[PATCH AUTOSEL 7.0-6.1] mmc: core: Validate UHS/DDR/HS200 timing selection for 1-bit bus width

[Sasha Levin <sashal@kernel.org>]

From: Luke Wang <ziniu.wang_1@nxp.com>

[ Upstream commit e98f926e5a2d8023a74ec2ba7a973b5d76610f4e ]

UHS/DDR/HS200 modes require at least 4-bit bus support. Host controllers
that lack relevant capability registers rely on paring properties provided
by firmware, which may incorrectly set these modes. Now that mmc_validate_host_caps()
has been introduced to validate such configuration violations, let's also
add checks for UHS/DDR/HS200 modes.

This fixes an issue where, if the HS200/HS400 property is set while only
a 1-bit bus width is used, mmc_select_hs200() returns 0 without actually
performing the mode switch. Consequently, mmc_select_timing() proceeds
without falling back to mmc_select_hs(), leaving the eMMC device operating
in legacy mode (26 MHz) instead of switching to High Speed mode (52 MHz).

Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
[Shawn: reword the commit msg and rework the code]
Signed-off-by: Shawn Lin <shawn.lin@linux.dev>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

Now I have a complete picture. Let me compile the final analysis.

---

## PHASE 1: COMMIT MESSAGE FORENSICS

**Step 1.1:** Subsystem: `mmc: core`. Action: "Validate" (adding missing
validation). Summary: Strips UHS/DDR/HS200 capability flags when only
1-bit bus is supported.
Record: [mmc: core] [validate] [Drop UHS/DDR/HS200 caps if host has only
1-bit bus width]

**Step 1.2:** Tags:
- `Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>` (author)
- `[Shawn: reword the commit msg and rework the code]` + `Signed-off-by:
  Shawn Lin <shawn.lin@linux.dev>` (co-author/reworker, active MMC
  maintainer)
- `Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>` (MMC subsystem
  maintainer)
- No Fixes: tag, no Cc: stable tag (expected for autosel candidates)
Record: Author is NXP developer (Luke Wang) with multiple mmc commits.
Reworked by Shawn Lin (MMC maintainer). Applied by Ulf Hansson (MMC
subsystem maintainer). No Reported-by, no Fixes.

**Step 1.3:** The commit body explicitly describes a bug: When
HS200/HS400 properties are set while only 1-bit bus width is used,
`mmc_select_hs200()` returns 0 without actually performing the mode
switch. `mmc_select_timing()` then skips `mmc_select_hs()`, leaving the
eMMC at legacy mode 26 MHz instead of High Speed 52 MHz.
Record: Bug: eMMC stuck at 26 MHz instead of 52 MHz. Cause: firmware
misconfiguration sets incompatible mode capabilities. Failure mode: ~50%
performance loss on affected eMMC.

**Step 1.4:** This is NOT a hidden bug fix. The commit message
explicitly describes the bug and its consequence.
Record: Explicitly described bug fix.

## PHASE 2: DIFF ANALYSIS

**Step 2.1:** Single file: `drivers/mmc/core/host.c`. ~12 lines added,
~2 lines removed. Only `mmc_validate_host_caps()` is modified.
Record: [host.c: +12, -2] [mmc_validate_host_caps] [Single-file surgical
fix]

**Step 2.2:** Two hunks:
1. NEW: Adds check before HS400 check: if no 4/8-bit bus capability but
   UHS/DDR/HS200 caps are set, strip those caps and warn.
2. MODIFIED: Refactors existing HS400 check to use `caps2 &=` instead of
   `host->caps2 =`, deferring the assignment to `host->caps` and
   `host->caps2` to after both checks.

Record: Before: only HS400 validated against 8-bit requirement. After:
also validates UHS/DDR/HS200 against 4-bit requirement, and consolidates
cap assignments.

**Step 2.3:** This is a **logic/correctness fix**. The HS200 mode
requires at least 4-bit bus per JEDEC spec. Without this check,
`mmc_select_hs200()` silently returns 0 on 1-bit hosts, causing
`mmc_select_timing()` to skip the HS fallback.
Record: [Logic/correctness] [mmc_select_hs200 returns 0 without
switching, preventing HS fallback]

**Step 2.4:** Fix is obviously correct: UHS/DDR/HS200 modes cannot work
on 1-bit bus. The fix is minimal. It follows the same validated pattern
as the existing HS400 check. Regression risk is very low - the only
behavioral change is on hosts with only 1-bit bus AND incorrectly set
UHS/DDR/HS200 caps, where performance IMPROVES.
Record: [Obviously correct, minimal, follows existing pattern] [No
regression risk for correctly configured hosts]

## PHASE 3: GIT HISTORY INVESTIGATION

**Step 3.1:** `mmc_validate_host_caps()` introduced by commit
`d6c9219ca1139b` (v5.18-rc1). The HS400 validation added by
`23e1b8c15b3ab4` (same merge window). Both from Ulf Hansson
(2022-03-03).
Record: Function has been in tree since v5.18. Present in all active
stable trees (v6.1+).

**Step 3.2:** No Fixes: tag in this commit. However, the companion
commit `5e3486e64094c` has `Fixes: f2119df6b764` ("mmc: sd: add support
for signal voltage switch procedure") which goes back to v3.1 era.
Record: The underlying issue (UHS/HS200 modes requiring multi-bit bus)
has existed since the original UHS/HS200 support was added.

**Step 3.3:** Related commits from the same author:
- `5e3486e64094c`: sdhci-specific fix for the same issue
  (SDHCI_QUIRK_FORCE_1_BIT_DATA)
- This is from a 4-patch v3 series: [1] sdhci fix, [2] esdhc-imx
  support, [3] HS400 cleanup, [4] pltfm cleanup
- The commit being analyzed appears to be a separate reworked version by
  Shawn Lin
Record: Part of a series addressing 1-bit bus mode timing issues. The
sdhci fix (patch 1) handles sdhci controllers; this core fix provides
generic protection for all host controllers.

**Step 3.4:** Luke Wang is an active NXP contributor to MMC (10+ commits
in `drivers/mmc/`). Shawn Lin is an active MMC maintainer (multiple
commits, co-maintains dwcmshc and rockchip drivers).
Record: Both authors are established MMC subsystem contributors.

**Step 3.5:** The commit depends only on `mmc_validate_host_caps()`
existing and the `MMC_CAP_UHS`, `MMC_CAP_DDR`, `MMC_CAP2_HS200` macros.
All confirmed present in v6.1+.
Record: No prerequisites beyond what's in stable trees. Standalone fix.

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

**Step 4.1:** Using `b4 dig`, found the series at
https://patch.msgid.link/20260311095009.1254556-2-ziniu.wang_1@nxp.com
(v3 series). The maintainer Ulf Hansson explicitly applied patch 1/4
"for fixes and by adding a stable tag" while the other patches were
"Applied for next."
Record: The sdhci fix was explicitly marked for fixes/stable by
maintainer. The core fix (this commit) was reworked by Shawn Lin
separately.

**Step 4.2:** Original recipients included Ulf Hansson (maintainer),
Adrian Hunter (reviewer), NXP developers, and linux-mmc@vger.kernel.org.
Adrian Hunter Acked the sdhci fix.
Record: Appropriate reviewers were involved.

**Step 4.3-4.5:** The bug is from real NXP hardware configuration. No
separate bug report link, but the fix series addresses a concrete
hardware issue with eMMC on 1-bit bus connections.
Record: Real hardware issue from NXP platforms.

## PHASE 5: CODE SEMANTIC ANALYSIS

**Step 5.1:** Only `mmc_validate_host_caps()` is modified.

**Step 5.2:** `mmc_validate_host_caps()` is called from
`mmc_add_host()`, which is called by every MMC host controller driver
during probe. This is a universal path.
Record: Called during host controller initialization by all drivers.

**Step 5.3-5.4:** The fix prevents `mmc_select_hs200()` from being
called for 1-bit hosts. The bug path is:
1. `mmc_add_host()` -> `mmc_validate_host_caps()` (init time)
2. Later: `mmc_init_card()` -> `mmc_select_timing()` ->
   `mmc_select_hs200()` returns 0 without switching -> skips
   `mmc_select_hs()` fallback
Record: Bug path is triggered during every eMMC card initialization on
affected hosts.

**Step 5.5:** The existing HS400 check is the exact same pattern
(checking bus width requirement before allowing high-speed mode). This
fix extends the pattern to UHS/DDR/HS200.
Record: Follows established validation pattern in same function.

## PHASE 6: CROSS-REFERENCING

**Step 6.1:** `mmc_validate_host_caps()` exists in v6.1, v6.6, v6.12.
Not in v5.15. The function is identical across v6.1-v6.12, so the patch
should apply cleanly. The `MMC_CAP_UHS` and `MMC_CAP_DDR` macros are
confirmed to exist in v6.1+.
Record: Applies to v6.1+, should apply cleanly.

**Step 6.2:** The function code in v6.1, v6.6, v6.12 is identical to the
pre-patch state. The patch should apply cleanly to all.
Record: Clean apply expected.

**Step 6.3:** The companion sdhci fix (`5e3486e64094c`) has `Cc: stable`
and handles the sdhci-specific case. This core fix is complementary and
handles all other host controllers.
Record: No duplicate fix in stable. Companion sdhci fix covers only
sdhci controllers.

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

**Step 7.1:** MMC core (`drivers/mmc/core/`) is an IMPORTANT subsystem.
eMMC is critical for embedded systems (Android, IoT, SBCs), and the
performance impact (26 MHz vs 52 MHz) is significant.
Record: [MMC core] [IMPORTANT - affects embedded systems with eMMC]

**Step 7.2:** The MMC subsystem is actively maintained with regular
contributions.
Record: Active subsystem.

## PHASE 8: IMPACT AND RISK ASSESSMENT

**Step 8.1:** Affects users with eMMC connected via 1-bit bus where
firmware incorrectly advertises UHS/DDR/HS200 capabilities. This is
likely NXP and similar embedded platforms.
Record: [Platform-specific but significant for affected users]

**Step 8.2:** Triggered during every eMMC initialization on affected
platforms. No special user action needed.
Record: [Always triggered on affected hardware configurations]

**Step 8.3:** Failure mode: eMMC runs at 26 MHz instead of 52 MHz -
roughly 50% performance degradation. Not a crash or data corruption, but
significant performance impact on storage I/O.
Record: [Performance degradation] [Severity: MEDIUM-HIGH - halves eMMC
throughput]

**Step 8.4:**
- BENEFIT: Fixes 50% performance loss on affected eMMC configurations.
  Prevents silent timing selection failure.
- RISK: Very low. Only affects hosts with no 4/8-bit bus AND
  UHS/DDR/HS200 caps. Correctly configured hosts are unaffected.
Record: [High benefit for affected users] [Very low risk] [Favorable
ratio]

## PHASE 9: FINAL SYNTHESIS

**Step 9.1:**
Evidence FOR:
- Real bug with concrete user impact (50% performance loss)
- Small, surgical fix (~12 lines added)
- Follows established validation pattern in same function
- Applied by subsystem maintainer for fixes tree
- Companion sdhci fix was explicitly Cc: stable
- Reworked by experienced MMC contributor (Shawn Lin)
- No regression risk for correctly configured hosts
- Applies cleanly to all active stable trees (v6.1+)

Evidence AGAINST:
- No explicit Cc: stable or Fixes: tag on this specific commit
- Not a crash/security issue - "only" performance degradation
- Includes minor refactoring of HS400 check (style, not behavioral)

**Step 9.2:**
1. Obviously correct? YES - UHS/DDR/HS200 modes genuinely require multi-
   bit bus
2. Fixes real bug? YES - eMMC runs at 26 MHz instead of 52 MHz
3. Important issue? YES - 50% throughput loss on embedded eMMC systems
4. Small and contained? YES - ~12 lines in one function in one file
5. No new features/APIs? CORRECT - only adds validation
6. Applies to stable? YES - function exists in v6.1+, applies cleanly

**Step 9.3:** Not an exception category (device ID, quirk, etc.) but
meets standard criteria.

**Step 9.4:** The fix addresses a real performance bug that halves eMMC
throughput on affected platforms. It's small, obviously correct, follows
the existing validation pattern, and was applied to the fixes tree by
the subsystem maintainer. The companion sdhci-specific fix was
explicitly tagged for stable. This core-level fix provides the same
protection generically for all host controllers.

## Verification

- [Phase 1] Parsed tags: Author Luke Wang (NXP), reworked by Shawn Lin,
  applied by Ulf Hansson
- [Phase 2] Diff analysis: ~12 lines added to
  `mmc_validate_host_caps()`, adds UHS/DDR/HS200 bus width validation
- [Phase 2] Confirmed bug mechanism: `mmc_select_bus_width()` returns 0
  on 1-bit hosts (line 1026-1028), causing `mmc_select_hs200()` to skip
  switch (line 1491 `if (err > 0)`) and return 0, preventing HS fallback
  in `mmc_select_timing()`
- [Phase 3] git blame: `mmc_validate_host_caps()` introduced in
  `d6c9219ca1139b` (v5.18-rc1, 2022-03-03)
- [Phase 3] git merge-base: function present in v6.1, v6.6, v6.12 (all
  active stable trees)
- [Phase 3] Companion commit `5e3486e64094c` by same author fixes same
  issue in sdhci with Cc: stable and Fixes: tag
- [Phase 3] git show v6.1/v6.6/v6.12:drivers/mmc/core/host.c: function
  is identical, patch applies cleanly
- [Phase 3] MMC_CAP_UHS and MMC_CAP_DDR macros confirmed in v6.1 and
  v6.6 include/linux/mmc/host.h
- [Phase 4] b4 dig: found series v3 at
  patch.msgid.link/20260311095009.1254556-2-ziniu.wang_1@nxp.com
- [Phase 4] Mbox: Ulf Hansson said "Applied for fixes and by adding a
  stable tag" for the sdhci fix
- [Phase 4] b4 dig -w: appropriate maintainers (Ulf Hansson, Adrian
  Hunter) were CC'd
- [Phase 5] `mmc_validate_host_caps()` called from `mmc_add_host()` -
  universal initialization path
- [Phase 6] Function code identical across v6.1, v6.6, v6.12 - clean
  apply expected
- [Phase 8] Failure mode: eMMC at 26 MHz instead of 52 MHz = ~50%
  throughput loss, severity MEDIUM-HIGH

**YES**

 drivers/mmc/core/host.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 88c95dbfd9cfd..a457c88fdcbc7 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -624,12 +624,24 @@ static int mmc_validate_host_caps(struct mmc_host *host)
 		return -EINVAL;
 	}
 
+	/* UHS/DDR/HS200 modes require at least 4-bit bus */
+	if (!(caps & (MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA)) &&
+	    ((caps & (MMC_CAP_UHS | MMC_CAP_DDR)) || (caps2 & MMC_CAP2_HS200))) {
+		dev_warn(dev, "drop UHS/DDR/HS200 support since 1-bit bus only\n");
+		caps &= ~(MMC_CAP_UHS | MMC_CAP_DDR);
+		caps2 &= ~MMC_CAP2_HS200;
+	}
+
+	/* HS400 and HS400ES modes require 8-bit bus */
 	if (caps2 & (MMC_CAP2_HS400_ES | MMC_CAP2_HS400) &&
 	    !(caps & MMC_CAP_8_BIT_DATA) && !(caps2 & MMC_CAP2_NO_MMC)) {
 		dev_warn(dev, "drop HS400 support since no 8-bit bus\n");
-		host->caps2 = caps2 & ~MMC_CAP2_HS400_ES & ~MMC_CAP2_HS400;
+		caps2 &= ~(MMC_CAP2_HS400_ES | MMC_CAP2_HS400);
 	}
 
+	host->caps = caps;
+	host->caps2 = caps2;
+
 	return 0;
 }
 
-- 
2.53.0