Commit Graph

826140 Commits

Author SHA1 Message Date
Ulf Hansson
c6645985d7 MAINTAINERS: Collect TI FLASH MEDIA drivers into one section
The current SONY MEMORYSTICK CARD SUPPORT section is pointing to the TI
flash media memorystick driver, which is a bit confusing. Let's make this
more clear by moving this part into TI FLASH MEDIA INTERFACE DRIVER
section, but rename the section to TI FLASH MEDIA MEMORYSTICK/MMC DRIVERS,
as to make it more clear.

Finally, add Alex Dubov to the SONY MEMORYSTICK STANDARD SUPPORT, as I
believe that has been the intention.

Cc: Alex Dubov <oakad@yahoo.com>
Cc: Alex Dubov <alex.dubov@gmail.com>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Andy Shevchenko
aad5f19e47 mmc: mmc_spi: Convert to use SPDX identifier
Reduce size of duplicated comments by switching to use SPDX identifier.

No functional change.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Andy Shevchenko
1ae5160352 mmc: mmc_spi: Indentation fixes
- spaces surrounding arithmetic operators
- utilize full line limit
- drop extra spaces / TABs in variable definitions

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Andy Shevchenko
38b2168581 mmc: mmc_spi: Join string literals back
For easy grepping on debug purposes join string literals back in
the messages.

No functional change.

While here, join list of module authors as well.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Andy Shevchenko
70a557e63f mmc: mmc_spi: Remove useless NULL check at ->remove()
The mmc pointer can't be NULL at ->remove(), drop the useless check.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Andy Shevchenko
b9ffe40862 mmc: mmc_spi: Remove redundant dev_set_drvdata()
Driver core sets it to NULL upon probe failure or release.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ludovic Barre
41ed65e7ce mmc: mmci: replace blksz_datactrlXX by get_datactrl_cfg callback
This patch allows to get datactrl configuration specific
at variant. This introduce more flexibility on datactlr
value.

Signed-off-by: Ludovic Barre <ludovic.barre@st.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ludovic Barre
8372f9d0ef mmc: mmci: stm32: define get_dctrl_cfg
This patch defines get_dctrl_cfg callback for sdmmc variant.
sdmmc variant has specific stm32 transfer modes.
sdmmc data transfer mode selection could be:
-Block data transfer ending on block count.
-SDIO multibyte data transfer.
-MMC Stream data transfer (not used).
-Block data transfer ending with STOP_TRANSMISSION command.

Signed-off-by: Ludovic Barre <ludovic.barre@st.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ludovic Barre
5db1e1fc7c mmc: mmci: qcom: define get_dctrl_cfg
This patch defines get_dctrl_cfg callback for qcom variant.
qcom variant has a specific block size definition.

Signed-off-by: Ludovic Barre <ludovic.barre@st.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ludovic Barre
b3fb9d64b4 mmc: mmci: define get_dctrl_cfg for legacy variant
This patch defines get_dctrl_cfg callback for legacy variants
whatever DMA_ENGINE configuration.

Signed-off-by: Ludovic Barre <ludovic.barre@st.com>
[Ulf: Fixed a build error]
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ludovic Barre
0732ea75de mmc: mmci: add get_datactrl_cfg callback and helper functions
This patch adds get_datactrl_cfg callback in mmci_host_ops
to allow to get datactrl configuration specific at variant.
Common helper function is defined and could be call by variant.

Signed-off-by: Ludovic Barre <ludovic.barre@st.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Daniel Drake
e5a34b0c10 mmc: alcor: enable DMA for writes
Enable the DMA codepath for writes as well as reads.
This improves write speed from 1mb/sec to 2mb/sec (tested with dd).

The original ampe_stor vendor driver also uses DMA for writes.

Signed-off-by: Daniel Drake <drake@endlessm.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Christoph Muellner
7bda9482e7 mmc: sdhci-of-arasan: Add DTS property to disable DCMDs.
Direct commands (DCMDs) are an optional feature of eMMC 5.1's command
queue engine (CQE). The Arasan eMMC 5.1 controller uses the CQHCI,
which exposes a control register bit to enable the feature.
The current implementation sets this bit unconditionally.

This patch allows to suppress the feature activation,
by specifying the property disable-cqe-dcmd.

Signed-off-by: Christoph Muellner <christoph.muellner@theobroma-systems.com>
Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: 84362d79f4 ("mmc: sdhci-of-arasan: Add CQHCI support for arasan,sdhci-5.1")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Christoph Muellner
28f22fb755 dt-bindings: mmc: Add disable-cqe-dcmd property.
Add disable-cqe-dcmd as optional property for MMC hosts.
This property allows to disable or not enable the direct command
features of the command queue engine.

Signed-off-by: Christoph Muellner <christoph.muellner@theobroma-systems.com>
Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
Fixes: 84362d79f4 ("mmc: sdhci-of-arasan: Add CQHCI support for arasan,sdhci-5.1")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
YueHaibing
2198eeff23 mmc: sdhci-omap: Make sdhci_omap_reset static
Fix sparse warning:

drivers/mmc/host/sdhci-omap.c:788:6: warning:
 symbol 'sdhci_omap_reset' was not declared. Should it be static?

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Faiz Abbas <faiz_abbas@ti.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
b77544280c mmc: tegra: fix CQE enable and resume sequence
Tegra CQHCI/SDHCI design prevents write access to SDHCI block size
register when CQE is enabled and unhalted.

CQHCI driver enables CQE prior to invoking sdhci_cqe_enable which
violates this Tegra specific host requirement.

This patch fixes this by configuring sdhci block registers prior
to CQE unhalt.

This patch also has a fix for retry of unhalt due to known Tegra
specific CQE resume bug where first unhalt might not succeed when
clear all tasks is performed prior to resume and need a second unhalt.

This patch also includes CQE enable fix for CMD CRC errors that
happen with the specific sandisk emmc device when status command
is sent during the transfer of last data block due to marginal timing.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
688956440e mmc: cqhci: add CQHCI_SSC1 register CBC field mask
This patch adds define for CBC field mask of the register
CQHCI_SSC1.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
c6e7ab9092 mmc: tegra: add Tegra186 WAR for CQE
Tegra186 CQHCI host has a known bug where CQHCI controller selects
DATA_PRESENT_SELECT bit to 1 for DCMDs with R1B response type and
since DCMD does not trigger any data transfer, DCMD task complete
happens leaving the DATA FSM of host controller in wait state for
the data.

This effects the data transfer tasks issued after the DCMDs with
R1b response type resulting in timeout.

SW WAR is to set CMD_TIMING to 1 in DCMD task descriptor. This bug
and SW WAR is applicable only for Tegra186 and not for Tegra194.

This patch implements this WAR thru NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING
for Tegra186 and also implements update_dcmd_desc of cqhci_host_ops
interface to set CMD_TIMING bit depending on the NVQUIRK.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Ritesh Harjani <riteshh@codeaurora.org>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
c46d089aa7 mmc: cqhci: allow hosts to update dcmd cmd desc
This patch adds update_dcmd_desc interface to cqhci_host_ops to
allow hosts to update any of the DCMD task descriptor attributes
and parameters.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Ritesh Harjani <riteshh@codeaurora.org>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
ad64a7908c dt-bindings: mmc: tegra: document Tegra194 compatible string
SDHCI controller of Tegra194 is similar to SDHCI controller in Tegra186.
This patch documents Tegra194 sdhci compatible string.

Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
ea8fc5953e mmc: tegra: update hw tuning process
This patch includes below HW tuning related fixes.
    configures tuning parameters as per Tegra TRM
    WAR fix for manual tap change
    HW auto-tuning post process

As per Tegra TRM, SDR50 mode tuning execution takes upto maximum
of 256 tuning iterations and SDR104/HS200/HS400 modes tuning
execution takes upto maximum of 128 tuning iterations.

This patch programs tuning control register with maximum tuning
iterations needed based on the timing along with the start tap,
multiplier, and step size used by the HW tuning.

Tegra210 has a known issue of glitch on trimmer output when the
tap value is changed with the trimmer input clock running and the
WAR is to disable card clock before sending tuning command and
after sending tuning command wait for 1usec and issue SW reset
followed by enabling card clock.

This WAR is applicable when changing tap value manually as well.
Tegra SDHCI driver has this implemented correctly for manual tap
change but missing SW reset before enabling card clock during
sending tuning command.

Issuing SW reset during tuning command as a part of WAR and is
applicable in cases where tuning is performed with single step size
for more iterations. This patch includes this fix.

HW auto-tuning finds the best largest passing window and sets the
tap at the middle of the window. With some devices like sandisk
eMMC driving fast edges and due to high tap to tap delay in the
Tegra chipset, auto-tuning does not detect falling tap between the
valid windows resulting in a parital window or a merged window and
the best tap is set at the signal transition which is actually the
worst tap location.

Recommended SW solution is to detect if the best passing window
picked by the HW tuning is a partial or a merged window based on
min and max tap delays found from chip characterization across
PVT and perform tuning correction to pick the best tap.

This patch has implementation of this post HW tuning process for
the tegra hosts that support HW tuning through the callback function
tegra_sdhci_execute_hw_tuning and uses the tuned tap delay.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
1d8cd065f7 mmc: sdhci: allow host to specify maximum tuning loops
As per the Host Controller Standard Specification Version 4.20,
limitation of tuning iteration count is removed as PLL locking
time can be longer than UHS-1 tuning due to larger PVT fluctuation
and it will result in increase of tuning iteration to complete the
tuning.

This patch creates sdhci_host member tuning_loop_count to allow
hosts to specify maximum tuning iterations and also updates
execute_tuning to use this specified maximum tuning iteration count.

Default tuning_loop_count is set to same as existing loop count of
MAX_TUNING_LOOP which is 40 iterations.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Sowjanya Komatineni
92cd1667d5 mmc: tegra: fix ddr signaling for non-ddr modes
ddr_signaling is set to true for DDR50 and DDR52 modes but is
not set back to false for other modes. This programs incorrect
host clock when mode change happens from DDR52/DDR50 to other
SDR or HS modes like incase of mmc_retune where it switches
from HS400 to HS DDR and then from HS DDR to HS mode and then
to HS200.

This patch fixes the ddr_signaling to set properly for non DDR
modes.

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Cc: stable@vger.kernel.org # v4.20 +
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Fabien Parent
89822b7354 mmc: mtk-sd: add support for MT8516
Add the MSDC configuration for the MT8516 SoC.

Signed-off-by: Fabien Parent <fparent@baylibre.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Wolfram Sang
91ecbe50b6 mmc: renesas_sdhi: set CBSY flag before probing TMIO host
The CBSY flag should be proper before calling tmio_mmc_host_probe()
because this function will already use write16 which checks this bit.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Wolfram Sang
2a55c1eac7 mmc: renesas_sdhi: prevent overflow for max_req_size
max_req_size is calculated by 'max_blk_size * max_blk_count' in the TMIO
core. So, specifying U32_MAX as max_blk_count will overflow this
calculation. It will cause no harm in practice because the immense high
number will overflow into another immense high number. However, it is
not good coding practice, so calculate max_blk_count so that
max_req_size will fit into unsigned int on ARM32/64.

Thanks to the Renesas BSP team for the bug report!

Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Wolfram Sang
609e5fba56 mmc: tmio: introduce macro for max block size
We will need it later for other calculations.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Wolfram Sang
f49bdcde0a mmc: renesas_sdhi: update copyright information
Mostly year updates, but one addition as well.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Reviewed-by: Niklas Söderlund <niklas.soderlund@ragnatech.se>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Stefan Wahren
8dcf48e5f4 mmc: mxs-mmc: Enable MMC_CAP_ERASE
According to the i.MX23/28 reference manuals both mmc interfaces support
the MMC_ERASE command. So enable this capability in the driver to allow
erase/discard/trim requests.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Kangjie Lu
611025983b mmc_spi: add a status check for spi_sync_locked
In case spi_sync_locked fails, the fix reports the error and
returns the error code upstream.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yangbo Lu
1f1929f3f2 mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data
For some controllers, in Present State Register, Data Line
Active bit is not reliable for commands (such as CMD6, CMD7,
CMD12, CMD28, CMD29, or CMD38) with busy signal. DLA affects
Command with Data Inhibit bit. Therefore, software driver
may not know the busy status in DLA/CDIHB.

Futunately MMC core driver has already polled card status
with CMD13 after sending any command with busy signal. So
we can just ignore CDIHB never released issue for such
controllers. This patch is to add a quirk to handle this.

Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yinbo Zhu
b214fe592a mmc: sdhci-of-esdhc: add erratum eSDHC7 support
Invalid Transfer Complete (IRQSTAT[TC]) bit could be set during
multi-write operation even when the BLK_CNT in BLKATTR register
has not reached zero. Therefore, Transfer Complete might be
reported twice due to this erratum since a valid Transfer Complete
occurs when BLK_CNT reaches zero. This erratum is to fix this issue

Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yinbo Zhu
5dd1955225 mmc: sdhci-of-esdhc: add erratum A-009204 support
In the event of that any data error (like, IRQSTAT[DCE]) occurs
during an eSDHC data transaction where DMA is used for data
transfer to/from the system memory, setting the SYSCTL[RSTD]
register may cause a system hang. If software sets the register
SYSCTL[RSTD] to 1 for error recovery while DMA transferring is
not complete, eSDHC may hang the system bus. This happens because
the software register SYSCTL[RSTD] resets the DMA engine without
waiting for the completion of pending system transactions. This
erratum is to fix this issue.

Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yinbo Zhu
05cb6b2a66 mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
eSDHC-A001: The data timeout counter (SYSCTL[DTOCV]) is not
reliable for DTOCV values 0x4(2^17 SD clock), 0x8(2^21 SD clock),
and 0xC(2^25 SD clock). The data timeout counter can count from
2^13–2^27, but for values 2^17, 2^21, and 2^25, the timeout
counter counts for only 2^13 SD clocks.
A-008358: The data timeout counter value loaded into the timeout
counter is less than expected and can result into early timeout
error in case of eSDHC data transactions. The table below shows
the expected vs actual timeout period for different values of
SYSCTL[DTOCV]:
these two erratum has the same quirk to control it, and set
SDHCI_QUIRK_RESET_AFTER_REQUEST to fix above issue.

Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yinbo Zhu
a46e427125 mmc: sdhci-of-esdhc: add erratum eSDHC5 support
Software writing to the Transfer Type configuration register
(system clock domain) can cause a setup/hold violation in the
CRC flops (card clock domain), which can cause write accesses
to be sent with corrupt CRC values. This issue occurs only for
write preceded by read. this erratum is to fix this issue.

Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Yinbo Zhu
8e9a691993 mmc: sdhci-of-esdhc: add erratum A011334 support in lx2160 2.0 SoC
This patch is to add erratum A011334 support in lx2160 2.0 SoC

Signed-off-by: Yinbo Zhu <yinbo.zhu@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Enrico Weigelt, metux IT consult
6f549034bb mmc: host: Pedantic cleanups to Kconfig
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
71953e0e79 mmc: mmci: Make mmci_variant_init() static
As mmci_variant_init() is a local function to mmci.c, let's convert it into
static.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
62e546be6d mmc: mmci: Share sdmmc_variant_init() via the common header file
It's good practice to share functions via header files, rather than from
the c-files. Therefore, let's move sdmmc_variant_init() to mmci.h.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Ludovic Barre <ludovic.barre@st.com>
Tested-by: Ludovic Barre <ludovic.barre@st.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
f7f3e7dac8 mmc: mmci: Drop qcom specific header file
It seems a bit silly to have a header file to share only the
qcom_variant_init() function. So, let's just drop it and move the
declaration of the function into the common mmci.h instead.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
ea27c95a7a mmc: mmci: Re-work code starting DMA for the qcom variant
Having mmci_dmae_start() to invoke the shared function, dml_start_xfer(),
explicitly for the qcom variant isn't very nice. Let's clean up this code
by moving the qcom specific parts into the qcom ->dma_start() callback and
then drop dml_start_xfer() altogether.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
c21aa7a804 mmc: mmci: Drop unnecessary clear of variant->qcom_dml flag
There's no point clearing the variant flag in case the qcom variant fails
to setup DMA. This is because if mmci_dma_setup() fails, then the use_dma
flag remains set to false, which leads to mmci using PIO mode and not DMA.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Ulf Hansson
6aa35ce743 mmc: mmci: Don't share un-implemented DMA functions
Some of the DMA functions are shared via mmci.h, however they are not
implemented unless CONFIG_DMA_ENGINE is set. Therefore, add that constraint
to the header file as well.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
2019-04-15 11:55:54 +02:00
Linus Torvalds
dc4060a5dc Linux 5.1-rc5 2019-04-14 15:17:41 -07:00
Linus Torvalds
6b3a707736 Merge branch 'page-refs' (page ref overflow)
Merge page ref overflow branch.

Jann Horn reported that he can overflow the page ref count with
sufficient memory (and a filesystem that is intentionally extremely
slow).

Admittedly it's not exactly easy.  To have more than four billion
references to a page requires a minimum of 32GB of kernel memory just
for the pointers to the pages, much less any metadata to keep track of
those pointers.  Jann needed a total of 140GB of memory and a specially
crafted filesystem that leaves all reads pending (in order to not ever
free the page references and just keep adding more).

Still, we have a fairly straightforward way to limit the two obvious
user-controllable sources of page references: direct-IO like page
references gotten through get_user_pages(), and the splice pipe page
duplication.  So let's just do that.

* branch page-refs:
  fs: prevent page refcount overflow in pipe_buf_get
  mm: prevent get_user_pages() from overflowing page refcount
  mm: add 'try_get_page()' helper function
  mm: make page ref count overflow check tighter and more explicit
2019-04-14 15:09:40 -07:00
Matthew Wilcox
15fab63e1e fs: prevent page refcount overflow in pipe_buf_get
Change pipe_buf_get() to return a bool indicating whether it succeeded
in raising the refcount of the page (if the thing in the pipe is a page).
This removes another mechanism for overflowing the page refcount.  All
callers converted to handle a failure.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Matthew Wilcox <willy@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-04-14 10:00:04 -07:00
Linus Torvalds
8fde12ca79 mm: prevent get_user_pages() from overflowing page refcount
If the page refcount wraps around past zero, it will be freed while
there are still four billion references to it.  One of the possible
avenues for an attacker to try to make this happen is by doing direct IO
on a page multiple times.  This patch makes get_user_pages() refuse to
take a new page reference if there are already more than two billion
references to the page.

Reported-by: Jann Horn <jannh@google.com>
Acked-by: Matthew Wilcox <willy@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-04-14 10:00:04 -07:00
Linus Torvalds
88b1a17dfc mm: add 'try_get_page()' helper function
This is the same as the traditional 'get_page()' function, but instead
of unconditionally incrementing the reference count of the page, it only
does so if the count was "safe".  It returns whether the reference count
was incremented (and is marked __must_check, since the caller obviously
has to be aware of it).

Also like 'get_page()', you can't use this function unless you already
had a reference to the page.  The intent is that you can use this
exactly like get_page(), but in situations where you want to limit the
maximum reference count.

The code currently does an unconditional WARN_ON_ONCE() if we ever hit
the reference count issues (either zero or negative), as a notification
that the conditional non-increment actually happened.

NOTE! The count access for the "safety" check is inherently racy, but
that doesn't matter since the buffer we use is basically half the range
of the reference count (ie we look at the sign of the count).

Acked-by: Matthew Wilcox <willy@infradead.org>
Cc: Jann Horn <jannh@google.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-04-14 10:00:04 -07:00
Linus Torvalds
f958d7b528 mm: make page ref count overflow check tighter and more explicit
We have a VM_BUG_ON() to check that the page reference count doesn't
underflow (or get close to overflow) by checking the sign of the count.

That's all fine, but we actually want to allow people to use a "get page
ref unless it's already very high" helper function, and we want that one
to use the sign of the page ref (without triggering this VM_BUG_ON).

Change the VM_BUG_ON to only check for small underflows (or _very_ close
to overflowing), and ignore overflows which have strayed into negative
territory.

Acked-by: Matthew Wilcox <willy@infradead.org>
Cc: Jann Horn <jannh@google.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-04-14 10:00:04 -07:00
Linus Torvalds
4443f8e6ac for-linus-20190412
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAlyw354QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpiMyEAC4THUReCrTuv9oFRNg5uILVYIq51nP8dw7
 XamC7A92jPXd6vl/QVjmvLwT34/Y2XvX0t62RBsk849CEjgGYTeF1/qI3tMkpN7c
 huupab3aYM/Rrv4i1KSPQu6iIto3DYqfmREaGJJ1Ikbu/CKDuUGyEo+Z4wrKUPon
 GWnE8QMS2fdc764eVzKKqB+GryaEiHmeD1N4NnPs+nla14ysueUvJUikkTt/Laef
 h7nOmz9mrqE6u1xVHNpo0TlW0oJdLfaDIL9ghwHFJXqvriTh8Tg2tEHpXI6vSTTt
 StnPbTA1s1uhHs4rWYl8J0UXSZnRRp0Ep8jCvqEb9CJ23uHCNyGEoy/R7q+x2quf
 T+ruolMXY7IIJP30ZMHar374YfajJdw7EH/565nlbLnjSBXhqjmc07kQ7mIYvpg6
 JgureSdDwOOHpfrJgVq5es48ndt5HBYUBPzkvVGTgkeSJkMydkkM1qZeYEnai105
 8EnUFusRUnYZtb73HBPjKS7i0BZZvZlI1oKYHabiMtajqcKyvwDP2tTmhqXYLDLY
 9uloW0u2B0lddfzCb9hTYZOroNWfifo4vuSU5DHvnJoKvf4z3auDxaFD9N8fGn6S
 aZsRjMCpFqFd0YEnZPbsctgPg2Licrs02uPntlzBTJ0ByH20pX4OepYrvgQk3vao
 tOQ1jRYMKw==
 =cISy
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-20190412' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:
 "Set of fixes that should go into this round. This pull is larger than
  I'd like at this time, but there's really no specific reason for that.
  Some are fixes for issues that went into this merge window, others are
  not. Anyway, this contains:

   - Hardware queue limiting for virtio-blk/scsi (Dongli)

   - Multi-page bvec fixes for lightnvm pblk

   - Multi-bio dio error fix (Jason)

   - Remove the cache hint from the io_uring tool side, since we didn't
     move forward with that (me)

   - Make io_uring SETUP_SQPOLL root restricted (me)

   - Fix leak of page in error handling for pc requests (Jérôme)

   - Fix BFQ regression introduced in this merge window (Paolo)

   - Fix break logic for bio segment iteration (Ming)

   - Fix NVMe cancel request error handling (Ming)

   - NVMe pull request with two fixes (Christoph):
       - fix the initial CSN for nvme-fc (James)
       - handle log page offsets properly in the target (Keith)"

* tag 'for-linus-20190412' of git://git.kernel.dk/linux-block:
  block: fix the return errno for direct IO
  nvmet: fix discover log page when offsets are used
  nvme-fc: correct csn initialization and increments on error
  block: do not leak memory in bio_copy_user_iov()
  lightnvm: pblk: fix crash in pblk_end_partial_read due to multipage bvecs
  nvme: cancel request synchronously
  blk-mq: introduce blk_mq_complete_request_sync()
  scsi: virtio_scsi: limit number of hw queues by nr_cpu_ids
  virtio-blk: limit number of hw queues by nr_cpu_ids
  block, bfq: fix use after free in bfq_bfqq_expire
  io_uring: restrict IORING_SETUP_SQPOLL to root
  tools/io_uring: remove IOCQE_FLAG_CACHEHIT
  block: don't use for-inside-for in bio_for_each_segment_all
2019-04-13 16:23:16 -07:00