1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * Access SD/MMC cards through SPI master controllers
   4 *
   5 * (C) Copyright 2005, Intec Automation,
   6 *		Mike Lavender (mike@steroidmicros)
   7 * (C) Copyright 2006-2007, David Brownell
   8 * (C) Copyright 2007, Axis Communications,
   9 *		Hans-Peter Nilsson (hp@axis.com)
  10 * (C) Copyright 2007, ATRON electronic GmbH,
  11 *		Jan Nikitenko <jan.nikitenko@gmail.com>
  12 */
  13#include <linux/sched.h>
  14#include <linux/delay.h>
  15#include <linux/slab.h>
  16#include <linux/module.h>
  17#include <linux/bio.h>
  18#include <linux/dma-mapping.h>
  19#include <linux/crc7.h>
  20#include <linux/crc-itu-t.h>
  21#include <linux/scatterlist.h>
  22
  23#include <linux/mmc/host.h>
  24#include <linux/mmc/mmc.h>		/* for R1_SPI_* bit values */
  25#include <linux/mmc/slot-gpio.h>
  26
  27#include <linux/spi/spi.h>
  28#include <linux/spi/mmc_spi.h>
  29
  30#include <asm/unaligned.h>
  31
  32
  33/* NOTES:
  34 *
  35 * - For now, we won't try to interoperate with a real mmc/sd/sdio
  36 *   controller, although some of them do have hardware support for
  37 *   SPI protocol.  The main reason for such configs would be mmc-ish
  38 *   cards like DataFlash, which don't support that "native" protocol.
  39 *
  40 *   We don't have a "DataFlash/MMC/SD/SDIO card slot" abstraction to
  41 *   switch between driver stacks, and in any case if "native" mode
  42 *   is available, it will be faster and hence preferable.
  43 *
  44 * - MMC depends on a different chipselect management policy than the
  45 *   SPI interface currently supports for shared bus segments:  it needs
  46 *   to issue multiple spi_message requests with the chipselect active,
  47 *   using the results of one message to decide the next one to issue.
  48 *
  49 *   Pending updates to the programming interface, this driver expects
  50 *   that it not share the bus with other drivers (precluding conflicts).
  51 *
  52 * - We tell the controller to keep the chipselect active from the
  53 *   beginning of an mmc_host_ops.request until the end.  So beware
  54 *   of SPI controller drivers that mis-handle the cs_change flag!
  55 *
  56 *   However, many cards seem OK with chipselect flapping up/down
  57 *   during that time ... at least on unshared bus segments.
  58 */
  59
  60
  61/*
  62 * Local protocol constants, internal to data block protocols.
  63 */
  64
  65/* Response tokens used to ack each block written: */
  66#define SPI_MMC_RESPONSE_CODE(x)	((x) & 0x1f)
  67#define SPI_RESPONSE_ACCEPTED		((2 << 1)|1)
  68#define SPI_RESPONSE_CRC_ERR		((5 << 1)|1)
  69#define SPI_RESPONSE_WRITE_ERR		((6 << 1)|1)
  70
  71/* Read and write blocks start with these tokens and end with crc;
  72 * on error, read tokens act like a subset of R2_SPI_* values.
  73 */
  74#define SPI_TOKEN_SINGLE	0xfe	/* single block r/w, multiblock read */
  75#define SPI_TOKEN_MULTI_WRITE	0xfc	/* multiblock write */
  76#define SPI_TOKEN_STOP_TRAN	0xfd	/* terminate multiblock write */
  77
  78#define MMC_SPI_BLOCKSIZE	512
  79
  80#define MMC_SPI_R1B_TIMEOUT_MS	3000
  81#define MMC_SPI_INIT_TIMEOUT_MS	3000
  82
  83/* One of the critical speed parameters is the amount of data which may
  84 * be transferred in one command. If this value is too low, the SD card
  85 * controller has to do multiple partial block writes (argggh!). With
  86 * today (2008) SD cards there is little speed gain if we transfer more
  87 * than 64 KBytes at a time. So use this value until there is any indication
  88 * that we should do more here.
  89 */
  90#define MMC_SPI_BLOCKSATONCE	128
  91
  92/****************************************************************************/
  93
  94/*
  95 * Local Data Structures
  96 */
  97
  98/* "scratch" is per-{command,block} data exchanged with the card */
  99struct scratch {
 100	u8			status[29];
 101	u8			data_token;
 102	__be16			crc_val;
 103};
 104
 105struct mmc_spi_host {
 106	struct mmc_host		*mmc;
 107	struct spi_device	*spi;
 108
 109	unsigned char		power_mode;
 110	u16			powerup_msecs;
 111
 112	struct mmc_spi_platform_data	*pdata;
 113
 114	/* for bulk data transfers */
 115	struct spi_transfer	token, t, crc, early_status;
 116	struct spi_message	m;
 117
 118	/* for status readback */
 119	struct spi_transfer	status;
 120	struct spi_message	readback;
 121
 122	/* underlying DMA-aware controller, or null */
 123	struct device		*dma_dev;
 124
 125	/* buffer used for commands and for message "overhead" */
 126	struct scratch		*data;
 127	dma_addr_t		data_dma;
 128
 129	/* Specs say to write ones most of the time, even when the card
 130	 * has no need to read its input data; and many cards won't care.
 131	 * This is our source of those ones.
 132	 */
 133	void			*ones;
 134	dma_addr_t		ones_dma;
 135};
 136
 137
 138/****************************************************************************/
 139
 140/*
 141 * MMC-over-SPI protocol glue, used by the MMC stack interface
 142 */
 143
 144static inline int mmc_cs_off(struct mmc_spi_host *host)
 145{
 146	/* chipselect will always be inactive after setup() */
 147	return spi_setup(host->spi);
 148}
 149
 150static int
 151mmc_spi_readbytes(struct mmc_spi_host *host, unsigned len)
 152{
 153	int status;
 154
 155	if (len > sizeof(*host->data)) {
 156		WARN_ON(1);
 157		return -EIO;
 158	}
 159
 160	host->status.len = len;
 161
 162	if (host->dma_dev)
 163		dma_sync_single_for_device(host->dma_dev,
 164				host->data_dma, sizeof(*host->data),
 165				DMA_FROM_DEVICE);
 166
 167	status = spi_sync_locked(host->spi, &host->readback);
 168
 169	if (host->dma_dev)
 170		dma_sync_single_for_cpu(host->dma_dev,
 171				host->data_dma, sizeof(*host->data),
 172				DMA_FROM_DEVICE);
 173
 174	return status;
 175}
 176
 177static int mmc_spi_skip(struct mmc_spi_host *host, unsigned long timeout,
 178			unsigned n, u8 byte)
 179{
 180	u8 *cp = host->data->status;
 181	unsigned long start = jiffies;
 182
 183	do {
 184		int		status;
 185		unsigned	i;
 186
 187		status = mmc_spi_readbytes(host, n);
 188		if (status < 0)
 189			return status;
 190
 191		for (i = 0; i < n; i++) {
 192			if (cp[i] != byte)
 193				return cp[i];
 194		}
 195
 196		/* If we need long timeouts, we may release the CPU */
 197		cond_resched();
 198	} while (time_is_after_jiffies(start + timeout));
 199	return -ETIMEDOUT;
 200}
 201
 202static inline int
 203mmc_spi_wait_unbusy(struct mmc_spi_host *host, unsigned long timeout)
 204{
 205	return mmc_spi_skip(host, timeout, sizeof(host->data->status), 0);
 206}
 207
 208static int mmc_spi_readtoken(struct mmc_spi_host *host, unsigned long timeout)
 209{
 210	return mmc_spi_skip(host, timeout, 1, 0xff);
 211}
 212
 213
 214/*
 215 * Note that for SPI, cmd->resp[0] is not the same data as "native" protocol
 216 * hosts return!  The low byte holds R1_SPI bits.  The next byte may hold
 217 * R2_SPI bits ... for SEND_STATUS, or after data read errors.
 218 *
 219 * cmd->resp[1] holds any four-byte response, for R3 (READ_OCR) and on
 220 * newer cards R7 (IF_COND).
 221 */
 222
 223static char *maptype(struct mmc_command *cmd)
 224{
 225	switch (mmc_spi_resp_type(cmd)) {
 226	case MMC_RSP_SPI_R1:	return "R1";
 227	case MMC_RSP_SPI_R1B:	return "R1B";
 228	case MMC_RSP_SPI_R2:	return "R2/R5";
 229	case MMC_RSP_SPI_R3:	return "R3/R4/R7";
 230	default:		return "?";
 231	}
 232}
 233
 234/* return zero, else negative errno after setting cmd->error */
 235static int mmc_spi_response_get(struct mmc_spi_host *host,
 236		struct mmc_command *cmd, int cs_on)
 237{
 238	unsigned long timeout_ms;
 239	u8	*cp = host->data->status;
 240	u8	*end = cp + host->t.len;
 241	int	value = 0;
 242	int	bitshift;
 243	u8 	leftover = 0;
 244	unsigned short rotator;
 245	int 	i;
 246	char	tag[32];
 247
 248	snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
 249		cmd->opcode, maptype(cmd));
 250
 251	/* Except for data block reads, the whole response will already
 252	 * be stored in the scratch buffer.  It's somewhere after the
 253	 * command and the first byte we read after it.  We ignore that
 254	 * first byte.  After STOP_TRANSMISSION command it may include
 255	 * two data bits, but otherwise it's all ones.
 256	 */
 257	cp += 8;
 258	while (cp < end && *cp == 0xff)
 259		cp++;
 260
 261	/* Data block reads (R1 response types) may need more data... */
 262	if (cp == end) {
 263		cp = host->data->status;
 264		end = cp+1;
 265
 266		/* Card sends N(CR) (== 1..8) bytes of all-ones then one
 267		 * status byte ... and we already scanned 2 bytes.
 268		 *
 269		 * REVISIT block read paths use nasty byte-at-a-time I/O
 270		 * so it can always DMA directly into the target buffer.
 271		 * It'd probably be better to memcpy() the first chunk and
 272		 * avoid extra i/o calls...
 273		 *
 274		 * Note we check for more than 8 bytes, because in practice,
 275		 * some SD cards are slow...
 276		 */
 277		for (i = 2; i < 16; i++) {
 278			value = mmc_spi_readbytes(host, 1);
 279			if (value < 0)
 280				goto done;
 281			if (*cp != 0xff)
 282				goto checkstatus;
 283		}
 284		value = -ETIMEDOUT;
 285		goto done;
 286	}
 287
 288checkstatus:
 289	bitshift = 0;
 290	if (*cp & 0x80)	{
 291		/* Houston, we have an ugly card with a bit-shifted response */
 292		rotator = *cp++ << 8;
 293		/* read the next byte */
 294		if (cp == end) {
 295			value = mmc_spi_readbytes(host, 1);
 296			if (value < 0)
 297				goto done;
 298			cp = host->data->status;
 299			end = cp+1;
 300		}
 301		rotator |= *cp++;
 302		while (rotator & 0x8000) {
 303			bitshift++;
 304			rotator <<= 1;
 305		}
 306		cmd->resp[0] = rotator >> 8;
 307		leftover = rotator;
 308	} else {
 309		cmd->resp[0] = *cp++;
 310	}
 311	cmd->error = 0;
 312
 313	/* Status byte: the entire seven-bit R1 response.  */
 314	if (cmd->resp[0] != 0) {
 315		if ((R1_SPI_PARAMETER | R1_SPI_ADDRESS)
 316				& cmd->resp[0])
 317			value = -EFAULT; /* Bad address */
 318		else if (R1_SPI_ILLEGAL_COMMAND & cmd->resp[0])
 319			value = -ENOSYS; /* Function not implemented */
 320		else if (R1_SPI_COM_CRC & cmd->resp[0])
 321			value = -EILSEQ; /* Illegal byte sequence */
 322		else if ((R1_SPI_ERASE_SEQ | R1_SPI_ERASE_RESET)
 323				& cmd->resp[0])
 324			value = -EIO;    /* I/O error */
 325		/* else R1_SPI_IDLE, "it's resetting" */
 326	}
 327
 328	switch (mmc_spi_resp_type(cmd)) {
 329
 330	/* SPI R1B == R1 + busy; STOP_TRANSMISSION (for multiblock reads)
 331	 * and less-common stuff like various erase operations.
 332	 */
 333	case MMC_RSP_SPI_R1B:
 334		/* maybe we read all the busy tokens already */
 335		while (cp < end && *cp == 0)
 336			cp++;
 337		if (cp == end) {
 338			timeout_ms = cmd->busy_timeout ? cmd->busy_timeout :
 339				MMC_SPI_R1B_TIMEOUT_MS;
 340			mmc_spi_wait_unbusy(host, msecs_to_jiffies(timeout_ms));
 341		}
 342		break;
 343
 344	/* SPI R2 == R1 + second status byte; SEND_STATUS
 345	 * SPI R5 == R1 + data byte; IO_RW_DIRECT
 346	 */
 347	case MMC_RSP_SPI_R2:
 348		/* read the next byte */
 349		if (cp == end) {
 350			value = mmc_spi_readbytes(host, 1);
 351			if (value < 0)
 352				goto done;
 353			cp = host->data->status;
 354			end = cp+1;
 355		}
 356		if (bitshift) {
 357			rotator = leftover << 8;
 358			rotator |= *cp << bitshift;
 359			cmd->resp[0] |= (rotator & 0xFF00);
 360		} else {
 361			cmd->resp[0] |= *cp << 8;
 362		}
 363		break;
 364
 365	/* SPI R3, R4, or R7 == R1 + 4 bytes */
 366	case MMC_RSP_SPI_R3:
 367		rotator = leftover << 8;
 368		cmd->resp[1] = 0;
 369		for (i = 0; i < 4; i++) {
 370			cmd->resp[1] <<= 8;
 371			/* read the next byte */
 372			if (cp == end) {
 373				value = mmc_spi_readbytes(host, 1);
 374				if (value < 0)
 375					goto done;
 376				cp = host->data->status;
 377				end = cp+1;
 378			}
 379			if (bitshift) {
 380				rotator |= *cp++ << bitshift;
 381				cmd->resp[1] |= (rotator >> 8);
 382				rotator <<= 8;
 383			} else {
 384				cmd->resp[1] |= *cp++;
 385			}
 386		}
 387		break;
 388
 389	/* SPI R1 == just one status byte */
 390	case MMC_RSP_SPI_R1:
 391		break;
 392
 393	default:
 394		dev_dbg(&host->spi->dev, "bad response type %04x\n",
 395			mmc_spi_resp_type(cmd));
 396		if (value >= 0)
 397			value = -EINVAL;
 398		goto done;
 399	}
 400
 401	if (value < 0)
 402		dev_dbg(&host->spi->dev, "%s: resp %04x %08x\n",
 403			tag, cmd->resp[0], cmd->resp[1]);
 404
 405	/* disable chipselect on errors and some success cases */
 406	if (value >= 0 && cs_on)
 407		return value;
 408done:
 409	if (value < 0)
 410		cmd->error = value;
 411	mmc_cs_off(host);
 412	return value;
 413}
 414
 415/* Issue command and read its response.
 416 * Returns zero on success, negative for error.
 417 *
 418 * On error, caller must cope with mmc core retry mechanism.  That
 419 * means immediate low-level resubmit, which affects the bus lock...
 420 */
 421static int
 422mmc_spi_command_send(struct mmc_spi_host *host,
 423		struct mmc_request *mrq,
 424		struct mmc_command *cmd, int cs_on)
 425{
 426	struct scratch		*data = host->data;
 427	u8			*cp = data->status;
 428	int			status;
 429	struct spi_transfer	*t;
 430
 431	/* We can handle most commands (except block reads) in one full
 432	 * duplex I/O operation before either starting the next transfer
 433	 * (data block or command) or else deselecting the card.
 434	 *
 435	 * First, write 7 bytes:
 436	 *  - an all-ones byte to ensure the card is ready
 437	 *  - opcode byte (plus start and transmission bits)
 438	 *  - four bytes of big-endian argument
 439	 *  - crc7 (plus end bit) ... always computed, it's cheap
 440	 *
 441	 * We init the whole buffer to all-ones, which is what we need
 442	 * to write while we're reading (later) response data.
 443	 */
 444	memset(cp, 0xff, sizeof(data->status));
 445
 446	cp[1] = 0x40 | cmd->opcode;
 447	put_unaligned_be32(cmd->arg, cp + 2);
 448	cp[6] = crc7_be(0, cp + 1, 5) | 0x01;
 449	cp += 7;
 450
 451	/* Then, read up to 13 bytes (while writing all-ones):
 452	 *  - N(CR) (== 1..8) bytes of all-ones
 453	 *  - status byte (for all response types)
 454	 *  - the rest of the response, either:
 455	 *      + nothing, for R1 or R1B responses
 456	 *	+ second status byte, for R2 responses
 457	 *	+ four data bytes, for R3 and R7 responses
 458	 *
 459	 * Finally, read some more bytes ... in the nice cases we know in
 460	 * advance how many, and reading 1 more is always OK:
 461	 *  - N(EC) (== 0..N) bytes of all-ones, before deselect/finish
 462	 *  - N(RC) (== 1..N) bytes of all-ones, before next command
 463	 *  - N(WR) (== 1..N) bytes of all-ones, before data write
 464	 *
 465	 * So in those cases one full duplex I/O of at most 21 bytes will
 466	 * handle the whole command, leaving the card ready to receive a
 467	 * data block or new command.  We do that whenever we can, shaving
 468	 * CPU and IRQ costs (especially when using DMA or FIFOs).
 469	 *
 470	 * There are two other cases, where it's not generally practical
 471	 * to rely on a single I/O:
 472	 *
 473	 *  - R1B responses need at least N(EC) bytes of all-zeroes.
 474	 *
 475	 *    In this case we can *try* to fit it into one I/O, then
 476	 *    maybe read more data later.
 477	 *
 478	 *  - Data block reads are more troublesome, since a variable
 479	 *    number of padding bytes precede the token and data.
 480	 *      + N(CX) (== 0..8) bytes of all-ones, before CSD or CID
 481	 *      + N(AC) (== 1..many) bytes of all-ones
 482	 *
 483	 *    In this case we currently only have minimal speedups here:
 484	 *    when N(CR) == 1 we can avoid I/O in response_get().
 485	 */
 486	if (cs_on && (mrq->data->flags & MMC_DATA_READ)) {
 487		cp += 2;	/* min(N(CR)) + status */
 488		/* R1 */
 489	} else {
 490		cp += 10;	/* max(N(CR)) + status + min(N(RC),N(WR)) */
 491		if (cmd->flags & MMC_RSP_SPI_S2)	/* R2/R5 */
 492			cp++;
 493		else if (cmd->flags & MMC_RSP_SPI_B4)	/* R3/R4/R7 */
 494			cp += 4;
 495		else if (cmd->flags & MMC_RSP_BUSY)	/* R1B */
 496			cp = data->status + sizeof(data->status);
 497		/* else:  R1 (most commands) */
 498	}
 499
 500	dev_dbg(&host->spi->dev, "  CMD%d, resp %s\n",
 501		cmd->opcode, maptype(cmd));
 502
 503	/* send command, leaving chipselect active */
 504	spi_message_init(&host->m);
 505
 506	t = &host->t;
 507	memset(t, 0, sizeof(*t));
 508	t->tx_buf = t->rx_buf = data->status;
 509	t->tx_dma = t->rx_dma = host->data_dma;
 510	t->len = cp - data->status;
 511	t->cs_change = 1;
 512	spi_message_add_tail(t, &host->m);
 513
 514	if (host->dma_dev) {
 515		host->m.is_dma_mapped = 1;
 516		dma_sync_single_for_device(host->dma_dev,
 517				host->data_dma, sizeof(*host->data),
 518				DMA_BIDIRECTIONAL);
 519	}
 520	status = spi_sync_locked(host->spi, &host->m);
 521
 522	if (host->dma_dev)
 523		dma_sync_single_for_cpu(host->dma_dev,
 524				host->data_dma, sizeof(*host->data),
 525				DMA_BIDIRECTIONAL);
 526	if (status < 0) {
 527		dev_dbg(&host->spi->dev, "  ... write returned %d\n", status);
 528		cmd->error = status;
 529		return status;
 530	}
 531
 532	/* after no-data commands and STOP_TRANSMISSION, chipselect off */
 533	return mmc_spi_response_get(host, cmd, cs_on);
 534}
 535
 536/* Build data message with up to four separate transfers.  For TX, we
 537 * start by writing the data token.  And in most cases, we finish with
 538 * a status transfer.
 539 *
 540 * We always provide TX data for data and CRC.  The MMC/SD protocol
 541 * requires us to write ones; but Linux defaults to writing zeroes;
 542 * so we explicitly initialize it to all ones on RX paths.
 543 *
 544 * We also handle DMA mapping, so the underlying SPI controller does
 545 * not need to (re)do it for each message.
 546 */
 547static void
 548mmc_spi_setup_data_message(
 549	struct mmc_spi_host	*host,
 550	bool			multiple,
 551	enum dma_data_direction	direction)
 552{
 553	struct spi_transfer	*t;
 554	struct scratch		*scratch = host->data;
 555	dma_addr_t		dma = host->data_dma;
 556
 557	spi_message_init(&host->m);
 558	if (dma)
 559		host->m.is_dma_mapped = 1;
 560
 561	/* for reads, readblock() skips 0xff bytes before finding
 562	 * the token; for writes, this transfer issues that token.
 563	 */
 564	if (direction == DMA_TO_DEVICE) {
 565		t = &host->token;
 566		memset(t, 0, sizeof(*t));
 567		t->len = 1;
 568		if (multiple)
 569			scratch->data_token = SPI_TOKEN_MULTI_WRITE;
 570		else
 571			scratch->data_token = SPI_TOKEN_SINGLE;
 572		t->tx_buf = &scratch->data_token;
 573		if (dma)
 574			t->tx_dma = dma + offsetof(struct scratch, data_token);
 575		spi_message_add_tail(t, &host->m);
 576	}
 577
 578	/* Body of transfer is buffer, then CRC ...
 579	 * either TX-only, or RX with TX-ones.
 580	 */
 581	t = &host->t;
 582	memset(t, 0, sizeof(*t));
 583	t->tx_buf = host->ones;
 584	t->tx_dma = host->ones_dma;
 585	/* length and actual buffer info are written later */
 586	spi_message_add_tail(t, &host->m);
 587
 588	t = &host->crc;
 589	memset(t, 0, sizeof(*t));
 590	t->len = 2;
 591	if (direction == DMA_TO_DEVICE) {
 592		/* the actual CRC may get written later */
 593		t->tx_buf = &scratch->crc_val;
 594		if (dma)
 595			t->tx_dma = dma + offsetof(struct scratch, crc_val);
 596	} else {
 597		t->tx_buf = host->ones;
 598		t->tx_dma = host->ones_dma;
 599		t->rx_buf = &scratch->crc_val;
 600		if (dma)
 601			t->rx_dma = dma + offsetof(struct scratch, crc_val);
 602	}
 603	spi_message_add_tail(t, &host->m);
 604
 605	/*
 606	 * A single block read is followed by N(EC) [0+] all-ones bytes
 607	 * before deselect ... don't bother.
 608	 *
 609	 * Multiblock reads are followed by N(AC) [1+] all-ones bytes before
 610	 * the next block is read, or a STOP_TRANSMISSION is issued.  We'll
 611	 * collect that single byte, so readblock() doesn't need to.
 612	 *
 613	 * For a write, the one-byte data response follows immediately, then
 614	 * come zero or more busy bytes, then N(WR) [1+] all-ones bytes.
 615	 * Then single block reads may deselect, and multiblock ones issue
 616	 * the next token (next data block, or STOP_TRAN).  We can try to
 617	 * minimize I/O ops by using a single read to collect end-of-busy.
 618	 */
 619	if (multiple || direction == DMA_TO_DEVICE) {
 620		t = &host->early_status;
 621		memset(t, 0, sizeof(*t));
 622		t->len = (direction == DMA_TO_DEVICE) ? sizeof(scratch->status) : 1;
 623		t->tx_buf = host->ones;
 624		t->tx_dma = host->ones_dma;
 625		t->rx_buf = scratch->status;
 626		if (dma)
 627			t->rx_dma = dma + offsetof(struct scratch, status);
 628		t->cs_change = 1;
 629		spi_message_add_tail(t, &host->m);
 630	}
 631}
 632
 633/*
 634 * Write one block:
 635 *  - caller handled preceding N(WR) [1+] all-ones bytes
 636 *  - data block
 637 *	+ token
 638 *	+ data bytes
 639 *	+ crc16
 640 *  - an all-ones byte ... card writes a data-response byte
 641 *  - followed by N(EC) [0+] all-ones bytes, card writes zero/'busy'
 642 *
 643 * Return negative errno, else success.
 644 */
 645static int
 646mmc_spi_writeblock(struct mmc_spi_host *host, struct spi_transfer *t,
 647	unsigned long timeout)
 648{
 649	struct spi_device	*spi = host->spi;
 650	int			status, i;
 651	struct scratch		*scratch = host->data;
 652	u32			pattern;
 653
 654	if (host->mmc->use_spi_crc)
 655		scratch->crc_val = cpu_to_be16(crc_itu_t(0, t->tx_buf, t->len));
 656	if (host->dma_dev)
 657		dma_sync_single_for_device(host->dma_dev,
 658				host->data_dma, sizeof(*scratch),
 659				DMA_BIDIRECTIONAL);
 660
 661	status = spi_sync_locked(spi, &host->m);
 662
 663	if (status != 0) {
 664		dev_dbg(&spi->dev, "write error (%d)\n", status);
 665		return status;
 666	}
 667
 668	if (host->dma_dev)
 669		dma_sync_single_for_cpu(host->dma_dev,
 670				host->data_dma, sizeof(*scratch),
 671				DMA_BIDIRECTIONAL);
 672
 673	/*
 674	 * Get the transmission data-response reply.  It must follow
 675	 * immediately after the data block we transferred.  This reply
 676	 * doesn't necessarily tell whether the write operation succeeded;
 677	 * it just says if the transmission was ok and whether *earlier*
 678	 * writes succeeded; see the standard.
 679	 *
 680	 * In practice, there are (even modern SDHC-)cards which are late
 681	 * in sending the response, and miss the time frame by a few bits,
 682	 * so we have to cope with this situation and check the response
 683	 * bit-by-bit. Arggh!!!
 684	 */
 685	pattern = get_unaligned_be32(scratch->status);
 686
 687	/* First 3 bit of pattern are undefined */
 688	pattern |= 0xE0000000;
 689
 690	/* left-adjust to leading 0 bit */
 691	while (pattern & 0x80000000)
 692		pattern <<= 1;
 693	/* right-adjust for pattern matching. Code is in bit 4..0 now. */
 694	pattern >>= 27;
 695
 696	switch (pattern) {
 697	case SPI_RESPONSE_ACCEPTED:
 698		status = 0;
 699		break;
 700	case SPI_RESPONSE_CRC_ERR:
 701		/* host shall then issue MMC_STOP_TRANSMISSION */
 702		status = -EILSEQ;
 703		break;
 704	case SPI_RESPONSE_WRITE_ERR:
 705		/* host shall then issue MMC_STOP_TRANSMISSION,
 706		 * and should MMC_SEND_STATUS to sort it out
 707		 */
 708		status = -EIO;
 709		break;
 710	default:
 711		status = -EPROTO;
 712		break;
 713	}
 714	if (status != 0) {
 715		dev_dbg(&spi->dev, "write error %02x (%d)\n",
 716			scratch->status[0], status);
 717		return status;
 718	}
 719
 720	t->tx_buf += t->len;
 721	if (host->dma_dev)
 722		t->tx_dma += t->len;
 723
 724	/* Return when not busy.  If we didn't collect that status yet,
 725	 * we'll need some more I/O.
 726	 */
 727	for (i = 4; i < sizeof(scratch->status); i++) {
 728		/* card is non-busy if the most recent bit is 1 */
 729		if (scratch->status[i] & 0x01)
 730			return 0;
 731	}
 732	return mmc_spi_wait_unbusy(host, timeout);
 733}
 734
 735/*
 736 * Read one block:
 737 *  - skip leading all-ones bytes ... either
 738 *      + N(AC) [1..f(clock,CSD)] usually, else
 739 *      + N(CX) [0..8] when reading CSD or CID
 740 *  - data block
 741 *	+ token ... if error token, no data or crc
 742 *	+ data bytes
 743 *	+ crc16
 744 *
 745 * After single block reads, we're done; N(EC) [0+] all-ones bytes follow
 746 * before dropping chipselect.
 747 *
 748 * For multiblock reads, caller either reads the next block or issues a
 749 * STOP_TRANSMISSION command.
 750 */
 751static int
 752mmc_spi_readblock(struct mmc_spi_host *host, struct spi_transfer *t,
 753	unsigned long timeout)
 754{
 755	struct spi_device	*spi = host->spi;
 756	int			status;
 757	struct scratch		*scratch = host->data;
 758	unsigned int 		bitshift;
 759	u8			leftover;
 760
 761	/* At least one SD card sends an all-zeroes byte when N(CX)
 762	 * applies, before the all-ones bytes ... just cope with that.
 763	 */
 764	status = mmc_spi_readbytes(host, 1);
 765	if (status < 0)
 766		return status;
 767	status = scratch->status[0];
 768	if (status == 0xff || status == 0)
 769		status = mmc_spi_readtoken(host, timeout);
 770
 771	if (status < 0) {
 772		dev_dbg(&spi->dev, "read error %02x (%d)\n", status, status);
 773		return status;
 774	}
 775
 776	/* The token may be bit-shifted...
 777	 * the first 0-bit precedes the data stream.
 778	 */
 779	bitshift = 7;
 780	while (status & 0x80) {
 781		status <<= 1;
 782		bitshift--;
 783	}
 784	leftover = status << 1;
 785
 786	if (host->dma_dev) {
 787		dma_sync_single_for_device(host->dma_dev,
 788				host->data_dma, sizeof(*scratch),
 789				DMA_BIDIRECTIONAL);
 790		dma_sync_single_for_device(host->dma_dev,
 791				t->rx_dma, t->len,
 792				DMA_FROM_DEVICE);
 793	}
 794
 795	status = spi_sync_locked(spi, &host->m);
 796	if (status < 0) {
 797		dev_dbg(&spi->dev, "read error %d\n", status);
 798		return status;
 799	}
 800
 801	if (host->dma_dev) {
 802		dma_sync_single_for_cpu(host->dma_dev,
 803				host->data_dma, sizeof(*scratch),
 804				DMA_BIDIRECTIONAL);
 805		dma_sync_single_for_cpu(host->dma_dev,
 806				t->rx_dma, t->len,
 807				DMA_FROM_DEVICE);
 808	}
 809
 810	if (bitshift) {
 811		/* Walk through the data and the crc and do
 812		 * all the magic to get byte-aligned data.
 813		 */
 814		u8 *cp = t->rx_buf;
 815		unsigned int len;
 816		unsigned int bitright = 8 - bitshift;
 817		u8 temp;
 818		for (len = t->len; len; len--) {
 819			temp = *cp;
 820			*cp++ = leftover | (temp >> bitshift);
 821			leftover = temp << bitright;
 822		}
 823		cp = (u8 *) &scratch->crc_val;
 824		temp = *cp;
 825		*cp++ = leftover | (temp >> bitshift);
 826		leftover = temp << bitright;
 827		temp = *cp;
 828		*cp = leftover | (temp >> bitshift);
 829	}
 830
 831	if (host->mmc->use_spi_crc) {
 832		u16 crc = crc_itu_t(0, t->rx_buf, t->len);
 833
 834		be16_to_cpus(&scratch->crc_val);
 835		if (scratch->crc_val != crc) {
 836			dev_dbg(&spi->dev,
 837				"read - crc error: crc_val=0x%04x, computed=0x%04x len=%d\n",
 838				scratch->crc_val, crc, t->len);
 839			return -EILSEQ;
 840		}
 841	}
 842
 843	t->rx_buf += t->len;
 844	if (host->dma_dev)
 845		t->rx_dma += t->len;
 846
 847	return 0;
 848}
 849
 850/*
 851 * An MMC/SD data stage includes one or more blocks, optional CRCs,
 852 * and inline handshaking.  That handhaking makes it unlike most
 853 * other SPI protocol stacks.
 854 */
 855static void
 856mmc_spi_data_do(struct mmc_spi_host *host, struct mmc_command *cmd,
 857		struct mmc_data *data, u32 blk_size)
 858{
 859	struct spi_device	*spi = host->spi;
 860	struct device		*dma_dev = host->dma_dev;
 861	struct spi_transfer	*t;
 862	enum dma_data_direction	direction = mmc_get_dma_dir(data);
 863	struct scatterlist	*sg;
 864	unsigned		n_sg;
 865	bool			multiple = (data->blocks > 1);
 866	const char		*write_or_read = (direction == DMA_TO_DEVICE) ? "write" : "read";
 867	u32			clock_rate;
 868	unsigned long		timeout;
 869
 870	mmc_spi_setup_data_message(host, multiple, direction);
 871	t = &host->t;
 872
 873	if (t->speed_hz)
 874		clock_rate = t->speed_hz;
 875	else
 876		clock_rate = spi->max_speed_hz;
 877
 878	timeout = data->timeout_ns / 1000 +
 879		  data->timeout_clks * 1000000 / clock_rate;
 880	timeout = usecs_to_jiffies((unsigned int)timeout) + 1;
 881
 882	/* Handle scatterlist segments one at a time, with synch for
 883	 * each 512-byte block
 884	 */
 885	for_each_sg(data->sg, sg, data->sg_len, n_sg) {
 886		int			status = 0;
 887		dma_addr_t		dma_addr = 0;
 888		void			*kmap_addr;
 889		unsigned		length = sg->length;
 890		enum dma_data_direction	dir = direction;
 891
 892		/* set up dma mapping for controller drivers that might
 893		 * use DMA ... though they may fall back to PIO
 894		 */
 895		if (dma_dev) {
 896			/* never invalidate whole *shared* pages ... */
 897			if ((sg->offset != 0 || length != PAGE_SIZE)
 898					&& dir == DMA_FROM_DEVICE)
 899				dir = DMA_BIDIRECTIONAL;
 900
 901			dma_addr = dma_map_page(dma_dev, sg_page(sg), 0,
 902						PAGE_SIZE, dir);
 903			if (dma_mapping_error(dma_dev, dma_addr)) {
 904				data->error = -EFAULT;
 905				break;
 906			}
 907			if (direction == DMA_TO_DEVICE)
 908				t->tx_dma = dma_addr + sg->offset;
 909			else
 910				t->rx_dma = dma_addr + sg->offset;
 911		}
 912
 913		/* allow pio too; we don't allow highmem */
 914		kmap_addr = kmap(sg_page(sg));
 915		if (direction == DMA_TO_DEVICE)
 916			t->tx_buf = kmap_addr + sg->offset;
 917		else
 918			t->rx_buf = kmap_addr + sg->offset;
 919
 920		/* transfer each block, and update request status */
 921		while (length) {
 922			t->len = min(length, blk_size);
 923
 924			dev_dbg(&spi->dev, "    %s block, %d bytes\n", write_or_read, t->len);
 925
 926			if (direction == DMA_TO_DEVICE)
 927				status = mmc_spi_writeblock(host, t, timeout);
 928			else
 929				status = mmc_spi_readblock(host, t, timeout);
 930			if (status < 0)
 931				break;
 932
 933			data->bytes_xfered += t->len;
 934			length -= t->len;
 935
 936			if (!multiple)
 937				break;
 938		}
 939
 940		/* discard mappings */
 941		if (direction == DMA_FROM_DEVICE)
 942			flush_dcache_page(sg_page(sg));
 943		kunmap(sg_page(sg));
 944		if (dma_dev)
 945			dma_unmap_page(dma_dev, dma_addr, PAGE_SIZE, dir);
 946
 947		if (status < 0) {
 948			data->error = status;
 949			dev_dbg(&spi->dev, "%s status %d\n", write_or_read, status);
 950			break;
 951		}
 952	}
 953
 954	/* NOTE some docs describe an MMC-only SET_BLOCK_COUNT (CMD23) that
 955	 * can be issued before multiblock writes.  Unlike its more widely
 956	 * documented analogue for SD cards (SET_WR_BLK_ERASE_COUNT, ACMD23),
 957	 * that can affect the STOP_TRAN logic.   Complete (and current)
 958	 * MMC specs should sort that out before Linux starts using CMD23.
 959	 */
 960	if (direction == DMA_TO_DEVICE && multiple) {
 961		struct scratch	*scratch = host->data;
 962		int		tmp;
 963		const unsigned	statlen = sizeof(scratch->status);
 964
 965		dev_dbg(&spi->dev, "    STOP_TRAN\n");
 966
 967		/* Tweak the per-block message we set up earlier by morphing
 968		 * it to hold single buffer with the token followed by some
 969		 * all-ones bytes ... skip N(BR) (0..1), scan the rest for
 970		 * "not busy any longer" status, and leave chip selected.
 971		 */
 972		INIT_LIST_HEAD(&host->m.transfers);
 973		list_add(&host->early_status.transfer_list,
 974				&host->m.transfers);
 975
 976		memset(scratch->status, 0xff, statlen);
 977		scratch->status[0] = SPI_TOKEN_STOP_TRAN;
 978
 979		host->early_status.tx_buf = host->early_status.rx_buf;
 980		host->early_status.tx_dma = host->early_status.rx_dma;
 981		host->early_status.len = statlen;
 982
 983		if (host->dma_dev)
 984			dma_sync_single_for_device(host->dma_dev,
 985					host->data_dma, sizeof(*scratch),
 986					DMA_BIDIRECTIONAL);
 987
 988		tmp = spi_sync_locked(spi, &host->m);
 989
 990		if (host->dma_dev)
 991			dma_sync_single_for_cpu(host->dma_dev,
 992					host->data_dma, sizeof(*scratch),
 993					DMA_BIDIRECTIONAL);
 994
 995		if (tmp < 0) {
 996			if (!data->error)
 997				data->error = tmp;
 998			return;
 999		}
1000
1001		/* Ideally we collected "not busy" status with one I/O,
1002		 * avoiding wasteful byte-at-a-time scanning... but more
1003		 * I/O is often needed.
1004		 */
1005		for (tmp = 2; tmp < statlen; tmp++) {
1006			if (scratch->status[tmp] != 0)
1007				return;
1008		}
1009		tmp = mmc_spi_wait_unbusy(host, timeout);
1010		if (tmp < 0 && !data->error)
1011			data->error = tmp;
1012	}
1013}
1014
1015/****************************************************************************/
1016
1017/*
1018 * MMC driver implementation -- the interface to the MMC stack
1019 */
1020
1021static void mmc_spi_request(struct mmc_host *mmc, struct mmc_request *mrq)
1022{
1023	struct mmc_spi_host	*host = mmc_priv(mmc);
1024	int			status = -EINVAL;
1025	int			crc_retry = 5;
1026	struct mmc_command	stop;
1027
1028#ifdef DEBUG
1029	/* MMC core and layered drivers *MUST* issue SPI-aware commands */
1030	{
1031		struct mmc_command	*cmd;
1032		int			invalid = 0;
1033
1034		cmd = mrq->cmd;
1035		if (!mmc_spi_resp_type(cmd)) {
1036			dev_dbg(&host->spi->dev, "bogus command\n");
1037			cmd->error = -EINVAL;
1038			invalid = 1;
1039		}
1040
1041		cmd = mrq->stop;
1042		if (cmd && !mmc_spi_resp_type(cmd)) {
1043			dev_dbg(&host->spi->dev, "bogus STOP command\n");
1044			cmd->error = -EINVAL;
1045			invalid = 1;
1046		}
1047
1048		if (invalid) {
1049			dump_stack();
1050			mmc_request_done(host->mmc, mrq);
1051			return;
1052		}
1053	}
1054#endif
1055
1056	/* request exclusive bus access */
1057	spi_bus_lock(host->spi->master);
1058
1059crc_recover:
1060	/* issue command; then optionally data and stop */
1061	status = mmc_spi_command_send(host, mrq, mrq->cmd, mrq->data != NULL);
1062	if (status == 0 && mrq->data) {
1063		mmc_spi_data_do(host, mrq->cmd, mrq->data, mrq->data->blksz);
1064
1065		/*
1066		 * The SPI bus is not always reliable for large data transfers.
1067		 * If an occasional crc error is reported by the SD device with
1068		 * data read/write over SPI, it may be recovered by repeating
1069		 * the last SD command again. The retry count is set to 5 to
1070		 * ensure the driver passes stress tests.
1071		 */
1072		if (mrq->data->error == -EILSEQ && crc_retry) {
1073			stop.opcode = MMC_STOP_TRANSMISSION;
1074			stop.arg = 0;
1075			stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
1076			status = mmc_spi_command_send(host, mrq, &stop, 0);
1077			crc_retry--;
1078			mrq->data->error = 0;
1079			goto crc_recover;
1080		}
1081
1082		if (mrq->stop)
1083			status = mmc_spi_command_send(host, mrq, mrq->stop, 0);
1084		else
1085			mmc_cs_off(host);
1086	}
1087
1088	/* release the bus */
1089	spi_bus_unlock(host->spi->master);
1090
1091	mmc_request_done(host->mmc, mrq);
1092}
1093
1094/* See Section 6.4.1, in SD "Simplified Physical Layer Specification 2.0"
1095 *
1096 * NOTE that here we can't know that the card has just been powered up;
1097 * not all MMC/SD sockets support power switching.
1098 *
1099 * FIXME when the card is still in SPI mode, e.g. from a previous kernel,
1100 * this doesn't seem to do the right thing at all...
1101 */
1102static void mmc_spi_initsequence(struct mmc_spi_host *host)
1103{
1104	/* Try to be very sure any previous command has completed;
1105	 * wait till not-busy, skip debris from any old commands.
1106	 */
1107	mmc_spi_wait_unbusy(host, msecs_to_jiffies(MMC_SPI_INIT_TIMEOUT_MS));
1108	mmc_spi_readbytes(host, 10);
1109
1110	/*
1111	 * Do a burst with chipselect active-high.  We need to do this to
1112	 * meet the requirement of 74 clock cycles with both chipselect
1113	 * and CMD (MOSI) high before CMD0 ... after the card has been
1114	 * powered up to Vdd(min), and so is ready to take commands.
1115	 *
1116	 * Some cards are particularly needy of this (e.g. Viking "SD256")
1117	 * while most others don't seem to care.
1118	 *
1119	 * Note that this is one of the places MMC/SD plays games with the
1120	 * SPI protocol.  Another is that when chipselect is released while
1121	 * the card returns BUSY status, the clock must issue several cycles
1122	 * with chipselect high before the card will stop driving its output.
1123	 *
1124	 * SPI_CS_HIGH means "asserted" here. In some cases like when using
1125	 * GPIOs for chip select, SPI_CS_HIGH is set but this will be logically
1126	 * inverted by gpiolib, so if we want to ascertain to drive it high
1127	 * we should toggle the default with an XOR as we do here.
1128	 */
1129	host->spi->mode ^= SPI_CS_HIGH;
1130	if (spi_setup(host->spi) != 0) {
1131		/* Just warn; most cards work without it. */
1132		dev_warn(&host->spi->dev,
1133				"can't change chip-select polarity\n");
1134		host->spi->mode ^= SPI_CS_HIGH;
1135	} else {
1136		mmc_spi_readbytes(host, 18);
1137
1138		host->spi->mode ^= SPI_CS_HIGH;
1139		if (spi_setup(host->spi) != 0) {
1140			/* Wot, we can't get the same setup we had before? */
1141			dev_err(&host->spi->dev,
1142					"can't restore chip-select polarity\n");
1143		}
1144	}
1145}
1146
1147static char *mmc_powerstring(u8 power_mode)
1148{
1149	switch (power_mode) {
1150	case MMC_POWER_OFF: return "off";
1151	case MMC_POWER_UP:  return "up";
1152	case MMC_POWER_ON:  return "on";
1153	}
1154	return "?";
1155}
1156
1157static void mmc_spi_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
1158{
1159	struct mmc_spi_host *host = mmc_priv(mmc);
1160
1161	if (host->power_mode != ios->power_mode) {
1162		int		canpower;
1163
1164		canpower = host->pdata && host->pdata->setpower;
1165
1166		dev_dbg(&host->spi->dev, "power %s (%d)%s\n",
1167				mmc_powerstring(ios->power_mode),
1168				ios->vdd,
1169				canpower ? ", can switch" : "");
1170
1171		/* switch power on/off if possible, accounting for
1172		 * max 250msec powerup time if needed.
1173		 */
1174		if (canpower) {
1175			switch (ios->power_mode) {
1176			case MMC_POWER_OFF:
1177			case MMC_POWER_UP:
1178				host->pdata->setpower(&host->spi->dev,
1179						ios->vdd);
1180				if (ios->power_mode == MMC_POWER_UP)
1181					msleep(host->powerup_msecs);
1182			}
1183		}
1184
1185		/* See 6.4.1 in the simplified SD card physical spec 2.0 */
1186		if (ios->power_mode == MMC_POWER_ON)
1187			mmc_spi_initsequence(host);
1188
1189		/* If powering down, ground all card inputs to avoid power
1190		 * delivery from data lines!  On a shared SPI bus, this
1191		 * will probably be temporary; 6.4.2 of the simplified SD
1192		 * spec says this must last at least 1msec.
1193		 *
1194		 *   - Clock low means CPOL 0, e.g. mode 0
1195		 *   - MOSI low comes from writing zero
1196		 *   - Chipselect is usually active low...
1197		 */
1198		if (canpower && ios->power_mode == MMC_POWER_OFF) {
1199			int mres;
1200			u8 nullbyte = 0;
1201
1202			host->spi->mode &= ~(SPI_CPOL|SPI_CPHA);
1203			mres = spi_setup(host->spi);
1204			if (mres < 0)
1205				dev_dbg(&host->spi->dev,
1206					"switch to SPI mode 0 failed\n");
1207
1208			if (spi_write(host->spi, &nullbyte, 1) < 0)
1209				dev_dbg(&host->spi->dev,
1210					"put spi signals to low failed\n");
1211
1212			/*
1213			 * Now clock should be low due to spi mode 0;
1214			 * MOSI should be low because of written 0x00;
1215			 * chipselect should be low (it is active low)
1216			 * power supply is off, so now MMC is off too!
1217			 *
1218			 * FIXME no, chipselect can be high since the
1219			 * device is inactive and SPI_CS_HIGH is clear...
1220			 */
1221			msleep(10);
1222			if (mres == 0) {
1223				host->spi->mode |= (SPI_CPOL|SPI_CPHA);
1224				mres = spi_setup(host->spi);
1225				if (mres < 0)
1226					dev_dbg(&host->spi->dev,
1227						"switch back to SPI mode 3 failed\n");
1228			}
1229		}
1230
1231		host->power_mode = ios->power_mode;
1232	}
1233
1234	if (host->spi->max_speed_hz != ios->clock && ios->clock != 0) {
1235		int		status;
1236
1237		host->spi->max_speed_hz = ios->clock;
1238		status = spi_setup(host->spi);
1239		dev_dbg(&host->spi->dev, "  clock to %d Hz, %d\n",
1240			host->spi->max_speed_hz, status);
1241	}
1242}
1243
1244static const struct mmc_host_ops mmc_spi_ops = {
1245	.request	= mmc_spi_request,
1246	.set_ios	= mmc_spi_set_ios,
1247	.get_ro		= mmc_gpio_get_ro,
1248	.get_cd		= mmc_gpio_get_cd,
1249};
1250
1251
1252/****************************************************************************/
1253
1254/*
1255 * SPI driver implementation
1256 */
1257
1258static irqreturn_t
1259mmc_spi_detect_irq(int irq, void *mmc)
1260{
1261	struct mmc_spi_host *host = mmc_priv(mmc);
1262	u16 delay_msec = max(host->pdata->detect_delay, (u16)100);
1263
1264	mmc_detect_change(mmc, msecs_to_jiffies(delay_msec));
1265	return IRQ_HANDLED;
1266}
1267
1268#ifdef CONFIG_HAS_DMA
1269static int mmc_spi_dma_alloc(struct mmc_spi_host *host)
1270{
1271	struct spi_device *spi = host->spi;
1272	struct device *dev;
1273
1274	if (!spi->master->dev.parent->dma_mask)
1275		return 0;
1276
1277	dev = spi->master->dev.parent;
1278
1279	host->ones_dma = dma_map_single(dev, host->ones, MMC_SPI_BLOCKSIZE,
1280					DMA_TO_DEVICE);
1281	if (dma_mapping_error(dev, host->ones_dma))
1282		return -ENOMEM;
1283
1284	host->data_dma = dma_map_single(dev, host->data, sizeof(*host->data),
1285					DMA_BIDIRECTIONAL);
1286	if (dma_mapping_error(dev, host->data_dma)) {
1287		dma_unmap_single(dev, host->ones_dma, MMC_SPI_BLOCKSIZE,
1288				 DMA_TO_DEVICE);
1289		return -ENOMEM;
1290	}
1291
1292	dma_sync_single_for_cpu(dev, host->data_dma, sizeof(*host->data),
1293				DMA_BIDIRECTIONAL);
1294
1295	host->dma_dev = dev;
1296	return 0;
1297}
1298
1299static void mmc_spi_dma_free(struct mmc_spi_host *host)
1300{
1301	if (!host->dma_dev)
1302		return;
1303
1304	dma_unmap_single(host->dma_dev, host->ones_dma, MMC_SPI_BLOCKSIZE,
1305			 DMA_TO_DEVICE);
1306	dma_unmap_single(host->dma_dev, host->data_dma,	sizeof(*host->data),
1307			 DMA_BIDIRECTIONAL);
1308}
1309#else
1310static inline int mmc_spi_dma_alloc(struct mmc_spi_host *host) { return 0; }
1311static inline void mmc_spi_dma_free(struct mmc_spi_host *host) {}
1312#endif
1313
1314static int mmc_spi_probe(struct spi_device *spi)
1315{
1316	void			*ones;
1317	struct mmc_host		*mmc;
1318	struct mmc_spi_host	*host;
1319	int			status;
1320	bool			has_ro = false;
1321
1322	/* We rely on full duplex transfers, mostly to reduce
1323	 * per-transfer overheads (by making fewer transfers).
1324	 */
1325	if (spi->master->flags & SPI_MASTER_HALF_DUPLEX)
1326		return -EINVAL;
1327
1328	/* MMC and SD specs only seem to care that sampling is on the
1329	 * rising edge ... meaning SPI modes 0 or 3.  So either SPI mode
1330	 * should be legit.  We'll use mode 0 since the steady state is 0,
1331	 * which is appropriate for hotplugging, unless the platform data
1332	 * specify mode 3 (if hardware is not compatible to mode 0).
1333	 */
1334	if (spi->mode != SPI_MODE_3)
1335		spi->mode = SPI_MODE_0;
1336	spi->bits_per_word = 8;
1337
1338	status = spi_setup(spi);
1339	if (status < 0) {
1340		dev_dbg(&spi->dev, "needs SPI mode %02x, %d KHz; %d\n",
1341				spi->mode, spi->max_speed_hz / 1000,
1342				status);
1343		return status;
1344	}
1345
1346	/* We need a supply of ones to transmit.  This is the only time
1347	 * the CPU touches these, so cache coherency isn't a concern.
1348	 *
1349	 * NOTE if many systems use more than one MMC-over-SPI connector
1350	 * it'd save some memory to share this.  That's evidently rare.
1351	 */
1352	status = -ENOMEM;
1353	ones = kmalloc(MMC_SPI_BLOCKSIZE, GFP_KERNEL);
1354	if (!ones)
1355		goto nomem;
1356	memset(ones, 0xff, MMC_SPI_BLOCKSIZE);
1357
1358	mmc = mmc_alloc_host(sizeof(*host), &spi->dev);
1359	if (!mmc)
1360		goto nomem;
1361
1362	mmc->ops = &mmc_spi_ops;
1363	mmc->max_blk_size = MMC_SPI_BLOCKSIZE;
1364	mmc->max_segs = MMC_SPI_BLOCKSATONCE;
1365	mmc->max_req_size = MMC_SPI_BLOCKSATONCE * MMC_SPI_BLOCKSIZE;
1366	mmc->max_blk_count = MMC_SPI_BLOCKSATONCE;
1367
1368	mmc->caps = MMC_CAP_SPI;
1369
1370	/* SPI doesn't need the lowspeed device identification thing for
1371	 * MMC or SD cards, since it never comes up in open drain mode.
1372	 * That's good; some SPI masters can't handle very low speeds!
1373	 *
1374	 * However, low speed SDIO cards need not handle over 400 KHz;
1375	 * that's the only reason not to use a few MHz for f_min (until
1376	 * the upper layer reads the target frequency from the CSD).
1377	 */
1378	mmc->f_min = 400000;
1379	mmc->f_max = spi->max_speed_hz;
1380
1381	host = mmc_priv(mmc);
1382	host->mmc = mmc;
1383	host->spi = spi;
1384
1385	host->ones = ones;
1386
1387	dev_set_drvdata(&spi->dev, mmc);
1388
1389	/* Platform data is used to hook up things like card sensing
1390	 * and power switching gpios.
1391	 */
1392	host->pdata = mmc_spi_get_pdata(spi);
1393	if (host->pdata)
1394		mmc->ocr_avail = host->pdata->ocr_mask;
1395	if (!mmc->ocr_avail) {
1396		dev_warn(&spi->dev, "ASSUMING 3.2-3.4 V slot power\n");
1397		mmc->ocr_avail = MMC_VDD_32_33|MMC_VDD_33_34;
1398	}
1399	if (host->pdata && host->pdata->setpower) {
1400		host->powerup_msecs = host->pdata->powerup_msecs;
1401		if (!host->powerup_msecs || host->powerup_msecs > 250)
1402			host->powerup_msecs = 250;
1403	}
1404
1405	/* preallocate dma buffers */
1406	host->data = kmalloc(sizeof(*host->data), GFP_KERNEL);
1407	if (!host->data)
1408		goto fail_nobuf1;
1409
1410	status = mmc_spi_dma_alloc(host);
1411	if (status)
1412		goto fail_dma;
1413
1414	/* setup message for status/busy readback */
1415	spi_message_init(&host->readback);
1416	host->readback.is_dma_mapped = (host->dma_dev != NULL);
1417
1418	spi_message_add_tail(&host->status, &host->readback);
1419	host->status.tx_buf = host->ones;
1420	host->status.tx_dma = host->ones_dma;
1421	host->status.rx_buf = &host->data->status;
1422	host->status.rx_dma = host->data_dma + offsetof(struct scratch, status);
1423	host->status.cs_change = 1;
1424
1425	/* register card detect irq */
1426	if (host->pdata && host->pdata->init) {
1427		status = host->pdata->init(&spi->dev, mmc_spi_detect_irq, mmc);
1428		if (status != 0)
1429			goto fail_glue_init;
1430	}
1431
1432	/* pass platform capabilities, if any */
1433	if (host->pdata) {
1434		mmc->caps |= host->pdata->caps;
1435		mmc->caps2 |= host->pdata->caps2;
1436	}
1437
1438	status = mmc_add_host(mmc);
1439	if (status != 0)
1440		goto fail_glue_init;
1441
1442	/*
1443	 * Index 0 is card detect
1444	 * Old boardfiles were specifying 1 ms as debounce
1445	 */
1446	status = mmc_gpiod_request_cd(mmc, NULL, 0, false, 1000);
1447	if (status == -EPROBE_DEFER)
1448		goto fail_gpiod_request;
1449	if (!status) {
1450		/*
1451		 * The platform has a CD GPIO signal that may support
1452		 * interrupts, so let mmc_gpiod_request_cd_irq() decide
1453		 * if polling is needed or not.
1454		 */
1455		mmc->caps &= ~MMC_CAP_NEEDS_POLL;
1456		mmc_gpiod_request_cd_irq(mmc);
1457	}
1458	mmc_detect_change(mmc, 0);
1459
1460	/* Index 1 is write protect/read only */
1461	status = mmc_gpiod_request_ro(mmc, NULL, 1, 0);
1462	if (status == -EPROBE_DEFER)
1463		goto fail_gpiod_request;
1464	if (!status)
1465		has_ro = true;
1466
1467	dev_info(&spi->dev, "SD/MMC host %s%s%s%s%s\n",
1468			dev_name(&mmc->class_dev),
1469			host->dma_dev ? "" : ", no DMA",
1470			has_ro ? "" : ", no WP",
1471			(host->pdata && host->pdata->setpower)
1472				? "" : ", no poweroff",
1473			(mmc->caps & MMC_CAP_NEEDS_POLL)
1474				? ", cd polling" : "");
1475	return 0;
1476
1477fail_gpiod_request:
1478	mmc_remove_host(mmc);
1479fail_glue_init:
1480	mmc_spi_dma_free(host);
1481fail_dma:
1482	kfree(host->data);
1483fail_nobuf1:
1484	mmc_spi_put_pdata(spi);
1485	mmc_free_host(mmc);
1486nomem:
1487	kfree(ones);
1488	return status;
1489}
1490
1491
1492static void mmc_spi_remove(struct spi_device *spi)
1493{
1494	struct mmc_host		*mmc = dev_get_drvdata(&spi->dev);
1495	struct mmc_spi_host	*host = mmc_priv(mmc);
1496
1497	/* prevent new mmc_detect_change() calls */
1498	if (host->pdata && host->pdata->exit)
1499		host->pdata->exit(&spi->dev, mmc);
1500
1501	mmc_remove_host(mmc);
1502
1503	mmc_spi_dma_free(host);
1504	kfree(host->data);
1505	kfree(host->ones);
1506
1507	spi->max_speed_hz = mmc->f_max;
1508	mmc_spi_put_pdata(spi);
1509	mmc_free_host(mmc);
1510}
1511
1512static const struct spi_device_id mmc_spi_dev_ids[] = {
1513	{ "mmc-spi-slot"},
1514	{ },
1515};
1516MODULE_DEVICE_TABLE(spi, mmc_spi_dev_ids);
1517
1518static const struct of_device_id mmc_spi_of_match_table[] = {
1519	{ .compatible = "mmc-spi-slot", },
1520	{},
1521};
1522MODULE_DEVICE_TABLE(of, mmc_spi_of_match_table);
1523
1524static struct spi_driver mmc_spi_driver = {
1525	.driver = {
1526		.name =		"mmc_spi",
1527		.of_match_table = mmc_spi_of_match_table,
1528	},
1529	.id_table =	mmc_spi_dev_ids,
1530	.probe =	mmc_spi_probe,
1531	.remove =	mmc_spi_remove,
1532};
1533
1534module_spi_driver(mmc_spi_driver);
1535
1536MODULE_AUTHOR("Mike Lavender, David Brownell, Hans-Peter Nilsson, Jan Nikitenko");
1537MODULE_DESCRIPTION("SPI SD/MMC host driver");
1538MODULE_LICENSE("GPL");
1539MODULE_ALIAS("spi:mmc_spi");