1 /* 2 * SD Memory Card emulation as defined in the "SD Memory Card Physical 3 * layer specification, Version 1.10." 4 * 5 * Copyright (c) 2006 Andrzej Zaborowski <balrog@zabor.org> 6 * Copyright (c) 2007 CodeSourcery 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the 17 * distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' 20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 21 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 22 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR 23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 24 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 25 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 26 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY 27 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 29 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include "hw/hw.h" 33 #include "block/block.h" 34 #include "hw/sd.h" 35 #include "qemu/bitmap.h" 36 37 //#define DEBUG_SD 1 38 39 #ifdef DEBUG_SD 40 #define DPRINTF(fmt, ...) \ 41 do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0) 42 #else 43 #define DPRINTF(fmt, ...) do {} while(0) 44 #endif 45 46 #define ACMD41_ENQUIRY_MASK 0x00ffffff 47 48 typedef enum { 49 sd_r0 = 0, /* no response */ 50 sd_r1, /* normal response command */ 51 sd_r2_i, /* CID register */ 52 sd_r2_s, /* CSD register */ 53 sd_r3, /* OCR register */ 54 sd_r6 = 6, /* Published RCA response */ 55 sd_r7, /* Operating voltage */ 56 sd_r1b = -1, 57 sd_illegal = -2, 58 } sd_rsp_type_t; 59 60 enum SDCardModes { 61 sd_inactive, 62 sd_card_identification_mode, 63 sd_data_transfer_mode, 64 }; 65 66 enum SDCardStates { 67 sd_inactive_state = -1, 68 sd_idle_state = 0, 69 sd_ready_state, 70 sd_identification_state, 71 sd_standby_state, 72 sd_transfer_state, 73 sd_sendingdata_state, 74 sd_receivingdata_state, 75 sd_programming_state, 76 sd_disconnect_state, 77 }; 78 79 struct SDState { 80 uint32_t mode; /* current card mode, one of SDCardModes */ 81 int32_t state; /* current card state, one of SDCardStates */ 82 uint32_t ocr; 83 uint8_t scr[8]; 84 uint8_t cid[16]; 85 uint8_t csd[16]; 86 uint16_t rca; 87 uint32_t card_status; 88 uint8_t sd_status[64]; 89 uint32_t vhs; 90 bool wp_switch; 91 unsigned long *wp_groups; 92 int32_t wpgrps_size; 93 uint64_t size; 94 uint32_t blk_len; 95 uint32_t erase_start; 96 uint32_t erase_end; 97 uint8_t pwd[16]; 98 uint32_t pwd_len; 99 uint8_t function_group[6]; 100 101 bool spi; 102 uint8_t current_cmd; 103 /* True if we will handle the next command as an ACMD. Note that this does 104 * *not* track the APP_CMD status bit! 105 */ 106 bool expecting_acmd; 107 uint32_t blk_written; 108 uint64_t data_start; 109 uint32_t data_offset; 110 uint8_t data[512]; 111 qemu_irq readonly_cb; 112 qemu_irq inserted_cb; 113 BlockDriverState *bdrv; 114 uint8_t *buf; 115 116 bool enable; 117 }; 118 119 static void sd_set_mode(SDState *sd) 120 { 121 switch (sd->state) { 122 case sd_inactive_state: 123 sd->mode = sd_inactive; 124 break; 125 126 case sd_idle_state: 127 case sd_ready_state: 128 case sd_identification_state: 129 sd->mode = sd_card_identification_mode; 130 break; 131 132 case sd_standby_state: 133 case sd_transfer_state: 134 case sd_sendingdata_state: 135 case sd_receivingdata_state: 136 case sd_programming_state: 137 case sd_disconnect_state: 138 sd->mode = sd_data_transfer_mode; 139 break; 140 } 141 } 142 143 static const sd_cmd_type_t sd_cmd_type[64] = { 144 sd_bc, sd_none, sd_bcr, sd_bcr, sd_none, sd_none, sd_none, sd_ac, 145 sd_bcr, sd_ac, sd_ac, sd_adtc, sd_ac, sd_ac, sd_none, sd_ac, 146 sd_ac, sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, 147 sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac, sd_ac, sd_adtc, sd_none, 148 sd_ac, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none, 149 sd_none, sd_none, sd_bc, sd_none, sd_none, sd_none, sd_none, sd_none, 150 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac, 151 sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, 152 }; 153 154 static const sd_cmd_type_t sd_acmd_type[64] = { 155 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac, sd_none, 156 sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, 157 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac, 158 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, 159 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, 160 sd_none, sd_bcr, sd_ac, sd_none, sd_none, sd_none, sd_none, sd_none, 161 sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none, 162 sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, 163 }; 164 165 static const int sd_cmd_class[64] = { 166 0, 0, 0, 0, 0, 9, 10, 0, 0, 0, 0, 1, 0, 0, 0, 0, 167 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 6, 6, 6, 6, 168 5, 5, 10, 10, 10, 10, 5, 9, 9, 9, 7, 7, 7, 7, 7, 7, 169 7, 7, 10, 7, 9, 9, 9, 8, 8, 10, 8, 8, 8, 8, 8, 8, 170 }; 171 172 static uint8_t sd_crc7(void *message, size_t width) 173 { 174 int i, bit; 175 uint8_t shift_reg = 0x00; 176 uint8_t *msg = (uint8_t *) message; 177 178 for (i = 0; i < width; i ++, msg ++) 179 for (bit = 7; bit >= 0; bit --) { 180 shift_reg <<= 1; 181 if ((shift_reg >> 7) ^ ((*msg >> bit) & 1)) 182 shift_reg ^= 0x89; 183 } 184 185 return shift_reg; 186 } 187 188 static uint16_t sd_crc16(void *message, size_t width) 189 { 190 int i, bit; 191 uint16_t shift_reg = 0x0000; 192 uint16_t *msg = (uint16_t *) message; 193 width <<= 1; 194 195 for (i = 0; i < width; i ++, msg ++) 196 for (bit = 15; bit >= 0; bit --) { 197 shift_reg <<= 1; 198 if ((shift_reg >> 15) ^ ((*msg >> bit) & 1)) 199 shift_reg ^= 0x1011; 200 } 201 202 return shift_reg; 203 } 204 205 static void sd_set_ocr(SDState *sd) 206 { 207 /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */ 208 sd->ocr = 0x80ffff00; 209 } 210 211 static void sd_set_scr(SDState *sd) 212 { 213 sd->scr[0] = 0x00; /* SCR Structure */ 214 sd->scr[1] = 0x2f; /* SD Security Support */ 215 sd->scr[2] = 0x00; 216 sd->scr[3] = 0x00; 217 sd->scr[4] = 0x00; 218 sd->scr[5] = 0x00; 219 sd->scr[6] = 0x00; 220 sd->scr[7] = 0x00; 221 } 222 223 #define MID 0xaa 224 #define OID "XY" 225 #define PNM "QEMU!" 226 #define PRV 0x01 227 #define MDT_YR 2006 228 #define MDT_MON 2 229 230 static void sd_set_cid(SDState *sd) 231 { 232 sd->cid[0] = MID; /* Fake card manufacturer ID (MID) */ 233 sd->cid[1] = OID[0]; /* OEM/Application ID (OID) */ 234 sd->cid[2] = OID[1]; 235 sd->cid[3] = PNM[0]; /* Fake product name (PNM) */ 236 sd->cid[4] = PNM[1]; 237 sd->cid[5] = PNM[2]; 238 sd->cid[6] = PNM[3]; 239 sd->cid[7] = PNM[4]; 240 sd->cid[8] = PRV; /* Fake product revision (PRV) */ 241 sd->cid[9] = 0xde; /* Fake serial number (PSN) */ 242 sd->cid[10] = 0xad; 243 sd->cid[11] = 0xbe; 244 sd->cid[12] = 0xef; 245 sd->cid[13] = 0x00 | /* Manufacture date (MDT) */ 246 ((MDT_YR - 2000) / 10); 247 sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON; 248 sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1; 249 } 250 251 #define HWBLOCK_SHIFT 9 /* 512 bytes */ 252 #define SECTOR_SHIFT 5 /* 16 kilobytes */ 253 #define WPGROUP_SHIFT 7 /* 2 megs */ 254 #define CMULT_SHIFT 9 /* 512 times HWBLOCK_SIZE */ 255 #define WPGROUP_SIZE (1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) 256 257 static const uint8_t sd_csd_rw_mask[16] = { 258 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 259 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe, 260 }; 261 262 static void sd_set_csd(SDState *sd, uint64_t size) 263 { 264 uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1; 265 uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1; 266 uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1; 267 268 if (size <= 0x40000000) { /* Standard Capacity SD */ 269 sd->csd[0] = 0x00; /* CSD structure */ 270 sd->csd[1] = 0x26; /* Data read access-time-1 */ 271 sd->csd[2] = 0x00; /* Data read access-time-2 */ 272 sd->csd[3] = 0x5a; /* Max. data transfer rate */ 273 sd->csd[4] = 0x5f; /* Card Command Classes */ 274 sd->csd[5] = 0x50 | /* Max. read data block length */ 275 HWBLOCK_SHIFT; 276 sd->csd[6] = 0xe0 | /* Partial block for read allowed */ 277 ((csize >> 10) & 0x03); 278 sd->csd[7] = 0x00 | /* Device size */ 279 ((csize >> 2) & 0xff); 280 sd->csd[8] = 0x3f | /* Max. read current */ 281 ((csize << 6) & 0xc0); 282 sd->csd[9] = 0xfc | /* Max. write current */ 283 ((CMULT_SHIFT - 2) >> 1); 284 sd->csd[10] = 0x40 | /* Erase sector size */ 285 (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1); 286 sd->csd[11] = 0x00 | /* Write protect group size */ 287 ((sectsize << 7) & 0x80) | wpsize; 288 sd->csd[12] = 0x90 | /* Write speed factor */ 289 (HWBLOCK_SHIFT >> 2); 290 sd->csd[13] = 0x20 | /* Max. write data block length */ 291 ((HWBLOCK_SHIFT << 6) & 0xc0); 292 sd->csd[14] = 0x00; /* File format group */ 293 sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1; 294 } else { /* SDHC */ 295 size /= 512 * 1024; 296 size -= 1; 297 sd->csd[0] = 0x40; 298 sd->csd[1] = 0x0e; 299 sd->csd[2] = 0x00; 300 sd->csd[3] = 0x32; 301 sd->csd[4] = 0x5b; 302 sd->csd[5] = 0x59; 303 sd->csd[6] = 0x00; 304 sd->csd[7] = (size >> 16) & 0xff; 305 sd->csd[8] = (size >> 8) & 0xff; 306 sd->csd[9] = (size & 0xff); 307 sd->csd[10] = 0x7f; 308 sd->csd[11] = 0x80; 309 sd->csd[12] = 0x0a; 310 sd->csd[13] = 0x40; 311 sd->csd[14] = 0x00; 312 sd->csd[15] = 0x00; 313 sd->ocr |= 1 << 30; /* High Capacity SD Memory Card */ 314 } 315 } 316 317 static void sd_set_rca(SDState *sd) 318 { 319 sd->rca += 0x4567; 320 } 321 322 /* Card status bits, split by clear condition: 323 * A : According to the card current state 324 * B : Always related to the previous command 325 * C : Cleared by read 326 */ 327 #define CARD_STATUS_A 0x02004100 328 #define CARD_STATUS_B 0x00c01e00 329 #define CARD_STATUS_C 0xfd39a028 330 331 static void sd_set_cardstatus(SDState *sd) 332 { 333 sd->card_status = 0x00000100; 334 } 335 336 static void sd_set_sdstatus(SDState *sd) 337 { 338 memset(sd->sd_status, 0, 64); 339 } 340 341 static int sd_req_crc_validate(SDRequest *req) 342 { 343 uint8_t buffer[5]; 344 buffer[0] = 0x40 | req->cmd; 345 buffer[1] = (req->arg >> 24) & 0xff; 346 buffer[2] = (req->arg >> 16) & 0xff; 347 buffer[3] = (req->arg >> 8) & 0xff; 348 buffer[4] = (req->arg >> 0) & 0xff; 349 return 0; 350 return sd_crc7(buffer, 5) != req->crc; /* TODO */ 351 } 352 353 static void sd_response_r1_make(SDState *sd, uint8_t *response) 354 { 355 uint32_t status = sd->card_status; 356 /* Clear the "clear on read" status bits */ 357 sd->card_status &= ~CARD_STATUS_C; 358 359 response[0] = (status >> 24) & 0xff; 360 response[1] = (status >> 16) & 0xff; 361 response[2] = (status >> 8) & 0xff; 362 response[3] = (status >> 0) & 0xff; 363 } 364 365 static void sd_response_r3_make(SDState *sd, uint8_t *response) 366 { 367 response[0] = (sd->ocr >> 24) & 0xff; 368 response[1] = (sd->ocr >> 16) & 0xff; 369 response[2] = (sd->ocr >> 8) & 0xff; 370 response[3] = (sd->ocr >> 0) & 0xff; 371 } 372 373 static void sd_response_r6_make(SDState *sd, uint8_t *response) 374 { 375 uint16_t arg; 376 uint16_t status; 377 378 arg = sd->rca; 379 status = ((sd->card_status >> 8) & 0xc000) | 380 ((sd->card_status >> 6) & 0x2000) | 381 (sd->card_status & 0x1fff); 382 sd->card_status &= ~(CARD_STATUS_C & 0xc81fff); 383 384 response[0] = (arg >> 8) & 0xff; 385 response[1] = arg & 0xff; 386 response[2] = (status >> 8) & 0xff; 387 response[3] = status & 0xff; 388 } 389 390 static void sd_response_r7_make(SDState *sd, uint8_t *response) 391 { 392 response[0] = (sd->vhs >> 24) & 0xff; 393 response[1] = (sd->vhs >> 16) & 0xff; 394 response[2] = (sd->vhs >> 8) & 0xff; 395 response[3] = (sd->vhs >> 0) & 0xff; 396 } 397 398 static inline uint64_t sd_addr_to_wpnum(uint64_t addr) 399 { 400 return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT); 401 } 402 403 static void sd_reset(SDState *sd, BlockDriverState *bdrv) 404 { 405 uint64_t size; 406 uint64_t sect; 407 408 if (bdrv) { 409 bdrv_get_geometry(bdrv, §); 410 } else { 411 sect = 0; 412 } 413 size = sect << 9; 414 415 sect = sd_addr_to_wpnum(size) + 1; 416 417 sd->state = sd_idle_state; 418 sd->rca = 0x0000; 419 sd_set_ocr(sd); 420 sd_set_scr(sd); 421 sd_set_cid(sd); 422 sd_set_csd(sd, size); 423 sd_set_cardstatus(sd); 424 sd_set_sdstatus(sd); 425 426 sd->bdrv = bdrv; 427 428 if (sd->wp_groups) 429 g_free(sd->wp_groups); 430 sd->wp_switch = bdrv ? bdrv_is_read_only(bdrv) : false; 431 sd->wpgrps_size = sect; 432 sd->wp_groups = bitmap_new(sd->wpgrps_size); 433 memset(sd->function_group, 0, sizeof(sd->function_group)); 434 sd->erase_start = 0; 435 sd->erase_end = 0; 436 sd->size = size; 437 sd->blk_len = 0x200; 438 sd->pwd_len = 0; 439 sd->expecting_acmd = false; 440 } 441 442 static void sd_cardchange(void *opaque, bool load) 443 { 444 SDState *sd = opaque; 445 446 qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv)); 447 if (bdrv_is_inserted(sd->bdrv)) { 448 sd_reset(sd, sd->bdrv); 449 qemu_set_irq(sd->readonly_cb, sd->wp_switch); 450 } 451 } 452 453 static const BlockDevOps sd_block_ops = { 454 .change_media_cb = sd_cardchange, 455 }; 456 457 static const VMStateDescription sd_vmstate = { 458 .name = "sd-card", 459 .version_id = 1, 460 .minimum_version_id = 1, 461 .fields = (VMStateField[]) { 462 VMSTATE_UINT32(mode, SDState), 463 VMSTATE_INT32(state, SDState), 464 VMSTATE_UINT8_ARRAY(cid, SDState, 16), 465 VMSTATE_UINT8_ARRAY(csd, SDState, 16), 466 VMSTATE_UINT16(rca, SDState), 467 VMSTATE_UINT32(card_status, SDState), 468 VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1), 469 VMSTATE_UINT32(vhs, SDState), 470 VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size), 471 VMSTATE_UINT32(blk_len, SDState), 472 VMSTATE_UINT32(erase_start, SDState), 473 VMSTATE_UINT32(erase_end, SDState), 474 VMSTATE_UINT8_ARRAY(pwd, SDState, 16), 475 VMSTATE_UINT32(pwd_len, SDState), 476 VMSTATE_UINT8_ARRAY(function_group, SDState, 6), 477 VMSTATE_UINT8(current_cmd, SDState), 478 VMSTATE_BOOL(expecting_acmd, SDState), 479 VMSTATE_UINT32(blk_written, SDState), 480 VMSTATE_UINT64(data_start, SDState), 481 VMSTATE_UINT32(data_offset, SDState), 482 VMSTATE_UINT8_ARRAY(data, SDState, 512), 483 VMSTATE_BUFFER_POINTER_UNSAFE(buf, SDState, 1, 512), 484 VMSTATE_BOOL(enable, SDState), 485 VMSTATE_END_OF_LIST() 486 } 487 }; 488 489 /* We do not model the chip select pin, so allow the board to select 490 whether card should be in SSI or MMC/SD mode. It is also up to the 491 board to ensure that ssi transfers only occur when the chip select 492 is asserted. */ 493 SDState *sd_init(BlockDriverState *bs, bool is_spi) 494 { 495 SDState *sd; 496 497 if (bs && bdrv_is_read_only(bs)) { 498 fprintf(stderr, "sd_init: Cannot use read-only drive\n"); 499 return NULL; 500 } 501 502 sd = (SDState *) g_malloc0(sizeof(SDState)); 503 sd->buf = qemu_blockalign(bs, 512); 504 sd->spi = is_spi; 505 sd->enable = true; 506 sd_reset(sd, bs); 507 if (sd->bdrv) { 508 bdrv_attach_dev_nofail(sd->bdrv, sd); 509 bdrv_set_dev_ops(sd->bdrv, &sd_block_ops, sd); 510 } 511 vmstate_register(NULL, -1, &sd_vmstate, sd); 512 return sd; 513 } 514 515 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert) 516 { 517 sd->readonly_cb = readonly; 518 sd->inserted_cb = insert; 519 qemu_set_irq(readonly, sd->bdrv ? bdrv_is_read_only(sd->bdrv) : 0); 520 qemu_set_irq(insert, sd->bdrv ? bdrv_is_inserted(sd->bdrv) : 0); 521 } 522 523 static void sd_erase(SDState *sd) 524 { 525 int i; 526 uint64_t erase_start = sd->erase_start; 527 uint64_t erase_end = sd->erase_end; 528 529 if (!sd->erase_start || !sd->erase_end) { 530 sd->card_status |= ERASE_SEQ_ERROR; 531 return; 532 } 533 534 if (extract32(sd->ocr, OCR_CCS_BITN, 1)) { 535 /* High capacity memory card: erase units are 512 byte blocks */ 536 erase_start *= 512; 537 erase_end *= 512; 538 } 539 540 erase_start = sd_addr_to_wpnum(erase_start); 541 erase_end = sd_addr_to_wpnum(erase_end); 542 sd->erase_start = 0; 543 sd->erase_end = 0; 544 sd->csd[14] |= 0x40; 545 546 for (i = erase_start; i <= erase_end; i++) { 547 if (test_bit(i, sd->wp_groups)) { 548 sd->card_status |= WP_ERASE_SKIP; 549 } 550 } 551 } 552 553 static uint32_t sd_wpbits(SDState *sd, uint64_t addr) 554 { 555 uint32_t i, wpnum; 556 uint32_t ret = 0; 557 558 wpnum = sd_addr_to_wpnum(addr); 559 560 for (i = 0; i < 32; i++, wpnum++, addr += WPGROUP_SIZE) { 561 if (addr < sd->size && test_bit(wpnum, sd->wp_groups)) { 562 ret |= (1 << i); 563 } 564 } 565 566 return ret; 567 } 568 569 static void sd_function_switch(SDState *sd, uint32_t arg) 570 { 571 int i, mode, new_func, crc; 572 mode = !!(arg & 0x80000000); 573 574 sd->data[0] = 0x00; /* Maximum current consumption */ 575 sd->data[1] = 0x01; 576 sd->data[2] = 0x80; /* Supported group 6 functions */ 577 sd->data[3] = 0x01; 578 sd->data[4] = 0x80; /* Supported group 5 functions */ 579 sd->data[5] = 0x01; 580 sd->data[6] = 0x80; /* Supported group 4 functions */ 581 sd->data[7] = 0x01; 582 sd->data[8] = 0x80; /* Supported group 3 functions */ 583 sd->data[9] = 0x01; 584 sd->data[10] = 0x80; /* Supported group 2 functions */ 585 sd->data[11] = 0x43; 586 sd->data[12] = 0x80; /* Supported group 1 functions */ 587 sd->data[13] = 0x03; 588 for (i = 0; i < 6; i ++) { 589 new_func = (arg >> (i * 4)) & 0x0f; 590 if (mode && new_func != 0x0f) 591 sd->function_group[i] = new_func; 592 sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4); 593 } 594 memset(&sd->data[17], 0, 47); 595 crc = sd_crc16(sd->data, 64); 596 sd->data[65] = crc >> 8; 597 sd->data[66] = crc & 0xff; 598 } 599 600 static inline bool sd_wp_addr(SDState *sd, uint64_t addr) 601 { 602 return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups); 603 } 604 605 static void sd_lock_command(SDState *sd) 606 { 607 int erase, lock, clr_pwd, set_pwd, pwd_len; 608 erase = !!(sd->data[0] & 0x08); 609 lock = sd->data[0] & 0x04; 610 clr_pwd = sd->data[0] & 0x02; 611 set_pwd = sd->data[0] & 0x01; 612 613 if (sd->blk_len > 1) 614 pwd_len = sd->data[1]; 615 else 616 pwd_len = 0; 617 618 if (erase) { 619 if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 || 620 set_pwd || clr_pwd || lock || sd->wp_switch || 621 (sd->csd[14] & 0x20)) { 622 sd->card_status |= LOCK_UNLOCK_FAILED; 623 return; 624 } 625 bitmap_zero(sd->wp_groups, sd->wpgrps_size); 626 sd->csd[14] &= ~0x10; 627 sd->card_status &= ~CARD_IS_LOCKED; 628 sd->pwd_len = 0; 629 /* Erasing the entire card here! */ 630 fprintf(stderr, "SD: Card force-erased by CMD42\n"); 631 return; 632 } 633 634 if (sd->blk_len < 2 + pwd_len || 635 pwd_len <= sd->pwd_len || 636 pwd_len > sd->pwd_len + 16) { 637 sd->card_status |= LOCK_UNLOCK_FAILED; 638 return; 639 } 640 641 if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) { 642 sd->card_status |= LOCK_UNLOCK_FAILED; 643 return; 644 } 645 646 pwd_len -= sd->pwd_len; 647 if ((pwd_len && !set_pwd) || 648 (clr_pwd && (set_pwd || lock)) || 649 (lock && !sd->pwd_len && !set_pwd) || 650 (!set_pwd && !clr_pwd && 651 (((sd->card_status & CARD_IS_LOCKED) && lock) || 652 (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) { 653 sd->card_status |= LOCK_UNLOCK_FAILED; 654 return; 655 } 656 657 if (set_pwd) { 658 memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len); 659 sd->pwd_len = pwd_len; 660 } 661 662 if (clr_pwd) { 663 sd->pwd_len = 0; 664 } 665 666 if (lock) 667 sd->card_status |= CARD_IS_LOCKED; 668 else 669 sd->card_status &= ~CARD_IS_LOCKED; 670 } 671 672 static sd_rsp_type_t sd_normal_command(SDState *sd, 673 SDRequest req) 674 { 675 uint32_t rca = 0x0000; 676 uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg; 677 678 /* Not interpreting this as an app command */ 679 sd->card_status &= ~APP_CMD; 680 681 if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc) 682 rca = req.arg >> 16; 683 684 DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state); 685 switch (req.cmd) { 686 /* Basic commands (Class 0 and Class 1) */ 687 case 0: /* CMD0: GO_IDLE_STATE */ 688 switch (sd->state) { 689 case sd_inactive_state: 690 return sd->spi ? sd_r1 : sd_r0; 691 692 default: 693 sd->state = sd_idle_state; 694 sd_reset(sd, sd->bdrv); 695 return sd->spi ? sd_r1 : sd_r0; 696 } 697 break; 698 699 case 1: /* CMD1: SEND_OP_CMD */ 700 if (!sd->spi) 701 goto bad_cmd; 702 703 sd->state = sd_transfer_state; 704 return sd_r1; 705 706 case 2: /* CMD2: ALL_SEND_CID */ 707 if (sd->spi) 708 goto bad_cmd; 709 switch (sd->state) { 710 case sd_ready_state: 711 sd->state = sd_identification_state; 712 return sd_r2_i; 713 714 default: 715 break; 716 } 717 break; 718 719 case 3: /* CMD3: SEND_RELATIVE_ADDR */ 720 if (sd->spi) 721 goto bad_cmd; 722 switch (sd->state) { 723 case sd_identification_state: 724 case sd_standby_state: 725 sd->state = sd_standby_state; 726 sd_set_rca(sd); 727 return sd_r6; 728 729 default: 730 break; 731 } 732 break; 733 734 case 4: /* CMD4: SEND_DSR */ 735 if (sd->spi) 736 goto bad_cmd; 737 switch (sd->state) { 738 case sd_standby_state: 739 break; 740 741 default: 742 break; 743 } 744 break; 745 746 case 5: /* CMD5: reserved for SDIO cards */ 747 return sd_illegal; 748 749 case 6: /* CMD6: SWITCH_FUNCTION */ 750 if (sd->spi) 751 goto bad_cmd; 752 switch (sd->mode) { 753 case sd_data_transfer_mode: 754 sd_function_switch(sd, req.arg); 755 sd->state = sd_sendingdata_state; 756 sd->data_start = 0; 757 sd->data_offset = 0; 758 return sd_r1; 759 760 default: 761 break; 762 } 763 break; 764 765 case 7: /* CMD7: SELECT/DESELECT_CARD */ 766 if (sd->spi) 767 goto bad_cmd; 768 switch (sd->state) { 769 case sd_standby_state: 770 if (sd->rca != rca) 771 return sd_r0; 772 773 sd->state = sd_transfer_state; 774 return sd_r1b; 775 776 case sd_transfer_state: 777 case sd_sendingdata_state: 778 if (sd->rca == rca) 779 break; 780 781 sd->state = sd_standby_state; 782 return sd_r1b; 783 784 case sd_disconnect_state: 785 if (sd->rca != rca) 786 return sd_r0; 787 788 sd->state = sd_programming_state; 789 return sd_r1b; 790 791 case sd_programming_state: 792 if (sd->rca == rca) 793 break; 794 795 sd->state = sd_disconnect_state; 796 return sd_r1b; 797 798 default: 799 break; 800 } 801 break; 802 803 case 8: /* CMD8: SEND_IF_COND */ 804 /* Physical Layer Specification Version 2.00 command */ 805 switch (sd->state) { 806 case sd_idle_state: 807 sd->vhs = 0; 808 809 /* No response if not exactly one VHS bit is set. */ 810 if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff))) 811 return sd->spi ? sd_r7 : sd_r0; 812 813 /* Accept. */ 814 sd->vhs = req.arg; 815 return sd_r7; 816 817 default: 818 break; 819 } 820 break; 821 822 case 9: /* CMD9: SEND_CSD */ 823 switch (sd->state) { 824 case sd_standby_state: 825 if (sd->rca != rca) 826 return sd_r0; 827 828 return sd_r2_s; 829 830 case sd_transfer_state: 831 if (!sd->spi) 832 break; 833 sd->state = sd_sendingdata_state; 834 memcpy(sd->data, sd->csd, 16); 835 sd->data_start = addr; 836 sd->data_offset = 0; 837 return sd_r1; 838 839 default: 840 break; 841 } 842 break; 843 844 case 10: /* CMD10: SEND_CID */ 845 switch (sd->state) { 846 case sd_standby_state: 847 if (sd->rca != rca) 848 return sd_r0; 849 850 return sd_r2_i; 851 852 case sd_transfer_state: 853 if (!sd->spi) 854 break; 855 sd->state = sd_sendingdata_state; 856 memcpy(sd->data, sd->cid, 16); 857 sd->data_start = addr; 858 sd->data_offset = 0; 859 return sd_r1; 860 861 default: 862 break; 863 } 864 break; 865 866 case 11: /* CMD11: READ_DAT_UNTIL_STOP */ 867 if (sd->spi) 868 goto bad_cmd; 869 switch (sd->state) { 870 case sd_transfer_state: 871 sd->state = sd_sendingdata_state; 872 sd->data_start = req.arg; 873 sd->data_offset = 0; 874 875 if (sd->data_start + sd->blk_len > sd->size) 876 sd->card_status |= ADDRESS_ERROR; 877 return sd_r0; 878 879 default: 880 break; 881 } 882 break; 883 884 case 12: /* CMD12: STOP_TRANSMISSION */ 885 switch (sd->state) { 886 case sd_sendingdata_state: 887 sd->state = sd_transfer_state; 888 return sd_r1b; 889 890 case sd_receivingdata_state: 891 sd->state = sd_programming_state; 892 /* Bzzzzzzztt .... Operation complete. */ 893 sd->state = sd_transfer_state; 894 return sd_r1b; 895 896 default: 897 break; 898 } 899 break; 900 901 case 13: /* CMD13: SEND_STATUS */ 902 switch (sd->mode) { 903 case sd_data_transfer_mode: 904 if (sd->rca != rca) 905 return sd_r0; 906 907 return sd_r1; 908 909 default: 910 break; 911 } 912 break; 913 914 case 15: /* CMD15: GO_INACTIVE_STATE */ 915 if (sd->spi) 916 goto bad_cmd; 917 switch (sd->mode) { 918 case sd_data_transfer_mode: 919 if (sd->rca != rca) 920 return sd_r0; 921 922 sd->state = sd_inactive_state; 923 return sd_r0; 924 925 default: 926 break; 927 } 928 break; 929 930 /* Block read commands (Classs 2) */ 931 case 16: /* CMD16: SET_BLOCKLEN */ 932 switch (sd->state) { 933 case sd_transfer_state: 934 if (req.arg > (1 << HWBLOCK_SHIFT)) 935 sd->card_status |= BLOCK_LEN_ERROR; 936 else 937 sd->blk_len = req.arg; 938 939 return sd_r1; 940 941 default: 942 break; 943 } 944 break; 945 946 case 17: /* CMD17: READ_SINGLE_BLOCK */ 947 switch (sd->state) { 948 case sd_transfer_state: 949 sd->state = sd_sendingdata_state; 950 sd->data_start = addr; 951 sd->data_offset = 0; 952 953 if (sd->data_start + sd->blk_len > sd->size) 954 sd->card_status |= ADDRESS_ERROR; 955 return sd_r1; 956 957 default: 958 break; 959 } 960 break; 961 962 case 18: /* CMD18: READ_MULTIPLE_BLOCK */ 963 switch (sd->state) { 964 case sd_transfer_state: 965 sd->state = sd_sendingdata_state; 966 sd->data_start = addr; 967 sd->data_offset = 0; 968 969 if (sd->data_start + sd->blk_len > sd->size) 970 sd->card_status |= ADDRESS_ERROR; 971 return sd_r1; 972 973 default: 974 break; 975 } 976 break; 977 978 /* Block write commands (Class 4) */ 979 case 24: /* CMD24: WRITE_SINGLE_BLOCK */ 980 if (sd->spi) 981 goto unimplemented_cmd; 982 switch (sd->state) { 983 case sd_transfer_state: 984 /* Writing in SPI mode not implemented. */ 985 if (sd->spi) 986 break; 987 sd->state = sd_receivingdata_state; 988 sd->data_start = addr; 989 sd->data_offset = 0; 990 sd->blk_written = 0; 991 992 if (sd->data_start + sd->blk_len > sd->size) 993 sd->card_status |= ADDRESS_ERROR; 994 if (sd_wp_addr(sd, sd->data_start)) 995 sd->card_status |= WP_VIOLATION; 996 if (sd->csd[14] & 0x30) 997 sd->card_status |= WP_VIOLATION; 998 return sd_r1; 999 1000 default: 1001 break; 1002 } 1003 break; 1004 1005 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */ 1006 if (sd->spi) 1007 goto unimplemented_cmd; 1008 switch (sd->state) { 1009 case sd_transfer_state: 1010 /* Writing in SPI mode not implemented. */ 1011 if (sd->spi) 1012 break; 1013 sd->state = sd_receivingdata_state; 1014 sd->data_start = addr; 1015 sd->data_offset = 0; 1016 sd->blk_written = 0; 1017 1018 if (sd->data_start + sd->blk_len > sd->size) 1019 sd->card_status |= ADDRESS_ERROR; 1020 if (sd_wp_addr(sd, sd->data_start)) 1021 sd->card_status |= WP_VIOLATION; 1022 if (sd->csd[14] & 0x30) 1023 sd->card_status |= WP_VIOLATION; 1024 return sd_r1; 1025 1026 default: 1027 break; 1028 } 1029 break; 1030 1031 case 26: /* CMD26: PROGRAM_CID */ 1032 if (sd->spi) 1033 goto bad_cmd; 1034 switch (sd->state) { 1035 case sd_transfer_state: 1036 sd->state = sd_receivingdata_state; 1037 sd->data_start = 0; 1038 sd->data_offset = 0; 1039 return sd_r1; 1040 1041 default: 1042 break; 1043 } 1044 break; 1045 1046 case 27: /* CMD27: PROGRAM_CSD */ 1047 if (sd->spi) 1048 goto unimplemented_cmd; 1049 switch (sd->state) { 1050 case sd_transfer_state: 1051 sd->state = sd_receivingdata_state; 1052 sd->data_start = 0; 1053 sd->data_offset = 0; 1054 return sd_r1; 1055 1056 default: 1057 break; 1058 } 1059 break; 1060 1061 /* Write protection (Class 6) */ 1062 case 28: /* CMD28: SET_WRITE_PROT */ 1063 switch (sd->state) { 1064 case sd_transfer_state: 1065 if (addr >= sd->size) { 1066 sd->card_status |= ADDRESS_ERROR; 1067 return sd_r1b; 1068 } 1069 1070 sd->state = sd_programming_state; 1071 set_bit(sd_addr_to_wpnum(addr), sd->wp_groups); 1072 /* Bzzzzzzztt .... Operation complete. */ 1073 sd->state = sd_transfer_state; 1074 return sd_r1b; 1075 1076 default: 1077 break; 1078 } 1079 break; 1080 1081 case 29: /* CMD29: CLR_WRITE_PROT */ 1082 switch (sd->state) { 1083 case sd_transfer_state: 1084 if (addr >= sd->size) { 1085 sd->card_status |= ADDRESS_ERROR; 1086 return sd_r1b; 1087 } 1088 1089 sd->state = sd_programming_state; 1090 clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups); 1091 /* Bzzzzzzztt .... Operation complete. */ 1092 sd->state = sd_transfer_state; 1093 return sd_r1b; 1094 1095 default: 1096 break; 1097 } 1098 break; 1099 1100 case 30: /* CMD30: SEND_WRITE_PROT */ 1101 switch (sd->state) { 1102 case sd_transfer_state: 1103 sd->state = sd_sendingdata_state; 1104 *(uint32_t *) sd->data = sd_wpbits(sd, req.arg); 1105 sd->data_start = addr; 1106 sd->data_offset = 0; 1107 return sd_r1b; 1108 1109 default: 1110 break; 1111 } 1112 break; 1113 1114 /* Erase commands (Class 5) */ 1115 case 32: /* CMD32: ERASE_WR_BLK_START */ 1116 switch (sd->state) { 1117 case sd_transfer_state: 1118 sd->erase_start = req.arg; 1119 return sd_r1; 1120 1121 default: 1122 break; 1123 } 1124 break; 1125 1126 case 33: /* CMD33: ERASE_WR_BLK_END */ 1127 switch (sd->state) { 1128 case sd_transfer_state: 1129 sd->erase_end = req.arg; 1130 return sd_r1; 1131 1132 default: 1133 break; 1134 } 1135 break; 1136 1137 case 38: /* CMD38: ERASE */ 1138 switch (sd->state) { 1139 case sd_transfer_state: 1140 if (sd->csd[14] & 0x30) { 1141 sd->card_status |= WP_VIOLATION; 1142 return sd_r1b; 1143 } 1144 1145 sd->state = sd_programming_state; 1146 sd_erase(sd); 1147 /* Bzzzzzzztt .... Operation complete. */ 1148 sd->state = sd_transfer_state; 1149 return sd_r1b; 1150 1151 default: 1152 break; 1153 } 1154 break; 1155 1156 /* Lock card commands (Class 7) */ 1157 case 42: /* CMD42: LOCK_UNLOCK */ 1158 if (sd->spi) 1159 goto unimplemented_cmd; 1160 switch (sd->state) { 1161 case sd_transfer_state: 1162 sd->state = sd_receivingdata_state; 1163 sd->data_start = 0; 1164 sd->data_offset = 0; 1165 return sd_r1; 1166 1167 default: 1168 break; 1169 } 1170 break; 1171 1172 case 52: 1173 case 53: 1174 /* CMD52, CMD53: reserved for SDIO cards 1175 * (see the SDIO Simplified Specification V2.0) 1176 * Handle as illegal command but do not complain 1177 * on stderr, as some OSes may use these in their 1178 * probing for presence of an SDIO card. 1179 */ 1180 return sd_illegal; 1181 1182 /* Application specific commands (Class 8) */ 1183 case 55: /* CMD55: APP_CMD */ 1184 if (sd->rca != rca) 1185 return sd_r0; 1186 1187 sd->expecting_acmd = true; 1188 sd->card_status |= APP_CMD; 1189 return sd_r1; 1190 1191 case 56: /* CMD56: GEN_CMD */ 1192 fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg); 1193 1194 switch (sd->state) { 1195 case sd_transfer_state: 1196 sd->data_offset = 0; 1197 if (req.arg & 1) 1198 sd->state = sd_sendingdata_state; 1199 else 1200 sd->state = sd_receivingdata_state; 1201 return sd_r1; 1202 1203 default: 1204 break; 1205 } 1206 break; 1207 1208 default: 1209 bad_cmd: 1210 fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd); 1211 return sd_illegal; 1212 1213 unimplemented_cmd: 1214 /* Commands that are recognised but not yet implemented in SPI mode. */ 1215 fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd); 1216 return sd_illegal; 1217 } 1218 1219 fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd); 1220 return sd_illegal; 1221 } 1222 1223 static sd_rsp_type_t sd_app_command(SDState *sd, 1224 SDRequest req) 1225 { 1226 DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg); 1227 sd->card_status |= APP_CMD; 1228 switch (req.cmd) { 1229 case 6: /* ACMD6: SET_BUS_WIDTH */ 1230 switch (sd->state) { 1231 case sd_transfer_state: 1232 sd->sd_status[0] &= 0x3f; 1233 sd->sd_status[0] |= (req.arg & 0x03) << 6; 1234 return sd_r1; 1235 1236 default: 1237 break; 1238 } 1239 break; 1240 1241 case 13: /* ACMD13: SD_STATUS */ 1242 switch (sd->state) { 1243 case sd_transfer_state: 1244 sd->state = sd_sendingdata_state; 1245 sd->data_start = 0; 1246 sd->data_offset = 0; 1247 return sd_r1; 1248 1249 default: 1250 break; 1251 } 1252 break; 1253 1254 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */ 1255 switch (sd->state) { 1256 case sd_transfer_state: 1257 *(uint32_t *) sd->data = sd->blk_written; 1258 1259 sd->state = sd_sendingdata_state; 1260 sd->data_start = 0; 1261 sd->data_offset = 0; 1262 return sd_r1; 1263 1264 default: 1265 break; 1266 } 1267 break; 1268 1269 case 23: /* ACMD23: SET_WR_BLK_ERASE_COUNT */ 1270 switch (sd->state) { 1271 case sd_transfer_state: 1272 return sd_r1; 1273 1274 default: 1275 break; 1276 } 1277 break; 1278 1279 case 41: /* ACMD41: SD_APP_OP_COND */ 1280 if (sd->spi) { 1281 /* SEND_OP_CMD */ 1282 sd->state = sd_transfer_state; 1283 return sd_r1; 1284 } 1285 switch (sd->state) { 1286 case sd_idle_state: 1287 /* We accept any voltage. 10000 V is nothing. 1288 * 1289 * We don't model init delay so just advance straight to ready state 1290 * unless it's an enquiry ACMD41 (bits 23:0 == 0). 1291 */ 1292 if (req.arg & ACMD41_ENQUIRY_MASK) { 1293 sd->state = sd_ready_state; 1294 } 1295 1296 return sd_r3; 1297 1298 default: 1299 break; 1300 } 1301 break; 1302 1303 case 42: /* ACMD42: SET_CLR_CARD_DETECT */ 1304 switch (sd->state) { 1305 case sd_transfer_state: 1306 /* Bringing in the 50KOhm pull-up resistor... Done. */ 1307 return sd_r1; 1308 1309 default: 1310 break; 1311 } 1312 break; 1313 1314 case 51: /* ACMD51: SEND_SCR */ 1315 switch (sd->state) { 1316 case sd_transfer_state: 1317 sd->state = sd_sendingdata_state; 1318 sd->data_start = 0; 1319 sd->data_offset = 0; 1320 return sd_r1; 1321 1322 default: 1323 break; 1324 } 1325 break; 1326 1327 default: 1328 /* Fall back to standard commands. */ 1329 return sd_normal_command(sd, req); 1330 } 1331 1332 fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd); 1333 return sd_illegal; 1334 } 1335 1336 static int cmd_valid_while_locked(SDState *sd, SDRequest *req) 1337 { 1338 /* Valid commands in locked state: 1339 * basic class (0) 1340 * lock card class (7) 1341 * CMD16 1342 * implicitly, the ACMD prefix CMD55 1343 * ACMD41 and ACMD42 1344 * Anything else provokes an "illegal command" response. 1345 */ 1346 if (sd->expecting_acmd) { 1347 return req->cmd == 41 || req->cmd == 42; 1348 } 1349 if (req->cmd == 16 || req->cmd == 55) { 1350 return 1; 1351 } 1352 return sd_cmd_class[req->cmd] == 0 || sd_cmd_class[req->cmd] == 7; 1353 } 1354 1355 int sd_do_command(SDState *sd, SDRequest *req, 1356 uint8_t *response) { 1357 int last_state; 1358 sd_rsp_type_t rtype; 1359 int rsplen; 1360 1361 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) { 1362 return 0; 1363 } 1364 1365 if (sd_req_crc_validate(req)) { 1366 sd->card_status |= COM_CRC_ERROR; 1367 rtype = sd_illegal; 1368 goto send_response; 1369 } 1370 1371 if (sd->card_status & CARD_IS_LOCKED) { 1372 if (!cmd_valid_while_locked(sd, req)) { 1373 sd->card_status |= ILLEGAL_COMMAND; 1374 sd->expecting_acmd = false; 1375 fprintf(stderr, "SD: Card is locked\n"); 1376 rtype = sd_illegal; 1377 goto send_response; 1378 } 1379 } 1380 1381 last_state = sd->state; 1382 sd_set_mode(sd); 1383 1384 if (sd->expecting_acmd) { 1385 sd->expecting_acmd = false; 1386 rtype = sd_app_command(sd, *req); 1387 } else { 1388 rtype = sd_normal_command(sd, *req); 1389 } 1390 1391 if (rtype == sd_illegal) { 1392 sd->card_status |= ILLEGAL_COMMAND; 1393 } else { 1394 /* Valid command, we can update the 'state before command' bits. 1395 * (Do this now so they appear in r1 responses.) 1396 */ 1397 sd->current_cmd = req->cmd; 1398 sd->card_status &= ~CURRENT_STATE; 1399 sd->card_status |= (last_state << 9); 1400 } 1401 1402 send_response: 1403 switch (rtype) { 1404 case sd_r1: 1405 case sd_r1b: 1406 sd_response_r1_make(sd, response); 1407 rsplen = 4; 1408 break; 1409 1410 case sd_r2_i: 1411 memcpy(response, sd->cid, sizeof(sd->cid)); 1412 rsplen = 16; 1413 break; 1414 1415 case sd_r2_s: 1416 memcpy(response, sd->csd, sizeof(sd->csd)); 1417 rsplen = 16; 1418 break; 1419 1420 case sd_r3: 1421 sd_response_r3_make(sd, response); 1422 rsplen = 4; 1423 break; 1424 1425 case sd_r6: 1426 sd_response_r6_make(sd, response); 1427 rsplen = 4; 1428 break; 1429 1430 case sd_r7: 1431 sd_response_r7_make(sd, response); 1432 rsplen = 4; 1433 break; 1434 1435 case sd_r0: 1436 case sd_illegal: 1437 default: 1438 rsplen = 0; 1439 break; 1440 } 1441 1442 if (rtype != sd_illegal) { 1443 /* Clear the "clear on valid command" status bits now we've 1444 * sent any response 1445 */ 1446 sd->card_status &= ~CARD_STATUS_B; 1447 } 1448 1449 #ifdef DEBUG_SD 1450 if (rsplen) { 1451 int i; 1452 DPRINTF("Response:"); 1453 for (i = 0; i < rsplen; i++) 1454 fprintf(stderr, " %02x", response[i]); 1455 fprintf(stderr, " state %d\n", sd->state); 1456 } else { 1457 DPRINTF("No response %d\n", sd->state); 1458 } 1459 #endif 1460 1461 return rsplen; 1462 } 1463 1464 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len) 1465 { 1466 uint64_t end = addr + len; 1467 1468 DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n", 1469 (unsigned long long) addr, len); 1470 if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) < 0) { 1471 fprintf(stderr, "sd_blk_read: read error on host side\n"); 1472 return; 1473 } 1474 1475 if (end > (addr & ~511) + 512) { 1476 memcpy(sd->data, sd->buf + (addr & 511), 512 - (addr & 511)); 1477 1478 if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) < 0) { 1479 fprintf(stderr, "sd_blk_read: read error on host side\n"); 1480 return; 1481 } 1482 memcpy(sd->data + 512 - (addr & 511), sd->buf, end & 511); 1483 } else 1484 memcpy(sd->data, sd->buf + (addr & 511), len); 1485 } 1486 1487 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len) 1488 { 1489 uint64_t end = addr + len; 1490 1491 if ((addr & 511) || len < 512) 1492 if (!sd->bdrv || bdrv_read(sd->bdrv, addr >> 9, sd->buf, 1) < 0) { 1493 fprintf(stderr, "sd_blk_write: read error on host side\n"); 1494 return; 1495 } 1496 1497 if (end > (addr & ~511) + 512) { 1498 memcpy(sd->buf + (addr & 511), sd->data, 512 - (addr & 511)); 1499 if (bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) < 0) { 1500 fprintf(stderr, "sd_blk_write: write error on host side\n"); 1501 return; 1502 } 1503 1504 if (bdrv_read(sd->bdrv, end >> 9, sd->buf, 1) < 0) { 1505 fprintf(stderr, "sd_blk_write: read error on host side\n"); 1506 return; 1507 } 1508 memcpy(sd->buf, sd->data + 512 - (addr & 511), end & 511); 1509 if (bdrv_write(sd->bdrv, end >> 9, sd->buf, 1) < 0) { 1510 fprintf(stderr, "sd_blk_write: write error on host side\n"); 1511 } 1512 } else { 1513 memcpy(sd->buf + (addr & 511), sd->data, len); 1514 if (!sd->bdrv || bdrv_write(sd->bdrv, addr >> 9, sd->buf, 1) < 0) { 1515 fprintf(stderr, "sd_blk_write: write error on host side\n"); 1516 } 1517 } 1518 } 1519 1520 #define BLK_READ_BLOCK(a, len) sd_blk_read(sd, a, len) 1521 #define BLK_WRITE_BLOCK(a, len) sd_blk_write(sd, a, len) 1522 #define APP_READ_BLOCK(a, len) memset(sd->data, 0xec, len) 1523 #define APP_WRITE_BLOCK(a, len) 1524 1525 void sd_write_data(SDState *sd, uint8_t value) 1526 { 1527 int i; 1528 1529 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) 1530 return; 1531 1532 if (sd->state != sd_receivingdata_state) { 1533 fprintf(stderr, "sd_write_data: not in Receiving-Data state\n"); 1534 return; 1535 } 1536 1537 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION)) 1538 return; 1539 1540 switch (sd->current_cmd) { 1541 case 24: /* CMD24: WRITE_SINGLE_BLOCK */ 1542 sd->data[sd->data_offset ++] = value; 1543 if (sd->data_offset >= sd->blk_len) { 1544 /* TODO: Check CRC before committing */ 1545 sd->state = sd_programming_state; 1546 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset); 1547 sd->blk_written ++; 1548 sd->csd[14] |= 0x40; 1549 /* Bzzzzzzztt .... Operation complete. */ 1550 sd->state = sd_transfer_state; 1551 } 1552 break; 1553 1554 case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */ 1555 if (sd->data_offset == 0) { 1556 /* Start of the block - let's check the address is valid */ 1557 if (sd->data_start + sd->blk_len > sd->size) { 1558 sd->card_status |= ADDRESS_ERROR; 1559 break; 1560 } 1561 if (sd_wp_addr(sd, sd->data_start)) { 1562 sd->card_status |= WP_VIOLATION; 1563 break; 1564 } 1565 } 1566 sd->data[sd->data_offset++] = value; 1567 if (sd->data_offset >= sd->blk_len) { 1568 /* TODO: Check CRC before committing */ 1569 sd->state = sd_programming_state; 1570 BLK_WRITE_BLOCK(sd->data_start, sd->data_offset); 1571 sd->blk_written++; 1572 sd->data_start += sd->blk_len; 1573 sd->data_offset = 0; 1574 sd->csd[14] |= 0x40; 1575 1576 /* Bzzzzzzztt .... Operation complete. */ 1577 sd->state = sd_receivingdata_state; 1578 } 1579 break; 1580 1581 case 26: /* CMD26: PROGRAM_CID */ 1582 sd->data[sd->data_offset ++] = value; 1583 if (sd->data_offset >= sizeof(sd->cid)) { 1584 /* TODO: Check CRC before committing */ 1585 sd->state = sd_programming_state; 1586 for (i = 0; i < sizeof(sd->cid); i ++) 1587 if ((sd->cid[i] | 0x00) != sd->data[i]) 1588 sd->card_status |= CID_CSD_OVERWRITE; 1589 1590 if (!(sd->card_status & CID_CSD_OVERWRITE)) 1591 for (i = 0; i < sizeof(sd->cid); i ++) { 1592 sd->cid[i] |= 0x00; 1593 sd->cid[i] &= sd->data[i]; 1594 } 1595 /* Bzzzzzzztt .... Operation complete. */ 1596 sd->state = sd_transfer_state; 1597 } 1598 break; 1599 1600 case 27: /* CMD27: PROGRAM_CSD */ 1601 sd->data[sd->data_offset ++] = value; 1602 if (sd->data_offset >= sizeof(sd->csd)) { 1603 /* TODO: Check CRC before committing */ 1604 sd->state = sd_programming_state; 1605 for (i = 0; i < sizeof(sd->csd); i ++) 1606 if ((sd->csd[i] | sd_csd_rw_mask[i]) != 1607 (sd->data[i] | sd_csd_rw_mask[i])) 1608 sd->card_status |= CID_CSD_OVERWRITE; 1609 1610 /* Copy flag (OTP) & Permanent write protect */ 1611 if (sd->csd[14] & ~sd->data[14] & 0x60) 1612 sd->card_status |= CID_CSD_OVERWRITE; 1613 1614 if (!(sd->card_status & CID_CSD_OVERWRITE)) 1615 for (i = 0; i < sizeof(sd->csd); i ++) { 1616 sd->csd[i] |= sd_csd_rw_mask[i]; 1617 sd->csd[i] &= sd->data[i]; 1618 } 1619 /* Bzzzzzzztt .... Operation complete. */ 1620 sd->state = sd_transfer_state; 1621 } 1622 break; 1623 1624 case 42: /* CMD42: LOCK_UNLOCK */ 1625 sd->data[sd->data_offset ++] = value; 1626 if (sd->data_offset >= sd->blk_len) { 1627 /* TODO: Check CRC before committing */ 1628 sd->state = sd_programming_state; 1629 sd_lock_command(sd); 1630 /* Bzzzzzzztt .... Operation complete. */ 1631 sd->state = sd_transfer_state; 1632 } 1633 break; 1634 1635 case 56: /* CMD56: GEN_CMD */ 1636 sd->data[sd->data_offset ++] = value; 1637 if (sd->data_offset >= sd->blk_len) { 1638 APP_WRITE_BLOCK(sd->data_start, sd->data_offset); 1639 sd->state = sd_transfer_state; 1640 } 1641 break; 1642 1643 default: 1644 fprintf(stderr, "sd_write_data: unknown command\n"); 1645 break; 1646 } 1647 } 1648 1649 uint8_t sd_read_data(SDState *sd) 1650 { 1651 /* TODO: Append CRCs */ 1652 uint8_t ret; 1653 int io_len; 1654 1655 if (!sd->bdrv || !bdrv_is_inserted(sd->bdrv) || !sd->enable) 1656 return 0x00; 1657 1658 if (sd->state != sd_sendingdata_state) { 1659 fprintf(stderr, "sd_read_data: not in Sending-Data state\n"); 1660 return 0x00; 1661 } 1662 1663 if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION)) 1664 return 0x00; 1665 1666 io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len; 1667 1668 switch (sd->current_cmd) { 1669 case 6: /* CMD6: SWITCH_FUNCTION */ 1670 ret = sd->data[sd->data_offset ++]; 1671 1672 if (sd->data_offset >= 64) 1673 sd->state = sd_transfer_state; 1674 break; 1675 1676 case 9: /* CMD9: SEND_CSD */ 1677 case 10: /* CMD10: SEND_CID */ 1678 ret = sd->data[sd->data_offset ++]; 1679 1680 if (sd->data_offset >= 16) 1681 sd->state = sd_transfer_state; 1682 break; 1683 1684 case 11: /* CMD11: READ_DAT_UNTIL_STOP */ 1685 if (sd->data_offset == 0) 1686 BLK_READ_BLOCK(sd->data_start, io_len); 1687 ret = sd->data[sd->data_offset ++]; 1688 1689 if (sd->data_offset >= io_len) { 1690 sd->data_start += io_len; 1691 sd->data_offset = 0; 1692 if (sd->data_start + io_len > sd->size) { 1693 sd->card_status |= ADDRESS_ERROR; 1694 break; 1695 } 1696 } 1697 break; 1698 1699 case 13: /* ACMD13: SD_STATUS */ 1700 ret = sd->sd_status[sd->data_offset ++]; 1701 1702 if (sd->data_offset >= sizeof(sd->sd_status)) 1703 sd->state = sd_transfer_state; 1704 break; 1705 1706 case 17: /* CMD17: READ_SINGLE_BLOCK */ 1707 if (sd->data_offset == 0) 1708 BLK_READ_BLOCK(sd->data_start, io_len); 1709 ret = sd->data[sd->data_offset ++]; 1710 1711 if (sd->data_offset >= io_len) 1712 sd->state = sd_transfer_state; 1713 break; 1714 1715 case 18: /* CMD18: READ_MULTIPLE_BLOCK */ 1716 if (sd->data_offset == 0) 1717 BLK_READ_BLOCK(sd->data_start, io_len); 1718 ret = sd->data[sd->data_offset ++]; 1719 1720 if (sd->data_offset >= io_len) { 1721 sd->data_start += io_len; 1722 sd->data_offset = 0; 1723 if (sd->data_start + io_len > sd->size) { 1724 sd->card_status |= ADDRESS_ERROR; 1725 break; 1726 } 1727 } 1728 break; 1729 1730 case 22: /* ACMD22: SEND_NUM_WR_BLOCKS */ 1731 ret = sd->data[sd->data_offset ++]; 1732 1733 if (sd->data_offset >= 4) 1734 sd->state = sd_transfer_state; 1735 break; 1736 1737 case 30: /* CMD30: SEND_WRITE_PROT */ 1738 ret = sd->data[sd->data_offset ++]; 1739 1740 if (sd->data_offset >= 4) 1741 sd->state = sd_transfer_state; 1742 break; 1743 1744 case 51: /* ACMD51: SEND_SCR */ 1745 ret = sd->scr[sd->data_offset ++]; 1746 1747 if (sd->data_offset >= sizeof(sd->scr)) 1748 sd->state = sd_transfer_state; 1749 break; 1750 1751 case 56: /* CMD56: GEN_CMD */ 1752 if (sd->data_offset == 0) 1753 APP_READ_BLOCK(sd->data_start, sd->blk_len); 1754 ret = sd->data[sd->data_offset ++]; 1755 1756 if (sd->data_offset >= sd->blk_len) 1757 sd->state = sd_transfer_state; 1758 break; 1759 1760 default: 1761 fprintf(stderr, "sd_read_data: unknown command\n"); 1762 return 0x00; 1763 } 1764 1765 return ret; 1766 } 1767 1768 bool sd_data_ready(SDState *sd) 1769 { 1770 return sd->state == sd_sendingdata_state; 1771 } 1772 1773 void sd_enable(SDState *sd, bool enable) 1774 { 1775 sd->enable = enable; 1776 } 1777