1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Access SD/MMC cards through SPI master controllers 4 * 5 * (C) Copyright 2005, Intec Automation, 6 * Mike Lavender (mike@steroidmicros) 7 * (C) Copyright 2006-2007, David Brownell 8 * (C) Copyright 2007, Axis Communications, 9 * Hans-Peter Nilsson (hp@axis.com) 10 * (C) Copyright 2007, ATRON electronic GmbH, 11 * Jan Nikitenko <jan.nikitenko@gmail.com> 12 */ 13 #include <linux/sched.h> 14 #include <linux/delay.h> 15 #include <linux/slab.h> 16 #include <linux/module.h> 17 #include <linux/bio.h> 18 #include <linux/dma-direction.h> 19 #include <linux/crc7.h> 20 #include <linux/crc-itu-t.h> 21 #include <linux/scatterlist.h> 22 23 #include <linux/mmc/host.h> 24 #include <linux/mmc/mmc.h> /* for R1_SPI_* bit values */ 25 #include <linux/mmc/slot-gpio.h> 26 27 #include <linux/spi/spi.h> 28 #include <linux/spi/mmc_spi.h> 29 30 #include <asm/unaligned.h> 31 32 33 /* NOTES: 34 * 35 * - For now, we won't try to interoperate with a real mmc/sd/sdio 36 * controller, although some of them do have hardware support for 37 * SPI protocol. The main reason for such configs would be mmc-ish 38 * cards like DataFlash, which don't support that "native" protocol. 39 * 40 * We don't have a "DataFlash/MMC/SD/SDIO card slot" abstraction to 41 * switch between driver stacks, and in any case if "native" mode 42 * is available, it will be faster and hence preferable. 43 * 44 * - MMC depends on a different chipselect management policy than the 45 * SPI interface currently supports for shared bus segments: it needs 46 * to issue multiple spi_message requests with the chipselect active, 47 * using the results of one message to decide the next one to issue. 48 * 49 * Pending updates to the programming interface, this driver expects 50 * that it not share the bus with other drivers (precluding conflicts). 51 * 52 * - We tell the controller to keep the chipselect active from the 53 * beginning of an mmc_host_ops.request until the end. So beware 54 * of SPI controller drivers that mis-handle the cs_change flag! 55 * 56 * However, many cards seem OK with chipselect flapping up/down 57 * during that time ... at least on unshared bus segments. 58 */ 59 60 61 /* 62 * Local protocol constants, internal to data block protocols. 63 */ 64 65 /* Response tokens used to ack each block written: */ 66 #define SPI_MMC_RESPONSE_CODE(x) ((x) & 0x1f) 67 #define SPI_RESPONSE_ACCEPTED ((2 << 1)|1) 68 #define SPI_RESPONSE_CRC_ERR ((5 << 1)|1) 69 #define SPI_RESPONSE_WRITE_ERR ((6 << 1)|1) 70 71 /* Read and write blocks start with these tokens and end with crc; 72 * on error, read tokens act like a subset of R2_SPI_* values. 73 */ 74 #define SPI_TOKEN_SINGLE 0xfe /* single block r/w, multiblock read */ 75 #define SPI_TOKEN_MULTI_WRITE 0xfc /* multiblock write */ 76 #define SPI_TOKEN_STOP_TRAN 0xfd /* terminate multiblock write */ 77 78 #define MMC_SPI_BLOCKSIZE 512 79 80 #define MMC_SPI_R1B_TIMEOUT_MS 3000 81 #define MMC_SPI_INIT_TIMEOUT_MS 3000 82 83 /* One of the critical speed parameters is the amount of data which may 84 * be transferred in one command. If this value is too low, the SD card 85 * controller has to do multiple partial block writes (argggh!). With 86 * today (2008) SD cards there is little speed gain if we transfer more 87 * than 64 KBytes at a time. So use this value until there is any indication 88 * that we should do more here. 89 */ 90 #define MMC_SPI_BLOCKSATONCE 128 91 92 /****************************************************************************/ 93 94 /* 95 * Local Data Structures 96 */ 97 98 /* "scratch" is per-{command,block} data exchanged with the card */ 99 struct scratch { 100 u8 status[29]; 101 u8 data_token; 102 __be16 crc_val; 103 }; 104 105 struct mmc_spi_host { 106 struct mmc_host *mmc; 107 struct spi_device *spi; 108 109 unsigned char power_mode; 110 u16 powerup_msecs; 111 112 struct mmc_spi_platform_data *pdata; 113 114 /* for bulk data transfers */ 115 struct spi_transfer token, t, crc, early_status; 116 struct spi_message m; 117 118 /* for status readback */ 119 struct spi_transfer status; 120 struct spi_message readback; 121 122 /* buffer used for commands and for message "overhead" */ 123 struct scratch *data; 124 125 /* Specs say to write ones most of the time, even when the card 126 * has no need to read its input data; and many cards won't care. 127 * This is our source of those ones. 128 */ 129 void *ones; 130 }; 131 132 133 /****************************************************************************/ 134 135 /* 136 * MMC-over-SPI protocol glue, used by the MMC stack interface 137 */ 138 139 static inline int mmc_cs_off(struct mmc_spi_host *host) 140 { 141 /* chipselect will always be inactive after setup() */ 142 return spi_setup(host->spi); 143 } 144 145 static int mmc_spi_readbytes(struct mmc_spi_host *host, unsigned int len) 146 { 147 if (len > sizeof(*host->data)) { 148 WARN_ON(1); 149 return -EIO; 150 } 151 152 host->status.len = len; 153 154 return spi_sync_locked(host->spi, &host->readback); 155 } 156 157 static int mmc_spi_skip(struct mmc_spi_host *host, unsigned long timeout, 158 unsigned n, u8 byte) 159 { 160 u8 *cp = host->data->status; 161 unsigned long start = jiffies; 162 163 do { 164 int status; 165 unsigned i; 166 167 status = mmc_spi_readbytes(host, n); 168 if (status < 0) 169 return status; 170 171 for (i = 0; i < n; i++) { 172 if (cp[i] != byte) 173 return cp[i]; 174 } 175 176 /* If we need long timeouts, we may release the CPU */ 177 cond_resched(); 178 } while (time_is_after_jiffies(start + timeout)); 179 return -ETIMEDOUT; 180 } 181 182 static inline int 183 mmc_spi_wait_unbusy(struct mmc_spi_host *host, unsigned long timeout) 184 { 185 return mmc_spi_skip(host, timeout, sizeof(host->data->status), 0); 186 } 187 188 static int mmc_spi_readtoken(struct mmc_spi_host *host, unsigned long timeout) 189 { 190 return mmc_spi_skip(host, timeout, 1, 0xff); 191 } 192 193 194 /* 195 * Note that for SPI, cmd->resp[0] is not the same data as "native" protocol 196 * hosts return! The low byte holds R1_SPI bits. The next byte may hold 197 * R2_SPI bits ... for SEND_STATUS, or after data read errors. 198 * 199 * cmd->resp[1] holds any four-byte response, for R3 (READ_OCR) and on 200 * newer cards R7 (IF_COND). 201 */ 202 203 static char *maptype(struct mmc_command *cmd) 204 { 205 switch (mmc_spi_resp_type(cmd)) { 206 case MMC_RSP_SPI_R1: return "R1"; 207 case MMC_RSP_SPI_R1B: return "R1B"; 208 case MMC_RSP_SPI_R2: return "R2/R5"; 209 case MMC_RSP_SPI_R3: return "R3/R4/R7"; 210 default: return "?"; 211 } 212 } 213 214 /* return zero, else negative errno after setting cmd->error */ 215 static int mmc_spi_response_get(struct mmc_spi_host *host, 216 struct mmc_command *cmd, int cs_on) 217 { 218 unsigned long timeout_ms; 219 u8 *cp = host->data->status; 220 u8 *end = cp + host->t.len; 221 int value = 0; 222 int bitshift; 223 u8 leftover = 0; 224 unsigned short rotator; 225 int i; 226 227 /* Except for data block reads, the whole response will already 228 * be stored in the scratch buffer. It's somewhere after the 229 * command and the first byte we read after it. We ignore that 230 * first byte. After STOP_TRANSMISSION command it may include 231 * two data bits, but otherwise it's all ones. 232 */ 233 cp += 8; 234 while (cp < end && *cp == 0xff) 235 cp++; 236 237 /* Data block reads (R1 response types) may need more data... */ 238 if (cp == end) { 239 cp = host->data->status; 240 end = cp+1; 241 242 /* Card sends N(CR) (== 1..8) bytes of all-ones then one 243 * status byte ... and we already scanned 2 bytes. 244 * 245 * REVISIT block read paths use nasty byte-at-a-time I/O 246 * so it can always DMA directly into the target buffer. 247 * It'd probably be better to memcpy() the first chunk and 248 * avoid extra i/o calls... 249 * 250 * Note we check for more than 8 bytes, because in practice, 251 * some SD cards are slow... 252 */ 253 for (i = 2; i < 16; i++) { 254 value = mmc_spi_readbytes(host, 1); 255 if (value < 0) 256 goto done; 257 if (*cp != 0xff) 258 goto checkstatus; 259 } 260 value = -ETIMEDOUT; 261 goto done; 262 } 263 264 checkstatus: 265 bitshift = 0; 266 if (*cp & 0x80) { 267 /* Houston, we have an ugly card with a bit-shifted response */ 268 rotator = *cp++ << 8; 269 /* read the next byte */ 270 if (cp == end) { 271 value = mmc_spi_readbytes(host, 1); 272 if (value < 0) 273 goto done; 274 cp = host->data->status; 275 end = cp+1; 276 } 277 rotator |= *cp++; 278 while (rotator & 0x8000) { 279 bitshift++; 280 rotator <<= 1; 281 } 282 cmd->resp[0] = rotator >> 8; 283 leftover = rotator; 284 } else { 285 cmd->resp[0] = *cp++; 286 } 287 cmd->error = 0; 288 289 /* Status byte: the entire seven-bit R1 response. */ 290 if (cmd->resp[0] != 0) { 291 if ((R1_SPI_PARAMETER | R1_SPI_ADDRESS) 292 & cmd->resp[0]) 293 value = -EFAULT; /* Bad address */ 294 else if (R1_SPI_ILLEGAL_COMMAND & cmd->resp[0]) 295 value = -ENOSYS; /* Function not implemented */ 296 else if (R1_SPI_COM_CRC & cmd->resp[0]) 297 value = -EILSEQ; /* Illegal byte sequence */ 298 else if ((R1_SPI_ERASE_SEQ | R1_SPI_ERASE_RESET) 299 & cmd->resp[0]) 300 value = -EIO; /* I/O error */ 301 /* else R1_SPI_IDLE, "it's resetting" */ 302 } 303 304 switch (mmc_spi_resp_type(cmd)) { 305 306 /* SPI R1B == R1 + busy; STOP_TRANSMISSION (for multiblock reads) 307 * and less-common stuff like various erase operations. 308 */ 309 case MMC_RSP_SPI_R1B: 310 /* maybe we read all the busy tokens already */ 311 while (cp < end && *cp == 0) 312 cp++; 313 if (cp == end) { 314 timeout_ms = cmd->busy_timeout ? cmd->busy_timeout : 315 MMC_SPI_R1B_TIMEOUT_MS; 316 mmc_spi_wait_unbusy(host, msecs_to_jiffies(timeout_ms)); 317 } 318 break; 319 320 /* SPI R2 == R1 + second status byte; SEND_STATUS 321 * SPI R5 == R1 + data byte; IO_RW_DIRECT 322 */ 323 case MMC_RSP_SPI_R2: 324 /* read the next byte */ 325 if (cp == end) { 326 value = mmc_spi_readbytes(host, 1); 327 if (value < 0) 328 goto done; 329 cp = host->data->status; 330 end = cp+1; 331 } 332 if (bitshift) { 333 rotator = leftover << 8; 334 rotator |= *cp << bitshift; 335 cmd->resp[0] |= (rotator & 0xFF00); 336 } else { 337 cmd->resp[0] |= *cp << 8; 338 } 339 break; 340 341 /* SPI R3, R4, or R7 == R1 + 4 bytes */ 342 case MMC_RSP_SPI_R3: 343 rotator = leftover << 8; 344 cmd->resp[1] = 0; 345 for (i = 0; i < 4; i++) { 346 cmd->resp[1] <<= 8; 347 /* read the next byte */ 348 if (cp == end) { 349 value = mmc_spi_readbytes(host, 1); 350 if (value < 0) 351 goto done; 352 cp = host->data->status; 353 end = cp+1; 354 } 355 if (bitshift) { 356 rotator |= *cp++ << bitshift; 357 cmd->resp[1] |= (rotator >> 8); 358 rotator <<= 8; 359 } else { 360 cmd->resp[1] |= *cp++; 361 } 362 } 363 break; 364 365 /* SPI R1 == just one status byte */ 366 case MMC_RSP_SPI_R1: 367 break; 368 369 default: 370 dev_dbg(&host->spi->dev, "bad response type %04x\n", 371 mmc_spi_resp_type(cmd)); 372 if (value >= 0) 373 value = -EINVAL; 374 goto done; 375 } 376 377 if (value < 0) 378 dev_dbg(&host->spi->dev, 379 " ... CMD%d response SPI_%s: resp %04x %08x\n", 380 cmd->opcode, maptype(cmd), cmd->resp[0], cmd->resp[1]); 381 382 /* disable chipselect on errors and some success cases */ 383 if (value >= 0 && cs_on) 384 return value; 385 done: 386 if (value < 0) 387 cmd->error = value; 388 mmc_cs_off(host); 389 return value; 390 } 391 392 /* Issue command and read its response. 393 * Returns zero on success, negative for error. 394 * 395 * On error, caller must cope with mmc core retry mechanism. That 396 * means immediate low-level resubmit, which affects the bus lock... 397 */ 398 static int 399 mmc_spi_command_send(struct mmc_spi_host *host, 400 struct mmc_request *mrq, 401 struct mmc_command *cmd, int cs_on) 402 { 403 struct scratch *data = host->data; 404 u8 *cp = data->status; 405 int status; 406 struct spi_transfer *t; 407 408 /* We can handle most commands (except block reads) in one full 409 * duplex I/O operation before either starting the next transfer 410 * (data block or command) or else deselecting the card. 411 * 412 * First, write 7 bytes: 413 * - an all-ones byte to ensure the card is ready 414 * - opcode byte (plus start and transmission bits) 415 * - four bytes of big-endian argument 416 * - crc7 (plus end bit) ... always computed, it's cheap 417 * 418 * We init the whole buffer to all-ones, which is what we need 419 * to write while we're reading (later) response data. 420 */ 421 memset(cp, 0xff, sizeof(data->status)); 422 423 cp[1] = 0x40 | cmd->opcode; 424 put_unaligned_be32(cmd->arg, cp + 2); 425 cp[6] = crc7_be(0, cp + 1, 5) | 0x01; 426 cp += 7; 427 428 /* Then, read up to 13 bytes (while writing all-ones): 429 * - N(CR) (== 1..8) bytes of all-ones 430 * - status byte (for all response types) 431 * - the rest of the response, either: 432 * + nothing, for R1 or R1B responses 433 * + second status byte, for R2 responses 434 * + four data bytes, for R3 and R7 responses 435 * 436 * Finally, read some more bytes ... in the nice cases we know in 437 * advance how many, and reading 1 more is always OK: 438 * - N(EC) (== 0..N) bytes of all-ones, before deselect/finish 439 * - N(RC) (== 1..N) bytes of all-ones, before next command 440 * - N(WR) (== 1..N) bytes of all-ones, before data write 441 * 442 * So in those cases one full duplex I/O of at most 21 bytes will 443 * handle the whole command, leaving the card ready to receive a 444 * data block or new command. We do that whenever we can, shaving 445 * CPU and IRQ costs (especially when using DMA or FIFOs). 446 * 447 * There are two other cases, where it's not generally practical 448 * to rely on a single I/O: 449 * 450 * - R1B responses need at least N(EC) bytes of all-zeroes. 451 * 452 * In this case we can *try* to fit it into one I/O, then 453 * maybe read more data later. 454 * 455 * - Data block reads are more troublesome, since a variable 456 * number of padding bytes precede the token and data. 457 * + N(CX) (== 0..8) bytes of all-ones, before CSD or CID 458 * + N(AC) (== 1..many) bytes of all-ones 459 * 460 * In this case we currently only have minimal speedups here: 461 * when N(CR) == 1 we can avoid I/O in response_get(). 462 */ 463 if (cs_on && (mrq->data->flags & MMC_DATA_READ)) { 464 cp += 2; /* min(N(CR)) + status */ 465 /* R1 */ 466 } else { 467 cp += 10; /* max(N(CR)) + status + min(N(RC),N(WR)) */ 468 if (cmd->flags & MMC_RSP_SPI_S2) /* R2/R5 */ 469 cp++; 470 else if (cmd->flags & MMC_RSP_SPI_B4) /* R3/R4/R7 */ 471 cp += 4; 472 else if (cmd->flags & MMC_RSP_BUSY) /* R1B */ 473 cp = data->status + sizeof(data->status); 474 /* else: R1 (most commands) */ 475 } 476 477 dev_dbg(&host->spi->dev, " CMD%d, resp %s\n", 478 cmd->opcode, maptype(cmd)); 479 480 /* send command, leaving chipselect active */ 481 spi_message_init(&host->m); 482 483 t = &host->t; 484 memset(t, 0, sizeof(*t)); 485 t->tx_buf = t->rx_buf = data->status; 486 t->len = cp - data->status; 487 t->cs_change = 1; 488 spi_message_add_tail(t, &host->m); 489 490 status = spi_sync_locked(host->spi, &host->m); 491 if (status < 0) { 492 dev_dbg(&host->spi->dev, " ... write returned %d\n", status); 493 cmd->error = status; 494 return status; 495 } 496 497 /* after no-data commands and STOP_TRANSMISSION, chipselect off */ 498 return mmc_spi_response_get(host, cmd, cs_on); 499 } 500 501 /* Build data message with up to four separate transfers. For TX, we 502 * start by writing the data token. And in most cases, we finish with 503 * a status transfer. 504 * 505 * We always provide TX data for data and CRC. The MMC/SD protocol 506 * requires us to write ones; but Linux defaults to writing zeroes; 507 * so we explicitly initialize it to all ones on RX paths. 508 */ 509 static void 510 mmc_spi_setup_data_message( 511 struct mmc_spi_host *host, 512 bool multiple, 513 enum dma_data_direction direction) 514 { 515 struct spi_transfer *t; 516 struct scratch *scratch = host->data; 517 518 spi_message_init(&host->m); 519 520 /* for reads, readblock() skips 0xff bytes before finding 521 * the token; for writes, this transfer issues that token. 522 */ 523 if (direction == DMA_TO_DEVICE) { 524 t = &host->token; 525 memset(t, 0, sizeof(*t)); 526 t->len = 1; 527 if (multiple) 528 scratch->data_token = SPI_TOKEN_MULTI_WRITE; 529 else 530 scratch->data_token = SPI_TOKEN_SINGLE; 531 t->tx_buf = &scratch->data_token; 532 spi_message_add_tail(t, &host->m); 533 } 534 535 /* Body of transfer is buffer, then CRC ... 536 * either TX-only, or RX with TX-ones. 537 */ 538 t = &host->t; 539 memset(t, 0, sizeof(*t)); 540 t->tx_buf = host->ones; 541 /* length and actual buffer info are written later */ 542 spi_message_add_tail(t, &host->m); 543 544 t = &host->crc; 545 memset(t, 0, sizeof(*t)); 546 t->len = 2; 547 if (direction == DMA_TO_DEVICE) { 548 /* the actual CRC may get written later */ 549 t->tx_buf = &scratch->crc_val; 550 } else { 551 t->tx_buf = host->ones; 552 t->rx_buf = &scratch->crc_val; 553 } 554 spi_message_add_tail(t, &host->m); 555 556 /* 557 * A single block read is followed by N(EC) [0+] all-ones bytes 558 * before deselect ... don't bother. 559 * 560 * Multiblock reads are followed by N(AC) [1+] all-ones bytes before 561 * the next block is read, or a STOP_TRANSMISSION is issued. We'll 562 * collect that single byte, so readblock() doesn't need to. 563 * 564 * For a write, the one-byte data response follows immediately, then 565 * come zero or more busy bytes, then N(WR) [1+] all-ones bytes. 566 * Then single block reads may deselect, and multiblock ones issue 567 * the next token (next data block, or STOP_TRAN). We can try to 568 * minimize I/O ops by using a single read to collect end-of-busy. 569 */ 570 if (multiple || direction == DMA_TO_DEVICE) { 571 t = &host->early_status; 572 memset(t, 0, sizeof(*t)); 573 t->len = (direction == DMA_TO_DEVICE) ? sizeof(scratch->status) : 1; 574 t->tx_buf = host->ones; 575 t->rx_buf = scratch->status; 576 t->cs_change = 1; 577 spi_message_add_tail(t, &host->m); 578 } 579 } 580 581 /* 582 * Write one block: 583 * - caller handled preceding N(WR) [1+] all-ones bytes 584 * - data block 585 * + token 586 * + data bytes 587 * + crc16 588 * - an all-ones byte ... card writes a data-response byte 589 * - followed by N(EC) [0+] all-ones bytes, card writes zero/'busy' 590 * 591 * Return negative errno, else success. 592 */ 593 static int 594 mmc_spi_writeblock(struct mmc_spi_host *host, struct spi_transfer *t, 595 unsigned long timeout) 596 { 597 struct spi_device *spi = host->spi; 598 int status, i; 599 struct scratch *scratch = host->data; 600 u32 pattern; 601 602 if (host->mmc->use_spi_crc) 603 scratch->crc_val = cpu_to_be16(crc_itu_t(0, t->tx_buf, t->len)); 604 605 status = spi_sync_locked(spi, &host->m); 606 if (status != 0) { 607 dev_dbg(&spi->dev, "write error (%d)\n", status); 608 return status; 609 } 610 611 /* 612 * Get the transmission data-response reply. It must follow 613 * immediately after the data block we transferred. This reply 614 * doesn't necessarily tell whether the write operation succeeded; 615 * it just says if the transmission was ok and whether *earlier* 616 * writes succeeded; see the standard. 617 * 618 * In practice, there are (even modern SDHC-)cards which are late 619 * in sending the response, and miss the time frame by a few bits, 620 * so we have to cope with this situation and check the response 621 * bit-by-bit. Arggh!!! 622 */ 623 pattern = get_unaligned_be32(scratch->status); 624 625 /* First 3 bit of pattern are undefined */ 626 pattern |= 0xE0000000; 627 628 /* left-adjust to leading 0 bit */ 629 while (pattern & 0x80000000) 630 pattern <<= 1; 631 /* right-adjust for pattern matching. Code is in bit 4..0 now. */ 632 pattern >>= 27; 633 634 switch (pattern) { 635 case SPI_RESPONSE_ACCEPTED: 636 status = 0; 637 break; 638 case SPI_RESPONSE_CRC_ERR: 639 /* host shall then issue MMC_STOP_TRANSMISSION */ 640 status = -EILSEQ; 641 break; 642 case SPI_RESPONSE_WRITE_ERR: 643 /* host shall then issue MMC_STOP_TRANSMISSION, 644 * and should MMC_SEND_STATUS to sort it out 645 */ 646 status = -EIO; 647 break; 648 default: 649 status = -EPROTO; 650 break; 651 } 652 if (status != 0) { 653 dev_dbg(&spi->dev, "write error %02x (%d)\n", 654 scratch->status[0], status); 655 return status; 656 } 657 658 t->tx_buf += t->len; 659 660 /* Return when not busy. If we didn't collect that status yet, 661 * we'll need some more I/O. 662 */ 663 for (i = 4; i < sizeof(scratch->status); i++) { 664 /* card is non-busy if the most recent bit is 1 */ 665 if (scratch->status[i] & 0x01) 666 return 0; 667 } 668 return mmc_spi_wait_unbusy(host, timeout); 669 } 670 671 /* 672 * Read one block: 673 * - skip leading all-ones bytes ... either 674 * + N(AC) [1..f(clock,CSD)] usually, else 675 * + N(CX) [0..8] when reading CSD or CID 676 * - data block 677 * + token ... if error token, no data or crc 678 * + data bytes 679 * + crc16 680 * 681 * After single block reads, we're done; N(EC) [0+] all-ones bytes follow 682 * before dropping chipselect. 683 * 684 * For multiblock reads, caller either reads the next block or issues a 685 * STOP_TRANSMISSION command. 686 */ 687 static int 688 mmc_spi_readblock(struct mmc_spi_host *host, struct spi_transfer *t, 689 unsigned long timeout) 690 { 691 struct spi_device *spi = host->spi; 692 int status; 693 struct scratch *scratch = host->data; 694 unsigned int bitshift; 695 u8 leftover; 696 697 /* At least one SD card sends an all-zeroes byte when N(CX) 698 * applies, before the all-ones bytes ... just cope with that. 699 */ 700 status = mmc_spi_readbytes(host, 1); 701 if (status < 0) 702 return status; 703 status = scratch->status[0]; 704 if (status == 0xff || status == 0) 705 status = mmc_spi_readtoken(host, timeout); 706 707 if (status < 0) { 708 dev_dbg(&spi->dev, "read error %02x (%d)\n", status, status); 709 return status; 710 } 711 712 /* The token may be bit-shifted... 713 * the first 0-bit precedes the data stream. 714 */ 715 bitshift = 7; 716 while (status & 0x80) { 717 status <<= 1; 718 bitshift--; 719 } 720 leftover = status << 1; 721 722 status = spi_sync_locked(spi, &host->m); 723 if (status < 0) { 724 dev_dbg(&spi->dev, "read error %d\n", status); 725 return status; 726 } 727 728 if (bitshift) { 729 /* Walk through the data and the crc and do 730 * all the magic to get byte-aligned data. 731 */ 732 u8 *cp = t->rx_buf; 733 unsigned int len; 734 unsigned int bitright = 8 - bitshift; 735 u8 temp; 736 for (len = t->len; len; len--) { 737 temp = *cp; 738 *cp++ = leftover | (temp >> bitshift); 739 leftover = temp << bitright; 740 } 741 cp = (u8 *) &scratch->crc_val; 742 temp = *cp; 743 *cp++ = leftover | (temp >> bitshift); 744 leftover = temp << bitright; 745 temp = *cp; 746 *cp = leftover | (temp >> bitshift); 747 } 748 749 if (host->mmc->use_spi_crc) { 750 u16 crc = crc_itu_t(0, t->rx_buf, t->len); 751 752 be16_to_cpus(&scratch->crc_val); 753 if (scratch->crc_val != crc) { 754 dev_dbg(&spi->dev, 755 "read - crc error: crc_val=0x%04x, computed=0x%04x len=%d\n", 756 scratch->crc_val, crc, t->len); 757 return -EILSEQ; 758 } 759 } 760 761 t->rx_buf += t->len; 762 763 return 0; 764 } 765 766 /* 767 * An MMC/SD data stage includes one or more blocks, optional CRCs, 768 * and inline handshaking. That handhaking makes it unlike most 769 * other SPI protocol stacks. 770 */ 771 static void 772 mmc_spi_data_do(struct mmc_spi_host *host, struct mmc_command *cmd, 773 struct mmc_data *data, u32 blk_size) 774 { 775 struct spi_device *spi = host->spi; 776 struct spi_transfer *t; 777 enum dma_data_direction direction = mmc_get_dma_dir(data); 778 struct scatterlist *sg; 779 unsigned n_sg; 780 bool multiple = (data->blocks > 1); 781 const char *write_or_read = (direction == DMA_TO_DEVICE) ? "write" : "read"; 782 u32 clock_rate; 783 unsigned long timeout; 784 785 mmc_spi_setup_data_message(host, multiple, direction); 786 t = &host->t; 787 788 if (t->speed_hz) 789 clock_rate = t->speed_hz; 790 else 791 clock_rate = spi->max_speed_hz; 792 793 timeout = data->timeout_ns / 1000 + 794 data->timeout_clks * 1000000 / clock_rate; 795 timeout = usecs_to_jiffies((unsigned int)timeout) + 1; 796 797 /* Handle scatterlist segments one at a time, with synch for 798 * each 512-byte block 799 */ 800 for_each_sg(data->sg, sg, data->sg_len, n_sg) { 801 int status = 0; 802 void *kmap_addr; 803 unsigned length = sg->length; 804 805 /* allow pio too; we don't allow highmem */ 806 kmap_addr = kmap(sg_page(sg)); 807 if (direction == DMA_TO_DEVICE) 808 t->tx_buf = kmap_addr + sg->offset; 809 else 810 t->rx_buf = kmap_addr + sg->offset; 811 812 /* transfer each block, and update request status */ 813 while (length) { 814 t->len = min(length, blk_size); 815 816 dev_dbg(&spi->dev, " %s block, %d bytes\n", write_or_read, t->len); 817 818 if (direction == DMA_TO_DEVICE) 819 status = mmc_spi_writeblock(host, t, timeout); 820 else 821 status = mmc_spi_readblock(host, t, timeout); 822 if (status < 0) 823 break; 824 825 data->bytes_xfered += t->len; 826 length -= t->len; 827 828 if (!multiple) 829 break; 830 } 831 832 /* discard mappings */ 833 if (direction == DMA_FROM_DEVICE) 834 flush_dcache_page(sg_page(sg)); 835 kunmap(sg_page(sg)); 836 837 if (status < 0) { 838 data->error = status; 839 dev_dbg(&spi->dev, "%s status %d\n", write_or_read, status); 840 break; 841 } 842 } 843 844 /* NOTE some docs describe an MMC-only SET_BLOCK_COUNT (CMD23) that 845 * can be issued before multiblock writes. Unlike its more widely 846 * documented analogue for SD cards (SET_WR_BLK_ERASE_COUNT, ACMD23), 847 * that can affect the STOP_TRAN logic. Complete (and current) 848 * MMC specs should sort that out before Linux starts using CMD23. 849 */ 850 if (direction == DMA_TO_DEVICE && multiple) { 851 struct scratch *scratch = host->data; 852 int tmp; 853 const unsigned statlen = sizeof(scratch->status); 854 855 dev_dbg(&spi->dev, " STOP_TRAN\n"); 856 857 /* Tweak the per-block message we set up earlier by morphing 858 * it to hold single buffer with the token followed by some 859 * all-ones bytes ... skip N(BR) (0..1), scan the rest for 860 * "not busy any longer" status, and leave chip selected. 861 */ 862 INIT_LIST_HEAD(&host->m.transfers); 863 list_add(&host->early_status.transfer_list, 864 &host->m.transfers); 865 866 memset(scratch->status, 0xff, statlen); 867 scratch->status[0] = SPI_TOKEN_STOP_TRAN; 868 869 host->early_status.tx_buf = host->early_status.rx_buf; 870 host->early_status.len = statlen; 871 872 tmp = spi_sync_locked(spi, &host->m); 873 if (tmp < 0) { 874 if (!data->error) 875 data->error = tmp; 876 return; 877 } 878 879 /* Ideally we collected "not busy" status with one I/O, 880 * avoiding wasteful byte-at-a-time scanning... but more 881 * I/O is often needed. 882 */ 883 for (tmp = 2; tmp < statlen; tmp++) { 884 if (scratch->status[tmp] != 0) 885 return; 886 } 887 tmp = mmc_spi_wait_unbusy(host, timeout); 888 if (tmp < 0 && !data->error) 889 data->error = tmp; 890 } 891 } 892 893 /****************************************************************************/ 894 895 /* 896 * MMC driver implementation -- the interface to the MMC stack 897 */ 898 899 static void mmc_spi_request(struct mmc_host *mmc, struct mmc_request *mrq) 900 { 901 struct mmc_spi_host *host = mmc_priv(mmc); 902 int status = -EINVAL; 903 int crc_retry = 5; 904 struct mmc_command stop; 905 906 #ifdef DEBUG 907 /* MMC core and layered drivers *MUST* issue SPI-aware commands */ 908 { 909 struct mmc_command *cmd; 910 int invalid = 0; 911 912 cmd = mrq->cmd; 913 if (!mmc_spi_resp_type(cmd)) { 914 dev_dbg(&host->spi->dev, "bogus command\n"); 915 cmd->error = -EINVAL; 916 invalid = 1; 917 } 918 919 cmd = mrq->stop; 920 if (cmd && !mmc_spi_resp_type(cmd)) { 921 dev_dbg(&host->spi->dev, "bogus STOP command\n"); 922 cmd->error = -EINVAL; 923 invalid = 1; 924 } 925 926 if (invalid) { 927 dump_stack(); 928 mmc_request_done(host->mmc, mrq); 929 return; 930 } 931 } 932 #endif 933 934 /* request exclusive bus access */ 935 spi_bus_lock(host->spi->master); 936 937 crc_recover: 938 /* issue command; then optionally data and stop */ 939 status = mmc_spi_command_send(host, mrq, mrq->cmd, mrq->data != NULL); 940 if (status == 0 && mrq->data) { 941 mmc_spi_data_do(host, mrq->cmd, mrq->data, mrq->data->blksz); 942 943 /* 944 * The SPI bus is not always reliable for large data transfers. 945 * If an occasional crc error is reported by the SD device with 946 * data read/write over SPI, it may be recovered by repeating 947 * the last SD command again. The retry count is set to 5 to 948 * ensure the driver passes stress tests. 949 */ 950 if (mrq->data->error == -EILSEQ && crc_retry) { 951 stop.opcode = MMC_STOP_TRANSMISSION; 952 stop.arg = 0; 953 stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC; 954 status = mmc_spi_command_send(host, mrq, &stop, 0); 955 crc_retry--; 956 mrq->data->error = 0; 957 goto crc_recover; 958 } 959 960 if (mrq->stop) 961 status = mmc_spi_command_send(host, mrq, mrq->stop, 0); 962 else 963 mmc_cs_off(host); 964 } 965 966 /* release the bus */ 967 spi_bus_unlock(host->spi->master); 968 969 mmc_request_done(host->mmc, mrq); 970 } 971 972 /* See Section 6.4.1, in SD "Simplified Physical Layer Specification 2.0" 973 * 974 * NOTE that here we can't know that the card has just been powered up; 975 * not all MMC/SD sockets support power switching. 976 * 977 * FIXME when the card is still in SPI mode, e.g. from a previous kernel, 978 * this doesn't seem to do the right thing at all... 979 */ 980 static void mmc_spi_initsequence(struct mmc_spi_host *host) 981 { 982 /* Try to be very sure any previous command has completed; 983 * wait till not-busy, skip debris from any old commands. 984 */ 985 mmc_spi_wait_unbusy(host, msecs_to_jiffies(MMC_SPI_INIT_TIMEOUT_MS)); 986 mmc_spi_readbytes(host, 10); 987 988 /* 989 * Do a burst with chipselect active-high. We need to do this to 990 * meet the requirement of 74 clock cycles with both chipselect 991 * and CMD (MOSI) high before CMD0 ... after the card has been 992 * powered up to Vdd(min), and so is ready to take commands. 993 * 994 * Some cards are particularly needy of this (e.g. Viking "SD256") 995 * while most others don't seem to care. 996 * 997 * Note that this is one of the places MMC/SD plays games with the 998 * SPI protocol. Another is that when chipselect is released while 999 * the card returns BUSY status, the clock must issue several cycles 1000 * with chipselect high before the card will stop driving its output. 1001 * 1002 * SPI_CS_HIGH means "asserted" here. In some cases like when using 1003 * GPIOs for chip select, SPI_CS_HIGH is set but this will be logically 1004 * inverted by gpiolib, so if we want to ascertain to drive it high 1005 * we should toggle the default with an XOR as we do here. 1006 */ 1007 host->spi->mode ^= SPI_CS_HIGH; 1008 if (spi_setup(host->spi) != 0) { 1009 /* Just warn; most cards work without it. */ 1010 dev_warn(&host->spi->dev, 1011 "can't change chip-select polarity\n"); 1012 host->spi->mode ^= SPI_CS_HIGH; 1013 } else { 1014 mmc_spi_readbytes(host, 18); 1015 1016 host->spi->mode ^= SPI_CS_HIGH; 1017 if (spi_setup(host->spi) != 0) { 1018 /* Wot, we can't get the same setup we had before? */ 1019 dev_err(&host->spi->dev, 1020 "can't restore chip-select polarity\n"); 1021 } 1022 } 1023 } 1024 1025 static char *mmc_powerstring(u8 power_mode) 1026 { 1027 switch (power_mode) { 1028 case MMC_POWER_OFF: return "off"; 1029 case MMC_POWER_UP: return "up"; 1030 case MMC_POWER_ON: return "on"; 1031 } 1032 return "?"; 1033 } 1034 1035 static void mmc_spi_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) 1036 { 1037 struct mmc_spi_host *host = mmc_priv(mmc); 1038 1039 if (host->power_mode != ios->power_mode) { 1040 int canpower; 1041 1042 canpower = host->pdata && host->pdata->setpower; 1043 1044 dev_dbg(&host->spi->dev, "power %s (%d)%s\n", 1045 mmc_powerstring(ios->power_mode), 1046 ios->vdd, 1047 canpower ? ", can switch" : ""); 1048 1049 /* switch power on/off if possible, accounting for 1050 * max 250msec powerup time if needed. 1051 */ 1052 if (canpower) { 1053 switch (ios->power_mode) { 1054 case MMC_POWER_OFF: 1055 case MMC_POWER_UP: 1056 host->pdata->setpower(&host->spi->dev, 1057 ios->vdd); 1058 if (ios->power_mode == MMC_POWER_UP) 1059 msleep(host->powerup_msecs); 1060 } 1061 } 1062 1063 /* See 6.4.1 in the simplified SD card physical spec 2.0 */ 1064 if (ios->power_mode == MMC_POWER_ON) 1065 mmc_spi_initsequence(host); 1066 1067 /* If powering down, ground all card inputs to avoid power 1068 * delivery from data lines! On a shared SPI bus, this 1069 * will probably be temporary; 6.4.2 of the simplified SD 1070 * spec says this must last at least 1msec. 1071 * 1072 * - Clock low means CPOL 0, e.g. mode 0 1073 * - MOSI low comes from writing zero 1074 * - Chipselect is usually active low... 1075 */ 1076 if (canpower && ios->power_mode == MMC_POWER_OFF) { 1077 int mres; 1078 u8 nullbyte = 0; 1079 1080 host->spi->mode &= ~(SPI_CPOL|SPI_CPHA); 1081 mres = spi_setup(host->spi); 1082 if (mres < 0) 1083 dev_dbg(&host->spi->dev, 1084 "switch to SPI mode 0 failed\n"); 1085 1086 if (spi_write(host->spi, &nullbyte, 1) < 0) 1087 dev_dbg(&host->spi->dev, 1088 "put spi signals to low failed\n"); 1089 1090 /* 1091 * Now clock should be low due to spi mode 0; 1092 * MOSI should be low because of written 0x00; 1093 * chipselect should be low (it is active low) 1094 * power supply is off, so now MMC is off too! 1095 * 1096 * FIXME no, chipselect can be high since the 1097 * device is inactive and SPI_CS_HIGH is clear... 1098 */ 1099 msleep(10); 1100 if (mres == 0) { 1101 host->spi->mode |= (SPI_CPOL|SPI_CPHA); 1102 mres = spi_setup(host->spi); 1103 if (mres < 0) 1104 dev_dbg(&host->spi->dev, 1105 "switch back to SPI mode 3 failed\n"); 1106 } 1107 } 1108 1109 host->power_mode = ios->power_mode; 1110 } 1111 1112 if (host->spi->max_speed_hz != ios->clock && ios->clock != 0) { 1113 int status; 1114 1115 host->spi->max_speed_hz = ios->clock; 1116 status = spi_setup(host->spi); 1117 dev_dbg(&host->spi->dev, " clock to %d Hz, %d\n", 1118 host->spi->max_speed_hz, status); 1119 } 1120 } 1121 1122 static const struct mmc_host_ops mmc_spi_ops = { 1123 .request = mmc_spi_request, 1124 .set_ios = mmc_spi_set_ios, 1125 .get_ro = mmc_gpio_get_ro, 1126 .get_cd = mmc_gpio_get_cd, 1127 }; 1128 1129 1130 /****************************************************************************/ 1131 1132 /* 1133 * SPI driver implementation 1134 */ 1135 1136 static irqreturn_t 1137 mmc_spi_detect_irq(int irq, void *mmc) 1138 { 1139 struct mmc_spi_host *host = mmc_priv(mmc); 1140 u16 delay_msec = max(host->pdata->detect_delay, (u16)100); 1141 1142 mmc_detect_change(mmc, msecs_to_jiffies(delay_msec)); 1143 return IRQ_HANDLED; 1144 } 1145 1146 static int mmc_spi_probe(struct spi_device *spi) 1147 { 1148 void *ones; 1149 struct mmc_host *mmc; 1150 struct mmc_spi_host *host; 1151 int status; 1152 bool has_ro = false; 1153 1154 /* We rely on full duplex transfers, mostly to reduce 1155 * per-transfer overheads (by making fewer transfers). 1156 */ 1157 if (spi->master->flags & SPI_MASTER_HALF_DUPLEX) 1158 return -EINVAL; 1159 1160 /* MMC and SD specs only seem to care that sampling is on the 1161 * rising edge ... meaning SPI modes 0 or 3. So either SPI mode 1162 * should be legit. We'll use mode 0 since the steady state is 0, 1163 * which is appropriate for hotplugging, unless the platform data 1164 * specify mode 3 (if hardware is not compatible to mode 0). 1165 */ 1166 if (spi->mode != SPI_MODE_3) 1167 spi->mode = SPI_MODE_0; 1168 spi->bits_per_word = 8; 1169 1170 status = spi_setup(spi); 1171 if (status < 0) { 1172 dev_dbg(&spi->dev, "needs SPI mode %02x, %d KHz; %d\n", 1173 spi->mode, spi->max_speed_hz / 1000, 1174 status); 1175 return status; 1176 } 1177 1178 /* We need a supply of ones to transmit. This is the only time 1179 * the CPU touches these, so cache coherency isn't a concern. 1180 * 1181 * NOTE if many systems use more than one MMC-over-SPI connector 1182 * it'd save some memory to share this. That's evidently rare. 1183 */ 1184 status = -ENOMEM; 1185 ones = kmalloc(MMC_SPI_BLOCKSIZE, GFP_KERNEL); 1186 if (!ones) 1187 goto nomem; 1188 memset(ones, 0xff, MMC_SPI_BLOCKSIZE); 1189 1190 mmc = mmc_alloc_host(sizeof(*host), &spi->dev); 1191 if (!mmc) 1192 goto nomem; 1193 1194 mmc->ops = &mmc_spi_ops; 1195 mmc->max_blk_size = MMC_SPI_BLOCKSIZE; 1196 mmc->max_segs = MMC_SPI_BLOCKSATONCE; 1197 mmc->max_req_size = MMC_SPI_BLOCKSATONCE * MMC_SPI_BLOCKSIZE; 1198 mmc->max_blk_count = MMC_SPI_BLOCKSATONCE; 1199 1200 mmc->caps = MMC_CAP_SPI; 1201 1202 /* SPI doesn't need the lowspeed device identification thing for 1203 * MMC or SD cards, since it never comes up in open drain mode. 1204 * That's good; some SPI masters can't handle very low speeds! 1205 * 1206 * However, low speed SDIO cards need not handle over 400 KHz; 1207 * that's the only reason not to use a few MHz for f_min (until 1208 * the upper layer reads the target frequency from the CSD). 1209 */ 1210 mmc->f_min = 400000; 1211 mmc->f_max = spi->max_speed_hz; 1212 1213 host = mmc_priv(mmc); 1214 host->mmc = mmc; 1215 host->spi = spi; 1216 1217 host->ones = ones; 1218 1219 dev_set_drvdata(&spi->dev, mmc); 1220 1221 /* Platform data is used to hook up things like card sensing 1222 * and power switching gpios. 1223 */ 1224 host->pdata = mmc_spi_get_pdata(spi); 1225 if (host->pdata) 1226 mmc->ocr_avail = host->pdata->ocr_mask; 1227 if (!mmc->ocr_avail) { 1228 dev_warn(&spi->dev, "ASSUMING 3.2-3.4 V slot power\n"); 1229 mmc->ocr_avail = MMC_VDD_32_33|MMC_VDD_33_34; 1230 } 1231 if (host->pdata && host->pdata->setpower) { 1232 host->powerup_msecs = host->pdata->powerup_msecs; 1233 if (!host->powerup_msecs || host->powerup_msecs > 250) 1234 host->powerup_msecs = 250; 1235 } 1236 1237 /* Preallocate buffers */ 1238 host->data = kmalloc(sizeof(*host->data), GFP_KERNEL); 1239 if (!host->data) 1240 goto fail_nobuf1; 1241 1242 /* setup message for status/busy readback */ 1243 spi_message_init(&host->readback); 1244 1245 spi_message_add_tail(&host->status, &host->readback); 1246 host->status.tx_buf = host->ones; 1247 host->status.rx_buf = &host->data->status; 1248 host->status.cs_change = 1; 1249 1250 /* register card detect irq */ 1251 if (host->pdata && host->pdata->init) { 1252 status = host->pdata->init(&spi->dev, mmc_spi_detect_irq, mmc); 1253 if (status != 0) 1254 goto fail_glue_init; 1255 } 1256 1257 /* pass platform capabilities, if any */ 1258 if (host->pdata) { 1259 mmc->caps |= host->pdata->caps; 1260 mmc->caps2 |= host->pdata->caps2; 1261 } 1262 1263 status = mmc_add_host(mmc); 1264 if (status != 0) 1265 goto fail_glue_init; 1266 1267 /* 1268 * Index 0 is card detect 1269 * Old boardfiles were specifying 1 ms as debounce 1270 */ 1271 status = mmc_gpiod_request_cd(mmc, NULL, 0, false, 1000); 1272 if (status == -EPROBE_DEFER) 1273 goto fail_gpiod_request; 1274 if (!status) { 1275 /* 1276 * The platform has a CD GPIO signal that may support 1277 * interrupts, so let mmc_gpiod_request_cd_irq() decide 1278 * if polling is needed or not. 1279 */ 1280 mmc->caps &= ~MMC_CAP_NEEDS_POLL; 1281 mmc_gpiod_request_cd_irq(mmc); 1282 } 1283 mmc_detect_change(mmc, 0); 1284 1285 /* Index 1 is write protect/read only */ 1286 status = mmc_gpiod_request_ro(mmc, NULL, 1, 0); 1287 if (status == -EPROBE_DEFER) 1288 goto fail_gpiod_request; 1289 if (!status) 1290 has_ro = true; 1291 1292 dev_info(&spi->dev, "SD/MMC host %s%s%s%s\n", 1293 dev_name(&mmc->class_dev), 1294 has_ro ? "" : ", no WP", 1295 (host->pdata && host->pdata->setpower) 1296 ? "" : ", no poweroff", 1297 (mmc->caps & MMC_CAP_NEEDS_POLL) 1298 ? ", cd polling" : ""); 1299 return 0; 1300 1301 fail_gpiod_request: 1302 mmc_remove_host(mmc); 1303 fail_glue_init: 1304 kfree(host->data); 1305 fail_nobuf1: 1306 mmc_spi_put_pdata(spi); 1307 mmc_free_host(mmc); 1308 nomem: 1309 kfree(ones); 1310 return status; 1311 } 1312 1313 1314 static void mmc_spi_remove(struct spi_device *spi) 1315 { 1316 struct mmc_host *mmc = dev_get_drvdata(&spi->dev); 1317 struct mmc_spi_host *host = mmc_priv(mmc); 1318 1319 /* prevent new mmc_detect_change() calls */ 1320 if (host->pdata && host->pdata->exit) 1321 host->pdata->exit(&spi->dev, mmc); 1322 1323 mmc_remove_host(mmc); 1324 1325 kfree(host->data); 1326 kfree(host->ones); 1327 1328 spi->max_speed_hz = mmc->f_max; 1329 mmc_spi_put_pdata(spi); 1330 mmc_free_host(mmc); 1331 } 1332 1333 static const struct spi_device_id mmc_spi_dev_ids[] = { 1334 { "mmc-spi-slot"}, 1335 { }, 1336 }; 1337 MODULE_DEVICE_TABLE(spi, mmc_spi_dev_ids); 1338 1339 static const struct of_device_id mmc_spi_of_match_table[] = { 1340 { .compatible = "mmc-spi-slot", }, 1341 {}, 1342 }; 1343 MODULE_DEVICE_TABLE(of, mmc_spi_of_match_table); 1344 1345 static struct spi_driver mmc_spi_driver = { 1346 .driver = { 1347 .name = "mmc_spi", 1348 .of_match_table = mmc_spi_of_match_table, 1349 }, 1350 .id_table = mmc_spi_dev_ids, 1351 .probe = mmc_spi_probe, 1352 .remove = mmc_spi_remove, 1353 }; 1354 1355 module_spi_driver(mmc_spi_driver); 1356 1357 MODULE_AUTHOR("Mike Lavender, David Brownell, Hans-Peter Nilsson, Jan Nikitenko"); 1358 MODULE_DESCRIPTION("SPI SD/MMC host driver"); 1359 MODULE_LICENSE("GPL"); 1360 MODULE_ALIAS("spi:mmc_spi"); 1361