kernel/git/next/linux-next.git/drivers/mmc, branch master

mmc: rtsx_usb_sdmmc: suppress false CD after init timeout

2026-07-10T13:03:21+00:00

Some Realtek USB SD readers with a tray keep raw SD_CD asserted when an empty tray is inserted. The MMC core then repeatedly tries to initialize non-existent media, sees command timeouts, calls ->get_cd() again, and starts the same detect cycle over. Do not qualify media by open-coding MMC commands in ->get_cd(). Instead, let the normal MMC rescan path probe the card. If an initialization command times out before a card has been attached, suppress the raw SD_CD signal so the host can settle and the USB parent can autosuspend. Clear the suppression only when raw SD_CD drops. On the affected tray reader, changing media requires removing and reinserting the tray, so a low CD transition is the signal that a new insertion attempt can be trusted again. Signed-off-by: Sean Rhodes Signed-off-by: Ulf Hansson

mmc: sdhci-of-dwcmshc: Log eMMC reset calls

2026-07-10T12:42:09+00:00

Log when the BlueField-3 eMMC hardware reset path is invoked. This makes it easier to diagnose cases where the controller recovery path depends on issuing an eMMC reset, and helps confirm that the reset sequence was attempted on affected systems. Signed-off-by: Satyansh Shukla Signed-off-by: Ulf Hansson

mmc: block: reject invalid perdev_minors before division

2026-07-10T12:39:18+00:00

The mmcblk.perdev_minors module parameter is parsed as a signed int and is used during mmc_blk_init() to compute the number of supported block devices. Passing perdev_minors=0 makes the init path divide by zero when it computes max_devices. Negative values are invalid as well and would make max_devices negative before it is later used as an IDA limit. Reject non-positive perdev_minors values before registering any mmcblk resources. Signed-off-by: Xu Rao Signed-off-by: Ulf Hansson

mmc: Merge branch fixes into next

2026-07-06T15:28:08+00:00

Merge the mmc fixes for v7.2-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson

mmc: block: fix RPMB device unregister ordering

2026-07-06T15:25:03+00:00

Since commit 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem"), each mmc RPMB partition is represented by two device objects: - the mmc-owned device (`rpmb->dev`, backing the legacy /dev/mmcblkXrpmb char device) and - the rpmb-core device (`rdev`, backing /dev/rpmbN). The child RPMB device holds a reference to its parent, so the parent's release callback cannot be invoked if the child device is still registered. Remove rpmb_dev_unregister() from the parent release handler and unregister the child RPMB device in the remove path before tearing down the parent device. Also delete the extra blank line between mmc_blk_remove_rpmb_part() and {. Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem") Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li Signed-off-by: Ao Sun Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson

mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()

2026-07-06T15:20:24+00:00

The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. Signed-off-by: Pengpeng Hou Signed-off-by: Ulf Hansson

mmc: litex_mmc: Remove unused logic for the fixed bus width

2026-07-06T14:58:00+00:00

As the set_ios() function in litex_mmc driver does support setting bus width, it is not necessary to leave the logic for fixed bus width. Clean up these unneeded code. Signed-off-by: Inochi Amaoto Signed-off-by: Ulf Hansson

mmc: litex_mmc: Set width from linux request

2026-07-06T14:57:50+00:00

Previously, the litex_mmc driver force the 4 bits bus width. This means that the gateware with 1 bit bus width is not fit. However, litesdcard does support setting bus width, which make the 1 bit bus width gateware possible to be used. Add logic for setting bus width in the set_ios() function. Signed-off-by: Inochi Amaoto Signed-off-by: Ulf Hansson

mmc: cqhci: fix to missed endian conversions

2026-07-06T14:27:23+00:00

Fix two places where the wrong type or conversion of little-endian types to fix the following sparse warnings: drivers/mmc/host/cqhci-core.c:487:15: warning: incorrect type in assignment (different base types) drivers/mmc/host/cqhci-core.c:487:15: expected restricted __le32 [usertype] drivers/mmc/host/cqhci-core.c:487:15: got int drivers/mmc/host/cqhci-core.c:566:19: warning: incorrect type in assignment (different base types) drivers/mmc/host/cqhci-core.c:566:19: expected unsigned long long [usertype] *task_desc drivers/mmc/host/cqhci-core.c:566:19: got restricted __le64 [usertype] * Signed-off-by: Ben Dooks Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson

mmc: vub300: defer reset until cmd_mutex is unlocked

2026-07-06T14:20:12+00:00

vub300_cmndwork_thread() holds cmd_mutex while it sends a command and waits for the command response. If the response wait times out, __vub300_command_response() kills the command URBs and then synchronously resets the USB device through usb_reset_device(). That reset path re-enters the driver through vub300_pre_reset(), which also takes cmd_mutex. The worker therefore tries to acquire the same mutex recursively while it is still holding it from the command path. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the real worker and timeout/reset carrier: vub300_cmndwork_thread() __vub300_command_response() usb_lock_device_for_reset() usb_reset_device() vub300_pre_reset() Lockdep reported the same-task recursive acquisition on cmd_mutex: WARNING: possible recursive locking detected ... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv] ... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv] Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv] *** DEADLOCK *** Return a flag from __vub300_command_response() when the timeout path needs a device reset, then perform the reset after vub300_cmndwork_thread() has cleared the in-flight command state and dropped cmd_mutex. The reset is still attempted before mmc_request_done(), preserving the existing request completion ordering while avoiding the recursive lock. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao Signed-off-by: Ulf Hansson