commit f27a95845b01e86d67c8b014b4f41bd3327daa63 Author: Arthur Simchaev Date: Thu Feb 20 16:20:39 2025 +0200 scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0 Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable@vger.kernel.org Reviewed-by: Bean Huo Signed-off-by: Arthur Simchaev Link: https://lore.kernel.org/r/20250220142039.250992-1-arthur.simchaev@sandisk.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit fe06b7c07f3fbcce2a2ca6f7b0d543b5699ea00f Author: Manivannan Sadhasivam Date: Wed Feb 19 16:20:47 2025 +0530 scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init() Commit bb9850704c04 ("scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers") introduced the check for setting default PM levels only if the levels are uninitialized by the host controller drivers. But it missed the fact that the levels could be initialized to 0 (UFS_PM_LVL_0) on purpose by the controller drivers. Even though none of the drivers are doing so now, the logic should be fixed irrespectively. So set the default levels unconditionally before calling ufshcd_hba_init() API which initializes the controller drivers. It ensures that the controller drivers could override the default levels if required. Fixes: bb9850704c04 ("scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers") Reported-by: Bao D. Nguyen Signed-off-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250219105047.49932-1-manivannan.sadhasivam@linaro.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit dce5c4afd035e8090a26e5d776b1682c0e649683 Author: Ye Bin Date: Mon Feb 17 10:16:28 2025 +0800 scsi: core: Clear driver private data when retrying request After commit 1bad6c4a57ef ("scsi: zero per-cmd private driver data for each MQ I/O"), the xen-scsifront/virtio_scsi/snic drivers all removed code that explicitly zeroed driver-private command data. In combination with commit 464a00c9e0ad ("scsi: core: Kill DRIVER_SENSE"), after virtio_scsi performs a capacity expansion, the first request will return a unit attention to indicate that the capacity has changed. And then the original command is retried. As driver-private command data was not cleared, the request would return UA again and eventually time out and fail. Zero driver-private command data when a request is retried. Fixes: f7de50da1479 ("scsi: xen-scsifront: Remove code that zeroes driver-private command data") Fixes: c2bb87318baa ("scsi: virtio_scsi: Remove code that zeroes driver-private command data") Fixes: c3006a926468 ("scsi: snic: Remove code that zeroes driver-private command data") Signed-off-by: Ye Bin Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20250217021628.2929248-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen commit 4fa382be430421e1445f9c95c4dc9b7e0949ae8a Author: Bart Van Assche Date: Fri Feb 14 14:43:44 2025 -0800 scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out() ufshcd_is_ufs_dev_busy(), ufshcd_print_host_state() and ufshcd_eh_timed_out() are used in both modes (legacy mode and MCQ mode). hba->outstanding_reqs only represents the outstanding requests in legacy mode. Hence, change hba->outstanding_reqs into scsi_host_busy(hba->host) in these functions. Fixes: eacb139b77ff ("scsi: ufs: core: mcq: Enable multi-circular queue") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250214224352.3025151-1-bvanassche@acm.org Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 3bcd901e4257d88cd3fc0e5cfa7d2fb3a1a1af99 Author: Bart Van Assche Date: Wed Feb 12 13:38:02 2025 -0800 scsi: ufs: Constify the third pwr_change_notify() argument The third pwr_change_notify() argument is an input parameter. Make this explicit by declaring it 'const'. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250212213838.1044917-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 0ea163a18b17f9e0f8350bb348ae69c4a376be66 Author: Bart Van Assche Date: Mon Feb 10 12:50:09 2025 -0800 scsi: usb: Rename the RESERVE and RELEASE constants The names RESERVE and RELEASE are not only used in but also elsewhere in the kernel: $ git grep -nHE 'define[[:blank:]]*(RESERVE|RELEASE)[[:blank:]]' drivers/input/joystick/walkera0701.c:13:#define RESERVE 20000 drivers/s390/char/tape_std.h:56:#define RELEASE 0xD4 /* 3420 NOP, 3480 REJECT */ drivers/s390/char/tape_std.h:58:#define RESERVE 0xF4 /* 3420 NOP, 3480 REJECT */ Additionally, while the names of the symbolic constants RESERVE_10 and RELEASE_10 include the command length, the command length is not included in the RESERVE and RELEASE names. Address both issues by renaming the RESERVE and RELEASE constants into RESERVE_6 and RELEASE_6 respectively. Reviewed-by: Christoph Hellwig Cc: Greg Kroah-Hartman Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250210205031.2970833-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit edfaf868f3ae65099b41ec28724cb5241eeb9edf Author: Avri Altman Date: Tue Feb 11 08:58:13 2025 +0200 scsi: ufs: core: Critical health condition Martin hi, The UFS4.1 standard, released on January 8, 2025, added a new exception event: HEALTH_CRITICAL, which notifies the host of a device's critical health condition. This notification implies that the device is approaching the end of its lifetime based on the amount of performed program/erase cycles. Once an EOL (End-of-Life) exception event is received, we increment a designated member, which is exposed via a sysfs entry. This new entry, will report the number of times a critical health event has been reported by a UFS device. To handle this new sysfs entry, userspace applications can use select(), poll(), or epoll() to monitor changes in the critical_health attribute. The kernel will call sysfs_notify() to signal changes, allowing the userspace application to detect and respond to these changes efficiently. The host can gain further insight into the specific issue by reading one of the following attributes: bPreEOLInfo, bDeviceLifeTimeEstA, bDeviceLifeTimeEstB, bWriteBoosterBufferLifeTimeEst, and bRPMBLifeTimeEst. All those are available for reading via the driver's sysfs entries or through an applicable utility. It is up to userspace to read these attributes if needed. Signed-off-by: Avri Altman Link: https://lore.kernel.org/r/20250211065813.58091-1-avri.altman@wdc.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 92186c1455a2d3563dcea58a6f4729d518b5be50 Author: Eric Biggers Date: Thu Feb 6 20:17:24 2025 -0800 scsi: iscsi_tcp: Switch to using the crc32c library Now that the crc32c() library function directly takes advantage of architecture-specific optimizations, it is unnecessary to go through the crypto API. Just use crc32c(). This is much simpler, and it improves performance due to eliminating the crypto API overhead. Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20250207041724.70733-1-ebiggers@kernel.org Signed-off-by: Martin K. Petersen commit 035b9fa023fb4645e9cf104e0f1b4641b1938d08 Author: Andrew Kreimer Date: Thu Feb 6 10:47:03 2025 +0200 scsi: target: iscsi: Fix typos There are some typos in comments/messages: - Nin -> Min - occuring -> occurring Fix them via codespell. Signed-off-by: Andrew Kreimer Link: https://lore.kernel.org/r/20250206084905.11327-1-algonell@gmail.com Signed-off-by: Martin K. Petersen commit 7c1b882ccb1320cc131d4f0e2e1032c11a08293c Author: Colin Ian King Date: Wed Feb 5 09:11:18 2025 +0000 scsi: mpi3mr: Fix spelling mistake "skiping" -> "skipping" There is a spelling mistake in a dprint_bsg_err message. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250205091119.715630-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit fb27da6e06a0869d2e36255bb7e0b6102daf712f Author: Paul Menzel Date: Fri Jan 31 18:16:40 2025 +0100 scsi: mpt3sas: Reduce log level of ignore_delay_remove message to KERN_INFO On several systems with Dell HBA controller Linux prints the warning below: $ dmesg | grep -e "Linux version" -e "DMI: Dell" -e "ignore_delay_remove" [ 0.000000] Linux version 6.12.11.mx64.479 (root@lucy.molgen.mpg.de) (gcc (GCC) 12.3.0, GNU ld (GNU Binutils) 2.41) #1 SMP PREEMPT_DYNAMIC Fri Jan 24 13:30:47 CET 2025 [ 0.000000] DMI: Dell Inc. PowerEdge R7625/0M7YXP, BIOS 1.10.6 12/06/2024 [ 9.386551] scsi 0:0:4:0: set ignore_delay_remove for handle(0x0012) A user does not know, what to do about it, and everything seems to work as expected. Therefore, remove the log level from warning to info. Device information: $ dmesg | grep -e 0:4:0 -e '12)' [ 8.857606] mpt3sas_cm0: config page(0x00000000db0e4179) - dma(0xfd5f6000): size(512) [ 9.133856] scsi 0:0:0:0: SATA: handle(0x0017), sas_addr(0x3c0470e0d40cc20c), phy(12), device_name(0x5000039db8d2284b) [ 9.366341] mpt3sas_cm0: handle(0x12) sas_address(0x3c0570e0d40cc208) port_type(0x0) [ 9.378867] scsi 0:0:4:0: Enclosure DP BP_PSV 7.10 PQ: 0 ANSI: 7 [ 9.386551] scsi 0:0:4:0: set ignore_delay_remove for handle(0x0012) [ 9.387465] scsi 0:0:4:0: SES: handle(0x0012), sas_addr(0x3c0570e0d40cc208), phy(17), device_name(0x3c0570e0d40cc208) [ 9.387465] scsi 0:0:4:0: enclosure logical id (0x3c0470e0d4092108), slot(8) [ 9.387465] scsi 0:0:4:0: enclosure level(0x0001), connector name( C0 ) [ 9.390495] scsi 0:0:4:0: qdepth(1), tagged(0), scsi_level(8), cmd_que(0) [ 9.401700] end_device-0:4: add: handle(0x0012), sas_addr(0x3c0570e0d40cc208) [ 9.471916] ses 0:0:4:0: Attached Enclosure device [ 9.480088] ses 0:0:4:0: Attached scsi generic sg4 type 13 $ lspci -nn -k -s 41: 41:00.0 Serial Attached SCSI controller [0107]: Broadcom / LSI Fusion-MPT 12GSAS/PCIe Secure SAS38xx [1000:00e6] DeviceName: SL3 NonRAID Subsystem: Dell HBA355i Front [1028:200c] Kernel driver in use: mpt3sas Fixes: 30158dc9bbc9 ("mpt3sas: Never block the Enclosure device") Cc: Tomas Henzl Signed-off-by: Paul Menzel Link: https://lore.kernel.org/r/20250131171640.30721-1-pmenzel@molgen.mpg.de Signed-off-by: Martin K. Petersen commit 04ad06e41d1c74cc323b20a7bd023c47bd0e0c38 Author: Chaohai Chen Date: Fri Jan 24 16:55:42 2025 +0800 scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() Stop traversing after finding the appropriate descriptor. Signed-off-by: Chaohai Chen Link: https://lore.kernel.org/r/20250124085542.109088-1-wdhh66@163.com Signed-off-by: Martin K. Petersen commit b50532318793d28a7628c1ffc129a2226e83e495 Author: Chaohai Chen Date: Wed Jan 15 15:07:39 2025 +0800 scsi: target: spc: Fix RSOC parameter data header size The SPC document states that "The COMMAND DATA LENGTH field indicates the length in bytes of the command descriptor list". The length should be subtracted by 4 to represent the length of the description list, not 3. Signed-off-by: Chaohai Chen Link: https://lore.kernel.org/r/20250115070739.216154-1-wdhh66@163.com Reviewed-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit 640a6af5099ae8f6a858a8612bec70048a4aee69 Author: Ram Kumar Dwivedi Date: Mon Feb 3 16:57:39 2025 +0530 scsi: ufs: qcom: Enable UFS Shared ICE Feature By default, the UFS controller allocates a fixed number of RX and TX engines statically. Consequently, when UFS reads are in progress, the TX ICE engines remain idle, and vice versa. This leads to inefficient utilization of RX and TX engines. To address this limitation, enable the UFS shared ICE feature for Qualcomm UFS V5.0 and above. This feature utilizes a pool of crypto cores for both TX streams (UFS Write – Encryption) and RX streams (UFS Read – Decryption). With this approach, crypto cores are dynamically allocated to either the RX or TX stream as needed. Reviewed-by: Manivannan Sadhasivam Co-developed-by: Naveen Kumar Goud Arepalli Signed-off-by: Naveen Kumar Goud Arepalli Co-developed-by: Nitin Rawat Signed-off-by: Nitin Rawat Signed-off-by: Ram Kumar Dwivedi Link: https://lore.kernel.org/r/20250203112739.11425-1-quic_rdwivedi@quicinc.com Signed-off-by: Martin K. Petersen commit ef12deb6ce74e85f6933a01e4d5ced70f5c12d2a Author: Justin Tee Date: Thu Jan 30 16:05:24 2025 -0800 scsi: lpfc: Copyright updates for 14.4.0.8 patches Update copyrights to 2025 for files modified in the 14.4.0.8 patch set. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 8be7202ad3afa76a3bec9bfc18e9e5cb988832d5 Author: Justin Tee Date: Thu Jan 30 16:05:23 2025 -0800 scsi: lpfc: Update lpfc version to 14.4.0.8 Update lpfc version to 14.4.0.8 Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 56c3d809b7b450379162d0b8a70bbe71ab8db706 Author: Justin Tee Date: Thu Jan 30 16:05:22 2025 -0800 scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine After a port swap between separate fabrics, there may be multiple nodes in the vport's fc_nodes list with the same fabric well known address. Duplication is temporary and eventually resolves itself after dev_loss_tmo expires, but nameserver queries may still occur before dev_loss_tmo. This possibly results in returning stale fabric ndlp objects. Fix by adding an nlp_state check to ensure the ndlp search routine returns the correct newer allocated ndlp fabric object. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 23ed62897746f49f195d819ce6edeb1db27d1b72 Author: Justin Tee Date: Thu Jan 30 16:05:21 2025 -0800 scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk With repeated port swaps between separate fabrics, there can be multiple registrations for fabric well known address 0xfffffe. This can cause ndlp reference confusion due to the usage of a single ndlp ptr that stores the rport object in fc_rport struct private storage during transport registration. Subsequent registrations update the ndlp->rport field with the newer rport, so when transport layer triggers dev_loss_tmo for the earlier registered rport the ndlp->rport private storage is referencing the newer rport instead of the older rport in dev_loss_tmo callbk. Because the older ndlp->rport object is already cleaned up elsewhere in driver code during the time of fabric swap, check that the rport provided in dev_loss_tmo callbk actually matches the rport stored in the LLDD's ndlp->rport field. Otherwise, skip dev_loss_tmo work on a stale rport. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f0842902b383982d1f72c490996aa8fc29a7aa0d Author: Justin Tee Date: Thu Jan 30 16:05:20 2025 -0800 scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails Fix smatch warning regarding missed calls to free_irq(). Free the phba IRQ in the failed pci_irq_vector cases. lpfc_init.c: lpfc_sli4_enable_msi() warn: 'phba->pcidev->irq' from request_irq() not released. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 8eccc58d71eafbd2635077916b68fda15791d270 Author: Justin Tee Date: Thu Jan 30 16:05:19 2025 -0800 scsi: lpfc: Reduce log message generation during ELS ring clean up A clean up log message is output from lpfc_els_flush_cmd() for each outstanding ELS I/O and repeated for every NPIV instance. The log message should only be generated for active I/Os matching the NPIV vport. Thus, move the vport check to before logging the message. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250131000524.163662-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 35a0437d9f33071d81d51af70432ecab1e686078 Author: Ranjan Kumar Date: Wed Jan 29 15:38:50 2025 +0530 scsi: mpi3mr: Update driver version to 8.12.1.0.50 Update driver version to 8.12.1.0.50 Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250129100850.25430-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit f195fc060c738d303a21fae146dbf85e1595fb4c Author: Ranjan Kumar Date: Wed Jan 29 15:38:49 2025 +0530 scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread accesses an invalid queue ID (0xFFFF), set by the reset thread, which points to unallocated memory, causing a crash. Add flag 'io_admin_reset_sync' to synchronize access between the reset, I/O, and admin threads. Before a reset, the reset handler sets this flag to block I/O and admin processing threads. If any thread bypasses the initial check, the reset thread waits up to 10 seconds for processing to finish. If the wait exceeds 10 seconds, the controller is marked as unrecoverable. Signed-off-by: Sumit Saxena Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250129100850.25430-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 339a7b32a371a667dccfcd0e945add38f2cbe596 Author: Ranjan Kumar Date: Wed Jan 29 15:38:48 2025 +0530 scsi: mpi3mr: Support for Segmented Hardware Trace buffer Allocate segmented trace buffer if firmware advertises the capability in IOCfacts. Upon driver load, read the trace buffer size from driver page 1, calculate the required segments for trace buffer, and allocate segmented buffers. Each segment is 4096 bytes in size. While posting driver diagnostic buffer to firmware, advertise that trace buffer is segmented. Signed-off-by: Sumit Saxena Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250129100850.25430-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit f08b24d82749117ce779cc66689e8594341130d3 Author: Ranjan Kumar Date: Wed Jan 29 15:38:47 2025 +0530 scsi: mpi3mr: Avoid reply queue full condition To avoid reply queue full condition, update the driver to check IOCFacts capabilities for qfull. Update the operational reply queue's Consumer Index after processing 100 replies. If pending I/Os on a reply queue exceeds a threshold (reply_queue_depth - 200), then return I/O back to OS to retry. Also increase default admin reply queue size to 2K. Signed-off-by: Sumit Saxena Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250129100850.25430-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 772ba9b5bd2701a9967c084b66ff1daaee0367eb Author: Andrew Donnellan Date: Mon Feb 3 18:27:59 2025 +1100 scsi: cxlflash: Remove driver Remove the cxlflash driver for IBM CAPI Flash devices. The cxlflash driver has received minimal maintenance for some time, and the CAPI Flash hardware that uses it is no longer commercially available. Thanks to Uma Krishnan, Matthew Ochs and Manoj Kumar for their work on this driver over the years. Signed-off-by: Andrew Donnellan Link: https://lore.kernel.org/r/20250203072801.365551-2-ajd@linux.ibm.com Reviewed-by: Frederic Barrat Signed-off-by: Martin K. Petersen commit 08795f4c096c55def0ecb99218917851b9b993bc Author: Dr. David Alan Gilbert Date: Mon Jan 27 00:28:51 2025 +0000 scsi: mpt3sas: Remove unused config functions mpt3sas_config_get_manufacturing_pg7() and mpt3sas_config_get_sas_device_pg1() were added as part of 2012's commit f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") but haven't been used. Remove them. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250127002851.113711-1-linux@treblig.org Signed-off-by: Martin K. Petersen commit b932ff7d0459ff792c00c2350c2fe9e6545eca48 Author: Dr. David Alan Gilbert Date: Mon Jan 27 00:27:16 2025 +0000 scsi: message: fusion: Remove unused mptscsih_target_reset() mptscsih_target_reset() was added in 2023 by commit e6629081fb12 ("scsi: message: fusion: Correct definitions for mptscsih_dev_reset()") but never used. Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250127002716.113641-1-linux@treblig.org Signed-off-by: Martin K. Petersen commit a307d6ec12394c069f539d6d7de1c2e247765fb4 Author: Dr. David Alan Gilbert Date: Mon Jan 27 00:26:01 2025 +0000 scsi: mvsas: Remove unused mvs_phys_reset() mvs_phys_reset() was added in 2009's commit 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") but hasn't been used. Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250127002601.113555-1-linux@treblig.org Signed-off-by: Martin K. Petersen commit 5233e3235dec3065ccc632729675575dbe3c6b8a Author: Magnus Lindholm Date: Sat Jan 25 10:49:22 2025 +0100 scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. Signed-off-by: Magnus Lindholm Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com Signed-off-by: Martin K. Petersen commit 120430bff6126870b571c378e6828c7c0b5cba51 Author: Charles Han Date: Fri Jan 24 16:13:30 2025 +0800 scsi: isci: Fix double word in comments Remove the repeated word "for" in comments. Signed-off-by: Charles Han Link: https://lore.kernel.org/r/20250124081330.210724-1-hanchunchao@inspur.com Signed-off-by: Martin K. Petersen commit 2c445d5f832a51dfd8527fcce7323f79d37c0432 Author: Kai Mäkisara Date: Sat Feb 1 17:11:06 2025 +0200 scsi: st: Add sysfs file position_lost_in_reset If the value read from the file is 1, reads and writes from/to the device are blocked because the tape position may not match user's expectation (tape rewound after device reset). Signed-off-by: Kai Mäkisara Link: https://lore.kernel.org/r/20250201151106.25529-1-Kai.Makisara@kolumbus.fi Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen commit 341128dfe10a7c8681d86e81b5bc63902da644ef Author: Kai Mäkisara Date: Mon Jan 20 21:49:24 2025 +0200 scsi: st: Modify st.c to use the new scsi_error counters Compare the stored values of por_ctr and new_media_ctr against the values in the device struct. In case of mismatch, the Unit Attention corresponding to the counter has happened. This is a safeguard against another ULD catching the Unit Attention sense data. Macros scsi_get_ua_new_media_ctr and scsi_get_ua_por_ctr are added to read the current values of the counters. Signed-off-by: Kai Mäkisara Link: https://lore.kernel.org/r/20250120194925.44432-4-Kai.Makisara@kolumbus.fi Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen commit a5d518cd4e3e592eaa59b888a5d75ad639d554ea Author: Kai Mäkisara Date: Mon Jan 20 21:49:23 2025 +0200 scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs The purpose of the counters is to enable all ULDs attached to a device to find out that a New Media or/and Power On/Reset Unit Attentions has/have been set, even if another ULD catches the Unit Attention as response to a SCSI command. The ULDs can read the counters and see if the values have changed from the previous check. Signed-off-by: Kai Mäkisara Link: https://lore.kernel.org/r/20250120194925.44432-3-Kai.Makisara@kolumbus.fi Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen commit 7081dc75df79696d8322d01821c28e53416c932c Author: Kai Mäkisara Date: Mon Jan 20 21:49:22 2025 +0200 scsi: st: Restore some drive settings after reset Some of the allowed operations put the tape into a known position to continue operation assuming only the tape position has changed. But reset sets partition, density and block size to drive default values. These should be restored to the values before reset. Normally the current block size and density are stored by the drive. If the settings have been changed, the changed values have to be saved by the driver across reset. Signed-off-by: Kai Mäkisara Link: https://lore.kernel.org/r/20250120194925.44432-2-Kai.Makisara@kolumbus.fi Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen commit 14807b4a4e03b66c26f4c82f495fc8fbe35fb95d Author: Christophe JAILLET Date: Sun Jan 19 21:29:39 2025 +0100 scsi: Constify struct pci_error_handlers 'struct pci_error_handlers' are not modified in these drivers. Constifying these structures moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 39049 6429 112 45590 b216 drivers/scsi/aacraid/linit.o After: ===== text data bss dec hex filename 39113 6365 112 45590 b216 drivers/scsi/aacraid/linit.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/efdec8425981e10fc398fa2ac599c9c45d930561.1737318548.git.christophe.jaillet@wanadoo.fr Signed-off-by: Martin K. Petersen commit 1a78a56ea65252bb089e0daace989167227f2d31 Author: Seunghui Lee Date: Sat Jan 18 11:38:08 2025 +0900 scsi: ufs: core: Fix error return with query response There is currently no mechanism to return error from query responses. Return the error and print the corresponding error message with it. Signed-off-by: Seunghui Lee Link: https://lore.kernel.org/r/20250118023808.24726-1-sh043.lee@samsung.com Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 87c4b5e8a6b65189abd9ea5010ab308941f964a4 Author: Long Li Date: Wed Jan 22 19:07:22 2025 -0800 scsi: storvsc: Set correct data length for sending SCSI command without payload In StorVSC, payload->range.len is used to indicate if this SCSI command carries payload. This data is allocated as part of the private driver data by the upper layer and may get passed to lower driver uninitialized. For example, the SCSI error handling mid layer may send TEST_UNIT_READY or REQUEST_SENSE while reusing the buffer from a failed command. The private data section may have stale data from the previous command. If the SCSI command doesn't carry payload, the driver may use this value as is for communicating with host, resulting in possible corruption. Fix this by always initializing this value. Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host") Cc: stable@kernel.org Tested-by: Roman Kisel Reviewed-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Long Li Link: https://lore.kernel.org/r/1737601642-7759-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Martin K. Petersen commit f8fb2403ddebb5eea0033d90d9daae4c88749ada Author: André Draszik Date: Fri Jan 24 15:09:00 2025 +0000 scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation. During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation: Call trace: kfree+0x60/0x2d8 (P) kvfree+0x44/0x60 blk_crypto_profile_destroy_callback+0x28/0x70 devm_action_release+0x1c/0x30 release_nodes+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup Fixes: cb77cb5abe1f ("blk-crypto: rename blk_keyslot_manager to blk_crypto_profile") Fixes: d76d9d7d1009 ("scsi: ufs: use devm_blk_ksm_init()") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250124-ufshcd-fix-v4-1-c5d0144aae59@linaro.org Reviewed-by: Bean Huo Reviewed-by: Manivannan Sadhasivam Acked-by: Eric Biggers Signed-off-by: Martin K. Petersen commit 9ff7c383b8ac0c482a1da7989f703406d78445c6 Author: Igor Pylypiv Date: Fri Jan 31 10:44:07 2025 -0800 scsi: core: Do not retry I/Os during depopulation Fail I/Os instead of retry to prevent user space processes from being blocked on the I/O completion for several minutes. Retrying I/Os during "depopulation in progress" or "depopulation restore in progress" results in a continuous retry loop until the depopulation completes or until the I/O retry loop is aborted due to a timeout by the scsi_cmd_runtime_exceeced(). Depopulation is slow and can take 24+ hours to complete on 20+ TB HDDs. Most I/Os in the depopulation retry loop end up taking several minutes before returning the failure to user space. Cc: stable@vger.kernel.org # 4.18.x: 2bbeb8d scsi: core: Handle depopulation and restoration in progress Cc: stable@vger.kernel.org # 4.18.x Fixes: e37c7d9a0341 ("scsi: core: sanitize++ in progress") Signed-off-by: Igor Pylypiv Link: https://lore.kernel.org/r/20250131184408.859579-1-ipylypiv@google.com Signed-off-by: Martin K. Petersen commit 5363ee9d110e139584c2d92a0b640bc210588506 Author: Rik van Riel Date: Tue Jan 28 16:35:39 2025 -0500 scsi: core: Use GFP_NOIO to avoid circular locking dependency Filesystems can write to disk from page reclaim with __GFP_FS set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in page reclaim with GFP_KERNEL, where it could try to take filesystem locks again, leading to a deadlock. WARNING: possible circular locking dependency detected 6.13.0 #1 Not tainted ------------------------------------------------------ kswapd0/70 is trying to acquire lock: ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0 but task is already holding lock: ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760 The full lockdep splat can be found in Marc's report: https://lkml.org/lkml/2025/1/24/1101 Avoid the potential deadlock by doing the allocation with GFP_NOIO, which prevents both filesystem and block layer recursion. Reported-by: Marc Aurèle La France Signed-off-by: Rik van Riel Link: https://lore.kernel.org/r/20250129104525.0ae8421e@fangorn Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 839a74b5649c9f41d939a05059b5ca6b17156d03 Author: Avri Altman Date: Tue Jan 28 09:12:07 2025 +0200 scsi: ufs: Fix toggling of clk_gating.state when clock gating is not allowed This commit addresses an issue where clk_gating.state is being toggled in ufshcd_setup_clocks() even if clock gating is not allowed. The fix is to add a check for hba->clk_gating.is_initialized before toggling clk_gating.state in ufshcd_setup_clocks(). Since clk_gating.lock is now initialized unconditionally, it can no longer lead to the spinlock being used before it is properly initialized, but instead it is mostly for documentation purposes. Fixes: 1ab27c9cf8b6 ("ufs: Add support for clock gating") Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Avri Altman Link: https://lore.kernel.org/r/20250128071207.75494-3-avri.altman@wdc.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 3d4114a1d34413dfffa0094c2eb7b95e61087abd Author: Avri Altman Date: Tue Jan 28 09:12:06 2025 +0200 scsi: ufs: core: Ensure clk_gating.lock is used only after initialization Address a lockdep warning triggered by the use of the clk_gating.lock before it is properly initialized. The warning is as follows: [ 4.388838] INFO: trying to register non-static key. [ 4.395673] The code is fine but needs lockdep annotation, or maybe [ 4.402118] you didn't initialize this object before use? [ 4.407673] turning off the locking correctness validator. [ 4.413334] CPU: 5 UID: 0 PID: 58 Comm: kworker/u32:1 Not tainted 6.12-rc1 #185 [ 4.413343] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) [ 4.413362] Call trace: [ 4.413364] show_stack+0x18/0x24 (C) [ 4.413374] dump_stack_lvl+0x90/0xd0 [ 4.413384] dump_stack+0x18/0x24 [ 4.413392] register_lock_class+0x498/0x4a8 [ 4.413400] __lock_acquire+0xb4/0x1b90 [ 4.413406] lock_acquire+0x114/0x310 [ 4.413413] _raw_spin_lock_irqsave+0x60/0x88 [ 4.413423] ufshcd_setup_clocks+0x2c0/0x490 [ 4.413433] ufshcd_init+0x198/0x10ec [ 4.413437] ufshcd_pltfrm_init+0x600/0x7c0 [ 4.413444] ufs_qcom_probe+0x20/0x58 [ 4.413449] platform_probe+0x68/0xd8 [ 4.413459] really_probe+0xbc/0x268 [ 4.413466] __driver_probe_device+0x78/0x12c [ 4.413473] driver_probe_device+0x40/0x11c [ 4.413481] __device_attach_driver+0xb8/0xf8 [ 4.413489] bus_for_each_drv+0x84/0xe4 [ 4.413495] __device_attach+0xfc/0x18c [ 4.413502] device_initial_probe+0x14/0x20 [ 4.413510] bus_probe_device+0xb0/0xb4 [ 4.413517] deferred_probe_work_func+0x8c/0xc8 [ 4.413524] process_scheduled_works+0x250/0x658 [ 4.413534] worker_thread+0x15c/0x2c8 [ 4.413542] kthread+0x134/0x200 [ 4.413550] ret_from_fork+0x10/0x20 To fix this issue, ensure that the spinlock is only used after it has been properly initialized before using it in ufshcd_setup_clocks(). Do that unconditionally as initializing a spinlock is a fast operation. Fixes: 209f4e43b806 ("scsi: ufs: core: Introduce a new clock_gating lock") Reported-by: Dmitry Baryshkov Tested-by: Geert Uytterhoeven Signed-off-by: Avri Altman Link: https://lore.kernel.org/r/20250128071207.75494-2-avri.altman@wdc.com Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 8c09f612b2937da109ed0df583ace3a29fc95a93 Author: Avri Altman Date: Tue Jan 14 20:12:05 2025 +0200 scsi: ufs: core: Simplify temperature exception event handling This commit simplifies the temperature exception event handling by removing the ufshcd_temp_exception_event_handler() function and directly calling ufs_hwmon_notify_event() in ufshcd_exception_event_handler(). The ufshcd_temp_exception_event_handler() function contained a placeholder comment for platform vendors to add additional steps if required. However, since its introduction a few years ago, no vendor has added any additional steps. Therefore, the placeholder function is removed to streamline the code. Signed-off-by: Avri Altman Link: https://lore.kernel.org/r/20250114181205.153760-1-avri.altman@wdc.com Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit c9d2782988df354b5a2db00be93920b4ecdde7a2 Author: Guixin Liu Date: Tue Jan 14 10:50:41 2025 +0800 scsi: target: core: Add line break to status show To ensure the output is not tangled with the shell prompt, add a line break to clearly display the status. Signed-off-by: Guixin Liu Link: https://lore.kernel.org/r/20250114025041.97301-1-kanie@linux.alibaba.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 1b3e2d4ec0c5848776cc56d2624998aa5b2f0d27 Author: Bao D. Nguyen Date: Mon Jan 13 10:32:07 2025 -0800 scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions According to the UFS Device Specification, the dExtendedUFSFeaturesSupport defines the support for TOO_HIGH_TEMPERATURE as bit[4] and the TOO_LOW_TEMPERATURE as bit[5]. Correct the code to match with the UFS device specification definition. Cc: stable@vger.kernel.org Fixes: e88e2d32200a ("scsi: ufs: core: Probe for temperature notification support") Signed-off-by: Bao D. Nguyen Link: https://lore.kernel.org/r/69992b3e3e3434a5c7643be5a64de48be892ca46.1736793068.git.quic_nguyenb@quicinc.com Reviewed-by: Avri Altman Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit b893d7ff853e27aa6000fc4ca12e0ffda3318bfc Author: Mike Christie Date: Mon Jan 13 12:07:57 2025 -0600 scsi: core: Add passthrough tests for success and no failure definitions This patch adds scsi_check_passthrough() tests for the cases where a command completes successfully and when the command failed but the caller did not pass in a list of failures. Signed-off-by: Mike Christie Link: https://lore.kernel.org/r/20250113180757.16691-1-michael.christie@oracle.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen