xref: /openbmc/linux/drivers/mmc/core/block.c (revision 901181b7)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Block driver for media (i.e., flash cards)
4  *
5  * Copyright 2002 Hewlett-Packard Company
6  * Copyright 2005-2008 Pierre Ossman
7  *
8  * Use consistent with the GNU GPL is permitted,
9  * provided that this copyright notice is
10  * preserved in its entirety in all copies and derived works.
11  *
12  * HEWLETT-PACKARD COMPANY MAKES NO WARRANTIES, EXPRESSED OR IMPLIED,
13  * AS TO THE USEFULNESS OR CORRECTNESS OF THIS CODE OR ITS
14  * FITNESS FOR ANY PARTICULAR PURPOSE.
15  *
16  * Many thanks to Alessandro Rubini and Jonathan Corbet!
17  *
18  * Author:  Andrew Christian
19  *          28 May 2002
20  */
21 #include <linux/moduleparam.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 
25 #include <linux/kernel.h>
26 #include <linux/fs.h>
27 #include <linux/slab.h>
28 #include <linux/errno.h>
29 #include <linux/hdreg.h>
30 #include <linux/kdev_t.h>
31 #include <linux/kref.h>
32 #include <linux/blkdev.h>
33 #include <linux/cdev.h>
34 #include <linux/mutex.h>
35 #include <linux/scatterlist.h>
36 #include <linux/string_helpers.h>
37 #include <linux/delay.h>
38 #include <linux/capability.h>
39 #include <linux/compat.h>
40 #include <linux/pm_runtime.h>
41 #include <linux/idr.h>
42 #include <linux/debugfs.h>
43 
44 #include <linux/mmc/ioctl.h>
45 #include <linux/mmc/card.h>
46 #include <linux/mmc/host.h>
47 #include <linux/mmc/mmc.h>
48 #include <linux/mmc/sd.h>
49 
50 #include <linux/uaccess.h>
51 
52 #include "queue.h"
53 #include "block.h"
54 #include "core.h"
55 #include "card.h"
56 #include "crypto.h"
57 #include "host.h"
58 #include "bus.h"
59 #include "mmc_ops.h"
60 #include "quirks.h"
61 #include "sd_ops.h"
62 
63 MODULE_ALIAS("mmc:block");
64 #ifdef MODULE_PARAM_PREFIX
65 #undef MODULE_PARAM_PREFIX
66 #endif
67 #define MODULE_PARAM_PREFIX "mmcblk."
68 
69 /*
70  * Set a 10 second timeout for polling write request busy state. Note, mmc core
71  * is setting a 3 second timeout for SD cards, and SDHCI has long had a 10
72  * second software timer to timeout the whole request, so 10 seconds should be
73  * ample.
74  */
75 #define MMC_BLK_TIMEOUT_MS  (10 * 1000)
76 #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
77 #define MMC_EXTRACT_VALUE_FROM_ARG(x) ((x & 0x0000FF00) >> 8)
78 
79 #define mmc_req_rel_wr(req)	((req->cmd_flags & REQ_FUA) && \
80 				  (rq_data_dir(req) == WRITE))
81 static DEFINE_MUTEX(block_mutex);
82 
83 /*
84  * The defaults come from config options but can be overriden by module
85  * or bootarg options.
86  */
87 static int perdev_minors = CONFIG_MMC_BLOCK_MINORS;
88 
89 /*
90  * We've only got one major, so number of mmcblk devices is
91  * limited to (1 << 20) / number of minors per device.  It is also
92  * limited by the MAX_DEVICES below.
93  */
94 static int max_devices;
95 
96 #define MAX_DEVICES 256
97 
98 static DEFINE_IDA(mmc_blk_ida);
99 static DEFINE_IDA(mmc_rpmb_ida);
100 
101 struct mmc_blk_busy_data {
102 	struct mmc_card *card;
103 	u32 status;
104 };
105 
106 /*
107  * There is one mmc_blk_data per slot.
108  */
109 struct mmc_blk_data {
110 	struct device	*parent;
111 	struct gendisk	*disk;
112 	struct mmc_queue queue;
113 	struct list_head part;
114 	struct list_head rpmbs;
115 
116 	unsigned int	flags;
117 #define MMC_BLK_CMD23	(1 << 0)	/* Can do SET_BLOCK_COUNT for multiblock */
118 #define MMC_BLK_REL_WR	(1 << 1)	/* MMC Reliable write support */
119 
120 	struct kref	kref;
121 	unsigned int	read_only;
122 	unsigned int	part_type;
123 	unsigned int	reset_done;
124 #define MMC_BLK_READ		BIT(0)
125 #define MMC_BLK_WRITE		BIT(1)
126 #define MMC_BLK_DISCARD		BIT(2)
127 #define MMC_BLK_SECDISCARD	BIT(3)
128 #define MMC_BLK_CQE_RECOVERY	BIT(4)
129 
130 	/*
131 	 * Only set in main mmc_blk_data associated
132 	 * with mmc_card with dev_set_drvdata, and keeps
133 	 * track of the current selected device partition.
134 	 */
135 	unsigned int	part_curr;
136 	int	area_type;
137 
138 	/* debugfs files (only in main mmc_blk_data) */
139 	struct dentry *status_dentry;
140 	struct dentry *ext_csd_dentry;
141 };
142 
143 /* Device type for RPMB character devices */
144 static dev_t mmc_rpmb_devt;
145 
146 /* Bus type for RPMB character devices */
147 static struct bus_type mmc_rpmb_bus_type = {
148 	.name = "mmc_rpmb",
149 };
150 
151 /**
152  * struct mmc_rpmb_data - special RPMB device type for these areas
153  * @dev: the device for the RPMB area
154  * @chrdev: character device for the RPMB area
155  * @id: unique device ID number
156  * @part_index: partition index (0 on first)
157  * @md: parent MMC block device
158  * @node: list item, so we can put this device on a list
159  */
160 struct mmc_rpmb_data {
161 	struct device dev;
162 	struct cdev chrdev;
163 	int id;
164 	unsigned int part_index;
165 	struct mmc_blk_data *md;
166 	struct list_head node;
167 };
168 
169 static DEFINE_MUTEX(open_lock);
170 
171 module_param(perdev_minors, int, 0444);
172 MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
173 
174 static inline int mmc_blk_part_switch(struct mmc_card *card,
175 				      unsigned int part_type);
176 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
177 			       struct mmc_card *card,
178 			       int disable_multi,
179 			       struct mmc_queue *mq);
180 static void mmc_blk_hsq_req_done(struct mmc_request *mrq);
181 
182 static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
183 {
184 	struct mmc_blk_data *md;
185 
186 	mutex_lock(&open_lock);
187 	md = disk->private_data;
188 	if (md && !kref_get_unless_zero(&md->kref))
189 		md = NULL;
190 	mutex_unlock(&open_lock);
191 
192 	return md;
193 }
194 
195 static inline int mmc_get_devidx(struct gendisk *disk)
196 {
197 	int devidx = disk->first_minor / perdev_minors;
198 	return devidx;
199 }
200 
201 static void mmc_blk_kref_release(struct kref *ref)
202 {
203 	struct mmc_blk_data *md = container_of(ref, struct mmc_blk_data, kref);
204 	int devidx;
205 
206 	devidx = mmc_get_devidx(md->disk);
207 	ida_simple_remove(&mmc_blk_ida, devidx);
208 
209 	mutex_lock(&open_lock);
210 	md->disk->private_data = NULL;
211 	mutex_unlock(&open_lock);
212 
213 	put_disk(md->disk);
214 	kfree(md);
215 }
216 
217 static void mmc_blk_put(struct mmc_blk_data *md)
218 {
219 	kref_put(&md->kref, mmc_blk_kref_release);
220 }
221 
222 static ssize_t power_ro_lock_show(struct device *dev,
223 		struct device_attribute *attr, char *buf)
224 {
225 	int ret;
226 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
227 	struct mmc_card *card = md->queue.card;
228 	int locked = 0;
229 
230 	if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PERM_WP_EN)
231 		locked = 2;
232 	else if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_EN)
233 		locked = 1;
234 
235 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
236 
237 	mmc_blk_put(md);
238 
239 	return ret;
240 }
241 
242 static ssize_t power_ro_lock_store(struct device *dev,
243 		struct device_attribute *attr, const char *buf, size_t count)
244 {
245 	int ret;
246 	struct mmc_blk_data *md, *part_md;
247 	struct mmc_queue *mq;
248 	struct request *req;
249 	unsigned long set;
250 
251 	if (kstrtoul(buf, 0, &set))
252 		return -EINVAL;
253 
254 	if (set != 1)
255 		return count;
256 
257 	md = mmc_blk_get(dev_to_disk(dev));
258 	mq = &md->queue;
259 
260 	/* Dispatch locking to the block layer */
261 	req = blk_mq_alloc_request(mq->queue, REQ_OP_DRV_OUT, 0);
262 	if (IS_ERR(req)) {
263 		count = PTR_ERR(req);
264 		goto out_put;
265 	}
266 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
267 	blk_execute_rq(NULL, req, 0);
268 	ret = req_to_mmc_queue_req(req)->drv_op_result;
269 	blk_mq_free_request(req);
270 
271 	if (!ret) {
272 		pr_info("%s: Locking boot partition ro until next power on\n",
273 			md->disk->disk_name);
274 		set_disk_ro(md->disk, 1);
275 
276 		list_for_each_entry(part_md, &md->part, part)
277 			if (part_md->area_type == MMC_BLK_DATA_AREA_BOOT) {
278 				pr_info("%s: Locking boot partition ro until next power on\n", part_md->disk->disk_name);
279 				set_disk_ro(part_md->disk, 1);
280 			}
281 	}
282 out_put:
283 	mmc_blk_put(md);
284 	return count;
285 }
286 
287 static DEVICE_ATTR(ro_lock_until_next_power_on, 0,
288 		power_ro_lock_show, power_ro_lock_store);
289 
290 static ssize_t force_ro_show(struct device *dev, struct device_attribute *attr,
291 			     char *buf)
292 {
293 	int ret;
294 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
295 
296 	ret = snprintf(buf, PAGE_SIZE, "%d\n",
297 		       get_disk_ro(dev_to_disk(dev)) ^
298 		       md->read_only);
299 	mmc_blk_put(md);
300 	return ret;
301 }
302 
303 static ssize_t force_ro_store(struct device *dev, struct device_attribute *attr,
304 			      const char *buf, size_t count)
305 {
306 	int ret;
307 	char *end;
308 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
309 	unsigned long set = simple_strtoul(buf, &end, 0);
310 	if (end == buf) {
311 		ret = -EINVAL;
312 		goto out;
313 	}
314 
315 	set_disk_ro(dev_to_disk(dev), set || md->read_only);
316 	ret = count;
317 out:
318 	mmc_blk_put(md);
319 	return ret;
320 }
321 
322 static DEVICE_ATTR(force_ro, 0644, force_ro_show, force_ro_store);
323 
324 static struct attribute *mmc_disk_attrs[] = {
325 	&dev_attr_force_ro.attr,
326 	&dev_attr_ro_lock_until_next_power_on.attr,
327 	NULL,
328 };
329 
330 static umode_t mmc_disk_attrs_is_visible(struct kobject *kobj,
331 		struct attribute *a, int n)
332 {
333 	struct device *dev = container_of(kobj, struct device, kobj);
334 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
335 	umode_t mode = a->mode;
336 
337 	if (a == &dev_attr_ro_lock_until_next_power_on.attr &&
338 	    (md->area_type & MMC_BLK_DATA_AREA_BOOT) &&
339 	    md->queue.card->ext_csd.boot_ro_lockable) {
340 		mode = S_IRUGO;
341 		if (!(md->queue.card->ext_csd.boot_ro_lock &
342 				EXT_CSD_BOOT_WP_B_PWR_WP_DIS))
343 			mode |= S_IWUSR;
344 	}
345 
346 	mmc_blk_put(md);
347 	return mode;
348 }
349 
350 static const struct attribute_group mmc_disk_attr_group = {
351 	.is_visible	= mmc_disk_attrs_is_visible,
352 	.attrs		= mmc_disk_attrs,
353 };
354 
355 static const struct attribute_group *mmc_disk_attr_groups[] = {
356 	&mmc_disk_attr_group,
357 	NULL,
358 };
359 
360 static int mmc_blk_open(struct block_device *bdev, fmode_t mode)
361 {
362 	struct mmc_blk_data *md = mmc_blk_get(bdev->bd_disk);
363 	int ret = -ENXIO;
364 
365 	mutex_lock(&block_mutex);
366 	if (md) {
367 		ret = 0;
368 		if ((mode & FMODE_WRITE) && md->read_only) {
369 			mmc_blk_put(md);
370 			ret = -EROFS;
371 		}
372 	}
373 	mutex_unlock(&block_mutex);
374 
375 	return ret;
376 }
377 
378 static void mmc_blk_release(struct gendisk *disk, fmode_t mode)
379 {
380 	struct mmc_blk_data *md = disk->private_data;
381 
382 	mutex_lock(&block_mutex);
383 	mmc_blk_put(md);
384 	mutex_unlock(&block_mutex);
385 }
386 
387 static int
388 mmc_blk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
389 {
390 	geo->cylinders = get_capacity(bdev->bd_disk) / (4 * 16);
391 	geo->heads = 4;
392 	geo->sectors = 16;
393 	return 0;
394 }
395 
396 struct mmc_blk_ioc_data {
397 	struct mmc_ioc_cmd ic;
398 	unsigned char *buf;
399 	u64 buf_bytes;
400 	struct mmc_rpmb_data *rpmb;
401 };
402 
403 static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
404 	struct mmc_ioc_cmd __user *user)
405 {
406 	struct mmc_blk_ioc_data *idata;
407 	int err;
408 
409 	idata = kmalloc(sizeof(*idata), GFP_KERNEL);
410 	if (!idata) {
411 		err = -ENOMEM;
412 		goto out;
413 	}
414 
415 	if (copy_from_user(&idata->ic, user, sizeof(idata->ic))) {
416 		err = -EFAULT;
417 		goto idata_err;
418 	}
419 
420 	idata->buf_bytes = (u64) idata->ic.blksz * idata->ic.blocks;
421 	if (idata->buf_bytes > MMC_IOC_MAX_BYTES) {
422 		err = -EOVERFLOW;
423 		goto idata_err;
424 	}
425 
426 	if (!idata->buf_bytes) {
427 		idata->buf = NULL;
428 		return idata;
429 	}
430 
431 	idata->buf = memdup_user((void __user *)(unsigned long)
432 				 idata->ic.data_ptr, idata->buf_bytes);
433 	if (IS_ERR(idata->buf)) {
434 		err = PTR_ERR(idata->buf);
435 		goto idata_err;
436 	}
437 
438 	return idata;
439 
440 idata_err:
441 	kfree(idata);
442 out:
443 	return ERR_PTR(err);
444 }
445 
446 static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr,
447 				      struct mmc_blk_ioc_data *idata)
448 {
449 	struct mmc_ioc_cmd *ic = &idata->ic;
450 
451 	if (copy_to_user(&(ic_ptr->response), ic->response,
452 			 sizeof(ic->response)))
453 		return -EFAULT;
454 
455 	if (!idata->ic.write_flag) {
456 		if (copy_to_user((void __user *)(unsigned long)ic->data_ptr,
457 				 idata->buf, idata->buf_bytes))
458 			return -EFAULT;
459 	}
460 
461 	return 0;
462 }
463 
464 static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
465 			       struct mmc_blk_ioc_data *idata)
466 {
467 	struct mmc_command cmd = {}, sbc = {};
468 	struct mmc_data data = {};
469 	struct mmc_request mrq = {};
470 	struct scatterlist sg;
471 	int err;
472 	unsigned int target_part;
473 
474 	if (!card || !md || !idata)
475 		return -EINVAL;
476 
477 	/*
478 	 * The RPMB accesses comes in from the character device, so we
479 	 * need to target these explicitly. Else we just target the
480 	 * partition type for the block device the ioctl() was issued
481 	 * on.
482 	 */
483 	if (idata->rpmb) {
484 		/* Support multiple RPMB partitions */
485 		target_part = idata->rpmb->part_index;
486 		target_part |= EXT_CSD_PART_CONFIG_ACC_RPMB;
487 	} else {
488 		target_part = md->part_type;
489 	}
490 
491 	cmd.opcode = idata->ic.opcode;
492 	cmd.arg = idata->ic.arg;
493 	cmd.flags = idata->ic.flags;
494 
495 	if (idata->buf_bytes) {
496 		data.sg = &sg;
497 		data.sg_len = 1;
498 		data.blksz = idata->ic.blksz;
499 		data.blocks = idata->ic.blocks;
500 
501 		sg_init_one(data.sg, idata->buf, idata->buf_bytes);
502 
503 		if (idata->ic.write_flag)
504 			data.flags = MMC_DATA_WRITE;
505 		else
506 			data.flags = MMC_DATA_READ;
507 
508 		/* data.flags must already be set before doing this. */
509 		mmc_set_data_timeout(&data, card);
510 
511 		/* Allow overriding the timeout_ns for empirical tuning. */
512 		if (idata->ic.data_timeout_ns)
513 			data.timeout_ns = idata->ic.data_timeout_ns;
514 
515 		if ((cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
516 			/*
517 			 * Pretend this is a data transfer and rely on the
518 			 * host driver to compute timeout.  When all host
519 			 * drivers support cmd.cmd_timeout for R1B, this
520 			 * can be changed to:
521 			 *
522 			 *     mrq.data = NULL;
523 			 *     cmd.cmd_timeout = idata->ic.cmd_timeout_ms;
524 			 */
525 			data.timeout_ns = idata->ic.cmd_timeout_ms * 1000000;
526 		}
527 
528 		mrq.data = &data;
529 	}
530 
531 	mrq.cmd = &cmd;
532 
533 	err = mmc_blk_part_switch(card, target_part);
534 	if (err)
535 		return err;
536 
537 	if (idata->ic.is_acmd) {
538 		err = mmc_app_cmd(card->host, card);
539 		if (err)
540 			return err;
541 	}
542 
543 	if (idata->rpmb) {
544 		sbc.opcode = MMC_SET_BLOCK_COUNT;
545 		/*
546 		 * We don't do any blockcount validation because the max size
547 		 * may be increased by a future standard. We just copy the
548 		 * 'Reliable Write' bit here.
549 		 */
550 		sbc.arg = data.blocks | (idata->ic.write_flag & BIT(31));
551 		sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
552 		mrq.sbc = &sbc;
553 	}
554 
555 	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_SANITIZE_START) &&
556 	    (cmd.opcode == MMC_SWITCH))
557 		return mmc_sanitize(card, idata->ic.cmd_timeout_ms);
558 
559 	mmc_wait_for_req(card->host, &mrq);
560 	memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
561 
562 	if (cmd.error) {
563 		dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
564 						__func__, cmd.error);
565 		return cmd.error;
566 	}
567 	if (data.error) {
568 		dev_err(mmc_dev(card->host), "%s: data error %d\n",
569 						__func__, data.error);
570 		return data.error;
571 	}
572 
573 	/*
574 	 * Make sure the cache of the PARTITION_CONFIG register and
575 	 * PARTITION_ACCESS bits is updated in case the ioctl ext_csd write
576 	 * changed it successfully.
577 	 */
578 	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_PART_CONFIG) &&
579 	    (cmd.opcode == MMC_SWITCH)) {
580 		struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
581 		u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg);
582 
583 		/*
584 		 * Update cache so the next mmc_blk_part_switch call operates
585 		 * on up-to-date data.
586 		 */
587 		card->ext_csd.part_config = value;
588 		main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK;
589 	}
590 
591 	/*
592 	 * Make sure to update CACHE_CTRL in case it was changed. The cache
593 	 * will get turned back on if the card is re-initialized, e.g.
594 	 * suspend/resume or hw reset in recovery.
595 	 */
596 	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_CACHE_CTRL) &&
597 	    (cmd.opcode == MMC_SWITCH)) {
598 		u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg) & 1;
599 
600 		card->ext_csd.cache_ctrl = value;
601 	}
602 
603 	/*
604 	 * According to the SD specs, some commands require a delay after
605 	 * issuing the command.
606 	 */
607 	if (idata->ic.postsleep_min_us)
608 		usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
609 
610 	if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
611 		/*
612 		 * Ensure RPMB/R1B command has completed by polling CMD13
613 		 * "Send Status".
614 		 */
615 		err = mmc_poll_for_busy(card, MMC_BLK_TIMEOUT_MS, false,
616 					MMC_BUSY_IO);
617 	}
618 
619 	return err;
620 }
621 
622 static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
623 			     struct mmc_ioc_cmd __user *ic_ptr,
624 			     struct mmc_rpmb_data *rpmb)
625 {
626 	struct mmc_blk_ioc_data *idata;
627 	struct mmc_blk_ioc_data *idatas[1];
628 	struct mmc_queue *mq;
629 	struct mmc_card *card;
630 	int err = 0, ioc_err = 0;
631 	struct request *req;
632 
633 	idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
634 	if (IS_ERR(idata))
635 		return PTR_ERR(idata);
636 	/* This will be NULL on non-RPMB ioctl():s */
637 	idata->rpmb = rpmb;
638 
639 	card = md->queue.card;
640 	if (IS_ERR(card)) {
641 		err = PTR_ERR(card);
642 		goto cmd_done;
643 	}
644 
645 	/*
646 	 * Dispatch the ioctl() into the block request queue.
647 	 */
648 	mq = &md->queue;
649 	req = blk_mq_alloc_request(mq->queue,
650 		idata->ic.write_flag ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0);
651 	if (IS_ERR(req)) {
652 		err = PTR_ERR(req);
653 		goto cmd_done;
654 	}
655 	idatas[0] = idata;
656 	req_to_mmc_queue_req(req)->drv_op =
657 		rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
658 	req_to_mmc_queue_req(req)->drv_op_data = idatas;
659 	req_to_mmc_queue_req(req)->ioc_count = 1;
660 	blk_execute_rq(NULL, req, 0);
661 	ioc_err = req_to_mmc_queue_req(req)->drv_op_result;
662 	err = mmc_blk_ioctl_copy_to_user(ic_ptr, idata);
663 	blk_mq_free_request(req);
664 
665 cmd_done:
666 	kfree(idata->buf);
667 	kfree(idata);
668 	return ioc_err ? ioc_err : err;
669 }
670 
671 static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
672 				   struct mmc_ioc_multi_cmd __user *user,
673 				   struct mmc_rpmb_data *rpmb)
674 {
675 	struct mmc_blk_ioc_data **idata = NULL;
676 	struct mmc_ioc_cmd __user *cmds = user->cmds;
677 	struct mmc_card *card;
678 	struct mmc_queue *mq;
679 	int i, err = 0, ioc_err = 0;
680 	__u64 num_of_cmds;
681 	struct request *req;
682 
683 	if (copy_from_user(&num_of_cmds, &user->num_of_cmds,
684 			   sizeof(num_of_cmds)))
685 		return -EFAULT;
686 
687 	if (!num_of_cmds)
688 		return 0;
689 
690 	if (num_of_cmds > MMC_IOC_MAX_CMDS)
691 		return -EINVAL;
692 
693 	idata = kcalloc(num_of_cmds, sizeof(*idata), GFP_KERNEL);
694 	if (!idata)
695 		return -ENOMEM;
696 
697 	for (i = 0; i < num_of_cmds; i++) {
698 		idata[i] = mmc_blk_ioctl_copy_from_user(&cmds[i]);
699 		if (IS_ERR(idata[i])) {
700 			err = PTR_ERR(idata[i]);
701 			num_of_cmds = i;
702 			goto cmd_err;
703 		}
704 		/* This will be NULL on non-RPMB ioctl():s */
705 		idata[i]->rpmb = rpmb;
706 	}
707 
708 	card = md->queue.card;
709 	if (IS_ERR(card)) {
710 		err = PTR_ERR(card);
711 		goto cmd_err;
712 	}
713 
714 
715 	/*
716 	 * Dispatch the ioctl()s into the block request queue.
717 	 */
718 	mq = &md->queue;
719 	req = blk_mq_alloc_request(mq->queue,
720 		idata[0]->ic.write_flag ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0);
721 	if (IS_ERR(req)) {
722 		err = PTR_ERR(req);
723 		goto cmd_err;
724 	}
725 	req_to_mmc_queue_req(req)->drv_op =
726 		rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
727 	req_to_mmc_queue_req(req)->drv_op_data = idata;
728 	req_to_mmc_queue_req(req)->ioc_count = num_of_cmds;
729 	blk_execute_rq(NULL, req, 0);
730 	ioc_err = req_to_mmc_queue_req(req)->drv_op_result;
731 
732 	/* copy to user if data and response */
733 	for (i = 0; i < num_of_cmds && !err; i++)
734 		err = mmc_blk_ioctl_copy_to_user(&cmds[i], idata[i]);
735 
736 	blk_mq_free_request(req);
737 
738 cmd_err:
739 	for (i = 0; i < num_of_cmds; i++) {
740 		kfree(idata[i]->buf);
741 		kfree(idata[i]);
742 	}
743 	kfree(idata);
744 	return ioc_err ? ioc_err : err;
745 }
746 
747 static int mmc_blk_check_blkdev(struct block_device *bdev)
748 {
749 	/*
750 	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
751 	 * whole block device, not on a partition.  This prevents overspray
752 	 * between sibling partitions.
753 	 */
754 	if (!capable(CAP_SYS_RAWIO) || bdev_is_partition(bdev))
755 		return -EPERM;
756 	return 0;
757 }
758 
759 static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode,
760 	unsigned int cmd, unsigned long arg)
761 {
762 	struct mmc_blk_data *md;
763 	int ret;
764 
765 	switch (cmd) {
766 	case MMC_IOC_CMD:
767 		ret = mmc_blk_check_blkdev(bdev);
768 		if (ret)
769 			return ret;
770 		md = mmc_blk_get(bdev->bd_disk);
771 		if (!md)
772 			return -EINVAL;
773 		ret = mmc_blk_ioctl_cmd(md,
774 					(struct mmc_ioc_cmd __user *)arg,
775 					NULL);
776 		mmc_blk_put(md);
777 		return ret;
778 	case MMC_IOC_MULTI_CMD:
779 		ret = mmc_blk_check_blkdev(bdev);
780 		if (ret)
781 			return ret;
782 		md = mmc_blk_get(bdev->bd_disk);
783 		if (!md)
784 			return -EINVAL;
785 		ret = mmc_blk_ioctl_multi_cmd(md,
786 					(struct mmc_ioc_multi_cmd __user *)arg,
787 					NULL);
788 		mmc_blk_put(md);
789 		return ret;
790 	default:
791 		return -EINVAL;
792 	}
793 }
794 
795 #ifdef CONFIG_COMPAT
796 static int mmc_blk_compat_ioctl(struct block_device *bdev, fmode_t mode,
797 	unsigned int cmd, unsigned long arg)
798 {
799 	return mmc_blk_ioctl(bdev, mode, cmd, (unsigned long) compat_ptr(arg));
800 }
801 #endif
802 
803 static int mmc_blk_alternative_gpt_sector(struct gendisk *disk,
804 					  sector_t *sector)
805 {
806 	struct mmc_blk_data *md;
807 	int ret;
808 
809 	md = mmc_blk_get(disk);
810 	if (!md)
811 		return -EINVAL;
812 
813 	if (md->queue.card)
814 		ret = mmc_card_alternative_gpt_sector(md->queue.card, sector);
815 	else
816 		ret = -ENODEV;
817 
818 	mmc_blk_put(md);
819 
820 	return ret;
821 }
822 
823 static const struct block_device_operations mmc_bdops = {
824 	.open			= mmc_blk_open,
825 	.release		= mmc_blk_release,
826 	.getgeo			= mmc_blk_getgeo,
827 	.owner			= THIS_MODULE,
828 	.ioctl			= mmc_blk_ioctl,
829 #ifdef CONFIG_COMPAT
830 	.compat_ioctl		= mmc_blk_compat_ioctl,
831 #endif
832 	.alternative_gpt_sector	= mmc_blk_alternative_gpt_sector,
833 };
834 
835 static int mmc_blk_part_switch_pre(struct mmc_card *card,
836 				   unsigned int part_type)
837 {
838 	int ret = 0;
839 
840 	if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
841 		if (card->ext_csd.cmdq_en) {
842 			ret = mmc_cmdq_disable(card);
843 			if (ret)
844 				return ret;
845 		}
846 		mmc_retune_pause(card->host);
847 	}
848 
849 	return ret;
850 }
851 
852 static int mmc_blk_part_switch_post(struct mmc_card *card,
853 				    unsigned int part_type)
854 {
855 	int ret = 0;
856 
857 	if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
858 		mmc_retune_unpause(card->host);
859 		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
860 			ret = mmc_cmdq_enable(card);
861 	}
862 
863 	return ret;
864 }
865 
866 static inline int mmc_blk_part_switch(struct mmc_card *card,
867 				      unsigned int part_type)
868 {
869 	int ret = 0;
870 	struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
871 
872 	if (main_md->part_curr == part_type)
873 		return 0;
874 
875 	if (mmc_card_mmc(card)) {
876 		u8 part_config = card->ext_csd.part_config;
877 
878 		ret = mmc_blk_part_switch_pre(card, part_type);
879 		if (ret)
880 			return ret;
881 
882 		part_config &= ~EXT_CSD_PART_CONFIG_ACC_MASK;
883 		part_config |= part_type;
884 
885 		ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
886 				 EXT_CSD_PART_CONFIG, part_config,
887 				 card->ext_csd.part_time);
888 		if (ret) {
889 			mmc_blk_part_switch_post(card, part_type);
890 			return ret;
891 		}
892 
893 		card->ext_csd.part_config = part_config;
894 
895 		ret = mmc_blk_part_switch_post(card, main_md->part_curr);
896 	}
897 
898 	main_md->part_curr = part_type;
899 	return ret;
900 }
901 
902 static int mmc_sd_num_wr_blocks(struct mmc_card *card, u32 *written_blocks)
903 {
904 	int err;
905 	u32 result;
906 	__be32 *blocks;
907 
908 	struct mmc_request mrq = {};
909 	struct mmc_command cmd = {};
910 	struct mmc_data data = {};
911 
912 	struct scatterlist sg;
913 
914 	cmd.opcode = MMC_APP_CMD;
915 	cmd.arg = card->rca << 16;
916 	cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
917 
918 	err = mmc_wait_for_cmd(card->host, &cmd, 0);
919 	if (err)
920 		return err;
921 	if (!mmc_host_is_spi(card->host) && !(cmd.resp[0] & R1_APP_CMD))
922 		return -EIO;
923 
924 	memset(&cmd, 0, sizeof(struct mmc_command));
925 
926 	cmd.opcode = SD_APP_SEND_NUM_WR_BLKS;
927 	cmd.arg = 0;
928 	cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
929 
930 	data.blksz = 4;
931 	data.blocks = 1;
932 	data.flags = MMC_DATA_READ;
933 	data.sg = &sg;
934 	data.sg_len = 1;
935 	mmc_set_data_timeout(&data, card);
936 
937 	mrq.cmd = &cmd;
938 	mrq.data = &data;
939 
940 	blocks = kmalloc(4, GFP_KERNEL);
941 	if (!blocks)
942 		return -ENOMEM;
943 
944 	sg_init_one(&sg, blocks, 4);
945 
946 	mmc_wait_for_req(card->host, &mrq);
947 
948 	result = ntohl(*blocks);
949 	kfree(blocks);
950 
951 	if (cmd.error || data.error)
952 		return -EIO;
953 
954 	*written_blocks = result;
955 
956 	return 0;
957 }
958 
959 static unsigned int mmc_blk_clock_khz(struct mmc_host *host)
960 {
961 	if (host->actual_clock)
962 		return host->actual_clock / 1000;
963 
964 	/* Clock may be subject to a divisor, fudge it by a factor of 2. */
965 	if (host->ios.clock)
966 		return host->ios.clock / 2000;
967 
968 	/* How can there be no clock */
969 	WARN_ON_ONCE(1);
970 	return 100; /* 100 kHz is minimum possible value */
971 }
972 
973 static unsigned int mmc_blk_data_timeout_ms(struct mmc_host *host,
974 					    struct mmc_data *data)
975 {
976 	unsigned int ms = DIV_ROUND_UP(data->timeout_ns, 1000000);
977 	unsigned int khz;
978 
979 	if (data->timeout_clks) {
980 		khz = mmc_blk_clock_khz(host);
981 		ms += DIV_ROUND_UP(data->timeout_clks, khz);
982 	}
983 
984 	return ms;
985 }
986 
987 static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host,
988 			 int type)
989 {
990 	int err;
991 
992 	if (md->reset_done & type)
993 		return -EEXIST;
994 
995 	md->reset_done |= type;
996 	err = mmc_hw_reset(host);
997 	/* Ensure we switch back to the correct partition */
998 	if (err) {
999 		struct mmc_blk_data *main_md =
1000 			dev_get_drvdata(&host->card->dev);
1001 		int part_err;
1002 
1003 		main_md->part_curr = main_md->part_type;
1004 		part_err = mmc_blk_part_switch(host->card, md->part_type);
1005 		if (part_err) {
1006 			/*
1007 			 * We have failed to get back into the correct
1008 			 * partition, so we need to abort the whole request.
1009 			 */
1010 			return -ENODEV;
1011 		}
1012 	}
1013 	return err;
1014 }
1015 
1016 static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type)
1017 {
1018 	md->reset_done &= ~type;
1019 }
1020 
1021 /*
1022  * The non-block commands come back from the block layer after it queued it and
1023  * processed it with all other requests and then they get issued in this
1024  * function.
1025  */
1026 static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req)
1027 {
1028 	struct mmc_queue_req *mq_rq;
1029 	struct mmc_card *card = mq->card;
1030 	struct mmc_blk_data *md = mq->blkdata;
1031 	struct mmc_blk_ioc_data **idata;
1032 	bool rpmb_ioctl;
1033 	u8 **ext_csd;
1034 	u32 status;
1035 	int ret;
1036 	int i;
1037 
1038 	mq_rq = req_to_mmc_queue_req(req);
1039 	rpmb_ioctl = (mq_rq->drv_op == MMC_DRV_OP_IOCTL_RPMB);
1040 
1041 	switch (mq_rq->drv_op) {
1042 	case MMC_DRV_OP_IOCTL:
1043 		if (card->ext_csd.cmdq_en) {
1044 			ret = mmc_cmdq_disable(card);
1045 			if (ret)
1046 				break;
1047 		}
1048 		fallthrough;
1049 	case MMC_DRV_OP_IOCTL_RPMB:
1050 		idata = mq_rq->drv_op_data;
1051 		for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) {
1052 			ret = __mmc_blk_ioctl_cmd(card, md, idata[i]);
1053 			if (ret)
1054 				break;
1055 		}
1056 		/* Always switch back to main area after RPMB access */
1057 		if (rpmb_ioctl)
1058 			mmc_blk_part_switch(card, 0);
1059 		else if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
1060 			mmc_cmdq_enable(card);
1061 		break;
1062 	case MMC_DRV_OP_BOOT_WP:
1063 		ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP,
1064 				 card->ext_csd.boot_ro_lock |
1065 				 EXT_CSD_BOOT_WP_B_PWR_WP_EN,
1066 				 card->ext_csd.part_time);
1067 		if (ret)
1068 			pr_err("%s: Locking boot partition ro until next power on failed: %d\n",
1069 			       md->disk->disk_name, ret);
1070 		else
1071 			card->ext_csd.boot_ro_lock |=
1072 				EXT_CSD_BOOT_WP_B_PWR_WP_EN;
1073 		break;
1074 	case MMC_DRV_OP_GET_CARD_STATUS:
1075 		ret = mmc_send_status(card, &status);
1076 		if (!ret)
1077 			ret = status;
1078 		break;
1079 	case MMC_DRV_OP_GET_EXT_CSD:
1080 		ext_csd = mq_rq->drv_op_data;
1081 		ret = mmc_get_ext_csd(card, ext_csd);
1082 		break;
1083 	default:
1084 		pr_err("%s: unknown driver specific operation\n",
1085 		       md->disk->disk_name);
1086 		ret = -EINVAL;
1087 		break;
1088 	}
1089 	mq_rq->drv_op_result = ret;
1090 	blk_mq_end_request(req, ret ? BLK_STS_IOERR : BLK_STS_OK);
1091 }
1092 
1093 static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
1094 {
1095 	struct mmc_blk_data *md = mq->blkdata;
1096 	struct mmc_card *card = md->queue.card;
1097 	unsigned int from, nr;
1098 	int err = 0, type = MMC_BLK_DISCARD;
1099 	blk_status_t status = BLK_STS_OK;
1100 
1101 	if (!mmc_can_erase(card)) {
1102 		status = BLK_STS_NOTSUPP;
1103 		goto fail;
1104 	}
1105 
1106 	from = blk_rq_pos(req);
1107 	nr = blk_rq_sectors(req);
1108 
1109 	do {
1110 		err = 0;
1111 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1112 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1113 					 INAND_CMD38_ARG_EXT_CSD,
1114 					 card->erase_arg == MMC_TRIM_ARG ?
1115 					 INAND_CMD38_ARG_TRIM :
1116 					 INAND_CMD38_ARG_ERASE,
1117 					 card->ext_csd.generic_cmd6_time);
1118 		}
1119 		if (!err)
1120 			err = mmc_erase(card, from, nr, card->erase_arg);
1121 	} while (err == -EIO && !mmc_blk_reset(md, card->host, type));
1122 	if (err)
1123 		status = BLK_STS_IOERR;
1124 	else
1125 		mmc_blk_reset_success(md, type);
1126 fail:
1127 	blk_mq_end_request(req, status);
1128 }
1129 
1130 static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
1131 				       struct request *req)
1132 {
1133 	struct mmc_blk_data *md = mq->blkdata;
1134 	struct mmc_card *card = md->queue.card;
1135 	unsigned int from, nr, arg;
1136 	int err = 0, type = MMC_BLK_SECDISCARD;
1137 	blk_status_t status = BLK_STS_OK;
1138 
1139 	if (!(mmc_can_secure_erase_trim(card))) {
1140 		status = BLK_STS_NOTSUPP;
1141 		goto out;
1142 	}
1143 
1144 	from = blk_rq_pos(req);
1145 	nr = blk_rq_sectors(req);
1146 
1147 	if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
1148 		arg = MMC_SECURE_TRIM1_ARG;
1149 	else
1150 		arg = MMC_SECURE_ERASE_ARG;
1151 
1152 retry:
1153 	if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1154 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1155 				 INAND_CMD38_ARG_EXT_CSD,
1156 				 arg == MMC_SECURE_TRIM1_ARG ?
1157 				 INAND_CMD38_ARG_SECTRIM1 :
1158 				 INAND_CMD38_ARG_SECERASE,
1159 				 card->ext_csd.generic_cmd6_time);
1160 		if (err)
1161 			goto out_retry;
1162 	}
1163 
1164 	err = mmc_erase(card, from, nr, arg);
1165 	if (err == -EIO)
1166 		goto out_retry;
1167 	if (err) {
1168 		status = BLK_STS_IOERR;
1169 		goto out;
1170 	}
1171 
1172 	if (arg == MMC_SECURE_TRIM1_ARG) {
1173 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1174 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1175 					 INAND_CMD38_ARG_EXT_CSD,
1176 					 INAND_CMD38_ARG_SECTRIM2,
1177 					 card->ext_csd.generic_cmd6_time);
1178 			if (err)
1179 				goto out_retry;
1180 		}
1181 
1182 		err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
1183 		if (err == -EIO)
1184 			goto out_retry;
1185 		if (err) {
1186 			status = BLK_STS_IOERR;
1187 			goto out;
1188 		}
1189 	}
1190 
1191 out_retry:
1192 	if (err && !mmc_blk_reset(md, card->host, type))
1193 		goto retry;
1194 	if (!err)
1195 		mmc_blk_reset_success(md, type);
1196 out:
1197 	blk_mq_end_request(req, status);
1198 }
1199 
1200 static void mmc_blk_issue_flush(struct mmc_queue *mq, struct request *req)
1201 {
1202 	struct mmc_blk_data *md = mq->blkdata;
1203 	struct mmc_card *card = md->queue.card;
1204 	int ret = 0;
1205 
1206 	ret = mmc_flush_cache(card->host);
1207 	blk_mq_end_request(req, ret ? BLK_STS_IOERR : BLK_STS_OK);
1208 }
1209 
1210 /*
1211  * Reformat current write as a reliable write, supporting
1212  * both legacy and the enhanced reliable write MMC cards.
1213  * In each transfer we'll handle only as much as a single
1214  * reliable write can handle, thus finish the request in
1215  * partial completions.
1216  */
1217 static inline void mmc_apply_rel_rw(struct mmc_blk_request *brq,
1218 				    struct mmc_card *card,
1219 				    struct request *req)
1220 {
1221 	if (!(card->ext_csd.rel_param & EXT_CSD_WR_REL_PARAM_EN)) {
1222 		/* Legacy mode imposes restrictions on transfers. */
1223 		if (!IS_ALIGNED(blk_rq_pos(req), card->ext_csd.rel_sectors))
1224 			brq->data.blocks = 1;
1225 
1226 		if (brq->data.blocks > card->ext_csd.rel_sectors)
1227 			brq->data.blocks = card->ext_csd.rel_sectors;
1228 		else if (brq->data.blocks < card->ext_csd.rel_sectors)
1229 			brq->data.blocks = 1;
1230 	}
1231 }
1232 
1233 #define CMD_ERRORS_EXCL_OOR						\
1234 	(R1_ADDRESS_ERROR |	/* Misaligned address */		\
1235 	 R1_BLOCK_LEN_ERROR |	/* Transferred block length incorrect */\
1236 	 R1_WP_VIOLATION |	/* Tried to write to protected block */	\
1237 	 R1_CARD_ECC_FAILED |	/* Card ECC failed */			\
1238 	 R1_CC_ERROR |		/* Card controller error */		\
1239 	 R1_ERROR)		/* General/unknown error */
1240 
1241 #define CMD_ERRORS							\
1242 	(CMD_ERRORS_EXCL_OOR |						\
1243 	 R1_OUT_OF_RANGE)	/* Command argument out of range */	\
1244 
1245 static void mmc_blk_eval_resp_error(struct mmc_blk_request *brq)
1246 {
1247 	u32 val;
1248 
1249 	/*
1250 	 * Per the SD specification(physical layer version 4.10)[1],
1251 	 * section 4.3.3, it explicitly states that "When the last
1252 	 * block of user area is read using CMD18, the host should
1253 	 * ignore OUT_OF_RANGE error that may occur even the sequence
1254 	 * is correct". And JESD84-B51 for eMMC also has a similar
1255 	 * statement on section 6.8.3.
1256 	 *
1257 	 * Multiple block read/write could be done by either predefined
1258 	 * method, namely CMD23, or open-ending mode. For open-ending mode,
1259 	 * we should ignore the OUT_OF_RANGE error as it's normal behaviour.
1260 	 *
1261 	 * However the spec[1] doesn't tell us whether we should also
1262 	 * ignore that for predefined method. But per the spec[1], section
1263 	 * 4.15 Set Block Count Command, it says"If illegal block count
1264 	 * is set, out of range error will be indicated during read/write
1265 	 * operation (For example, data transfer is stopped at user area
1266 	 * boundary)." In another word, we could expect a out of range error
1267 	 * in the response for the following CMD18/25. And if argument of
1268 	 * CMD23 + the argument of CMD18/25 exceed the max number of blocks,
1269 	 * we could also expect to get a -ETIMEDOUT or any error number from
1270 	 * the host drivers due to missing data response(for write)/data(for
1271 	 * read), as the cards will stop the data transfer by itself per the
1272 	 * spec. So we only need to check R1_OUT_OF_RANGE for open-ending mode.
1273 	 */
1274 
1275 	if (!brq->stop.error) {
1276 		bool oor_with_open_end;
1277 		/* If there is no error yet, check R1 response */
1278 
1279 		val = brq->stop.resp[0] & CMD_ERRORS;
1280 		oor_with_open_end = val & R1_OUT_OF_RANGE && !brq->mrq.sbc;
1281 
1282 		if (val && !oor_with_open_end)
1283 			brq->stop.error = -EIO;
1284 	}
1285 }
1286 
1287 static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
1288 			      int disable_multi, bool *do_rel_wr_p,
1289 			      bool *do_data_tag_p)
1290 {
1291 	struct mmc_blk_data *md = mq->blkdata;
1292 	struct mmc_card *card = md->queue.card;
1293 	struct mmc_blk_request *brq = &mqrq->brq;
1294 	struct request *req = mmc_queue_req_to_req(mqrq);
1295 	bool do_rel_wr, do_data_tag;
1296 
1297 	/*
1298 	 * Reliable writes are used to implement Forced Unit Access and
1299 	 * are supported only on MMCs.
1300 	 */
1301 	do_rel_wr = (req->cmd_flags & REQ_FUA) &&
1302 		    rq_data_dir(req) == WRITE &&
1303 		    (md->flags & MMC_BLK_REL_WR);
1304 
1305 	memset(brq, 0, sizeof(struct mmc_blk_request));
1306 
1307 	mmc_crypto_prepare_req(mqrq);
1308 
1309 	brq->mrq.data = &brq->data;
1310 	brq->mrq.tag = req->tag;
1311 
1312 	brq->stop.opcode = MMC_STOP_TRANSMISSION;
1313 	brq->stop.arg = 0;
1314 
1315 	if (rq_data_dir(req) == READ) {
1316 		brq->data.flags = MMC_DATA_READ;
1317 		brq->stop.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
1318 	} else {
1319 		brq->data.flags = MMC_DATA_WRITE;
1320 		brq->stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
1321 	}
1322 
1323 	brq->data.blksz = 512;
1324 	brq->data.blocks = blk_rq_sectors(req);
1325 	brq->data.blk_addr = blk_rq_pos(req);
1326 
1327 	/*
1328 	 * The command queue supports 2 priorities: "high" (1) and "simple" (0).
1329 	 * The eMMC will give "high" priority tasks priority over "simple"
1330 	 * priority tasks. Here we always set "simple" priority by not setting
1331 	 * MMC_DATA_PRIO.
1332 	 */
1333 
1334 	/*
1335 	 * The block layer doesn't support all sector count
1336 	 * restrictions, so we need to be prepared for too big
1337 	 * requests.
1338 	 */
1339 	if (brq->data.blocks > card->host->max_blk_count)
1340 		brq->data.blocks = card->host->max_blk_count;
1341 
1342 	if (brq->data.blocks > 1) {
1343 		/*
1344 		 * Some SD cards in SPI mode return a CRC error or even lock up
1345 		 * completely when trying to read the last block using a
1346 		 * multiblock read command.
1347 		 */
1348 		if (mmc_host_is_spi(card->host) && (rq_data_dir(req) == READ) &&
1349 		    (blk_rq_pos(req) + blk_rq_sectors(req) ==
1350 		     get_capacity(md->disk)))
1351 			brq->data.blocks--;
1352 
1353 		/*
1354 		 * After a read error, we redo the request one sector
1355 		 * at a time in order to accurately determine which
1356 		 * sectors can be read successfully.
1357 		 */
1358 		if (disable_multi)
1359 			brq->data.blocks = 1;
1360 
1361 		/*
1362 		 * Some controllers have HW issues while operating
1363 		 * in multiple I/O mode
1364 		 */
1365 		if (card->host->ops->multi_io_quirk)
1366 			brq->data.blocks = card->host->ops->multi_io_quirk(card,
1367 						(rq_data_dir(req) == READ) ?
1368 						MMC_DATA_READ : MMC_DATA_WRITE,
1369 						brq->data.blocks);
1370 	}
1371 
1372 	if (do_rel_wr) {
1373 		mmc_apply_rel_rw(brq, card, req);
1374 		brq->data.flags |= MMC_DATA_REL_WR;
1375 	}
1376 
1377 	/*
1378 	 * Data tag is used only during writing meta data to speed
1379 	 * up write and any subsequent read of this meta data
1380 	 */
1381 	do_data_tag = card->ext_csd.data_tag_unit_size &&
1382 		      (req->cmd_flags & REQ_META) &&
1383 		      (rq_data_dir(req) == WRITE) &&
1384 		      ((brq->data.blocks * brq->data.blksz) >=
1385 		       card->ext_csd.data_tag_unit_size);
1386 
1387 	if (do_data_tag)
1388 		brq->data.flags |= MMC_DATA_DAT_TAG;
1389 
1390 	mmc_set_data_timeout(&brq->data, card);
1391 
1392 	brq->data.sg = mqrq->sg;
1393 	brq->data.sg_len = mmc_queue_map_sg(mq, mqrq);
1394 
1395 	/*
1396 	 * Adjust the sg list so it is the same size as the
1397 	 * request.
1398 	 */
1399 	if (brq->data.blocks != blk_rq_sectors(req)) {
1400 		int i, data_size = brq->data.blocks << 9;
1401 		struct scatterlist *sg;
1402 
1403 		for_each_sg(brq->data.sg, sg, brq->data.sg_len, i) {
1404 			data_size -= sg->length;
1405 			if (data_size <= 0) {
1406 				sg->length += data_size;
1407 				i++;
1408 				break;
1409 			}
1410 		}
1411 		brq->data.sg_len = i;
1412 	}
1413 
1414 	if (do_rel_wr_p)
1415 		*do_rel_wr_p = do_rel_wr;
1416 
1417 	if (do_data_tag_p)
1418 		*do_data_tag_p = do_data_tag;
1419 }
1420 
1421 #define MMC_CQE_RETRIES 2
1422 
1423 static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
1424 {
1425 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1426 	struct mmc_request *mrq = &mqrq->brq.mrq;
1427 	struct request_queue *q = req->q;
1428 	struct mmc_host *host = mq->card->host;
1429 	enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
1430 	unsigned long flags;
1431 	bool put_card;
1432 	int err;
1433 
1434 	mmc_cqe_post_req(host, mrq);
1435 
1436 	if (mrq->cmd && mrq->cmd->error)
1437 		err = mrq->cmd->error;
1438 	else if (mrq->data && mrq->data->error)
1439 		err = mrq->data->error;
1440 	else
1441 		err = 0;
1442 
1443 	if (err) {
1444 		if (mqrq->retries++ < MMC_CQE_RETRIES)
1445 			blk_mq_requeue_request(req, true);
1446 		else
1447 			blk_mq_end_request(req, BLK_STS_IOERR);
1448 	} else if (mrq->data) {
1449 		if (blk_update_request(req, BLK_STS_OK, mrq->data->bytes_xfered))
1450 			blk_mq_requeue_request(req, true);
1451 		else
1452 			__blk_mq_end_request(req, BLK_STS_OK);
1453 	} else {
1454 		blk_mq_end_request(req, BLK_STS_OK);
1455 	}
1456 
1457 	spin_lock_irqsave(&mq->lock, flags);
1458 
1459 	mq->in_flight[issue_type] -= 1;
1460 
1461 	put_card = (mmc_tot_in_flight(mq) == 0);
1462 
1463 	mmc_cqe_check_busy(mq);
1464 
1465 	spin_unlock_irqrestore(&mq->lock, flags);
1466 
1467 	if (!mq->cqe_busy)
1468 		blk_mq_run_hw_queues(q, true);
1469 
1470 	if (put_card)
1471 		mmc_put_card(mq->card, &mq->ctx);
1472 }
1473 
1474 void mmc_blk_cqe_recovery(struct mmc_queue *mq)
1475 {
1476 	struct mmc_card *card = mq->card;
1477 	struct mmc_host *host = card->host;
1478 	int err;
1479 
1480 	pr_debug("%s: CQE recovery start\n", mmc_hostname(host));
1481 
1482 	err = mmc_cqe_recovery(host);
1483 	if (err)
1484 		mmc_blk_reset(mq->blkdata, host, MMC_BLK_CQE_RECOVERY);
1485 	else
1486 		mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
1487 
1488 	pr_debug("%s: CQE recovery done\n", mmc_hostname(host));
1489 }
1490 
1491 static void mmc_blk_cqe_req_done(struct mmc_request *mrq)
1492 {
1493 	struct mmc_queue_req *mqrq = container_of(mrq, struct mmc_queue_req,
1494 						  brq.mrq);
1495 	struct request *req = mmc_queue_req_to_req(mqrq);
1496 	struct request_queue *q = req->q;
1497 	struct mmc_queue *mq = q->queuedata;
1498 
1499 	/*
1500 	 * Block layer timeouts race with completions which means the normal
1501 	 * completion path cannot be used during recovery.
1502 	 */
1503 	if (mq->in_recovery)
1504 		mmc_blk_cqe_complete_rq(mq, req);
1505 	else if (likely(!blk_should_fake_timeout(req->q)))
1506 		blk_mq_complete_request(req);
1507 }
1508 
1509 static int mmc_blk_cqe_start_req(struct mmc_host *host, struct mmc_request *mrq)
1510 {
1511 	mrq->done		= mmc_blk_cqe_req_done;
1512 	mrq->recovery_notifier	= mmc_cqe_recovery_notifier;
1513 
1514 	return mmc_cqe_start_req(host, mrq);
1515 }
1516 
1517 static struct mmc_request *mmc_blk_cqe_prep_dcmd(struct mmc_queue_req *mqrq,
1518 						 struct request *req)
1519 {
1520 	struct mmc_blk_request *brq = &mqrq->brq;
1521 
1522 	memset(brq, 0, sizeof(*brq));
1523 
1524 	brq->mrq.cmd = &brq->cmd;
1525 	brq->mrq.tag = req->tag;
1526 
1527 	return &brq->mrq;
1528 }
1529 
1530 static int mmc_blk_cqe_issue_flush(struct mmc_queue *mq, struct request *req)
1531 {
1532 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1533 	struct mmc_request *mrq = mmc_blk_cqe_prep_dcmd(mqrq, req);
1534 
1535 	mrq->cmd->opcode = MMC_SWITCH;
1536 	mrq->cmd->arg = (MMC_SWITCH_MODE_WRITE_BYTE << 24) |
1537 			(EXT_CSD_FLUSH_CACHE << 16) |
1538 			(1 << 8) |
1539 			EXT_CSD_CMD_SET_NORMAL;
1540 	mrq->cmd->flags = MMC_CMD_AC | MMC_RSP_R1B;
1541 
1542 	return mmc_blk_cqe_start_req(mq->card->host, mrq);
1543 }
1544 
1545 static int mmc_blk_hsq_issue_rw_rq(struct mmc_queue *mq, struct request *req)
1546 {
1547 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1548 	struct mmc_host *host = mq->card->host;
1549 	int err;
1550 
1551 	mmc_blk_rw_rq_prep(mqrq, mq->card, 0, mq);
1552 	mqrq->brq.mrq.done = mmc_blk_hsq_req_done;
1553 	mmc_pre_req(host, &mqrq->brq.mrq);
1554 
1555 	err = mmc_cqe_start_req(host, &mqrq->brq.mrq);
1556 	if (err)
1557 		mmc_post_req(host, &mqrq->brq.mrq, err);
1558 
1559 	return err;
1560 }
1561 
1562 static int mmc_blk_cqe_issue_rw_rq(struct mmc_queue *mq, struct request *req)
1563 {
1564 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1565 	struct mmc_host *host = mq->card->host;
1566 
1567 	if (host->hsq_enabled)
1568 		return mmc_blk_hsq_issue_rw_rq(mq, req);
1569 
1570 	mmc_blk_data_prep(mq, mqrq, 0, NULL, NULL);
1571 
1572 	return mmc_blk_cqe_start_req(mq->card->host, &mqrq->brq.mrq);
1573 }
1574 
1575 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
1576 			       struct mmc_card *card,
1577 			       int disable_multi,
1578 			       struct mmc_queue *mq)
1579 {
1580 	u32 readcmd, writecmd;
1581 	struct mmc_blk_request *brq = &mqrq->brq;
1582 	struct request *req = mmc_queue_req_to_req(mqrq);
1583 	struct mmc_blk_data *md = mq->blkdata;
1584 	bool do_rel_wr, do_data_tag;
1585 
1586 	mmc_blk_data_prep(mq, mqrq, disable_multi, &do_rel_wr, &do_data_tag);
1587 
1588 	brq->mrq.cmd = &brq->cmd;
1589 
1590 	brq->cmd.arg = blk_rq_pos(req);
1591 	if (!mmc_card_blockaddr(card))
1592 		brq->cmd.arg <<= 9;
1593 	brq->cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
1594 
1595 	if (brq->data.blocks > 1 || do_rel_wr) {
1596 		/* SPI multiblock writes terminate using a special
1597 		 * token, not a STOP_TRANSMISSION request.
1598 		 */
1599 		if (!mmc_host_is_spi(card->host) ||
1600 		    rq_data_dir(req) == READ)
1601 			brq->mrq.stop = &brq->stop;
1602 		readcmd = MMC_READ_MULTIPLE_BLOCK;
1603 		writecmd = MMC_WRITE_MULTIPLE_BLOCK;
1604 	} else {
1605 		brq->mrq.stop = NULL;
1606 		readcmd = MMC_READ_SINGLE_BLOCK;
1607 		writecmd = MMC_WRITE_BLOCK;
1608 	}
1609 	brq->cmd.opcode = rq_data_dir(req) == READ ? readcmd : writecmd;
1610 
1611 	/*
1612 	 * Pre-defined multi-block transfers are preferable to
1613 	 * open ended-ones (and necessary for reliable writes).
1614 	 * However, it is not sufficient to just send CMD23,
1615 	 * and avoid the final CMD12, as on an error condition
1616 	 * CMD12 (stop) needs to be sent anyway. This, coupled
1617 	 * with Auto-CMD23 enhancements provided by some
1618 	 * hosts, means that the complexity of dealing
1619 	 * with this is best left to the host. If CMD23 is
1620 	 * supported by card and host, we'll fill sbc in and let
1621 	 * the host deal with handling it correctly. This means
1622 	 * that for hosts that don't expose MMC_CAP_CMD23, no
1623 	 * change of behavior will be observed.
1624 	 *
1625 	 * N.B: Some MMC cards experience perf degradation.
1626 	 * We'll avoid using CMD23-bounded multiblock writes for
1627 	 * these, while retaining features like reliable writes.
1628 	 */
1629 	if ((md->flags & MMC_BLK_CMD23) && mmc_op_multi(brq->cmd.opcode) &&
1630 	    (do_rel_wr || !(card->quirks & MMC_QUIRK_BLK_NO_CMD23) ||
1631 	     do_data_tag)) {
1632 		brq->sbc.opcode = MMC_SET_BLOCK_COUNT;
1633 		brq->sbc.arg = brq->data.blocks |
1634 			(do_rel_wr ? (1 << 31) : 0) |
1635 			(do_data_tag ? (1 << 29) : 0);
1636 		brq->sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
1637 		brq->mrq.sbc = &brq->sbc;
1638 	}
1639 }
1640 
1641 #define MMC_MAX_RETRIES		5
1642 #define MMC_DATA_RETRIES	2
1643 #define MMC_NO_RETRIES		(MMC_MAX_RETRIES + 1)
1644 
1645 static int mmc_blk_send_stop(struct mmc_card *card, unsigned int timeout)
1646 {
1647 	struct mmc_command cmd = {
1648 		.opcode = MMC_STOP_TRANSMISSION,
1649 		.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC,
1650 		/* Some hosts wait for busy anyway, so provide a busy timeout */
1651 		.busy_timeout = timeout,
1652 	};
1653 
1654 	return mmc_wait_for_cmd(card->host, &cmd, 5);
1655 }
1656 
1657 static int mmc_blk_fix_state(struct mmc_card *card, struct request *req)
1658 {
1659 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1660 	struct mmc_blk_request *brq = &mqrq->brq;
1661 	unsigned int timeout = mmc_blk_data_timeout_ms(card->host, &brq->data);
1662 	int err;
1663 
1664 	mmc_retune_hold_now(card->host);
1665 
1666 	mmc_blk_send_stop(card, timeout);
1667 
1668 	err = mmc_poll_for_busy(card, timeout, false, MMC_BUSY_IO);
1669 
1670 	mmc_retune_release(card->host);
1671 
1672 	return err;
1673 }
1674 
1675 #define MMC_READ_SINGLE_RETRIES	2
1676 
1677 /* Single sector read during recovery */
1678 static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req)
1679 {
1680 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1681 	struct mmc_request *mrq = &mqrq->brq.mrq;
1682 	struct mmc_card *card = mq->card;
1683 	struct mmc_host *host = card->host;
1684 	blk_status_t error = BLK_STS_OK;
1685 	int retries = 0;
1686 
1687 	do {
1688 		u32 status;
1689 		int err;
1690 
1691 		mmc_blk_rw_rq_prep(mqrq, card, 1, mq);
1692 
1693 		mmc_wait_for_req(host, mrq);
1694 
1695 		err = mmc_send_status(card, &status);
1696 		if (err)
1697 			goto error_exit;
1698 
1699 		if (!mmc_host_is_spi(host) &&
1700 		    !mmc_ready_for_data(status)) {
1701 			err = mmc_blk_fix_state(card, req);
1702 			if (err)
1703 				goto error_exit;
1704 		}
1705 
1706 		if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES)
1707 			continue;
1708 
1709 		retries = 0;
1710 
1711 		if (mrq->cmd->error ||
1712 		    mrq->data->error ||
1713 		    (!mmc_host_is_spi(host) &&
1714 		     (mrq->cmd->resp[0] & CMD_ERRORS || status & CMD_ERRORS)))
1715 			error = BLK_STS_IOERR;
1716 		else
1717 			error = BLK_STS_OK;
1718 
1719 	} while (blk_update_request(req, error, 512));
1720 
1721 	return;
1722 
1723 error_exit:
1724 	mrq->data->bytes_xfered = 0;
1725 	blk_update_request(req, BLK_STS_IOERR, 512);
1726 	/* Let it try the remaining request again */
1727 	if (mqrq->retries > MMC_MAX_RETRIES - 1)
1728 		mqrq->retries = MMC_MAX_RETRIES - 1;
1729 }
1730 
1731 static inline bool mmc_blk_oor_valid(struct mmc_blk_request *brq)
1732 {
1733 	return !!brq->mrq.sbc;
1734 }
1735 
1736 static inline u32 mmc_blk_stop_err_bits(struct mmc_blk_request *brq)
1737 {
1738 	return mmc_blk_oor_valid(brq) ? CMD_ERRORS : CMD_ERRORS_EXCL_OOR;
1739 }
1740 
1741 /*
1742  * Check for errors the host controller driver might not have seen such as
1743  * response mode errors or invalid card state.
1744  */
1745 static bool mmc_blk_status_error(struct request *req, u32 status)
1746 {
1747 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1748 	struct mmc_blk_request *brq = &mqrq->brq;
1749 	struct mmc_queue *mq = req->q->queuedata;
1750 	u32 stop_err_bits;
1751 
1752 	if (mmc_host_is_spi(mq->card->host))
1753 		return false;
1754 
1755 	stop_err_bits = mmc_blk_stop_err_bits(brq);
1756 
1757 	return brq->cmd.resp[0]  & CMD_ERRORS    ||
1758 	       brq->stop.resp[0] & stop_err_bits ||
1759 	       status            & stop_err_bits ||
1760 	       (rq_data_dir(req) == WRITE && !mmc_ready_for_data(status));
1761 }
1762 
1763 static inline bool mmc_blk_cmd_started(struct mmc_blk_request *brq)
1764 {
1765 	return !brq->sbc.error && !brq->cmd.error &&
1766 	       !(brq->cmd.resp[0] & CMD_ERRORS);
1767 }
1768 
1769 /*
1770  * Requests are completed by mmc_blk_mq_complete_rq() which sets simple
1771  * policy:
1772  * 1. A request that has transferred at least some data is considered
1773  * successful and will be requeued if there is remaining data to
1774  * transfer.
1775  * 2. Otherwise the number of retries is incremented and the request
1776  * will be requeued if there are remaining retries.
1777  * 3. Otherwise the request will be errored out.
1778  * That means mmc_blk_mq_complete_rq() is controlled by bytes_xfered and
1779  * mqrq->retries. So there are only 4 possible actions here:
1780  *	1. do not accept the bytes_xfered value i.e. set it to zero
1781  *	2. change mqrq->retries to determine the number of retries
1782  *	3. try to reset the card
1783  *	4. read one sector at a time
1784  */
1785 static void mmc_blk_mq_rw_recovery(struct mmc_queue *mq, struct request *req)
1786 {
1787 	int type = rq_data_dir(req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
1788 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1789 	struct mmc_blk_request *brq = &mqrq->brq;
1790 	struct mmc_blk_data *md = mq->blkdata;
1791 	struct mmc_card *card = mq->card;
1792 	u32 status;
1793 	u32 blocks;
1794 	int err;
1795 
1796 	/*
1797 	 * Some errors the host driver might not have seen. Set the number of
1798 	 * bytes transferred to zero in that case.
1799 	 */
1800 	err = __mmc_send_status(card, &status, 0);
1801 	if (err || mmc_blk_status_error(req, status))
1802 		brq->data.bytes_xfered = 0;
1803 
1804 	mmc_retune_release(card->host);
1805 
1806 	/*
1807 	 * Try again to get the status. This also provides an opportunity for
1808 	 * re-tuning.
1809 	 */
1810 	if (err)
1811 		err = __mmc_send_status(card, &status, 0);
1812 
1813 	/*
1814 	 * Nothing more to do after the number of bytes transferred has been
1815 	 * updated and there is no card.
1816 	 */
1817 	if (err && mmc_detect_card_removed(card->host))
1818 		return;
1819 
1820 	/* Try to get back to "tran" state */
1821 	if (!mmc_host_is_spi(mq->card->host) &&
1822 	    (err || !mmc_ready_for_data(status)))
1823 		err = mmc_blk_fix_state(mq->card, req);
1824 
1825 	/*
1826 	 * Special case for SD cards where the card might record the number of
1827 	 * blocks written.
1828 	 */
1829 	if (!err && mmc_blk_cmd_started(brq) && mmc_card_sd(card) &&
1830 	    rq_data_dir(req) == WRITE) {
1831 		if (mmc_sd_num_wr_blocks(card, &blocks))
1832 			brq->data.bytes_xfered = 0;
1833 		else
1834 			brq->data.bytes_xfered = blocks << 9;
1835 	}
1836 
1837 	/* Reset if the card is in a bad state */
1838 	if (!mmc_host_is_spi(mq->card->host) &&
1839 	    err && mmc_blk_reset(md, card->host, type)) {
1840 		pr_err("%s: recovery failed!\n", req->rq_disk->disk_name);
1841 		mqrq->retries = MMC_NO_RETRIES;
1842 		return;
1843 	}
1844 
1845 	/*
1846 	 * If anything was done, just return and if there is anything remaining
1847 	 * on the request it will get requeued.
1848 	 */
1849 	if (brq->data.bytes_xfered)
1850 		return;
1851 
1852 	/* Reset before last retry */
1853 	if (mqrq->retries + 1 == MMC_MAX_RETRIES)
1854 		mmc_blk_reset(md, card->host, type);
1855 
1856 	/* Command errors fail fast, so use all MMC_MAX_RETRIES */
1857 	if (brq->sbc.error || brq->cmd.error)
1858 		return;
1859 
1860 	/* Reduce the remaining retries for data errors */
1861 	if (mqrq->retries < MMC_MAX_RETRIES - MMC_DATA_RETRIES) {
1862 		mqrq->retries = MMC_MAX_RETRIES - MMC_DATA_RETRIES;
1863 		return;
1864 	}
1865 
1866 	/* FIXME: Missing single sector read for large sector size */
1867 	if (!mmc_large_sector(card) && rq_data_dir(req) == READ &&
1868 	    brq->data.blocks > 1) {
1869 		/* Read one sector at a time */
1870 		mmc_blk_read_single(mq, req);
1871 		return;
1872 	}
1873 }
1874 
1875 static inline bool mmc_blk_rq_error(struct mmc_blk_request *brq)
1876 {
1877 	mmc_blk_eval_resp_error(brq);
1878 
1879 	return brq->sbc.error || brq->cmd.error || brq->stop.error ||
1880 	       brq->data.error || brq->cmd.resp[0] & CMD_ERRORS;
1881 }
1882 
1883 static int mmc_blk_busy_cb(void *cb_data, bool *busy)
1884 {
1885 	struct mmc_blk_busy_data *data = cb_data;
1886 	u32 status = 0;
1887 	int err;
1888 
1889 	err = mmc_send_status(data->card, &status);
1890 	if (err)
1891 		return err;
1892 
1893 	/* Accumulate response error bits. */
1894 	data->status |= status;
1895 
1896 	*busy = !mmc_ready_for_data(status);
1897 	return 0;
1898 }
1899 
1900 static int mmc_blk_card_busy(struct mmc_card *card, struct request *req)
1901 {
1902 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1903 	struct mmc_blk_busy_data cb_data;
1904 	int err;
1905 
1906 	if (mmc_host_is_spi(card->host) || rq_data_dir(req) == READ)
1907 		return 0;
1908 
1909 	cb_data.card = card;
1910 	cb_data.status = 0;
1911 	err = __mmc_poll_for_busy(card, MMC_BLK_TIMEOUT_MS, &mmc_blk_busy_cb,
1912 				  &cb_data);
1913 
1914 	/*
1915 	 * Do not assume data transferred correctly if there are any error bits
1916 	 * set.
1917 	 */
1918 	if (cb_data.status & mmc_blk_stop_err_bits(&mqrq->brq)) {
1919 		mqrq->brq.data.bytes_xfered = 0;
1920 		err = err ? err : -EIO;
1921 	}
1922 
1923 	/* Copy the exception bit so it will be seen later on */
1924 	if (mmc_card_mmc(card) && cb_data.status & R1_EXCEPTION_EVENT)
1925 		mqrq->brq.cmd.resp[0] |= R1_EXCEPTION_EVENT;
1926 
1927 	return err;
1928 }
1929 
1930 static inline void mmc_blk_rw_reset_success(struct mmc_queue *mq,
1931 					    struct request *req)
1932 {
1933 	int type = rq_data_dir(req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
1934 
1935 	mmc_blk_reset_success(mq->blkdata, type);
1936 }
1937 
1938 static void mmc_blk_mq_complete_rq(struct mmc_queue *mq, struct request *req)
1939 {
1940 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
1941 	unsigned int nr_bytes = mqrq->brq.data.bytes_xfered;
1942 
1943 	if (nr_bytes) {
1944 		if (blk_update_request(req, BLK_STS_OK, nr_bytes))
1945 			blk_mq_requeue_request(req, true);
1946 		else
1947 			__blk_mq_end_request(req, BLK_STS_OK);
1948 	} else if (!blk_rq_bytes(req)) {
1949 		__blk_mq_end_request(req, BLK_STS_IOERR);
1950 	} else if (mqrq->retries++ < MMC_MAX_RETRIES) {
1951 		blk_mq_requeue_request(req, true);
1952 	} else {
1953 		if (mmc_card_removed(mq->card))
1954 			req->rq_flags |= RQF_QUIET;
1955 		blk_mq_end_request(req, BLK_STS_IOERR);
1956 	}
1957 }
1958 
1959 static bool mmc_blk_urgent_bkops_needed(struct mmc_queue *mq,
1960 					struct mmc_queue_req *mqrq)
1961 {
1962 	return mmc_card_mmc(mq->card) && !mmc_host_is_spi(mq->card->host) &&
1963 	       (mqrq->brq.cmd.resp[0] & R1_EXCEPTION_EVENT ||
1964 		mqrq->brq.stop.resp[0] & R1_EXCEPTION_EVENT);
1965 }
1966 
1967 static void mmc_blk_urgent_bkops(struct mmc_queue *mq,
1968 				 struct mmc_queue_req *mqrq)
1969 {
1970 	if (mmc_blk_urgent_bkops_needed(mq, mqrq))
1971 		mmc_run_bkops(mq->card);
1972 }
1973 
1974 static void mmc_blk_hsq_req_done(struct mmc_request *mrq)
1975 {
1976 	struct mmc_queue_req *mqrq =
1977 		container_of(mrq, struct mmc_queue_req, brq.mrq);
1978 	struct request *req = mmc_queue_req_to_req(mqrq);
1979 	struct request_queue *q = req->q;
1980 	struct mmc_queue *mq = q->queuedata;
1981 	struct mmc_host *host = mq->card->host;
1982 	unsigned long flags;
1983 
1984 	if (mmc_blk_rq_error(&mqrq->brq) ||
1985 	    mmc_blk_urgent_bkops_needed(mq, mqrq)) {
1986 		spin_lock_irqsave(&mq->lock, flags);
1987 		mq->recovery_needed = true;
1988 		mq->recovery_req = req;
1989 		spin_unlock_irqrestore(&mq->lock, flags);
1990 
1991 		host->cqe_ops->cqe_recovery_start(host);
1992 
1993 		schedule_work(&mq->recovery_work);
1994 		return;
1995 	}
1996 
1997 	mmc_blk_rw_reset_success(mq, req);
1998 
1999 	/*
2000 	 * Block layer timeouts race with completions which means the normal
2001 	 * completion path cannot be used during recovery.
2002 	 */
2003 	if (mq->in_recovery)
2004 		mmc_blk_cqe_complete_rq(mq, req);
2005 	else if (likely(!blk_should_fake_timeout(req->q)))
2006 		blk_mq_complete_request(req);
2007 }
2008 
2009 void mmc_blk_mq_complete(struct request *req)
2010 {
2011 	struct mmc_queue *mq = req->q->queuedata;
2012 	struct mmc_host *host = mq->card->host;
2013 
2014 	if (host->cqe_enabled)
2015 		mmc_blk_cqe_complete_rq(mq, req);
2016 	else if (likely(!blk_should_fake_timeout(req->q)))
2017 		mmc_blk_mq_complete_rq(mq, req);
2018 }
2019 
2020 static void mmc_blk_mq_poll_completion(struct mmc_queue *mq,
2021 				       struct request *req)
2022 {
2023 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
2024 	struct mmc_host *host = mq->card->host;
2025 
2026 	if (mmc_blk_rq_error(&mqrq->brq) ||
2027 	    mmc_blk_card_busy(mq->card, req)) {
2028 		mmc_blk_mq_rw_recovery(mq, req);
2029 	} else {
2030 		mmc_blk_rw_reset_success(mq, req);
2031 		mmc_retune_release(host);
2032 	}
2033 
2034 	mmc_blk_urgent_bkops(mq, mqrq);
2035 }
2036 
2037 static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, struct request *req)
2038 {
2039 	unsigned long flags;
2040 	bool put_card;
2041 
2042 	spin_lock_irqsave(&mq->lock, flags);
2043 
2044 	mq->in_flight[mmc_issue_type(mq, req)] -= 1;
2045 
2046 	put_card = (mmc_tot_in_flight(mq) == 0);
2047 
2048 	spin_unlock_irqrestore(&mq->lock, flags);
2049 
2050 	if (put_card)
2051 		mmc_put_card(mq->card, &mq->ctx);
2052 }
2053 
2054 static void mmc_blk_mq_post_req(struct mmc_queue *mq, struct request *req)
2055 {
2056 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
2057 	struct mmc_request *mrq = &mqrq->brq.mrq;
2058 	struct mmc_host *host = mq->card->host;
2059 
2060 	mmc_post_req(host, mrq, 0);
2061 
2062 	/*
2063 	 * Block layer timeouts race with completions which means the normal
2064 	 * completion path cannot be used during recovery.
2065 	 */
2066 	if (mq->in_recovery)
2067 		mmc_blk_mq_complete_rq(mq, req);
2068 	else if (likely(!blk_should_fake_timeout(req->q)))
2069 		blk_mq_complete_request(req);
2070 
2071 	mmc_blk_mq_dec_in_flight(mq, req);
2072 }
2073 
2074 void mmc_blk_mq_recovery(struct mmc_queue *mq)
2075 {
2076 	struct request *req = mq->recovery_req;
2077 	struct mmc_host *host = mq->card->host;
2078 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
2079 
2080 	mq->recovery_req = NULL;
2081 	mq->rw_wait = false;
2082 
2083 	if (mmc_blk_rq_error(&mqrq->brq)) {
2084 		mmc_retune_hold_now(host);
2085 		mmc_blk_mq_rw_recovery(mq, req);
2086 	}
2087 
2088 	mmc_blk_urgent_bkops(mq, mqrq);
2089 
2090 	mmc_blk_mq_post_req(mq, req);
2091 }
2092 
2093 static void mmc_blk_mq_complete_prev_req(struct mmc_queue *mq,
2094 					 struct request **prev_req)
2095 {
2096 	if (mmc_host_done_complete(mq->card->host))
2097 		return;
2098 
2099 	mutex_lock(&mq->complete_lock);
2100 
2101 	if (!mq->complete_req)
2102 		goto out_unlock;
2103 
2104 	mmc_blk_mq_poll_completion(mq, mq->complete_req);
2105 
2106 	if (prev_req)
2107 		*prev_req = mq->complete_req;
2108 	else
2109 		mmc_blk_mq_post_req(mq, mq->complete_req);
2110 
2111 	mq->complete_req = NULL;
2112 
2113 out_unlock:
2114 	mutex_unlock(&mq->complete_lock);
2115 }
2116 
2117 void mmc_blk_mq_complete_work(struct work_struct *work)
2118 {
2119 	struct mmc_queue *mq = container_of(work, struct mmc_queue,
2120 					    complete_work);
2121 
2122 	mmc_blk_mq_complete_prev_req(mq, NULL);
2123 }
2124 
2125 static void mmc_blk_mq_req_done(struct mmc_request *mrq)
2126 {
2127 	struct mmc_queue_req *mqrq = container_of(mrq, struct mmc_queue_req,
2128 						  brq.mrq);
2129 	struct request *req = mmc_queue_req_to_req(mqrq);
2130 	struct request_queue *q = req->q;
2131 	struct mmc_queue *mq = q->queuedata;
2132 	struct mmc_host *host = mq->card->host;
2133 	unsigned long flags;
2134 
2135 	if (!mmc_host_done_complete(host)) {
2136 		bool waiting;
2137 
2138 		/*
2139 		 * We cannot complete the request in this context, so record
2140 		 * that there is a request to complete, and that a following
2141 		 * request does not need to wait (although it does need to
2142 		 * complete complete_req first).
2143 		 */
2144 		spin_lock_irqsave(&mq->lock, flags);
2145 		mq->complete_req = req;
2146 		mq->rw_wait = false;
2147 		waiting = mq->waiting;
2148 		spin_unlock_irqrestore(&mq->lock, flags);
2149 
2150 		/*
2151 		 * If 'waiting' then the waiting task will complete this
2152 		 * request, otherwise queue a work to do it. Note that
2153 		 * complete_work may still race with the dispatch of a following
2154 		 * request.
2155 		 */
2156 		if (waiting)
2157 			wake_up(&mq->wait);
2158 		else
2159 			queue_work(mq->card->complete_wq, &mq->complete_work);
2160 
2161 		return;
2162 	}
2163 
2164 	/* Take the recovery path for errors or urgent background operations */
2165 	if (mmc_blk_rq_error(&mqrq->brq) ||
2166 	    mmc_blk_urgent_bkops_needed(mq, mqrq)) {
2167 		spin_lock_irqsave(&mq->lock, flags);
2168 		mq->recovery_needed = true;
2169 		mq->recovery_req = req;
2170 		spin_unlock_irqrestore(&mq->lock, flags);
2171 		wake_up(&mq->wait);
2172 		schedule_work(&mq->recovery_work);
2173 		return;
2174 	}
2175 
2176 	mmc_blk_rw_reset_success(mq, req);
2177 
2178 	mq->rw_wait = false;
2179 	wake_up(&mq->wait);
2180 
2181 	mmc_blk_mq_post_req(mq, req);
2182 }
2183 
2184 static bool mmc_blk_rw_wait_cond(struct mmc_queue *mq, int *err)
2185 {
2186 	unsigned long flags;
2187 	bool done;
2188 
2189 	/*
2190 	 * Wait while there is another request in progress, but not if recovery
2191 	 * is needed. Also indicate whether there is a request waiting to start.
2192 	 */
2193 	spin_lock_irqsave(&mq->lock, flags);
2194 	if (mq->recovery_needed) {
2195 		*err = -EBUSY;
2196 		done = true;
2197 	} else {
2198 		done = !mq->rw_wait;
2199 	}
2200 	mq->waiting = !done;
2201 	spin_unlock_irqrestore(&mq->lock, flags);
2202 
2203 	return done;
2204 }
2205 
2206 static int mmc_blk_rw_wait(struct mmc_queue *mq, struct request **prev_req)
2207 {
2208 	int err = 0;
2209 
2210 	wait_event(mq->wait, mmc_blk_rw_wait_cond(mq, &err));
2211 
2212 	/* Always complete the previous request if there is one */
2213 	mmc_blk_mq_complete_prev_req(mq, prev_req);
2214 
2215 	return err;
2216 }
2217 
2218 static int mmc_blk_mq_issue_rw_rq(struct mmc_queue *mq,
2219 				  struct request *req)
2220 {
2221 	struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
2222 	struct mmc_host *host = mq->card->host;
2223 	struct request *prev_req = NULL;
2224 	int err = 0;
2225 
2226 	mmc_blk_rw_rq_prep(mqrq, mq->card, 0, mq);
2227 
2228 	mqrq->brq.mrq.done = mmc_blk_mq_req_done;
2229 
2230 	mmc_pre_req(host, &mqrq->brq.mrq);
2231 
2232 	err = mmc_blk_rw_wait(mq, &prev_req);
2233 	if (err)
2234 		goto out_post_req;
2235 
2236 	mq->rw_wait = true;
2237 
2238 	err = mmc_start_request(host, &mqrq->brq.mrq);
2239 
2240 	if (prev_req)
2241 		mmc_blk_mq_post_req(mq, prev_req);
2242 
2243 	if (err)
2244 		mq->rw_wait = false;
2245 
2246 	/* Release re-tuning here where there is no synchronization required */
2247 	if (err || mmc_host_done_complete(host))
2248 		mmc_retune_release(host);
2249 
2250 out_post_req:
2251 	if (err)
2252 		mmc_post_req(host, &mqrq->brq.mrq, err);
2253 
2254 	return err;
2255 }
2256 
2257 static int mmc_blk_wait_for_idle(struct mmc_queue *mq, struct mmc_host *host)
2258 {
2259 	if (host->cqe_enabled)
2260 		return host->cqe_ops->cqe_wait_for_idle(host);
2261 
2262 	return mmc_blk_rw_wait(mq, NULL);
2263 }
2264 
2265 enum mmc_issued mmc_blk_mq_issue_rq(struct mmc_queue *mq, struct request *req)
2266 {
2267 	struct mmc_blk_data *md = mq->blkdata;
2268 	struct mmc_card *card = md->queue.card;
2269 	struct mmc_host *host = card->host;
2270 	int ret;
2271 
2272 	ret = mmc_blk_part_switch(card, md->part_type);
2273 	if (ret)
2274 		return MMC_REQ_FAILED_TO_START;
2275 
2276 	switch (mmc_issue_type(mq, req)) {
2277 	case MMC_ISSUE_SYNC:
2278 		ret = mmc_blk_wait_for_idle(mq, host);
2279 		if (ret)
2280 			return MMC_REQ_BUSY;
2281 		switch (req_op(req)) {
2282 		case REQ_OP_DRV_IN:
2283 		case REQ_OP_DRV_OUT:
2284 			mmc_blk_issue_drv_op(mq, req);
2285 			break;
2286 		case REQ_OP_DISCARD:
2287 			mmc_blk_issue_discard_rq(mq, req);
2288 			break;
2289 		case REQ_OP_SECURE_ERASE:
2290 			mmc_blk_issue_secdiscard_rq(mq, req);
2291 			break;
2292 		case REQ_OP_FLUSH:
2293 			mmc_blk_issue_flush(mq, req);
2294 			break;
2295 		default:
2296 			WARN_ON_ONCE(1);
2297 			return MMC_REQ_FAILED_TO_START;
2298 		}
2299 		return MMC_REQ_FINISHED;
2300 	case MMC_ISSUE_DCMD:
2301 	case MMC_ISSUE_ASYNC:
2302 		switch (req_op(req)) {
2303 		case REQ_OP_FLUSH:
2304 			if (!mmc_cache_enabled(host)) {
2305 				blk_mq_end_request(req, BLK_STS_OK);
2306 				return MMC_REQ_FINISHED;
2307 			}
2308 			ret = mmc_blk_cqe_issue_flush(mq, req);
2309 			break;
2310 		case REQ_OP_READ:
2311 		case REQ_OP_WRITE:
2312 			if (host->cqe_enabled)
2313 				ret = mmc_blk_cqe_issue_rw_rq(mq, req);
2314 			else
2315 				ret = mmc_blk_mq_issue_rw_rq(mq, req);
2316 			break;
2317 		default:
2318 			WARN_ON_ONCE(1);
2319 			ret = -EINVAL;
2320 		}
2321 		if (!ret)
2322 			return MMC_REQ_STARTED;
2323 		return ret == -EBUSY ? MMC_REQ_BUSY : MMC_REQ_FAILED_TO_START;
2324 	default:
2325 		WARN_ON_ONCE(1);
2326 		return MMC_REQ_FAILED_TO_START;
2327 	}
2328 }
2329 
2330 static inline int mmc_blk_readonly(struct mmc_card *card)
2331 {
2332 	return mmc_card_readonly(card) ||
2333 	       !(card->csd.cmdclass & CCC_BLOCK_WRITE);
2334 }
2335 
2336 static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
2337 					      struct device *parent,
2338 					      sector_t size,
2339 					      bool default_ro,
2340 					      const char *subname,
2341 					      int area_type,
2342 					      unsigned int part_type)
2343 {
2344 	struct mmc_blk_data *md;
2345 	int devidx, ret;
2346 	char cap_str[10];
2347 
2348 	devidx = ida_simple_get(&mmc_blk_ida, 0, max_devices, GFP_KERNEL);
2349 	if (devidx < 0) {
2350 		/*
2351 		 * We get -ENOSPC because there are no more any available
2352 		 * devidx. The reason may be that, either userspace haven't yet
2353 		 * unmounted the partitions, which postpones mmc_blk_release()
2354 		 * from being called, or the device has more partitions than
2355 		 * what we support.
2356 		 */
2357 		if (devidx == -ENOSPC)
2358 			dev_err(mmc_dev(card->host),
2359 				"no more device IDs available\n");
2360 
2361 		return ERR_PTR(devidx);
2362 	}
2363 
2364 	md = kzalloc(sizeof(struct mmc_blk_data), GFP_KERNEL);
2365 	if (!md) {
2366 		ret = -ENOMEM;
2367 		goto out;
2368 	}
2369 
2370 	md->area_type = area_type;
2371 
2372 	/*
2373 	 * Set the read-only status based on the supported commands
2374 	 * and the write protect switch.
2375 	 */
2376 	md->read_only = mmc_blk_readonly(card);
2377 
2378 	md->disk = mmc_init_queue(&md->queue, card);
2379 	if (IS_ERR(md->disk)) {
2380 		ret = PTR_ERR(md->disk);
2381 		goto err_kfree;
2382 	}
2383 
2384 	INIT_LIST_HEAD(&md->part);
2385 	INIT_LIST_HEAD(&md->rpmbs);
2386 	kref_init(&md->kref);
2387 
2388 	md->queue.blkdata = md;
2389 	md->part_type = part_type;
2390 
2391 	md->disk->major	= MMC_BLOCK_MAJOR;
2392 	md->disk->minors = perdev_minors;
2393 	md->disk->first_minor = devidx * perdev_minors;
2394 	md->disk->fops = &mmc_bdops;
2395 	md->disk->private_data = md;
2396 	md->parent = parent;
2397 	set_disk_ro(md->disk, md->read_only || default_ro);
2398 	md->disk->flags = GENHD_FL_EXT_DEVT;
2399 	if (area_type & (MMC_BLK_DATA_AREA_RPMB | MMC_BLK_DATA_AREA_BOOT))
2400 		md->disk->flags |= GENHD_FL_NO_PART_SCAN
2401 				   | GENHD_FL_SUPPRESS_PARTITION_INFO;
2402 
2403 	/*
2404 	 * As discussed on lkml, GENHD_FL_REMOVABLE should:
2405 	 *
2406 	 * - be set for removable media with permanent block devices
2407 	 * - be unset for removable block devices with permanent media
2408 	 *
2409 	 * Since MMC block devices clearly fall under the second
2410 	 * case, we do not set GENHD_FL_REMOVABLE.  Userspace
2411 	 * should use the block device creation/destruction hotplug
2412 	 * messages to tell when the card is present.
2413 	 */
2414 
2415 	snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
2416 		 "mmcblk%u%s", card->host->index, subname ? subname : "");
2417 
2418 	set_capacity(md->disk, size);
2419 
2420 	if (mmc_host_cmd23(card->host)) {
2421 		if ((mmc_card_mmc(card) &&
2422 		     card->csd.mmca_vsn >= CSD_SPEC_VER_3) ||
2423 		    (mmc_card_sd(card) &&
2424 		     card->scr.cmds & SD_SCR_CMD23_SUPPORT))
2425 			md->flags |= MMC_BLK_CMD23;
2426 	}
2427 
2428 	if (mmc_card_mmc(card) &&
2429 	    md->flags & MMC_BLK_CMD23 &&
2430 	    ((card->ext_csd.rel_param & EXT_CSD_WR_REL_PARAM_EN) ||
2431 	     card->ext_csd.rel_sectors)) {
2432 		md->flags |= MMC_BLK_REL_WR;
2433 		blk_queue_write_cache(md->queue.queue, true, true);
2434 	}
2435 
2436 	string_get_size((u64)size, 512, STRING_UNITS_2,
2437 			cap_str, sizeof(cap_str));
2438 	pr_info("%s: %s %s %s %s\n",
2439 		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
2440 		cap_str, md->read_only ? "(ro)" : "");
2441 
2442 	/* used in ->open, must be set before add_disk: */
2443 	if (area_type == MMC_BLK_DATA_AREA_MAIN)
2444 		dev_set_drvdata(&card->dev, md);
2445 	ret = device_add_disk(md->parent, md->disk, mmc_disk_attr_groups);
2446 	if (ret)
2447 		goto err_cleanup_queue;
2448 	return md;
2449 
2450  err_cleanup_queue:
2451 	blk_cleanup_queue(md->disk->queue);
2452 	blk_mq_free_tag_set(&md->queue.tag_set);
2453  err_kfree:
2454 	kfree(md);
2455  out:
2456 	ida_simple_remove(&mmc_blk_ida, devidx);
2457 	return ERR_PTR(ret);
2458 }
2459 
2460 static struct mmc_blk_data *mmc_blk_alloc(struct mmc_card *card)
2461 {
2462 	sector_t size;
2463 
2464 	if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
2465 		/*
2466 		 * The EXT_CSD sector count is in number or 512 byte
2467 		 * sectors.
2468 		 */
2469 		size = card->ext_csd.sectors;
2470 	} else {
2471 		/*
2472 		 * The CSD capacity field is in units of read_blkbits.
2473 		 * set_capacity takes units of 512 bytes.
2474 		 */
2475 		size = (typeof(sector_t))card->csd.capacity
2476 			<< (card->csd.read_blkbits - 9);
2477 	}
2478 
2479 	return mmc_blk_alloc_req(card, &card->dev, size, false, NULL,
2480 					MMC_BLK_DATA_AREA_MAIN, 0);
2481 }
2482 
2483 static int mmc_blk_alloc_part(struct mmc_card *card,
2484 			      struct mmc_blk_data *md,
2485 			      unsigned int part_type,
2486 			      sector_t size,
2487 			      bool default_ro,
2488 			      const char *subname,
2489 			      int area_type)
2490 {
2491 	struct mmc_blk_data *part_md;
2492 
2493 	part_md = mmc_blk_alloc_req(card, disk_to_dev(md->disk), size, default_ro,
2494 				    subname, area_type, part_type);
2495 	if (IS_ERR(part_md))
2496 		return PTR_ERR(part_md);
2497 	list_add(&part_md->part, &md->part);
2498 
2499 	return 0;
2500 }
2501 
2502 /**
2503  * mmc_rpmb_ioctl() - ioctl handler for the RPMB chardev
2504  * @filp: the character device file
2505  * @cmd: the ioctl() command
2506  * @arg: the argument from userspace
2507  *
2508  * This will essentially just redirect the ioctl()s coming in over to
2509  * the main block device spawning the RPMB character device.
2510  */
2511 static long mmc_rpmb_ioctl(struct file *filp, unsigned int cmd,
2512 			   unsigned long arg)
2513 {
2514 	struct mmc_rpmb_data *rpmb = filp->private_data;
2515 	int ret;
2516 
2517 	switch (cmd) {
2518 	case MMC_IOC_CMD:
2519 		ret = mmc_blk_ioctl_cmd(rpmb->md,
2520 					(struct mmc_ioc_cmd __user *)arg,
2521 					rpmb);
2522 		break;
2523 	case MMC_IOC_MULTI_CMD:
2524 		ret = mmc_blk_ioctl_multi_cmd(rpmb->md,
2525 					(struct mmc_ioc_multi_cmd __user *)arg,
2526 					rpmb);
2527 		break;
2528 	default:
2529 		ret = -EINVAL;
2530 		break;
2531 	}
2532 
2533 	return ret;
2534 }
2535 
2536 #ifdef CONFIG_COMPAT
2537 static long mmc_rpmb_ioctl_compat(struct file *filp, unsigned int cmd,
2538 			      unsigned long arg)
2539 {
2540 	return mmc_rpmb_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
2541 }
2542 #endif
2543 
2544 static int mmc_rpmb_chrdev_open(struct inode *inode, struct file *filp)
2545 {
2546 	struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
2547 						  struct mmc_rpmb_data, chrdev);
2548 
2549 	get_device(&rpmb->dev);
2550 	filp->private_data = rpmb;
2551 	mmc_blk_get(rpmb->md->disk);
2552 
2553 	return nonseekable_open(inode, filp);
2554 }
2555 
2556 static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
2557 {
2558 	struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
2559 						  struct mmc_rpmb_data, chrdev);
2560 
2561 	mmc_blk_put(rpmb->md);
2562 	put_device(&rpmb->dev);
2563 
2564 	return 0;
2565 }
2566 
2567 static const struct file_operations mmc_rpmb_fileops = {
2568 	.release = mmc_rpmb_chrdev_release,
2569 	.open = mmc_rpmb_chrdev_open,
2570 	.owner = THIS_MODULE,
2571 	.llseek = no_llseek,
2572 	.unlocked_ioctl = mmc_rpmb_ioctl,
2573 #ifdef CONFIG_COMPAT
2574 	.compat_ioctl = mmc_rpmb_ioctl_compat,
2575 #endif
2576 };
2577 
2578 static void mmc_blk_rpmb_device_release(struct device *dev)
2579 {
2580 	struct mmc_rpmb_data *rpmb = dev_get_drvdata(dev);
2581 
2582 	ida_simple_remove(&mmc_rpmb_ida, rpmb->id);
2583 	kfree(rpmb);
2584 }
2585 
2586 static int mmc_blk_alloc_rpmb_part(struct mmc_card *card,
2587 				   struct mmc_blk_data *md,
2588 				   unsigned int part_index,
2589 				   sector_t size,
2590 				   const char *subname)
2591 {
2592 	int devidx, ret;
2593 	char rpmb_name[DISK_NAME_LEN];
2594 	char cap_str[10];
2595 	struct mmc_rpmb_data *rpmb;
2596 
2597 	/* This creates the minor number for the RPMB char device */
2598 	devidx = ida_simple_get(&mmc_rpmb_ida, 0, max_devices, GFP_KERNEL);
2599 	if (devidx < 0)
2600 		return devidx;
2601 
2602 	rpmb = kzalloc(sizeof(*rpmb), GFP_KERNEL);
2603 	if (!rpmb) {
2604 		ida_simple_remove(&mmc_rpmb_ida, devidx);
2605 		return -ENOMEM;
2606 	}
2607 
2608 	snprintf(rpmb_name, sizeof(rpmb_name),
2609 		 "mmcblk%u%s", card->host->index, subname ? subname : "");
2610 
2611 	rpmb->id = devidx;
2612 	rpmb->part_index = part_index;
2613 	rpmb->dev.init_name = rpmb_name;
2614 	rpmb->dev.bus = &mmc_rpmb_bus_type;
2615 	rpmb->dev.devt = MKDEV(MAJOR(mmc_rpmb_devt), rpmb->id);
2616 	rpmb->dev.parent = &card->dev;
2617 	rpmb->dev.release = mmc_blk_rpmb_device_release;
2618 	device_initialize(&rpmb->dev);
2619 	dev_set_drvdata(&rpmb->dev, rpmb);
2620 	rpmb->md = md;
2621 
2622 	cdev_init(&rpmb->chrdev, &mmc_rpmb_fileops);
2623 	rpmb->chrdev.owner = THIS_MODULE;
2624 	ret = cdev_device_add(&rpmb->chrdev, &rpmb->dev);
2625 	if (ret) {
2626 		pr_err("%s: could not add character device\n", rpmb_name);
2627 		goto out_put_device;
2628 	}
2629 
2630 	list_add(&rpmb->node, &md->rpmbs);
2631 
2632 	string_get_size((u64)size, 512, STRING_UNITS_2,
2633 			cap_str, sizeof(cap_str));
2634 
2635 	pr_info("%s: %s %s %s, chardev (%d:%d)\n",
2636 		rpmb_name, mmc_card_id(card), mmc_card_name(card), cap_str,
2637 		MAJOR(mmc_rpmb_devt), rpmb->id);
2638 
2639 	return 0;
2640 
2641 out_put_device:
2642 	put_device(&rpmb->dev);
2643 	return ret;
2644 }
2645 
2646 static void mmc_blk_remove_rpmb_part(struct mmc_rpmb_data *rpmb)
2647 
2648 {
2649 	cdev_device_del(&rpmb->chrdev, &rpmb->dev);
2650 	put_device(&rpmb->dev);
2651 }
2652 
2653 /* MMC Physical partitions consist of two boot partitions and
2654  * up to four general purpose partitions.
2655  * For each partition enabled in EXT_CSD a block device will be allocatedi
2656  * to provide access to the partition.
2657  */
2658 
2659 static int mmc_blk_alloc_parts(struct mmc_card *card, struct mmc_blk_data *md)
2660 {
2661 	int idx, ret;
2662 
2663 	if (!mmc_card_mmc(card))
2664 		return 0;
2665 
2666 	for (idx = 0; idx < card->nr_parts; idx++) {
2667 		if (card->part[idx].area_type & MMC_BLK_DATA_AREA_RPMB) {
2668 			/*
2669 			 * RPMB partitions does not provide block access, they
2670 			 * are only accessed using ioctl():s. Thus create
2671 			 * special RPMB block devices that do not have a
2672 			 * backing block queue for these.
2673 			 */
2674 			ret = mmc_blk_alloc_rpmb_part(card, md,
2675 				card->part[idx].part_cfg,
2676 				card->part[idx].size >> 9,
2677 				card->part[idx].name);
2678 			if (ret)
2679 				return ret;
2680 		} else if (card->part[idx].size) {
2681 			ret = mmc_blk_alloc_part(card, md,
2682 				card->part[idx].part_cfg,
2683 				card->part[idx].size >> 9,
2684 				card->part[idx].force_ro,
2685 				card->part[idx].name,
2686 				card->part[idx].area_type);
2687 			if (ret)
2688 				return ret;
2689 		}
2690 	}
2691 
2692 	return 0;
2693 }
2694 
2695 static void mmc_blk_remove_req(struct mmc_blk_data *md)
2696 {
2697 	/*
2698 	 * Flush remaining requests and free queues. It is freeing the queue
2699 	 * that stops new requests from being accepted.
2700 	 */
2701 	del_gendisk(md->disk);
2702 	mmc_cleanup_queue(&md->queue);
2703 	mmc_blk_put(md);
2704 }
2705 
2706 static void mmc_blk_remove_parts(struct mmc_card *card,
2707 				 struct mmc_blk_data *md)
2708 {
2709 	struct list_head *pos, *q;
2710 	struct mmc_blk_data *part_md;
2711 	struct mmc_rpmb_data *rpmb;
2712 
2713 	/* Remove RPMB partitions */
2714 	list_for_each_safe(pos, q, &md->rpmbs) {
2715 		rpmb = list_entry(pos, struct mmc_rpmb_data, node);
2716 		list_del(pos);
2717 		mmc_blk_remove_rpmb_part(rpmb);
2718 	}
2719 	/* Remove block partitions */
2720 	list_for_each_safe(pos, q, &md->part) {
2721 		part_md = list_entry(pos, struct mmc_blk_data, part);
2722 		list_del(pos);
2723 		mmc_blk_remove_req(part_md);
2724 	}
2725 }
2726 
2727 #ifdef CONFIG_DEBUG_FS
2728 
2729 static int mmc_dbg_card_status_get(void *data, u64 *val)
2730 {
2731 	struct mmc_card *card = data;
2732 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2733 	struct mmc_queue *mq = &md->queue;
2734 	struct request *req;
2735 	int ret;
2736 
2737 	/* Ask the block layer about the card status */
2738 	req = blk_mq_alloc_request(mq->queue, REQ_OP_DRV_IN, 0);
2739 	if (IS_ERR(req))
2740 		return PTR_ERR(req);
2741 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
2742 	blk_execute_rq(NULL, req, 0);
2743 	ret = req_to_mmc_queue_req(req)->drv_op_result;
2744 	if (ret >= 0) {
2745 		*val = ret;
2746 		ret = 0;
2747 	}
2748 	blk_mq_free_request(req);
2749 
2750 	return ret;
2751 }
2752 DEFINE_DEBUGFS_ATTRIBUTE(mmc_dbg_card_status_fops, mmc_dbg_card_status_get,
2753 			 NULL, "%08llx\n");
2754 
2755 /* That is two digits * 512 + 1 for newline */
2756 #define EXT_CSD_STR_LEN 1025
2757 
2758 static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
2759 {
2760 	struct mmc_card *card = inode->i_private;
2761 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2762 	struct mmc_queue *mq = &md->queue;
2763 	struct request *req;
2764 	char *buf;
2765 	ssize_t n = 0;
2766 	u8 *ext_csd;
2767 	int err, i;
2768 
2769 	buf = kmalloc(EXT_CSD_STR_LEN + 1, GFP_KERNEL);
2770 	if (!buf)
2771 		return -ENOMEM;
2772 
2773 	/* Ask the block layer for the EXT CSD */
2774 	req = blk_mq_alloc_request(mq->queue, REQ_OP_DRV_IN, 0);
2775 	if (IS_ERR(req)) {
2776 		err = PTR_ERR(req);
2777 		goto out_free;
2778 	}
2779 	req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
2780 	req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
2781 	blk_execute_rq(NULL, req, 0);
2782 	err = req_to_mmc_queue_req(req)->drv_op_result;
2783 	blk_mq_free_request(req);
2784 	if (err) {
2785 		pr_err("FAILED %d\n", err);
2786 		goto out_free;
2787 	}
2788 
2789 	for (i = 0; i < 512; i++)
2790 		n += sprintf(buf + n, "%02x", ext_csd[i]);
2791 	n += sprintf(buf + n, "\n");
2792 
2793 	if (n != EXT_CSD_STR_LEN) {
2794 		err = -EINVAL;
2795 		kfree(ext_csd);
2796 		goto out_free;
2797 	}
2798 
2799 	filp->private_data = buf;
2800 	kfree(ext_csd);
2801 	return 0;
2802 
2803 out_free:
2804 	kfree(buf);
2805 	return err;
2806 }
2807 
2808 static ssize_t mmc_ext_csd_read(struct file *filp, char __user *ubuf,
2809 				size_t cnt, loff_t *ppos)
2810 {
2811 	char *buf = filp->private_data;
2812 
2813 	return simple_read_from_buffer(ubuf, cnt, ppos,
2814 				       buf, EXT_CSD_STR_LEN);
2815 }
2816 
2817 static int mmc_ext_csd_release(struct inode *inode, struct file *file)
2818 {
2819 	kfree(file->private_data);
2820 	return 0;
2821 }
2822 
2823 static const struct file_operations mmc_dbg_ext_csd_fops = {
2824 	.open		= mmc_ext_csd_open,
2825 	.read		= mmc_ext_csd_read,
2826 	.release	= mmc_ext_csd_release,
2827 	.llseek		= default_llseek,
2828 };
2829 
2830 static int mmc_blk_add_debugfs(struct mmc_card *card, struct mmc_blk_data *md)
2831 {
2832 	struct dentry *root;
2833 
2834 	if (!card->debugfs_root)
2835 		return 0;
2836 
2837 	root = card->debugfs_root;
2838 
2839 	if (mmc_card_mmc(card) || mmc_card_sd(card)) {
2840 		md->status_dentry =
2841 			debugfs_create_file_unsafe("status", 0400, root,
2842 						   card,
2843 						   &mmc_dbg_card_status_fops);
2844 		if (!md->status_dentry)
2845 			return -EIO;
2846 	}
2847 
2848 	if (mmc_card_mmc(card)) {
2849 		md->ext_csd_dentry =
2850 			debugfs_create_file("ext_csd", S_IRUSR, root, card,
2851 					    &mmc_dbg_ext_csd_fops);
2852 		if (!md->ext_csd_dentry)
2853 			return -EIO;
2854 	}
2855 
2856 	return 0;
2857 }
2858 
2859 static void mmc_blk_remove_debugfs(struct mmc_card *card,
2860 				   struct mmc_blk_data *md)
2861 {
2862 	if (!card->debugfs_root)
2863 		return;
2864 
2865 	if (!IS_ERR_OR_NULL(md->status_dentry)) {
2866 		debugfs_remove(md->status_dentry);
2867 		md->status_dentry = NULL;
2868 	}
2869 
2870 	if (!IS_ERR_OR_NULL(md->ext_csd_dentry)) {
2871 		debugfs_remove(md->ext_csd_dentry);
2872 		md->ext_csd_dentry = NULL;
2873 	}
2874 }
2875 
2876 #else
2877 
2878 static int mmc_blk_add_debugfs(struct mmc_card *card, struct mmc_blk_data *md)
2879 {
2880 	return 0;
2881 }
2882 
2883 static void mmc_blk_remove_debugfs(struct mmc_card *card,
2884 				   struct mmc_blk_data *md)
2885 {
2886 }
2887 
2888 #endif /* CONFIG_DEBUG_FS */
2889 
2890 static int mmc_blk_probe(struct mmc_card *card)
2891 {
2892 	struct mmc_blk_data *md;
2893 	int ret = 0;
2894 
2895 	/*
2896 	 * Check that the card supports the command class(es) we need.
2897 	 */
2898 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
2899 		return -ENODEV;
2900 
2901 	mmc_fixup_device(card, mmc_blk_fixups);
2902 
2903 	card->complete_wq = alloc_workqueue("mmc_complete",
2904 					WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
2905 	if (!card->complete_wq) {
2906 		pr_err("Failed to create mmc completion workqueue");
2907 		return -ENOMEM;
2908 	}
2909 
2910 	md = mmc_blk_alloc(card);
2911 	if (IS_ERR(md)) {
2912 		ret = PTR_ERR(md);
2913 		goto out_free;
2914 	}
2915 
2916 	ret = mmc_blk_alloc_parts(card, md);
2917 	if (ret)
2918 		goto out;
2919 
2920 	/* Add two debugfs entries */
2921 	mmc_blk_add_debugfs(card, md);
2922 
2923 	pm_runtime_set_autosuspend_delay(&card->dev, 3000);
2924 	pm_runtime_use_autosuspend(&card->dev);
2925 
2926 	/*
2927 	 * Don't enable runtime PM for SD-combo cards here. Leave that
2928 	 * decision to be taken during the SDIO init sequence instead.
2929 	 */
2930 	if (card->type != MMC_TYPE_SD_COMBO) {
2931 		pm_runtime_set_active(&card->dev);
2932 		pm_runtime_enable(&card->dev);
2933 	}
2934 
2935 	return 0;
2936 
2937 out:
2938 	mmc_blk_remove_parts(card, md);
2939 	mmc_blk_remove_req(md);
2940 out_free:
2941 	destroy_workqueue(card->complete_wq);
2942 	return ret;
2943 }
2944 
2945 static void mmc_blk_remove(struct mmc_card *card)
2946 {
2947 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2948 
2949 	mmc_blk_remove_debugfs(card, md);
2950 	mmc_blk_remove_parts(card, md);
2951 	pm_runtime_get_sync(&card->dev);
2952 	if (md->part_curr != md->part_type) {
2953 		mmc_claim_host(card->host);
2954 		mmc_blk_part_switch(card, md->part_type);
2955 		mmc_release_host(card->host);
2956 	}
2957 	if (card->type != MMC_TYPE_SD_COMBO)
2958 		pm_runtime_disable(&card->dev);
2959 	pm_runtime_put_noidle(&card->dev);
2960 	mmc_blk_remove_req(md);
2961 	dev_set_drvdata(&card->dev, NULL);
2962 	destroy_workqueue(card->complete_wq);
2963 }
2964 
2965 static int _mmc_blk_suspend(struct mmc_card *card)
2966 {
2967 	struct mmc_blk_data *part_md;
2968 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2969 
2970 	if (md) {
2971 		mmc_queue_suspend(&md->queue);
2972 		list_for_each_entry(part_md, &md->part, part) {
2973 			mmc_queue_suspend(&part_md->queue);
2974 		}
2975 	}
2976 	return 0;
2977 }
2978 
2979 static void mmc_blk_shutdown(struct mmc_card *card)
2980 {
2981 	_mmc_blk_suspend(card);
2982 }
2983 
2984 #ifdef CONFIG_PM_SLEEP
2985 static int mmc_blk_suspend(struct device *dev)
2986 {
2987 	struct mmc_card *card = mmc_dev_to_card(dev);
2988 
2989 	return _mmc_blk_suspend(card);
2990 }
2991 
2992 static int mmc_blk_resume(struct device *dev)
2993 {
2994 	struct mmc_blk_data *part_md;
2995 	struct mmc_blk_data *md = dev_get_drvdata(dev);
2996 
2997 	if (md) {
2998 		/*
2999 		 * Resume involves the card going into idle state,
3000 		 * so current partition is always the main one.
3001 		 */
3002 		md->part_curr = md->part_type;
3003 		mmc_queue_resume(&md->queue);
3004 		list_for_each_entry(part_md, &md->part, part) {
3005 			mmc_queue_resume(&part_md->queue);
3006 		}
3007 	}
3008 	return 0;
3009 }
3010 #endif
3011 
3012 static SIMPLE_DEV_PM_OPS(mmc_blk_pm_ops, mmc_blk_suspend, mmc_blk_resume);
3013 
3014 static struct mmc_driver mmc_driver = {
3015 	.drv		= {
3016 		.name	= "mmcblk",
3017 		.pm	= &mmc_blk_pm_ops,
3018 	},
3019 	.probe		= mmc_blk_probe,
3020 	.remove		= mmc_blk_remove,
3021 	.shutdown	= mmc_blk_shutdown,
3022 };
3023 
3024 static int __init mmc_blk_init(void)
3025 {
3026 	int res;
3027 
3028 	res  = bus_register(&mmc_rpmb_bus_type);
3029 	if (res < 0) {
3030 		pr_err("mmcblk: could not register RPMB bus type\n");
3031 		return res;
3032 	}
3033 	res = alloc_chrdev_region(&mmc_rpmb_devt, 0, MAX_DEVICES, "rpmb");
3034 	if (res < 0) {
3035 		pr_err("mmcblk: failed to allocate rpmb chrdev region\n");
3036 		goto out_bus_unreg;
3037 	}
3038 
3039 	if (perdev_minors != CONFIG_MMC_BLOCK_MINORS)
3040 		pr_info("mmcblk: using %d minors per device\n", perdev_minors);
3041 
3042 	max_devices = min(MAX_DEVICES, (1 << MINORBITS) / perdev_minors);
3043 
3044 	res = register_blkdev(MMC_BLOCK_MAJOR, "mmc");
3045 	if (res)
3046 		goto out_chrdev_unreg;
3047 
3048 	res = mmc_register_driver(&mmc_driver);
3049 	if (res)
3050 		goto out_blkdev_unreg;
3051 
3052 	return 0;
3053 
3054 out_blkdev_unreg:
3055 	unregister_blkdev(MMC_BLOCK_MAJOR, "mmc");
3056 out_chrdev_unreg:
3057 	unregister_chrdev_region(mmc_rpmb_devt, MAX_DEVICES);
3058 out_bus_unreg:
3059 	bus_unregister(&mmc_rpmb_bus_type);
3060 	return res;
3061 }
3062 
3063 static void __exit mmc_blk_exit(void)
3064 {
3065 	mmc_unregister_driver(&mmc_driver);
3066 	unregister_blkdev(MMC_BLOCK_MAJOR, "mmc");
3067 	unregister_chrdev_region(mmc_rpmb_devt, MAX_DEVICES);
3068 	bus_unregister(&mmc_rpmb_bus_type);
3069 }
3070 
3071 module_init(mmc_blk_init);
3072 module_exit(mmc_blk_exit);
3073 
3074 MODULE_LICENSE("GPL");
3075 MODULE_DESCRIPTION("Multimedia Card (MMC) block device driver");
3076 
3077