1 /*

     2  * SD Memory Card emulation as defined in the "SD Memory Card Physical

     3  * layer specification, Version 1.10."

     4  *

     5  * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>

     6  * Copyright (c) 2007 CodeSourcery

     7  *

     8  * Redistribution and use in source and binary forms, with or without

     9  * modification, are permitted provided that the following conditions

    10  * are met:

    11  *

    12  * 1. Redistributions of source code must retain the above copyright

    13  *    notice, this list of conditions and the following disclaimer.

    14  * 2. Redistributions in binary form must reproduce the above copyright

    15  *    notice, this list of conditions and the following disclaimer in

    16  *    the documentation and/or other materials provided with the

    17  *    distribution.

    18  *

    19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS''

    20  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,

    21  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

    22  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR

    23  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

    24  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

    25  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

    26  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

    27  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

    28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

    29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

    30  */

    31 

    32 #include "hw.h"

    33 #include "block.h"

    34 #include "sd.h"

    35 

    36 //#define DEBUG_SD 1

    37 

    38 #ifdef DEBUG_SD

    39 #define DPRINTF(fmt, args...) \

    40 do { fprintf(stderr, "SD: " fmt , ##args); } while (0)

    41 #else

    42 #define DPRINTF(fmt, args...) do {} while(0)

    43 #endif

    44 

    45 typedef enum {

    46     sd_r0 = 0,    /* no response */

    47     sd_r1,        /* normal response command */

    48     sd_r2_i,      /* CID register */

    49     sd_r2_s,      /* CSD register */

    50     sd_r3,        /* OCR register */

    51     sd_r6 = 6,    /* Published RCA response */

    52     sd_r7,        /* Operating voltage */

    53     sd_r1b = -1,

    54 } sd_rsp_type_t;

    55 

    56 struct SDState {

    57     enum {

    58         sd_inactive,

    59         sd_card_identification_mode,

    60         sd_data_transfer_mode,

    61     } mode;

    62     enum {

    63         sd_inactive_state = -1,

    64         sd_idle_state = 0,

    65         sd_ready_state,

    66         sd_identification_state,

    67         sd_standby_state,

    68         sd_transfer_state,

    69         sd_sendingdata_state,

    70         sd_receivingdata_state,

    71         sd_programming_state,

    72         sd_disconnect_state,

    73     } state;

    74     uint32_t ocr;

    75     uint8_t scr[8];

    76     uint8_t cid[16];

    77     uint8_t csd[16];

    78     uint16_t rca;

    79     uint32_t card_status;

    80     uint8_t sd_status[64];

    81     uint32_t vhs;

    82     int wp_switch;

    83     int *wp_groups;

    84     uint32_t size;

    85     int blk_len;

    86     uint32_t erase_start;

    87     uint32_t erase_end;

    88     uint8_t pwd[16];

    89     int pwd_len;

    90     int function_group[6];

    91 

    92     int spi;

    93     int current_cmd;

    94     int blk_written;

    95     uint32_t data_start;

    96     uint32_t data_offset;

    97     uint8_t data[512];

    98     qemu_irq readonly_cb;

    99     qemu_irq inserted_cb;

   100     BlockDriverState *bdrv;

   101     uint8_t *buf;

   102 

   103     int enable;

   104 };

   105 

   106 static void sd_set_status(SDState *sd)

   107 {

   108     switch (sd->state) {

   109     case sd_inactive_state:

   110         sd->mode = sd_inactive;

   111         break;

   112 

   113     case sd_idle_state:

   114     case sd_ready_state:

   115     case sd_identification_state:

   116         sd->mode = sd_card_identification_mode;

   117         break;

   118 

   119     case sd_standby_state:

   120     case sd_transfer_state:

   121     case sd_sendingdata_state:

   122     case sd_receivingdata_state:

   123     case sd_programming_state:

   124     case sd_disconnect_state:

   125         sd->mode = sd_data_transfer_mode;

   126         break;

   127     }

   128 

   129     sd->card_status &= ~CURRENT_STATE;

   130     sd->card_status |= sd->state << 9;

   131 }

   132 

   133 static const sd_cmd_type_t sd_cmd_type[64] = {

   134     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,

   135     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,

   136     sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,

   137     sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,

   138     sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,

   139     sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,

   140     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,

   141     sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,

   142 };

   143 

   144 static const sd_cmd_type_t sd_acmd_type[64] = {

   145     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,

   146     sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none,

   147     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_adtc, sd_ac,

   148     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,

   149     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,

   150     sd_none, sd_bcr,  sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_none,

   151     sd_none, sd_none, sd_none, sd_adtc, sd_none, sd_none, sd_none, sd_none,

   152     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,

   153 };

   154 

   155 static const int sd_cmd_class[64] = {

   156     0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,

   157     2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,

   158     5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,

   159     7,  7, 10,  7,  9,  9,  9,  8,  8, 10,  8,  8,  8,  8,  8,  8,

   160 };

   161 

   162 static uint8_t sd_crc7(void *message, size_t width)

   163 {

   164     int i, bit;

   165     uint8_t shift_reg = 0x00;

   166     uint8_t *msg = (uint8_t *) message;

   167 

   168     for (i = 0; i < width; i ++, msg ++)

   169         for (bit = 7; bit >= 0; bit --) {

   170             shift_reg <<= 1;

   171             if ((shift_reg >> 7) ^ ((*msg >> bit) & 1))

   172                 shift_reg ^= 0x89;

   173         }

   174 

   175     return shift_reg;

   176 }

   177 

   178 static uint16_t sd_crc16(void *message, size_t width)

   179 {

   180     int i, bit;

   181     uint16_t shift_reg = 0x0000;

   182     uint16_t *msg = (uint16_t *) message;

   183     width <<= 1;

   184 

   185     for (i = 0; i < width; i ++, msg ++)

   186         for (bit = 15; bit >= 0; bit --) {

   187             shift_reg <<= 1;

   188             if ((shift_reg >> 15) ^ ((*msg >> bit) & 1))

   189                 shift_reg ^= 0x1011;

   190         }

   191 

   192     return shift_reg;

   193 }

   194 

   195 static void sd_set_ocr(SDState *sd)

   196 {

   197     /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */

   198     sd->ocr = 0x80ffff80;

   199 }

   200 

   201 static void sd_set_scr(SDState *sd)

   202 {

   203     sd->scr[0] = 0x00;		/* SCR Structure */

   204     sd->scr[1] = 0x2f;		/* SD Security Support */

   205     sd->scr[2] = 0x00;

   206     sd->scr[3] = 0x00;

   207     sd->scr[4] = 0x00;

   208     sd->scr[5] = 0x00;

   209     sd->scr[6] = 0x00;

   210     sd->scr[7] = 0x00;

   211 }

   212 

   213 #define MID	0xaa

   214 #define OID	"XY"

   215 #define PNM	"QEMU!"

   216 #define PRV	0x01

   217 #define MDT_YR	2006

   218 #define MDT_MON	2

   219 

   220 static void sd_set_cid(SDState *sd)

   221 {

   222     sd->cid[0] = MID;		/* Fake card manufacturer ID (MID) */

   223     sd->cid[1] = OID[0];	/* OEM/Application ID (OID) */

   224     sd->cid[2] = OID[1];

   225     sd->cid[3] = PNM[0];	/* Fake product name (PNM) */

   226     sd->cid[4] = PNM[1];

   227     sd->cid[5] = PNM[2];

   228     sd->cid[6] = PNM[3];

   229     sd->cid[7] = PNM[4];

   230     sd->cid[8] = PRV;		/* Fake product revision (PRV) */

   231     sd->cid[9] = 0xde;		/* Fake serial number (PSN) */

   232     sd->cid[10] = 0xad;

   233     sd->cid[11] = 0xbe;

   234     sd->cid[12] = 0xef;

   235     sd->cid[13] = 0x00 |	/* Manufacture date (MDT) */

   236         ((MDT_YR - 2000) / 10);

   237     sd->cid[14] = ((MDT_YR % 10) << 4) | MDT_MON;

   238     sd->cid[15] = (sd_crc7(sd->cid, 15) << 1) | 1;

   239 }

   240 

   241 #define HWBLOCK_SHIFT	9			/* 512 bytes */

   242 #define SECTOR_SHIFT	5			/* 16 kilobytes */

   243 #define WPGROUP_SHIFT	7			/* 2 megs */

   244 #define CMULT_SHIFT	9			/* 512 times HWBLOCK_SIZE */

   245 #define BLOCK_SIZE	(1 << (HWBLOCK_SHIFT))

   246 #define SECTOR_SIZE	(1 << (HWBLOCK_SHIFT + SECTOR_SHIFT))

   247 #define WPGROUP_SIZE	(1 << (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT))

   248 

   249 static const uint8_t sd_csd_rw_mask[16] = {

   250     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

   251     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfc, 0xfe,

   252 };

   253 

   254 static void sd_set_csd(SDState *sd, uint32_t size)

   255 {

   256     uint32_t csize = (size >> (CMULT_SHIFT + HWBLOCK_SHIFT)) - 1;

   257     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;

   258     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;

   259 

   260     sd->csd[0] = 0x00;		/* CSD structure */

   261     sd->csd[1] = 0x26;		/* Data read access-time-1 */

   262     sd->csd[2] = 0x00;		/* Data read access-time-2 */

   263     sd->csd[3] = 0x5a;		/* Max. data transfer rate */

   264     sd->csd[4] = 0x5f;		/* Card Command Classes */

   265     sd->csd[5] = 0x50 |		/* Max. read data block length */

   266         HWBLOCK_SHIFT;

   267     sd->csd[6] = 0xe0 |		/* Partial block for read allowed */

   268         ((csize >> 10) & 0x03);

   269     sd->csd[7] = 0x00 |		/* Device size */

   270         ((csize >> 2) & 0xff);

   271     sd->csd[8] = 0x3f |		/* Max. read current */

   272         ((csize << 6) & 0xc0);

   273     sd->csd[9] = 0xfc |		/* Max. write current */

   274         ((CMULT_SHIFT - 2) >> 1);

   275     sd->csd[10] = 0x40 |	/* Erase sector size */

   276         (((CMULT_SHIFT - 2) << 7) & 0x80) | (sectsize >> 1);

   277     sd->csd[11] = 0x00 |	/* Write protect group size */

   278         ((sectsize << 7) & 0x80) | wpsize;

   279     sd->csd[12] = 0x90 |	/* Write speed factor */

   280         (HWBLOCK_SHIFT >> 2);

   281     sd->csd[13] = 0x20 |	/* Max. write data block length */

   282         ((HWBLOCK_SHIFT << 6) & 0xc0);

   283     sd->csd[14] = 0x00;		/* File format group */

   284     sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;

   285 }

   286 

   287 static void sd_set_rca(SDState *sd)

   288 {

   289     sd->rca += 0x4567;

   290 }

   291 

   292 #define CARD_STATUS_A	0x02004100

   293 #define CARD_STATUS_B	0x00c01e00

   294 #define CARD_STATUS_C	0xfd39a028

   295 

   296 static void sd_set_cardstatus(SDState *sd)

   297 {

   298     sd->card_status = 0x00000100;

   299 }

   300 

   301 static void sd_set_sdstatus(SDState *sd)

   302 {

   303     memset(sd->sd_status, 0, 64);

   304 }

   305 

   306 static int sd_req_crc_validate(struct sd_request_s *req)

   307 {

   308     uint8_t buffer[5];

   309     buffer[0] = 0x40 | req->cmd;

   310     buffer[1] = (req->arg >> 24) & 0xff;

   311     buffer[2] = (req->arg >> 16) & 0xff;

   312     buffer[3] = (req->arg >> 8) & 0xff;

   313     buffer[4] = (req->arg >> 0) & 0xff;

   314     return 0;

   315     return sd_crc7(buffer, 5) != req->crc;	/* TODO */

   316 }

   317 

   318 static void sd_response_r1_make(SDState *sd,

   319                                 uint8_t *response, uint32_t last_status)

   320 {

   321     uint32_t mask = CARD_STATUS_B ^ ILLEGAL_COMMAND;

   322     uint32_t status;

   323 

   324     status = (sd->card_status & ~mask) | (last_status & mask);

   325     sd->card_status &= ~CARD_STATUS_C | APP_CMD;

   326 

   327     response[0] = (status >> 24) & 0xff;

   328     response[1] = (status >> 16) & 0xff;

   329     response[2] = (status >> 8) & 0xff;

   330     response[3] = (status >> 0) & 0xff;

   331 }

   332 

   333 static void sd_response_r3_make(SDState *sd, uint8_t *response)

   334 {

   335     response[0] = (sd->ocr >> 24) & 0xff;

   336     response[1] = (sd->ocr >> 16) & 0xff;

   337     response[2] = (sd->ocr >> 8) & 0xff;

   338     response[3] = (sd->ocr >> 0) & 0xff;

   339 }

   340 

   341 static void sd_response_r6_make(SDState *sd, uint8_t *response)

   342 {

   343     uint16_t arg;

   344     uint16_t status;

   345 

   346     arg = sd->rca;

   347     status = ((sd->card_status >> 8) & 0xc000) |

   348              ((sd->card_status >> 6) & 0x2000) |

   349               (sd->card_status & 0x1fff);

   350 

   351     response[0] = (arg >> 8) & 0xff;

   352     response[1] = arg & 0xff;

   353     response[2] = (status >> 8) & 0xff;

   354     response[3] = status & 0xff;

   355 }

   356 

   357 static void sd_response_r7_make(SDState *sd, uint8_t *response)

   358 {

   359     response[0] = (sd->vhs >> 24) & 0xff;

   360     response[1] = (sd->vhs >> 16) & 0xff;

   361     response[2] = (sd->vhs >>  8) & 0xff;

   362     response[3] = (sd->vhs >>  0) & 0xff;

   363 }

   364 

   365 static void sd_reset(SDState *sd, BlockDriverState *bdrv)

   366 {

   367     uint32_t size;

   368     uint64_t sect;

   369 

   370     bdrv_get_geometry(bdrv, &sect);

   371     sect <<= 9;

   372 

   373     if (sect > 0x40000000)

   374         size = 0x40000000;	/* 1 gig */

   375     else

   376         size = sect + 1;

   377 

   378     sect = (size >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)) + 1;

   379 

   380     sd->state = sd_idle_state;

   381     sd->rca = 0x0000;

   382     sd_set_ocr(sd);

   383     sd_set_scr(sd);

   384     sd_set_cid(sd);

   385     sd_set_csd(sd, size);

   386     sd_set_cardstatus(sd);

   387     sd_set_sdstatus(sd);

   388 

   389     sd->bdrv = bdrv;

   390 

   391     if (sd->wp_groups)

   392         qemu_free(sd->wp_groups);

   393     sd->wp_switch = bdrv_is_read_only(bdrv);

   394     sd->wp_groups = (int *) qemu_mallocz(sizeof(int) * sect);

   395     memset(sd->function_group, 0, sizeof(int) * 6);

   396     sd->erase_start = 0;

   397     sd->erase_end = 0;

   398     sd->size = size;

   399     sd->blk_len = 0x200;

   400     sd->pwd_len = 0;

   401 }

   402 

   403 static void sd_cardchange(void *opaque)

   404 {

   405     SDState *sd = opaque;

   406     qemu_set_irq(sd->inserted_cb, bdrv_is_inserted(sd->bdrv));

   407     if (bdrv_is_inserted(sd->bdrv)) {

   408         sd_reset(sd, sd->bdrv);

   409         qemu_set_irq(sd->readonly_cb, sd->wp_switch);

   410     }

   411 }

   412 

   413 /* We do not model the chip select pin, so allow the board to select

   414    whether card should be in SSI or MMC/SD mode.  It is also up to the

   415    board to ensure that ssi transfers only occur when the chip select

   416    is asserted.  */

   417 SDState *sd_init(BlockDriverState *bs, int is_spi)

   418 {

   419     SDState *sd;

   420 

   421     sd = (SDState *) qemu_mallocz(sizeof(SDState));

   422     sd->buf = qemu_memalign(512, 512);

   423     sd->spi = is_spi;

   424     sd->enable = 1;

   425     sd_reset(sd, bs);

   426     bdrv_set_change_cb(sd->bdrv, sd_cardchange, sd);

   427     return sd;

   428 }

   429 

   430 void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)

   431 {

   432     sd->readonly_cb = readonly;

   433     sd->inserted_cb = insert;

   434     qemu_set_irq(readonly, bdrv_is_read_only(sd->bdrv));

   435     qemu_set_irq(insert, bdrv_is_inserted(sd->bdrv));

   436 }

   437 

   438 static void sd_erase(SDState *sd)

   439 {

   440     int i, start, end;

   441     if (!sd->erase_start || !sd->erase_end) {

   442         sd->card_status |= ERASE_SEQ_ERROR;

   443         return;

   444     }

   445 

   446     start = sd->erase_start >>

   447             (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);

   448     end = sd->erase_end >>

   449             (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);

   450     sd->erase_start = 0;

   451     sd->erase_end = 0;

   452     sd->csd[14] |= 0x40;

   453 

   454     for (i = start; i <= end; i ++)

   455         if (sd->wp_groups[i])

   456             sd->card_status |= WP_ERASE_SKIP;

   457 }

   458 

   459 static uint32_t sd_wpbits(SDState *sd, uint32_t addr)

   460 {

   461     uint32_t i, wpnum;

   462     uint32_t ret = 0;

   463 

   464     wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);

   465 

   466     for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)

   467         if (addr < sd->size && sd->wp_groups[wpnum])

   468             ret |= (1 << i);

   469 

   470     return ret;

   471 }

   472 

   473 static void sd_function_switch(SDState *sd, uint32_t arg)

   474 {

   475     int i, mode, new_func, crc;

   476     mode = !!(arg & 0x80000000);

   477 

   478     sd->data[0] = 0x00;		/* Maximum current consumption */

   479     sd->data[1] = 0x01;

   480     sd->data[2] = 0x80;		/* Supported group 6 functions */

   481     sd->data[3] = 0x01;

   482     sd->data[4] = 0x80;		/* Supported group 5 functions */

   483     sd->data[5] = 0x01;

   484     sd->data[6] = 0x80;		/* Supported group 4 functions */

   485     sd->data[7] = 0x01;

   486     sd->data[8] = 0x80;		/* Supported group 3 functions */

   487     sd->data[9] = 0x01;

   488     sd->data[10] = 0x80;	/* Supported group 2 functions */

   489     sd->data[11] = 0x43;

   490     sd->data[12] = 0x80;	/* Supported group 1 functions */

   491     sd->data[13] = 0x03;

   492     for (i = 0; i < 6; i ++) {

   493         new_func = (arg >> (i * 4)) & 0x0f;

   494         if (mode && new_func != 0x0f)

   495             sd->function_group[i] = new_func;

   496         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);

   497     }

   498     memset(&sd->data[17], 0, 47);

   499     crc = sd_crc16(sd->data, 64);

   500     sd->data[65] = crc >> 8;

   501     sd->data[66] = crc & 0xff;

   502 }

   503 

   504 static inline int sd_wp_addr(SDState *sd, uint32_t addr)

   505 {

   506     return sd->wp_groups[addr >>

   507             (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)];

   508 }

   509 

   510 static void sd_lock_command(SDState *sd)

   511 {

   512     int erase, lock, clr_pwd, set_pwd, pwd_len;

   513     erase = !!(sd->data[0] & 0x08);

   514     lock = sd->data[0] & 0x04;

   515     clr_pwd = sd->data[0] & 0x02;

   516     set_pwd = sd->data[0] & 0x01;

   517 

   518     if (sd->blk_len > 1)

   519         pwd_len = sd->data[1];

   520     else

   521         pwd_len = 0;

   522 

   523     if (erase) {

   524         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||

   525                         set_pwd || clr_pwd || lock || sd->wp_switch ||

   526                         (sd->csd[14] & 0x20)) {

   527             sd->card_status |= LOCK_UNLOCK_FAILED;

   528             return;

   529         }

   530         memset(sd->wp_groups, 0, sizeof(int) * (sd->size >>

   531                         (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT)));

   532         sd->csd[14] &= ~0x10;

   533         sd->card_status &= ~CARD_IS_LOCKED;

   534         sd->pwd_len = 0;

   535         /* Erasing the entire card here! */

   536         fprintf(stderr, "SD: Card force-erased by CMD42\n");

   537         return;

   538     }

   539 

   540     if (sd->blk_len < 2 + pwd_len ||

   541                     pwd_len <= sd->pwd_len ||

   542                     pwd_len > sd->pwd_len + 16) {

   543         sd->card_status |= LOCK_UNLOCK_FAILED;

   544         return;

   545     }

   546 

   547     if (sd->pwd_len && memcmp(sd->pwd, sd->data + 2, sd->pwd_len)) {

   548         sd->card_status |= LOCK_UNLOCK_FAILED;

   549         return;

   550     }

   551 

   552     pwd_len -= sd->pwd_len;

   553     if ((pwd_len && !set_pwd) ||

   554                     (clr_pwd && (set_pwd || lock)) ||

   555                     (lock && !sd->pwd_len && !set_pwd) ||

   556                     (!set_pwd && !clr_pwd &&

   557                      (((sd->card_status & CARD_IS_LOCKED) && lock) ||

   558                       (!(sd->card_status & CARD_IS_LOCKED) && !lock)))) {

   559         sd->card_status |= LOCK_UNLOCK_FAILED;

   560         return;

   561     }

   562 

   563     if (set_pwd) {

   564         memcpy(sd->pwd, sd->data + 2 + sd->pwd_len, pwd_len);

   565         sd->pwd_len = pwd_len;

   566     }

   567 

   568     if (clr_pwd) {

   569         sd->pwd_len = 0;

   570     }

   571 

   572     if (lock)

   573         sd->card_status |= CARD_IS_LOCKED;

   574     else

   575         sd->card_status &= ~CARD_IS_LOCKED;

   576 }

   577 

   578 static sd_rsp_type_t sd_normal_command(SDState *sd,

   579                                        struct sd_request_s req)

   580 {

   581     uint32_t rca = 0x0000;

   582 

   583     if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)

   584         rca = req.arg >> 16;

   585 

   586     DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);

   587     switch (req.cmd) {

   588     /* Basic commands (Class 0 and Class 1) */

   589     case 0:	/* CMD0:   GO_IDLE_STATE */

   590         switch (sd->state) {

   591         case sd_inactive_state:

   592             return sd->spi ? sd_r1 : sd_r0;

   593 

   594         default:

   595             sd->state = sd_idle_state;

   596             sd_reset(sd, sd->bdrv);

   597             return sd->spi ? sd_r1 : sd_r0;

   598         }

   599         break;

   600 

   601     case 1:	/* CMD1:   SEND_OP_CMD */

   602         if (!sd->spi)

   603             goto bad_cmd;

   604 

   605         sd->state = sd_transfer_state;

   606         return sd_r1;

   607 

   608     case 2:	/* CMD2:   ALL_SEND_CID */

   609         if (sd->spi)

   610             goto bad_cmd;

   611         switch (sd->state) {

   612         case sd_ready_state:

   613             sd->state = sd_identification_state;

   614             return sd_r2_i;

   615 

   616         default:

   617             break;

   618         }

   619         break;

   620 

   621     case 3:	/* CMD3:   SEND_RELATIVE_ADDR */

   622         if (sd->spi)

   623             goto bad_cmd;

   624         switch (sd->state) {

   625         case sd_identification_state:

   626         case sd_standby_state:

   627             sd->state = sd_standby_state;

   628             sd_set_rca(sd);

   629             return sd_r6;

   630 

   631         default:

   632             break;

   633         }

   634         break;

   635 

   636     case 4:	/* CMD4:   SEND_DSR */

   637         if (sd->spi)

   638             goto bad_cmd;

   639         switch (sd->state) {

   640         case sd_standby_state:

   641             break;

   642 

   643         default:

   644             break;

   645         }

   646         break;

   647 

   648     case 6:	/* CMD6:   SWITCH_FUNCTION */

   649         if (sd->spi)

   650             goto bad_cmd;

   651         switch (sd->mode) {

   652         case sd_data_transfer_mode:

   653             sd_function_switch(sd, req.arg);

   654             sd->state = sd_sendingdata_state;

   655             sd->data_start = 0;

   656             sd->data_offset = 0;

   657             return sd_r1;

   658 

   659         default:

   660             break;

   661         }

   662         break;

   663 

   664     case 7:	/* CMD7:   SELECT/DESELECT_CARD */

   665         if (sd->spi)

   666             goto bad_cmd;

   667         switch (sd->state) {

   668         case sd_standby_state:

   669             if (sd->rca != rca)

   670                 return sd_r0;

   671 

   672             sd->state = sd_transfer_state;

   673             return sd_r1b;

   674 

   675         case sd_transfer_state:

   676         case sd_sendingdata_state:

   677             if (sd->rca == rca)

   678                 break;

   679 

   680             sd->state = sd_standby_state;

   681             return sd_r1b;

   682 

   683         case sd_disconnect_state:

   684             if (sd->rca != rca)

   685                 return sd_r0;

   686 

   687             sd->state = sd_programming_state;

   688             return sd_r1b;

   689 

   690         case sd_programming_state:

   691             if (sd->rca == rca)

   692                 break;

   693 

   694             sd->state = sd_disconnect_state;

   695             return sd_r1b;

   696 

   697         default:

   698             break;

   699         }

   700         break;

   701 

   702     case 8:	/* CMD8:   SEND_IF_COND */

   703         /* Physical Layer Specification Version 2.00 command */

   704         switch (sd->state) {

   705         case sd_idle_state:

   706             sd->vhs = 0;

   707 

   708             /* No response if not exactly one VHS bit is set.  */

   709             if (!(req.arg >> 8) || (req.arg >> ffs(req.arg & ~0xff)))

   710                 return sd->spi ? sd_r7 : sd_r0;

   711 

   712             /* Accept.  */

   713             sd->vhs = req.arg;

   714             return sd_r7;

   715 

   716         default:

   717             break;

   718         }

   719         break;

   720 

   721     case 9:	/* CMD9:   SEND_CSD */

   722         switch (sd->state) {

   723         case sd_standby_state:

   724             if (sd->rca != rca)

   725                 return sd_r0;

   726 

   727             return sd_r2_s;

   728 

   729         case sd_transfer_state:

   730             if (!sd->spi)

   731                 break;

   732             sd->state = sd_sendingdata_state;

   733             memcpy(sd->data, sd->csd, 16);

   734             sd->data_start = req.arg;

   735             sd->data_offset = 0;

   736             return sd_r1;

   737 

   738         default:

   739             break;

   740         }

   741         break;

   742 

   743     case 10:	/* CMD10:  SEND_CID */

   744         switch (sd->state) {

   745         case sd_standby_state:

   746             if (sd->rca != rca)

   747                 return sd_r0;

   748 

   749             return sd_r2_i;

   750 

   751         case sd_transfer_state:

   752             if (!sd->spi)

   753                 break;

   754             sd->state = sd_sendingdata_state;

   755             memcpy(sd->data, sd->cid, 16);

   756             sd->data_start = req.arg;

   757             sd->data_offset = 0;

   758             return sd_r1;

   759 

   760         default:

   761             break;

   762         }

   763         break;

   764 

   765     case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */

   766         if (sd->spi)

   767             goto bad_cmd;

   768         switch (sd->state) {

   769         case sd_transfer_state:

   770             sd->state = sd_sendingdata_state;

   771             sd->data_start = req.arg;

   772             sd->data_offset = 0;

   773 

   774             if (sd->data_start + sd->blk_len > sd->size)

   775                 sd->card_status |= ADDRESS_ERROR;

   776             return sd_r0;

   777 

   778         default:

   779             break;

   780         }

   781         break;

   782 

   783     case 12:	/* CMD12:  STOP_TRANSMISSION */

   784         switch (sd->state) {

   785         case sd_sendingdata_state:

   786             sd->state = sd_transfer_state;

   787             return sd_r1b;

   788 

   789         case sd_receivingdata_state:

   790             sd->state = sd_programming_state;

   791             /* Bzzzzzzztt .... Operation complete.  */

   792             sd->state = sd_transfer_state;

   793             return sd_r1b;

   794 

   795         default:

   796             break;

   797         }

   798         break;

   799 

   800     case 13:	/* CMD13:  SEND_STATUS */

   801         switch (sd->mode) {

   802         case sd_data_transfer_mode:

   803             if (sd->rca != rca)

   804                 return sd_r0;

   805 

   806             return sd_r1;

   807 

   808         default:

   809             break;

   810         }

   811         break;

   812 

   813     case 15:	/* CMD15:  GO_INACTIVE_STATE */

   814         if (sd->spi)

   815             goto bad_cmd;

   816         switch (sd->mode) {

   817         case sd_data_transfer_mode:

   818             if (sd->rca != rca)

   819                 return sd_r0;

   820 

   821             sd->state = sd_inactive_state;

   822             return sd_r0;

   823 

   824         default:

   825             break;

   826         }

   827         break;

   828 

   829     /* Block read commands (Classs 2) */

   830     case 16:	/* CMD16:  SET_BLOCKLEN */

   831         switch (sd->state) {

   832         case sd_transfer_state:

   833             if (req.arg > (1 << HWBLOCK_SHIFT))

   834                 sd->card_status |= BLOCK_LEN_ERROR;

   835             else

   836                 sd->blk_len = req.arg;

   837 

   838             return sd_r1;

   839 

   840         default:

   841             break;

   842         }

   843         break;

   844 

   845     case 17:	/* CMD17:  READ_SINGLE_BLOCK */

   846         switch (sd->state) {

   847         case sd_transfer_state:

   848             sd->state = sd_sendingdata_state;

   849             sd->data_start = req.arg;

   850             sd->data_offset = 0;

   851 

   852             if (sd->data_start + sd->blk_len > sd->size)

   853                 sd->card_status |= ADDRESS_ERROR;

   854             return sd_r1;

   855 

   856         default:

   857             break;

   858         }

   859         break;

   860 

   861     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */

   862         switch (sd->state) {

   863         case sd_transfer_state:

   864             sd->state = sd_sendingdata_state;

   865             sd->data_start = req.arg;

   866             sd->data_offset = 0;

   867 

   868             if (sd->data_start + sd->blk_len > sd->size)

   869                 sd->card_status |= ADDRESS_ERROR;

   870             return sd_r1;

   871 

   872         default:

   873             break;

   874         }

   875         break;

   876 

   877     /* Block write commands (Class 4) */

   878     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */

   879         if (sd->spi)

   880             goto unimplemented_cmd;

   881         switch (sd->state) {

   882         case sd_transfer_state:

   883             /* Writing in SPI mode not implemented.  */

   884             if (sd->spi)

   885                 break;

   886             sd->state = sd_receivingdata_state;

   887             sd->data_start = req.arg;

   888             sd->data_offset = 0;

   889             sd->blk_written = 0;

   890 

   891             if (sd->data_start + sd->blk_len > sd->size)

   892                 sd->card_status |= ADDRESS_ERROR;

   893             if (sd_wp_addr(sd, sd->data_start))

   894                 sd->card_status |= WP_VIOLATION;

   895             if (sd->csd[14] & 0x30)

   896                 sd->card_status |= WP_VIOLATION;

   897             return sd_r1;

   898 

   899         default:

   900             break;

   901         }

   902         break;

   903 

   904     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */

   905         if (sd->spi)

   906             goto unimplemented_cmd;

   907         switch (sd->state) {

   908         case sd_transfer_state:

   909             /* Writing in SPI mode not implemented.  */

   910             if (sd->spi)

   911                 break;

   912             sd->state = sd_receivingdata_state;

   913             sd->data_start = req.arg;

   914             sd->data_offset = 0;

   915             sd->blk_written = 0;

   916 

   917             if (sd->data_start + sd->blk_len > sd->size)

   918                 sd->card_status |= ADDRESS_ERROR;

   919             if (sd_wp_addr(sd, sd->data_start))

   920                 sd->card_status |= WP_VIOLATION;

   921             if (sd->csd[14] & 0x30)

   922                 sd->card_status |= WP_VIOLATION;

   923             return sd_r1;

   924 

   925         default:

   926             break;

   927         }

   928         break;

   929 

   930     case 26:	/* CMD26:  PROGRAM_CID */

   931         if (sd->spi)

   932             goto bad_cmd;

   933         switch (sd->state) {

   934         case sd_transfer_state:

   935             sd->state = sd_receivingdata_state;

   936             sd->data_start = 0;

   937             sd->data_offset = 0;

   938             return sd_r1;

   939 

   940         default:

   941             break;

   942         }

   943         break;

   944 

   945     case 27:	/* CMD27:  PROGRAM_CSD */

   946         if (sd->spi)

   947             goto unimplemented_cmd;

   948         switch (sd->state) {

   949         case sd_transfer_state:

   950             sd->state = sd_receivingdata_state;

   951             sd->data_start = 0;

   952             sd->data_offset = 0;

   953             return sd_r1;

   954 

   955         default:

   956             break;

   957         }

   958         break;

   959 

   960     /* Write protection (Class 6) */

   961     case 28:	/* CMD28:  SET_WRITE_PROT */

   962         switch (sd->state) {

   963         case sd_transfer_state:

   964             if (req.arg >= sd->size) {

   965                 sd->card_status = ADDRESS_ERROR;

   966                 return sd_r1b;

   967             }

   968 

   969             sd->state = sd_programming_state;

   970             sd->wp_groups[req.arg >> (HWBLOCK_SHIFT +

   971                             SECTOR_SHIFT + WPGROUP_SHIFT)] = 1;

   972             /* Bzzzzzzztt .... Operation complete.  */

   973             sd->state = sd_transfer_state;

   974             return sd_r1b;

   975 

   976         default:

   977             break;

   978         }

   979         break;

   980 

   981     case 29:	/* CMD29:  CLR_WRITE_PROT */

   982         switch (sd->state) {

   983         case sd_transfer_state:

   984             if (req.arg >= sd->size) {

   985                 sd->card_status = ADDRESS_ERROR;

   986                 return sd_r1b;

   987             }

   988 

   989             sd->state = sd_programming_state;

   990             sd->wp_groups[req.arg >> (HWBLOCK_SHIFT +

   991                             SECTOR_SHIFT + WPGROUP_SHIFT)] = 0;

   992             /* Bzzzzzzztt .... Operation complete.  */

   993             sd->state = sd_transfer_state;

   994             return sd_r1b;

   995 

   996         default:

   997             break;

   998         }

   999         break;

  1000 

  1001     case 30:	/* CMD30:  SEND_WRITE_PROT */

  1002         switch (sd->state) {

  1003         case sd_transfer_state:

  1004             sd->state = sd_sendingdata_state;

  1005             *(uint32_t *) sd->data = sd_wpbits(sd, req.arg);

  1006             sd->data_start = req.arg;

  1007             sd->data_offset = 0;

  1008             return sd_r1b;

  1009 

  1010         default:

  1011             break;

  1012         }

  1013         break;

  1014 

  1015     /* Erase commands (Class 5) */

  1016     case 32:	/* CMD32:  ERASE_WR_BLK_START */

  1017         switch (sd->state) {

  1018         case sd_transfer_state:

  1019             sd->erase_start = req.arg;

  1020             return sd_r1;

  1021 

  1022         default:

  1023             break;

  1024         }

  1025         break;

  1026 

  1027     case 33:	/* CMD33:  ERASE_WR_BLK_END */

  1028         switch (sd->state) {

  1029         case sd_transfer_state:

  1030             sd->erase_end = req.arg;

  1031             return sd_r1;

  1032 

  1033         default:

  1034             break;

  1035         }

  1036         break;

  1037 

  1038     case 38:	/* CMD38:  ERASE */

  1039         switch (sd->state) {

  1040         case sd_transfer_state:

  1041             if (sd->csd[14] & 0x30) {

  1042                 sd->card_status |= WP_VIOLATION;

  1043                 return sd_r1b;

  1044             }

  1045 

  1046             sd->state = sd_programming_state;

  1047             sd_erase(sd);

  1048             /* Bzzzzzzztt .... Operation complete.  */

  1049             sd->state = sd_transfer_state;

  1050             return sd_r1b;

  1051 

  1052         default:

  1053             break;

  1054         }

  1055         break;

  1056 

  1057     /* Lock card commands (Class 7) */

  1058     case 42:	/* CMD42:  LOCK_UNLOCK */

  1059         if (sd->spi)

  1060             goto unimplemented_cmd;

  1061         switch (sd->state) {

  1062         case sd_transfer_state:

  1063             sd->state = sd_receivingdata_state;

  1064             sd->data_start = 0;

  1065             sd->data_offset = 0;

  1066             return sd_r1;

  1067 

  1068         default:

  1069             break;

  1070         }

  1071         break;

  1072 

  1073     /* Application specific commands (Class 8) */

  1074     case 55:	/* CMD55:  APP_CMD */

  1075         if (sd->rca != rca)

  1076             return sd_r0;

  1077 

  1078         sd->card_status |= APP_CMD;

  1079         return sd_r1;

  1080 

  1081     case 56:	/* CMD56:  GEN_CMD */

  1082         fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);

  1083 

  1084         switch (sd->state) {

  1085         case sd_transfer_state:

  1086             sd->data_offset = 0;

  1087             if (req.arg & 1)

  1088                 sd->state = sd_sendingdata_state;

  1089             else

  1090                 sd->state = sd_receivingdata_state;

  1091             return sd_r1;

  1092 

  1093         default:

  1094             break;

  1095         }

  1096         break;

  1097 

  1098     default:

  1099     bad_cmd:

  1100         sd->card_status |= ILLEGAL_COMMAND;

  1101 

  1102         fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd);

  1103         return sd_r0;

  1104 

  1105     unimplemented_cmd:

  1106         /* Commands that are recognised but not yet implemented in SPI mode.  */

  1107         sd->card_status |= ILLEGAL_COMMAND;

  1108         fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd);

  1109         return sd_r0;

  1110     }

  1111 

  1112     sd->card_status |= ILLEGAL_COMMAND;

  1113     fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd);

  1114     return sd_r0;

  1115 }

  1116 

  1117 static sd_rsp_type_t sd_app_command(SDState *sd,

  1118                                     struct sd_request_s req) {

  1119     uint32_t rca;

  1120 

  1121     if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)

  1122         rca = req.arg >> 16;

  1123 

  1124     DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);

  1125     switch (req.cmd) {

  1126     case 6:	/* ACMD6:  SET_BUS_WIDTH */

  1127         switch (sd->state) {

  1128         case sd_transfer_state:

  1129             sd->sd_status[0] &= 0x3f;

  1130             sd->sd_status[0] |= (req.arg & 0x03) << 6;

  1131             return sd_r1;

  1132 

  1133         default:

  1134             break;

  1135         }