Y2 storage hardware ceiling — eMMC and SD bus modes

Source and software record, 2026-10-01. The ceilings below come from stock Y2 binaries, the MT6582 BSP source, the installed eMMC's EXT_CSD and the MT6323 regulator tables. The implementation is software-validated. No bus mode above 50 MHz has run on a Y2 under Linux yet. The candidate section records what was built. Physical results belong in a separate report.

Before this pass both hosts ran at 50 MHz SDR. The eMMC used 8-bit HS52 and the SD used 4-bit SD High Speed at 3.3 V. That limit came from our own device tree, not from the hardware.

Answers

These answers depend on the card that is inserted. A card without UHS-I, or one that refuses 1.8 V, negotiates SD High Speed at 3.3 V as before.

Evidence

Extracted disassembly is kept privately in out/storage-ceiling-source/stock/.

Implementation

Negotiation and fallback

The MMC core negotiates the highest mode both the host and the card admit. The current ladder level limits what the host offers.

The SD ladder follows the core's own preference, SDR104 > DDR50 > SDR50, so SDR50 comes after DDR50. A 1.8 V switch failure skips every remaining UHS level.

A downgrade lowers the caps first. If the current timing is still admitted, only the clock changes. Otherwise the card is re-initialised with mmc_hw_reset(). The core flushes the cache first. On eMMC its "power cycle" changes no rail (no vmmc, VIO18 always-on), so the card sees a CMD0 re-initialisation. SD is power-cycled through VMCH. If re-init fails, the next level is tried. The filesystem never stays on a mode that failed.

Safety

• Root/data eMMC is never power-cycled. VEMC_3V3 is not declared, so Linux

  cannot switch the card supply off. VIO18 is always-on.

• No IO voltage is guessed. eMMC IO stays at the fixed 1.8 V rail. SD uses

  only VMC's two table values, which are the values stock uses.

• Partitions, geometry, boot areas and protected regions are untouched. The

  request firewall admits only the CMD21 block read and the HS200/DDR switch values.

• CRC and error handling are unchanged. Retries and fallbacks are added on

  top.

• Runtime PM keeps MSDC_CFG, IOCON, PAD_TUNE and DAT_RDDLY0/1 across clock

  gating, so tuning survives. eMMC s2idle re-initialises on resume, which re-negotiates and retunes.

• SD hotplug: CMD55 timing out with no card resets the SD ladder to its

  ceiling, so a replacement card starts from the top. VMC/VMCH power-off is followed by the stock 10 ms wait.

Boot controls

y2_clock_limit_hz also accepts 13/25/50/100/200 MHz at runtime.

Diagnostics

/sys/bus/platform/devices/1123{0,4}0000.mmc/y2_storage is one line of key=value:

`host level ceiling timing width clock_hz actual_hz cap_hz signal_mv vqmmc_mv card_level card_caps hs400_card tuning tuning_runs tuning_failures tune_iocon tune_pad tune_rddly0 voltage_switches verify fallbacks resets reset_error clock_error drive_before crc_events timeout_events controller_events tuning_events voltage_events verify_events`

y2-platform status exposes it as storage.controllers[].mode, and Reborn Diagnostics shows it as plain text. No register decoding is needed.

Tests

Candidate receipt

The shipped DTB declares mmc0 mmc-ddr-1_8v, mmc-hs200-1_8v and vqmmc→VIO18 (1.8 V, always-on). It declares mmc1 sd-uhs-sdr12/25/50/104 and sd-uhs-ddr50 with vmmc→VMCH (3.3 V) and vqmmc→VMC (1.8–3.3 V). Both hosts allow 200 MHz. No VEMC_3V3 node exists.

The first build, from 0e62046, was stopped by the DT gate. That gate still pinned 50 MHz and admitted no MMC supply. 540ae02 taught the gate the reviewed set. The first container run then failed one stale test, which 2c1ab53 fixed. Logs are kept in out/storage-ceiling/superseded-*.

out/y2linux-storage-ceiling-candidate/: MT6582_preserve_data_scatter.txt selects only BOOTIMG and ANDROID/Y2ROOT. Nothing was flashed or pushed.

First boot checks for the owner

1. cat /sys/bus/platform/devices/11230000.mmc/y2_storage should show

   `level=HS200 timing=hs200 width=8 actual_hz=200000000 signal_mv=1800 tuning=pass verify=passwith all*_events=0`. Reborn shows the same under Diagnostics → Storage.

2. With a UHS-I card inserted, 11240000.mmc/y2_storage should show

   level=SDR104 (or DDR50/SDR50, as the card supports) with signal_mv=1800 and voltage_switches ≥ 1. With a non-UHS card it should show HS at 3300 mV.

3. Run the existing storage hash rounds on /data and /media/sd. Then

   remove the card and insert another; the SD level should start from the ceiling again.

4. Any fallbacks > 0 names the failing level and event in the kernel log

   (Y2 storage fallback <from> -> <to> (<event>)). If boot itself fails, boot the fallback pair, or add y2.emmc_mode=HS52 y2.sd_mode=HS (previous modes) or y2.mmc_safe=1.

First device check and candidate 2

The first candidate booted on 2026-10-01.

• eMMC: works at HS200. Status showed 8-bit, 199 999 771 Hz, 1.8 V; tuning

  passed on the first run and the readback passed. There were no CRC/timeout events and no fallbacks. A read-only 128 MiB direct read took 0.96 s (~133 MB/s).

• SD: no card initialised. The PWRAP PMIC write gate

  (kernel/platform/policy.h) refused every VMC/VMCH write with -EPERM (vmch-sd-card: failed to disable: -1, could not set regulator OCR (-1)). The 1.8 V switch failed, and so did the 3.3 V power cycle used for the fallback.

Commit 61a353b admits only VMC enable (DIGLDO_CON3 bit 12), VMCH enable (CON5 bit 14), the VMC 1.8/3.3 V selector (CON24 bit 4) and the VMCH selector pinned to 3.3 V (CON26 bit 7). VEMC_3V3 stays unwritable. A PWRAP test drives the exact regulator writes through the gate.

Package: out/y2linux-storage-ceiling-02-candidate/. It supersedes the first candidate. Not flashed by this pass.