{"id":2224339,"url":"http://patchwork.ozlabs.org/api/patches/2224339/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260417-sdcard-performance-b4-v4-3-119e66be10c2@avm.de/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260417-sdcard-performance-b4-v4-3-119e66be10c2@avm.de>","list_archive_url":null,"date":"2026-04-17T09:51:36","name":"[v4,3/7] hw/sd/sd: Use multi-byte/block writes for block path","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"4ee6fe3b8a6e330aaa7bee6e4acb512b3cf33b6e","submitter":{"id":91343,"url":"http://patchwork.ozlabs.org/api/people/91343/?format=json","name":"Christian Speich","email":"c.speich@avm.de"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260417-sdcard-performance-b4-v4-3-119e66be10c2@avm.de/mbox/","series":[{"id":500297,"url":"http://patchwork.ozlabs.org/api/series/500297/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=500297","date":"2026-04-17T09:51:34","name":"hw/sd: Improve performance of read/write/erase","version":4,"mbox":"http://patchwork.ozlabs.org/series/500297/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224339/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224339/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=avm.de header.i=@avm.de header.a=rsa-sha256\n header.s=mail header.b=OPKm0Gxd;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxr2153BRz1yDF\n\tfor ; Fri, 17 Apr 2026 19:59:05 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wDfxH-00031t-4P; Fri, 17 Apr 2026 05:57:43 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wDfx9-0002jp-Uj; Fri, 17 Apr 2026 05:57:35 -0400","from mail.avm.de ([212.42.244.119])\n by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wDfx5-00030T-HO; Fri, 17 Apr 2026 05:57:35 -0400","from [172.16.0.1] (helo=mail.avm.de)\n by mail.avm.de with ESMTP (eXpurgate 4.55.2)\n (envelope-from )\n id 69e20405-1e6c-7f0000032729-7f000001c51e-1\n for ; Fri, 17 Apr 2026 11:57:25 +0200","from mail-notes.avm.de (mail-notes.avm.de [172.16.0.1])\n by mail.avm.de (Postfix) with ESMTP;\n Fri, 17 Apr 2026 11:57:25 +0200 (CEST)","from [127.0.1.1] ([172.17.89.139])\n by mail-notes.avm.de (HCL Domino Release 14.0FP4)\n with ESMTP id 2026041711572443-2976 ;\n Fri, 17 Apr 2026 11:57:24 +0200"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=avm.de; s=mail;\n t=1776419845; bh=QoyvxQROiGbE6vAvJxaG+85jruxRTacuSs9YktkmEG0=;\n h=From:Date:Subject:References:In-Reply-To:To:Cc:From;\n b=OPKm0GxdEpwO+n7aXHamI33uktNSIId8uheR7V3/x/MCVl1IjvdFq85n1S1ChZs/c\n gBk5D1rjOAVORQGUdDDXoXEfUwPZvU066FU9OYQ91F2ZWPaCwGI42O13y7GfQ6mIo0\n V2TwgMroMnWGDsXUXuy5qsEZOIL3LL0uZ7tcUino=","From":"Christian Speich ","Date":"Fri, 17 Apr 2026 11:51:36 +0200","Subject":"[PATCH v4 3/7] hw/sd/sd: Use multi-byte/block writes for block\n path","MIME-Version":"1.0","Message-Id":"<20260417-sdcard-performance-b4-v4-3-119e66be10c2@avm.de>","References":"<20260417-sdcard-performance-b4-v4-0-119e66be10c2@avm.de>","In-Reply-To":"<20260417-sdcard-performance-b4-v4-0-119e66be10c2@avm.de>","To":"qemu-devel@nongnu.org","Cc":"=?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= ,\n Bin Meng , qemu-block@nongnu.org,\n Marcel Apfelbaum ,\n Yanan Wang , Zhao Liu ,\n Christian Speich ","X-Mailer":"b4 0.14.2","X-MIMETrack":"Itemize by SMTP Server on ANIS1/AVM(Release 14.0FP4|March 10,\n 2025) at 17.04.2026 11:57:24,\n Serialize by Router on ANIS1/AVM(Release 14.0FP4|March 10, 2025) at\n 17.04.2026 11:57:25, Serialize complete at 17.04.2026 11:57:25","X-TNEFEvaluated":"1","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"utf-8\"","X-purgate-ID":"149429::1776419845-4BF2C233-2AF0D54D/0/0","X-purgate-type":"clean","X-purgate-size":"12969","X-purgate-Ad":"Categorized by eleven eXpurgate (R) https://www.eleven.de","X-purgate":["This mail is considered clean (visit https://www.eleven.de for\n further information)","clean"],"Received-SPF":"pass client-ip=212.42.244.119; envelope-from=c.speich@avm.de;\n helo=mail.avm.de","X-Spam_score_int":"-48","X-Spam_score":"-4.9","X-Spam_bar":"----","X-Spam_report":"(-4.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.54,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,\n RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"When writing/reading blocks via WRITE/READ_MULTIPLE_BLOCK we try to\ndirectly pass this request down to the block layer. This can only be done\nfor properly sized and aligned accesses, other access still use a bounce\nbuffer but still benefit from copying as much data in one memcpy as\npossible.\n\nRPMB is limited to the slow path using a bounce buffer.\n\nSigned-off-by: Christian Speich \n---\n hw/sd/sd.c | 228 ++++++++++++++++++++++++++++++++++++++++++++++---------------\n 1 file changed, 172 insertions(+), 56 deletions(-)","diff":"diff --git a/hw/sd/sd.c b/hw/sd/sd.c\nindex 2c81776df316feda75f97e15cc9bbd1538f1a21c..b27fed2e563e5971dd32787498eb8abed9ffe9be 100644\n--- a/hw/sd/sd.c\n+++ b/hw/sd/sd.c\n@@ -1112,24 +1112,36 @@ static const VMStateDescription sd_vmstate = {\n },\n };\n \n-static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)\n+static void sd_blk_read(SDState *sd, void* buf, uint64_t addr,\n+ uint32_t len)\n {\n trace_sdcard_read_block(addr, len);\n addr += sd_part_offset(sd);\n- if (!sd->blk || blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {\n+ if (!sd->blk || blk_pread(sd->blk, addr, len, buf, 0) < 0) {\n fprintf(stderr, \"sd_blk_read: read error on host side\\n\");\n }\n }\n \n-static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)\n+static void sd_blk_read_bounce_buffer(SDState *sd, uint64_t addr, uint32_t len)\n+{\n+ sd_blk_read(sd, sd->data, addr, len);\n+}\n+\n+static void sd_blk_write(SDState *sd, const void *buf, uint64_t addr,\n+ uint32_t len)\n {\n trace_sdcard_write_block(addr, len);\n addr += sd_part_offset(sd);\n- if (!sd->blk || blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {\n+ if (!sd->blk || blk_pwrite(sd->blk, addr, len, buf, 0) < 0) {\n fprintf(stderr, \"sd_blk_write: write error on host side\\n\");\n }\n }\n \n+static void sd_blk_write_bounce_buffer(SDState *sd, uint64_t addr, uint32_t len)\n+{\n+ sd_blk_write(sd, sd->data, addr, len);\n+}\n+\n static bool rpmb_calc_hmac(SDState *sd, const RPMBDataFrame *frame,\n unsigned int num_blocks, uint8_t *mac)\n {\n@@ -1363,7 +1375,7 @@ static void sd_erase(SDState *sd)\n continue;\n }\n }\n- sd_blk_write(sd, erase_addr, erase_len);\n+ sd_blk_write_bounce_buffer(sd, erase_addr, erase_len);\n }\n }\n \n@@ -1984,7 +1996,7 @@ static sd_rsp_type_t sd_cmd_READ_SINGLE_BLOCK(SDState *sd, SDRequest req)\n return sd_r1;\n }\n \n- sd_blk_read(sd, addr, sd->blk_len);\n+ sd_blk_read_bounce_buffer(sd, addr, sd->blk_len);\n return sd_cmd_to_sendingdata(sd, req, addr, NULL, sd->blk_len);\n }\n \n@@ -2673,7 +2685,7 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)\n if (sd_generic_write_data(sd, buf, &length)) {\n /* TODO: Check CRC before committing */\n sd->state = sd_programming_state;\n- sd_blk_write(sd, sd->data_start, sd->data_offset);\n+ sd_blk_write_bounce_buffer(sd, sd->data_start, sd->data_offset);\n sd->blk_written ++;\n sd->csd[14] |= 0x40;\n /* Bzzzzzzztt .... Operation complete. */\n@@ -2682,44 +2694,85 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)\n break;\n \n case 25: /* CMD25: WRITE_MULTIPLE_BLOCK */\n- /*\n- * Only read one byte at a time. We will be called again with the\n- * remaining.\n- */\n- length = 1;\n-\n- if (sd->data_offset == 0) {\n- /* Start of the block - let's check the address is valid */\n- if (!address_in_range(sd, \"WRITE_MULTIPLE_BLOCK\",\n- sd->data_start, sd->blk_len)) {\n- break;\n+ if (!address_in_range(sd, \"WRITE_MULTIPLE_BLOCK\",\n+ sd->data_start + sd->data_offset, length)) {\n+ /* Limit writing data to our device size */\n+ length = sd->size - sd->data_start - sd->data_offset;\n+\n+ /* We've read past the end, return a dummy write. */\n+ if (length == 0) {\n+ return 1;\n }\n- if (sd->size <= SDSC_MAX_CAPACITY) {\n- if (sd_wp_addr(sd, sd->data_start)) {\n+ }\n+\n+ if (sd->size <= SDSC_MAX_CAPACITY) {\n+ uint64_t start = sd->data_start + sd->data_offset;\n+\n+ /*\n+ * Check if any covered address violates WP. If so, limit our write\n+ * up to the allowed address.\n+ */\n+ for (uint64_t addr = start; addr < start + length;\n+ addr = ROUND_UP(addr + 1, WPGROUP_SIZE)) {\n+ if (sd_wp_addr(sd, addr)) {\n sd->card_status |= WP_VIOLATION;\n+\n+ length = addr - start - 1;\n break;\n }\n }\n }\n- sd->data[sd->data_offset++] = value[0];\n- if (sd->data_offset >= sd->blk_len) {\n- /* TODO: Check CRC before committing */\n- sd->state = sd_programming_state;\n- partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]\n- & EXT_CSD_PART_CONFIG_ACC_MASK;\n- if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {\n- emmc_rpmb_blk_write(sd, sd->data_start, sd->data_offset);\n- } else {\n- sd_blk_write(sd, sd->data_start, sd->data_offset);\n+\n+ partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]\n+ & EXT_CSD_PART_CONFIG_ACC_MASK;\n+\n+ /* Partial write or RPMB (single block only for now) */\n+ if (sd->data_offset > 0\n+ || partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {\n+ length = MIN(sd->blk_len - sd->data_offset, length);\n+\n+ memcpy(sd->data + sd->data_offset, buf, length);\n+ sd->data_offset += length;\n+\n+ if (sd->data_offset >= sd->blk_len) {\n+ sd->state = sd_programming_state;\n+ if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {\n+ emmc_rpmb_blk_write(sd, sd->data_start, sd->data_offset);\n+ } else {\n+ sd_blk_write_bounce_buffer(sd, sd->data_start,\n+ sd->data_offset);\n+ }\n+ sd->blk_written++;\n+ sd->data_start += sd->blk_len;\n+ sd->data_offset = 0;\n+ sd->csd[14] |= 0x40;\n+\n+ /* Bzzzzzzztt .... Operation complete. */\n+ if (sd->multi_blk_cnt != 0) {\n+ if (--sd->multi_blk_cnt == 0) {\n+ /* Stop! */\n+ sd->state = sd_transfer_state;\n+ break;\n+ }\n+ }\n+\n+ sd->state = sd_receivingdata_state;\n }\n- sd->blk_written++;\n- sd->data_start += sd->blk_len;\n- sd->data_offset = 0;\n+ }\n+ /* Try to write multiple of block sizes */\n+ else if (length >= sd->blk_len) {\n+ length = QEMU_ALIGN_DOWN(length, sd->blk_len);\n+\n+ sd->state = sd_programming_state;\n+ sd_blk_write(sd, buf, sd->data_start, length);\n+ sd->blk_written += length / sd->blk_len;\n+ sd->data_start += length;\n sd->csd[14] |= 0x40;\n \n- /* Bzzzzzzztt .... Operation complete. */\n if (sd->multi_blk_cnt != 0) {\n- if (--sd->multi_blk_cnt == 0) {\n+ sd->multi_blk_cnt -= length / sd->blk_len;\n+\n+ if (sd->multi_blk_cnt == 0) {\n /* Stop! */\n sd->state = sd_transfer_state;\n break;\n@@ -2728,6 +2781,12 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)\n \n sd->state = sd_receivingdata_state;\n }\n+ /* Partial write */\n+ else if (length > 0) {\n+ memcpy(sd->data, buf, length);\n+ sd->data_offset = length;\n+ }\n+\n break;\n \n case 26: /* CMD26: PROGRAM_CID */\n@@ -2798,7 +2857,6 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length)\n const uint8_t dummy_byte = 0x00;\n unsigned int partition_access;\n uint32_t io_len;\n- uint8_t *value = buf;\n \n if (!sd->blk || !blk_is_inserted(sd->blk)) {\n memset(buf, dummy_byte, length);\n@@ -2838,36 +2896,94 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length)\n break;\n \n case 18: /* CMD18: READ_MULTIPLE_BLOCK */\n+ if (!address_in_range(sd, \"READ_MULTIPLE_BLOCK\",\n+ sd->data_start + sd->data_offset, length)) {\n+ /* Limit reading data to our device size */\n+ length = sd->size - sd->data_start - sd->data_offset;\n+\n+ /* We read past the end, return a dummy read. */\n+ if (length == 0) {\n+ memset(buf, dummy_byte, 1);\n+ return 1;\n+ }\n+ }\n+\n+ partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]\n+ & EXT_CSD_PART_CONFIG_ACC_MASK;\n+\n+ /* We have a partially read block. */\n+ if (sd->data_offset > 0) {\n+ length = MIN(sd->data_size - sd->data_offset, length);\n+\n+ memcpy(buf, sd->data + sd->data_offset, length);\n+\n+ sd->data_offset += length;\n+\n+ /* Partial read is complete, clear state. */\n+ if (sd->data_offset >= sd->data_size) {\n+ sd->data_start += io_len;\n+ sd->data_size = 0;\n+ sd->data_offset = 0;\n+\n+ if (sd->multi_blk_cnt != 0) {\n+ if (--sd->multi_blk_cnt == 0) {\n+ sd->state = sd_transfer_state;\n+ }\n+ }\n+ }\n+ }\n /*\n- * We will only read one byte at a time. We will be called again with\n- * the remaining buffer.\n+ * Try to read multiples of the block size directly bypassing the local\n+ * bounce buffer.\n+ * Not for RPMB.\n */\n- length = 1;\n+ else if (length >= io_len\n+ && partition_access != EXT_CSD_PART_CONFIG_ACC_RPMB) {\n+ length = QEMU_ALIGN_DOWN(length, io_len);\n \n- if (sd->data_offset == 0) {\n- if (!address_in_range(sd, \"READ_MULTIPLE_BLOCK\",\n- sd->data_start, io_len)) {\n- return dummy_byte;\n+ /* For limited reads, only read the requested block count. */\n+ if (sd->multi_blk_cnt != 0) {\n+ length = MIN(length, sd->multi_blk_cnt * io_len);\n }\n- partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]\n- & EXT_CSD_PART_CONFIG_ACC_MASK;\n+\n+ sd_blk_read(sd, buf, sd->data_start, length);\n+\n+ sd->data_start += length;\n+\n+ if (sd->multi_blk_cnt != 0) {\n+ sd->multi_blk_cnt -= length / io_len;\n+\n+ if (sd->multi_blk_cnt == 0) {\n+ sd->state = sd_transfer_state;\n+ }\n+ }\n+ }\n+ /* Read partial at the end or sinlge-block RPMB */\n+ else if (length > 0) {\n+ length = MIN(length, io_len);\n+\n+ /* Fill the buffer */\n if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {\n emmc_rpmb_blk_read(sd, sd->data_start, io_len);\n } else {\n- sd_blk_read(sd, sd->data_start, io_len);\n+ sd_blk_read_bounce_buffer(sd, sd->data_start, io_len);\n }\n- }\n- *value = sd->data[sd->data_offset++];\n \n- if (sd->data_offset >= io_len) {\n- sd->data_start += io_len;\n- sd->data_offset = 0;\n+ memcpy(buf, sd->data, length);\n \n- if (sd->multi_blk_cnt != 0) {\n- if (--sd->multi_blk_cnt == 0) {\n- /* Stop! */\n- sd->state = sd_transfer_state;\n- break;\n+ sd->data_size = io_len;\n+ sd->data_offset = length;\n+\n+ if (sd->data_offset >= io_len) {\n+ sd->data_start += io_len;\n+ sd->data_offset = 0;\n+\n+ if (sd->multi_blk_cnt != 0) {\n+ if (--sd->multi_blk_cnt == 0) {\n+ /* Stop! */\n+ sd->state = sd_transfer_state;\n+ break;\n+ }\n }\n }\n }\n","prefixes":["v4","3/7"]}