* [PATCH 5.10.y 2/4] mmc: core: Drop superfluous validations in mmc_hw|sw_reset()
2026-03-17 11:49 ` [PATCH 5.10.y 1/4] mmc: core: Drop redundant member in struct mmc host Sasha Levin
@ 2026-03-17 11:49 ` Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 3/4] mmc: core: Drop reference counting of the bus_ops Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 4/4] mmc: core: Avoid bitfield RMW for claim/retune flags Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-03-17 11:49 UTC (permalink / raw)
To: stable; +Cc: Ulf Hansson, Adrian Hunter, Sasha Levin
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit fefdd3c91e0a7b3cbb3f25925d93a57c45cb0f31 ]
The mmc_hw|sw_reset() APIs are designed to be called solely from upper
layers, which means drivers that operates on top of the struct mmc_card,
like the mmc block device driver and an SDIO functional driver.
Additionally, as long as the struct mmc_host has a valid pointer to a
struct mmc_card, the corresponding host->bus_ops pointer stays valid and
assigned.
For these reasons, let's drop the superfluous reference counting and the
redundant validations in mmc_hw|sw_reset().
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210212131532.236775-1-ulf.hansson@linaro.org
Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/block.c | 2 +-
drivers/mmc/core/core.c | 21 +--------------------
2 files changed, 2 insertions(+), 21 deletions(-)
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 71ecdb13477a5..2756a5f149f1d 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -987,7 +987,7 @@ static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host,
md->reset_done |= type;
err = mmc_hw_reset(host);
/* Ensure we switch back to the correct partition */
- if (err != -EOPNOTSUPP) {
+ if (err) {
struct mmc_blk_data *main_md =
dev_get_drvdata(&host->card->dev);
int part_err;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index d8169c8c3f405..cef46bae60b6a 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2096,18 +2096,7 @@ int mmc_hw_reset(struct mmc_host *host)
{
int ret;
- if (!host->card)
- return -EINVAL;
-
- mmc_bus_get(host);
- if (!host->bus_ops || host->bus_dead || !host->bus_ops->hw_reset) {
- mmc_bus_put(host);
- return -EOPNOTSUPP;
- }
-
ret = host->bus_ops->hw_reset(host);
- mmc_bus_put(host);
-
if (ret < 0)
pr_warn("%s: tried to HW reset card, got error %d\n",
mmc_hostname(host), ret);
@@ -2120,18 +2109,10 @@ int mmc_sw_reset(struct mmc_host *host)
{
int ret;
- if (!host->card)
- return -EINVAL;
-
- mmc_bus_get(host);
- if (!host->bus_ops || host->bus_dead || !host->bus_ops->sw_reset) {
- mmc_bus_put(host);
+ if (!host->bus_ops->sw_reset)
return -EOPNOTSUPP;
- }
ret = host->bus_ops->sw_reset(host);
- mmc_bus_put(host);
-
if (ret)
pr_warn("%s: tried to SW reset card, got error %d\n",
mmc_hostname(host), ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 5.10.y 3/4] mmc: core: Drop reference counting of the bus_ops
2026-03-17 11:49 ` [PATCH 5.10.y 1/4] mmc: core: Drop redundant member in struct mmc host Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 2/4] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Sasha Levin
@ 2026-03-17 11:49 ` Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 4/4] mmc: core: Avoid bitfield RMW for claim/retune flags Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-03-17 11:49 UTC (permalink / raw)
To: stable; +Cc: Ulf Hansson, Pierre Ossman, Russell King, Adrian Hunter,
Sasha Levin
From: Ulf Hansson <ulf.hansson@linaro.org>
[ Upstream commit e9ce2ce17da626d930812199568bd426b2832f57 ]
When the mmc_rescan work is enabled for execution (host->rescan_disable),
it's the only instance per mmc host that is allowed to set/clear the
host->bus_ops pointer.
Besides the mmc_rescan work, there are a couple of scenarios when the
host->bus_ops pointer may be accessed. Typically, those can be described as
as below:
*)
Upper mmc driver layers (like the mmc block device driver or an SDIO
functional driver) needs to execute a host->bus_ops callback. This can be
considered as safe without having to use some special locking mechanism,
because they operate on top of the struct mmc_card. As long as there is a
card to operate upon, the mmc core guarantees that there is a host->bus_ops
assigned as well. Note that, upper layer mmc drivers are of course
responsible to clean up from themselves from their ->remove() callbacks,
otherwise things would fall apart anyways.
**)
Via the mmc host instance, we may need to force a removal of an inserted
mmc card. This happens when a mmc host driver gets unbind, for example. In
this case, we protect the host->bus_ops pointer from concurrent accesses,
by disabling the mmc_rescan work upfront (host->rescan_disable). See
mmc_stop_host() for example.
This said, it seems like the reference counting of the host->bus_ops
pointer at some point have become superfluous. As this is an old mechanism
of the mmc core, it a bit difficult to digest the history of when that
could have happened. However, let's drop the reference counting to avoid
unnecessary code-paths and lockings.
Cc: Pierre Ossman <pierre@ossman.eu>
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210212131610.236843-1-ulf.hansson@linaro.org
Stable-dep-of: 901084c51a0a ("mmc: core: Avoid bitfield RMW for claim/retune flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/core.c | 89 ++--------------------------------------
include/linux/mmc/host.h | 2 -
2 files changed, 4 insertions(+), 87 deletions(-)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index cef46bae60b6a..dda6ec423e9e8 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1388,63 +1388,13 @@ void mmc_power_cycle(struct mmc_host *host, u32 ocr)
mmc_power_up(host, ocr);
}
-/*
- * Cleanup when the last reference to the bus operator is dropped.
- */
-static void __mmc_release_bus(struct mmc_host *host)
-{
- WARN_ON(!host->bus_dead);
-
- host->bus_ops = NULL;
-}
-
-/*
- * Increase reference count of bus operator
- */
-static inline void mmc_bus_get(struct mmc_host *host)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&host->lock, flags);
- host->bus_refs++;
- spin_unlock_irqrestore(&host->lock, flags);
-}
-
-/*
- * Decrease reference count of bus operator and free it if
- * it is the last reference.
- */
-static inline void mmc_bus_put(struct mmc_host *host)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&host->lock, flags);
- host->bus_refs--;
- if ((host->bus_refs == 0) && host->bus_ops)
- __mmc_release_bus(host);
- spin_unlock_irqrestore(&host->lock, flags);
-}
-
/*
* Assign a mmc bus handler to a host. Only one bus handler may control a
* host at any given time.
*/
void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops)
{
- unsigned long flags;
-
- WARN_ON(!host->claimed);
-
- spin_lock_irqsave(&host->lock, flags);
-
- WARN_ON(host->bus_ops);
- WARN_ON(host->bus_refs);
-
host->bus_ops = ops;
- host->bus_refs = 1;
- host->bus_dead = 0;
-
- spin_unlock_irqrestore(&host->lock, flags);
}
/*
@@ -1452,18 +1402,7 @@ void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops)
*/
void mmc_detach_bus(struct mmc_host *host)
{
- unsigned long flags;
-
- WARN_ON(!host->claimed);
- WARN_ON(!host->bus_ops);
-
- spin_lock_irqsave(&host->lock, flags);
-
- host->bus_dead = 1;
-
- spin_unlock_irqrestore(&host->lock, flags);
-
- mmc_bus_put(host);
+ host->bus_ops = NULL;
}
void _mmc_detect_change(struct mmc_host *host, unsigned long delay, bool cd_irq)
@@ -2260,32 +2199,15 @@ void mmc_rescan(struct work_struct *work)
host->trigger_card_event = false;
}
- mmc_bus_get(host);
-
/* Verify a registered card to be functional, else remove it. */
- if (host->bus_ops && !host->bus_dead)
+ if (host->bus_ops)
host->bus_ops->detect(host);
host->detect_change = 0;
- /*
- * Let mmc_bus_put() free the bus/bus_ops if we've found that
- * the card is no longer present.
- */
- mmc_bus_put(host);
- mmc_bus_get(host);
-
/* if there still is a card present, stop here */
- if (host->bus_ops != NULL) {
- mmc_bus_put(host);
+ if (host->bus_ops != NULL)
goto out;
- }
-
- /*
- * Only we can add a new handler, so it's safe to
- * release the lock here.
- */
- mmc_bus_put(host);
mmc_claim_host(host);
if (mmc_card_is_removable(host) && host->ops->get_cd &&
@@ -2356,18 +2278,15 @@ void mmc_stop_host(struct mmc_host *host)
/* clear pm flags now and let card drivers set them as needed */
host->pm_flags = 0;
- mmc_bus_get(host);
- if (host->bus_ops && !host->bus_dead) {
+ if (host->bus_ops) {
/* Calling bus_ops->remove() with a claimed host can deadlock */
host->bus_ops->remove(host);
mmc_claim_host(host);
mmc_detach_bus(host);
mmc_power_off(host);
mmc_release_host(host);
- mmc_bus_put(host);
return;
}
- mmc_bus_put(host);
mmc_claim_host(host);
mmc_power_off(host);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 1c7b716c96f30..400556db06cb0 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -403,7 +403,6 @@ struct mmc_host {
/* group bitfields together to minimize padding */
unsigned int use_spi_crc:1;
unsigned int claimed:1; /* host exclusively claimed */
- unsigned int bus_dead:1; /* bus has been released */
unsigned int doing_init_tune:1; /* initial tuning in progress */
unsigned int can_retune:1; /* re-tuning can be used */
unsigned int doing_retune:1; /* re-tuning in progress */
@@ -435,7 +434,6 @@ struct mmc_host {
struct mmc_slot slot;
const struct mmc_bus_ops *bus_ops; /* current bus driver */
- unsigned int bus_refs; /* reference counter */
unsigned int sdio_irqs;
struct task_struct *sdio_irq_thread;
--
2.51.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 5.10.y 4/4] mmc: core: Avoid bitfield RMW for claim/retune flags
2026-03-17 11:49 ` [PATCH 5.10.y 1/4] mmc: core: Drop redundant member in struct mmc host Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 2/4] mmc: core: Drop superfluous validations in mmc_hw|sw_reset() Sasha Levin
2026-03-17 11:49 ` [PATCH 5.10.y 3/4] mmc: core: Drop reference counting of the bus_ops Sasha Levin
@ 2026-03-17 11:49 ` Sasha Levin
2 siblings, 0 replies; 5+ messages in thread
From: Sasha Levin @ 2026-03-17 11:49 UTC (permalink / raw)
To: stable; +Cc: Penghe Geng, Adrian Hunter, Ulf Hansson, Sasha Levin
From: Penghe Geng <pgeng@nvidia.com>
[ Upstream commit 901084c51a0a8fb42a3f37d2e9c62083c495f824 ]
Move claimed and retune control flags out of the bitfield word to
avoid unrelated RMW side effects in asynchronous contexts.
The host->claimed bit shared a word with retune flags. Writes to claimed
in __mmc_claim_host() or retune_now in mmc_mq_queue_rq() can overwrite
other bits when concurrent updates happen in other contexts, triggering
spurious WARN_ON(!host->claimed). Convert claimed, can_retune,
retune_now and retune_paused to bool to remove shared-word coupling.
Fixes: 6c0cedd1ef952 ("mmc: core: Introduce host claiming by context")
Fixes: 1e8e55b67030c ("mmc: block: Add CQE support")
Cc: stable@vger.kernel.org
Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Penghe Geng <pgeng@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/mmc/host.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 400556db06cb0..daed43b39b611 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -400,14 +400,12 @@ struct mmc_host {
struct mmc_ios ios; /* current io bus settings */
+ bool claimed; /* host exclusively claimed */
+
/* group bitfields together to minimize padding */
unsigned int use_spi_crc:1;
- unsigned int claimed:1; /* host exclusively claimed */
unsigned int doing_init_tune:1; /* initial tuning in progress */
- unsigned int can_retune:1; /* re-tuning can be used */
unsigned int doing_retune:1; /* re-tuning in progress */
- unsigned int retune_now:1; /* do re-tuning at next req */
- unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
unsigned int can_dma_map_merge:1; /* merging can be used */
unsigned int vqmmc_enabled:1; /* vqmmc regulator is enabled */
@@ -415,6 +413,9 @@ struct mmc_host {
int rescan_disable; /* disable card detection */
int rescan_entered; /* used with nonremovable devices */
+ bool can_retune; /* re-tuning can be used */
+ bool retune_now; /* do re-tuning at next req */
+ bool retune_paused; /* re-tuning is temporarily disabled */
int need_retune; /* re-tuning is needed */
int hold_retune; /* hold off re-tuning */
unsigned int retune_period; /* re-tuning period in secs */
--
2.51.0
^ permalink raw reply related [flat|nested] 5+ messages in thread