-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJXXS5iAAoJEE44bZycYXAvDj8P/jbhmGAgW6tw2cnS90QIZDqG
M/nclEId61jICNvbfP6zsioKeWyrmzr5G7NjqTThsSNhCo/DXs3ddMqLy3pOaFdq
mytXtHIUpwZoplEib+ODinW40CMqnu11XSWEcee2nrsPuGNsnc7BY0wmFBa6UVCV
rOZef9SN9lJcZSYY/auvgLDXOXdQ+NMxp5hau30aF5HBO8hTDXStjPRcUwCvz7aR
govTQJHlS4HzLH3JOYS3Dt8IYFDOrKhQIby2nFdw7eiUxHCRy2F0asabTh3DzCw1
iLvFroozjyVXwozfWMqLCvMa+514MXJy8Nkva6xiAHraC8UrgfPtcNsTdgtkdH9T
V2Am9b0L7yiBdG6hsZLxkU3akk7vU/0dtppwzvudANT6i2tGcDSBeaZq3T2pAv7B
7coY53GzHZdQnbdTZbYeS1fxebxyXw50D5OJkF8DyLhoL7Uj2Dvv0QdjKv+U/e5D
VQ+ZyGcBdCLuOzflXysI10E01y0/M3FrkubgGBM4Oh0eYKCHJaHG/NCZy5JY/qxy
S0phem8RbeZPbcL14z+5buWIi1lUkTiCIMG8c32ZEmDh84drnICqABA0RzKmqdkj
ucQa+PzkMQ1DyhAMUl/CwpBfSqf1Zs3agLo78Kp5MTGfeAA90m0SeVqhmDgWhwqG
HhSlsPFfMfmJl5S0uJpQ
=UhFl
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqdSoACgkQmXOSYMts
txbb1A/6A1pJjz3//6RsYU7G2f4WgAjqCRzQDPtVtBUwpyBtj7DuAxNGeOAvw0KM
BfOTy0fhtgHfOV6F4kynIuU6scNY8zZlZ2ZCgndhiC45dlDBSto2mYgF9DmDl7m3
rRhiWmmSqFvJW+USxCETg8PxXVIs0Si+TU8AfBKJt3Mf25UyLsrm/hIDqg3FtkyP
STZlpmACGQEJl6qTVTubTv6/psJc0oE7gUZ2G4TTuFxt+p3/4MPf+pnicl5jcP04
laN1k2ce8ciV8Tc7f5zM55ArLGM+M4QQNRqO6Wrl7gQvtXpn6Efno9aY2MuaXtdm
7sKKvQWj0QMS/9tei+wGS73gDsfIb1qrsaMWD9UF9zGb7miGkRr3wdDZPYurysWy
5cIL1TErJDiIVlVedL/o8EYOxCYamSQPJ35WGxSgeS9kqfTlh3C1angGy9EOpv27
ER1myFM4TUc51ziPIFlEeBu1ku4vVY7atCsZU25VqKFLAapeDG3xuK1RDmal/PTd
d2JahllwPQ4Uh8OUNeHcN4Ptxf/fBVezSCZw1tv6vkAUdt6uXcbweutDw74cWlNJ
KbKd5yluWVCAVsOSiVNRFX8ij/9GeJvu94eU5o7jiC578TQTRrMdKyxEqVKzz6te
39rFoX20GZ7IosRoJDp9gsJTA7GAVsCcfU9CK/SNL3jxGLFvJbo=
=CaKB
-----END PGP SIGNATURE-----
Merge 3.10.102 into android-msm-bullhead-3.10-oreo-m5
Changes in 3.10.102: (144 commits)
pipe: Fix buffer offset after partially failed read
x86/iopl/64: Properly context-switch IOPL on Xen PV
ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
compiler-gcc: integrate the various compiler-gcc[345].h files
x86: LLVMLinux: Fix "incomplete type const struct x86cpu_device_id"
KVM: i8254: change PIT discard tick policy
KVM: fix spin_lock_init order on x86
EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
PCI: Disable IO/MEM decoding for devices with non-compliant BARs
linux/const.h: Add _BITUL() and _BITULL()
x86: Rename X86_CR4_RDWRGSFS to X86_CR4_FSGSBASE
x86, processor-flags: Fix the datatypes and add bit number defines
x86/iopl: Fix iopl capability check on Xen PV
sg: fix dxferp in from_to case
aacraid: Fix memory leak in aac_fib_map_free
be2iscsi: set the boot_kset pointer to NULL in case of failure
usb: retry reset if a device times out
USB: cdc-acm: more sanity checking
USB: iowarrior: fix oops with malicious USB descriptors
USB: usb_driver_claim_interface: add sanity checking
USB: mct_u232: add sanity checking in probe
USB: digi_acceleport: do sanity checking for the number of ports
USB: cypress_m8: add endpoint sanity check
USB: serial: cp210x: Adding GE Healthcare Device ID
USB: option: add "D-Link DWM-221 B1" device id
pwc: Add USB id for Philips Spc880nc webcam
Input: powermate - fix oops with malicious USB descriptors
net: irda: Fix use-after-free in irtty_open()
8250: use callbacks to access UART_DLL/UART_DLM
bttv: Width must be a multiple of 16 when capturing planar formats
media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
bcache: fix cache_set_flush() NULL pointer dereference on OOM
watchdog: rc32434_wdt: fix ioctl error handling
splice: handle zero nr_pages in splice_to_pipe()
xtensa: ISS: don't hang if stdin EOF is reached
xtensa: clear all DBREAKC registers on start
md/raid5: Compare apples to apples (or sectors to sectors)
rapidio/rionet: fix deadlock on SMP
ipr: Fix out-of-bounds null overwrite
ipr: Fix regression when loading firmware
drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.
tracing: Have preempt(irqs)off trace preempt disabled functions
tracing: Fix crash from reading trace_pipe with sendfile
tracing: Fix trace_printk() to print when not using bprintk()
scripts/coccinelle: modernize &
Input: ims-pcu - sanity check against missing interfaces
Input: ati_remote2 - fix crashes on detecting device with invalid descriptor
ocfs2/dlm: fix race between convert and recovery
ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list
mtd: onenand: fix deadlock in onenand_block_markbad
sched/cputime: Fix steal time accounting vs. CPU hotplug
perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere
hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
parisc: Avoid function pointers for kernel exception routines
parisc: Fix kernel crash with reversed copy_from_user()
ALSA: timer: Use mod_timer() for rearming the system timer
net: jme: fix suspend/resume on JMC260
sctp: lack the check for ports in sctp_v6_cmp_addr
ipv6: re-enable fragment header matching in ipv6_find_hdr
cdc_ncm: toggle altsetting to force reset before setup
usbnet: cleanup after bind() in probe()
udp6: fix UDP/IPv6 encap resubmit path
sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
net: Fix use after free in the recvmmsg exit path
farsync: fix off-by-one bug in fst_add_one
ath9k: fix buffer overrun for ar9287
qlge: Fix receive packets drop.
ppp: take reference on channels netns
qmi_wwan: add "D-Link DWM-221 B1" device id
ipv4: l2tp: fix a potential issue in l2tp_ip_recv
ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
ip6_tunnel: set rtnl_link_ops before calling register_netdevice
usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
ext4: add lockdep annotations for i_data_sem
HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
drm/radeon: hold reference to fences in radeon_sa_bo_new (3.17 and older)
usbvision-video: fix memory leak of alt_max_pkt_size
usbvision: fix leak of usb_dev on failure paths in usbvision_probe()
usbvision: fix crash on detecting device with invalid configuration
usb: xhci: fix wild pointers in xhci_mem_cleanup
usb: hcd: out of bounds access in for_each_companion
crypto: gcm - Fix rfc4543 decryption crash
nl80211: check netlink protocol in socket release notification
Input: gtco - fix crash on detecting device without endpoints
i2c: cpm: Fix build break due to incompatible pointer types
EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
ASoC: s3c24xx: use const snd_soc_component_driver pointer
efi: Fix out-of-bounds read in variable_matches()
workqueue: fix ghost PENDING flag while doing MQ IO
USB: usbip: fix potential out-of-bounds write
paride: make 'verbose' parameter an 'int' again
fbdev: da8xx-fb: fix videomodes of lcd panels
misc/bmp085: Enable building as a module
rtc: vr41xx: Wire up alarm_irq_enable
drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
include/linux/poison.h: fix LIST_POISON{1,2} offset
Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors
perf stat: Document --detailed option
ARM: OMAP3: Add cpuidle parameters table for omap3430
compiler-gcc: disable -ftracer for __noclone functions
ipvs: correct initial offset of Call-ID header search in SIP persistence engine
nbd: ratelimit error msgs after socket close
clk: versatile: sp810: support reentrance
lpfc: fix misleading indentation
ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel
proc: prevent accessing /proc/<PID>/environ until it's ready
batman-adv: Fix broadcast/ogm queue limit on a removed interface
MAINTAINERS: Remove asterisk from EFI directory names
ACPICA: Dispatcher: Update thread ID for recursive method calls
USB: serial: cp210x: add ID for Link ECU
USB: serial: cp210x: add Straizona Focusers device ids
Input: ads7846 - correct the value got from SPI
powerpc: scan_features() updates incorrect bits for REAL_LE
crypto: hash - Fix page length clamping in hash walk
get_rock_ridge_filename(): handle malformed NM entries
Input: max8997-haptic - fix NULL pointer dereference
asmlinkage, pnp: Make variables used from assembler code visible
ARM: OMAP3: Fix booting with thumb2 kernel
decnet: Do not build routes to devices without decnet private data.
route: do not cache fib route info on local routes with oif
packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface
atl2: Disable unimplemented scatter/gather feature
net: fix infoleak in llc
net: fix infoleak in rtnetlink
VSOCK: do not disconnect socket when peer has shutdown SEND only
net: bridge: fix old ioctl unlocked net device walk
net: fix a kernel infoleak in x25 module
fs/cifs: correctly to anonymous authentication via NTLMSSP
ring-buffer: Use long for nr_pages to avoid overflow failures
ring-buffer: Prevent overflow of size in ring_buffer_resize()
mfd: omap-usb-tll: Fix scheduling while atomic BUG
mmc: mmc: Fix partition switch timeout for some eMMCs
mmc: longer timeout for long read time quirk
Bluetooth: vhci: purge unhandled skbs
USB: serial: keyspan: fix use-after-free in probe error path
USB: serial: quatech2: fix use-after-free in probe error path
USB: serial: io_edgeport: fix memory leaks in probe error path
USB: serial: option: add support for Cinterion PH8 and AHxx
tty: vt, return error when con_startup fails
serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios()
Linux 3.10.102
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Conflicts:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c
fs/pipe.c
kernel/trace/trace_printk.c
net/core/rtnetlink.c
net/socket.c
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJWDQYBAAoJEDjbvchgkmk+PrcQAICXm5q6InTIv16/Q2PKdny6
iydBdhM8sBUYt2fFv0hOJgEXgzQ1HeNQ4JLNrfUHocoSw6gTq4e7pFN4AsyhoZzy
DB2ZQ6cpxK6C3QPUa0C+zevoY/LsJac5TkNKT5RCxGRRolPgtTgtFw9RIXZdGPYo
3Fpt8xrwBp+SS6cXUH7j7hJEeSCpcDN3P8xq1DcAmLX1fm8At9MLOujyaILQis4U
oSaAinjg7rfTYbIpZFYix6B9F8PGqWe6/+bKLljhQhH7V7oR7aAyGKfKM53Gr1/h
Y0j+FbLxa9GNeYlR/Kw79fiX8fMpW88qGQ26rSAVIN7JtMReu7CBRHY7/hvTsyrR
wYywcHs9+zDUDlDMbp/v5ecTBkXVNRecEJpKtd7wQ7P4M79K3lR3Ar8sNxRvnP77
IHLBBNQTzOagZLQXWAYfTdmsWXjf1J4Ij673Ae1DZf2/mkSp/3wXslDYwHbrLIP4
WIYDlqc8B4+TxyJWNPXflfI6c2/nWU0ASYP/bMGGA9Kg+hReMW2DrGY0MTYCsfPg
uhu9hq8AW9JIEwA5t8sj4iebq2U1Nl1QgdpuwmgolmROwmie7zf6+yuK6e7XKpwe
A5vC7fDNTNmZOOo2tcNIH5QdHjrF/S19Re3dd1J44eBtkYiR4KM7vuBTMCrYf7r8
cknJgSXzT1VMvcpM84Zq
=w0iE
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEJDfLduVEy2qz2d/TmXOSYMtstxYFAlpqcAwACgkQmXOSYMts
txZtmA/+IzGuQW8ZtcxJgkca+QNgod6AW32WiH5btVRwRe0SiifT1vFSqIouKSWI
rwIG0E2qDpYMitydli5zooSF5pUGW+zzyKiNElBQhbBQvZuS2VxUBlaqRvWXIk6e
heDueAC/0OfXTuDRNf4Omj9BcI78881LTz/VUd3NKkOrf4qA6Xjjj8HGIlGgYO0h
UtkbsGP2QzWo51X1Ad2TqZbs0rFP0kO2dOHIohVd4QQKIxNctLOj2+5oYpgxyNnA
uxGOGQp5JnBOolclT2yVTuKLSHLRIzdqX+fB/swxoUjmeFMEsj8KEEtfZEIP+vP3
b0rhNReA/v0j5Z6r/0oKtwqWm4p2aBjjhmmloMNu8xmpyxCnS5o9zits3HEzJ8EL
MJ/NbRIhIGi2eLtGHn54+yS9MeX5AWurzLI+iNw8SBnDRKdbAMy0iki+puLtNP1f
OaNmH67mHXNTt5juowHAMmbqb7UAHSIpHR1AthpahRZ+nSob9Z1I8b7aTvjB96n0
sYBoe2eDIIFS6hqvkFh5pfv4uH9Ut171yu0G5fI7J9mfRsPuPhwmk0ZhBTby2a2n
u8XuJe5oOwMphYCAZELdkfU6Y8ZpNWGySV7nIxKIc7bnYsDP/PukzbGqoITgtxU8
W6CDDk8TVH0aCtnodpgiIvihYoPUc2FpodRD2aQRgcPVomO//wc=
=qmSH
-----END PGP SIGNATURE-----
Merge 3.10.90 into android-msm-bullhead-3.10-oreo-m5
Changes in 3.10.90: (55 commits)
unshare: Unsharing a thread does not require unsharing a vm
rtlwifi: rtl8192cu: Add new device ID
tg3: Fix temperature reporting
mac80211: enable assoc check for mesh interfaces
arm64: kconfig: Move LIST_POISON to a safe value
arm64: compat: fix vfp save/restore across signal handlers in big-endian
arm64: head.S: initialise mdcr_el2 in el2_setup
ALSA: hda - Enable headphone jack detect on old Fujitsu laptops
ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437
powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash
powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers
Add radeon suspend/resume quirk for HP Compaq dc5750.
x86/mm: Initialize pmd_idx in page_table_range_init_count()
rc-core: fix remove uevent generation
NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
NFS: nfs_set_pgio_error sometimes misses errors
parisc: Filter out spurious interrupts in PA-RISC irq handler
vmscan: fix increasing nr_isolated incurred by putback unevictable pages
fs: if a coredump already exists, unlink and recreate with O_EXCL
mmc: core: fix race condition in mmc_wait_data_done
md/raid10: always set reshape_safe when initializing reshape_position.
xen/gntdev: convert priv->lock to a mutex
hfs: fix B-tree corruption after insertion at position 0
IB/uverbs: reject invalid or unknown opcodes
IB/uverbs: Fix race between ib_uverbs_open and remove_one
IB/mlx4: Forbid using sysfs to change RoCE pkeys
IB/mlx4: Use correct SL on AH query under RoCE
hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
sctp: fix ASCONF list handling
vhost/scsi: potential memory corruption
x86: bpf_jit: fix compilation of large bpf programs
ipv6: Make MLD packets to only be processed locally
net/tipc: initialize security state for new connection socket
bridge: mdb: zero out the local br_ip variable before use
net: pktgen: fix race between pktgen_thread_worker() and kthread_stop()
net: call rcu_read_lock early in process_backlog
net: Clone skb before setting peeked flag
net: Fix skb csum races when peeking
net: Fix skb_set_peeked use-after-free bug
bridge: mdb: fix double add notification
isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
ipv6: lock socket in ip6_datagram_connect()
bonding: fix destruction of bond with devices different from arphrd_ether
inet: frags: fix defragmented packet's IP header for af_packet
netlink: don't hold mutex in rcu callback when releasing mmapd ring
rds: fix an integer overflow test in rds_info_getsockopt()
ip6_gre: release cached dst on tunnel removal
usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared
ipv6: fix exthdrs offload registration in out_rt path
net/ipv6: Correct PIM6 mrt_lock handling
sctp: fix race on protocol/netns initialization
fib_rules: fix fib rule dumps across multiple skbs
vfs: Remove incorrect debugging WARN in prepend_path
Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required"
Linux 3.10.90
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
commit 32ecd320db39bcb007679ed42f283740641b81ea upstream.
008GE0 Toshiba mmc in some Intel Baytrail tablets responds to
MMC_SEND_EXT_CSD in 450-600ms.
This patch will...
() Increase the long read time quirk timeout from 300ms to 600ms. Original
author of that quirk says 300ms was only a guess and that the number
may need to be raised in the future.
() Add this specific MMC to the quirk
Signed-off-by: Matt Gumbel <matthew.k.gumbel@intel.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit 1c447116d017a98c90f8f71c8c5a611e0aa42178 upstream.
Some eMMCs set the partition switch timeout too low.
Now typically eMMCs are considered a critical component (e.g. because
they store the root file system) and consequently are expected to be
reliable. Thus we can neglect the use case where eMMCs can't switch
reliably and we might want a lower timeout to facilitate speedy
recovery.
Although we could employ a quirk for the cards that are affected (if
we could identify them all), as described above, there is little
benefit to having a low timeout, so instead simply set a minimum
timeout.
The minimum is set to 300ms somewhat arbitrarily - the examples that
have been seen had a timeout of 10ms but were sometimes taking 60-70ms.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
commit 71f8a4b81d040b3d094424197ca2f1bf811b1245 upstream.
The following panic is captured in ker3.14, but the issue still exists
in latest kernel.
---------------------------------------------------------------------
[ 20.738217] c0 3136 (Compiler) Unable to handle kernel NULL pointer dereference
at virtual address 00000578
......
[ 20.738499] c0 3136 (Compiler) PC is at _raw_spin_lock_irqsave+0x24/0x60
[ 20.738527] c0 3136 (Compiler) LR is at _raw_spin_lock_irqsave+0x20/0x60
[ 20.740134] c0 3136 (Compiler) Call trace:
[ 20.740165] c0 3136 (Compiler) [<ffffffc0008ee900>] _raw_spin_lock_irqsave+0x24/0x60
[ 20.740200] c0 3136 (Compiler) [<ffffffc0000dd024>] __wake_up+0x1c/0x54
[ 20.740230] c0 3136 (Compiler) [<ffffffc000639414>] mmc_wait_data_done+0x28/0x34
[ 20.740262] c0 3136 (Compiler) [<ffffffc0006391a0>] mmc_request_done+0xa4/0x220
[ 20.740314] c0 3136 (Compiler) [<ffffffc000656894>] sdhci_tasklet_finish+0xac/0x264
[ 20.740352] c0 3136 (Compiler) [<ffffffc0000a2b58>] tasklet_action+0xa0/0x158
[ 20.740382] c0 3136 (Compiler) [<ffffffc0000a2078>] __do_softirq+0x10c/0x2e4
[ 20.740411] c0 3136 (Compiler) [<ffffffc0000a24bc>] irq_exit+0x8c/0xc0
[ 20.740439] c0 3136 (Compiler) [<ffffffc00008489c>] handle_IRQ+0x48/0xac
[ 20.740469] c0 3136 (Compiler) [<ffffffc000081428>] gic_handle_irq+0x38/0x7c
----------------------------------------------------------------------
Because in SMP, "mrq" has race condition between below two paths:
path1: CPU0: <tasklet context>
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
//
// If CPU0 has just finished "is_done_rcv = true" in path1, and at
// this moment, IRQ or ICache line missing happens in CPU0.
// What happens in CPU1 (path2)?
//
// If the mmcqd thread in CPU1(path2) hasn't entered to sleep mode:
// path2 would have chance to break from wait_event_interruptible
// in mmc_wait_for_data_req_done and continue to run for next
// mmc_request (mmc_blk_rw_rq_prep).
//
// Within mmc_blk_rq_prep, mrq is cleared to 0.
// If below line still gets host from "mrq" as the result of
// compiler, the panic happens as we traced.
wake_up_interruptible(&mrq->host->context_info.wait);
}
path2: CPU1: <The mmcqd thread runs mmc_queue_thread>
static int mmc_wait_for_data_req_done(...
{
...
while (1) {
wait_event_interruptible(context_info->wait,
(context_info->is_done_rcv ||
context_info->is_new_req));
static void mmc_blk_rw_rq_prep(...
{
...
memset(brq, 0, sizeof(struct mmc_blk_request));
This issue happens very coincidentally; however adding mdelay(1) in
mmc_wait_data_done as below could duplicate it easily.
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
+ mdelay(1);
wake_up_interruptible(&mrq->host->context_info.wait);
}
At runtime, IRQ or ICache line missing may just happen at the same place
of the mdelay(1).
This patch gets the mmc_context_info at the beginning of function, it can
avoid this race condition.
Signed-off-by: Jialing Fu <jlfu@marvell.com>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Fixes: 2220eedfd7 ("mmc: fix async request mechanism ....")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
No need to check for valid state when we want to
scale down the clocks. As this state validity
check is to only address that clk scaling
doesnt scale up (which will send tuning
cmds) during definite cmds sequences (like
erase operation).
CRs-Fixed: 800478
Change-Id: Ia7a578434d7db8983493788ab2d7f9383d703169
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
This change removes quirks for Hynix cards.
These quirks were used to avoid HPI and Cache
feature for specific Hynix cards due to
issues such as data corruption.
After further discussion with the card vendor it was
decided to restore the usage of these features.
Change-Id: I3fc85064eb427f6b3b6a4a941d8251341a6137d0
Signed-off-by: Talel Shenhar <tatias@codeaurora.org>
As stated by the eMMC 5.0 specification, a chip should not be rejected
only because of the revision stated in the EXT_CSD_REV field of the
EXT_CSD register.
Remove the control on this value, the control of the CSD_STRUCTURE field
should be sufficient to reject future incompatible changes.
Change-Id: I655a59004e7e4997c12077d3a267e71344f10b66
Signed-off-by: Romain Izard <romain.izard.pro@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Git-commit: 03a59437ef6b6ad7fb0165cb9b96c08d6bf057fc
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
The eMMC card can go into "reset state" due to several
reasons and without host involvement,
e.g. low voltage detection.
This kind of eMMC card reset requires eMMC host to
re-initialize the eMMC card.
In case of eMMC card reset, eMMC card firmware sets its
state to "reset state" which allows CMD0 only.
In case the eMMC host is in the middle of FLUSH request it will
get timeout which will cause the driver to requeue the flush
request and try it later on.
The problem with this is that no one is going to initialize
the eMMC card to move out of "reset state", hence, the flush
request will keep on failing over and over again.
This commit adds a device reset for the case where flush request
fails due to timeout.
Change-Id: Ic268e13cb19d0cdce0070174bf7847e6253e4513
Signed-off-by: Talel Shenhar <tatias@codeaurora.org>
This change adds a read-modify-write logic to BKOPS feature enable.
It is required in order to avoid overriding other fields defined
in BKOPS_EN register.
Change-Id: I689f5cd14d9ec1bb881f503a0418026a59e6c197
Signed-off-by: Talel Shenhar <tatias@codeaurora.org>
Include one more state of MMC_LOAD_INIT when resume (which
calls for mmc clk init algorithm) is called
to notify sdhci with SDHCI_PERMORMANCE_MODE_INIT.
Change-Id: I80661d7c9a927ed16925c0b9c00ac7abec608cee
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
The unclocked access could happen in the following scenario -
1. mmcqd thread is waiting for previously submitted io to be done
2. before this io is done, it is woken up due to is_urgent event
3. mmcqd thread is running and is processing the is_urgent event
4. Just about the same time the previously submitted io is done and
it sets is_done_rcv flag, tries to wake up mmcqd thread and release
host clock so as to gate the clocks.
If step 3 and 4 happen at the same time, then clocks will be gated off
before is_urgent is completely handled. Hence, make sure to hold the
clock before invoking get_xfer_remain and stop_request host->op.
Change-Id: If03177bf5e28cc217cc8e86b10d81d4adbab78b9
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
This reverts commit 3ec1ed2a8d.
The original 10ms delay is enough to reach power on from power
up. Increase delay is workaround to resovle resume Re-init
retries time out error. The root cause is additional QDSD block
would impact SD fucntionality as they are multiplex with SD
interface. If cd-gpio is HW floating and has a pulse, QDSD 100ms
search process would be triggerred is prior to SD block and SD
interface work as QDSD instead of SD.
The fix is merged, so revert the workaround.
Change-Id: I647be754de4a6a13678cbb1456a9db88c2714f94
Signed-off-by: Guoping Yu <guopingy@codeaurora.org>
When eMMC cache is disabled, the card has to flush all the data in its
cache.
This change increases the timeout for cache flush operation and also uses
the cache flush timeout in cache disable operation.
Change-Id: I373050a99816c95e784a957de4271955a511b9f9
CRs-Fixed: 723701
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
Add a capability to selectively increase the delay between
power_up and power_on. This delay was arrived at after performing
a series of experiments to find the minimum value. It is required
in some scenarios to avoid command timeouts during resume.
Change-Id: I857e740aa20a33e08515d054e5c9bf128db229c6
Signed-off-by: Guoping Yu <guopingy@codeaurora.org>
In the current HS400 selection sequence high speed mode is entered
twice unnecessarily. Skip the first hs selection as it is also done
as part of entering high speed DDR mode.
CRs-fixed: 707453
Change-Id: Id027af977fe416056a6fbef39da1a84e41d89e53
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
If the card is removed, the wakelock has to be held for
an extended period of time to enable the user-space to
respond. The code to extend the wakelock has been
duplicated. This patch removes this duplicate code.
CRs-fixed: 684724
Change-Id: I96e4e9dec46ada7853724c36f0c2c6329f696e5d
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
This changes ensures that pointer to card struct is valid.
Change-Id: I11405cd7dd3a1a43fdb3010152a07c1c7944fc9d
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
Use the correct power class field from the extended CSD register
for HS400 mode as defined in the eMMC5.0 specification.
CRs-fixed: 690341
Change-Id: Ie10e35941fd3c6ee49c686f721bf5af6fcd74862
Signed-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>
The only error returned by stop_request(), is returned when there is
no current request to stop. This case is handled by mmc_stop_request()
caller.
Change-Id: I09bb30593d6accefef5d550881d87b6bf603296c
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
Enhance the error handling/recovery path during eMMC resume by
adding retry mechanism and by adding additional error messages
to failure cases. This may help some of the bad parts which fail
to resume sporadically.
Change-Id: I895068edb487e6a44205e0769342b2ec2c89c876
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Fix a race condition that can lead to null pointer dereference
while the MMC transfers are going on.
1) mmc_request_done() -> mmc_wait_for_data_done ->
step1: update is_done_rcv
step2: wake_up sleeping thread (mmcqd) waiting for is_done_rcv
2) mmcqd -> mmc_wait_for_data_req_done
step4: wait for is_done_rcv or is_new_req
step5: is_new_req set from block layer context and mmcqd
is woken up
step6: let's say step1 is done, so complete the current request
step7: fetch new request and issue to host layer
step8: fetch one more request and wait for previous request to
complete
In the above execution contexts, if step4-step8 happens between step1 and
step2 a null pointer dereference is observed -
[ 29.483302] Unable to handle kernel NULL pointer dereference
at virtual address 00000488
[ 29.490366] pgd = c0004000
[ 29.493054] [00000488] *pgd=00000000
[ 29.518937] PC is at do_raw_spin_lock+0x8/0x13c
[ 29.523445] LR is at _raw_spin_lock_irqsave+0x20/0x28
[ 30.108789] [<c0339cd4>] (do_raw_spin_lock+0x8/0x13c) from
[ 30.118418] [<c095d178>] (_raw_spin_lock_irqsave+0x20/0x28) from
[ 30.127445] [<c0142ef4>] (__wake_up+0x20/0x50) from
[ 30.136124] [<c0663f70>] (mmc_request_done+0x30c/0x368) from
[ 30.145932] [<c067bd98>] (sdhci_tasklet_finish+0x130/0x13c) from
Change-Id: I9a21431b5fd9bb9bbcb5c18a9895096fe845e64b
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
This reverts and updates commit 77776fd0a4cc541b9 ("mmc: sd: fix the
maximum au_size for SD3.0"). The au_size for SD3.0 cannot be achieved
by a simple bit shift, so this needs to be implemented differently.
Also, don't print the warning in case of 0 since 'not defined' is
different from 'invalid'.
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: stable <stable@vger.kernel.org> # [3.12, 3.13]
Signed-off-by: Chris Ball <chris@printf.net>
Git-commit: 9288cac05405a7da406097a44721aa4004609b4d
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: Ia19e30f1b9d793e1757a3eb3126b994df6b7a72a
[stummala@codeaurora.org: resolved merge conflicts]
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Since SD Physical Layer specification V3.0, AU_SIZE is supported up
to 0xf. So If SD-card is supported v3.0, then max_au should be 0xf.
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Git-commit: 77776fd0a4cc541b9a528eacc1d31ca47eb1ae7a
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I140ad257098ab88ae8fab0a9cdb28130c3d4327b
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
There could be a race between suspend and mmc_rescan as follows:
At resume:
-> mmc_pm_notify
-> mmc_rescan is scheduled
Suspend is triggered:
-> mmc_pm_notify
-> wait for mmc_rescan/cancel it
-> rescan acquires wakelock if card is detected
so as to give user-space a chance to respond
-> PM framework cancels suspend since wakelock is active
Hence, release the wake-lock if its active in suspend prepare
and check for rescan_disable before acquiring wake-lock.
This prefers suspend over notifying the user-space of the status
of the card, which is fine since with suspend user-space is frozen
too.
CRs-fixed: 655281
Change-Id: I83783589f9b541d3af73931e9a7b0b144a25538e
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Enabling cache in micron devices with manufacturer ID 0xFE
is resulting in data corruption issues during power-off tests.
CRs-fixed: 654661
Change-Id: Ifcdecb26c4c75b055a128a8d9b883fc028521930
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Mmc thread is waiting for one of following events occurs:
- current running request completion (is_done_rcv)
- new request notification arrived (is_new_req)
- urgent request notification arrived (is_urgent)
or the thread received a signal. In this case none of described events
happened.
This change process the case, when mmc thread was unblocked from wait by
signal, for example system shutdown flow.
Change-Id: I0b4f0cefedc839640c162ad3cdb011d13daaee0c
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
If the last access to eMMC before runtime/system suspend is an
RPMB access, the partition type within EXT_CSD[179] will be set
to RPMB. As per specification, the deselect CMD7 and sleep CMD5
are ignored by the card and are treated as illegal commands in
this state. This causes eMMC sleep command to timeout and thus
fails runtime/system suspend. Hence, switch to default partition
config before sending deselect CMD7 and sleep CMD5.
CRs-fixed: 630894
Change-Id: I40f3fb590aeba787de8ca3356a8eed5f2780bcc1
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
eMMC and SD card specifications restrict the usage of a class of
commands while commands in other class are in progress. For example,
during erase operations the SD/eMMC spec. allows only CMD35, CMD36,
CMD38. If clock scaling is enabled and decide to scale up the clocks
it may be possible that CMD19/21 tuning commands are sent in between
erase commands, which is illegal as per specification.
Fix such illegal transactions to the card and also make clock scaling
statistics accountable only for read/write commands instead of time
consuming commands, like CMD38 erase, where transactions are independent
of bus frequency.
Change-Id: Iffba175787837e7f95bde8970f19d0f0f9d7d67d
Signed-off-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
This change prevents enabling cache during card init for specific
Kingstone card.
This change is workaround the problem of long timeouts for cache
operations.
Change-Id: I6be53a408c7d6422556585d4ea2f9b1c487563e0
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
Certain Kingston eMMC 4.41 cards might get broken when HPI feature.
This quirk will disable the HPI feature for such buggy cards.
There are features depending on HPI, the change will disable them:
- BKOPS support
- stop transmission flow
- CACHE_CTRL
Change-Id: Ie675f6cb0646c06458ac8eee9a38d12fbc485be5
Signed-off-by: Konstantin Dorfman <kdorfman@codeaurora.org>
After removing the SD/MMC 'card' from the driver model we
are cancelling the pending clock scaling work which accesses
card->dev. This could cause NULL pointer issue as the card
is already removed.
CRs-Fixed: 640344
Change-Id: I8c5ee817e3f116dedf0bf4fb51eb6b70d52467b7
Signed-off-by: Pratibhasagar V <pratibha@codeaurora.org>
The status variable is being overwritten by label variable,
since the latter is an array of 0 length. Hence, move label
to be the last member of the structure.
CRs-fixed: 642326
Change-Id: If63d760427b729fe60731aad89144a600f2a2cb7
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Enables the asynchronous suspend of card and class device.
This would enable both these devices to suspend in separate
respective threads, thus allowing other devices to suspend
concurrently.
CRs-fixed: 634333
Change-Id: Ic73022ef777b4fae4b1065f92cfa19da51a99634
Signed-off-by: Asutosh Das <asutoshd@codeaurora.org>
Fix possible NULL pointer dereference within cd-gpio IRQ
handler mmc_gpio_cd_irqt(), which can potentially happen
if the card detect IRQ gets triggered before host->ops
are initialized.
CRs-fixed: 628836
Change-Id: I2f47717d338c5c7f8e7a994c28bb5c30b30286c6
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Nathan Chancellor