linux-kernel - [RFC PATCH] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260117234800.931664-1-matthew.schwartz@linux.dev>
Date: Sat, 17 Jan 2026 15:48:00 -0800
From: Matthew Schwartz <matthew.schwartz@...ux.dev>
To: Adrian Hunter <adrian.hunter@...el.com>,
	Ulf Hansson <ulf.hansson@...aro.org>,
	Ben Chuang <ben.chuang@...esyslogic.com.tw>,
	Victor Shih <victor.shih@...esyslogic.com.tw>
Cc: linux-mmc@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Matthew Schwartz <matthew.schwartz@...ux.dev>
Subject: [RFC PATCH] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption

The GL9750 SD host controller has intermittent data corruption during
DMA write operations, which has been traced to an incorrect burst
configuration. This was discovered by comparing initialization sequences
between the working GL9767 controller and GL9750 and seeing that the
GM_BURST register was handled differently.

Clearing bits 16-17 eliminates the corruption with f3write/f3read tests
while maintaining full DMA write/read performance.

Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support")
Closes: https://lore.kernel.org/linux-mmc/33d12807-5c72-41ce-8679-57aa11831fad@linux.dev/
Signed-off-by: Matthew Schwartz <matthew.schwartz@...ux.dev>
---

Hi all,

I arrived at this after a whole bunch of guesswork based on the other
Genesys card readers in the kernel that do work, like GL9767. I landed on
register 0x510 which appears to be "GM_BURST_SIZE" and ended up going
through each bit and either setting it or masking it. Eventually, I
arrived at masking bits 16-17 which seemed to stabilize writes completely.

Could someone at Genesys confirm what this register is for on GL9750, and
what those bits are? At least locally, I have been able to run 50GB of
f3write/f3read without any corruption while before even 1GB would corrupt.
This also maintains the same read/write speed as before this change. I
tried searching online but was unable to find any relevant docs, and I'd
like to confirm the purpose of those bits before sending this out as v1.

Thanks,
Matt

---
 drivers/mmc/host/sdhci-pci-gli.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c
index b0f91cc9e40e4..a06b0cf11f12d 100644
--- a/drivers/mmc/host/sdhci-pci-gli.c
+++ b/drivers/mmc/host/sdhci-pci-gli.c
@@ -26,6 +26,9 @@
 #define   GLI_9750_WT_EN_ON	    0x1
 #define   GLI_9750_WT_EN_OFF	    0x0

+#define SDHCI_GLI_9750_GM_BURST_SIZE		  0x510
+#define   SDHCI_GLI_9750_GM_BURST_SIZE_MASK	    GENMASK(17, 16)
+
 #define SDHCI_GLI_9750_CFG2          0x848
 #define   SDHCI_GLI_9750_CFG2_L1DLY    GENMASK(28, 24)
 #define   GLI_9750_CFG2_L1DLY_VALUE    0x1F
@@ -629,6 +632,11 @@ static void gl9750_hw_setting(struct sdhci_host *host)

 	gl9750_wt_on(host);

+	/* clear GM_BURST bits to avoid corruption with DMA writes */
+	value = sdhci_readl(host, SDHCI_GLI_9750_GM_BURST_SIZE);
+	value &= ~SDHCI_GLI_9750_GM_BURST_SIZE_MASK;
+	sdhci_writel(host, value, SDHCI_GLI_9750_GM_BURST_SIZE);
+
 	value = sdhci_readl(host, SDHCI_GLI_9750_CFG2);
 	value &= ~SDHCI_GLI_9750_CFG2_L1DLY;
 	/* set ASPM L1 entry delay to 7.9us */
-- 
2.52.0