[PATCH 0/2] mmc: speed up secure erase on ISSI IS22TF128G eMMC

[PATCH 0/2] mmc: speed up secure erase on ISSI IS22TF128G eMMC

[Michael Haener]

Secure erasing a 33.5GiB partition on an ISSI IS22TF128G eMMC (NXP
i.MX8, sdhci-esdhc-imx) takes 5-7 hours, because the request is split
into roughly 10000 max_discard sized secure erase commands, each with a
large fixed overhead.

Patch 1 adds the card to MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, which
brings the same operation down to about 6 minutes. It is tagged for
stable.

Patch 2 is hardening for the quirk: with qty no longer bound by
max_busy_timeout, the 32-bit erase timeout calculation can overflow for
cards with large ERASE_TIMEOUT_MULT * SEC_ERASE_MULT. None of the
currently quirked cards reach that limit (the ISSI card is at about
half of it), so it is not tagged for stable.

Michael Haener (2):
  mmc: add ISSI IS22TF128G to fixed secure erase time quirk
  mmc: core: saturate erase timeout instead of overflowing

 drivers/mmc/core/card.h   |  1 +
 drivers/mmc/core/core.c   | 19 ++++++++++++++-----
 drivers/mmc/core/quirks.h |  9 +++++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

-- 
2.56.0

[PATCH 1/2] mmc: add ISSI IS22TF128G to fixed secure erase time quirk

[Michael Haener]

The ISSI IS22TF128G eMMC (CID manfid 0x9d, oemid 0x0101, name "IS128G")
reports SECURE_REMOVAL_TYPE 0x01 (overwrite, then erase) and has a large
per-command overhead for secure erase. Secure erasing a 33.5GiB
partition with blkdiscard -s on an NXP i.MX8 (sdhci-esdhc-imx, HS400ES)
is split into max_discard sized requests of about 3.5MiB, i.e. roughly
10000 secure erase commands, which takes 5-7 hours once ~27GiB of the
partition have been written.

Since the per-command overhead dominates, apply
MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME so secure erase requests are no
longer limited by max_discard. With the quirk, secure erasing the same
partition with ~27GiB written takes about 6 minutes.

Card parameters: ERASE_GROUP_DEF 0x01, HC_ERASE_GRP_SIZE 0x01 (512KiB),
ERASE_TIMEOUT_MULT 0x12, SEC_ERASE_MULT 0x64, SEC_TRIM_MULT 0x64.

Cc: stable@vger.kernel.org
Signed-off-by: Michael Haener <michael.haener@siemens.com>
---
 drivers/mmc/core/card.h   | 1 +
 drivers/mmc/core/quirks.h | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index a7c364d0030a..dc99242a0af2 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -93,6 +93,7 @@ struct mmc_fixup {
 #define CID_MANFID_SWISSBIT     0x5D
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX	0x90
+#define CID_MANFID_ISSI		0x9D
 #define CID_MANFID_KINGSTON_SD	0x9F
 #define CID_MANFID_NUMONYX	0xFE
 
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index 98cb680e3ace..be29be8ec413 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -162,6 +162,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = {
 	MMC_FIXUP("IB2932", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
 		  MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME),
 
+	/*
+	 * ISSI IS22TF128G has a large per-command overhead for secure erase
+	 * once data has been written: splitting a 33GB secure erase into
+	 * max_discard sized chunks takes hours, while a single command over
+	 * the same range finishes in about 10 seconds.
+	 */
+	MMC_FIXUP("IS128G", CID_MANFID_ISSI, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME),
+
 	END_FIXUP
 };
 
-- 
2.56.0

[PATCH 2/2] mmc: core: saturate erase timeout instead of overflowing

[Michael Haener]

With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, secure erase/trim requests
are no longer limited by max_discard, so mmc_mmc_erase_timeout() can be
called with a qty of several thousand erase groups. The timeout is then
computed as erase_timeout * sec_erase_mult * qty in 32-bit arithmetic.

With 512KiB erase groups the block layer limits a request to about 4096
groups, so the product overflows once ERASE_TIMEOUT_MULT * SEC_ERASE_MULT
exceeds about 3496. The wrapped value can be much shorter than the real
erase time, making the busy polling give up early with -ETIMEDOUT. No
card in the quirk list is known to reach that limit today.

Use check_mul_overflow() and saturate at UINT_MAX.

Signed-off-by: Michael Haener <michael.haener@siemens.com>
---
 drivers/mmc/core/core.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 677e445dc48c..9730633dfa81 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -24,6 +24,7 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/overflow.h>
 
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>
@@ -1568,13 +1569,21 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
 
 	/* Multiplier for secure operations */
 	if (arg & MMC_SECURE_ARGS) {
-		if (arg == MMC_SECURE_ERASE_ARG)
-			erase_timeout *= card->ext_csd.sec_erase_mult;
-		else
-			erase_timeout *= card->ext_csd.sec_trim_mult;
+		unsigned int mult = arg == MMC_SECURE_ERASE_ARG ?
+				    card->ext_csd.sec_erase_mult :
+				    card->ext_csd.sec_trim_mult;
+
+		if (check_mul_overflow(erase_timeout, mult, &erase_timeout))
+			erase_timeout = UINT_MAX;
 	}
 
-	erase_timeout *= qty;
+	/*
+	 * With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, qty is no longer bound
+	 * by max_busy_timeout, so the product can exceed 32 bits. Saturate
+	 * instead of wrapping to a too short timeout.
+	 */
+	if (check_mul_overflow(erase_timeout, qty, &erase_timeout))
+		erase_timeout = UINT_MAX;
 
 	/*
 	 * Ensure at least a 1 second timeout for SPI as per
-- 
2.56.0