xref: /linux/drivers/mmc/core/block.c (revision 69fb09f6ccdb2f070557fd1f4c56c4d646694c8e)
1 /*
2  * Block driver for media (i.e., flash cards)
3  *
4  * Copyright 2002 Hewlett-Packard Company
5  * Copyright 2005-2008 Pierre Ossman
6  *
7  * Use consistent with the GNU GPL is permitted,
8  * provided that this copyright notice is
9  * preserved in its entirety in all copies and derived works.
10  *
11  * HEWLETT-PACKARD COMPANY MAKES NO WARRANTIES, EXPRESSED OR IMPLIED,
12  * AS TO THE USEFULNESS OR CORRECTNESS OF THIS CODE OR ITS
13  * FITNESS FOR ANY PARTICULAR PURPOSE.
14  *
15  * Many thanks to Alessandro Rubini and Jonathan Corbet!
16  *
17  * Author:  Andrew Christian
18  *          28 May 2002
19  */
20 #include <linux/moduleparam.h>
21 #include <linux/module.h>
22 #include <linux/init.h>
23 
24 #include <linux/kernel.h>
25 #include <linux/fs.h>
26 #include <linux/slab.h>
27 #include <linux/errno.h>
28 #include <linux/hdreg.h>
29 #include <linux/kdev_t.h>
30 #include <linux/blkdev.h>
31 #include <linux/mutex.h>
32 #include <linux/scatterlist.h>
33 #include <linux/string_helpers.h>
34 #include <linux/delay.h>
35 #include <linux/capability.h>
36 #include <linux/compat.h>
37 #include <linux/pm_runtime.h>
38 #include <linux/idr.h>
39 
40 #include <linux/mmc/ioctl.h>
41 #include <linux/mmc/card.h>
42 #include <linux/mmc/host.h>
43 #include <linux/mmc/mmc.h>
44 #include <linux/mmc/sd.h>
45 
46 #include <linux/uaccess.h>
47 
48 #include "queue.h"
49 #include "block.h"
50 #include "core.h"
51 #include "card.h"
52 #include "host.h"
53 #include "bus.h"
54 #include "mmc_ops.h"
55 #include "quirks.h"
56 #include "sd_ops.h"
57 
58 MODULE_ALIAS("mmc:block");
59 #ifdef MODULE_PARAM_PREFIX
60 #undef MODULE_PARAM_PREFIX
61 #endif
62 #define MODULE_PARAM_PREFIX "mmcblk."
63 
64 #define MMC_BLK_TIMEOUT_MS  (10 * 60 * 1000)        /* 10 minute timeout */
65 #define MMC_SANITIZE_REQ_TIMEOUT 240000
66 #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16)
67 
68 #define mmc_req_rel_wr(req)	((req->cmd_flags & REQ_FUA) && \
69 				  (rq_data_dir(req) == WRITE))
70 static DEFINE_MUTEX(block_mutex);
71 
72 /*
73  * The defaults come from config options but can be overriden by module
74  * or bootarg options.
75  */
76 static int perdev_minors = CONFIG_MMC_BLOCK_MINORS;
77 
78 /*
79  * We've only got one major, so number of mmcblk devices is
80  * limited to (1 << 20) / number of minors per device.  It is also
81  * limited by the MAX_DEVICES below.
82  */
83 static int max_devices;
84 
85 #define MAX_DEVICES 256
86 
87 static DEFINE_IDA(mmc_blk_ida);
88 
89 /*
90  * There is one mmc_blk_data per slot.
91  */
92 struct mmc_blk_data {
93 	spinlock_t	lock;
94 	struct device	*parent;
95 	struct gendisk	*disk;
96 	struct mmc_queue queue;
97 	struct list_head part;
98 
99 	unsigned int	flags;
100 #define MMC_BLK_CMD23	(1 << 0)	/* Can do SET_BLOCK_COUNT for multiblock */
101 #define MMC_BLK_REL_WR	(1 << 1)	/* MMC Reliable write support */
102 
103 	unsigned int	usage;
104 	unsigned int	read_only;
105 	unsigned int	part_type;
106 	unsigned int	reset_done;
107 #define MMC_BLK_READ		BIT(0)
108 #define MMC_BLK_WRITE		BIT(1)
109 #define MMC_BLK_DISCARD		BIT(2)
110 #define MMC_BLK_SECDISCARD	BIT(3)
111 
112 	/*
113 	 * Only set in main mmc_blk_data associated
114 	 * with mmc_card with dev_set_drvdata, and keeps
115 	 * track of the current selected device partition.
116 	 */
117 	unsigned int	part_curr;
118 	struct device_attribute force_ro;
119 	struct device_attribute power_ro_lock;
120 	int	area_type;
121 };
122 
123 static DEFINE_MUTEX(open_lock);
124 
125 module_param(perdev_minors, int, 0444);
126 MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
127 
128 static inline int mmc_blk_part_switch(struct mmc_card *card,
129 				      struct mmc_blk_data *md);
130 static int get_card_status(struct mmc_card *card, u32 *status, int retries);
131 
132 static void mmc_blk_requeue(struct request_queue *q, struct request *req)
133 {
134 	spin_lock_irq(q->queue_lock);
135 	blk_requeue_request(q, req);
136 	spin_unlock_irq(q->queue_lock);
137 }
138 
139 static struct mmc_blk_data *mmc_blk_get(struct gendisk *disk)
140 {
141 	struct mmc_blk_data *md;
142 
143 	mutex_lock(&open_lock);
144 	md = disk->private_data;
145 	if (md && md->usage == 0)
146 		md = NULL;
147 	if (md)
148 		md->usage++;
149 	mutex_unlock(&open_lock);
150 
151 	return md;
152 }
153 
154 static inline int mmc_get_devidx(struct gendisk *disk)
155 {
156 	int devidx = disk->first_minor / perdev_minors;
157 	return devidx;
158 }
159 
160 static void mmc_blk_put(struct mmc_blk_data *md)
161 {
162 	mutex_lock(&open_lock);
163 	md->usage--;
164 	if (md->usage == 0) {
165 		int devidx = mmc_get_devidx(md->disk);
166 		blk_cleanup_queue(md->queue.queue);
167 		ida_simple_remove(&mmc_blk_ida, devidx);
168 		put_disk(md->disk);
169 		kfree(md);
170 	}
171 	mutex_unlock(&open_lock);
172 }
173 
174 static ssize_t power_ro_lock_show(struct device *dev,
175 		struct device_attribute *attr, char *buf)
176 {
177 	int ret;
178 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
179 	struct mmc_card *card = md->queue.card;
180 	int locked = 0;
181 
182 	if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PERM_WP_EN)
183 		locked = 2;
184 	else if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_EN)
185 		locked = 1;
186 
187 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
188 
189 	mmc_blk_put(md);
190 
191 	return ret;
192 }
193 
194 static ssize_t power_ro_lock_store(struct device *dev,
195 		struct device_attribute *attr, const char *buf, size_t count)
196 {
197 	int ret;
198 	struct mmc_blk_data *md, *part_md;
199 	struct mmc_card *card;
200 	unsigned long set;
201 
202 	if (kstrtoul(buf, 0, &set))
203 		return -EINVAL;
204 
205 	if (set != 1)
206 		return count;
207 
208 	md = mmc_blk_get(dev_to_disk(dev));
209 	card = md->queue.card;
210 
211 	mmc_get_card(card);
212 
213 	ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP,
214 				card->ext_csd.boot_ro_lock |
215 				EXT_CSD_BOOT_WP_B_PWR_WP_EN,
216 				card->ext_csd.part_time);
217 	if (ret)
218 		pr_err("%s: Locking boot partition ro until next power on failed: %d\n", md->disk->disk_name, ret);
219 	else
220 		card->ext_csd.boot_ro_lock |= EXT_CSD_BOOT_WP_B_PWR_WP_EN;
221 
222 	mmc_put_card(card);
223 
224 	if (!ret) {
225 		pr_info("%s: Locking boot partition ro until next power on\n",
226 			md->disk->disk_name);
227 		set_disk_ro(md->disk, 1);
228 
229 		list_for_each_entry(part_md, &md->part, part)
230 			if (part_md->area_type == MMC_BLK_DATA_AREA_BOOT) {
231 				pr_info("%s: Locking boot partition ro until next power on\n", part_md->disk->disk_name);
232 				set_disk_ro(part_md->disk, 1);
233 			}
234 	}
235 
236 	mmc_blk_put(md);
237 	return count;
238 }
239 
240 static ssize_t force_ro_show(struct device *dev, struct device_attribute *attr,
241 			     char *buf)
242 {
243 	int ret;
244 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
245 
246 	ret = snprintf(buf, PAGE_SIZE, "%d\n",
247 		       get_disk_ro(dev_to_disk(dev)) ^
248 		       md->read_only);
249 	mmc_blk_put(md);
250 	return ret;
251 }
252 
253 static ssize_t force_ro_store(struct device *dev, struct device_attribute *attr,
254 			      const char *buf, size_t count)
255 {
256 	int ret;
257 	char *end;
258 	struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
259 	unsigned long set = simple_strtoul(buf, &end, 0);
260 	if (end == buf) {
261 		ret = -EINVAL;
262 		goto out;
263 	}
264 
265 	set_disk_ro(dev_to_disk(dev), set || md->read_only);
266 	ret = count;
267 out:
268 	mmc_blk_put(md);
269 	return ret;
270 }
271 
272 static int mmc_blk_open(struct block_device *bdev, fmode_t mode)
273 {
274 	struct mmc_blk_data *md = mmc_blk_get(bdev->bd_disk);
275 	int ret = -ENXIO;
276 
277 	mutex_lock(&block_mutex);
278 	if (md) {
279 		if (md->usage == 2)
280 			check_disk_change(bdev);
281 		ret = 0;
282 
283 		if ((mode & FMODE_WRITE) && md->read_only) {
284 			mmc_blk_put(md);
285 			ret = -EROFS;
286 		}
287 	}
288 	mutex_unlock(&block_mutex);
289 
290 	return ret;
291 }
292 
293 static void mmc_blk_release(struct gendisk *disk, fmode_t mode)
294 {
295 	struct mmc_blk_data *md = disk->private_data;
296 
297 	mutex_lock(&block_mutex);
298 	mmc_blk_put(md);
299 	mutex_unlock(&block_mutex);
300 }
301 
302 static int
303 mmc_blk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
304 {
305 	geo->cylinders = get_capacity(bdev->bd_disk) / (4 * 16);
306 	geo->heads = 4;
307 	geo->sectors = 16;
308 	return 0;
309 }
310 
311 struct mmc_blk_ioc_data {
312 	struct mmc_ioc_cmd ic;
313 	unsigned char *buf;
314 	u64 buf_bytes;
315 };
316 
317 static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
318 	struct mmc_ioc_cmd __user *user)
319 {
320 	struct mmc_blk_ioc_data *idata;
321 	int err;
322 
323 	idata = kmalloc(sizeof(*idata), GFP_KERNEL);
324 	if (!idata) {
325 		err = -ENOMEM;
326 		goto out;
327 	}
328 
329 	if (copy_from_user(&idata->ic, user, sizeof(idata->ic))) {
330 		err = -EFAULT;
331 		goto idata_err;
332 	}
333 
334 	idata->buf_bytes = (u64) idata->ic.blksz * idata->ic.blocks;
335 	if (idata->buf_bytes > MMC_IOC_MAX_BYTES) {
336 		err = -EOVERFLOW;
337 		goto idata_err;
338 	}
339 
340 	if (!idata->buf_bytes) {
341 		idata->buf = NULL;
342 		return idata;
343 	}
344 
345 	idata->buf = kmalloc(idata->buf_bytes, GFP_KERNEL);
346 	if (!idata->buf) {
347 		err = -ENOMEM;
348 		goto idata_err;
349 	}
350 
351 	if (copy_from_user(idata->buf, (void __user *)(unsigned long)
352 					idata->ic.data_ptr, idata->buf_bytes)) {
353 		err = -EFAULT;
354 		goto copy_err;
355 	}
356 
357 	return idata;
358 
359 copy_err:
360 	kfree(idata->buf);
361 idata_err:
362 	kfree(idata);
363 out:
364 	return ERR_PTR(err);
365 }
366 
367 static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr,
368 				      struct mmc_blk_ioc_data *idata)
369 {
370 	struct mmc_ioc_cmd *ic = &idata->ic;
371 
372 	if (copy_to_user(&(ic_ptr->response), ic->response,
373 			 sizeof(ic->response)))
374 		return -EFAULT;
375 
376 	if (!idata->ic.write_flag) {
377 		if (copy_to_user((void __user *)(unsigned long)ic->data_ptr,
378 				 idata->buf, idata->buf_bytes))
379 			return -EFAULT;
380 	}
381 
382 	return 0;
383 }
384 
385 static int ioctl_rpmb_card_status_poll(struct mmc_card *card, u32 *status,
386 				       u32 retries_max)
387 {
388 	int err;
389 	u32 retry_count = 0;
390 
391 	if (!status || !retries_max)
392 		return -EINVAL;
393 
394 	do {
395 		err = get_card_status(card, status, 5);
396 		if (err)
397 			break;
398 
399 		if (!R1_STATUS(*status) &&
400 				(R1_CURRENT_STATE(*status) != R1_STATE_PRG))
401 			break; /* RPMB programming operation complete */
402 
403 		/*
404 		 * Rechedule to give the MMC device a chance to continue
405 		 * processing the previous command without being polled too
406 		 * frequently.
407 		 */
408 		usleep_range(1000, 5000);
409 	} while (++retry_count < retries_max);
410 
411 	if (retry_count == retries_max)
412 		err = -EPERM;
413 
414 	return err;
415 }
416 
417 static int ioctl_do_sanitize(struct mmc_card *card)
418 {
419 	int err;
420 
421 	if (!mmc_can_sanitize(card)) {
422 			pr_warn("%s: %s - SANITIZE is not supported\n",
423 				mmc_hostname(card->host), __func__);
424 			err = -EOPNOTSUPP;
425 			goto out;
426 	}
427 
428 	pr_debug("%s: %s - SANITIZE IN PROGRESS...\n",
429 		mmc_hostname(card->host), __func__);
430 
431 	err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
432 					EXT_CSD_SANITIZE_START, 1,
433 					MMC_SANITIZE_REQ_TIMEOUT);
434 
435 	if (err)
436 		pr_err("%s: %s - EXT_CSD_SANITIZE_START failed. err=%d\n",
437 		       mmc_hostname(card->host), __func__, err);
438 
439 	pr_debug("%s: %s - SANITIZE COMPLETED\n", mmc_hostname(card->host),
440 					     __func__);
441 out:
442 	return err;
443 }
444 
445 static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
446 			       struct mmc_blk_ioc_data *idata)
447 {
448 	struct mmc_command cmd = {};
449 	struct mmc_data data = {};
450 	struct mmc_request mrq = {};
451 	struct scatterlist sg;
452 	int err;
453 	int is_rpmb = false;
454 	u32 status = 0;
455 
456 	if (!card || !md || !idata)
457 		return -EINVAL;
458 
459 	if (md->area_type & MMC_BLK_DATA_AREA_RPMB)
460 		is_rpmb = true;
461 
462 	cmd.opcode = idata->ic.opcode;
463 	cmd.arg = idata->ic.arg;
464 	cmd.flags = idata->ic.flags;
465 
466 	if (idata->buf_bytes) {
467 		data.sg = &sg;
468 		data.sg_len = 1;
469 		data.blksz = idata->ic.blksz;
470 		data.blocks = idata->ic.blocks;
471 
472 		sg_init_one(data.sg, idata->buf, idata->buf_bytes);
473 
474 		if (idata->ic.write_flag)
475 			data.flags = MMC_DATA_WRITE;
476 		else
477 			data.flags = MMC_DATA_READ;
478 
479 		/* data.flags must already be set before doing this. */
480 		mmc_set_data_timeout(&data, card);
481 
482 		/* Allow overriding the timeout_ns for empirical tuning. */
483 		if (idata->ic.data_timeout_ns)
484 			data.timeout_ns = idata->ic.data_timeout_ns;
485 
486 		if ((cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
487 			/*
488 			 * Pretend this is a data transfer and rely on the
489 			 * host driver to compute timeout.  When all host
490 			 * drivers support cmd.cmd_timeout for R1B, this
491 			 * can be changed to:
492 			 *
493 			 *     mrq.data = NULL;
494 			 *     cmd.cmd_timeout = idata->ic.cmd_timeout_ms;
495 			 */
496 			data.timeout_ns = idata->ic.cmd_timeout_ms * 1000000;
497 		}
498 
499 		mrq.data = &data;
500 	}
501 
502 	mrq.cmd = &cmd;
503 
504 	err = mmc_blk_part_switch(card, md);
505 	if (err)
506 		return err;
507 
508 	if (idata->ic.is_acmd) {
509 		err = mmc_app_cmd(card->host, card);
510 		if (err)
511 			return err;
512 	}
513 
514 	if (is_rpmb) {
515 		err = mmc_set_blockcount(card, data.blocks,
516 			idata->ic.write_flag & (1 << 31));
517 		if (err)
518 			return err;
519 	}
520 
521 	if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_SANITIZE_START) &&
522 	    (cmd.opcode == MMC_SWITCH)) {
523 		err = ioctl_do_sanitize(card);
524 
525 		if (err)
526 			pr_err("%s: ioctl_do_sanitize() failed. err = %d",
527 			       __func__, err);
528 
529 		return err;
530 	}
531 
532 	mmc_wait_for_req(card->host, &mrq);
533 
534 	if (cmd.error) {
535 		dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
536 						__func__, cmd.error);
537 		return cmd.error;
538 	}
539 	if (data.error) {
540 		dev_err(mmc_dev(card->host), "%s: data error %d\n",
541 						__func__, data.error);
542 		return data.error;
543 	}
544 
545 	/*
546 	 * According to the SD specs, some commands require a delay after
547 	 * issuing the command.
548 	 */
549 	if (idata->ic.postsleep_min_us)
550 		usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
551 
552 	memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
553 
554 	if (is_rpmb) {
555 		/*
556 		 * Ensure RPMB command has completed by polling CMD13
557 		 * "Send Status".
558 		 */
559 		err = ioctl_rpmb_card_status_poll(card, &status, 5);
560 		if (err)
561 			dev_err(mmc_dev(card->host),
562 					"%s: Card Status=0x%08X, error %d\n",
563 					__func__, status, err);
564 	}
565 
566 	return err;
567 }
568 
569 static int mmc_blk_ioctl_cmd(struct block_device *bdev,
570 			     struct mmc_ioc_cmd __user *ic_ptr)
571 {
572 	struct mmc_blk_ioc_data *idata;
573 	struct mmc_blk_data *md;
574 	struct mmc_card *card;
575 	int err = 0, ioc_err = 0;
576 
577 	/*
578 	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
579 	 * whole block device, not on a partition.  This prevents overspray
580 	 * between sibling partitions.
581 	 */
582 	if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
583 		return -EPERM;
584 
585 	idata = mmc_blk_ioctl_copy_from_user(ic_ptr);
586 	if (IS_ERR(idata))
587 		return PTR_ERR(idata);
588 
589 	md = mmc_blk_get(bdev->bd_disk);
590 	if (!md) {
591 		err = -EINVAL;
592 		goto cmd_err;
593 	}
594 
595 	card = md->queue.card;
596 	if (IS_ERR(card)) {
597 		err = PTR_ERR(card);
598 		goto cmd_done;
599 	}
600 
601 	mmc_get_card(card);
602 
603 	ioc_err = __mmc_blk_ioctl_cmd(card, md, idata);
604 
605 	/* Always switch back to main area after RPMB access */
606 	if (md->area_type & MMC_BLK_DATA_AREA_RPMB)
607 		mmc_blk_part_switch(card, dev_get_drvdata(&card->dev));
608 
609 	mmc_put_card(card);
610 
611 	err = mmc_blk_ioctl_copy_to_user(ic_ptr, idata);
612 
613 cmd_done:
614 	mmc_blk_put(md);
615 cmd_err:
616 	kfree(idata->buf);
617 	kfree(idata);
618 	return ioc_err ? ioc_err : err;
619 }
620 
621 static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev,
622 				   struct mmc_ioc_multi_cmd __user *user)
623 {
624 	struct mmc_blk_ioc_data **idata = NULL;
625 	struct mmc_ioc_cmd __user *cmds = user->cmds;
626 	struct mmc_card *card;
627 	struct mmc_blk_data *md;
628 	int i, err = 0, ioc_err = 0;
629 	__u64 num_of_cmds;
630 
631 	/*
632 	 * The caller must have CAP_SYS_RAWIO, and must be calling this on the
633 	 * whole block device, not on a partition.  This prevents overspray
634 	 * between sibling partitions.
635 	 */
636 	if ((!capable(CAP_SYS_RAWIO)) || (bdev != bdev->bd_contains))
637 		return -EPERM;
638 
639 	if (copy_from_user(&num_of_cmds, &user->num_of_cmds,
640 			   sizeof(num_of_cmds)))
641 		return -EFAULT;
642 
643 	if (num_of_cmds > MMC_IOC_MAX_CMDS)
644 		return -EINVAL;
645 
646 	idata = kcalloc(num_of_cmds, sizeof(*idata), GFP_KERNEL);
647 	if (!idata)
648 		return -ENOMEM;
649 
650 	for (i = 0; i < num_of_cmds; i++) {
651 		idata[i] = mmc_blk_ioctl_copy_from_user(&cmds[i]);
652 		if (IS_ERR(idata[i])) {
653 			err = PTR_ERR(idata[i]);
654 			num_of_cmds = i;
655 			goto cmd_err;
656 		}
657 	}
658 
659 	md = mmc_blk_get(bdev->bd_disk);
660 	if (!md) {
661 		err = -EINVAL;
662 		goto cmd_err;
663 	}
664 
665 	card = md->queue.card;
666 	if (IS_ERR(card)) {
667 		err = PTR_ERR(card);
668 		goto cmd_done;
669 	}
670 
671 	mmc_get_card(card);
672 
673 	for (i = 0; i < num_of_cmds && !ioc_err; i++)
674 		ioc_err = __mmc_blk_ioctl_cmd(card, md, idata[i]);
675 
676 	/* Always switch back to main area after RPMB access */
677 	if (md->area_type & MMC_BLK_DATA_AREA_RPMB)
678 		mmc_blk_part_switch(card, dev_get_drvdata(&card->dev));
679 
680 	mmc_put_card(card);
681 
682 	/* copy to user if data and response */
683 	for (i = 0; i < num_of_cmds && !err; i++)
684 		err = mmc_blk_ioctl_copy_to_user(&cmds[i], idata[i]);
685 
686 cmd_done:
687 	mmc_blk_put(md);
688 cmd_err:
689 	for (i = 0; i < num_of_cmds; i++) {
690 		kfree(idata[i]->buf);
691 		kfree(idata[i]);
692 	}
693 	kfree(idata);
694 	return ioc_err ? ioc_err : err;
695 }
696 
697 static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode,
698 	unsigned int cmd, unsigned long arg)
699 {
700 	switch (cmd) {
701 	case MMC_IOC_CMD:
702 		return mmc_blk_ioctl_cmd(bdev,
703 				(struct mmc_ioc_cmd __user *)arg);
704 	case MMC_IOC_MULTI_CMD:
705 		return mmc_blk_ioctl_multi_cmd(bdev,
706 				(struct mmc_ioc_multi_cmd __user *)arg);
707 	default:
708 		return -EINVAL;
709 	}
710 }
711 
712 #ifdef CONFIG_COMPAT
713 static int mmc_blk_compat_ioctl(struct block_device *bdev, fmode_t mode,
714 	unsigned int cmd, unsigned long arg)
715 {
716 	return mmc_blk_ioctl(bdev, mode, cmd, (unsigned long) compat_ptr(arg));
717 }
718 #endif
719 
720 static const struct block_device_operations mmc_bdops = {
721 	.open			= mmc_blk_open,
722 	.release		= mmc_blk_release,
723 	.getgeo			= mmc_blk_getgeo,
724 	.owner			= THIS_MODULE,
725 	.ioctl			= mmc_blk_ioctl,
726 #ifdef CONFIG_COMPAT
727 	.compat_ioctl		= mmc_blk_compat_ioctl,
728 #endif
729 };
730 
731 static int mmc_blk_part_switch_pre(struct mmc_card *card,
732 				   unsigned int part_type)
733 {
734 	int ret = 0;
735 
736 	if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
737 		if (card->ext_csd.cmdq_en) {
738 			ret = mmc_cmdq_disable(card);
739 			if (ret)
740 				return ret;
741 		}
742 		mmc_retune_pause(card->host);
743 	}
744 
745 	return ret;
746 }
747 
748 static int mmc_blk_part_switch_post(struct mmc_card *card,
749 				    unsigned int part_type)
750 {
751 	int ret = 0;
752 
753 	if (part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) {
754 		mmc_retune_unpause(card->host);
755 		if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
756 			ret = mmc_cmdq_enable(card);
757 	}
758 
759 	return ret;
760 }
761 
762 static inline int mmc_blk_part_switch(struct mmc_card *card,
763 				      struct mmc_blk_data *md)
764 {
765 	int ret = 0;
766 	struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev);
767 
768 	if (main_md->part_curr == md->part_type)
769 		return 0;
770 
771 	if (mmc_card_mmc(card)) {
772 		u8 part_config = card->ext_csd.part_config;
773 
774 		ret = mmc_blk_part_switch_pre(card, md->part_type);
775 		if (ret)
776 			return ret;
777 
778 		part_config &= ~EXT_CSD_PART_CONFIG_ACC_MASK;
779 		part_config |= md->part_type;
780 
781 		ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
782 				 EXT_CSD_PART_CONFIG, part_config,
783 				 card->ext_csd.part_time);
784 		if (ret) {
785 			mmc_blk_part_switch_post(card, md->part_type);
786 			return ret;
787 		}
788 
789 		card->ext_csd.part_config = part_config;
790 
791 		ret = mmc_blk_part_switch_post(card, main_md->part_curr);
792 	}
793 
794 	main_md->part_curr = md->part_type;
795 	return ret;
796 }
797 
798 static int mmc_sd_num_wr_blocks(struct mmc_card *card, u32 *written_blocks)
799 {
800 	int err;
801 	u32 result;
802 	__be32 *blocks;
803 
804 	struct mmc_request mrq = {};
805 	struct mmc_command cmd = {};
806 	struct mmc_data data = {};
807 
808 	struct scatterlist sg;
809 
810 	cmd.opcode = MMC_APP_CMD;
811 	cmd.arg = card->rca << 16;
812 	cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
813 
814 	err = mmc_wait_for_cmd(card->host, &cmd, 0);
815 	if (err)
816 		return err;
817 	if (!mmc_host_is_spi(card->host) && !(cmd.resp[0] & R1_APP_CMD))
818 		return -EIO;
819 
820 	memset(&cmd, 0, sizeof(struct mmc_command));
821 
822 	cmd.opcode = SD_APP_SEND_NUM_WR_BLKS;
823 	cmd.arg = 0;
824 	cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
825 
826 	data.blksz = 4;
827 	data.blocks = 1;
828 	data.flags = MMC_DATA_READ;
829 	data.sg = &sg;
830 	data.sg_len = 1;
831 	mmc_set_data_timeout(&data, card);
832 
833 	mrq.cmd = &cmd;
834 	mrq.data = &data;
835 
836 	blocks = kmalloc(4, GFP_KERNEL);
837 	if (!blocks)
838 		return -ENOMEM;
839 
840 	sg_init_one(&sg, blocks, 4);
841 
842 	mmc_wait_for_req(card->host, &mrq);
843 
844 	result = ntohl(*blocks);
845 	kfree(blocks);
846 
847 	if (cmd.error || data.error)
848 		return -EIO;
849 
850 	*written_blocks = result;
851 
852 	return 0;
853 }
854 
855 static int get_card_status(struct mmc_card *card, u32 *status, int retries)
856 {
857 	struct mmc_command cmd = {};
858 	int err;
859 
860 	cmd.opcode = MMC_SEND_STATUS;
861 	if (!mmc_host_is_spi(card->host))
862 		cmd.arg = card->rca << 16;
863 	cmd.flags = MMC_RSP_SPI_R2 | MMC_RSP_R1 | MMC_CMD_AC;
864 	err = mmc_wait_for_cmd(card->host, &cmd, retries);
865 	if (err == 0)
866 		*status = cmd.resp[0];
867 	return err;
868 }
869 
870 static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms,
871 		bool hw_busy_detect, struct request *req, bool *gen_err)
872 {
873 	unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
874 	int err = 0;
875 	u32 status;
876 
877 	do {
878 		err = get_card_status(card, &status, 5);
879 		if (err) {
880 			pr_err("%s: error %d requesting status\n",
881 			       req->rq_disk->disk_name, err);
882 			return err;
883 		}
884 
885 		if (status & R1_ERROR) {
886 			pr_err("%s: %s: error sending status cmd, status %#x\n",
887 				req->rq_disk->disk_name, __func__, status);
888 			*gen_err = true;
889 		}
890 
891 		/* We may rely on the host hw to handle busy detection.*/
892 		if ((card->host->caps & MMC_CAP_WAIT_WHILE_BUSY) &&
893 			hw_busy_detect)
894 			break;
895 
896 		/*
897 		 * Timeout if the device never becomes ready for data and never
898 		 * leaves the program state.
899 		 */
900 		if (time_after(jiffies, timeout)) {
901 			pr_err("%s: Card stuck in programming state! %s %s\n",
902 				mmc_hostname(card->host),
903 				req->rq_disk->disk_name, __func__);
904 			return -ETIMEDOUT;
905 		}
906 
907 		/*
908 		 * Some cards mishandle the status bits,
909 		 * so make sure to check both the busy
910 		 * indication and the card state.
911 		 */
912 	} while (!(status & R1_READY_FOR_DATA) ||
913 		 (R1_CURRENT_STATE(status) == R1_STATE_PRG));
914 
915 	return err;
916 }
917 
918 static int send_stop(struct mmc_card *card, unsigned int timeout_ms,
919 		struct request *req, bool *gen_err, u32 *stop_status)
920 {
921 	struct mmc_host *host = card->host;
922 	struct mmc_command cmd = {};
923 	int err;
924 	bool use_r1b_resp = rq_data_dir(req) == WRITE;
925 
926 	/*
927 	 * Normally we use R1B responses for WRITE, but in cases where the host
928 	 * has specified a max_busy_timeout we need to validate it. A failure
929 	 * means we need to prevent the host from doing hw busy detection, which
930 	 * is done by converting to a R1 response instead.
931 	 */
932 	if (host->max_busy_timeout && (timeout_ms > host->max_busy_timeout))
933 		use_r1b_resp = false;
934 
935 	cmd.opcode = MMC_STOP_TRANSMISSION;
936 	if (use_r1b_resp) {
937 		cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
938 		cmd.busy_timeout = timeout_ms;
939 	} else {
940 		cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
941 	}
942 
943 	err = mmc_wait_for_cmd(host, &cmd, 5);
944 	if (err)
945 		return err;
946 
947 	*stop_status = cmd.resp[0];
948 
949 	/* No need to check card status in case of READ. */
950 	if (rq_data_dir(req) == READ)
951 		return 0;
952 
953 	if (!mmc_host_is_spi(host) &&
954 		(*stop_status & R1_ERROR)) {
955 		pr_err("%s: %s: general error sending stop command, resp %#x\n",
956 			req->rq_disk->disk_name, __func__, *stop_status);
957 		*gen_err = true;
958 	}
959 
960 	return card_busy_detect(card, timeout_ms, use_r1b_resp, req, gen_err);
961 }
962 
963 #define ERR_NOMEDIUM	3
964 #define ERR_RETRY	2
965 #define ERR_ABORT	1
966 #define ERR_CONTINUE	0
967 
968 static int mmc_blk_cmd_error(struct request *req, const char *name, int error,
969 	bool status_valid, u32 status)
970 {
971 	switch (error) {
972 	case -EILSEQ:
973 		/* response crc error, retry the r/w cmd */
974 		pr_err("%s: %s sending %s command, card status %#x\n",
975 			req->rq_disk->disk_name, "response CRC error",
976 			name, status);
977 		return ERR_RETRY;
978 
979 	case -ETIMEDOUT:
980 		pr_err("%s: %s sending %s command, card status %#x\n",
981 			req->rq_disk->disk_name, "timed out", name, status);
982 
983 		/* If the status cmd initially failed, retry the r/w cmd */
984 		if (!status_valid) {
985 			pr_err("%s: status not valid, retrying timeout\n",
986 				req->rq_disk->disk_name);
987 			return ERR_RETRY;
988 		}
989 
990 		/*
991 		 * If it was a r/w cmd crc error, or illegal command
992 		 * (eg, issued in wrong state) then retry - we should
993 		 * have corrected the state problem above.
994 		 */
995 		if (status & (R1_COM_CRC_ERROR | R1_ILLEGAL_COMMAND)) {
996 			pr_err("%s: command error, retrying timeout\n",
997 				req->rq_disk->disk_name);
998 			return ERR_RETRY;
999 		}
1000 
1001 		/* Otherwise abort the command */
1002 		return ERR_ABORT;
1003 
1004 	default:
1005 		/* We don't understand the error code the driver gave us */
1006 		pr_err("%s: unknown error %d sending read/write command, card status %#x\n",
1007 		       req->rq_disk->disk_name, error, status);
1008 		return ERR_ABORT;
1009 	}
1010 }
1011 
1012 /*
1013  * Initial r/w and stop cmd error recovery.
1014  * We don't know whether the card received the r/w cmd or not, so try to
1015  * restore things back to a sane state.  Essentially, we do this as follows:
1016  * - Obtain card status.  If the first attempt to obtain card status fails,
1017  *   the status word will reflect the failed status cmd, not the failed
1018  *   r/w cmd.  If we fail to obtain card status, it suggests we can no
1019  *   longer communicate with the card.
1020  * - Check the card state.  If the card received the cmd but there was a
1021  *   transient problem with the response, it might still be in a data transfer
1022  *   mode.  Try to send it a stop command.  If this fails, we can't recover.
1023  * - If the r/w cmd failed due to a response CRC error, it was probably
1024  *   transient, so retry the cmd.
1025  * - If the r/w cmd timed out, but we didn't get the r/w cmd status, retry.
1026  * - If the r/w cmd timed out, and the r/w cmd failed due to CRC error or
1027  *   illegal cmd, retry.
1028  * Otherwise we don't understand what happened, so abort.
1029  */
1030 static int mmc_blk_cmd_recovery(struct mmc_card *card, struct request *req,
1031 	struct mmc_blk_request *brq, bool *ecc_err, bool *gen_err)
1032 {
1033 	bool prev_cmd_status_valid = true;
1034 	u32 status, stop_status = 0;
1035 	int err, retry;
1036 
1037 	if (mmc_card_removed(card))
1038 		return ERR_NOMEDIUM;
1039 
1040 	/*
1041 	 * Try to get card status which indicates both the card state
1042 	 * and why there was no response.  If the first attempt fails,
1043 	 * we can't be sure the returned status is for the r/w command.
1044 	 */
1045 	for (retry = 2; retry >= 0; retry--) {
1046 		err = get_card_status(card, &status, 0);
1047 		if (!err)
1048 			break;
1049 
1050 		/* Re-tune if needed */
1051 		mmc_retune_recheck(card->host);
1052 
1053 		prev_cmd_status_valid = false;
1054 		pr_err("%s: error %d sending status command, %sing\n",
1055 		       req->rq_disk->disk_name, err, retry ? "retry" : "abort");
1056 	}
1057 
1058 	/* We couldn't get a response from the card.  Give up. */
1059 	if (err) {
1060 		/* Check if the card is removed */
1061 		if (mmc_detect_card_removed(card->host))
1062 			return ERR_NOMEDIUM;
1063 		return ERR_ABORT;
1064 	}
1065 
1066 	/* Flag ECC errors */
1067 	if ((status & R1_CARD_ECC_FAILED) ||
1068 	    (brq->stop.resp[0] & R1_CARD_ECC_FAILED) ||
1069 	    (brq->cmd.resp[0] & R1_CARD_ECC_FAILED))
1070 		*ecc_err = true;
1071 
1072 	/* Flag General errors */
1073 	if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ)
1074 		if ((status & R1_ERROR) ||
1075 			(brq->stop.resp[0] & R1_ERROR)) {
1076 			pr_err("%s: %s: general error sending stop or status command, stop cmd response %#x, card status %#x\n",
1077 			       req->rq_disk->disk_name, __func__,
1078 			       brq->stop.resp[0], status);
1079 			*gen_err = true;
1080 		}
1081 
1082 	/*
1083 	 * Check the current card state.  If it is in some data transfer
1084 	 * mode, tell it to stop (and hopefully transition back to TRAN.)
1085 	 */
1086 	if (R1_CURRENT_STATE(status) == R1_STATE_DATA ||
1087 	    R1_CURRENT_STATE(status) == R1_STATE_RCV) {
1088 		err = send_stop(card,
1089 			DIV_ROUND_UP(brq->data.timeout_ns, 1000000),
1090 			req, gen_err, &stop_status);
1091 		if (err) {
1092 			pr_err("%s: error %d sending stop command\n",
1093 			       req->rq_disk->disk_name, err);
1094 			/*
1095 			 * If the stop cmd also timed out, the card is probably
1096 			 * not present, so abort. Other errors are bad news too.
1097 			 */
1098 			return ERR_ABORT;
1099 		}
1100 
1101 		if (stop_status & R1_CARD_ECC_FAILED)
1102 			*ecc_err = true;
1103 	}
1104 
1105 	/* Check for set block count errors */
1106 	if (brq->sbc.error)
1107 		return mmc_blk_cmd_error(req, "SET_BLOCK_COUNT", brq->sbc.error,
1108 				prev_cmd_status_valid, status);
1109 
1110 	/* Check for r/w command errors */
1111 	if (brq->cmd.error)
1112 		return mmc_blk_cmd_error(req, "r/w cmd", brq->cmd.error,
1113 				prev_cmd_status_valid, status);
1114 
1115 	/* Data errors */
1116 	if (!brq->stop.error)
1117 		return ERR_CONTINUE;
1118 
1119 	/* Now for stop errors.  These aren't fatal to the transfer. */
1120 	pr_info("%s: error %d sending stop command, original cmd response %#x, card status %#x\n",
1121 	       req->rq_disk->disk_name, brq->stop.error,
1122 	       brq->cmd.resp[0], status);
1123 
1124 	/*
1125 	 * Subsitute in our own stop status as this will give the error
1126 	 * state which happened during the execution of the r/w command.
1127 	 */
1128 	if (stop_status) {
1129 		brq->stop.resp[0] = stop_status;
1130 		brq->stop.error = 0;
1131 	}
1132 	return ERR_CONTINUE;
1133 }
1134 
1135 static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host,
1136 			 int type)
1137 {
1138 	int err;
1139 
1140 	if (md->reset_done & type)
1141 		return -EEXIST;
1142 
1143 	md->reset_done |= type;
1144 	err = mmc_hw_reset(host);
1145 	/* Ensure we switch back to the correct partition */
1146 	if (err != -EOPNOTSUPP) {
1147 		struct mmc_blk_data *main_md =
1148 			dev_get_drvdata(&host->card->dev);
1149 		int part_err;
1150 
1151 		main_md->part_curr = main_md->part_type;
1152 		part_err = mmc_blk_part_switch(host->card, md);
1153 		if (part_err) {
1154 			/*
1155 			 * We have failed to get back into the correct
1156 			 * partition, so we need to abort the whole request.
1157 			 */
1158 			return -ENODEV;
1159 		}
1160 	}
1161 	return err;
1162 }
1163 
1164 static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type)
1165 {
1166 	md->reset_done &= ~type;
1167 }
1168 
1169 int mmc_access_rpmb(struct mmc_queue *mq)
1170 {
1171 	struct mmc_blk_data *md = mq->blkdata;
1172 	/*
1173 	 * If this is a RPMB partition access, return ture
1174 	 */
1175 	if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB)
1176 		return true;
1177 
1178 	return false;
1179 }
1180 
1181 static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
1182 {
1183 	struct mmc_blk_data *md = mq->blkdata;
1184 	struct mmc_card *card = md->queue.card;
1185 	unsigned int from, nr, arg;
1186 	int err = 0, type = MMC_BLK_DISCARD;
1187 	blk_status_t status = BLK_STS_OK;
1188 
1189 	if (!mmc_can_erase(card)) {
1190 		status = BLK_STS_NOTSUPP;
1191 		goto fail;
1192 	}
1193 
1194 	from = blk_rq_pos(req);
1195 	nr = blk_rq_sectors(req);
1196 
1197 	if (mmc_can_discard(card))
1198 		arg = MMC_DISCARD_ARG;
1199 	else if (mmc_can_trim(card))
1200 		arg = MMC_TRIM_ARG;
1201 	else
1202 		arg = MMC_ERASE_ARG;
1203 	do {
1204 		err = 0;
1205 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1206 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1207 					 INAND_CMD38_ARG_EXT_CSD,
1208 					 arg == MMC_TRIM_ARG ?
1209 					 INAND_CMD38_ARG_TRIM :
1210 					 INAND_CMD38_ARG_ERASE,
1211 					 0);
1212 		}
1213 		if (!err)
1214 			err = mmc_erase(card, from, nr, arg);
1215 	} while (err == -EIO && !mmc_blk_reset(md, card->host, type));
1216 	if (err)
1217 		status = BLK_STS_IOERR;
1218 	else
1219 		mmc_blk_reset_success(md, type);
1220 fail:
1221 	blk_end_request(req, status, blk_rq_bytes(req));
1222 }
1223 
1224 static void mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
1225 				       struct request *req)
1226 {
1227 	struct mmc_blk_data *md = mq->blkdata;
1228 	struct mmc_card *card = md->queue.card;
1229 	unsigned int from, nr, arg;
1230 	int err = 0, type = MMC_BLK_SECDISCARD;
1231 	blk_status_t status = BLK_STS_OK;
1232 
1233 	if (!(mmc_can_secure_erase_trim(card))) {
1234 		status = BLK_STS_NOTSUPP;
1235 		goto out;
1236 	}
1237 
1238 	from = blk_rq_pos(req);
1239 	nr = blk_rq_sectors(req);
1240 
1241 	if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
1242 		arg = MMC_SECURE_TRIM1_ARG;
1243 	else
1244 		arg = MMC_SECURE_ERASE_ARG;
1245 
1246 retry:
1247 	if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1248 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1249 				 INAND_CMD38_ARG_EXT_CSD,
1250 				 arg == MMC_SECURE_TRIM1_ARG ?
1251 				 INAND_CMD38_ARG_SECTRIM1 :
1252 				 INAND_CMD38_ARG_SECERASE,
1253 				 0);
1254 		if (err)
1255 			goto out_retry;
1256 	}
1257 
1258 	err = mmc_erase(card, from, nr, arg);
1259 	if (err == -EIO)
1260 		goto out_retry;
1261 	if (err) {
1262 		status = BLK_STS_IOERR;
1263 		goto out;
1264 	}
1265 
1266 	if (arg == MMC_SECURE_TRIM1_ARG) {
1267 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
1268 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
1269 					 INAND_CMD38_ARG_EXT_CSD,
1270 					 INAND_CMD38_ARG_SECTRIM2,
1271 					 0);
1272 			if (err)
1273 				goto out_retry;
1274 		}
1275 
1276 		err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
1277 		if (err == -EIO)
1278 			goto out_retry;
1279 		if (err) {
1280 			status = BLK_STS_IOERR;
1281 			goto out;
1282 		}
1283 	}
1284 
1285 out_retry:
1286 	if (err && !mmc_blk_reset(md, card->host, type))
1287 		goto retry;
1288 	if (!err)
1289 		mmc_blk_reset_success(md, type);
1290 out:
1291 	blk_end_request(req, status, blk_rq_bytes(req));
1292 }
1293 
1294 static void mmc_blk_issue_flush(struct mmc_queue *mq, struct request *req)
1295 {
1296 	struct mmc_blk_data *md = mq->blkdata;
1297 	struct mmc_card *card = md->queue.card;
1298 	int ret = 0;
1299 
1300 	ret = mmc_flush_cache(card);
1301 	blk_end_request_all(req, ret ? BLK_STS_IOERR : BLK_STS_OK);
1302 }
1303 
1304 /*
1305  * Reformat current write as a reliable write, supporting
1306  * both legacy and the enhanced reliable write MMC cards.
1307  * In each transfer we'll handle only as much as a single
1308  * reliable write can handle, thus finish the request in
1309  * partial completions.
1310  */
1311 static inline void mmc_apply_rel_rw(struct mmc_blk_request *brq,
1312 				    struct mmc_card *card,
1313 				    struct request *req)
1314 {
1315 	if (!(card->ext_csd.rel_param & EXT_CSD_WR_REL_PARAM_EN)) {
1316 		/* Legacy mode imposes restrictions on transfers. */
1317 		if (!IS_ALIGNED(blk_rq_pos(req), card->ext_csd.rel_sectors))
1318 			brq->data.blocks = 1;
1319 
1320 		if (brq->data.blocks > card->ext_csd.rel_sectors)
1321 			brq->data.blocks = card->ext_csd.rel_sectors;
1322 		else if (brq->data.blocks < card->ext_csd.rel_sectors)
1323 			brq->data.blocks = 1;
1324 	}
1325 }
1326 
1327 #define CMD_ERRORS							\
1328 	(R1_OUT_OF_RANGE |	/* Command argument out of range */	\
1329 	 R1_ADDRESS_ERROR |	/* Misaligned address */		\
1330 	 R1_BLOCK_LEN_ERROR |	/* Transferred block length incorrect */\
1331 	 R1_WP_VIOLATION |	/* Tried to write to protected block */	\
1332 	 R1_CC_ERROR |		/* Card controller error */		\
1333 	 R1_ERROR)		/* General/unknown error */
1334 
1335 static enum mmc_blk_status mmc_blk_err_check(struct mmc_card *card,
1336 					     struct mmc_async_req *areq)
1337 {
1338 	struct mmc_queue_req *mq_mrq = container_of(areq, struct mmc_queue_req,
1339 						    areq);
1340 	struct mmc_blk_request *brq = &mq_mrq->brq;
1341 	struct request *req = mq_mrq->req;
1342 	int need_retune = card->host->need_retune;
1343 	bool ecc_err = false;
1344 	bool gen_err = false;
1345 
1346 	/*
1347 	 * sbc.error indicates a problem with the set block count
1348 	 * command.  No data will have been transferred.
1349 	 *
1350 	 * cmd.error indicates a problem with the r/w command.  No
1351 	 * data will have been transferred.
1352 	 *
1353 	 * stop.error indicates a problem with the stop command.  Data
1354 	 * may have been transferred, or may still be transferring.
1355 	 */
1356 	if (brq->sbc.error || brq->cmd.error || brq->stop.error ||
1357 	    brq->data.error) {
1358 		switch (mmc_blk_cmd_recovery(card, req, brq, &ecc_err, &gen_err)) {
1359 		case ERR_RETRY:
1360 			return MMC_BLK_RETRY;
1361 		case ERR_ABORT:
1362 			return MMC_BLK_ABORT;
1363 		case ERR_NOMEDIUM:
1364 			return MMC_BLK_NOMEDIUM;
1365 		case ERR_CONTINUE:
1366 			break;
1367 		}
1368 	}
1369 
1370 	/*
1371 	 * Check for errors relating to the execution of the
1372 	 * initial command - such as address errors.  No data
1373 	 * has been transferred.
1374 	 */
1375 	if (brq->cmd.resp[0] & CMD_ERRORS) {
1376 		pr_err("%s: r/w command failed, status = %#x\n",
1377 		       req->rq_disk->disk_name, brq->cmd.resp[0]);
1378 		return MMC_BLK_ABORT;
1379 	}
1380 
1381 	/*
1382 	 * Everything else is either success, or a data error of some
1383 	 * kind.  If it was a write, we may have transitioned to
1384 	 * program mode, which we have to wait for it to complete.
1385 	 */
1386 	if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
1387 		int err;
1388 
1389 		/* Check stop command response */
1390 		if (brq->stop.resp[0] & R1_ERROR) {
1391 			pr_err("%s: %s: general error sending stop command, stop cmd response %#x\n",
1392 			       req->rq_disk->disk_name, __func__,
1393 			       brq->stop.resp[0]);
1394 			gen_err = true;
1395 		}
1396 
1397 		err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, false, req,
1398 					&gen_err);
1399 		if (err)
1400 			return MMC_BLK_CMD_ERR;
1401 	}
1402 
1403 	/* if general error occurs, retry the write operation. */
1404 	if (gen_err) {
1405 		pr_warn("%s: retrying write for general error\n",
1406 				req->rq_disk->disk_name);
1407 		return MMC_BLK_RETRY;
1408 	}
1409 
1410 	if (brq->data.error) {
1411 		if (need_retune && !brq->retune_retry_done) {
1412 			pr_debug("%s: retrying because a re-tune was needed\n",
1413 				 req->rq_disk->disk_name);
1414 			brq->retune_retry_done = 1;
1415 			return MMC_BLK_RETRY;
1416 		}
1417 		pr_err("%s: error %d transferring data, sector %u, nr %u, cmd response %#x, card status %#x\n",
1418 		       req->rq_disk->disk_name, brq->data.error,
1419 		       (unsigned)blk_rq_pos(req),
1420 		       (unsigned)blk_rq_sectors(req),
1421 		       brq->cmd.resp[0], brq->stop.resp[0]);
1422 
1423 		if (rq_data_dir(req) == READ) {
1424 			if (ecc_err)
1425 				return MMC_BLK_ECC_ERR;
1426 			return MMC_BLK_DATA_ERR;
1427 		} else {
1428 			return MMC_BLK_CMD_ERR;
1429 		}
1430 	}
1431 
1432 	if (!brq->data.bytes_xfered)
1433 		return MMC_BLK_RETRY;
1434 
1435 	if (blk_rq_bytes(req) != brq->data.bytes_xfered)
1436 		return MMC_BLK_PARTIAL;
1437 
1438 	return MMC_BLK_SUCCESS;
1439 }
1440 
1441 static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
1442 			      int disable_multi, bool *do_rel_wr,
1443 			      bool *do_data_tag)
1444 {
1445 	struct mmc_blk_data *md = mq->blkdata;
1446 	struct mmc_card *card = md->queue.card;
1447 	struct mmc_blk_request *brq = &mqrq->brq;
1448 	struct request *req = mqrq->req;
1449 
1450 	/*
1451 	 * Reliable writes are used to implement Forced Unit Access and
1452 	 * are supported only on MMCs.
1453 	 */
1454 	*do_rel_wr = (req->cmd_flags & REQ_FUA) &&
1455 		     rq_data_dir(req) == WRITE &&
1456 		     (md->flags & MMC_BLK_REL_WR);
1457 
1458 	memset(brq, 0, sizeof(struct mmc_blk_request));
1459 
1460 	brq->mrq.data = &brq->data;
1461 
1462 	brq->stop.opcode = MMC_STOP_TRANSMISSION;
1463 	brq->stop.arg = 0;
1464 
1465 	if (rq_data_dir(req) == READ) {
1466 		brq->data.flags = MMC_DATA_READ;
1467 		brq->stop.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
1468 	} else {
1469 		brq->data.flags = MMC_DATA_WRITE;
1470 		brq->stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
1471 	}
1472 
1473 	brq->data.blksz = 512;
1474 	brq->data.blocks = blk_rq_sectors(req);
1475 
1476 	/*
1477 	 * The block layer doesn't support all sector count
1478 	 * restrictions, so we need to be prepared for too big
1479 	 * requests.
1480 	 */
1481 	if (brq->data.blocks > card->host->max_blk_count)
1482 		brq->data.blocks = card->host->max_blk_count;
1483 
1484 	if (brq->data.blocks > 1) {
1485 		/*
1486 		 * After a read error, we redo the request one sector
1487 		 * at a time in order to accurately determine which
1488 		 * sectors can be read successfully.
1489 		 */
1490 		if (disable_multi)
1491 			brq->data.blocks = 1;
1492 
1493 		/*
1494 		 * Some controllers have HW issues while operating
1495 		 * in multiple I/O mode
1496 		 */
1497 		if (card->host->ops->multi_io_quirk)
1498 			brq->data.blocks = card->host->ops->multi_io_quirk(card,
1499 						(rq_data_dir(req) == READ) ?
1500 						MMC_DATA_READ : MMC_DATA_WRITE,
1501 						brq->data.blocks);
1502 	}
1503 
1504 	if (*do_rel_wr)
1505 		mmc_apply_rel_rw(brq, card, req);
1506 
1507 	/*
1508 	 * Data tag is used only during writing meta data to speed
1509 	 * up write and any subsequent read of this meta data
1510 	 */
1511 	*do_data_tag = card->ext_csd.data_tag_unit_size &&
1512 		       (req->cmd_flags & REQ_META) &&
1513 		       (rq_data_dir(req) == WRITE) &&
1514 		       ((brq->data.blocks * brq->data.blksz) >=
1515 			card->ext_csd.data_tag_unit_size);
1516 
1517 	mmc_set_data_timeout(&brq->data, card);
1518 
1519 	brq->data.sg = mqrq->sg;
1520 	brq->data.sg_len = mmc_queue_map_sg(mq, mqrq);
1521 
1522 	/*
1523 	 * Adjust the sg list so it is the same size as the
1524 	 * request.
1525 	 */
1526 	if (brq->data.blocks != blk_rq_sectors(req)) {
1527 		int i, data_size = brq->data.blocks << 9;
1528 		struct scatterlist *sg;
1529 
1530 		for_each_sg(brq->data.sg, sg, brq->data.sg_len, i) {
1531 			data_size -= sg->length;
1532 			if (data_size <= 0) {
1533 				sg->length += data_size;
1534 				i++;
1535 				break;
1536 			}
1537 		}
1538 		brq->data.sg_len = i;
1539 	}
1540 
1541 	mqrq->areq.mrq = &brq->mrq;
1542 
1543 	mmc_queue_bounce_pre(mqrq);
1544 }
1545 
1546 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
1547 			       struct mmc_card *card,
1548 			       int disable_multi,
1549 			       struct mmc_queue *mq)
1550 {
1551 	u32 readcmd, writecmd;
1552 	struct mmc_blk_request *brq = &mqrq->brq;
1553 	struct request *req = mqrq->req;
1554 	struct mmc_blk_data *md = mq->blkdata;
1555 	bool do_rel_wr, do_data_tag;
1556 
1557 	mmc_blk_data_prep(mq, mqrq, disable_multi, &do_rel_wr, &do_data_tag);
1558 
1559 	brq->mrq.cmd = &brq->cmd;
1560 
1561 	brq->cmd.arg = blk_rq_pos(req);
1562 	if (!mmc_card_blockaddr(card))
1563 		brq->cmd.arg <<= 9;
1564 	brq->cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
1565 
1566 	if (brq->data.blocks > 1 || do_rel_wr) {
1567 		/* SPI multiblock writes terminate using a special
1568 		 * token, not a STOP_TRANSMISSION request.
1569 		 */
1570 		if (!mmc_host_is_spi(card->host) ||
1571 		    rq_data_dir(req) == READ)
1572 			brq->mrq.stop = &brq->stop;
1573 		readcmd = MMC_READ_MULTIPLE_BLOCK;
1574 		writecmd = MMC_WRITE_MULTIPLE_BLOCK;
1575 	} else {
1576 		brq->mrq.stop = NULL;
1577 		readcmd = MMC_READ_SINGLE_BLOCK;
1578 		writecmd = MMC_WRITE_BLOCK;
1579 	}
1580 	brq->cmd.opcode = rq_data_dir(req) == READ ? readcmd : writecmd;
1581 
1582 	/*
1583 	 * Pre-defined multi-block transfers are preferable to
1584 	 * open ended-ones (and necessary for reliable writes).
1585 	 * However, it is not sufficient to just send CMD23,
1586 	 * and avoid the final CMD12, as on an error condition
1587 	 * CMD12 (stop) needs to be sent anyway. This, coupled
1588 	 * with Auto-CMD23 enhancements provided by some
1589 	 * hosts, means that the complexity of dealing
1590 	 * with this is best left to the host. If CMD23 is
1591 	 * supported by card and host, we'll fill sbc in and let
1592 	 * the host deal with handling it correctly. This means
1593 	 * that for hosts that don't expose MMC_CAP_CMD23, no
1594 	 * change of behavior will be observed.
1595 	 *
1596 	 * N.B: Some MMC cards experience perf degradation.
1597 	 * We'll avoid using CMD23-bounded multiblock writes for
1598 	 * these, while retaining features like reliable writes.
1599 	 */
1600 	if ((md->flags & MMC_BLK_CMD23) && mmc_op_multi(brq->cmd.opcode) &&
1601 	    (do_rel_wr || !(card->quirks & MMC_QUIRK_BLK_NO_CMD23) ||
1602 	     do_data_tag)) {
1603 		brq->sbc.opcode = MMC_SET_BLOCK_COUNT;
1604 		brq->sbc.arg = brq->data.blocks |
1605 			(do_rel_wr ? (1 << 31) : 0) |
1606 			(do_data_tag ? (1 << 29) : 0);
1607 		brq->sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
1608 		brq->mrq.sbc = &brq->sbc;
1609 	}
1610 
1611 	mqrq->areq.err_check = mmc_blk_err_check;
1612 }
1613 
1614 static bool mmc_blk_rw_cmd_err(struct mmc_blk_data *md, struct mmc_card *card,
1615 			       struct mmc_blk_request *brq, struct request *req,
1616 			       bool old_req_pending)
1617 {
1618 	bool req_pending;
1619 
1620 	/*
1621 	 * If this is an SD card and we're writing, we can first
1622 	 * mark the known good sectors as ok.
1623 	 *
1624 	 * If the card is not SD, we can still ok written sectors
1625 	 * as reported by the controller (which might be less than
1626 	 * the real number of written sectors, but never more).
1627 	 */
1628 	if (mmc_card_sd(card)) {
1629 		u32 blocks;
1630 		int err;
1631 
1632 		err = mmc_sd_num_wr_blocks(card, &blocks);
1633 		if (err)
1634 			req_pending = old_req_pending;
1635 		else
1636 			req_pending = blk_end_request(req, 0, blocks << 9);
1637 	} else {
1638 		req_pending = blk_end_request(req, 0, brq->data.bytes_xfered);
1639 	}
1640 	return req_pending;
1641 }
1642 
1643 static void mmc_blk_rw_cmd_abort(struct mmc_queue *mq, struct mmc_card *card,
1644 				 struct request *req,
1645 				 struct mmc_queue_req *mqrq)
1646 {
1647 	if (mmc_card_removed(card))
1648 		req->rq_flags |= RQF_QUIET;
1649 	while (blk_end_request(req, BLK_STS_IOERR, blk_rq_cur_bytes(req)));
1650 	mmc_queue_req_free(mq, mqrq);
1651 }
1652 
1653 /**
1654  * mmc_blk_rw_try_restart() - tries to restart the current async request
1655  * @mq: the queue with the card and host to restart
1656  * @req: a new request that want to be started after the current one
1657  */
1658 static void mmc_blk_rw_try_restart(struct mmc_queue *mq, struct request *req,
1659 				   struct mmc_queue_req *mqrq)
1660 {
1661 	if (!req)
1662 		return;
1663 
1664 	/*
1665 	 * If the card was removed, just cancel everything and return.
1666 	 */
1667 	if (mmc_card_removed(mq->card)) {
1668 		req->rq_flags |= RQF_QUIET;
1669 		blk_end_request_all(req, BLK_STS_IOERR);
1670 		mmc_queue_req_free(mq, mqrq);
1671 		return;
1672 	}
1673 	/* Else proceed and try to restart the current async request */
1674 	mmc_blk_rw_rq_prep(mqrq, mq->card, 0, mq);
1675 	mmc_start_areq(mq->card->host, &mqrq->areq, NULL);
1676 }
1677 
1678 static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
1679 {
1680 	struct mmc_blk_data *md = mq->blkdata;
1681 	struct mmc_card *card = md->queue.card;
1682 	struct mmc_blk_request *brq;
1683 	int disable_multi = 0, retry = 0, type, retune_retry_done = 0;
1684 	enum mmc_blk_status status;
1685 	struct mmc_queue_req *mqrq_cur = NULL;
1686 	struct mmc_queue_req *mq_rq;
1687 	struct request *old_req;
1688 	struct mmc_async_req *new_areq;
1689 	struct mmc_async_req *old_areq;
1690 	bool req_pending = true;
1691 
1692 	if (new_req) {
1693 		mqrq_cur = mmc_queue_req_find(mq, new_req);
1694 		if (!mqrq_cur) {
1695 			WARN_ON(1);
1696 			mmc_blk_requeue(mq->queue, new_req);
1697 			new_req = NULL;
1698 		}
1699 	}
1700 
1701 	if (!mq->qcnt)
1702 		return;
1703 
1704 	do {
1705 		if (new_req) {
1706 			/*
1707 			 * When 4KB native sector is enabled, only 8 blocks
1708 			 * multiple read or write is allowed
1709 			 */
1710 			if (mmc_large_sector(card) &&
1711 				!IS_ALIGNED(blk_rq_sectors(new_req), 8)) {
1712 				pr_err("%s: Transfer size is not 4KB sector size aligned\n",
1713 					new_req->rq_disk->disk_name);
1714 				mmc_blk_rw_cmd_abort(mq, card, new_req, mqrq_cur);
1715 				return;
1716 			}
1717 
1718 			mmc_blk_rw_rq_prep(mqrq_cur, card, 0, mq);
1719 			new_areq = &mqrq_cur->areq;
1720 		} else
1721 			new_areq = NULL;
1722 
1723 		old_areq = mmc_start_areq(card->host, new_areq, &status);
1724 		if (!old_areq) {
1725 			/*
1726 			 * We have just put the first request into the pipeline
1727 			 * and there is nothing more to do until it is
1728 			 * complete.
1729 			 */
1730 			return;
1731 		}
1732 
1733 		/*
1734 		 * An asynchronous request has been completed and we proceed
1735 		 * to handle the result of it.
1736 		 */
1737 		mq_rq =	container_of(old_areq, struct mmc_queue_req, areq);
1738 		brq = &mq_rq->brq;
1739 		old_req = mq_rq->req;
1740 		type = rq_data_dir(old_req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
1741 		mmc_queue_bounce_post(mq_rq);
1742 
1743 		switch (status) {
1744 		case MMC_BLK_SUCCESS:
1745 		case MMC_BLK_PARTIAL:
1746 			/*
1747 			 * A block was successfully transferred.
1748 			 */
1749 			mmc_blk_reset_success(md, type);
1750 
1751 			req_pending = blk_end_request(old_req, BLK_STS_OK,
1752 						      brq->data.bytes_xfered);
1753 			/*
1754 			 * If the blk_end_request function returns non-zero even
1755 			 * though all data has been transferred and no errors
1756 			 * were returned by the host controller, it's a bug.
1757 			 */
1758 			if (status == MMC_BLK_SUCCESS && req_pending) {
1759 				pr_err("%s BUG rq_tot %d d_xfer %d\n",
1760 				       __func__, blk_rq_bytes(old_req),
1761 				       brq->data.bytes_xfered);
1762 				mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1763 				return;
1764 			}
1765 			break;
1766 		case MMC_BLK_CMD_ERR:
1767 			req_pending = mmc_blk_rw_cmd_err(md, card, brq, old_req, req_pending);
1768 			if (mmc_blk_reset(md, card->host, type)) {
1769 				if (req_pending)
1770 					mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1771 				else
1772 					mmc_queue_req_free(mq, mq_rq);
1773 				mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1774 				return;
1775 			}
1776 			if (!req_pending) {
1777 				mmc_queue_req_free(mq, mq_rq);
1778 				mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1779 				return;
1780 			}
1781 			break;
1782 		case MMC_BLK_RETRY:
1783 			retune_retry_done = brq->retune_retry_done;
1784 			if (retry++ < 5)
1785 				break;
1786 			/* Fall through */
1787 		case MMC_BLK_ABORT:
1788 			if (!mmc_blk_reset(md, card->host, type))
1789 				break;
1790 			mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1791 			mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1792 			return;
1793 		case MMC_BLK_DATA_ERR: {
1794 			int err;
1795 
1796 			err = mmc_blk_reset(md, card->host, type);
1797 			if (!err)
1798 				break;
1799 			if (err == -ENODEV) {
1800 				mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1801 				mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1802 				return;
1803 			}
1804 			/* Fall through */
1805 		}
1806 		case MMC_BLK_ECC_ERR:
1807 			if (brq->data.blocks > 1) {
1808 				/* Redo read one sector at a time */
1809 				pr_warn("%s: retrying using single block read\n",
1810 					old_req->rq_disk->disk_name);
1811 				disable_multi = 1;
1812 				break;
1813 			}
1814 			/*
1815 			 * After an error, we redo I/O one sector at a
1816 			 * time, so we only reach here after trying to
1817 			 * read a single sector.
1818 			 */
1819 			req_pending = blk_end_request(old_req, BLK_STS_IOERR,
1820 						      brq->data.blksz);
1821 			if (!req_pending) {
1822 				mmc_queue_req_free(mq, mq_rq);
1823 				mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1824 				return;
1825 			}
1826 			break;
1827 		case MMC_BLK_NOMEDIUM:
1828 			mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1829 			mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1830 			return;
1831 		default:
1832 			pr_err("%s: Unhandled return value (%d)",
1833 					old_req->rq_disk->disk_name, status);
1834 			mmc_blk_rw_cmd_abort(mq, card, old_req, mq_rq);
1835 			mmc_blk_rw_try_restart(mq, new_req, mqrq_cur);
1836 			return;
1837 		}
1838 
1839 		if (req_pending) {
1840 			/*
1841 			 * In case of a incomplete request
1842 			 * prepare it again and resend.
1843 			 */
1844 			mmc_blk_rw_rq_prep(mq_rq, card,
1845 					disable_multi, mq);
1846 			mmc_start_areq(card->host,
1847 					&mq_rq->areq, NULL);
1848 			mq_rq->brq.retune_retry_done = retune_retry_done;
1849 		}
1850 	} while (req_pending);
1851 
1852 	mmc_queue_req_free(mq, mq_rq);
1853 }
1854 
1855 void mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
1856 {
1857 	int ret;
1858 	struct mmc_blk_data *md = mq->blkdata;
1859 	struct mmc_card *card = md->queue.card;
1860 
1861 	if (req && !mq->qcnt)
1862 		/* claim host only for the first request */
1863 		mmc_get_card(card);
1864 
1865 	ret = mmc_blk_part_switch(card, md);
1866 	if (ret) {
1867 		if (req) {
1868 			blk_end_request_all(req, BLK_STS_IOERR);
1869 		}
1870 		goto out;
1871 	}
1872 
1873 	if (req && req_op(req) == REQ_OP_DISCARD) {
1874 		/* complete ongoing async transfer before issuing discard */
1875 		if (mq->qcnt)
1876 			mmc_blk_issue_rw_rq(mq, NULL);
1877 		mmc_blk_issue_discard_rq(mq, req);
1878 	} else if (req && req_op(req) == REQ_OP_SECURE_ERASE) {
1879 		/* complete ongoing async transfer before issuing secure erase*/
1880 		if (mq->qcnt)
1881 			mmc_blk_issue_rw_rq(mq, NULL);
1882 		mmc_blk_issue_secdiscard_rq(mq, req);
1883 	} else if (req && req_op(req) == REQ_OP_FLUSH) {
1884 		/* complete ongoing async transfer before issuing flush */
1885 		if (mq->qcnt)
1886 			mmc_blk_issue_rw_rq(mq, NULL);
1887 		mmc_blk_issue_flush(mq, req);
1888 	} else {
1889 		mmc_blk_issue_rw_rq(mq, req);
1890 		card->host->context_info.is_waiting_last_req = false;
1891 	}
1892 
1893 out:
1894 	if (!mq->qcnt)
1895 		mmc_put_card(card);
1896 }
1897 
1898 static inline int mmc_blk_readonly(struct mmc_card *card)
1899 {
1900 	return mmc_card_readonly(card) ||
1901 	       !(card->csd.cmdclass & CCC_BLOCK_WRITE);
1902 }
1903 
1904 static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
1905 					      struct device *parent,
1906 					      sector_t size,
1907 					      bool default_ro,
1908 					      const char *subname,
1909 					      int area_type)
1910 {
1911 	struct mmc_blk_data *md;
1912 	int devidx, ret;
1913 
1914 	devidx = ida_simple_get(&mmc_blk_ida, 0, max_devices, GFP_KERNEL);
1915 	if (devidx < 0)
1916 		return ERR_PTR(devidx);
1917 
1918 	md = kzalloc(sizeof(struct mmc_blk_data), GFP_KERNEL);
1919 	if (!md) {
1920 		ret = -ENOMEM;
1921 		goto out;
1922 	}
1923 
1924 	md->area_type = area_type;
1925 
1926 	/*
1927 	 * Set the read-only status based on the supported commands
1928 	 * and the write protect switch.
1929 	 */
1930 	md->read_only = mmc_blk_readonly(card);
1931 
1932 	md->disk = alloc_disk(perdev_minors);
1933 	if (md->disk == NULL) {
1934 		ret = -ENOMEM;
1935 		goto err_kfree;
1936 	}
1937 
1938 	spin_lock_init(&md->lock);
1939 	INIT_LIST_HEAD(&md->part);
1940 	md->usage = 1;
1941 
1942 	ret = mmc_init_queue(&md->queue, card, &md->lock, subname);
1943 	if (ret)
1944 		goto err_putdisk;
1945 
1946 	md->queue.blkdata = md;
1947 
1948 	md->disk->major	= MMC_BLOCK_MAJOR;
1949 	md->disk->first_minor = devidx * perdev_minors;
1950 	md->disk->fops = &mmc_bdops;
1951 	md->disk->private_data = md;
1952 	md->disk->queue = md->queue.queue;
1953 	md->parent = parent;
1954 	set_disk_ro(md->disk, md->read_only || default_ro);
1955 	md->disk->flags = GENHD_FL_EXT_DEVT;
1956 	if (area_type & (MMC_BLK_DATA_AREA_RPMB | MMC_BLK_DATA_AREA_BOOT))
1957 		md->disk->flags |= GENHD_FL_NO_PART_SCAN;
1958 
1959 	/*
1960 	 * As discussed on lkml, GENHD_FL_REMOVABLE should:
1961 	 *
1962 	 * - be set for removable media with permanent block devices
1963 	 * - be unset for removable block devices with permanent media
1964 	 *
1965 	 * Since MMC block devices clearly fall under the second
1966 	 * case, we do not set GENHD_FL_REMOVABLE.  Userspace
1967 	 * should use the block device creation/destruction hotplug
1968 	 * messages to tell when the card is present.
1969 	 */
1970 
1971 	snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
1972 		 "mmcblk%u%s", card->host->index, subname ? subname : "");
1973 
1974 	if (mmc_card_mmc(card))
1975 		blk_queue_logical_block_size(md->queue.queue,
1976 					     card->ext_csd.data_sector_size);
1977 	else
1978 		blk_queue_logical_block_size(md->queue.queue, 512);
1979 
1980 	set_capacity(md->disk, size);
1981 
1982 	if (mmc_host_cmd23(card->host)) {
1983 		if ((mmc_card_mmc(card) &&
1984 		     card->csd.mmca_vsn >= CSD_SPEC_VER_3) ||
1985 		    (mmc_card_sd(card) &&
1986 		     card->scr.cmds & SD_SCR_CMD23_SUPPORT))
1987 			md->flags |= MMC_BLK_CMD23;
1988 	}
1989 
1990 	if (mmc_card_mmc(card) &&
1991 	    md->flags & MMC_BLK_CMD23 &&
1992 	    ((card->ext_csd.rel_param & EXT_CSD_WR_REL_PARAM_EN) ||
1993 	     card->ext_csd.rel_sectors)) {
1994 		md->flags |= MMC_BLK_REL_WR;
1995 		blk_queue_write_cache(md->queue.queue, true, true);
1996 	}
1997 
1998 	return md;
1999 
2000  err_putdisk:
2001 	put_disk(md->disk);
2002  err_kfree:
2003 	kfree(md);
2004  out:
2005 	ida_simple_remove(&mmc_blk_ida, devidx);
2006 	return ERR_PTR(ret);
2007 }
2008 
2009 static struct mmc_blk_data *mmc_blk_alloc(struct mmc_card *card)
2010 {
2011 	sector_t size;
2012 
2013 	if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
2014 		/*
2015 		 * The EXT_CSD sector count is in number or 512 byte
2016 		 * sectors.
2017 		 */
2018 		size = card->ext_csd.sectors;
2019 	} else {
2020 		/*
2021 		 * The CSD capacity field is in units of read_blkbits.
2022 		 * set_capacity takes units of 512 bytes.
2023 		 */
2024 		size = (typeof(sector_t))card->csd.capacity
2025 			<< (card->csd.read_blkbits - 9);
2026 	}
2027 
2028 	return mmc_blk_alloc_req(card, &card->dev, size, false, NULL,
2029 					MMC_BLK_DATA_AREA_MAIN);
2030 }
2031 
2032 static int mmc_blk_alloc_part(struct mmc_card *card,
2033 			      struct mmc_blk_data *md,
2034 			      unsigned int part_type,
2035 			      sector_t size,
2036 			      bool default_ro,
2037 			      const char *subname,
2038 			      int area_type)
2039 {
2040 	char cap_str[10];
2041 	struct mmc_blk_data *part_md;
2042 
2043 	part_md = mmc_blk_alloc_req(card, disk_to_dev(md->disk), size, default_ro,
2044 				    subname, area_type);
2045 	if (IS_ERR(part_md))
2046 		return PTR_ERR(part_md);
2047 	part_md->part_type = part_type;
2048 	list_add(&part_md->part, &md->part);
2049 
2050 	string_get_size((u64)get_capacity(part_md->disk), 512, STRING_UNITS_2,
2051 			cap_str, sizeof(cap_str));
2052 	pr_info("%s: %s %s partition %u %s\n",
2053 	       part_md->disk->disk_name, mmc_card_id(card),
2054 	       mmc_card_name(card), part_md->part_type, cap_str);
2055 	return 0;
2056 }
2057 
2058 /* MMC Physical partitions consist of two boot partitions and
2059  * up to four general purpose partitions.
2060  * For each partition enabled in EXT_CSD a block device will be allocatedi
2061  * to provide access to the partition.
2062  */
2063 
2064 static int mmc_blk_alloc_parts(struct mmc_card *card, struct mmc_blk_data *md)
2065 {
2066 	int idx, ret = 0;
2067 
2068 	if (!mmc_card_mmc(card))
2069 		return 0;
2070 
2071 	for (idx = 0; idx < card->nr_parts; idx++) {
2072 		if (card->part[idx].size) {
2073 			ret = mmc_blk_alloc_part(card, md,
2074 				card->part[idx].part_cfg,
2075 				card->part[idx].size >> 9,
2076 				card->part[idx].force_ro,
2077 				card->part[idx].name,
2078 				card->part[idx].area_type);
2079 			if (ret)
2080 				return ret;
2081 		}
2082 	}
2083 
2084 	return ret;
2085 }
2086 
2087 static void mmc_blk_remove_req(struct mmc_blk_data *md)
2088 {
2089 	struct mmc_card *card;
2090 
2091 	if (md) {
2092 		/*
2093 		 * Flush remaining requests and free queues. It
2094 		 * is freeing the queue that stops new requests
2095 		 * from being accepted.
2096 		 */
2097 		card = md->queue.card;
2098 		mmc_cleanup_queue(&md->queue);
2099 		if (md->disk->flags & GENHD_FL_UP) {
2100 			device_remove_file(disk_to_dev(md->disk), &md->force_ro);
2101 			if ((md->area_type & MMC_BLK_DATA_AREA_BOOT) &&
2102 					card->ext_csd.boot_ro_lockable)
2103 				device_remove_file(disk_to_dev(md->disk),
2104 					&md->power_ro_lock);
2105 
2106 			del_gendisk(md->disk);
2107 		}
2108 		mmc_blk_put(md);
2109 	}
2110 }
2111 
2112 static void mmc_blk_remove_parts(struct mmc_card *card,
2113 				 struct mmc_blk_data *md)
2114 {
2115 	struct list_head *pos, *q;
2116 	struct mmc_blk_data *part_md;
2117 
2118 	list_for_each_safe(pos, q, &md->part) {
2119 		part_md = list_entry(pos, struct mmc_blk_data, part);
2120 		list_del(pos);
2121 		mmc_blk_remove_req(part_md);
2122 	}
2123 }
2124 
2125 static int mmc_add_disk(struct mmc_blk_data *md)
2126 {
2127 	int ret;
2128 	struct mmc_card *card = md->queue.card;
2129 
2130 	device_add_disk(md->parent, md->disk);
2131 	md->force_ro.show = force_ro_show;
2132 	md->force_ro.store = force_ro_store;
2133 	sysfs_attr_init(&md->force_ro.attr);
2134 	md->force_ro.attr.name = "force_ro";
2135 	md->force_ro.attr.mode = S_IRUGO | S_IWUSR;
2136 	ret = device_create_file(disk_to_dev(md->disk), &md->force_ro);
2137 	if (ret)
2138 		goto force_ro_fail;
2139 
2140 	if ((md->area_type & MMC_BLK_DATA_AREA_BOOT) &&
2141 	     card->ext_csd.boot_ro_lockable) {
2142 		umode_t mode;
2143 
2144 		if (card->ext_csd.boot_ro_lock & EXT_CSD_BOOT_WP_B_PWR_WP_DIS)
2145 			mode = S_IRUGO;
2146 		else
2147 			mode = S_IRUGO | S_IWUSR;
2148 
2149 		md->power_ro_lock.show = power_ro_lock_show;
2150 		md->power_ro_lock.store = power_ro_lock_store;
2151 		sysfs_attr_init(&md->power_ro_lock.attr);
2152 		md->power_ro_lock.attr.mode = mode;
2153 		md->power_ro_lock.attr.name =
2154 					"ro_lock_until_next_power_on";
2155 		ret = device_create_file(disk_to_dev(md->disk),
2156 				&md->power_ro_lock);
2157 		if (ret)
2158 			goto power_ro_lock_fail;
2159 	}
2160 	return ret;
2161 
2162 power_ro_lock_fail:
2163 	device_remove_file(disk_to_dev(md->disk), &md->force_ro);
2164 force_ro_fail:
2165 	del_gendisk(md->disk);
2166 
2167 	return ret;
2168 }
2169 
2170 static int mmc_blk_probe(struct mmc_card *card)
2171 {
2172 	struct mmc_blk_data *md, *part_md;
2173 	char cap_str[10];
2174 	int ret;
2175 
2176 	/*
2177 	 * Check that the card supports the command class(es) we need.
2178 	 */
2179 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
2180 		return -ENODEV;
2181 
2182 	mmc_fixup_device(card, mmc_blk_fixups);
2183 
2184 	ret = mmc_queue_alloc_shared_queue(card);
2185 	if (ret)
2186 		return ret;
2187 
2188 	md = mmc_blk_alloc(card);
2189 	if (IS_ERR(md)) {
2190 		mmc_queue_free_shared_queue(card);
2191 		return PTR_ERR(md);
2192 	}
2193 
2194 	string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
2195 			cap_str, sizeof(cap_str));
2196 	pr_info("%s: %s %s %s %s\n",
2197 		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
2198 		cap_str, md->read_only ? "(ro)" : "");
2199 
2200 	if (mmc_blk_alloc_parts(card, md))
2201 		goto out;
2202 
2203 	dev_set_drvdata(&card->dev, md);
2204 
2205 	if (mmc_add_disk(md))
2206 		goto out;
2207 
2208 	list_for_each_entry(part_md, &md->part, part) {
2209 		if (mmc_add_disk(part_md))
2210 			goto out;
2211 	}
2212 
2213 	pm_runtime_set_autosuspend_delay(&card->dev, 3000);
2214 	pm_runtime_use_autosuspend(&card->dev);
2215 
2216 	/*
2217 	 * Don't enable runtime PM for SD-combo cards here. Leave that
2218 	 * decision to be taken during the SDIO init sequence instead.
2219 	 */
2220 	if (card->type != MMC_TYPE_SD_COMBO) {
2221 		pm_runtime_set_active(&card->dev);
2222 		pm_runtime_enable(&card->dev);
2223 	}
2224 
2225 	return 0;
2226 
2227  out:
2228 	mmc_blk_remove_parts(card, md);
2229 	mmc_blk_remove_req(md);
2230 	mmc_queue_free_shared_queue(card);
2231 	return 0;
2232 }
2233 
2234 static void mmc_blk_remove(struct mmc_card *card)
2235 {
2236 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2237 
2238 	mmc_blk_remove_parts(card, md);
2239 	pm_runtime_get_sync(&card->dev);
2240 	mmc_claim_host(card->host);
2241 	mmc_blk_part_switch(card, md);
2242 	mmc_release_host(card->host);
2243 	if (card->type != MMC_TYPE_SD_COMBO)
2244 		pm_runtime_disable(&card->dev);
2245 	pm_runtime_put_noidle(&card->dev);
2246 	mmc_blk_remove_req(md);
2247 	dev_set_drvdata(&card->dev, NULL);
2248 	mmc_queue_free_shared_queue(card);
2249 }
2250 
2251 static int _mmc_blk_suspend(struct mmc_card *card)
2252 {
2253 	struct mmc_blk_data *part_md;
2254 	struct mmc_blk_data *md = dev_get_drvdata(&card->dev);
2255 
2256 	if (md) {
2257 		mmc_queue_suspend(&md->queue);
2258 		list_for_each_entry(part_md, &md->part, part) {
2259 			mmc_queue_suspend(&part_md->queue);
2260 		}
2261 	}
2262 	return 0;
2263 }
2264 
2265 static void mmc_blk_shutdown(struct mmc_card *card)
2266 {
2267 	_mmc_blk_suspend(card);
2268 }
2269 
2270 #ifdef CONFIG_PM_SLEEP
2271 static int mmc_blk_suspend(struct device *dev)
2272 {
2273 	struct mmc_card *card = mmc_dev_to_card(dev);
2274 
2275 	return _mmc_blk_suspend(card);
2276 }
2277 
2278 static int mmc_blk_resume(struct device *dev)
2279 {
2280 	struct mmc_blk_data *part_md;
2281 	struct mmc_blk_data *md = dev_get_drvdata(dev);
2282 
2283 	if (md) {
2284 		/*
2285 		 * Resume involves the card going into idle state,
2286 		 * so current partition is always the main one.
2287 		 */
2288 		md->part_curr = md->part_type;
2289 		mmc_queue_resume(&md->queue);
2290 		list_for_each_entry(part_md, &md->part, part) {
2291 			mmc_queue_resume(&part_md->queue);
2292 		}
2293 	}
2294 	return 0;
2295 }
2296 #endif
2297 
2298 static SIMPLE_DEV_PM_OPS(mmc_blk_pm_ops, mmc_blk_suspend, mmc_blk_resume);
2299 
2300 static struct mmc_driver mmc_driver = {
2301 	.drv		= {
2302 		.name	= "mmcblk",
2303 		.pm	= &mmc_blk_pm_ops,
2304 	},
2305 	.probe		= mmc_blk_probe,
2306 	.remove		= mmc_blk_remove,
2307 	.shutdown	= mmc_blk_shutdown,
2308 };
2309 
2310 static int __init mmc_blk_init(void)
2311 {
2312 	int res;
2313 
2314 	if (perdev_minors != CONFIG_MMC_BLOCK_MINORS)
2315 		pr_info("mmcblk: using %d minors per device\n", perdev_minors);
2316 
2317 	max_devices = min(MAX_DEVICES, (1 << MINORBITS) / perdev_minors);
2318 
2319 	res = register_blkdev(MMC_BLOCK_MAJOR, "mmc");
2320 	if (res)
2321 		goto out;
2322 
2323 	res = mmc_register_driver(&mmc_driver);
2324 	if (res)
2325 		goto out2;
2326 
2327 	return 0;
2328  out2:
2329 	unregister_blkdev(MMC_BLOCK_MAJOR, "mmc");
2330  out:
2331 	return res;
2332 }
2333 
2334 static void __exit mmc_blk_exit(void)
2335 {
2336 	mmc_unregister_driver(&mmc_driver);
2337 	unregister_blkdev(MMC_BLOCK_MAJOR, "mmc");
2338 }
2339 
2340 module_init(mmc_blk_init);
2341 module_exit(mmc_blk_exit);
2342 
2343 MODULE_LICENSE("GPL");
2344 MODULE_DESCRIPTION("Multimedia Card (MMC) block device driver");
2345 
2346