Statistics
| Branch: | Revision:

root / hw / sd.c @ 2a424990

History | View | Annotate | Download (45.3 kB)

1
/*
2
 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3
 * layer specification, Version 1.10."
4
 *
5
 * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
6
 * Copyright (c) 2007 CodeSourcery
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in
16
 *    the documentation and/or other materials provided with the
17
 *    distribution.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22
 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31

    
32
#include "hw.h"
33
#include "block.h"
34
#include "sd.h"
35

    
36
//#define DEBUG_SD 1
37

    
38
#ifdef DEBUG_SD
39
#define DPRINTF(fmt, ...) \
40
do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
41
#else
42
#define DPRINTF(fmt, ...) do {} while(0)
43
#endif
44

    
45
typedef enum {
46
    sd_r0 = 0,    /* no response */
47
    sd_r1,        /* normal response command */
48
    sd_r2_i,      /* CID register */
49
    sd_r2_s,      /* CSD register */
50
    sd_r3,        /* OCR register */
51
    sd_r6 = 6,    /* Published RCA response */
52
    sd_r7,        /* Operating voltage */
53
    sd_r1b = -1,
54
} sd_rsp_type_t;
55

    
56
struct SDState {
57
    enum {
58
        sd_inactive,
59
        sd_card_identification_mode,
60
        sd_data_transfer_mode,
61
    } mode;
62
    enum {
63
        sd_inactive_state = -1,
64
        sd_idle_state = 0,
65
        sd_ready_state,
66
        sd_identification_state,
67
        sd_standby_state,
68
        sd_transfer_state,
69
        sd_sendingdata_state,
70
        sd_receivingdata_state,
71
        sd_programming_state,
72
        sd_disconnect_state,
73
    } state;
74
    uint32_t ocr;
75
    uint8_t scr[8];
76
    uint8_t cid[16];
77
    uint8_t csd[16];
78
    uint16_t rca;
79
    uint32_t card_status;
80
    uint8_t sd_status[64];
81
    uint32_t vhs;
82
    int wp_switch;
83
    int *wp_groups;
84
    uint64_t size;
85
    int blk_len;
86
    uint32_t erase_start;
87
    uint32_t erase_end;
88
    uint8_t pwd[16];
89
    int pwd_len;
90
    int function_group[6];
91

    
92
    int spi;
93
    int current_cmd;
94
    int blk_written;
95
    uint64_t data_start;
96
    uint32_t data_offset;
97
    uint8_t data[512];
98
    qemu_irq readonly_cb;
99
    qemu_irq inserted_cb;
100
    BlockDriverState *bdrv;
101
    uint8_t *buf;
102

    
103
    int enable;
104
};
105

    
106
static void sd_set_status(SDState *sd)
107
{
108
    switch (sd->state) {
109
    case sd_inactive_state:
110
        sd->mode = sd_inactive;
111
        break;
112

    
113
    case sd_idle_state:
114
    case sd_ready_state:
115
    case sd_identification_state:
116
        sd->mode = sd_card_identification_mode;
117
        break;
118

    
119
    case sd_standby_state:
120
    case sd_transfer_state:
121
    case sd_sendingdata_state:
122
    case sd_receivingdata_state:
123
    case sd_programming_state:
124
    case sd_disconnect_state:
125
        sd->mode = sd_data_transfer_mode;
126
        break;
127
    }
128

    
129
    sd->card_status &= ~CURRENT_STATE;
130
    sd->card_status |= sd->state << 9;
131
}
132

    
133
static const sd_cmd_type_t sd_cmd_type[64] = {
134
    sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
135
    sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
136
    sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
137
    sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
138
    sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
139
    sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
140
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
141
    sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
142
};
143

    
144
static const sd_cmd_type_t sd_acmd_type[64] = {
145
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
146
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none,
147
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac,
148
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
149
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
150
    sd_none, sd_bcr,  sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_none,
151
    sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none,
152
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
153
};
154

    
155
static const int sd_cmd_class[64] = {
156
    0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
157
    2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
158
    5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
159
    7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
160
};
161

    
162
static uint8_t sd_crc7(void *message, size_t width)
163
{
164
    int i, bit;
165
    uint8_t shift_reg = 0x00;
166
    uint8_t *msg = (uint8_t *) message;
167

    
168
    for (i = 0; i < width; i ++, msg ++)
169
        for (bit = 7; bit >= 0; bit --) {
170
            shift_reg <<= 1;
171
            if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
172
                shift_reg ^= 0x89;
173
        }
174

    
175
    return shift_reg;
176
}
177

    
178
static uint16_t sd_crc16(void *message, size_t width)
179
{
180
    int i, bit;
181
    uint16_t shift_reg = 0x0000;
182
    uint16_t *msg = (uint16_t *) message;
183
    width <<= 1;
184

    
185
    for (i = 0; i < width; i ++, msg ++)
186
        for (bit = 15; bit >= 0; bit --) {
187
            shift_reg <<= 1;
188
            if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
189
                shift_reg ^= 0x1011;
190
        }
191

    
192
    return shift_reg;
193
}
194

    
195
static void sd_set_ocr(SDState *sd)
196
{
197
    /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */
198
    sd->ocr = 0x80ffff00;
199
}
200

    
201
static void sd_set_scr(SDState *sd)
202
{
203
    sd->scr[0] = 0x00;                /* SCR Structure */
204
    sd->scr[1] = 0x2f;                /* SD Security Support */
205
    sd->scr[2] = 0x00;
206
    sd->scr[3] = 0x00;
207
    sd->scr[4] = 0x00;
208
    sd->scr[5] = 0x00;
209
    sd->scr[6] = 0x00;
210
    sd->scr[7] = 0x00;
211
}
212

    
213
#define MID        0xaa
214
#define OID        "XY"
215
#define PNM        "QEMU!"
216
#define PRV        0x01
217
#define MDT_YR        2006
218
#define MDT_MON        2
219

    
220
static void sd_set_cid(SDState *sd)
221
{
222
    sd->cid[0] = MID;                /* Fake card manufacturer ID (MID) */
223
    sd->cid[1] = OID[0];        /* OEM/Application ID (OID) */
224
    sd->cid[2] = OID[1];
225
    sd->cid[3] = PNM[0];        /* Fake product name (PNM) */
226
    sd->cid[4] = PNM[1];
227
    sd->cid[5] = PNM[2];
228
    sd->cid[6] = PNM[3];
229
    sd->cid[7] = PNM[4];
230
    sd->cid[8] = PRV;                /* Fake product revision (PRV) */
231
    sd->cid[9] = 0xde;                /* Fake serial number (PSN) */
232
    sd->cid[10] = 0xad;
233
    sd->cid[11] = 0xbe;
234
    sd->cid[12] = 0xef;
235
    sd->cid[13] = 0x00 |        /* Manufacture date (MDT) */
236
        ((MDT_YR - 2000) / 10);
237
    sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
238
    sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
239
}
240

    
241
#define HWBLOCK_SHIFT        9                        /* 512 bytes */
242
#define SECTOR_SHIFT        5                        /* 16 kilobytes */
243
#define WPGROUP_SHIFT        7                        /* 2 megs */
244
#define CMULT_SHIFT        9                        /* 512 times HWBLOCK_SIZE */
245
#define WPGROUP_SIZE        (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
246

    
247
static const uint8_t sd_csd_rw_mask[16] = {
248
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
250
};
251

    
252
static void sd_set_csd(SDState *sd, uint64_t size)
253
{
254
    uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
255
    uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
256
    uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
257

    
258
    if (size <= 0x40000000) {        /* Standard Capacity SD */
259
        sd->csd[0] = 0x00;        /* CSD structure */
260
        sd->csd[1] = 0x26;        /* Data read access-time-1 */
261
        sd->csd[2] = 0x00;        /* Data read access-time-2 */
262
        sd->csd[3] = 0x5a;        /* Max. data transfer rate */
263
        sd->csd[4] = 0x5f;        /* Card Command Classes */
264
        sd->csd[5] = 0x50 |        /* Max. read data block length */
265
            HWBLOCK_SHIFT;
266
        sd->csd[6] = 0xe0 |        /* Partial block for read allowed */
267
            ((csize >> 10) & 0x03);
268
        sd->csd[7] = 0x00 |        /* Device size */
269
            ((csize >> 2) & 0xff);
270
        sd->csd[8] = 0x3f |        /* Max. read current */
271
            ((csize << 6) & 0xc0);
272
        sd->csd[9] = 0xfc |        /* Max. write current */
273
            ((CMULT_SHIFT - 2) >> 1);
274
        sd->csd[10] = 0x40 |        /* Erase sector size */
275
            (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
276
        sd->csd[11] = 0x00 |        /* Write protect group size */
277
            ((sectsize << 7) & 0x80) | wpsize;
278
        sd->csd[12] = 0x90 |        /* Write speed factor */
279
            (HWBLOCK_SHIFT >> 2);
280
        sd->csd[13] = 0x20 |        /* Max. write data block length */
281
            ((HWBLOCK_SHIFT << 6) & 0xc0);
282
        sd->csd[14] = 0x00;        /* File format group */
283
        sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
284
    } else {                        /* SDHC */
285
        size /= 512 * 1024;
286
        size -= 1;
287
        sd->csd[0] = 0x40;
288
        sd->csd[1] = 0x0e;
289
        sd->csd[2] = 0x00;
290
        sd->csd[3] = 0x32;
291
        sd->csd[4] = 0x5b;
292
        sd->csd[5] = 0x59;
293
        sd->csd[6] = 0x00;
294
        sd->csd[7] = (size >> 16) & 0xff;
295
        sd->csd[8] = (size >> 8) & 0xff;
296
        sd->csd[9] = (size & 0xff);
297
        sd->csd[10] = 0x7f;
298
        sd->csd[11] = 0x80;
299
        sd->csd[12] = 0x0a;
300
        sd->csd[13] = 0x40;
301
        sd->csd[14] = 0x00;
302
        sd->csd[15] = 0x00;
303
        sd->ocr |= 1 << 30;        /* High Capacity SD Memort Card */
304
    }
305
}
306

    
307
static void sd_set_rca(SDState *sd)
308
{
309
    sd->rca += 0x4567;
310
}
311

    
312
#define CARD_STATUS_A        0x02004100
313
#define CARD_STATUS_B        0x00c01e00
314
#define CARD_STATUS_C        0xfd39a028
315

    
316
static void sd_set_cardstatus(SDState *sd)
317
{
318
    sd->card_status = 0x00000100;
319
}
320

    
321
static void sd_set_sdstatus(SDState *sd)
322
{
323
    memset(sd->sd_status, 0, 64);
324
}
325

    
326
static int sd_req_crc_validate(SDRequest *req)
327
{
328
    uint8_t buffer[5];
329
    buffer[0] = 0x40 | req->cmd;
330
    buffer[1] = (req->arg >> 24) & 0xff;
331
    buffer[2] = (req->arg >> 16) & 0xff;
332
    buffer[3] = (req->arg >> 8) & 0xff;
333
    buffer[4] = (req->arg >> 0) & 0xff;
334
    return 0;
335
    return sd_crc7(buffer, 5) != req->crc;        /* TODO */
336
}
337

    
338
static void sd_response_r1_make(SDState *sd,
339
                                uint8_t *response, uint32_t last_status)
340
{
341
    uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;
342
    uint32_t status;
343

    
344
    status = (sd->card_status & ~mask) | (last_status & mask);
345
    sd->card_status &= ~CARD_STATUS_C | APP_CMD;
346

    
347
    response[0] = (status >> 24) & 0xff;
348
    response[1] = (status >> 16) & 0xff;
349
    response[2] = (status >> 8) & 0xff;
350
    response[3] = (status >> 0) & 0xff;
351
}
352

    
353
static void sd_response_r3_make(SDState *sd, uint8_t *response)
354
{
355
    response[0] = (sd->ocr >> 24) & 0xff;
356
    response[1] = (sd->ocr >> 16) & 0xff;
357
    response[2] = (sd->ocr >> 8) & 0xff;
358
    response[3] = (sd->ocr >> 0) & 0xff;
359
}
360

    
361
static void sd_response_r6_make(SDState *sd, uint8_t *response)
362
{
363
    uint16_t arg;
364
    uint16_t status;
365

    
366
    arg = sd->rca;
367
    status = ((sd->card_status >> 8) & 0xc000) |
368
             ((sd->card_status >> 6) & 0x2000) |
369
              (sd->card_status & 0x1fff);
370

    
371
    response[0] = (arg >> 8) & 0xff;
372
    response[1] = arg & 0xff;
373
    response[2] = (status >> 8) & 0xff;
374
    response[3] = status & 0xff;
375
}
376

    
377
static void sd_response_r7_make(SDState *sd, uint8_t *response)
378
{
379
    response[0] = (sd->vhs >> 24) & 0xff;
380
    response[1] = (sd->vhs >> 16) & 0xff;
381
    response[2] = (sd->vhs >>  8) & 0xff;
382
    response[3] = (sd->vhs >>  0) & 0xff;
383
}
384

    
385
static void sd_reset(SDState *sd, BlockDriverState *bdrv)
386
{
387
    uint64_t size;
388
    uint64_t sect;
389

    
390
    if (bdrv) {
391
        bdrv_get_geometry(bdrv, &sect);
392
    } else {
393
        sect = 0;
394
    }
395
    sect <<= 9;
396

    
397
    size = sect + 1;
398

    
399
    sect = (size >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) + 1;
400

    
401
    sd->state = sd_idle_state;
402
    sd->rca = 0x0000;
403
    sd_set_ocr(sd);
404
    sd_set_scr(sd);
405
    sd_set_cid(sd);
406
    sd_set_csd(sd, size);
407
    sd_set_cardstatus(sd);
408
    sd_set_sdstatus(sd);
409

    
410
    sd->bdrv = bdrv;
411

    
412
    if (sd->wp_groups)
413
        qemu_free(sd->wp_groups);
414
    sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
415
    sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
416
    memset(sd->function_group, 0, sizeof(int) * 6);
417
    sd->erase_start = 0;
418
    sd->erase_end = 0;
419
    sd->size = size;
420
    sd->blk_len = 0x200;
421
    sd->pwd_len = 0;
422
}
423

    
424
static void sd_cardchange(void *opaque)
425
{
426
    SDState *sd = opaque;
427
    qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));
428
    if (bdrv_is_inserted(sd->bdrv)) {
429
        sd_reset(sd, sd->bdrv);
430
        qemu_set_irq(sd->readonly_cb, sd->wp_switch);
431
    }
432
}
433

    
434
/* We do not model the chip select pin, so allow the board to select
435
   whether card should be in SSI or MMC/SD mode.  It is also up to the
436
   board to ensure that ssi transfers only occur when the chip select
437
   is asserted.  */
438
SDState *sd_init(BlockDriverState *bs, int is_spi)
439
{
440
    SDState *sd;
441

    
442
    sd = (SDState *) qemu_mallocz(sizeof(SDState));
443
    sd->buf = qemu_memalign(512, 512);
444
    sd->spi = is_spi;
445
    sd->enable = 1;
446
    sd_reset(sd, bs);
447
    if (sd->bdrv) {
448
        bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);
449
    }
450
    return sd;
451
}
452

    
453
void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
454
{
455
    sd->readonly_cb = readonly;
456
    sd->inserted_cb = insert;
457
    qemu_set_irq(readonly, bdrv_is_read_only(sd->bdrv));
458
    qemu_set_irq(insert, bdrv_is_inserted(sd->bdrv));
459
}
460

    
461
static void sd_erase(SDState *sd)
462
{
463
    int i, start, end;
464
    if (!sd->erase_start || !sd->erase_end) {
465
        sd->card_status |= ERASE_SEQ_ERROR;
466
        return;
467
    }
468

    
469
    start = sd->erase_start >>
470
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
471
    end = sd->erase_end >>
472
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
473
    sd->erase_start = 0;
474
    sd->erase_end = 0;
475
    sd->csd[14] |= 0x40;
476

    
477
    for (i = start; i <= end; i ++)
478
        if (sd->wp_groups[i])
479
            sd->card_status |= WP_ERASE_SKIP;
480
}
481

    
482
static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
483
{
484
    uint32_t i, wpnum;
485
    uint32_t ret = 0;
486

    
487
    wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
488

    
489
    for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)
490
        if (addr < sd->size && sd->wp_groups[wpnum])
491
            ret |= (1 << i);
492

    
493
    return ret;
494
}
495

    
496
static void sd_function_switch(SDState *sd, uint32_t arg)
497
{
498
    int i, mode, new_func, crc;
499
    mode = !!(arg & 0x80000000);
500

    
501
    sd->data[0] = 0x00;                /* Maximum current consumption */
502
    sd->data[1] = 0x01;
503
    sd->data[2] = 0x80;                /* Supported group 6 functions */
504
    sd->data[3] = 0x01;
505
    sd->data[4] = 0x80;                /* Supported group 5 functions */
506
    sd->data[5] = 0x01;
507
    sd->data[6] = 0x80;                /* Supported group 4 functions */
508
    sd->data[7] = 0x01;
509
    sd->data[8] = 0x80;                /* Supported group 3 functions */
510
    sd->data[9] = 0x01;
511
    sd->data[10] = 0x80;        /* Supported group 2 functions */
512
    sd->data[11] = 0x43;
513
    sd->data[12] = 0x80;        /* Supported group 1 functions */
514
    sd->data[13] = 0x03;
515
    for (i = 0; i < 6; i ++) {
516
        new_func = (arg >> (i * 4)) & 0x0f;
517
        if (mode && new_func != 0x0f)
518
            sd->function_group[i] = new_func;
519
        sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
520
    }
521
    memset(&sd->data[17], 0, 47);
522
    crc = sd_crc16(sd->data, 64);
523
    sd->data[65] = crc >> 8;
524
    sd->data[66] = crc & 0xff;
525
}
526

    
527
static inline int sd_wp_addr(SDState *sd, uint32_t addr)
528
{
529
    return sd->wp_groups[addr >>
530
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)];
531
}
532

    
533
static void sd_lock_command(SDState *sd)
534
{
535
    int erase, lock, clr_pwd, set_pwd, pwd_len;
536
    erase = !!(sd->data[0] & 0x08);
537
    lock = sd->data[0] & 0x04;
538
    clr_pwd = sd->data[0] & 0x02;
539
    set_pwd = sd->data[0] & 0x01;
540

    
541
    if (sd->blk_len > 1)
542
        pwd_len = sd->data[1];
543
    else
544
        pwd_len = 0;
545

    
546
    if (erase) {
547
        if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
548
                        set_pwd || clr_pwd || lock || sd->wp_switch ||
549
                        (sd->csd[14] & 0x20)) {
550
            sd->card_status |= LOCK_UNLOCK_FAILED;
551
            return;
552
        }
553
        memset(sd->wp_groups, 0, sizeof(int) * (sd->size >>
554
                        (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)));
555
        sd->csd[14] &= ~0x10;
556
        sd->card_status &= ~CARD_IS_LOCKED;
557
        sd->pwd_len = 0;
558
        /* Erasing the entire card here! */
559
        fprintf(stderr, "SD: Card force-erased by CMD42\n");
560
        return;
561
    }
562

    
563
    if (sd->blk_len < 2 + pwd_len ||
564
                    pwd_len <= sd->pwd_len ||
565
                    pwd_len > sd->pwd_len + 16) {
566
        sd->card_status |= LOCK_UNLOCK_FAILED;
567
        return;
568
    }
569

    
570
    if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
571
        sd->card_status |= LOCK_UNLOCK_FAILED;
572
        return;
573
    }
574

    
575
    pwd_len -= sd->pwd_len;
576
    if ((pwd_len && !set_pwd) ||
577
                    (clr_pwd && (set_pwd || lock)) ||
578
                    (lock && !sd->pwd_len && !set_pwd) ||
579
                    (!set_pwd && !clr_pwd &&
580
                     (((sd->card_status & CARD_IS_LOCKED) && lock) ||
581
                      (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
582
        sd->card_status |= LOCK_UNLOCK_FAILED;
583
        return;
584
    }
585

    
586
    if (set_pwd) {
587
        memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
588
        sd->pwd_len = pwd_len;
589
    }
590

    
591
    if (clr_pwd) {
592
        sd->pwd_len = 0;
593
    }
594

    
595
    if (lock)
596
        sd->card_status |= CARD_IS_LOCKED;
597
    else
598
        sd->card_status &= ~CARD_IS_LOCKED;
599
}
600

    
601
static sd_rsp_type_t sd_normal_command(SDState *sd,
602
                                       SDRequest req)
603
{
604
    uint32_t rca = 0x0000;
605
    uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
606

    
607
    if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
608
        rca = req.arg >> 16;
609

    
610
    DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
611
    switch (req.cmd) {
612
    /* Basic commands (Class 0 and Class 1) */
613
    case 0:        /* CMD0:   GO_IDLE_STATE */
614
        switch (sd->state) {
615
        case sd_inactive_state:
616
            return sd->spi ? sd_r1 : sd_r0;
617

    
618
        default:
619
            sd->state = sd_idle_state;
620
            sd_reset(sd, sd->bdrv);
621
            return sd->spi ? sd_r1 : sd_r0;
622
        }
623
        break;
624

    
625
    case 1:        /* CMD1:   SEND_OP_CMD */
626
        if (!sd->spi)
627
            goto bad_cmd;
628

    
629
        sd->state = sd_transfer_state;
630
        return sd_r1;
631

    
632
    case 2:        /* CMD2:   ALL_SEND_CID */
633
        if (sd->spi)
634
            goto bad_cmd;
635
        switch (sd->state) {
636
        case sd_ready_state:
637
            sd->state = sd_identification_state;
638
            return sd_r2_i;
639

    
640
        default:
641
            break;
642
        }
643
        break;
644

    
645
    case 3:        /* CMD3:   SEND_RELATIVE_ADDR */
646
        if (sd->spi)
647
            goto bad_cmd;
648
        switch (sd->state) {
649
        case sd_identification_state:
650
        case sd_standby_state:
651
            sd->state = sd_standby_state;
652
            sd_set_rca(sd);
653
            return sd_r6;
654

    
655
        default:
656
            break;
657
        }
658
        break;
659

    
660
    case 4:        /* CMD4:   SEND_DSR */
661
        if (sd->spi)
662
            goto bad_cmd;
663
        switch (sd->state) {
664
        case sd_standby_state:
665
            break;
666

    
667
        default:
668
            break;
669
        }
670
        break;
671

    
672
    case 6:        /* CMD6:   SWITCH_FUNCTION */
673
        if (sd->spi)
674
            goto bad_cmd;
675
        switch (sd->mode) {
676
        case sd_data_transfer_mode:
677
            sd_function_switch(sd, req.arg);
678
            sd->state = sd_sendingdata_state;
679
            sd->data_start = 0;
680
            sd->data_offset = 0;
681
            return sd_r1;
682

    
683
        default:
684
            break;
685
        }
686
        break;
687

    
688
    case 7:        /* CMD7:   SELECT/DESELECT_CARD */
689
        if (sd->spi)
690
            goto bad_cmd;
691
        switch (sd->state) {
692
        case sd_standby_state:
693
            if (sd->rca != rca)
694
                return sd_r0;
695

    
696
            sd->state = sd_transfer_state;
697
            return sd_r1b;
698

    
699
        case sd_transfer_state:
700
        case sd_sendingdata_state:
701
            if (sd->rca == rca)
702
                break;
703

    
704
            sd->state = sd_standby_state;
705
            return sd_r1b;
706

    
707
        case sd_disconnect_state:
708
            if (sd->rca != rca)
709
                return sd_r0;
710

    
711
            sd->state = sd_programming_state;
712
            return sd_r1b;
713

    
714
        case sd_programming_state:
715
            if (sd->rca == rca)
716
                break;
717

    
718
            sd->state = sd_disconnect_state;
719
            return sd_r1b;
720

    
721
        default:
722
            break;
723
        }
724
        break;
725

    
726
    case 8:        /* CMD8:   SEND_IF_COND */
727
        /* Physical Layer Specification Version 2.00 command */
728
        switch (sd->state) {
729
        case sd_idle_state:
730
            sd->vhs = 0;
731

    
732
            /* No response if not exactly one VHS bit is set.  */
733
            if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff)))
734
                return sd->spi ? sd_r7 : sd_r0;
735

    
736
            /* Accept.  */
737
            sd->vhs = req.arg;
738
            return sd_r7;
739

    
740
        default:
741
            break;
742
        }
743
        break;
744

    
745
    case 9:        /* CMD9:   SEND_CSD */
746
        switch (sd->state) {
747
        case sd_standby_state:
748
            if (sd->rca != rca)
749
                return sd_r0;
750

    
751
            return sd_r2_s;
752

    
753
        case sd_transfer_state:
754
            if (!sd->spi)
755
                break;
756
            sd->state = sd_sendingdata_state;
757
            memcpy(sd->data, sd->csd, 16);
758
            sd->data_start = addr;
759
            sd->data_offset = 0;
760
            return sd_r1;
761

    
762
        default:
763
            break;
764
        }
765
        break;
766

    
767
    case 10:        /* CMD10:  SEND_CID */
768
        switch (sd->state) {
769
        case sd_standby_state:
770
            if (sd->rca != rca)
771
                return sd_r0;
772

    
773
            return sd_r2_i;
774

    
775
        case sd_transfer_state:
776
            if (!sd->spi)
777
                break;
778
            sd->state = sd_sendingdata_state;
779
            memcpy(sd->data, sd->cid, 16);
780
            sd->data_start = addr;
781
            sd->data_offset = 0;
782
            return sd_r1;
783

    
784
        default:
785
            break;
786
        }
787
        break;
788

    
789
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
790
        if (sd->spi)
791
            goto bad_cmd;
792
        switch (sd->state) {
793
        case sd_transfer_state:
794
            sd->state = sd_sendingdata_state;
795
            sd->data_start = req.arg;
796
            sd->data_offset = 0;
797

    
798
            if (sd->data_start + sd->blk_len > sd->size)
799
                sd->card_status |= ADDRESS_ERROR;
800
            return sd_r0;
801

    
802
        default:
803
            break;
804
        }
805
        break;
806

    
807
    case 12:        /* CMD12:  STOP_TRANSMISSION */
808
        switch (sd->state) {
809
        case sd_sendingdata_state:
810
            sd->state = sd_transfer_state;
811
            return sd_r1b;
812

    
813
        case sd_receivingdata_state:
814
            sd->state = sd_programming_state;
815
            /* Bzzzzzzztt .... Operation complete.  */
816
            sd->state = sd_transfer_state;
817
            return sd_r1b;
818

    
819
        default:
820
            break;
821
        }
822
        break;
823

    
824
    case 13:        /* CMD13:  SEND_STATUS */
825
        switch (sd->mode) {
826
        case sd_data_transfer_mode:
827
            if (sd->rca != rca)
828
                return sd_r0;
829

    
830
            return sd_r1;
831

    
832
        default:
833
            break;
834
        }
835
        break;
836

    
837
    case 15:        /* CMD15:  GO_INACTIVE_STATE */
838
        if (sd->spi)
839
            goto bad_cmd;
840
        switch (sd->mode) {
841
        case sd_data_transfer_mode:
842
            if (sd->rca != rca)
843
                return sd_r0;
844

    
845
            sd->state = sd_inactive_state;
846
            return sd_r0;
847

    
848
        default:
849
            break;
850
        }
851
        break;
852

    
853
    /* Block read commands (Classs 2) */
854
    case 16:        /* CMD16:  SET_BLOCKLEN */
855
        switch (sd->state) {
856
        case sd_transfer_state:
857
            if (req.arg > (1 << HWBLOCK_SHIFT))
858
                sd->card_status |= BLOCK_LEN_ERROR;
859
            else
860
                sd->blk_len = req.arg;
861

    
862
            return sd_r1;
863

    
864
        default:
865
            break;
866
        }
867
        break;
868

    
869
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
870
        switch (sd->state) {
871
        case sd_transfer_state:
872
            sd->state = sd_sendingdata_state;
873
            sd->data_start = addr;
874
            sd->data_offset = 0;
875

    
876
            if (sd->data_start + sd->blk_len > sd->size)
877
                sd->card_status |= ADDRESS_ERROR;
878
            return sd_r1;
879

    
880
        default:
881
            break;
882
        }
883
        break;
884

    
885
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
886
        switch (sd->state) {
887
        case sd_transfer_state:
888
            sd->state = sd_sendingdata_state;
889
            sd->data_start = addr;
890
            sd->data_offset = 0;
891

    
892
            if (sd->data_start + sd->blk_len > sd->size)
893
                sd->card_status |= ADDRESS_ERROR;
894
            return sd_r1;
895

    
896
        default:
897
            break;
898
        }
899
        break;
900

    
901
    /* Block write commands (Class 4) */
902
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
903
        if (sd->spi)
904
            goto unimplemented_cmd;
905
        switch (sd->state) {
906
        case sd_transfer_state:
907
            /* Writing in SPI mode not implemented.  */
908
            if (sd->spi)
909
                break;
910
            sd->state = sd_receivingdata_state;
911
            sd->data_start = addr;
912
            sd->data_offset = 0;
913
            sd->blk_written = 0;
914

    
915
            if (sd->data_start + sd->blk_len > sd->size)
916
                sd->card_status |= ADDRESS_ERROR;
917
            if (sd_wp_addr(sd, sd->data_start))
918
                sd->card_status |= WP_VIOLATION;
919
            if (sd->csd[14] & 0x30)
920
                sd->card_status |= WP_VIOLATION;
921
            return sd_r1;
922

    
923
        default:
924
            break;
925
        }
926
        break;
927

    
928
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
929
        if (sd->spi)
930
            goto unimplemented_cmd;
931
        switch (sd->state) {
932
        case sd_transfer_state:
933
            /* Writing in SPI mode not implemented.  */
934
            if (sd->spi)
935
                break;
936
            sd->state = sd_receivingdata_state;
937
            sd->data_start = addr;
938
            sd->data_offset = 0;
939
            sd->blk_written = 0;
940

    
941
            if (sd->data_start + sd->blk_len > sd->size)
942
                sd->card_status |= ADDRESS_ERROR;
943
            if (sd_wp_addr(sd, sd->data_start))
944
                sd->card_status |= WP_VIOLATION;
945
            if (sd->csd[14] & 0x30)
946
                sd->card_status |= WP_VIOLATION;
947
            return sd_r1;
948

    
949
        default:
950
            break;
951
        }
952
        break;
953

    
954
    case 26:        /* CMD26:  PROGRAM_CID */
955
        if (sd->spi)
956
            goto bad_cmd;
957
        switch (sd->state) {
958
        case sd_transfer_state:
959
            sd->state = sd_receivingdata_state;
960
            sd->data_start = 0;
961
            sd->data_offset = 0;
962
            return sd_r1;
963

    
964
        default:
965
            break;
966
        }
967
        break;
968

    
969
    case 27:        /* CMD27:  PROGRAM_CSD */
970
        if (sd->spi)
971
            goto unimplemented_cmd;
972
        switch (sd->state) {
973
        case sd_transfer_state:
974
            sd->state = sd_receivingdata_state;
975
            sd->data_start = 0;
976
            sd->data_offset = 0;
977
            return sd_r1;
978

    
979
        default:
980
            break;
981
        }
982
        break;
983

    
984
    /* Write protection (Class 6) */
985
    case 28:        /* CMD28:  SET_WRITE_PROT */
986
        switch (sd->state) {
987
        case sd_transfer_state:
988
            if (addr >= sd->size) {
989
                sd->card_status = ADDRESS_ERROR;
990
                return sd_r1b;
991
            }
992

    
993
            sd->state = sd_programming_state;
994
            sd->wp_groups[addr >> (HWBLOCK_SHIFT +
995
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 1;
996
            /* Bzzzzzzztt .... Operation complete.  */
997
            sd->state = sd_transfer_state;
998
            return sd_r1b;
999

    
1000
        default:
1001
            break;
1002
        }
1003
        break;
1004

    
1005
    case 29:        /* CMD29:  CLR_WRITE_PROT */
1006
        switch (sd->state) {
1007
        case sd_transfer_state:
1008
            if (addr >= sd->size) {
1009
                sd->card_status = ADDRESS_ERROR;
1010
                return sd_r1b;
1011
            }
1012

    
1013
            sd->state = sd_programming_state;
1014
            sd->wp_groups[addr >> (HWBLOCK_SHIFT +
1015
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 0;
1016
            /* Bzzzzzzztt .... Operation complete.  */
1017
            sd->state = sd_transfer_state;
1018
            return sd_r1b;
1019

    
1020
        default:
1021
            break;
1022
        }
1023
        break;
1024

    
1025
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1026
        switch (sd->state) {
1027
        case sd_transfer_state:
1028
            sd->state = sd_sendingdata_state;
1029
            *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1030
            sd->data_start = addr;
1031
            sd->data_offset = 0;
1032
            return sd_r1b;
1033

    
1034
        default:
1035
            break;
1036
        }
1037
        break;
1038

    
1039
    /* Erase commands (Class 5) */
1040
    case 32:        /* CMD32:  ERASE_WR_BLK_START */
1041
        switch (sd->state) {
1042
        case sd_transfer_state:
1043
            sd->erase_start = req.arg;
1044
            return sd_r1;
1045

    
1046
        default:
1047
            break;
1048
        }
1049
        break;
1050

    
1051
    case 33:        /* CMD33:  ERASE_WR_BLK_END */
1052
        switch (sd->state) {
1053
        case sd_transfer_state:
1054
            sd->erase_end = req.arg;
1055
            return sd_r1;
1056

    
1057
        default:
1058
            break;
1059
        }
1060
        break;
1061

    
1062
    case 38:        /* CMD38:  ERASE */
1063
        switch (sd->state) {
1064
        case sd_transfer_state:
1065
            if (sd->csd[14] & 0x30) {
1066
                sd->card_status |= WP_VIOLATION;
1067
                return sd_r1b;
1068
            }
1069

    
1070
            sd->state = sd_programming_state;
1071
            sd_erase(sd);
1072
            /* Bzzzzzzztt .... Operation complete.  */
1073
            sd->state = sd_transfer_state;
1074
            return sd_r1b;
1075

    
1076
        default:
1077
            break;
1078
        }
1079
        break;
1080

    
1081
    /* Lock card commands (Class 7) */
1082
    case 42:        /* CMD42:  LOCK_UNLOCK */
1083
        if (sd->spi)
1084
            goto unimplemented_cmd;
1085
        switch (sd->state) {
1086
        case sd_transfer_state:
1087
            sd->state = sd_receivingdata_state;
1088
            sd->data_start = 0;
1089
            sd->data_offset = 0;
1090
            return sd_r1;
1091

    
1092
        default:
1093
            break;
1094
        }
1095
        break;
1096

    
1097
    /* Application specific commands (Class 8) */
1098
    case 55:        /* CMD55:  APP_CMD */
1099
        if (sd->rca != rca)
1100
            return sd_r0;
1101

    
1102
        sd->card_status |= APP_CMD;
1103
        return sd_r1;
1104

    
1105
    case 56:        /* CMD56:  GEN_CMD */
1106
        fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1107

    
1108
        switch (sd->state) {
1109
        case sd_transfer_state:
1110
            sd->data_offset = 0;
1111
            if (req.arg & 1)
1112
                sd->state = sd_sendingdata_state;
1113
            else
1114
                sd->state = sd_receivingdata_state;
1115
            return sd_r1;
1116

    
1117
        default:
1118
            break;
1119
        }
1120
        break;
1121

    
1122
    default:
1123
    bad_cmd:
1124
        sd->card_status |= ILLEGAL_COMMAND;
1125

    
1126
        fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd);
1127
        return sd_r0;
1128

    
1129
    unimplemented_cmd:
1130
        /* Commands that are recognised but not yet implemented in SPI mode.  */
1131
        sd->card_status |= ILLEGAL_COMMAND;
1132
        fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd);
1133
        return sd_r0;
1134
    }
1135

    
1136
    sd->card_status |= ILLEGAL_COMMAND;
1137
    fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd);
1138
    return sd_r0;
1139
}
1140

    
1141
static sd_rsp_type_t sd_app_command(SDState *sd,
1142
                                    SDRequest req) {
1143
    uint32_t rca;
1144

    
1145
    if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
1146
        rca = req.arg >> 16;
1147

    
1148
    DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1149
    switch (req.cmd) {
1150
    case 6:        /* ACMD6:  SET_BUS_WIDTH */
1151
        switch (sd->state) {
1152
        case sd_transfer_state:
1153
            sd->sd_status[0] &= 0x3f;
1154
            sd->sd_status[0] |= (req.arg & 0x03) << 6;
1155
            return sd_r1;
1156

    
1157
        default:
1158
            break;
1159
        }
1160
        break;
1161

    
1162
    case 13:        /* ACMD13: SD_STATUS */
1163
        switch (sd->state) {
1164
        case sd_transfer_state:
1165
            sd->data_start = 0;
1166
            sd->data_offset = 0;
1167
            return sd_r1;
1168

    
1169
        default:
1170
            break;
1171
        }
1172
        break;
1173

    
1174
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1175
        switch (sd->state) {
1176
        case sd_transfer_state:
1177
            *(uint32_t *) sd->data = sd->blk_written;
1178

    
1179
            sd->data_start = 0;
1180
            sd->data_offset = 0;
1181
            return sd_r1;
1182

    
1183
        default:
1184
            break;
1185
        }
1186
        break;
1187

    
1188
    case 23:        /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1189
        switch (sd->state) {
1190
        case sd_transfer_state:
1191
            return sd_r1;
1192

    
1193
        default:
1194
            break;
1195
        }
1196
        break;
1197

    
1198
    case 41:        /* ACMD41: SD_APP_OP_COND */
1199
        if (sd->spi) {
1200
            /* SEND_OP_CMD */
1201
            sd->state = sd_transfer_state;
1202
            return sd_r1;
1203
        }
1204
        switch (sd->state) {
1205
        case sd_idle_state:
1206
            /* We accept any voltage.  10000 V is nothing.  */
1207
            if (req.arg)
1208
                sd->state = sd_ready_state;
1209

    
1210
            return sd_r3;
1211

    
1212
        default:
1213
            break;
1214
        }
1215
        break;
1216

    
1217
    case 42:        /* ACMD42: SET_CLR_CARD_DETECT */
1218
        switch (sd->state) {
1219
        case sd_transfer_state:
1220
            /* Bringing in the 50KOhm pull-up resistor... Done.  */
1221
            return sd_r1;
1222

    
1223
        default:
1224
            break;
1225
        }
1226
        break;
1227

    
1228
    case 51:        /* ACMD51: SEND_SCR */
1229
        switch (sd->state) {
1230
        case sd_transfer_state:
1231
            sd->state = sd_sendingdata_state;
1232
            sd->data_start = 0;
1233
            sd->data_offset = 0;
1234
            return sd_r1;
1235

    
1236
        default:
1237
            break;
1238
        }
1239
        break;
1240

    
1241
    default:
1242
        /* Fall back to standard commands.  */
1243
        sd->card_status &= ~APP_CMD;
1244
        return sd_normal_command(sd, req);
1245
    }
1246

    
1247
    fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd);
1248
    return sd_r0;
1249
}
1250

    
1251
int sd_do_command(SDState *sd, SDRequest *req,
1252
                  uint8_t *response) {
1253
    uint32_t last_status = sd->card_status;
1254
    sd_rsp_type_t rtype;
1255
    int rsplen;
1256

    
1257
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) {
1258
        return 0;
1259
    }
1260

    
1261
    if (sd_req_crc_validate(req)) {
1262
        sd->card_status &= ~COM_CRC_ERROR;
1263
        return 0;
1264
    }
1265

    
1266
    sd->card_status &= ~CARD_STATUS_B;
1267
    sd_set_status(sd);
1268

    
1269
    if (last_status & CARD_IS_LOCKED)
1270
        if (((last_status & APP_CMD) &&
1271
                                 req->cmd == 41) ||
1272
                        (!(last_status & APP_CMD) &&
1273
                         (sd_cmd_class[req->cmd] == 0 ||
1274
                          sd_cmd_class[req->cmd] == 7 ||
1275
                          req->cmd == 16 || req->cmd == 55))) {
1276
            sd->card_status |= ILLEGAL_COMMAND;
1277
            fprintf(stderr, "SD: Card is locked\n");
1278
            return 0;
1279
        }
1280

    
1281
    if (last_status & APP_CMD) {
1282
        rtype = sd_app_command(sd, *req);
1283
        sd->card_status &= ~APP_CMD;
1284
    } else
1285
        rtype = sd_normal_command(sd, *req);
1286

    
1287
    sd->current_cmd = req->cmd;
1288

    
1289
    switch (rtype) {
1290
    case sd_r1:
1291
    case sd_r1b:
1292
        sd_response_r1_make(sd, response, last_status);
1293
        rsplen = 4;
1294
        break;
1295

    
1296
    case sd_r2_i:
1297
        memcpy(response, sd->cid, sizeof(sd->cid));
1298
        rsplen = 16;
1299
        break;
1300

    
1301
    case sd_r2_s:
1302
        memcpy(response, sd->csd, sizeof(sd->csd));
1303
        rsplen = 16;
1304
        break;
1305

    
1306
    case sd_r3:
1307
        sd_response_r3_make(sd, response);
1308
        rsplen = 4;
1309
        break;
1310

    
1311
    case sd_r6:
1312
        sd_response_r6_make(sd, response);
1313
        rsplen = 4;
1314
        break;
1315

    
1316
    case sd_r7:
1317
        sd_response_r7_make(sd, response);
1318
        rsplen = 4;
1319
        break;
1320

    
1321
    case sd_r0:
1322
    default:
1323
        rsplen = 0;
1324
        break;
1325
    }
1326

    
1327
    if (sd->card_status & ILLEGAL_COMMAND)
1328
        rsplen = 0;
1329

    
1330
#ifdef DEBUG_SD
1331
    if (rsplen) {
1332
        int i;
1333
        DPRINTF("Response:");
1334
        for (i = 0; i < rsplen; i++)
1335
            printf(" %02x", response[i]);
1336
        printf(" state %d\n", sd->state);
1337
    } else {
1338
        DPRINTF("No response %d\n", sd->state);
1339
    }
1340
#endif
1341

    
1342
    return rsplen;
1343
}
1344

    
1345
static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1346
{
1347
    uint64_t end = addr + len;
1348

    
1349
    DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
1350
            (unsigned long long) addr, len);
1351
    if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1352
        fprintf(stderr, "sd_blk_read: read error on host side\n");
1353
        return;
1354
    }
1355

    
1356
    if (end > (addr & ~511) + 512) {
1357
        memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511));
1358

    
1359
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1360
            fprintf(stderr, "sd_blk_read: read error on host side\n");
1361
            return;
1362
        }
1363
        memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511);
1364
    } else
1365
        memcpy(sd->data, sd->buf + (addr & 511), len);
1366
}
1367

    
1368
static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1369
{
1370
    uint64_t end = addr + len;
1371

    
1372
    if ((addr & 511) || len < 512)
1373
        if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1374
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1375
            return;
1376
        }
1377

    
1378
    if (end > (addr & ~511) + 512) {
1379
        memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511));
1380
        if (bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1381
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1382
            return;
1383
        }
1384

    
1385
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1386
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1387
            return;
1388
        }
1389
        memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511);
1390
        if (bdrv_write(sd->bdrv, end >> 9, sd->buf, 1) == -1)
1391
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1392
    } else {
1393
        memcpy(sd->buf + (addr & 511), sd->data, len);
1394
        if (!sd->bdrv || bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1)
1395
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1396
    }
1397
}
1398

    
1399
#define BLK_READ_BLOCK(a, len)        sd_blk_read(sd, a, len)
1400
#define BLK_WRITE_BLOCK(a, len)        sd_blk_write(sd, a, len)
1401
#define APP_READ_BLOCK(a, len)        memset(sd->data, 0xec, len)
1402
#define APP_WRITE_BLOCK(a, len)
1403

    
1404
void sd_write_data(SDState *sd, uint8_t value)
1405
{
1406
    int i;
1407

    
1408
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1409
        return;
1410

    
1411
    if (sd->state != sd_receivingdata_state) {
1412
        fprintf(stderr, "sd_write_data: not in Receiving-Data state\n");
1413
        return;
1414
    }
1415

    
1416
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1417
        return;
1418

    
1419
    switch (sd->current_cmd) {
1420
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
1421
        sd->data[sd->data_offset ++] = value;
1422
        if (sd->data_offset >= sd->blk_len) {
1423
            /* TODO: Check CRC before committing */
1424
            sd->state = sd_programming_state;
1425
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1426
            sd->blk_written ++;
1427
            sd->csd[14] |= 0x40;
1428
            /* Bzzzzzzztt .... Operation complete.  */
1429
            sd->state = sd_transfer_state;
1430
        }
1431
        break;
1432

    
1433
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
1434
        sd->data[sd->data_offset ++] = value;
1435
        if (sd->data_offset >= sd->blk_len) {
1436
            /* TODO: Check CRC before committing */
1437
            sd->state = sd_programming_state;
1438
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1439
            sd->blk_written ++;
1440
            sd->data_start += sd->blk_len;
1441
            sd->data_offset = 0;
1442
            if (sd->data_start + sd->blk_len > sd->size) {
1443
                sd->card_status |= ADDRESS_ERROR;
1444
                break;
1445
            }
1446
            if (sd_wp_addr(sd, sd->data_start)) {
1447
                sd->card_status |= WP_VIOLATION;
1448
                break;
1449
            }
1450
            sd->csd[14] |= 0x40;
1451

    
1452
            /* Bzzzzzzztt .... Operation complete.  */
1453
            sd->state = sd_receivingdata_state;
1454
        }
1455
        break;
1456

    
1457
    case 26:        /* CMD26:  PROGRAM_CID */
1458
        sd->data[sd->data_offset ++] = value;
1459
        if (sd->data_offset >= sizeof(sd->cid)) {
1460
            /* TODO: Check CRC before committing */
1461
            sd->state = sd_programming_state;
1462
            for (i = 0; i < sizeof(sd->cid); i ++)
1463
                if ((sd->cid[i] | 0x00) != sd->data[i])
1464
                    sd->card_status |= CID_CSD_OVERWRITE;
1465

    
1466
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1467
                for (i = 0; i < sizeof(sd->cid); i ++) {
1468
                    sd->cid[i] |= 0x00;
1469
                    sd->cid[i] &= sd->data[i];
1470
                }
1471
            /* Bzzzzzzztt .... Operation complete.  */
1472
            sd->state = sd_transfer_state;
1473
        }
1474
        break;
1475

    
1476
    case 27:        /* CMD27:  PROGRAM_CSD */
1477
        sd->data[sd->data_offset ++] = value;
1478
        if (sd->data_offset >= sizeof(sd->csd)) {
1479
            /* TODO: Check CRC before committing */
1480
            sd->state = sd_programming_state;
1481
            for (i = 0; i < sizeof(sd->csd); i ++)
1482
                if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1483
                    (sd->data[i] | sd_csd_rw_mask[i]))
1484
                    sd->card_status |= CID_CSD_OVERWRITE;
1485

    
1486
            /* Copy flag (OTP) & Permanent write protect */
1487
            if (sd->csd[14] & ~sd->data[14] & 0x60)
1488
                sd->card_status |= CID_CSD_OVERWRITE;
1489

    
1490
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1491
                for (i = 0; i < sizeof(sd->csd); i ++) {
1492
                    sd->csd[i] |= sd_csd_rw_mask[i];
1493
                    sd->csd[i] &= sd->data[i];
1494
                }
1495
            /* Bzzzzzzztt .... Operation complete.  */
1496
            sd->state = sd_transfer_state;
1497
        }
1498
        break;
1499

    
1500
    case 42:        /* CMD42:  LOCK_UNLOCK */
1501
        sd->data[sd->data_offset ++] = value;
1502
        if (sd->data_offset >= sd->blk_len) {
1503
            /* TODO: Check CRC before committing */
1504
            sd->state = sd_programming_state;
1505
            sd_lock_command(sd);
1506
            /* Bzzzzzzztt .... Operation complete.  */
1507
            sd->state = sd_transfer_state;
1508
        }
1509
        break;
1510

    
1511
    case 56:        /* CMD56:  GEN_CMD */
1512
        sd->data[sd->data_offset ++] = value;
1513
        if (sd->data_offset >= sd->blk_len) {
1514
            APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1515
            sd->state = sd_transfer_state;
1516
        }
1517
        break;
1518

    
1519
    default:
1520
        fprintf(stderr, "sd_write_data: unknown command\n");
1521
        break;
1522
    }
1523
}
1524

    
1525
uint8_t sd_read_data(SDState *sd)
1526
{
1527
    /* TODO: Append CRCs */
1528
    uint8_t ret;
1529
    int io_len;
1530

    
1531
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1532
        return 0x00;
1533

    
1534
    if (sd->state != sd_sendingdata_state) {
1535
        fprintf(stderr, "sd_read_data: not in Sending-Data state\n");
1536
        return 0x00;
1537
    }
1538

    
1539
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1540
        return 0x00;
1541

    
1542
    io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1543

    
1544
    switch (sd->current_cmd) {
1545
    case 6:        /* CMD6:   SWITCH_FUNCTION */
1546
        ret = sd->data[sd->data_offset ++];
1547

    
1548
        if (sd->data_offset >= 64)
1549
            sd->state = sd_transfer_state;
1550
        break;
1551

    
1552
    case 9:        /* CMD9:   SEND_CSD */
1553
    case 10:        /* CMD10:  SEND_CID */
1554
        ret = sd->data[sd->data_offset ++];
1555

    
1556
        if (sd->data_offset >= 16)
1557
            sd->state = sd_transfer_state;
1558
        break;
1559

    
1560
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
1561
        if (sd->data_offset == 0)
1562
            BLK_READ_BLOCK(sd->data_start, io_len);
1563
        ret = sd->data[sd->data_offset ++];
1564

    
1565
        if (sd->data_offset >= io_len) {
1566
            sd->data_start += io_len;
1567
            sd->data_offset = 0;
1568
            if (sd->data_start + io_len > sd->size) {
1569
                sd->card_status |= ADDRESS_ERROR;
1570
                break;
1571
            }
1572
        }
1573
        break;
1574

    
1575
    case 13:        /* ACMD13: SD_STATUS */
1576
        ret = sd->sd_status[sd->data_offset ++];
1577

    
1578
        if (sd->data_offset >= sizeof(sd->sd_status))
1579
            sd->state = sd_transfer_state;
1580
        break;
1581

    
1582
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
1583
        if (sd->data_offset == 0)
1584
            BLK_READ_BLOCK(sd->data_start, io_len);
1585
        ret = sd->data[sd->data_offset ++];
1586

    
1587
        if (sd->data_offset >= io_len)
1588
            sd->state = sd_transfer_state;
1589
        break;
1590

    
1591
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
1592
        if (sd->data_offset == 0)
1593
            BLK_READ_BLOCK(sd->data_start, io_len);
1594
        ret = sd->data[sd->data_offset ++];
1595

    
1596
        if (sd->data_offset >= io_len) {
1597
            sd->data_start += io_len;
1598
            sd->data_offset = 0;
1599
            if (sd->data_start + io_len > sd->size) {
1600
                sd->card_status |= ADDRESS_ERROR;
1601
                break;
1602
            }
1603
        }
1604
        break;
1605

    
1606
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1607
        ret = sd->data[sd->data_offset ++];
1608

    
1609
        if (sd->data_offset >= 4)
1610
            sd->state = sd_transfer_state;
1611
        break;
1612

    
1613
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1614
        ret = sd->data[sd->data_offset ++];
1615

    
1616
        if (sd->data_offset >= 4)
1617
            sd->state = sd_transfer_state;
1618
        break;
1619

    
1620
    case 51:        /* ACMD51: SEND_SCR */
1621
        ret = sd->scr[sd->data_offset ++];
1622

    
1623
        if (sd->data_offset >= sizeof(sd->scr))
1624
            sd->state = sd_transfer_state;
1625
        break;
1626

    
1627
    case 56:        /* CMD56:  GEN_CMD */
1628
        if (sd->data_offset == 0)
1629
            APP_READ_BLOCK(sd->data_start, sd->blk_len);
1630
        ret = sd->data[sd->data_offset ++];
1631

    
1632
        if (sd->data_offset >= sd->blk_len)
1633
            sd->state = sd_transfer_state;
1634
        break;
1635

    
1636
    default:
1637
        fprintf(stderr, "sd_read_data: unknown command\n");
1638
        return 0x00;
1639
    }
1640

    
1641
    return ret;
1642
}
1643

    
1644
int sd_data_ready(SDState *sd)
1645
{
1646
    return sd->state == sd_sendingdata_state;
1647
}
1648

    
1649
void sd_enable(SDState *sd, int enable)
1650
{
1651
    sd->enable = enable;
1652
}