#ifndef __UM_FS_HOSTFS
#define __UM_FS_HOSTFS

#include <os.h>

/*
 * These are exactly the same definitions as in fs.h, but the names are
 * changed so that this file can be included in both kernel and user files.
 */

#define HOSTFS_ATTR_MODE	1
#define HOSTFS_ATTR_UID 	2
#define HOSTFS_ATTR_GID 	4
#define HOSTFS_ATTR_SIZE	8
#define HOSTFS_ATTR_ATIME	16
#define HOSTFS_ATTR_MTIME	32
#define HOSTFS_ATTR_CTIME	64
#define HOSTFS_ATTR_ATIME_SET	128
#define HOSTFS_ATTR_MTIME_SET	256

/* These two are unused by hostfs. */
#define HOSTFS_ATTR_FORCE	512	/* Not a change, but a change it */
#define HOSTFS_ATTR_ATTR_FLAG	1024

/*
 * If you are very careful, you'll notice that these two are missing:
 *
 * #define ATTR_KILL_SUID	2048
 * #define ATTR_KILL_SGID	4096
 *
 * and this is because they were added in 2.5 development.
 * Actually, they are not needed by most ->setattr() methods - they are set by
 * callers of notify_change() to notify that the setuid/setgid bits must be
 * dropped.
 * notify_change() will delete those flags, make sure attr->ia_valid & ATTR_MODE
 * is on, and remove the appropriate bits from attr->ia_mode (attr is a
 * "struct iattr *"). -BlaisorBlade
 */

struct hostfs_iattr {
	unsigned int	ia_valid;
	unsigned short	ia_mode;
	uid_t		ia_uid;
	gid_t		ia_gid;
	loff_t		ia_size;
	struct timespec	ia_atime;
	struct timespec	ia_mtime;
	struct timespec	ia_ctime;
};

struct hostfs_stat {
	unsigned long long ino;
	unsigned int mode;
	unsigned int nlink;
	unsigned int uid;
	unsigned int gid;
	unsigned long long size;
	struct timespec atime, mtime, ctime;
	unsigned int blksize;
	unsigned long long blocks;
	unsigned int maj;
	unsigned int min;
};

extern int stat_file(const char *path, struct hostfs_stat *p, int fd);
extern int access_file(char *path, int r, int w, int x);
extern int open_file(char *path, int r, int w, int append);
extern void *open_dir(char *path, int *err_out);
extern void seek_dir(void *stream, unsigned long long pos);
extern char *read_dir(void *stream, unsigned long long *pos_out,
		      unsigned long long *ino_out, int *len_out,
		      unsigned int *type_out);
extern void close_file(void *stream);
extern int replace_file(int oldfd, int fd);
extern void close_dir(void *stream);
extern int read_file(int fd, unsigned long long *offset, char *buf, int len);
extern int write_file(int fd, unsigned long long *offset, const char *buf,
		      int len);
extern int lseek_file(int fd, long long offset, int whence);
extern int fsync_file(int fd, int datasync);
extern int file_create(char *name, int mode);
extern int set_attr(const char *file, struct hostfs_iattr *attrs, int fd);
extern int make_symlink(const char *from, const char *to);
extern int unlink_file(const char *file);
extern int do_mkdir(const char *file, int mode);
extern int do_rmdir(const char *file);
extern int do_mknod(const char *file, int mode, unsigned int major,
		    unsigned int minor);
extern int link_file(const char *from, const char *to);
extern int hostfs_do_readlink(char *file, char *buf, int size);
extern int rename_file(char *from, char *to);
extern int rename2_file(char *from, char *to, unsigned int flags);
extern int do_statfs(char *root, long *bsize_out, long long *blocks_out,
		     long long *bfree_out, long long *bavail_out,
		     long long *files_out, long long *ffree_out,
		     void *fsid_out, int fsid_size, long *namelen_out);

#endif
ers/usb/musb?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>musb</a>/<a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/musb/ux500.c?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>ux500.c</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='h' value='nds-private-remove'/><input type='hidden' name='id' value='5cad24d835772f9f709971a8d6fcf12afe53b2a7'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Jean-Nicolas Graux &lt;jean-nicolas.graux@st.com&gt;</td><td class='right'>2017-02-07 12:12:41 +0100</td></tr>
<tr><th>committer</th><td>Ulf Hansson &lt;ulf.hansson@linaro.org&gt;</td><td class='right'>2017-02-08 12:22:27 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/musb/ux500.c?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>5cad24d835772f9f709971a8d6fcf12afe53b2a7</a> (<a href='/cgit.cgi/linux/net-next.git/patch/drivers/usb/musb/ux500.c?id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>0c1a8bc700c3c219c45ca05dbc5ce3df6be89813</a> /<a href='/cgit.cgi/linux/net-next.git/tree/drivers/usb/musb/ux500.c?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>drivers/usb/musb/ux500.c</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/drivers/usb/musb/ux500.c?h=nds-private-remove&amp;id=d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c'>d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c</a> (<a href='/cgit.cgi/linux/net-next.git/diff/drivers/usb/musb/ux500.c?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7&amp;id2=d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c'>diff</a>)</td></tr></table>
<div class='commit-subject'>mmc: mmci: avoid clearing ST Micro busy end interrupt mistakenly</div><div class='commit-msg'>This fixes a race condition that may occur whenever ST micro busy end
interrupt is raised just after being unmasked but before leaving mmci
interrupt context.

A dead-lock has been found if connecting mmci ST Micro variant whose amba
id is 0x10480180 to some new eMMC that supports internal caches.  Whenever
mmci driver enables cache control by programming eMMC's EXT_CSD register,
block driver may request to flush the eMMC internal caches causing mmci
driver to send a MMC_SWITCH command to the card with FLUSH_CACHE operation.
And because busy end interrupt may be mistakenly cleared while not yet
processed, this mmc request may never complete.  As a result, mmcqd task
may be stuck forever.

Here is an instance caught by lockup detector which shows that mmcqd task
was hung while waiting for mmc_flush_cache command to complete:

..
[  240.251595] INFO: task mmcqd/1:52 blocked for more than 120 seconds.
[  240.257973]       Not tainted 4.1.13-00510-g9d91424 #2
[  240.263109] "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.270955] mmcqd/1         D c047504c     0    52      2 0x00000000
[  240.277359] [&lt;c047504c&gt;] (__schedule) from [&lt;c04754a0&gt;] (schedule+0x40/0x98)
[  240.284418] [&lt;c04754a0&gt;] (schedule) from [&lt;c0477d40&gt;] (schedule_timeout+0x148/0x188)
[  240.292191] [&lt;c0477d40&gt;] (schedule_timeout) from [&lt;c0476040&gt;] (wait_for_common+0xa4/0x170)
[  240.300491] [&lt;c0476040&gt;] (wait_for_common) from [&lt;c02efc1c&gt;] (mmc_wait_for_req_done+0x4c/0x13c)
[  240.309224] [&lt;c02efc1c&gt;] (mmc_wait_for_req_done) from [&lt;c02efd90&gt;] (mmc_wait_for_cmd+0x64/0x84)
[  240.317953] [&lt;c02efd90&gt;] (mmc_wait_for_cmd) from [&lt;c02f5b14&gt;] (__mmc_switch+0xa4/0x2a8)
[  240.325964] [&lt;c02f5b14&gt;] (__mmc_switch) from [&lt;c02f5d40&gt;] (mmc_switch+0x28/0x30)
[  240.333389] [&lt;c02f5d40&gt;] (mmc_switch) from [&lt;c02f0984&gt;] (mmc_flush_cache+0x54/0x80)
[  240.341073] [&lt;c02f0984&gt;] (mmc_flush_cache) from [&lt;c02ff0c4&gt;] (mmc_blk_issue_rq+0x114/0x4e8)
[  240.349459] [&lt;c02ff0c4&gt;] (mmc_blk_issue_rq) from [&lt;c03008d4&gt;] (mmc_queue_thread+0xc0/0x180)
[  240.357844] [&lt;c03008d4&gt;] (mmc_queue_thread) from [&lt;c003cf90&gt;] (kthread+0xdc/0xf4)
[  240.365339] [&lt;c003cf90&gt;] (kthread) from [&lt;c0010068&gt;] (ret_from_fork+0x14/0x2c)
..
..
[  240.664311] INFO: task partprobe:564 blocked for more than 120 seconds.
[  240.670943]       Not tainted 4.1.13-00510-g9d91424 #2
[  240.676078] "echo 0 &gt; /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.683922] partprobe       D c047504c     0   564    486 0x00000000
[  240.690318] [&lt;c047504c&gt;] (__schedule) from [&lt;c04754a0&gt;] (schedule+0x40/0x98)
[  240.697396] [&lt;c04754a0&gt;] (schedule) from [&lt;c0477d40&gt;] (schedule_timeout+0x148/0x188)
[  240.705149] [&lt;c0477d40&gt;] (schedule_timeout) from [&lt;c0476040&gt;] (wait_for_common+0xa4/0x170)
[  240.713446] [&lt;c0476040&gt;] (wait_for_common) from [&lt;c01f3300&gt;] (submit_bio_wait+0x58/0x64)
[  240.721571] [&lt;c01f3300&gt;] (submit_bio_wait) from [&lt;c01fbbd8&gt;] (blkdev_issue_flush+0x60/0x88)
[  240.729957] [&lt;c01fbbd8&gt;] (blkdev_issue_flush) from [&lt;c010ff84&gt;] (blkdev_fsync+0x34/0x44)
[  240.738083] [&lt;c010ff84&gt;] (blkdev_fsync) from [&lt;c0109594&gt;] (do_fsync+0x3c/0x64)
[  240.745319] [&lt;c0109594&gt;] (do_fsync) from [&lt;c000ffc0&gt;] (ret_fast_syscall+0x0/0x3c)
..

Here is the detailed sequence showing when this issue may happen:

1) At probe time, mmci device is initialized and card busy detection based
on DAT[0] monitoring is enabled.

2) Later during run time, since card reported to support internal caches, a
MMCI_SWITCH command is sent to eMMC device with FLUSH_CACHE operation. On
receiving this command, eMMC may enter busy state (for a relatively short
time in the case of the dead-lock).

3) Then mmci interrupt is raised and mmci_irq() is called:

MMCISTATUS register is read and is equal to 0x01000440. So the following
status bits are set:
- MCI_CMDRESPEND (= 6)
- MCI_DATABLOCKEND (= 10)
- MCI_ST_CARDBUSY (= 24)

Since MMCIMASK0 register is 0x3FF, status variable is set to 0x00000040 and
BIT MCI_CMDRESPEND is cleared by writing MMCICLEAR register.

Then mmci_cmd_irq() is called. Considering the following conditions:
- host-&gt;busy_status is 0,
- this is a "busy response",
- reading again MMCISTATUS register gives 0x1000400,
MMCIMASK0 is updated to unmask MCI_ST_BUSYEND bit.

Thus, MMCIMASK0 is set to 0x010003FF and host-&gt;busy_status is set to wait
for busy end completion.

Back again in status loop of mmci_irq(), we quickly go through
mmci_data_irq() as there are no data in that case.  And we finally go
through following test at the end of while(status) loop:

/*
 * Don't poll for busy completion in irq context.
 */
if (host-&gt;variant-&gt;busy_detect &amp;&amp; host-&gt;busy_status)
	status &amp;= ~host-&gt;variant-&gt;busy_detect_flag;

Because status variable is not yet null (is equal to 0x40), we do not leave
interrupt context yet but we loop again into while(status) loop. So we run
across following steps:

a) MMCISTATUS register is read again and this time is equal to 0x01000400.
So that following bits are set:
- MCI_DATABLOCKEND (= 10)
- MCI_ST_CARDBUSY (= 24)

Since MMCIMASK0 register is equal to 0x010003FF:

b) status variable is set to 0x01000000.
c) MCI_ST_CARDBUSY bit is cleared by writing MMCICLEAR register.

Then, mmci_cmd_irq() is called one more time. Since host-&gt;busy_status is
set and that MCI_ST_CARDBUSY is set in status variable, we just return from
this function.

Back again in mmci_irq(), status variable is set to 0 and we finally leave
the while(status) loop. As a result we leave interrupt context, waiting for
busy end interrupt event.

Now, consider that busy end completion is raised IN BETWEEN steps 3.a) and
3.c). In such a case, we may mistakenly clear busy end interrupt at step
3.c) while it has not yet been processed. This will result in mmc command
to wait forever for a busy end completion that will never happen.

To fix the problem, this patch implements the following changes:

Considering that the mmci seems to be triggering the IRQ on both edges
while monitoring DAT0 for busy completion and that same status bit is used
to monitor start and end of busy detection, special care must be taken to
make sure that both start and end interrupts are always cleared one after
the other.

1) Clearing of card busy bit is moved in mmc_cmd_irq() function where
unmasking of busy end bit is effectively handled.
2) Just before unmasking busy end event, busy start event is cleared by
writing card busy bit in MMCICLEAR register.
3) Finally, once we are no more busy with a command, busy end event is
cleared writing again card busy bit in MMCICLEAR register.

This patch has been tested with the ST Accordo5 machine, not yet supported
upstream but relies on the mmci driver.

Signed-off-by: Sarang Mairal &lt;sarang.mairal@garmin.com&gt;
Signed-off-by: Jean-Nicolas Graux &lt;jean-nicolas.graux@st.com&gt;
Reviewed-by: Linus Walleij &lt;linus.walleij@linaro.org&gt;
Tested-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&amp;id=5cad24d835772f9f709971a8d6fcf12afe53b2a7'>Diffstat</a> (limited to 'drivers/usb/musb/ux500.c')</div><table summary='diffstat' class='diffstat'>