From nobody Mon Jun 15 09:37:13 2026 Received: from mail-m49247.qiye.163.com (mail-m49247.qiye.163.com [45.254.49.247]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 751EE382399; Thu, 9 Apr 2026 07:48:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.247 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720923; cv=none; b=VmFEwcDR3zBO7U9pHd95rwAkbDTI0Z9WlhLIhmgxHU8zaQr8N0rrdcDbNww9XyDLpVpa4+X6xKK2QoJkQzyUP8kmCkwtdlm/qBjqCSzgqOuFeBx+1yTygo+br6Wo+mRXTFor44Xpk/RPBotqW9dy58iG/CY1iKfa7KLswiX1Wwc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720923; c=relaxed/simple; bh=7JvyWtnohW2TBYBNq3uaBK4HSb2uSdPyqhKY59UEzrk=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=KpIx8YC8v2HNPA464DeNLJTD2tJLxaKdQ4I3BMncfuMDW5h1g1c+u2c+258urwBoKFcFmwm90nfcPCbbOqsghBjWle7XeE0kwtTOGvBa+09RG9D5zHAPNCsEJqFSFuSd1M2GW6cEJChIVFwuXYbwJs32rUjHFVJADP/4kZkuD+s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com; spf=pass smtp.mailfrom=rock-chips.com; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b=LBXN5buW; arc=none smtp.client-ip=45.254.49.247 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b="LBXN5buW" Received: from localhost.localdomain (unknown [58.22.7.114]) by smtp.qiye.163.com (Hmail) with ESMTP id 3a14149c6; Thu, 9 Apr 2026 15:48:37 +0800 (GMT+08:00) From: Shawn Lin To: Ulf Hansson , Jaehoon Chung Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Shawn Lin Subject: [PATCH 1/4] mmc: core: mmc: core: Add validation for host-provided max_segs Date: Thu, 9 Apr 2026 15:48:11 +0800 Message-Id: <1775720894-97901-2-git-send-email-shawn.lin@rock-chips.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> References: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> X-HM-Tid: 0a9d7136ea8809cckunm41b60ef14ae51c X-HM-MType: 1 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFDSUNOT01LS0k3V1ktWUFJV1kPCRoVCBIfWUFZGU5MGFYfGB8dT0geSEIdSUtWFRQJFh oXVRMBExYaEhckFA4PWVdZGBILWUFZTkNVSUlVTFVKSk9ZV1kWGg8SFR0UWUFZT0tIVUpLSU9PT0 tVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=LBXN5buWO6odFUhA7ZL9K7g2bFVoelI0k7gnezL3C9yPciLOc1errz9lvzwvJBSv6473Ca7yR4nMtK2wW56riaPqd6LCGzyJu/QhLRkX5YF1f6SA93zLBh6TRZmRCG24mh5FbN5eNa9Gp7n8VBpr94Zjm7x9oJGetcOqWTI8X8Q=; s=default; c=relaxed/relaxed; d=rock-chips.com; v=1; bh=Vj7st+aaHGCmsECHWtX7z1vecuBHVbFNeFrVua9VPz4=; h=date:mime-version:subject:message-id:from; Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The max_segs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmc_alloc_sg() to call kmalloc_objs() with a zero size allocation request, which leads to undefined behavior. Under the SLUB allocator, kmalloc(0) returns a special pointer (ZERO_SIZE_PTR). The subsequent 'if (sg)' check will evaluate to true, and sg_init_table() will then attempt to access invalid memory, resulting in a crash: dwmmc_rockchip 2a310000.mmc: Successfully tuned phase to 133 mmc1: new UHS-I speed SDR104 SDHC card at address aaaa Unable to handle kernel paging request at virtual address 0000001ffffffff0 Mem abort info: ESR =3D 0x0000000096000004 EC =3D 0x25: DABT (current EL), IL =3D 32 bits SET =3D 0, FnV =3D 0 EA =3D 0, S1PTW =3D 0 FSC =3D 0x04: level 0 translation fault Data abort info: ISV =3D 0, ISS =3D 0x00000004, ISS2 =3D 0x00000000 CM =3D 0, WnR =3D 0, TnD =3D 0, TagAccess =3D 0 GCS =3D 0, Overlay =3D 0, DirtyBit =3D 0, Xs =3D 0 user pgtable: 4k pages, 48-bit VAs, pgdp=3D0000000102c88000 [0000001ffffffff0] pgd=3D0000000000000000, p4d=3D0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 2 UID: 0 PID: 102 Comm: kworker/2:1 Not tainted 7.0.0-rc6-next-2026033= 1-00013-g4d93c25963c5-dirty #80 PREEMPT Hardware name: Rockchip RK3576 EVB V10 Board (DT) Workqueue: events_freezable mmc_rescan pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=3D--) pc : sg_init_table+0x2c/0x50 lr : sg_init_table+0x24/0x50 sp : ffff8000837db710 x29: ffff8000837db710 x28: 000000000000c000 x27: 0000000000000300 x26: 0000000000000000 x25: 0000000000000040 x24: ffff0000c46a0000 x23: 0000000000000000 x22: ffff0000c0c73c00 x21: 0000000000000010 x20: 0000000000000010 x19: 0000000000000000 x18: 000000000000002c x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000400 x13: ffff8000837dc000 x12: 0000000000000000 x11: ffff0000c0c73ca0 x10: 0000000000000040 x9 : 459ec1f0abbdbb00 x8 : 0000001fffffffe0 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000035579 x4 : 0000000000000901 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000010 Call trace: sg_init_table+0x2c/0x50 (P) mmc_mq_init_request+0x64/0x90 blk_mq_alloc_map_and_rqs+0x3ac/0x480 blk_mq_alloc_set_map_and_rqs+0x98/0x1e0 blk_mq_alloc_tag_set+0x1c0/0x290 mmc_init_queue+0x120/0x370 mmc_blk_alloc_req+0x150/0x420 To prevent this, add a validation check in mmc_mq_init_request() to detect when sg_len (derived from max_segs) is zero. If sg_len is zero, we return an error and print an error message, allowing host driver developers to identify and fix incorrect max_segs configuration. This is a defensive measure that ensures the MMC core fails gracefully when host drivers provide invalid max_segs values, rather than crashing with a page fault. Signed-off-by: Shawn Lin --- drivers/mmc/core/queue.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c index 39fcb66..c9028e4 100644 --- a/drivers/mmc/core/queue.c +++ b/drivers/mmc/core/queue.c @@ -214,8 +214,14 @@ static int mmc_mq_init_request(struct blk_mq_tag_set *= set, struct request *req, struct mmc_queue *mq =3D set->driver_data; struct mmc_card *card =3D mq->card; struct mmc_host *host =3D card->host; + u16 sg_len =3D mmc_get_max_segments(host); =20 - mq_rq->sg =3D mmc_alloc_sg(mmc_get_max_segments(host), GFP_KERNEL); + if (!sg_len) { + dev_err(mmc_dev(host), "Wrong max_segs assigned\n"); + return -EINVAL; + } + + mq_rq->sg =3D mmc_alloc_sg(sg_len, GFP_KERNEL); if (!mq_rq->sg) return -ENOMEM; =20 --=20 2.7.4 From nobody Mon Jun 15 09:37:13 2026 Received: from mail-m1973190.qiye.163.com (mail-m1973190.qiye.163.com [220.197.31.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73AB5386576; Thu, 9 Apr 2026 07:48:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.90 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720931; cv=none; b=KF5GllMFrzLDy/aRpfXjNcRcCSZ/S2YLw5TAJe6YhlCXJsDic0XjOOR4e5ATDxmYAn7+G7qiErOlx5ymCpnXVz6WXbsn0/BmzHfC68UVaL0k8KyfoOFn3UU/KFtkWqNk4YY85YRW2c5Os+YQwFauJCCEMQafF7637ynVXylfAiU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720931; c=relaxed/simple; bh=BzOhoPZ0VBRVYeVdaFbzNrWq0HEPY4W0ycoe0M4CpG0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=cw37Hd7AAwawo6d+N5AEnoBkIsfmxkVhdHKBb6L7p/2IhTPo/bis5fheAc6SFkgoE4rgNmlK4EMPkqCKTClAPZk+x9imsnZ7F6ThFw+iQpH+1NrgV5B2YGi4Vxrj5XbpY68L9e0fHoOoOc7DLvEELjATKc+Fm4EP80Q9QlJ2lDA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com; spf=pass smtp.mailfrom=rock-chips.com; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b=QY/n87v9; arc=none smtp.client-ip=220.197.31.90 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b="QY/n87v9" Received: from localhost.localdomain (unknown [58.22.7.114]) by smtp.qiye.163.com (Hmail) with ESMTP id 3a14149e3; Thu, 9 Apr 2026 15:48:41 +0800 (GMT+08:00) From: Shawn Lin To: Ulf Hansson , Jaehoon Chung Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Shawn Lin Subject: [PATCH 2/4] mmc: dw_mmc: Move misplaced comment Date: Thu, 9 Apr 2026 15:48:12 +0800 Message-Id: <1775720894-97901-3-git-send-email-shawn.lin@rock-chips.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> References: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> X-HM-Tid: 0a9d7136f86e09cckunm41b60ef14ae55d X-HM-MType: 1 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFDSUNOT01LS0k3V1ktWUFJV1kPCRoVCBIfWUFZQh1LTFYYH0MYGUoaTB8dSElWFRQJFh oXVRMBExYaEhckFA4PWVdZGBILWUFZTkNVSUlVTFVKSk9ZV1kWGg8SFR0UWUFZT0tIVUpLSU9PT0 hVSktLVUpCS0tZBg++ DKIM-Signature: a=rsa-sha256; b=QY/n87v9hVgrn19zK095l+lkEWRDBT+C914i23GdREIBNFm4/0B4J7iaZZPKpbYprR0DiaoVgNyZ7GrQ5fhZCrNyOFAXkzRYWn+Vt6IXfWHHf6WOjsGVbt+u99va57f5vPPlb7gsVRX4GEPXepA07eu3A0Rk6zjgPoskEeBfk50=; s=default; c=relaxed/relaxed; d=rock-chips.com; v=1; bh=xUJOorcH0rkIC+8Xhmh2ejYgA+Zrc9oNbwzUaiVJLh0=; h=date:mime-version:subject:message-id:from; Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" It was originally part of the @cmd_status field description but became separated and now appears between @ring_size and @dms without proper contex= t. Signed-off-by: Shawn Lin --- drivers/mmc/host/dw_mmc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h index 42e58be..14fb2b3 100644 --- a/drivers/mmc/host/dw_mmc.h +++ b/drivers/mmc/host/dw_mmc.h @@ -78,8 +78,8 @@ struct dw_mci_dma_slave { * @sg_cpu: Virtual address of DMA buffer. * @dma_ops: Pointer to DMA callbacks. * @cmd_status: Snapshot of SR taken upon completion of the current - * @ring_size: Buffer size for idma descriptors. * command. Only valid when EVENT_CMD_COMPLETE is pending. + * @ring_size: Buffer size for idma descriptors. * @dms: structure of slave-dma private data. * @phy_regs: physical address of controller's register map * @data_status: Snapshot of SR taken upon completion of the current --=20 2.7.4 From nobody Mon Jun 15 09:37:13 2026 Received: from mail-m49195.qiye.163.com (mail-m49195.qiye.163.com [45.254.49.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08F62382399; Thu, 9 Apr 2026 07:53:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.195 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775721238; cv=none; b=KwpqgEteGNXpxqHyjR+H0wMocvDh+onx3HkrUhTobmYJc+Pt4ysTuC4SIF8Z0qsTU/+mawuxKeh/BHwo538Gsw2v/SOeO+vEERoSh2L6C6eO5VFgI/+GDg6XUQ49nIPj1ckyjLTLEofx7hFph2b05n04hRKWAe5lUGfKxtTefOw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775721238; c=relaxed/simple; bh=OxZO01IRFxToakVWxoOCTbVjJGde2fF0FaSVlhPAgqs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=m1rbwO4TqcgHNppwm1FKPmADB698JFSA/r8THfDyXxVZ9BQVg6NskR+qrnQ/KxH4WXW1z0Fo2hoXIkzb88xJkXIILU6BtPQw1Mb48tRsiaKNu7UE+IM4p+CBkBqJWMlByHCK9FeLuZHdMoIg39UON45c206Av83ZvTh878fZ2Zo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com; spf=pass smtp.mailfrom=rock-chips.com; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b=FS3omU6W; arc=none smtp.client-ip=45.254.49.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b="FS3omU6W" Received: from localhost.localdomain (unknown [58.22.7.114]) by smtp.qiye.163.com (Hmail) with ESMTP id 3a14149f9; Thu, 9 Apr 2026 15:48:43 +0800 (GMT+08:00) From: Shawn Lin To: Ulf Hansson , Jaehoon Chung Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Shawn Lin Subject: [PATCH 3/4] mmc: dw_mmc: Add desc_num field for clarity Date: Thu, 9 Apr 2026 15:48:13 +0800 Message-Id: <1775720894-97901-4-git-send-email-shawn.lin@rock-chips.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> References: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> X-HM-Tid: 0a9d713702a909cckunm41b60ef14ae58b X-HM-MType: 1 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFDSUNOT01LS0k3V1ktWUFJV1kPCRoVCBIfWUFZGk0ZS1ZJGR8ZGh9KGBpNSklWFRQJFh oXVRMBExYaEhckFA4PWVdZGBILWUFZTkNVSUlVTFVKSk9ZV1kWGg8SFR0UWUFZT0tIVUpLSU9PT0 hVSktLVUpCS0tZBg++ DKIM-Signature: a=rsa-sha256; b=FS3omU6WhJAAzUETJ3QO+n/WoKcHcZhFdODxmc+LPitPPOr4EJCnsL083PCU1n1PJDzLu5uCf7IiOLHlyz1J1Eicmi5o6MduXztS/mHvXzfd9ay1H3BdSiV2qnwAGv7YCWz083fvgx+AvtUOuANx7Hx9oHeN+MW7IzGGqxdpX74=; s=default; c=relaxed/relaxed; d=rock-chips.com; v=1; bh=8vLa5zAi/MK4RjjIAGtsBGisnHM+C9uxsWt3aNA78BI=; h=date:mime-version:subject:message-id:from; Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The ring_size field in struct dw_mci is misleadingly named. Despite its name, it does not represent the size of the descriptor ring buffer in bytes, but rather the number of descriptors allocated within the fixed-size ring buffer. The actual ring buffer size is fixed at PAGE_SIZE (or DESC_RING_BUF_SZ, which equals PAGE_SIZE). Within this buffer, we allocate either struct idmac_desc or struct idmac_desc_64addr descriptors, and ring_size stores the count of these descriptors. This naming has caused confusion, as it's also used to set mmc->max_segs (the maximum number of scatter-gather segments), which logically corresponds to the number of descriptors, not a size in bytes. No functional change is introduced by this naming-only patch. Signed-off-by: Shawn Lin --- drivers/mmc/host/dw_mmc.c | 16 ++++++++-------- drivers/mmc/host/dw_mmc.h | 2 ++ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c index 20193ee..df6daa6 100644 --- a/drivers/mmc/host/dw_mmc.c +++ b/drivers/mmc/host/dw_mmc.c @@ -491,12 +491,12 @@ static int dw_mci_idmac_init(struct dw_mci *host) =20 if (host->dma_64bit_address =3D=3D 1) { struct idmac_desc_64addr *p; - /* Number of descriptors in the ring buffer */ - host->ring_size =3D + + host->desc_num =3D DESC_RING_BUF_SZ / sizeof(struct idmac_desc_64addr); =20 /* Forward link the descriptor list */ - for (i =3D 0, p =3D host->sg_cpu; i < host->ring_size - 1; + for (i =3D 0, p =3D host->sg_cpu; i < host->desc_num - 1; i++, p++) { p->des6 =3D (host->sg_dma + (sizeof(struct idmac_desc_64addr) * @@ -519,13 +519,13 @@ static int dw_mci_idmac_init(struct dw_mci *host) =20 } else { struct idmac_desc *p; - /* Number of descriptors in the ring buffer */ - host->ring_size =3D + + host->desc_num =3D DESC_RING_BUF_SZ / sizeof(struct idmac_desc); =20 /* Forward link the descriptor list */ for (i =3D 0, p =3D host->sg_cpu; - i < host->ring_size - 1; + i < host->desc_num - 1; i++, p++) { p->des3 =3D cpu_to_le32(host->sg_dma + (sizeof(struct idmac_desc) * (i + 1))); @@ -2858,10 +2858,10 @@ static int dw_mci_init_host(struct dw_mci *host) =20 /* Useful defaults if platform data is unset. */ if (host->use_dma =3D=3D TRANS_MODE_IDMAC) { - mmc->max_segs =3D host->ring_size; + mmc->max_segs =3D host->desc_num; mmc->max_blk_size =3D 65535; mmc->max_seg_size =3D 0x1000; - mmc->max_req_size =3D mmc->max_seg_size * host->ring_size; + mmc->max_req_size =3D mmc->max_seg_size * host->desc_num; mmc->max_blk_count =3D mmc->max_req_size / 512; } else if (host->use_dma =3D=3D TRANS_MODE_EDMAC) { mmc->max_segs =3D 64; diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h index 14fb2b3..a05100c 100644 --- a/drivers/mmc/host/dw_mmc.h +++ b/drivers/mmc/host/dw_mmc.h @@ -80,6 +80,7 @@ struct dw_mci_dma_slave { * @cmd_status: Snapshot of SR taken upon completion of the current * command. Only valid when EVENT_CMD_COMPLETE is pending. * @ring_size: Buffer size for idma descriptors. + * @desc_num: Number of idmac descriptors available. * @dms: structure of slave-dma private data. * @phy_regs: physical address of controller's register map * @data_status: Snapshot of SR taken upon completion of the current @@ -185,6 +186,7 @@ struct dw_mci { const struct dw_mci_dma_ops *dma_ops; /* For idmac */ unsigned int ring_size; + unsigned short desc_num; =20 /* For edmac */ struct dw_mci_dma_slave *dms; --=20 2.7.4 From nobody Mon Jun 15 09:37:13 2026 Received: from mail-m3286.qiye.163.com (mail-m3286.qiye.163.com [220.197.32.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE6F237F730; Thu, 9 Apr 2026 07:48:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.32.86 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720931; cv=none; b=tOXPmH7I/FR4pyjVSV0axtLsnI+7ft/zamagJaiRhebJxarJJx/Uaqb/DWFW2j6FWeS9Uuo4Z+gRdPgcIyNFPaatlzvWuX8+CCVXhznTHKchxnPQGB/8Ug140fwxgzK6gIPUzvLO4qvW7gI+UYYY3yCXTRZVf+7h4vJ+Q0D73/g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775720931; c=relaxed/simple; bh=r1OGjaa9YGLuGwwm2trkT4Ohn5ECx4QzKW6mJWs5tMM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=vFoARJHakRc+X8GtJqRwf5mN9y2P1cMMYjzNwRDE2KN0uYBGtOhVZTfndZRcKCToQKoxi49KMp/kTyhvosIQ4VkOS+/cTH81vryQbkr0bgEb+oVfDP3Tf36SDmdCRSVtza+fvX6GP9ymgS3OyMtIhGMxugQsyo4n69y0PPxpck8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com; spf=pass smtp.mailfrom=rock-chips.com; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b=FRLdfrWY; arc=none smtp.client-ip=220.197.32.86 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rock-chips.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=rock-chips.com header.i=@rock-chips.com header.b="FRLdfrWY" Received: from localhost.localdomain (unknown [58.22.7.114]) by smtp.qiye.163.com (Hmail) with ESMTP id 3a1414a02; Thu, 9 Apr 2026 15:48:46 +0800 (GMT+08:00) From: Shawn Lin To: Ulf Hansson , Jaehoon Chung Cc: linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, Shawn Lin Subject: [PATCH 4/4] mmc: dw_mmc: Convert descriptor ring buffer to per-instance configurable Date: Thu, 9 Apr 2026 15:48:14 +0800 Message-Id: <1775720894-97901-5-git-send-email-shawn.lin@rock-chips.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> References: <1775720894-97901-1-git-send-email-shawn.lin@rock-chips.com> X-HM-Tid: 0a9d71370baa09cckunm41b60ef14ae5ac X-HM-MType: 1 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFDSUNOT01LS0k3V1ktWUFJV1kPCRoVCBIfWUFZGkxOTVZJHh4dGhpLTh5KGU1WFRQJFh oXVRMBExYaEhckFA4PWVdZGBILWUFZTkNVSUlVTFVKSk9ZV1kWGg8SFR0UWUFZT0tIVUpLSU9PT0 hVSktLVUpCS0tZBg++ DKIM-Signature: a=rsa-sha256; b=FRLdfrWYh0i5sSqERvxCipsRAM5f+fkxu5T1K3kOnhgldpeRx5A6MrC9aakEul4uPk38M7EbjCYrO8ejwkb5NQoxhoeSNLQGxrxtMmaAJdNxLLpULhlbosUZQT+OFnR6dWRkb6LO2UYdaWWBY3eyc50jVV2AkJz2Syra4vVWuGs=; s=default; c=relaxed/relaxed; d=rock-chips.com; v=1; bh=Y9GZFxq1QLk8K9LiyX+Z9t8ZmOK6L01EVxcZERV2Two=; h=date:mime-version:subject:message-id:from; Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Replace the hardcoded DESC_RING_BUF_SZ macro with a per-instance ring_size member in struct dw_mci. This change provides greater flexibility and prepares the driver for future configuration options. Variant host controllers can now override the default ring_size via the struct dw_mci_drv_data::init() callback, allowing them to tune the descriptor ring buffer size for their specific use cases. This is particularly beneficial for improving performance in large-block sequential read/write scenarios. Empirical testing shows that increasing ring_size can significantly improve request efficiency. For example, the block count per request can increase from 0x800 (1 MiB) to 0x2000 (4 MiB), as demonstrated by trace data: dd-706 [004] ..... 106.017566: mmc_request_start: mmc1: start struct mmc_request[0000000066f43a37]: ... sbc_arg=3D0x800 dd-697 [001] ..... 15.227953: mmc_request_start: mmc1: start struct mmc_request[00000000d82bf187]: ... sbc_arg=3D0x2000 While increasing the request size improves sequential I/O throughput, it also introduces trade-offs: larger requests can delay other pending I/O operations. Therefore, this configuration should be balanced according to the specific workload and not hardcoded globally. The default ring_size is initialized to PAGE_SIZE in dw_mci_alloc_host(), preserving existing behavior. All buffer size calculations now use host->ring_size instead of the hardcoded macro. No functional changes are introduced for existing platforms. Signed-off-by: Shawn Lin --- drivers/mmc/host/dw_mmc.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c index df6daa6..61f10e7 100644 --- a/drivers/mmc/host/dw_mmc.c +++ b/drivers/mmc/host/dw_mmc.c @@ -50,8 +50,6 @@ SDMMC_IDMAC_INT_FBE | SDMMC_IDMAC_INT_RI | \ SDMMC_IDMAC_INT_TI) =20 -#define DESC_RING_BUF_SZ PAGE_SIZE - struct idmac_desc_64addr { u32 des0; /* Control Descriptor */ #define IDMAC_OWN_CLR64(x) \ @@ -493,7 +491,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) struct idmac_desc_64addr *p; =20 host->desc_num =3D - DESC_RING_BUF_SZ / sizeof(struct idmac_desc_64addr); + host->ring_size / sizeof(struct idmac_desc_64addr); =20 /* Forward link the descriptor list */ for (i =3D 0, p =3D host->sg_cpu; i < host->desc_num - 1; @@ -521,7 +519,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) struct idmac_desc *p; =20 host->desc_num =3D - DESC_RING_BUF_SZ / sizeof(struct idmac_desc); + host->ring_size / sizeof(struct idmac_desc); =20 /* Forward link the descriptor list */ for (i =3D 0, p =3D host->sg_cpu; @@ -653,7 +651,7 @@ static inline int dw_mci_prepare_desc(struct dw_mci *ho= st, struct mmc_data *data err_own_bit: /* restore the descriptor chain as it's polluted */ dev_dbg(host->dev, "descriptor is still owned by IDMAC.\n"); - memset(host->sg_cpu, 0, DESC_RING_BUF_SZ); + memset(host->sg_cpu, 0, host->ring_size); dw_mci_idmac_init(host); return -EINVAL; } @@ -2954,7 +2952,7 @@ static void dw_mci_init_dma(struct dw_mci *host) =20 /* Alloc memory for sg translation */ host->sg_cpu =3D dmam_alloc_coherent(host->dev, - DESC_RING_BUF_SZ, + host->ring_size, &host->sg_dma, GFP_KERNEL); if (!host->sg_cpu) { dev_err(host->dev, @@ -3185,6 +3183,7 @@ struct dw_mci *dw_mci_alloc_host(struct device *dev) host =3D mmc_priv(mmc); host->mmc =3D mmc; host->dev =3D dev; + host->ring_size =3D PAGE_SIZE; =20 return host; } --=20 2.7.4