Statistics
| Branch: | Revision:

root / hw / sd.c @ bc24a225

History | View | Annotate | Download (44.5 kB)

1
/*
2
 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3
 * layer specification, Version 1.10."
4
 *
5
 * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
6
 * Copyright (c) 2007 CodeSourcery
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 * 2. Redistributions in binary form must reproduce the above copyright
15
 *    notice, this list of conditions and the following disclaimer in
16
 *    the documentation and/or other materials provided with the
17
 *    distribution.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22
 * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31

    
32
#include "hw.h"
33
#include "block.h"
34
#include "sd.h"
35

    
36
//#define DEBUG_SD 1
37

    
38
#ifdef DEBUG_SD
39
#define DPRINTF(fmt, args...) \
40
do { fprintf(stderr, "SD: " fmt , ##args); } while (0)
41
#else
42
#define DPRINTF(fmt, args...) do {} while(0)
43
#endif
44

    
45
typedef enum {
46
    sd_r0 = 0,    /* no response */
47
    sd_r1,        /* normal response command */
48
    sd_r2_i,      /* CID register */
49
    sd_r2_s,      /* CSD register */
50
    sd_r3,        /* OCR register */
51
    sd_r6 = 6,    /* Published RCA response */
52
    sd_r7,        /* Operating voltage */
53
    sd_r1b = -1,
54
} sd_rsp_type_t;
55

    
56
struct SDState {
57
    enum {
58
        sd_inactive,
59
        sd_card_identification_mode,
60
        sd_data_transfer_mode,
61
    } mode;
62
    enum {
63
        sd_inactive_state = -1,
64
        sd_idle_state = 0,
65
        sd_ready_state,
66
        sd_identification_state,
67
        sd_standby_state,
68
        sd_transfer_state,
69
        sd_sendingdata_state,
70
        sd_receivingdata_state,
71
        sd_programming_state,
72
        sd_disconnect_state,
73
    } state;
74
    uint32_t ocr;
75
    uint8_t scr[8];
76
    uint8_t cid[16];
77
    uint8_t csd[16];
78
    uint16_t rca;
79
    uint32_t card_status;
80
    uint8_t sd_status[64];
81
    uint32_t vhs;
82
    int wp_switch;
83
    int *wp_groups;
84
    uint32_t size;
85
    int blk_len;
86
    uint32_t erase_start;
87
    uint32_t erase_end;
88
    uint8_t pwd[16];
89
    int pwd_len;
90
    int function_group[6];
91

    
92
    int spi;
93
    int current_cmd;
94
    int blk_written;
95
    uint32_t data_start;
96
    uint32_t data_offset;
97
    uint8_t data[512];
98
    qemu_irq readonly_cb;
99
    qemu_irq inserted_cb;
100
    BlockDriverState *bdrv;
101
    uint8_t *buf;
102

    
103
    int enable;
104
};
105

    
106
static void sd_set_status(SDState *sd)
107
{
108
    switch (sd->state) {
109
    case sd_inactive_state:
110
        sd->mode = sd_inactive;
111
        break;
112

    
113
    case sd_idle_state:
114
    case sd_ready_state:
115
    case sd_identification_state:
116
        sd->mode = sd_card_identification_mode;
117
        break;
118

    
119
    case sd_standby_state:
120
    case sd_transfer_state:
121
    case sd_sendingdata_state:
122
    case sd_receivingdata_state:
123
    case sd_programming_state:
124
    case sd_disconnect_state:
125
        sd->mode = sd_data_transfer_mode;
126
        break;
127
    }
128

    
129
    sd->card_status &= ~CURRENT_STATE;
130
    sd->card_status |= sd->state << 9;
131
}
132

    
133
static const sd_cmd_type_t sd_cmd_type[64] = {
134
    sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
135
    sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
136
    sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
137
    sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
138
    sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
139
    sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
140
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
141
    sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
142
};
143

    
144
static const sd_cmd_type_t sd_acmd_type[64] = {
145
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
146
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none,
147
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac,
148
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
149
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
150
    sd_none, sd_bcr,  sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_none,
151
    sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none,
152
    sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
153
};
154

    
155
static const int sd_cmd_class[64] = {
156
    0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
157
    2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
158
    5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
159
    7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,
160
};
161

    
162
static uint8_t sd_crc7(void *message, size_t width)
163
{
164
    int i, bit;
165
    uint8_t shift_reg = 0x00;
166
    uint8_t *msg = (uint8_t *) message;
167

    
168
    for (i = 0; i < width; i ++, msg ++)
169
        for (bit = 7; bit >= 0; bit --) {
170
            shift_reg <<= 1;
171
            if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
172
                shift_reg ^= 0x89;
173
        }
174

    
175
    return shift_reg;
176
}
177

    
178
static uint16_t sd_crc16(void *message, size_t width)
179
{
180
    int i, bit;
181
    uint16_t shift_reg = 0x0000;
182
    uint16_t *msg = (uint16_t *) message;
183
    width <<= 1;
184

    
185
    for (i = 0; i < width; i ++, msg ++)
186
        for (bit = 15; bit >= 0; bit --) {
187
            shift_reg <<= 1;
188
            if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
189
                shift_reg ^= 0x1011;
190
        }
191

    
192
    return shift_reg;
193
}
194

    
195
static void sd_set_ocr(SDState *sd)
196
{
197
    /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */
198
    sd->ocr = 0x80ffff00;
199
}
200

    
201
static void sd_set_scr(SDState *sd)
202
{
203
    sd->scr[0] = 0x00;                /* SCR Structure */
204
    sd->scr[1] = 0x2f;                /* SD Security Support */
205
    sd->scr[2] = 0x00;
206
    sd->scr[3] = 0x00;
207
    sd->scr[4] = 0x00;
208
    sd->scr[5] = 0x00;
209
    sd->scr[6] = 0x00;
210
    sd->scr[7] = 0x00;
211
}
212

    
213
#define MID        0xaa
214
#define OID        "XY"
215
#define PNM        "QEMU!"
216
#define PRV        0x01
217
#define MDT_YR        2006
218
#define MDT_MON        2
219

    
220
static void sd_set_cid(SDState *sd)
221
{
222
    sd->cid[0] = MID;                /* Fake card manufacturer ID (MID) */
223
    sd->cid[1] = OID[0];        /* OEM/Application ID (OID) */
224
    sd->cid[2] = OID[1];
225
    sd->cid[3] = PNM[0];        /* Fake product name (PNM) */
226
    sd->cid[4] = PNM[1];
227
    sd->cid[5] = PNM[2];
228
    sd->cid[6] = PNM[3];
229
    sd->cid[7] = PNM[4];
230
    sd->cid[8] = PRV;                /* Fake product revision (PRV) */
231
    sd->cid[9] = 0xde;                /* Fake serial number (PSN) */
232
    sd->cid[10] = 0xad;
233
    sd->cid[11] = 0xbe;
234
    sd->cid[12] = 0xef;
235
    sd->cid[13] = 0x00 |        /* Manufacture date (MDT) */
236
        ((MDT_YR - 2000) / 10);
237
    sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
238
    sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
239
}
240

    
241
#define HWBLOCK_SHIFT        9                        /* 512 bytes */
242
#define SECTOR_SHIFT        5                        /* 16 kilobytes */
243
#define WPGROUP_SHIFT        7                        /* 2 megs */
244
#define CMULT_SHIFT        9                        /* 512 times HWBLOCK_SIZE */
245
#define WPGROUP_SIZE        (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
246

    
247
static const uint8_t sd_csd_rw_mask[16] = {
248
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
250
};
251

    
252
static void sd_set_csd(SDState *sd, uint32_t size)
253
{
254
    uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
255
    uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
256
    uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
257

    
258
    sd->csd[0] = 0x00;                /* CSD structure */
259
    sd->csd[1] = 0x26;                /* Data read access-time-1 */
260
    sd->csd[2] = 0x00;                /* Data read access-time-2 */
261
    sd->csd[3] = 0x5a;                /* Max. data transfer rate */
262
    sd->csd[4] = 0x5f;                /* Card Command Classes */
263
    sd->csd[5] = 0x50 |                /* Max. read data block length */
264
        HWBLOCK_SHIFT;
265
    sd->csd[6] = 0xe0 |                /* Partial block for read allowed */
266
        ((csize >> 10) & 0x03);
267
    sd->csd[7] = 0x00 |                /* Device size */
268
        ((csize >> 2) & 0xff);
269
    sd->csd[8] = 0x3f |                /* Max. read current */
270
        ((csize << 6) & 0xc0);
271
    sd->csd[9] = 0xfc |                /* Max. write current */
272
        ((CMULT_SHIFT - 2) >> 1);
273
    sd->csd[10] = 0x40 |        /* Erase sector size */
274
        (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
275
    sd->csd[11] = 0x00 |        /* Write protect group size */
276
        ((sectsize << 7) & 0x80) | wpsize;
277
    sd->csd[12] = 0x90 |        /* Write speed factor */
278
        (HWBLOCK_SHIFT >> 2);
279
    sd->csd[13] = 0x20 |        /* Max. write data block length */
280
        ((HWBLOCK_SHIFT << 6) & 0xc0);
281
    sd->csd[14] = 0x00;                /* File format group */
282
    sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
283
}
284

    
285
static void sd_set_rca(SDState *sd)
286
{
287
    sd->rca += 0x4567;
288
}
289

    
290
#define CARD_STATUS_A        0x02004100
291
#define CARD_STATUS_B        0x00c01e00
292
#define CARD_STATUS_C        0xfd39a028
293

    
294
static void sd_set_cardstatus(SDState *sd)
295
{
296
    sd->card_status = 0x00000100;
297
}
298

    
299
static void sd_set_sdstatus(SDState *sd)
300
{
301
    memset(sd->sd_status, 0, 64);
302
}
303

    
304
static int sd_req_crc_validate(SDRequest *req)
305
{
306
    uint8_t buffer[5];
307
    buffer[0] = 0x40 | req->cmd;
308
    buffer[1] = (req->arg >> 24) & 0xff;
309
    buffer[2] = (req->arg >> 16) & 0xff;
310
    buffer[3] = (req->arg >> 8) & 0xff;
311
    buffer[4] = (req->arg >> 0) & 0xff;
312
    return 0;
313
    return sd_crc7(buffer, 5) != req->crc;        /* TODO */
314
}
315

    
316
static void sd_response_r1_make(SDState *sd,
317
                                uint8_t *response, uint32_t last_status)
318
{
319
    uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;
320
    uint32_t status;
321

    
322
    status = (sd->card_status & ~mask) | (last_status & mask);
323
    sd->card_status &= ~CARD_STATUS_C | APP_CMD;
324

    
325
    response[0] = (status >> 24) & 0xff;
326
    response[1] = (status >> 16) & 0xff;
327
    response[2] = (status >> 8) & 0xff;
328
    response[3] = (status >> 0) & 0xff;
329
}
330

    
331
static void sd_response_r3_make(SDState *sd, uint8_t *response)
332
{
333
    response[0] = (sd->ocr >> 24) & 0xff;
334
    response[1] = (sd->ocr >> 16) & 0xff;
335
    response[2] = (sd->ocr >> 8) & 0xff;
336
    response[3] = (sd->ocr >> 0) & 0xff;
337
}
338

    
339
static void sd_response_r6_make(SDState *sd, uint8_t *response)
340
{
341
    uint16_t arg;
342
    uint16_t status;
343

    
344
    arg = sd->rca;
345
    status = ((sd->card_status >> 8) & 0xc000) |
346
             ((sd->card_status >> 6) & 0x2000) |
347
              (sd->card_status & 0x1fff);
348

    
349
    response[0] = (arg >> 8) & 0xff;
350
    response[1] = arg & 0xff;
351
    response[2] = (status >> 8) & 0xff;
352
    response[3] = status & 0xff;
353
}
354

    
355
static void sd_response_r7_make(SDState *sd, uint8_t *response)
356
{
357
    response[0] = (sd->vhs >> 24) & 0xff;
358
    response[1] = (sd->vhs >> 16) & 0xff;
359
    response[2] = (sd->vhs >>  8) & 0xff;
360
    response[3] = (sd->vhs >>  0) & 0xff;
361
}
362

    
363
static void sd_reset(SDState *sd, BlockDriverState *bdrv)
364
{
365
    uint32_t size;
366
    uint64_t sect;
367

    
368
    if (bdrv) {
369
        bdrv_get_geometry(bdrv, &sect);
370
    } else {
371
        sect = 0;
372
    }
373
    sect <<= 9;
374

    
375
    if (sect > 0x40000000)
376
        size = 0x40000000;        /* 1 gig */
377
    else
378
        size = sect + 1;
379

    
380
    sect = (size >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) + 1;
381

    
382
    sd->state = sd_idle_state;
383
    sd->rca = 0x0000;
384
    sd_set_ocr(sd);
385
    sd_set_scr(sd);
386
    sd_set_cid(sd);
387
    sd_set_csd(sd, size);
388
    sd_set_cardstatus(sd);
389
    sd_set_sdstatus(sd);
390

    
391
    sd->bdrv = bdrv;
392

    
393
    if (sd->wp_groups)
394
        qemu_free(sd->wp_groups);
395
    sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
396
    sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
397
    memset(sd->function_group, 0, sizeof(int) * 6);
398
    sd->erase_start = 0;
399
    sd->erase_end = 0;
400
    sd->size = size;
401
    sd->blk_len = 0x200;
402
    sd->pwd_len = 0;
403
}
404

    
405
static void sd_cardchange(void *opaque)
406
{
407
    SDState *sd = opaque;
408
    qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));
409
    if (bdrv_is_inserted(sd->bdrv)) {
410
        sd_reset(sd, sd->bdrv);
411
        qemu_set_irq(sd->readonly_cb, sd->wp_switch);
412
    }
413
}
414

    
415
/* We do not model the chip select pin, so allow the board to select
416
   whether card should be in SSI or MMC/SD mode.  It is also up to the
417
   board to ensure that ssi transfers only occur when the chip select
418
   is asserted.  */
419
SDState *sd_init(BlockDriverState *bs, int is_spi)
420
{
421
    SDState *sd;
422

    
423
    sd = (SDState *) qemu_mallocz(sizeof(SDState));
424
    sd->buf = qemu_memalign(512, 512);
425
    sd->spi = is_spi;
426
    sd->enable = 1;
427
    sd_reset(sd, bs);
428
    if (sd->bdrv) {
429
        bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);
430
    }
431
    return sd;
432
}
433

    
434
void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
435
{
436
    sd->readonly_cb = readonly;
437
    sd->inserted_cb = insert;
438
    qemu_set_irq(readonly, bdrv_is_read_only(sd->bdrv));
439
    qemu_set_irq(insert, bdrv_is_inserted(sd->bdrv));
440
}
441

    
442
static void sd_erase(SDState *sd)
443
{
444
    int i, start, end;
445
    if (!sd->erase_start || !sd->erase_end) {
446
        sd->card_status |= ERASE_SEQ_ERROR;
447
        return;
448
    }
449

    
450
    start = sd->erase_start >>
451
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
452
    end = sd->erase_end >>
453
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
454
    sd->erase_start = 0;
455
    sd->erase_end = 0;
456
    sd->csd[14] |= 0x40;
457

    
458
    for (i = start; i <= end; i ++)
459
        if (sd->wp_groups[i])
460
            sd->card_status |= WP_ERASE_SKIP;
461
}
462

    
463
static uint32_t sd_wpbits(SDState *sd, uint32_t addr)
464
{
465
    uint32_t i, wpnum;
466
    uint32_t ret = 0;
467

    
468
    wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
469

    
470
    for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)
471
        if (addr < sd->size && sd->wp_groups[wpnum])
472
            ret |= (1 << i);
473

    
474
    return ret;
475
}
476

    
477
static void sd_function_switch(SDState *sd, uint32_t arg)
478
{
479
    int i, mode, new_func, crc;
480
    mode = !!(arg & 0x80000000);
481

    
482
    sd->data[0] = 0x00;                /* Maximum current consumption */
483
    sd->data[1] = 0x01;
484
    sd->data[2] = 0x80;                /* Supported group 6 functions */
485
    sd->data[3] = 0x01;
486
    sd->data[4] = 0x80;                /* Supported group 5 functions */
487
    sd->data[5] = 0x01;
488
    sd->data[6] = 0x80;                /* Supported group 4 functions */
489
    sd->data[7] = 0x01;
490
    sd->data[8] = 0x80;                /* Supported group 3 functions */
491
    sd->data[9] = 0x01;
492
    sd->data[10] = 0x80;        /* Supported group 2 functions */
493
    sd->data[11] = 0x43;
494
    sd->data[12] = 0x80;        /* Supported group 1 functions */
495
    sd->data[13] = 0x03;
496
    for (i = 0; i < 6; i ++) {
497
        new_func = (arg >> (i * 4)) & 0x0f;
498
        if (mode && new_func != 0x0f)
499
            sd->function_group[i] = new_func;
500
        sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
501
    }
502
    memset(&sd->data[17], 0, 47);
503
    crc = sd_crc16(sd->data, 64);
504
    sd->data[65] = crc >> 8;
505
    sd->data[66] = crc & 0xff;
506
}
507

    
508
static inline int sd_wp_addr(SDState *sd, uint32_t addr)
509
{
510
    return sd->wp_groups[addr >>
511
            (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)];
512
}
513

    
514
static void sd_lock_command(SDState *sd)
515
{
516
    int erase, lock, clr_pwd, set_pwd, pwd_len;
517
    erase = !!(sd->data[0] & 0x08);
518
    lock = sd->data[0] & 0x04;
519
    clr_pwd = sd->data[0] & 0x02;
520
    set_pwd = sd->data[0] & 0x01;
521

    
522
    if (sd->blk_len > 1)
523
        pwd_len = sd->data[1];
524
    else
525
        pwd_len = 0;
526

    
527
    if (erase) {
528
        if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
529
                        set_pwd || clr_pwd || lock || sd->wp_switch ||
530
                        (sd->csd[14] & 0x20)) {
531
            sd->card_status |= LOCK_UNLOCK_FAILED;
532
            return;
533
        }
534
        memset(sd->wp_groups, 0, sizeof(int) * (sd->size >>
535
                        (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)));
536
        sd->csd[14] &= ~0x10;
537
        sd->card_status &= ~CARD_IS_LOCKED;
538
        sd->pwd_len = 0;
539
        /* Erasing the entire card here! */
540
        fprintf(stderr, "SD: Card force-erased by CMD42\n");
541
        return;
542
    }
543

    
544
    if (sd->blk_len < 2 + pwd_len ||
545
                    pwd_len <= sd->pwd_len ||
546
                    pwd_len > sd->pwd_len + 16) {
547
        sd->card_status |= LOCK_UNLOCK_FAILED;
548
        return;
549
    }
550

    
551
    if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
552
        sd->card_status |= LOCK_UNLOCK_FAILED;
553
        return;
554
    }
555

    
556
    pwd_len -= sd->pwd_len;
557
    if ((pwd_len && !set_pwd) ||
558
                    (clr_pwd && (set_pwd || lock)) ||
559
                    (lock && !sd->pwd_len && !set_pwd) ||
560
                    (!set_pwd && !clr_pwd &&
561
                     (((sd->card_status & CARD_IS_LOCKED) && lock) ||
562
                      (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
563
        sd->card_status |= LOCK_UNLOCK_FAILED;
564
        return;
565
    }
566

    
567
    if (set_pwd) {
568
        memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
569
        sd->pwd_len = pwd_len;
570
    }
571

    
572
    if (clr_pwd) {
573
        sd->pwd_len = 0;
574
    }
575

    
576
    if (lock)
577
        sd->card_status |= CARD_IS_LOCKED;
578
    else
579
        sd->card_status &= ~CARD_IS_LOCKED;
580
}
581

    
582
static sd_rsp_type_t sd_normal_command(SDState *sd,
583
                                       SDRequest req)
584
{
585
    uint32_t rca = 0x0000;
586

    
587
    if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
588
        rca = req.arg >> 16;
589

    
590
    DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
591
    switch (req.cmd) {
592
    /* Basic commands (Class 0 and Class 1) */
593
    case 0:        /* CMD0:   GO_IDLE_STATE */
594
        switch (sd->state) {
595
        case sd_inactive_state:
596
            return sd->spi ? sd_r1 : sd_r0;
597

    
598
        default:
599
            sd->state = sd_idle_state;
600
            sd_reset(sd, sd->bdrv);
601
            return sd->spi ? sd_r1 : sd_r0;
602
        }
603
        break;
604

    
605
    case 1:        /* CMD1:   SEND_OP_CMD */
606
        if (!sd->spi)
607
            goto bad_cmd;
608

    
609
        sd->state = sd_transfer_state;
610
        return sd_r1;
611

    
612
    case 2:        /* CMD2:   ALL_SEND_CID */
613
        if (sd->spi)
614
            goto bad_cmd;
615
        switch (sd->state) {
616
        case sd_ready_state:
617
            sd->state = sd_identification_state;
618
            return sd_r2_i;
619

    
620
        default:
621
            break;
622
        }
623
        break;
624

    
625
    case 3:        /* CMD3:   SEND_RELATIVE_ADDR */
626
        if (sd->spi)
627
            goto bad_cmd;
628
        switch (sd->state) {
629
        case sd_identification_state:
630
        case sd_standby_state:
631
            sd->state = sd_standby_state;
632
            sd_set_rca(sd);
633
            return sd_r6;
634

    
635
        default:
636
            break;
637
        }
638
        break;
639

    
640
    case 4:        /* CMD4:   SEND_DSR */
641
        if (sd->spi)
642
            goto bad_cmd;
643
        switch (sd->state) {
644
        case sd_standby_state:
645
            break;
646

    
647
        default:
648
            break;
649
        }
650
        break;
651

    
652
    case 6:        /* CMD6:   SWITCH_FUNCTION */
653
        if (sd->spi)
654
            goto bad_cmd;
655
        switch (sd->mode) {
656
        case sd_data_transfer_mode:
657
            sd_function_switch(sd, req.arg);
658
            sd->state = sd_sendingdata_state;
659
            sd->data_start = 0;
660
            sd->data_offset = 0;
661
            return sd_r1;
662

    
663
        default:
664
            break;
665
        }
666
        break;
667

    
668
    case 7:        /* CMD7:   SELECT/DESELECT_CARD */
669
        if (sd->spi)
670
            goto bad_cmd;
671
        switch (sd->state) {
672
        case sd_standby_state:
673
            if (sd->rca != rca)
674
                return sd_r0;
675

    
676
            sd->state = sd_transfer_state;
677
            return sd_r1b;
678

    
679
        case sd_transfer_state:
680
        case sd_sendingdata_state:
681
            if (sd->rca == rca)
682
                break;
683

    
684
            sd->state = sd_standby_state;
685
            return sd_r1b;
686

    
687
        case sd_disconnect_state:
688
            if (sd->rca != rca)
689
                return sd_r0;
690

    
691
            sd->state = sd_programming_state;
692
            return sd_r1b;
693

    
694
        case sd_programming_state:
695
            if (sd->rca == rca)
696
                break;
697

    
698
            sd->state = sd_disconnect_state;
699
            return sd_r1b;
700

    
701
        default:
702
            break;
703
        }
704
        break;
705

    
706
    case 8:        /* CMD8:   SEND_IF_COND */
707
        /* Physical Layer Specification Version 2.00 command */
708
        switch (sd->state) {
709
        case sd_idle_state:
710
            sd->vhs = 0;
711

    
712
            /* No response if not exactly one VHS bit is set.  */
713
            if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff)))
714
                return sd->spi ? sd_r7 : sd_r0;
715

    
716
            /* Accept.  */
717
            sd->vhs = req.arg;
718
            return sd_r7;
719

    
720
        default:
721
            break;
722
        }
723
        break;
724

    
725
    case 9:        /* CMD9:   SEND_CSD */
726
        switch (sd->state) {
727
        case sd_standby_state:
728
            if (sd->rca != rca)
729
                return sd_r0;
730

    
731
            return sd_r2_s;
732

    
733
        case sd_transfer_state:
734
            if (!sd->spi)
735
                break;
736
            sd->state = sd_sendingdata_state;
737
            memcpy(sd->data, sd->csd, 16);
738
            sd->data_start = req.arg;
739
            sd->data_offset = 0;
740
            return sd_r1;
741

    
742
        default:
743
            break;
744
        }
745
        break;
746

    
747
    case 10:        /* CMD10:  SEND_CID */
748
        switch (sd->state) {
749
        case sd_standby_state:
750
            if (sd->rca != rca)
751
                return sd_r0;
752

    
753
            return sd_r2_i;
754

    
755
        case sd_transfer_state:
756
            if (!sd->spi)
757
                break;
758
            sd->state = sd_sendingdata_state;
759
            memcpy(sd->data, sd->cid, 16);
760
            sd->data_start = req.arg;
761
            sd->data_offset = 0;
762
            return sd_r1;
763

    
764
        default:
765
            break;
766
        }
767
        break;
768

    
769
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
770
        if (sd->spi)
771
            goto bad_cmd;
772
        switch (sd->state) {
773
        case sd_transfer_state:
774
            sd->state = sd_sendingdata_state;
775
            sd->data_start = req.arg;
776
            sd->data_offset = 0;
777

    
778
            if (sd->data_start + sd->blk_len > sd->size)
779
                sd->card_status |= ADDRESS_ERROR;
780
            return sd_r0;
781

    
782
        default:
783
            break;
784
        }
785
        break;
786

    
787
    case 12:        /* CMD12:  STOP_TRANSMISSION */
788
        switch (sd->state) {
789
        case sd_sendingdata_state:
790
            sd->state = sd_transfer_state;
791
            return sd_r1b;
792

    
793
        case sd_receivingdata_state:
794
            sd->state = sd_programming_state;
795
            /* Bzzzzzzztt .... Operation complete.  */
796
            sd->state = sd_transfer_state;
797
            return sd_r1b;
798

    
799
        default:
800
            break;
801
        }
802
        break;
803

    
804
    case 13:        /* CMD13:  SEND_STATUS */
805
        switch (sd->mode) {
806
        case sd_data_transfer_mode:
807
            if (sd->rca != rca)
808
                return sd_r0;
809

    
810
            return sd_r1;
811

    
812
        default:
813
            break;
814
        }
815
        break;
816

    
817
    case 15:        /* CMD15:  GO_INACTIVE_STATE */
818
        if (sd->spi)
819
            goto bad_cmd;
820
        switch (sd->mode) {
821
        case sd_data_transfer_mode:
822
            if (sd->rca != rca)
823
                return sd_r0;
824

    
825
            sd->state = sd_inactive_state;
826
            return sd_r0;
827

    
828
        default:
829
            break;
830
        }
831
        break;
832

    
833
    /* Block read commands (Classs 2) */
834
    case 16:        /* CMD16:  SET_BLOCKLEN */
835
        switch (sd->state) {
836
        case sd_transfer_state:
837
            if (req.arg > (1 << HWBLOCK_SHIFT))
838
                sd->card_status |= BLOCK_LEN_ERROR;
839
            else
840
                sd->blk_len = req.arg;
841

    
842
            return sd_r1;
843

    
844
        default:
845
            break;
846
        }
847
        break;
848

    
849
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
850
        switch (sd->state) {
851
        case sd_transfer_state:
852
            sd->state = sd_sendingdata_state;
853
            sd->data_start = req.arg;
854
            sd->data_offset = 0;
855

    
856
            if (sd->data_start + sd->blk_len > sd->size)
857
                sd->card_status |= ADDRESS_ERROR;
858
            return sd_r1;
859

    
860
        default:
861
            break;
862
        }
863
        break;
864

    
865
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
866
        switch (sd->state) {
867
        case sd_transfer_state:
868
            sd->state = sd_sendingdata_state;
869
            sd->data_start = req.arg;
870
            sd->data_offset = 0;
871

    
872
            if (sd->data_start + sd->blk_len > sd->size)
873
                sd->card_status |= ADDRESS_ERROR;
874
            return sd_r1;
875

    
876
        default:
877
            break;
878
        }
879
        break;
880

    
881
    /* Block write commands (Class 4) */
882
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
883
        if (sd->spi)
884
            goto unimplemented_cmd;
885
        switch (sd->state) {
886
        case sd_transfer_state:
887
            /* Writing in SPI mode not implemented.  */
888
            if (sd->spi)
889
                break;
890
            sd->state = sd_receivingdata_state;
891
            sd->data_start = req.arg;
892
            sd->data_offset = 0;
893
            sd->blk_written = 0;
894

    
895
            if (sd->data_start + sd->blk_len > sd->size)
896
                sd->card_status |= ADDRESS_ERROR;
897
            if (sd_wp_addr(sd, sd->data_start))
898
                sd->card_status |= WP_VIOLATION;
899
            if (sd->csd[14] & 0x30)
900
                sd->card_status |= WP_VIOLATION;
901
            return sd_r1;
902

    
903
        default:
904
            break;
905
        }
906
        break;
907

    
908
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
909
        if (sd->spi)
910
            goto unimplemented_cmd;
911
        switch (sd->state) {
912
        case sd_transfer_state:
913
            /* Writing in SPI mode not implemented.  */
914
            if (sd->spi)
915
                break;
916
            sd->state = sd_receivingdata_state;
917
            sd->data_start = req.arg;
918
            sd->data_offset = 0;
919
            sd->blk_written = 0;
920

    
921
            if (sd->data_start + sd->blk_len > sd->size)
922
                sd->card_status |= ADDRESS_ERROR;
923
            if (sd_wp_addr(sd, sd->data_start))
924
                sd->card_status |= WP_VIOLATION;
925
            if (sd->csd[14] & 0x30)
926
                sd->card_status |= WP_VIOLATION;
927
            return sd_r1;
928

    
929
        default:
930
            break;
931
        }
932
        break;
933

    
934
    case 26:        /* CMD26:  PROGRAM_CID */
935
        if (sd->spi)
936
            goto bad_cmd;
937
        switch (sd->state) {
938
        case sd_transfer_state:
939
            sd->state = sd_receivingdata_state;
940
            sd->data_start = 0;
941
            sd->data_offset = 0;
942
            return sd_r1;
943

    
944
        default:
945
            break;
946
        }
947
        break;
948

    
949
    case 27:        /* CMD27:  PROGRAM_CSD */
950
        if (sd->spi)
951
            goto unimplemented_cmd;
952
        switch (sd->state) {
953
        case sd_transfer_state:
954
            sd->state = sd_receivingdata_state;
955
            sd->data_start = 0;
956
            sd->data_offset = 0;
957
            return sd_r1;
958

    
959
        default:
960
            break;
961
        }
962
        break;
963

    
964
    /* Write protection (Class 6) */
965
    case 28:        /* CMD28:  SET_WRITE_PROT */
966
        switch (sd->state) {
967
        case sd_transfer_state:
968
            if (req.arg >= sd->size) {
969
                sd->card_status = ADDRESS_ERROR;
970
                return sd_r1b;
971
            }
972

    
973
            sd->state = sd_programming_state;
974
            sd->wp_groups[req.arg >> (HWBLOCK_SHIFT +
975
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 1;
976
            /* Bzzzzzzztt .... Operation complete.  */
977
            sd->state = sd_transfer_state;
978
            return sd_r1b;
979

    
980
        default:
981
            break;
982
        }
983
        break;
984

    
985
    case 29:        /* CMD29:  CLR_WRITE_PROT */
986
        switch (sd->state) {
987
        case sd_transfer_state:
988
            if (req.arg >= sd->size) {
989
                sd->card_status = ADDRESS_ERROR;
990
                return sd_r1b;
991
            }
992

    
993
            sd->state = sd_programming_state;
994
            sd->wp_groups[req.arg >> (HWBLOCK_SHIFT +
995
                            SECTOR_SHIFT + WPGROUP_SHIFT)] = 0;
996
            /* Bzzzzzzztt .... Operation complete.  */
997
            sd->state = sd_transfer_state;
998
            return sd_r1b;
999

    
1000
        default:
1001
            break;
1002
        }
1003
        break;
1004

    
1005
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1006
        switch (sd->state) {
1007
        case sd_transfer_state:
1008
            sd->state = sd_sendingdata_state;
1009
            *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1010
            sd->data_start = req.arg;
1011
            sd->data_offset = 0;
1012
            return sd_r1b;
1013

    
1014
        default:
1015
            break;
1016
        }
1017
        break;
1018

    
1019
    /* Erase commands (Class 5) */
1020
    case 32:        /* CMD32:  ERASE_WR_BLK_START */
1021
        switch (sd->state) {
1022
        case sd_transfer_state:
1023
            sd->erase_start = req.arg;
1024
            return sd_r1;
1025

    
1026
        default:
1027
            break;
1028
        }
1029
        break;
1030

    
1031
    case 33:        /* CMD33:  ERASE_WR_BLK_END */
1032
        switch (sd->state) {
1033
        case sd_transfer_state:
1034
            sd->erase_end = req.arg;
1035
            return sd_r1;
1036

    
1037
        default:
1038
            break;
1039
        }
1040
        break;
1041

    
1042
    case 38:        /* CMD38:  ERASE */
1043
        switch (sd->state) {
1044
        case sd_transfer_state:
1045
            if (sd->csd[14] & 0x30) {
1046
                sd->card_status |= WP_VIOLATION;
1047
                return sd_r1b;
1048
            }
1049

    
1050
            sd->state = sd_programming_state;
1051
            sd_erase(sd);
1052
            /* Bzzzzzzztt .... Operation complete.  */
1053
            sd->state = sd_transfer_state;
1054
            return sd_r1b;
1055

    
1056
        default:
1057
            break;
1058
        }
1059
        break;
1060

    
1061
    /* Lock card commands (Class 7) */
1062
    case 42:        /* CMD42:  LOCK_UNLOCK */
1063
        if (sd->spi)
1064
            goto unimplemented_cmd;
1065
        switch (sd->state) {
1066
        case sd_transfer_state:
1067
            sd->state = sd_receivingdata_state;
1068
            sd->data_start = 0;
1069
            sd->data_offset = 0;
1070
            return sd_r1;
1071

    
1072
        default:
1073
            break;
1074
        }
1075
        break;
1076

    
1077
    /* Application specific commands (Class 8) */
1078
    case 55:        /* CMD55:  APP_CMD */
1079
        if (sd->rca != rca)
1080
            return sd_r0;
1081

    
1082
        sd->card_status |= APP_CMD;
1083
        return sd_r1;
1084

    
1085
    case 56:        /* CMD56:  GEN_CMD */
1086
        fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1087

    
1088
        switch (sd->state) {
1089
        case sd_transfer_state:
1090
            sd->data_offset = 0;
1091
            if (req.arg & 1)
1092
                sd->state = sd_sendingdata_state;
1093
            else
1094
                sd->state = sd_receivingdata_state;
1095
            return sd_r1;
1096

    
1097
        default:
1098
            break;
1099
        }
1100
        break;
1101

    
1102
    default:
1103
    bad_cmd:
1104
        sd->card_status |= ILLEGAL_COMMAND;
1105

    
1106
        fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd);
1107
        return sd_r0;
1108

    
1109
    unimplemented_cmd:
1110
        /* Commands that are recognised but not yet implemented in SPI mode.  */
1111
        sd->card_status |= ILLEGAL_COMMAND;
1112
        fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd);
1113
        return sd_r0;
1114
    }
1115

    
1116
    sd->card_status |= ILLEGAL_COMMAND;
1117
    fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd);
1118
    return sd_r0;
1119
}
1120

    
1121
static sd_rsp_type_t sd_app_command(SDState *sd,
1122
                                    SDRequest req) {
1123
    uint32_t rca;
1124

    
1125
    if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
1126
        rca = req.arg >> 16;
1127

    
1128
    DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1129
    switch (req.cmd) {
1130
    case 6:        /* ACMD6:  SET_BUS_WIDTH */
1131
        switch (sd->state) {
1132
        case sd_transfer_state:
1133
            sd->sd_status[0] &= 0x3f;
1134
            sd->sd_status[0] |= (req.arg & 0x03) << 6;
1135
            return sd_r1;
1136

    
1137
        default:
1138
            break;
1139
        }
1140
        break;
1141

    
1142
    case 13:        /* ACMD13: SD_STATUS */
1143
        switch (sd->state) {
1144
        case sd_transfer_state:
1145
            sd->data_start = 0;
1146
            sd->data_offset = 0;
1147
            return sd_r1;
1148

    
1149
        default:
1150
            break;
1151
        }
1152
        break;
1153

    
1154
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1155
        switch (sd->state) {
1156
        case sd_transfer_state:
1157
            *(uint32_t *) sd->data = sd->blk_written;
1158

    
1159
            sd->data_start = 0;
1160
            sd->data_offset = 0;
1161
            return sd_r1;
1162

    
1163
        default:
1164
            break;
1165
        }
1166
        break;
1167

    
1168
    case 23:        /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1169
        switch (sd->state) {
1170
        case sd_transfer_state:
1171
            return sd_r1;
1172

    
1173
        default:
1174
            break;
1175
        }
1176
        break;
1177

    
1178
    case 41:        /* ACMD41: SD_APP_OP_COND */
1179
        if (sd->spi) {
1180
            /* SEND_OP_CMD */
1181
            sd->state = sd_transfer_state;
1182
            return sd_r1;
1183
        }
1184
        switch (sd->state) {
1185
        case sd_idle_state:
1186
            /* We accept any voltage.  10000 V is nothing.  */
1187
            if (req.arg)
1188
                sd->state = sd_ready_state;
1189

    
1190
            return sd_r3;
1191

    
1192
        default:
1193
            break;
1194
        }
1195
        break;
1196

    
1197
    case 42:        /* ACMD42: SET_CLR_CARD_DETECT */
1198
        switch (sd->state) {
1199
        case sd_transfer_state:
1200
            /* Bringing in the 50KOhm pull-up resistor... Done.  */
1201
            return sd_r1;
1202

    
1203
        default:
1204
            break;
1205
        }
1206
        break;
1207

    
1208
    case 51:        /* ACMD51: SEND_SCR */
1209
        switch (sd->state) {
1210
        case sd_transfer_state:
1211
            sd->state = sd_sendingdata_state;
1212
            sd->data_start = 0;
1213
            sd->data_offset = 0;
1214
            return sd_r1;
1215

    
1216
        default:
1217
            break;
1218
        }
1219
        break;
1220

    
1221
    default:
1222
        /* Fall back to standard commands.  */
1223
        sd->card_status &= ~APP_CMD;
1224
        return sd_normal_command(sd, req);
1225
    }
1226

    
1227
    fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd);
1228
    return sd_r0;
1229
}
1230

    
1231
int sd_do_command(SDState *sd, SDRequest *req,
1232
                  uint8_t *response) {
1233
    uint32_t last_status = sd->card_status;
1234
    sd_rsp_type_t rtype;
1235
    int rsplen;
1236

    
1237
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) {
1238
        return 0;
1239
    }
1240

    
1241
    if (sd_req_crc_validate(req)) {
1242
        sd->card_status &= ~COM_CRC_ERROR;
1243
        return 0;
1244
    }
1245

    
1246
    sd->card_status &= ~CARD_STATUS_B;
1247
    sd_set_status(sd);
1248

    
1249
    if (last_status & CARD_IS_LOCKED)
1250
        if (((last_status & APP_CMD) &&
1251
                                 req->cmd == 41) ||
1252
                        (!(last_status & APP_CMD) &&
1253
                         (sd_cmd_class[req->cmd] == 0 ||
1254
                          sd_cmd_class[req->cmd] == 7 ||
1255
                          req->cmd == 16 || req->cmd == 55))) {
1256
            sd->card_status |= ILLEGAL_COMMAND;
1257
            fprintf(stderr, "SD: Card is locked\n");
1258
            return 0;
1259
        }
1260

    
1261
    if (last_status & APP_CMD) {
1262
        rtype = sd_app_command(sd, *req);
1263
        sd->card_status &= ~APP_CMD;
1264
    } else
1265
        rtype = sd_normal_command(sd, *req);
1266

    
1267
    sd->current_cmd = req->cmd;
1268

    
1269
    switch (rtype) {
1270
    case sd_r1:
1271
    case sd_r1b:
1272
        sd_response_r1_make(sd, response, last_status);
1273
        rsplen = 4;
1274
        break;
1275

    
1276
    case sd_r2_i:
1277
        memcpy(response, sd->cid, sizeof(sd->cid));
1278
        rsplen = 16;
1279
        break;
1280

    
1281
    case sd_r2_s:
1282
        memcpy(response, sd->csd, sizeof(sd->csd));
1283
        rsplen = 16;
1284
        break;
1285

    
1286
    case sd_r3:
1287
        sd_response_r3_make(sd, response);
1288
        rsplen = 4;
1289
        break;
1290

    
1291
    case sd_r6:
1292
        sd_response_r6_make(sd, response);
1293
        rsplen = 4;
1294
        break;
1295

    
1296
    case sd_r7:
1297
        sd_response_r7_make(sd, response);
1298
        rsplen = 4;
1299
        break;
1300

    
1301
    case sd_r0:
1302
    default:
1303
        rsplen = 0;
1304
        break;
1305
    }
1306

    
1307
    if (sd->card_status & ILLEGAL_COMMAND)
1308
        rsplen = 0;
1309

    
1310
#ifdef DEBUG_SD
1311
    if (rsplen) {
1312
        int i;
1313
        DPRINTF("Response:");
1314
        for (i = 0; i < rsplen; i++)
1315
            printf(" %02x", response[i]);
1316
        printf(" state %d\n", sd->state);
1317
    } else {
1318
        DPRINTF("No response %d\n", sd->state);
1319
    }
1320
#endif
1321

    
1322
    return rsplen;
1323
}
1324

    
1325
/* No real need for 64 bit addresses here */
1326
static void sd_blk_read(SDState *sd, uint32_t addr, uint32_t len)
1327
{
1328
    uint32_t end = addr + len;
1329

    
1330
    if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1331
        fprintf(stderr, "sd_blk_read: read error on host side\n");
1332
        return;
1333
    }
1334

    
1335
    if (end > (addr & ~511) + 512) {
1336
        memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511));
1337

    
1338
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1339
            fprintf(stderr, "sd_blk_read: read error on host side\n");
1340
            return;
1341
        }
1342
        memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511);
1343
    } else
1344
        memcpy(sd->data, sd->buf + (addr & 511), len);
1345
}
1346

    
1347
static void sd_blk_write(SDState *sd, uint32_t addr, uint32_t len)
1348
{
1349
    uint32_t end = addr + len;
1350

    
1351
    if ((addr & 511) || len < 512)
1352
        if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1353
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1354
            return;
1355
        }
1356

    
1357
    if (end > (addr & ~511) + 512) {
1358
        memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511));
1359
        if (bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1360
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1361
            return;
1362
        }
1363

    
1364
        if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1365
            fprintf(stderr, "sd_blk_write: read error on host side\n");
1366
            return;
1367
        }
1368
        memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511);
1369
        if (bdrv_write(sd->bdrv, end >> 9, sd->buf, 1) == -1)
1370
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1371
    } else {
1372
        memcpy(sd->buf + (addr & 511), sd->data, len);
1373
        if (!sd->bdrv || bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1)
1374
            fprintf(stderr, "sd_blk_write: write error on host side\n");
1375
    }
1376
}
1377

    
1378
#define BLK_READ_BLOCK(a, len)        sd_blk_read(sd, a, len)
1379
#define BLK_WRITE_BLOCK(a, len)        sd_blk_write(sd, a, len)
1380
#define APP_READ_BLOCK(a, len)        memset(sd->data, 0xec, len)
1381
#define APP_WRITE_BLOCK(a, len)
1382

    
1383
void sd_write_data(SDState *sd, uint8_t value)
1384
{
1385
    int i;
1386

    
1387
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1388
        return;
1389

    
1390
    if (sd->state != sd_receivingdata_state) {
1391
        fprintf(stderr, "sd_write_data: not in Receiving-Data state\n");
1392
        return;
1393
    }
1394

    
1395
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1396
        return;
1397

    
1398
    switch (sd->current_cmd) {
1399
    case 24:        /* CMD24:  WRITE_SINGLE_BLOCK */
1400
        sd->data[sd->data_offset ++] = value;
1401
        if (sd->data_offset >= sd->blk_len) {
1402
            /* TODO: Check CRC before committing */
1403
            sd->state = sd_programming_state;
1404
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1405
            sd->blk_written ++;
1406
            sd->csd[14] |= 0x40;
1407
            /* Bzzzzzzztt .... Operation complete.  */
1408
            sd->state = sd_transfer_state;
1409
        }
1410
        break;
1411

    
1412
    case 25:        /* CMD25:  WRITE_MULTIPLE_BLOCK */
1413
        sd->data[sd->data_offset ++] = value;
1414
        if (sd->data_offset >= sd->blk_len) {
1415
            /* TODO: Check CRC before committing */
1416
            sd->state = sd_programming_state;
1417
            BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1418
            sd->blk_written ++;
1419
            sd->data_start += sd->blk_len;
1420
            sd->data_offset = 0;
1421
            if (sd->data_start + sd->blk_len > sd->size) {
1422
                sd->card_status |= ADDRESS_ERROR;
1423
                break;
1424
            }
1425
            if (sd_wp_addr(sd, sd->data_start)) {
1426
                sd->card_status |= WP_VIOLATION;
1427
                break;
1428
            }
1429
            sd->csd[14] |= 0x40;
1430

    
1431
            /* Bzzzzzzztt .... Operation complete.  */
1432
            sd->state = sd_receivingdata_state;
1433
        }
1434
        break;
1435

    
1436
    case 26:        /* CMD26:  PROGRAM_CID */
1437
        sd->data[sd->data_offset ++] = value;
1438
        if (sd->data_offset >= sizeof(sd->cid)) {
1439
            /* TODO: Check CRC before committing */
1440
            sd->state = sd_programming_state;
1441
            for (i = 0; i < sizeof(sd->cid); i ++)
1442
                if ((sd->cid[i] | 0x00) != sd->data[i])
1443
                    sd->card_status |= CID_CSD_OVERWRITE;
1444

    
1445
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1446
                for (i = 0; i < sizeof(sd->cid); i ++) {
1447
                    sd->cid[i] |= 0x00;
1448
                    sd->cid[i] &= sd->data[i];
1449
                }
1450
            /* Bzzzzzzztt .... Operation complete.  */
1451
            sd->state = sd_transfer_state;
1452
        }
1453
        break;
1454

    
1455
    case 27:        /* CMD27:  PROGRAM_CSD */
1456
        sd->data[sd->data_offset ++] = value;
1457
        if (sd->data_offset >= sizeof(sd->csd)) {
1458
            /* TODO: Check CRC before committing */
1459
            sd->state = sd_programming_state;
1460
            for (i = 0; i < sizeof(sd->csd); i ++)
1461
                if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1462
                    (sd->data[i] | sd_csd_rw_mask[i]))
1463
                    sd->card_status |= CID_CSD_OVERWRITE;
1464

    
1465
            /* Copy flag (OTP) & Permanent write protect */
1466
            if (sd->csd[14] & ~sd->data[14] & 0x60)
1467
                sd->card_status |= CID_CSD_OVERWRITE;
1468

    
1469
            if (!(sd->card_status & CID_CSD_OVERWRITE))
1470
                for (i = 0; i < sizeof(sd->csd); i ++) {
1471
                    sd->csd[i] |= sd_csd_rw_mask[i];
1472
                    sd->csd[i] &= sd->data[i];
1473
                }
1474
            /* Bzzzzzzztt .... Operation complete.  */
1475
            sd->state = sd_transfer_state;
1476
        }
1477
        break;
1478

    
1479
    case 42:        /* CMD42:  LOCK_UNLOCK */
1480
        sd->data[sd->data_offset ++] = value;
1481
        if (sd->data_offset >= sd->blk_len) {
1482
            /* TODO: Check CRC before committing */
1483
            sd->state = sd_programming_state;
1484
            sd_lock_command(sd);
1485
            /* Bzzzzzzztt .... Operation complete.  */
1486
            sd->state = sd_transfer_state;
1487
        }
1488
        break;
1489

    
1490
    case 56:        /* CMD56:  GEN_CMD */
1491
        sd->data[sd->data_offset ++] = value;
1492
        if (sd->data_offset >= sd->blk_len) {
1493
            APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1494
            sd->state = sd_transfer_state;
1495
        }
1496
        break;
1497

    
1498
    default:
1499
        fprintf(stderr, "sd_write_data: unknown command\n");
1500
        break;
1501
    }
1502
}
1503

    
1504
uint8_t sd_read_data(SDState *sd)
1505
{
1506
    /* TODO: Append CRCs */
1507
    uint8_t ret;
1508

    
1509
    if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1510
        return 0x00;
1511

    
1512
    if (sd->state != sd_sendingdata_state) {
1513
        fprintf(stderr, "sd_read_data: not in Sending-Data state\n");
1514
        return 0x00;
1515
    }
1516

    
1517
    if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1518
        return 0x00;
1519

    
1520
    switch (sd->current_cmd) {
1521
    case 6:        /* CMD6:   SWITCH_FUNCTION */
1522
        ret = sd->data[sd->data_offset ++];
1523

    
1524
        if (sd->data_offset >= 64)
1525
            sd->state = sd_transfer_state;
1526
        break;
1527

    
1528
    case 9:        /* CMD9:   SEND_CSD */
1529
    case 10:        /* CMD10:  SEND_CID */
1530
        ret = sd->data[sd->data_offset ++];
1531

    
1532
        if (sd->data_offset >= 16)
1533
            sd->state = sd_transfer_state;
1534
        break;
1535

    
1536
    case 11:        /* CMD11:  READ_DAT_UNTIL_STOP */
1537
        if (sd->data_offset == 0)
1538
            BLK_READ_BLOCK(sd->data_start, sd->blk_len);
1539
        ret = sd->data[sd->data_offset ++];
1540

    
1541
        if (sd->data_offset >= sd->blk_len) {
1542
            sd->data_start += sd->blk_len;
1543
            sd->data_offset = 0;
1544
            if (sd->data_start + sd->blk_len > sd->size) {
1545
                sd->card_status |= ADDRESS_ERROR;
1546
                break;
1547
            }
1548
        }
1549
        break;
1550

    
1551
    case 13:        /* ACMD13: SD_STATUS */
1552
        ret = sd->sd_status[sd->data_offset ++];
1553

    
1554
        if (sd->data_offset >= sizeof(sd->sd_status))
1555
            sd->state = sd_transfer_state;
1556
        break;
1557

    
1558
    case 17:        /* CMD17:  READ_SINGLE_BLOCK */
1559
        if (sd->data_offset == 0)
1560
            BLK_READ_BLOCK(sd->data_start, sd->blk_len);
1561
        ret = sd->data[sd->data_offset ++];
1562

    
1563
        if (sd->data_offset >= sd->blk_len)
1564
            sd->state = sd_transfer_state;
1565
        break;
1566

    
1567
    case 18:        /* CMD18:  READ_MULTIPLE_BLOCK */
1568
        if (sd->data_offset == 0)
1569
            BLK_READ_BLOCK(sd->data_start, sd->blk_len);
1570
        ret = sd->data[sd->data_offset ++];
1571

    
1572
        if (sd->data_offset >= sd->blk_len) {
1573
            sd->data_start += sd->blk_len;
1574
            sd->data_offset = 0;
1575
            if (sd->data_start + sd->blk_len > sd->size) {
1576
                sd->card_status |= ADDRESS_ERROR;
1577
                break;
1578
            }
1579
        }
1580
        break;
1581

    
1582
    case 22:        /* ACMD22: SEND_NUM_WR_BLOCKS */
1583
        ret = sd->data[sd->data_offset ++];
1584

    
1585
        if (sd->data_offset >= 4)
1586
            sd->state = sd_transfer_state;
1587
        break;
1588

    
1589
    case 30:        /* CMD30:  SEND_WRITE_PROT */
1590
        ret = sd->data[sd->data_offset ++];
1591

    
1592
        if (sd->data_offset >= 4)
1593
            sd->state = sd_transfer_state;
1594
        break;
1595

    
1596
    case 51:        /* ACMD51: SEND_SCR */
1597
        ret = sd->scr[sd->data_offset ++];
1598

    
1599
        if (sd->data_offset >= sizeof(sd->scr))
1600
            sd->state = sd_transfer_state;
1601
        break;
1602

    
1603
    case 56:        /* CMD56:  GEN_CMD */
1604
        if (sd->data_offset == 0)
1605
            APP_READ_BLOCK(sd->data_start, sd->blk_len);
1606
        ret = sd->data[sd->data_offset ++];
1607

    
1608
        if (sd->data_offset >= sd->blk_len)
1609
            sd->state = sd_transfer_state;
1610
        break;
1611

    
1612
    default:
1613
        fprintf(stderr, "sd_read_data: unknown command\n");
1614
        return 0x00;
1615
    }
1616

    
1617
    return ret;
1618
}
1619

    
1620
int sd_data_ready(SDState *sd)
1621
{
1622
    return sd->state == sd_sendingdata_state;
1623
}
1624

    
1625
void sd_enable(SDState *sd, int enable)
1626
{
1627
    sd->enable = enable;
1628
}