| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<TYZPR01MB426077A7AB8CE602ECA2CAF4D766A@TYZPR01MB4260.apcprd01.prod.exchangelabs.com>
Date: Fri, 6 Feb 2026 08:05:04 +0000
From: BenChuang[莊智量]
<Ben.Chuang@...esyslogic.com.tw>
To: Adrian Hunter <adrian.hunter@...el.com>, Matthew Schwartz
<matthew.schwartz@...ux.dev>, Ulf Hansson <ulf.hansson@...aro.org>, Victor
Shih <victor.shih@...esyslogic.com.tw>
CC: "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"benchuanggli@...il.com" <benchuanggli@...il.com>
Subject: RE: [RFC PATCH] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
> -----Original Message-----
> From: Adrian Hunter <adrian.hunter@...el.com>
> Sent: Friday, January 30, 2026 6:53 PM
> To: Matthew Schwartz <matthew.schwartz@...ux.dev>; Ulf Hansson <ulf.hansson@...aro.org>; BenChuang[莊智量]
> <Ben.Chuang@...esyslogic.com.tw>; Victor Shih <victor.shih@...esyslogic.com.tw>
> Cc: linux-mmc@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: Re: [RFC PATCH] mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
>
> Genesys folks : Any comment on this?
Hi Matthew,
Could you share the 510h register value on your computer under Windows,
and the 510h register value under Linux when the f3 test is normal and abnormal?
These two bits 510h[17:16] (R_OSRC_Lmt) on GL9750, are likely used to limit requests.
Additionally, 510h[25:24] are similar but marked as W_OSRC_Lmt.
I tested the demo board I had on hand with an Intel PC, and I didn't reproduce the issue.
The test information is as follows.
--
$ sudo f3write -e 3 /run/media/gli/sdsamsung/ && sudo f3read /run/media/gli/sdsamsung/
F3 write 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
Free space: 29.00 GB
Creating file 1.h2w ... OK!
Creating file 2.h2w ... OK!
Creating file 3.h2w ... OK!
Free space: 26.00 GB
Average writing speed: 21.17 MB/s
F3 read 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
SECTORS ok/corrupted/changed/overwritten
Validating file 1.h2w ... 2097152/ 0/ 0/ 0
Validating file 2.h2w ... 2097152/ 0/ 0/ 0
Validating file 3.h2w ... 2097152/ 0/ 0/ 0
Data OK: 3.00 GB (6291456 sectors)
Data LOST: 0.00 Byte (0 sectors)
Corrupted: 0.00 Byte (0 sectors)
Slightly changed: 0.00 Byte (0 sectors)
Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 70.75 MB/s
$ sudo f3write -e 3 /run/media/gli/sdsamsung/ && sudo f3read /run/media/gli/sdsamsung/
F3 write 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
Removing old file 1.h2w ...
Removing old file 2.h2w ...
Removing old file 3.h2w ...
Free space: 29.00 GB
Creating file 1.h2w ... OK!
Creating file 2.h2w ... OK!
Creating file 3.h2w ... OK!
Free space: 26.00 GB
Average writing speed: 20.90 MB/s
F3 read 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
SECTORS ok/corrupted/changed/overwritten
Validating file 1.h2w ... 2097152/ 0/ 0/ 0
Validating file 2.h2w ... 2097152/ 0/ 0/ 0
Validating file 3.h2w ... 2097152/ 0/ 0/ 0
Data OK: 3.00 GB (6291456 sectors)
Data LOST: 0.00 Byte (0 sectors)
Corrupted: 0.00 Byte (0 sectors)
Slightly changed: 0.00 Byte (0 sectors)
Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 71.18 MB/s
$ sudo f3write -e 3 /run/media/gli/sdsamsung/ && sudo f3read /run/media/gli/sdsamsung/
F3 write 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
Removing old file 1.h2w ...
Removing old file 2.h2w ...
Removing old file 3.h2w ...
Free space: 29.00 GB
Creating file 1.h2w ... OK!
Creating file 2.h2w ... OK!
Creating file 3.h2w ... OK!
Free space: 26.00 GB
Average writing speed: 20.48 MB/s
F3 read 9.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
SECTORS ok/corrupted/changed/overwritten
Validating file 1.h2w ... 2097152/ 0/ 0/ 0
Validating file 2.h2w ... 2097152/ 0/ 0/ 0
Validating file 3.h2w ... 2097152/ 0/ 0/ 0
Data OK: 3.00 GB (6291456 sectors)
Data LOST: 0.00 Byte (0 sectors)
Corrupted: 0.00 Byte (0 sectors)
Slightly changed: 0.00 Byte (0 sectors)
Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 71.22 MB/s
$
$ uname -a
Linux arch-pc 6.18.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Sat, 24 Jan 2026 00:47:39 +0000 x86_64 GNU/Linux
$ lsblk /dev/mmcblk1
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
mmcblk1 179:0 0 29.8G 0 disk
└─mmcblk1p1 179:1 0 29.8G 0 part /run/media/gli/sdsamsung
$ sudo dmesg | grep mmc1
[ 1.557901] mmc1: SDHCI controller on PCI [0000:06:00.0] using ADMA
[ 272.440507] mmc1: new UHS-I speed SDR104 SDHC card at address 0001
[ 272.468419] mmcblk1: mmc1:0001 EB1QT 29.8 GiB
$ sudo lspci -d 17a0:9750 -vvv
06:00.0 SD Host controller: Genesys Logic, Inc GL9750 SD Host Controller (rev 01) (prog-if 01)
Subsystem: Genesys Logic, Inc GL9750 SD Host Controller
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 205
Region 0: Memory at 84000000 (32-bit, non-prefetchable) [size=4K]
Capabilities: [80] Express (v2) Endpoint, IntMsgNum 0
DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s <4us, L1 unlimited
ExtTag+ AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 10W TEE-IO-
DevCtl: CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
RlxdOrd+ ExtTag+ PhantFunc- AuxPwr- NoSnoop+
MaxPayload 128 bytes, MaxReadReq 512 bytes
DevSta: CorrErr+ NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
LnkCap: Port #80, Speed 2.5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <4us, L1 unlimited
ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
LnkCtl: ASPM L1 Enabled; RCB 64 bytes, LnkDisable- CommClk+
ExtSynch- ClockPM+ AutWidDis- BWInt- AutBWInt- FltModeDis-
LnkSta: Speed 2.5GT/s, Width x1
TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
10BitTagComp- 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix-
EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
FRS- TPHComp- ExtTPHComp-
AtomicOpsCap: 32bit- 64bit- 128bitCAS-
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-
AtomicOpsCtl: ReqEn-
IDOReq- IDOCompl- LTR+ EmergencyPowerReductionReq-
10BitTagReq- OBFF Disabled, EETLPPrefixBlk-
LnkCap2: Supported Link Speeds: 2.5GT/s, Crosslink- Retimer- 2Retimers- DRS-
LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-
Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete- EqualizationPhase1-
EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
Retimer- 2Retimers- CrosslinkRes: unsupported, FltMode-
Capabilities: [e0] MSI: Enable+ Count=1/1 Maskable- 64bit+
Address: 00000000fee00d58 Data: 0000
Capabilities: [f8] Power Management version 3
Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0-,D1+,D2+,D3hot+,D3cold+)
Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME+
Capabilities: [100 v1] Vendor Specific Information: ID=17a0 Rev=1 Len=008 <?>
Capabilities: [108 v1] Latency Tolerance Reporting
Max snoop latency: 3145728ns
Max no snoop latency: 3145728ns
Capabilities: [110 v1] L1 PM Substates
L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
PortCommonModeRestoreTime=255us PortTPowerOnTime=3100us
L1SubCtl1: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+
T_CommonMode=0us LTR1.2_Threshold=3375104ns
L1SubCtl2: T_PwrOn=3100us
Capabilities: [200 v1] Advanced Error Reporting
UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-
ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP-
ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+
ECRC- UnsupReq- ACSViol- UncorrIntErr- BlockedTLP- AtomicOpBlocked- TLPBlockedErr-
PoisonTLPBlocked- DMWrReqBlocked- IDECheck- MisIDETLP- PCRC_CHECK- TLPXlatBlocked-
CESta: RxErr- BadTLP- BadDLLP- Rollover- Timeout+ AdvNonFatalErr- CorrIntErr- HeaderOF-
CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout+ AdvNonFatalErr+ CorrIntErr- HeaderOF-
AERCap: First Error Pointer: 00, ECRCGenCap- ECRCGenEn- ECRCChkCap- ECRCChkEn-
MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
HeaderLog: 00000000 00000000 00000000 00000000
Kernel driver in use: sdhci-pci
Kernel modules: sdhci_pci
$ sudo iotools mmio_read32 0x84000510
0x0303000f
$
--
Best regards,
Ben Chuang
>
> On 18/01/2026 01:48, Matthew Schwartz wrote:
> > The GL9750 SD host controller has intermittent data corruption during
> > DMA write operations, which has been traced to an incorrect burst
> > configuration. This was discovered by comparing initialization sequences
> > between the working GL9767 controller and GL9750 and seeing that the
> > GM_BURST register was handled differently.
> >
> > Clearing bits 16-17 eliminates the corruption with f3write/f3read tests
> > while maintaining full DMA write/read performance.
> >
> > Fixes: e51df6ce668a ("mmc: host: sdhci-pci: Add Genesys Logic GL975x support")
> > Closes:
> https://lore.kernel.org/linux-mmc/33d12807-5c72-41c
> e-8679-57aa11831fad%40linux.dev%2F&data=05%7C02%7Cben.chuang%40genesyslogic.com.tw%7C2361bfc18a574c93ddc
> 308de5fedb708%7C4e753840bf6b40a19645185818deeb52%7C0%7C0%7C639053671790416204%7CUnknown%7CTWFpbG
> Zsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7
> C%7C%7C&sdata=AzJ5iXlS1yxTdGDFK64jJxRkOAty%2FzNAGMHM%2FItQDfA%3D&reserved=0
> > Signed-off-by: Matthew Schwartz <matthew.schwartz@...ux.dev>
> > ---
> >
> > Hi all,
> >
> > I arrived at this after a whole bunch of guesswork based on the other
> > Genesys card readers in the kernel that do work, like GL9767. I landed on
> > register 0x510 which appears to be "GM_BURST_SIZE" and ended up going
> > through each bit and either setting it or masking it. Eventually, I
> > arrived at masking bits 16-17 which seemed to stabilize writes completely.
> >
> > Could someone at Genesys confirm what this register is for on GL9750, and
> > what those bits are? At least locally, I have been able to run 50GB of
> > f3write/f3read without any corruption while before even 1GB would corrupt.
> > This also maintains the same read/write speed as before this change. I
> > tried searching online but was unable to find any relevant docs, and I'd
> > like to confirm the purpose of those bits before sending this out as v1.
> >
> > Thanks,
> > Matt
> >
> > ---
> > drivers/mmc/host/sdhci-pci-gli.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c
> > index b0f91cc9e40e4..a06b0cf11f12d 100644
> > --- a/drivers/mmc/host/sdhci-pci-gli.c
> > +++ b/drivers/mmc/host/sdhci-pci-gli.c
> > @@ -26,6 +26,9 @@
> > #define GLI_9750_WT_EN_ON 0x1
> > #define GLI_9750_WT_EN_OFF 0x0
> >
> > +#define SDHCI_GLI_9750_GM_BURST_SIZE 0x510
> > +#define SDHCI_GLI_9750_GM_BURST_SIZE_MASK GENMASK(17, 16)
> > +
> > #define SDHCI_GLI_9750_CFG2 0x848
> > #define SDHCI_GLI_9750_CFG2_L1DLY GENMASK(28, 24)
> > #define GLI_9750_CFG2_L1DLY_VALUE 0x1F
> > @@ -629,6 +632,11 @@ static void gl9750_hw_setting(struct sdhci_host *host)
> >
> > gl9750_wt_on(host);
> >
> > + /* clear GM_BURST bits to avoid corruption with DMA writes */
> > + value = sdhci_readl(host, SDHCI_GLI_9750_GM_BURST_SIZE);
> > + value &= ~SDHCI_GLI_9750_GM_BURST_SIZE_MASK;
> > + sdhci_writel(host, value, SDHCI_GLI_9750_GM_BURST_SIZE);
> > +
> > value = sdhci_readl(host, SDHCI_GLI_9750_CFG2);
> > value &= ~SDHCI_GLI_9750_CFG2_L1DLY;
> > /* set ASPM L1 entry delay to 7.9us */
________________________________
Genesys Logic Email Confidentiality Notice:
This mail and any attachments may contain information that is confidential, proprietary, privileged or otherwise protected by law. The mail is intended solely for the named addressee (or a person responsible for delivering it to the addressee). If you are not the intended recipient of this mail, you are not authorized to read, print, copy or disseminate this mail.
If you have received this email in error, please notify us immediately by reply email and immediately delete this message and any attachments from your system. Please be noted that any unauthorized use, dissemination, distribution or copying of this email is strictly prohibited.
________________________________
Powered by blists - more mailing lists