mmc: speed up secure erase on ISSI IS22TF128G eMMC

Secure erasing a 33.5GiB partition on an ISSI IS22TF128G eMMC (NXP i.MX8, sdhci-esdhc-imx) takes 5-7 hours, because the request is split into roughly 10000 max_discard sized secure erase commands, each with a large fixed overhead.

Patch 1 adds the card to MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, which brings the same operation down to about 6 minutes. It is tagged for stable.

Patch 2 is hardening for the quirk: with qty no longer bound by max_busy_timeout, the 32-bit erase timeout calculation can overflow for cards with large ERASE_TIMEOUT_MULT * SEC_ERASE_MULT. None of the currently quirked cards reach that limit (the ISSI card is at about half of it), so it is not tagged for stable.

Michael Haener (2):
mmc: add ISSI IS22TF128G to fixed secure erase time quirk
mmc: core: saturate erase timeout instead of overflowing

 drivers/mmc/core/card.h   |  1 +
 drivers/mmc/core/core.c   | 19 ++++++++++++++-----
 drivers/mmc/core/quirks.h |  9 +++++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

2.56.0

The ISSI IS22TF128G eMMC (CID manfid 0x9d, oemid 0x0101, name "IS128G") reports SECURE_REMOVAL_TYPE 0x01 (overwrite, then erase) and has a large per-command overhead for secure erase. Secure erasing a 33.5GiB partition with blkdiscard -s on an NXP i.MX8 (sdhci-esdhc-imx, HS400ES) is split into max_discard sized requests of about 3.5MiB, i.e. roughly 10000 secure erase commands, which takes 5-7 hours once ~27GiB of the partition have been written.

Since the per-command overhead dominates, apply MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME so secure erase requests are no longer limited by max_discard. With the quirk, secure erasing the same partition with ~27GiB written takes about 6 minutes.

Card parameters: ERASE_GROUP_DEF 0x01, HC_ERASE_GRP_SIZE 0x01 (512KiB), ERASE_TIMEOUT_MULT 0x12, SEC_ERASE_MULT 0x64, SEC_TRIM_MULT 0x64.

---
 drivers/mmc/core/card.h   | 1 +
 drivers/mmc/core/quirks.h | 9 +++++++++
 2 files changed, 10 insertions(+)

index a7c364d0030a..dc99242a0af2 100644
@@ -93,6 +93,7 @@ struct mmc_fixup {
 #define CID_MANFID_SWISSBIT     0x5D
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX	0x90
+#define CID_MANFID_ISSI		0x9D
 #define CID_MANFID_KINGSTON_SD	0x9F
 #define CID_MANFID_NUMONYX	0xFE
 

index 98cb680e3ace..be29be8ec413 100644
@@ -162,6 +162,15 @@ static const struct mmc_fixup __maybe_unused mmc_blk_fixups[] = {
 	MMC_FIXUP("IB2932", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
 		  MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME),
 
+	/*
+	 * ISSI IS22TF128G has a large per-command overhead for secure erase
+	 * once data has been written: splitting a 33GB secure erase into
+	 * max_discard sized chunks takes hours, while a single command over
+	 * the same range finishes in about 10 seconds.
+	 */
+	MMC_FIXUP("IS128G", CID_MANFID_ISSI, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME),
+
 	END_FIXUP
 };
 

2.56.0

With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, secure erase/trim requests are no longer limited by max_discard, so mmc_mmc_erase_timeout() can be called with a qty of several thousand erase groups. The timeout is then computed as erase_timeout * sec_erase_mult * qty in 32-bit arithmetic.

With 512KiB erase groups the block layer limits a request to about 4096 groups, so the product overflows once ERASE_TIMEOUT_MULT * SEC_ERASE_MULT exceeds about 3496. The wrapped value can be much shorter than the real erase time, making the busy polling give up early with -ETIMEDOUT. No card in the quirk list is known to reach that limit today.

Use check_mul_overflow() and saturate at UINT_MAX.

---
 drivers/mmc/core/core.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

index 677e445dc48c..9730633dfa81 100644
@@ -24,6 +24,7 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/overflow.h>
 
 #include <linux/mmc/card.h>
 #include <linux/mmc/host.h>

@@ -1568,13 +1569,21 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
 
 	/* Multiplier for secure operations */
 	if (arg & MMC_SECURE_ARGS) {
-		if (arg == MMC_SECURE_ERASE_ARG)
-			erase_timeout *= card->ext_csd.sec_erase_mult;
-		else
-			erase_timeout *= card->ext_csd.sec_trim_mult;
+		unsigned int mult = arg == MMC_SECURE_ERASE_ARG ?
+				    card->ext_csd.sec_erase_mult :
+				    card->ext_csd.sec_trim_mult;
+
+		if (check_mul_overflow(erase_timeout, mult, &erase_timeout))
+			erase_timeout = UINT_MAX;
 	}
 
-	erase_timeout *= qty;
+	/*
+	 * With MMC_QUIRK_FIXED_SECURE_ERASE_TRIM_TIME, qty is no longer bound
+	 * by max_busy_timeout, so the product can exceed 32 bits. Saturate
+	 * instead of wrapping to a too short timeout.
+	 */
+	if (check_mul_overflow(erase_timeout, qty, &erase_timeout))
+		erase_timeout = UINT_MAX;
 
 	/*
 	 * Ensure at least a 1 second timeout for SPI as per

2.56.0