        if (!sd->bdrv || bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1)
1413
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1414
    }
1415
}
1416

    
1417
#define BLK_READ_BLOCK(a, len)        sd_blk_read(sd, a, len)
1418
#define BLK_WRITE_BLOCK(a, len)        sd_blk_write(sd, a, len)
1419
#define APP_READ_BLOCK(a, len)        memset(sd->data, 0xec, len)
1420
#define APP_WRITE_BLOCK(a, len)
1421

    
1422
void sd_write_data(SDState *sd, uint8_t value)
1423
{
1424
    int i;
1425

    
1426
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1427
        return;
1428

    
1429
    if (sd->state != sd_receivingdata_state) {
1430
        fprintf(stderr, "sd_write_data: not in Receiving-Data state\n");
1431
        return;
1432
    }
1433

    
1434
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1435
        return;
1436

    
1437
    switch (sd->current_cmd) {
1438
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
1439
        sd->data[sd->data_offset ++] = value;
1440
        if (sd->data_offset >= sd->blk_len) {
1441
            /* TODO: Check CRC before committing */
1442
            sd->state = sd_programming_state;
1443
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1444
            sd->blk_written ++;
1445
            sd->csd[14] |= 0x40;
1446
            /* Bzzzzzzztt .... Operation complete.  */
1447
            sd->state = sd_transfer_state;
1448
        }
1449
        break;
1450

    
1451
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
1452
        if (sd->data_offset == 0) {
1453
            /* Start of the block - lets check the address is valid */
1454
            if (sd->data_start + sd->blk_len > sd->size) {
1455
                sd->card_status |= ADDRESS_ERROR;
1456
                break;
1457
            }
1458
            if (sd_wp_addr(sd, sd->data_start)) {
1459
                sd->card_status |= WP_VIOLATION;
1460
                break;
1461
            }
1462
        }
1463
        sd->data[sd->data_offset++] = value;
1464
        if (sd->data_offset >= sd->blk_len) {
1465
            /* TODO: Check CRC before committing */
1466
            sd->state = sd_programming_state;
1467
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1468
            sd->blk_written++;
1469
            sd->data_start += sd->blk_len;
1470
            sd->data_offset = 0;
1471
            sd->csd[14] |= 0x40;
1472

    
1473
            /* Bzzzzzzztt .... Operation complete.  */
1474
            sd->state = sd_receivingdata_state;
1475
        }
1476
        break;
1477

    
1478
    case 26:        /* CMD26:  PROGRAM_CID */
1479
        sd->data[sd->data_offset ++] = value;
1480
        if (sd->data_offset >= sizeof(sd->cid)) {
1481
            /* TODO: Check CRC before committing */
1482
            sd->state = sd_programming_state;
1483
            for (i = 0; i < sizeof(sd->cid); i ++)
1484
                if ((sd->cid[i] | 0x00) != sd->data[i])
1485
                    sd->card_status |= CID_CSD_OVERWRITE;
1486

    
1487
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1488
                for (i = 0; i < sizeof(sd->cid); i ++) {
1489
                    sd->cid[i] |= 0x00;
1490
                    sd->cid[i] &= sd->data[i];
1491
                }
1492
            /* Bzzzzzzztt .... Operation complete.  */
1493
            sd->state = sd_transfer_state;
1494
        }
1495
        break;
1496

    
1497
    case 27:        /* CMD27:  PROGRAM_CSD */
1498
        sd->data[sd->data_offset ++] = value;
1499
        if (sd->data_offset >= sizeof(sd->csd)) {
1500
            /* TODO: Check CRC before committing */
1501
            sd->state = sd_programming_state;
1502
            for (i = 0; i < sizeof(sd->csd); i ++)
1503
                if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1504
                    (sd->data[i] | sd_csd_rw_mask[i]))
1505
                    sd->card_status |= CID_CSD_OVERWRITE;
1506

    
1507
            /* Copy flag (OTP) & Permanent write protect */
1508
            if (sd->csd[14] & ~sd->data[14] & 0x60)
1509
                sd->card_status |= CID_CSD_OVERWRITE;
1510

    
1511
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1512
                for (i = 0; i < sizeof(sd->csd); i ++) {
1513
                    sd->csd[i] |= sd_csd_rw_mask[i];
1514
                    sd->csd[i] &= sd->data[i];
1515
                }
1516
            /* Bzzzzzzztt .... Operation complete.  */
1517
            sd->state = sd_transfer_state;
1518
        }
1519
        break;
1520

    
1521
    case 42:        /* CMD42:  LOCK_UNLOCK */
1522
        sd->data[sd->data_offset ++] = value;
1523
        if (sd->data_offset >= sd->blk_len) {
1524
            /* TODO: Check CRC before committing */
1525
            sd->state = sd_programming_state;
1526
            sd_lock_command(sd);
1527
            /* Bzzzzzzztt .... Operation complete.  */
1528
            sd->state = sd_transfer_state;
1529
        }
1530
        break;
1531

    
1532
    case 56:        /* CMD56:  GEN_CMD */
1533
        sd->data[sd->data_offset ++] = value;
1534
        if (sd->data_offset >= sd->blk_len) {
1535
            APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1536
            sd->state = sd_transfer_state;
1537
        }
1538
        break;
1539

    
1540
    default:
1541
        fprintf(stderr, "sd_write_data: unknown command\n");
1542
        break;
1543
    }
1544
}
1545

    
1546
uint8_t sd_read_data(SDState *sd)
1547
{
1548
    /* TODO: Append CRCs */
1549
    uint8_t ret;
1550
    int io_len;
1551

    
1552
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1553
        return 0x00;
1554

    
1555
    if (sd->state != sd_sendingdata_state) {
1556
        fprintf(stderr, "sd_read_data: not in Sending-Data state\n");
1557
        return 0x00;
1558
    }
1559

    
1560
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1561
        return 0x00;
1562

    
1563
    io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1564

    
1565
    switch (sd->current_cmd) {
1566
    case 6:        /* CMD6:   SWITCH_FUNCTION */
1567
        ret = sd->data[sd->data_offset ++];
1568

    
1569
        if (sd->data_offset >= 64)
1570
            sd->state = sd_transfer_state;
1571
        break;
1572

    
1573
    case 9:        /* CMD9:   SEND_CSD */
1574
    case 10:        /* CMD10:  SEND_CID */
1575
        ret = sd->data[sd->data_offset ++];
1576

    
1577
        if (sd->data_offset >= 16)
1578
            sd->state = sd_transfer_state;
1579
        break;
1580

    
1581
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
1582
        if (sd->data_offset == 0)
1583
            BLK_READ_BLOCK(sd->data_start, io_len);
1584
        ret = sd->data[sd->data_offset ++];
1585

    
1586
        if (sd->data_offset >= io_len) {
1587
            sd->data_start += io_len;
1588
            sd->data_offset = 0;
1589
            if (sd->data_start + io_len > sd->size) {
1590
                sd->card_status |= ADDRESS_ERROR;
1591
                break;
1592
            }
1593
        }
1594
        break;
1595

    
1596
    case 13:        /* ACMD13: SD_STATUS */
1597
        ret = sd->sd_status[sd->data_offset ++];
1598

    
1599
        if (sd->data_offset >= sizeof(sd->sd_status))
1600
            sd->state = sd_transfer_state;
1601
        break;
1602

    
1603
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
1604
        if (sd->data_offset == 0)
1605
            BLK_READ_BLOCK(sd->data_start, io_len);
1606
        ret = sd->data[sd->data_offset ++];
1607

    
1608
        if (sd->data_offset >= io_len)
1609
            sd->state = sd_transfer_state;
1610
        break;
1611

    
1612
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
1613
        if (sd->data_offset == 0)
1614
            BLK_READ_BLOCK(sd->data_start, io_len);
1615
        ret = sd->data[sd->data_offset ++];
1616

    
1617
        if (sd->data_offset >= io_len) {
1618
            sd->data_start += io_len;
1619
            sd->data_offset = 0;
1620
            if (sd->data_start + io_len > sd->size) {
1621
                sd->card_status |= ADDRESS_ERROR;
1622
                break;
1623
            }
1624
        }
1625
        break;
1626

    
1627
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1628
        ret = sd->data[sd->data_offset ++];
1629

    
1630
        if (sd->data_offset >= 4)
1631
            sd->state = sd_transfer_state;
1632
        break;
1633

    
1634
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1635
        ret = sd->data[sd->data_offset ++];
1636

    
1637
        if (sd->data_offset >= 4)
1638
            sd->state = sd_transfer_state;
1639
        break;
1640

    
1641
    case 51:        /* ACMD51: SEND_SCR */
1642
        ret = sd->scr[sd->data_offset ++];
1643

    
1644
        if (sd->data_offset >= sizeof(sd->scr))
1645
            sd->state = sd_transfer_state;
1646
        break;
1647

    
1648
    case 56:        /* CMD56:  GEN_CMD */
1649
        if (sd->data_offset == 0)
1650
            APP_READ_BLOCK(sd->data_start, sd->blk_len);
1651
        ret = sd->data[sd->data_offset ++];
1652

    
1653
        if (sd->data_offset >= sd->blk_len)
1654
            sd->state = sd_transfer_state;
1655
        break;
1656

    
1657
    default:
1658
        fprintf(stderr, "sd_read_data: unknown command\n");
1659
        return 0x00;
1660
    }
1661

    
1662
    return ret;
1663
}
1664

    
1665
int sd_data_ready(SDState *sd)
1666
{
1667
    return sd->state == sd_sendingdata_state;
1668
}
1669

    
1670
void sd_enable(SDState *sd, int enable)
1671
{
1672
    sd->enable = enable;
1673
}