#include #include #include "utils.h" #include "subunit.h" #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ #define cpu_to_be32(x) bswap_32(x) #define be32_to_cpu(x) bswap_32(x) #define be16_to_cpup(x) bswap_16(*x) #define cpu_to_be64(x) bswap_64(x) #else #define cpu_to_be32(x) (x) #define be32_to_cpu(x) (x) #define be16_to_cpup(x) (*x) #define cpu_to_be64(x) (x) #endif #include "vphn.c" static struct test { char *descr; long input[VPHN_REGISTER_COUNT]; u32 expected[VPHN_ASSOC_BUFSIZE]; } all_tests[] = { { "vphn: no data", { 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000000 } }, { "vphn: 1 x 16-bit value", { 0x8001ffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000001, 0x00000001 } }, { "vphn: 2 x 16-bit values", { 0x80018002ffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000002, 0x00000001, 0x00000002 } }, { "vphn: 3 x 16-bit values", { 0x800180028003ffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000003, 0x00000001, 0x00000002, 0x00000003 } }, { "vphn: 4 x 16-bit values", { 0x8001800280038004, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000004, 0x00000001, 0x00000002, 0x00000003, 0x00000004 } }, { /* Parsing the next 16-bit value out of the next 64-bit input * value. */ "vphn: 5 x 16-bit values", { 0x8001800280038004, 0x8005ffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, }, { 0x00000005, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005 } }, { /* Parse at most 6 x 64-bit input values */ "vphn: 24 x 16-bit values", { 0x8001800280038004, 0x8005800680078008, 0x8009800a800b800c, 0x800d800e800f8010, 0x8011801280138014, 0x8015801680178018 }, { 0x00000018, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c, 0x0000000d, 0x0000000e, 0x0000000f, 0x00000010, 0x00000011, 0x00000012, 0x00000013, 0x00000014, 0x00000015, 0x00000016, 0x00000017, 0x00000018 } }, { "vphn: 1 x 32-bit value", { 0x00000001ffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000001, 0x00000001 } }, { "vphn: 2 x 32-bit values", { 0x0000000100000002, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000002, 0x00000001, 0x00000002 } }, { /* Parsing the next 32-bit value out of the next 64-bit input * value. */ "vphn: 3 x 32-bit values", { 0x0000000100000002, 0x00000003ffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000003, 0x00000001, 0x00000002, 0x00000003 } }, { /* Parse at most 6 x 64-bit input values */ "vphn: 12 x 32-bit values", { 0x0000000100000002, 0x0000000300000004, 0x0000000500000006, 0x0000000700000008, 0x000000090000000a, 0x0000000b0000000c }, { 0x0000000c, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c } }, { "vphn: 16-bit value followed by 32-bit value", { 0x800100000002ffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000002, 0x00000001, 0x00000002 } }, { "vphn: 32-bit value followed by 16-bit value", { 0x000000018002ffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000002, 0x00000001, 0x00000002 } }, { /* Parse a 32-bit value split accross two consecutives 64-bit * input values. */ "vphn: 16-bit value followed by 2 x 32-bit values", { 0x8001000000020000, 0x0003ffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000003, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005 } }, { /* The lower bits in 0x0001ffff don't get mixed up with the * 0xffff terminator. */ "vphn: 32-bit value has all ones in 16 lower bits", { 0x0001ffff80028003, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff }, { 0x00000003, 0x0001ffff, 0x00000002, 0x00000003 } }, { /* The following input doesn't follow the specification. */ "vphn: last 32-bit value is truncated", { 0x0000000100000002, 0x0000000300000004, 0x0000000500000006, 0x0000000700000008, 0x000000090000000a, 0x0000000b800c2bad }, { 0x0000000c, 0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000006, 0x00000007, 0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c } }, { "vphn: garbage after terminator", { 0xffff2bad2bad2bad, 0x2bad2bad2bad2bad, 0x2bad2bad2bad2bad, 0x2bad2bad2bad2bad, 0x2bad2bad2bad2bad, 0x2bad2bad2bad2bad }, { 0x00000000 } }, { NULL } }; static int test_one(struct test *test) { __be32 output[VPHN_ASSOC_BUFSIZE] = { 0 }; int i, len; vphn_unpack_associativity(test->input, output); len = be32_to_cpu(output[0]); if (len != test->expected[0]) { printf("expected %d elements, got %d\n", test->expected[0], len); return 1; } for (i = 1; i < len; i++) { u32 val = be32_to_cpu(output[i]); if (val != test->expected[i]) { printf("element #%d is 0x%x, should be 0x%x\n", i, val, test->expected[i]); return 1; } } return 0; } static int test_vphn(void) { static struct test *test; for (test = all_tests; test->descr; test++) { int ret; ret = test_one(test); test_finish(test->descr, ret); if (ret) return ret; } return 0; } int main(int argc, char **argv) { return test_harness(test_vphn, "test-vphn"); } akenly
This fixes a race condition that may occur whenever ST micro busy end interrupt is raised just after being unmasked but before leaving mmci interrupt context. A dead-lock has been found if connecting mmci ST Micro variant whose amba id is 0x10480180 to some new eMMC that supports internal caches. Whenever mmci driver enables cache control by programming eMMC's EXT_CSD register, block driver may request to flush the eMMC internal caches causing mmci driver to send a MMC_SWITCH command to the card with FLUSH_CACHE operation. And because busy end interrupt may be mistakenly cleared while not yet processed, this mmc request may never complete. As a result, mmcqd task may be stuck forever. Here is an instance caught by lockup detector which shows that mmcqd task was hung while waiting for mmc_flush_cache command to complete: .. [ 240.251595] INFO: task mmcqd/1:52 blocked for more than 120 seconds. [ 240.257973] Not tainted 4.1.13-00510-g9d91424 #2 [ 240.263109] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 240.270955] mmcqd/1 D c047504c 0 52 2 0x00000000 [ 240.277359] [<c047504c>] (__schedule) from [<c04754a0>] (schedule+0x40/0x98) [ 240.284418] [<c04754a0>] (schedule) from [<c0477d40>] (schedule_timeout+0x148/0x188) [ 240.292191] [<c0477d40>] (schedule_timeout) from [<c0476040>] (wait_for_common+0xa4/0x170) [ 240.300491] [<c0476040>] (wait_for_common) from [<c02efc1c>] (mmc_wait_for_req_done+0x4c/0x13c) [ 240.309224] [<c02efc1c>] (mmc_wait_for_req_done) from [<c02efd90>] (mmc_wait_for_cmd+0x64/0x84) [ 240.317953] [<c02efd90>] (mmc_wait_for_cmd) from [<c02f5b14>] (__mmc_switch+0xa4/0x2a8) [ 240.325964] [<c02f5b14>] (__mmc_switch) from [<c02f5d40>] (mmc_switch+0x28/0x30) [ 240.333389] [<c02f5d40>] (mmc_switch) from [<c02f0984>] (mmc_flush_cache+0x54/0x80) [ 240.341073] [<c02f0984>] (mmc_flush_cache) from [<c02ff0c4>] (mmc_blk_issue_rq+0x114/0x4e8) [ 240.349459] [<c02ff0c4>] (mmc_blk_issue_rq) from [<c03008d4>] (mmc_queue_thread+0xc0/0x180) [ 240.357844] [<c03008d4>] (mmc_queue_thread) from [<c003cf90>] (kthread+0xdc/0xf4) [ 240.365339] [<c003cf90>] (kthread) from [<c0010068>] (ret_from_fork+0x14/0x2c) .. .. [ 240.664311] INFO: task partprobe:564 blocked for more than 120 seconds. [ 240.670943] Not tainted 4.1.13-00510-g9d91424 #2 [ 240.676078] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 240.683922] partprobe D c047504c 0 564 486 0x00000000 [ 240.690318] [<c047504c>] (__schedule) from [<c04754a0>] (schedule+0x40/0x98) [ 240.697396] [<c04754a0>] (schedule) from [<c0477d40>] (schedule_timeout+0x148/0x188) [ 240.705149] [<c0477d40>] (schedule_timeout) from [<c0476040>] (wait_for_common+0xa4/0x170) [ 240.713446] [<c0476040>] (wait_for_common) from [<c01f3300>] (submit_bio_wait+0x58/0x64) [ 240.721571] [<c01f3300>] (submit_bio_wait) from [<c01fbbd8>] (blkdev_issue_flush+0x60/0x88) [ 240.729957] [<c01fbbd8>] (blkdev_issue_flush) from [<c010ff84>] (blkdev_fsync+0x34/0x44) [ 240.738083] [<c010ff84>] (blkdev_fsync) from [<c0109594>] (do_fsync+0x3c/0x64) [ 240.745319] [<c0109594>] (do_fsync) from [<c000ffc0>] (ret_fast_syscall+0x0/0x3c) .. Here is the detailed sequence showing when this issue may happen: 1) At probe time, mmci device is initialized and card busy detection based on DAT[0] monitoring is enabled. 2) Later during run time, since card reported to support internal caches, a MMCI_SWITCH command is sent to eMMC device with FLUSH_CACHE operation. On receiving this command, eMMC may enter busy state (for a relatively short time in the case of the dead-lock). 3) Then mmci interrupt is raised and mmci_irq() is called: MMCISTATUS register is read and is equal to 0x01000440. So the following status bits are set: - MCI_CMDRESPEND (= 6) - MCI_DATABLOCKEND (= 10) - MCI_ST_CARDBUSY (= 24) Since MMCIMASK0 register is 0x3FF, status variable is set to 0x00000040 and BIT MCI_CMDRESPEND is cleared by writing MMCICLEAR register. Then mmci_cmd_irq() is called. Considering the following conditions: - host->busy_status is 0, - this is a "busy response", - reading again MMCISTATUS register gives 0x1000400, MMCIMASK0 is updated to unmask MCI_ST_BUSYEND bit. Thus, MMCIMASK0 is set to 0x010003FF and host->busy_status is set to wait for busy end completion. Back again in status loop of mmci_irq(), we quickly go through mmci_data_irq() as there are no data in that case. And we finally go through following test at the end of while(status) loop: /* * Don't poll for busy completion in irq context. */ if (host->variant->busy_detect && host->busy_status) status &= ~host->variant->busy_detect_flag; Because status variable is not yet null (is equal to 0x40), we do not leave interrupt context yet but we loop again into while(status) loop. So we run across following steps: a) MMCISTATUS register is read again and this time is equal to 0x01000400. So that following bits are set: - MCI_DATABLOCKEND (= 10) - MCI_ST_CARDBUSY (= 24) Since MMCIMASK0 register is equal to 0x010003FF: b) status variable is set to 0x01000000. c) MCI_ST_CARDBUSY bit is cleared by writing MMCICLEAR register. Then, mmci_cmd_irq() is called one more time. Since host->busy_status is set and that MCI_ST_CARDBUSY is set in status variable, we just return from this function. Back again in mmci_irq(), status variable is set to 0 and we finally leave the while(status) loop. As a result we leave interrupt context, waiting for busy end interrupt event. Now, consider that busy end completion is raised IN BETWEEN steps 3.a) and 3.c). In such a case, we may mistakenly clear busy end interrupt at step 3.c) while it has not yet been processed. This will result in mmc command to wait forever for a busy end completion that will never happen. To fix the problem, this patch implements the following changes: Considering that the mmci seems to be triggering the IRQ on both edges while monitoring DAT0 for busy completion and that same status bit is used to monitor start and end of busy detection, special care must be taken to make sure that both start and end interrupts are always cleared one after the other. 1) Clearing of card busy bit is moved in mmc_cmd_irq() function where unmasking of busy end bit is effectively handled. 2) Just before unmasking busy end event, busy start event is cleared by writing card busy bit in MMCICLEAR register. 3) Finally, once we are no more busy with a command, busy end event is cleared writing again card busy bit in MMCICLEAR register. This patch has been tested with the ST Accordo5 machine, not yet supported upstream but relies on the mmci driver. Signed-off-by: Sarang Mairal <sarang.mairal@garmin.com> Signed-off-by: Jean-Nicolas Graux <jean-nicolas.graux@st.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Tested-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Diffstat (limited to 'drivers/usb/host/ehci-pci.c')