mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-16 08:44:21 +08:00
f06391c45e
[ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0
[ 6684.498531] mmc0: card 0001 removed
[ 6684.501556] Mem abort info:
[ 6684.509681] ESR = 0x96000047
[ 6684.512786] EC = 0x25: DABT (current EL), IL = 32 bits
[ 6684.518394] SET = 0, FnV = 0
[ 6684.521707] EA = 0, S1PTW = 0
[ 6684.524998] Data abort info:
[ 6684.528236] ISV = 0, ISS = 0x00000047
[ 6684.532986] CM = 0, WnR = 1
[ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000
[ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000
[ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP
[ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
[ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10
[ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
[ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
[ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
^GMessage from syslogd@ at Thu Jan 1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
[ 6684.626734] sp : ffff80001243b9f0
[ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000
[ 6684.635367] x27: 0000000000000001 x26: 0000000000000001
[ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f
[ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000
[ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550
[ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500
[ 6684.661977] x17: 0000000000000000 x16: 0000000000000000
[ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278
[ 6684.672610] x13: 0000000000000001 x12: 0000000000000001
[ 6684.677927] x11: 0000000000000000 x10: 0000000000000000
[ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000
[ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678
[ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000
[ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008
[ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f
[ 6684.709854] Call trace:
[ 6684.712313] cqhci_request+0x148/0x4e8 [cqhci]
[ 6684.716803] mmc_cqe_start_req+0x58/0x68 [mmc_core]
[ 6684.721698] mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
[ 6684.727018] mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
The problem occurs when cqhci_request() get called after cqhci_disable() as
it leads to access of allocated memory that has already been freed. Let's
fix the problem by calling cqhci_disable() a bit later in the remove path.
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Diagnosed-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210303174248.542175-1-Frank.Li@nxp.com
Fixes: f690f4409d
("mmc: mmc: Enable CQE's")
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
421 lines
8.8 KiB
C
421 lines
8.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* linux/drivers/mmc/core/bus.c
|
|
*
|
|
* Copyright (C) 2003 Russell King, All Rights Reserved.
|
|
* Copyright (C) 2007 Pierre Ossman
|
|
*
|
|
* MMC card bus driver model
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <linux/device.h>
|
|
#include <linux/err.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/stat.h>
|
|
#include <linux/of.h>
|
|
#include <linux/pm_runtime.h>
|
|
|
|
#include <linux/mmc/card.h>
|
|
#include <linux/mmc/host.h>
|
|
|
|
#include "core.h"
|
|
#include "card.h"
|
|
#include "host.h"
|
|
#include "sdio_cis.h"
|
|
#include "bus.h"
|
|
|
|
#define to_mmc_driver(d) container_of(d, struct mmc_driver, drv)
|
|
|
|
static ssize_t type_show(struct device *dev,
|
|
struct device_attribute *attr, char *buf)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
|
|
switch (card->type) {
|
|
case MMC_TYPE_MMC:
|
|
return sprintf(buf, "MMC\n");
|
|
case MMC_TYPE_SD:
|
|
return sprintf(buf, "SD\n");
|
|
case MMC_TYPE_SDIO:
|
|
return sprintf(buf, "SDIO\n");
|
|
case MMC_TYPE_SD_COMBO:
|
|
return sprintf(buf, "SDcombo\n");
|
|
default:
|
|
return -EFAULT;
|
|
}
|
|
}
|
|
static DEVICE_ATTR_RO(type);
|
|
|
|
static struct attribute *mmc_dev_attrs[] = {
|
|
&dev_attr_type.attr,
|
|
NULL,
|
|
};
|
|
ATTRIBUTE_GROUPS(mmc_dev);
|
|
|
|
/*
|
|
* This currently matches any MMC driver to any MMC card - drivers
|
|
* themselves make the decision whether to drive this card in their
|
|
* probe method.
|
|
*/
|
|
static int mmc_bus_match(struct device *dev, struct device_driver *drv)
|
|
{
|
|
return 1;
|
|
}
|
|
|
|
static int
|
|
mmc_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
const char *type;
|
|
unsigned int i;
|
|
int retval = 0;
|
|
|
|
switch (card->type) {
|
|
case MMC_TYPE_MMC:
|
|
type = "MMC";
|
|
break;
|
|
case MMC_TYPE_SD:
|
|
type = "SD";
|
|
break;
|
|
case MMC_TYPE_SDIO:
|
|
type = "SDIO";
|
|
break;
|
|
case MMC_TYPE_SD_COMBO:
|
|
type = "SDcombo";
|
|
break;
|
|
default:
|
|
type = NULL;
|
|
}
|
|
|
|
if (type) {
|
|
retval = add_uevent_var(env, "MMC_TYPE=%s", type);
|
|
if (retval)
|
|
return retval;
|
|
}
|
|
|
|
if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) {
|
|
retval = add_uevent_var(env, "SDIO_ID=%04X:%04X",
|
|
card->cis.vendor, card->cis.device);
|
|
if (retval)
|
|
return retval;
|
|
|
|
retval = add_uevent_var(env, "SDIO_REVISION=%u.%u",
|
|
card->major_rev, card->minor_rev);
|
|
if (retval)
|
|
return retval;
|
|
|
|
for (i = 0; i < card->num_info; i++) {
|
|
retval = add_uevent_var(env, "SDIO_INFO%u=%s", i+1, card->info[i]);
|
|
if (retval)
|
|
return retval;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* SDIO (non-combo) cards are not handled by mmc_block driver and do not
|
|
* have accessible CID register which used by mmc_card_name() function.
|
|
*/
|
|
if (card->type == MMC_TYPE_SDIO)
|
|
return 0;
|
|
|
|
retval = add_uevent_var(env, "MMC_NAME=%s", mmc_card_name(card));
|
|
if (retval)
|
|
return retval;
|
|
|
|
/*
|
|
* Request the mmc_block device. Note: that this is a direct request
|
|
* for the module it carries no information as to what is inserted.
|
|
*/
|
|
retval = add_uevent_var(env, "MODALIAS=mmc:block");
|
|
|
|
return retval;
|
|
}
|
|
|
|
static int mmc_bus_probe(struct device *dev)
|
|
{
|
|
struct mmc_driver *drv = to_mmc_driver(dev->driver);
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
|
|
return drv->probe(card);
|
|
}
|
|
|
|
static int mmc_bus_remove(struct device *dev)
|
|
{
|
|
struct mmc_driver *drv = to_mmc_driver(dev->driver);
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
|
|
drv->remove(card);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void mmc_bus_shutdown(struct device *dev)
|
|
{
|
|
struct mmc_driver *drv = to_mmc_driver(dev->driver);
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
struct mmc_host *host = card->host;
|
|
int ret;
|
|
|
|
if (dev->driver && drv->shutdown)
|
|
drv->shutdown(card);
|
|
|
|
if (host->bus_ops->shutdown) {
|
|
ret = host->bus_ops->shutdown(host);
|
|
if (ret)
|
|
pr_warn("%s: error %d during shutdown\n",
|
|
mmc_hostname(host), ret);
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_PM_SLEEP
|
|
static int mmc_bus_suspend(struct device *dev)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
struct mmc_host *host = card->host;
|
|
int ret;
|
|
|
|
ret = pm_generic_suspend(dev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = host->bus_ops->suspend(host);
|
|
if (ret)
|
|
pm_generic_resume(dev);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int mmc_bus_resume(struct device *dev)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
struct mmc_host *host = card->host;
|
|
int ret;
|
|
|
|
ret = host->bus_ops->resume(host);
|
|
if (ret)
|
|
pr_warn("%s: error %d during resume (card was removed?)\n",
|
|
mmc_hostname(host), ret);
|
|
|
|
ret = pm_generic_resume(dev);
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#ifdef CONFIG_PM
|
|
static int mmc_runtime_suspend(struct device *dev)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
struct mmc_host *host = card->host;
|
|
|
|
return host->bus_ops->runtime_suspend(host);
|
|
}
|
|
|
|
static int mmc_runtime_resume(struct device *dev)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
struct mmc_host *host = card->host;
|
|
|
|
return host->bus_ops->runtime_resume(host);
|
|
}
|
|
#endif /* !CONFIG_PM */
|
|
|
|
static const struct dev_pm_ops mmc_bus_pm_ops = {
|
|
SET_RUNTIME_PM_OPS(mmc_runtime_suspend, mmc_runtime_resume, NULL)
|
|
SET_SYSTEM_SLEEP_PM_OPS(mmc_bus_suspend, mmc_bus_resume)
|
|
};
|
|
|
|
static struct bus_type mmc_bus_type = {
|
|
.name = "mmc",
|
|
.dev_groups = mmc_dev_groups,
|
|
.match = mmc_bus_match,
|
|
.uevent = mmc_bus_uevent,
|
|
.probe = mmc_bus_probe,
|
|
.remove = mmc_bus_remove,
|
|
.shutdown = mmc_bus_shutdown,
|
|
.pm = &mmc_bus_pm_ops,
|
|
};
|
|
|
|
int mmc_register_bus(void)
|
|
{
|
|
return bus_register(&mmc_bus_type);
|
|
}
|
|
|
|
void mmc_unregister_bus(void)
|
|
{
|
|
bus_unregister(&mmc_bus_type);
|
|
}
|
|
|
|
/**
|
|
* mmc_register_driver - register a media driver
|
|
* @drv: MMC media driver
|
|
*/
|
|
int mmc_register_driver(struct mmc_driver *drv)
|
|
{
|
|
drv->drv.bus = &mmc_bus_type;
|
|
return driver_register(&drv->drv);
|
|
}
|
|
|
|
EXPORT_SYMBOL(mmc_register_driver);
|
|
|
|
/**
|
|
* mmc_unregister_driver - unregister a media driver
|
|
* @drv: MMC media driver
|
|
*/
|
|
void mmc_unregister_driver(struct mmc_driver *drv)
|
|
{
|
|
drv->drv.bus = &mmc_bus_type;
|
|
driver_unregister(&drv->drv);
|
|
}
|
|
|
|
EXPORT_SYMBOL(mmc_unregister_driver);
|
|
|
|
static void mmc_release_card(struct device *dev)
|
|
{
|
|
struct mmc_card *card = mmc_dev_to_card(dev);
|
|
|
|
sdio_free_common_cis(card);
|
|
|
|
kfree(card->info);
|
|
|
|
kfree(card);
|
|
}
|
|
|
|
/*
|
|
* Allocate and initialise a new MMC card structure.
|
|
*/
|
|
struct mmc_card *mmc_alloc_card(struct mmc_host *host, struct device_type *type)
|
|
{
|
|
struct mmc_card *card;
|
|
|
|
card = kzalloc(sizeof(struct mmc_card), GFP_KERNEL);
|
|
if (!card)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
card->host = host;
|
|
|
|
device_initialize(&card->dev);
|
|
|
|
card->dev.parent = mmc_classdev(host);
|
|
card->dev.bus = &mmc_bus_type;
|
|
card->dev.release = mmc_release_card;
|
|
card->dev.type = type;
|
|
|
|
return card;
|
|
}
|
|
|
|
/*
|
|
* Register a new MMC card with the driver model.
|
|
*/
|
|
int mmc_add_card(struct mmc_card *card)
|
|
{
|
|
int ret;
|
|
const char *type;
|
|
const char *uhs_bus_speed_mode = "";
|
|
static const char *const uhs_speeds[] = {
|
|
[UHS_SDR12_BUS_SPEED] = "SDR12 ",
|
|
[UHS_SDR25_BUS_SPEED] = "SDR25 ",
|
|
[UHS_SDR50_BUS_SPEED] = "SDR50 ",
|
|
[UHS_SDR104_BUS_SPEED] = "SDR104 ",
|
|
[UHS_DDR50_BUS_SPEED] = "DDR50 ",
|
|
};
|
|
|
|
|
|
dev_set_name(&card->dev, "%s:%04x", mmc_hostname(card->host), card->rca);
|
|
|
|
switch (card->type) {
|
|
case MMC_TYPE_MMC:
|
|
type = "MMC";
|
|
break;
|
|
case MMC_TYPE_SD:
|
|
type = "SD";
|
|
if (mmc_card_blockaddr(card)) {
|
|
if (mmc_card_ext_capacity(card))
|
|
type = "SDXC";
|
|
else
|
|
type = "SDHC";
|
|
}
|
|
break;
|
|
case MMC_TYPE_SDIO:
|
|
type = "SDIO";
|
|
break;
|
|
case MMC_TYPE_SD_COMBO:
|
|
type = "SD-combo";
|
|
if (mmc_card_blockaddr(card))
|
|
type = "SDHC-combo";
|
|
break;
|
|
default:
|
|
type = "?";
|
|
break;
|
|
}
|
|
|
|
if (mmc_card_uhs(card) &&
|
|
(card->sd_bus_speed < ARRAY_SIZE(uhs_speeds)))
|
|
uhs_bus_speed_mode = uhs_speeds[card->sd_bus_speed];
|
|
|
|
if (mmc_host_is_spi(card->host)) {
|
|
pr_info("%s: new %s%s%s card on SPI\n",
|
|
mmc_hostname(card->host),
|
|
mmc_card_hs(card) ? "high speed " : "",
|
|
mmc_card_ddr52(card) ? "DDR " : "",
|
|
type);
|
|
} else {
|
|
pr_info("%s: new %s%s%s%s%s%s card at address %04x\n",
|
|
mmc_hostname(card->host),
|
|
mmc_card_uhs(card) ? "ultra high speed " :
|
|
(mmc_card_hs(card) ? "high speed " : ""),
|
|
mmc_card_hs400(card) ? "HS400 " :
|
|
(mmc_card_hs200(card) ? "HS200 " : ""),
|
|
mmc_card_hs400es(card) ? "Enhanced strobe " : "",
|
|
mmc_card_ddr52(card) ? "DDR " : "",
|
|
uhs_bus_speed_mode, type, card->rca);
|
|
}
|
|
|
|
#ifdef CONFIG_DEBUG_FS
|
|
mmc_add_card_debugfs(card);
|
|
#endif
|
|
card->dev.of_node = mmc_of_find_child_device(card->host, 0);
|
|
|
|
device_enable_async_suspend(&card->dev);
|
|
|
|
ret = device_add(&card->dev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
mmc_card_set_present(card);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Unregister a new MMC card with the driver model, and
|
|
* (eventually) free it.
|
|
*/
|
|
void mmc_remove_card(struct mmc_card *card)
|
|
{
|
|
struct mmc_host *host = card->host;
|
|
|
|
#ifdef CONFIG_DEBUG_FS
|
|
mmc_remove_card_debugfs(card);
|
|
#endif
|
|
|
|
if (mmc_card_present(card)) {
|
|
if (mmc_host_is_spi(card->host)) {
|
|
pr_info("%s: SPI card removed\n",
|
|
mmc_hostname(card->host));
|
|
} else {
|
|
pr_info("%s: card %04x removed\n",
|
|
mmc_hostname(card->host), card->rca);
|
|
}
|
|
device_del(&card->dev);
|
|
of_node_put(card->dev.of_node);
|
|
}
|
|
|
|
if (host->cqe_enabled) {
|
|
host->cqe_ops->cqe_disable(host);
|
|
host->cqe_enabled = false;
|
|
}
|
|
|
|
put_device(&card->dev);
|
|
}
|