xref: /freebsd/sys/dev/mmc/mmcsd.c (revision 2f513db72b034fd5ef7f080b11be5c711c15186a)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2006 Bernd Walter.  All rights reserved.
5  * Copyright (c) 2006 M. Warner Losh <imp@FreeBSD.org>
6  * Copyright (c) 2017 Marius Strobl <marius@FreeBSD.org>
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  *
28  * Portions of this software may have been developed with reference to
29  * the SD Simplified Specification.  The following disclaimer may apply:
30  *
31  * The following conditions apply to the release of the simplified
32  * specification ("Simplified Specification") by the SD Card Association and
33  * the SD Group. The Simplified Specification is a subset of the complete SD
34  * Specification which is owned by the SD Card Association and the SD
35  * Group. This Simplified Specification is provided on a non-confidential
36  * basis subject to the disclaimers below. Any implementation of the
37  * Simplified Specification may require a license from the SD Card
38  * Association, SD Group, SD-3C LLC or other third parties.
39  *
40  * Disclaimers:
41  *
42  * The information contained in the Simplified Specification is presented only
43  * as a standard specification for SD Cards and SD Host/Ancillary products and
44  * is provided "AS-IS" without any representations or warranties of any
45  * kind. No responsibility is assumed by the SD Group, SD-3C LLC or the SD
46  * Card Association for any damages, any infringements of patents or other
47  * right of the SD Group, SD-3C LLC, the SD Card Association or any third
48  * parties, which may result from its use. No license is granted by
49  * implication, estoppel or otherwise under any patent or other rights of the
50  * SD Group, SD-3C LLC, the SD Card Association or any third party. Nothing
51  * herein shall be construed as an obligation by the SD Group, the SD-3C LLC
52  * or the SD Card Association to disclose or distribute any technical
53  * information, know-how or other confidential information to any third party.
54  */
55 
56 #include <sys/cdefs.h>
57 __FBSDID("$FreeBSD$");
58 
59 #include <sys/param.h>
60 #include <sys/systm.h>
61 #include <sys/bio.h>
62 #include <sys/bus.h>
63 #include <sys/conf.h>
64 #include <sys/endian.h>
65 #include <sys/fcntl.h>
66 #include <sys/ioccom.h>
67 #include <sys/kernel.h>
68 #include <sys/kthread.h>
69 #include <sys/lock.h>
70 #include <sys/malloc.h>
71 #include <sys/module.h>
72 #include <sys/mutex.h>
73 #include <sys/priv.h>
74 #include <sys/slicer.h>
75 #include <sys/sysctl.h>
76 #include <sys/time.h>
77 
78 #include <geom/geom.h>
79 #include <geom/geom_disk.h>
80 
81 #include <dev/mmc/bridge.h>
82 #include <dev/mmc/mmc_ioctl.h>
83 #include <dev/mmc/mmc_subr.h>
84 #include <dev/mmc/mmcbrvar.h>
85 #include <dev/mmc/mmcreg.h>
86 #include <dev/mmc/mmcvar.h>
87 
88 #include "mmcbus_if.h"
89 
90 #if __FreeBSD_version < 800002
91 #define	kproc_create	kthread_create
92 #define	kproc_exit	kthread_exit
93 #endif
94 
95 #define	MMCSD_CMD_RETRIES	5
96 
97 #define	MMCSD_FMT_BOOT		"mmcsd%dboot"
98 #define	MMCSD_FMT_GP		"mmcsd%dgp"
99 #define	MMCSD_FMT_RPMB		"mmcsd%drpmb"
100 #define	MMCSD_LABEL_ENH		"enh"
101 
102 #define	MMCSD_PART_NAMELEN	(16 + 1)
103 
104 struct mmcsd_softc;
105 
106 struct mmcsd_part {
107 	struct mtx disk_mtx;
108 	struct mtx ioctl_mtx;
109 	struct mmcsd_softc *sc;
110 	struct disk *disk;
111 	struct proc *p;
112 	struct bio_queue_head bio_queue;
113 	daddr_t eblock, eend;	/* Range remaining after the last erase. */
114 	u_int cnt;
115 	u_int type;
116 	int running;
117 	int suspend;
118 	int ioctl;
119 	bool ro;
120 	char name[MMCSD_PART_NAMELEN];
121 };
122 
123 struct mmcsd_softc {
124 	device_t dev;
125 	device_t mmcbus;
126 	struct mmcsd_part *part[MMC_PART_MAX];
127 	enum mmc_card_mode mode;
128 	u_int max_data;		/* Maximum data size [blocks] */
129 	u_int erase_sector;	/* Device native erase sector size [blocks] */
130 	uint8_t	high_cap;	/* High Capacity device (block addressed) */
131 	uint8_t part_curr;	/* Partition currently switched to */
132 	uint8_t ext_csd[MMC_EXTCSD_SIZE];
133 	uint16_t rca;
134 	uint32_t flags;
135 #define	MMCSD_INAND_CMD38	0x0001
136 #define	MMCSD_USE_TRIM		0x0002
137 #define	MMCSD_FLUSH_CACHE	0x0004
138 #define	MMCSD_DIRTY		0x0008
139 	uint32_t cmd6_time;	/* Generic switch timeout [us] */
140 	uint32_t part_time;	/* Partition switch timeout [us] */
141 	off_t enh_base;		/* Enhanced user data area slice base ... */
142 	off_t enh_size;		/* ... and size [bytes] */
143 	int log_count;
144 	struct timeval log_time;
145 	struct cdev *rpmb_dev;
146 };
147 
148 static const char *errmsg[] =
149 {
150 	"None",
151 	"Timeout",
152 	"Bad CRC",
153 	"Fifo",
154 	"Failed",
155 	"Invalid",
156 	"NO MEMORY"
157 };
158 
159 static SYSCTL_NODE(_hw, OID_AUTO, mmcsd, CTLFLAG_RD, NULL, "mmcsd driver");
160 
161 static int mmcsd_cache = 1;
162 SYSCTL_INT(_hw_mmcsd, OID_AUTO, cache, CTLFLAG_RDTUN, &mmcsd_cache, 0,
163     "Device R/W cache enabled if present");
164 
165 #define	LOG_PPS		5 /* Log no more than 5 errors per second. */
166 
167 /* bus entry points */
168 static int mmcsd_attach(device_t dev);
169 static int mmcsd_detach(device_t dev);
170 static int mmcsd_probe(device_t dev);
171 static int mmcsd_shutdown(device_t dev);
172 
173 /* disk routines */
174 static int mmcsd_close(struct disk *dp);
175 static int mmcsd_dump(void *arg, void *virtual, vm_offset_t physical,
176     off_t offset, size_t length);
177 static int mmcsd_getattr(struct bio *);
178 static int mmcsd_ioctl_disk(struct disk *disk, u_long cmd, void *data,
179     int fflag, struct thread *td);
180 static void mmcsd_strategy(struct bio *bp);
181 static void mmcsd_task(void *arg);
182 
183 /* RMPB cdev interface */
184 static int mmcsd_ioctl_rpmb(struct cdev *dev, u_long cmd, caddr_t data,
185     int fflag, struct thread *td);
186 
187 static void mmcsd_add_part(struct mmcsd_softc *sc, u_int type,
188     const char *name, u_int cnt, off_t media_size, bool ro);
189 static int mmcsd_bus_bit_width(device_t dev);
190 static daddr_t mmcsd_delete(struct mmcsd_part *part, struct bio *bp);
191 static const char *mmcsd_errmsg(int e);
192 static int mmcsd_flush_cache(struct mmcsd_softc *sc);
193 static int mmcsd_ioctl(struct mmcsd_part *part, u_long cmd, void *data,
194     int fflag, struct thread *td);
195 static int mmcsd_ioctl_cmd(struct mmcsd_part *part, struct mmc_ioc_cmd *mic,
196     int fflag);
197 static uintmax_t mmcsd_pretty_size(off_t size, char *unit);
198 static daddr_t mmcsd_rw(struct mmcsd_part *part, struct bio *bp);
199 static int mmcsd_set_blockcount(struct mmcsd_softc *sc, u_int count, bool rel);
200 static int mmcsd_slicer(device_t dev, const char *provider,
201     struct flash_slice *slices, int *nslices);
202 static int mmcsd_switch_part(device_t bus, device_t dev, uint16_t rca,
203     u_int part);
204 
205 #define	MMCSD_DISK_LOCK(_part)		mtx_lock(&(_part)->disk_mtx)
206 #define	MMCSD_DISK_UNLOCK(_part)	mtx_unlock(&(_part)->disk_mtx)
207 #define	MMCSD_DISK_LOCK_INIT(_part)					\
208 	mtx_init(&(_part)->disk_mtx, (_part)->name, "mmcsd disk", MTX_DEF)
209 #define	MMCSD_DISK_LOCK_DESTROY(_part)	mtx_destroy(&(_part)->disk_mtx);
210 #define	MMCSD_DISK_ASSERT_LOCKED(_part)					\
211 	mtx_assert(&(_part)->disk_mtx, MA_OWNED);
212 #define	MMCSD_DISK_ASSERT_UNLOCKED(_part)				\
213 	mtx_assert(&(_part)->disk_mtx, MA_NOTOWNED);
214 
215 #define	MMCSD_IOCTL_LOCK(_part)		mtx_lock(&(_part)->ioctl_mtx)
216 #define	MMCSD_IOCTL_UNLOCK(_part)	mtx_unlock(&(_part)->ioctl_mtx)
217 #define	MMCSD_IOCTL_LOCK_INIT(_part)					\
218 	mtx_init(&(_part)->ioctl_mtx, (_part)->name, "mmcsd IOCTL", MTX_DEF)
219 #define	MMCSD_IOCTL_LOCK_DESTROY(_part)	mtx_destroy(&(_part)->ioctl_mtx);
220 #define	MMCSD_IOCTL_ASSERT_LOCKED(_part)				\
221 	mtx_assert(&(_part)->ioctl_mtx, MA_OWNED);
222 #define	MMCSD_IOCLT_ASSERT_UNLOCKED(_part)				\
223 	mtx_assert(&(_part)->ioctl_mtx, MA_NOTOWNED);
224 
225 static int
226 mmcsd_probe(device_t dev)
227 {
228 
229 	device_quiet(dev);
230 	device_set_desc(dev, "MMC/SD Memory Card");
231 	return (0);
232 }
233 
234 static int
235 mmcsd_attach(device_t dev)
236 {
237 	device_t mmcbus;
238 	struct mmcsd_softc *sc;
239 	const uint8_t *ext_csd;
240 	off_t erase_size, sector_size, size, wp_size;
241 	uintmax_t bytes;
242 	int err, i;
243 	uint32_t quirks;
244 	uint8_t rev;
245 	bool comp, ro;
246 	char unit[2];
247 
248 	sc = device_get_softc(dev);
249 	sc->dev = dev;
250 	sc->mmcbus = mmcbus = device_get_parent(dev);
251 	sc->mode = mmc_get_card_type(dev);
252 	/*
253 	 * Note that in principle with an SDHCI-like re-tuning implementation,
254 	 * the maximum data size can change at runtime due to a device removal/
255 	 * insertion that results in switches to/from a transfer mode involving
256 	 * re-tuning, iff there are multiple devices on a given bus.  Until now
257 	 * mmc(4) lacks support for rescanning already attached buses, however,
258 	 * and sdhci(4) to date has no support for shared buses in the first
259 	 * place either.
260 	 */
261 	sc->max_data = mmc_get_max_data(dev);
262 	sc->high_cap = mmc_get_high_cap(dev);
263 	sc->rca = mmc_get_rca(dev);
264 	sc->cmd6_time = mmc_get_cmd6_timeout(dev);
265 	quirks = mmc_get_quirks(dev);
266 
267 	/* Only MMC >= 4.x devices support EXT_CSD. */
268 	if (mmc_get_spec_vers(dev) >= 4) {
269 		MMCBUS_ACQUIRE_BUS(mmcbus, dev);
270 		err = mmc_send_ext_csd(mmcbus, dev, sc->ext_csd);
271 		MMCBUS_RELEASE_BUS(mmcbus, dev);
272 		if (err != MMC_ERR_NONE) {
273 			device_printf(dev, "Error reading EXT_CSD %s\n",
274 			    mmcsd_errmsg(err));
275 			return (ENXIO);
276 		}
277 	}
278 	ext_csd = sc->ext_csd;
279 
280 	if ((quirks & MMC_QUIRK_INAND_CMD38) != 0) {
281 		if (mmc_get_spec_vers(dev) < 4) {
282 			device_printf(dev,
283 			    "MMC_QUIRK_INAND_CMD38 set but no EXT_CSD\n");
284 			return (EINVAL);
285 		}
286 		sc->flags |= MMCSD_INAND_CMD38;
287 	}
288 
289 	/*
290 	 * EXT_CSD_SEC_FEATURE_SUPPORT_GB_CL_EN denotes support for both
291 	 * insecure and secure TRIM.
292 	 */
293 	if ((ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT] &
294 	    EXT_CSD_SEC_FEATURE_SUPPORT_GB_CL_EN) != 0 &&
295 	    (quirks & MMC_QUIRK_BROKEN_TRIM) == 0) {
296 		if (bootverbose)
297 			device_printf(dev, "taking advantage of TRIM\n");
298 		sc->flags |= MMCSD_USE_TRIM;
299 		sc->erase_sector = 1;
300 	} else
301 		sc->erase_sector = mmc_get_erase_sector(dev);
302 
303 	/*
304 	 * Enhanced user data area and general purpose partitions are only
305 	 * supported in revision 1.4 (EXT_CSD_REV == 4) and later, the RPMB
306 	 * partition in revision 1.5 (MMC v4.41, EXT_CSD_REV == 5) and later.
307 	 */
308 	rev = ext_csd[EXT_CSD_REV];
309 
310 	/*
311 	 * With revision 1.5 (MMC v4.5, EXT_CSD_REV == 6) and later, take
312 	 * advantage of the device R/W cache if present and useage is not
313 	 * disabled.
314 	 */
315 	if (rev >= 6 && mmcsd_cache != 0) {
316 		size = le32dec(&ext_csd[EXT_CSD_CACHE_SIZE]);
317 		if (bootverbose)
318 			device_printf(dev, "cache size %juKB\n", size);
319 		if (size > 0) {
320 			MMCBUS_ACQUIRE_BUS(mmcbus, dev);
321 			err = mmc_switch(mmcbus, dev, sc->rca,
322 			    EXT_CSD_CMD_SET_NORMAL, EXT_CSD_CACHE_CTRL,
323 			    EXT_CSD_CACHE_CTRL_CACHE_EN, sc->cmd6_time, true);
324 			MMCBUS_RELEASE_BUS(mmcbus, dev);
325 			if (err != MMC_ERR_NONE)
326 				device_printf(dev, "failed to enable cache\n");
327 			else
328 				sc->flags |= MMCSD_FLUSH_CACHE;
329 		}
330 	}
331 
332 	/*
333 	 * Ignore user-creatable enhanced user data area and general purpose
334 	 * partitions partitions as long as partitioning hasn't been finished.
335 	 */
336 	comp = (ext_csd[EXT_CSD_PART_SET] & EXT_CSD_PART_SET_COMPLETED) != 0;
337 
338 	/*
339 	 * Add enhanced user data area slice, unless it spans the entirety of
340 	 * the user data area.  The enhanced area is of a multiple of high
341 	 * capacity write protect groups ((ERASE_GRP_SIZE + HC_WP_GRP_SIZE) *
342 	 * 512 KB) and its offset given in either sectors or bytes, depending
343 	 * on whether it's a high capacity device or not.
344 	 * NB: The slicer and its slices need to be registered before adding
345 	 *     the disk for the corresponding user data area as re-tasting is
346 	 *     racy.
347 	 */
348 	sector_size = mmc_get_sector_size(dev);
349 	size = ext_csd[EXT_CSD_ENH_SIZE_MULT] +
350 	    (ext_csd[EXT_CSD_ENH_SIZE_MULT + 1] << 8) +
351 	    (ext_csd[EXT_CSD_ENH_SIZE_MULT + 2] << 16);
352 	if (rev >= 4 && comp == TRUE && size > 0 &&
353 	    (ext_csd[EXT_CSD_PART_SUPPORT] &
354 	    EXT_CSD_PART_SUPPORT_ENH_ATTR_EN) != 0 &&
355 	    (ext_csd[EXT_CSD_PART_ATTR] & (EXT_CSD_PART_ATTR_ENH_USR)) != 0) {
356 		erase_size = ext_csd[EXT_CSD_ERASE_GRP_SIZE] * 1024 *
357 		    MMC_SECTOR_SIZE;
358 		wp_size = ext_csd[EXT_CSD_HC_WP_GRP_SIZE];
359 		size *= erase_size * wp_size;
360 		if (size != mmc_get_media_size(dev) * sector_size) {
361 			sc->enh_size = size;
362 			sc->enh_base =
363 			    le32dec(&ext_csd[EXT_CSD_ENH_START_ADDR]) *
364 			    (sc->high_cap == 0 ? MMC_SECTOR_SIZE : 1);
365 		} else if (bootverbose)
366 			device_printf(dev,
367 			    "enhanced user data area spans entire device\n");
368 	}
369 
370 	/*
371 	 * Add default partition.  This may be the only one or the user
372 	 * data area in case partitions are supported.
373 	 */
374 	ro = mmc_get_read_only(dev);
375 	mmcsd_add_part(sc, EXT_CSD_PART_CONFIG_ACC_DEFAULT, "mmcsd",
376 	    device_get_unit(dev), mmc_get_media_size(dev) * sector_size, ro);
377 
378 	if (mmc_get_spec_vers(dev) < 3)
379 		return (0);
380 
381 	/* Belatedly announce enhanced user data slice. */
382 	if (sc->enh_size != 0) {
383 		bytes = mmcsd_pretty_size(size, unit);
384 		printf(FLASH_SLICES_FMT ": %ju%sB enhanced user data area "
385 		    "slice offset 0x%jx at %s\n", device_get_nameunit(dev),
386 		    MMCSD_LABEL_ENH, bytes, unit, (uintmax_t)sc->enh_base,
387 		    device_get_nameunit(dev));
388 	}
389 
390 	/*
391 	 * Determine partition switch timeout (provided in units of 10 ms)
392 	 * and ensure it's at least 300 ms as some eMMC chips lie.
393 	 */
394 	sc->part_time = max(ext_csd[EXT_CSD_PART_SWITCH_TO] * 10 * 1000,
395 	    300 * 1000);
396 
397 	/* Add boot partitions, which are of a fixed multiple of 128 KB. */
398 	size = ext_csd[EXT_CSD_BOOT_SIZE_MULT] * MMC_BOOT_RPMB_BLOCK_SIZE;
399 	if (size > 0 && (mmcbr_get_caps(mmcbus) & MMC_CAP_BOOT_NOACC) == 0) {
400 		mmcsd_add_part(sc, EXT_CSD_PART_CONFIG_ACC_BOOT0,
401 		    MMCSD_FMT_BOOT, 0, size,
402 		    ro | ((ext_csd[EXT_CSD_BOOT_WP_STATUS] &
403 		    EXT_CSD_BOOT_WP_STATUS_BOOT0_MASK) != 0));
404 		mmcsd_add_part(sc, EXT_CSD_PART_CONFIG_ACC_BOOT1,
405 		    MMCSD_FMT_BOOT, 1, size,
406 		    ro | ((ext_csd[EXT_CSD_BOOT_WP_STATUS] &
407 		    EXT_CSD_BOOT_WP_STATUS_BOOT1_MASK) != 0));
408 	}
409 
410 	/* Add RPMB partition, which also is of a fixed multiple of 128 KB. */
411 	size = ext_csd[EXT_CSD_RPMB_MULT] * MMC_BOOT_RPMB_BLOCK_SIZE;
412 	if (rev >= 5 && size > 0)
413 		mmcsd_add_part(sc, EXT_CSD_PART_CONFIG_ACC_RPMB,
414 		    MMCSD_FMT_RPMB, 0, size, ro);
415 
416 	if (rev <= 3 || comp == FALSE)
417 		return (0);
418 
419 	/*
420 	 * Add general purpose partitions, which are of a multiple of high
421 	 * capacity write protect groups, too.
422 	 */
423 	if ((ext_csd[EXT_CSD_PART_SUPPORT] & EXT_CSD_PART_SUPPORT_EN) != 0) {
424 		erase_size = ext_csd[EXT_CSD_ERASE_GRP_SIZE] * 1024 *
425 		    MMC_SECTOR_SIZE;
426 		wp_size = ext_csd[EXT_CSD_HC_WP_GRP_SIZE];
427 		for (i = 0; i < MMC_PART_GP_MAX; i++) {
428 			size = ext_csd[EXT_CSD_GP_SIZE_MULT + i * 3] +
429 			    (ext_csd[EXT_CSD_GP_SIZE_MULT + i * 3 + 1] << 8) +
430 			    (ext_csd[EXT_CSD_GP_SIZE_MULT + i * 3 + 2] << 16);
431 			if (size == 0)
432 				continue;
433 			mmcsd_add_part(sc, EXT_CSD_PART_CONFIG_ACC_GP0 + i,
434 			    MMCSD_FMT_GP, i, size * erase_size * wp_size, ro);
435 		}
436 	}
437 	return (0);
438 }
439 
440 static uintmax_t
441 mmcsd_pretty_size(off_t size, char *unit)
442 {
443 	uintmax_t bytes;
444 	int i;
445 
446 	/*
447 	 * Display in most natural units.  There's no card < 1MB.  However,
448 	 * RPMB partitions occasionally are smaller than that, though.  The
449 	 * SD standard goes to 2 GiB due to its reliance on FAT, but the data
450 	 * format supports up to 4 GiB and some card makers push it up to this
451 	 * limit.  The SDHC standard only goes to 32 GiB due to FAT32, but the
452 	 * data format supports up to 2 TiB however.  2048 GB isn't too ugly,
453 	 * so we note it in passing here and don't add the code to print TB).
454 	 * Since these cards are sold in terms of MB and GB not MiB and GiB,
455 	 * report them like that.  We also round to the nearest unit, since
456 	 * many cards are a few percent short, even of the power of 10 size.
457 	 */
458 	bytes = size;
459 	unit[0] = unit[1] = '\0';
460 	for (i = 0; i <= 2 && bytes >= 1000; i++) {
461 		bytes = (bytes + 1000 / 2 - 1) / 1000;
462 		switch (i) {
463 		case 0:
464 			unit[0] = 'k';
465 			break;
466 		case 1:
467 			unit[0] = 'M';
468 			break;
469 		case 2:
470 			unit[0] = 'G';
471 			break;
472 		default:
473 			break;
474 		}
475 	}
476 	return (bytes);
477 }
478 
479 static struct cdevsw mmcsd_rpmb_cdevsw = {
480 	.d_version	= D_VERSION,
481 	.d_name		= "mmcsdrpmb",
482 	.d_ioctl	= mmcsd_ioctl_rpmb
483 };
484 
485 static void
486 mmcsd_add_part(struct mmcsd_softc *sc, u_int type, const char *name, u_int cnt,
487     off_t media_size, bool ro)
488 {
489 	struct make_dev_args args;
490 	device_t dev, mmcbus;
491 	const char *ext;
492 	const uint8_t *ext_csd;
493 	struct mmcsd_part *part;
494 	struct disk *d;
495 	uintmax_t bytes;
496 	u_int gp;
497 	uint32_t speed;
498 	uint8_t extattr;
499 	bool enh;
500 	char unit[2];
501 
502 	dev = sc->dev;
503 	mmcbus = sc->mmcbus;
504 	part = sc->part[type] = malloc(sizeof(*part), M_DEVBUF,
505 	    M_WAITOK | M_ZERO);
506 	part->sc = sc;
507 	part->cnt = cnt;
508 	part->type = type;
509 	part->ro = ro;
510 	snprintf(part->name, sizeof(part->name), name, device_get_unit(dev));
511 
512 	MMCSD_IOCTL_LOCK_INIT(part);
513 
514 	/*
515 	 * For the RPMB partition, allow IOCTL access only.
516 	 * NB: If ever attaching RPMB partitions to disk(9), the re-tuning
517 	 *     implementation and especially its pausing need to be revisited,
518 	 *     because then re-tuning requests may be issued by the IOCTL half
519 	 *     of this driver while re-tuning is already paused by the disk(9)
520 	 *     one and vice versa.
521 	 */
522 	if (type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
523 		make_dev_args_init(&args);
524 		args.mda_flags = MAKEDEV_CHECKNAME | MAKEDEV_WAITOK;
525 		args.mda_devsw = &mmcsd_rpmb_cdevsw;
526 		args.mda_uid = UID_ROOT;
527 		args.mda_gid = GID_OPERATOR;
528 		args.mda_mode = 0640;
529 		args.mda_si_drv1 = part;
530 		if (make_dev_s(&args, &sc->rpmb_dev, "%s", part->name) != 0) {
531 			device_printf(dev, "Failed to make RPMB device\n");
532 			free(part, M_DEVBUF);
533 			return;
534 		}
535 	} else {
536 		MMCSD_DISK_LOCK_INIT(part);
537 
538 		d = part->disk = disk_alloc();
539 		d->d_close = mmcsd_close;
540 		d->d_strategy = mmcsd_strategy;
541 		d->d_ioctl = mmcsd_ioctl_disk;
542 		d->d_dump = mmcsd_dump;
543 		d->d_getattr = mmcsd_getattr;
544 		d->d_name = part->name;
545 		d->d_drv1 = part;
546 		d->d_sectorsize = mmc_get_sector_size(dev);
547 		d->d_maxsize = sc->max_data * d->d_sectorsize;
548 		d->d_mediasize = media_size;
549 		d->d_stripesize = sc->erase_sector * d->d_sectorsize;
550 		d->d_unit = cnt;
551 		d->d_flags = DISKFLAG_CANDELETE;
552 		if ((sc->flags & MMCSD_FLUSH_CACHE) != 0)
553 			d->d_flags |= DISKFLAG_CANFLUSHCACHE;
554 		d->d_delmaxsize = mmc_get_erase_sector(dev) * d->d_sectorsize;
555 		strlcpy(d->d_ident, mmc_get_card_sn_string(dev),
556 		    sizeof(d->d_ident));
557 		strlcpy(d->d_descr, mmc_get_card_id_string(dev),
558 		    sizeof(d->d_descr));
559 		d->d_rotation_rate = DISK_RR_NON_ROTATING;
560 
561 		disk_create(d, DISK_VERSION);
562 		bioq_init(&part->bio_queue);
563 
564 		part->running = 1;
565 		kproc_create(&mmcsd_task, part, &part->p, 0, 0,
566 		    "%s%d: mmc/sd card", part->name, cnt);
567 	}
568 
569 	bytes = mmcsd_pretty_size(media_size, unit);
570 	if (type == EXT_CSD_PART_CONFIG_ACC_DEFAULT) {
571 		speed = mmcbr_get_clock(mmcbus);
572 		printf("%s%d: %ju%sB <%s>%s at %s %d.%01dMHz/%dbit/%d-block\n",
573 		    part->name, cnt, bytes, unit, mmc_get_card_id_string(dev),
574 		    ro ? " (read-only)" : "", device_get_nameunit(mmcbus),
575 		    speed / 1000000, (speed / 100000) % 10,
576 		    mmcsd_bus_bit_width(dev), sc->max_data);
577 	} else if (type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
578 		printf("%s: %ju%sB partition %d%s at %s\n", part->name, bytes,
579 		    unit, type, ro ? " (read-only)" : "",
580 		    device_get_nameunit(dev));
581 	} else {
582 		enh = false;
583 		ext = NULL;
584 		extattr = 0;
585 		if (type >= EXT_CSD_PART_CONFIG_ACC_GP0 &&
586 		    type <= EXT_CSD_PART_CONFIG_ACC_GP3) {
587 			ext_csd = sc->ext_csd;
588 			gp = type - EXT_CSD_PART_CONFIG_ACC_GP0;
589 			if ((ext_csd[EXT_CSD_PART_SUPPORT] &
590 			    EXT_CSD_PART_SUPPORT_ENH_ATTR_EN) != 0 &&
591 			    (ext_csd[EXT_CSD_PART_ATTR] &
592 			    (EXT_CSD_PART_ATTR_ENH_GP0 << gp)) != 0)
593 				enh = true;
594 			else if ((ext_csd[EXT_CSD_PART_SUPPORT] &
595 			    EXT_CSD_PART_SUPPORT_EXT_ATTR_EN) != 0) {
596 				extattr = (ext_csd[EXT_CSD_EXT_PART_ATTR +
597 				    (gp / 2)] >> (4 * (gp % 2))) & 0xF;
598 				switch (extattr) {
599 					case EXT_CSD_EXT_PART_ATTR_DEFAULT:
600 						break;
601 					case EXT_CSD_EXT_PART_ATTR_SYSTEMCODE:
602 						ext = "system code";
603 						break;
604 					case EXT_CSD_EXT_PART_ATTR_NPERSISTENT:
605 						ext = "non-persistent";
606 						break;
607 					default:
608 						ext = "reserved";
609 						break;
610 				}
611 			}
612 		}
613 		if (ext == NULL)
614 			printf("%s%d: %ju%sB partition %d%s%s at %s\n",
615 			    part->name, cnt, bytes, unit, type, enh ?
616 			    " enhanced" : "", ro ? " (read-only)" : "",
617 			    device_get_nameunit(dev));
618 		else
619 			printf("%s%d: %ju%sB partition %d extended 0x%x "
620 			    "(%s)%s at %s\n", part->name, cnt, bytes, unit,
621 			    type, extattr, ext, ro ? " (read-only)" : "",
622 			    device_get_nameunit(dev));
623 	}
624 }
625 
626 static int
627 mmcsd_slicer(device_t dev, const char *provider,
628     struct flash_slice *slices, int *nslices)
629 {
630 	char name[MMCSD_PART_NAMELEN];
631 	struct mmcsd_softc *sc;
632 	struct mmcsd_part *part;
633 
634 	*nslices = 0;
635 	if (slices == NULL)
636 		return (ENOMEM);
637 
638 	sc = device_get_softc(dev);
639 	if (sc->enh_size == 0)
640 		return (ENXIO);
641 
642 	part = sc->part[EXT_CSD_PART_CONFIG_ACC_DEFAULT];
643 	snprintf(name, sizeof(name), "%s%d", part->disk->d_name,
644 	    part->disk->d_unit);
645 	if (strcmp(name, provider) != 0)
646 		return (ENXIO);
647 
648 	*nslices = 1;
649 	slices[0].base = sc->enh_base;
650 	slices[0].size = sc->enh_size;
651 	slices[0].label = MMCSD_LABEL_ENH;
652 	return (0);
653 }
654 
655 static int
656 mmcsd_detach(device_t dev)
657 {
658 	struct mmcsd_softc *sc = device_get_softc(dev);
659 	struct mmcsd_part *part;
660 	int i;
661 
662 	for (i = 0; i < MMC_PART_MAX; i++) {
663 		part = sc->part[i];
664 		if (part != NULL) {
665 			if (part->disk != NULL) {
666 				MMCSD_DISK_LOCK(part);
667 				part->suspend = 0;
668 				if (part->running > 0) {
669 					/* kill thread */
670 					part->running = 0;
671 					wakeup(part);
672 					/* wait for thread to finish. */
673 					while (part->running != -1)
674 						msleep(part, &part->disk_mtx, 0,
675 						    "mmcsd disk detach", 0);
676 				}
677 				MMCSD_DISK_UNLOCK(part);
678 			}
679 			MMCSD_IOCTL_LOCK(part);
680 			while (part->ioctl > 0)
681 				msleep(part, &part->ioctl_mtx, 0,
682 				    "mmcsd IOCTL detach", 0);
683 			part->ioctl = -1;
684 			MMCSD_IOCTL_UNLOCK(part);
685 		}
686 	}
687 
688 	if (sc->rpmb_dev != NULL)
689 		destroy_dev(sc->rpmb_dev);
690 
691 	for (i = 0; i < MMC_PART_MAX; i++) {
692 		part = sc->part[i];
693 		if (part != NULL) {
694 			if (part->disk != NULL) {
695 				/* Flush the request queue. */
696 				bioq_flush(&part->bio_queue, NULL, ENXIO);
697 				/* kill disk */
698 				disk_destroy(part->disk);
699 
700 				MMCSD_DISK_LOCK_DESTROY(part);
701 			}
702 			MMCSD_IOCTL_LOCK_DESTROY(part);
703 			free(part, M_DEVBUF);
704 		}
705 	}
706 	if (mmcsd_flush_cache(sc) != MMC_ERR_NONE)
707 		device_printf(dev, "failed to flush cache\n");
708 	return (0);
709 }
710 
711 static int
712 mmcsd_shutdown(device_t dev)
713 {
714 	struct mmcsd_softc *sc = device_get_softc(dev);
715 
716 	if (mmcsd_flush_cache(sc) != MMC_ERR_NONE)
717 		device_printf(dev, "failed to flush cache\n");
718 	return (0);
719 }
720 
721 static int
722 mmcsd_suspend(device_t dev)
723 {
724 	struct mmcsd_softc *sc = device_get_softc(dev);
725 	struct mmcsd_part *part;
726 	int i;
727 
728 	for (i = 0; i < MMC_PART_MAX; i++) {
729 		part = sc->part[i];
730 		if (part != NULL) {
731 			if (part->disk != NULL) {
732 				MMCSD_DISK_LOCK(part);
733 				part->suspend = 1;
734 				if (part->running > 0) {
735 					/* kill thread */
736 					part->running = 0;
737 					wakeup(part);
738 					/* wait for thread to finish. */
739 					while (part->running != -1)
740 						msleep(part, &part->disk_mtx, 0,
741 						    "mmcsd disk suspension", 0);
742 				}
743 				MMCSD_DISK_UNLOCK(part);
744 			}
745 			MMCSD_IOCTL_LOCK(part);
746 			while (part->ioctl > 0)
747 				msleep(part, &part->ioctl_mtx, 0,
748 				    "mmcsd IOCTL suspension", 0);
749 			part->ioctl = -1;
750 			MMCSD_IOCTL_UNLOCK(part);
751 		}
752 	}
753 	if (mmcsd_flush_cache(sc) != MMC_ERR_NONE)
754 		device_printf(dev, "failed to flush cache\n");
755 	return (0);
756 }
757 
758 static int
759 mmcsd_resume(device_t dev)
760 {
761 	struct mmcsd_softc *sc = device_get_softc(dev);
762 	struct mmcsd_part *part;
763 	int i;
764 
765 	for (i = 0; i < MMC_PART_MAX; i++) {
766 		part = sc->part[i];
767 		if (part != NULL) {
768 			if (part->disk != NULL) {
769 				MMCSD_DISK_LOCK(part);
770 				part->suspend = 0;
771 				if (part->running <= 0) {
772 					part->running = 1;
773 					MMCSD_DISK_UNLOCK(part);
774 					kproc_create(&mmcsd_task, part,
775 					    &part->p, 0, 0, "%s%d: mmc/sd card",
776 					    part->name, part->cnt);
777 				} else
778 					MMCSD_DISK_UNLOCK(part);
779 			}
780 			MMCSD_IOCTL_LOCK(part);
781 			part->ioctl = 0;
782 			MMCSD_IOCTL_UNLOCK(part);
783 		}
784 	}
785 	return (0);
786 }
787 
788 static int
789 mmcsd_close(struct disk *dp)
790 {
791 	struct mmcsd_softc *sc;
792 
793 	if ((dp->d_flags & DISKFLAG_OPEN) != 0) {
794 		sc = ((struct mmcsd_part *)dp->d_drv1)->sc;
795 		if (mmcsd_flush_cache(sc) != MMC_ERR_NONE)
796 			device_printf(sc->dev, "failed to flush cache\n");
797 	}
798 	return (0);
799 }
800 
801 static void
802 mmcsd_strategy(struct bio *bp)
803 {
804 	struct mmcsd_part *part;
805 
806 	part = bp->bio_disk->d_drv1;
807 	MMCSD_DISK_LOCK(part);
808 	if (part->running > 0 || part->suspend > 0) {
809 		bioq_disksort(&part->bio_queue, bp);
810 		MMCSD_DISK_UNLOCK(part);
811 		wakeup(part);
812 	} else {
813 		MMCSD_DISK_UNLOCK(part);
814 		biofinish(bp, NULL, ENXIO);
815 	}
816 }
817 
818 static int
819 mmcsd_ioctl_rpmb(struct cdev *dev, u_long cmd, caddr_t data,
820     int fflag, struct thread *td)
821 {
822 
823 	return (mmcsd_ioctl(dev->si_drv1, cmd, data, fflag, td));
824 }
825 
826 static int
827 mmcsd_ioctl_disk(struct disk *disk, u_long cmd, void *data, int fflag,
828     struct thread *td)
829 {
830 
831 	return (mmcsd_ioctl(disk->d_drv1, cmd, data, fflag, td));
832 }
833 
834 static int
835 mmcsd_ioctl(struct mmcsd_part *part, u_long cmd, void *data, int fflag,
836     struct thread *td)
837 {
838 	struct mmc_ioc_cmd *mic;
839 	struct mmc_ioc_multi_cmd *mimc;
840 	int i, err;
841 	u_long cnt, size;
842 
843 	if ((fflag & FREAD) == 0)
844 		return (EBADF);
845 
846 	err = priv_check(td, PRIV_DRIVER);
847 	if (err != 0)
848 		return (err);
849 
850 	err = 0;
851 	switch (cmd) {
852 	case MMC_IOC_CMD:
853 		mic = data;
854 		err = mmcsd_ioctl_cmd(part, mic, fflag);
855 		break;
856 	case MMC_IOC_MULTI_CMD:
857 		mimc = data;
858 		if (mimc->num_of_cmds == 0)
859 			break;
860 		if (mimc->num_of_cmds > MMC_IOC_MAX_CMDS)
861 			return (EINVAL);
862 		cnt = mimc->num_of_cmds;
863 		size = sizeof(*mic) * cnt;
864 		mic = malloc(size, M_TEMP, M_WAITOK);
865 		err = copyin((const void *)mimc->cmds, mic, size);
866 		if (err == 0) {
867 			for (i = 0; i < cnt; i++) {
868 				err = mmcsd_ioctl_cmd(part, &mic[i], fflag);
869 				if (err != 0)
870 					break;
871 			}
872 		}
873 		free(mic, M_TEMP);
874 		break;
875 	default:
876 		return (ENOIOCTL);
877 	}
878 	return (err);
879 }
880 
881 static int
882 mmcsd_ioctl_cmd(struct mmcsd_part *part, struct mmc_ioc_cmd *mic, int fflag)
883 {
884 	struct mmc_command cmd;
885 	struct mmc_data data;
886 	struct mmcsd_softc *sc;
887 	device_t dev, mmcbus;
888 	void *dp;
889 	u_long len;
890 	int err, retries;
891 	uint32_t status;
892 	uint16_t rca;
893 
894 	if ((fflag & FWRITE) == 0 && mic->write_flag != 0)
895 		return (EBADF);
896 
897 	if (part->ro == TRUE && mic->write_flag != 0)
898 		return (EROFS);
899 
900 	/*
901 	 * We don't need to explicitly lock against the disk(9) half of this
902 	 * driver as MMCBUS_ACQUIRE_BUS() will serialize us.  However, it's
903 	 * necessary to protect against races with detachment and suspension,
904 	 * especially since it's required to switch away from RPMB partitions
905 	 * again after an access (see mmcsd_switch_part()).
906 	 */
907 	MMCSD_IOCTL_LOCK(part);
908 	while (part->ioctl != 0) {
909 		if (part->ioctl < 0) {
910 			MMCSD_IOCTL_UNLOCK(part);
911 			return (ENXIO);
912 		}
913 		msleep(part, &part->ioctl_mtx, 0, "mmcsd IOCTL", 0);
914 	}
915 	part->ioctl = 1;
916 	MMCSD_IOCTL_UNLOCK(part);
917 
918 	err = 0;
919 	dp = NULL;
920 	len = mic->blksz * mic->blocks;
921 	if (len > MMC_IOC_MAX_BYTES) {
922 		err = EOVERFLOW;
923 		goto out;
924 	}
925 	if (len != 0) {
926 		dp = malloc(len, M_TEMP, M_WAITOK);
927 		err = copyin((void *)(uintptr_t)mic->data_ptr, dp, len);
928 		if (err != 0)
929 			goto out;
930 	}
931 	memset(&cmd, 0, sizeof(cmd));
932 	memset(&data, 0, sizeof(data));
933 	cmd.opcode = mic->opcode;
934 	cmd.arg = mic->arg;
935 	cmd.flags = mic->flags;
936 	if (len != 0) {
937 		data.len = len;
938 		data.data = dp;
939 		data.flags = mic->write_flag != 0 ? MMC_DATA_WRITE :
940 		    MMC_DATA_READ;
941 		cmd.data = &data;
942 	}
943 	sc = part->sc;
944 	rca = sc->rca;
945 	if (mic->is_acmd == 0) {
946 		/* Enforce/patch/restrict RCA-based commands */
947 		switch (cmd.opcode) {
948 		case MMC_SET_RELATIVE_ADDR:
949 		case MMC_SELECT_CARD:
950 			err = EPERM;
951 			goto out;
952 		case MMC_STOP_TRANSMISSION:
953 			if ((cmd.arg & 0x1) == 0)
954 				break;
955 			/* FALLTHROUGH */
956 		case MMC_SLEEP_AWAKE:
957 		case MMC_SEND_CSD:
958 		case MMC_SEND_CID:
959 		case MMC_SEND_STATUS:
960 		case MMC_GO_INACTIVE_STATE:
961 		case MMC_FAST_IO:
962 		case MMC_APP_CMD:
963 			cmd.arg = (cmd.arg & 0x0000FFFF) | (rca << 16);
964 			break;
965 		default:
966 			break;
967 		}
968 		/*
969 		 * No partition switching in userland; it's almost impossible
970 		 * to recover from that, especially if things go wrong.
971 		 */
972 		if (cmd.opcode == MMC_SWITCH_FUNC && dp != NULL &&
973 		    (((uint8_t *)dp)[EXT_CSD_PART_CONFIG] &
974 		    EXT_CSD_PART_CONFIG_ACC_MASK) != part->type) {
975 			err = EINVAL;
976 			goto out;
977 		}
978 	}
979 	dev = sc->dev;
980 	mmcbus = sc->mmcbus;
981 	MMCBUS_ACQUIRE_BUS(mmcbus, dev);
982 	err = mmcsd_switch_part(mmcbus, dev, rca, part->type);
983 	if (err != MMC_ERR_NONE)
984 		goto release;
985 	if (part->type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
986 		err = mmcsd_set_blockcount(sc, mic->blocks,
987 		    mic->write_flag & (1 << 31));
988 		if (err != MMC_ERR_NONE)
989 			goto switch_back;
990 	}
991 	if (mic->write_flag != 0)
992 		sc->flags |= MMCSD_DIRTY;
993 	if (mic->is_acmd != 0)
994 		(void)mmc_wait_for_app_cmd(mmcbus, dev, rca, &cmd, 0);
995 	else
996 		(void)mmc_wait_for_cmd(mmcbus, dev, &cmd, 0);
997 	if (part->type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
998 		/*
999 		 * If the request went to the RPMB partition, try to ensure
1000 		 * that the command actually has completed.
1001 		 */
1002 		retries = MMCSD_CMD_RETRIES;
1003 		do {
1004 			err = mmc_send_status(mmcbus, dev, rca, &status);
1005 			if (err != MMC_ERR_NONE)
1006 				break;
1007 			if (R1_STATUS(status) == 0 &&
1008 			    R1_CURRENT_STATE(status) != R1_STATE_PRG)
1009 				break;
1010 			DELAY(1000);
1011 		} while (retries-- > 0);
1012 	}
1013 	/*
1014 	 * If EXT_CSD was changed, our copy is outdated now.  Specifically,
1015 	 * the upper bits of EXT_CSD_PART_CONFIG used in mmcsd_switch_part(),
1016 	 * so retrieve EXT_CSD again.
1017 	 */
1018 	if (cmd.opcode == MMC_SWITCH_FUNC) {
1019 		err = mmc_send_ext_csd(mmcbus, dev, sc->ext_csd);
1020 		if (err != MMC_ERR_NONE)
1021 			goto release;
1022 	}
1023 switch_back:
1024 	if (part->type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
1025 		/*
1026 		 * If the request went to the RPMB partition, always switch
1027 		 * back to the default partition (see mmcsd_switch_part()).
1028 		 */
1029 		err = mmcsd_switch_part(mmcbus, dev, rca,
1030 		    EXT_CSD_PART_CONFIG_ACC_DEFAULT);
1031 		if (err != MMC_ERR_NONE)
1032 			goto release;
1033 	}
1034 	MMCBUS_RELEASE_BUS(mmcbus, dev);
1035 	if (cmd.error != MMC_ERR_NONE) {
1036 		switch (cmd.error) {
1037 		case MMC_ERR_TIMEOUT:
1038 			err = ETIMEDOUT;
1039 			break;
1040 		case MMC_ERR_BADCRC:
1041 			err = EILSEQ;
1042 			break;
1043 		case MMC_ERR_INVALID:
1044 			err = EINVAL;
1045 			break;
1046 		case MMC_ERR_NO_MEMORY:
1047 			err = ENOMEM;
1048 			break;
1049 		default:
1050 			err = EIO;
1051 			break;
1052 		}
1053 		goto out;
1054 	}
1055 	memcpy(mic->response, cmd.resp, 4 * sizeof(uint32_t));
1056 	if (mic->write_flag == 0 && len != 0) {
1057 		err = copyout(dp, (void *)(uintptr_t)mic->data_ptr, len);
1058 		if (err != 0)
1059 			goto out;
1060 	}
1061 	goto out;
1062 
1063 release:
1064 	MMCBUS_RELEASE_BUS(mmcbus, dev);
1065 	err = EIO;
1066 
1067 out:
1068 	MMCSD_IOCTL_LOCK(part);
1069 	part->ioctl = 0;
1070 	MMCSD_IOCTL_UNLOCK(part);
1071 	wakeup(part);
1072 	if (dp != NULL)
1073 		free(dp, M_TEMP);
1074 	return (err);
1075 }
1076 
1077 static int
1078 mmcsd_getattr(struct bio *bp)
1079 {
1080 	struct mmcsd_part *part;
1081 	device_t dev;
1082 
1083 	if (strcmp(bp->bio_attribute, "MMC::device") == 0) {
1084 		if (bp->bio_length != sizeof(dev))
1085 			return (EFAULT);
1086 		part = bp->bio_disk->d_drv1;
1087 		dev = part->sc->dev;
1088 		bcopy(&dev, bp->bio_data, sizeof(dev));
1089 		bp->bio_completed = bp->bio_length;
1090 		return (0);
1091 	}
1092 	return (-1);
1093 }
1094 
1095 static int
1096 mmcsd_set_blockcount(struct mmcsd_softc *sc, u_int count, bool reliable)
1097 {
1098 	struct mmc_command cmd;
1099 	struct mmc_request req;
1100 
1101 	memset(&req, 0, sizeof(req));
1102 	memset(&cmd, 0, sizeof(cmd));
1103 	cmd.mrq = &req;
1104 	req.cmd = &cmd;
1105 	cmd.opcode = MMC_SET_BLOCK_COUNT;
1106 	cmd.arg = count & 0x0000FFFF;
1107 	if (reliable)
1108 		cmd.arg |= 1 << 31;
1109 	cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
1110 	MMCBUS_WAIT_FOR_REQUEST(sc->mmcbus, sc->dev, &req);
1111 	return (cmd.error);
1112 }
1113 
1114 static int
1115 mmcsd_switch_part(device_t bus, device_t dev, uint16_t rca, u_int part)
1116 {
1117 	struct mmcsd_softc *sc;
1118 	int err;
1119 	uint8_t	value;
1120 
1121 	sc = device_get_softc(dev);
1122 
1123 	if (sc->mode == mode_sd)
1124 		return (MMC_ERR_NONE);
1125 
1126 	/*
1127 	 * According to section "6.2.2 Command restrictions" of the eMMC
1128 	 * specification v5.1, CMD19/CMD21 aren't allowed to be used with
1129 	 * RPMB partitions.  So we pause re-tuning along with triggering
1130 	 * it up-front to decrease the likelihood of re-tuning becoming
1131 	 * necessary while accessing an RPMB partition.  Consequently, an
1132 	 * RPMB partition should immediately be switched away from again
1133 	 * after an access in order to allow for re-tuning to take place
1134 	 * anew.
1135 	 */
1136 	if (part == EXT_CSD_PART_CONFIG_ACC_RPMB)
1137 		MMCBUS_RETUNE_PAUSE(sc->mmcbus, sc->dev, true);
1138 
1139 	if (sc->part_curr == part)
1140 		return (MMC_ERR_NONE);
1141 
1142 	value = (sc->ext_csd[EXT_CSD_PART_CONFIG] &
1143 	    ~EXT_CSD_PART_CONFIG_ACC_MASK) | part;
1144 	/* Jump! */
1145 	err = mmc_switch(bus, dev, rca, EXT_CSD_CMD_SET_NORMAL,
1146 	    EXT_CSD_PART_CONFIG, value, sc->part_time, true);
1147 	if (err != MMC_ERR_NONE) {
1148 		if (part == EXT_CSD_PART_CONFIG_ACC_RPMB)
1149 			MMCBUS_RETUNE_UNPAUSE(sc->mmcbus, sc->dev);
1150 		return (err);
1151 	}
1152 
1153 	sc->ext_csd[EXT_CSD_PART_CONFIG] = value;
1154 	if (sc->part_curr == EXT_CSD_PART_CONFIG_ACC_RPMB)
1155 		MMCBUS_RETUNE_UNPAUSE(sc->mmcbus, sc->dev);
1156 	sc->part_curr = part;
1157 	return (MMC_ERR_NONE);
1158 }
1159 
1160 static const char *
1161 mmcsd_errmsg(int e)
1162 {
1163 
1164 	if (e < 0 || e > MMC_ERR_MAX)
1165 		return "Bad error code";
1166 	return (errmsg[e]);
1167 }
1168 
1169 static daddr_t
1170 mmcsd_rw(struct mmcsd_part *part, struct bio *bp)
1171 {
1172 	daddr_t block, end;
1173 	struct mmc_command cmd;
1174 	struct mmc_command stop;
1175 	struct mmc_request req;
1176 	struct mmc_data data;
1177 	struct mmcsd_softc *sc;
1178 	device_t dev, mmcbus;
1179 	u_int numblocks, sz;
1180 	char *vaddr;
1181 
1182 	sc = part->sc;
1183 	dev = sc->dev;
1184 	mmcbus = sc->mmcbus;
1185 
1186 	block = bp->bio_pblkno;
1187 	sz = part->disk->d_sectorsize;
1188 	end = bp->bio_pblkno + (bp->bio_bcount / sz);
1189 	while (block < end) {
1190 		vaddr = bp->bio_data + (block - bp->bio_pblkno) * sz;
1191 		numblocks = min(end - block, sc->max_data);
1192 		memset(&req, 0, sizeof(req));
1193 		memset(&cmd, 0, sizeof(cmd));
1194 		memset(&stop, 0, sizeof(stop));
1195 		memset(&data, 0, sizeof(data));
1196 		cmd.mrq = &req;
1197 		req.cmd = &cmd;
1198 		cmd.data = &data;
1199 		if (bp->bio_cmd == BIO_READ) {
1200 			if (numblocks > 1)
1201 				cmd.opcode = MMC_READ_MULTIPLE_BLOCK;
1202 			else
1203 				cmd.opcode = MMC_READ_SINGLE_BLOCK;
1204 		} else {
1205 			sc->flags |= MMCSD_DIRTY;
1206 			if (numblocks > 1)
1207 				cmd.opcode = MMC_WRITE_MULTIPLE_BLOCK;
1208 			else
1209 				cmd.opcode = MMC_WRITE_BLOCK;
1210 		}
1211 		cmd.arg = block;
1212 		if (sc->high_cap == 0)
1213 			cmd.arg <<= 9;
1214 		cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
1215 		data.data = vaddr;
1216 		data.mrq = &req;
1217 		if (bp->bio_cmd == BIO_READ)
1218 			data.flags = MMC_DATA_READ;
1219 		else
1220 			data.flags = MMC_DATA_WRITE;
1221 		data.len = numblocks * sz;
1222 		if (numblocks > 1) {
1223 			data.flags |= MMC_DATA_MULTI;
1224 			stop.opcode = MMC_STOP_TRANSMISSION;
1225 			stop.arg = 0;
1226 			stop.flags = MMC_RSP_R1B | MMC_CMD_AC;
1227 			stop.mrq = &req;
1228 			req.stop = &stop;
1229 		}
1230 		MMCBUS_WAIT_FOR_REQUEST(mmcbus, dev, &req);
1231 		if (req.cmd->error != MMC_ERR_NONE) {
1232 			if (ppsratecheck(&sc->log_time, &sc->log_count,
1233 			    LOG_PPS))
1234 				device_printf(dev, "Error indicated: %d %s\n",
1235 				    req.cmd->error,
1236 				    mmcsd_errmsg(req.cmd->error));
1237 			break;
1238 		}
1239 		block += numblocks;
1240 	}
1241 	return (block);
1242 }
1243 
1244 static daddr_t
1245 mmcsd_delete(struct mmcsd_part *part, struct bio *bp)
1246 {
1247 	daddr_t block, end, start, stop;
1248 	struct mmc_command cmd;
1249 	struct mmc_request req;
1250 	struct mmcsd_softc *sc;
1251 	device_t dev, mmcbus;
1252 	u_int erase_sector, sz;
1253 	int err;
1254 	bool use_trim;
1255 
1256 	sc = part->sc;
1257 	dev = sc->dev;
1258 	mmcbus = sc->mmcbus;
1259 
1260 	block = bp->bio_pblkno;
1261 	sz = part->disk->d_sectorsize;
1262 	end = bp->bio_pblkno + (bp->bio_bcount / sz);
1263 	use_trim = sc->flags & MMCSD_USE_TRIM;
1264 	if (use_trim == true) {
1265 		start = block;
1266 		stop = end;
1267 	} else {
1268 		/* Coalesce with the remainder of the previous request. */
1269 		if (block > part->eblock && block <= part->eend)
1270 			block = part->eblock;
1271 		if (end >= part->eblock && end < part->eend)
1272 			end = part->eend;
1273 		/* Safely round to the erase sector boundaries. */
1274 		erase_sector = sc->erase_sector;
1275 		start = block + erase_sector - 1;	 /* Round up. */
1276 		start -= start % erase_sector;
1277 		stop = end;				/* Round down. */
1278 		stop -= end % erase_sector;
1279 		/*
1280 		 * We can't erase an area smaller than an erase sector, so
1281 		 * store it for later.
1282 		 */
1283 		if (start >= stop) {
1284 			part->eblock = block;
1285 			part->eend = end;
1286 			return (end);
1287 		}
1288 	}
1289 
1290 	if ((sc->flags & MMCSD_INAND_CMD38) != 0) {
1291 		err = mmc_switch(mmcbus, dev, sc->rca, EXT_CSD_CMD_SET_NORMAL,
1292 		    EXT_CSD_INAND_CMD38, use_trim == true ?
1293 		    EXT_CSD_INAND_CMD38_TRIM : EXT_CSD_INAND_CMD38_ERASE,
1294 		    sc->cmd6_time, true);
1295 		if (err != MMC_ERR_NONE) {
1296 			device_printf(dev,
1297 			    "Setting iNAND erase command failed %s\n",
1298 			    mmcsd_errmsg(err));
1299 			return (block);
1300 		}
1301 	}
1302 
1303 	/*
1304 	 * Pause re-tuning so it won't interfere with the order of erase
1305 	 * commands.  Note that these latter don't use the data lines, so
1306 	 * re-tuning shouldn't actually become necessary during erase.
1307 	 */
1308 	MMCBUS_RETUNE_PAUSE(mmcbus, dev, false);
1309 	/* Set erase start position. */
1310 	memset(&req, 0, sizeof(req));
1311 	memset(&cmd, 0, sizeof(cmd));
1312 	cmd.mrq = &req;
1313 	req.cmd = &cmd;
1314 	if (sc->mode == mode_sd)
1315 		cmd.opcode = SD_ERASE_WR_BLK_START;
1316 	else
1317 		cmd.opcode = MMC_ERASE_GROUP_START;
1318 	cmd.arg = start;
1319 	if (sc->high_cap == 0)
1320 		cmd.arg <<= 9;
1321 	cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
1322 	MMCBUS_WAIT_FOR_REQUEST(mmcbus, dev, &req);
1323 	if (req.cmd->error != MMC_ERR_NONE) {
1324 		device_printf(dev, "Setting erase start position failed %s\n",
1325 		    mmcsd_errmsg(req.cmd->error));
1326 		block = bp->bio_pblkno;
1327 		goto unpause;
1328 	}
1329 	/* Set erase stop position. */
1330 	memset(&req, 0, sizeof(req));
1331 	memset(&cmd, 0, sizeof(cmd));
1332 	req.cmd = &cmd;
1333 	if (sc->mode == mode_sd)
1334 		cmd.opcode = SD_ERASE_WR_BLK_END;
1335 	else
1336 		cmd.opcode = MMC_ERASE_GROUP_END;
1337 	cmd.arg = stop;
1338 	if (sc->high_cap == 0)
1339 		cmd.arg <<= 9;
1340 	cmd.arg--;
1341 	cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
1342 	MMCBUS_WAIT_FOR_REQUEST(mmcbus, dev, &req);
1343 	if (req.cmd->error != MMC_ERR_NONE) {
1344 		device_printf(dev, "Setting erase stop position failed %s\n",
1345 		    mmcsd_errmsg(req.cmd->error));
1346 		block = bp->bio_pblkno;
1347 		goto unpause;
1348 	}
1349 	/* Erase range. */
1350 	memset(&req, 0, sizeof(req));
1351 	memset(&cmd, 0, sizeof(cmd));
1352 	req.cmd = &cmd;
1353 	cmd.opcode = MMC_ERASE;
1354 	cmd.arg = use_trim == true ? MMC_ERASE_TRIM : MMC_ERASE_ERASE;
1355 	cmd.flags = MMC_RSP_R1B | MMC_CMD_AC;
1356 	MMCBUS_WAIT_FOR_REQUEST(mmcbus, dev, &req);
1357 	if (req.cmd->error != MMC_ERR_NONE) {
1358 		device_printf(dev, "Issuing erase command failed %s\n",
1359 		    mmcsd_errmsg(req.cmd->error));
1360 		block = bp->bio_pblkno;
1361 		goto unpause;
1362 	}
1363 	if (use_trim == false) {
1364 		/* Store one of the remaining parts for the next call. */
1365 		if (bp->bio_pblkno >= part->eblock || block == start) {
1366 			part->eblock = stop;	/* Predict next forward. */
1367 			part->eend = end;
1368 		} else {
1369 			part->eblock = block;	/* Predict next backward. */
1370 			part->eend = start;
1371 		}
1372 	}
1373 	block = end;
1374 unpause:
1375 	MMCBUS_RETUNE_UNPAUSE(mmcbus, dev);
1376 	return (block);
1377 }
1378 
1379 static int
1380 mmcsd_dump(void *arg, void *virtual, vm_offset_t physical, off_t offset,
1381     size_t length)
1382 {
1383 	struct bio bp;
1384 	daddr_t block, end;
1385 	struct disk *disk;
1386 	struct mmcsd_softc *sc;
1387 	struct mmcsd_part *part;
1388 	device_t dev, mmcbus;
1389 	int err;
1390 
1391 	disk = arg;
1392 	part = disk->d_drv1;
1393 	sc = part->sc;
1394 
1395 	/* length zero is special and really means flush buffers to media */
1396 	if (length == 0) {
1397 		err = mmcsd_flush_cache(sc);
1398 		if (err != MMC_ERR_NONE)
1399 			return (EIO);
1400 		return (0);
1401 	}
1402 
1403 	dev = sc->dev;
1404 	mmcbus = sc->mmcbus;
1405 
1406 	g_reset_bio(&bp);
1407 	bp.bio_disk = disk;
1408 	bp.bio_pblkno = offset / disk->d_sectorsize;
1409 	bp.bio_bcount = length;
1410 	bp.bio_data = virtual;
1411 	bp.bio_cmd = BIO_WRITE;
1412 	end = bp.bio_pblkno + bp.bio_bcount / disk->d_sectorsize;
1413 	MMCBUS_ACQUIRE_BUS(mmcbus, dev);
1414 	err = mmcsd_switch_part(mmcbus, dev, sc->rca, part->type);
1415 	if (err != MMC_ERR_NONE) {
1416 		if (ppsratecheck(&sc->log_time, &sc->log_count, LOG_PPS))
1417 			device_printf(dev, "Partition switch error\n");
1418 		MMCBUS_RELEASE_BUS(mmcbus, dev);
1419 		return (EIO);
1420 	}
1421 	block = mmcsd_rw(part, &bp);
1422 	MMCBUS_RELEASE_BUS(mmcbus, dev);
1423 	return ((end < block) ? EIO : 0);
1424 }
1425 
1426 static void
1427 mmcsd_task(void *arg)
1428 {
1429 	daddr_t block, end;
1430 	struct mmcsd_part *part;
1431 	struct mmcsd_softc *sc;
1432 	struct bio *bp;
1433 	device_t dev, mmcbus;
1434 	int bio_error, err, sz;
1435 
1436 	part = arg;
1437 	sc = part->sc;
1438 	dev = sc->dev;
1439 	mmcbus = sc->mmcbus;
1440 
1441 	while (1) {
1442 		MMCSD_DISK_LOCK(part);
1443 		do {
1444 			if (part->running == 0)
1445 				goto out;
1446 			bp = bioq_takefirst(&part->bio_queue);
1447 			if (bp == NULL)
1448 				msleep(part, &part->disk_mtx, PRIBIO,
1449 				    "mmcsd disk jobqueue", 0);
1450 		} while (bp == NULL);
1451 		MMCSD_DISK_UNLOCK(part);
1452 		if (__predict_false(bp->bio_cmd == BIO_FLUSH)) {
1453 			if (mmcsd_flush_cache(sc) != MMC_ERR_NONE) {
1454 				bp->bio_error = EIO;
1455 				bp->bio_flags |= BIO_ERROR;
1456 			}
1457 			biodone(bp);
1458 			continue;
1459 		}
1460 		if (bp->bio_cmd != BIO_READ && part->ro) {
1461 			bp->bio_error = EROFS;
1462 			bp->bio_resid = bp->bio_bcount;
1463 			bp->bio_flags |= BIO_ERROR;
1464 			biodone(bp);
1465 			continue;
1466 		}
1467 		MMCBUS_ACQUIRE_BUS(mmcbus, dev);
1468 		sz = part->disk->d_sectorsize;
1469 		block = bp->bio_pblkno;
1470 		end = bp->bio_pblkno + (bp->bio_bcount / sz);
1471 		err = mmcsd_switch_part(mmcbus, dev, sc->rca, part->type);
1472 		if (err != MMC_ERR_NONE) {
1473 			if (ppsratecheck(&sc->log_time, &sc->log_count,
1474 			    LOG_PPS))
1475 				device_printf(dev, "Partition switch error\n");
1476 			goto release;
1477 		}
1478 		if (bp->bio_cmd == BIO_READ || bp->bio_cmd == BIO_WRITE) {
1479 			/* Access to the remaining erase block obsoletes it. */
1480 			if (block < part->eend && end > part->eblock)
1481 				part->eblock = part->eend = 0;
1482 			block = mmcsd_rw(part, bp);
1483 		} else if (bp->bio_cmd == BIO_DELETE) {
1484 			block = mmcsd_delete(part, bp);
1485 		} else {
1486 			bio_error = EOPNOTSUPP;
1487 			goto release;
1488 		}
1489 release:
1490 		MMCBUS_RELEASE_BUS(mmcbus, dev);
1491 		if (block < end) {
1492 			bp->bio_error = (bio_error == 0) ? EIO : bio_error;
1493 			bp->bio_resid = (end - block) * sz;
1494 			bp->bio_flags |= BIO_ERROR;
1495 		} else {
1496 			bp->bio_resid = 0;
1497 		}
1498 		biodone(bp);
1499 	}
1500 out:
1501 	/* tell parent we're done */
1502 	part->running = -1;
1503 	MMCSD_DISK_UNLOCK(part);
1504 	wakeup(part);
1505 
1506 	kproc_exit(0);
1507 }
1508 
1509 static int
1510 mmcsd_bus_bit_width(device_t dev)
1511 {
1512 
1513 	if (mmc_get_bus_width(dev) == bus_width_1)
1514 		return (1);
1515 	if (mmc_get_bus_width(dev) == bus_width_4)
1516 		return (4);
1517 	return (8);
1518 }
1519 
1520 static int
1521 mmcsd_flush_cache(struct mmcsd_softc *sc)
1522 {
1523 	device_t dev, mmcbus;
1524 	int err;
1525 
1526 	if ((sc->flags & MMCSD_FLUSH_CACHE) == 0)
1527 		return (MMC_ERR_NONE);
1528 
1529 	dev = sc->dev;
1530 	mmcbus = sc->mmcbus;
1531 	MMCBUS_ACQUIRE_BUS(mmcbus, dev);
1532 	if ((sc->flags & MMCSD_DIRTY) == 0) {
1533 		MMCBUS_RELEASE_BUS(mmcbus, dev);
1534 		return (MMC_ERR_NONE);
1535 	}
1536 	err = mmc_switch(mmcbus, dev, sc->rca, EXT_CSD_CMD_SET_NORMAL,
1537 	    EXT_CSD_FLUSH_CACHE, EXT_CSD_FLUSH_CACHE_FLUSH, 60 * 1000, true);
1538 	if (err == MMC_ERR_NONE)
1539 		sc->flags &= ~MMCSD_DIRTY;
1540 	MMCBUS_RELEASE_BUS(mmcbus, dev);
1541 	return (err);
1542 }
1543 
1544 static device_method_t mmcsd_methods[] = {
1545 	DEVMETHOD(device_probe, mmcsd_probe),
1546 	DEVMETHOD(device_attach, mmcsd_attach),
1547 	DEVMETHOD(device_detach, mmcsd_detach),
1548 	DEVMETHOD(device_shutdown, mmcsd_shutdown),
1549 	DEVMETHOD(device_suspend, mmcsd_suspend),
1550 	DEVMETHOD(device_resume, mmcsd_resume),
1551 	DEVMETHOD_END
1552 };
1553 
1554 static driver_t mmcsd_driver = {
1555 	"mmcsd",
1556 	mmcsd_methods,
1557 	sizeof(struct mmcsd_softc),
1558 };
1559 static devclass_t mmcsd_devclass;
1560 
1561 static int
1562 mmcsd_handler(module_t mod __unused, int what, void *arg __unused)
1563 {
1564 
1565 	switch (what) {
1566 	case MOD_LOAD:
1567 		flash_register_slicer(mmcsd_slicer, FLASH_SLICES_TYPE_MMC,
1568 		    TRUE);
1569 		return (0);
1570 	case MOD_UNLOAD:
1571 		flash_register_slicer(NULL, FLASH_SLICES_TYPE_MMC, TRUE);
1572 		return (0);
1573 	}
1574 	return (0);
1575 }
1576 
1577 DRIVER_MODULE(mmcsd, mmc, mmcsd_driver, mmcsd_devclass, mmcsd_handler, NULL);
1578 MODULE_DEPEND(mmcsd, g_flashmap, 0, 0, 0);
1579 MMC_DEPEND(mmcsd);
1580