/* * USB Peripheral Controller driver for Aeroflex Gaisler GRUSBDC. * * 2013 (c) Aeroflex Gaisler AB * * This driver supports GRUSBDC USB Device Controller cores available in the * GRLIB VHDL IP core library. * * Full documentation of the GRUSBDC core can be found here: * http://www.gaisler.com/products/grlib/grip.pdf * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation; either version 2 of the License, or (at your * option) any later version. * * Contributors: * - Andreas Larsson * - Marko Isomaki */ /* Control registers on the AMBA bus */ #define GR_MAXEP 16 /* Max # endpoints for *each* direction */ struct gr_epregs { u32 epctrl; union { struct { /* Slave mode*/ u32 slvctrl; u32 slvdata; }; struct { /* DMA mode*/ u32 dmactrl; u32 dmaaddr; }; }; u32 epstat; }; struct gr_regs { struct gr_epregs epo[GR_MAXEP]; /* 0x000 - 0x0fc */ struct gr_epregs epi[GR_MAXEP]; /* 0x100 - 0x1fc */ u32 control; /* 0x200 */ u32 status; /* 0x204 */ }; #define GR_EPCTRL_BUFSZ_SCALER 8 #define GR_EPCTRL_BUFSZ_MASK 0xffe00000 #define GR_EPCTRL_BUFSZ_POS 21 #define GR_EPCTRL_PI BIT(20) #define GR_EPCTRL_CB BIT(19) #define GR_EPCTRL_CS BIT(18) #define GR_EPCTRL_MAXPL_MASK 0x0003ff80 #define GR_EPCTRL_MAXPL_POS 7 #define GR_EPCTRL_NT_MASK 0x00000060 #define GR_EPCTRL_NT_POS 5 #define GR_EPCTRL_TT_MASK 0x00000018 #define GR_EPCTRL_TT_POS 3 #define GR_EPCTRL_EH BIT(2) #define GR_EPCTRL_ED BIT(1) #define GR_EPCTRL_EV BIT(0) #define GR_DMACTRL_AE BIT(10) #define GR_DMACTRL_AD BIT(3) #define GR_DMACTRL_AI BIT(2) #define GR_DMACTRL_IE BIT(1) #define GR_DMACTRL_DA BIT(0) #define GR_EPSTAT_PT BIT(29) #define GR_EPSTAT_PR BIT(29) #define GR_EPSTAT_B1CNT_MASK 0x1fff0000 #define GR_EPSTAT_B1CNT_POS 16 #define GR_EPSTAT_B0CNT_MASK 0x0000fff8 #define GR_EPSTAT_B0CNT_POS 3 #define GR_EPSTAT_B1 BIT(2) #define GR_EPSTAT_B0 BIT(1) #define GR_EPSTAT_BS BIT(0) #define GR_CONTROL_SI BIT(31) #define GR_CONTROL_UI BIT(30) #define GR_CONTROL_VI BIT(29) #define GR_CONTROL_SP BIT(28) #define GR_CONTROL_FI BIT(27) #define GR_CONTROL_EP BIT(14) #define GR_CONTROL_DH BIT(13) #define GR_CONTROL_RW BIT(12) #define GR_CONTROL_TS_MASK 0x00000e00 #define GR_CONTROL_TS_POS 9 #define GR_CONTROL_TM BIT(8) #define GR_CONTROL_UA_MASK 0x000000fe #define GR_CONTROL_UA_POS 1 #define GR_CONTROL_SU BIT(0) #define GR_STATUS_NEPI_MASK 0xf0000000 #define GR_STATUS_NEPI_POS 28 #define GR_STATUS_NEPO_MASK 0x0f000000 #define GR_STATUS_NEPO_POS 24 #define GR_STATUS_DM BIT(23) #define GR_STATUS_SU BIT(17) #define GR_STATUS_UR BIT(16) #define GR_STATUS_VB BIT(15) #define GR_STATUS_SP BIT(14) #define GR_STATUS_AF_MASK 0x00003800 #define GR_STATUS_AF_POS 11 #define GR_STATUS_FN_MASK 0x000007ff #define GR_STATUS_FN_POS 0 #define MAX_CTRL_PL_SIZE 64 /* As per USB standard for full and high speed */ /*-------------------------------------------------------------------------*/ /* Driver data structures and utilities */ struct gr_dma_desc { u32 ctrl; u32 data; u32 next; /* These must be last because hw uses the previous three */ u32 paddr; struct gr_dma_desc *next_desc; }; #define GR_DESC_OUT_CTRL_SE BIT(17) #define GR_DESC_OUT_CTRL_IE BIT(15) #define GR_DESC_OUT_CTRL_NX BIT(14) #define GR_DESC_OUT_CTRL_EN BIT(13) #define GR_DESC_OUT_CTRL_LEN_MASK 0x00001fff #define GR_DESC_IN_CTRL_MO BIT(18) #define GR_DESC_IN_CTRL_PI BIT(17) #define GR_DESC_IN_CTRL_ML BIT(16) #define GR_DESC_IN_CTRL_IE BIT(15) #define GR_DESC_IN_CTRL_NX BIT(14) #define GR_DESC_IN_CTRL_EN BIT(13) #define GR_DESC_IN_CTRL_LEN_MASK 0x00001fff #define GR_DESC_DMAADDR_MASK 0xfffffffc struct gr_ep { struct usb_ep ep; struct gr_udc *dev; u16 bytes_per_buffer; unsigned int dma_start; struct gr_epregs __iomem *regs; unsigned num:8; unsigned is_in:1; unsigned stopped:1; unsigned wedged:1; unsigned callback:1; /* analogous to a host-side qh */ struct list_head queue; struct list_head ep_list; /* Bounce buffer for end of "odd" sized OUT requests */ void *tailbuf; dma_addr_t tailbuf_paddr; }; struct gr_request { struct usb_request req; struct list_head queue; /* Chain of dma descriptors */ struct gr_dma_desc *first_desc; /* First in the chain */ struct gr_dma_desc *curr_desc; /* Current descriptor */ struct gr_dma_desc *last_desc; /* Last in the chain */ u16 evenlen; /* Size of even length head (if oddlen != 0) */ u16 oddlen; /* Size of odd length tail if buffer length is "odd" */ u8 setup; /* Setup packet */ }; enum gr_ep0state { GR_EP0_DISCONNECT = 0, /* No host */ GR_EP0_SETUP, /* Between STATUS ack and SETUP report */ GR_EP0_IDATA, /* IN data stage */ GR_EP0_ODATA, /* OUT data stage */ GR_EP0_ISTATUS, /* Status stage after IN data stage */ GR_EP0_OSTATUS, /* Status stage after OUT data stage */ GR_EP0_STALL, /* Data or status stages */ GR_EP0_SUSPEND, /* USB suspend */ }; struct gr_udc { struct usb_gadget gadget; struct gr_ep epi[GR_MAXEP]; struct gr_ep epo[GR_MAXEP]; struct usb_gadget_driver *driver; struct dma_pool *desc_pool; struct device *dev; enum gr_ep0state ep0state; struct gr_request *ep0reqo; struct gr_request *ep0reqi; struct gr_regs __iomem *regs; int irq; int irqi; int irqo; unsigned added:1; unsigned irq_enabled:1; unsigned remote_wakeup:1; u8 test_mode; enum usb_device_state suspended_from; unsigned int nepi; unsigned int nepo; struct list_head ep_list; spinlock_t lock; /* General lock, a.k.a. "dev->lock" in comments */ struct dentry *dfs_root; struct dentry *dfs_state; }; #define to_gr_udc(gadget) (container_of((gadget), struct gr_udc, gadget)) ss='oid'>0c1a8bc700c3c219c45ca05dbc5ce3df6be89813 /drivers/usb/dwc3/Makefile parentd5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c (diff)
mmc: mmci: avoid clearing ST Micro busy end interrupt mistakenly
This fixes a race condition that may occur whenever ST micro busy end interrupt is raised just after being unmasked but before leaving mmci interrupt context. A dead-lock has been found if connecting mmci ST Micro variant whose amba id is 0x10480180 to some new eMMC that supports internal caches. Whenever mmci driver enables cache control by programming eMMC's EXT_CSD register, block driver may request to flush the eMMC internal caches causing mmci driver to send a MMC_SWITCH command to the card with FLUSH_CACHE operation. And because busy end interrupt may be mistakenly cleared while not yet processed, this mmc request may never complete. As a result, mmcqd task may be stuck forever. Here is an instance caught by lockup detector which shows that mmcqd task was hung while waiting for mmc_flush_cache command to complete: .. [ 240.251595] INFO: task mmcqd/1:52 blocked for more than 120 seconds. [ 240.257973] Not tainted 4.1.13-00510-g9d91424 #2 [ 240.263109] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 240.270955] mmcqd/1 D c047504c 0 52 2 0x00000000 [ 240.277359] [<c047504c>] (__schedule) from [<c04754a0>] (schedule+0x40/0x98) [ 240.284418] [<c04754a0>] (schedule) from [<c0477d40>] (schedule_timeout+0x148/0x188) [ 240.292191] [<c0477d40>] (schedule_timeout) from [<c0476040>] (wait_for_common+0xa4/0x170) [ 240.300491] [<c0476040>] (wait_for_common) from [<c02efc1c>] (mmc_wait_for_req_done+0x4c/0x13c) [ 240.309224] [<c02efc1c>] (mmc_wait_for_req_done) from [<c02efd90>] (mmc_wait_for_cmd+0x64/0x84) [ 240.317953] [<c02efd90>] (mmc_wait_for_cmd) from [<c02f5b14>] (__mmc_switch+0xa4/0x2a8) [ 240.325964] [<c02f5b14>] (__mmc_switch) from [<c02f5d40>] (mmc_switch+0x28/0x30) [ 240.333389] [<c02f5d40>] (mmc_switch) from [<c02f0984>] (mmc_flush_cache+0x54/0x80) [ 240.341073] [<c02f0984>] (mmc_flush_cache) from [<c02ff0c4>] (mmc_blk_issue_rq+0x114/0x4e8) [ 240.349459] [<c02ff0c4>] (mmc_blk_issue_rq) from [<c03008d4>] (mmc_queue_thread+0xc0/0x180) [ 240.357844] [<c03008d4>] (mmc_queue_thread) from [<c003cf90>] (kthread+0xdc/0xf4) [ 240.365339] [<c003cf90>] (kthread) from [<c0010068>] (ret_from_fork+0x14/0x2c) .. .. [ 240.664311] INFO: task partprobe:564 blocked for more than 120 seconds. [ 240.670943] Not tainted 4.1.13-00510-g9d91424 #2 [ 240.676078] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 240.683922] partprobe D c047504c 0 564 486 0x00000000 [ 240.690318] [<c047504c>] (__schedule) from [<c04754a0>] (schedule+0x40/0x98) [ 240.697396] [<c04754a0>] (schedule) from [<c0477d40>] (schedule_timeout+0x148/0x188) [ 240.705149] [<c0477d40>] (schedule_timeout) from [<c0476040>] (wait_for_common+0xa4/0x170) [ 240.713446] [<c0476040>] (wait_for_common) from [<c01f3300>] (submit_bio_wait+0x58/0x64) [ 240.721571] [<c01f3300>] (submit_bio_wait) from [<c01fbbd8>] (blkdev_issue_flush+0x60/0x88) [ 240.729957] [<c01fbbd8>] (blkdev_issue_flush) from [<c010ff84>] (blkdev_fsync+0x34/0x44) [ 240.738083] [<c010ff84>] (blkdev_fsync) from [<c0109594>] (do_fsync+0x3c/0x64) [ 240.745319] [<c0109594>] (do_fsync) from [<c000ffc0>] (ret_fast_syscall+0x0/0x3c) .. Here is the detailed sequence showing when this issue may happen: 1) At probe time, mmci device is initialized and card busy detection based on DAT[0] monitoring is enabled. 2) Later during run time, since card reported to support internal caches, a MMCI_SWITCH command is sent to eMMC device with FLUSH_CACHE operation. On receiving this command, eMMC may enter busy state (for a relatively short time in the case of the dead-lock). 3) Then mmci interrupt is raised and mmci_irq() is called: MMCISTATUS register is read and is equal to 0x01000440. So the following status bits are set: - MCI_CMDRESPEND (= 6) - MCI_DATABLOCKEND (= 10) - MCI_ST_CARDBUSY (= 24) Since MMCIMASK0 register is 0x3FF, status variable is set to 0x00000040 and BIT MCI_CMDRESPEND is cleared by writing MMCICLEAR register. Then mmci_cmd_irq() is called. Considering the following conditions: - host->busy_status is 0, - this is a "busy response", - reading again MMCISTATUS register gives 0x1000400, MMCIMASK0 is updated to unmask MCI_ST_BUSYEND bit. Thus, MMCIMASK0 is set to 0x010003FF and host->busy_status is set to wait for busy end completion. Back again in status loop of mmci_irq(), we quickly go through mmci_data_irq() as there are no data in that case. And we finally go through following test at the end of while(status) loop: /* * Don't poll for busy completion in irq context. */ if (host->variant->busy_detect && host->busy_status) status &= ~host->variant->busy_detect_flag; Because status variable is not yet null (is equal to 0x40), we do not leave interrupt context yet but we loop again into while(status) loop. So we run across following steps: a) MMCISTATUS register is read again and this time is equal to 0x01000400. So that following bits are set: - MCI_DATABLOCKEND (= 10) - MCI_ST_CARDBUSY (= 24) Since MMCIMASK0 register is equal to 0x010003FF: b) status variable is set to 0x01000000. c) MCI_ST_CARDBUSY bit is cleared by writing MMCICLEAR register. Then, mmci_cmd_irq() is called one more time. Since host->busy_status is set and that MCI_ST_CARDBUSY is set in status variable, we just return from this function. Back again in mmci_irq(), status variable is set to 0 and we finally leave the while(status) loop. As a result we leave interrupt context, waiting for busy end interrupt event. Now, consider that busy end completion is raised IN BETWEEN steps 3.a) and 3.c). In such a case, we may mistakenly clear busy end interrupt at step 3.c) while it has not yet been processed. This will result in mmc command to wait forever for a busy end completion that will never happen. To fix the problem, this patch implements the following changes: Considering that the mmci seems to be triggering the IRQ on both edges while monitoring DAT0 for busy completion and that same status bit is used to monitor start and end of busy detection, special care must be taken to make sure that both start and end interrupts are always cleared one after the other. 1) Clearing of card busy bit is moved in mmc_cmd_irq() function where unmasking of busy end bit is effectively handled. 2) Just before unmasking busy end event, busy start event is cleared by writing card busy bit in MMCICLEAR register. 3) Finally, once we are no more busy with a command, busy end event is cleared writing again card busy bit in MMCICLEAR register. This patch has been tested with the ST Accordo5 machine, not yet supported upstream but relies on the mmci driver. Signed-off-by: Sarang Mairal <sarang.mairal@garmin.com> Signed-off-by: Jean-Nicolas Graux <jean-nicolas.graux@st.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Tested-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Diffstat (limited to 'drivers/usb/dwc3/Makefile')