1 /*
2 * SSI to SD card adapter.
3 *
4 * Copyright (c) 2007-2009 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * Copyright (c) 2021 Wind River Systems, Inc.
8 * Improved by Bin Meng <bin.meng@windriver.com>
9 *
10 * Validated with U-Boot v2021.01 and Linux v5.10 mmc_spi driver
11 *
12 * This code is licensed under the GNU GPL v2.
13 *
14 * Contributions after 2012-01-13 are licensed under the terms of the
15 * GNU GPL, version 2 or (at your option) any later version.
16 */
17
18 #include "qemu/osdep.h"
19 #include "sysemu/blockdev.h"
20 #include "hw/ssi/ssi.h"
21 #include "migration/vmstate.h"
22 #include "hw/qdev-properties.h"
23 #include "hw/sd/sd.h"
24 #include "qapi/error.h"
25 #include "qemu/crc-ccitt.h"
26 #include "qemu/module.h"
27 #include "qom/object.h"
28
29 //#define DEBUG_SSI_SD 1
30
31 #ifdef DEBUG_SSI_SD
32 #define DPRINTF(fmt, ...) \
33 do { printf("ssi_sd: " fmt , ## __VA_ARGS__); } while (0)
34 #define BADF(fmt, ...) \
35 do { fprintf(stderr, "ssi_sd: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
36 #else
37 #define DPRINTF(fmt, ...) do {} while(0)
38 #define BADF(fmt, ...) \
39 do { fprintf(stderr, "ssi_sd: error: " fmt , ## __VA_ARGS__);} while (0)
40 #endif
41
42 typedef enum {
43 SSI_SD_CMD = 0,
44 SSI_SD_CMDARG,
45 SSI_SD_PREP_RESP,
46 SSI_SD_RESPONSE,
47 SSI_SD_PREP_DATA,
48 SSI_SD_DATA_START,
49 SSI_SD_DATA_READ,
50 SSI_SD_DATA_CRC16,
51 SSI_SD_DATA_WRITE,
52 SSI_SD_SKIP_CRC16,
53 } ssi_sd_mode;
54
55 struct ssi_sd_state {
56 SSIPeripheral ssidev;
57 uint32_t mode;
58 int cmd;
59 uint8_t cmdarg[4];
60 uint8_t response[5];
61 uint16_t crc16;
62 int32_t read_bytes;
63 int32_t write_bytes;
64 int32_t arglen;
65 int32_t response_pos;
66 int32_t stopping;
67 SDBus sdbus;
68 };
69
70 #define TYPE_SSI_SD "ssi-sd"
OBJECT_DECLARE_SIMPLE_TYPE(ssi_sd_state,SSI_SD)71 OBJECT_DECLARE_SIMPLE_TYPE(ssi_sd_state, SSI_SD)
72
73 /* State word bits. */
74 #define SSI_SDR_LOCKED 0x0001
75 #define SSI_SDR_WP_ERASE 0x0002
76 #define SSI_SDR_ERROR 0x0004
77 #define SSI_SDR_CC_ERROR 0x0008
78 #define SSI_SDR_ECC_FAILED 0x0010
79 #define SSI_SDR_WP_VIOLATION 0x0020
80 #define SSI_SDR_ERASE_PARAM 0x0040
81 #define SSI_SDR_OUT_OF_RANGE 0x0080
82 #define SSI_SDR_IDLE 0x0100
83 #define SSI_SDR_ERASE_RESET 0x0200
84 #define SSI_SDR_ILLEGAL_COMMAND 0x0400
85 #define SSI_SDR_COM_CRC_ERROR 0x0800
86 #define SSI_SDR_ERASE_SEQ_ERROR 0x1000
87 #define SSI_SDR_ADDRESS_ERROR 0x2000
88 #define SSI_SDR_PARAMETER_ERROR 0x4000
89
90 /* multiple block write */
91 #define SSI_TOKEN_MULTI_WRITE 0xfc
92 /* terminate multiple block write */
93 #define SSI_TOKEN_STOP_TRAN 0xfd
94 /* single block read/write, multiple block read */
95 #define SSI_TOKEN_SINGLE 0xfe
96
97 /* dummy value - don't care */
98 #define SSI_DUMMY 0xff
99
100 /* data accepted */
101 #define DATA_RESPONSE_ACCEPTED 0x05
102
103 static uint32_t ssi_sd_transfer(SSIPeripheral *dev, uint32_t val)
104 {
105 ssi_sd_state *s = SSI_SD(dev);
106 SDRequest request;
107 uint8_t longresp[16];
108
109 /*
110 * Special case: allow CMD12 (STOP TRANSMISSION) while reading data.
111 *
112 * See "Physical Layer Specification Version 8.00" chapter 7.5.2.2,
113 * to avoid conflict between CMD12 response and next data block,
114 * timing of CMD12 should be controlled as follows:
115 *
116 * - CMD12 issued at the timing that end bit of CMD12 and end bit of
117 * data block is overlapped
118 * - CMD12 issued after one clock cycle after host receives a token
119 * (either Start Block token or Data Error token)
120 *
121 * We need to catch CMD12 in all of the data read states.
122 */
123 if (s->mode >= SSI_SD_PREP_DATA && s->mode <= SSI_SD_DATA_CRC16) {
124 if (val == 0x4c) {
125 s->mode = SSI_SD_CMD;
126 /* There must be at least one byte delay before the card responds */
127 s->stopping = 1;
128 }
129 }
130
131 switch (s->mode) {
132 case SSI_SD_CMD:
133 switch (val) {
134 case SSI_DUMMY:
135 DPRINTF("NULL command\n");
136 return SSI_DUMMY;
137 break;
138 case SSI_TOKEN_SINGLE:
139 case SSI_TOKEN_MULTI_WRITE:
140 DPRINTF("Start write block\n");
141 s->mode = SSI_SD_DATA_WRITE;
142 return SSI_DUMMY;
143 case SSI_TOKEN_STOP_TRAN:
144 DPRINTF("Stop multiple write\n");
145
146 /* manually issue cmd12 to stop the transfer */
147 request.cmd = 12;
148 request.arg = 0;
149 s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
150 if (s->arglen <= 0) {
151 s->arglen = 1;
152 /* a zero value indicates the card is busy */
153 s->response[0] = 0;
154 DPRINTF("SD card busy\n");
155 } else {
156 s->arglen = 1;
157 /* a non-zero value indicates the card is ready */
158 s->response[0] = SSI_DUMMY;
159 }
160
161 return SSI_DUMMY;
162 }
163
164 s->cmd = val & 0x3f;
165 s->mode = SSI_SD_CMDARG;
166 s->arglen = 0;
167 return SSI_DUMMY;
168 case SSI_SD_CMDARG:
169 if (s->arglen == 4) {
170 /* FIXME: Check CRC. */
171 request.cmd = s->cmd;
172 request.arg = ldl_be_p(s->cmdarg);
173 DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
174 s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
175 if (s->arglen <= 0) {
176 s->arglen = 1;
177 s->response[0] = 4;
178 DPRINTF("SD command failed\n");
179 } else if (s->cmd == 8 || s->cmd == 58) {
180 /* CMD8/CMD58 returns R3/R7 response */
181 DPRINTF("Returned R3/R7\n");
182 s->arglen = 5;
183 s->response[0] = 1;
184 memcpy(&s->response[1], longresp, 4);
185 } else if (s->arglen != 4) {
186 BADF("Unexpected response to cmd %d\n", s->cmd);
187 /* Illegal command is about as near as we can get. */
188 s->arglen = 1;
189 s->response[0] = 4;
190 } else {
191 /* All other commands return status. */
192 uint32_t cardstatus;
193 uint16_t status;
194 /* CMD13 returns a 2-byte statuse work. Other commands
195 only return the first byte. */
196 s->arglen = (s->cmd == 13) ? 2 : 1;
197
198 /* handle R1b */
199 if (s->cmd == 28 || s->cmd == 29 || s->cmd == 38) {
200 s->stopping = 1;
201 }
202
203 cardstatus = ldl_be_p(longresp);
204 status = 0;
205 if (((cardstatus >> 9) & 0xf) < 4)
206 status |= SSI_SDR_IDLE;
207 if (cardstatus & ERASE_RESET)
208 status |= SSI_SDR_ERASE_RESET;
209 if (cardstatus & ILLEGAL_COMMAND)
210 status |= SSI_SDR_ILLEGAL_COMMAND;
211 if (cardstatus & COM_CRC_ERROR)
212 status |= SSI_SDR_COM_CRC_ERROR;
213 if (cardstatus & ERASE_SEQ_ERROR)
214 status |= SSI_SDR_ERASE_SEQ_ERROR;
215 if (cardstatus & ADDRESS_ERROR)
216 status |= SSI_SDR_ADDRESS_ERROR;
217 if (cardstatus & CARD_IS_LOCKED)
218 status |= SSI_SDR_LOCKED;
219 if (cardstatus & (LOCK_UNLOCK_FAILED | WP_ERASE_SKIP))
220 status |= SSI_SDR_WP_ERASE;
221 if (cardstatus & SD_ERROR)
222 status |= SSI_SDR_ERROR;
223 if (cardstatus & CC_ERROR)
224 status |= SSI_SDR_CC_ERROR;
225 if (cardstatus & CARD_ECC_FAILED)
226 status |= SSI_SDR_ECC_FAILED;
227 if (cardstatus & WP_VIOLATION)
228 status |= SSI_SDR_WP_VIOLATION;
229 if (cardstatus & ERASE_PARAM)
230 status |= SSI_SDR_ERASE_PARAM;
231 if (cardstatus & (OUT_OF_RANGE | CID_CSD_OVERWRITE))
232 status |= SSI_SDR_OUT_OF_RANGE;
233 /* ??? Don't know what Parameter Error really means, so
234 assume it's set if the second byte is nonzero. */
235 if (status & 0xff)
236 status |= SSI_SDR_PARAMETER_ERROR;
237 s->response[0] = status >> 8;
238 s->response[1] = status;
239 DPRINTF("Card status 0x%02x\n", status);
240 }
241 s->mode = SSI_SD_PREP_RESP;
242 s->response_pos = 0;
243 } else {
244 s->cmdarg[s->arglen++] = val;
245 }
246 return SSI_DUMMY;
247 case SSI_SD_PREP_RESP:
248 DPRINTF("Prepare card response (Ncr)\n");
249 s->mode = SSI_SD_RESPONSE;
250 return SSI_DUMMY;
251 case SSI_SD_RESPONSE:
252 if (s->response_pos < s->arglen) {
253 DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
254 return s->response[s->response_pos++];
255 }
256 if (s->stopping) {
257 s->stopping = 0;
258 s->mode = SSI_SD_CMD;
259 return SSI_DUMMY;
260 }
261 if (sdbus_data_ready(&s->sdbus)) {
262 DPRINTF("Data read\n");
263 s->mode = SSI_SD_DATA_START;
264 } else {
265 DPRINTF("End of command\n");
266 s->mode = SSI_SD_CMD;
267 }
268 return SSI_DUMMY;
269 case SSI_SD_PREP_DATA:
270 DPRINTF("Prepare data block (Nac)\n");
271 s->mode = SSI_SD_DATA_START;
272 return SSI_DUMMY;
273 case SSI_SD_DATA_START:
274 DPRINTF("Start read block\n");
275 s->mode = SSI_SD_DATA_READ;
276 s->response_pos = 0;
277 return SSI_TOKEN_SINGLE;
278 case SSI_SD_DATA_READ:
279 val = sdbus_read_byte(&s->sdbus);
280 s->read_bytes++;
281 s->crc16 = crc_ccitt_false(s->crc16, (uint8_t *)&val, 1);
282 if (!sdbus_data_ready(&s->sdbus) || s->read_bytes == 512) {
283 DPRINTF("Data read end\n");
284 s->mode = SSI_SD_DATA_CRC16;
285 }
286 return val;
287 case SSI_SD_DATA_CRC16:
288 val = (s->crc16 & 0xff00) >> 8;
289 s->crc16 <<= 8;
290 s->response_pos++;
291 if (s->response_pos == 2) {
292 DPRINTF("CRC16 read end\n");
293 if (s->read_bytes == 512 && s->cmd != 17) {
294 s->mode = SSI_SD_PREP_DATA;
295 } else {
296 s->mode = SSI_SD_CMD;
297 }
298 s->read_bytes = 0;
299 s->response_pos = 0;
300 }
301 return val;
302 case SSI_SD_DATA_WRITE:
303 sdbus_write_byte(&s->sdbus, val);
304 s->write_bytes++;
305 if (!sdbus_receive_ready(&s->sdbus) || s->write_bytes == 512) {
306 DPRINTF("Data write end\n");
307 s->mode = SSI_SD_SKIP_CRC16;
308 s->response_pos = 0;
309 }
310 return val;
311 case SSI_SD_SKIP_CRC16:
312 /* we don't verify the crc16 */
313 s->response_pos++;
314 if (s->response_pos == 2) {
315 DPRINTF("CRC16 receive end\n");
316 s->mode = SSI_SD_RESPONSE;
317 s->write_bytes = 0;
318 s->arglen = 1;
319 s->response[0] = DATA_RESPONSE_ACCEPTED;
320 s->response_pos = 0;
321 }
322 return SSI_DUMMY;
323 }
324 /* Should never happen. */
325 return SSI_DUMMY;
326 }
327
ssi_sd_post_load(void * opaque,int version_id)328 static int ssi_sd_post_load(void *opaque, int version_id)
329 {
330 ssi_sd_state *s = (ssi_sd_state *)opaque;
331
332 if (s->mode > SSI_SD_SKIP_CRC16) {
333 return -EINVAL;
334 }
335 if (s->mode == SSI_SD_CMDARG &&
336 (s->arglen < 0 || s->arglen >= ARRAY_SIZE(s->cmdarg))) {
337 return -EINVAL;
338 }
339 if (s->mode == SSI_SD_RESPONSE &&
340 (s->response_pos < 0 || s->response_pos >= ARRAY_SIZE(s->response) ||
341 (!s->stopping && s->arglen > ARRAY_SIZE(s->response)))) {
342 return -EINVAL;
343 }
344
345 return 0;
346 }
347
348 static const VMStateDescription vmstate_ssi_sd = {
349 .name = "ssi_sd",
350 .version_id = 7,
351 .minimum_version_id = 7,
352 .post_load = ssi_sd_post_load,
353 .fields = (const VMStateField []) {
354 VMSTATE_UINT32(mode, ssi_sd_state),
355 VMSTATE_INT32(cmd, ssi_sd_state),
356 VMSTATE_UINT8_ARRAY(cmdarg, ssi_sd_state, 4),
357 VMSTATE_UINT8_ARRAY(response, ssi_sd_state, 5),
358 VMSTATE_UINT16(crc16, ssi_sd_state),
359 VMSTATE_INT32(read_bytes, ssi_sd_state),
360 VMSTATE_INT32(write_bytes, ssi_sd_state),
361 VMSTATE_INT32(arglen, ssi_sd_state),
362 VMSTATE_INT32(response_pos, ssi_sd_state),
363 VMSTATE_INT32(stopping, ssi_sd_state),
364 VMSTATE_SSI_PERIPHERAL(ssidev, ssi_sd_state),
365 VMSTATE_END_OF_LIST()
366 }
367 };
368
ssi_sd_realize(SSIPeripheral * d,Error ** errp)369 static void ssi_sd_realize(SSIPeripheral *d, Error **errp)
370 {
371 ssi_sd_state *s = SSI_SD(d);
372
373 qbus_init(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS, DEVICE(d), "sd-bus");
374 }
375
ssi_sd_reset(DeviceState * dev)376 static void ssi_sd_reset(DeviceState *dev)
377 {
378 ssi_sd_state *s = SSI_SD(dev);
379
380 s->mode = SSI_SD_CMD;
381 s->cmd = 0;
382 memset(s->cmdarg, 0, sizeof(s->cmdarg));
383 memset(s->response, 0, sizeof(s->response));
384 s->crc16 = 0;
385 s->read_bytes = 0;
386 s->write_bytes = 0;
387 s->arglen = 0;
388 s->response_pos = 0;
389 s->stopping = 0;
390 }
391
ssi_sd_class_init(ObjectClass * klass,void * data)392 static void ssi_sd_class_init(ObjectClass *klass, void *data)
393 {
394 DeviceClass *dc = DEVICE_CLASS(klass);
395 SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
396
397 k->realize = ssi_sd_realize;
398 k->transfer = ssi_sd_transfer;
399 k->cs_polarity = SSI_CS_LOW;
400 dc->vmsd = &vmstate_ssi_sd;
401 device_class_set_legacy_reset(dc, ssi_sd_reset);
402 /* Reason: GPIO chip-select line should be wired up */
403 dc->user_creatable = false;
404 }
405
406 static const TypeInfo ssi_sd_types[] = {
407 {
408 .name = TYPE_SSI_SD,
409 .parent = TYPE_SSI_PERIPHERAL,
410 .instance_size = sizeof(ssi_sd_state),
411 .class_init = ssi_sd_class_init,
412 },
413 };
414
415 DEFINE_TYPES(ssi_sd_types)
416