]> git.proxmox.com Git - qemu.git/blob - hw/sd.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote branch 'kwolf/for-anthony' into staging
[qemu.git] / hw / sd.c
1 /*
2 * SD Memory Card emulation as defined in the "SD Memory Card Physical
3 * layer specification, Version 1.10."
4 *
5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org>
6 * Copyright (c) 2007 CodeSourcery
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''
20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include "hw.h"
33 #include "block.h"
34 #include "sd.h"
35
36 //#define DEBUG_SD 1
37
38 #ifdef DEBUG_SD
39 #define DPRINTF(fmt, ...) \
40 do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
41 #else
42 #define DPRINTF(fmt, ...) do {} while(0)
43 #endif
44
45 typedef enum {
46 sd_r0 = 0, /* no response */
47 sd_r1, /* normal response command */
48 sd_r2_i, /* CID register */
49 sd_r2_s, /* CSD register */
50 sd_r3, /* OCR register */
51 sd_r6 = 6, /* Published RCA response */
52 sd_r7, /* Operating voltage */
53 sd_r1b = -1,
54 } sd_rsp_type_t;
55
56 struct SDState {
57 enum {
58 sd_inactive,
59 sd_card_identification_mode,
60 sd_data_transfer_mode,
61 } mode;
62 enum {
63 sd_inactive_state = -1,
64 sd_idle_state = 0,
65 sd_ready_state,
66 sd_identification_state,
67 sd_standby_state,
68 sd_transfer_state,
69 sd_sendingdata_state,
70 sd_receivingdata_state,
71 sd_programming_state,
72 sd_disconnect_state,
73 } state;
74 uint32_t ocr;
75 uint8_t scr[8];
76 uint8_t cid[16];
77 uint8_t csd[16];
78 uint16_t rca;
79 uint32_t card_status;
80 uint8_t sd_status[64];
81 uint32_t vhs;
82 int wp_switch;
83 int *wp_groups;
84 uint64_t size;
85 int blk_len;
86 uint32_t erase_start;
87 uint32_t erase_end;
88 uint8_t pwd[16];
89 int pwd_len;
90 int function_group[6];
91
92 int spi;
93 int current_cmd;
94 int blk_written;
95 uint64_t data_start;
96 uint32_t data_offset;
97 uint8_t data[512];
98 qemu_irq readonly_cb;
99 qemu_irq inserted_cb;
100 BlockDriverState *bdrv;
101 uint8_t *buf;
102
103 int enable;
104 };
105
106 static void sd_set_status(SDState *sd)
107 {
108 switch (sd->state) {
109 case sd_inactive_state:
110 sd->mode = sd_inactive;
111 break;
112
113 case sd_idle_state:
114 case sd_ready_state:
115 case sd_identification_state:
116 sd->mode = sd_card_identification_mode;
117 break;
118
119 case sd_standby_state:
120 case sd_transfer_state:
121 case sd_sendingdata_state:
122 case sd_receivingdata_state:
123 case sd_programming_state:
124 case sd_disconnect_state:
125 sd->mode = sd_data_transfer_mode;
126 break;
127 }
128
129 sd->card_status &= ~CURRENT_STATE;
130 sd->card_status |= sd->state << 9;
131 }
132
133 static const sd_cmd_type_t sd_cmd_type[64] = {
134 sd_bc, sd_none, sd_bcr, sd_bcr, sd_none, sd_none, sd_none, sd_ac,
135 sd_bcr, sd_ac, sd_ac, sd_adtc, sd_ac, sd_ac, sd_none, sd_ac,
136 sd_ac, sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
137 sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac, sd_ac, sd_adtc, sd_none,
138 sd_ac, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none,
139 sd_none, sd_none, sd_bc, sd_none, sd_none, sd_none, sd_none, sd_none,
140 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
141 sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
142 };
143
144 static const sd_cmd_type_t sd_acmd_type[64] = {
145 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none,
146 sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none,
147 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac,
148 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
149 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
150 sd_none, sd_bcr, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_none,
151 sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none,
152 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
153 };
154
155 static const int sd_cmd_class[64] = {
156 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0,
157 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6,
158 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7,
159 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8,
160 };
161
162 static uint8_t sd_crc7(void *message, size_t width)
163 {
164 int i, bit;
165 uint8_t shift_reg = 0x00;
166 uint8_t *msg = (uint8_t *) message;
167
168 for (i = 0; i < width; i ++, msg ++)
169 for (bit = 7; bit >= 0; bit --) {
170 shift_reg <<= 1;
171 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))
172 shift_reg ^= 0x89;
173 }
174
175 return shift_reg;
176 }
177
178 static uint16_t sd_crc16(void *message, size_t width)
179 {
180 int i, bit;
181 uint16_t shift_reg = 0x0000;
182 uint16_t *msg = (uint16_t *) message;
183 width <<= 1;
184
185 for (i = 0; i < width; i ++, msg ++)
186 for (bit = 15; bit >= 0; bit --) {
187 shift_reg <<= 1;
188 if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))
189 shift_reg ^= 0x1011;
190 }
191
192 return shift_reg;
193 }
194
195 static void sd_set_ocr(SDState *sd)
196 {
197 /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */
198 sd->ocr = 0x80ffff00;
199 }
200
201 static void sd_set_scr(SDState *sd)
202 {
203 sd->scr[0] = 0x00; /* SCR Structure */
204 sd->scr[1] = 0x2f; /* SD Security Support */
205 sd->scr[2] = 0x00;
206 sd->scr[3] = 0x00;
207 sd->scr[4] = 0x00;
208 sd->scr[5] = 0x00;
209 sd->scr[6] = 0x00;
210 sd->scr[7] = 0x00;
211 }
212
213 #define MID 0xaa
214 #define OID "XY"
215 #define PNM "QEMU!"
216 #define PRV 0x01
217 #define MDT_YR 2006
218 #define MDT_MON 2
219
220 static void sd_set_cid(SDState *sd)
221 {
222 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */
223 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */
224 sd->cid[2] = OID[1];
225 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */
226 sd->cid[4] = PNM[1];
227 sd->cid[5] = PNM[2];
228 sd->cid[6] = PNM[3];
229 sd->cid[7] = PNM[4];
230 sd->cid[8] = PRV; /* Fake product revision (PRV) */
231 sd->cid[9] = 0xde; /* Fake serial number (PSN) */
232 sd->cid[10] = 0xad;
233 sd->cid[11] = 0xbe;
234 sd->cid[12] = 0xef;
235 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */
236 ((MDT_YR - 2000) / 10);
237 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;
238 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;
239 }
240
241 #define HWBLOCK_SHIFT 9 /* 512 bytes */
242 #define SECTOR_SHIFT 5 /* 16 kilobytes */
243 #define WPGROUP_SHIFT 7 /* 2 megs */
244 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */
245 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))
246
247 static const uint8_t sd_csd_rw_mask[16] = {
248 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,
250 };
251
252 static void sd_set_csd(SDState *sd, uint64_t size)
253 {
254 uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;
255 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
256 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
257
258 if (size <= 0x40000000) { /* Standard Capacity SD */
259 sd->csd[0] = 0x00; /* CSD structure */
260 sd->csd[1] = 0x26; /* Data read access-time-1 */
261 sd->csd[2] = 0x00; /* Data read access-time-2 */
262 sd->csd[3] = 0x5a; /* Max. data transfer rate */
263 sd->csd[4] = 0x5f; /* Card Command Classes */
264 sd->csd[5] = 0x50 | /* Max. read data block length */
265 HWBLOCK_SHIFT;
266 sd->csd[6] = 0xe0 | /* Partial block for read allowed */
267 ((csize >> 10) & 0x03);
268 sd->csd[7] = 0x00 | /* Device size */
269 ((csize >> 2) & 0xff);
270 sd->csd[8] = 0x3f | /* Max. read current */
271 ((csize << 6) & 0xc0);
272 sd->csd[9] = 0xfc | /* Max. write current */
273 ((CMULT_SHIFT - 2) >> 1);
274 sd->csd[10] = 0x40 | /* Erase sector size */
275 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);
276 sd->csd[11] = 0x00 | /* Write protect group size */
277 ((sectsize << 7) & 0x80) | wpsize;
278 sd->csd[12] = 0x90 | /* Write speed factor */
279 (HWBLOCK_SHIFT >> 2);
280 sd->csd[13] = 0x20 | /* Max. write data block length */
281 ((HWBLOCK_SHIFT << 6) & 0xc0);
282 sd->csd[14] = 0x00; /* File format group */
283 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
284 } else { /* SDHC */
285 size /= 512 * 1024;
286 size -= 1;
287 sd->csd[0] = 0x40;
288 sd->csd[1] = 0x0e;
289 sd->csd[2] = 0x00;
290 sd->csd[3] = 0x32;
291 sd->csd[4] = 0x5b;
292 sd->csd[5] = 0x59;
293 sd->csd[6] = 0x00;
294 sd->csd[7] = (size >> 16) & 0xff;
295 sd->csd[8] = (size >> 8) & 0xff;
296 sd->csd[9] = (size & 0xff);
297 sd->csd[10] = 0x7f;
298 sd->csd[11] = 0x80;
299 sd->csd[12] = 0x0a;
300 sd->csd[13] = 0x40;
301 sd->csd[14] = 0x00;
302 sd->csd[15] = 0x00;
303 sd->ocr |= 1 << 30; /* High Capacity SD Memort Card */
304 }
305 }
306
307 static void sd_set_rca(SDState *sd)
308 {
309 sd->rca += 0x4567;
310 }
311
312 #define CARD_STATUS_A 0x02004100
313 #define CARD_STATUS_B 0x00c01e00
314 #define CARD_STATUS_C 0xfd39a028
315
316 static void sd_set_cardstatus(SDState *sd)
317 {
318 sd->card_status = 0x00000100;
319 }
320
321 static void sd_set_sdstatus(SDState *sd)
322 {
323 memset(sd->sd_status, 0, 64);
324 }
325
326 static int sd_req_crc_validate(SDRequest *req)
327 {
328 uint8_t buffer[5];
329 buffer[0] = 0x40 | req->cmd;
330 buffer[1] = (req->arg >> 24) & 0xff;
331 buffer[2] = (req->arg >> 16) & 0xff;
332 buffer[3] = (req->arg >> 8) & 0xff;
333 buffer[4] = (req->arg >> 0) & 0xff;
334 return 0;
335 return sd_crc7(buffer, 5) != req->crc; /* TODO */
336 }
337
338 static void sd_response_r1_make(SDState *sd,
339 uint8_t *response, uint32_t last_status)
340 {
341 uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;
342 uint32_t status;
343
344 status = (sd->card_status & ~mask) | (last_status & mask);
345 sd->card_status &= ~CARD_STATUS_C | APP_CMD;
346
347 response[0] = (status >> 24) & 0xff;
348 response[1] = (status >> 16) & 0xff;
349 response[2] = (status >> 8) & 0xff;
350 response[3] = (status >> 0) & 0xff;
351 }
352
353 static void sd_response_r3_make(SDState *sd, uint8_t *response)
354 {
355 response[0] = (sd->ocr >> 24) & 0xff;
356 response[1] = (sd->ocr >> 16) & 0xff;
357 response[2] = (sd->ocr >> 8) & 0xff;
358 response[3] = (sd->ocr >> 0) & 0xff;
359 }
360
361 static void sd_response_r6_make(SDState *sd, uint8_t *response)
362 {
363 uint16_t arg;
364 uint16_t status;
365
366 arg = sd->rca;
367 status = ((sd->card_status >> 8) & 0xc000) |
368 ((sd->card_status >> 6) & 0x2000) |
369 (sd->card_status & 0x1fff);
370
371 response[0] = (arg >> 8) & 0xff;
372 response[1] = arg & 0xff;
373 response[2] = (status >> 8) & 0xff;
374 response[3] = status & 0xff;
375 }
376
377 static void sd_response_r7_make(SDState *sd, uint8_t *response)
378 {
379 response[0] = (sd->vhs >> 24) & 0xff;
380 response[1] = (sd->vhs >> 16) & 0xff;
381 response[2] = (sd->vhs >> 8) & 0xff;
382 response[3] = (sd->vhs >> 0) & 0xff;
383 }
384
385 static void sd_reset(SDState *sd, BlockDriverState *bdrv)
386 {
387 uint64_t size;
388 uint64_t sect;
389
390 if (bdrv) {
391 bdrv_get_geometry(bdrv, &sect);
392 } else {
393 sect = 0;
394 }
395 sect <<= 9;
396
397 size = sect + 1;
398
399 sect = (size >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) + 1;
400
401 sd->state = sd_idle_state;
402 sd->rca = 0x0000;
403 sd_set_ocr(sd);
404 sd_set_scr(sd);
405 sd_set_cid(sd);
406 sd_set_csd(sd, size);
407 sd_set_cardstatus(sd);
408 sd_set_sdstatus(sd);
409
410 sd->bdrv = bdrv;
411
412 if (sd->wp_groups)
413 qemu_free(sd->wp_groups);
414 sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : 0;
415 sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);
416 memset(sd->function_group, 0, sizeof(int) * 6);
417 sd->erase_start = 0;
418 sd->erase_end = 0;
419 sd->size = size;
420 sd->blk_len = 0x200;
421 sd->pwd_len = 0;
422 }
423
424 static void sd_cardchange(void *opaque)
425 {
426 SDState *sd = opaque;
427 qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));
428 if (bdrv_is_inserted(sd->bdrv)) {
429 sd_reset(sd, sd->bdrv);
430 qemu_set_irq(sd->readonly_cb, sd->wp_switch);
431 }
432 }
433
434 /* We do not model the chip select pin, so allow the board to select
435 whether card should be in SSI or MMC/SD mode. It is also up to the
436 board to ensure that ssi transfers only occur when the chip select
437 is asserted. */
438 SDState *sd_init(BlockDriverState *bs, int is_spi)
439 {
440 SDState *sd;
441
442 sd = (SDState *) qemu_mallocz(sizeof(SDState));
443 sd->buf = qemu_memalign(512, 512);
444 sd->spi = is_spi;
445 sd->enable = 1;
446 sd_reset(sd, bs);
447 if (sd->bdrv) {
448 bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);
449 }
450 return sd;
451 }
452
453 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)
454 {
455 sd->readonly_cb = readonly;
456 sd->inserted_cb = insert;
457 qemu_set_irq(readonly, bdrv_is_read_only(sd->bdrv));
458 qemu_set_irq(insert, bdrv_is_inserted(sd->bdrv));
459 }
460
461 static void sd_erase(SDState *sd)
462 {
463 int i, start, end;
464 if (!sd->erase_start || !sd->erase_end) {
465 sd->card_status |= ERASE_SEQ_ERROR;
466 return;
467 }
468
469 start = sd->erase_start >>
470 (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
471 end = sd->erase_end >>
472 (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
473 sd->erase_start = 0;
474 sd->erase_end = 0;
475 sd->csd[14] |= 0x40;
476
477 for (i = start; i <= end; i ++)
478 if (sd->wp_groups[i])
479 sd->card_status |= WP_ERASE_SKIP;
480 }
481
482 static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
483 {
484 uint32_t i, wpnum;
485 uint32_t ret = 0;
486
487 wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);
488
489 for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)
490 if (addr < sd->size && sd->wp_groups[wpnum])
491 ret |= (1 << i);
492
493 return ret;
494 }
495
496 static void sd_function_switch(SDState *sd, uint32_t arg)
497 {
498 int i, mode, new_func, crc;
499 mode = !!(arg & 0x80000000);
500
501 sd->data[0] = 0x00; /* Maximum current consumption */
502 sd->data[1] = 0x01;
503 sd->data[2] = 0x80; /* Supported group 6 functions */
504 sd->data[3] = 0x01;
505 sd->data[4] = 0x80; /* Supported group 5 functions */
506 sd->data[5] = 0x01;
507 sd->data[6] = 0x80; /* Supported group 4 functions */
508 sd->data[7] = 0x01;
509 sd->data[8] = 0x80; /* Supported group 3 functions */
510 sd->data[9] = 0x01;
511 sd->data[10] = 0x80; /* Supported group 2 functions */
512 sd->data[11] = 0x43;
513 sd->data[12] = 0x80; /* Supported group 1 functions */
514 sd->data[13] = 0x03;
515 for (i = 0; i < 6; i ++) {
516 new_func = (arg >> (i * 4)) & 0x0f;
517 if (mode && new_func != 0x0f)
518 sd->function_group[i] = new_func;
519 sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
520 }
521 memset(&sd->data[17], 0, 47);
522 crc = sd_crc16(sd->data, 64);
523 sd->data[65] = crc >> 8;
524 sd->data[66] = crc & 0xff;
525 }
526
527 static inline int sd_wp_addr(SDState *sd, uint32_t addr)
528 {
529 return sd->wp_groups[addr >>
530 (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)];
531 }
532
533 static void sd_lock_command(SDState *sd)
534 {
535 int erase, lock, clr_pwd, set_pwd, pwd_len;
536 erase = !!(sd->data[0] & 0x08);
537 lock = sd->data[0] & 0x04;
538 clr_pwd = sd->data[0] & 0x02;
539 set_pwd = sd->data[0] & 0x01;
540
541 if (sd->blk_len > 1)
542 pwd_len = sd->data[1];
543 else
544 pwd_len = 0;
545
546 if (erase) {
547 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
548 set_pwd || clr_pwd || lock || sd->wp_switch ||
549 (sd->csd[14] & 0x20)) {
550 sd->card_status |= LOCK_UNLOCK_FAILED;
551 return;
552 }
553 memset(sd->wp_groups, 0, sizeof(int) * (sd->size >>
554 (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)));
555 sd->csd[14] &= ~0x10;
556 sd->card_status &= ~CARD_IS_LOCKED;
557 sd->pwd_len = 0;
558 /* Erasing the entire card here! */
559 fprintf(stderr, "SD: Card force-erased by CMD42\n");
560 return;
561 }
562
563 if (sd->blk_len < 2 + pwd_len ||
564 pwd_len <= sd->pwd_len ||
565 pwd_len > sd->pwd_len + 16) {
566 sd->card_status |= LOCK_UNLOCK_FAILED;
567 return;
568 }
569
570 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {
571 sd->card_status |= LOCK_UNLOCK_FAILED;
572 return;
573 }
574
575 pwd_len -= sd->pwd_len;
576 if ((pwd_len && !set_pwd) ||
577 (clr_pwd && (set_pwd || lock)) ||
578 (lock && !sd->pwd_len && !set_pwd) ||
579 (!set_pwd && !clr_pwd &&
580 (((sd->card_status & CARD_IS_LOCKED) && lock) ||
581 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {
582 sd->card_status |= LOCK_UNLOCK_FAILED;
583 return;
584 }
585
586 if (set_pwd) {
587 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);
588 sd->pwd_len = pwd_len;
589 }
590
591 if (clr_pwd) {
592 sd->pwd_len = 0;
593 }
594
595 if (lock)
596 sd->card_status |= CARD_IS_LOCKED;
597 else
598 sd->card_status &= ~CARD_IS_LOCKED;
599 }
600
601 static sd_rsp_type_t sd_normal_command(SDState *sd,
602 SDRequest req)
603 {
604 uint32_t rca = 0x0000;
605 uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
606
607 if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
608 rca = req.arg >> 16;
609
610 DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
611 switch (req.cmd) {
612 /* Basic commands (Class 0 and Class 1) */
613 case 0: /* CMD0: GO_IDLE_STATE */
614 switch (sd->state) {
615 case sd_inactive_state:
616 return sd->spi ? sd_r1 : sd_r0;
617
618 default:
619 sd->state = sd_idle_state;
620 sd_reset(sd, sd->bdrv);
621 return sd->spi ? sd_r1 : sd_r0;
622 }
623 break;
624
625 case 1: /* CMD1: SEND_OP_CMD */
626 if (!sd->spi)
627 goto bad_cmd;
628
629 sd->state = sd_transfer_state;
630 return sd_r1;
631
632 case 2: /* CMD2: ALL_SEND_CID */
633 if (sd->spi)
634 goto bad_cmd;
635 switch (sd->state) {
636 case sd_ready_state:
637 sd->state = sd_identification_state;
638 return sd_r2_i;
639
640 default:
641 break;
642 }
643 break;
644
645 case 3: /* CMD3: SEND_RELATIVE_ADDR */
646 if (sd->spi)
647 goto bad_cmd;
648 switch (sd->state) {
649 case sd_identification_state:
650 case sd_standby_state:
651 sd->state = sd_standby_state;
652 sd_set_rca(sd);
653 return sd_r6;
654
655 default:
656 break;
657 }
658 break;
659
660 case 4: /* CMD4: SEND_DSR */
661 if (sd->spi)
662 goto bad_cmd;
663 switch (sd->state) {
664 case sd_standby_state:
665 break;
666
667 default:
668 break;
669 }
670 break;
671
672 case 5: /* CMD5: reserved for SDIO cards */
673 sd->card_status |= ILLEGAL_COMMAND;
674 return sd_r0;
675
676 case 6: /* CMD6: SWITCH_FUNCTION */
677 if (sd->spi)
678 goto bad_cmd;
679 switch (sd->mode) {
680 case sd_data_transfer_mode:
681 sd_function_switch(sd, req.arg);
682 sd->state = sd_sendingdata_state;
683 sd->data_start = 0;
684 sd->data_offset = 0;
685 return sd_r1;
686
687 default:
688 break;
689 }
690 break;
691
692 case 7: /* CMD7: SELECT/DESELECT_CARD */
693 if (sd->spi)
694 goto bad_cmd;
695 switch (sd->state) {
696 case sd_standby_state:
697 if (sd->rca != rca)
698 return sd_r0;
699
700 sd->state = sd_transfer_state;
701 return sd_r1b;
702
703 case sd_transfer_state:
704 case sd_sendingdata_state:
705 if (sd->rca == rca)
706 break;
707
708 sd->state = sd_standby_state;
709 return sd_r1b;
710
711 case sd_disconnect_state:
712 if (sd->rca != rca)
713 return sd_r0;
714
715 sd->state = sd_programming_state;
716 return sd_r1b;
717
718 case sd_programming_state:
719 if (sd->rca == rca)
720 break;
721
722 sd->state = sd_disconnect_state;
723 return sd_r1b;
724
725 default:
726 break;
727 }
728 break;
729
730 case 8: /* CMD8: SEND_IF_COND */
731 /* Physical Layer Specification Version 2.00 command */
732 switch (sd->state) {
733 case sd_idle_state:
734 sd->vhs = 0;
735
736 /* No response if not exactly one VHS bit is set. */
737 if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff)))
738 return sd->spi ? sd_r7 : sd_r0;
739
740 /* Accept. */
741 sd->vhs = req.arg;
742 return sd_r7;
743
744 default:
745 break;
746 }
747 break;
748
749 case 9: /* CMD9: SEND_CSD */
750 switch (sd->state) {
751 case sd_standby_state:
752 if (sd->rca != rca)
753 return sd_r0;
754
755 return sd_r2_s;
756
757 case sd_transfer_state:
758 if (!sd->spi)
759 break;
760 sd->state = sd_sendingdata_state;
761 memcpy(sd->data, sd->csd, 16);
762 sd->data_start = addr;
763 sd->data_offset = 0;
764 return sd_r1;
765
766 default:
767 break;
768 }
769 break;
770
771 case 10: /* CMD10: SEND_CID */
772 switch (sd->state) {
773 case sd_standby_state:
774 if (sd->rca != rca)
775 return sd_r0;
776
777 return sd_r2_i;
778
779 case sd_transfer_state:
780 if (!sd->spi)
781 break;
782 sd->state = sd_sendingdata_state;
783 memcpy(sd->data, sd->cid, 16);
784 sd->data_start = addr;
785 sd->data_offset = 0;
786 return sd_r1;
787
788 default:
789 break;
790 }
791 break;
792
793 case 11: /* CMD11: READ_DAT_UNTIL_STOP */
794 if (sd->spi)
795 goto bad_cmd;
796 switch (sd->state) {
797 case sd_transfer_state:
798 sd->state = sd_sendingdata_state;
799 sd->data_start = req.arg;
800 sd->data_offset = 0;
801
802 if (sd->data_start + sd->blk_len > sd->size)
803 sd->card_status |= ADDRESS_ERROR;
804 return sd_r0;
805
806 default:
807 break;
808 }
809 break;
810
811 case 12: /* CMD12: STOP_TRANSMISSION */
812 switch (sd->state) {
813 case sd_sendingdata_state:
814 sd->state = sd_transfer_state;
815 return sd_r1b;
816
817 case sd_receivingdata_state:
818 sd->state = sd_programming_state;
819 /* Bzzzzzzztt .... Operation complete. */
820 sd->state = sd_transfer_state;
821 return sd_r1b;
822
823 default:
824 break;
825 }
826 break;
827
828 case 13: /* CMD13: SEND_STATUS */
829 switch (sd->mode) {
830 case sd_data_transfer_mode:
831 if (sd->rca != rca)
832 return sd_r0;
833
834 return sd_r1;
835
836 default:
837 break;
838 }
839 break;
840
841 case 15: /* CMD15: GO_INACTIVE_STATE */
842 if (sd->spi)
843 goto bad_cmd;
844 switch (sd->mode) {
845 case sd_data_transfer_mode:
846 if (sd->rca != rca)
847 return sd_r0;
848
849 sd->state = sd_inactive_state;
850 return sd_r0;
851
852 default:
853 break;
854 }
855 break;
856
857 /* Block read commands (Classs 2) */
858 case 16: /* CMD16: SET_BLOCKLEN */
859 switch (sd->state) {
860 case sd_transfer_state:
861 if (req.arg > (1 << HWBLOCK_SHIFT))
862 sd->card_status |= BLOCK_LEN_ERROR;
863 else
864 sd->blk_len = req.arg;
865
866 return sd_r1;
867
868 default:
869 break;
870 }
871 break;
872
873 case 17: /* CMD17: READ_SINGLE_BLOCK */
874 switch (sd->state) {
875 case sd_transfer_state:
876 sd->state = sd_sendingdata_state;
877 sd->data_start = addr;
878 sd->data_offset = 0;
879
880 if (sd->data_start + sd->blk_len > sd->size)
881 sd->card_status |= ADDRESS_ERROR;
882 return sd_r1;
883
884 default:
885 break;
886 }
887 break;
888
889 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
890 switch (sd->state) {
891 case sd_transfer_state:
892 sd->state = sd_sendingdata_state;
893 sd->data_start = addr;
894 sd->data_offset = 0;
895
896 if (sd->data_start + sd->blk_len > sd->size)
897 sd->card_status |= ADDRESS_ERROR;
898 return sd_r1;
899
900 default:
901 break;
902 }
903 break;
904
905 /* Block write commands (Class 4) */
906 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
907 if (sd->spi)
908 goto unimplemented_cmd;
909 switch (sd->state) {
910 case sd_transfer_state:
911 /* Writing in SPI mode not implemented. */
912 if (sd->spi)
913 break;
914 sd->state = sd_receivingdata_state;
915 sd->data_start = addr;
916 sd->data_offset = 0;
917 sd->blk_written = 0;
918
919 if (sd->data_start + sd->blk_len > sd->size)
920 sd->card_status |= ADDRESS_ERROR;
921 if (sd_wp_addr(sd, sd->data_start))
922 sd->card_status |= WP_VIOLATION;
923 if (sd->csd[14] & 0x30)
924 sd->card_status |= WP_VIOLATION;
925 return sd_r1;
926
927 default:
928 break;
929 }
930 break;
931
932 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
933 if (sd->spi)
934 goto unimplemented_cmd;
935 switch (sd->state) {
936 case sd_transfer_state:
937 /* Writing in SPI mode not implemented. */
938 if (sd->spi)
939 break;
940 sd->state = sd_receivingdata_state;
941 sd->data_start = addr;
942 sd->data_offset = 0;
943 sd->blk_written = 0;
944
945 if (sd->data_start + sd->blk_len > sd->size)
946 sd->card_status |= ADDRESS_ERROR;
947 if (sd_wp_addr(sd, sd->data_start))
948 sd->card_status |= WP_VIOLATION;
949 if (sd->csd[14] & 0x30)
950 sd->card_status |= WP_VIOLATION;
951 return sd_r1;
952
953 default:
954 break;
955 }
956 break;
957
958 case 26: /* CMD26: PROGRAM_CID */
959 if (sd->spi)
960 goto bad_cmd;
961 switch (sd->state) {
962 case sd_transfer_state:
963 sd->state = sd_receivingdata_state;
964 sd->data_start = 0;
965 sd->data_offset = 0;
966 return sd_r1;
967
968 default:
969 break;
970 }
971 break;
972
973 case 27: /* CMD27: PROGRAM_CSD */
974 if (sd->spi)
975 goto unimplemented_cmd;
976 switch (sd->state) {
977 case sd_transfer_state:
978 sd->state = sd_receivingdata_state;
979 sd->data_start = 0;
980 sd->data_offset = 0;
981 return sd_r1;
982
983 default:
984 break;
985 }
986 break;
987
988 /* Write protection (Class 6) */
989 case 28: /* CMD28: SET_WRITE_PROT */
990 switch (sd->state) {
991 case sd_transfer_state:
992 if (addr >= sd->size) {
993 sd->card_status = ADDRESS_ERROR;
994 return sd_r1b;
995 }
996
997 sd->state = sd_programming_state;
998 sd->wp_groups[addr >> (HWBLOCK_SHIFT +
999 SECTOR_SHIFT + WPGROUP_SHIFT)] = 1;
1000 /* Bzzzzzzztt .... Operation complete. */
1001 sd->state = sd_transfer_state;
1002 return sd_r1b;
1003
1004 default:
1005 break;
1006 }
1007 break;
1008
1009 case 29: /* CMD29: CLR_WRITE_PROT */
1010 switch (sd->state) {
1011 case sd_transfer_state:
1012 if (addr >= sd->size) {
1013 sd->card_status = ADDRESS_ERROR;
1014 return sd_r1b;
1015 }
1016
1017 sd->state = sd_programming_state;
1018 sd->wp_groups[addr >> (HWBLOCK_SHIFT +
1019 SECTOR_SHIFT + WPGROUP_SHIFT)] = 0;
1020 /* Bzzzzzzztt .... Operation complete. */
1021 sd->state = sd_transfer_state;
1022 return sd_r1b;
1023
1024 default:
1025 break;
1026 }
1027 break;
1028
1029 case 30: /* CMD30: SEND_WRITE_PROT */
1030 switch (sd->state) {
1031 case sd_transfer_state:
1032 sd->state = sd_sendingdata_state;
1033 *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);
1034 sd->data_start = addr;
1035 sd->data_offset = 0;
1036 return sd_r1b;
1037
1038 default:
1039 break;
1040 }
1041 break;
1042
1043 /* Erase commands (Class 5) */
1044 case 32: /* CMD32: ERASE_WR_BLK_START */
1045 switch (sd->state) {
1046 case sd_transfer_state:
1047 sd->erase_start = req.arg;
1048 return sd_r1;
1049
1050 default:
1051 break;
1052 }
1053 break;
1054
1055 case 33: /* CMD33: ERASE_WR_BLK_END */
1056 switch (sd->state) {
1057 case sd_transfer_state:
1058 sd->erase_end = req.arg;
1059 return sd_r1;
1060
1061 default:
1062 break;
1063 }
1064 break;
1065
1066 case 38: /* CMD38: ERASE */
1067 switch (sd->state) {
1068 case sd_transfer_state:
1069 if (sd->csd[14] & 0x30) {
1070 sd->card_status |= WP_VIOLATION;
1071 return sd_r1b;
1072 }
1073
1074 sd->state = sd_programming_state;
1075 sd_erase(sd);
1076 /* Bzzzzzzztt .... Operation complete. */
1077 sd->state = sd_transfer_state;
1078 return sd_r1b;
1079
1080 default:
1081 break;
1082 }
1083 break;
1084
1085 /* Lock card commands (Class 7) */
1086 case 42: /* CMD42: LOCK_UNLOCK */
1087 if (sd->spi)
1088 goto unimplemented_cmd;
1089 switch (sd->state) {
1090 case sd_transfer_state:
1091 sd->state = sd_receivingdata_state;
1092 sd->data_start = 0;
1093 sd->data_offset = 0;
1094 return sd_r1;
1095
1096 default:
1097 break;
1098 }
1099 break;
1100
1101 /* Application specific commands (Class 8) */
1102 case 55: /* CMD55: APP_CMD */
1103 if (sd->rca != rca)
1104 return sd_r0;
1105
1106 sd->card_status |= APP_CMD;
1107 return sd_r1;
1108
1109 case 56: /* CMD56: GEN_CMD */
1110 fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
1111
1112 switch (sd->state) {
1113 case sd_transfer_state:
1114 sd->data_offset = 0;
1115 if (req.arg & 1)
1116 sd->state = sd_sendingdata_state;
1117 else
1118 sd->state = sd_receivingdata_state;
1119 return sd_r1;
1120
1121 default:
1122 break;
1123 }
1124 break;
1125
1126 default:
1127 bad_cmd:
1128 sd->card_status |= ILLEGAL_COMMAND;
1129
1130 fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd);
1131 return sd_r0;
1132
1133 unimplemented_cmd:
1134 /* Commands that are recognised but not yet implemented in SPI mode. */
1135 sd->card_status |= ILLEGAL_COMMAND;
1136 fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd);
1137 return sd_r0;
1138 }
1139
1140 sd->card_status |= ILLEGAL_COMMAND;
1141 fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd);
1142 return sd_r0;
1143 }
1144
1145 static sd_rsp_type_t sd_app_command(SDState *sd,
1146 SDRequest req)
1147 {
1148 DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
1149 switch (req.cmd) {
1150 case 6: /* ACMD6: SET_BUS_WIDTH */
1151 switch (sd->state) {
1152 case sd_transfer_state:
1153 sd->sd_status[0] &= 0x3f;
1154 sd->sd_status[0] |= (req.arg & 0x03) << 6;
1155 return sd_r1;
1156
1157 default:
1158 break;
1159 }
1160 break;
1161
1162 case 13: /* ACMD13: SD_STATUS */
1163 switch (sd->state) {
1164 case sd_transfer_state:
1165 sd->data_start = 0;
1166 sd->data_offset = 0;
1167 return sd_r1;
1168
1169 default:
1170 break;
1171 }
1172 break;
1173
1174 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1175 switch (sd->state) {
1176 case sd_transfer_state:
1177 *(uint32_t *) sd->data = sd->blk_written;
1178
1179 sd->data_start = 0;
1180 sd->data_offset = 0;
1181 return sd_r1;
1182
1183 default:
1184 break;
1185 }
1186 break;
1187
1188 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */
1189 switch (sd->state) {
1190 case sd_transfer_state:
1191 return sd_r1;
1192
1193 default:
1194 break;
1195 }
1196 break;
1197
1198 case 41: /* ACMD41: SD_APP_OP_COND */
1199 if (sd->spi) {
1200 /* SEND_OP_CMD */
1201 sd->state = sd_transfer_state;
1202 return sd_r1;
1203 }
1204 switch (sd->state) {
1205 case sd_idle_state:
1206 /* We accept any voltage. 10000 V is nothing. */
1207 if (req.arg)
1208 sd->state = sd_ready_state;
1209
1210 return sd_r3;
1211
1212 default:
1213 break;
1214 }
1215 break;
1216
1217 case 42: /* ACMD42: SET_CLR_CARD_DETECT */
1218 switch (sd->state) {
1219 case sd_transfer_state:
1220 /* Bringing in the 50KOhm pull-up resistor... Done. */
1221 return sd_r1;
1222
1223 default:
1224 break;
1225 }
1226 break;
1227
1228 case 51: /* ACMD51: SEND_SCR */
1229 switch (sd->state) {
1230 case sd_transfer_state:
1231 sd->state = sd_sendingdata_state;
1232 sd->data_start = 0;
1233 sd->data_offset = 0;
1234 return sd_r1;
1235
1236 default:
1237 break;
1238 }
1239 break;
1240
1241 default:
1242 /* Fall back to standard commands. */
1243 sd->card_status &= ~APP_CMD;
1244 return sd_normal_command(sd, req);
1245 }
1246
1247 fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd);
1248 return sd_r0;
1249 }
1250
1251 int sd_do_command(SDState *sd, SDRequest *req,
1252 uint8_t *response) {
1253 uint32_t last_status = sd->card_status;
1254 sd_rsp_type_t rtype;
1255 int rsplen;
1256
1257 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) {
1258 return 0;
1259 }
1260
1261 if (sd_req_crc_validate(req)) {
1262 sd->card_status &= ~COM_CRC_ERROR;
1263 return 0;
1264 }
1265
1266 sd->card_status &= ~CARD_STATUS_B;
1267 sd_set_status(sd);
1268
1269 if (last_status & CARD_IS_LOCKED)
1270 if (((last_status & APP_CMD) &&
1271 req->cmd == 41) ||
1272 (!(last_status & APP_CMD) &&
1273 (sd_cmd_class[req->cmd] == 0 ||
1274 sd_cmd_class[req->cmd] == 7 ||
1275 req->cmd == 16 || req->cmd == 55))) {
1276 sd->card_status |= ILLEGAL_COMMAND;
1277 fprintf(stderr, "SD: Card is locked\n");
1278 return 0;
1279 }
1280
1281 if (last_status & APP_CMD) {
1282 rtype = sd_app_command(sd, *req);
1283 sd->card_status &= ~APP_CMD;
1284 } else
1285 rtype = sd_normal_command(sd, *req);
1286
1287 sd->current_cmd = req->cmd;
1288
1289 switch (rtype) {
1290 case sd_r1:
1291 case sd_r1b:
1292 sd_response_r1_make(sd, response, last_status);
1293 rsplen = 4;
1294 break;
1295
1296 case sd_r2_i:
1297 memcpy(response, sd->cid, sizeof(sd->cid));
1298 rsplen = 16;
1299 break;
1300
1301 case sd_r2_s:
1302 memcpy(response, sd->csd, sizeof(sd->csd));
1303 rsplen = 16;
1304 break;
1305
1306 case sd_r3:
1307 sd_response_r3_make(sd, response);
1308 rsplen = 4;
1309 break;
1310
1311 case sd_r6:
1312 sd_response_r6_make(sd, response);
1313 rsplen = 4;
1314 break;
1315
1316 case sd_r7:
1317 sd_response_r7_make(sd, response);
1318 rsplen = 4;
1319 break;
1320
1321 case sd_r0:
1322 default:
1323 rsplen = 0;
1324 break;
1325 }
1326
1327 if (sd->card_status & ILLEGAL_COMMAND)
1328 rsplen = 0;
1329
1330 #ifdef DEBUG_SD
1331 if (rsplen) {
1332 int i;
1333 DPRINTF("Response:");
1334 for (i = 0; i < rsplen; i++)
1335 printf(" %02x", response[i]);
1336 printf(" state %d\n", sd->state);
1337 } else {
1338 DPRINTF("No response %d\n", sd->state);
1339 }
1340 #endif
1341
1342 return rsplen;
1343 }
1344
1345 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
1346 {
1347 uint64_t end = addr + len;
1348
1349 DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
1350 (unsigned long long) addr, len);
1351 if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1352 fprintf(stderr, "sd_blk_read: read error on host side\n");
1353 return;
1354 }
1355
1356 if (end > (addr & ~511) + 512) {
1357 memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511));
1358
1359 if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1360 fprintf(stderr, "sd_blk_read: read error on host side\n");
1361 return;
1362 }
1363 memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511);
1364 } else
1365 memcpy(sd->data, sd->buf + (addr & 511), len);
1366 }
1367
1368 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
1369 {
1370 uint64_t end = addr + len;
1371
1372 if ((addr & 511) || len < 512)
1373 if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1374 fprintf(stderr, "sd_blk_write: read error on host side\n");
1375 return;
1376 }
1377
1378 if (end > (addr & ~511) + 512) {
1379 memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511));
1380 if (bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1) {
1381 fprintf(stderr, "sd_blk_write: write error on host side\n");
1382 return;
1383 }
1384
1385 if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) == -1) {
1386 fprintf(stderr, "sd_blk_write: read error on host side\n");
1387 return;
1388 }
1389 memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511);
1390 if (bdrv_write(sd->bdrv, end >> 9, sd->buf, 1) == -1)
1391 fprintf(stderr, "sd_blk_write: write error on host side\n");
1392 } else {
1393 memcpy(sd->buf + (addr & 511), sd->data, len);
1394 if (!sd->bdrv || bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) == -1)
1395 fprintf(stderr, "sd_blk_write: write error on host side\n");
1396 }
1397 }
1398
1399 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len)
1400 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len)
1401 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len)
1402 #define APP_WRITE_BLOCK(a, len)
1403
1404 void sd_write_data(SDState *sd, uint8_t value)
1405 {
1406 int i;
1407
1408 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1409 return;
1410
1411 if (sd->state != sd_receivingdata_state) {
1412 fprintf(stderr, "sd_write_data: not in Receiving-Data state\n");
1413 return;
1414 }
1415
1416 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1417 return;
1418
1419 switch (sd->current_cmd) {
1420 case 24: /* CMD24: WRITE_SINGLE_BLOCK */
1421 sd->data[sd->data_offset ++] = value;
1422 if (sd->data_offset >= sd->blk_len) {
1423 /* TODO: Check CRC before committing */
1424 sd->state = sd_programming_state;
1425 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1426 sd->blk_written ++;
1427 sd->csd[14] |= 0x40;
1428 /* Bzzzzzzztt .... Operation complete. */
1429 sd->state = sd_transfer_state;
1430 }
1431 break;
1432
1433 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */
1434 sd->data[sd->data_offset ++] = value;
1435 if (sd->data_offset >= sd->blk_len) {
1436 /* TODO: Check CRC before committing */
1437 sd->state = sd_programming_state;
1438 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset);
1439 sd->blk_written ++;
1440 sd->data_start += sd->blk_len;
1441 sd->data_offset = 0;
1442 if (sd->data_start + sd->blk_len > sd->size) {
1443 sd->card_status |= ADDRESS_ERROR;
1444 break;
1445 }
1446 if (sd_wp_addr(sd, sd->data_start)) {
1447 sd->card_status |= WP_VIOLATION;
1448 break;
1449 }
1450 sd->csd[14] |= 0x40;
1451
1452 /* Bzzzzzzztt .... Operation complete. */
1453 sd->state = sd_receivingdata_state;
1454 }
1455 break;
1456
1457 case 26: /* CMD26: PROGRAM_CID */
1458 sd->data[sd->data_offset ++] = value;
1459 if (sd->data_offset >= sizeof(sd->cid)) {
1460 /* TODO: Check CRC before committing */
1461 sd->state = sd_programming_state;
1462 for (i = 0; i < sizeof(sd->cid); i ++)
1463 if ((sd->cid[i] | 0x00) != sd->data[i])
1464 sd->card_status |= CID_CSD_OVERWRITE;
1465
1466 if (!(sd->card_status & CID_CSD_OVERWRITE))
1467 for (i = 0; i < sizeof(sd->cid); i ++) {
1468 sd->cid[i] |= 0x00;
1469 sd->cid[i] &= sd->data[i];
1470 }
1471 /* Bzzzzzzztt .... Operation complete. */
1472 sd->state = sd_transfer_state;
1473 }
1474 break;
1475
1476 case 27: /* CMD27: PROGRAM_CSD */
1477 sd->data[sd->data_offset ++] = value;
1478 if (sd->data_offset >= sizeof(sd->csd)) {
1479 /* TODO: Check CRC before committing */
1480 sd->state = sd_programming_state;
1481 for (i = 0; i < sizeof(sd->csd); i ++)
1482 if ((sd->csd[i] | sd_csd_rw_mask[i]) !=
1483 (sd->data[i] | sd_csd_rw_mask[i]))
1484 sd->card_status |= CID_CSD_OVERWRITE;
1485
1486 /* Copy flag (OTP) & Permanent write protect */
1487 if (sd->csd[14] & ~sd->data[14] & 0x60)
1488 sd->card_status |= CID_CSD_OVERWRITE;
1489
1490 if (!(sd->card_status & CID_CSD_OVERWRITE))
1491 for (i = 0; i < sizeof(sd->csd); i ++) {
1492 sd->csd[i] |= sd_csd_rw_mask[i];
1493 sd->csd[i] &= sd->data[i];
1494 }
1495 /* Bzzzzzzztt .... Operation complete. */
1496 sd->state = sd_transfer_state;
1497 }
1498 break;
1499
1500 case 42: /* CMD42: LOCK_UNLOCK */
1501 sd->data[sd->data_offset ++] = value;
1502 if (sd->data_offset >= sd->blk_len) {
1503 /* TODO: Check CRC before committing */
1504 sd->state = sd_programming_state;
1505 sd_lock_command(sd);
1506 /* Bzzzzzzztt .... Operation complete. */
1507 sd->state = sd_transfer_state;
1508 }
1509 break;
1510
1511 case 56: /* CMD56: GEN_CMD */
1512 sd->data[sd->data_offset ++] = value;
1513 if (sd->data_offset >= sd->blk_len) {
1514 APP_WRITE_BLOCK(sd->data_start, sd->data_offset);
1515 sd->state = sd_transfer_state;
1516 }
1517 break;
1518
1519 default:
1520 fprintf(stderr, "sd_write_data: unknown command\n");
1521 break;
1522 }
1523 }
1524
1525 uint8_t sd_read_data(SDState *sd)
1526 {
1527 /* TODO: Append CRCs */
1528 uint8_t ret;
1529 int io_len;
1530
1531 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable)
1532 return 0x00;
1533
1534 if (sd->state != sd_sendingdata_state) {
1535 fprintf(stderr, "sd_read_data: not in Sending-Data state\n");
1536 return 0x00;
1537 }
1538
1539 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
1540 return 0x00;
1541
1542 io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
1543
1544 switch (sd->current_cmd) {
1545 case 6: /* CMD6: SWITCH_FUNCTION */
1546 ret = sd->data[sd->data_offset ++];
1547
1548 if (sd->data_offset >= 64)
1549 sd->state = sd_transfer_state;
1550 break;
1551
1552 case 9: /* CMD9: SEND_CSD */
1553 case 10: /* CMD10: SEND_CID */
1554 ret = sd->data[sd->data_offset ++];
1555
1556 if (sd->data_offset >= 16)
1557 sd->state = sd_transfer_state;
1558 break;
1559
1560 case 11: /* CMD11: READ_DAT_UNTIL_STOP */
1561 if (sd->data_offset == 0)
1562 BLK_READ_BLOCK(sd->data_start, io_len);
1563 ret = sd->data[sd->data_offset ++];
1564
1565 if (sd->data_offset >= io_len) {
1566 sd->data_start += io_len;
1567 sd->data_offset = 0;
1568 if (sd->data_start + io_len > sd->size) {
1569 sd->card_status |= ADDRESS_ERROR;
1570 break;
1571 }
1572 }
1573 break;
1574
1575 case 13: /* ACMD13: SD_STATUS */
1576 ret = sd->sd_status[sd->data_offset ++];
1577
1578 if (sd->data_offset >= sizeof(sd->sd_status))
1579 sd->state = sd_transfer_state;
1580 break;
1581
1582 case 17: /* CMD17: READ_SINGLE_BLOCK */
1583 if (sd->data_offset == 0)
1584 BLK_READ_BLOCK(sd->data_start, io_len);
1585 ret = sd->data[sd->data_offset ++];
1586
1587 if (sd->data_offset >= io_len)
1588 sd->state = sd_transfer_state;
1589 break;
1590
1591 case 18: /* CMD18: READ_MULTIPLE_BLOCK */
1592 if (sd->data_offset == 0)
1593 BLK_READ_BLOCK(sd->data_start, io_len);
1594 ret = sd->data[sd->data_offset ++];
1595
1596 if (sd->data_offset >= io_len) {
1597 sd->data_start += io_len;
1598 sd->data_offset = 0;
1599 if (sd->data_start + io_len > sd->size) {
1600 sd->card_status |= ADDRESS_ERROR;
1601 break;
1602 }
1603 }
1604 break;
1605
1606 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */
1607 ret = sd->data[sd->data_offset ++];
1608
1609 if (sd->data_offset >= 4)
1610 sd->state = sd_transfer_state;
1611 break;
1612
1613 case 30: /* CMD30: SEND_WRITE_PROT */
1614 ret = sd->data[sd->data_offset ++];
1615
1616 if (sd->data_offset >= 4)
1617 sd->state = sd_transfer_state;
1618 break;
1619
1620 case 51: /* ACMD51: SEND_SCR */
1621 ret = sd->scr[sd->data_offset ++];
1622
1623 if (sd->data_offset >= sizeof(sd->scr))
1624 sd->state = sd_transfer_state;
1625 break;
1626
1627 case 56: /* CMD56: GEN_CMD */
1628 if (sd->data_offset == 0)
1629 APP_READ_BLOCK(sd->data_start, sd->blk_len);
1630 ret = sd->data[sd->data_offset ++];
1631
1632 if (sd->data_offset >= sd->blk_len)
1633 sd->state = sd_transfer_state;
1634 break;
1635
1636 default:
1637 fprintf(stderr, "sd_read_data: unknown command\n");
1638 return 0x00;
1639 }
1640
1641 return ret;
1642 }
1643
1644 int sd_data_ready(SDState *sd)
1645 {
1646 return sd->state == sd_sendingdata_state;
1647 }
1648
1649 void sd_enable(SDState *sd, int enable)
1650 {
1651 sd->enable = enable;
1652 }
Qemu copy for testing